TL;DR
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
| Skyhigh Secure Web Gateway (SWG) Access Logs | ✅ | ✅ | ✅ | ✅ | skyhigh_secure_web_gateway_logs |
Key value | S3 |
Overview
Skyhigh Security's Secure Web Gateway (SWG), part of the Skyhigh Cloud Platform (formerly McAfee Web Gateway / Skyhigh Security Service Edge), is a cloud-delivered secure web gateway that inspects and controls web and cloud application traffic for an organization's users. The logs captured here are HTTP/HTTPS proxy access records that document every web request processed by the gateway, including the requesting user, client and destination IPs, requested host/path, HTTP method and status, SSL inspection status, malware/DLP scanning results, content category, and reputation scoring. These logs are delivered as syslog-wrapped key=value lines and are collected via Amazon S3. Integrating this data with Hunters provides visibility into outbound web traffic, enabling detection of malware downloads, command-and-control communication over HTTP(S), data exfiltration via DLP violations, access to risky or malicious domains, and shadow IT/cloud application usage.
Supported data types
Skyhigh Secure Web Gateway (SWG) Access Logs
Table name: skyhigh_secure_web_gateway_logs
This data type contains proxy access records generated by the Skyhigh SWG for every web and cloud application request processed by the gateway. Each record includes user and client identity, source and destination network details, requested host/path, HTTP method and response status, SSL inspection status, malware/DLP scan results, URL category, and reputation scoring — enabling detection of malicious downloads, risky destinations, and policy violations across outbound web traffic.
Expected format
Logs are expected in key value format.
<14>May 14 19:17:40 HOSTPRX012 -: user_id=-1,username="network service",source_ip=198.51.100.60,http_action=GET,server_to_client_bytes=236,client_to_server_bytes=1832,requested_host=crl.example-ca.com,requested_path=/ExampleRootCA.crl,result=OBSERVED,virus=,request_timestamp_epoch=1778803762,request_timestamp="2026-05-15 00:09:22",uri_scheme=http,category=Software/Hardware,media_type=,application_type=,reputation="Minimal Risk",last_rule="Bypass Office 365",http_status_code=304,client_ip=192.168.40.98,location=,block_reason=,user_agent_product=Microsoft-CryptoAPI,user_agent_version=10.0,user_agent_comment=Microsoft-CryptoAPI/10.0,process_name=svchost.exe,destination_ip=203.0.113.59,destination_port=80,pop_country_code=US,referer=,ssl_scanned=f,av_scanned_up=f,av_scanned_down=f,rbi=f,dlp=f,client_system_name=wrk-dev-20478,filename=ExampleRootCA.crl,pop_egress_ip=198.51.100.11,pop_ingress_ip=198.51.100.111,proxy_port=8080,mw_probability=0,discarded_host=,ssl_client_prot=,ssl_server_prot=,domain_fronting_url=,popid=259,duration=7,internal_proc_time=9,server_latency_time=4,server_bandwidth_time=0,data_tagging=
Send data to Hunters
Hunters supports the collection of Skyhigh Secure Web Gateway logs using Amazon S3.
To connect Skyhigh Secure Web Gateway logs:
- Configure Skyhigh Secure Web Gateway to export access logs (syslog-formatted key=value records) to your log collection pipeline, and route them into an AWS S3 bucket. Refer to Skyhigh Security's product documentation for configuring log forwarding/export from your SWG tenant: Skyhigh Secure Web and Cloud solutions.
- Once the logs are landing in S3, follow the steps in this section to connect the S3 bucket to Hunters.