Skip to main content
Internet Information Services (IIS) Request Filtering rejects HTTP requests for file extensions that are not on its allow list. In default IIS installations the filter is permissive, but hardened Windows Server environments and organizations following IIS security baselines often restrict the allow list to a small set of extensions. When Request Filtering is that restrictive, the Syteca Management Tool and Session Player stop functioning correctly because the web components they serve are rejected before they reach the browser. This page lists every file extension Syteca requires and the procedure for adding them to the IIS Request Filtering allow list.
NOT AVAILABLE IN SAAS. IIS Request Filtering configuration is on the Windows Server hosting the Application Server and Management Tool. In SaaS deployments this server is managed by the Syteca vendor and Request Filtering is already configured correctly.

​
When to add these exceptions

Add the exceptions on the Windows Server hosting the Syteca Management Tool (typically the same server hosting the Application Server) when:
  1. IIS Request Filtering is configured with an explicit allow list rather than the default permissive allow.
  2. The organization enforces a Windows Server hardening baseline (CIS, DISA STIG, or an internal equivalent) that restricts IIS file-extension policies.
  3. Any Syteca resource fails to load with an HTTP 404.7 (File Name Extension Not Allowed) error in the browser or Application Server logs.
If IIS Request Filtering has not been explicitly hardened on the Syteca host, the default configuration allows all extensions Syteca uses. This page’s procedure is only necessary in restricted environments.

​
Permissions required

The user performing this procedure needs local administrator access on the Windows Server hosting IIS and the Syteca Management Tool. IIS Manager displays and modifies the Request Filtering rules stored in applicationHost.config, which requires administrator write access.

​
Add the file extension exceptions

Perform this procedure once on the Windows Server hosting the Syteca Management Tool.
1

Open IIS Manager

Open Internet Information Services (IIS) Manager on the Windows Server hosting the Management Tool.
2

Navigate to the Syteca application

In the IIS Manager left tree, expand:
Click on Syteca to select it.
3

Open Request Filtering

In the middle pane, in the IIS section, double-click Request Filtering.
4

Add each required extension

In the Request Filtering pane, click File Name Extensions. Then click Allow File Name Extension… in the Actions pane on the right.Add each of the extensions listed in the two tables below, one at a time. Each entry adds an <add fileExtension="..." allowed="true" /> line to the applicationHost.config.
IIS Manager Request Filtering pane with the Allow File Name Extension dialog

IIS Manager. The Allow File Name Extension dialog under Request Filtering, where each Syteca extension is added.

​
Extensions required for the Management Tool web interface

The following file extensions must be allowed for the Management Tool interface, Session Player, and reports to render correctly: The complete list of extensions to add: .bmp, .eot, .html, .jpg, .xml, .json, .svg, .woff2, .gif, .map, .woff, .css, .ttf, .pdf, .js, .cs, .png, .axd

​
Extensions required for other Syteca components

The following additional extensions are required for specific Syteca features. If the feature is not used, its extension can be omitted, but adding all of them at once is simpler and does not increase the attack surface meaningfully.
If Forensic Player is not used in the deployment (for example, when session review only happens in the browser-based Session Player), the .exe exception can be safely omitted.

​
Verify the exceptions took effect

After adding all extensions:
  1. Reload the Management Tool in a browser.
  2. Verify that the interface loads fully. Icons, fonts, and the Session Player thumbnail grid should all render correctly.
  3. Download an Application Server log zip from the Management Tool. If the download succeeds, the .zip exception is active.
  4. If any resource still fails to load, check the browser’s Developer Tools Network tab for HTTP 404.7 errors. The rejected extension will be listed in the response and can be added to the allow list.

Install Application Server

Full Application Server install procedure. IIS is installed as part of the standard install.

Application Server troubleshooting

Common Application Server issues and their resolutions.

Application Server advanced settings

Advanced configuration on the Application Server, including IIS-facing settings.

System requirements

IIS version requirements alongside other prerequisites.