Microsoft IIS

About the Device

An IIS web server runs on the Microsoft .NET platform on the Windows OS. It’s versatile and stable, and it’s been widely used in production for many years. A web server is a process for hosting web applications. The web server allows an application to process messages that arrive through specific TCP ports (by default). For example, the default port for HTTP traffic is 80, and the one for HTTPS is 443.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 10014 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

Prerequisite: Generate certificate on CyberHub using the following steps.

1. Navigate to support user mode by executing following command su - support on CyberHub terminal and choose option 29 - Manage the TLS certificates.

2. Choose option 2 - View EA Server TLS certificate and this will print Private Key and Certificate content on console.

3. Copy certificate from the console output to a file and save it.

To configure Microsoft IIS on Windows Server 2012 and 2016

1. Click Start > Administrative Tools > Internet Information Services (IIS) Manager.

2. In Connections, select the server or site for which to configure logging.

3. In Home, click Logging.

4. In Logging > Log File, click W3C in the Format and click Select Fields.

5. In W3C Logging Fields window, click select all fields, then click OK.

6. To get the real source IPs in the IIS hit logs for servers, create a new custom field (optional)

Field Name – Source-IP

Source Type – Request Header

Source – X-FORWARDED-FOR

7. Please proceed with restarting IIS. Following this action, our IIS logs will display the IP addresses of client PCs instead of the IP addresses of the load balancer.

To configure NxLog Agent for Microsoft IIS logs on port 10014

1. Download and install the NXLog Windows agent from the following location: https://nxlog.co/products/nxlog-community-edition/download.

2. Navigate to services.msc and stop the nxlog service.

3. Navigate to the folder C:\Program Files\nxlog\data and delete the file configcache.dat if it present.

4. Rename the attached file to nxlog.conf and copy into C:\Program Files\nxlog\conf. folder.

5. Replace the placeholder CyberHub IP with the actual CyberHub IP in the nxlog.conf file.

6. Copy the previously created certificate file on Windows machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against "CAFile" on line number 45.

7. Now, start the NxLog service from services.msc.

8. NXLog agent logs will be available at the location C:\Program Files\nxlog\data\nxlog.log.

9. The log flow should work, and you can check it using tcpdump with the command tcpdump -AA port 10014

Log configuration via Epilog Agent (version 5.4.1 onwards)

To enable logging

1. Login to Snare Epilog Console using Web UI.

2. Navigate to Log Configuration > Add

3. Select Custom Event Log in Select the Log Type and mention Epilog-IISWebLog.

4. Select Single line only in Multi-Line Format

5. Enable Send Comments

6. Select HTTP log file directory of MS-IIS in Log File or Directory

7. Provide log file name (in case of multiple files, make it “u_ex%.log”) in Log Name Format

8. Click Change Configuration to save your configuration.

To configure destination

1. Navigate to Destination Configuration

2. Mention CyberHub IP Address in Domain/IP in Network Destination

3. Mention Port as 10013

4. Select TCP as protocol

5. Select SYSLOG (RFC3164) in format

6. Select Space [] in Delimiter Character

7. Click Update Destinations to save your configuration

8. Navigate to Menu and click Apply Configuration and Restart Service.

Log configuration via Syslog-NG Agent (version 5.4.1 onwards)

To configure HTTP logging

1. Navigate to Settings > Eventlog Sources in syslog-ng Agent

2. Click Disable in Setting. This will prevent syslog-ng to send windows event logs further. (Recommended)

3. Click File Sources, select to Enable

4. Click Add, opens File Source Property window.

5. Browse the directory where MS-IIS store its HTTP log files in Base Directory

6. Browse the file which you want to be monitored in File Name Filter

7. Mention MSIISHTTP in Application Name

8. Click Ok to save the configurations.

To configure destination:

1. Right-click on Destinations and click Add New Server

2. Select Server tab

3. Select Enable Flow Control

4. Add CyberHub IP Address in Server Name or Address (IPv4) field

5. Mention port number as 10013 in Server Port

6. Select Messages tab

7. Select Legacy BSD Syslog Protocol in Protocol field and mention below text in Template field:

NXLOG|${HOST}|OFFBOX-MSFTWEBIIS-TO-LCP|${FILE_NAME}|::::${MSG}

7. Click Ok to save the configurations.

8. Start the syslog-ng service.

Integration Parameters

Parameters required from customer for Integration.