Windows filtering events (Firewall)

Description

Get all filtering events done by the Windows filtering platform. This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls. When no Firewall rules are configured, the default behavior is to block all incoming network connections.

Query · kql

DeviceEvents
| where ActionType in ("FirewallOutboundConnectionBlocked", "FirewallInboundConnectionBlocked", "FirewallInboundConnectionToAppBlocked")
| project DeviceId , Timestamp , InitiatingProcessFileName , InitiatingProcessParentFileName, RemoteIP, RemotePort, LocalIP, LocalPort
| summarize MachineCount=dcount(DeviceId) by RemoteIP
| top 100 by MachineCount desc
Raw source Windows filtering events (Firewall) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fb02b8f1-1eb9-43f9-b6e6-cca78a323f2b
name: Windows filtering events (Firewall)
description: |
  Get all filtering events done by the Windows filtering platform.
  This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
  When no Firewall rules are configured, the default behavior is to block all incoming network connections.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
  | where ActionType in ("FirewallOutboundConnectionBlocked", "FirewallInboundConnectionBlocked", "FirewallInboundConnectionToAppBlocked")
  | project DeviceId , Timestamp , InitiatingProcessFileName , InitiatingProcessParentFileName, RemoteIP, RemotePort, LocalIP, LocalPort
  | summarize MachineCount=dcount(DeviceId) by RemoteIP
  | top 100 by MachineCount desc

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.