Overview
AWS WAF is a web application firewall that helps protect your web applications from common web exploits.
Enable this integration to see your WAF metrics in Datadog.
Setup
Installation
If you haven’t already, set up the Amazon Web Services integration
first.
Metric collection
In the AWS integration page
, ensure that WAF or WAFV2 is enabled under the Metric Collection tab, depending on which endpoint you are using.
Install the Datadog - AWS WAF integration
.
Log collection
Audit logs
Enable Web Application Firewall audit logs to get detailed information about your web ACL analyzed traffic:
- Create a
Amazon Kinesis Data Firehose with a name starting with aws-waf-logs-. - In the
Amazon Kinesis Data Firehose destination, pick Amazon S3 and make sure you add waf as prefix. - Select the wanted web ACL and send its logs to the newly created Firehose (detailed steps
).
The WAF logs are collected and sent to a S3 bucket.
Send logs to Datadog
- If you haven’t already, set up the Datadog Forwarder Lambda function
.
- Once the Lambda function is installed, manually add a trigger on the S3 bucket that contains your WAF logs in the AWS console, in your Lambda, click on S3 in the trigger list:Configure your trigger by choosing the S3 bucket that contains your WAF logs and change the event type to
Object Created (All) then click on the add button.
Note: The Datadog Lambda forwarder automatically transforms arrays of nested object in WAF logs into a key:value format for ease of use.
Data collected
Metrics
aws.waf.allowed_requests
(gauge) | The number of allowed web requests.
Shown as request |
aws.waf.blocked_requests
(gauge) | The number of blocked web requests.
Shown as request |
aws.waf.counted_requests
(gauge) | The number of counted web requests.
Shown as request |
aws.waf.passed_requests
(gauge) | The number of passed web requests.
Shown as request |
aws.wafv2.allowed_requests
(gauge) | The number of allowed web requests.
Shown as request |
aws.wafv2.blocked_requests
(gauge) | The number of blocked web requests.
Shown as request |
aws.wafv2.counted_requests
(gauge) | The number of counted web requests.
Shown as request |
aws.wafv2.passed_requests
(gauge) | The number of passed web requests.
Shown as request |
waf.allowed_requests
(gauge) | The number of allowed web requests.
Shown as request |
waf.blocked_requests
(gauge) | The number of blocked web requests.
Shown as request |
waf.counted_requests
(gauge) | The number of counted web requests.
Shown as request |
waf.passed_requests
(gauge) | The number of passed web requests.
Shown as request |
Note: Both aws.waf.* and waf.* metrics are reported due to the historic format of the CloudWatch metric APIs for WAF.
Each of the metrics retrieved from AWS is assigned the same tags that appear in the AWS console, including but not limited to host name, security-groups, and more.
Events
The AWS WAF integration does not include any events.
Service Checks
The AWS WAF integration does not include any service checks.
Troubleshooting
Need help? Contact Datadog support
.
