Skip to content

SUMO-288649 | Apoorv | Add. monitors and update sections with older f… #6916

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Apoorvkudesia-sumologic wants to merge 1 commit into
base: main
Choose a base branch
from
Open

SUMO-288649 | Apoorv | Add. monitors and update sections with older f… #6916

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions docs/integrations/amazon-aws/waf.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,3 +129,30 @@ See details of threats allowed and blocked by AWS WAF.

See details of allowed and blocked AWS WAF traffic by location, rules and outliers.
<img src={useBaseUrl('img/integrations/amazon-aws/aws-waf-traffic.png')} alt="AWS WAF" />

## Create monitors for AWS WAF app

import CreateMonitors from '../../reuse/apps/create-monitors.md';

<CreateMonitors/>

### AWS WAF alerts

| Name | Description | Alert Condition | Recover Condition |
|:--|:--|:--|:--|
| `AWS WAF - Known Malicious IP Allowed` | This alert is triggered when AWS WAF allows a request from a known malicious IP address detected via threat intelligence. `Note: Please configure the scope filter to match your AWS WAF log source.` | Count > 0 | Count < = 0 |
| `AWS WAF - Block Burst from Single IP` | This alert is triggered when a single IP address is blocked by AWS WAF more than 5 times within 5 minutes, indicating active scanning, brute-force, or exploit probing. `Note: Please configure the scope filter to match your AWS WAF log source.` | Count > 0 | Count < = 0 |
| `AWS WAF - Known Malicious IP Blocked` | This alert is triggered when AWS WAF blocks a request from a known malicious IP address detected via threat intelligence. `Note: Please configure the scope filter to match your AWS WAF log source.` | Count > 0 | Count < = 0 |
| `AWS WAF - URI Scanning Burst from Single IP` | This alert is triggered when a single IP address accesses more than 5 distinct URIs within 5 minutes, indicating web scanning or directory enumeration activity. `Note: Please configure the scope filter to match your AWS WAF log source.` | Count > 0 | Count < = 0 |

## Upgrade/Downgrade the AWS WAF app (Optional)

import AppUpdate from '../../reuse/apps/app-update.md';

<AppUpdate/>

## Uninstalling the AWS WAF app (Optional)

import AppUninstall from '../../reuse/apps/app-uninstall.md';

<AppUninstall/>