IIS parser will not parse all IIS information

[RSAAdmin]

Hi,

I'm working with SA 10.3 and i have multiple IIS sites that i'm transferring the logs to SA using SFTP agent.

The problem i'm facing with is that most of the logs are not parsing in SA.

For example, the following log:

%IIS-4-: date="2014-12-14",time="06:17:09",s-ip="192.168.121.30",cs-method="GET",cs-uri-stem="/",cs-uri-query="-",s-port="444",cs-username="-",c-ip="192.168.121.252",cs(User-Agent)="-",sc-status="200",sc-substatus="0",sc-win32-status="0",time-taken="31",

SA will not parse the webpage and only show me the information inside the msg container:

sessionid=11000751318

time=2014-12-14T08:19:35.0

size=322

lc.cid="hostname***"

forward.ip=127.0.0.1

device.ip=192.168.121.30

medium=32

device.type="microsoftiis"

device.class="Web Logs"

header.id="0001"

ip.dst=192.168.121.30

ip.dstport=444

ip.src=192.168.121.252

result.code="200"

result="0"

event.time=2014-12-14 06:17:09.000

msg="date="2014-12-14",time="06:17:09",s-ip="192.168.121.30",cs-method="GET",cs-uri-stem="/",cs-uri-query="-",s-port="444",cs-username="-",c-ip="192.168.121.252",cs(User-Agent)="-",sc-status="200",sc-substatus="0",sc-win32-status="0",time-taken="31","

level=6

msg.id="GET"

event.cat.name="Content.Web Traffic"

I followed the documentation here: http://sadocs.emc.com/@api/deki/files/40485/Microsoft_IIS.pdf

Anyone knows how can i fix this?

[RSAAdmin]

No one knows how to set up IIS on SA? Isn't that should be the basic?

[Anonymous]

Hello Guy,

As I observed this issue is related to something issue with the parser of MS IIS in RSA SA. My suggestion would be to kindly update your server from 10.3.3 to 10.3.5, hope this will resolve the issue.

Or either I can share the latest parser for MS IIS from 10.4.2.

Regards,

Deepanshu Sood.

[RSAAdmin]

Hi,

Thank you so much for the fast reply.

Can you please share your 10.4.2 MS IIS parser? I would like to check it before i'm upgrading the servers for nothing.

Best Regards,

Guy Miretzky

[Anonymous]

Hi,

Kindly find the attached xml file for iis and replace the attached file with the below mentioned path.

Before replace the file, always remember to take the backup of the original file.

/etc/netwitness/ng/logcollection/content/collection/file/iis_tvm.xml

Hope this will work and solve your problem.

Regards,

Deepanshu Sood.

[RSAAdmin]

Hi,

Thanks for the file, but this is the same file that i'm using today:

$ md5sum.exe ~/working/RSA/SecurityAnalytics/Parses/microsoftiis/backup/iis_tvm.xml

5c4453b5d9d1ef8f8480ea52c0372524 */home/Guym/working/RSA/SecurityAnalytics/Parses/microsoftiis/backup/iis_tvm.xml

$ md5sum.exe ~/working/RSA/SecurityAnalytics/Parses/microsoftiis/iis_tvm.xml

5c4453b5d9d1ef8f8480ea52c0372524 */home/Guym/working/RSA/SecurityAnalytics/Parses/microsoftiis/iis_tvm.xml

Are you sure this is the file i need to change?

I think i need to change the two files in: /etc/netwitness/ng/envision/etc/devices/microsoftiis

Can you send them to me so i can compare?

Best Regards,

Gu yMiretzky

[Anonymous]

Thanks Guy.

Kindly find the file attached now.

[RSAAdmin]

Sorry to say, but those are also the same files as i have.  Maybe there was no change in the IIS parser between the two upgrades.

Thanks for the help, can anyone think on another solution ?

Best Regards,

Guy Miretzky

[Anonymous]

It appears to be parsing correctly, what is the issue you are seeing?  If you click on view details you will see all the meta.

msg = entire log message.  You should not even be parsing that in your /etc/netwitness/ng/envision/etc/table-map.xml file, wastes too much space on your concentrator.

Some fields below might need to be modified in the table-map.xml. 

To give you a rundown of what I am seeing.

Date/time = event.time

s-ip = ip.dst (top line on your image)

cs-method = msg.id

cs-uri-stem  = web.page (if parsing it)

s-port = ip.dstport

cs-username = username

c-ip = ip.src (top line on your image)

cs(User-Agent) = client (or user.agent)

sc-status = result.code

sc-substatus = result

sc-win32-status = disposition

time-taken = duration

[RSAAdmin]

Hi,

Thank you for the reply.

I read it twice (and even more), but i'm not sure i understand what you meant

I can see that the msg meta tag is holding all the information that i need. But i cant figure out how to access it in reports / investigation view.

The most important one is the webpage. I need to be able to search logs according to the webpage meta tag.

I can't find a way to grep / search by this criteria. Even when i' running regex on msg to find the correct word, i'm getting zero results.

I'm looking for a way to parse the webpage information - cs-uri-stem - in a way that will allow me to search for it in reports.

Can someone please assist me?

Best Regards,

Guy Miretzky