AWS WAF traffic blocked by specific rule

cloudtrail
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detects when a specific AWS Web Application Firewall (WAF) rule blocks an anomalous amount of traffic.

Strategy

The rule monitors AWS WAF logs and detects when the @system.action has a value of BLOCK.

Triage and response

  1. Inspect the @webaclId: {{@webaclId}} logs to confirm if the observed traffic should have been blocked or not.
  2. If the request should have been blocked, then navigate to the IP Investigation dashboard. Inspect other requests from the IP address:{{@network.client.ip}} to find any other potentially malicious behaviors from the IP.