| Event Id | 5156 |
| Source | Microsoft-Windows-Security-Auditing |
| Description | The Windows Filtering Platform has allowed a connection. Application Information: Process ID: <Process ID> Application Name:<Process ID> Network Information: Direction:<Direction> Source Address:<Source Address> Source Port:<Source Port> Destination Address:<Destination Address> Destination Port:<Destination Port> Protocol:<Protocol> Filter Information: Filter Run-Time ID:<Filter Run-Time ID> Layer Name:<Layer Name> Layer Run-Time ID:<Layer Run-Time ID> |
| Event Information | Cause : This event is logged each time WFP allows a program to connect to another process (on the same or a remote computer) on a TCP or UDP port. Resolution : This is an information event and no user action is required. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.