What you can see
Firewall reporting answers a few plain questions: Is the firewall on and healthy? What is being blocked, and what is allowed? Which programs, ports and destinations are involved? Is something exposed or unusual? Is a block a security concern or just a connectivity problem? It is part of Highwind Fleet and needs no extra server.
| Page | What it is for |
|---|---|
| Overview | The firewall health score and the few things that need attention first. |
| Needs attention | Every finding, with why it matters and what to do next. |
| Devices | One row per device: firewall state, how fresh its data is, and how many concerns it has. |
| Troubleshoot | Pick a device and a program or destination to see why a connection was blocked or allowed. |
| Exposure | Risky firewall rules: inbound allows, very broad rules, rules that do not apply. |
| Baseline | How each device’s rules compare with similar devices. |
| Applications and Networks | Which programs and which networks, countries and owners the traffic goes to. |
| Changes | Firewall rules that were added, removed or changed, and what changed afterwards. |
The search box at the top finds devices, programs, rules and addresses. Save this view keeps a page and its filters for you or for your team. Saving a view changes nothing on any device.
Turn it on
Firewall reporting is off until you allow it on the devices. The portal only asks a device what its own policy allows.
- Update the devices to the current Highwind build (3.7.0 or later). Older builds do not report firewall data.
- In Group Policy or Intune, turn on Allow firewall reporting in the Highwind template. Start with a small pilot group of devices. See ADMX templates.
- Turn on Windows firewall auditing on those devices (next section). Without it, you still get the firewall state and rules, but not what was blocked or allowed.
- Wait for the next check-in. The first data appears within an hour, and the portal shows how fresh each device’s data is.
Windows audit events
What was blocked or allowed comes from the Windows Security log. Windows only writes those events when auditing is on. Highwind never changes your audit policy; it tells you if it is off and shows what to turn on.
auditpol /set /subcategory:"Filtering Platform Connection" /failure:enable /success:enable
auditpol /set /subcategory:"Filtering Platform Packet Drop" /failure:enableUse Group Policy for a fleet: Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Object Access.
Start with blocks. Logging every allowed connection can produce a very large number of events. Turn on failure auditing first, on a pilot group, and add success auditing when you know the volume is acceptable.
Microsoft’s documentation: Audit Filtering Platform Connection and Audit Filtering Platform Packet Drop. The Highwind desktop client also has a WFP Events page under Firewall that shows these events on one machine, or explains how to turn them on.
Reading the pages
- Health score. One score out of 100 with every deduction listed: firewall off, stale or missing data, inbound exposure, rule differences, and devices that are not reporting. 90 or more is Healthy, 70 or more Fair, 50 or more Needs attention, below that At risk. The page also lists what Highwind does not know.
- Findings. A finding is a reason to look, not proof of a problem. Each one says what was seen, why it matters, which devices, the evidence and a next step.
- Why was it blocked? Windows does not always say which rule made a decision. Highwind states how sure it is: an exact rule, a likely rule, default firewall behavior, or not enough evidence. A block is not assumed to come from a Windows Defender Firewall rule, because VPN and security products can also block traffic.
- Evidence report. Evidence report on the Firewall pages downloads a short report (health, exposure, risky rules, baseline differences, changes, applications that need attention and the limits of the data) to attach to a ticket or review.
- Networks. Define your own internal networks (corporate, datacenter, VPN, partner) so traffic is labeled the way you talk about it. Country and network owner come from databases that ship with the service; nothing is looked up online. This is approximate location from IP registration data, not the location of a person.
Baselines and device groups
Highwind compares each device’s firewall rules with similar devices, so a rule that is normal on servers is not flagged on a server because workstations lack it. Devices are grouped by their tags.
- Highwind adds a Workstation or Server tag to each device automatically, and DomainController for domain controllers. Your own tags stay and are listed after them.
- These automatic tags need the 3.7.0 agent. Until a device is updated, it sits in a group with other untagged devices and the comparison is less precise.
- Use your own tags (for example DEV or Finance) to compare groups you define. You can also set up posture baselines by tag; a tagged baseline is applied on top of the Default one and its values win for the settings it sets.
- Comparisons need at least 10 devices reporting in a group to be meaningful.
What it cannot tell you
- It reports what Windows records. It does not test connections from the device and does not look up DNS names itself.
- Rule attribution is only as exact as Windows allows. It is often “likely”, not “exact”.
- The source network is inferred from addresses seen on the device.
- Traffic is counted by the hour, so two changes within the same hour cannot be told apart.
- There are no byte counts, and the contents of traffic are never read.
- This is new in 3.7.0. Pilot it on a small group before rolling it out widely.
What is collected
Per device:
- the state of the Domain, Private and Public profiles
- the firewall rules in effect
- hourly totals of allowed and blocked connections by program, port, direction and remote address
- a short list of recent example events
It is stored in your own database. Example events are kept for 14 days, hourly totals for 180 days and rule changes for a year by default; your administrator can change this. Nothing is sent to LaPlante Labs.