web:edge waf_log
Web application firewall log
Matched rules and the request that triggered them, from a WAF in front of the server (AWS WAF, Azure WAF, cloud or appliance).
- Log source
- Edge logs in front of web servers (WAF, load balancer, CDN)
- Host type
- Other / unclassified
- How to enable
- AWS WAF: enable logging per web ACL to CloudWatch Logs, S3 or Firehose (destination name aws-waf-logs-*).
- Tier, host type
- Recommended
- Techniques
- 0
- Rules depending on it
- none
Why this tier
CISA CM0106
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Recommended | CISA CM0106 |
| Linux web server, internet-facing | Recommended | CISA CM0106 |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.
Standards and guidance naming it
| Requirement | Relation | Basis |
|---|---|---|
| CISA: Web shell eviction countermeasureEviction Strategies Tool, CM0106 Eliminate Web Shells | Names this event | quoted: logs to preserve: WAF, reverse proxy, CDN |