Refresh intakes documentation

_shared_content/operations_center/integrations/generated/250e4095-fa08-4101-bb02-e72f870fcbd1.md

@@ -281,7 +281,7 @@ Find below few samples of events and how they are normalized by Sekoia.io.
     ```json
 
     {
-        "message": "{\"user\":{\"id\":\"1063\",\"name\":\"USER_FOO\"},\"action\":{\"properties\":{\"hostname\":\"1.1.1.1\",\"id\":\"1063\",\"op\":\"login\",\"terminal\":\"ssh\"}},\"event\":{\"action\":\"logged-in\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"authentication\"],\"type\":[\"start\"]},\"agent\":{\"id\":\"2c59eed20c79ccd855d4a9c336ae9e0d2311970d30b87e426ff582032eeef137\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"foobar.net\"},\"network\":{\"direction\":\"ingress\"},\"process\":{\"executable\":\"/usr/sbin/sshd\",\"pid\":1750},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T07:41:09.858Z\"}\n",
+        "message": "{\"user\":{\"id\":\"1063\",\"name\":\"USER_FOO\"},\"action\":{\"properties\":{\"hostname\":\"1.1.1.1\",\"id\":\"1063\",\"op\":\"login\",\"terminal\":\"ssh\"}},\"event\":{\"action\":\"logged-in\",\"provider\":\"SEKOIA-IO-Endpoint\",\"outcome\":\"success\",\"category\":[\"authentication\"],\"type\":[\"start\"], \"start\":\"2023-06-23T07:41:09.858Z\", \"end\":\"2023-06-23T07:46:09.858Z\"},\"agent\":{\"id\":\"2c59eed20c79ccd855d4a9c336ae9e0d2311970d30b87e426ff582032eeef137\",\"version\":\"v1.1.0+5369595aebc1c30ff2c849af30f51e4d9327584f\"},\"host\":{\"os\":{\"type\":\"linux\"},\"hostname\":\"foobar.net\"},\"network\":{\"direction\":\"ingress\"},\"process\":{\"executable\":\"/usr/sbin/sshd\",\"pid\":1750},\"source\":{\"address\":\"1.1.1.1\",\"ip\":\"1.1.1.1\"},\"@timestamp\":\"2023-06-23T07:41:09.858Z\"}\n",
         "event": {
             "action": "logged-in",
             "category": [
@@ -290,7 +290,9 @@ Find below few samples of events and how they are normalized by Sekoia.io.
             "provider": "SEKOIA-IO-Endpoint",
             "type": [
                 "start"
-            ]
+            ],
+            "start": "2023-06-23T07:41:09.858000Z",
+            "end": "2023-06-23T07:46:09.858000Z"
         },
         "@timestamp": "2023-06-23T07:41:09.858000Z",
         "action": {
@@ -953,9 +955,11 @@ The following table lists the fields that are extracted, normalized under the EC
 |`event.action` | `keyword` | The action captured by the event. |
 |`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. |
 |`event.code` | `keyword` | Identification code for this event. |
+|`event.end` | `date` | event.end contains the date when the event ended or when the activity was last observed. |
 |`event.kind` | `keyword` | The kind of the event. The highest categorization field in the hierarchy. |
 |`event.provider` | `keyword` | Source of the event. |
 |`event.reason` | `keyword` | Reason why this event happened, according to the source |
+|`event.start` | `date` | event.start contains the date when the event started or when the activity was first observed. |
 |`event.type` | `keyword` | Event type. The third categorization field in the hierarchy. |
 |`host.os.type` | `keyword` | Which commercial OS family (one of: linux, macos, unix or windows). |
 |`process.name` | `keyword` | Process name. |

_shared_content/operations_center/integrations/generated/63974ce1-2f0a-44f7-a4cf-3e64787c1c39.md

@@ -0,0 +1,104 @@
+
+## Event Categories
+
+
+The following table lists the data source offered by this integration.
+
+| Data Source | Description                          |
+| ----------- | ------------------------------------ |
+| `Web logs` | Microsoft IIS logs site activity |
+
+
+
+
+
+In details, the following table denotes the type of events produced by this integration.
+
+| Name | Values |
+| ---- | ------ |
+| Kind | `event` |
+| Category | `web` |
+| Type | `access` |
+
+
+
+
+## Event Samples
+
+Find below few samples of events and how they are normalized by Sekoia.io.
+
+
+=== "sample.json"
+
+    ```json
+
+    {
+        "message": "::1, -, 11/20/2023, 15:44:03, W3SVC1, IIS-server, ::1, 2, 769, 143, 304, 0, GET, /, -,",
+        "event": {
+            "category": [
+                "web"
+            ],
+            "duration": 2000,
+            "kind": "event",
+            "type": [
+                "access"
+            ]
+        },
+        "@timestamp": "2023-11-20T15:44:03Z",
+        "client": {
+            "address": "::1",
+            "bytes": 769,
+            "ip": "::1"
+        },
+        "http": {
+            "request": {
+                "method": "GET"
+            },
+            "response": {
+                "status_code": 304
+            }
+        },
+        "observer": {
+            "name": "IIS-server"
+        },
+        "related": {
+            "ip": [
+                "::1"
+            ]
+        },
+        "server": {
+            "bytes": 143,
+            "ip": "::1"
+        },
+        "url": {
+            "path": "/"
+        }
+    }
+    	
+	```
+
+
+
+
+
+## Extracted Fields
+
+The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
+
+| Name | Type | Description                |
+| ---- | ---- | ---------------------------|
+|`@timestamp` | `date` | Date/time when the event originated. |
+|`client.bytes` | `long` | Bytes sent from the client to the server. |
+|`client.ip` | `ip` | IP address of the client. |
+|`event.category` | `keyword` | Event category. The second categorization field in the hierarchy. |
+|`event.duration` | `long` | Duration of the event in nanoseconds. |
+|`event.kind` | `keyword` | The kind of the event. The highest categorization field in the hierarchy. |
+|`event.type` | `keyword` | Event type. The third categorization field in the hierarchy. |
+|`http.request.method` | `keyword` | HTTP request method. |
+|`http.response.status_code` | `long` | HTTP response status code. |
+|`observer.name` | `keyword` | Custom name of the observer. |
+|`server.bytes` | `long` | Bytes sent from the server to the client. |
+|`server.ip` | `ip` | IP address of the server. |
+|`url.path` | `wildcard` | Path of the request, such as "/search". |
+|`user.name` | `keyword` | Short name or login of the user. |
+