HTTP Fields

HTTP Fields
Field Name Example Values Field Type Notes
http_application facebook keyword Layer 7 application name
http_bytes 29347485 Long Sum of request + response bytes
http_content_type application/octet-stream keyword Mime type of http content
http_headers   keyword Full list of http headers
http_host Host: wwww.mycorp.local keyword host: … header from request, if present
http_method GET, POST keyword HTTP request method from
http_referrer http://mycorp.local/ keyword “referer” header value if present
http_request_bytes 239478 long SIze of request
http_request_path /path/to/resource?option=test keyword Need to review field length/truncation at 8192 characters (consider utf-8). Some may consider the path not to include the “query” (text after the last “/”) but this value may include it.
http_response_bytes 498274 long Size of response
http_response OK, Moved Permanently keyword Text response mapped from the response code
http_response_code 200, 404, 500 integer Numeric server response code
http_uri,, https://www.mycorp.local/workspaces/team#posts keyword Full request string; Need to review field length/truncation at 8192 characters (consider utf-8)
http_uri_category Suspicious, Games keyword Categorization of associated web site/URL
http_user_agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:74.0) Gecko/20100101 Firefox/74.0) keyword User Agent string
http_user_agent_name Firefox keyword Attempted identification of the browser client usually based on user agent analysis
http_user_agent_os Windows 10 keyword Operating System of User Agent
http_version 1.0, 1.1, 2.0 keyword HTTP version
http_xff X-Forwarded-For: keyword HTTP x-forwarded-for header value. Future: May map as IP, need to account for different ways this is presented.
Derived and Enriched Fields (values will be derived or added from external sources)
Field Name Example Values Field Type Notes
http_request_path_analyzed   ** TBD Need to review best analyzer configuration for HTTP paths / consider truncation
http_uri_analyzed ftp://ftp01.server.internal/file.tar.gz,, text/standard Optionally copied when a URL must be tokenized. Future: will have to research best analyzer config / consider truncation
http_uri_length 9283 long String length of HTTP user agent
http_user_agent_analyzed   text/standard This is a copy of the http_user_agent field but processed with text analysis
http_user_agent_length 54 long String length of original user agent