Microsoft IIS Web Server
Configuration on Microsoft IIS
Follow the steps below on Microsoft IIS to configure IIS logging at the site level using the UI.
For configuring logging Per-site or Per-server at the server level, refer to the Microsoft Configure Logging in IIS docs.
Open the IIS Manager.
Under the Connections tree view on the left, select the requested website for logging.
In Features View, click Logging.
In the Log File section under Format, select W3C.
Click Select Fields and ensure all the standard fields are selected.
Supported Log Formats
The XDM normalization included in this pack is supported only for the W3C format, for logs with the following field list structures:
Access Log
date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-takenError Log
date time c-ip c-port s-ip s-port cs-version cs-method cs-uri sc-status s-siteid s-reason s-queuename date time c-ip c-port s-ip s-port cs-version cs-method cs-uri streamid sc-status s-siteid s-reason s-queuename date time c-ip c-port s-ip s-port cs-version cs-method cs-uri streamid streamid_ex sc-status s-siteid s-reason s-queuename transportConfiguration on Cortex XSIAM
XDRC (XDR Collector) Filebeat Configuration
You will need to use the information described here for Filebeat.
When configuring the Filebeat Configuration File (inside the relevant profile under the XDR Collectors Profiles) for the IIS collector instance, you can either use the sample configuration file below or select the predefined IIS template, and update it as necessary.
IIS Filebeat Configuration File Sample
filebeat.modules:
- module: iis
access:
enabled: true
var.paths: ["C:/inetpub/**logs**/LogFiles/*/*.log"]
error:
enabled: true
var.paths: ["C:/Windows/System32/LogFiles/HTTPERR/*.log"]