{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"1"},"maxLevel":{"value":"2"},"outline":{"value":"false"},"type":{"value":"flat"},"separator":{"value":"brackets"},"printable":{"value":"true"}},"macroMetadata":{"macroId":{"value":"c1e5dc81-a84d-48cf-acda-0938d59c2707"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"d2a6c4bc-225a-4bec-aa40-e0ff3cf0bbae"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Purpose","type":"text"}]},{"type":"paragraph","content":[{"text":"An analyst wants to ","type":"text"},{"text":"detect malicious network traffic in web applications","type":"text","marks":[{"type":"strong"}]},{"text":". Using ","type":"text"},{"text":"the WAF ACL SQS collector ","type":"text","marks":[{"type":"strong"}]},{"text":"to send firewall logs to Devo, the analyst will ","type":"text"},{"text":"find malicious IP activity","type":"text","marks":[{"type":"strong"}]},{"text":". As a result, the analyst will use Access Control Lists to block the traffic, preventing attackers from cross-site scripting.","type":"text"}]},{"type":"paragraph","content":[{"text":"Devo recommends also logging AWS WAF actions using the ","type":"text"},{"text":"CloudTrail","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/waf/latest/developerguide/understanding-waf-entries.html"}}]},{"text":" SQS Collector.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Example tables","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"ca372086-838d-4fac-a7a7-44014baae6dd"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Table","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"cloud.aws.waf.logs","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Access Control List Traffic","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/waf/latest/developerguide/logging-fields.html"}}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Authorize It","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Authorize SQS Data Access","type":"text","marks":[{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/1098121229"}}]},{"text":".","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"For this service, the bucket name ","type":"text"},{"text":"must","type":"text","marks":[{"type":"strong"}]},{"text":" start with ","type":"text"},{"text":"aws-waf-logs-","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add data to the S3 bucket.","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/waf/latest/developerguide/logging-management-enable.html"}}]}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In WAF, select a Web ACL. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":712,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":713,"alt":"image-20250129-211550.png","id":"974e785b-3987-47f4-98a3-da5d1ef3f723","collection":"contentId-1097990179","type":"file","height":542}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select “Logging” and “Enable.”","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":712,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1359,"alt":"image-20250129-211618.png","id":"06dcf3b3-b00f-41ed-b810-34fee08769fd","collection":"contentId-1097990179","type":"file","height":367}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Set the destination to the S3 bucket previously authorized.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":562,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":562,"alt":"image-20250129-211641.png","id":"34656a86-6146-40e5-b738-f8d171f8f72d","collection":"contentId-1097990179","type":"file","height":587}}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run It","type":"text"}]},{"type":"paragraph","content":[{"text":"In the Cloud Collector App, ","type":"text"},{"text":"create an SQS Collector instance","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/space/latest/409305131/Catalog#Create-an-instance"}}]},{"text":". ","type":"text"},{"text":"Remove ","type":"text","marks":[{"type":"strong"}]},{"text":"the default collector parameters and insert this parameters template, replacing the values enclosed in ","type":"text"},{"text":"< >","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"codeBlock","content":[{"text":"{\n \"inputs\": {\n \"sqs_collector\": {\n \"id\": \"\",\n \"services\": {\n \"\": {}\n },\n \"credentials\": {\n \"aws_cross_account_role\": \"arn::iam:::role/\",\n \"aws_external_id\": \"\"\n },\n \"region\": \"\",\n \"base_url\": \"https://sqs..amazonaws.com//\"\n }\n }\n}","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Secure It","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"IP Evading ","type":"text"},{"text":"Reputation Block List","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-ip-rep.html"}}]}]},{"type":"codeBlock","content":[{"text":"/*\nIt has been determined that a particular IP is malicious.\nCheck if the IP has contacted the firewall,\nif it was allowed, if it was on Amazon's reputation list, \nand which terinating rules blocked the IP.\n\nIf the reputation list did not terminate the request, then the rules \nneed improvement.\n*/\n\nfrom cloud.aws.waf.logs \nwhere eq(httpRequest_clientIp,233.252.0.0)//example IP\ngroup by action, \neq(terminatingRuleId,\"AWS-AWSManagedRulesAmazonIpReputationList\") as on_reputation_list\nselect collectdistinct(ruleGroupList_terminatingRule_ruleId_str) as terminating_rules","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Malicious WAF Rule Created","type":"text"}]},{"type":"codeBlock","content":[{"text":"/*\nA malicious user has gained access to WAF configuration.\nThe user has created a rule which has blocked critical traffic.\nIdentify new rules which are blocking lots of traffic so they can be removed.\n*/\nfrom cloud.aws.waf.logs \nwhere eq(action,\"BLOCK\")\ngroup by terminatingRuleId\nselect count() as requests_blocked,\nfirst(eventdate) as rule_started \nwhere rule_started>today()-7d //recently created rule","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Monitor It","type":"text"}]},{"type":"paragraph","content":[{"text":"Create an ","type":"text"},{"text":"inactivity alert","type":"text","marks":[{"type":"strong"},{"type":"link","attrs":{"href":"https://docs.devo.com/space/latest/95126785/Inactivity+alert"}}]},{"text":" to detect interruptions of transfer of data from the source to the SQS queue using the query","type":"text"}]},{"type":"codeBlock","content":[{"text":"from cloud.aws.waf.logs\nwhere toktains(hostchain,\"collector-\") \nselect split(hostchain,\"-\",1) as collector_id","type":"text"}]},{"type":"paragraph","content":[{"text":"Set the inactivity alert to keep track of the ","type":"text"},{"text":"collector_id","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"If protection of a particular URI is very important, it can be monitored individually for inactivity.","type":"text"}]},{"type":"codeBlock","content":[{"text":"from cloud.aws.waf.logs \n//An alert is required if logging of requests to this important API stop.\nwhere startswith(httpRequest_uri,\"/api/\")","type":"text"}]}],"version":1}

Browser not supported