AWS CloudFront

Connecting AWS CloudFront standard logs to Panther

Overview

Panther supports ingesting Amazon Web Services (AWS) CloudFront standard logs (also known as access logs) via AWS S3.

How to onboard AWS CloudFront standard logs to Panther

Step 1: Enable standard logging in your CloudFront distribution

To pull CloudFront logs into Panther, you'll first need to enable standard logging in the CloudFront distribution you want to monitor. The instructions below explain how to edit an existing distribution, but it's also possible to activate standard logging while creating a new distribution.

1. In your AWS console, navigate to CloudFront.

2. In the left-hand navigation bar, click Distributions.

   • Locate the distribution of interest, then click it.

3. In the upper-right corner of the Settings tile, click Edit.

4. Scroll down to the Standard logging field, and set it to On. Configure the fields that appear:

   • S3 bucket: Enter the name of the bucket you'd like the logs to be sent to.

   • Log prefix - optional: If you'd like, enter a prefix value to be prepended to log file names.

   • Cookie logging: Optionally set this field to On.

     • If Cookie logging is set to On, the AWS.CloudFrontAccess schema will capture cookies sent in standard logs.

Step 2: Create a CloudFront log source in Panther

If the S3 bucket where you are routing CloudFront standard logs is already onboarded in Panther, you can simply attach the AWS.CloudFrontAccess schema to that source and skip this step.

1. In the left-hand navigation bar of your Panther Console, click Configure > Log Sources.

2. Click Create New.

3. Search for "AWS CloudFront," then click its tile.

4. In the slide-out panel, click Start Setup.\

   
5. Follow Panther’s documentation for configuring S3.

   • You will need to provide the name of the S3 bucket you used in Step 1.

Supported Logs

AWS.CloudFrontAccess

schema: AWS.CloudFrontAccess
parser:
    csv:
        delimiter: "\t"
        columns:
            - date
            - time
            - x-edge-location
            - sc-bytes
            - c-ip
            - cs-method
            - cs-Host
            - cs-uri-stem
            - sc-status
            - cs-Referer
            - cs-UserAgent
            - cs-uri-query
            - cs-Cookie
            - x-edge-result-type
            - x-edge-request-id
            - x-host-header
            - cs-protocol
            - cs-bytes
            - time-taken
            - x-forwarded-for
            - ssl-protocol
            - ssl-cipher
            - x-edge-response-result-type
            - cs-protocol-version
            - fle-status
            - fle-encrypted-fields
            - c-port
            - time-to-first-byte
            - x-edge-detailed-result-type
            - sc-content-type
            - sc-content-len
            - sc-range-start
            - sc-range-end
        skipPrefix: '#'
        emptyValues:
            - '-'
        expandFields:
            timestamp: '%{date} %{time}'
fields:
    - name: timestamp
      description: The datetime (date and time) on which the event occurred.
      type: timestamp
      timeFormat: '%Y-%m-%d %H:%M:%S'
      isEventTime: true
    - name: x-edge-location
      description: The AWS Edge Location that handled the request.
      type: string
    - name: sc-bytes
      description: The number of bytes sent to the client.
      type: bigint
    - name: c-ip
      description: The IP address of the viewer that made the request.
      type: string
      indicators:
        - ip
    - name: cs-method
      description: The HTTP method used in the request.
      type: string
    - name: cs-Host
      description: The host header in the request.
      type: string
      indicators:
        - hostname
    - name: cs-uri-stem
      description: The URI stem of the request.
      type: string
    - name: sc-status
      description: The HTTP status code of the response.
      type: bigint
    - name: cs-Referer
      description: The HTTP referrer.
      type: string
      indicators:
        - url
    - name: cs-UserAgent
      description: The User-Agent header in the request.
      type: string
    - name: cs-uri-query
      description: The query string portion of the URI.
      type: string
    - name: cs-Cookie
      description: The Cookie header in the request, if any.
      type: string
    - name: x-edge-result-type
      description: The type of result of the request.
      type: string
    - name: x-edge-request-id
      description: The unique request ID generated by CloudFront.
      type: string
    - name: x-host-header
      description: The host header in the request.
      type: string
    - name: cs-protocol
      description: The protocol used in the request.
      type: string
    - name: cs-bytes
      description: The response bytes.
      type: bigint
    - name: time-taken
      description: The time in seconds from when the server receives the viewer's request to when the server writes the last byte of the response to the output queue.
      type: float
    - name: x-forwarded-for
      description: The IP address of the viewer that originated the request.
      type: string
      indicators:
        - ip
    - name: ssl-protocol
      description: The SSL/TLS protocol negotiated for transmitting the request and response.
      type: string
    - name: ssl-cipher
      description: The SSL/TLS cipher negotiated for encrypting the request and response.
      type: string
    - name: x-edge-response-result-type
      description: 'How the server classified the response just before returning it to the viewer. Can be one of: Hit, RefreshHit, Miss, LimitExceeded, CapacityExceeded, Error, Redirect'
      type: string
    - name: cs-protocol-version
      description: The HTTP version specified by the viewer in the request.
      type: string
    - name: fle-status
      description: Field-level encryption status indicating whether the request body was successfully processed.
      type: string
    - name: fle-encrypted-fields
      description: The number of field-level encryption fields encrypted and forwarded to the origin.
      type: string
    - name: c-port
      description: The port number of the request from the viewer.
      type: bigint
    - name: time-to-first-byte
      description: The time in seconds between receiving the request and writing the first byte of the response.
      type: float
    - name: x-edge-detailed-result-type
      description: A detailed result type providing additional information about certain errors.
      type: string
    - name: sc-content-type
      description: The value of the HTTP Content-Type header of the response.
      type: string
    - name: sc-content-len
      description: The value of the HTTP Content-Length header of the response.
      type: bigint
    - name: sc-range-start
      description: The range start value when the response contains the HTTP Content-Range header.
      type: bigint
    - name: sc-range-end
      description: The range end value when the response contains the HTTP Content-Range header.
      type: bigint