Windows Business System Servers

Deployment

The Windows business system server type contains hosts that have events that are recorded locally on the file system or data store, not using the Windows Event Log architectural pattern. High value sources include:

• Windows DNS (debug log).
• Windows Internet Information Services (IIS).
• Microsoft SQL Server.
• Microsoft Sharepoint.

Common non-Microsoft services include:

• Oracle database.
• ERP systems such as SAP.
• Open source services such as Apache HTTP and Tomcat.

These sources are best added once the common Windows and Linux implementation patterns are completed. It is recommended that Windows DNS and IIS sources are added first.

These sources can be added by deploying the HyperSec automation assisted Filebeat deployment if available. This must be performed by the customer or organisation.

Updates

Updates can be performed by cloning the latest version from the repository and then deploying and re-executing the installation for automation assisted sources.

Other sources (such as specific Filebeat sources) can be updated using the source specific documentation.