Forum Discussion

Altocumulus

Jun 17, 2022

F5 rules for AWS WAF - F5-CVE_Managed rule group Logs

Hello, I've contacted AWS support regarding the WAF and your specific rule group, and AWS suggested I reach out here for specific questions regarding the F5 managed rule. I asked the following quest...

cloud

security

will-will

Altocumulus

Jun 20, 2022

Hi Nikoolayy1,

Thanks for the reply. Yes I can confirm that the AWS WAF ACL is enabled and sending logs to Cloudwatch. However the only logs not available (that I can tell) are specifically F5 Common Vulnerabilities & Exposures (CVE) Rules. The metrics for that rule group are available, just not the logs. Thank you for your other suggestions, and that is something to consider, but for now I'm trying to view the logs in Cloudwatch for this particular rule group.

Thank you!

Nikoolayy1
MVP
Jun 20, 2022
Maybe check the JSON config file for AWS WAF as the Visibility config should look like the example below:

"VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "AWS-AWSBotControl-Example"

https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-rule-group-settings.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-visibilityconfig.html
- will-will
  Altocumulus
  Jun 20, 2022
  config file looks good
  
  "OverrideAction": { "None": {} }, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "F5-CVE_Managed" }
  
  From your last comment though I was able to find some logs in cloudwatch using:
  filter terminatingRuleId = "F5-CVE_Managed"
  Now that I can see these logs in Cloudwatch I can check and see if the exploits are getting blocked.
  Thank you for your help!