WAF ACL Firewall Access Control SQS Collector

Purpose

An analyst wants to detect malicious network traffic in web applications.  Using the WAF ACL SQS collector to send firewall logs to Devo, the analyst will find malicious IP activity.  As a result, the analyst will use Access Control Lists to block the traffic, preventing attackers from cross-site scripting.

Devo recommends also logging AWS WAF actions using the CloudTrail SQS Collector.

Example tables

Authorize It

1. Authorize SQS Data Access.

   1. For this service, the bucket name must start with aws-waf-logs-.

2. Add data to the S3 bucket.

   1. In WAF, select a Web ACL.

      

   2. Select “Logging” and “Enable.”

      

   3. Set the destination to the S3 bucket previously authorized.

      

   4. f

Run It

In the Cloud Collector App, create an SQS Collector instance using this parameters template, replacing the values enclosed in < >.

{
  "inputs": {
    "sqs_collector": {
      "id": "<FIVE_UNIQUE_DIGITS>",
      "services": {
        "<SERVICE_NAME>": {}
      },
      "credentials": {
              "aws_cross_account_role": "arn:<PARTITION>:iam::<YOUR_AWS_ACCOUNT_NUMBER>:role/<YOUR_ROLE>",
              "aws_external_id": "<EXTERNAL_ID>"
      },
      "region": "<REGION>",
      "base_url": "https://sqs.<REGION>.amazonaws.com/<YOUR_AWS_ACCOUNT_NUMBER>/<QUEUE_NAME>"
    }
  }
}

Secure It

Monitor It

Create an inactivity alert to detect interruptions of transfer of data from the source to the SQS queue using the query

from TABLE 
where toktains(hostchain,"collector-") 
select split(hostchain,"-",1) as collector_id

Set the inactivity alert to keep track of the collector_id.