How do I send WAF logs to a SIEM; which formats carry attack information in a structured way (CEF, JSON)?

Short answer

For SIEM integration, WAF records are sent over syslog with a Logs profile assigned to the vService: the profile is created with Load Balancer → Profiles → Logs → Add, and Log Addresses (UDP or TCP, address, port), Log Standard and Line Format are selected; in the edit form of the vService, LOG is checked, the profile is selected in the Log Profile field and Save is clicked. The formats that carry the attack information (WAF info) in a structured way: CEF Format (isWafAttack and wafInfo fields), TR7 JSON Format ("isWafAttack" and "wafInfo" keys), TR7 WAF Log (the whole line is the JSON of the attack information; only blocked requests) and, with the %WAFINFO variable, Manual JSON Format, Manual CEF Format or Manual Log Line Format. The Standard Log Format, Apache Combined Log Format and Apache VHost Log Format formats do not carry attack information. CEF and TR7 JSON send all requests; if there is no attack, wafInfo is an empty object ({}), and isWafAttack becomes 1 only in blocked requests. The content of the attack information (fields, payload, language) is determined in the SIEM & Attack Details card on WAF Management.

Problem: WAF Records Are Wanted in the SIEM

Event Logs records are kept on the device and are deleted by the Disk Management rules. For the attacks to be monitored together with the other sources, correlated and stored for a long time in the organization's SIEM, the records must be sent out with syslog. In TR7, WAF records are sent by the same path as the access logs of the vService, with the log profile; the attack information is added to the line according to the format of the profile.

Solution: Three Methods

Your situation	Suitable method
All requests in the SIEM, the attack information on the same line	Method 1: CEF Format or TR7 JSON Format
Only blocked attacks to the SIEM	Method 2: TR7 WAF Log
A special line structure that the SIEM expects	Method 3: Manual formats and %WAFINFO

Method 1: CEF Format or TR7 JSON Format Recommended

• How it works One line is sent for each HTTP request; the line contains the isWafAttack and wafInfo fields together with the information of the request. In requests in which an attack is found (blocked, passed in Monitor mode, recognized by Teacher, or staying below the threshold and triggering a signature in the Monitor state), wafInfo carries the attack list (CEF · WAF Information).
• Where it is openedLoad Balancer → Profiles → Logs · vService edit form → Details → LOG
• Requirement Modify permission in the Load Balancer area (the Logs profile and the vService form are on Load Balancer screens); syslog access from TR7 to the SIEM (UDP or TCP); WAF protection on the vService; modify permission in the WAF area for the SIEM & Attack Details card
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

The profile form is opened with Load Balancer → Profiles → Logs → Add (how to add).

2

Adım 2 Enter the log address

Name is entered. In the Log Addresses row, the protocol (UDP or TCP), the address of the SIEM (e.g. 192.0.2.50) and its port (e.g. 514) are entered; another target can be added with +.

3

Adım 3 Select the standard and the format

Log Standard is selected according to the header that the SIEM expects (e.g. rfc5424). CEF Format or TR7 JSON Format is selected as the Line Format.

4

Adım 4 Save the profile

Add in the form is clicked.

5

Adım 5 Open the vService edit form

On the Load Balancer → Load Balancer vService List screen, the vService is right-clicked and Edit is selected (how to add to a vService).

6

Adım 6 Check LOG and select the profile

In the Details panel, LOG is checked and the created profile is selected in the Log Profile field.

7

Adım 7 Save

Save is clicked. In a cluster setup, the change is also sent to the peer device with the default auto-sync, and the two devices send the lines of their own traffic to the same addresses; if Manual Sync Mode is on, it is sent to the peer device manually.

8

Adım 8 Set the content of the attack information (if needed)

On the WAF Management tab of the vService, in the window opened with the pencil icon of the SIEM & Attack Details card, Attack Payload in WAF Info, Attack Details in WAF Info and WAF Info Language are selected and Edit is clicked (Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?).

Verification

1SIEM lineSIEM side

A test request that contains an attack is sent to the vService, and the line is searched for in the SIEM by the vService name.

Command: curl -s -o /dev/null -w '%{http_code}' 'https://www.example.com/cmd.exe'

ExpectedCEF:0|TR7|TR7 ASP|… isWafAttack=1 wafInfo={"uid":…,"action":"block",…}

In the line of requests that do not contain an attack, wafInfo={} is written. If the host group is in Monitor mode, the attack line contains "action":"monitor" and isWafAttack does not become 1.

Method 2: TR7 WAF Log

• How it works In the TR7 WAF Log format, only the requests that WAF blocked produce a line; the whole line is the JSON of the attack information. Requests passed in Monitor mode and requests recognized by Teacher are not sent.
• Where it is openedLoad Balancer → Profiles → Logs → Line Format = TR7 WAF Log
• Requirement Modify permission in the Load Balancer area (the Logs profile and the vService form are on Load Balancer screens); WAF on in the vService (on a vService whose WAF box is not checked, this format produces no lines at all)
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Create the profile

Steps 1–4 of Method 1 are followed; TR7 WAF Log is selected as the Line Format. To parse the line directly as JSON, Log Standard = raw is selected (log parsing example).

2

Adım 2 Bind to the vService and save

With steps 5–7 of Method 1, the profile is selected under LOG on the vService and Save is clicked. Details: Can I send only attack records to the SIEM?

Verification

1SIEM lineSIEM side

After a blocked test request, the line in the SIEM is examined.

Expected{"uid":"…","totalScore":8,"action":"block","attacks":[{"id":130005,…}],"wafTime":1.485}

Method 3: Manual Formats and %WAFINFO

• How it works In the Manual JSON Format, Manual CEF Format and Manual Log Line Format formats, the line is built manually; the attack information is added at the desired place with the %WAFINFO smart variable (Smart Variables).
• Where it is openedLoad Balancer → Profiles → Logs → Line Format = one of the Manual formats
• Requirement Modify permission in the Load Balancer area (the Logs profile and the vService form are on Load Balancer screens); the field structure that the SIEM expects
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Create the profile

Steps 1–2 of Method 1 are followed; one of the Manual formats is selected as the Line Format and the line structure is entered. For the attack information, the %WAFINFO variable is added (formats).

2

Adım 2 Save and bind

The profile is saved with Add; it is bound to the vService with steps 5–7 of Method 1.

Verification

1SIEM lineSIEM side

In the SIEM, the %WAFINFO position in the line is examined.

Expected{} if there is no attack, the JSON of the attack information if there is an attack

Common Mistakes

• Selecting the TR7 WAF Log format in Monitor mode. This format sends only the blocked requests; if the host group is in Monitor mode, no line goes to the SIEM because the requests that contain attacks are not blocked. For monitored attacks, CEF Format or TR7 JSON Format is used.
• Looking for attack information in the Standard or Apache formats. The Standard Log Format, Apache Combined Log Format and Apache VHost Log Format formats have no wafInfo.
• Not binding the profile to the vService. Even though the profile has been created, if LOG is not checked on the vService or the built-in Stream Log has stayed selected, the records are not sent out.
• Taking the isWafAttack field as the sign of every attack. The field becomes 1 only in blocked requests; in Monitor and Teacher records, the verdict of the request is read from the action key in wafInfo (monitor, fpc).
• Using the Log Forwarding screen. Log Forwarding forwards system logs (User Logs, Notification Logs …); WAF records are sent with the log profile.

How it is done in the documentation

• Logs profile · SIEM Integration
• CEF Format · WAF Info Structure
• TR7 JSON Format · The wafInfo Structure
• SIEM & Attack Details · What Is SIEM & Attack Details?

Related questions

• How do I send logs to a SIEM (Syslog)?
• Can I send only attack records to the SIEM?
• Which attack fields are sent to the SIEM (score, severity, scope, name, category, CWE, MITRE, CAPEC, OWASP, target)?