Security monitoring - how to check if Windows Firewall is running

1. Go to Monitoring->Monitoring Packs & Policies.
2. Create New Monitoring Pack.
3. Switch to Alerting & Reporting tab and use Add Alert button.
4. Select Windows tab and double-click on New Event for Received Windows Event Log Entry.
5. In Alerting Rule window in Windows Event Log file field select Security.
6. In Expression field select Event Identifier is equal and type 5025 as identifier. (5025 ID value corresponds to: The Windows Firewall service was stopped message).
7. Assign nodes to this Monitoring Pack and save Monitoring Pack Settings.

You can find more descriptions of Windows security events here.