Skip to main content
Skip table of contents

V 2.0 : EVID 5156 : WFP - Connection Permitted

Vendor Documentation




Classification

Rule Name

Rule Type

Common Event

Classification

V 2.0 : EVID 5156 : WFP - Connection PermittedBase RuleTraffic Allowed by Host FirewallNetwork Allow

Mapping with LogRhythm Schema

Device Key in Log MessageLogRhythm SchemaData TypeSchema Description
ProviderN/AN/AIdentifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID<vmid>NumberThe identifier that the provider used to identify the event.
Version

The version number of the event's definition.
Level<severity>String/Number/TextThe severity level defined in the event.
Task<vendorinfo>Text/StringThe task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
OpcodeN/AN/AThe opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged.
Keywords<result>Text/StringA bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreatedN/AN/AThe time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordIDN/AN/AThe record number assigned to the event when it was logged.
CorrelationN/AN/AThe activity identifiers that consumers can use to group related events together.
ExecutionN/AN/AContains information about the process and thread that logged the event.
ChannelN/AN/AThe channel to which the event was logged.
ComputerN/AN/AThe name of the computer on which the event occurred.
ProcessId<processid>Text/String/ Numberhexadecimal Process ID of the process which received the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process.
Application<process>Text/Stringfull path and the name of the executable for the process.
DirectionN/AN/Adirection of allowed connection.
Inbound – for inbound connections.
Outbound – for unbound connections.
SourceAddress<sip>Ip AddressIP address from which the connection was initiated.
IPv4 Address
IPv6 Address
:: - all IP addresses in IPv6 format
0.0.0.0 - all IP addresses in IPv4 format
127.0.0.1 , ::1 - localhost
SourcePort<sport>Numberport number from which the connection was initiated.
DestAddress<dip>Ip AddressIP address where the connection was received.
IPv4 Address
IPv6 Address
:: - all IP addresses in IPv6 format
0.0.0.0 - all IP addresses in IPv4 format
127.0.0.1 , ::1 - localhost
DestPort<dport>Numberport number where the connection was received.
Protocol<protnum>Numbernumber of protocol which was used.
FilterRTIDN/AN/Aunique filter ID which allowed the connection.
LayerNameN/AN/AApplication Layer Enforcement layer name.
LayerRTIDN/AN/AWindows Filtering Platform layer identifier.
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.