Enterprise Security Operations: Integrating AWS WAF Telemetry in Graylog

Architectural Overview: The Illuminate Processing Pipeline

The AWS WAF Content Pack is built specifically for AWS WAF v2 architectures using Amazon Kinesis Data Firehose for real-time delivery. Upon activation, the suite executes automated extraction, enrichment, and normalization loops:

Data Ingestion Configuration

Integrating your AWS environment with Graylog requires an active Enterprise or Security license alongside the Illuminate processing framework. Follow this deployment sequence to establish data routing:

Step 1: Activate Web ACL Logging

Navigate to the target AWS Web ACL configuration panel. Enable logging and specify an Amazon Kinesis Data Firehose Delivery Stream as your target logging destination.

Step 2: Stream Records to Graylog

Configure the Kinesis Data Firehose stream to forward its records to the Graylog instance using the native AWS Kinesis/CloudWatch Input. Graylog’s input engine automatically tags traffic using the aws_kinesis_stream and aws_kinesis_message_type attributes, meaning you do not need to configure custom stream-matching rules.

Step 3: Verify the JSON Log Structures

AWS WAF delivers a single, detailed JSON object for every request it evaluates. The Graylog processing engine normalizes these variations automatically:

Example A: Rule Invalidation and Terminating BLOCK Decision

{
  "timestamp": 1778140491525,
  "formatVersion": 1,
  "webaclId": "arn:aws:wafv2:us-east-1:517803882956:regional/webacl/prod-waf/3b8a9ef3-9057-4538-acdd-bda6c27c2131",
  "terminatingRuleId": "AWS-AWSManagedRulesCommonRuleSet",
  "terminatingRuleType": "MANAGED_RULE_GROUP",
  "action": "BLOCK",
  "httpSourceName": "ALB",
  "httpRequest": {
    "clientIp": "185.142.236.41",
    "country": "SC",
    "uri": "/.well-known/security.txt",
    "httpMethod": "GET",
    "scheme": "http",
    "host": "34.238.104.93"
  },
  "labels": [
    { "name": "awswaf:managed:aws:core-rule-set:NoUserAgent_Header" }
  ]
}

Example B: Standard Default Action ALLOW Decision

{
  "timestamp": 1778154180000,
  "formatVersion": 1,
  "webaclId": "arn:aws:wafv2:us-east-1:517803882956:regional/webacl/prod-waf/3b8a9ef3-9057-4538-acdd-bda6c27c2131",
  "terminatingRuleId": "Default_Action",
  "terminatingRuleType": "REGULAR",
  "action": "ALLOW",
  "httpSourceName": "ALB",
  "httpRequest": {
    "clientIp": "192.0.2.10",
    "country": "US",
    "uri": "/",
    "httpMethod": "GET",
    "scheme": "https",
    "host": "app.example.com"
  },
  "labels": []
}

Step 4: Initialize the Processing Engine

Log into the Graylog console, navigate to Enterprise → Illuminate, locate the AWS WAF Processing Pack, and click Activate. The indexing architecture and parsing logic initialize instantly behind the scenes.

Graylog Information Model (GIM) Classification Schema

The content pack maps AWS WAF actions into standardized GIM fields, organizing traffic into network and detection categories to enable consistent threat hunting:

Strategic Drivers for Engineering AWS WAF Visibility

Centralizing WAF infrastructure metrics within Graylog provides defensive teams with vital technical evidence across four key security domains:

1. Real-Time Attack Monitoring

• Exposes malicious web payloads—including SQL Injection (SQLi) and Cross-Site Scripting (XSS) patterns—intercepted by AWS Managed Rules before they reach your app servers.
• Tracks high-frequency BLOCK triggers linked to single client IP profiles to catch automated web scraping, directory brute-forcing, and vulnerability scanning.
• Monitors COUNT rules to evaluate the real-world impact of newly drafted custom rules before moving them to active blocking mode.
• Identifies high rates of CAPTCHA or CHALLENGE failures to track botnets attempting to bypass application access controls.

2. Multi-Layered Threat Hunting

• Allows analysts to search across your entire application fleet for specific terminating rule IDs linked to active CVE exploits or known cyberespionage campaigns.
• Correlates source IP parameters across both ALLOW and BLOCK events to trace how attackers attempt to map out your application structures.
• Flags unexpected geolocation anomalies sending high volumes of blocked traffic against production Web ACL endpoints.

3. Incident Response and Forensic Investigation

• Provides digital forensics teams with an immutable timeline of request histories to quickly reconstruct an attacker’s actions during an active incident.
• Pinpoints the exact rule or managed group that intercepted an exploit, and easily identifies any gaps where a rule missed a bypass attempt.
• Audits the ALLOW traffic surrounding a BLOCK action to determine exactly which requests reached back-end origin repositories beforehand.

4. Compliance and Operational Auditing

• Maintains immutable, long-term logs of application-layer enforcement decisions to demonstrate compliance with strict access control mandates under PCI DSS, HIPAA, and SOC 2.
• Tracks Web ACL and rule group configuration adjustments, providing change management teams with verifiable compliance evidence.