AWS WAF web access control list modified


Detect when an AWS Web Application Firewall (WAF) Access Control List (ACL) is updated.


The rule monitors AWS WAF logs @eventSource:waf* and detects when the is UpdateWebACL.

Triage and response

  1. Determine if {{@userIdentity.arn}} is expected to perform the {{}} API call on the account: {{@userIdentity.accountId}}.
  2. If the API call was not made legitimately by the user, rotate the user’s credentials and investigate what other APIs were successfully accessed.