Windows Firewall logs

Location & availability

Configured firewall log path; commonly %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log

Logging is optional and profile-specific. Rotation, missing fields and action settings limit coverage.

Fields to examine

• Action, protocol and source/destination endpoint fields.
• Recorded time with the log’s timezone convention.
• Active profile, logging options and retained period.

What it can establish

• Support a recorded permit/drop event according to the log format.

What it cannot prove

• Read traffic contents or equate a permitted packet with a completed application transaction.
• Prove no traffic occurred when the appropriate logging was disabled.

Use it in a screenshare

1. Preserve relevant firewall logs and record their existing configuration without enabling new logging for a past incident.
2. Read the header and field order rather than assuming every line has the same schema.
3. Correlate matching endpoints and time with live process context or process-scoped telemetry. Keep dropped traffic separate from successfully established connections.

Worked example

A firewall record shows an outbound packet was allowed. It supports that firewall action, not a completed download. Correlate with the application and transfer records before making a payload claim.

Cross-check the finding

• Live network connections →Support an observed endpoint/state association with a process at collection.
• Sysmon event logs →Link configured process telemetry and subsequent events through ProcessGuid.
• SRUM →Support that an application consumed resources during a recorded interval.

Sources

• Microsoft — Windows Firewall logging ↗