name: Bro
id: c5d9612b-0ffd-44d3-8247-3cf3486ec5e2
author: Patrick Bareiss, Splunk
source: bro:http:json
sourcetype: bro:http:json
supported_TA: {}
event_names: []
fields:
  - _time
  - bytes
  - bytes_in
  - bytes_out
  - dest
  - dest_host
  - dest_ip
  - dest_port
  - direction
  - dvc
  - eventtype
  - flow_id
  - host
  - host_header
  - http_content_type
  - http_method
  - http_user_agent
  - http_user_agent_length
  - id.orig_h
  - id.orig_p
  - id.resp_h
  - id.resp_p
  - id_orig_h
  - id_orig_p
  - id_resp_h
  - index
  - is_broadcast
  - is_dest_internal_ip
  - is_src_internal_ip
  - linecount
  - method
  - product
  - punct
  - request_body_len
  - resp_fuids
  - resp_fuids{}
  - resp_mime_types
  - resp_mime_types{}
  - response_body_len
  - sensor_name
  - site
  - source
  - sourcetype
  - splunk_server
  - src
  - src_ip
  - src_port
  - status
  - status_code
  - status_msg
  - tag
  - tag::eventtype
  - timestamp
  - trans_depth
  - ts
  - uid
  - uri
  - uri_path
  - uri_query
  - url
  - user_agent
  - vendor
  - vendor_product
  - version
example_log:
  '{"ts":"2022-10-26T18:00:59.345538Z","uid":"CobZQ21IIZvzswjyjh","id.orig_h":"10.0.1.15","id.orig_p":16976,"id.resp_h":"10.0.1.20","id.resp_p":8080,"trans_depth":1,"method":"GET","host":"10.0.1.20","uri":"/?q=${url:UTF-8:https://10.0.1.20:8080.q.cdcnbmk03o13j77svqvgpu44hdbnhypcq.oast.site}","version":"1.1","user_agent":"Mozilla/5.0
  (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","request_body_len":0,"response_body_len":121,"status_code":404,"status_msg":"","tags":[],"resp_fuids":["FxuRnn2rNk2RjIfQQ8"],"resp_mime_types":["text/json"]}'