Microsoft IIS Server

The Microsoft Internet Information Services (IIS) Server DSM for IBM® QRadar® accepts FTP, HTTP, NNTP, and SMTP events using syslog.

You can integrate a Microsoft IIS Server with QRadar by using one of the following methods:

  • Configure QRadar to connect to your Microsoft IIS Server by using the IIS Protocol which collects HTTP events from Microsoft IIS servers. For more information, see Configuring Microsoft IIS by using the IIS Protocol.
  • Configure WinCollect to forward IIS events to QRadar. For more information, go to Log Sources for WinCollect agents in the IBM QRadar WinCollect User Guide (https://www.ibm.com/docs/en/SS42VS_SHR/com.ibm.wincollect.doc/c_ug_wincollect_log_sources.html).
Table 1. Supported log types for Microsoft IIS 6.0 - IIS 10.0

Method of Import

Supported Log Type

IIS Protocol

HTTP

WinCollect

SMTP, NNTP, FTP, HTTP