W3CIISLog

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Reference for W3CIISLog table in Azure Monitor Logs.

Attribute Value
Category IT & Management Tools, Virtual Machines
Basic Logs Eligible ✗ No (source)
Supports Transformations ✓ Yes (source)
Ingestion API Supported ✗ No
Lake-Only Ingestion ✗ No (source)
Azure Monitor Tables Reference View Documentation

Contents

Schema (44 columns)

Source: Azure Monitor documentation

Column Name Type Description
_BilledSize real The record size in bytes
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
_ResourceId string A unique identifier for the resource that the record is associated with
_SubscriptionId string A unique identifier for the subscription that the record is associated with
AzureDeploymentID string Azure deployment ID of the cloud service the log belongs to. Only populated when events are collected using Azure Diagnostics agent when data is pulled from Azure storage.
cIP string IP address of the client that accessed the web server.
Computer string Name of the computer that the event was collected from.
Confidence string Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
csBytes long Number of bytes that the server received.
csCookie string Content of the cookie sent or received if any.
csHost string Host header name if any.
csMethod string Method of the request such as GET or POST.
csReferer string Site that the user last visited. This site provided a link to the current site.
csUriQuery string The query if any that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages.
csUriStem string Target of the action such as a web page for example Default.htm.
csUserAgent string Browser type of the client.
csUserName string Name of the authenticated user that accessed the server. Anonymous users are indicated by a hyphen.
csVersion string Protocol version that the client used.
Description string Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
FirstReportedDateTime string Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
IndicatorThreatType string Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
IsActive string Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
LastReportedDateTime string Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
MaliciousIP string Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
ManagementGroupName string Name of the management group for Operations Manager agents. For other agents this is AOI-.
RemoteIPCountry string Country/region of the IP address of the client.
RemoteIPLatitude real Latitude of the client IP address.
RemoteIPLongitude real Longitude of the client IP address.
Role string Role instance of the cloud service the log belongs to. Only populated when events are collected using Azure Diagnostics agent and data is pulled from Azure storage.
RoleInstance string Role of the cloud service the log belongs to. Only populated when events are collected using Azure Diagnostics agent and data is pulled from Azure storage.
scBytes long Number of bytes that the server sent.
scStatus string HTTP status code.
scSubStatus string Substatus error code.
scWin32Status string Windows status code.
Severity int Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
sIP string IP address of the server on which the log file entry was generated.
SourceSystem string The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
sPort int Server port number that is configured for the service.
sSiteName string Name of the IIS site.
StorageAccount string Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
TimeGenerated datetime Date and time the record was created.
TimeTaken long Length of time to process the request in milliseconds.
TLPLevel string Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
Type string The name of the table

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (8)

This table is used by the following solutions:

Connectors (2)

This table is ingested by the following connectors:

Connector Selection Criteria
[Deprecated] Microsoft Exchange Logs and Events
IIS Logs of Microsoft Exchange Servers

Content Items Using This Table (38)

Analytic Rules (15)

In solution Apache Log4j Vulnerability Detection:

Analytic Rule Selection Criteria
Log4j vulnerability exploit aka Log4Shell IP IOC
User agent search for log4j exploitation attempt

In solution Network Threat Protection Essentials:

Analytic Rule Selection Criteria
New UserAgent observed in last 24 hours

In solution Threat Intelligence: cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"

Analytic Rule
TI Map IP Entity to W3CIISLog

In solution Threat Intelligence (NEW): cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"

Analytic Rule
TI Map IP Entity to W3CIISLog

In solution Web Shells Threat Protection:

Analytic Rule Selection Criteria
Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts
SUPERNOVA webshell csMethod == "GET"
csUriQuery contains "args"
csUriQuery contains "clazz"
csUriQuery contains "codes"
csUriQuery contains "method"
csUriStem contains "logoimagehandler.ashx"

Standalone Content:

Analytic Rule Selection Criteria
Anomalous User Agent connection attempt cIP != "::1"
cIP !startswith "192.168."
csUserAgent !in "-,MSRPC"
Exchange SSRF Autodiscover ProxyShell - Detection csUriQuery !has "Protocol"
csUriQuery contains ":"
csUriQuery contains "@"
Exchange Worker Process Making Remote Call
High count of connections by client IP on many ports
High count of failed attempts from same client IP csUserName != "-"
scStatus in "401,403"
High count of failed logons by a user csUserName != "-"
scStatus in "401,403"
Malformed user agent
Silk Typhoon Suspicious Exchange Request csUriQuery startswith "t="

Hunting Queries (16)

In solution Network Threat Protection Essentials:

Hunting Query Selection Criteria
Exploit and Pentest Framework User Agent

In solution Web Shells Threat Protection:

Hunting Query Selection Criteria
Web Shell Activity
Webshell Detection csMethod == "GET"
csReferer has "whoami"
csUriQuery has "whoami"
csUriStem has "whoami"

Standalone Content:

Hunting Query Selection Criteria
Potential IIS brute force cIP != "::1"
cIP !startswith "192.168."
csUserName != "-"
scStatus in "401,403"
scStatus startswith "20"
Potential IIS code injection attempt
Rare User Agent strings cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csUserAgent !in "-,MSRPC"
Same IP address with multiple csUserAgent cIP != "::1"
cIP !startswith "127."
cIP !startswith "192.168."
cIP !startswith "::"
cIP !startswith "fe80"
scStatus !startswith "20"
scStatus !startswith "30"
Suspect Mailbox Export on IIS/OWA cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csUriStem contains "/owa/"
Tracking Privileged Account Rare Activity
URI requests from single client csUserAgent startswith "Mozilla"
Web shell command alert enrichment
Web shell file alert enrichment

GitHub Only:

Hunting Query Selection Criteria
Exchange Server ProxyLogon URIs cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
Exchange Server Suspicious URIs Visited csUriStem == "/ews/exchange.asmx"
Exchange Servers and Associated Security Alerts
Suspected ProxyToken Exploitation cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csCookie has "SecurityToken"
csMethod == "POST"
csUriQuery has "msExchEcpCanary"
csUriStem has "/ecp"

Workbooks (7)

In solution Apache Log4j Vulnerability Detection:

Workbook Selection Criteria
Log4jPostCompromiseHunting

In solution Microsoft Exchange Security - Exchange On-Premises:

Workbook Selection Criteria
Microsoft Exchange Admin Activity

In solution SOC Handbook:

Workbook Selection Criteria
SecurityStatus

GitHub Only:

Workbook Selection Criteria
ExchangeCompromiseHunting cIP !startswith "10."
cIP !startswith "127."
cIP !startswith "172."
cIP !startswith "::"
cIP !startswith "fe80"
csUriQuery startswith "t="
csUriStem == "/ews/exchange.asmx"
Log4jPostCompromiseHunting
SecurityStatus
UserMap

Parsers Using This Table (1)

ASIM Parsers (1)

Parser Schema Product Selection Criteria
ASimWebSessionIIS WebSession Internet Information Services (IIS)

Resource Types

This table collects data from the following Azure resource types:

Selection Criteria Summary (14 criteria, 17 total references)

References by type: 0 connectors, 17 content items, 0 ASIM parsers, 0 other parsers.

Selection Criteria Connectors Content Items ASIM Parsers Other Parsers Total
cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"		 - 3 - - 3
csUserName != "-"
scStatus in "401,403"		 - 2 - - 2
csMethod == "GET"
csUriQuery contains "args"
csUriQuery contains "clazz"
csUriQuery contains "codes"
csUriQuery contains "method"
csUriStem contains "logoimagehandler.ashx"		 - 1 - - 1
cIP != "::1"
cIP !startswith "192.168."
csUserAgent !in "-,MSRPC"		 - 1 - - 1
csUriQuery !has "Protocol"
csUriQuery contains ":"
csUriQuery contains "@"		 - 1 - - 1
csUriQuery startswith "t=" - 1 - - 1
csMethod == "GET"
csReferer has "whoami"
csUriQuery has "whoami"
csUriStem has "whoami"		 - 1 - - 1
cIP != "::1"
cIP !startswith "127."
cIP !startswith "192.168."
cIP !startswith "::"
cIP !startswith "fe80"
scStatus !startswith "20"
scStatus !startswith "30"		 - 1 - - 1
csUriStem == "/ews/exchange.asmx" - 1 - - 1
cIP != "::1"
cIP !startswith "192.168."
csUserName != "-"
scStatus in "401,403"
scStatus startswith "20"		 - 1 - - 1
csUserAgent startswith "Mozilla" - 1 - - 1
cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csUserAgent !in "-,MSRPC"		 - 1 - - 1
cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csUriStem contains "/owa/"		 - 1 - - 1
cIP !startswith "127."
cIP !startswith "::"
cIP !startswith "fe80"
csCookie has "SecurityToken"
csMethod == "POST"
csUriQuery has "msExchEcpCanary"
csUriStem has "/ecp"		 - 1 - - 1
Total 0 17 0 0 17

cIP

Value Connectors Content Items ASIM Parsers Other Parsers Total
!startswith 127. - 7 - - 7
!startswith :: - 7 - - 7
!startswith fe80 - 7 - - 7
!= ::1 - 3 - - 3
!startswith 192.168. - 3 - - 3

csCookie

Value Connectors Content Items ASIM Parsers Other Parsers Total
has SecurityToken - 1 - - 1

csMethod

Value Connectors Content Items ASIM Parsers Other Parsers Total
GET - 2 - - 2
POST - 1 - - 1

csReferer

Value Connectors Content Items ASIM Parsers Other Parsers Total
has whoami - 1 - - 1

csUriQuery

Value Connectors Content Items ASIM Parsers Other Parsers Total
contains args - 1 - - 1
contains clazz - 1 - - 1
contains codes - 1 - - 1
contains method - 1 - - 1
!has Protocol - 1 - - 1
contains : - 1 - - 1
contains @ - 1 - - 1
startswith t= - 1 - - 1
has whoami - 1 - - 1
has msExchEcpCanary - 1 - - 1

csUriStem

Value Connectors Content Items ASIM Parsers Other Parsers Total
contains logoimagehandler.ashx - 1 - - 1
has whoami - 1 - - 1
/ews/exchange.asmx - 1 - - 1
contains /owa/ - 1 - - 1
has /ecp - 1 - - 1

csUserAgent

Value Connectors Content Items ASIM Parsers Other Parsers Total
!= - - 2 - - 2
!= MSRPC - 2 - - 2
startswith Mozilla - 1 - - 1

csUserName

Value Connectors Content Items ASIM Parsers Other Parsers Total
!= - - 3 - - 3

scStatus

Value Connectors Content Items ASIM Parsers Other Parsers Total
401 - 3 - - 3
403 - 3 - - 3
!startswith 20 - 1 - - 1
!startswith 30 - 1 - - 1
startswith 20 - 1 - - 1

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index