Monitoring Windows IIS

[Adiel Navarro]

Can I monitoring Windows IIS with OSSEC?

Are there decoder and rules for IIS in OSSEC?

[Jesus Linares]

Hi,

you can set the log format to IIS: http://ossec.github.io/docs/syntax/head_ossec_config.localfile.html#element-log_format

Also, there are decoders referencing IIS: https://github.com/wazuh/ossec-rules/blob/master/decoders/windows_decoders.xml

Just configure it and review archives.log and alerts.log.

Regards

[Adiel Navarro]

What about the rules?

[Jesus Linares]

Hi Adiel,

I'm not sure if we have specified rules for IIS. Did you try to configure the proper localfile and review archives.log and alerts.log?.

If you share the kind of logs you want to handle with OSSEC, we can help to create decoders and rules.

Thanks.

Regards.

[Adiel Navarro]

Can I Configura <localfile> in Windows OSSEC Agent?

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To post to this group, send email to wa...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/32880874-e553-4a97-981b-51cb88218e0e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Santiago Bassett]

Hi Adiel,

yes, I don't see why not.

Best regards

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/32880874-e553-4a97-981b-51cb88218e0e%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+unsubscribe@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/013701d244d4%240c093050%24241b90f0%24%40mail.telcel.com.

[Kurtuluş Karasu]

Hi

How can i understand iis logs send to ossec server ?

Regards

Kurtuluş

Saygılarımla,

Kurtuluş

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/CAEb-Ba_K2LyVopARN7CiPnJ6F%2BRSq9D2kCeNdd%3DhtfC60vd%2BZQ%40mail.gmail.com.

[Adiel Navarro]

Gracias por tu correo electrónico.

Pero te informo que mi dirección a cambiado...

Ahora es adiel....@telcel.com

 

Saludos cordiales.

 

L.I. Adiel Jesús Navarro Rosado

Analista OyM Seguridad Operativa

*: adiel....@telcel.com

'. Ext. 5179

È: 5510101509

 

 

[Santiago Bassett]

Hi Kurtulus,

It seems there are decoders to process IIS access logs but I haven't been able to find rules that use them. There is an interesting thread in OSSEC mailing list about it:

https://groups.google.com/forum/#!topic/ossec-list/lgZs4JikRUo

I hope it helps,

Santiago.

[Kurtuluş Karasu]

Hi Santiago

My iis log file name  filename-date-miliseconds so how can i send my iis logs to wazuh.

i wrote this but it is failed 

<location>C:\inetpub\logs\AdcancedLogs\iisserver%y%m%d-%f.log<location>

iPhone'umdan gönderildi

Santiago Bassett <sant...@wazuh.com> şunları yazdı (1 Ara 2016 03:33):

[Jesus Linares]

Hi,

what error are you getting?. Could you paste it here?.

Thanks.

[Kurtuluş Karasu]

Hi,

ERROR: unable to open file: C:\inetpub\logs\AdcancedLogs\iisserver%y%m%d-%f

Regards

Jesus Linares <je...@wazuh.com> şunları yazdı (13 Ara 2016 19:53):

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/f74e31ee-96a5-4a31-bdaf-2478a4402efc%40googlegroups.com.

[Victor Fernandez]

Hi Kurtuluş,

I tested your settings:

<location>C:\inetpub\logs\AdcancedLogs\iisserver%y%m%d-%f.log<location>

And I got the same error as you. The problem is that the "%f" isn't accepted. OSSEC uses internally the function "strftime" to compose the actual file path. You can find the complete list of allowed format fields at:

http://www.cplusplus.com/reference/ctime/strftime

So you may change the file name template used by IIS and use another format field on OSSEC. A template such this one does work:

<location>C:\inetpub\logs\AdcancedLogs\iisserver%y%m%d.log<location>

Out of curiosity, what do you want "%f" for?

Kind regards.

[Kurtuluş Karasu]

Hi Victor

Thank you for your reply 

i dont want that anything but Windows iis advanced logs got it

Victor Fernandez <vic...@wazuh.com> şunları yazdı (20 Ara 2016 13:20):

To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.

To post to this group, send email to wa...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/24dd6492-2054-48db-8b6e-edc46d2c1d3a%40googlegroups.com.