AWS WAF_AWSManagedRulesAnonymousIpList

Question

Hello,

I've enabled the AWS WAF service in my project. I've also set the rule action of HostingProviderIPList Rule in AWSManagedRulesAnonymousIpList
 as "Challenge." After analyzing the WAF logs from Cloudwatch, I noticed that the log was incomplete and we can see that only the main rule action is "Challenge," and there's no indication of whether the client passed or failed the challenge. Furthermore, there are no logs showing what happened after the challenge, such as the execution of the challenge.js script or the generation of a token for retrying the request. How can I find out what happened next? Please Help!

NARRAVULA MUNISAI TEJA · Answer

Hello Elson,

**Default AWS WAF logs lack details on challenge responses. To gain insights:**
* Enable logging for specific fields like `request_headers` in your WAF logging configuration.
* Check CloudTrail logs around the challenge timeframe for WAF events `(e.g., wafv2:RuleAction).`

**Web ACL logging configuration:** https://docs.aws.amazon.com/waf/latest/developerguide/logging.html

**Logging and monitoring in AWS WAF:** https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/aws-security-incident-response-guide.html

AWS WAF_AWSManagedRulesAnonymousIpList

Relevant content