Amazon CloudFront Logs

Overview

Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFront, the request is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.

• Vendor: Cisco
• Supported environment: SaaS
• Detection based on: Telemetry
• Supported application or feature: Web logs

Configure

Important

Cloudfront have strict requirements regarding regions. Make sure to check the regions availabled before creating the data collection architecture.

Deploying the Data Collection Architecture

This section will guide you through creating all the AWS resources needed to collect AWS logs. If you already have existing resources that you want to use, you may do so, but any potential issues or incompatibilities with this tutorial will be your responsibility.

Prerequisites

In order to set up the AWS architecture, you need an administator access to the Amazon console with the permissions to create and manage S3 buckets, SQS queues, S3 notifications and users.

AutomaticManual

To get started, click on the button below and fill the form on AWS to set up the required environment for Sekoia

You need to fill 4 inputs:

• Stack name - Name of the stack in CloudFormation (Name of the template)
• BucketName - Name of the S3 Bucket
• IAMUserName - Name of the dedicated user to access the S3 and SQS queue
• SQSName - Name of the SQS queue

Read the different pages and click on Next, then click on Submit.

You can follow the creation in the Events tab (it can take few minutes).

Once finished, it should be displayed on the left CREATE_COMPLETE. Click on the Outputs tab in order to retrieve the information needed for Sekoia playbook.

Create a S3 Bucket

Please refer to this guide to create a S3 Bucket.

Create a SQS queue

The collect will rely on S3 Event Notifications (SQS) to get new S3 objects.

1. Create a queue in the SQS service by following this guide
2. In the Access Policy step, choose the advanced configuration and adapt this configuration sample with your own SQS Amazon Resource Name (ARN) (the main change is the Service directive allowing S3 bucket access):

   {
     "Version": "2008-10-17",
     "Id": "__default_policy_ID",
     "Statement": [
       {
         "Sid": "__owner_statement",
         "Effect": "Allow",
         "Principal": {
           "Service": "s3.amazonaws.com"
         },
         "Action": "SQS:SendMessage",
         "Resource": "arn:aws:sqs:XXX:XXX"
       }
     ]
   }
   

Important

Keep in mind that you have to create the SQS queue in the same region as the S3 bucket you want to watch.

** Create a S3 Event Notification **

Use the following guide to create S3 Event Notification. Once created:

1. Select the notification for object creation in the Event type section
2. As the destination, choose the SQS service
3. Select the queue you created in the previous section

CloudFront Logs

You can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives. These are called standard logs, also known as access logs.

First of all, follow the regions and s3 buckets requirements

also your AWS account must have the following permissions for the bucket that you specify for log files - see this link for more information:

• The S3 access control list (ACL) for the bucket must grant you FULL_CONTROL. If you're the bucket owner, your account has this permission by default. If you're not, the bucket owner must update the ACL for the bucket.
• s3:GetBucketAcl
• s3:PutBucketAcl

To turn on standard logging for a CloudFront distribution, follow these steps:

1. Access the CloudFront console.
2. Choose the distribution you want to update.
3. On the General tab, under Settings, choose Edit.
4. For Standard logging, select On.
5. Choose the S3 bucket where you want CloudFront to deliver the log files. You can specify an optional prefix for the file names.
6. Choose Save changes.

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

1. Go to the Sekoia Intake page.
2. Click on the + New Intake button at the top right of the page.
3. Search for your Intake by the product name in the search bar.
4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
5. Click on Create.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Pull events

Create your intake

1. Go to the intake page and create a new intake from the AWS CloudFront.
2. Set up the intake account configuration with the AWS Access Key, the secret key and the region name. Set up the intake configuration with the name of the SQS queue

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

get_recordmiss_recordrefresh_record

{
    "date": "2024-07-17",
    "x-edge-location": "XXXXXXX",
    "sc-bytes": "1289",
    "c-ip": "1.2.3.4",
    "cs-method": "GET",
    "cs(Host)": "xxxxxxxxxxxx.cloudfront.net",
    "cs-uri-stem": "/en-us/api/",
    "sc-status": "200",
    "cs(Referer)": "-",
    "cs(User-Agent)": "_",
    "cs-uri-query": "-",
    "cs(Cookie)": "-",
    "x-edge-result-type": "Miss",
    "x-edge-request-id": "_",
    "x-host-header": "cache.example.org",
    "cs-protocol": "https",
    "cs-bytes": "_",
    "time-taken": "_",
    "x-forwarded-for": "_",
    "ssl-protocol": "TLSv1.3",
    "ssl-cipher": "TLS_AES_128_GCM_SHA256",
    "x-edge-response-result-type": "Miss",
    "cs-protocol-version": "HTTP/1.1",
    "fle-status": "-",
    "fle-encrypted-fields": "-",
    "c-port": "_",
    "time-to-first-byte": "_",
    "x-edge-detailed-result-type": "Miss",
    "sc-content-type": "application/json",
    "sc-content-len": "-",
    "sc-range-start": "-",
    "sc-range-end": "-",
    "count": 2,
    "start_time": "09:08:27",
    "end_time": "09:08:27"
}

{
    "date": "2023-12-05",
    "x-edge-location": "test-P1",
    "sc-bytes": "484",
    "c-ip": "0000:111:222:3333:4444:5555:6666:7777",
    "cs-method": "GET",
    "cs(Host)": "dtest.cloudfront.net",
    "cs-uri-stem": "/",
    "sc-status": "302",
    "cs(Referer)": "-",
    "cs(User-Agent)": "Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15",
    "cs-uri-query": "-",
    "cs(Cookie)": "-",
    "x-edge-result-type": "Miss",
    "x-edge-request-id": "Dw16HXgISOWLclFzkdTDjdlWWwg==",
    "x-host-header": "test.cloudfront.net",
    "cs-protocol": "https",
    "cs-bytes": "258",
    "time-taken": "0.358",
    "x-forwarded-for": "-",
    "ssl-protocol": "TLSv1.3",
    "ssl-cipher": "TLS_SHA256",
    "x-edge-response-result-type": "Miss",
    "cs-protocol-version": "HTTP/2.0",
    "fle-status": "-",
    "fle-encrypted-fields": "-",
    "c-port": "58622",
    "time-to-first-byte": "0.358",
    "x-edge-detailed-result-type": "Miss",
    "sc-content-type": "text/html;%20charset=UTF-8",
    "sc-content-len": "0",
    "sc-range-start": "-",
    "sc-range-end": "-",
    "start_time": "16:15:33",
    "end_time": "16:15:33",
    "count": "3"
}

{
    "date": "2023-12-05",
    "x-edge-location": "test-P1",
    "sc-bytes": "484",
    "c-ip": "0000:111:222:3333:4444:5555:6666:7777",
    "cs-method": "GET",
    "cs(Host)": "dtest.cloudfront.net",
    "cs-uri-stem": "/",
    "sc-status": "302",
    "cs(Referer)": "-",
    "cs(User-Agent)": "Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15",
    "cs-uri-query": "-",
    "cs(Cookie)": "-",
    "x-edge-result-type": "Miss",
    "x-edge-request-id": "Dw16HXgISOWLclFzkdTDjdlWWwg==",
    "x-host-header": "test.cloudfront.net",
    "cs-protocol": "https",
    "cs-bytes": "258",
    "time-taken": "0.358",
    "x-forwarded-for": "-",
    "ssl-protocol": "TLSv1.3",
    "ssl-cipher": "TLS_SHA256",
    "x-edge-response-result-type": "RefreshHit",
    "cs-protocol-version": "HTTP/2.0",
    "fle-status": "-",
    "fle-encrypted-fields": "-",
    "c-port": "58622",
    "time-to-first-byte": "0.358",
    "x-edge-detailed-result-type": "Miss",
    "sc-content-type": "text/html;%20charset=UTF-8",
    "sc-content-len": "0",
    "sc-range-start": "-",
    "sc-range-end": "-",
    "start_time": "16:15:33",
    "end_time": "16:15:33",
    "count": 1
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Related Built-in Rules

The following Sekoia.io built-in rules match the intake AWS CloudFront. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x AWS CloudFront on ATT&CK Navigator

Burp Suite Tool Detected

Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner).

• Effort: intermediate

Correlation Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

• Effort: advanced

Covenant Default HTTP Beaconing

Detects potential Covenant communications through the user-agent and specific urls

• Effort: intermediate

Cryptomining

Detection of domain names potentially related to cryptomining activities.

• Effort: master

Discord Suspicious Download

Discord is a messaging application. It allows users to create their own communities to share messages and attachments. Those attachments have little to no overview and can be downloaded by almost anyone, which has been abused by attackers to host malicious payloads.

• Effort: intermediate

Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

• Effort: master

EvilProxy Phishing Domain

Detects subdomains potentially generated by the EvilProxy adversary-in-the-middle phishing platform. Inspect the other subdomains of the domain to identify the landing page, and determine if the user submitted credentials. This rule has a small percentage of false positives on legitimate domains.

• Effort: intermediate

Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

• Effort: master

Koadic MSHTML Command

Detects Koadic payload using MSHTML module

• Effort: intermediate

Nimbo-C2 User Agent

Nimbo-C2 Uses an unusual User-Agent format in its implants.

• Effort: intermediate

Potential Azure AD Phishing Page (Adversary-in-the-Middle)

Detects an HTTP request to an URL typical of the Azure AD authentication flow, but towards a domain that is not one the legitimate Microsoft domains used for Azure AD authentication.

• Effort: intermediate

Potential Bazar Loader User-Agents

Detects potential Bazar loader communications through the user-agent

• Effort: elementary

Potential DNS Tunnel

Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.

• Effort: advanced

Potential Lemon Duck User-Agent

Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".

• Effort: elementary

Potential LokiBot User-Agent

Detects potential LokiBot communications through the user-agent

• Effort: intermediate

Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

• Effort: master

Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

• Effort: master

Remote Monitoring and Management Software - Atera

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.

• Effort: master

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

• Effort: elementary

Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

• Effort: master

Suspicious TOR Gateway

Detects suspicious TOR gateways. Gateways are often used by the victim to pay and decrypt the encrypted files without installing TOR. Tor intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

• Effort: advanced

TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

• Effort: master

Telegram Bot API Request

Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

• Effort: advanced

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
Web logs	Web visitor logs coming from CloudFront

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	``
Category	web
Type	access

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

get_record.jsonmiss_record.jsonrefresh_record.json

{
    "message": "{\"date\":\"2024-07-17\",\"x-edge-location\":\"XXXXXXX\",\"sc-bytes\":\"1289\",\"c-ip\":\"1.2.3.4\",\"cs-method\":\"GET\",\"cs(Host)\":\"xxxxxxxxxxxx.cloudfront.net\",\"cs-uri-stem\":\"/en-us/api/\",\"sc-status\":\"200\",\"cs(Referer)\":\"-\",\"cs(User-Agent)\":\"_\",\"cs-uri-query\":\"-\",\"cs(Cookie)\":\"-\",\"x-edge-result-type\":\"Miss\",\"x-edge-request-id\":\"_\",\"x-host-header\":\"cache.example.org\",\"cs-protocol\":\"https\",\"cs-bytes\":\"_\",\"time-taken\":\"_\",\"x-forwarded-for\":\"_\",\"ssl-protocol\":\"TLSv1.3\",\"ssl-cipher\":\"TLS_AES_128_GCM_SHA256\",\"x-edge-response-result-type\":\"Miss\",\"cs-protocol-version\":\"HTTP/1.1\",\"fle-status\":\"-\",\"fle-encrypted-fields\":\"-\",\"c-port\":\"_\",\"time-to-first-byte\":\"_\",\"x-edge-detailed-result-type\":\"Miss\",\"sc-content-type\":\"application/json\",\"sc-content-len\":\"-\",\"sc-range-start\":\"-\",\"sc-range-end\":\"-\",\"count\":2,\"start_time\":\"09:08:27\",\"end_time\":\"09:08:27\"}\n",
    "event": {
        "action": "Miss",
        "category": [
            "web"
        ],
        "type": [
            "access"
        ]
    },
    "@timestamp": "2024-07-17T09:08:27Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudfront"
        }
    },
    "destination": {
        "address": "xxxxxxxxxxxx.cloudfront.net",
        "domain": "xxxxxxxxxxxx.cloudfront.net",
        "registered_domain": "cloudfront.net",
        "subdomain": "xxxxxxxxxxxx",
        "top_level_domain": "net"
    },
    "http": {
        "request": {
            "method": "GET"
        },
        "response": {
            "status_code": 200
        }
    },
    "network": {
        "protocol": "https"
    },
    "related": {
        "hosts": [
            "xxxxxxxxxxxx.cloudfront.net"
        ],
        "ip": [
            "1.2.3.4"
        ]
    },
    "sekoiaio": {
        "repeat": {
            "count": 2
        }
    },
    "server": {
        "geo": {
            "name": "XXXXXXX"
        }
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "url": {
        "path": "/en-us/api/"
    }
}

{
    "message": "{\"date\":\"2023-12-05\",\"x-edge-location\":\"test-P1\",\"sc-bytes\":\"484\",\"c-ip\":\"0000:111:222:3333:4444:5555:6666:7777\",\"cs-method\":\"GET\",\"cs(Host)\":\"dtest.cloudfront.net\",\"cs-uri-stem\":\"/\",\"sc-status\":\"302\",\"cs(Referer)\":\"-\",\"cs(User-Agent)\":\"Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15\",\"cs-uri-query\":\"-\",\"cs(Cookie)\":\"-\",\"x-edge-result-type\":\"Miss\",\"x-edge-request-id\":\"Dw16HXgISOWLclFzkdTDjdlWWwg==\",\"x-host-header\":\"test.cloudfront.net\",\"cs-protocol\":\"https\",\"cs-bytes\":\"258\",\"time-taken\":\"0.358\",\"x-forwarded-for\":\"-\",\"ssl-protocol\":\"TLSv1.3\",\"ssl-cipher\":\"TLS_SHA256\",\"x-edge-response-result-type\":\"Miss\",\"cs-protocol-version\":\"HTTP/2.0\",\"fle-status\":\"-\",\"fle-encrypted-fields\":\"-\",\"c-port\":\"58622\",\"time-to-first-byte\":\"0.358\",\"x-edge-detailed-result-type\":\"Miss\",\"sc-content-type\":\"text/html;%20charset=UTF-8\",\"sc-content-len\":\"0\",\"sc-range-start\":\"-\",\"sc-range-end\":\"-\",\"start_time\":\"16:15:33\", \"end_time\":\"16:15:33\" ,\"count\":\"3\"}",
    "event": {
        "action": "Miss",
        "category": [
            "web"
        ],
        "type": [
            "access"
        ]
    },
    "@timestamp": "2023-12-05T16:15:33Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudfront"
        }
    },
    "destination": {
        "address": "dtest.cloudfront.net",
        "domain": "dtest.cloudfront.net",
        "registered_domain": "cloudfront.net",
        "subdomain": "dtest",
        "top_level_domain": "net"
    },
    "http": {
        "request": {
            "method": "GET"
        },
        "response": {
            "status_code": 302
        }
    },
    "network": {
        "protocol": "https"
    },
    "related": {
        "hosts": [
            "dtest.cloudfront.net"
        ],
        "ip": [
            "0:111:222:3333:4444:5555:6666:7777"
        ]
    },
    "sekoiaio": {
        "repeat": {
            "count": "3"
        }
    },
    "server": {
        "geo": {
            "name": "test-P1"
        }
    },
    "source": {
        "address": "0:111:222:3333:4444:5555:6666:7777",
        "ip": "0:111:222:3333:4444:5555:6666:7777",
        "port": 58622
    },
    "url": {
        "path": "/"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Safari",
        "original": "Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15",
        "os": {
            "name": "Other"
        },
        "version": "17.1"
    }
}

{
    "message": "{\"date\":\"2023-12-05\",\"x-edge-location\":\"test-P1\",\"sc-bytes\":\"484\",\"c-ip\":\"0000:111:222:3333:4444:5555:6666:7777\",\"cs-method\":\"GET\",\"cs(Host)\":\"dtest.cloudfront.net\",\"cs-uri-stem\":\"/\",\"sc-status\":\"302\",\"cs(Referer)\":\"-\",\"cs(User-Agent)\":\"Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15\",\"cs-uri-query\":\"-\",\"cs(Cookie)\":\"-\",\"x-edge-result-type\":\"Miss\",\"x-edge-request-id\":\"Dw16HXgISOWLclFzkdTDjdlWWwg==\",\"x-host-header\":\"test.cloudfront.net\",\"cs-protocol\":\"https\",\"cs-bytes\":\"258\",\"time-taken\":\"0.358\",\"x-forwarded-for\":\"-\",\"ssl-protocol\":\"TLSv1.3\",\"ssl-cipher\":\"TLS_SHA256\",\"x-edge-response-result-type\":\"RefreshHit\",\"cs-protocol-version\":\"HTTP/2.0\",\"fle-status\":\"-\",\"fle-encrypted-fields\":\"-\",\"c-port\":\"58622\",\"time-to-first-byte\":\"0.358\",\"x-edge-detailed-result-type\":\"Miss\",\"sc-content-type\":\"text/html;%20charset=UTF-8\",\"sc-content-len\":\"0\",\"sc-range-start\":\"-\",\"sc-range-end\":\"-\", \"start_time\":\"16:15:33\", \"end_time\":\"16:15:33\", \"count\": 1}",
    "event": {
        "action": "RefreshHit",
        "category": [
            "web"
        ],
        "type": [
            "access"
        ]
    },
    "@timestamp": "2023-12-05T16:15:33Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudfront"
        }
    },
    "destination": {
        "address": "dtest.cloudfront.net",
        "domain": "dtest.cloudfront.net",
        "registered_domain": "cloudfront.net",
        "subdomain": "dtest",
        "top_level_domain": "net"
    },
    "http": {
        "request": {
            "method": "GET"
        },
        "response": {
            "status_code": 302
        }
    },
    "network": {
        "protocol": "https"
    },
    "related": {
        "hosts": [
            "dtest.cloudfront.net"
        ],
        "ip": [
            "0:111:222:3333:4444:5555:6666:7777"
        ]
    },
    "sekoiaio": {
        "repeat": {
            "count": 1
        }
    },
    "server": {
        "geo": {
            "name": "test-P1"
        }
    },
    "source": {
        "address": "0:111:222:3333:4444:5555:6666:7777",
        "ip": "0:111:222:3333:4444:5555:6666:7777",
        "port": 58622
    },
    "url": {
        "path": "/"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Safari",
        "original": "Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15",
        "os": {
            "name": "Other"
        },
        "version": "17.1"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
@timestamp	date	Date/time when the event originated.
cloud.provider	keyword	Name of the cloud provider.
cloud.service.name	keyword	The cloud service name.
destination.domain	keyword	The domain name of the destination.
event.action	keyword	The action captured by the event.
event.category	keyword	Event category. The second categorization field in the hierarchy.
event.type	keyword	Event type. The third categorization field in the hierarchy.
http.request.method	keyword	HTTP request method.
http.response.status_code	long	HTTP response status code.
network.protocol	keyword	Application protocol name.
server.geo.name	keyword	User-defined description of a location.
source.ip	ip	IP address of the source.
source.port	long	Port of the source.
url.path	wildcard	Path of the request, such as "/search".
user_agent.original	keyword	Unparsed user_agent string.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further Readings

• AWS CloudFront configuration doc