​
Overview

AWS WAF logs every request a web ACL evaluates, capturing:
  • ALLOW, BLOCK, COUNT, and CAPTCHA actions per rule
  • Source IP, country, headers, and User-Agent
  • Matched managed rule group (for example, AWSManagedRulesCommonRuleSet)
  • Rate-based rule trigger details
Atatus reads WAF logs from a CloudWatch log group that the web ACL delivers logs to.

​
Prerequisites

  • An AWS WAF web ACL with logging enabled to CloudWatch Logs.
  • IAM credentials with read access to that log group.

​
Step 1: Enable WAF logging to CloudWatch Logs

  1. Open the AWS Console → WAF & Shield → Web ACLs and select your web ACL.
  2. Open the Logging and metrics tab and click Enable logging.
  3. Choose CloudWatch Logs and select (or create) a log group whose name begins with aws-waf-logs- (for example, aws-waf-logs-prod).
  4. Optionally redact sensitive fields, then click Enable logging.

​
Step 2: Create an IAM user with log read access

  1. Open IAM → Users → Create user, name it atatus-waf-reader.
  2. Attach an inline policy granting:
    • logs:DescribeLogGroups
    • logs:DescribeLogStreams
    • logs:GetLogEvents
    • logs:FilterLogEvents
  3. Scope the policy to the WAF log group ARN.
  4. Create an access key under Security credentials → Create access key and copy both values.

​
Step 3: Connect AWS WAF in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the AWS WAF card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The AWS WAF card shows Configured.
  • WAF events appear in Security → Cloud SIEM → Audit Logs → Events with source aws_waf.