W3CIISLog

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Reference for W3CIISLog table in Azure Monitor Logs.

Attribute	Value
Category	IT & Management Tools, Virtual Machines
Basic Logs Eligible	✗ No (source)
Supports Transformations	✓ Yes (source)
Ingestion API Supported	✗ No
Azure Monitor Tables Reference	View Documentation

Schema
Solutions
Connectors
Content Items
Parsers
Resource Types

Schema (44 columns)

Source: Azure Monitor documentation

Column Name	Type	Description
_BilledSize	real	The record size in bytes
_IsBillable	string	Specifies whether ingesting the data is billable. When _IsBillable isfalseingestion isn't billed to your Azure account
_ResourceId	string	A unique identifier for the resource that the record is associated with
_SubscriptionId	string	A unique identifier for the subscription that the record is associated with
AzureDeploymentID	string	Azure deployment ID of the cloud service the log belongs to. Only populated when events are collected using Azure Diagnostics agent when data is pulled from Azure storage.
cIP	string	IP address of the client that accessed the web server.
Computer	string	Name of the computer that the event was collected from.
Confidence	string	Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
csBytes	long	Number of bytes that the server received.
csCookie	string	Content of the cookie sent or received if any.
csHost	string	Host header name if any.
csMethod	string	Method of the request such as GET or POST.
csReferer	string	Site that the user last visited. This site provided a link to the current site.
csUriQuery	string	The query if any that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages.
csUriStem	string	Target of the action such as a web page for example Default.htm.
csUserAgent	string	Browser type of the client.
csUserName	string	Name of the authenticated user that accessed the server. Anonymous users are indicated by a hyphen.
csVersion	string	Protocol version that the client used.
Description	string	Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
FirstReportedDateTime	string	Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
IndicatorThreatType	string	Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
IsActive	string	Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
LastReportedDateTime	string	Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
MaliciousIP	string	Only populated for IIS logs collected from Azure Cloud Services (through Azure Diagnostics Extension).
ManagementGroupName	string	Name of the management group for Operations Manager agents. For other agents this is AOI-.
RemoteIPCountry	string	Country/region of the IP address of the client.
RemoteIPLatitude	real	Latitude of the client IP address.
RemoteIPLongitude	real	Longitude of the client IP address.
Role	string	Role instance of the cloud service the log belongs to. Only populated when events are collected using Azure Diagnostics agent and data is pulled from Azure storage.
RoleInstance	string	Role of the cloud service the log belongs to. Only populated when events are collected using Azure Diagnostics agent and data is pulled from Azure storage.
scBytes	long	Number of bytes that the server sent.
scStatus	string	HTTP status code.
scSubStatus	string	Substatus error code.
scWin32Status	string	Windows status code.
Severity	int	Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
sIP	string	IP address of the server on which the log file entry was generated.
SourceSystem	string	The type of agent the event was collected by. For example,OpsManagerfor Windows agent, either direct connect or Operations Manager,Linuxfor all Linux agents, orAzurefor Azure Diagnostics
sPort	int	Server port number that is configured for the service.
sSiteName	string	Name of the IIS site.
StorageAccount	string	Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
TimeGenerated	datetime	Date and time the record was created.
TimeTaken	long	Length of time to process the request in milliseconds.
TLPLevel	string	Only populated for IIS logs collected from Azure Cloud Services through Azure Diagnostics Extension.
Type	string	The name of the table

Solutions (8)

This table is used by the following solutions:

Connectors (2)

This table is ingested by the following connectors:

Connector	Selection Criteria
[Deprecated] Microsoft Exchange Logs and Events
IIS Logs of Microsoft Exchange Servers

Content Items Using This Table (38)

Analytic Rules (15)

In solution Apache Log4j Vulnerability Detection:

Analytic Rule	Selection Criteria
Log4j vulnerability exploit aka Log4Shell IP IOC
User agent search for log4j exploitation attempt

In solution Network Threat Protection Essentials:

Analytic Rule	Selection Criteria
New UserAgent observed in last 24 hours

In solution Threat Intelligence:

Analytic Rule	Selection Criteria
TI Map IP Entity to W3CIISLog

In solution Threat Intelligence (NEW):

Analytic Rule	Selection Criteria
TI Map IP Entity to W3CIISLog

In solution Web Shells Threat Protection:

Analytic Rule	Selection Criteria
Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts
SUPERNOVA webshell

Standalone Content:

Analytic Rule	Selection Criteria
Anomalous User Agent connection attempt
Exchange SSRF Autodiscover ProxyShell - Detection
Exchange Worker Process Making Remote Call
High count of connections by client IP on many ports
High count of failed attempts from same client IP
High count of failed logons by a user
Malformed user agent
Silk Typhoon Suspicious Exchange Request

Hunting Queries (16)

In solution Network Threat Protection Essentials:

Hunting Query	Selection Criteria
Exploit and Pentest Framework User Agent

In solution Web Shells Threat Protection:

Hunting Query	Selection Criteria
Web Shell Activity
Webshell Detection

Standalone Content:

Hunting Query	Selection Criteria
Potential IIS brute force
Potential IIS code injection attempt
Rare User Agent strings
Same IP address with multiple csUserAgent
Suspect Mailbox Export on IIS/OWA
Tracking Privileged Account Rare Activity
URI requests from single client
Web shell command alert enrichment
Web shell file alert enrichment

GitHub Only:

Hunting Query	Selection Criteria
Exchange Server ProxyLogon URIs
Exchange Server Suspicious URIs Visited
Exchange Servers and Associated Security Alerts
Suspected ProxyToken Exploitation

Workbooks (7)

In solution Apache Log4j Vulnerability Detection:

Workbook	Selection Criteria
Log4jPostCompromiseHunting

In solution Microsoft Exchange Security - Exchange On-Premises:

Workbook	Selection Criteria
Microsoft Exchange Admin Activity

In solution SOC Handbook:

Workbook	Selection Criteria
SecurityStatus

GitHub Only:

Workbook	Selection Criteria
ExchangeCompromiseHunting
Log4jPostCompromiseHunting
SecurityStatus
UserMap

Parsers Using This Table (1)

ASIM Parsers (1)

Parser	Schema	Product	Selection Criteria
ASimWebSessionIIS	WebSession	Internet Information Services (IIS)

Resource Types

This table collects data from the following Azure resource types:

microsoft.compute/virtualmachines
microsoft.conenctedvmwarevsphere/virtualmachines
microsoft.azurestackhci/virtualmachines
microsoft.scvmm/virtualmachines
microsoft.compute/virtualmachinescalesets