Enterasys Security Information and Event Manager, Configuration Manual

Page: 231 / 426

Configuring DSMs
Microsoft IIS Server
215
Configuring
Microsoft IIS Using
the IIS Protocol
Before you configure SIEM with the Microsoft IIS protocol, you must configure your
Microsoft IIS Server to generate the proper log format. The Microsoft IIS Protocol
only supports the W3C Extended Log File format. The Microsoft authentication
protocol NTLMv2 Session is not supported by the Microsoft IIS protocol.
Configuring Microsoft IIS with SIEM requires the following:
1 Configuring Your IIS Server
2 Configuring the Microsoft IIS Protocol in SIEM
Configuring Your IIS Server
To configure the W3C event log format in Microsoft IIS:
Step 1
Log in to your Microsoft Information Services (IIS) Manager.
Step 2
In the IIS Manager menu tree, expand Local Computer .
Step 3
Select Web Sites .
Step 4
Right-click on Default Web Sites and select Properties .
The Default Web Site Properties window is displayed.
Step 5
Select the Web Site tab.
Step 6
Select the Enable logging check box.
Step 7
From the Active Log Format drop-down list box, select W3C Extended Log File
Format .
Step 8
From the Enable Logging pane, click Properties .
The Logging Properties window is displayed.
Step 9
Click the Advanced tab.
Step 10
From the list of properties, select check boxes for the following W3C properties:
Microsoft IIS 6.0 SMTP, NNTP,
FTP, HTTP Adaptive Log Exporter or Snare
Microsoft IIS 7.0 HTTP IIS Protocol
Microsoft IIS 7.0 SMTP, NNTP,
FTP, HTTP Adaptive Log Exporter or Snare
Table 41-1 Microsoft IIS Supported Log Types (continued)
Version
Supported Log
Type
Method of Import for SIEM
Table 41-2 Required Properties for IIS Event Logs
IIS 6.0 Required Properties IIS 7.0 Required Properties
Date (date) Date (date)
Time (time) Time (time)
Client IP Address (c-ip) Client IP Address (c-ip)