Stream WAF events to a SIEM

You can send the events of Web Application Firewall (WAF) to a security information and event management (SIEM) platform from Azion Console or with the Azion API. To send the requests of your applications without WAF data, refer to Endpoints and the guide of your endpoint.

A Data Stream stream reads the WAF Events data source and shapes each event with the WAF Event Collector template. Each log line carries the score the request received, the WAF rules it matched, the attack family, and the action WAF took. For every variable, refer to WAF Events.

The example sends the events to an Apache Kafka topic that your SIEM reads. In the stream form, the endpoint is set in the field labeled Connector.

Prerequisites

Console

An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
Firewall with WAF on the account, protecting a workload that receives requests. To set up WAF, refer to the WAF quickstart.
An endpoint that your SIEM reads. This guide uses an Apache Kafka cluster, with the host and port of its servers for the initial connection and the name of one topic. For the other endpoints a stream can send to, refer to Endpoints.
Access to Azion Console. To sign in, refer to How to access Azion Console.

Create the stream

The stream collects the WAF events of the workload you choose, through a workload filter. Unlike sampling, a workload filter leaves your other streams active.

Console

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream

Name the stream

In the General section, enter a Name. For example: waf-to-siem.

Select the WAF Events data source

In the Input section, select WAF Events in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. In Available Workload, select the workload that WAF protects and move it to Chosen Workload with the arrow. If your Console names domains where this guide names workloads, the same control reads Filter Domains. The pick list then reads Available Domain and Chosen Domain.

Select the template

In the Render Template section, select WAF Event Collector in Template. The Data Set field shows the keys of each log line.

Select the endpoint

In the Output section, select Apache Kafka in Connector. For another SIEM, select its option, such as Splunk, IBM QRadar, or Elasticsearch, and enter the fields that Endpoints lists for it.

Enter the bootstrap servers

In Bootstrap Servers, enter each server as host:port, separated by a comma and no space. For example: kafka1.example.com:9092,kafka2.example.com:9092.

Enter the topic

In Kafka Topic, enter the name of the topic your SIEM reads. For example: azion.waf.

(Optional) Turn on TLS

Turn on Enable Transport Layer Security (TLS) to send the events encrypted. The receiving servers need a certificate from a trusted certificate authority.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The stream appears in the Data Stream list with waf in the Source column and the Active status.

Saving the stream checks the format of each field and does not contact the cluster. A wrong server address or topic surfaces only when the stream sends. An activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload that WAF analyzes, then wait about a minute. A stream sends a batch every 60 seconds, or sooner when it reaches 2,000 log lines.

Console

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source

Read the latest sends

Each row is one send. Find the rows whose Endpoint Type matches your endpoint, and read their Status Code.

A Status Code of 200 means the endpoint accepted the batch. Streamed Lines gives the number of log lines in the batch.

A status other than 200 is the answer of the endpoint, and 503 means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

At the SIEM, each log line carries the keys of the WAF Event Collector template. Read these keys to check that the events are the ones WAF analyzed:

waf_attack_action holds the action WAF took, such as $BLOCK or $PASS.
waf_attack_family holds the class of the infraction, such as SQL or XSS.
waf_score and waf_match hold the score of the request and the infractions it matched.
blocked reads 1 when WAF blocked the request. While waf_learning reads 1, WAF blocks no request.

To correlate these events with the request data of your applications in one log line, use the Applications data source with the Applications + WAF Event Collector template instead. For the tradeoff, refer to Best practices for Data Stream.

These checks confirm the Protect web applications from OWASP Top 10 and zero-day attacks use case.

These checks confirm the Protect public APIs from abuse use case.

These checks confirm the Block attackers automatically from SIEM detections use case.

Next steps

Data sources and variablesRead what each variable of the WAF Events data source holds, with an example value.EndpointsFind the fields of the endpoint your SIEM reads, with their bounds and API names.Send logs to Apache KafkaSet the bootstrap servers, the topic, and TLS for an Apache Kafka endpoint.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.Block attackers automatically from SIEM detectionsA design where the SIEM's detections on these events come back as blocks in a network list.Protect web applications from OWASP Top 10 and zero-day attacksA web application whose firewall runs network lists, WAF, and Bot Manager in one policy.Protect public APIs from abuseAn API whose rate limit runs last, after WAF, a token check, and Bot Manager.