How to Enable Windows Defender Firewall Logging for Optimal Security

How to Read and Analyze Firewall Logs

After enabling Windows Defender Firewall Logging, the next step is to read and analyze the log files for useful information. Here is the full guide:

1. Opening the Log File

Firewall log files are typically stored in the following locations:

C:\Windows\System32\LogFiles\Firewall\pfirewall.log

You can open these log files using several tools, such as:

• Notepad++: A lightweight text editor that supports log formatting well.
• Event Viewer: Built-in Windows tools that can be used to view system logs, including firewalls.
• Log Parser: A tool from Microsoft that allows you to analyze logs with SQL queries.

2. Identify Threats

After opening the log file, you will see some important columns that can help you analyze network activity. Some key information to note are:

• IP Address: The IP address of the source or destination involved in the connection.
• Port Number: The port used for the connection (for example, port 80 for HTTP or port 443 for HTTPS).
• Connection Status: Whether the connection was successful (ALLOW) or blocked (DROP).

Example log:

2023-10-15 12:34:56  ALLOW TCP 192.168.1.100203.0.13.45 80 443
2023-10-15 12:35:10  DROP TCP 192.168.110 198.51.10.10 2 54321

From the example above:

• The first line shows the connection allowed from IP 192.168.1.100 to IP 203.0.113.45 on port 80 (HTTP).
• The second line shows the connection is blocked from IP 192.168.1.100 to IP 198.51.100.10 on port 22 (SSH).

3. Using PowerShell for Further Analysis

PowerShell is a very useful tool for analyzing firewall logs in more depth. You can use the following commands to read and filter logs:

Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log

For more specific analysis, you can use PowerShell commands such as:

Search for blocked connections:

Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log | Select-String “DROP”

Search for activity from a specific IP:

Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log | Select-String “192.168.1.100”

Search for activity on a specific port:

Get-Content C:\Windows\System32\LogFiles\Firewall\pfirewall.log | Select-String “:43”

4. Log Analysis Tips

• Monitor Unknown IP Addresses: If you see an unknown IP address trying to access your system, block the IP immediately.
• Check for Unusual Ports: Unusual ports (for example, ports above 50000) can indicate suspicious activity.
• Use Visualization Tools: For large logs, consider using tools such as Microsoft Log Parser Studio or ELK Stack for easier data visualization.