---
title: "Microsoft Windows Firewall Logs"
slug: "microsoft-windows-firewall-logs"
updated: 2026-03-13T20:10:20Z
published: 2026-03-13T20:30:00Z
canonical: "docs.hunters.ai/microsoft-windows-firewall-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Windows Firewall Logs

## Overview

**Table name:** `windows_firewall_logs`

Windows Firewall logs allow you to monitor any dropped or successful connections by the firewall. The logs are saved locally in the directory `%root%\system32\LogFiles\Firewall\`.

Integrating this source into Hunters allows ingestion and parsing of the data, as well as leveraging the data to protect your network in a more comprehensive way and add it to the detection phase in the Hunters’ pipeline.

See more details [here](https://www.howtogeek.com/220204/how-to-track-firewall-activity-with-the-windows-firewall-log/).

## Send data to Hunters
To export your Windows Firewall Logs, follow the section "How to Generate the Log File" in [this guide](https://www.howtogeek.com/220204/how-to-track-firewall-activity-with-the-windows-firewall-log/).
Once the data is collected, use an on premise shipping agent to ship the data to S3.
{{snippet.S3-ingestion}}.

## Expected format
Hunters expect the data to be in a CSV format, without header and with a space delimiter.
The fields should be:
- date
- time
- action
- protocol
- src_ip
- dst_ip
- src_port
- dst_port
- size
- tcpflags
- tcpsyn
- tcppack
- tcpwin
- icmptype
- icmpcode
- info
- path

An example of an event is as follows:
```
2022-03-01 15:29:30 ALLOW TCP 10.0.0.1 10.0.0.2 1234 80 52 S 14835656767 0 64240 - - - RECEIVE
```