Windows Defender Firewall logs to %WINDIR%\System32\LogFiles\Firewall\pfirewall.log on Windows.
Paths are printed exactly as Windows Defender Firewall writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.
Dropped packets and connections%WINDIR%\System32\LogFiles\Firewall\pfirewall.log- Off by default; enable per profile with Group Policy, Intune or netsh.