# http Event fields used to define/normalize metadata about HTTP (Hypertext Transfer Protocol) information. This is based on information in the layer 7 (HTTP) application, however can also include HTTP information from an endpoint/server. IIS, Apache, NGINX, proxy logs, and other variances of logs that have HTTP information would go in here. Also, if the HTTP connection is from a decrypted/MITM HTTPS/TLS session then portions of that information, where applicable, would go in here. ## Attributes | Name | Type | Description | Sample Value | |:---|:---|:---|:---| | http_content_type | string | The HTTP Response content type header for HTTP/HTTPS network sessions. | `````` | | http_cookie_variables | string | The values of (HTTP) cookies | ```T1NTRU0K``` | | http_informational_code | integer | integer response code of 100-199 | ```101``` | | http_informational_message | string | message/text of the integer response code that was 100-199 | ```Switching Protocols``` | | http_proxied_headers | string | All of the headers that may indicate if the request was proxied. i.e. FORWARDED;X-FORWARDED-FOR;X-FORWARDED-FROM;CLIENT-IP;VIA;XROXY-CONNECTION;PROXY-CONNECTION | ```Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36``` | | http_referrer_original | string | HTTP header "Referer". The HTTP referer header for HTTP/HTTPS network sessions. | ```https://sub.domain.tld/path/a/b/JavaScript``` | | http_request_body_bytes | integer | Amount of bytes that the source/client sent | ```2``` | | http_request_header_host | string | Value of the HOST header from the client. This should be copied to dst_host_name | ```www.activewebsoftwares.com``` | | http_request_header_names | string | List of any additional (or all) HTTP headers. Because a client can use any HTTP header they want and there are already hundreds of https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers it would be impossible to define a specific field for each one. | ```X-Forwarded-For``` | | http_request_header_origin | string | Value of the Origin header from the client | ```origin``` | | http_request_header_values | string | Values for the request_header_names parameters | ```10.1.1.1``` | | http_request_method | string | Type of HTTP request that was made. Other examples could be (anything) PUT, POST, HEAD, DELETE | ```GET``` | | http_request_time | integer | The amount of time in milliseconds it took to send the request to the server, if applicable. | ```700``` | | http_request_xff | string | The HTTP X-Forwarded-For header for HTTP/HTTPS network sessions. | ```203.0.113.195``` | | http_response_body_bytes | integer | Amount of bytes that the destination/server returned | ```87``` | | http_response_body_original | string | The raw HTTP (response) body | ```
This is title
Hello world ``` | | http_response_header_names | string | List of any additional (or all) HTTP headers. Because a server can use any HTTP header they want and there are already hundreds of https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers it would be impossible to define a specific field for each one. | ```X-Forwarded-For``` | | http_response_header_values | string | Values for the response_header_names parameters | ```10.1.1.1``` | | http_response_time | inte | The amount of time in milliseconds it took to receive a response in the server, if applicable. | ```800``` | | http_status_code | integer | HTTP Server reply code | ```200``` | | http_status_message | string | HTTP server reply message | ```OK``` | | http_user_agent_original | string | The User agent seen in the HTTP request. | ```Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36``` | | http_version | string | HTTP request version | ```1.1``` |