Disabled windows firewall

[J.PrezHidalgo]

Hello,

Could you give me assistance to generate a query to detect when the firewall is disabled?

Best regards.

[nsinghvirk · Accepted solution]

Hello @J.PrezHidalgo 

Thanks for reaching out on LiveCommunity!

There may not be a direct way to query the status of windows firewall but as an alternative we can query the status of services being used by windows firewall like "mpssvc". I have created below query please modify it according to your use case.

preset = host_inventory_services
| filter (service_state = SERVICE_STOPPED and service_name contains """mpssvc""")

Also you can see these details under Incident Response -> Investigation -> Host Inventory -> Services.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.