# Ensure 'Windows Firewall: Private: Logging: Size limit (KB)' is set to '16,384 KB or greater'

Necessity: Enabling and adequately sizing firewall logs is critical for security monitoring and incident response. These logs record allowed and denied network traffic, providing a detailed audit trail that can be used to detect intrusion attempts, identify malware communication, and perform forensic analysis after a security breach. If the log size is too small, critical event data can be quickly overwritten and lost, severely hampering an investigation. This setting applies to the 'Private' profile, which is used on trusted networks like a home or corporate LAN, where internal threats or compromised devices can still pose a significant risk. Auditing and Remediation: The audit script queries the Windows networking stack using the Get-NetFirewallProfile cmdlet to find the value of the 'LogFileSizeKilobytes' property for the Private profile. The remediation script uses the corresponding Set-NetFirewallProfile cmdlet to modify this same property, allowing an administrator to enforce the desired log file size limit. Recommended State Rationale: Basic ([16384, 32767]): A minimum size of 16,384 KB (16 MB) aligns with established security benchmarks like CIS. This provides a baseline level of logging sufficient for detecting and analyzing recent security events in low-risk environments. Moderate ([32768, 65535]): Increasing the limit to at least 32,768 KB (32 MB) offers a more robust data retention period. This is suitable for standard business environments, ensuring that log data is available for several days or weeks, which is often necessary as security incidents may not be discovered immediately. Strict ([65536, 'upper bound']): A limit of 65,536 KB (64 MB) or greater is recommended for high-security systems, servers, or networks subject to compliance regulations. This large capacity ensures an extensive historical record is maintained, which is invaluable for deep forensic investigations and correlating events over a long period.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[16384, 'upper bound']` |
| **Moderate** | `[32768, 'upper bound']` |
| **Strict** | `[65536, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that retrieves the current 'Windows Firewall: Private: Logging: Size limit (KB)'. The script must use the 'Get-NetFirewallProfile' cmdlet for the 'Private' profile and select the 'LogFileSizeKilobytes' property. The output must be the numerical value only, with no additional text or formatting.

## Remediation Script Working

PowerShell script that sets the 'Windows Firewall: Private: Logging: Size limit (KB)'. The script must accept a single, positional command-line argument representing the desired size in kilobytes. It should use the 'Set-NetFirewallProfile' cmdlet to apply the setting to the 'Private' profile and must return '$true' upon successful application or '$false' if it fails.

