DateTime
|
Date/Time of event origination in GMT format.
|
DateTime
|
10.10.2000 19:00:00
|
Source
|
Name of an Application or System Service originating the event.
|
Source
|
Security
|
Type
|
Warning, Information, Error, Success, Failure, etc.
|
Type
|
Success
|
User
|
Domain\Account name of user/service/computer initiating event.
|
User
|
RESEARCH\Alebovsky
|
Computer
|
Name of server workstation where event was logged.
|
Computer
|
DC1
|
EventID
|
Numerical ID of event. Unique within one Event Source.
|
EventId
|
576
|
Description
|
The entire unparsed event message.
|
Description
|
Special privileges assigned to new logon.
|
Log Name
|
The name of the event log (e.g. Application, Security, System, etc.)
|
LogName
|
Security
|
Category
|
A name for a subclass of events within the same Event Source.
|
Category
|
Logon/Logoff
|
Policy origin
|
Indicates whether Windows Firewall was getting its settings from Group Policy or the system's local policy.
|
InsertionString1
|
Local Policy
|
Profile used
|
Standard or Domain. Domain profile is applied when the computer is on its "home" network, Standard profile is applied when the computer is not connected to its "home" network, e.g. out travelling and connected to public internet via Wi-Fi.
|
InsertionString2
|
Standard
|
Name
|
Name of the exception. Normally displays the application name.
|
InsertionString3
|
Message Queuing
|
Path
|
Full system path to the application listed as an exception.
|
InsertionString4
|
C:\WINDOWS\system32\mqsvc.exe
|
State
|
State of the exception rule: Enabled or Disabled.
|
InsertionString5
|
Enabled
|
Scope
|
The IP Address and Subnet scopes to which traffic the exception rule applies.
|
InsertionString6
|
All subnets
|