Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/fusion/customer/help/en-us/index.html?contextId=xdr-integration-aws-alb

AWS ALB logs

You can integrate AWS Application Load Balancer (ALB) logs with Sophos XDR so that it sends data to Sophos for analysis.

This page gives you an overview of the integration.

AWS ALB product overview

AWS Application Load Balancer (ALB) is a Layer 7 Elastic Load Balancing service that distributes HTTP and HTTPS traffic across targets. Its access logs capture detailed information about each request the load balancer processes, such as the client, target, request line, response, and processing times, stored as log files in Amazon S3.

What we ingest

Sophos XDR collects AWS ALB access logs from an Amazon S3 bucket: you deploy a CloudFormation template that provisions a Lambda function, which forwards access log files to Sophos XDR as they are delivered to the bucket. The following log categories are collected:

  • Load balancer access activity: ALB access-log HTTP request records.

Event and data types

We ingest the following event and data types from AWS ALB:

  • Load balancer access activity: ALB access-log HTTP requests, including the client and target addresses, request line, response status code, and processing times. Normalized to HTTP telemetry.

Data provided by this integration

Data provided by AWS ALB gets normalized to the following schemas:

  • http

For more information about using schemas in Data Lake Search, see Schemas and logical types.

Vendor documentation