The HTTP server stores cookies in metadata.http.cookies.keyname entries.

In requests, the HTTP server takes any number of HTTP Cookie headers and turns them into corresponding metadata.http.cookies entries. You can either map the entire set of cookies to a dictionary field in an event, or you can map a specific cookie key to a field in an event.