Microsoft IIS Integration Guide

integrations endpoints microsoft

This guide provides configuration instructions for Microsoft Internet Information Services (IIS) logging in order to transmit the logs for security monitoring by other agents. Supported agents can be found at Connect Microsoft Windows Event Log.

The Secureworks® Taegis™ XDR On-Premises Data Collector accepts logs in the Snare over Syslog format.

Connectivity Requirements ⫘

Source	Destination	Port/Protocol
Windows Server	Taegis™ XDR Collector (mgmt IP)	UDP/514

Data Provided from Integration ⫘

	Auth	DHCP	DNS	File	HTTP	Management	Netflow	NIDS	Process	Thirdparty
Microsoft IIS					D

Y = Normalized | D = Out-of-the-Box Detections | V = Vendor-Specific Detections

Logging Configuration Instructions ⫘

Logging configuration depends on the version of Microsoft IIS you are running.

Configuring Microsoft IIS Logging ⫘

1. From your Windows machine, open Administrative Tools > Internet Information Services (IIS) Manager.
2. Within the IIS management console, select the IIS Web Site you are configuring.
3. Select Logging

Select Logging from IIS Server Properties

4. Select the following fields:

   • Date
   • Time
   • Client IP Address
   • User Name
   • Service Name
   • Server Name
   • Server IP Address
   • Server Port
   • Method
   • URI Stem
   • URI Query
   • Protocol Status
   • Protocol Substatus
   • Win32 Status
   • Bytes Sent
   • Bytes Received
   • Time Taken
   • Host
   • User Agent
   • Referrer

Required Fields

5. Select Add field to configure X-Forwarded-For custom field.

   • Field Name — X-Forwarded-For
   • Source Type — Request Header
   • Source — X-Forwarded-For

Custom Field

6. Select OK.
7. Apply changes by selecting Apply from Actions.

Apply Changes

Configuring Syslog Forwarding ⫘

Configuring Snare ⫘

1. Navigate to the Enterprise Agent for Windows web interface, available at http://<ip-address>:6161.
2. From the left-hand menu, select Log Configuration.

Add Snare Log Configuration

3. Select Add to add a Snare Log Configuration monitor:
   • Log Type — MS IIS Logs
   • Multi-Line Format — Single line only
   • Log File or Directory — C:\inetpub\logs\LogFiles\W3C\W3SVC<siteIDnumber>\

• Log Name Format — u_ex%_x.log
• All matching files

Snare Log Configuration

4. Select Change Configuration.
5. Add as many more monitors as necessary, based on how many site IDs you have.
6. On the left-hand menu, select Apply Configuration & Restart Service.

Apply Configuration

Configuring NXLog ⫘

1. Modify the following configuration to reflect the proper file path for your environment, if not default, and your XDR Collector FQDN or IP.
2. Under the Input stanza, change the File path if your IIS logs are not stored in the default location.
3. Under the Output stanza, modify the Host value to be the FQDN or IP of your XDR Collector. If you prefer to use UDP, change Module to om_udp and Port to 514.

## Please set ROOT to the folder NXLog is installed in.
## - if 64bit NxLog is used, comment out (#) x86 and uncomment C:\Program Files\nxlog lines
define ROOT C:\Program Files\nxlog
define ROOT_STRING C:\Program Files\nxlog
## - if 32bit NxLog is used, comment out (#) "C:\Program Files\nxlog" and uncomment x86 lines
#define ROOT C:\Program Files (x86)\nxlog
#define ROOT_STRING C:\Program Files (x86)\nxlog

Moduledir %ROOT%\modules
CacheDir %ROOT%\data
Pidfile %ROOT%\data\nxlog.pid
SpoolDir %ROOT%\data
LogFile %LOGFILE%

<Extension _syslog>
Module xm_syslog
</Extension>

<Input W3SVCIN>
Module im_file
## By using the recursive directive, we'll monitor all directories under LogFiles for file u_ex*.log

File 'C:\inetpub\logs\LogFiles\u_ex*.log'
SavePos TRUE
Recursive TRUE
ReadFromLast TRUE
PollInterval 1
Exec if $raw_event =~ /^#/ drop();            \
               else                            \
               {                                \
               $Hostname = hostname_fqdn();    \
               $SourceName = "IISWebLog";        \
               $Message = $raw_event;            \
               }
</Input>

<Output W3SVCOUT>
    Module      om_udp
    Module      om_tcp
## Guidance on TLS/SSL configuration - https://nxlog.co/documentation/nxlog-user-guide/om_ssl.html
    Module    om_ssl
    Host        %XDR%
    Port        %PORT%
    CAFile    %CERTDIR%\CA.cer
    CertFile    %CERTDIR%\winhost.cer
    CertKeyFile    %CERTDIR%\winhost.key
    AllowUntrusted    FALSE

## Create our RFC3164 compliant syslog line and transmit on local5.info
    Exec        $SyslogFacilityValue = 21;$Hostname=hostname_fqdn();$Severity = 'INFO';to_syslog_bsd();

</Output>

<Route 1>
    Path    W3SVCIN => W3SVCOUT
</Route>

4. Place the config contents in a file on the desktop called nxlog.conf.
5. Make a backup of your existing C:\Program Files (x86)\NXLog\conf\nxlog.conf file.
6. Replace the C:\Program Files (x86)\NXLog\conf\nxlog.conf file with the new one on the desktop.
7. Restart the NXLog service.