Events collected from pfirewall.log and Windows Event Log cannot tell you the current STATE. If a host had its firewall turned off before you deployed Splunk, no change event will ever be produced and the host simply looks quiet. Worse: a host with "Log dropped packets" disabled produces no traffic log at all, and is indistinguishable from a host with no network activity.

This add-on closes that gap by inventorying the configuration itself.

Amara Mohamed Traore

Add-on for windows firewall posture

Forwarder-side collection of the current Windows Defender Firewall posture: profile state, default inbound and outbound actions, logging settings and log file health, plus a daily inventory of the enabled rules with their port, address and application filters and a risk score. Answers 'which hosts are unprotected right now' and 'why is this host missing from my traffic dashboards', which an event stream alone cannot. Collection uses the NetSecurity PowerShell cmdlets, so it is independent of the Windows display language - unlike netsh based collectors, whose text output is localised. Companion add-on to Microsoft Windows Firewall Observability. Read only: it never modifies the firewall configuration, and both inputs ship disabled.

TA-windows-firewall-posture

Splunk General Terms (SGT)

Windows Firewall Posture Add-on

1.0.3

This add-on additionally collects the default actions, the logging configuration, the log file health and the rule inventory