RA_1104_access_external_http_logs.md

Title	Access external HTTP logs
ID	RA1104
Description	Make sure you have access to external communication HTTP logs
Author	@atc_project
Creation Date	2020/05/06
Category	Network
Stage	RS0001: Preparation
References	https://docs.zeek.org/en/current/examples/httpmonitor/ https://en.wikipedia.org/wiki/Common_Log_Format
Requirements	MS_border_proxy MS_border_ngfw DN_zeek_http_log

Workflow

Make sure that there is a collection of HTTP connections logs for external communication (from corporate assets to the Internet) configured.