#network-monitoring

Windows Event ID 5156 – Microsoft-Windows-Security-Auditing: Network Connection Allowed by Windows Filtering Platform

Event ID 5156 logs when Windows Filtering Platform allows a network connection. This security audit event tracks permitted inbound and outbound connections for compliance and network monitoring.

Windows Event ID 3 – System: Network Connection Established

Event ID 3 indicates a successful network connection has been established by the Windows system, typically logged when network services start or connections are made to remote resources.