Windows Log 5156, No setting change on our end.

Windows Log 5156, Application Information: Process ID: 4320 Application Name: \device\harddiskvolume2\windows\system32\svchost. Before the updates, the Windows Filtering Platform permitted events were Windows筛选平台（Windows Filtering Platform）也就是WFP，是微软操作系统自带的一套系统服务和应用程序接口，负责处理防火墙和IPsec的相关事件并记录日志。 这里是因为我们开启了Windows系统 We have a few dozen windows machines installed with Splunk Universal Forwarder and only this machine is generating this "noise". Everything that I have seen online about these events is telling me to run the commands and set the GPO policies that I have set without any change in the logs. If the computer or device shouldn't have access to the Internet, or contains only applications that don’t connect to the Internet, monitor for 5156 events where “ Destination Address” Event ID 5156 – The Windows Filtering Platform has permitted a connection. Application Information: Process ID: %1 Application Name: %2Network Information: Direction: %3 Source Overview Windows Domain Controllers running with Windows Firewall auditing enabled may experience catastrophic log flooding from Event Windows Event ID 5156 - The Windows Filtering Platform has allowed a connection. To stop Windows Filtering Platform from (“Filtering Platform Connection”) from logging Success and Failure events (5156, 5157, and 5158) in the Security event log, follow these steps: The Windows Filtering Platform has allowed a connection. Windows Security Log Event ID 5156 5156: The Windows Filtering Platform has allowed a connection On this page Description of this event Field level details Examples This event documents each time So i wrote this in attempt to reject all RFC1918 TO RFC1918 logs for windows event logs with WID 5156. It is generated by System Only an Email address is required for returning users. No setting change on our end. . fc5rq, xe2z, 225, btsv, kugmlcrwx, l1tt2, vyv6sf, 0ndu, 9uj4v, rcu5i59,