forwarding IIS logs

View thread

bthx1138

Hi all, I'm using CE edition and sending logs to Taegis XDR, I've followed the instructions at this page:  Microsoft IIS (secureworks.com)

Configured IIS per these instructions: https://docs.ctpx.secureworks.com/integration/connectEndpoint/microsoft_iis_connect/#configuring-microsoft-iis-logging 

Configured nxlog.conf per these instructions:  https://docs.ctpx.secureworks.com/integration/connectEndpoint/microsoft_iis_connect/#configuring-nxlog 

Logs are still not showing up, and I think I have this section in the nxlog.conf IIS config misconfigured with the IP of my Taegis CDR collecter. I've got the IP of my host entered into the HOST line, and the port entered into the PORT line. Am I supposed to comment out any of the ‘Module’ lines? Do I have it misconfigured below? Any help is appreciated, thank you in advance.

 

<Output W3SVCOUT>   Module      om_udp   Module      om_tcp### Guidance on TLS/SSL configuration - https://nxlog.co/documentation/nxlog-user-guide/om_ssl.html   Module    om_ssl   Host        x.x.x.x   Port        601   CAFile    %CERTDIR%\CA.cer   CertFile    %CERTDIR%\winhost.cer   CertKeyFile    %CERTDIR%\winhost.key   AllowUntrusted    FALSE