search

philhagen / sof-elk

Configuration files for the SOF-ELK VM
GNU General Public License v3.0
1.47k stars 276 forks source link

Update 6100-httpd.conf #208

Closed joshlemon closed 3 years ago

joshlemon commented 3 years ago

Updated IIS parser to cover logs produced by an Exchange Server. Also includes an update to the 'ident' parameter to account for a Windows-based user account that occurs in IIS logs on an Exchange Server.

philhagen commented 3 years ago

I handled this by extending the ident detection to include DOMAIN/user and DOMAIN\user formats. I verified that an existing grok that includes the referer matches your sample.