{"type":"doc","content":[{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Topics Discussed","type":"text"},{"type":"hardBreak"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"9e192079-b019-4d00-8248-74b5489534cd"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"9c3b3fd9-a9e5-4501-8d31-eec783d2016f"}},{"type":"paragraph"},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"excerpt-include","parameters":{"macroParams":{"":{"value":"Obtain Log Relay for Remote Log Collection"},"name":{"value":"Remote Log Collection Permissions"},"nopanel":{"value":"true"}},"macroMetadata":{"macroId":{"value":"a47bfed3-008f-4940-8233-79e98681d8d9"},"schemaVersion":{"value":"1"},"title":"Insert excerpt"}},"localId":"24794c94-13c1-4687-ba33-54b39bc06435"}},{"type":"hardBreak"}]},{"type":"paragraph","content":[{"text":"You can use this document to send IIS logs to Armor's Security Information & Event Management (SIEM).","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configure Your IIS Service","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Configuring IIS services uses the Command Line Interface (CLI) feature. For more information, see ","type":"text"},{"text":"Security Service CLI Commands","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/KB/pages/3519583035"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"The following arguments are possible parameters for the Logging CLI feature. This allows customers to manage filebeat modules on Virtual Machines.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#333333"}}]}]},{"type":"table","attrs":{"layout":"wide","width":1800.0,"localId":"5f64a883-df12-4291-af47-d8966bd9c191"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"paragraph","content":[{"text":"Command","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"Arguments","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Result","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-enable","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Enables filebeat IIS/apache/nginx. When run, module yml file will change from disabled state to enable state.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis- disable","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Disables Filebeat IIS/apache/nginx. When run the module yml file will change from enable state to disable mode.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-add-access-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Includes the argument paths in module yml file under the 'access_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-remove-access-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Removes the argument paths in module yml file under the 'access_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-add-error-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Includes the argument paths in module yml file under the 'error_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-remove-error-paths","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"path1, path2, path3","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"Removes the argument paths in module yml file under the 'error_paths' section. Removes the argument paths in module yml file under the 'error_paths' section.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-sync-config","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"The command sync the module yml file on vm with latest changes which are required.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[224.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"iis-describe-config","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[328.0]},"content":[{"type":"paragraph","content":[{"text":"The command displays current access & error paths which are configured in module yml file.","type":"text"}]}]}]}]},{"type":"paragraph"},{"type":"heading","attrs":{"level":4},"content":[{"text":"Command Usage:","type":"text"}]},{"type":"codeBlock","content":[{"text":"armor logging iis-enable\n\narmor logging iis-disable\n\narmor logging iis-add-access-paths \n\narmor logging iis-remove-access-paths \n\narmor logging iis-add-error-paths \n\narmor logging iis-remove-error-paths \n\narmor logging iis-sync-config\n\narmor logging iis-describe-config","type":"text"}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"paragraph","content":[{"text":"Verify that logs are formatted correctly, similar to the following example:","type":"text"}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Midnight1

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"codeBlock","content":[{"text":"2020-04-09 08:09:10 203.0.113.80 2094 192.0.2.5 80 HTTP/1.1 GET /qos/file.txt 503 - ConnLimit -","type":"text"}]}],"version":1}}}}]},{"type":"paragraph","content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.migration","extensionKey":"__confluenceADFMigrationUnsupportedContentInternalExtension__","text":"","parameters":{"cxhtml":"Midnight1

","block-inline":true,"nestedContent":{"type":"doc","content":[{"type":"codeBlock","content":[{"text":"2020-04-09 17:45:25 198.51.100.80 58467 192.0.2.5 80 HTTP/1.1 GET / - 1 Client_Reset DefaultAppPool","type":"text"}]}],"version":1}}}}]}]}],"version":1}

Browser not supported