If the directory contains any files other than IIS logs, optionally specify *.log in the File Pattern field.In the UNC path field, enter the network path you noted when configuring Microsoft IIS to send data to InsightIDR.Select Watch Directory as your collection method.Configure your default domain and any Advanced Event Source Settings.Optionally, select the option to send unparsed data.This name will be used to name the log that contains the event data in Log Search. Select the event source type: Microsoft IIS.From the Security Data section, click Web Server Access Logs.From the left menu, go to Data Collection and click Setup Event Source > Add Event Source.

To configure the new event source in InsightIDR: You will need a credential that has both Read Share permissions and Read NTFS permissions to access the IIS logs.

Configure InsightIDR to receive data from the event sourceĪfter you complete the prerequisite steps and configure Microsoft IIS server logging, you must add the event source in InsightIDR. This option displays as an optional field at the end of the list of fields on the W3C Logging Fields screen. If you use a load balancer, you must configure an X-Forwarded-For header by following the instructions at: Fields must be specified in this exact order to be parsed (note that this is the default Microsoft IIS 10 format): You must also select sc-bytes (which represents the number of bytes sent by the server) from the list of unchecked fields.

Specify the fields in the W3C Logging Fields screen.

On the Logging page, click Select Fields.

Ensure that you select the W3C log file format.

To configure logging in Microsoft IIS, you must: Configure logging in Microsoft IISĬomplete the instructions in the Configuring Per-site Logging at the Server Level topic of the Microsoft IIS documentation at. For more information, see the Troubleshooting section. If you notice that the source IP address for all users is the IP address associated with your load balancer instead of the true IP address, you must configure an X-Forwarded-For header for the Microsoft IIS logs. Load balancers can affect the source IP address logged by Microsoft IIS

Note the Network Path to the share as you will need it when you configure InsightIDR to receive data from the event source.

Grant your service account Read permissions to the share.

Create a hidden network share for the destination folder.

If you need to store IIS logs in an additional folder, you must configure a new event source for that destination.

Note: InsightIDR cannot retrieve logs from folders or subfolders other than the folder you specify during the configuration process.

To allow the Collector to ingest logs from Microsoft IIS, perform these steps on the Microsoft IIS server(s):

Optionally, perform any required troubleshooting tasks.Ĭonfigure Microsoft IIS to send data to InsightIDRīefore you configure the Microsoft IIS event source in InsightIDR, you need to configure logging in IIS so that InsightIDR can collect the logs.

Configure InsightIDR to collect logs from Microsoft IIS.

Configure Microsoft IIS to send data to InsightIDR.

You can configure a directory watcher on a collector to monitor the logs of the asset that is running the Microsoft IIS software. These logs are ingested in the W3C-compliant format. You can search Microsoft IIS logs to detect and report web server access activity. Microsoft IIS provides valuable data about how users interact with your website or application.

Sophos xg home setup guide