Windows Security Log Event ID 5154

5154: The Windows Filtering Platform has permitted an application or service to listen on a port for incoming connections

On this page

• Description of this event
• Field level details
• Examples
• Discuss this event
• Mini-seminars on this event

This event documents each time WFP allows a program to begin listening on a TCP or UDP port for incoming connections and documents the program, port and filter that allowed it.

The above example is of WFP allowing the DNS Server service to listen on port 53 for DNS queries.

Application Information:

• Process ID:  process ID specified when the executable started as logged in 4688
• Application Name: the program executable on this computer's side of the packet transmission

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 5154

Application Information:

•  Process ID:  %1
•  Application Name: %2

Network Information:

•  Source Address:  %3
•  Source Port:  %4
•  Protocol:  %5

Filter Information:

•  Filter Run-Time ID: %6
•  Layer Name:  %7
•  Layer Run-Time ID: %8

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

Mini-Seminars Covering Event ID 5154 How to Monitor Network Activity with the Windows Security & Firewall Logs to Detect Inbound and Outbound Attacks 5 Indicators of Evil on Windows Hosts using Endpoint Threat Detection and Response

Discussions on Event ID 5154 Ask a question about this event

 

Upcoming Webinars Correlating Vulnerability Scans with Network Path Analysis to Find and Remediate the Biggest Risks to Your Network and Avoid Wasting Time on the Little Ones Getting all Your Security Information Into One Place and Searching It Like Google Regulating Privileged Access: When to Require Human Approval Workflows WSUS vs. SCCM: Which is the best way to go for security patching? XPath Deep Dive: Building Advanced Filters for Windows Event Collection Top 5 Ways for Analyzing Entitlements and Identifying High-Risk

Additional Resources Security Log Quick Reference Chart

•	All Event IDs
•	Audit Policy