AWSS3ServerAccess

AWSS3ServerAccess Schema #

Table description #

TableSection TableType TableSectionName Description
Usx Regular Microsoft Sentinel This stack integrates Microsoft Sentinel by creating an IAM role with minimal permissions for accessing S3 server access logs stored in a specified S3 bucket and sending log events to an SQS queue.

Table retention #

HotDays ColdDays TotalInteractiveDays
14 16 30

Schema #

Name Description Type
_BilledSize Double
_IsBillable String
AccessPointARN The Amazon Resource Name (ARN) of the S3 access point used for the request, or ‘-’ if not used. String
ACLRequired Indicates if an ACL was required for the request: ‘Yes’ if required, ‘-’ otherwise. String
AuthenticationType The authentication type used: AuthHeader, QueryString, or ‘-’ for unauthenticated requests. String
Bucket The name of the S3 bucket against which the request was processed. String
BucketOwner The canonical user ID of the owner of the source bucket (another form of AWS account ID). String
BytesSent Number of response bytes sent, excluding HTTP overhead, or 0. Int32
CipherSuite The TLS cipher suite negotiated for HTTPS, or ‘-’ for HTTP. String
ErrorCode The S3 error code returned in the response, or ‘-’ if none. String
HostHeader The endpoint (host header) used to connect to S3 (e.g., s3.us-west-2.amazonaws.com). String
HostId Amazon S3 extended request ID (x-amz-id-2). String
HttpStatus The HTTP status code returned in the response. Int32
Key The object key (name) involved in the request. String
ObjectSize The size of the object in bytes. Int32
Operation The operation type (e.g., REST.PUT.OBJECT, S3.LIFECYCLETRANSITION.OBJECT). String
Referer The value of the HTTP Referer header (linking page URL), if present. String
RemoteIp The apparent IP address of the requester (may be obscured by proxies or firewalls). String
Requester The canonical user ID, IAM user, or assumed role making the request, or ‘-’ for unauthenticated. String
RequestId A unique string ID generated by Amazon S3 to identify the request. String
RequestUri The URI part of the HTTP request. String
SignatureVersion The signature version (SigV2 or SigV4) used to authenticate the request, or ‘-’ for unauthenticated. String
SourceSystem String
TenantId Unique identifier of the tenant into which the data connector ingests data. String
TimeGenerated The time the AWS Server Access log was received by the S3 bucket, in UTC. DateTime
TLSVersion The TLS version used by the client (e.g., TLSv1.2), or ‘-’ if TLS wasn’t used. String
TotalTime The total time in milliseconds the request was in flight (from receipt to last response byte sent). Int32
TurnAroundTime The time in milliseconds S3 spent processing the request (from last request byte to first response byte). String
Type The name of the table String
UserAgent The value of the HTTP User-Agent header (e.g., client software or browser). String
VersionId The version ID of the object involved in the request, or ‘-’ if not applicable. String

Schema changes #

Date Action
2026-01-02 Table added to tracking