web:edge cloudfront_log
CDN access log (CloudFront standard log)
W3C-style request log at the edge: client IP, method, host, URI, status, Referer, User-Agent, query, cookie, edge result type, TLS, x-forwarded-for, time to first byte.
- Log source
- Edge logs in front of web servers (WAF, load balancer, CDN)
- Host type
- Other / unclassified
- How to enable
- Off by default; enable standard logging on the distribution.
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
CISA CM0106
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Recommended | CISA CM0106 |
| Linux web server, internet-facing | Recommended | CISA CM0106 |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: logs to preserve: CDN |