CloudFront logs
Overview
Amazon CloudFront is a web service that speeds up distribution of your static and dynamic web content, such as .html, .css, .js, and image files, to your users. CloudFront delivers your content through a worldwide network of data centers called edge locations. When a user requests content that you're serving with CloudFront, the request is routed to the edge location that provides the lowest latency (time delay), so that content is delivered with the best possible performance.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake AWS CloudFront. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x AWS CloudFront on ATT&CK Navigator
Burp Suite Tool Detected
Burp Suite is a cybersecurity tool. When used as a proxy service, its purpose is to intercept packets and modify them to send them to the server. Burp Collaborator is a network service that Burp Suite uses to help discover many kinds of vulnerabilities (vulnerabilities scanner).
- Effort: intermediate
Nimbo-C2 User Agent
Nimbo-C2 Uses an unusual User-Agent format in its implants.
- Effort: intermediate
Potential Azure AD Phishing Page (Adversary-in-the-Middle)
Detects an HTTP request to an URL typical of the Azure AD authentication flow, but towards a domain that is not one the legitimate Microsoft domains used for Azure AD authentication.
- Effort: intermediate
Potential Bazar Loader User-Agents
Detects potential Bazar loader communications through the user-agent
- Effort: elementary
Potential DNS Tunnel
Detects domain name which is longer than 95 characters. Long domain names are distinctive of DNS tunnels.
- Effort: advanced
Potential Lemon Duck User-Agent
Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".
- Effort: elementary
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Telegram Bot API Request
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
- Effort: advanced
Event Categories
The following table lists the data source offered by this integration.
Data Source | Description |
---|---|
Web logs |
Web visitor logs coming from CloudFront |
In details, the following table denotes the type of events produced by this integration.
Name | Values |
---|---|
Kind | `` |
Category | web |
Type | access |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "{\"date\":\"2023-12-05\",\"x-edge-location\":\"test-P1\",\"sc-bytes\":\"484\",\"c-ip\":\"0000:111:222:3333:4444:5555:6666:7777\",\"cs-method\":\"GET\",\"cs(Host)\":\"dtest.cloudfront.net\",\"cs-uri-stem\":\"/\",\"sc-status\":\"302\",\"cs(Referer)\":\"-\",\"cs(User-Agent)\":\"Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15\",\"cs-uri-query\":\"-\",\"cs(Cookie)\":\"-\",\"x-edge-result-type\":\"Miss\",\"x-edge-request-id\":\"Dw16HXgISOWLclFzkdTDjdlWWwg==\",\"x-host-header\":\"test.cloudfront.net\",\"cs-protocol\":\"https\",\"cs-bytes\":\"258\",\"time-taken\":\"0.358\",\"x-forwarded-for\":\"-\",\"ssl-protocol\":\"TLSv1.3\",\"ssl-cipher\":\"TLS_SHA256\",\"x-edge-response-result-type\":\"Miss\",\"cs-protocol-version\":\"HTTP/2.0\",\"fle-status\":\"-\",\"fle-encrypted-fields\":\"-\",\"c-port\":\"58622\",\"time-to-first-byte\":\"0.358\",\"x-edge-detailed-result-type\":\"Miss\",\"sc-content-type\":\"text/html;%20charset=UTF-8\",\"sc-content-len\":\"0\",\"sc-range-start\":\"-\",\"sc-range-end\":\"-\",\"start_time\":\"16:15:33\", \"end_time\":\"16:15:33\" ,\"count\":\"3\"}",
"event": {
"action": "Miss",
"category": [
"web"
],
"type": [
"access"
]
},
"@timestamp": "2023-12-05T16:15:33Z",
"cloud": {
"provider": "aws",
"service": {
"name": "cloudfront"
}
},
"destination": {
"address": "dtest.cloudfront.net",
"domain": "dtest.cloudfront.net",
"registered_domain": "cloudfront.net",
"subdomain": "dtest",
"top_level_domain": "net"
},
"http": {
"request": {
"method": "GET"
},
"response": {
"status_code": 302
}
},
"network": {
"protocol": "https"
},
"related": {
"hosts": [
"dtest.cloudfront.net"
],
"ip": [
"0:111:222:3333:4444:5555:6666:7777"
]
},
"sekoiaio": {
"repeat": {
"count": "3"
}
},
"server": {
"geo": {
"name": "test-P1"
}
},
"source": {
"address": "0:111:222:3333:4444:5555:6666:7777",
"ip": "0:111:222:3333:4444:5555:6666:7777",
"port": 58622
},
"url": {
"path": "/"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Safari",
"original": "Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15",
"os": {
"name": "Other"
},
"version": "17.1"
}
}
{
"message": "{\"date\":\"2023-12-05\",\"x-edge-location\":\"test-P1\",\"sc-bytes\":\"484\",\"c-ip\":\"0000:111:222:3333:4444:5555:6666:7777\",\"cs-method\":\"GET\",\"cs(Host)\":\"dtest.cloudfront.net\",\"cs-uri-stem\":\"/\",\"sc-status\":\"302\",\"cs(Referer)\":\"-\",\"cs(User-Agent)\":\"Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15\",\"cs-uri-query\":\"-\",\"cs(Cookie)\":\"-\",\"x-edge-result-type\":\"Miss\",\"x-edge-request-id\":\"Dw16HXgISOWLclFzkdTDjdlWWwg==\",\"x-host-header\":\"test.cloudfront.net\",\"cs-protocol\":\"https\",\"cs-bytes\":\"258\",\"time-taken\":\"0.358\",\"x-forwarded-for\":\"-\",\"ssl-protocol\":\"TLSv1.3\",\"ssl-cipher\":\"TLS_SHA256\",\"x-edge-response-result-type\":\"RefreshHit\",\"cs-protocol-version\":\"HTTP/2.0\",\"fle-status\":\"-\",\"fle-encrypted-fields\":\"-\",\"c-port\":\"58622\",\"time-to-first-byte\":\"0.358\",\"x-edge-detailed-result-type\":\"Miss\",\"sc-content-type\":\"text/html;%20charset=UTF-8\",\"sc-content-len\":\"0\",\"sc-range-start\":\"-\",\"sc-range-end\":\"-\", \"start_time\":\"16:15:33\", \"end_time\":\"16:15:33\", \"count\": 1}",
"event": {
"action": "RefreshHit",
"category": [
"web"
],
"type": [
"access"
]
},
"@timestamp": "2023-12-05T16:15:33Z",
"cloud": {
"provider": "aws",
"service": {
"name": "cloudfront"
}
},
"destination": {
"address": "dtest.cloudfront.net",
"domain": "dtest.cloudfront.net",
"registered_domain": "cloudfront.net",
"subdomain": "dtest",
"top_level_domain": "net"
},
"http": {
"request": {
"method": "GET"
},
"response": {
"status_code": 302
}
},
"network": {
"protocol": "https"
},
"related": {
"hosts": [
"dtest.cloudfront.net"
],
"ip": [
"0:111:222:3333:4444:5555:6666:7777"
]
},
"sekoiaio": {
"repeat": {
"count": 1
}
},
"server": {
"geo": {
"name": "test-P1"
}
},
"source": {
"address": "0:111:222:3333:4444:5555:6666:7777",
"ip": "0:111:222:3333:4444:5555:6666:7777",
"port": 58622
},
"url": {
"path": "/"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Safari",
"original": "Mozilla/5.0%20(Macintosh;%20Intel%20Mac%20OS%20X%2010_15_7)%20AppleWebKit/605.1.15%20(KHTML,%20like%20Gecko)%20Version/17.1%20Safari/605.1.15",
"os": {
"name": "Other"
},
"version": "17.1"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
Name | Type | Description |
---|---|---|
@timestamp |
date |
Date/time when the event originated. |
cloud.provider |
keyword |
Name of the cloud provider. |
cloud.service.name |
keyword |
The cloud service name. |
destination.domain |
keyword |
The domain name of the destination. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
http.request.method |
keyword |
HTTP request method. |
http.response.status_code |
long |
HTTP response status code. |
network.protocol |
keyword |
Application protocol name. |
server.geo.name |
keyword |
User-defined description of a location. |
source.ip |
ip |
IP address of the source. |
source.port |
long |
Port of the source. |
url.path |
wildcard |
Path of the request, such as "/search". |
user_agent.original |
keyword |
Unparsed user_agent string. |
Configure
Important
Cloudfront have strict requirements regarding regions. Make sure to check the regions availabled before creating the data collection architecture.
Deploying the Data Collection Architecture
This section will guide you through creating all the AWS resources needed to collect AWS logs. If you already have existing resources that you want to use, you may do so, but any potential issues or incompatibilities with this tutorial will be your responsibility.
Prerequisites
In order to set up the AWS architecture, you need an administator access to the Amazon console with the permissions to create and manage S3 buckets, SQS queues, S3 notifications and users.
To get started, click on the button below and fill the form on AWS to set up the required environment for Sekoia
You need to fill 4 inputs:
- Stack name - Name of the stack in CloudFormation (Name of the template)
- BucketName - Name of the S3 Bucket
- IAMUserName - Name of the dedicated user to access the S3 and SQS queue
- SQSName - Name of the SQS queue
Read the different pages and click on Next
, then click on Submit
.
You can follow the creation in the Events
tab (it can take few minutes).
Once finished, it should be displayed on the left CREATE_COMPLETE
. Click on the Outputs
tab in order to retrieve the information needed for Sekoia playbook.
Create a S3 Bucket
Please refer to this guide to create a S3 Bucket.
Create a SQS queue
The collect will rely on S3 Event Notifications (SQS) to get new S3 objects.
- Create a queue in the SQS service by following this guide
- In the Access Policy step, choose the advanced configuration and adapt this configuration sample with your own SQS Amazon Resource Name (ARN) (the main change is the Service directive allowing S3 bucket access):
{ "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__owner_statement", "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "SQS:SendMessage", "Resource": "arn:aws:sqs:XXX:XXX" } ] }
Important
Keep in mind that you have to create the SQS queue in the same region as the S3 bucket you want to watch.
Create a S3 Event Notification
Use the following guide to create S3 Event Notification. Once created:
- Select the notification for object creation in the Event type section
- As the destination, choose the SQS service
- Select the queue you created in the previous section
CloudFront Logs
You can configure CloudFront to create log files that contain detailed information about every user request that CloudFront receives. These are called standard logs, also known as access logs.
First of all, follow the regions and s3 buckets requirements
also your AWS account must have the following permissions for the bucket that you specify for log files - see this link for more information:
- The S3 access control list (ACL) for the bucket must grant you FULL_CONTROL. If you're the bucket owner, your account has this permission by default. If you're not, the bucket owner must update the ACL for the bucket.
- s3:GetBucketAcl
- s3:PutBucketAcl
To turn on standard logging for a CloudFront distribution, follow these steps:
- Access the CloudFront console.
- Choose the distribution you want to update.
- On the General tab, under Settings, choose Edit.
- For Standard logging, select On.
- Choose the S3 bucket where you want CloudFront to deliver the log files. You can specify an optional prefix for the file names.
- Choose Save changes.
Create the intake
Go to the intake page and create a new intake from the format AWS CloudFront
Pull events
To start to pull events, you have to:
- Go to the playbook page and create a new playbook with the Fetch new CloudFront logs on S3.
- Set up the module configuration with the AWS Access Key, the secret key and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key, from the intake previously created.
- Start the playbook and enjoy your events.