Event Details

Event TypeAudit Filtering Platform Connection
Event Description5031(F) : The Windows Firewall Service blocked an application from accepting incoming connections on the network.
Event ID5031

Log Fields and Parsing

This section details the log fields available in this log message type, along with values parsed for both LogRhythm Default and LogRhythm Default v2.0 policies. A value of "N/A" (not applicable) means that there is no value parsed for a specified log field.

Log FieldLogRhythm DefaultLogRhythm Default v2.0
ProviderN/AN/A
EventID<vmid><vmid>
VersionN/AN/A
Level<severity><severity>
Task<vendorinfo><vendorinfo>
OpcodeN/AN/A
KeywordsN/A<result>, <tag1>
TimeCreatedN/AN/A
EventRecordIDN/AN/A
CorrelationN/AN/A
ExecutionN/AN/A
Processid<processid>N/A
ChannelN/AN/A
Computer<dname><dname>
SecurityN/AN/A
ProfilesN/AN/A
Application<process><process>
Application NameN/AN/A
Direction<sname>N/A
Source Address<sip>N/A
Source Port<sport>N/A
Destination Address<dip>N/A
Destination Port<dport>N/A
Protocol<protnum>N/A

Log Processing Settings

This section details log processing changes made from the LogRhythm Default policy to LogRhythm Default v2.0. In some cases, base rules are broken down into sub-rules to appropriately parse log message types by their event types.

LogRhythm Default

Regex IDRule NameRule TypeCommon EventClassification
1004667EVID 5031 & 5152 - 5159 : Windows Firewall EventsBase RuleNetwork TrafficNetwork Traffic
EVID 5031 : Firewall Service Blocked Incoming AppSub RuleTraffic Denied by Host FirewallNetwork Deny
EVID 5152 : Permitted Bind To Local PortSub RulePermitted Bind To Local PortInformation
EVID 5153 : Restricted Filtering Blocked PacketSub RuleTraffic Denied by Host FirewallNetwork Deny
EVID 5154 : App Allowed To Listen For ConnSub RuleApplication Allowed To Listen For ConnectionsInformation
EVID 5155 : App Not Allowed To Listen For ConnSub RuleTraffic Denied by Host FirewallNetwork Deny
EVID 5156 : Filtering Platform Allowed ConnectionSub RuleTraffic Allowed by Host FirewallNetwork Allow
EVID 5157 : Filtering Platform Blocked ConnectionSub RuleTraffic Denied by Host FirewallNetwork Deny
EVID 5158 : Permitted Bind To Local PortSub RulePermitted Bind To Local PortInformation
EVID 5159 : Denied Bind To Local PortSub RuleTraffic Denied by Host FirewallNetwork Deny

LogRhythm Default v2.0

Regex IDRule NameRule TypeCommon EventClassification
1011119V 2.0 : EVID 5031 : WFP - Application BlockedBase RuleTraffic Denied by Host FirewallNetwork Deny