Microsoft-Windows-Base-Filtering-Engine-Connections
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 2000 | New Connection | Operational | N | N |
| 2001 | Connection Closed | Operational | N | N |
Event ID 2000: New Connection
#Fields #
| Name | Description |
|---|---|
ConnectionId UInt64 | |
MachineAuthenticationMethod UInt32 | |
RemoteMachineAccount UnicodeString | |
UserAuthenticationMethod UInt32 | |
RemoteUserAcount UnicodeString | |
RemoteIPAddress UnicodeString | |
LocalIPAddress UnicodeString | |
TechnologyProviderKey GUID | |
IPsecTrafficMode UInt32 | |
DHGroup UInt32 | |
StartTime SYSTEMTIME |
Event ID 2001: Connection Closed
#Fields #
| Name | Description |
|---|---|
ConnectionId UInt64 | |
MachineAuthenticationMethod UInt32 | |
RemoteMachineAccount UnicodeString | |
UserAuthenticationMethod UInt32 | |
RemoteUserAcount UnicodeString | |
RemoteIPAddress UnicodeString | |
LocalIPAddress UnicodeString | |
TechnologyProviderKey GUID | |
IPsecTrafficMode UInt32 | |
BytesTransferredInbound UInt64 | |
BytesTransferredOutbound UInt64 | |
BytesTransferredTotal UInt64 | |
StartTime SYSTEMTIME | |
CloseTime SYSTEMTIME |
Provenance
ETW provider GUID 121d3da8-baf1-4dcb-929f-2d4c9a47f7ab
Defined in bfe.dll, which carries the event manifest.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.3328, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.3915, captured 2026-06-02 — Manifest XML pack, 2.0 MB