{"id":278,"date":"2013-07-04T07:05:50","date_gmt":"2013-07-04T07:05:50","guid":{"rendered":"http:\/\/www.andreagirardi.it\/blog\/?p=278"},"modified":"2014-01-22T14:24:12","modified_gmt":"2014-01-22T14:24:12","slug":"analyzie-ms-exchange-log","status":"publish","type":"post","link":"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/","title":{"rendered":"Analyzie MS Exchange log"},"content":{"rendered":"<p>Sometime happens to receive some interesting requests from the business like &#8220;Hey man, take a look if there are some strange access to our web mail&#8221;. This tool it&#8217;s really useful for this kind of task: <a href=\"http:\/\/blogs.technet.com\/b\/karywa\/archive\/2013\/04\/21\/getting-started-with-log-parser-studio.aspx\" title=\"Log Parser Studio\" target=\"_blank\">Log Parser Studio <\/a><\/p>\n<p>It requires (in this case) a IISW3CLOG and a simple query like that:<\/p>\n<pre lang=\"sql\">\r\nSELECT TOP 20 cs-username AS UserID, \r\n\tcs(User-Agent) AS Application, \r\n\tcs-uri-stem AS Vdir,\r\n\tc-ip AS CLIENT,\r\n\tcs-method,\r\n\tCount(*)\r\nFROM '[LOGFILEPATH]'\r\nWHERE cs-uri-stem LIKE '%OWA%'\r\nGROUP BY UserID, Application, Vdir, Client, cs-method\r\nORDER BY COUNT(*) DESC\r\n<\/pre>\n<p>That&#8217;s all!<\/p>\n<div class=\"sharedaddy sd-sharing-enabled\"><div class=\"robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing\"><h3 class=\"sd-title\">Share this:<\/h3><div class=\"sd-content\"><ul><li class=\"share-linkedin\"><a rel=\"nofollow\" data-shared=\"sharing-linkedin-278\" class=\"share-linkedin sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=linkedin\" target=\"_blank\" title=\"Click to share on LinkedIn\"><span>LinkedIn<\/span><\/a><\/li><li class=\"share-reddit\"><a rel=\"nofollow\" data-shared=\"\" class=\"share-reddit sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=reddit\" target=\"_blank\" title=\"Click to share on Reddit\"><span>Reddit<\/span><\/a><\/li><li class=\"share-twitter\"><a rel=\"nofollow\" data-shared=\"sharing-twitter-278\" class=\"share-twitter sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=twitter\" target=\"_blank\" title=\"Click to share on Twitter\"><span>Twitter<\/span><\/a><\/li><li class=\"share-facebook\"><a rel=\"nofollow\" data-shared=\"sharing-facebook-278\" class=\"share-facebook sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=facebook\" target=\"_blank\" title=\"Click to share on Facebook\"><span>Facebook<\/span><\/a><\/li><li class=\"share-skype\"><a rel=\"nofollow\" data-shared=\"sharing-skype-278\" class=\"share-skype sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=skype\" target=\"_blank\" title=\"Share on Skype\"><span>Skype<\/span><\/a><\/li><li class=\"share-pocket\"><a rel=\"nofollow\" data-shared=\"\" class=\"share-pocket sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=pocket\" target=\"_blank\" title=\"Click to share on Pocket\"><span>Pocket<\/span><\/a><\/li><li class=\"share-end\"><\/li><\/ul><\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"<p>Sometime happens to receive some interesting requests from the business like &#8220;Hey man, take a look if there are some strange access to our web mail&#8221;. This tool it&#8217;s really useful for this kind of task: Log Parser Studio It requires (in this case) a IISW3CLOG and a simple query like that: SELECT TOP 20 [&hellip;]<\/p>\n<div class=\"sharedaddy sd-sharing-enabled\"><div class=\"robots-nocontent sd-block sd-social sd-social-icon-text sd-sharing\"><h3 class=\"sd-title\">Share this:<\/h3><div class=\"sd-content\"><ul><li class=\"share-linkedin\"><a rel=\"nofollow\" data-shared=\"sharing-linkedin-278\" class=\"share-linkedin sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=linkedin\" target=\"_blank\" title=\"Click to share on LinkedIn\"><span>LinkedIn<\/span><\/a><\/li><li class=\"share-reddit\"><a rel=\"nofollow\" data-shared=\"\" class=\"share-reddit sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=reddit\" target=\"_blank\" title=\"Click to share on Reddit\"><span>Reddit<\/span><\/a><\/li><li class=\"share-twitter\"><a rel=\"nofollow\" data-shared=\"sharing-twitter-278\" class=\"share-twitter sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=twitter\" target=\"_blank\" title=\"Click to share on Twitter\"><span>Twitter<\/span><\/a><\/li><li class=\"share-facebook\"><a rel=\"nofollow\" data-shared=\"sharing-facebook-278\" class=\"share-facebook sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=facebook\" target=\"_blank\" title=\"Click to share on Facebook\"><span>Facebook<\/span><\/a><\/li><li class=\"share-skype\"><a rel=\"nofollow\" data-shared=\"sharing-skype-278\" class=\"share-skype sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=skype\" target=\"_blank\" title=\"Share on Skype\"><span>Skype<\/span><\/a><\/li><li class=\"share-pocket\"><a rel=\"nofollow\" data-shared=\"\" class=\"share-pocket sd-button share-icon\" href=\"https:\/\/www.andreagirardi.it\/blog\/analyzie-ms-exchange-log\/?share=pocket\" target=\"_blank\" title=\"Click to share on Pocket\"><span>Pocket<\/span><\/a><\/li><li class=\"share-end\"><\/li><\/ul><\/div><\/div><\/div>","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"footnotes":""},"categories":[14],"tags":[36,35],"_links":{"self":[{"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/posts\/278"}],"collection":[{"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/comments?post=278"}],"version-history":[{"count":2,"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/posts\/278\/revisions"}],"predecessor-version":[{"id":363,"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/posts\/278\/revisions\/363"}],"wp:attachment":[{"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/media?parent=278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/categories?post=278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.andreagirardi.it\/blog\/wp-json\/wp\/v2\/tags?post=278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}