Event Log Security - Windows Event Search

ID	Event Description
4944	The following policy was active when the Windows Firewall started Audit Success
4945	A rule was listed when the Windows Firewall started Audit Success
4946	A change was made to the Windows Firewall exception list. A rule was added Audit Success
4947	A change was made to the Windows Firewall exception list. A rule was modified Audit Success
4948	A change was made to the Windows Firewall exception list. A rule was deleted Audit Success
4949	Windows Firewall settings were restored to the default values. Audit Success
4950	A Windows Firewall setting was changed Audit Success
4951	Windows Firewall ignored a rule because its major version number is not recognized Audit Failure
4952	Windows Firewall ignored parts of a rule because its minor version number is not recognized Audit Failure
4953	Windows Firewall ignored a rule because it could not be parsed Audit Failure
4954	Group Policy settings for Windows Firewall were changed, and the new settings were applied. Audit Success
4956	Windows Firewall changed the active profile Audit Success
4957	Windows Firewall did not apply the following rule Audit Failure
4958	Windows Firewall did not apply the following rule because the rule referred to items not configured on this computer Audit Failure