---
title: AWS WAF traffic blocked by specific rule on multiple IPs
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > AWS WAF traffic blocked by specific
  rule on multiple IPs
---

# AWS WAF traffic blocked by specific rule on multiple IPs
 
## Goal{% #goal %}

Detect when a specific AWS Web Application Firewall (WAF) rule blocks traffic from multiple IPs.

## Strategy{% #strategy %}

The rule monitors AWS WAF logs and detects when the `@system.action` has a value of `BLOCK`.

## Triage and response{% #triage-and-response %}

1. Inspect the `@http.request_id`: `{{@http.request_id}}` to confirm if this request should have been blocked or not.
1. If the request should have been blocked, then navigate to the IP Investigation dashboard. Inspect other requests from the IP address:{{@network.client.ip}} to find any other potentially malicious behaviors from the IP.