Amazon AWS WAF

The IBM QRadar DSM for Amazon AWS WAF collects Amazon AWS REST API events from an Amazon AWS WAF service.

To integrate Amazon AWS WAF with QRadar, complete the following steps:
  1. If automatic updates are not enabled, RPMs are available for download from the IBM® support website (http://www.ibm.com/support). Download and install the most recent version of the following RPMs on your QRadar Console:
    • Protocol Common RPM
    • Protocol Amazon Web Services RPM
    • Protocol Amazon AWS REST API RPM
    • Amazon AWS WAF DSM RPM
  2. Configure your Amazon AWS WAF service to send events to QRadar. For more information about configuring Amazon AWS WAF, see Configuring Amazon AWS WAF to communicate with QRadar.
  3. Add an Amazon AWS WAF log source on the QRadar Console. For more information about configuring the log source parameters, see Amazon AWS S3 REST API log source parameters for Amazon AWS AWF.