Elastic Windows Event Explorer


Publisher - Microsoft-Windows-WinNat

Event ID 1022

Message:

Deleted NAT instance %{InstanceName}

Event Data:

# Name In Type
Out Type
1 InstanceName win:UnicodeString xs:string
2 InternalRoutingDomainId win:GUID xs:GUID
3 ExternalIPInterfaceAddressPrefixLength win:UInt32 xs:unsignedInt
4 ExternalIPInterfaceAddressPrefix win:UInt32 win:IPv4
5 CompartmentId win:UInt32 xs:unsignedInt
6 ExternalInterfaceIndex win:UInt32 xs:unsignedInt
7 UdpIdleSessionTimeout win:UInt32 xs:unsignedInt
8 TcpTransientConnectionTimeout win:UInt32 xs:unsignedInt
9 TcpEstablishedConnectionTimeout win:UInt32 xs:unsignedInt
10 IcmpQueryTimeout win:UInt32 xs:unsignedInt
11 TcpFilteringBehavior win:UInt32 xs:unsignedInt
12 UdpFilteringBehavior win:UInt32 xs:unsignedInt
13 UdpInboundRefresh win:Boolean xs:boolean

Observed Windows Versions:

Version: 0

Fingerprint: YCKVBKQ6DCAM4