Ensure 'ETW Logging' is enabled

MediaNivel 1Automatizadaiis

Descripción

Event Tracing for Windows (ETW) is a Windows feature that allows Administrators to send logging information to another location. This information is then compiled on the server and can be queried. siteDefaults logFile logTargetW3C must include ETW (File,ETW = both log file and ETW event). PowerShell 5.1 with the WebAdministration module; run elevated. CIS marks this recommendation Manual; the automated check implements its audit procedure.

Cómo se verifica

Método de auditoría: Comando de shell

shell

Import-Module WebAdministration -ErrorAction Stop; $c = Get-WebConfiguration -Filter 'system.applicationHost/sites/siteDefaults/logFile' -PSPath 'MACHINE/WEBROOT/APPHOST'; if ([string]$c.logTargetW3C -match 'ETW') { 'compliant' } else { 'noncompliant' }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Set-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' -Filter system.applicationHost/sites/siteDefaults/logFile -Name logTargetW3C -Value 'File,ETW'

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: iislogging
Referencia: CIS Microsoft IIS 10 Benchmark v1.2.1 - 5.3 Ensure 'ETW Logging' is enabled

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target iis