Installation
sudo cscli parsers install Zaulao/aws-albThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stagefilter: "evt.Line.Labels.type == 'aws-alb'"name: crowdsecurity/aws-albdescription: "Parse AWS ALB access logs"grok:pattern: '%{DATA:type}\s+%{TIMESTAMP_ISO8601:time}\s+%{DATA:elb}\s+%{IP:remote_addr}:%{BASE10NUM:remote_port}\s+(-|(%{IP:target_addr}:%{BASE10NUM:target_port}))\s+%{BASE10NUM:request_processing_time}\s+%{DATA:target_processing_time}\s+%{BASE10NUM:response_processing_time}\s+%{BASE10NUM:elb_status_code}\s+%{DATA:target_status_code}\s+%{BASE10NUM:received_bytes}\s+%{BASE10NUM:sent_bytes}\s+\"%{WORD:http_method}\s+%{DATA:protocol}://%{DATA:host}:%{NUMBER:port}%{DATA:request}\s+HTTP/%{NUMBER:http_version}\"\s+\"%{DATA:http_user_agent}\"\s+%{DATA:ssl_cipher}\s+%{DATA:ssl_protocol}\s+%{DATA:target_group_arn}\s+\"%{DATA:trace_id}\"\s+\"%{DATA:domain_name}\"\s+\"%{DATA:chosen_cert_arn}\"\s+%{DATA:matched_rule_priority}\s+%{TIMESTAMP_ISO8601:request_creation_time}\s+\"%{DATA:actions_executed}\"\s+\"%{DATA:redirect_url}\"\s+\"%{DATA:error_reason}\"\s+\"%{DATA:target_list}\"\s+\"%{DATA:target_status_code_list}\"\s+\"%{DATA:classification}\"\s+\"%{DATA:classification_reason}\"(\s+%{DATA:conn_trace_id}\s+\"%{DATA:transformed_host}\"\s+\"%{DATA:transformed_uri}\"\s+\"%{DATA:request_transform_status}\")?'apply_on: Line.Rawstatics:- meta: log_typevalue: alb_access_logstatics:- meta: servicevalue: http- meta: log_typevalue: http_access-log- target: evt.StrTimeexpression: evt.Parsed.request_creation_time- meta: source_ipexpression: "evt.Parsed.remote_addr"- meta: http_statusexpression: "evt.Parsed.elb_status_code"- meta: http_hostexpression: "evt.Parsed.host"- meta: http_portexpression: "evt.Parsed.port"- meta: http_pathexpression: "evt.Parsed.request"- meta: http_verbexpression: "evt.Parsed.http_method"- meta: http_user_agentexpression: "evt.Parsed.http_user_agent"
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Description
A parser for AWS Application Load Balancer (ALB) access logs. Extracts HTTP request fields from the raw message, which are used for further enrichment and processing. ALB log format is well defined here.
Usage
Application Load Balancers access logs are stored in S3 buckets, as indicated in the official documentation. Therefore, the collection of these logs must start from this data source initially.
The user can collect the logs using the AWS S3 data source, available from version 1.5 of Crowdsec, or use alternatives, such as, for example, other log collection tools that allow saving in a file or any other destinations (in this case, the data source must be specified according to the chosen alternative).
The use of this parser follows the default configuration, that is, it is performed from the acquis.yaml file. Therefore, after configuring the correct data source of the logs, its type must be specified as indicated below:
1labels:2 type: aws-alb
Metadata
The information extracted from the raw log is:
time: The time when the load balancer generated a response to the client;remote_addr: The IP address of the requesting client;elb_status_code: The status code of the response from the load balancer;host: The host name from the request;port: The port of the request;request: The request line URI (i.e. thepath) from the client;verb: The request HTTP method from the client;http_user_agent: A User-Agent string that identifies the client that originated the request.
This information is exported for use in common threat detection scenarios from HTTP requests.