V 2.0 : Windows Firewall Connection Events

V 2.0 : Windows Firewall Connection Events

Base Rule

Network Traffic

Network Traffic

V 2.0 : EVID 5152 : WFP - Packet Blocked

Sub Rule

Traffic Denied by Host Firewall

Network Deny

V 2.0 : EVID 5153 : WFP - Packet Blocked

Sub Rule

Traffic Denied by Host Firewall

Network Deny

V 2.0 : EVID 5154 : WFP - Application Allowed

Sub Rule

Application Allowed to Listen for Connections

Information

V 2.0 : EVID 5155 : WFP - Application Blocked

Sub Rule

Application Blocked from Listening for Connections

Warning

V 2.0 : EVID 5156 : WFP - Connection Permitted

Sub Rule

Traffic Allowed by Host Firewall

Network Allow

V 2.0 : EVID 5157 : WFP - Connection Blocked

Sub Rule

Traffic Denied by Host Firewall

Network Deny

V 2.0 : EVID 5158 : WFP - Permitted Bind to Local Port

Sub Rule

Permitted Bind to Local Port

Information

V 2.0 : EVID 5159 : WFP - Blocked Bind to Local Port

Sub Rule

Traffic Denied by Host Firewall

Network Deny

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

Provider

N/A

N/A

Identifies the provider that logged the event. The Name and Guid attributes are included if the provider used an instrumentation manifest to define its events. The EventSourceName attribute is included if a legacy event provider (using the Event Logging API) logged the event.

EventID

<vmid>
<tag1>

Number

The identifier that the provider used to identify the event.

Version

N/A

N/A

The version number of the event's definition.

Level

<severity>

String/Number/Text

The severity level defined in the event.

Task

<vendorinfo>

Text/String

The task defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged.

Opcode

N/A

N/A

The opcode defined in the event. Task and Opcode are typically used to identify the location in the application from where the event was logged.

Keywords

<result>

Text/String

A bitmask of the keywords defined in the event. Keywords are used to classify types of events (for example, events associated with reading data).

TimeCreated

N/A

N/A

The time stamp that identifies when the event was logged. The time stamp will include either the SystemTime attribute or the RawTime attribute.

EventRecordID

N/A

N/A

The record number assigned to the event when it was logged.

Correlation

N/A

N/A

The activity identifiers that consumers can use to group related events together.

Execution

N/A

N/A

Contains information about the process and thread that logged the event.

Channel

N/A

N/A

The channel to which the event was logged.

Computer

N/A

Text/String

The name of the computer on which the event occurred.

ProcessId

<processid>

Text/String/ Number

The hexadecimal Process ID of the process which received the connection. Process ID (PID) is a number used by the operating system to uniquely identify an active process.

Application

<process>

Text/String

The full path and the name of the executable for the process.

Direction

N/A

Number

N/A

SourceAddress

<sip>

Text/String

IP address from which the connection was initiated.
IPv4 Address
IPv6 Address
:: - all IP addresses in IPv6 format
0.0.0.0 - all IP addresses in IPv4 format
127.0.0.1 , ::1 - localhost

SourcePort

<sport>

Text/String

The port number from which the connection was initiated.

DestAddress

<dip>

Number

N/A

DestPort

<dport>

Number

N/A

Protocol

<protnum>

Number

The number of the protocol which was used.

FilterRTID

N/A

N/A

The unique filter ID which allowed the connection.

LayerName

N/A

N/A

Application Layer Enforcement layer name.

LayerRTID

N/A

N/A

Windows Filtering Platform layer identifier.