#event-forwarding

Windows Firewall logging and monitoring that works

Turn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.