Document toolboxDocument toolbox

cloud.aws.waf

Introduction

The tags beginning with cloud.aws.waf identify events generated by the AWS Web Application Firewall (WAF). 

Valid tags and data tables

The full tag must have 4 levels. The first 3 are fixed as cloud.aws.waf. The fourth level identifies the events subtype.

These are the valid tags and corresponding data tables that will receive the parsers' data:

Product / Service

Tags

Data tables

Product / Service

Tags

Data tables

AWS Web Application Firewall (WAF)

cloud.aws.waf.logs

cloud.aws.waf.logs

For more information, read more about Devo tags.

How is the data sent to Devo?

Logs generated by AWS WAF service can be sent to AWS CloudWatch Logs, S3, and Kinesis Data Firehose services.

The preferred methods are using the first two services as destinations. In these cases, Devo AWS collector can be used for gathering, properly tagging, and securely forwarding these logs to Devo.

Logs sent to Kinesis Data Firehose can be properly tagged using an AWS Lambda function and forwarded to a Devo HTTP(s) endpoint (as an alternative, a Devo Relay deployed in an EC2 instance can be used for tagging and securely forwarding events using Syslog protocol).

Table structure

These are the fields displayed in this table:

cloud.aws.waf.logs

Field

Type

Field transformation

Source field name

Extra fields

Field

Type

Field transformation

Source field name

Extra fields

eventdate

timestamp

 

 

 

hostname

str

 

 

 

ACCID

str

 

 

 

ACCID_actual

str

 

 

 

REGION

str

 

 

 

timestamp

timestamp

 

 

 

formatVersion

int4

 

 

 

webaclId

str

 

 

 

terminatingRuleId

str

 

 

 

terminatingRuleType

str

 

 

 

action

str

 

 

 

terminatingRuleMatchDetails_conditionType_str

str

 

join(terminatingRuleMatchDetails_conditionType, ',')

 

terminatingRuleMatchDetails_conditionType

 

terminatingRuleMatchDetails_location_str

str

 

join(terminatingRuleMatchDetails_location, ',')

 

terminatingRuleMatchDetails_location

 

terminatingRuleMatchDetails_matchedData_str

str

 

join(terminatingRuleMatchDetails_matchedData, ',')

 

terminatingRuleMatchDetails_matchedData

 

httpSourceName

str

 

 

 

httpSourceId

str

 

 

 

ruleGroupList_ruleGroupId_str

str

 

 

ruleGroupList_ruleGroupId

 

ruleGroupList_terminatingRule_ruleId_str

str

 

 

ruleGroupList_terminatingRule_ruleId

 

ruleGroupList_terminatingRule_action_str

str

 

 

ruleGroupList_terminatingRule_action

 

ruleGroupList_terminatingRule_ruleMatchDetails_str

str

 

 

ruleGroupList_terminatingRule_ruleMatchDetails

 

ruleGroupList_nonTerminatingMatchingRules_str

str

 

 

ruleGroupList_nonTerminatingMatchingRules

 

ruleGroupList_excludedRules_str

str

 

 

ruleGroupList_excludedRules

 

rateBasedRuleList_rateBasedRuleId_str

str

 

 

rateBasedRuleList_rateBasedRuleId

 

rateBasedRuleList_limitKey_str

str

 

 

rateBasedRuleList_limitKey

 

rateBasedRuleList_maxRateAllowed_str

str

 

 

rateBasedRuleList_maxRateAllowed

 

nonTerminatingMatchingRules_action_str

str

 

 

nonTerminatingMatchingRules_action

 

nonTerminatingMatchingRules_ruleId_str

str

 

 

nonTerminatingMatchingRules_ruleId

 

requestHeadersInserted_name_str

str

 

 

requestHeadersInserted_name

 

requestHeadersInserted_value_str

str

 

 

requestHeadersInserted_value

 

responseCodeSent

int4

 

 

 

httpRequest_clientIp

str

 

 

 

httpRequest_country

str

 

 

 

httpRequest_headers_name_str

str

 

 

httpRequest_headers_name

 

httpRequest_headers_value_str

str

 

 

httpRequest_headers_value

 

httpRequest_uri

str

 

 

 

httpRequest_args

str

 

 

 

httpRequest_httpVersion

str

 

 

 

httpRequest_httpMethod

str

 

 

 

httpRequest_requestId

str

 

 

 

labels_name_str

str

 

 

labels_name

 

hostchain

str

 

 

✓

tag

str

 

 

✓

rawMessage

str

 

 

✓