Enterasys Security Information and Event Manager, Configuration Manual

Page: 234 / 426

Configuring DSMs
218 M
ICROSOFT
Step 4
Right-click on Default Web Sites and select Properties .
The Default Web Site Properties window is displayed.
Step 5
Select the Web Site tab.
Step 6
Select the Enable logging check box.
Step 7
From the Active Log Format drop-down list box, select W3C Extended Log File
Format .
Step 8
From the Enable Logging panel, click Properties .
The Logging Properties window is displayed.
Step 9
Click the Advanced tab.
Step 10
From the list of properties, select check boxes for the following W3C properties:
Step 11
Click OK .
Step 12
You are now ready to configure the Snare Agent.
Configuring the Snare Agent
To configure your Snare Agent, you must preform the following steps:
Step 1
Access the InterSect Alliance website:
http://www.intersectalliance.com/projects/SnareIIS/
Step 2
Download open source Snare Agent for IIS, version 1.2:
SnareIISSetup-1.2.exe
Step 3
Install the open source Snare Agent for IIS.
Step 4
In the Snare Agent, select Audit Configuration .
The Audit Service Configuration window is displayed.
Table 41-4 Required Properties for IIS Event Logs
IIS 6.0 Required Properties IIS 7.0 Required Properties
Date (date) Date (date)
Time (time) Time (time)
Client IP Address (c-ip) Client IP Address (c-ip)
User Name (cs-username) User Name (cs-username)
Server IP Address (s-ip) Server IP Address (s-ip)
Server Port (s-port) Server Port (s-port)
Method (cs-method) Method (cs-method)
URI Stem (cs-uri-stem) URI Stem (cs-uri-stem)
URI Query (cs-uri-query) URI Query (cs-uri-query)
Protocol Status (sc-status) Protocol Status (sc-status)
Protocol Version (cs-version) User Agent (cs(User-Agent))
User Agent (cs(User-Agent))