AWS WAF

AWS WAF. Web ACL request evaluation records.

Source and collection

Configured WAF log destination.

Enable logging with suitable redaction, filtering and destination permissions.

Native example and provenance

upstream test fixture. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — line 1

One complete record selected; values unchanged.

Pinned source commit: 9ae756f00f82786ac3496ce99c2dd288c5a5c031

Download the exact sample · Offline research kit

SHA-256: 0ce3dfa3d85c9dcff9ff34df000942f19c7d53865a950ecd5d250980bd899f56

{"timestamp":1576280412771,"formatVersion":1,"webaclId":"arn:aws:wafv2:ap-southeast-2:EXAMPLE12345:regional/webacl/STMTest/1EXAMPLE-2ARN-3ARN-4ARN-123456EXAMPLE","terminatingRuleId":"STMTest_SQLi_XSS","terminatingRuleType":"REGULAR","action":"BLOCK","terminatingRuleMatchDetails":[{"conditionType":"SQL_INJECTION","location":"HEADER","matchedData":["10","AND","1"]}],"httpSourceName":"-","httpSourceId":"-","ruleGroupList":[],"rateBasedRuleList":[],"nonTerminatingMatchingRules":[],"httpRequest":{"clientIp":"89.160.20.156","country":"AU","headers":[{"name":"Host","value":"localhost:1989"},{"name":"User-Agent","value":"curl/7.61.1"},{"name":"Accept","value":"*/*"},{"name":"x-stm-test","value":"10 AND 1=1"}],"uri":"/foo","args":"","httpVersion":"HTTP/1.1","httpMethod":"GET","requestId":"rid"},"labels":[{"name":"value"}]}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`timestamp`	int
`formatVersion`	int
`webaclId`	str
`terminatingRuleId`	str
`terminatingRuleType`	str
`action`	str
`terminatingRuleMatchDetails`	array
`terminatingRuleMatchDetails[0].conditionType`	str
`terminatingRuleMatchDetails[0].location`	str
`terminatingRuleMatchDetails[0].matchedData`	array
`terminatingRuleMatchDetails[0].matchedData[0]`	str
`httpSourceName`	str
`httpSourceId`	str
`ruleGroupList`	array
`rateBasedRuleList`	array
`nonTerminatingMatchingRules`	array
`httpRequest.clientIp`	str
`httpRequest.country`	str
`httpRequest.headers`	array
`httpRequest.headers[0].name`	str
`httpRequest.headers[0].value`	str
`httpRequest.uri`	str
`httpRequest.args`	str
`httpRequest.httpVersion`	str
`httpRequest.httpMethod`	str
`httpRequest.requestId`	str
`labels`	array
`labels[0].name`	str

action: Native field; inspect its exact type and nesting in the complete example below.
httpRequest: Native field; inspect its exact type and nesting in the complete example below.
webaclId: Native field; inspect its exact type and nesting in the complete example below.
timestamp: Native field; inspect its exact type and nesting in the complete example below.

Investigation uses

Investigate terminating rules and action with httpRequest context.
Retain resource, account/project/subscription and region context for correlation.

Validation boundaries

ALLOW/BLOCK is a WAF decision, not an application response or exploitation verdict.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

Log fields for protection pack (web ACL) traffic - AWS WAF, AWS Firewall Manager, AWS Shield Advanced, and AWS Shield network security director

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.