Firewall policy at startup. Used to audit what rules were active.
Baseline firewall policy. Deviations from expected policy may indicate tampering.
Compare with known-good baseline after incidents.
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 4944 // The following policy was active when the Windows Firewall started
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=4944
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The following policy was active when the Windows Firewall started — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`The following policy was active when the Windows Firewall started. Firewall policy at startup. Used to audit what rules were active.
Event 4944 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Windows Firewall' subcategory (Success and/or Failure).
Compare with known-good baseline after incidents.