【Overview】
In this blog, we will introduce monthly report function of WafCharm. The report is generated on a monthly basis for the registered Web ACL, and includes information regarding attacks, such as its kind, frequency and source. You can also check the monthly reports on your smartphone.
【Usage Requirements】
The following settings are required to use the monthly report function.
1. Output AWS WAF logs to S3 using Kinesis Firehose, or output AWS WAF logs directly to S3 bucket.
2. Transfer the output log from Step 1. to WafCharm using Lambda.
※The setting instructions are on the “Help” page and can be accessed from WafCharm management screen in the following way.
【Monthly report (for PC)】
"Grand Total" in the monthly report is the total of all detections in that month for all the Web ACLs registered in WafCharm for which the monthly report function is enabled.
You can also check the monthly report status for each Web ACL separately.
To check you can either click the Web ACL name to browse the report (Example: Web ACL Sample A) or scroll down.
You can also check past monthly reports.
【Monthly report (for smartphones)】
It looks like the following when viewed on a smartphone.
Example: Screen for “Grand Total”
【Attack Type Classification】
The Attack Type is classified and displayed as follows. ※As of December 13, 2023
【Download Excel data】
You can download the data from the [Excel] button at the top right corner.
Excel will include all data presented in the monthly report page for each report.
For example, if you download Excel data from the Grand Total report, the data from the Grand Total report, which is a report that shows aggregated data from all of the registered web ACLs, will be downloaded. If you download Excel data from one of the web ACL's reports, the data for that web ACL will be downloaded.
You can see the data shown in the tooltip on the report page in the Excel file. You can also use this data based on your needs to adjust how to present them.
【Summary】
This time we introduced WafCharm's monthly report function.
Try it yourself and see how easy it is to check information regarding attack types, source, frequency.
