name: Windows IIS
id: d6f31fda-702c-431d-a378-9bf096529764
author: Patrick Bareiss, Splunk
source: ms:iis:splunk
sourcetype: ms:iis:splunk
separator: None
supported_TA: {}
event_names: []
fields:
- _time
- CorrelationID
- Email
- X_Rps_CAT
- cafeReqId
- charset
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- exchangecookie
- host
- index
- linecount
- punct
- source
- sourcetype
- splunk_server
- timeendpos
- timestartpos
example_log: 2022-10-03 17:58:25 W3SVC1 exchange01 10.0.1.15 POST /autodiscover/autodiscover.json
  @evil.corp/powershell/?X-Rps-CAT=VgEAVAdXaW5kb3dzQwBBCEtlcmJlcm9zTB9BZG1pbmlzdHJhdG9yQGF0dGFja3JhbmdlLmxvY2FsVS1TLTEtNS0yMS0yMjUxNTE4MTc3LTE2OTY3OTA1MTUtMzAxNDQ1MzMzNi01MDBHAQAAAAcAAAAMUy0xLTUtMzItNTQ0RQAAAAA=&Email=autodiscover/autodiscover.json%3F@evil.corp&CorrelationID=<empty>;&cafeReqId=985523e1-c41a-49eb-aa80-b15405b78ef5;
  443 - 89.23.145.158 HTTP/1.1 python-requests/2.25.0 exchangecookie=77dd4bf3fa444547abe0e69d2a979499
  - 100.21.120.14 200 0 0 2384 2125 433 - application/soap+xml;charset=UTF-8 on