V 2.0 : Windows Filtering Platform Rule Events

V 2.0 : Windows Filtering Platform Rule Events

Base Rule

Configuration Modified : Security

Configuration

V 2.0 : EVID 4945 : WFP - Rule Listed on Firewall Start

Sub Rule

Rule Listed on Firewall Start

Information

V 2.0 : EVID 4946 : WFP - Rule Added

Sub Rule

Configuration Loaded : Security

Configuration

V 2.0 : EVID 4947 : WFP - Rule Modified

Sub Rule

Configuration Modified : Security

Configuration

V 2.0 : EVID 4948 : WFP - Rule Deleted

Sub Rule

Configuration Deleted : Security

Configuration

V 2.0 : EVID 4951 : WFP - Rule Ignored

Sub Rule

Firewall Rule Not Applied

Warning

V 2.0 : EVID 4952 : WFP - Rule Ignored

Sub Rule

Firewall Rule Not Applied

Warning

V 2.0 : EVID 4953 : WFP - Rule Ignored

Sub Rule

Firewall Rule Not Applied

Warning

V 2.0 : EVID 4956 : WFP - Active Profile Changed

Sub Rule

Configuration Modified : Security

Configuration

V 2.0 : EVID 4957 : WFP - Rule Ignored

Sub Rule

Firewall Rule Not Applied

Warning

V 2.0 : EVID 4958 : WFP - Rule Ignored

Sub Rule

Firewall Rule Not Applied

Warning

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events; The EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>
<tag1>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

The version number of the event's definition.

Level

<severity>

String/Number/Text

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

<dname>

Text/String

The name of the computer on which the event occurred.

ProfileChanged

<policy>

Text/String

The name of the profile that the rule belongs to. It always has value “Public," because this event shows rules only for “Public” profile.

RuleId

<object>

Text/String

The unique firewall rule identifier.

RuleName

<objectname>

Number/Text/String

The name of the rule which was listed when the Windows Firewall started.