I'm not seeing the HEAD entries when it works when opening a SDM link within an Microsoft Excel file attached to an email in "Protected View":
WORKING ("Excel Protected View")
#Software: Microsoft Internet Information Services 8.0
#Version: 1.0
#Date: 2020-11-05 03:31:55
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko - 200 0 0 31
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=652107228+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 - 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 401 2 5 15
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=652107228+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 15
2020-11-05 03:31:55 10.xx.xx.xx POST /CAisd/pdmweb.exe - 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=95432107+FID=652107228+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 200 0 0 140
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=gobtn_role.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 31
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=welcome_banner.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 46
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=role_main.htmpl+prop.role_menubar=menubar_sd.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 62
2020-11-05 03:31:55 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=95432107+FID=125+HTMPL=load_cache.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 46
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/capa.properties _=1604547116544 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=role_main.htmpl+prop.role_menubar=menubar_sd.htmpl 200 0 0 15
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/capa.properties _=1604547116651 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=gobtn_role.htmpl 200 0 0 15
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/capa.properties _=1604547116668 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=welcome_banner.htmpl 200 0 0 15
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=95432107+FID=123+HTMPL=role_main.htmpl+prop.role_menubar=menubar_sd.htmpl 200 0 0 78
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/capa.properties _=1604547117551 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=95432107+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 15
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=1297177407+OP=VALID_TRANSITIONS+FACTORY=cr+STATUS_FACTORY=crs+STATUS=OP+PERSID=cr:799922+TENANT=+TYPE=R 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=95432107+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 15
2020-11-05 03:31:56 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=512+OP=SEARCH+FACTORY=alg+QBE.EQ.call_req_id=cr:799922 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=95432107+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 46
2020-11-05 03:31:58 10.xx.xx.xx GET /CAisd/capa.properties _=1604547117960 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=95432107+FID=512+OP=SEARCH+FACTORY=alg+QBE.EQ.call_req_id=cr:799922 200 0 0 15
2020-11-05 03:31:58 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=1297177407+OP=SPEC_HAND+FACTORY=cnt+PERSID=cnt:D18B4835EA28A643800260AA1C282A87 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=95432107+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 15
2020-11-05 03:32:04 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=95432107+FID=0+ENDSESSION=1 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 15
NOT WORKING
#Software: Microsoft Internet Information Services 8.0
#Version: 1.0
#Date: 2020-11-05 03:32:36
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
2020-11-05 03:32:36 10.xx.xx.xx HEAD /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 - 10.xx.xx.xx Microsoft+Office+Excel+2014+(16.0.12527)+Windows+NT+10.0 - 401 2 5 15
2020-11-05 03:32:36 10.xx.xx.xx HEAD /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Microsoft+Office+Excel+2014+(16.0.12527)+Windows+NT+10.0 - 200 0 0 93
2020-11-05 03:32:36 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/4.0+(compatible;+ms-office) - 200 0 0 46
2020-11-05 03:32:36 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=782502305+FID=879500744+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 - 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 401 2 5 15
2020-11-05 03:32:36 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=782502305+FID=879500744+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 31
2020-11-05 03:32:36 10.xx.xx.xx POST /CAisd/pdmweb.exe - 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=782502305+FID=879500744+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 200 0 0 15
2020-11-05 03:32:36 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=782502305+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko - 200 0 0 31
2020-11-05 03:32:36 10.xx.xx.xx GET /CAisd/img/circleca.png - 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=782502305+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 304 0 0 15
######################################################################################################
And only 1 HEAD entry for clicking the link from a locally saved Microsoft Word document:
FIRST TAB = FAULT2020-11-05 03:15:55 10.xx.xx.xx HEAD /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 - 10.xx.xx.xx Microsoft+Office+Word+2014+(16.0.12527)+Windows+NT+10.0 - 401 2 5 15
2020-11-05 03:15:55 10.xx.xx.xx HEAD /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Microsoft+Office+Word+2014+(16.0.12527)+Windows+NT+10.0 - 200 0 0 93
2020-11-05 03:15:55 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/4.0+(compatible;+ms-office) - 200 0 0 31
2020-11-05 03:15:55 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=544108233+FID=1641470309+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 - 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 401 2 5 15
2020-11-05 03:15:55 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=544108233+FID=1641470309+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 31
2020-11-05 03:15:55 10.xx.xx.xx POST /CAisd/pdmweb.exe - 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=544108233+FID=1641470309+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 200 0 0 15
2020-11-05 03:15:55 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=544108233+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko - 200 0 0 31
2020-11-05 03:15:55 10.xx.xx.xx GET /CAisd/img/circleca.png - 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=544108233+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 304 0 0 15
SECOND TAB (Existing SDM Session) = NO FAULT2020-11-05 03:16:10 10.xx.xx.xx HEAD /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Microsoft+Office+Word+2014+(16.0.12527)+Windows+NT+10.0 - 200 0 0 93
2020-11-05 03:16:10 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/4.0+(compatible;+ms-office) - 200 0 0 31
2020-11-05 03:16:10 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 - 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko - 401 2 5 15
2020-11-05 03:16:10 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko - 200 0 0 31
2020-11-05 03:16:10 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=712826668+FID=1590700018+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 62
2020-11-05 03:16:10 10.xx.xx.xx POST /CAisd/pdmweb.exe - 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=712826668+FID=1590700018+OP=REPLACE_LOGIN+HTMPL=post_menu.htmpl 200 0 0 140
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=gobtn_role.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 31
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=welcome_banner.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 46
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=role_main.htmpl+prop.role_menubar=menubar_sd.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 62
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/pdmweb.exe OP=DISPLAY_FORM+SID=712826668+FID=125+HTMPL=load_cache.htmpl 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 46
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/capa.properties _=1604546171317 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=role_main.htmpl+prop.role_menubar=menubar_sd.htmpl 200 0 0 31
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/capa.properties _=1604546171438 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=gobtn_role.htmpl 200 0 0 15
2020-11-05 03:16:11 10.xx.xx.xx GET /CAisd/capa.properties _=1604546171466 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=welcome_banner.htmpl 200 0 0 15
2020-11-05 03:16:12 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=712826668+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?OP=DISPLAY_FORM+SID=712826668+FID=123+HTMPL=role_main.htmpl+prop.role_menubar=menubar_sd.htmpl 200 0 0 78
2020-11-05 03:16:12 10.xx.xx.xx GET /CAisd/capa.properties _=1604546172499 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=712826668+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 15
2020-11-05 03:16:12 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=712826668+FID=525867349+OP=VALID_TRANSITIONS+FACTORY=cr+STATUS_FACTORY=crs+STATUS=OP+PERSID=cr:799922+TENANT=+TYPE=R 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=712826668+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 15
2020-11-05 03:16:12 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=712826668+FID=4264+OP=SEARCH+FACTORY=alg+QBE.EQ.call_req_id=cr:799922 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=712826668+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 31
2020-11-05 03:16:12 10.xx.xx.xx GET /CAisd/capa.properties _=1604546172829 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=712826668+FID=4264+OP=SEARCH+FACTORY=alg+QBE.EQ.call_req_id=cr:799922 200 0 0 15
2020-11-05 03:16:12 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=712826668+FID=525867349+OP=SPEC_HAND+FACTORY=cnt+PERSID=cnt:D18B4835EA28A643800260AA1C282A87 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe?SID=712826668+FID=123+OP=SEARCH+FACTORY=cr+SKIPLIST=1+QBE.EQ.ref_num=398935 200 0 0 31
2020-11-05 03:16:21 10.xx.xx.xx GET /CAisd/pdmweb.exe SID=712826668+FID=0+ENDSESSION=1 80 DOMAIN\matthews 10.xx.xx.xx Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+Touch;+rv:11.0)+like+Gecko
http://server/CAisd/pdmweb.exe 200 0 0 15