Forum Discussion

will-will's avatar
will-will
Icon for Altocumulus rankAltocumulus
Jun 17, 2022

F5 rules for AWS WAF - F5-CVE_Managed rule group Logs

Hello, I've contacted AWS support regarding the WAF and your specific rule group, and AWS suggested I reach out here for specific questions regarding the F5 managed rule. I asked the following quest...
cloud
security
will-will's avatar
will-will
Icon for Altocumulus rankAltocumulus

Hi Nikoolayy1,

Thanks for the reply. Yes I can confirm that the AWS WAF ACL is enabled and sending logs to Cloudwatch. However the only logs not available (that I can tell) are specifically F5 Common Vulnerabilities & Exposures (CVE) Rules. The metrics for that rule group are available, just not the logs. Thank you for your other suggestions, and that is something to consider, but for now I'm trying to view the logs in Cloudwatch for this particular rule group.

Thank you!

  • will-will's avatar
    will-will
    Icon for Altocumulus rankAltocumulus
    Jun 20, 2022

    config file looks good

     

      "OverrideAction": {
    "None": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "F5-CVE_Managed"
  }

     

    From your last comment though I was able to find some logs in cloudwatch using:

    filter terminatingRuleId = "F5-CVE_Managed"

    Now that I can see these logs in Cloudwatch I can check and see if the exploits are getting blocked.

    Thank you for your help!