Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CONFIGURING DSMS REV 1 Manual page 123

51
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
M
ICROSOFT
You can integrate a Microsoft Internet Information Services (IIS) 5.x or 6.x server
with STRM. A STRM IIS DSM accepts IIS server events using syslog. STRM
records all HTTP status code events.
Before you configure STRM to integrate with an IIS server, you must:
Open the IIS console.
From the login options, select W3C Extended format.
Select the following options:
Date
•
• Time
Client IP
•
User Name
•
• Server IP Address
Server Port
•
Method
•
• URI Stem
URI Query
•
Protocol Status
•
• User Agent
Access the InterSect Alliance web site:
http://www.intersectalliance.com/projects/SnareIIS/
Download open source Snare Agent for IIS, version 1.2:
SnareIISSetup-1.2.exe
Install the open source Snare Agent for IIS.
In the Snare Agent interface, select Audit Configuration.
The Audit Service Configuration window appears.
In the Target Host field, enter the IP address of your STRM installation.
Configuring DSMs Guide
IIS