Collect Microsoft IIS logs

This guide explains how you can ingest Microsoft Internet Information Services (IIS) logs to Google Security Operations using Bindplane.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• A Windows Server 2016 or later with IIS installed
• Administrative access to the IIS server
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File. Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer IDfrom the Organization Detailssection.

Configure IIS W3C extended logging

Open IIS Manager

1. Click Start.
2. Type inetmgr and press Enter.
3. The Internet Information Services (IIS) Managerwindow opens.

Alternative method:

1. Press Windows Key + R.
2. Type inetmgr and press Enter.

Navigate to logging configuration

1. In the Connectionspane, expand your server name.
2. To configure server-wide logging (recommended):
   • Click the server nameat the root level.
3. To configure site-specific logging:
   • Expand Sitesand then click the specific site (for example, Default Web Site).
4. In the Features View, double-click Logging.

Select W3C extended log format

1. On the Loggingpage, under Log Filesection:
   • In the Formatdropdown, select W3C.
2. Click Select Fieldsbutton.

Configure W3C logging fields

In the W3C Logging Fieldsdialog, enable the following fields by checking the boxes:

Fields required for parsers

• Date(date) - Event timestamp (date component).
• Time(time) - Event timestamp (time component in UTC).
• Client IP Address(c-ip) - Source IP address.
• Method(cs-method) - HTTP method (GET, POST, PUT, DELETE).
• URI Stem(cs-uri-stem) - Requested resource path.
• Protocol Status(sc-status) - HTTP response code (200, 404, 500).

Fields required for detections

These fields are essential for Google SecOps built-in security detections:

• Service Name(s-sitename) - Site or service identifier
• Server Name(s-computername) - Server hostname
• Server IP Address(s-ip) - Target server IP address
• Server Port(s-port) - Target port number
• User Name(cs-username) - Authenticated username (critical for authentication attack detection)
• User Agent(cs(User-Agent)) - Client browser or application identifier (critical for bot and malware detection)

Fields for enhanced visibility

These fields provide additional context for security analysis:

• URI Query(cs-uri-query) - Query string parameters
• Referer(cs(Referer)) - Referrer URL
• Protocol Substatus(sc-substatus) - Detailed HTTP substatus code
• Win32 Status(sc-win32-status) - Windows error code
• Bytes Sent(sc-bytes) - Response size in bytes
• Bytes Received(cs-bytes) - Request size in bytes
• Time Taken(time-taken) - Request duration in milliseconds

Optional fields (use-case specific)

Enable these fields if needed for your specific requirements:

• Host(cs-host) - Virtual host header (enable if using virtual hosts)
• Protocol Version(cs-version) - HTTP protocol version (HTTP/1.1, HTTP/2)
• Cookie(cs(Cookie)) - Cookie values (enable if tracking sessions)

Apply configuration

1. Click OKto close the W3C Logging Fieldsdialog.
2. Verify the Directorypath where logs will be written.
   • Default: %SystemDrive%\inetpub\logs\LogFiles
3. Under Log File Rollover, select Daily(recommended for Google SecOps ingestion).
4. Click Applyin the Actionspane.

Verify IIS logging

1. Generate test traffic to your IIS site by opening a web page in a browser.
2. Navigate to the log directory: C:\inetpub\logs\LogFiles\W3SVC1\
3. Open the most recent log file (for example, u_ex251020.log ) in Notepad.
4. Verify the #Fields: line contains all the fields you enabled.

Example #Fields: line:

 #Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken 

Example log entry:

  2025 
 - 
 10 
 - 
 20 
  
 14 
 : 
 23 
 : 
 15 
  
 Def 
 ault_Web_Site 
  
 SERVER01 
  
 192.168.1.10 
  
 GET 
  
 / 
 index 
 . 
 html 
  
 - 
  
 80 
  
 - 
  
 203.0.113.45 
  
 Mozilla 
 / 
 5.0 
 + 
 ( 
 Windows 
 + 
 NT 
 + 
 10.0 
 ) 
  
 - 
  
 200 
  
 0 
  
 0 
  
 1234 
  
 567 
  
 125 
 

Install Bindplane agent

Install the Bindplane agent on your Windows server according to the following instructions.

Windows installation

1. Open Command Promptor PowerShellas an administrator.
2. Run the following command:

  msiexec 
  
 / 
 i 
  
 "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" 
  
 / 
 quiet 
 

Additional installation resources

• For additional installation options, consult this installation guide .

Configure Bindplane agent to ingest IIS logs and send to Google SecOps

Stop the Bindplane service

Before editing the configuration file, stop the service:

  Stop-Service 
 "observIQ OpenTelemetry Collector" 
 

Edit the configuration file

1. Locate the config.yaml file.
   • Default path: C:\Program Files\observIQ OpenTelemetry Collector\config.yaml
2. Open the file using a text editor (for example, Notepad, VS Code, or Notepad++) as Administrator.

3. Replace the entire contents with the following configuration:

     receivers 
    : 
     
    iis 
    : 
     
    collection_interval 
    : 
     
    60s 
    processors 
    : 
     
    resourcedetection 
    : 
     
    detectors 
    : 
     
    [ 
    "system" 
    ] 
     
    system 
    : 
     
    hostname_sources 
    : 
     
    [ 
    "os" 
    ] 
     
    normalizesums 
    : 
     
    batch 
    : 
    exporters 
    : 
     
    chronicle/iis 
    : 
     
    endpoint 
    : 
     
    malachiteingestion-pa.googleapis.com 
     
    creds 
    : 
     
    'C:\SecOps\ingestion-auth.json' 
     
    log_type 
    : 
     
    'IIS' 
     
    override_log_type 
    : 
     
    false 
     
    raw_log_field 
    : 
     
    body 
     
    customer_id 
    : 
     
    '<CUSTOMER_ID>' 
     
    compression 
    : 
     
    gzip 
    service 
    : 
     
    pipelines 
    : 
     
    logs/iis 
    : 
     
    receivers 
    : 
     
    - 
     
    iis 
     
    processors 
    : 
     
    - 
     
    resourcedetection 
     
    - 
     
    normalizesums 
     
    - 
     
    batch 
     
    exporters 
    : 
     
    - 
     
    chronicle/iis 
    
   

Update configuration values

Replace the following placeholders:

• creds: - Path to your ingestion authentication file (for example, C:\SecOps\ingestion-auth.json ).
• customer_id: - Your actual Google SecOps customer ID from the Get Google SecOps customer ID section.

Restart Bindplane agent to apply the changes

After saving the config.yaml file, restart the Bindplane service:

  Start-Service 
 "observIQ OpenTelemetry Collector" 
 

Verify the service is running:

  Get-Service 
 "observIQ OpenTelemetry Collector" 
 

Expected output:

 Status   Name                               DisplayName
  ------   ----                               -----------
  Running  observiq-otel-collector            observIQ OpenTelemetry Collector 

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.