1

I'm using QRadar as a SIEM solution. I want to integrate TMG logs so that I can obtain/search GET requests with specific extensions (e.g., .jpg, .html, .php).

I know in Apache you can get this through web access logs.

2

The following might help with parsing your Apache access log for GET requests: Analyzing Apache Log Files

I haven't used TMG, but have done this with awk. See section 1 in the link above for the Apache combined log format, and sections 2 and 3 for parsing examples which you might adapt.

You can also parse Apache logs with cross-platform scripting languages, like Perl: ApacheLog::Parser

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.