Add Exchange IIS service telemetry

tests/OCSentinelCli.Tests/ExchangeIisLogParserTests.cs

@@ -0,0 +1,42 @@
+using OCSentinelCli;
+using Xunit;
+
+namespace OCSentinelCli.Tests;
+
+public sealed class ExchangeIisLogParserTests
+{
+    [Fact]
+    public void ParsesFailedOwaLoginWithActualIisPort()
+    {
+        string[] lines =
+        [
+            "#Fields: date time s-ip cs-method cs-uri-stem cs-username c-ip s-port sc-status",
+            "2026-08-02 04:15:00 10.0.0.10 POST /owa/auth.owa - 203.0.113.20 443 401"
+        ];
+
+        AttackEvent attack = Assert.Single(ExchangeIisLogParser.ParseLines(lines, new DateTimeOffset(2026, 8, 2, 4, 0, 0, TimeSpan.Zero)));
+
+        Assert.Equal("Exchange OWA login", attack.Target);
+        Assert.Equal("OWA", attack.Service);
+        Assert.Equal(443, attack.DestinationPort);
+        Assert.Equal("/owa/auth.owa", attack.Endpoint);
+        Assert.Equal("203.0.113.20", attack.SourceIp);
+    }
+
+    [Fact]
+    public void ParsesMapiAndIgnoresSuccessfulRequests()
+    {
+        string[] lines =
+        [
+            "#Fields: date time cs-uri-stem cs-username c-ip s-port sc-status",
+            "2026-08-02 04:15:00 /mapi/emsmdb/ user@example.test 198.51.100.8 444 403",
+            "2026-08-02 04:16:00 /ecp/ user@example.test 198.51.100.9 443 200"
+        ];
+
+        AttackEvent attack = Assert.Single(ExchangeIisLogParser.ParseLines(lines, new DateTimeOffset(2026, 8, 2, 4, 0, 0, TimeSpan.Zero)));
+
+        Assert.Equal("MAPI/HTTP", attack.Service);
+        Assert.Equal(444, attack.DestinationPort);
+        Assert.Equal("user@example.test", attack.Username);
+    }
+}