HTTP Fields

HTTP Fields
Field Name Example Values Field Type Notes
http_application   keyword Layer 7 app name, e.g. “Facebook”, etc.
http_bytes integer Long Size of request + response bytes
http_content_type   keyword Mime type of http content https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types
http_headers   keyword Full list of http headers https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
http_host   keyword host: … header from request, if present
http_method GET, POST keyword  
http_path /path/to/resource?option=test keyword Need to review field length/truncation at 8192 characters (consider utf-8). Some may consider the path not to include the “query” (text after the last “/”) but this value may include it.
http_referrer   keyword “referer” header value if present
http_request_bytes   long SIze of request
http_response_bytes   long Size of response
http_response   keyword Text response mapped from the response code https://www.w3.org/Protocols/rfc2616/rfc2616-sec6.html
http_response_code   integer Numeric server response code - 200, 404, 500, etc.
http_url ftp://ftp01.server.internal/file.tar.gz, https://www.graylog.org, https://www.graylog.org/blog keyword Need to review field length/truncation at 8192 characters (consider utf-8)
http_url_category Suspicious, Games keyword  
http_user_agent   keyword Original User Agent (Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:74.0) Gecko/20100101 Firefox/74.0”
http_user_agent_analyzed string text/standard This is a copy of the http_user_agent field
http_user_agent_name   keyword Name of User Agent (Firefox)
http_user_agent_os   keyword Operating System of User Agent
http_user_agent_length   integer String length of original user agent
http_version   keyword HTTP version, e.g 1.0, 1.1, etc.
http_xff   keyword HTTP x-forwarded for header value. Future: May map as IP, need to account for different ways this is presented.
Derived and Enriched Fields (values will be derived or added from external sources)
Field Name Example Values Field Type Notes
http_request_path_analyzed   ** TBD Need to review best analyzer configuration for HTTP paths / consider truncation
http_url_analyzed ftp://ftp01.server.internal/file.tar.gz, https://www.graylog.org, https://www.graylog.org/blog text/standard Optionally copied when a URL must be tokenized. Future: will have to research best analyzer config / consider truncation
http_url_length 9283 long