TA-winfw Technology Addon for Windows Firewall
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Details
The Splunk Technology Add-On for Windows Firewall provides extractions and CIM normalization for Windows Firewall Logs.
Technology Add-On for Windows Firewall
The Splunk Technology Add-On for Windows Firewall provides extractions and CIM normalization for Windows Firewall Logs.
Activation of Firewall Logging in Windows
To activate logging of Windows Firewall events run the "Windows Firewall with Advanced Security" App or simply run WF.msc from command line.
- select "Windows Firewall properties"
- select "Customize..." in the "Logging" section
- define logfile location, logging settings (log dropped/allowed packets) and logfile size.
It's recommended to increase the logfile size to the maximum possible (32MB).
Installation and Deployment of TA-winfw
Download this TA and place it in etc/apps on your Searchhead and Universal Forwarders.
The default file input is deactivated by default. To collect data on the Forwarder make sure to create a local/inputs.conf file like this:
[monitor://C:\Windows\system32\LogFiles\Firewall\pfirewall.log]
disabled = false
sourcetype = winfw
Verify the data input and extraction works by searching for
sourcetype=winfw tag=network tag=communicate