name: Nginx Access
id: c716a418-eab3-4df5-9dff-5420174e3068
version: 2
date: '2025-01-23'
author: Patrick Bareiss, Splunk
description: Logs HTTP/S access events on an Nginx server, including details such
  as client IP, request method, URI, response status, and user agent.
mitre_components:
- Network Traffic Content
- Network Traffic Flow
- Response Metadata
- Application Log Content
- User Account Metadata
source: /var/log/nginx/access.log
sourcetype: nginx:plus:kv
supported_TA:
- name: Splunk Add-on for NGINX
  url: https://splunkbase.splunk.com/app/3258
  version: 3.3.0
field_mappings:
- data_model: cim
  data_set: Web
  mapping:
    server: Web.dest
    http_method: Web.http_method
    http_user_agent: Web.http_user_agent
    status: Web.status
    uri_path: Web.url
    url_length: Web.url_length
    src_ip: Web.src
fields:
- _time
- action
- app
- bytes
- bytes_in
- bytes_out
- category
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- dest_ip
- dest_port
- eventtype
- host
- http_content_type
- http_method
- http_referer
- http_user_agent
- http_user_agent_length
- http_x_forwarded_for
- http_x_header
- https
- index
- linecount
- nginx_version
- product
- protocol
- punct
- request_time
- response_time
- server
- site
- source
- sourcetype
- splunk_server
- src
- src_ip
- status
- status_description
- status_type
- tag
- tag::eventtype
- time_local
- timeendpos
- timestartpos
- uri_path
- url
- url_domain
- url_length
- vendor
- vendor_product
- version
- web_server
example_log: site="www.example.com" server="www.example.com" dest_port="443" dest_ip="192.0.2.1"
  src="198.51.100.1" src_ip="198.51.100.1" user="-" time_local="22/Feb/2024:13:00:00
  -0500" protocol="HTTP/1.1" status="200" bytes_out="1073741000" bytes_in="234" http_referer="-"
  http_user_agent="python-requests/2.25.1" nginx_version="1.18.0" http_x_forwarded_for="-"
  http_x_header="-" uri_query="-" uri_path="/wp-json/bricks/v1/render_element" http_method="POST"
  response_time="0.250" cookie="-" request_time="0.650" category="application/json"
  https="on"