Data Source: Zeek HTTP

Created: 2026-10-12

Last Updated: 2026-10-12

ID: 257a3ae6-a3f6-44e0-9d10-bdc5b4f011a3

Author: Raven Tait, Nasreddine Bencherchali, Splunk

Description

Logs HTTP requests and responses analyzed by Zeek, including methods, URI, host, status codes, and request bodies when configured.

Details

Property	Value
Source	`http.log`
Sourcetype	`zeek:http`

Name ▲▼	Technique ▲▼	Type ▲▼
Unusual HTTP Request Method	Web Protocols, Exploit Public-Facing Application	Anomaly
HTTP POST Request with Encoded Payload	Web Protocols, Standard Encoding	Anomaly

Supported Apps

TA for Zeek (version 1.0.11)

Event Fields

+ Fields

  <span class="pill kill-chain">id.orig_h</span>
  
  <span class="pill kill-chain">id.orig_p</span>
  
  <span class="pill kill-chain">id.resp_h</span>
  
  <span class="pill kill-chain">id.resp_p</span>
  
  <span class="pill kill-chain">method</span>
  
  <span class="pill kill-chain">uri</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">status_code</span>
  
  <span class="pill kill-chain">post_body</span>
  
  <span class="pill kill-chain">user_agent</span>
  
</div>

Example Log

1{"ts": 1665164348.511363, "uid": "Ct9dph2EXJhTjowDF3", "id.orig_h": "192.168.196.131", "id.orig_p": 50050, "id.resp_h": "192.168.196.129", "id.resp_p": 80, "trans_depth": 13, "method": "POST", "host": "192.168.196.129", "uri": "/test.php", "version": "1.1", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "request_body_len": 108, "response_body_len": 0, "status_code": 200, "status_msg": "OK", "tags": [], "orig_fuids": ["FwroIQ2TSmbiOBzVz4"], "orig_mime_types": ["text/plain"], "post_body": "hMUlHTVEzmc+5fNbbspSRUEVsphYbAJ2Sy3CJZ9K12xyL1cRo1jrslMNWGGNnxbHB14R/CMybW0Z2+wOIuWtkDfKUG2IMpcOUutkDFdSiKo=", "client_header_names": ["USER-AGENT", "HOST", "CONTENT-LENGTH", "CACHE-CONTROL"], "client_header_values": ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36", "192.168.196.129", "108", "no-cache"], "server_header_names": ["CONTENT-TYPE", "DATE", "CONTENT-LENGTH"], "server_header_values": ["text/html", "Fri, 07 Oct 2022 17:39:09 GMT", "0"], "row_id": "dd80e4d5-b10b-4de0-bcd8-dba62c2901ea", "snapattack_session": "e50dc64e-0fc6-b1ad-429c-23ccdd5452c4"}

Required Output Fields

id.orig_h
id.resp_h
id.resp_p
uri
method
status_code

Source: GitHub | Version: 1