Event ID 5156: The Windows Filtering Platform has permitted a connection
Written for each network connection the Windows firewall allows, with process, addresses and ports.
- Log
- Security
- Category
- Network
Why it matters
- Ties network connections to the process that made them, when no EDR or Sysmon is available. Extremely noisy.
What to check
Check Application Name, Direction, Source and Destination Address and Port.
How to turn it on
Advanced Audit Policy: Object Access > Audit Filtering Platform Connection.