How to know what text transformation I need

Hi THere

When you analyze the WAF logs , you have to identify the Encoding Schemes. Based on the patterns you observe in the logs, try to identify the encoding schemes used in the malicious requests. Common encoding schemes include:

• URL encoding (e.g., %20 for space)
• Hexadecimal encoding (e.g., 0x20 for space)
• Base64 encoding
• JSON encoding
• HTML entity encoding (e.g.,   for space)

Here's a common order for applying text transformations:

1. Decode HTML entity encoding (if present)
2. Decode URL encoding
3. Decode Base64 encoding (if present)
4. Decode Hex encoding (if present)
5. Normalize JSON bodies (if present)

For example, if you notice that the malicious requests use URL encoding and Hex encoding, you can apply the URLDecode and HexDecode transformations in that order.

Are you using the AWS Managed rules for WAF? These rules are maintained by AWS and can provide protection against common attack patterns, including DDoS attacks.