cscli parsers install crowdsecurity/windows-firewall-logsA parser for windows firewall logs.
This only handles logs that contains both DROP and RECEIVE to avoid false positives for outgoing traffic or logging for successful connections.
You need to enable logging for dropped packets (off by default): https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/configure-the-windows-firewall-log
Format is:
#Fields: date time action protocol src-ip dst-ip src-port dst-port size tcpflags tcpsyn tcpack tcpwin icmptype icmpcode info path pid
2022-01-31 12:24:51 DROP TCP 192.168.9.163 192.168.9.212 63619 445 64 S 1031365855 0 65535 - - - RECEIVE 41onsuccess: next_stage2filter: "evt.Parsed.program == 'windows-firewall' and evt.Parsed.message contains ' DROP TCP ' and evt.Parsed.message contains ' RECEIVE'"3name: crowdsecurity/windows-firewall-logs4description: "Parse windows firewall drop logs"5grok:6 pattern: "%{TIMESTAMP_ISO8601:date} DROP TCP %{IP:src_ip} %{IP:dst_ip} %{INT:src_port} %{INT:dst_port} %{INT:size} %{WORD:flags} %{INT:tcpsyn} %{INT:tcpack} %{INT:window} - - - RECEIVE( %{INT:pid})?"7 apply_on: message8statics:9 - meta: service10 value: tcp11 - meta: log_type12 value: iptables_drop13 - meta: source_ip14 expression: "evt.Parsed.src_ip"15 - target: evt.StrTime16 expression: evt.Parsed.date1718