[IIS] Update document with supported ingest patterns for access_log

[muthu-mps]

What does this PR do?

The IIS access_log provides flexibility for the customer to edit the default logging fields and add new fields. The IIS integration currently supports the default and a few custom selections. The supported patterns are captured in the document.

How to test this PR locally

Verify the documentation in the access_log section and make sure that the supported patterns are captured.

Related issues

• Closes [IIS] Add access-log logging information in the document #6709

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-07-19T06:54:45.730+0000

• Duration: 16 min 57 sec

Test stats 🧪

Test	Results
Failed	0
Passed	29
Skipped	0
Total	29

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (2/2)	💚
Classes	100.0% (2/2)	💚
Methods	85.714% (30/35)	👎 -14.286
Lines	93.772% (271/289)	👎 -6.228
Conditionals	100.0% (0/0)	💚

[shmsr]

Please refer to this: https://www.crowdstrike.com/cybersecurity-101/observability/iis-logs/

Did we miss a format (see the blog by Crowdstrike)? And can we elaborate on some points like in this blog? Also, we have not referenced any official document or so. Please add some links so that users can cross-check what's written here.

Also, see: https://github.com/ossec/ossec-hids/blob/7b3e12bc9dddac561da2d10331a482d501af74b0/etc/decoder.xml#L1868

[shmsr]

Did you check this comment: #6892 (review)?

[muthu-mps]

Please refer to this: https://www.crowdstrike.com/cybersecurity-101/observability/iis-logs/

Did we miss a format (see the blog by Crowdstrike)? And can we elaborate on some points like in this blog? Also, we have not referenced any official document or so. Please add some links so that users can cross-check what's written here.

Also, see: https://github.com/ossec/ossec-hids/blob/7b3e12bc9dddac561da2d10331a482d501af74b0/etc/decoder.xml#L1868

You mean the log format like W3C, We have captured the supported log formats in the document already. Its not necessary to cover the logging formats what IIS provides in detail as of now as we don't support them right now.

We have the IIS logging official document link included.

[shmsr]

Looks good.

[elasticmachine]

Package iis - 1.14.0 containing this change is available at https://epr.elastic.co/search?package=iis