Exemple de messages d'événement d'Amazon AWS WAF
Utilisez ces exemples de messages d'événement pour vérifier la réussite de l'intégration avec IBM QRadar.
Important: En raison de problèmes de formatage, collez le format de message dans un éditeur de texte, puis supprimez les caractères de retour chariot ou de saut de ligne.
Exemple de messages Amazon AWS WAF lorsque vous utilisez le protocole d'API REST Amazon AWS S3
Exemple 1 : L'exemple de message d'événement suivant montre qu'Amazon AWS WAF a autorisé l'accès à la ressource sous-jacente.
{"timestamp":1613576332142,"formatVersion":1,"webaclId":"webaclId","terminatingRuleId":"First_Rule","terminatingRuleType":"REGULAR","action":"ALLOW","terminatingRuleMatchDetails":[],"httpSourceName":"APIGW","httpSourceId":"11111111111111:1111111111:First_API_Gateway","ruleGroupList":[],"rateBasedRuleList":[],"nonTerminatingMatchingRules":[],"requestHeadersInserted":null,"responseCodeSent":null,"httpRequest":{"clientIp":"10.2.173.13","country":"country","headers":[{"name":"accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"},{"name":"accept-encoding","value":"gzip, deflate, br"},{"name":"accept-language","value":"en-US,en;q=0.9"},{"name":"cache-control","value":"max-age=0"},{"name":"Host","value":"1111111111.execute-api.region.amazonaws.com"},{"name":"sec-fetch-dest","value":"document"},{"name":"sec-fetch-mode","value":"navigate"},{"name":"sec-fetch-site","value":"none"},{"name":"sec-fetch-user","value":"?1"},{"name":"upgrade-insecure-requests","value":"1"},{"name":"user-agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36"},{"name":"X-Amzn-Trace-Id","value":"Root=1-111111aaaaa1111111"},{"name":"X-Forwarded-For","value":"10.2.173.13"},{"name":"X-Forwarded-Port","value":"443"},{"name":"X-Forwarded-Proto","value":"https"},{"name":"Content-Length","value":"0"},{"name":"Connection","value":"Keep-Alive"}],"uri":"/First_API_Gateway/pets","args":"","httpVersion":"HTTP/1.1","httpMethod":"GET","requestId":"111111aaaa1aaa1"}}| Nom de zone QRadar | Valeurs mises en évidence dans le contenu d'événement |
|---|---|
| ID d'événement | ALLOW |
| Catégorie d'événement | Pour ce DSM, la valeur dans QRadar est toujours AmazonAWSWAF. |
| Horodatage | 1613576332142 |
| Adresse IP source | 10.2.173.13 |
Exemple 2 : L'exemple de message d'événement suivant montre qu'Amazon AWS WAF a bloqué le trafic vers la ressource sous-jacente.
{"timestamp":16135764421213,"formatVersion":1,"webaclId":"webaclId","terminatingRuleId":"First_Rule","terminatingRuleType":"REGULAR","action":"BLOCK","terminatingRuleMatchDetails":[],"httpSourceName":"APIGW","httpSourceId":"11111111111111:1111111111:First_API_Gateway","ruleGroupList":[],"rateBasedRuleList":[],"nonTerminatingMatchingRules":[],"requestHeadersInserted":null,"responseCodeSent":null,"httpRequest":{"clientIp":"10.2.173.14","country":"country","headers":[{"name":"accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"},{"name":"accept-encoding","value":"gzip, deflate, br"},{"name":"accept-language","value":"en-US,en;q=0.9"},{"name":"cache-control","value":"max-age=0"},{"name":"Host","value":"1111111111.execute-api.region.amazonaws.com"},{"name":"sec-fetch-dest","value":"document"},{"name":"sec-fetch-mode","value":"navigate"},{"name":"sec-fetch-site","value":"none"},{"name":"sec-fetch-user","value":"?1"},{"name":"upgrade-insecure-requests","value":"1"},{"name":"user-agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36"},{"name":"X-Amzn-Trace-Id","value":"Root=1-111111aaaaa1111111"},{"name":"X-Forwarded-For","value":"10.2.173.13"},{"name":"X-Forwarded-Port","value":"443"},{"name":"X-Forwarded-Proto","value":"https"},{"name":"Content-Length","value":"0"},{"name":"Connection","value":"Keep-Alive"}],"uri":"/First_API_Gateway/pets","args":"","httpVersion":"HTTP/1.1","httpMethod":"GET","requestId":"111111aaaa1aaa1"}}| Nom de zone QRadar | Valeurs mises en évidence dans le contenu d'événement |
|---|---|
| ID d'événement | BLOCK |
| Catégorie d'événement | Pour ce DSM, la valeur dans QRadar est toujours AmazonAWSWAF. |
| Horodatage | 16135764421213 |
| Adresse IP source | 10.2.173.14 |