mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
a94a743b63
--------- Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Co-authored-by: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
107 lines
2.1 KiB
YAML
107 lines
2.1 KiB
YAML
name: AWS Cloudfront
|
|
id: 780086dc-2384-45b6-ade7-56cb00105464
|
|
version: 2
|
|
date: '2025-01-23'
|
|
author: Patrick Bareiss, Splunk
|
|
description: Logs requests made to AWS CloudFront distributions, including details
|
|
on client access, response data, and performance metrics.
|
|
mitre_components:
|
|
- Network Traffic Content
|
|
- Network Traffic Flow
|
|
- Response Metadata
|
|
- Response Content
|
|
- Logon Session Metadata
|
|
- Cloud Service Metadata
|
|
source: aws
|
|
sourcetype: aws:cloudfront:accesslogs
|
|
supported_TA:
|
|
- name: Splunk Add-on for AWS
|
|
url: https://splunkbase.splunk.com/app/1876
|
|
version: 8.1.1
|
|
fields:
|
|
- _time
|
|
- action
|
|
- app
|
|
- bytes
|
|
- bytes_in
|
|
- bytes_out
|
|
- c_ip
|
|
- c_port
|
|
- cached
|
|
- category
|
|
- client_ip
|
|
- cs_bytes
|
|
- cs_cookie
|
|
- cs_host
|
|
- cs_method
|
|
- cs_protocol
|
|
- cs_protocol_version
|
|
- cs_referer
|
|
- cs_uri_query
|
|
- cs_uri_stem
|
|
- cs_user_agent
|
|
- date
|
|
- date_hour
|
|
- date_mday
|
|
- date_minute
|
|
- date_month
|
|
- date_second
|
|
- date_wday
|
|
- date_year
|
|
- date_zone
|
|
- dest
|
|
- duration
|
|
- edge_location_name
|
|
- eventtype
|
|
- fle_encrypted_fields
|
|
- fle_status
|
|
- host
|
|
- http_content_type
|
|
- http_method
|
|
- http_user_agent
|
|
- http_user_agent_length
|
|
- index
|
|
- linecount
|
|
- punct
|
|
- response_time
|
|
- sc_bytes
|
|
- sc_content_len
|
|
- sc_content_type
|
|
- sc_range_end
|
|
- sc_range_start
|
|
- sc_status
|
|
- source
|
|
- sourcetype
|
|
- splunk_server
|
|
- src
|
|
- src_ip
|
|
- src_port
|
|
- ssl_cipher
|
|
- ssl_protocol
|
|
- status
|
|
- tag
|
|
- tag::eventtype
|
|
- time
|
|
- time_taken
|
|
- time_to_first_byte
|
|
- timeendpos
|
|
- timestartpos
|
|
- uri_path
|
|
- url
|
|
- url_domain
|
|
- url_length
|
|
- vendor_product
|
|
- x_edge_detail_result_type
|
|
- x_edge_location
|
|
- x_edge_request_id
|
|
- x_edge_response_result_type
|
|
- x_edge_result_type
|
|
- x_forwarded_for
|
|
- x_host_header
|
|
example_log: "2023-11-07\t16:58:21\tIAD55-P5\t921\t44.192.78.55\tGET\td3u5aue66f5ui4.cloudfront.net\t\
|
|
/plugins/servlet/com.jsos.shell/ShellServlet\t200\t-\tSlackbot-LinkExpanding%201.0%20(+https://api.slack.com/robots)\t\
|
|
-\t-\tLambdaGeneratedResponse\tsGwvFCkFU4qlMxatCoJRgW87P7Ee8bKQor3U6lRt6I6jaFvLC7vcPA==\t\
|
|
confluence.catjamfest.com\thttps\t232\t0.276\t-\tTLSv1.3\tTLS_AES_128_GCM_SHA256\t\
|
|
LambdaGeneratedResponse\tHTTP/1.1\t-\t-\t57232\t0.276\tLambdaGeneratedResponse\t\
|
|
text/html\t527\t-\t-"
|