https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-HttpProxy-logs-from-Exchange/m-p/642892#M109574 <P>Hi,</P><P>I have the need to detect basic authentication logons on our exchange on-prem system.</P><P>we have deployed the TA add-on for Exchange but it does not monitor a log file where I found the information I needed.</P><P>The log files are located in the path&nbsp;E:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Mapi</P><P>I thought to add one stanza to monitor the log files in there but I don't know which source type should I use for it. I wonder if someone already create one that could be shared.</P><P>[monitor://E:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Mapi]<BR />whitelist=\.log$|\.LOG$<BR />time_before_close = 0<BR />sourcetype= ???????????????<BR />queue=parsingQueue<BR />index=msexchange<BR />disabled=false</P><P>many thanks.</P> Wed, 10 May 2023 17:18:00 GMT corti77 2023-05-10T17:18:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-HttpProxy-logs-from-Exchange/m-p/642892#M109574 <P>Hi,</P><P>I have the need to detect basic authentication logons on our exchange on-prem system.</P><P>we have deployed the TA add-on for Exchange but it does not monitor a log file where I found the information I needed.</P><P>The log files are located in the path&nbsp;E:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Mapi</P><P>I thought to add one stanza to monitor the log files in there but I don't know which source type should I use for it. I wonder if someone already create one that could be shared.</P><P>[monitor://E:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\Mapi]<BR />whitelist=\.log$|\.LOG$<BR />time_before_close = 0<BR />sourcetype= ???????????????<BR />queue=parsingQueue<BR />index=msexchange<BR />disabled=false</P><P>many thanks.</P> Wed, 10 May 2023 17:18:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-ingest-HttpProxy-logs-from-Exchange/m-p/642892#M109574 corti77 2023-05-10T17:18:00Z