name: AWS Cloudfront
id: 780086dc-2384-45b6-ade7-56cb00105464
version: 3
creation_date: '2024-07-16'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs requests made to AWS CloudFront distributions, including details on client access, response data, and performance metrics.
mitre_components:
    - Network Traffic Content
    - Network Traffic Flow
    - Response Metadata
    - Response Content
    - Logon Session Metadata
    - Cloud Service Metadata
source: aws
sourcetype: aws:cloudfront:accesslogs
supported_TA:
    - name: Splunk Add-on for AWS
      url: https://splunkbase.splunk.com/app/1876
      version: 8.1.2
fields:
    - _time
    - action
    - app
    - bytes
    - bytes_in
    - bytes_out
    - c_ip
    - c_port
    - cached
    - category
    - client_ip
    - cs_bytes
    - cs_cookie
    - cs_host
    - cs_method
    - cs_protocol
    - cs_protocol_version
    - cs_referer
    - cs_uri_query
    - cs_uri_stem
    - cs_user_agent
    - date
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - dest
    - duration
    - edge_location_name
    - eventtype
    - fle_encrypted_fields
    - fle_status
    - host
    - http_content_type
    - http_method
    - http_user_agent
    - http_user_agent_length
    - index
    - linecount
    - punct
    - response_time
    - sc_bytes
    - sc_content_len
    - sc_content_type
    - sc_range_end
    - sc_range_start
    - sc_status
    - source
    - sourcetype
    - splunk_server
    - src
    - src_ip
    - src_port
    - ssl_cipher
    - ssl_protocol
    - status
    - tag
    - tag::eventtype
    - time
    - time_taken
    - time_to_first_byte
    - timeendpos
    - timestartpos
    - uri_path
    - url
    - url_domain
    - url_length
    - vendor_product
    - x_edge_detail_result_type
    - x_edge_location
    - x_edge_request_id
    - x_edge_response_result_type
    - x_edge_result_type
    - x_forwarded_for
    - x_host_header
example_log: "2023-11-07\t16:58:21\tIAD55-P5\t921\t44.192.78.55\tGET\td3u5aue66f5ui4.cloudfront.net\t/plugins/servlet/com.jsos.shell/ShellServlet\t200\t-\tSlackbot-LinkExpanding%201.0%20(+https://api.slack.com/robots)\t-\t-\tLambdaGeneratedResponse\tsGwvFCkFU4qlMxatCoJRgW87P7Ee8bKQor3U6lRt6I6jaFvLC7vcPA==\tconfluence.catjamfest.com\thttps\t232\t0.276\t-\tTLSv1.3\tTLS_AES_128_GCM_SHA256\tLambdaGeneratedResponse\tHTTP/1.1\t-\t-\t57232\t0.276\tLambdaGeneratedResponse\ttext/html\t527\t-\t-"