0013 Automatically Update Windows Firewall Rules

Block repeat SFTP attackers from Windows event log entries

This example shows how to read failed SFTP login events, extract the attacker IP addresses, and pass them to a PowerShell script that updates Windows Firewall. It is a practical defensive workflow, not a magic security product. Test it on a safe machine first, because locking out the wrong IP address is the sort of automation nobody applauds.

How the workflow works

• Windows records failed SFTP connection attempts in the event log.
• Advanced ETL Processor scans the event log and saves the extracted IP addresses into a text file.
• Advanced ETL Processor runs a PowerShell script that blocks those IP addresses in Windows Firewall.

Prepare the example files

• Download and install Advanced ETL Processor [Link]
• Download and unzip the example [Link]
• Create a new directory called Scripts.

Configure the transformation

Create a new transformation and open the .ats file from the example package.

• Double-click the Reader object and select the computer name.
• Double-click the Writer object and set the connection name to "Script".
• Save the transformation.

Configure the package

Create a new package and open the .wfp file from the example.

Double-click the transformation step and select 0013 Extract IP Addresses.

Run the package

Run the package by pressing the green arrow. Review the extracted IP list and firewall changes before using the workflow on a production server.