nico-stefani
commented
2 years ago Issue Update
I was able to reproduce the scenario with:
JSON Log
{ "Records": [ { "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "xxxxxxxxxxxxxxx", "arn": "-", "accountId": "XXXXXXXXXXXX", "accessKeyId": "-", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "-", "arn": "-" }, "webIdFederationData": {}, "attributes": { "creationDate": "2022-07-05T16:49:18Z", "mfaAuthenticated": "false" } } }, "eventTime": "2022-07-05T18:20:27Z", "eventSource": "wafv2.amazonaws.com", "eventName": "UpdateWebACL", "awsRegion": "us-west-2", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": { "name": "ec-web-acl", "scope": "REGIONAL", "id": "fd4c5ae0-4ddb-4bff-b67e-6786976f465f", "defaultAction": { "allow": {} }, "description": "ec-web-acl", "rules": [ { "name": "X-Application-ID", "priority": 0, "statement": { "byteMatchStatement": { "searchString": { "hb": [ 115, 121, 110, 116, 104, 101, 116, 105, 99 ], "offset": 0, "isReadOnly": false, "bigEndian": true, "nativeByteOrder": false, "mark": -1, "position": 0, "limit": 9, "capacity": 9, "address": 0 }, "fieldToMatch": { "singleHeader": { "name": "x-application-id" } }, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ], "positionalConstraint": "CONTAINS" } }, "action": { "count": {} }, "ruleLabels": [ { "name": "RulesCustom:ApplicationRappi:Synthetic" } ], "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "X-Application-ID" } }, { "name": "MS-Internos", "priority": 1, "statement": { "andStatement": { "statements": [ { "sizeConstraintStatement": { "fieldToMatch": { "singleHeader": { "name": "x-application-id" } }, "comparisonOperator": "GE", "size": 0, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ] } }, { "notStatement": { "statement": { "byteMatchStatement": { "searchString": { "hb": [ 115, 121, 110, 116, 104, 101, 116, 105, 99 ], "offset": 0, "isReadOnly": false, "bigEndian": true, "nativeByteOrder": false, "mark": -1, "position": 0, "limit": 9, "capacity": 9, "address": 0 }, "fieldToMatch": { "singleHeader": { "name": "x-application-id" } }, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ], "positionalConstraint": "CONTAINS" } } } } ] } }, "action": { "count": {} }, "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "MS-Internos" } }, { "name": "some-rules", "priority": 2, "statement": { "ruleGroupReferenceStatement": { "aRN": "arn:aws:wafv2:us-west-2:XXXXXXXXXXXX:regional/rulegroup/some/19dc9c90-b13d-420f-9a6f-fe8995d7bb4c" } }, "overrideAction": { "none": {} }, "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "some-rules" } }, { "name": "MS-ECOM-PARTNER", "priority": 3, "statement": { "byteMatchStatement": { "searchString": { "hb": [ 47, 101, 99, 111, 109, 45, 112, 97, 114, 116, 110, 101, 114, 115, 47 ], "offset": 0, "isReadOnly": false, "bigEndian": true, "nativeByteOrder": false, "mark": -1, "position": 0, "limit": 15, "capacity": 15, "address": 0 }, "fieldToMatch": { "uriPath": {} }, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ], "positionalConstraint": "CONTAINS" } }, "action": { "count": {} }, "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "MS-ECOM-PARTNER" } }, { "name": "RL_ALL", "priority": 4, "statement": { "rateBasedStatement": { "limit": 1000, "aggregateKeyType": "FORWARDED_IP", "forwardedIPConfig": { "headerName": "X-Forwarded-For", "fallbackBehavior": "MATCH" } } }, "action": { "count": {} }, "ruleLabels": [ { "name": "CustomRules:RateLimitMS" } ], "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "HttpFlood" } }, { "name": "Request_From_Country", "priority": 5, "statement": { "andStatement": { "statements": [ { "notStatement": { "statement": { "geoMatchStatement": { "countryCodes": [ "AR", "BR", "CL", "CO", "CR", "EC", "MX", "PE", "UY", "US" ], "forwardedIPConfig": { "headerName": "X-Forwarded-For", "fallbackBehavior": "MATCH" } } } } }, { "byteMatchStatement": { "searchString": { "hb": [ 47, 114, 101, 115, 116, 97, 117, 114, 97, 110, 116, 115, 45, 98, 117, 115, 47 ], "offset": 0, "isReadOnly": false, "bigEndian": true, "nativeByteOrder": false, "mark": -1, "position": 0, "limit": 17, "capacity": 17, "address": 0 }, "fieldToMatch": { "uriPath": {} }, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ], "positionalConstraint": "CONTAINS" } } ] } }, "action": { "block": {} }, "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "Request_From_Country" } }, { "name": "rl-es-proxy", "priority": 6, "statement": { "rateBasedStatement": { "limit": 750, "aggregateKeyType": "FORWARDED_IP", "scopeDownStatement": { "byteMatchStatement": { "searchString": { "hb": [ 47, 97, 112, 105, 47, 101, 115, 45, 112, 114, 111, 120, 121, 47, 115, 101, 97, 114, 99, 104, 47, 118, 50, 47, 112, 114, 111, 100, 117, 99, 116, 115 ], "offset": 0, "isReadOnly": false, "bigEndian": true, "nativeByteOrder": false, "mark": -1, "position": 0, "limit": 32, "capacity": 32, "address": 0 }, "fieldToMatch": { "uriPath": {} }, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ], "positionalConstraint": "STARTS_WITH" } }, "forwardedIPConfig": { "headerName": "X-Forwarded-For", "fallbackBehavior": "MATCH" } } }, "action": { "block": {} }, "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "rl-elasticsearch-proxy" } }, { "name": "some-bus-rl", "priority": 7, "statement": { "rateBasedStatement": { "limit": 350, "aggregateKeyType": "FORWARDED_IP", "scopeDownStatement": { "regexPatternSetReferenceStatement": { "aRN": "arn:aws:wafv2:us-west-2:XXXXXXXXXXXX:regional/regexpatternset/toppings-rl/a0350515-8fde-46a5-9f82-d786ff6327d1", "fieldToMatch": { "uriPath": {} }, "textTransformations": [ { "priority": 0, "type": "LOWERCASE" } ] } }, "forwardedIPConfig": { "headerName": "X-Forwarded-For", "fallbackBehavior": "MATCH" } } }, "action": { "block": {} }, "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "some-bus-rl" } } ], "visibilityConfig": { "sampledRequestsEnabled": true, "cloudWatchMetricsEnabled": true, "metricName": "ec-web-acl" }, "lockToken": "69fed7cb-3bf4-4496-b1c1-9d32e9fd8a93" }, "responseElements": { "nextLockToken": "6bfdbd0f-44aa-4da9-99e6-efee9587ccfd" }, "requestID": "1b4926c1-40a5-4a9c-886f-9b376fb5d4eb", "eventID": "d7219f7a-f2a4-4f05-a7f3-8ba35934ed0d", "readOnly": false, "eventType": "AwsApiCall", "apiVersion": "2019-04-23", "managementEvent": true, "recipientAccountId": "XXXXXXXXXXXX", "eventCategory": "Management", "sessionCredentialFromConsole": "true", "source": "cloudtrail", "aws_account_id": "XXXXXXXXXXXX" } ] }Using the command:
root@wazuh:/var/ossec# /var/ossec/wodles/aws/aws-s3 -b wazuh-aws-wodle-waf -t cloudtrail -s 2022-Aug-17 -p dev -d2
DEBUG: +++ Debug mode on - Level: 2
DEBUG: +++ Table does not exist; create
DEBUG: +++ Working on XXXXXXXXXXXX - us-west-1
DEBUG: +++ Marker: AWSLogs/XXXXXXXXXXXX/CloudTrail/us-west-1/2022/08/17
DEBUG: ++ Found new log: AWSLogs/XXXXXXXXXXXX/CloudTrail/us-west-1/2022/08/17/XXXXXXXXXXXX_CloudTrail_us-west-1_20220817T0000Z_HASDoKlxgfdkdIOa.json.txt
DEBUG: +++ DB MaintenanceAs a result, we can see that data.aws.requestParameters.rules field is not correctly showing in the dashboard.
In the discovery section we can see as raw JSON.
mcarmona99
Description
To determine the best way to address #14226 we need to determine if it is possible to filter the alerts in the UI using the data from the contents of the
requestParameters.rulesof a WAF log without having to apply major changes to our AWS integration. In particular, we want to be able to filter by thenameandactionkeys contained in the different items present in therequestParameters.ruleslist.The issue here is that the
requestParameters.rulescontains a list of items, each one corrresponding to a different application, which prevents us from being able to filter by these fields. In addition to that, these items can contain different fields each one.We need to investigate how the contents of
requestParameters.rulesare currently being indexed and displayed in theDiscoverpage of the UI. To do this, we should:requestParameters.rulesto the analysis engine without applying any modification to them.Discoverpage.requestParameters.rulescontents are rendered in the interface.One possible solution could be the usage of Elastic's nested fields to alter the way
requestParameters.rulesare being indexed and determine if this allows us to index them in a way that those items can be queried independently of each other.We need to determine if #14226 can be achieved by means of the nested field or any other solution involving Elasticsearch configurations.