HTTP Requests 2

Vendor Documentation

https://docs.microsoft.com/en-us/previous-versions/iis/6.0-sdk/ms525807(v=vs.90)

Classification

Rule Name	Rule Type	Common Event	Classification
HTTP Requests	Base Rule	Web Request	Network Traffic
GET Request	Sub Rule	HTTP GET Method Event	Information
HEAD Request	Sub Rule	HTTP HEAD Request	Information
POST Request	Sub Rule	HTTP POST Method Event	Information
HTTP - 440 - Client Error - Login Timeout	Sub Rule	HTTP 440 : Request Error - Login Timeout	Error
HTTP - 207 - Success - Multistatus Response	Sub Rule	HTTP 207 : Success - Multistatus Response	Information
HTTP - 100 - Transitional - Continue	Sub Rule	HTTP 100 : Transition Status - Continue	Information
HTTP - 101 - Transitional - Protocol Switch	Sub Rule	HTTP 101 : Transition Status - Protocol Switch	Information
HTTP - 200 - Success - OK	Sub Rule	HTTP 200 : Success Reply - OK	Information
HTTP - 201 - Success - Created	Sub Rule	HTTP 201 : Success Reply - Created	Information
HTTP - 202 - Success - Accepted	Sub Rule	HTTP 202 : Success Reply - Accepted	Information
HTTP - 203 - Success - Nonauthoritative Info	Sub Rule	HTTP 203 : Success Reply - Nonauthoritative Info	Information
HTTP - 204 - Success - No Content	Sub Rule	HTTP 204 : Success Reply - No Content	Information
HTTP - 205 - Success - Reset Content	Sub Rule	HTTP 205 : Success Reply - Reset Content	Information
HTTP - 206 - Success - Partial Content	Sub Rule	HTTP 206 : Success Reply - Partial Content	Information
HTTP - 300 - Redirect - Multiple Choices	Sub Rule	HTTP 300 : Redirect - Multiple Choices	Information
HTTP - 301 - Redirect - Moved Permanently	Sub Rule	HTTP 301 : Redirect - Moved Permanently	Information
HTTP - 302 - Redirect - Moved Temporarily	Sub Rule	HTTP 302 : Redirect - Moved Temporarily	Information
HTTP - 303 - Redirect - See Other	Sub Rule	HTTP 303 : Redirect - See Other	Information
HTTP - 304 - Redirect - Not Modified	Sub Rule	HTTP 304 : Redirect - Not Modified	Information
HTTP - 305 - Redirect - Use Proxy	Sub Rule	HTTP 305 : Redirect - Use Proxy	Information
HTTP - 306 - Redirect - Unused	Sub Rule	HTTP 306 : Redirect - Unused	Information
HTTP - 307 - Redirect - Temporary Redirect	Sub Rule	HTTP 307 : Redirect - Temporary Redirect	Information
HTTP - 400 - Req Error - Bad Request	Sub Rule	HTTP 400 : Request Error - Bad Request	Error
HTTP - 401 - Req Error - Unauthorized	Sub Rule	HTTP 401 : Request Error - Unauthorized	Error
HTTP - 402 - Req Error - Payment Required	Sub Rule	HTTP 402 : Request Error - Payment Required	Error
HTTP - 403 - Req Error - Forbidden	Sub Rule	HTTP 403 : Request Error - Forbidden	Error
HTTP - 404 - Req Error - Not Found	Sub Rule	HTTP 404 : Request Error - Not Found	Error
HTTP - 405 - Req Error - Method Not Allowed	Sub Rule	HTTP 405 : Request Error - Method Not Allowed	Error
HTTP - 406 - Req Error - Not Acceptable	Sub Rule	HTTP 406 : Request Error - Not Acceptable	Error
HTTP - 407 - Req Error - Proxy Auth Requested	Sub Rule	HTTP 407 : Request Error - Proxy Auth Required	Error
HTTP - 408 - Req Error - Request Time-Out	Sub Rule	HTTP 408 : Request Error - Request Time-Out	Error
HTTP - 409 - Req Error - Conflict	Sub Rule	HTTP 409 : Request Error - Conflict	Error
HTTP - 410 - Req Error - Gone	Sub Rule	HTTP 410 : Request Error - Gone	Error
HTTP - 411 - Req Error - Length Required	Sub Rule	HTTP 411 : Request Error - Length Required	Error
HTTP - 412 - Req Error - Precondition Failed	Sub Rule	HTTP 412 : Request Error - Precondition Failed	Error
HTTP - 413 - Req Error - Request Item Too Big	Sub Rule	HTTP 413 : Request Error - Request Item Too Big	Error
HTTP - 414 - Req Error - Request-URL Too Large	Sub Rule	HTTP 414 : Request Error - Request-URL Too Large	Error
HTTP - 415 - Req Error - Unsupported Type	Sub Rule	HTTP 415 : Request Error - Unsupported Type	Error
HTTP - 416 - Req Error - Requested Rng Unfillable	Sub Rule	HTTP 416 : Request Error - Range Unfillable	Error
HTTP - 417 - Req Error - Expectation Failed	Sub Rule	HTTP 417 : Request Error - Expectation Failed	Error
HTTP - 500 - Svr Error - Internal Server Error	Sub Rule	HTTP 500 : Server Error - Internal Server Error	Error
HTTP - 501 - Svr Error - Not Implemented	Sub Rule	HTTP 501 : Server Error - Not Implemented	Error
HTTP - 502 - Svr Error - Bad Gateway	Sub Rule	HTTP 502 : Server Error - Bad Gateway	Error
HTTP - 503 - Svr Error - Service Unavailable	Sub Rule	HTTP 503 : Server Error - Service Unavailable	Error
HTTP - 504 - Svr Error - Gateway Time-Out	Sub Rule	HTTP 504 : Server Error - Gateway Time-Out	Error
HTTP - 505 - Svr Error - HTTP Ver Unsupported	Sub Rule	HTTP 505 : Server Error - HTTP Ver Unsupported	Error

Mapping with LogRhythm Schema

Device Key in Log Message	LogRhythm Schema	Data Type
N/A	<vmid>	Number
N/A	<sip>	Number
N/A	<dip>	Number
N/A	<dport>	Number
N/A	<snatip>	Number
N/A	<login>	Number/Text
N/A	<domainorigin>	Number/Text
N/A	<object>	Number/Text
N/A	<objectname>	Text/String
N/A	<subject>	Text/String
N/A	<useragent>	Number/Text
N/A	<url>	Number/Text
N/A	<command>	Text/String
N/A	<responsecode>	Number
N/A	<duration>	Number
N/A	<tag1>	Text/String
N/A	<tag2>	Number