Enterasys Security Information and Event Manager, Configuration Manual

Page: 232 / 426

Configuring DSMs
216 M
ICROSOFT
Step 11
Click OK .
Step 12
You are now ready to configure the log source in SIEM.
Configuring the Microsoft IIS Protocol in SIEM
To configure the log source in the SIEM user interface:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
On the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select Microsoft IIS Server .
Step 7
From the Protocol Configuration drop-down list box, select Microsoft IIS .
Step 8
Configure the following values:
User Name (cs-username) User Name (cs-username)
Server IP Address (s-ip) Server IP Address (s-ip)
Server Port (s-port) Server Port (s-port)
Method (cs-method) Method (cs-method)
URI Stem (cs-uri-stem) URI Stem (cs-uri-stem)
URI Query (cs-uri-query) URI Query (cs-uri-query)
Protocol Status (sc-status) Protocol Status (sc-status)
Protocol Version (cs-version) User Agent (cs(User-Agent))
User Agent (cs(User-Agent))
Table 41-2 Required Properties for IIS Event Logs
IIS 6.0 Required Properties IIS 7.0 Required Properties
Table 41-3 Microsoft IIS Protocol Parameters
Parameter Description
Log Source Identifier Type the IP address or hostname for the log source.
Server Address Type the IP address of the Microsoft IIS server.
Username Type the username required to access the Microsoft IIS
server.
Password Type the password required to access the Microsoft IIS
server.
Confirm Password Confirm the password required to access the Microsoft IIS
server.