-
Notifications
You must be signed in to change notification settings - Fork 474
[AWS] Add WAF datastream #1886
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[AWS] Add WAF datastream #1886
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
This is LGTM from my side in terms of how the data is parsed, would want an approval from @kaiyan-sheng especially on the addition to the AWS package, as I know these are made as subpackages etc? |
The only thing i don't know about the WAF logs is if they are nested like the other JSON AWS logs
|
From what I can see @legoguy1000, that is more specific to Cloudtrail logs. When WAF logs are written directly to S3 (for example with Kinesis) it does not come in that nested format. |
/test |
/test |
Anything else needed for this @kaiyan-sheng ? |
@P1llus Looks good to me 👍 Thanks!! |
What does this PR do?
Adds a new datastream to parse WAF logs
Checklist
changelog.yml
file.manifest.yml
file to point to the latest Elastic stack release (e.g.^7.13.0
).Author's Checklist
How to test this PR locally
Related issues
Screenshots