Quest InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS
2017 Quest Sftware Inc. ALL RIGHTS RESERVED. This guide cntains prprietary infrmatin prtected by cpyright. The sftware described in this guide is furnished under a sftware license r nndisclsure agreement. This sftware may be used r cpied nly in accrdance with the terms f the applicable agreement. N part f this guide may be reprduced r transmitted in any frm r by any means, electrnic r mechanical, including phtcpying and recrding fr any purpse ther than the purchaser s persnal use withut the written permissin f Quest Sftware Inc. The infrmatin in this dcument is prvided in cnnectin with Quest Sftware prducts. N license, express r implied, by estppel r therwise, t any intellectual prperty right is granted by this dcument r in cnnectin with the sale f Quest Sftware prducts. EXCEPT AS SET FORTH IN THE TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, QUEST SOFTWARE ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL QUEST SOFTWARE BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF QUEST SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Quest Sftware makes n representatins r warranties with respect t the accuracy r cmpleteness f the cntents f this dcument and reserves the right t make changes t specificatins and prduct descriptins at any time withut ntice. Quest Sftware des nt make any cmmitment t update the infrmatin cntained in this dcument. If yu have any questins regarding yur ptential use f this material, cntact: Quest Sftware Inc. Attn: LEGAL Dept 4 Plaris Way Alis Viej, CA 92656 Refer t ur Web site (https://www.quest.cm) fr reginal and internatinal ffice infrmatin. Patents Quest Sftware is prud f ur advanced technlgy. Patents and pending patents may apply t this prduct. Fr the mst current infrmatin abut applicable patents fr this prduct, please visit ur website at https://www.quest.cm/legal. Trademarks Quest, the Quest lg, and Jin the Innvatin are trademarks and registered trademarks f Quest Sftware Inc. Fr a cmplete list f Quest marks, visit https://www.quest.cm/legal/trademark-infrmatin.aspx. All ther trademarks and registered trademarks are prperty f their respective wners. Legend CAUTION: A CAUTION icn indicates ptential damage t hardware r lss f data if instructins are nt fllwed. IMPORTANT, NOTE, TIP, MOBILE, r VIDEO: An infrmatin icn indicates supprting infrmatin. InTrust Preparing fr Auditing and Mnitring Micrsft IIS Updated - May 2017 Versin - 11.3
Cntents IIS Auditing Overview 4 Installing the Knwledge Pack fr Micrsft IIS 5 Cnfiguring Service Lgging fr IIS 6.0 and Earlier 6 Cnfiguring Service Lgging fr IIS 7.0 and FTP Service 7.5 7 Knwn Issues with IIS 7.0 and FTP Service 7.5 8 Hw t Gather Event Data with InTrust 9 Gathering Data Using Agents 9 Gathering Data Withut Agents 9 IP Address Reslutin 10 Hw t Mnitr fr Critical Events 11 InTrust Knwledge Pack fr Micrsft IIS 12 Abut us 13 Cntacting Quest 13 Technical supprt resurces 13 InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS 3
IIS Auditing Overview InTrust with the Knwledge Pack fr Micrsft IIS allws yu t gather and mnitr fr events generated by Micrsft Internet Infrmatin Services (IIS). This infrmatin allws yu t stay infrmed abut wh has been using the server and hw many times yur nline infrmatin was accessed. Yu can cllect, reprt, and mnitr fr events generated by Micrsft IIS versins 4.0 and later running n Micrsft Windws 2000 Server, Micrsft XP Prfessinal, Micrsft Windws Server 2003, Micrsft Windws Server 2008, Windws Vista, r Micrsft Windws Server 2008 R2. Gathering (but nt mnitring) f events generated by Micrsft FTP Service 7.5 fr IIS 7.0 is als supprted. InTrust can prcess the event data written by IIS t the fllwing lgs: Micrsft IIS WWW Lg Micrsft IIS FTP Lg Windws Security Lg (events generated by IIS) InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS IIS Auditing Overview 4
Installing the Knwledge Pack fr Micrsft IIS Supprt fr IIS auditing and real-time mnitring is prvided by the Knwledge Pack fr Micrsft IIS. The Knwledge Pack must be installed n tp f an existing InTrust installatin. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Installing the Knwledge Pack fr Micrsft IIS 5
Cnfiguring Service Lgging fr IIS 6.0 and Earlier Yu can use the fllwing prcedure t cnfigure WWW Service r FTP Service lgging fr IIS versin 6.0 (similar steps can be taken fr versins prir t 6.0). T enable WWW Service r FTP Service lgging 1. In Internet Infrmatin Services Manager, right-click the necessary service and select Prperties. 2. Depending n selected service, n the WWW Sites r FTP Sites tab, select the Enable lgging check bx. 3. In the Active Lg Frmat list, select the W3C Extended Lg File frmat. 4. Specify the lgging ptins yu need. Click OK t save the settings. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Cnfiguring Service Lgging fr IIS 6.0 and Earlier 6
Cnfiguring Service Lgging fr IIS 7.0 and FTP Service 7.5 1. In Internet Infrmatin Services Manager, in the left pane, click the necessary site r server. 2. In the right pane, click Lgging. 3. On the screen that pens, set the Frmat ptin t W3C. 4. Cnfigure ther lgging ptins as necessary. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Cnfiguring Service Lgging fr IIS 7.0 and FTP Service 7.5 7
Knwn Issues with IIS 7.0 and FTP Service 7.5 The fllwing issues exist with gathering and real-time mnitring f IIS 7.0 and FTP Service 7.5 lgs: 1. The "Oversized request" real-time mnitring rule des nt wrk fr these lgs. 2. When gathering uses agent-side lg backup, filtering by the sc-bytes, cs-bytes and time-taken fields des nt wrk in the fllwing audit data filters: MS IIS: Web Site: Failed Access MS IIS: Web Site: Restricted Access MS IIS FTP Site Lg MS IIS: Web Site: Warning-cde Access MS IIS: FTP Site: Successful Lgns MS IIS: Web Site: Successful Access MS IIS: FTP Site: Failed Lgns MS IIS: FTP Site: Uplad MS IIS: FTP Site: All Lgns MS IIS Web Site Lg MS IIS: Web Site: Nt Fund Errrs MS IIS: FTP Site: Dwnlad 3. If gathering uses agent-side lg backup, the "Web site ttal statistics" and "WEB site daily traffic [chart]" reprts cannt be generated frm the resulting events. 4. Real-time mnitring and gathering f FTP lgs with the agent-side audit lg backup enabled des nt wrk. 5. Gathering f WWW lg in UTF-8 frmat des nt wrk if D nt create new lg files lgging ptin is selected. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Knwn Issues with IIS 7.0 and FTP Service 7.5 8
Hw t Gather Event Data with InTrust 1. 1 In InTrust Manager, select Cnfiguratin Sites Micrsft Windws Netwrk, and select the All IIS Servers site. 2. 2 T autmatically install agents n the site cmputers, select Install Agents frm site s shrtcut menu. Agentless gathering peculiarities are described later. 3. 3 Select the IIS Daily Cllectin task, r cnfigure a new task yu need, with a gathering jb invlving the necessary gathering plicy and site. In the task prperties, select the Schedule enabled ptin. 4. 4 Select the IIS Weekly Reprting task, r cnfigure a new reprting task yu need, and enable its schedule in the similar way. CAUTION: If yu change the lcatin f IIS lg files between gathering sessins, make sure the ld lg files are available in the new lcatin. Gathering Data Using Agents T minimize impact n the netwrk when cmmunicating data frm target cmputer t InTrust server, agents are recmmended fr data gathering. The fllwing rights and permissins must be assigned t the InTrust agent accunt if the agent is nt running under the LcalSystem accunt: Membership in the lcal Site Operatrs grup (fr IIS 5.0). Read permissin t the HKLM\SYSTEM\CurrentCntrlSet\Cntrl\ TimeZneInfrmatin registry key. Read and List Flder Cntents permissins t lg file flders; the Delete permissin must als be granted if the agent-side lg backup is enabled and the Clear the backup after gathering ptin is turned n fr the data surce. Gathering Data Withut Agents T gather IIS events withut agents: Micrsft IIS Administrative Cmpnents must be installed n the InTrust server. On the prcessed cmputer, the Remte Registry Service is required. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Hw t Gather Event Data with InTrust 9
The accunt under which the gathering service will access site cmputers (specified explicitly in the site s settings, r inherited frm InTrust server r task) requires the fllwing: a. Access this cmputer frm the netwrk right. b. Deny access t this cmputer frm netwrk right must be disabled. c. Membership in the lcal Administratrs grup. d. Membership in the lcal Site Operatrs grup (IIS 5.0). e. Read permissin t the HKLM\SYSTEM\CurrentCntrlSet\Cntrl\ TimeZneInfrmatin registry key. f. Read permissin t the HKLM\SYSTEM\CurrentCntrlSet\Cntrl\ Nls\Language registry key. g. Read and List Flder Cntents permissins n lg file flders; the Delete permissin must als be granted if the agent-side lg backup is enabled and the Clear the backup after gathering ptin is turned n fr the data surce. IP Address Reslutin If specified by InTrust settings, IP addresses fund in the lg are reslved t hst names, and InTrust saves them bth (IP addresses and hst names) int the lg, appending them t riginal fields. This can significantly slw dwn the gathering prcess; s this ptin is disabled by default. If necessary, yu can enable this ptin in the fllwing way: 1. In InTrust Manager, select Cnfiguratin Data Surces. 2. On the right pane, select the IIS lg yu need, fr example, Micrsft IIS WWW Lg 3. Frm its shrtcut menu, select Prperties, n the Settings tab select Reslve IP addresses t and specify whether t reslve them int NetBIOS names r DNS names: InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Hw t Gather Event Data with InTrust 10
Hw t Mnitr fr Critical Events T mnitr fr critical events, InTrust agents are used n the cmputers included in the target site. If the agents are nt yet installed, they will be deplyed autmatically as sn as yu activate a real-time mnitring plicy. T simplify the cnfiguratin f the real-time mnitring wrkflw, InTrust Knwledge Pack fr Micrsft IIS ffers predefined mnitring rules and plicies. T cnfigure IIS mnitring with InTrust 1. In InTrust Manager, carry ut the fllwing: a. Enable the rule that will handle the events yu need, fr example, 'Unauthrized web-page access attempt', r any ther rule frm Real-Time Mnitring Rules IIS RTM Rules Cmmn Attacks. b. Activate a mnitring plicy that will bind this rule t yur InTrust site, that is the Real-Time Mnitring Plicies IIS Security plicy. c. If yu want t get an email ntificatin upn alert generatin, in the Cnfiguratin Persnnel, select Ntificatin Grups, select the necessary grup and specify the desired recipients. d. Select the site yu will mnitr (All IIS Servers), and frm its shrtcut menu, select Prperties. Click Security, and make sure the list f accunts includes users yu want t be able t wrk with the alerts (as alert readers r alert managers). Check the same fr the rule grup cntaining the rule yu are using. 2. In Mnitring Cnsle, d the fllwing: a. Open the prfile yu want t wrk with, r create a prfile by running Mnitring Cnsle Administratin frm the Start menu. b. Cnfigure an alert view t display the necessary alerts. Fr detailed infrmatin n cnfiguring gathering and mnitring prcesses, refer t the InTrust Auditing Guide and InTrust Real-Time Mnitring Guide. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Hw t Mnitr fr Critical Events 11
InTrust Knwledge Pack fr Micrsft IIS The Knwledge Pack fr Micrsft IIS ffers a set f predefined InTrust bjects that will help yu cnfigure the gathering and mnitring f event data frm yur IIS servers. The fllwing bjects are included: Gathering plicies: IIS: Security Cllects all IIS security events t bth a repsitry and a database. IIS: Health Cllects all IIS health events bth t a repsitry and a database. IIS: Usage: WWW Cllects IIS Web Site lg bth t a repsitry and a database. IIS: Usage: FTP Сllects IIS FTP Site lg bth t a repsitry and a database. Imprt plicies: IIS: Security Imprts all IIS security events t a database. IIS: Health Imprts all IIS health events t a database. IIS: Usage: WWW Imprts events frm IIS Web Site lg t a database. IIS: Usage: FTP Imprts events frm IIS FTP Site lg t a database. Jbs: IIS Security events cllectin Cllectin f all the IIS security events t the default repsitry and the default database. IIS Web Site Reprting Weekly reprting f IIS Web Site usage and security events. IIS FTP Reprting Weekly reprting f IIS FTP Site usage and security events. Tasks: IIS Daily cllectin Daily cllectin f all the IIS events t the default repsitry and the default database. Weekly Reprting Weekly reprting f IIS statistics and the mst critical events. All IIS servers site IIS Security real-time mnitring plicy Mnitrs all the security events n all the IIS servers f the dmain. InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS InTrust Knwledge Pack fr Micrsft IIS 12
Abut us We are mre than just a name We are n a quest t make yur infrmatin technlgy wrk harder fr yu. That is why we build cmmunitydriven sftware slutins that help yu spend less time n IT administratin and mre time n business innvatin. We help yu mdernize yur data center, get yu t the clud quicker and prvide the expertise, security and accessibility yu need t grw yur data-driven business. Cmbined with Quest s invitatin t the glbal cmmunity t be a part f its innvatin, and ur firm cmmitment t ensuring custmer satisfactin, we cntinue t deliver slutins that have a real impact n ur custmers tday and leave a legacy we are prud f. We are challenging the status qu by transfrming int a new sftware cmpany. And as yur partner, we wrk tirelessly t make sure yur infrmatin technlgy is designed fr yu and by yu. This is ur missin, and we are in this tgether. Welcme t a new Quest. Yu are invited t Jin the Innvatin. Our brand, ur visin. Tgether. Our lg reflects ur stry: innvatin, cmmunity and supprt. An imprtant part f this stry begins with the letter Q. It is a perfect circle, representing ur cmmitment t technlgical precisin and strength. The space in the Q itself symblizes ur need t add the missing piece yu t the cmmunity, t the new Quest. Cntacting Quest Fr sales r ther inquiries, visit https://www.quest.cm/cmpany/cntact-us.aspx r call +1-949-754-8000. Technical supprt resurces Technical supprt is available t Quest custmers with a valid maintenance cntract and custmers wh have trial versins. Yu can access the Quest Supprt Prtal at https://supprt.quest.cm. The Supprt Prtal prvides self-help tls yu can use t slve prblems quickly and independently, 24 hurs a day, 365 days a year. The Supprt Prtal enables yu t: Submit and manage a Service Request View Knwledge Base articles Sign up fr prduct ntificatins Dwnlad sftware and technical dcumentatin View hw-t-vides Engage in cmmunity discussins Chat with supprt engineers nline View services t assist yu with yur prduct InTrust 11.3 Preparing fr Auditing and Mnitring Micrsft IIS Abut us 13