Skip to main content

 

Splunk Lantern

Web proxy data

 

Web proxy data refers to the information generated, collected, or analyzed by a web proxy server as it intermediates communication between client devices and web servers. A web proxy acts as a gateway, forwarding client requests to the internet and retrieving responses on their behalf. Web proxy data includes logs, metadata, and analytics that capture details about web traffic, such as requested URLs, user IP addresses, access times, and filtering decisions.

This data is valuable for monitoring internet activity, enforcing security policies, filtering web content, and analyzing user behavior. It is commonly used in enterprise environments, schools, and other organizations to ensure safe and efficient internet usage.

Web proxy data typically includes:

  • Request data: This refers to information about web requests sent by clients through the proxy
  • Response data: This includes details about responses received from the requested web servers
  • User and device metadata: This includes data about the users or devices that made the requests
  • Bandwidth and traffic usage: This includes information about the amount of data transferred through the proxy
  • Filtering and security data: This includes data about blocked or filtered web traffic
  • Time-based data: This includes information related to the timing and frequency of requests
  • Authentication and access control data: This includes details about user authentication, access policies, and permissions
  • Real-time threat intelligence data: This includes data related to detected threats or suspicious activities
  • Cache data: This includes details about cached web content to improve performance and reduce bandwidth usage
  • Performance metrics: This includes information about the performance of the proxy server

The Splunk Common Information Model (CIM) add-on contains a Web data model with fields that describe web server and/or proxy server data in a security or operational context.

Before looking at documentation for specific data sources, review the Splunk Docs information on general data ingestion: 

Use cases for Splunk security products