Forwarding Windows Server firewall logs to other location like syslog server?

Question

Would it be possible to forward or configure the Windows server firewall logs to a SIEM or SYSLOG server?

Currently, using the official method through Group Policy only allows me to create the log on a specific server locally.

https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure-logging?tabs=gpo

Any help would be greatly appreciated.

Answer 1

You can try using the Get-Content cmdlet and the -Wait parameter.

I don't know, however, how the firewall logs are managed. Is a new file created every "X" number of characters? Or is the log file used in a circular fashion, where when the file reaches a given size, the firewall starts writing new records at the beginning of the existing file?

I think each log file is filled and then a new log file created. If that's the case you should be able to transfer each log file as a new one of created. You can combine file system event handling (deletion or creation of a file) to stop and restart your code using a new file name, while you treasfer the "old" file to a centralized collection point.

You may have better luck finding an existing answer (or better advice) on StackOverflow.com. The solution may be easier to write in C# than PowerShell.