Release Details
Fields |
Details |
---|---|
Name |
Microsoft TMG |
Version |
5.0.0 |
Supported On |
LogPoint v6.0.0 and later |
Release Date |
2020-05-14 |
Document Date | 2020-05-14 |
Download | MicrosoftTMG_5.0.0.pak |
SHA256 |
98f1e244b702c1942e9687da0fe8b5fb50dc54d96aba364cd667082e1d5d8601 |
Package Details
The application consist of the following component:
- Dashboard Package
- LP_MS TMG
- Report Package
- LP_MS TMG
- LP_MS TMG
- Normalization Packages
- LP_Microsoft ISA/ForeFont TMG Web Proxy
- LP_Microsoft ISA/ForeFont TMG
- Alert Packages
- LP_TMG Chained Proxy Server Access Attempt
- LP_TMG Configuration Problem of the Server Routing Policy
- LP_TMG Request Rejected by HTTP Filter
- LP_TMG Specified SSL Port is not Allowed
- LP_TMG Large Size of Response Header
- LP_TMG Connection Denied by Destination Host
- LP_TMG Internet Server API Filter Finished Handling the Request
- LP_TMG Authentication Failed
- LP_TMG URL Filtering Database not Available
- LP_TMG Number of HTTP Request Exceeded Configured Limit
- LP_TMG Access Denied to the Web Server
- LP_TMG SSL Certificate Issues
- LP_TMG Traffic Blocked by IPS
- LP_TMG Large Size of Request Header
- LP_TMG DNS Quota Exceeded
- Search Package
- TMG
Enhancement
A minor update has been done in the application’s normalizer for better signature handling.
General Description
The Microsoft TMG application normalizes Microsoft TMG events and enables you to analyze Microsoft TMG data using reports and pre-set dashboard views. You can further customize the dashboard and searches to perform in-depth analysis.
Installation
Follow these steps to install the Microsoft TMG v5.0.0 plugin:
- Download the Microsoft TMG package from the Download section above.
- Add the required Microsoft TMG as a device in LogPoint.
- Create a collection policy with the Syslog collector and appropriate processing policy.
- Assign the policy to the device.
- Add the dashboard.
Supported Version
The supported version of Microsoft TMG with LogPoint in this configuration are:
- Microsoft TMG 2010
Log Format
Expected Log Format
Microsoft TMG – space-delimited or comma-delimited.
Log Samples
GTMG, 8/23/2011, 11:58:10, TCP, 1.1.1.1:47944, 1.1.1.2:389, 1.1.1.3, Local Host, Internal, Terminate, 0x80074e21, [System] Allow access to directory services for authentication purposes, LDAP, -, 2060, 2060, 579, 579, -, -, -, -, -, 4, 15204, -, -, -, -, -, -, ::, -, -, -, -, -, -, -, -, -, 0, -, -
<13>Feb 22 10:33:25 prx.xyz.com ISAWebLog 0 1.1.1.1 ACCDOM01\m31057 WinHttp-Autoproxy-Service/5.1 Y 2013-01-13 22:27:54 w3proxy PRXSLTSRV01 - 1.1.1.2 1.1.1.3 80 1 176 152 http TCP GET http://1.1.1.4/pd.dat text/plain NotModified 0 0x2 [Enterprise] Trafik til ISA Req ID: xxxxxxxxx Internal Local Host 0x80 Allowed 2013-01-13 22:27:54 - <13>Feb 22 12:11:38 prx.xyz.com ISAWebLog 0 1.1.1.5 anonymous Mozilla/5.0 (Windows NT 6.1; rv:19.0) Gecko/20100101 Firefox/19.0 Y 2013-02-22 11:11:24 w3proxy PRXSLTSRV01 - www.cdef.com 1.1.1.6 443 - - 529 SSL-tunnel TCP - www.abc.com:443 - Inet 5 - [Enterprise] Adgang til alle Porte (PrxTCPUsers) Req ID: 1619bxxx; Req ID: 1619bxxx Internal External 0x800 Failed 2013-02-22 11:11:24 - #Fields: c-ip cs-username c-agent sc-authenticated date time s-svcname s-computername cs-referred r-host r-ip r-port time-taken cs-bytes sc-bytes cs-protocol cs-transport s-operation cs-uri cs-mime-type s-object-source sc-status s-cache-info rule FilterInfo cs-Network sc-Network error-info action GMT Time AuthenticationServer
To export data to LogPoint use Syslog collector on port 514 on the LogPoint server.
Support
If you have any queries or require assistance, please feel free to contact our support team:
Email: servicedesk@logpoint.com
Phone: +45 7060 6100
Best regards,
Comments
Article is closed for comments.