diff --git a/windows/security/threat-protection/auditing/event-5156.md b/windows/security/threat-protection/auditing/event-5156.md
index 613f28d976..a5aaae535b 100644
--- a/windows/security/threat-protection/auditing/event-5156.md
+++ b/windows/security/threat-protection/auditing/event-5156.md
@@ -102,7 +102,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co
 
     -   Outbound – for unbound connections.
 
--   **Source Address** \[Type = UnicodeString\]**:** local IP address on which application received the connection.
+-   **Source Address** \[Type = UnicodeString\]**:**  IP address from which the connection was initiated.
 
     -   IPv4 Address
 
@@ -114,9 +114,9 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co
 
     -   127.0.0.1 , ::1 - localhost
 
--   **Source Port** \[Type = UnicodeString\]**:** port number on which application received the connection.
+-   **Source Port** \[Type = UnicodeString\]**:** port number from which the connection was initiated.
 
--   **Destination Address** \[Type = UnicodeString\]**:** IP address ***from*** which connection was received or initiated.
+-   **Destination Address** \[Type = UnicodeString\]**:** IP address where the connection was received.
 
     -   IPv4 Address
 
@@ -128,7 +128,7 @@ This event generates when [Windows Filtering Platform](https://msdn.microsoft.co
 
     -   127.0.0.1 , ::1 - localhost
 
--   **Destination Port** \[Type = UnicodeString\]**:** port number which was used from remote machine to initiate connection.
+-   **Destination Port** \[Type = UnicodeString\]**:** port number where the connection was received.
 
 -   **Protocol** \[Type = UInt32\]: number of protocol which was used.