# Ensure 'Windows Firewall: Public: Logging: Size limit (KB)' is set to '16,384 KB or greater'

Necessity: Maintaining an adequate firewall log size is critical for security auditing and forensic analysis. The Public profile is applied on untrusted networks where the risk of malicious activity is highest. If the log size is too small, crucial information about connection attempts, dropped packets, and potential attacks can be quickly overwritten and lost, severely hindering an investigation into a security incident. A larger log file ensures a longer history of network events is available for review.

Auditing and Remediation: The audit script queries the current log file size limit (in KB) for the Public firewall profile using the Get-NetFirewallProfile PowerShell cmdlet. The remediation script uses the corresponding Set-NetFirewallProfile cmdlet to modify this value, accepting the desired size as a parameter to enforce compliance.

Recommended State Rationale:
- Basic: A minimum size of 16,384 KB (16 MB) aligns with established security benchmarks (e.g., CIS) and provides a sufficient baseline for capturing significant events on low-traffic systems.
- Moderate: Increasing the allowed range up to 32,768 KB (32 MB) offers a greater buffer for log retention, suitable for systems with higher traffic or in environments where logs are not collected as frequently. This extends the window for detecting and analyzing suspicious activity.
- Strict: For critical systems or high-risk environments, the log size should be at least 16,384 KB and ideally as large as disk space and log management policies permit. An 'upper bound' recommendation ensures that the maximum amount of historical data is preserved, which is invaluable for comprehensive forensic investigations following a sophisticated attack.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[16384, 'upper bound']` |
| **Moderate** | `[32768, 'upper bound']` |
| **Strict** | `[65536, 'upper bound']` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script that retrieves the current value for the 'Windows Defender Firewall with Advanced Security' Public profile log size limit. The script must use the 'Get-NetFirewallProfile' cmdlet to query the 'LogFileSizeKilobytes' property for the profile named 'Public'. The output must be only the numerical value, with no additional text or formatting.

## Remediation Script Working

PowerShell script that sets the 'Windows Defender Firewall with Advanced Security' Public profile log size limit. The script must accept the desired size in kilobytes as a single, positional command-line argument. It should use the 'Set-NetFirewallProfile' cmdlet to apply the setting to the 'LogFileSizeKilobytes' property for the 'Public' profile. The script must return '$true' on success and '$false' on failure.

