Event Details

Event TypeAudit MPSSVC Rule-Level Policy Change
Event Description
  • 4956(S) : Windows Firewall has changed the active profile.
  • 4957(F) : Windows Firewall did not apply the following rule.
Event IDs4956, 4957

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log FieldLogRhythm DefaultLogRhythm Default v2.0
ProviderN/AN/A
EventID<vmid><vmid>
VersionN/AN/A
Level<severity><severity>
Task<vendorinfo><vendorinfo>
OpcodeN/AN/A
KeywordsN/A<result>, <tag1>
TimeCreatedN/AN/A
EventRecordIDN/AN/A
CorrelationN/AN/A
ExecutionN/AN/A
ProcessidN/AN/A
ChannelN/AN/A
Computer<dname><dname>
Profile Used / ChangeN/A<policy>
Reason For RejectionN/A<reason>
RuleIDN/A<object>
RuleNameN/A<objectname>
RuleAttrN/A<reason>
TargetUserNameN/AN/A
DomainPolicyChangedN/AN/A
SubjectUserIDN/AN/A
SubjectUserNameN/AN/A
SubjectDomainNameN/AN/A
SubjectLogonIdN/AN/A
TargetUserNameN/AN/A
TargetUserDomainN/AN/A
NewProcessnameN/AN/A
ServiceNameN/AN/A
Security IDN/AN/A
Logon IDN/AN/A
Object TypeN/AN/A
Object NameN/AN/A
File NameN/AN/A
Process IDN/AN/A
Group NameN/AN/A
Task NameN/AN/A
New Active Profile<account>N/A
Control information<object>N/A
Object Name<objectname>N/A
Root cause<tag1>N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex IDRule NameRule TypeCommon EventClassification
1004689

EVID 4956 & 4957 : Firewall Action

Base Rule

General Firewall Event

Information

EVID 4956 : Firewall Changed Active ProfileSub RuleConfiguration Modified : SecurityConfiguration
EVID 4957 : Firewall Rule Not AppliedSub RuleFirewall Rule Not AppliedWarning

LogRhythm Default v2.0

Regex IDRule NameRule TypeCommon EventClassification
1011124









V 2.0 : Windows Filtering Platform Rule EventsBase RuleConfiguration Modified : SecurityConfiguration
V 2.0 : EVID 4945 : WFP Rule Listed On Firewll StrSub RuleRule Listed On Firewall StartInformation
V 2.0 : EVID 4946 : WFP - Rule AddedSub RuleConfiguration Loaded : SecurityConfiguration
V 2.0 : EVID 4947 : WFP - Rule ModfiedSub RuleConfiguration Modified : SecurityConfiguration
V 2.0 : EVID 4948 : WFP - Rule DeletedSub RuleConfiguration Deleted : SecurityConfiguration
V 2.0 : EVID 4951 : WFP - Rule IgnoredSub RuleFirewall Rule Not AppliedWarning
V 2.0 : EVID 4952 : WFP - Rule IgnoredSub RuleFirewall Rule Not AppliedWarning
V 2.0 : EVID 4953 : WFP - Rule IgnoredSub RuleFirewall Rule Not AppliedWarning
V 2.0 : EVID 4956 : WFP - Active Profile ChangedSub RuleConfiguration Modified : SecurityConfiguration
V 2.0 : EVID 4957 : WFP - Rule IgnoredSub RuleFirewall Rule Not AppliedWarning
V 2.0 : EVID 4958 : WFP - Rule IgnoredSub RuleFirewall Rule Not AppliedWarning