In order to query the log, in addtion to the builtin query viewer of ISA, you can install SQL client tools, then use SQL Analyzer to connect to ISA-SERVER\MSFW (replace ISA-SERVER with your actual server name) and query the log. See the example here .
