@timestamp

type: date

type: string

type: number

host.keyword

parent: host

httpRequest.clientIp

type: ip

userAgent.keyword

parent: userAgent

webaclId.keyword

parent: webaclId

title: awswaf-waf-*

type: index-pattern


title: awswaf-waf-Top Client IPs

title: awswaf-waf-Top Client IPs

type: table

type: count

schema: metric

type: terms

order: desc

otherBucketLabel: Other

missingBucketLabel: Missing

customLabel: Client IP Address

schema: bucket

totalFunc: sum

type: visualization


title: awswaf-waf-Total Requests

title: awswaf-waf-Total Requests

type: metric

colorSchema: Green to Red


query: action:BLOCK

title: awswaf-waf-Total Blocked Requests

title: awswaf-waf-Total Blocked Requests


title: awswaf-waf-Country or Region By Requests

customLabel: Country

schema: segment

legendPosition: bottomright

colorSchema: Yellow to Red

World Countries

attribution: Made with NaturalEarth | Elastic Maps Service

type: id

description: ISO 3166-1 alpha-2 code

description: ISO 3166-1 alpha-3 code

name

type: property

description: name

type: geojson

layerId: elastic_maps_service.World Countries

description: ISO 3166-1 alpha-2 code

format: image/png


title: awswaf-waf-Executed WAF Rules

title: awswaf-waf-Executed WAF Rules

type: pie

field: terminatingRuleId

legendPosition: right


title: awswaf-waf-Filters

title: awswaf-waf-Filters

fieldName: webaclName

label: WebACL

type: list

label: Rule

fieldName: action

label: Action

label: Country or Region

label: Client IP

label: Host

fieldName: terminatingRuleType

label: Rule Type


title: awswaf-waf-Top Countries or Regions

title: awswaf-waf-Top Countries or Regions

customLabel: Country or Region


title: awswaf-waf-Top User-Agents

direction: asc

title: awswaf-waf-Top User-Agents

customLabel: User-Agent


title: awswaf-waf-HTTP Methods

title: awswaf-waf-HTTP Methods


title: awswaf-waf-HTTP Versions

title: awswaf-waf-HTTP Versions


title: awswaf-waf-Unique Client IPs

title: awswaf-waf-Unique Client IPs

type: cardinality


title: awswaf-waf-Requests Timeline

title: awswaf-waf-Requests Timeline

type: timelion

expression: .es(index=awswaf-waf-*, timefield=timestamp, q='action:ALLOW').label("Allowed Requests").color(#009933), .es(index=awswaf-waf-*,timefield=timestamp, q='action:BLOCK').label("Blocked Requests").color(#cc0000), .es(index=awswaf-waf-*, timefield=timestamp).label("Requests Count").color(#AA9933)

interval: auto


title: awswaf-waf-Top Hosts

title: awswaf-waf-Top Hosts

customLabel: Host


title: awswaf-waf-Top WebACLs

title: awswaf-waf-Top WebACLs

field: webaclName

customLabel: WebACL Name

customLabel: WebACL ID


title: awswaf-waf-Top Rules

title: awswaf-waf-Top Rules

customLabel: Rule Name


title: awswaf-waf-Top Request URIs

title: awswaf-waf-Top Request URIs

customLabel: URI


sort: timestamp desc

title: awswaf-waf-Matched Details

type: search


columns: httpRequest.clientIp terminatingRuleMatchDetails nonTerminatingMatchingRules rateBasedRuleList ruleGroupList terminatingRuleId action httpRequest.args

query: terminatingRuleId:*

title: awswaf-waf-Terminating Matching Rule


title: awswaf-waf-Web ACLs

title: awswaf-waf-Web ACLs


title: awswaf-waf-Block Allow Host Uri

title: awswaf-waf-Block Allow Host Uri

customLabel: Request URI

field: action

customLabel: Action


title: awswaf-waf-Top Labels

direction: desc

title: awswaf-waf-Top Labels

customLabel: Label


title: Top Client IPs

title: Top Client IPs

title: Total Requests

title: Total Requests

title: Total Blocked Requests

title: Total Blocked Requests

title: Country or Region By Requests

title: Country or Region By Requests

title: WAF Rules

title: WAF Rules

title: Filters

title: Filters

title: Top Countries or Regions

title: Top Countries or Regions

title: Top User Agents

title: Top User Agents

title: HTTP Methods

title: HTTP Methods

title: HTTP Versions

title: HTTP Versions

title: Unique Client IPs

title: Unique Client IPs

title: Requests Timeline

title: Requests Timeline

title: Top Hosts

title: Top Hosts

title: Top WebACLs

title: Top WebACLs

title: Top Rules

title: Top Rules

title: Top Request URIs

title: Top Request URIs

title: View by httpRequest args,uri,path

title: View by httpRequest args,uri,path

title: View by Matching Rule

title: View by Matching Rule

title: Web ACLs

title: Web ACLs

title: Block Allow Host Uri

title: Block Allow Host Uri

title: Top Labels with Host, Uri

title: Top Labels with Host, Uri

title: awswaf-waf-dashboard

type: dashboard