How to search when firewall disabled on servers

[syed_star357]

Dear Team,

How to search when firewall disabled on servers. the below search able to see firewall status and server last log on. we want to know when the firewall option has been disabled.

| dbquery "" "SELECT * FROM tb_EntityInfo"|rename EI_OS_MachineName as Host|fillnull value="-"|search PFWSetting!=1|rename EI_OS_MachineName as Host EI_IPAddressList as IPAddress EI_UserDomain as Domain EI_UserAccount as LoggedInUser EI_LastLogonTime as LastLogonTime LastScheduleScanUTC as LastScheduleScan EI_DomainName as Group EI_MACAddressList as MAC|search Host!=|search EI_State= Host=* |eval AVEngine_Version=EI_ProductVersion+" "+EI_ProductBuildNumber|eval Operating_System=EI_OS_Name+" "+EI_OS_Version+" "+EI_OS_SPVersion|eval LastLogonTime=strftime(LastLogonTime,"%c") |eval LastScheduleScan=strftime(LastScheduleScan,"%c")|eval Firewall=if(PFWSetting="1","Enabled","Disabled")|eval State=if(EI_State="100","Online",if(EI_State="101","Offline","Roaming"))|fields - ID EI_*|table Host IPAddress MAC Operating_System Firewall State LastLogonTime

[inventsekar · Accepted solution]

this one finds out the Firewall status as Enabled or Disabled
| eval Firewall=if(PFWSetting="1","Enabled","Disabled")

and you are printing a table output which includes "Firewall", which was calculated above, as well.
|table Host IPAddress MAC Operating_System Firewall State LastLogonTime

so, the disabled firewall status is already printed by this query.
please update us more.

[syed_star357]

Dear Investsekar,

We want to know when the firewall status has been disabled from servers. what is the search to get firewall status disabled date and time.

Regards,
Syed

[inventsekar]

Hi Syed,
the query got two timestamps -
LastLogonTime
and
LastScheduleScan

so, disabled time is not picked up by the query, i guess.

maybe, you need to check the output of this and see if there is any field for disabled time and include that in the later part of the query.
| dbquery "" "SELECT FROM tb_EntityInfo"|rename EI_OS_MachineName as Host|fillnull value="-"|search PFWSetting!=1