Integrating with Microsoft Windows Firewall

Overview

Blumira integrates with Microsoft Windows operating systems to provide automated threat detection and actionable response for Windows Firewall. Blumira supports the following Microsoft Windows server operating systems:

• Windows Server 2019
• Windows Server 2016
• Windows Server 2012R2
• Windows Server 2012

Blumira provides broad coverage for Windows Server including collecting logs using NXLog, Command Line Logging, DNS Debugging, and Winlogbeat.

Before you begin

This integration requires a Blumira sensor to be installed before you can complete the steps below. Ensure that you complete the steps in Building a Blumira sensor with Ubuntu before you continue.

Using Poshim for automated Windows setup

To complete this integration, we recommend using Blumira’s Poshim (PowerShell Shim) script, which is designed to ensure that you are collecting the right data from hosts across your entire environment. Poshim handles the installation and configuration for NXLog and Sysmon to ship logs over Sysmon to a targeted IP.

Reference: See Automating Windows log collection with Poshim for instructions.

If you choose to use Poshim for this integration, nothing further is needed on this page. For manual configuration, continue reading below.

Setting up NXLog for Windows

You will need to first install and configure NXLog on the windows host using these instructions: Integrating with Microsoft Windows Server.

Setting up Windows Firewall logging

Windows Firewall logging has some significant benefits but does increase the amount of data being extracted from your host. Blumira recommends implementing this configuration in areas where you do not have good visibility within the network.

Note: Successful logging requires the on-host firewall to be enabled and functioning in the appropriate policies. In situations where your Windows Firewall has been disabled this will only set the FirewallProfile and not necessarily enable it. Please review Microsoft's documentation pertaining to your on-host firewall for more details. Blumira always recommends a least-access approach--only expected protocols should be allowed when possible--however, having it set to the default policies and enabled will allow log collection to function.

Enabling Logging using GPO

You will need to ensure that logging is enabled for the Windows FW via GPO for Dropped packets only. Adding successful packets will most likely be unnecessarily verbose unless you require visibility due to a lack of segmentation.

1. Open the appropriate group policy object
2. Navigate to Computer Configuration > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security > Windows Defender Firewall Properties.
   
   
3. For each network location type (Domain, Private, Public), complete these steps:
   1. Click the tab that corresponds to the network location type.
   2. Under Logging, click Customize.
   3. No need to change the location, the configuration assumes that you will have it in the default place.
   4. In the Log dropped packets box, select Yes,
   5. In the Log successful connections box, select Not configured.
      Note: If you require significant visibility, click Yes.
   6. Click OK.
      

Edit the NXLog Configuration File

If you did not change the default path for the Logging file, you only need to uncomment the Windows Firewall Logs section by removing the #, starting at #<Extension csv_windows_fw> until #</Route> above the Windows Firewall Logs END block.

Restart nxlog from the services console or with the following command:

net stop nxlog && net start nxlog