System32
Sysmon
Events
Compliance
Validator
TLS/SSL
GeoIP
Tools
Windows Security Events
Audit Category
Object Access
(8)
Operating Systems
Windows 10
(8)
Windows 11
(8)
Windows 2012
(8)
Windows 2012 R2
(8)
Windows 2016
(8)
Windows 2019
(8)
Windows 2022
(8)
Windows 8
(8)
Windows 8.1
(8)
Windows 2008
(6)
Windows 2008 R2
(6)
Windows 7
(6)
Windows Vista
(6)
Tags
Audit Failure
(3)
Audit Success
(3)
Auditing
Rarely
(3)
Volume
High
(3)
Very high
(2)
Medium
(1)
Audit Subcategory
Filtering Platform Connection
(8)
AppLocker
All AppLocker events
EventSentry
All EventSentry events
Security
All Windows Security events
Sysmon
All Sysmon events
ID
Event Description
5031
Windows Firewall blocked an application from accepting incoming connections on the network.
Audit Failure
5150
The Windows Filtering Platform has blocked a packet.
5151
A more restrictive Windows Filtering Platform filter has blocked a packet.
5154
The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections.
Audit Success
5155
The Windows Filtering Platform has blocked an application or service from listening on a port for incoming connections.
Audit Failure
5156
The Windows Filtering Platform has allowed a connection.
Audit Success
5157
The Windows Filtering Platform has blocked a connection.
Audit Failure
5158
The Windows Filtering Platform has permitted a bind to a local port.
Audit Success