---
title: "CloudFront Delivery Network SQS collector"
canonical: "https://docs.devo.com/space/latest/1097564187/CloudFront%20Delivery%20Network%20SQS%20collector"
format: markdown
---
> Macro (toc)

## Purpose

An analyst wants to **detect malicious behavior in requests to the content delivery network**.  Using the **CloudFront SQS collector** to send request logs to Devo, the analyst will find DDoS attempts.  As a result, the analyst will scale web services, preventing them from failing.

## Example tables

| Table | Description |
| --- | --- |
| cloud.aws.cloudfront.web_1 | [CloudFront content delivery network activity](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/standard-logs-reference.html) |
| web.all.access | All web activity logs |

## Authorize It

1. [Authorize SQS Data Access](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1098121229).
2. Add data to the S3 bucket.
  1. Update or create a CloudFront Distribution.
  2. Turn log delivery on.
  3. Enable cookie logging so that cookie poisoning attacks can be investigated.
  4. Select Amazon S3 as the delivery method.
  5. Enter the destination bucket created in Step 1.
  6. Devo requires that the default 33 fields be selected.
  7. Devo does not require partitioning.
  8. Select “Plain text” format.
  9. Select “\t” field delimiters.
    
    
    

## Run It

In the **Cloud Collector App**, [create an SQS Collector instance](https://docs.devo.com/space/latest/409305131/Catalog#Create-an-instance).  **Remove **the default collector parameters and insert this parameters template, replacing the values enclosed in `< >`.

```
{
  "inputs": {
    "sqs_collector": {
      "id": "<FIVE_UNIQUE_DIGITS>",
      "services": {
        "aws_sqs_control_tower": {}
      },
      "credentials": {
              "aws_cross_account_role": "arn:<PARTITION>:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
              "aws_external_id": "<EXTERNAL_ID>"
      },
      "region": "<REGION>",
      "base_url": "https://sqs.<REGION>.amazonaws.com/<YOUR_AWS_ACCOUNT_NUMBER>/<QUEUE_NAME>"
    }
  }
}
```

## Secure It

Use the [AWS](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#CLOUD%2FAWS) and [WEB](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#WEB) queries from the library.

### Access from unexpected location

```
/* 
Get a list of edge locations where CloudFront was accessed
to search for access from geographies that should not be using 
the application.
*/
from cloud.aws.cloudfront.web_1 group by x_edge_location 
```

### Malicious redirect created

```
/*
Get a list of redirects to check if a malicious person is
directing users to phishing.
*/
from cloud.aws.cloudfront.web_1 
where eq(x_edge_result_type,"Redirect"),
toktains(cs_uri_stem,"login")//redirect to phishing login page
group by cs_Host, cs_uri_stem
```

## Monitor It

Create an** ****[inactivity alert](https://docs.devo.com/space/latest/95126785/Inactivity+alert)** to detect interruptions of transfer of data from the source to the SQS queue using the query

```
from cloud.aws.cloudfront.web_1 
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id
```

Set the inactivity alert to keep track of the `collector_id`.