Microsoft Internet Authentication Server (IAS)

• What is Discovered and Monitored
• Event Types
• Configuration

What is Discovered and Monitored

Protocol	Information Discovered	Metrics Collected	Used For
WMI
Syslog
Windows Agent			IAS logs

Event Types

In ADMIN > Device Support > Event Types, search for "microsoft isa" to see the event types associated with this device.

Configuration

• WMI

• Syslog

WMI

See WMI Configurations in the Microsoft Windows Server Configuration section.

Syslog

You must configure your Microsoft Internet Authentication Server to save logs, and then you can use the Windows Agent Manager to configure the type of log information you want sent to FortiSIEM.

1. Log in to your server as an administrator.
2. Go to Start > Administrative Tools > Internet Authentication Service.
3. In the left-hand navigation, select Remote Access Logging, then select Local File.
4. Right-click on Local File to open the Properties menu, and then select Log File.
5. For Directory, enter C:\WINDOWS\system32\LogFiles\IAS.
6. Click OK.

You can now use Windows Agent Installation Guide to configure what information will be sent to FortiSIEM.