Installation
sudo cscli parsers install crowdsecurity/aws-cloudfrontThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
onsuccess: next_stagefilter: "evt.Line.Labels.type == 'aws-cloudfront'"name: crowdsecurity/aws-cloudfrontdescription: "Parse AWS CloudFront access logs"grok:pattern: '%{YEAR:year}-%{MONTHNUM2:month}-%{MONTHDAY:day}\s+%{TIME:time}\s+%{DATA:x_edge_location}\s+%{NUMBER:sc_bytes}\s+%{IP:c_ip}\s+%{WORD:cs_method}\s+%{HOSTNAME:cs_host}\s+%{DATA:cs_uri_stem}\s+%{NUMBER:sc_status}\s+%{DATA:cs_referer}\s+%{DATA:cs_user_agent}\s+%{DATA:cs_uri_query}\s+%{DATA:cs_cookie}\s+%{WORD:x_edge_result_type}\s+%{DATA:x_edge_request_id}\s+%{HOSTNAME:x_host_header}\s+%{WORD:cs_protocol}\s+%{NUMBER:cs_bytes}\s+%{NUMBER:time_taken}\s+%{DATA:x_forwarded_for}\s+%{DATA:ssl_protocol}\s+%{DATA:ssl_cipher}\s+%{WORD:x_edge_response_result_type}\s+%{DATA:cs_protocol_version}\s+%{DATA:fle_status}\s+%{DATA:fle_encrypted_fields}\s+%{NUMBER:c_port}\s+%{NUMBER:time_to_first_byte}\s+%{WORD:x_edge_detailed_result_type}\s+%{DATA:sc_content_type}\s+%{DATA:sc_content_len}\s+%{DATA:sc_range_start}\s+%{DATA:sc_range_end}'apply_on: messagestatics:- meta: servicevalue: http- meta: log_typevalue: http_access-log- target: evt.StrTimeexpression: "evt.Parsed.year + '-' + evt.Parsed.month + '-' + evt.Parsed.day + 'T' + evt.Parsed.time + 'Z'"- meta: source_ipexpression: "evt.Parsed.c_ip"- meta: http_statusexpression: "evt.Parsed.sc_status"- meta: http_pathexpression: |evt.Parsed.cs_uri_query == "-" ? evt.Parsed.cs_uri_stem : evt.Parsed.cs_uri_stem + '?' + evt.Parsed.cs_uri_query- meta: http_verbexpression: "evt.Parsed.cs_method"- meta: http_user_agentexpression: "evt.Parsed.cs_user_agent"
Installed on
Know where it runs
Sign in to see the Security Engines that run this log parser, the version they run and whether it was modified locally.
Documentation
Description
A parser for AWS CloudFront access logs.
Usage
Cloudfront delivers logs to S3, so you can use crowdsec S3 datasource to read the logs.
An example of the configuration is:
1source: s32polling_method: sqs3sqs_name: my-queue4sqs_format: s3notification5aws_region: eu-west-16use_time_machine: true7labels:8 type: aws-cloudfront
Because CloudFront will not deliver the logs in real time, you must set the use_time_machine option to force crowdsec to use the timestamp in the log itself, or you are very likely to run into false positives.