> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Add IIS Request Filtering Exceptions for Syteca

> Configure Internet Information Services (IIS) Request Filtering to allow the file extensions Syteca uses. Required when IIS Request Filtering is enabled with default deny rules, which is common in hardened Windows Server environments.

Internet Information Services (IIS) Request Filtering rejects HTTP requests for file extensions that are not on its allow list. In default IIS installations the filter is permissive, but hardened Windows Server environments and organizations following IIS security baselines often restrict the allow list to a small set of extensions. When Request Filtering is that restrictive, the Syteca Management Tool and Session Player stop functioning correctly because the web components they serve are rejected before they reach the browser.

This page lists every file extension Syteca requires and the procedure for adding them to the IIS Request Filtering allow list.

<Warning>
  **NOT AVAILABLE IN SAAS.** IIS Request Filtering configuration is on the Windows Server hosting the Application Server and Management Tool. In SaaS deployments this server is managed by the Syteca vendor and Request Filtering is already configured correctly.
</Warning>

## When to add these exceptions

Add the exceptions on the Windows Server hosting the Syteca Management Tool (typically the same server hosting the Application Server) when:

1. IIS Request Filtering is configured with an explicit allow list rather than the default permissive allow.
2. The organization enforces a Windows Server hardening baseline (CIS, DISA STIG, or an internal equivalent) that restricts IIS file-extension policies.
3. Any Syteca resource fails to load with an HTTP 404.7 (File Name Extension Not Allowed) error in the browser or Application Server logs.

If IIS Request Filtering has not been explicitly hardened on the Syteca host, the default configuration allows all extensions Syteca uses. This page's procedure is only necessary in restricted environments.

## Permissions required

The user performing this procedure needs local administrator access on the Windows Server hosting IIS and the Syteca Management Tool. IIS Manager displays and modifies the Request Filtering rules stored in `applicationHost.config`, which requires administrator write access.

## Add the file extension exceptions

Perform this procedure once on the Windows Server hosting the Syteca Management Tool.

<Steps>
  <Step title="Open IIS Manager">
    Open **Internet Information Services (IIS) Manager** on the Windows Server hosting the Management Tool.
  </Step>

  <Step title="Navigate to the Syteca application">
    In the IIS Manager left tree, expand:

    ```text theme={"system"}
    <hostname> > Sites > Default Web Site > Syteca
    ```

    Click on **Syteca** to select it.
  </Step>

  <Step title="Open Request Filtering">
    In the middle pane, in the **IIS** section, double-click **Request Filtering**.
  </Step>

  <Step title="Add each required extension">
    In the Request Filtering pane, click **File Name Extensions**. Then click **Allow File Name Extension...** in the Actions pane on the right.

    Add each of the extensions listed in the two tables below, one at a time. Each entry adds an `<add fileExtension="..." allowed="true" />` line to the applicationHost.config.
  </Step>
</Steps>

<Frame caption="IIS Manager. The Allow File Name Extension dialog under Request Filtering, where each Syteca extension is added.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/administration/security/iis-request-filtering-allow-extension.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=9646e104244b55ca5cc6b1c02810c0ef" alt="IIS Manager Request Filtering pane with the Allow File Name Extension dialog" width="1421" height="746" data-path="images/administration/security/iis-request-filtering-allow-extension.png" />
</Frame>

## Extensions required for the Management Tool web interface

The following file extensions must be allowed for the Management Tool interface, Session Player, and reports to render correctly:

| Group               | Extensions                                                     |
| ------------------- | -------------------------------------------------------------- |
| **Static assets**   | `.bmp`, `.gif`, `.jpg`, `.png`, `.svg`                         |
| **Web fonts**       | `.eot`, `.ttf`, `.woff`, `.woff2`                              |
| **Web application** | `.html`, `.css`, `.js`, `.json`, `.xml`, `.map`, `.cs`, `.axd` |
| **Documents**       | `.pdf`                                                         |

The complete list of extensions to add:

`.bmp`, `.eot`, `.html`, `.jpg`, `.xml`, `.json`, `.svg`, `.woff2`, `.gif`, `.map`, `.woff`, `.css`, `.ttf`, `.pdf`, `.js`, `.cs`, `.png`, `.axd`

## Extensions required for other Syteca components

The following additional extensions are required for specific Syteca features. If the feature is not used, its extension can be omitted, but adding all of them at once is simpler and does not increase the attack surface meaningfully.

| Extension | Required for                                                                       |
| --------- | ---------------------------------------------------------------------------------- |
| `.exe`    | Syteca Forensic Player download from the Management Tool                           |
| `.zip`    | Downloading Application Server logs, Management Tool logs, and Windows Client logs |
| `.tar.gz` | Downloading Linux and macOS Client logs                                            |

<Note>
  If Forensic Player is not used in the deployment (for example, when session review only happens in the browser-based Session Player), the `.exe` exception can be safely omitted.
</Note>

## Verify the exceptions took effect

After adding all extensions:

1. Reload the Management Tool in a browser.
2. Verify that the interface loads fully. Icons, fonts, and the Session Player thumbnail grid should all render correctly.
3. Download an Application Server log zip from the Management Tool. If the download succeeds, the `.zip` exception is active.
4. If any resource still fails to load, check the browser's Developer Tools Network tab for HTTP 404.7 errors. The rejected extension will be listed in the response and can be added to the allow list.

## Related

<CardGroup cols={2}>
  <Card title="Install Application Server" icon="server-cog" href="/docs/administration/deployment/install-application-server">
    Full Application Server install procedure. IIS is installed as part of the standard install.
  </Card>

  <Card title="Application Server troubleshooting" icon="wrench" href="/docs/resources/troubleshooting/application-server-troubleshooting">
    Common Application Server issues and their resolutions.
  </Card>

  <Card title="Application Server advanced settings" icon="settings" href="/docs/administration/deployment/server-advanced-settings">
    Advanced configuration on the Application Server, including IIS-facing settings.
  </Card>

  <Card title="System requirements" icon="server" href="/docs/get-started/system-requirements">
    IIS version requirements alongside other prerequisites.
  </Card>
</CardGroup>