Enterasys Security Information and Event Manager, Configuration Manual

Page: 236 / 426

Configuring DSMs
220 M
ICROSOFT
Configuring
Microsoft IIS Using
the Adaptive Log
Exporter
The Adaptive Log Exporter is a stand-alone application that allows you to integrate
device logs or application event data with SIEM. The Adaptive Log Export supports
NCSA, IIS, and W3C active log formats.
To integrate the Adaptive Log Exporter with Microsoft IIS, perform the following
steps:
Step 1
Log in to your Microsoft Information Services (IIS) Manager.
Step 2
In the IIS Manager menu tree, expand Local Computer .
Step 3
Select Web Sites .
Step 4
Right-click on Default Web Site and select Properties .
The Web Sites Properties window is displayed.
Step 5
From the Active Log Format drop-down list box, select one of the following:
•
Select NCSA . Go to Step 9 .
•
Select IIS . Go to Step 9 .
• Select W3C . Go to Step 6 .
Step 6
Click Properties .
The Properties window is displayed.
Step 7
Click the Advanced tab.
Step 8
From the list of properties, select all event properties that you want to apply to the
Microsoft IIS event log. The selected properties must include the following:
a
Select the Method (cs-method) check box.
b
Select the Protocol Version (cs-version) check box.
Step 9
Click OK .
Step 10
You are now ready to configure the Adaptive Log Exporter.
For more information on installing and configuring Microsoft IIS for the Adaptive
Log Exporter, see the
Adaptive Log Exporter User Guide .
Microsoft ISA
A SIEM Microsoft Internet and Acceleration (ISA) DSM accepts events using
syslog. You can integrate Microsoft ISA Server with SIEM using the Adaptive Log
Exporter. For more information on the Adaptive Log Exporter, see the
Adaptive
Log Exporter Users Guide .
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from a Microsoft ISA Server:

From the Log Source Type drop-down list box, select the Microsoft ISA
option.
For more information on configuring devices, see the Log Sources User Guide .