Microsoft-Windows-WFP

{
  "system": {
    "channel": "Microsoft-Windows-WFP/Analytic",
    "computer": "10.2.10.21",
    "correlation": {},
    "event_id": 1001,
    "event_record_id": 0,
    "event_source_name": "",
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "guid": "",
    "keywords": 0,
    "level": 4,
    "opcode": 0,
    "provider": "Microsoft-Windows-WFP",
    "security": {
      "user_id": ""
    },
    "task": 0,
    "time_created": "2026-07-22 00:01:52.386Z",
    "version": 0
  },
  "event_data": {
    "AppId": "NULL",
    "CurrentProfile": 0,
    "DestinationvSwitchPort": 0,
    "EffectiveName": "NULL",
    "EnterpriseId": "NULL",
    "FilterId": 84357,
    "LayerId": 32,
    "LocalAddress": "020000000A020A150000000000000000",
    "LocalAddressLength": 16,
    "Loopback": false,
    "OriginalProfile": 0,
    "PacketDirection": 14593,
    "PolicyFlags": 0,
    "ReauthReason": 0,
    "RemoteAddress": "020000000A020A0B0000000000000000",
    "RemoteAddressLength": 16,
    "ScopeId": 0,
    "SourcevSwitchPort": 0,
    "Timestamp": "1601-01-01 00:00:00.000Z",
    "UserSID": "\\NULL SID",
    "vSwitchId": ""
  },
  "message": ""
}

{
  "system": {
    "provider": "Microsoft-Windows-WFP",
    "guid": "0C478C5B-0351-41B1-8C58-4A6737DA32E3",
    "event_source_name": "",
    "event_id": 1013,
    "version": 1,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372174293729280,
    "time_created": "2026-03-13T20:18:51.253631+00:00",
    "event_record_id": 1,
    "correlation": {},
    "execution": {
      "process_id": 6452,
      "thread_id": 3736
    },
    "channel": "Microsoft-Windows-IKE/Operational",
    "computer": "LAB-DC01.ludus.domain",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "MainModeLocalAddressLength": 16,
    "MainModeLocalAddress": "020000000A020A0B0000000000000000",
    "MainModePeerAddressLength": 16,
    "MainModePeerAddress": "02000000A04F680A0000000000000000",
    "KeyingModule": 1,
    "SaLuid": 6,
    "ICookie": 3453738395519108605,
    "RCookie": 0
  },
  "message": ""
}

{
  "system": {
    "provider": "Microsoft-Windows-WFP",
    "event_id": 1013,
    "level": "Information",
    "task": null,
    "opcode": "Info",
    "time_created": "2026-03-13T23:09:45.5724923+00:00",
    "computer": "JD-DC01-2022.ludus.domain",
    "channel": "Microsoft-Windows-IKE/Operational"
  },
  "event_data": {
    "KeyingModule": "0",
    "RCookie": "0",
    "MainModePeerAddressLength": "16",
    "MainModePeerAddress": "020000000A0214290000000000000000",
    "MainModeLocalAddressLength": "16",
    "SaLuid": "1",
    "ICookie": "12944197821115802604",
    "MainModeLocalAddress": "020000000A020A0B0000000000000000"
  }
}

{
  "system": {
    "provider": "Microsoft-Windows-WFP",
    "guid": "{0C478C5B-0351-41B1-8C58-4A6737DA32E3}",
    "event_source_name": "",
    "event_id": 1030,
    "version": 0,
    "level": 3,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686293305294848,
    "time_created": "2026-05-29T01:25:16.8612526+00:00",
    "event_record_id": 2,
    "correlation": {},
    "execution": {
      "process_id": 1844,
      "thread_id": 2764
    },
    "channel": "Microsoft-Windows-WFP/Operational",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": "S-1-5-19"
    }
  },
  "event_data": {
    "ProcessId": "1844",
    "TxnTimeInMSec": "1359",
    "CommitTimeInMSec": "0",
    "WatchdogTimeoutInMSec": "500"
  },
  "message": "Transaction Watchdog Timeout\r\nThe filtering engine has exceeded the configured threshold to process a transaction. This could indicate a suboptimal policy configuration that may cause temporary network outages.\r\n    Owning Process ID: 1844\r\n    Transaction Time (msec): 1359\r\n    Transaction Commit Time (msec): 0\r\n    Configured Threshold (msec): 500"
}