HTTP Activity Class - Multiple Issues

[mikeradka]

In the 02/15/2022 Network Activity Sync, we uncovered several issues where this is room for improvement.
High Level - we considered that these changes would help align weblogs such as Apache Access logs better align with the HTTP Activity class, as web logs don't seem to fit very well under the Access Activity class.
Some of these may or may not be breaking changes:

1. There is some overlap between http_request.args (Optional String) and http_request.url.query_string (Recommended String). It was suggested that at a minimum args be changed from a string to an array that has name/value pairs. Note: this would be a breaking change.
2. Apache logs, which are very common HTTP activity, do not contain a url hostname or text string (the full url with the host hame). Suggestion: downgrade requirement of url.text and url.hostname from Required to Recommended.
3. http_method should be an enum of the various http methods. Note: this would be a breaking change.
4. http_ is redundant for http_method and http_header. Suggestion, drop the http_. Note: this would be a breaking change.
5. Downgrade dst_endpoint from Required to Recommended, as they are not present in Apache logs and other web logs.
6. Make referrer a url object, rather than a string value. The reason is that it contains urls with host, path, and query string. Note: this would be a breaking change.
7. Move the Access Activity class to the dev extension. It looks like it needs some work. Note: is anyone yet using this?

[floydtree]

Yeah, Access Activity is being used.

Also, I haven't gone through all the changes that you have mentioned, but we have to be careful about breaking changes, all of them will need to considered in v2.x.x to be compatible with SemVer.

[floydtree]

@pagbabian-splunk & for folks who are interested, here's a in-preview service which uses this class (note, it's an older version of the class though, will be updated) to emit it's Access Logs.

https://docs.aws.amazon.com/verified-access/latest/ug/verified-access-logs-examples.html

[pagbabian-splunk]

Thanks Rajas - I noticed that the class name is "class_name": "Access Logs", rather than Access Activity, maybe this is an old example?