I have found a way to parse IIS logs on Exchange 2010 Client Access Server in order to display the relationship between usernames and IPs they are using for connections. We are using this when spot-checking odd traffic patterns. If we schedule a script to be run that will either output a .CSV or formatted text file, can Orion/SAM input that file and display it? I have Orion NPM, SAM, and NTA.
Thanks