Starting with Windows Vista and Windows 2008, if you want to see who and when changes Windows Firewall with Advanced Security rules and other settings you must enable either the “Policy Changes” auditing category or rather the “Filtering Platform Policy Change” and “Other Policy Change Events” auditing subcategories. Afte you have enabled this auditing, system will log success and failure audits into the Security event log whenever any firewall setting changes.

you can enable the auditing with Group Policy, Local Security Policy or from command line:

auditpol /set /subcategory:”Filtering Platform Policy Change” /success:enable /failure:enable
auditpol /set /subcategory:”Other Policy Change Events” /success:enable /failure:enable

In the process of filtering Internet traffic, all firewalls have some type of logging feature that documents how the firewall handled various types of traffic. These logs can provide valuable information like source and destination IP addresses, port numbers, and protocols. You can also use the Windows Firewall log file to monitor TCP and UDP connections and packets that are blocked by the firewall.

Source: How to Track Firewall Activity with the Windows Firewall Log