How can I get access logs from TMG? (e.g,. GET method requests)

Question

I'm using QRadar as a SIEM solution. I want to integrate TMG logs so that I can obtain/search GET requests with specific extensions (e.g., .jpg, .html, .php).

I know in Apache you can get this through web access logs.

Answer 1

The following might help with parsing your Apache access log for GET requests: Analyzing Apache Log Files

I haven't used TMG, but have done this with awk. See section 1 in the link above for the Apache combined log format, and sections 2 and 3 for parsing examples which you might adapt.

You can also parse Apache logs with cross-platform scripting languages, like Perl: ApacheLog::Parser