How do I identify traffic patterns invoked by SQLi and XSS rules in AWS WAF?

Short description

To identify traffic patterns invoked by SQLi and XSS rules, create AWS WAF rules and turn on AWS WAF logging. Send the logs to a log group in Amazon CloudWatch Logs or an Amazon Simple Storage Service (Amazon S3) bucket. Then use Amazon CloudWatch Log Insights or Amazon Athena to query the logs.

Resolution

AWS WAF logs include the patterns that invoked SQLi and XSS rules in the terminatingRuleMatchDetails log field. You can use the patterns to troubleshoot SQLi and XSS rule false positives. For more information, see Log fields for protection pack (web ACL) traffic and Log examples for protection pack (web ACL) traffic.

AWS WAF log example

AWS WAF logging records details for every inspected request, including the rule that evaluated the request and when applicable, information about the matched pattern.
Example:

{
  "terminatingRuleId": "CustomRule",
  "terminatingRuleType": "REGULAR", 
  "action": "BLOCK",
  "terminatingRuleMatchDetails": [
    {
      "conditionType": "SQL_INJECTION",
      "location": "BODY",
      "matchedData": ["<redacted>"],
      "matchedFieldName": "",
      "sensitivityLevel": "LOW"
    }
  ]
}

conditionType defines which type of inspection matches. In the preceding example, the condtionType is SQL injection.

location defines which part of the request AWS WAF inspected. In the preceding example, location is BODY, URL, or QUERY_STRING.

matchedData contains the specific strings in the request that invokes the rule. If log redaction is enabled in AWS WAF, some fields may be partially or fully redacted in the log output.

sensitivityLevel defines the inspection sensitivity level used by the rule. By default, sensitivityLevel in the log entry is set to LOW for AWS Managed rule groups such as AWS Managed Rules for SQLi and XSS. This reduces the likelihood of false positives. For custom SQLi inspection statements that you define in your own rule groups, you can configure the inspection sensitivity level as either Low or High.

Examine fields such as terminatingRuleId, terminatingRuleMatchDetails and action to correlate requests with rule evaluations and outcomes.

When you use AWS Managed Rule groups, AWS WAF exposes many detections through rule labels in the log events. To identify which managed rule signatures match incoming requests, query both the terminating rule information and rule labels.

Depending on the action configured for a rule, a request might appear in the logs even when AWS WAF doesn't block it. Use the action and terminatingRuleId fields to distinguish between evaluated, counted, and blocked requests.

CloudWatch Logs Insights queries

If your AWS WAF logs are stored in Amazon CloudWatch Logs, then use CloudWatch Logs Insights to run queries to identify traffic patterns.
Run a CloudWatch Logs Insights query with the terminatingRuleMatchDetails log field to identify traffic patterns. The following example query returns the timestamp, the client IP address, the origin country, the details of the match, and the request Id:

fields @timestamp
| parse @message ',"terminatingRuleMatchDetails":[*],' as terminatingRuleMatchData
| filter (terminatingRuleMatchData like /XSS/ or terminatingRuleMatchData like /SQL/)
| display @timestamp, httpRequest.clientIp, httpRequest.country, terminatingRuleMatchData, httpRequest.requestId
| limit 100 

For more information, see How do I analyze AWS WAF logs in CloudWatch?

Amazon Athena queries

If your AWS WAF logs are stored in Amazon S3, then use Amazon Athena queries to identify traffic patterns. Run an Amazon Athena query with the terminatingRuleMatchDetails log field to identify traffic patterns. The following query returns the timestamp, the client IP address, the origin country, the details of the match, and the request Id:

SELECT 
    to_iso8601(from_unixtime(timestamp / 1000)) as timestamp,
    terminatingRuleId,
    action,
    httpRequest.requestId as RequestID,
    httpRequest.clientIp as ClientIP,
    httpRequest.country as Country,
    termmatchrules.conditionType as ConditionType,
    termmatchrules.location as Location,
    termmatchrules.matchedData as MatchedData
FROM waf_logs  
CROSS JOIN UNNEST(terminatingRuleMatchDetails) as t(termmatchrules)
WHERE termmatchrules.conditionType in ('XSS', 'SQL_INJECTION')

For more informatoin, see How do I analyze AWS WAF logs in Amazon Athena?

Related information

Analyzing AWS WAF Logs in Amazon CloudWatch Logs

How do I exclude specific URIs from XSS or SQLi inspection for HTTP requests in AWS WAF?