Microsoft-Windows-Base-Filtering-Engine-Resource-Flows
| Event | Title | Channel | Sample | Rule |
|---|---|---|---|---|
| 2002 | New Resource Flow | Operational | N | N |
| 2003 | Resource Flow Closed | Operational | N | N |
| 2004 | New Resource Flow | Operational | N | N |
| 2005 | Resource Flow Closed | Operational | N | N |
Event ID 2002: New Resource Flow
#Fields #
| Name | Description |
|---|---|
ConnectionUsedId UInt64 | |
Protocol UInt8 | Known values
|
RemoteIPAddress Binary | |
LocalIPAddress Binary | |
RemotePort UInt16 | |
LocalPort UInt16 | |
StartTime FILETIME |
Event ID 2003: Resource Flow Closed
#Fields #
| Name | Description |
|---|---|
ConnectionUsedId UInt64 | |
Protocol UInt8 | Known values
|
RemoteIPAddress Binary | |
LocalIPAddress Binary | |
RemotePort UInt16 | |
LocalPort UInt16 | |
StartTime FILETIME | |
CloseTime FILETIME |
Event ID 2004: New Resource Flow
#Fields #
| Name | Description |
|---|---|
ConnectionUsedId UInt64 | |
Protocol UInt8 | Known values
|
RemoteIPAddress UInt32 | |
LocalIPAddress UInt32 | |
RemotePort UInt16 | |
LocalPort UInt16 | |
StartTime FILETIME |
Event ID 2005: Resource Flow Closed
#Fields #
| Name | Description |
|---|---|
ConnectionUsedId UInt64 | |
Protocol UInt8 | Known values
|
RemoteIPAddress UInt32 | |
LocalIPAddress UInt32 | |
RemotePort UInt16 | |
LocalPort UInt16 | |
StartTime FILETIME | |
CloseTime FILETIME |
Provenance
ETW provider GUID 92765247-03a9-4ae3-a575-b42264616e78
Defined in fwpkclnt.sys, the binary that emits these events.
- WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.4647, captured 2026-06-02 — Manifest XML pack, 1.9 MB
- Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.6584, captured 2026-06-02 — Manifest XML pack, 2.0 MB