V 2.0 : Windows Filtering Platform Rule Events
Vendor Documentation
Classification
| Rule Name | Rule Type | Common Event | Classification |
|---|---|---|---|
| V 2.0 : Windows Filtering Platform Rule Events | Base Rule | Configuration Modified : Security | Configuration |
| V 2.0 : EVID 4945 : WFP - Rule Listed on Firewall Start | Sub Rule | Rule Listed on Firewall Start | Information |
| V 2.0 : EVID 4946 : WFP - Rule Added | Sub Rule | Configuration Loaded : Security | Configuration |
| V 2.0 : EVID 4947 : WFP - Rule Modified | Sub Rule | Configuration Modified : Security | Configuration |
| V 2.0 : EVID 4948 : WFP - Rule Deleted | Sub Rule | Configuration Deleted : Security | Configuration |
| V 2.0 : EVID 4951 : WFP - Rule Ignored | Sub Rule | Firewall Rule Not Applied | Warning |
| V 2.0 : EVID 4952 : WFP - Rule Ignored | Sub Rule | Firewall Rule Not Applied | Warning |
| V 2.0 : EVID 4953 : WFP - Rule Ignored | Sub Rule | Firewall Rule Not Applied | Warning |
| V 2.0 : EVID 4956 : WFP - Active Profile Changed | Sub Rule | Configuration Modified : Security | Configuration |
| V 2.0 : EVID 4957 : WFP - Rule Ignored | Sub Rule | Firewall Rule Not Applied | Warning |
| V 2.0 : EVID 4958 : WFP - Rule Ignored | Sub Rule | Firewall Rule Not Applied | Warning |
Mapping with LogRhythm Schema
| Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
| Provider | N/A | N/A | Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; The EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event. |
| EventID | <vmid> <tag1> | Number | The identifier that the provider used to identify the event. |
| Version | N/A | N/A | The version number of the event's definition. |
| Level | <severity> | String/Number/Text | The severity level defined in the event. |
| Task | <vendorinfo> | Text/String | The task defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged. |
| Opcode | N/A | N/A | The opcode defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged. |
| Keywords | <result> | Text/String | A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data). |
| TimeCreated | N/A | N/A | The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute. |
| EventRecordID | N/A | N/A | The record number assigned to the event when it was logged. |
| Correlation | N/A | N/A | The activity identifiers that consumers can use to group related events together. |
| Execution | N/A | N/A | Contains information about the process and thread that logged the event. |
| Channel | N/A | N/A | The channel to which the event was logged. |
| Computer | <dname> | Text/String | The name of the computer on which the event occurred. |
| ProfileChanged | <policy> | Text/String | The name of the profile that the rule belongs to. It always has value “Public," because this event shows rules only for “Public” profile. |
| RuleId | <object> | Text/String | The unique firewall rule identifier. |
| RuleName | <objectname> | Number/Text/String | The name of the rule which was listed when the Windows Firewall started. |