topic Re: Collecting IIS Log in Cortex XSIAM Discussions

Collecting IIS Log

BenjaminYabre — Wed, 23 Jul 2025 02:19:06 GMT

Hi,

I have configured the filebeat to collect the IIS log,

but I don't see any dataset related to the IIS log in the dataset table and also don't know how and in which dataset to get those logs.

this the filebeat configuration

---
filebeat.modules:
- module: iis
access:
enabled: true
var.paths:
- C:/inetpub/logs/LogFiles/W3SVC*/u_ex*.log
error:
enabled: true
var.paths:
- C:/Windows/System32/LogFiles/HTTPERR/*.log
processors:
- add_fields:
fields:
vendor: microsoft
product: IIS

Re: Collecting IIS Log

jmazzeo — Thu, 31 Jul 2025 13:08:54 GMT

Hi @BenjaminYabre,

Regarding your filebeat config, the logs should go to the dataset called "microsoft_iis_raw". The dataset format is vendor_product_raw.

If this post answers your question, please mark it as the solution.

Re: Collecting IIS Log

BenjaminYabre — Thu, 31 Jul 2025 13:33:15 GMT

hi !

Thanks for your feedback.