Enterasys Security Information and Event Manager, Configuration Manual

Page: 235 / 426

Configuring DSMs
Microsoft IIS Server
219
Step 5
In the Target Host field, type the IP address of your SIEM installation.
Step 6
In the Log Directory field type the IIS file location:
\%SystemRoot%\System32\LogFiles\
By default Snare for IIS is configured to look for logs in
C:\WINNT\System32\LogFiles\
.
Step 7
For Destination , select Syslog .
Step 8
For Delimiter , select TAB .
Step 9
Select the Display IIS Header Information check box.
Step 10
Click OK .
Configuring a Microsoft IIS Log Source in SIEM
SIEM automatically discovers and creates a log source for syslog events from the
Snare Agent for Microsoft IIS. If you want to manually configure a log source SIEM
to receive Microsoft IIS events from a Snare Agent, you must configure a Microsoft
IIS log source using syslog.
To manually configure a Microsoft IIS log source in SIEM, perform the following
steps:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
On the navigation menu, click Data Sources .
The Data Sources panel is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
Step 5
Click Add .
The Add a log source window is displayed.
Step 6
From the Log Source Type drop-down list box, select Microsoft IIS Server .
Step 7
From the Protocol Configuration drop-down list box, select Syslog .
Step 8
Configure the following values:
For more information on configuring log sources, see the Log Sources User Guide .
Step 9
The Microsoft IIS configuration using a Snare Agent is complete.
Table 41-5 Microsoft IIS Syslog Configuration
Parameter Description
Log Source Identifier Type the IP address or hostname for the log source.