Copying threat signature rule group rules into your own rule group - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Copying threat signature rule group rules into your own rule group

You have full visibility into threat signature rule content. You can either add Amazon managed threat signature rule groups as-is to your firewall policies, or you can copy and modify the rule group's rules to meet your specific needs.

Important

Copied rules don't automatically inherit rule updates that Amazon makes to managed rule group rules. We recommend that you subscribe to Amazon SNS topics for updates made to the originating rule group. For more information, see Getting notified of updates to a threat signature rule group. You're responsible for validating rule changes and making sure that your own rules are up-to-date.

To copy a managed threat signature rule group's rules, create a local copy of the rule group rules, make your modifications, then create your own rule group. The following procedure explains how to copy a threat signature rule group's rules, and then create your own rule group.

Console
To copy a managed threat signature rule group's rules using the console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon VPC console at https://console.amazonaws.cn/vpc/.

  2. In the navigation pane, under Network Firewall, choose Network Firewall rule groups.

  3. In the Amazon managed rule groups tab, under Threat signature rule groups, select a rule group to view its details.

  4. Choose Duplicate rule group to copy the rules into your own rule group. You can modify the rule group details, and then choose Create rule group.

    Alternatively, you can choose Copy to copy the rules to your clipboard. You can then modify them in a text editor, or create a new rule group and paste the rules into your own stateful rule group. For information about how to create your own stateful rule group, see Creating a stateful rule group.

CLI
To copy a managed threat signature rule group's rules using the Amazon CLI

  1. Run aws network-firewall list-rule-groups --scope MANAGED --managed-type AWS_MANAGED_THREAT_SIGNATURES to filter the Amazon managed threat signature rule groups.

  2. In the following command, replace rulegroup-arn with the Amazon Resource Name (ARN) of the threat signature managed rule group that you'd like to copy:

    aws network-firewall describe-rule-group --rule-group-arn rulegroup-arn.

    Network Firewall returns the rule group details in the response, which you can parse and modify in your text editor. Then, you can use the modified rule group details to create your own rule group using the command create-rule-group.