AWS WAF traffic blocked by specific rule on multiple IPs

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when a specific AWS Web Application Firewall (WAF) rule blocks traffic from multiple IPs.

The rule monitors AWS WAF logs and detects when the @system.action has a value of BLOCK.

Inspect the @http.request_id: {{@http.request_id}} to confirm if this request should have been blocked or not.
If the request should have been blocked, then navigate to the IP Investigation dashboard. Inspect other requests from the IP address:{{@network.client.ip}} to find any other potentially malicious behaviors from the IP.