Elastic Windows Event Explorer


Publisher - Microsoft-Windows-WinNat

Event ID 1046

Message:

Removed internal address %{IPAddress}: IfIndex %{IfIndex} from NAT instance %{InstanceName}

Event Data:

# Name In Type
Out Type
1 InstanceName win:UnicodeString xs:string
2 AddressLength win:UInt32 xs:unsignedInt
3 IPAddress win:Binary win:SocketAddress
4 IfIndex win:UInt32 xs:unsignedInt

Observed Windows Versions:

Version: 0

Fingerprint: 4XHTYI723N7BG