# Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater'

Necessity: Maintaining adequate firewall log sizes is critical for security monitoring and incident response. The Public profile is the most exposed to untrusted networks, making detailed logging essential for detecting and analyzing potential attacks, such as port scans or intrusion attempts. If the log size is too small, critical evidence of a breach can be quickly overwritten ('log wrapping') during a high-traffic event, severely hindering forensic investigation. A larger log file ensures that a longer history of network activity is preserved for analysis. Auditing and Remediation: The audit script queries the current configured value for the 'LogFileSizeKilobytes' property of the Public firewall profile. The remediation script modifies this same property, allowing an administrator to enforce a specific log size limit to meet security policy requirements. Recommended State Rationale: The recommended states are designed to provide increasing levels of forensic capability. 'Basic' ([16384, 32767]) aligns with common industry baselines like the CIS Benchmarks, ensuring a minimum level of data retention for recent events. 'Moderate' ([32768, 65535]) doubles this capacity, offering a more robust buffer that can retain log data for longer periods or during more significant network events. 'Strict' ([65536, 'upper bound']) provides a substantial log history, which is crucial for high-security environments, regulatory compliance, and in-depth forensic analysis where long-term trend analysis or investigation of low-and-slow attacks is necessary.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[16384, 'upper bound']` |
| **Moderate** | `[32768, 'upper bound']` |
| **Strict** | `[65536, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that retrieves the current size limit in kilobytes for the Windows Defender Firewall log on the Public profile. The script must execute the command '(Get-NetFirewallProfile -Name Public).LogFileSizeKilobytes' and output only the resulting numeric value.

## Remediation Script Working

PowerShell script that accepts a single numeric value as a direct, positional command-line argument. The script must use this value to set the 'LogFileSizeKilobytes' property for the Public firewall profile using the 'Set-NetFirewallProfile' cmdlet. The script must return '$true' on successful application of the setting and '$false' on failure.

