AWS Network Firewall Managed Signatures

Question

Hi,

I am trying to configure statefull rule using the new AWS network firewall managed signatures .  I am seeing that firewall is detecting some malicious traffic but its not blocked. Any idea how i can change the action to block or drop?

Thanks

Answer

It sounds like your default action for the managed rule group is set to alert.  You can set it to drop to block the traffic: 
https://docs.aws.amazon.com/network-firewall/latest/developerguide/nwfw-using-managed-rule-groups.html

You may also need to check out your rule group ordering:
https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html#suricata-default-rule-evaluation-order

AWS Network Firewall Managed Signatures

Relevanter Inhalt