iis.yaml

id: iis
metric_id: iis
backend_only: false
facets:
  - facetType: range
    groups:
      - Measure
    name: Duration
    path: duration
    source: log
    type: double
    unit:
      family: time
      name: nanosecond
  - groups:
      - Web Access
    name: Method
    path: http.method
    source: log
  - groups:
      - Web Access
    name: Referer
    path: http.referer
    source: log
  - groups:
      - Web Access
    name: Status Code
    path: http.status_code
    source: log
  - groups:
      - Web Access
    name: URL Host
    path: http.url_details.host
    source: log
  - groups:
      - Web Access
    name: URL Path
    path: http.url_details.path
    source: log
  - groups:
      - Web Access
    name: URL Port
    path: http.url_details.port
    source: log
  - groups:
      - Web Access
    name: URL scheme
    path: http.url_details.scheme
    source: log
  - groups:
      - Web Access
    name: Browser
    path: http.useragent_details.browser.family
    source: log
  - groups:
      - Web Access
    name: Device
    path: http.useragent_details.device.family
    source: log
  - groups:
      - Web Access
    name: OS
    path: http.useragent_details.os.family
    source: log
  - groups:
      - Web Access
    name: Client IP
    path: network.client.ip
    source: log
pipeline:
  type: pipeline
  name: IIS
  enabled: true
  filter:
    query: source:iis
  processors:
    - type: grok-parser
      name: ''
      enabled: true
      source: message
      samples:
        - 2002-05-02 17:42:15 172.22.255.255 GET /images/picture.jpg ?toto=tata 80 toto 123.123.123.123 Mozilla/4.0+(compatible;MSIE+5.5;+Windows+2000+Server) 200 211 322 1234
      grok:
        supportRules: |
          _auth %{notSpace:http.auth:nullIf("-")}
          _bytes_written %{integer:network.bytes_written}
          _bytes_read %{integer:network.bytes_read}
          _client_ip %{ipOrHost:network.client.ip}
          _client_port %{integer:network.client.port}
          _cookie %{notSpace:http.cookie:querystring}
          _date_iis %{date("yyyy-MM-dd HH:mm:ss"):date_access}
          _http_url %{notSpace:http.url}
          _http_version HTTP\/%{regex("\\d+\\.\\d+"):http.version}
          _http_query (?>\?|)%{notSpace:http.url_details.queryString:querystring}
          _ident %{notSpace:http.ident:nullIf("-")}
          _duration %{integer:duration:scale(1000000)}
          _referer %{notSpace:http.referer}
          _server_name %{ipOrHost:http.server_name}
          _server_port %{integer:server.port}
          _server_ip %{ip:server.ip}
          _status_code %{integer:http.status_code}
          _sub_status_code %{integer:http.sub_status_code}
          _user_agent %{regex("[^\\\"]*"):http.useragent}
          _username %{notSpace:user.name}
          _method %{word:http.method}
          _win32_status %{integer:iis.win32_status}
	  _x_forwarded_for %{notSpace:x_forwarded_for}
        matchRules: |
          iis.default %{_date_iis} %{_server_name} %{_method} %{_http_url} %{_http_query} %{_client_port} %{_auth} %{_client_ip} %{_user_agent} %{_status_code} %{_sub_status_code} %{_win32_status} %{_duration} ?{_x_forwarded_for}

          iis.fully_expanded %{_date_iis} %{_ident} %{word:hostname} %{_server_ip} %{_method} %{_http_url} %{_http_query} %{_server_port} %{_username} %{_client_ip} %{_http_version} %{_user_agent} %{_cookie} %{_referer} %{_server_name} %{_status_code} %{_sub_status_code} %{_win32_status} %{_bytes_written} %{_bytes_read} %{_duration} ?{_x_forwarded_for}

    - type: user-agent-parser
      name: ''
      enabled: true
      sources:
        - http.useragent
      target: http.useragent_details
      encoded: true
    - type: url-parser
      name: ''
      enabled: true
      sources:
        - http.url
      target: http.url_details
    - type: date-remapper
      name: Define `date_access` as the official date of the log
      enabled: true
      sources:
        - date_access
    - type: category-processor
      name: Categorise status code
      enabled: true
      categories:
        - filter:
            query: '@http.status_code:[200 TO 299]'
          name: OK
        - filter:
            query: '@http.status_code:[300 TO 399]'
          name: notice
        - filter:
            query: '@http.status_code:[400 TO 499]'
          name: warning
        - filter:
            query: '@http.status_code:[500 TO 599]'
          name: error
      target: http.status_category
    - type: status-remapper
      name: Define `http.status_category` as the official status of the log
      enabled: true
      sources:
        - http.status_category
    - type: pipeline
      name: OCSF sub pipeline for HTTP Activity [4002]
      enabled: true
      ocsf:
        isOcsf: true
      filter:
        query: "@http.method:*"
      processors:
        - type: string-builder-processor
          name: Add ocsf.metadata.product.name
          enabled: true
          template: "iis"
          target: ocsf.metadata.product.name
          replaceMissing: false
        - type: string-builder-processor
          name: Add ocsf.metadata.product.vendor_name
          enabled: true
          template: "Microsoft"
          target: ocsf.metadata.product.vendor_name
          replaceMissing: false
        - type: grok-parser
          name: Parsing `ocsf.http_request.url.query_string` from `http.url`
          enabled: true
          source: http.url
          samples:
            - /datadoghq/company?test=var1%20Pl
          grok:
            supportRules: ""
            matchRules: |
              extract_query_string %{regex("[^?]+")}\?%{regex(".*"):ocsf.http_request.url.query_string}
        - type: schema-processor
          name: Apply OCSF schema for 4002
          enabled: true
          mappers:
            - type: schema-category-mapper
              name: ocsf.activity_id
              categories:
                - filter:
                    query: "@http.method:CONNECT"
                  name: Connect
                  id: 1
                - filter:
                    query: "@http.method:DELETE"
                  name: Delete
                  id: 2
                - filter:
                    query: "@http.method:GET"
                  name: Get
                  id: 3
                - filter:
                    query: "@http.method:HEAD"
                  name: Head  
                  id: 4
                - filter:
                    query: "@http.method:OPTIONS"
                  name: Options
                  id: 5
                - filter:
                    query: "@http.method:POST"
                  name: Post
                  id: 6
                - filter:
                    query: "@http.method:PUT"
                  name: Put
                  id: 7
                - filter:
                    query: "@http.method:TRACE"
                  name: Trace
                  id: 8
                - filter:
                    query: "@http.method:PATCH"
                  name: Patch
                  id: 9
                - filter:
                    query: "@http.method:*"
                  name: Other
                  id: 99
              targets:
                name: ocsf.activity_name
                id: ocsf.activity_id
            - type: schema-category-mapper
              name: ocsf.severity_id
              categories:
                - filter:
                    query: "@http.method:*"
                  name: Informational
                  id: 1
              targets:
                name: ocsf.severity
                id: ocsf.severity_id
            - type: schema-category-mapper
              name: ocsf.status_id
              categories:
                - filter:
                    query: "@http.status_code:[200 TO 399]"
                  name: Success
                  id: 1
                - filter:
                    query: "@http.status_code:[400 TO 599]"
                  name: Failure
                  id: 2
                - filter:
                    query: "*"
                  name: Unknown
                  id: 99
              targets:
                name: ocsf.status
                id: ocsf.status_id
            - type: schema-remapper
              name: Map `http.server_name` to `ocsf.dst_endpoint.ip`
              sources:
                - http.server_name
              target: ocsf.dst_endpoint.ip
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.method` to `ocsf.http_request.http_method`
              sources:
                - http.method
              target: ocsf.http_request.http_method
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.referer` to `ocsf.http_request.referrer`
              sources:
                - http.referer
              target: ocsf.http_request.referrer
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.url_details.path` to `ocsf.http_request.url.path`
              sources:
                - http.url_details.path
              target: ocsf.http_request.url.path
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.url_details.port` to `ocsf.http_request.url.port`
              sources:
                - http.url_details.port
              target: ocsf.http_request.url.port
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `ocsf.http_request.url.query_string` to `ocsf.http_request.url.query_string`
              sources:
                - ocsf.http_request.url.query_string
              target: ocsf.http_request.url.query_string
              preserveSource: true
              overrideOnConflict: true  
            - type: schema-remapper
              name: Map `http.useragent` to `ocsf.http_request.user_agent`
              sources:
                - http.useragent
              target: ocsf.http_request.user_agent
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.status_code` to `ocsf.http_response.code`
              sources:
                - http.status_code
              target: ocsf.http_response.code
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.status_category` to `ocsf.http_response.status`
              sources:
                - http.status_category
              target: ocsf.http_response.status
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.method` to `ocsf.metadata.event_code`
              sources:
                - http.method
              target: ocsf.metadata.event_code
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `network.client.ip` to `ocsf.src_endpoint.ip`
              sources:
                - network.client.ip
              target: ocsf.src_endpoint.ip
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `http.useragent_details.os.family` to `ocsf.src_endpoint.os.name`
              sources:
                - http.useragent_details.os.family
              target: ocsf.src_endpoint.os.name
              preserveSource: true
              overrideOnConflict: true
            - type: schema-category-mapper
              name: ocsf.src_endpoint.os.type_id
              categories:
                - filter:
                    query: "@http.useragent_details.os.family:Windows"
                  name: Windows
                  id: 100
                - filter:
                    query: '@http.useragent_details.os.family:(Linux OR "Red Hat" OR Ubuntu OR Debian OR Fedora OR CentOS OR *BSD*)'
                  name: Linux
                  id: 200
                - filter:
                    query: "@http.useragent_details.os.family:Android"
                  name: Android
                  id: 201
                - filter:
                    query: '@http.useragent_details.os.family:("Mac OS X" OR macOS)'
                  name: macOS
                  id: 300
                - filter:
                    query: "@http.useragent_details.os.family:iOS"
                  name: Ios
                  id: 301
                - filter:
                    query: "@http.useragent_details.os.family:*"
                  name: Other
                  id: 99
              targets:
                name: ocsf.src_endpoint.os.type
                id: ocsf.src_endpoint.os.type_id
            - type: schema-remapper
              name: Map `http.status_code` to `ocsf.status_code`
              sources:
                - http.status_code
              target: ocsf.status_code
              preserveSource: true
              targetFormat: string
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `duration` to `ocsf.duration`
              sources:
                - duration
              target: ocsf.duration
              preserveSource: true
              targetFormat: double
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `ocsf.metadata.product.name` to `ocsf.metadata.product.name`
              sources:
                - ocsf.metadata.product.name
              target: ocsf.metadata.product.name
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `ocsf.metadata.product.vendor_name` to `ocsf.metadata.product.vendor_name`
              sources:
                - ocsf.metadata.product.vendor_name
              target: ocsf.metadata.product.vendor_name
              preserveSource: true
              overrideOnConflict: true
            - type: schema-remapper
              name: Map `date_access` to `ocsf.time`
              sources:
                - date_access
              target: ocsf.time
              preserveSource: true
              overrideOnConflict: true
          schema:
            schemaType: ocsf
            version: 1.5.0
            className: HTTP Activity
            classUid: 4002
            extensions: []
            profiles: []