I'm going to assume that you won't have to resources to use any enterprise grade IDS like tripwire? which would definitely be effective. What I can suggest is that you log all the requests you receive, so in IIS be sure to log and review your http requests. Can you limit the IP ranges you're expecting connections from?
Can you authenticate your web app? if you disable anonymous access you should be able to greatly reduce the attacks on your app. If not, look at lowering the privileges of your IIS service, and the app pools.
If you're seeing probes on your network, identify network services (netstat -an will help) switch everything you can off.
Switch on your windows firewall; look over the rules, limit it to the bare minimum.
There's no application you can install or device you can buy that will just switch on and make everything ok. Your best defense is to actively review your system.