Due to the way Microsoft logs IIS logs via ETW, we have been unable to collect those logs in the past. The EDR team is working on an update to the agent that would provide the needed visibility to collect those logs. This capability should become available by the end of Q2 2026.