Amazon WAF Monitoring in ObserveOps
Overview
The Amazon WAF integration with ObserveOps (formerly known as AIOps) collects configuration inventory and request traffic telemetry from AWS Web Application Firewall. It monitors Web ACL capacity, rule and rule group counts, rate-based blocking activity, and request disposition metrics including allowed, blocked, counted, CAPTCHA, and bot traffic volumes.
These metrics help security teams track WAF rule effectiveness, detect unusual traffic patterns, measure bot activity, and verify that logging and sampling are active on Web ACLs.
Prerequisites
- AWS WAF is enabled in the target AWS account and region with at least one Web ACL configured.
- The IAM role or user used for integration has read access to WAF resources (
wafv2:ListWebACLs, wafv2:GetWebACL, wafv2:ListRuleGroups, wafv2:ListIPSets, cloudwatch:GetMetricData). - Required WAF and CloudWatch API endpoints are reachable from ObserveOps.
- The AWS account is added in discovery with correct credentials and region configuration.
List of Supported KPIs
Web ACL
| Metric | Description | Type |
|---|
| aws.waf.webacl.capacity.used | Web ACL capacity units (WCUs) currently in use. | Count |
| aws.waf.webacl.rules | Number of rules configured in the Web ACL. | Count |
| aws.waf.logging.enabled | Indicates whether logging is enabled for the Web ACL. | Boolean |
| aws.waf.webacl.cloudwatch.metrics.enabled | Indicates whether CloudWatch metrics are enabled for the Web ACL. | Boolean |
| aws.waf.webacl.sampled.requests.enabled | Indicates whether sampled request logging is enabled. | Boolean |
| aws.waf.ratebasedrule.blocked.ipv4 | Number of IPv4 addresses currently blocked by rate-based rules. | Count |
| aws.waf.ratebasedrule.blocked.ipv6 | Number of IPv6 addresses currently blocked by rate-based rules. | Count |
| aws.waf.rule.groups | Number of rule groups referenced by the Web ACL. | Count |
| aws.waf.ip.sets | Number of IP sets referenced by the Web ACL. | Count |
Rule Groups and IP Sets
| Metric | Description | Type |
|---|
| aws.waf.rule.group | Identifier of an individual rule group. | String |
| aws.waf.rule.group.capacity | Capacity units consumed by the rule group. | Count |
| aws.waf.rule.group.rules | Number of rules in the rule group. | Count |
| aws.waf.ip.set | Identifier of an individual IP set. | String |
| aws.waf.ip.set.addresses | Number of IP addresses or CIDR ranges in the IP set. | Count |
Request Traffic
| Metric | Description | Type |
|---|
| aws.waf.request.allowed | Number of web requests allowed by the Web ACL. | Count |
| aws.waf.request.blocked | Number of web requests blocked by the Web ACL. | Count |
| aws.waf.request.counted | Number of web requests counted by COUNT rule actions. | Count |
| aws.waf.request.passed | Number of web requests that passed all rules without action. | Count |
| aws.waf.captcha.request | Total number of requests evaluated by CAPTCHA rules. | Count |
| aws.waf.captcha.solved | Number of CAPTCHA challenges successfully solved by users. | Count |
| aws.waf.captcha.attempted | Number of CAPTCHA challenge attempts recorded. | Count |
| aws.waf.challenge.request | Total number of requests evaluated by Challenge rules. | Count |
| aws.waf.challenge.solved | Number of Challenge verifications successfully completed. | Count |
| aws.waf.bot.sample.blocked | Number of sampled bot traffic requests blocked. | Count |
| aws.waf.bot.sample.allowed | Number of sampled bot traffic requests allowed. | Count |