AWS WAF traffic blocked by specific rule

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Goal

Detects when a specific AWS Web Application Firewall (WAF) rule blocks an anomalous amount of traffic.

The rule monitors AWS WAF logs and detects when the @system.action has a value of BLOCK.

Inspect the @webaclId: {{@webaclId}} logs to confirm if the observed traffic should have been blocked or not.
If the request should have been blocked, then navigate to the IP Investigation dashboard. Inspect other requests from the IP address:{{@network.client.ip}} to find any other potentially malicious behaviors from the IP.