V 2.0 : EVID 5157 : WFP - Connection Blocked

Vendor Documentation

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5152

Classification

Rule Name	Rule Type	Common Event	Classification
V 2.0 : EVID 5157 : WFP - Connection Blocked	Base Rule	Traffic Denied by Host Firewall	Network Deny

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type	Schema Description
Provider	N/A	N/A	Identifies the provider that logged the event. The Name and GUID attributes are included if the provider used an instrumentation manifest to define its events; otherwise, the EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.
EventID	<vmid>	Number	The identifier that the provider used to identify the event.
Version	N/A	N/A	The version number of the event's definition.
Level	<severity>	String/Number/Text	The severity level defined in the event.
Task	<vendorinfo>	Text/String	The task defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Opcode	N/A	N/A	The opcode defined in the event. Task and opcode are typically used to identify the location in the application from where the event was logged.
Keywords	<result>	Text/String	A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).
TimeCreated	N/A	N/A	The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.
EventRecordID	N/A	N/A	The record number assigned to the event when it was logged.
Correlation	N/A	N/A	The activity identifiers that consumers can use to group related events together.
Execution	N/A	N/A	Contains information about the process and thread that logged the event.
Channel	N/A	N/A	The channel to which the event was logged.
Computer	N/A	N/A	The name of the computer on which the event occurred.
ProcessId	<processid>	Text/String/ Number	Hexadecimal Process ID of the process that attempted to create the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process.
Application	<process>	Text/String	The full path and the name of the executable for the process.
Direction	N/A	N/A	The direction of blocked connection. Inbound – for inbound connections. Outbound – for unbound connections.
SourceAddress	<dip>	Ip Address	Local IP address on which application received the connection. IPv4 Address IPv6 Address :: - all IP addresses in IPv6 format 0.0.0.0 - all IP addresses in IPv4 format 127.0.0.1 , ::1 - localhost
SourcePort	<dport>	Number	The port number on which application received the connection.
DestAddress	<sip>	Ip Address	IP address from which connection was received or initiated. IPv4 Address IPv6 Address :: - all IP addresses in IPv6 format 0.0.0.0 - all IP addresses in IPv4 format 127.0.0.1 , ::1 - localhost
DestPort	<sport>	Number	The port number which was used from remote machine to initiate connection.
Protocol	<protnum>	Number	The number of protocol which was used.
FilterRTID	N/A	N/A	The unique filter ID which allowed the connection.
LayerName	N/A	N/A	Application Layer Enforcement layer name.
LayerRTID	N/A	N/A	Windows Filtering Platform layer identifier.