Reference Guide › Audit Log Records › Authorization Stage Codes for Outbound Network Connection Events › 400— _default service in class TCP
Indicates that CA Access Control permitted or denied access to a protected host, because of the _default object permissions in the TCP record for the connecting service.
More information:
TCP Class
