Microsoft TMG

Archived

The Microsoft TMG application normalizes Microsoft TMG events and enables you to analyze Microsoft TMG data using reports and pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.

Release Details

Version: 5.0.0

Release date: 2020-05-14

Supported On: LogPoint v6.0.0 and later

SHA 256: 98f1e244b702c1942e9687da0fe8b5fb50dc54d96aba364cd667082e1d5d8601

Download

Package Details

Dashboard Package
- LP_MS TMG
Report Package
- LP_MS TMG
Normalization Packages
- LP_Microsoft ISA/ForeFont TMG Web Proxy
- LP_Microsoft ISA/ForeFont TMG
Alert Packages
- LP_TMG Chained Proxy Server Access Attempt
- LP_TMG Configuration Problem of the Server Routing Policy
- LP_TMG Request Rejected by HTTP Filter
- LP_TMG Specified SSL Port is not Allowed
- LP_TMG Large Size of Response Header
- LP_TMG Connection Denied by Destination Host
- LP_TMG Internet Server API Filter Finished Handling the Request
- LP_TMG Authentication Failed
- LP_TMG URL Filtering Database not Available
- LP_TMG Number of HTTP Request Exceeded Configured Limit
- LP_TMG Access Denied to the Web Server
- LP_TMG SSL Certificate Issues
- LP_TMG Traffic Blocked by IPS
- LP_TMG Large Size of Request Header
- LP_TMG DNS Quota Exceeded
Search Package
- TMG

Enhancement

A minor update has been done in the application’s normalizer for better signature handling.

Installation

Follow these steps to install the Microsoft TMG v5.0.0 plugin:

Download the Microsoft TMG package from the Download section above.
Add the required Microsoft TMG as a device in LogPoint.
Create a collection policy with the Syslog collector and appropriate processing policy.
Assign the policy to the device.
Add the dashboard.

Log Format

Expected Log Format

Microsoft TMG – space-delimited or comma-delimited.

Log Samples

GTMG, 8/23/2011, 11:58:10, TCP, 1.1.1.1:47944, 1.1.1.2:389, 1.1.1.3, Local Host, Internal, Terminate, 0x80074e21, [System] Allow access to directory services for authentication purposes, LDAP, -, 2060, 2060, 579, 579, -, -, -, -, -, 4, 15204, -, -, -, -, -, -, ::, -, -, -, -, -, -, -, -, -, 0, -, -

<13>Feb 22 10:33:25 prx.xyz.com ISAWebLog 0 1.1.1.1 ACCDOM01\m31057 WinHttp-Autoproxy-Service/5.1 Y 2013-01-13 22:27:54 w3proxy PRXSLTSRV01 - 1.1.1.2 1.1.1.3 80 1 176 152 http TCP GET http://1.1.1.4/pd.dat text/plain NotModified 0 0x2 [Enterprise] Trafik til ISA Req ID: xxxxxxxxx Internal Local Host 0x80 Allowed 2013-01-13 22:27:54 - <13>Feb 22 12:11:38 prx.xyz.com ISAWebLog 0 1.1.1.5 anonymous Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0 Y 2013-02-22 11:11:24 w3proxy PRXSLTSRV01 - www.cdef.com 1.1.1.6 443 - - 529 SSL-tunnel TCP - www.abc.com:443 - Inet 5 - [Enterprise] Adgang til alle Porte (PrxTCPUsers) Req ID: 1619bxxx; Req ID: 1619bxxx Internal External 0x800 Failed 2013-02-22 11:11:24 - #Fields: c-ip cs-username c-agent sc-authenticated date time s-svcname s-computername cs-referred r-host r-ip r-port time-taken cs-bytes sc-bytes cs-protocol cs-transport s-operation cs-uri cs-mime-type s-object-source sc-status s-cache-info rule FilterInfo cs-Network sc-Network error-info action GMT Time AuthenticationServer

To export data to LogPoint use Syslog collector on port 514 on the LogPoint server.

Support

If you have any questions or require assistance, create a support ticket.