Security Compliance

Disable Windows Filtering Platform alerts using alert distribution policy

How to tune or disable Windows Filtering Platform alerts using the alert distribution policy to reduce load on the SEM manager.

First published date

10/9/2018 3:03 PM

Last published date

10/9/2018 3:03 PM

Overview

Windows Filtering Platform (WFP) is a new application in Windows 7/8 and Windows Server 2008/2012 that logs firewall and IPsec related events to the System Security Log. We recommend tuning WFP in your Active Directory group policies to decrease the load it would otherwise create on your Security Event Manager (formerly Log & Event Manager) manager.

These alerts represent "background" events which can consume additional resources on the SEM to process these events, and are not necessary for an optimized SEM deployment. Tuning out the “windows noise” in the group policies will reduce the space these events occupy in the Security Event log, will reduce network activity, and will not consume precious resources in SEM (CPU, memory, disk space).

 

Product section

Security Event Manager

Resolution

To modify your SEM Manager's Alert Distribution Policy:

  1. Open your SEM Console and log into your SEM Manager from the Manage > Appliances view.
  2. Click the gear icon next to your SEM Manager, and then select Policy.
  3. Locate the alerts you want to disable by either browsing the alert taxonomy or using the search box under Refine Results.
    Note: You can locate all of the alerts listed below by typing Windows Security in the search box.
  4. Check or uncheck the boxes in the Console, Database, Warehouse, or Rules columns as appropriate.
    Notes:
    • Uncheck the Console box to prevent your SEM Manager from showing the alert in your SEM Console.
    • Uncheck the Database box to prevent your SEM Manager from storing the alert on your SEM database.
    • Uncheck the Warehouse box to prevent your SEM Manager from sending the alert to an independent database warehouse.
    • Uncheck the Rules box to prevent your SEM Manager from processing the alert against your SEM rules.
    • Check any box to enable processing for the alert at any of the four levels listed above.
  5. If you want to save your changes and keep working, click Apply.
  6. If you want to save your changes and exit the Alert Distribution Policy window, click Save.

Table of Alerts with Windows Security Auditing Provider SIDs 

Note: The ProviderSID value in the following alerts match the format, Windows Security Auditing Event ID, where Event ID is one of the Windows Event IDs listed below.

Table of Descriptions by Event ID