web:edge alb_access_log
Load balancer access log (AWS ALB)
One line per request through the load balancer: client and target, processing times, status codes, bytes, request line, user agent, TLS cipher and protocol, target group, trace id.
- Log source
- Edge logs in front of web servers (WAF, load balancer, CDN)
- Host type
- Other / unclassified
- How to enable
- Off by default; enable access logs on the load balancer to an S3 bucket.
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
CISA CM0106
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Recommended | CISA CM0106 |
| Linux web server, internet-facing | Recommended | CISA CM0106 |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: logs to preserve: reverse proxy |