V 2.0 : IIS W3C Events
Vendor Documentation
Classification
Rule Name | Rule Type | Common Event | Classification |
---|---|---|---|
V 2.0 : IIS W3C Events | Base Rule | General IIS Activity | Information |
V 2.0 : HTTP POST 400 : Bad Request | Sub Rule | HTTP 400 : Bad Request | Error |
V 2.0 : HTTP POST 401 : Unauthorized | Sub Rule | HTTP 401 : Unauthorized | Error |
V 2.0 : HTTP POST 402 : Request Err - Payment Req | Sub Rule | HTTP 402 : Request Error - Payment Required | Error |
V 2.0 : HTTP POST 403 : Forbidden | Sub Rule | HTTP 403 : Forbidden | Error |
V 2.0 : HTTP POST 404 : Not Found | Sub Rule | HTTP 404 : Not Found | Error |
V 2.0 : HTTP POST 405 : Method Not Allowed | Sub Rule | HTTP 405 : Method Not Allowed | Error |
V 2.0 : HTTP POST 406 : Not Acceptable | Sub Rule | HTTP 406 : Not Acceptable | Error |
V 2.0 : HTTP POST 407 : Proxy Authentication Req | Sub Rule | HTTP 407 : Proxy Authentication Required | Error |
V 2.0 : HTTP POST 408 : Request Timeout | Sub Rule | HTTP 408 : Request Timeout | Error |
V 2.0 : HTTP POST 409 : Conflict | Sub Rule | HTTP 409 : Conflict | Error |
V 2.0 : HTTP POST 410 : Gone | Sub Rule | HTTP 410 : Gone | Error |
V 2.0 : HTTP POST 411 : Length Required | Sub Rule | HTTP 411 : Length Required | Error |
V 2.0 : HTTP POST 412 : Precondition Failed | Sub Rule | HTTP 412 : Precondition Failed | Error |
V 2.0 : HTTP POST 413 : Request Entity Too Large | Sub Rule | HTTP 413 : Request Entity Too Large | Error |
V 2.0 : HTTP POST 414 : Request-URI Too Long | Sub Rule | HTTP 414 : Request-URI Too Long | Error |
V 2.0 : HTTP POST 415 : Unsupported Media Type | Sub Rule | HTTP 415 : Unsupported Media Type | Error |
V 2.0 : HTTP POST 416 : Requested Range Not Satisf | Sub Rule | HTTP 416 : Requested Range Not Satisfiable | Error |
V 2.0 : HTTP POST 417 : Expectation Failed | Sub Rule | HTTP 417 : Expectation Failed | Error |
V 2.0 : HTTP POST 440 : Req Error - Login Timeout | Sub Rule | HTTP 440 : Request Error - Login Timeout | Error |
V 2.0 : HTTP POST 500 :Server Err - Int Server Err | Sub Rule | HTTP 500 : Server Error - Internal Server Error | Error |
V 2.0 : HTTP POST 501 : Server Err - Not Implement | Sub Rule | HTTP 501 : Server Error - Not Implemented | Error |
V 2.0 : HTTP POST 502 : Server Error - Bad Gateway | Sub Rule | HTTP 502 : Server Error - Bad Gateway | Error |
V 2.0 : HTTP POST 503 : Service Unavailable | Sub Rule | HTTP 503 : Service Unavailable | Error |
V 2.0 : HTTP POST 504 : Server Err -Gateway Timeout | Sub Rule | HTTP 504 : Server Error - Gateway Time-Out | Error |
V 2.0 : HTTP POST 505 : Server Err -HTTP Ver Unsupp | Sub Rule | HTTP 505 : Server Error - HTTP Ver Unsupported | Error |
V 2.0 : HTTP POST 995 : SSL Operation Aborted | Sub Rule | HTTP 995 : Request Error - SSL Operation Aborted | Error |
V 2.0 : HTTP POST 100 : Continue | Sub Rule | HTTP 100 : Continue | Information |
V 2.0 : HTTP POST 101 : Transition Status- Protocol | Sub Rule | HTTP 101 : Transition Status - Protocol Switch | Information |
V 2.0 : HTTP POST 200 : Success Reply - OK | Sub Rule | HTTP 200 : Success Reply - OK | Information |
V 2.0 : HTTP POST 201 : Success Reply - Created | Sub Rule | HTTP 201 : Success Reply - Created | Information |
V 2.0 : HTTP POST 202 : Success Reply - Accepted | Sub Rule | HTTP 202 : Success Reply - Accepted | Information |
V 2.0 : HTTP POST 203 : Success Reply - Non-auth | Sub Rule | HTTP 203 : Success Reply - Nonauthoritative Info | Information |
V 2.0 : HTTP POST 204 : Success Reply - No Content | Sub Rule | HTTP 204 : Success Reply - No Content | Information |
V 2.0 : HTTP POST 205 : Success Reply-Reset Content | Sub Rule | HTTP 205 : Success Reply - Reset Content | Information |
V 2.0 :HTTP POST 206 : Success Rep -Partial Content | Sub Rule | HTTP 206 : Success Reply - Partial Content | Information |
V 2.0 : HTTP POST 207 : Success - Multistatus Resp | Sub Rule | HTTP 207 : Success - Multistatus Response | Information |
V 2.0 : HTTP POST 300 : Redirect - Multiple Choice | Sub Rule | HTTP 300 : Redirect - Multiple Choices | Information |
V 2.0 : HTTP POST 301 : Redirect - Moved Permanent | Sub Rule | HTTP 301 : Redirect - Moved Permanently | Information |
V 2.0 : HTTP POST 302 : Redirect - Moved Temporary | Sub Rule | HTTP 302 : Redirect - Moved Temporarily | Information |
V 2.0 : HTTP POST 303 : Redirect - See Other | Sub Rule | HTTP 303 : Redirect - See Other | Information |
V 2.0 : HTTP POST 304 : Redirect - Not Modified | Sub Rule | HTTP 304 : Redirect - Not Modified | Information |
V 2.0 : HTTP POST 305 : Redirect - Use Proxy | Sub Rule | HTTP 305 : Redirect - Use Proxy | Information |
V 2.0 : HTTP POST 306 : Redirect - Unused | Sub Rule | HTTP 306 : Redirect - Unused | Information |
V 2.0 :HTTP POST 307 : Redirect -Temporary Redirect | Sub Rule | HTTP 307 : Redirect - Temporary Redirect | Information |
V 2.0 : HTTP GET 100 : Transitional - Continue | Sub Rule | HTTP 100 : Continue | Information |
V 2.0 : HTTP GET 101 : Transitional - Proto Switch | Sub Rule | HTTP 101 : Transition Status - Protocol Switch | Information |
V 2.0 : HTTP GET 200 : Success - OK | Sub Rule | HTTP 200 : Success Reply - OK | Information |
V 2.0 : HTTP GET 201 : Success - Created | Sub Rule | HTTP 201 : Success Reply - Created | Information |
V 2.0 : HTTP GET 202 : Success - Accepted | Sub Rule | HTTP 202 : Success Reply - Accepted | Information |
V 2.0 : HTTP GET 203 : Success - Nonauthoritative | Sub Rule | HTTP 203 : Success Reply - Nonauthoritative Info | Information |
V 2.0 : HTTP GET 204 : Success - No Content | Sub Rule | HTTP 204 : Success Reply - No Content | Information |
V 2.0 : HTTP GET 205 : Success - Reset Content | Sub Rule | HTTP 205 : Success Reply - Reset Content | Information |
V 2.0 : HTTP GET 206 : Success - Partial Content | Sub Rule | HTTP 206 : Success Reply - Partial Content | Information |
V 2.0 : HTTP GET 207 : Success - Mult Response | Sub Rule | HTTP 207 : Success - Multistatus Response | Information |
V 2.0 : HTTP GET 300 : Redirect - Multiple Choices | Sub Rule | HTTP 300 : Redirect - Multiple Choices | Information |
V 2.0 : HTTP GET 301 : Redirect - Moved Permanentl | Sub Rule | HTTP 301 : Redirect - Moved Permanently | Information |
V 2.0 : HTTP GET 302 : Redirect- Moved Temporarily | Sub Rule | HTTP 302 : Redirect - Moved Temporarily | Information |
V 2.0 : HTTP GET 303 : Redirect - See Other | Sub Rule | HTTP 303 : Redirect - See Other | Information |
V 2.0 : HTTP GET 304 : Redirect - Not Modified | Sub Rule | HTTP 304 : Redirect - Not Modified | Information |
V 2.0 : HTTP GET 305 : Redirect - Use Proxy | Sub Rule | HTTP 305 : Redirect - Use Proxy | Information |
V 2.0 : HTTP GET 306 : Redirect - Unused | Sub Rule | HTTP 306 : Redirect - Unused | Information |
V 2.0 : HTTP GET 307 : Redirect-Temporary Redirect | Sub Rule | HTTP 307 : Redirect - Temporary Redirect | Information |
V 2.0 : HTTP GET 400 : Req Error - Bad Request | Sub Rule | HTTP 400 : Bad Request | Error |
V 2.0 : HTTP GET 401 : Req Error - Unauthorized | Sub Rule | HTTP 401 : Unauthorized | Error |
V 2.0 : HTTP GET 402 : Req Error-Payment Required | Sub Rule | HTTP 402 : Request Error - Payment Required | Error |
V 2.0 : HTTP GET 403 : Req Error - Forbidden | Sub Rule | HTTP 403 : Forbidden | Error |
V 2.0 : HTTP GET 404 : Req Error - Not Found | Sub Rule | HTTP 404 : Not Found | Error |
V 2.0 : HTTP GET 405 : Req Error-Method Not Allowed | Sub Rule | HTTP 405 : Request Error - Method Not Allowed | Error |
V 2.0 : HTTP GET 406 : Req Error - Not Acceptable | Sub Rule | HTTP 406 : Not Acceptable | Error |
V 2.0 : HTTP GET 407 : Req Error-Proxy Auth Request | Sub Rule | HTTP 407 : Request Error - Proxy Auth Required | Error |
V 2.0 : HTTP GET 408 : Req Error -Request Time Out | Sub Rule | HTTP 408 : Request Error - Request Time-Out | Error |
V 2.0 : HTTP GET 409 : Req Error - Conflict | Sub Rule | HTTP 409 : Request Error - Conflict | Error |
V 2.0 : HTTP GET 410 : Req Error - Gone | Sub Rule | HTTP 410 : Request Error - Gone | Error |
V 2.0 : HTTP GET 411 : Req Error - Length Required | Sub Rule | HTTP 411 : Request Error - Length Required | Error |
V 2.0 :HTTP GET 412 : Req Error-Precondition Failed | Sub Rule | HTTP 412 : Request Error - Precondition Failed | Error |
V 2.0 : HTTP GET 413 : Req Error-Req Item Too Big | Sub Rule | HTTP 413 : Request Error - Request Item Too Big | Error |
V 2.0 : HTTP GET 414 : Req Error-Req URL Too Large | Sub Rule | HTTP 414 : Request-URI Too Long | Error |
V 2.0 : HTTP GET 415 : Req Error -Unsupported Type | Sub Rule | HTTP 415 : Request Error - Unsupported Type | Error |
V 2.0 :HTTP GET 416 : Req Error-Req Rng Unfillable | Sub Rule | HTTP 416 : Request Error - Range Unfillable | Error |
V 2.0 : HTTP GET 417 : Req Error -Expectation Failed | Sub Rule | HTTP 417 : Request Error - Expectation Failed | Error |
V 2.0 : HTTP GET 440 : Client Error -Login Timeout | Sub Rule | HTTP 440 : Request Error - Login Timeout | Error |
V 2.0 : HTTP GET 500 : Svr Err -Internal Server Err | Sub Rule | HTTP 500 : Server Error - Internal Server Error | Error |
V 2.0 : HTTP GET 501 : Svr Error - Not Implemented | Sub Rule | HTTP 501 : Server Error - Not Implemented | Error |
V 2.0 : HTTP GET 502 : Svr Error - Bad Gateway | Sub Rule | HTTP 502 : Server Error - Bad Gateway | Error |
V 2.0 : HTTP GET 503 : Svr Err-Service Unavailable | Sub Rule | HTTP 503 : Server Error - Service Unavailable | Error |
V 2.0 : HTTP GET 504 : Svr Error -Gateway Time Out | Sub Rule | HTTP 504 : Server Error - Gateway Time-Out | Error |
V 2.0 :HTTP GET 505 : Svr Error-HTTP Ver Unsupported | Sub Rule | HTTP 505 : Server Error - HTTP Ver Unsupported | Error |
V 2.0 : GET Request | Sub Rule | HTTP GET Method Event | Information |
V 2.0 : POST Request | Sub Rule | HTTP POST Method Event | Information |
V 2.0 : RPC_OUT_DATA: 200 - OK | Sub Rule | HTTP 200 : Success Reply - OK | Information |
V 2.0 : RPC_IN_DATA: 404 - Not Found | Sub Rule | HTTP 404 : Not Found | Error |
V 2.0 : RPC_OUT_DATA: 404 - Not Found | Sub Rule | HTTP 404 : Not Found | Error |
V 2.0 : RPC_IN_DATA: 200 - OK | Sub Rule | HTTP 200 : Success Reply - OK | Information |
V 2.0 : PROPFIND Request | Sub Rule | Webdav Protocol PROPFIND Method | Activity |
V 2.0 : HEAD Request | Sub Rule | HTTP Head | Activity |
V 2.0 : HTTP 440 : Client Error - Login Timeout | Sub Rule | HTTP 440 : Request Error - Login Timeout | Error |
V 2.0 : HTTP 207 : Success - Multistatus Response | Sub Rule | HTTP 207 : Success - Multistatus Response | Information |
V 2.0 : HTTP 100 : Transitional - Continue | Sub Rule | HTTP 100 : Transition Status - Continue | Information |
V 2.0 : HTTP 101 : Transitional - Protocol Switch | Sub Rule | HTTP 101 : Transition Status - Protocol Switch | Information |
V 2.0 : HTTP 200 : Success - OK | Sub Rule | HTTP 200 : Success Reply - OK | Information |
V 2.0 : HTTP 201 : Success - Created | Sub Rule | HTTP 201 : Success Reply - Created | Information |
V 2.0 : HTTP 202 : Success - Accepted | Sub Rule | HTTP 202 : Success Reply - Accepted | Information |
V 2.0 : HTTP 203 : Success - Nonauthoritative Info | Sub Rule | HTTP 203 : Success Reply - Nonauthoritative Info | Information |
V 2.0 : HTTP 204 : Success - No Content | Sub Rule | HTTP 204 : Success Reply - No Content | Information |
V 2.0 : HTTP 205 : Success - Reset Content | Sub Rule | HTTP 205 : Success Reply - Reset Content | Information |
V 2.0 : HTTP 206 : Success - Partial Content | Sub Rule | HTTP 206 : Success Reply - Partial Content | Information |
V 2.0 : HTTP 300 : Redirect - Multiple Choices | Sub Rule | HTTP 300 : Redirect - Multiple Choices | Information |
V 2.0 : HTTP 301 : Redirect - Moved Permanently | Sub Rule | HTTP 301 : Redirect - Moved Permanently | Information |
V 2.0 : HTTP 302 : Redirect - Moved Temporarily | Sub Rule | HTTP 302 : Redirect - Moved Temporarily | Information |
V 2.0 : HTTP 303 : Redirect - See Other | Sub Rule | HTTP 303 : Redirect - See Other | Information |
V 2.0 : HTTP 304 : Redirect - Not Modified | Sub Rule | HTTP 304 : Redirect - Not Modified | Information |
V 2.0 : HTTP 305 : Redirect - Use Proxy | Sub Rule | HTTP 305 : Redirect - Use Proxy | Information |
V 2.0 : HTTP 306 : Redirect - Unused | Sub Rule | HTTP 306 : Redirect - Unused | Information |
V 2.0 : HTTP 307 : Redirect - Temporary Redirect | Sub Rule | HTTP 307 : Redirect - Temporary Redirect | Information |
V 2.0 : HTTP 400 : Req Error - Bad Request | Sub Rule | HTTP 400 : Request Error - Bad Request | Error |
V 2.0 : HTTP 401 : Req Error - Unauthorized | Sub Rule | HTTP 401 : Request Error - Unauthorized | Error |
V 2.0 : HTTP 402 : Req Error - Payment Required | Sub Rule | HTTP 402 : Request Error - Payment Required | Error |
V 2.0 : HTTP 403 : Req Error - Forbidden | Sub Rule | HTTP 403 : Request Error - Forbidden | Error |
V 2.0 : HTTP 404 : Req Error - Not Found | Sub Rule | HTTP 404 : Request Error - Not Found | Error |
V 2.0 : HTTP 405 : Req Error - Method Not Allowed | Sub Rule | HTTP 405 : Request Error - Method Not Allowed | Error |
V 2.0 : HTTP 406 : Req Error - Not Acceptable | Sub Rule | HTTP 406 : Request Error - Not Acceptable | Error |
V 2.0 : HTTP 407 : Req Error -Proxy Auth Requested | Sub Rule | HTTP 407 : Request Error - Proxy Auth Required | Error |
V 2.0 : HTTP 408 : Req Error - Request Time Out | Sub Rule | HTTP 408 : Request Error - Request Time-Out | Error |
V 2.0 : HTTP 409 : Req Error - Conflict | Sub Rule | HTTP 409 : Request Error - Conflict | Error |
V 2.0 : HTTP 410 : Req Error - Gone | Sub Rule | HTTP 410 : Request Error - Gone | Error |
V 2.0 : HTTP 411 : Req Error - Length Required | Sub Rule | HTTP 411 : Request Error - Length Required | Error |
V 2.0 : HTTP 412 : Req Error - Precondition Failed | Sub Rule | HTTP 412 : Request Error - Precondition Failed | Error |
V 2.0 : HTTP 413 : Req Error - Req Item Too Big | Sub Rule | HTTP 413 : Request Error - Request Item Too Big | Error |
V 2.0 : HTTP 414 : Req Error - Req URL Too Large | Sub Rule | HTTP 414 : Request Error - Request-URL Too Large | Error |
V 2.0 : HTTP 415 : Req Error - Unsupported Type | Sub Rule | HTTP 415 : Request Error - Unsupported Type | Error |
V 2.0 : HTTP 416 : Req Error - Req Rng Unfillable | Sub Rule | HTTP 416 : Request Error - Range Unfillable | Error |
V 2.0 : HTTP 417 : Req Error - Expectation Failed | Sub Rule | HTTP 417 : Request Error - Expectation Failed | Error |
V 2.0 : HTTP 500 : Svr Error - Internal Server Err | Sub Rule | HTTP 500 : Server Error - Internal Server Error | Error |
V 2.0 : HTTP 501 : Svr Error - Not Implemented | Sub Rule | HTTP 501 : Server Error - Not Implemented | Error |
V 2.0 : HTTP 502 : Svr Error - Bad Gateway | Sub Rule | HTTP 502 : Server Error - Bad Gateway | Error |
V 2.0 : HTTP 503 : Svr Error - Service Unavailable | Sub Rule | HTTP 503 : Server Error - Service Unavailable | Error |
V 2.0 : HTTP 504 : Svr Error - Gateway Time Out | Sub Rule | HTTP 504 : Server Error - Gateway Time-Out | Error |
V 2.0 : HTTP 505 : Svr Error - HTTP Ver Unsupporte | Sub Rule | HTTP 505 : Server Error - HTTP Ver Unsupported | Error |
Mapping with LogRhythm Schema
Device Key in Log Message | LogRhythm Schema | Data Type | Schema Description |
---|---|---|---|
N/A | N/A | N/A | date - The date on which the activity occurred. |
N/A | N/A | N/A | time - The time, in coordinated universal time (UTC), at which the activity occurred. |
N/A | <process> | Text/String | s-sitename - The Internet service name and instance number that was running on the client. |
N/A | <dname> | Text/String | s-computername - The name of the server on which the log file entry was generated. |
N/A | <dip> | IP Address | s-ip - The IP address of the server on which the log file entry was generated. |
N/A | <command> <tag1> | Text/String | cs-method - The requested verb; for example, a GET method. |
N/A | <url> | Text/String | cs-uri-stem - The target of the verb; for example, Default.htm. |
N/A | <object> | Text/String | cs-uri-query - The query, if any, that the client was trying to perform. A Universal Resource Identifier (URI) query is necessary only for dynamic pages. |
N/A | <dport> | Number | s-port - The server port number that is configured for the service. |
N/A | <login> | Text/String | cs-username - The name of the authenticated user that accessed the server. Anonymous users are indicated by a hyphen. |
N/A | <sip> | IP Address | c-ip - The IP address of the client that made the request. |
N/A | <version> | Text/String | cs-version - The HTTP protocol version that the client used. |
N/A | <useragent> | Text/String | cs(User-Agent) - The browser type that the client used. |
N/A | N/A | N/A | cs(Cookie) - The content of the cookie sent or received, if any. |
N/A | N/A | N/A | cs(Referer) - The site that the user last visited. This site provided a link to the current site. |
N/A | N/A | N/A | cs-host - The host header name, if any. |
N/A | <responsecode> <tag2> | Number | sc-status - The HTTP status code. |
N/A | N/A | N/A | sc-substatus - The substatus error code. |
N/A | N/A | N/A | sc-win32-status - The Windows status code. |
N/A | <bytesin> | Number | sc-bytes - The number of bytes sent by the server. |
N/A | <bytesout> | Number | cs-bytes - The number of bytes received and processed by the server. |
N/A | <milliseconds> | Number | time-taken - The length of time that the action took, in milliseconds. |