AWS WAF

Scanner supports AWS WAF logs, which contain data about traffic that is analyzed by your web ACL. In order for Scanner to see these logs, you can configure WAF to publish them to an S3 bucket that Scanner is linked to.

Collect logs in S3

1

WAF to S3

Follow the AWS documentation to configure WAF to write web ACL traffic logs to an S3 bucket that Scanner is linked to.

See: Sending web ACL traffic logs to an Amazon Simple Storage Service bucket.

Create an Index Rule

Once WAF logs are landing in your S3 bucket, Create an Index Rule to ingest the logs via Scanner Collect for fast search and detections.