AWS WAF Monitoring

Updated Oct 30, 2023

Configure AWS WAF for Arctic Wolf monitoring

Configure AWS WAF for Arctic Wolf monitoring

You can configure Amazon Web Services (AWS)® Web Application Firewall (WAF)® for Arctic Wolf® monitoring.

WAF logs contain detailed information about the traffic that your web access control list (ACL) analyzes. This information includes the web request timestamp, source, destination, and the action for the matching rule. Arctic Wolf analyzes web ACL logs that result in Block requests to prioritize analyses for high risk web requests.

Notes:

By default, Arctic Wolf does not alert on WAF events until you indicate that you are ready to receive alerts. As a result, you can make frequent changes to your WAF rules without receiving alerts. When you have configured a stable ruleset, contact your Concierge Security® Team (CST) to enable alerts.

Requirements

An AWS WAF subscription
An active web ACL

Before you begin

If you would like to use, or are currently using, Amazon Kinesis Data Firehose or Amazon CloudWatch as the WAF log destination, contact your CST for more instruction.
Complete these steps:
- Provide AWS Credentials to Arctic Wolf.
- Configure AWS CloudTrail Event Monitoring.
Choose an existing S3 bucket as the destination of your logs, or see Create a bucket to create a new bucket using the S3 console.
Notes:
- The name of your bucket must start with aws-waf-logs-.
- Web Access Control Lists (ACLs) are region-specific, but you can send logs to an S3 bucket outside of what is listed in your web ACL.
- If you want Arctic Wolf to monitor WAF in multiple regions, Arctic Wolf recommends sending all web ACL logs to a single S3 bucket. Choose an S3 bucket that already stores log from other AWS services. For example, CloudTrail or Amazon GuardDuty.

Steps

Sign in to the AWS Management Console.
Open the Amazon S3 Console.
In the navigation menu, click Buckets.
Find the S3 bucket that will be used as the destination of your WAF logs.
Complete the steps in Permissions to publish logs to Amazon S3 to publish logs to Amazon S3.
Complete the steps in To enable logging for a web ACL to begin logging.

Tip: See Logging and monitoring web ACL traffic and AWS WAF logging destinations for more information about web ACL logging.

Next Steps

Complete Configure AWS S3 Bucket Log Monitoring using these values:
- bucketName — The S3 bucket where the logs are delivered.
- prefixPath — AWN/WAF/<12-digit-AWS-Account-ID>/, where <12-digit-AWS-Account-ID> is your 12-digit AWS account ID number.