Windows filtering events (Firewall)
Get all filtering events done by the Windows filtering platform. This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls. When no Firewall rules are configured, the default behavior is to block all incoming network connections.
Microsoft Sentinel (KQL)
