IIS/FTP?

[seanvree]

Does this work for IIS/FTP log on attempts?

THX

[EvanAnderson]

Can't say off the top of my head. If they generate Security Event Log entries sourced from either "Security" or "Microsoft-Windows-Security-Auditing", event IDs 529 or 4625 then there's a chance. The event details would need to contain the IP address and username in the appropriate insertion string locations, too.

What version of Windows Server are you thinking about?

[seanvree]

Yeah, trying to figure out how to log that data first I guess would be good.

IIS 10