I'm using QRadar as a SIEM solution. I want to integrate TMG logs so that I can obtain/search GET requests with specific extensions (e.g.,
I know in Apache you can get this through web access logs.
Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.Sign up to join this community
The following might help with parsing your Apache access log for GET requests: Analyzing Apache Log Files
I haven't used TMG, but have done this with
awk. See section 1 in the link above for the Apache combined log format, and sections 2 and 3 for parsing examples which you might adapt.
You can also parse Apache logs with cross-platform scripting languages, like Perl: ApacheLog::Parser