rakesh.mishra
New Member.
212 views

IIS config change detections

Jump to solution

i have been given task of configuring IIS Config change detections ? i dot have much expertise on IIS and would like to know if someone can share some  experience here .Also would need help if somene can help with the iis based detections in ArcSight

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Micro Focus Expert
Micro Focus Expert

Re: IIS config change detections

Jump to solution

One way to address this use case would be to search or monitor (rule fire) for

deviceProduct=IIS (or whatever the actual syntax is)

deviceVendor=Microsoft

and then use categorization to determine when the configuration has been modified. IIS should produce events when it's configuration changes, and the ArcSight SmartConnector should categorize the event accordingly.

Look at the 6 categorization fields specifically.

View solution in original post

0 Likes
2 Replies
Micro Focus Expert
Micro Focus Expert

Re: IIS config change detections

Jump to solution

One way to address this use case would be to search or monitor (rule fire) for

deviceProduct=IIS (or whatever the actual syntax is)

deviceVendor=Microsoft

and then use categorization to determine when the configuration has been modified. IIS should produce events when it's configuration changes, and the ArcSight SmartConnector should categorize the event accordingly.

Look at the 6 categorization fields specifically.

View solution in original post

0 Likes
Honored Contributor.. simon.simcic@sr Honored Contributor..
Honored Contributor..

Re: IIS config change detections

Jump to solution

IIS 7.5 – How to enable IIS Configuration Auditing? - WebTopics - Site Home - MSDN Blogs

it has to be enabled as well, as shows up in the event log, but in the IIS subtree.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.