WFP blocked a packet (firewall rule triggered).
High-volume blocked traffic from single source may indicate port scanning or exploit attempts.
High volume — use only for aggregate analysis. Alert on spikes in blocked packets from internal hosts (lateral movement scanning).
SubjectUserNameTargetUserNameLogonTypeIpAddressWorkstationName Starting points — adapt the log source, projected fields and thresholds for your environment.
SecurityEvent
| where EventID == 5152 // The Windows Filtering Platform has blocked a packet
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, LogonType, IpAddress, WorkstationName
| sort by TimeGenerated descindex=* sourcetype="WinEventLog:Security" EventCode=5152
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count `# The Windows Filtering Platform has blocked a packet — add EventData fields: SubjectUserName, TargetUserName, LogonType, IpAddress`The Windows Filtering Platform has blocked a packet. WFP blocked a packet (firewall rule triggered).
Event 5152 is written to the Security channel by Microsoft-Windows-Security-Auditing. Advanced Audit Policy — enable the 'Filtering Platform Packet Drop' subcategory (Success and/or Failure).
High volume — use only for aggregate analysis. Alert on spikes in blocked packets from internal hosts (lateral movement scanning).