Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-microsoftiis

Microsoft IIS

You can integrate Microsoft Internet Information Services (IIS) with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

Microsoft IIS product overview

Internet Information Services (IIS) is Microsoft's extensible web server for Windows Server, providing a secure, modular platform for hosting websites, web applications, and services, including ASP.NET Core and PHP applications.

What we ingest

A Sophos XDR data collector accepts Microsoft IIS W3C access logs in the Snare-over-syslog format, forwarded from your IIS servers by Snare or NXLog. The following log categories are collected:

  • Web activity: IIS W3C access-log web requests.

Event and data types

We ingest the following event and data types from Microsoft IIS:

  • Web activity: IIS W3C access-log web requests, including the client IP, HTTP method, URI, protocol status, and user agent. Normalized to HTTP telemetry.

Data provided by this integration

Data provided by Microsoft IIS gets normalized to the following schemas:

  • http

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation