topic Re: HTTP Methods in logs? in General Topics

HTTP Methods in logs?

Derek_Davenport — Thu, 03 May 2018 18:08:24 GMT

Sorry if I missed the answer to this question in documentation or forums...I promised I've tried to find the answer.

In the URL Filtering and/or Application Control blades is there a way to add the "HTTP method" (eg POST, GET, PROPS, OPTIONS) to the log and more specifically to the log that can be ingested by a 3rd party SIEM?

Thanks for any guidance!

Re: HTTP Methods in logs?

PhoneBoy — Thu, 03 May 2018 23:44:32 GMT

You must log the traffic with Extended Logging to get that information.

You will find it in the Session tab of the Log card:

I presume if we log it, it will also be sent to a SIEM as well, particularly if you're using Log Exporter.

See Log Exporter guide‌ for more details.

Re: HTTP Methods in logs?

Derek_Davenport — Mon, 07 May 2018 20:45:50 GMT

Thanks Dameon Welch Abernathy‌. I changed the log type to this in the URL/Application control blade, but I am still not seeing this value in the URL filtering log I am getting.

Does this only work on the Application Control blade? Was it added in a recent version? Is there a way to tweak what is logged in "Extended Logging" ?

Re: HTTP Methods in logs?

PhoneBoy — Mon, 07 May 2018 20:58:16 GMT

You must have App Control/URL Filtering enabled for this to work, both on the gateway and, R80+, the relevant layer.

What is logged by Extended Logging is determined by what blades are active on the relevant gateway and layer.

Re: HTTP Methods in logs?

Derek_Davenport — Mon, 07 May 2018 21:03:12 GMT

Thanks! I think R80 is my current stumbling block. We are migrating to R80.10 gateways in the next few weeks...so I'll be able to verify then. Thanks!!!!!

Re: HTTP Methods in logs?

PhoneBoy — Mon, 07 May 2018 21:04:12 GMT

This should also work in R77.30 as well, though it's in the App Control layer you use Extended Logging.