Security monitoring - how to check if Windows Firewall is running (8.x)

Applies to 8.x

Go to Tools->Alerting & Reporting->Settings
Create New Monitoring Pack
Switch to Alerting & Reporting tab and use Add Alert button
Select Windows tab and click on Create New Received Windows Event Log Entry Event
In Windows Event Log file select Security
In Expression field select Event Identifier is equal and type 5025 as identifier.
Assign nodes to this Monitoring Pack and confirm all windows by clicking OK. You can find more descriptions of Windows security events here

NetCrunch. Answers not just pictures