Enterasys Security Information and Event Manager, Configuration Manual

Page: 233 / 426

Configuring DSMs
Microsoft IIS Server
217
Step 9
Click Save .
Step 10
The Microsoft IIS protocol configuration is complete.
Configuring
Microsoft IIS Using a
Snare Agent
If you want to use a snare agent to integrate the Microsoft IIS server with SIEM,
you must configure a Snare Agent to forward information to SIEM.
Configuring Microsoft IIS using a Snare Agent with SIEM requires the following:
1 Configuring Your Microsoft IIS Server for Snare
2 Configuring the Snare Agent
3 Configuring a Microsoft IIS Log Source in SIEM
Configuring Your Microsoft IIS Server for Snare
To configure a Snare Agent to integrate a Microsoft IIS server with SIEM:
Step 1
Log in to your Microsoft Information Services (IIS) Manager.
Step 2
In the IIS Manager menu tree, expand Local Computer .
Step 3
Select Web Sites .
Domain Type the domain required to access the Microsoft IIS server.
Folder Path Type the directory path to access the IIS log files. The default
is
/WINDOWS/system32/LogFiles/W3SVC1/
Parameters that support file paths allow you to define a drive
letter with the path information. For example, you can use
c$/LogFiles/
for an administrative share or
LogFiles/
for a public share folder path, but not
c:/LogFiles
.
If a log folder path contains an administrative share (C$),
users with NetBIOS access on the administrative share (C$)
have the proper access required to read the log files.
Local
or domain administrators have sufficient privileges to access
log files that reside on administrative shares.
File Pattern Type the regular expression (regex) required to filter the
filenames. All matching files are included in the processing.
The default is
(?:u_)?ex.*\.(?:log|LOG)
For example, to list all files starting with the word log,
followed by one or more digits and ending with tar.gz, use
the following entry: log[0-9]+\.tar\.gz. Use of this parameter
requires knowledge of regular expressions (regex). For more
information, see the following website:
http://download.oracle.com/javase/tutorial/essential/regex/
Recursive Select the check box if you want the file pattern to search
sub folders. By default, the check box is selected.
Polling Interval (s) Type the polling interval, which is the number of seconds
between queries to the log files to check for new data. The
default is 10 seconds.
Table 41-3 Microsoft IIS Protocol Parameters (continued)
Parameter Description