Technology Add-On for Windows Firewall

The Splunk Technology Add-On for Windows Firewall provides extractions and CIM normalization for Windows Firewall Logs.

To activate logging of Windows Firewall events run the "Windows Firewall with Advanced Security" App or simply run WF.msc from command line.

select "Windows Firewall properties"
select "Customize..." in the "Logging" section
define logfile location, logging settings (log dropped/allowed packets) and logfile size.
It's recommended to increase the logfile size to the maximum possible (32MB).

Download this TA and place it in etc/apps on your Searchhead and Universal Forwarders.

The default file input is deactivated by default. To collect data on the Forwarder make sure to create a local/inputs.conf file like this:

[monitor://C:\Windows\system32\LogFiles\Firewall\pfirewall.log]
disabled = false
sourcetype = winfw

Verify the data input and extraction works by searching for

sourcetype=winfw tag=network tag=communicate