IIS - Generic Protection

IIS collection

A collection for IIS :

• ISS parser (only W3C format is supported, with the default format)
• base http scenarios for crawl, scan etc.

Note:

• IIS will buffer the logs in memory before writing them to the log file (or the event log). The flush is done every minute or every 64kB by default, this can lead to some false positives on low traffic websites, as crowdsec will be a surge of logs every minute. This can be mitigated by setting the use_time_machine settings to true in the relevant section of your acquisition config.

Acquisition template

Example acquisition for this collection if you log to a file:

1use_time_machine: true #Process logs as if we were replaying them to get the timestamp from the 
2filenames:
3  - C:\inetpub\logs\LogFiles\*\*.log
4labels:
5  type: iis

Example acquisition for this collection if you log to windows events:

1source: wineventlog
2event_channel: Microsoft-IIS-Logging/Logs
3event_ids:
4 - 6200
5event_level: information
6labels:
7 type: iis