AWSALBAccessLogs

AWSALBAccessLogs Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel This connector allows you to ingest AWS Elastic Load Balancer (ALB, NLB and GLB) logs into Microsoft Sentinel. These logs contain detailed records for requests handled by your load balancers, including client IPs, latencies, request paths, and status codes. These logs are useful for monitoring traffic patterns, investigating anomalies, and ensuring security compliance.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
ActionsExecuted The actions taken when processing the request (e.g., forward, fixed-response, redirect). String
Alb The ARN of the Application Load Balancer. String
ALBType The type of request (e.g., http or https). String
ChosenCertArn The ARN of the certificate presented to the client. String
Classification Classification of the request (e.g., success or error). String
ClassificationReason The reason why a request was classified in a certain way. String
ClientIp The IP address of the client. String
ClientPort The port number of the client. Int32
ConnTraceId The connection trace ID that uniquely identifies the connection. String
DomainName The SNI domain provided by the client during the TLS handshake. String
ElbStatusCode The status code sent from the load balancer to the client. Int32
LambdaErrorReason The reason code for a failed Lambda function, if applicable. String
MatchedRulePriority The priority value of the rule that matched the request. String
ReceivedBytes The size of the request, in bytes, received from the client. Int64
RedirectUrl The URL of the redirect target, if a redirect action was taken. String
RequestCreationTime The timestamp when the load balancer generated the request to the target. String
RequestProcessingTime The total time taken by the load balancer to receive the request from the client. String
RequestRaw The complete request line from the client. String
ResponseProcessingTime The total time taken by the load balancer to send the response to the client. String
SentBytes The size of the response, in bytes, sent to the client. Int64
SourceSystem String
SslCipher The SSL cipher used for the SSL connection (if any). String
SslProtocol The SSL protocol used for the SSL connection (if any). String
TargetGroupArn The ARN of the target group that handled the request. String
TargetIp The IP address of the target that processed the request. String
TargetPort The port number of the target that processed the request. Int32
TargetPortList A list of IP:port pairs of the targets that handled the request. String
TargetProcessingTime The total time taken by the target to process the request. String
TargetStatusCode The status code received from the target. String
TargetStatusCodeList A list of status codes returned by the targets. String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The time when the load balancer received the request. DateTime
TraceId The trace identifier for the request, useful for debugging. String
Type The name of the table String
UserAgent The user agent String of the client. String

Schema changes #

Date Action
2026-01-02 Table added to tracking