# Copyright (c) 2010 Flowerfire, Inc.  All Rights Reserved.
isacsv = {

  plugin_version = "2.2.2"

  info.1.manufacturer = "Microsoft"
  info.1.device = "ISA WebProxy Log Format (CSV)"
  info.1.version.1 = ""

  # 2006-11-29 - 2.0 - GMF - Simplified layout; added names of all fields; grouped reports.
  # 2006-12-05 - 2.1 - GMF - Merge of Graham's changes (similar to mine of the 29th).
  #                          ref: http://www.microsoft.com/technet/isa/2000/proddocs/isadocs/m_s_c_loggingfields.mspx?mfr=true
  # 2009-07-15 - 2.2 - MSG - Added  page_views to the log fields.
  # 2009-12-03 - 2.2.1 - GMF - Changed filter_info to rand hash, and added filter to simplify it.
  # 2011-03-22 - 2.2.2 - MSG - Edited info lines.

  # The name of the log format
  log.format.format_label = "Microsoft ISA WebProxy Log Format (CSV)"
  log.miscellaneous.log_data_type = "firewall"  
  log.miscellaneous.log_format_type = "firewall"

  # The log is in this format if any of the first ten lines match this regular expression
  log.format.autodetect_regular_expression = "^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+, [^,]+, [^,]+, [^,]+, [0-9]+/[0-9]+/[0-9][0-9][0-9][0-9], [0-9]+:[0-9][0-9]:[0-9][0-9], [^,]+, [^,]+, [^,]+, [^,]+, [0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+, [0-9]+, [0-9]+, [0-9]+, [0-9]+, [a-z]+, [^,]+, [A-Z]+, [^,]+, [^,]+, [^,]+, [0-9]+, [^,]+, [^,]+, [^,]+|#Software: Microsoft\\(R\\) Internet Security and Acceleration Serve"


  # Logs fields are separated by a comma
  log.format.field_separator = ", "

  # Log fields
  log.fields = {

    c_ip = {
      type = "host"
      index = 1
    } # c_ip

    cs_username = {
      index = 2
    } # cs_username

    c_agent = {
      type = "agent"
      index = 3
    } # c_agent

    sc_authenticated = {
      index = 4
    } # sc_authenticated

    date = {
      type = "date"
      index = 5
    } # date

    time = {
      type = "time"
      index = 6
    } # time

    s_svcname = {
      index = 7
    } # s_svcname

    s_computername = {
      index = 8
    } # s_computername

    cs_referred = {
      index = 9
    } # cs_referred

    r_host = {
      index = 10
    } # r_host

    r_ip = {
      index = 11
    } # r_ip

    r_port = {
      index = 12
    } # r_port

    time_taken = {
      index = 13
    } # time_taken

    cs_bytes = {
      index = 14
    } # cs_bytes

    sc_bytes = {
      index = 15
    } # sc_bytes

    cs_protocol = {
      index = 16
    } # cs_protocol

    cs_transport = {
      index = 17
    } # cs_transport

    s_operation = {
      index = 18
    } # s_operation

    cs_uri = {
      type = "page"
      index = 19
    } # cs_uri

    cs_mime_type = {
      index = 20
    } # cs_mime_type

    s_object_source = {
      index = 21
    } # s_object_source

    sc_status = {
      index = 22
    } # sc_status

    s_cache_info = {
      index = 23
    } # s_cache_info

    rule = {
      index = 24
    } # rule

    filter_info = {
      index = 25
    } # filter_info

    cs_network = {
      index = 26
    }

    sc_network = {
      index = 27
    }

    error_info = {
      index = 28
    }

    page_views = ""

  } # log.fields


  # Database fields
  database.fields = {

    date_time = ""
    day_of_week = ""
    hour_of_day = ""
    c_ip = ""
    location = ""
    cs_username = ""
    web_browser = ""
    operating_system = ""
    spider = ""
    sc_authenticated = ""
    s_svcname = ""
    s_computername = ""
    cs_referred = ""
    r_host = ""
    r_ip = ""
    r_port = ""
    cs_protocol = ""
    cs_transport = ""
    s_operation = ""
    
    cs_uri = {
      suppress_top = 1
      suppress_bottom = 3
    } # cs_uri

    worm = ""
    cs_mime_type = ""
    s_object_source = ""
    sc_status = ""
    s_cache_info = ""
    rule = ""
    filter_info = {
      itemnums_hash_function = "rand_sum"
    }
    cs_network = ""
    sc_network = ""
    error_info = ""

  } # database.fields


  # Get web browser, operating system, web browser, and spider information from the user-agent field.
  log.parsing_filters.derive_from_user_agent = `
get_user_agent_info(c_agent);
web_browser = volatile.web_browser;
operating_system = volatile.operating_system;
spider = volatile.spider;
`


  # Log Filters
  log.filters = {

    set_page_for_worm = {
      label = "$lang_admin.log_filters.set_page_for_worm_label"
      comment = "$lang_admin.log_filters.set_page_for_worm_comment"
      value = "if (starts_with(worm, '(')) then '' else cs_uri = '(worm)';"
    } # set_page_for_worm

    remove_query = {
      label = "$lang_admin.log_filters.remove_query_label"
      comment = "$lang_admin.log_filters.remove_query_comment"
      value = "if (contains(cs_uri, '?')) then cs_uri = substr(cs_uri, 0, index(cs_uri, '?') + 1) . '(parameters)';"
    } # remove_query

    detect_page_views = {
      label = '$lang_admin.log_filters.detect_page_views_label'
      comment = '$lang_admin.log_filters.detect_page_views_comment'
      value = "if ((file_type eq 'JPEG') or (file_type eq 'JPG') or (file_type eq 'GIF') or (file_type eq 'ICO') or (file_type eq 'PNG') or (file_type eq 'CSS') or (file_type eq 'SWF') or (file_type eq 'JS')) then page_views = 0; else page_views = 1;"
    } # detect_page_views

    simplify_url = {
      label = "$lang_admin.log_filters.simplify_url_label"
      comment = "$lang_admin.log_filters.simplify_url_comment"
      value = "if (matches_regular_expression(cs_uri, '^([^:]+://[^/]+/)')) then cs_uri = $1 . '(omitted)'"
    } # simplify_url

    simplify_filter_info = {
      label = "Simplify filter_info"
      comment = "This simplifies the generally important filter_info field, to keep the database small and fast"
      value = "filter_info = '(simplified)'"
    } # simplify_filter_info

    strip_non_page_views = {
      label = '$lang_admin.log_filters.strip_non_page_views_label'
      comment = '$lang_admin.log_filters.strip_non_page_views_comment'
      value = "if (page_views == 0) then cs_uri = substr(cs_uri, 0, last_index(cs_uri, '/') + 1) . '(nonpage)';"
    } # strip_non_page_views

    mark_entry = {
      label = '$lang_admin.log_filters.mark_entry_label'
      comment = '$lang_admin.log_filters.mark_entry_comment'
      value = 'hits = 1;'
    } # mark_entry

  } # log.filters

  log.field_options = {

    sessions_page_field = "cs_uri"
    sessions_visitor_id_field = "c_ip"
    sessions_event_field = "page_views"

  } # log.field_options


  database.numerical_fields = {

    hits = {
      requires_log_field = false
      entries_field = true
    } # hits

    page_views = {
      default = true
    } # page_views

    unique_client_ips = {
      log_field = "c_ip"
      type = "unique"
    } # unique_client_ips

    cs_bytes = {
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    } # cs_bytes

    sc_bytes = {
      type = "int"
      integer_bits = 64
      display_format_type = "bandwidth"
    }

    time_taken = {
      type = "int"
      integer_bits = 64
      display_format_type = duration_milliseconds
    } # time_taken

    time_taken_avg = {
      label = "$lang_stats.field_labels.time_taken $lang_stats.field_labels.average_tag"
      log_field = "time_taken"
      type = "int"
      integer_bits = 64
      aggregation_method = "average"
      average_denominator_field = "hits"
      display_format_type = duration_milliseconds
    } # time_taken_avg

  } # database.numerical_fields


  create_profile_wizard_options = {

    # How the reports should be grouped in the report menu
    report_groups = {
      date_time_group = ""
      content_group = {
        cs_uri = ""
        cs_mime_type = ""
      }
      client_group = {
        c_ip = ""
        location = ""
        cs_username = ""
        cs_network = ""
      }
      server_group = {
        sc_authenticated = ""
        s_svcname = ""
        s_computername = ""
        r_host = ""
        r_ip = ""
        r_port = ""
        sc_network = ""
      }
      visitor_systems_group = {
        web_browser = ""
        operating_system = ""
      }
      other_group = {
        cs_referred = ""
        cs_protocol = ""
        cs_transport = ""
        s_operation = ""
        worm = ""
        s_object_source = ""
        sc_status = ""
        s_cache_info = ""
        rule = ""
        filter_info = ""
        error_info = ""
      }

    } # report_groups

  } # create_profile_wizard_options

} # isacsv