KHIKA App for IIS WebServer

Introduction

IIS webserver logs have valuable information like each client's activity, and communication. KHIKA visual analytics make it simpler to identify and pinpoint where risks are introduced so you can exercise preventive measures accordingly. KHIKA app for IIS webserver is aimed to give you insights into the behaviour, errors as well as traffic.

With KHIKA App for IIS webserver, you can :

• Monitor hundreds of IIS servers at a central place.
• Monitor and see the http error trends.
• Monitor top n URLs serviced / requested and their statistics.
• See user wise request distribution on your servers

We explain below, steps to configure and interpret the output of KHIKA App for IIS Webserver.

The key parts to get here are:

1. Install the KHIKA App for IIS Webserver
2. Get data from your IIS Webserver into KHIKA Aggregator

How to Install the KHIKA App for IIS WebServer?

The section assumes that you have already configured KHIKA Data Aggregator in your environment. If not, please read how to configure KHIKA Data Aggregator and perform the pre-requisite steps.

This section explains how to pick and install the KHIKA application for IIS Webserver. Installing the application shall put together and activate the adapter (parser) that can handle Windows data format, the dashboards and the alert rules preconfigured.

Go to “Applications” tab in the “Configure” menu.

Check whether the appropriate Workspace is selected. Note: Application is always loaded in a Workspace. Read the section on Workspaces to know more about KHIKA Workspaces. Also select your KHIKA aggregator name in the Node dropdown. This is to ensure that we are collecting data from the desired source and into the correct workspace which is ready with the configured application and components.

Click on the “+” button next to the IIS WebServer App. A pop up appears.

Users can now select the contents of the application required. For example, on the dropdown for “Reports”, click to expand it. List of all reports can be seen. User can individually select the reports required by checking on the checkbox next to each. Alternatively, check on “Select All” option to get all of them. Similarly you can select contents from Alerts and Dashboards.

What are KHIKA Reports

What are KHIKA Dashboards

What are KHIKA Alerts

Click “Install” to proceed with the installation of the selected Application. If you have created multiple IIS webserver workspaces in KHIKA, and installed the previously, you will get below pop up.

Click on OK to proceed. If this is not the case, ignore this step. After successful installation, following status should be displayed.

Click on Close button. This simple procedure to install a KHIKA App, automatically configures the Adapter (required for parsing the data from raw syslogs), calculated KHIKA reports on raw data, Visualizations, Dashboards and Alerts – all in one click.

How to get your IIS WebServer data into KHIKA ?

KHIKA recommends, popular open source OSSEC integration to monitor the IIS Webservers. There are 2 components in OSSEC Integration with KHIKA.

1. OSSEC Agent – Installed on each server which we wish to monitor
2. OSSEC Server – Present on KHIKA Data Aggregator (which you have installed before)

The OSSEC agent and server communicate with each other using a unique key for encryption. The main steps to start getting data from a IIS Webserver are :

1. Add the webserver details in KHIKA
2. Extract a unique key for this device from KHIKA
3. Installing Ossec Agent on Webserver
4. Insert this key in the Ossec agent (ie. on your Webserver to be monitored)
5. Reload Configuration in KHIKA
6. Verify data collection in KHIKA

Each of these steps is explained in detail in the further sections.

Adding the device in the KHIKA

Go to Adapter tab, from the “Configure” menu. Click on the “Manage Devices” icon.

Pop up appears for device details

Click on “Add / Modify Device” tab. Another pop up appears for device details.

Enter the expected device name. Also, in the field for IP address, enter “any”. Please note : Always enter the IP Address as “any”. This is a safe and sure option to establish a connection with the server where we are suggesting ossec agent to use “any” of its configured IPs to be used to connect with the OSSEC Server. The device may have multiple NIC cards/IP addresses and unless we are sure of what IP will be used for connection, the connect will fail. Hence, use “any”

Select appropriate time zone of this device. In the “Node” field dropdown, select the name of the Aggregator or local data collector for this device. Click on Submit. We get a success message and device is added successfully to this adaptor.

Finally, go to Workspace tab and click on “Apply Configuration” icon.

We get a confirmation message here too, saying, “Changes Applied”

Extract key from KHIKA OSSEC Server

Now the expected server is added in the relevant KHIKA Adapter or parser that will parse this data type. To see this device entry, click on “Manage Devices” icon next to the adaptor .

A pop up with device details of the adaptor appears. Select “List of Devices” tab.

Click on the “Get OSSEC Key” icon next to this device.

This is the unique key for this device created by the OSSEC server. Paste this key in the Ossec agent which is installed on this Webserver.

Installing OSSEC Agent for IIS WebServer

Download Windows Ossec Agent from here.
For IIS Webserver you will need to select the Windows installer with filename ossec-win32-agent.zip. This works for both 32-bit and 64-bit windows servers OS versions.

Copy the downloaded installer on your Webserver (using winscp or your favourite scp client) and run installer with local "Admin" on the Server. Please Note : It is extremely important to install the OSSEC agent with admin privileges as this agent reads the security logs and in order to read it successfully, it has to be the local Admin. Select the installer file and Press "Run"

Click Next

Select "I Agree" and proceed

Keep the default selection in the next window and click Next

Enter the location to install the OSSEC agent on the local drive and let the installation complete

After the installation is complete, verify that the OSSEC HIDS Service is successfully installed on your WebServer. (Go to your Service Control Panel and check for OSSEC HIDS Service)

NOTE :- You will have to repeat these steps on each Webserver that you wish to monitor using KHIKA.

Insert unique OSSEC key in Windows OSSEC Agent

Perform following simple steps on the Agent on your Webserver : In the OSSEC Agent installation directory, run win32ui.exe to open-up a window as shown below – Run as Administrator.

In the field “OSSEC Server IP” - Enter the IP Address of the KHIKA data aggregator or collector node and paste the copied key (generated by OSSEC server above) in the box against "Authentication key" and click Save. From "Manage" drop-down, select "Restart" to restart the OSSEC Agent. Click on the Refresh button in the bottom next to Save.

Wait for a few minutes. Repeat above steps for all the agents to be added.

Reload Configuration

Login into the KHIKA portal.

• Go to Configure
• Select workspace, here IIS_WebServer (or whatever you have named your workspace)
• Go to Node Tab
• Click Reload Config

This step restarts OSSEC Server. Wait for a few minutes for server to restart.

Verifying OSSEC data collection

Once the device is added successfully, we can check the data for this device on Discover screen. Go to “Discover” from the main menu. Select the appropriate index for the same. Raw (khika formatted) data of all your Webservers added is seen here.

To see the data for our newly added device, enter search string in lower case – tl_src_host : name_of_the_device_added_in_lower_case and click on the search icon.

How to check the output of KHIKA IIS WebServer App ?

IIS Webserver Http Error Status Dashboard

This Dashboard shows the information about HTTP status code for accessed URL's.This dashboard also shows top 10 URL's which are accessed most,Server IP and HTTP status code.

Elements in the Dashboard are explained below :

IIS Webserver Http Error Status Dashboard

Visualization	Description
Server IP wise Status	X axis : Server IPs Y axis : Server IP status codes like 200,400,404, etc.
Client IP wise Status	X axis : Client IPs Y axis : Client IP status code like 200,400,404,504, etc.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. In the graph "Server IP wise Status", click and select any one server IP. This shall isolate respective status codes and URLs accessed for the selected server IP and get reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this server IP only.
2. Alternatively, in the graph "Client IP wise Status " click and select any one client IP. This shall isolate respective status code and URL accessed for that selected client IP and get reflected across the dashboard.

IIS Webserver Top N URL Dashboard

This dashboard shows top n URLs requested and their information. It includes details about domain and top hits on server.

Elements in the Dashboard are explained below :

IIS Webserver Top N URL Dashboard

Visualization	Description
Contribution of URL	This pie chart shows different URLs accessed by server.
Server Name wise Hits	X axis : Names of Server Y axis : Count of such request hits for each server.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Contribution of Domain	This pie chart shows different types of domain.
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. On the pie chart "Contribution of URL" select any one URL. This shall show the number of hits for the requested URL, server names, domain for selected URL across the dashboard making it easier to drill down and analyse.
2. In the "Contribution of Domain" pie, click on any one domain, filter gets applied on this selected domain, rest of the elements on the dashboard then show data for that domain only like URLs for this domain, server name, etc.

IIS Webserver Total Requests Per User Dashboard

This dashboard shows detailed information of users and requested URLs which are accessed by users.

Elements in the Dashboard are explained below :

IIS Webserver Total Request Per User Dashboard

Visualization	Description
Contribution of Server Name	This pie chart shows contribution of servers.
User wise Request	X axis : one or more user Y axis : Count of request hits for that user.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. In the graph "User wise Request ", click and select any one user. This shall isolate the requested hits for that selected user and get reflected across the dashboard. i.e the other pie charts, time trends and summary tables shall show filtered information for this user only.
2. In the pie "Contribution of Server Name " click and select any one server name. This shall isolate the respective user and requested hits for that server name and get reflected across the dashboard.

IIS Webserver Traffic Categorization Dashboard

This dashboard shows traffic categorization like DIRECT or REFERRED. Also it shows server IP wise category , top URLs and Servers.

Elements in the Dashboard are explained below :

IIS Webserver Traffic Categorization Dashboard

Visualization	Description
Server IP wise Category	X axis : Server IPs Y axis : count of Category.
Client IP wise Referrer	X axis : Client IPs Y axis : count of Referrer.
Contribution of URL	This pie chart shows contribution of different types of URL
Contribution of Category	This pie chart shows contribution of different types of Category.
Contribution of Referrer	This pie chart shows contribution of different types of Referrer.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. On the bar graph "Server IP wise Category" select any one server IP. This isolates respective category and its count for selected server IP and also domain and accessed URL for that server IP across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this server IP only.
2. Inversely, in the bar graph "Client IP wise Referrer", click on any one client IP to select and rest of the elements on the dashboard then show data for that client IP only.

IIS Webserver Top N Referrers Dashboard

This Dashboard shows the top referrers. Also gives the details of domain and top hits on server.

Elements in the Dashboard are explained below :

IIS Webserver Top N Referrers Dashboard

Visualization	Description
Contribution of Domain	This pie chart shows contribution of different types of Domain.
Server Name wise Hits	X axis : Server Names Y axis :Server name wise hits.
Contribution of Referrer	This pie chart shows contribution of different types of Referrers.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. On the bar graph "Contribution of Referrer" select any one. This shall isolate count of requested hits for selected referrer and also shows domain and server name for selected referrer across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this referrer only.
2. Inversely, in the "Contribution of Domain" pie, click on any one domain to select and rest of the elements on the dashboard then show data for that domain only.

IIS Webserver Referrer Detail Dashboard

This dashboard shows referrer details. Also it shows top URLs, Referrer, client IP, which are requested for any URL and server IP.

Elements in the Dashboard are explained below :

IIS Webserver Referrer Detail Dashboard

Visualization	Description
Contribution of Referrer	This pie chart shows contribution of different Referrers.
Contribution of URL	This pie chart shows contribution of different URLs .
Server IP wise Hits	X axis : Server IP Y axis : Count of request hits for that Server IP.
Client IP wise Hits	X axis : Client IP Y axis : Count of request hits for that Client IP.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. In the pie chart "Contribution of Referrer" click and select any one referrer type.This shall isolate count of hits for that selected type and also shows server IP and accessed URL for that referrer type reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this referrer type only.
2. Alternatively, in the graph "Client IP wise Hits" click and select any one client IP. This shall isolate request hits and also show referrer and accessed URLs for that client IP reflected across the dashboard.

IIS webserver loading delays Dashboard

This dashboard has information for total time taken, average time taken for accessed URI ,server IP.

Elements in the Dashboard are explained below :

IIS webserver loading delays Dashboard

Visualization	Description
URL wise Total Time	X axis : URL's Y axis : Total time required and count of most expensive request for particular URL.
Server IP Hits	X axis : Server IP Y axis : Count of request hits for that Server IP.
Contribution of Server IP	This pie chart shows contribution of different types of server IP.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. In the bar graph "URL wise Total Time" click and select any one URL. The rest of the dashboard shall show total time required for that selected URL, count of most expensive request for that URL and get reflected across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this URL only.
2. Alternatively, in the bar graph "Server IP Hits" click and select any one server IP. Click on the any one server IP to select and rest of the elements on the dashboard then show data for that server IP only.

IIS Webserver Avg Qtime Dashboard

This Dashboard shows the average time taken by accessed URL and it's query.

Elements in the Dashboard are explained below :

IIS Webserver Avg Qtime Dashboard

Visualization	Description
URL wise Hits	X axis :Name of URL's Y axis : Count of request hits for that URL.
Server IP Hits	X axis : ServerIP Y axis : Count of request hits for that Server IP.
Contribution of Query	This pie chart shows contribution of different types of Query.
Time trend	Trend of login events over time. Useful to identify unusual spikes at a glance. X axis : date & time Y axis : count of events
Summary Table	Detailed data with timestamp and count

Some suggestions for useful interaction with this dashboard could be :

1. In the pie chart "Contribution of Query" select any top Query. This shall isolate the count of hits for selected query and also server IP for that selected query across the dashboard.
2. In the bar graph "URL wise Hits" select any one URL. This shall isolate the count of request hits for selected URL and also query and server name for that URL across the dashboard. i.e the other pie charts, time trends and summary table shall show filtered information for this URL only.

KHIKA Alerts for IIS WebServer

Alerts are generated when certain ciritical behaviour is observed in the system – real time and notified on the Alerts Dashboard in KHIKA as well as can be received in email to relevant stakeholders. The details of KHIKA Alerts are mentioned here Click on “Alert Dashboard” on left menu. Certain alerts for Windows are pre-canned and shipped with KHIKA, keeping in mind the requirements of the users. They are mentioned in the table below :

Alerts Description

Alert Details Table

Alert Name	Description	Suggested Resolution
IIS communication with possible IOC or bad IP	This alert is triggered when Malicious/bad IPs are trying to communicate with IIS Webserver.	KHIKA shares community based threat intelligence (TI) every 24 hours. TI has list of IP addresses with bad reputation. Every bad IP is marked with number of communities reporting it, name of each community and confidence indicating how confident are we about the reputation. This alert is generated when communication with a bad IP is let through. If communication with a bad IP is happening, it must be blocked immediately as it could be a possible attack or data exfiltration. You can check how log this communication is happening by simply searching the malicious IP in the logs. You can also check what internal IP addresses are communicating with this IP addresses and track the real users behind those internal IP addresses. Cross-check the reputation of the IP with popular websites such as ipvoid.com, virustotal.com. If you see an internal IP constantly getting involved in malicious communication (with same or multiple external IP addresses), you may install agents on the internal nodes involved and check the real user and process responsible for this communication. It is critical to block this rogue communication.
IIS dangerous content posted to webserver,files with executable extensions	This alert is triggered when any of the client trying to posted some dangerous files on webserver within one minute.	Dangerous content is posted on the webserver. Victim has posted some potentially dangerous files like executable, scripts, shared objects, etc. on webserver. Kindly check upload activity done by the user and verify the uploaded content for policy violation.
IIS multiple errors for same URL when it is not accessible	This alert is triggered when client want to access invalid/unauthorized URL and got multiple errors like 404,405 etc within one minute.	Getting multiple errors for the same url. This kind of alert may occur due to incorrect application url e.g. user trying to access invalid/non-authorized url. Kindly check the legitimacy of the requesting users.