IIS Exchange report including the cs-User-Agent field

[RSAAdmin]

Hi, I have IIS logs sending to our enVision appliance and want to use it to report on our user's handhelds connecting to our Exchange servers and the type of handheld device they are using. The report is a simple one, it needs only 4 fields; username, date (no time), status (success/fail) and device type.

I have the report sorted with the exception of the device type field. The IIS logs have a "cs(User-Agent)" field, however, this one does not seem to appear in enVision's "Web Accounting" options.

Does anyone know how I can get this field into a report?

[AlanLaurencelle]

All you need to do is tag the field with an available variable in the device xml file.  The tricky part is knowing UDS and how to use it.  Have you taken the UDS Class?  If so, this will be a snap for you.  If not, UDS is defintiely not something you want to muck with if you are not famila - with great power comes great responsiblity, right?

Also, do any other customers out there have this customization done already and are willing to share the device xml with the community?

[RSAAdmin]

I would submit it to support for inclusion.  IIS is supported, so all fields should be available.  You should not have to deal with UDS for a device that is supported.

Regards,

Pete

[RSAAdmin]

Does anyone know if any more came of this?  I have the same need and I will submit it to support if nothing more has come of it.

[PatrickChouinar]

If you look at the different parsed fields, one of them ("Content") contains the browser type and version (ex.: MSIE+6.0). You could use this variable in your report to find out more about the end-user's browser.

On top of that, there is an Event Source Update available on SecurCare Online; This update contains new code for IIS that might solve your issue. I haven't had the chance to try it yet, but, hopefully, it could help getting more info from IIS.

You can download the update by logging to SecureCare Online (https://knowledge.rsasecurity.com) and looking under enVision and downloads.

[RSAAdmin]

I am actually trying to get the device type for each connection.  I want to know what phones are connectiing to our frontend servers.  I want to create a report of the number of connections by each phone type and whihc users are using whihc phones.  I am downloading the update now.

[RSAAdmin]

I did not see anything related to IIS in the update.  How do I submit this for inclusion so that it can be added.  I don't know hwo to modify the XML to parse it myself.

[RSAAdmin]

The best way I have found is to open a ticket with support since it is already a supported device that should make the enhancement fairly quickly.