V 2.0 : EVID 5156 : WFP - Connection Permitted
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
V 2.0 : EVID 5156 : WFP - Connection Permitted | Base Rule | Traffic Allowed by Host Firewall | Network Allow |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
Provider | N/A | N/A | Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
EventID | <vmid> | Number | The identifier that the provider used to identify the event. |
Version | The version number of the event's definition. | ||
Level | <severity> | String/Number/Text | The severity level defined in the event. |
Task | <vendorinfo> | Text/String | The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged. |
Opcode | N/A | N/A | The opcode defined in the event. Task and opcode are typcially used to identify the location in the application from where the event was logged. |
Keywords | <result> | Text/String | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
Channel | N/A | N/A | The channel to which the event was logged. |
Computer | N/A | N/A | The name of the computer on which the event occurred. |
ProcessId | <processid> | Text/String/ Number | hexadecimal Process ID of the process which received the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process. |
Application | <process> | Text/String | full path and the name of the executable for the process. |
Direction | N/A | N/A | direction of allowed connection. Inbound – for inbound connections. Outbound – for unbound connections. |
SourceAddress | <sip> | Ip Address | IP address from which the connection was initiated. IPv4 Address IPv6 Address :: - all IP addresses in IPv6 format 0.0.0.0 - all IP addresses in IPv4 format 127.0.0.1 , ::1 - localhost |
SourcePort | <sport> | Number | port number from which the connection was initiated. |
DestAddress | <dip> | Ip Address | IP address where the connection was received. IPv4 Address IPv6 Address :: - all IP addresses in IPv6 format 0.0.0.0 - all IP addresses in IPv4 format 127.0.0.1 , ::1 - localhost |
DestPort | <dport> | Number | port number where the connection was received. |
Protocol | <protnum> | Number | number of protocol which was used. |
FilterRTID | N/A | N/A | unique filter ID which allowed the connection. |
LayerName | N/A | N/A | Application Layer Enforcement layer name. |
LayerRTID | N/A | N/A | Windows Filtering Platform layer identifier. |