security_content/data_sources/web/Nginx_Access.yml at develop · Alphahpla/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: Nginx Access
id: c716a418-eab3-4df5-9dff-5420174e3068
author: Patrick Bareiss, Splunk
source: /var/log/nginx/access.log
sourcetype: nginx:plus:kv
supported_TA: {}
event_names: []
fields:
  - _time
  - JSESSIONID
  - action
  - app
  - bootstrapStatusProvider_applicationConfig_setupComplete
  - bytes
  - bytes_in
  - bytes_out
  - category
  - charset
  - cookie
  - date_hour
  - date_mday
  - date_minute
  - date_month
  - date_second
  - date_wday
  - date_year
  - date_zone
  - dest
  - dest_ip
  - dest_port
  - eventtype
  - host
  - http_content_type
  - http_method
  - http_referer
  - http_user_agent
  - http_user_agent_length
  - http_x_forwarded_for
  - http_x_header
  - https
  - index
  - linecount
  - nginx_version
  - product
  - protocol
  - punct
  - request_time
  - response_time
  - server
  - site
  - source
  - sourcetype
  - splunk_server
  - src
  - src_ip
  - status
  - status_description
  - status_type
  - tag
  - tag::eventtype
  - time_local
  - timeendpos
  - timestartpos
  - uri_path
  - uri_query
  - url
  - url_domain
  - url_length
  - vendor
  - vendor_product
  - version
  - web_server
example_log:
  site="confluence.catjamfest.com" server="confluence.catjamfest.com" dest_port="80"
  dest_ip="10.0.1.23" src="94.131.112.187" src_ip="94.131.112.187" user="-" time_local="22/Oct/2023:03:03:47
  +0000" protocol="HTTP/1.1" status="200" bytes_out="7411" bytes_in="7378" http_referer="-"
  http_user_agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML,
  like Gecko) Chrome/89.0.4389.114 Safari/537.36" nginx_version="1.18.0" http_x_forwarded_for="-"
  http_x_header="-" uri_query="bootstrapStatusProvider.applicationConfig.setupComplete=0&cache2X5vPeiC6GfiUtoxFW0NDIKQv7i"
  uri_path="/server-info.action" http_method="GET" response_time="0.060" cookie="JSESSIONID=E19F9F16ED5EC7869870D3E9E9E4F548"
  request_time="0.059" category="text/html;charset=UTF-8" https=""