Difference between revisions of "KHIKA App for IIS WebServer"
Jump to navigation
Jump to search
(→Elements in the Dashboard are explained below :) |
(→Some suggestions for useful interaction with this dashboard could be :) |
||
| (81 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
== Introduction == | == Introduction == | ||
| − | IIS webserver | + | IIS webserver logs have valuable information like each client's activity, and communication. KHIKA visual analytics make it simpler to identify and pinpoint where risks are introduced so you can exercise preventive measures accordingly. KHIKA app for IIS webserver is aimed to give you insights into the behaviour, errors as well as traffic. |
With KHIKA App for IIS webserver, you can : | With KHIKA App for IIS webserver, you can : | ||
| − | *Monitor hundreds of IIS servers at | + | *Monitor hundreds of IIS servers at a central place. |
| − | *Monitor and | + | *Monitor and see the http error trends. |
| − | *Monitor | + | *Monitor top n URLs serviced / requested and their statistics. |
| − | * | + | *See user wise request distribution on your servers |
| + | |||
| + | We explain below, steps to configure and interpret the output of KHIKA App for IIS Webserver. | ||
| − | |||
The key parts to get here are: | The key parts to get here are: | ||
#Install the KHIKA App for IIS Webserver | #Install the KHIKA App for IIS Webserver | ||
#Get data from your IIS Webserver into KHIKA Aggregator | #Get data from your IIS Webserver into KHIKA Aggregator | ||
| + | |||
== How to Install the KHIKA App for IIS WebServer? == | == How to Install the KHIKA App for IIS WebServer? == | ||
The section assumes that you have already configured KHIKA Data Aggregator in your environment. If not, please read [[Getting Started with KHIKA SaaS#Installing and configuring KHIKA Data Aggregator|how to configure KHIKA Data Aggregator]] and perform the pre-requisite steps. | The section assumes that you have already configured KHIKA Data Aggregator in your environment. If not, please read [[Getting Started with KHIKA SaaS#Installing and configuring KHIKA Data Aggregator|how to configure KHIKA Data Aggregator]] and perform the pre-requisite steps. | ||
| − | This section explains how to pick and install the KHIKA application for IIS | + | This section explains how to pick and install the KHIKA application for IIS Webserver. Installing the application shall put together and activate the adapter (parser) that can handle Windows data format, the dashboards and the alert rules preconfigured. |
Go to “Applications” tab in the “Configure” menu. | Go to “Applications” tab in the “Configure” menu. | ||
| − | [[File: | + | [[File:node.jpg|500px]] |
Check whether the appropriate Workspace is selected. | Check whether the appropriate Workspace is selected. | ||
| − | Note: Application is always loaded in a Workspace. Read the section on [[ | + | Note: Application is always loaded in a Workspace. Read the section on [[Accessing the KHIKA Gui#Creating a Workspace|Workspaces]] to know more about KHIKA Workspaces. |
Also select your KHIKA aggregator name in the Node dropdown. | Also select your KHIKA aggregator name in the Node dropdown. | ||
This is to ensure that we are collecting data from the desired source and into the correct workspace which is ready with the configured application and components. | This is to ensure that we are collecting data from the desired source and into the correct workspace which is ready with the configured application and components. | ||
| − | [[File: | + | [[File:install_app.jpg|500px]] |
| − | Click on the “+” button next to the | + | Click on the “+” button next to the IIS WebServer App. A pop up appears. |
| − | [[File: | + | [[File:install_app1.jpg|500px]] |
Users can now select the contents of the application required. For example, on the dropdown for “Reports”, click to expand it. List of all reports can be seen. User can individually select the reports required by checking on the checkbox next to each. Alternatively, check on “Select All” option to get all of them. | Users can now select the contents of the application required. For example, on the dropdown for “Reports”, click to expand it. List of all reports can be seen. User can individually select the reports required by checking on the checkbox next to each. Alternatively, check on “Select All” option to get all of them. | ||
| − | Similarly you can select contents from Alerts and Dashboards. | + | Similarly you can select contents from Alerts and Dashboards.</br> |
| − | [[KHIKA Reports|What are KHIKA Reports]] | + | [[KHIKA Reports|What are KHIKA Reports]]</br> |
| − | [[KHIKA Dashboards|What are KHIKA Dashboards]] | + | [[KHIKA Dashboards|What are KHIKA Dashboards]]</br> |
| − | [[KHIKA Alerts|What are KHIKA Alerts]] | + | [[KHIKA Alerts & Correlations|What are KHIKA Alerts]]</br> |
Click “Install” to proceed with the installation of the selected Application. | Click “Install” to proceed with the installation of the selected Application. | ||
| − | If you have created multiple | + | If you have created multiple IIS webserver workspaces in KHIKA, and installed the previously, you will get below pop up. |
| − | [[File: | + | [[File:App_alredy.JPG|500px]] |
Click on OK to proceed. If this is not the case, ignore this step. | Click on OK to proceed. If this is not the case, ignore this step. | ||
After successful installation, following status should be displayed. | After successful installation, following status should be displayed. | ||
| − | [[File: | + | [[File:install_status.jpg|500px]] |
Click on Close button. | Click on Close button. | ||
| Line 58: | Line 60: | ||
== How to get your IIS WebServer data into KHIKA ? == | == How to get your IIS WebServer data into KHIKA ? == | ||
| − | KHIKA recommends, popular open source OSSEC integration to monitor the | + | KHIKA recommends, popular open source OSSEC integration to monitor the IIS Webservers. |
There are 2 components in OSSEC Integration with KHIKA. | There are 2 components in OSSEC Integration with KHIKA. | ||
| − | #OSSEC Agent – Installed on each | + | #OSSEC Agent – Installed on each server which we wish to monitor |
#OSSEC Server – Present on KHIKA Data Aggregator (which you have installed before) | #OSSEC Server – Present on KHIKA Data Aggregator (which you have installed before) | ||
The OSSEC agent and server communicate with each other using a unique key for encryption. | The OSSEC agent and server communicate with each other using a unique key for encryption. | ||
| − | The main steps to start getting data from a | + | The main steps to start getting data from a IIS Webserver are : |
| − | #Add the | + | #Add the webserver details in KHIKA |
#Extract a unique key for this device from KHIKA | #Extract a unique key for this device from KHIKA | ||
| − | #Installing Ossec Agent on | + | #Installing Ossec Agent on Webserver |
| − | #Insert this key in the Ossec agent (ie. on your | + | #Insert this key in the Ossec agent (ie. on your Webserver to be monitored) |
#Reload Configuration in KHIKA | #Reload Configuration in KHIKA | ||
#Verify data collection in KHIKA | #Verify data collection in KHIKA | ||
| Line 78: | Line 80: | ||
Go to Adapter tab, from the “Configure” menu. Click on the “Manage Devices” icon. | Go to Adapter tab, from the “Configure” menu. Click on the “Manage Devices” icon. | ||
| − | [[File: | + | [[File:iis_manage_device_1.jpg|500px]] |
Pop up appears for device details | Pop up appears for device details | ||
| Line 86: | Line 88: | ||
Click on “Add / Modify Device” tab. Another pop up appears for device details. | Click on “Add / Modify Device” tab. Another pop up appears for device details. | ||
| − | [[File: | + | [[File:list_device_11.jpg|500px]] |
Enter the expected device name. Also, in the field for IP address, enter “any”. | Enter the expected device name. Also, in the field for IP address, enter “any”. | ||
| Line 94: | Line 96: | ||
Click on Submit. We get a success message and device is added successfully to this adaptor. | Click on Submit. We get a success message and device is added successfully to this adaptor. | ||
| − | [[File: | + | [[File:iis_adding_device.jpg|500px]] |
Finally, go to Workspace tab and click on “Apply Configuration” icon. | Finally, go to Workspace tab and click on “Apply Configuration” icon. | ||
| − | [[File: | + | [[File:iis_10_1.jpg|500px]] |
We get a confirmation message here too, saying, “Changes Applied” | We get a confirmation message here too, saying, “Changes Applied” | ||
| − | |||
== Extract key from KHIKA OSSEC Server == | == Extract key from KHIKA OSSEC Server == | ||
| − | Now the expected | + | Now the expected server is added in the relevant KHIKA Adapter or parser that will parse this data type. To see this device entry, click on “Manage Devices” icon next to the adaptor . |
| − | [[File: | + | [[File:iis_manage_device_1.jpg|500px]] |
A pop up with device details of the adaptor appears. Select “List of Devices” tab. | A pop up with device details of the adaptor appears. Select “List of Devices” tab. | ||
| − | [[File: | + | [[File:iis_12.jpg|500px]] |
Click on the “Get OSSEC Key” icon next to this device. | Click on the “Get OSSEC Key” icon next to this device. | ||
| − | [[File: | + | [[File:get_ossec_key_1.jpg|500px]] |
| − | [[File: | + | [[File:iis_extract_key.jpg|500px]] |
| − | This is the unique key for this device created by the OSSEC server. Paste this key in the Ossec agent which is installed on this | + | This is the unique key for this device created by the OSSEC server. Paste this key in the Ossec agent which is installed on this Webserver. |
| − | == Installing OSSEC Agent for | + | == Installing OSSEC Agent for IIS WebServer == |
| − | Download | + | Download [https://goo.gl/86gRQL Windows Ossec Agent from here].<br> |
| + | For IIS Webserver you will need to select the Windows installer with filename '''ossec-win32-agent.zip'''. This works for both 32-bit and 64-bit windows servers OS versions. | ||
| − | Copy the downloaded installer on your | + | Copy the downloaded installer on your Webserver (using winscp or your favourite scp client) and run installer with local "Admin" on the Server. |
Please Note : It is extremely important to install the OSSEC agent with admin privileges as this agent reads the security logs and in order to read it successfully, it has to be the local Admin. | Please Note : It is extremely important to install the OSSEC agent with admin privileges as this agent reads the security logs and in order to read it successfully, it has to be the local Admin. | ||
Select the installer file and Press "Run" | Select the installer file and Press "Run" | ||
| Line 147: | Line 149: | ||
[[File:Win19.jpg|500px]] | [[File:Win19.jpg|500px]] | ||
| − | After the installation is complete, verify that the OSSEC HIDS Service is successfully installed on your | + | After the installation is complete, verify that the OSSEC HIDS Service is successfully installed on your WebServer. (Go to your Service Control Panel and check for OSSEC HIDS Service) |
[[File:Win20.jpg|500px]] | [[File:Win20.jpg|500px]] | ||
| − | NOTE :- You will have to repeat these steps on | + | NOTE :- You will have to repeat these steps on each Webserver that you wish to monitor using KHIKA. |
== Insert unique OSSEC key in Windows OSSEC Agent == | == Insert unique OSSEC key in Windows OSSEC Agent == | ||
| − | Perform following simple steps on the | + | Perform following simple steps on the Agent on your Webserver : |
In the OSSEC Agent installation directory, run win32ui.exe to open-up a window as shown below – Run as Administrator. | In the OSSEC Agent installation directory, run win32ui.exe to open-up a window as shown below – Run as Administrator. | ||
| Line 167: | Line 169: | ||
Wait for a few minutes. Repeat above steps for all the agents to be added. | Wait for a few minutes. Repeat above steps for all the agents to be added. | ||
| − | == How to check the output of KHIKA | + | == Reload Configuration == |
| + | |||
| + | Login into the KHIKA portal. | ||
| + | *Go to Configure | ||
| + | *Select workspace, here IIS_WebServer (or whatever you have named your workspace) | ||
| + | *Go to Node Tab | ||
| + | *Click Reload Config | ||
| + | |||
| + | [[File:reload_conf.jpg|500px]] | ||
| + | |||
| + | This step restarts OSSEC Server. | ||
| + | Wait for a few minutes for server to restart. | ||
| + | |||
| + | == Verifying OSSEC data collection == | ||
| + | |||
| + | Once the device is added successfully, we can check the data for this device on Discover screen. Go to “Discover” from the main menu. | ||
| + | Select the appropriate index for the same. Raw (khika formatted) data of all your Webservers added is seen here. | ||
| + | |||
| + | [[File:Win24.jpg|500px]] | ||
| + | |||
| + | To see the data for our newly added device, enter search string in lower case – | ||
| + | tl_src_host : name_of_the_device_added_in_lower_case | ||
| + | and click on the search icon. | ||
| + | |||
| + | == How to check the output of KHIKA IIS WebServer App ? == | ||
| − | === | + | === IIS Webserver Http Error Status Dashboard === |
This Dashboard shows the information about HTTP status code for accessed URL's.This dashboard also shows top 10 URL's which are accessed most,Server IP and HTTP status code. | This Dashboard shows the information about HTTP status code for accessed URL's.This dashboard also shows top 10 URL's which are accessed most,Server IP and HTTP status code. | ||
| Line 177: | Line 203: | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Http Error Status Dashboard'' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 183: | Line 209: | ||
|- | |- | ||
|Server IP wise Status | |Server IP wise Status | ||
| − | |X axis : | + | |X axis : Server IPs<br/> Y axis : Server IP status codes like 200,400,404, etc. |
|- | |- | ||
|Client IP wise Status | |Client IP wise Status | ||
| − | |X axis : | + | |X axis : Client IPs<br/> Y axis : Client IP status code like 200,400,404,504, etc. |
|- | |- | ||
|Time trend | |Time trend | ||
| − | |X axis : date & time<br/>Y axis : count of events | + | |Trend of login events over time. Useful to identify unusual spikes at a glance.<br/><br/>X axis : date & time<br/>Y axis : count of events |
|- | |- | ||
|Summary Table | |Summary Table | ||
| Line 198: | Line 224: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #In the graph "Server IP wise Status" , click and select any one | + | #In the graph "Server IP wise Status", click and select any one server IP. This shall isolate respective status codes and URLs accessed for the selected server IP and get reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this server IP only. |
| − | # | + | #Alternatively, in the graph "Client IP wise Status " click and select any one client IP. This shall isolate respective status code and URL accessed for that selected client IP and get reflected across the dashboard. |
| − | === | + | === IIS Webserver Top N URL Dashboard === |
| − | + | ||
| − | This dashboard shows top | + | This dashboard shows top n URLs requested and their information. It includes details about domain and top hits on server. |
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Top N URL Dashboard'' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 214: | Line 240: | ||
|- | |- | ||
|Contribution of URL | |Contribution of URL | ||
| − | |This pie chart shows different | + | |This pie chart shows different URLs accessed by server. |
|- | |- | ||
|Server Name wise Hits | |Server Name wise Hits | ||
|X axis : Names of Server<br/>Y axis : Count of such request hits for each server. | |X axis : Names of Server<br/>Y axis : Count of such request hits for each server. | ||
| + | |- | ||
| + | |Time trend | ||
| + | |Trend of login events over time. Useful to identify unusual spikes at a glance.<br/><br/>X axis : date & time<br/>Y axis : count of events | ||
|- | |- | ||
|Contribution of Domain | |Contribution of Domain | ||
| Line 229: | Line 258: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #On the | + | #On the pie chart "Contribution of URL" select any one URL. This shall show the number of hits for the requested URL, server names, domain for selected URL across the dashboard making it easier to drill down and analyse. |
| − | # | + | #In the "Contribution of Domain" pie, click on any one domain, filter gets applied on this selected domain, rest of the elements on the dashboard then show data for that domain only like URLs for this domain, server name, etc. |
| − | === | + | === IIS Webserver Total Requests Per User Dashboard === |
| − | This dashboard shows | + | This dashboard shows detailed information of users and requested URLs which are accessed by users. |
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Total Request Per User Dashboard'' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 245: | Line 274: | ||
|- | |- | ||
|Contribution of Server Name | |Contribution of Server Name | ||
| − | | | + | |This pie chart shows contribution of servers. |
|- | |- | ||
|User wise Request | |User wise Request | ||
| Line 260: | Line 289: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #In the graph "User wise Request " , click and select any one user. This shall isolate the requested hits for that selected user and reflected across the dashboard. i.e the other pie charts, time trends and summary | + | #In the graph "User wise Request ", click and select any one user. This shall isolate the requested hits for that selected user and get reflected across the dashboard. i.e the other pie charts, time trends and summary tables shall show filtered information for this user only. |
| − | #In the pie "Contribution of Server Name " click and select any one | + | #In the pie "Contribution of Server Name " click and select any one server name. This shall isolate the respective user and requested hits for that server name and get reflected across the dashboard. |
| − | === | + | === IIS Webserver Traffic Categorization Dashboard === |
| − | This dashboard shows traffic categorization like DIRECT or REFERRED. Also it shows | + | This dashboard shows traffic categorization like DIRECT or REFERRED. Also it shows server IP wise category , top URLs and Servers. |
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Traffic Categorization Dashboard'' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 276: | Line 305: | ||
|- | |- | ||
|Server IP wise Category | |Server IP wise Category | ||
| − | |X axis : | + | |X axis : Server IPs<br/> Y axis : count of Category. |
|- | |- | ||
|Client IP wise Referrer | |Client IP wise Referrer | ||
| − | |X axis : | + | |X axis : Client IPs<br/> Y axis : count of Referrer. |
|- | |- | ||
|Contribution of URL | |Contribution of URL | ||
| − | | | + | |This pie chart shows contribution of different types of URL |
|- | |- | ||
|Contribution of Category | |Contribution of Category | ||
| − | | | + | |This pie chart shows contribution of different types of Category. |
|- | |- | ||
|Contribution of Referrer | |Contribution of Referrer | ||
| − | | | + | |This pie chart shows contribution of different types of Referrer. |
|- | |- | ||
|Time trend | |Time trend | ||
| Line 299: | Line 328: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #On the bar graph "Server IP wise Category" select any one | + | #On the bar graph "Server IP wise Category" select any one server IP. This isolates respective category and its count for selected server IP and also domain and accessed URL for that server IP across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this server IP only. |
| − | #Inversely, | + | #Inversely, in the bar graph "Client IP wise Referrer", click on any one client IP to select and rest of the elements on the dashboard then show data for that client IP only. |
| + | |||
| + | === IIS Webserver Top N Referrers Dashboard === | ||
| − | + | This Dashboard shows the top referrers. Also gives the details of domain and top hits on server. | |
| − | |||
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
| − | |||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Top N Referrers Dashboard'' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 315: | Line 344: | ||
|- | |- | ||
|Contribution of Domain | |Contribution of Domain | ||
| − | | | + | |This pie chart shows contribution of different types of Domain. |
|- | |- | ||
|Server Name wise Hits | |Server Name wise Hits | ||
| − | |X axis : | + | |X axis : Server Names<br/> Y axis :Server name wise hits. |
|- | |- | ||
|Contribution of Referrer | |Contribution of Referrer | ||
| − | | | + | |This pie chart shows contribution of different types of Referrers. |
|- | |- | ||
|Time trend | |Time trend | ||
| Line 333: | Line 362: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #On the bar graph " | + | #On the bar graph "Contribution of Referrer" select any one. This shall isolate count of requested hits for selected referrer and also shows domain and server name for selected referrer across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this referrer only. |
| − | #Inversely, | + | #Inversely, in the "Contribution of Domain" pie, click on any one domain to select and rest of the elements on the dashboard then show data for that domain only. |
| − | === | + | === IIS Webserver Referrer Detail Dashboard === |
| − | This dashboard shows referrer details. Also it shows top | + | This dashboard shows referrer details. Also it shows top URLs, Referrer, client IP, which are requested for any URL and server IP. |
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Referrer Detail Dashboard'' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 349: | Line 378: | ||
|- | |- | ||
|Contribution of Referrer | |Contribution of Referrer | ||
| − | | | + | |This pie chart shows contribution of different Referrers. |
|- | |- | ||
|Contribution of URL | |Contribution of URL | ||
| − | | | + | |This pie chart shows contribution of different URLs . |
|- | |- | ||
| Server IP wise Hits | | Server IP wise Hits | ||
| − | |X axis : | + | |X axis : Server IP<br/>Y axis : Count of request hits for that Server IP. |
|- | |- | ||
| Client IP wise Hits | | Client IP wise Hits | ||
| − | |X axis : | + | |X axis : Client IP<br/>Y axis : Count of request hits for that Client IP. |
|- | |- | ||
|Time trend | |Time trend | ||
| Line 370: | Line 399: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #In the | + | #In the pie chart "Contribution of Referrer" click and select any one referrer type.This shall isolate count of hits for that selected type and also shows server IP and accessed URL for that referrer type reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this referrer type only. |
| − | # | + | #Alternatively, in the graph "Client IP wise Hits" click and select any one client IP. This shall isolate request hits and also show referrer and accessed URLs for that client IP reflected across the dashboard. |
| − | === | + | === IIS webserver loading delays Dashboard === |
| − | This dashboard | + | This dashboard has information for total time taken, average time taken for accessed URI ,server IP. |
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS webserver loading delays Dashboard '' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 389: | Line 418: | ||
|- | |- | ||
|Server IP Hits | |Server IP Hits | ||
| − | |X axis : | + | |X axis : Server IP<br/>Y axis : Count of request hits for that Server IP. |
|- | |- | ||
| Contribution of Server IP | | Contribution of Server IP | ||
| − | |contribution of different types of | + | |This pie chart shows contribution of different types of server IP. |
|- | |- | ||
|Time trend | |Time trend | ||
| Line 404: | Line 433: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #In the bar graph "URL wise Total Time" click and select any one URL. | + | #In the bar graph "URL wise Total Time" click and select any one URL. The rest of the dashboard shall show total time required for that selected URL, count of most expensive request for that URL and get reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this URL only. |
| − | # | + | #Alternatively, in the bar graph "Server IP Hits" click and select any one server IP. Click on the any one server IP to select and rest of the elements on the dashboard then show data for that server IP only. |
| − | === | + | === IIS Webserver Avg Qtime Dashboard === |
This Dashboard shows the average time taken by accessed URL and it's query. | This Dashboard shows the average time taken by accessed URL and it's query. | ||
| − | |||
| − | |||
==== Elements in the Dashboard are explained below : ==== | ==== Elements in the Dashboard are explained below : ==== | ||
{| class="wikitable" | {| class="wikitable" | ||
| − | |+ style="caption-side:bottom; color:#e76700;"|'' | + | |+ style="caption-side:bottom; color:#e76700;"|''IIS Webserver Avg Qtime Dashboard '' |
|- | |- | ||
|'''Visualization''' | |'''Visualization''' | ||
| Line 425: | Line 452: | ||
|- | |- | ||
|Server IP Hits | |Server IP Hits | ||
| − | |X axis : ServerIP<br/>Y axis : Count of request hits for that | + | |X axis : ServerIP<br/>Y axis : Count of request hits for that Server IP. |
|- | |- | ||
| Contribution of Query | | Contribution of Query | ||
| − | |contribution of different types of Query. | + | |This pie chart shows contribution of different types of Query. |
|- | |- | ||
|Time trend | |Time trend | ||
| Line 440: | Line 467: | ||
==== Some suggestions for useful interaction with this dashboard could be : ==== | ==== Some suggestions for useful interaction with this dashboard could be : ==== | ||
| − | #In the | + | #In the pie chart "Contribution of Query" select any top Query. This shall isolate the count of hits for selected query and also server IP for that selected query across the dashboard. |
| − | #In the bar graph "URL wise Hits" select any one URL. This shall isolate the count of request hits for selected URL and also query and | + | #In the bar graph "URL wise Hits" select any one URL. This shall isolate the count of request hits for selected URL and also query and server name for that URL across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this URL only. |
| − | === KHIKA Alerts for | + | === KHIKA Alerts for IIS WebServer === |
Alerts are generated when certain ciritical behaviour is observed in the system – real time and notified on the Alerts Dashboard in KHIKA as well as can be received in email to relevant stakeholders. The details of KHIKA Alerts are mentioned here | Alerts are generated when certain ciritical behaviour is observed in the system – real time and notified on the Alerts Dashboard in KHIKA as well as can be received in email to relevant stakeholders. The details of KHIKA Alerts are mentioned here | ||
| Line 458: | Line 485: | ||
|'''Suggested Resolution''' | |'''Suggested Resolution''' | ||
|- | |- | ||
| − | |Malicious | + | |IIS communication with possible IOC or bad IP |
| − | | | + | |This alert is triggered when Malicious/bad IPs are trying to communicate with IIS Webserver. |
| − | + | |KHIKA shares community based threat intelligence (TI) every 24 hours. TI has list of IP addresses with bad reputation. Every bad IP is marked with number of communities reporting it, name of each community and confidence indicating how confident are we about the reputation. This alert is generated when communication with a bad IP is let through. | |
| − | + | If communication with a bad IP is happening, it must be blocked immediately as it could be a possible attack or data exfiltration. | |
| + | You can check how log this communication is happening by simply searching the malicious IP in the logs. You can also check what internal IP addresses are communicating with this IP addresses and track the real users behind those internal IP addresses. | ||
| + | Cross-check the reputation of the IP with popular websites such as ipvoid.com, virustotal.com. | ||
| + | If you see an internal IP constantly getting involved in malicious communication (with same or multiple external IP addresses), you may install agents on the internal nodes involved and check the real user and process responsible for this communication. | ||
| + | It is critical to block this rogue communication. | ||
|- | |- | ||
| − | | | + | |IIS dangerous content posted to webserver,files with executable extensions |
| − | | | + | |This alert is triggered when any of the client trying to posted some dangerous files on webserver within one minute. |
| − | | | + | |Dangerous content is posted on the webserver. Victim has posted some potentially dangerous files like executable, scripts, shared objects, etc. on webserver. |
| − | + | Kindly check upload activity done by the user and verify the uploaded content for policy violation. | |
|- | |- | ||
| − | | | + | |IIS multiple errors for same URL when it is not accessible |
| − | + | |This alert is triggered when client want to access invalid/unauthorized URL and got multiple errors like 404,405 etc within one minute. | |
| − | + | |Getting multiple errors for the same url. | |
| − | + | This kind of alert may occur due to incorrect application url e.g. user trying to access invalid/non-authorized url. | |
| − | + | Kindly check the legitimacy of the requesting users. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | | | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | | | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
|} | |} | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Latest revision as of 07:42, 7 April 2020
Contents
- 1 Introduction
- 2 How to Install the KHIKA App for IIS WebServer?
- 3 How to get your IIS WebServer data into KHIKA ?
- 4 Adding the device in the KHIKA
- 5 Extract key from KHIKA OSSEC Server
- 6 Installing OSSEC Agent for IIS WebServer
- 7 Insert unique OSSEC key in Windows OSSEC Agent
- 8 Reload Configuration
- 9 Verifying OSSEC data collection
- 10 How to check the output of KHIKA IIS WebServer App ?
- 10.1 IIS Webserver Http Error Status Dashboard
- 10.2 IIS Webserver Top N URL Dashboard
- 10.3 IIS Webserver Total Requests Per User Dashboard
- 10.4 IIS Webserver Traffic Categorization Dashboard
- 10.5 IIS Webserver Top N Referrers Dashboard
- 10.6 IIS Webserver Referrer Detail Dashboard
- 10.7 IIS webserver loading delays Dashboard
- 10.8 IIS Webserver Avg Qtime Dashboard
- 10.9 KHIKA Alerts for IIS WebServer
Introduction
IIS webserver logs have valuable information like each client's activity, and communication. KHIKA visual analytics make it simpler to identify and pinpoint where risks are introduced so you can exercise preventive measures accordingly. KHIKA app for IIS webserver is aimed to give you insights into the behaviour, errors as well as traffic.
With KHIKA App for IIS webserver, you can :
- Monitor hundreds of IIS servers at a central place.
- Monitor and see the http error trends.
- Monitor top n URLs serviced / requested and their statistics.
- See user wise request distribution on your servers
We explain below, steps to configure and interpret the output of KHIKA App for IIS Webserver.
The key parts to get here are:
- Install the KHIKA App for IIS Webserver
- Get data from your IIS Webserver into KHIKA Aggregator
How to Install the KHIKA App for IIS WebServer?
The section assumes that you have already configured KHIKA Data Aggregator in your environment. If not, please read how to configure KHIKA Data Aggregator and perform the pre-requisite steps.
This section explains how to pick and install the KHIKA application for IIS Webserver. Installing the application shall put together and activate the adapter (parser) that can handle Windows data format, the dashboards and the alert rules preconfigured.
Go to “Applications” tab in the “Configure” menu.
Check whether the appropriate Workspace is selected. Note: Application is always loaded in a Workspace. Read the section on Workspaces to know more about KHIKA Workspaces. Also select your KHIKA aggregator name in the Node dropdown. This is to ensure that we are collecting data from the desired source and into the correct workspace which is ready with the configured application and components.
Click on the “+” button next to the IIS WebServer App. A pop up appears.
Users can now select the contents of the application required. For example, on the dropdown for “Reports”, click to expand it. List of all reports can be seen. User can individually select the reports required by checking on the checkbox next to each. Alternatively, check on “Select All” option to get all of them.
Similarly you can select contents from Alerts and Dashboards.
Click “Install” to proceed with the installation of the selected Application. If you have created multiple IIS webserver workspaces in KHIKA, and installed the previously, you will get below pop up.
Click on OK to proceed. If this is not the case, ignore this step. After successful installation, following status should be displayed.
Click on Close button. This simple procedure to install a KHIKA App, automatically configures the Adapter (required for parsing the data from raw syslogs), calculated KHIKA reports on raw data, Visualizations, Dashboards and Alerts – all in one click.
How to get your IIS WebServer data into KHIKA ?
KHIKA recommends, popular open source OSSEC integration to monitor the IIS Webservers. There are 2 components in OSSEC Integration with KHIKA.
- OSSEC Agent – Installed on each server which we wish to monitor
- OSSEC Server – Present on KHIKA Data Aggregator (which you have installed before)
The OSSEC agent and server communicate with each other using a unique key for encryption. The main steps to start getting data from a IIS Webserver are :
- Add the webserver details in KHIKA
- Extract a unique key for this device from KHIKA
- Installing Ossec Agent on Webserver
- Insert this key in the Ossec agent (ie. on your Webserver to be monitored)
- Reload Configuration in KHIKA
- Verify data collection in KHIKA
Each of these steps is explained in detail in the further sections.
Adding the device in the KHIKA
Go to Adapter tab, from the “Configure” menu. Click on the “Manage Devices” icon.
Pop up appears for device details
Click on “Add / Modify Device” tab. Another pop up appears for device details.
Enter the expected device name. Also, in the field for IP address, enter “any”. Please note : Always enter the IP Address as “any”. This is a safe and sure option to establish a connection with the server where we are suggesting ossec agent to use “any” of its configured IPs to be used to connect with the OSSEC Server. The device may have multiple NIC cards/IP addresses and unless we are sure of what IP will be used for connection, the connect will fail. Hence, use “any”
Select appropriate time zone of this device. In the “Node” field dropdown, select the name of the Aggregator or local data collector for this device. Click on Submit. We get a success message and device is added successfully to this adaptor.
Finally, go to Workspace tab and click on “Apply Configuration” icon.
We get a confirmation message here too, saying, “Changes Applied”
Extract key from KHIKA OSSEC Server
Now the expected server is added in the relevant KHIKA Adapter or parser that will parse this data type. To see this device entry, click on “Manage Devices” icon next to the adaptor .
A pop up with device details of the adaptor appears. Select “List of Devices” tab.
Click on the “Get OSSEC Key” icon next to this device.
This is the unique key for this device created by the OSSEC server. Paste this key in the Ossec agent which is installed on this Webserver.
Installing OSSEC Agent for IIS WebServer
Download Windows Ossec Agent from here.
For IIS Webserver you will need to select the Windows installer with filename ossec-win32-agent.zip. This works for both 32-bit and 64-bit windows servers OS versions.
Copy the downloaded installer on your Webserver (using winscp or your favourite scp client) and run installer with local "Admin" on the Server. Please Note : It is extremely important to install the OSSEC agent with admin privileges as this agent reads the security logs and in order to read it successfully, it has to be the local Admin. Select the installer file and Press "Run"
Click Next
Select "I Agree" and proceed
Keep the default selection in the next window and click Next
Enter the location to install the OSSEC agent on the local drive and let the installation complete
After the installation is complete, verify that the OSSEC HIDS Service is successfully installed on your WebServer. (Go to your Service Control Panel and check for OSSEC HIDS Service)
NOTE :- You will have to repeat these steps on each Webserver that you wish to monitor using KHIKA.
Insert unique OSSEC key in Windows OSSEC Agent
Perform following simple steps on the Agent on your Webserver : In the OSSEC Agent installation directory, run win32ui.exe to open-up a window as shown below – Run as Administrator.
In the field “OSSEC Server IP” - Enter the IP Address of the KHIKA data aggregator or collector node and paste the copied key (generated by OSSEC server above) in the box against "Authentication key" and click Save. From "Manage" drop-down, select "Restart" to restart the OSSEC Agent. Click on the Refresh button in the bottom next to Save.
Wait for a few minutes. Repeat above steps for all the agents to be added.
Reload Configuration
Login into the KHIKA portal.
- Go to Configure
- Select workspace, here IIS_WebServer (or whatever you have named your workspace)
- Go to Node Tab
- Click Reload Config
This step restarts OSSEC Server. Wait for a few minutes for server to restart.
Verifying OSSEC data collection
Once the device is added successfully, we can check the data for this device on Discover screen. Go to “Discover” from the main menu. Select the appropriate index for the same. Raw (khika formatted) data of all your Webservers added is seen here.
To see the data for our newly added device, enter search string in lower case – tl_src_host : name_of_the_device_added_in_lower_case and click on the search icon.
How to check the output of KHIKA IIS WebServer App ?
IIS Webserver Http Error Status Dashboard
This Dashboard shows the information about HTTP status code for accessed URL's.This dashboard also shows top 10 URL's which are accessed most,Server IP and HTTP status code.
Elements in the Dashboard are explained below :
| Visualization | Description |
| Server IP wise Status | X axis : Server IPs Y axis : Server IP status codes like 200,400,404, etc. |
| Client IP wise Status | X axis : Client IPs Y axis : Client IP status code like 200,400,404,504, etc. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- In the graph "Server IP wise Status", click and select any one server IP. This shall isolate respective status codes and URLs accessed for the selected server IP and get reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this server IP only.
- Alternatively, in the graph "Client IP wise Status " click and select any one client IP. This shall isolate respective status code and URL accessed for that selected client IP and get reflected across the dashboard.
IIS Webserver Top N URL Dashboard
This dashboard shows top n URLs requested and their information. It includes details about domain and top hits on server.
Elements in the Dashboard are explained below :
| Visualization | Description |
| Contribution of URL | This pie chart shows different URLs accessed by server. |
| Server Name wise Hits | X axis : Names of Server Y axis : Count of such request hits for each server. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Contribution of Domain | This pie chart shows different types of domain. |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- On the pie chart "Contribution of URL" select any one URL. This shall show the number of hits for the requested URL, server names, domain for selected URL across the dashboard making it easier to drill down and analyse.
- In the "Contribution of Domain" pie, click on any one domain, filter gets applied on this selected domain, rest of the elements on the dashboard then show data for that domain only like URLs for this domain, server name, etc.
IIS Webserver Total Requests Per User Dashboard
This dashboard shows detailed information of users and requested URLs which are accessed by users.
Elements in the Dashboard are explained below :
| Visualization | Description |
| Contribution of Server Name | This pie chart shows contribution of servers. |
| User wise Request | X axis : one or more user Y axis : Count of request hits for that user. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- In the graph "User wise Request ", click and select any one user. This shall isolate the requested hits for that selected user and get reflected across the dashboard. i.e the other pie charts, time trends and summary tables shall show filtered information for this user only.
- In the pie "Contribution of Server Name " click and select any one server name. This shall isolate the respective user and requested hits for that server name and get reflected across the dashboard.
IIS Webserver Traffic Categorization Dashboard
This dashboard shows traffic categorization like DIRECT or REFERRED. Also it shows server IP wise category , top URLs and Servers.
Elements in the Dashboard are explained below :
| Visualization | Description |
| Server IP wise Category | X axis : Server IPs Y axis : count of Category. |
| Client IP wise Referrer | X axis : Client IPs Y axis : count of Referrer. |
| Contribution of URL | This pie chart shows contribution of different types of URL |
| Contribution of Category | This pie chart shows contribution of different types of Category. |
| Contribution of Referrer | This pie chart shows contribution of different types of Referrer. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- On the bar graph "Server IP wise Category" select any one server IP. This isolates respective category and its count for selected server IP and also domain and accessed URL for that server IP across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this server IP only.
- Inversely, in the bar graph "Client IP wise Referrer", click on any one client IP to select and rest of the elements on the dashboard then show data for that client IP only.
IIS Webserver Top N Referrers Dashboard
This Dashboard shows the top referrers. Also gives the details of domain and top hits on server.
Elements in the Dashboard are explained below :
| Visualization | Description |
| Contribution of Domain | This pie chart shows contribution of different types of Domain. |
| Server Name wise Hits | X axis : Server Names Y axis :Server name wise hits. |
| Contribution of Referrer | This pie chart shows contribution of different types of Referrers. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- On the bar graph "Contribution of Referrer" select any one. This shall isolate count of requested hits for selected referrer and also shows domain and server name for selected referrer across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this referrer only.
- Inversely, in the "Contribution of Domain" pie, click on any one domain to select and rest of the elements on the dashboard then show data for that domain only.
IIS Webserver Referrer Detail Dashboard
This dashboard shows referrer details. Also it shows top URLs, Referrer, client IP, which are requested for any URL and server IP.
Elements in the Dashboard are explained below :
| Visualization | Description |
| Contribution of Referrer | This pie chart shows contribution of different Referrers. |
| Contribution of URL | This pie chart shows contribution of different URLs . |
| Server IP wise Hits | X axis : Server IP Y axis : Count of request hits for that Server IP. |
| Client IP wise Hits | X axis : Client IP Y axis : Count of request hits for that Client IP. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- In the pie chart "Contribution of Referrer" click and select any one referrer type.This shall isolate count of hits for that selected type and also shows server IP and accessed URL for that referrer type reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this referrer type only.
- Alternatively, in the graph "Client IP wise Hits" click and select any one client IP. This shall isolate request hits and also show referrer and accessed URLs for that client IP reflected across the dashboard.
IIS webserver loading delays Dashboard
This dashboard has information for total time taken, average time taken for accessed URI ,server IP.
Elements in the Dashboard are explained below :
| Visualization | Description |
| URL wise Total Time | X axis : URL's Y axis : Total time required and count of most expensive request for particular URL. |
| Server IP Hits | X axis : Server IP Y axis : Count of request hits for that Server IP. |
| Contribution of Server IP | This pie chart shows contribution of different types of server IP. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- In the bar graph "URL wise Total Time" click and select any one URL. The rest of the dashboard shall show total time required for that selected URL, count of most expensive request for that URL and get reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this URL only.
- Alternatively, in the bar graph "Server IP Hits" click and select any one server IP. Click on the any one server IP to select and rest of the elements on the dashboard then show data for that server IP only.
IIS Webserver Avg Qtime Dashboard
This Dashboard shows the average time taken by accessed URL and it's query.
Elements in the Dashboard are explained below :
| Visualization | Description |
| URL wise Hits | X axis :Name of URL's Y axis : Count of request hits for that URL. |
| Server IP Hits | X axis : ServerIP Y axis : Count of request hits for that Server IP. |
| Contribution of Query | This pie chart shows contribution of different types of Query. |
| Time trend | Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events |
| Summary Table | Detailed data with timestamp and count |
Some suggestions for useful interaction with this dashboard could be :
- In the pie chart "Contribution of Query" select any top Query. This shall isolate the count of hits for selected query and also server IP for that selected query across the dashboard.
- In the bar graph "URL wise Hits" select any one URL. This shall isolate the count of request hits for selected URL and also query and server name for that URL across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this URL only.
KHIKA Alerts for IIS WebServer
Alerts are generated when certain ciritical behaviour is observed in the system – real time and notified on the Alerts Dashboard in KHIKA as well as can be received in email to relevant stakeholders. The details of KHIKA Alerts are mentioned here Click on “Alert Dashboard” on left menu. Certain alerts for Windows are pre-canned and shipped with KHIKA, keeping in mind the requirements of the users. They are mentioned in the table below :
Alerts Description
| Alert Name | Description | Suggested Resolution |
| IIS communication with possible IOC or bad IP | This alert is triggered when Malicious/bad IPs are trying to communicate with IIS Webserver. | KHIKA shares community based threat intelligence (TI) every 24 hours. TI has list of IP addresses with bad reputation. Every bad IP is marked with number of communities reporting it, name of each community and confidence indicating how confident are we about the reputation. This alert is generated when communication with a bad IP is let through.
If communication with a bad IP is happening, it must be blocked immediately as it could be a possible attack or data exfiltration. You can check how log this communication is happening by simply searching the malicious IP in the logs. You can also check what internal IP addresses are communicating with this IP addresses and track the real users behind those internal IP addresses. Cross-check the reputation of the IP with popular websites such as ipvoid.com, virustotal.com. If you see an internal IP constantly getting involved in malicious communication (with same or multiple external IP addresses), you may install agents on the internal nodes involved and check the real user and process responsible for this communication. It is critical to block this rogue communication. |
| IIS dangerous content posted to webserver,files with executable extensions | This alert is triggered when any of the client trying to posted some dangerous files on webserver within one minute. | Dangerous content is posted on the webserver. Victim has posted some potentially dangerous files like executable, scripts, shared objects, etc. on webserver.
Kindly check upload activity done by the user and verify the uploaded content for policy violation. |
| IIS multiple errors for same URL when it is not accessible | This alert is triggered when client want to access invalid/unauthorized URL and got multiple errors like 404,405 etc within one minute. | Getting multiple errors for the same url.
This kind of alert may occur due to incorrect application url e.g. user trying to access invalid/non-authorized url. Kindly check the legitimacy of the requesting users. |
