System32
Sysmon
Events
Compliance
Validator
TLS/SSL
GeoIP
Tools
Windows Security Events
Audit Category
Policy Change
(4)
Operating Systems
Windows 10
(4)
Windows 2008
(4)
Windows 2008 R2
(4)
Windows 2012
(4)
Windows 2012 R2
(4)
Windows 2016
(4)
Windows 2019
(4)
Windows 2022
(4)
Windows 7
(4)
Windows 8
(4)
Windows 8.1
(4)
Windows Vista
(4)
Windows 11
(3)
Windows 2025
(3)
Tags
Audit Success
(1)
Auditing
Rarely
(3)
Conditional
(1)
Volume
Low
(3)
High
(1)
Medium
(1)
Audit Subcategory
Filtering Platform Policy Change
(3)
Other Policy Change Events
(1)
AppLocker
All AppLocker events
EventSentry
All EventSentry events
Security
All Windows Security events
Sysmon
All Sysmon events
ID
Event Description
5440
The following callout was present when the Windows Filtering Platform Base Filtering Engine started.
5441
The following filter was present when the Windows Filtering Platform Base Filtering Engine started.
5446
A Windows Filtering Platform callout has been changed.
5447
A Windows Filtering Platform filter has been changed.
Audit Success