Overview

AWS WAF logs every request a web ACL evaluates, capturing:

• ALLOW, BLOCK, COUNT, and CAPTCHA actions per rule
• Source IP, country, headers, and User-Agent
• Matched managed rule group (for example, AWSManagedRulesCommonRuleSet)
• Rate-based rule trigger details

Atatus reads WAF logs from a CloudWatch log group that the web ACL delivers logs to.

Prerequisites

• An AWS WAF web ACL with logging enabled to CloudWatch Logs.
• IAM credentials with read access to that log group.

Step 1: Enable WAF logging to CloudWatch Logs

1. Open the AWS Console → WAF & Shield → Web ACLs and select your web ACL.
2. Open the Logging and metrics tab and click Enable logging.
3. Choose CloudWatch Logs and select (or create) a log group whose name begins with aws-waf-logs- (for example, aws-waf-logs-prod).
4. Optionally redact sensitive fields, then click Enable logging.

Step 2: Create an IAM user with log read access

1. Open IAM → Users → Create user, name it atatus-waf-reader.
2. Attach an inline policy granting:
   • logs:DescribeLogGroups
   • logs:DescribeLogStreams
   • logs:GetLogEvents
   • logs:FilterLogEvents
3. Scope the policy to the WAF log group ARN.
4. Create an access key under Security credentials → Create access key and copy both values.

Step 3: Connect AWS WAF in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS WAF card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The AWS WAF card shows Configured.
• WAF events appear in Security → Cloud SIEM → Audit Logs → Events with source aws_waf.