Device Integration: Windows AD and IIS

TABLE OF CONTENTS

• Overview
• Prerequisites
• Enabling Audit & IIS Logs
• NxLog Configuration for AD and IIS
• Apply and Restart NxLog
• Verification (MSSP Only)

Overview

This article explains how to enable and forward Active Directory (AD) audit logs and IIS web server logs from a Windows server to ADR CCE using NxLog. Once configured, ADR ingests, normalizes, and analyses these logs to provide visibility into user authentication, system events, and web application traffic.

Prerequisites

• Admin access to the Windows server hosting AD and IIS.

• Outbound connectivity from the Windows server to ADR CCE on:

  • UDP 514 (IIS logs)

  • UDP 5154 (AD audit logs)

• Installed NxLog Community Edition (download link).

• IIS Logging enabled

Enabling Audit & IIS Logs

Enable Windows / AD Audit Logs

Follow ADR KB instructions:

Enabling Windows Security Events using Audit Policy

Enable IIS Logging

1. Log in to the Windows server.

2. Open IIS Manager.

3. Select your server → double-click Logging.

4. Ensure logging is enabled, the log file directory is configured, and the W3C format is selected. Reference: Enable Logging on Windows IIS Server

NxLog Configuration for AD and IIS

To configure NXLog:

1. Log into the Active Directory server as Administrator.
2. If you are not already running NXLog, follow the directions below:
   1. Download the latest version of NXLog for Windows: http://nxlog.org/products/nxlog-community-edition/download.
   2. Double-click on the downloaded MSI and install NXLog.
3. As an administrator, download the adr_nxlog.conf file from: https://support-aria.s3.amazonaws.com/ADR/adr_nxlog.conf and save it in C:\Program Files\nxlog\conf.
4. As an administrator, open C:\Program Files\nxlog\conf\nxlog.conf in a text editor.
   1. Add the following lines to provide logs to ADR.
   2. Replace <CCE_IP_ADDRESS> with the local IP of your CCE VM.
      
      ## Replace <CCE_IP_ADDRESS> with the IP of your Collector VM ##
      ## and configure nxlog to use the ARIA ADR configuration file ##
      define CCE_IP <CCE_IP_ADDRESS>
      include %ROOT%\conf\adr_nxlog.conf

Apply and Restart NxLog

1. Save the updated nxlog.conf.

2. Restart the NXLog service:

   net stop nxlog
   net start nxlog

3. Generate test activity:

   • AD: User login/logout.

   • IIS: Access the hosted web application/site.

Verification

On ADR GUI

1. Log in to the ADR dashboard.

2. Navigate: System → Logs and Flows Collection Status.

3. Verify the Windows server’s IP is listed, and both AD and IIS logs are visible.