Versions Compared

Version Old Version 5 New Version Current
Changes made by

Juan Tomás Alonso Nieto (Deactivated)

Laszlo Frazer

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Table of Contents
maxLevel2
typeflat

...

For more information, read more about Devo tags.

How is the data sent to Devo?

Logs generated by AWS WAF service can be sent to AWS CloudWatch Logs, S3, and Kinesis Data Firehose services.

The preferred methods are using the first two services as destinations. In these cases, Devo AWS collector can be used for gathering, properly tagging, and securely forwarding these logs to Devo.

Logs sent to Kinesis Data Firehose can be properly tagged using an AWS Lambda function and forwarded to a Devo HTTP(s) endpoint (as an alternative, a Devo Relay deployed in an EC2 instance can be used for tagging and securely forwarding events using Syslog protocol)Send the logs using an AWS SQS collector.

Table structure

These are the fields displayed in this table:

cloud.aws.waf.logs

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

hostname

str

ACCID

str

ACCID_actual

str

REGION

str

timestamp

timestamp

formatVersion

int4

webaclId

str

terminatingRuleId

str

terminatingRuleType

str

action

str

terminatingRuleMatchDetails_conditionType_str

str

Code Block
join(terminatingRuleMatchDetails_conditionType, ',')

terminatingRuleMatchDetails_conditionType

terminatingRuleMatchDetails_location_str

str

Code Block
join(terminatingRuleMatchDetails_location, ',')

terminatingRuleMatchDetails_location

terminatingRuleMatchDetails_matchedData_str

str

Code Block
join(terminatingRuleMatchDetails_matchedData, ',')

terminatingRuleMatchDetails_matchedData

httpSourceName

str

httpSourceId

str

ruleGroupList_ruleGroupId_str

str

Code Block
join(ruleGroupList_ruleGroupId, ',')

ruleGroupList_ruleGroupId

ruleGroupList_terminatingRule_ruleId_str

str

Code Block
join(ruleGroupList_terminatingRule_ruleId, ',')

ruleGroupList_terminatingRule_ruleId

ruleGroupList_terminatingRule_action_str

str

Code Block
join(ruleGroupList_terminatingRule_action, ',')

ruleGroupList_terminatingRule_action

ruleGroupList_terminatingRule_ruleMatchDetails_str

str

Code Block
join(ruleGroupList_terminatingRule_ruleMatchDetails, ',')

ruleGroupList_terminatingRule_ruleMatchDetails

ruleGroupList_nonTerminatingMatchingRules_str

str

Code Block
join(ruleGroupList_nonTerminatingMatchingRules, ',')

ruleGroupList_nonTerminatingMatchingRules

ruleGroupList_excludedRules_str

str

Code Block
join(ruleGroupList_excludedRules, ',')

ruleGroupList_excludedRules

rateBasedRuleList_rateBasedRuleId_str

str

Code Block
join(rateBasedRuleList_rateBasedRuleId, ',')

rateBasedRuleList_rateBasedRuleId

rateBasedRuleList_limitKey_str

str

Code Block
join(rateBasedRuleList_limitKey, ',')

rateBasedRuleList_limitKey

rateBasedRuleList_maxRateAllowed_str

str

Code Block
stringify(json(rateBasedRuleList_maxRateAllowed))

rateBasedRuleList_maxRateAllowed

nonTerminatingMatchingRules_action_str

str

Code Block
join(nonTerminatingMatchingRules_action, ',')

nonTerminatingMatchingRules_action

nonTerminatingMatchingRules_ruleId_str

str

Code Block
join(nonTerminatingMatchingRules_ruleId, ',')

nonTerminatingMatchingRules_ruleId

requestHeadersInserted_name_str

str

Code Block
join(requestHeadersInserted_name, ',')

requestHeadersInserted_name

requestHeadersInserted_value_str

str

Code Block
join(requestHeadersInserted_value, ',')

requestHeadersInserted_value

responseCodeSent

int4

httpRequest_clientIp

str

httpRequest_country

str

httpRequest_headers_name_str

str

Code Block
join(httpRequest_headers_name, ',')

httpRequest_headers_name

httpRequest_headers_value_str

str

Code Block
join(httpRequest_headers_value, ',')

httpRequest_headers_value

httpRequest_uri

str

httpRequest_args

str

httpRequest_httpVersion

str

httpRequest_httpMethod

str

httpRequest_requestId

str

labels_name_str

str

Code Block
join(labels_name, ',')

labels_name

hostchain

str

✓

tag

str

✓

rawMessage

str

✓