log2timeline / plaso

Super timeline all the things
https://plaso.readthedocs.io
Apache License 2.0
1.71k stars 335 forks source link

Add support for MS HTTP Error logs #4879

Open sydp opened 5 months ago

sydp commented 5 months ago

Log files were found in a subfolder under %SystemRoot%\System32\LogFiles

Example file header:

#Software: Microsoft HTTP API 2.0
#Version: 1.0
#Date: YYYY-MM-DD HH:MM:SS
#Fields: date time c-ip c-port s-ip s-port cs-version cs-method cs-uri streamid streamid_ex sc-status s-siteid s-reason s-queuename transport

Some of the fields look like they are documented on this page: https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/aspnet/site-behavior-performance/error-logging-http-apis

joachimmetz commented 2 months ago

@sydp should I assign this to you? At first glance the format looks similar to IIS and Windows Firewall logs