---
title: "AWS WAF"
slug: "aws-waf-logs"
tags: ["Self Service Ingestion"]
updated: 2026-02-28T21:46:48Z
published: 2026-02-28T21:46:48Z
canonical: "docs.hunters.ai/aws-waf-logs"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS WAF

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

## Overview

![](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/WAF.png?sv=2026-02-06&spr=https&st=2026-11-11T09%3A08%3A16Z&se=2026-11-11T10%3A08%3A16Z&sr=c&sp=r&sig=L9zQI6NUozLQ09tgpZhdZvqFHtlcRDdRbjwiuOv%2FEK8%3D)**Table name:** `aws_waf`

AWS WAF is a web application firewall that helps protect web applications from attacks by allowing you to configure rules that allow, block, or monitor (count) web requests based on conditions that you define.

## Send data to Hunters

**To connect AWS WAF logs:**

1. Follow [this guide](https://docs.aws.amazon.com/waf/latest/developerguide/logging-s3.html) by AWS to export the logs to an S3 bucket.
2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](https://hunters.document360.io/docs/connect-data-through-aws-s3).

## Expected format

Logs are expected in JSON format.

```json
{"timestamp":1652785041199,"formatVersion":1,"webaclId":"arn:aws:asdf:eu-central-1:asdf:regional/webacl/ext-asdf-stack/asdf","terminatingRuleId":"Default_Action","terminatingRuleType":"REGULAR","action":"ALLOW","terminatingRuleMatchDetails":[],"httpSourceName":"ALB","httpSourceId":"asdf-app/aws-alb-support/asdf","ruleGroupList":[{"ruleGroupId":"AWS#asdf","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null},{"ruleGroupId":"AWS#asd","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null},{"ruleGroupId":"AWS#asdf","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null},{"ruleGroupId":"AWS#sadf","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null},{"ruleGroupId":"AWS#asdf","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null}],"rateBasedRuleList":[],"nonTerminatingMatchingRules":[],"requestHeadersInserted":null,"responseCodeSent":null,"httpRequest":{"clientIp":"1.1.1.1","country":"DE","headers":[{"name":"host","value":"support.user.user"},{"name":"content-length","value":"455"},{"name":"sec-ch-ua","value":"\" Not A;Brand\";v=\"99\", \"Chromium\";v=\"101\", \"Google Chrome\";v=\"101\""},{"name":"accept","value":"application/json, text/javascript, */*; q=0.01"},{"name":"content-type","value":"application/json"},{"name":"x-requested-with","value":"XMLHttpRequest"},{"name":"asdf","value":"?0"},{"name":"user-agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36"},{"name":"sec-asdfa-asdf","value":"\"macOS\""},{"name":"origin","value":"https://support.user.de"},{"name":"sec-fetch-site","value":"same-origin"},{"name":"sec-fetch-mode","value":"cors"},{"name":"sec-fetch-dest","value":"empty"},{"name":"referer","value":"https://support.user.de/secure/RapidBoard.jspa?rapidView=144"},{"name":"accept-encoding","value":"gzip, deflate, br"},{"name":"accept-language","value":"en-GB,en-US;q=0.9,en;q=0.8"},{"name":"cookie","value":"123=%asdf%asdf; JSESSIONID=123; atlassian.xsrf.token=123; slack.inapp.links.first.clicked.user.user=false; AWSALB=+123+123+123+o9TiX/BUcQix+123/123/123; AWSALBCORS=+123+123+123+123/123"}],"uri":"/rest/analytics/1.0/publish/bulk","args":"","httpVersion":"HTTP/2.0","httpMethod":"POST","requestId":"1-123-123"}}
```