Disabled windows firewall

JPrezHidalgo — Fri, 26 Apr 2024 08:55:53 GMT

Hello,

Could you give me assistance to generate a query to detect when the firewall is disabled?

Best regards.

Re: Disabled windows firewall

nsinghvirk — Fri, 03 May 2024 16:28:30 GMT

Thanks for reaching out on LiveCommunity!

There may not be a direct way to query the status of windows firewall but as an alternative we can query the status of services being used by windows firewall like "mpssvc". I have created below query please modify it according to your use case.

preset = host_inventory_services
| filter (service_state = SERVICE_STOPPED and service_name contains """mpssvc""")

Also you can see these details under Incident Response -> Investigation -> Host Inventory -> Services.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Disabled windows firewall in Cortex XDR Discussions

Disabled windows firewall

Re: Disabled windows firewall