Checking Exchange IIS logs for users who downloaded files via OWA

At my work we use a 3rd party application that rides ontop of OWA in Exchange in order to block attachment downloads across certain IP ranges (namely all external access). We recently had an issue with it silently failing and we needed to figure out who might have downloaded attachments via OWA while the application was down. In looking over the IIS logs we determined that we could accurately figure this out by looking for

1. Any cs-uri-stem like ‘/owa*Get*Attachment*’. In particualr these were the ones we want to capture
   1. /owa/service.svc/s/GetFileAttachment
   2. /owa/service.svc/s/GetAllAttachmentsAsZip
   3. We did not want /owa/service.svc/s/GetAttachmentThumbnail
2. Any cs-uri-query like ‘*&ClientRequestId=*&encoding=*’
3. In our parsing of the logs the same cs-uri-stem was used for uploading and downloading files, but downloads had that near the of the query while uploads had ‘*&ClientId=*’

With this info we used the following log parser query to look for any successful file downloads from the IP ranges we considered external as well as any non internal IP range. We also included some other items to weed out any actions a health mailbox performed

SELECT Distinct

TO_LOCALTIME(TO_TIMESTAMP(date, time)) AS [DateTime],

s-ip as [Server-IP],

REVERSEDNS(s-ip) as [ExchangeServer],

cs-uri-stem as [OWAUrl],

cs-username as [UserName],

c-ip as [Client-IP],

REVERSEDNS(c-ip) as [RemoteHostName],

cs(User-Agent) as [Browser]

FROM '[LOGFILEPATH]'

Where cs-uri-stem Like '/owa%Get%Attachment%'

and cs-uri-stem <> '/owa/service.svc/s/GetAttachmentThumbnail'

and cs-uri-query like '%&ClientRequestId=%&encoding=%'

and sc-status < 400 
and cs-username NOT LIKE 'HealthMailbox%'
and cs-method = 'GET'
and (c-ip like '192.172.%' or c-ip like '189.18.5.%')
and (c-ip not like '10.%' or c-ip not like '172.20.2%')
and cs(User-Agent) <> 'AMProbe/Local/ClientAccess'