Viewing a sample of web requests - Amazon WAF, Amazon Firewall Manager, and Amazon Shield Advanced
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Viewing a sample of web requests

This section describes the web ACL Sampled requests tab in the Amazon WAF console. In this tab, you can view a graph of all of the rule matches for web requests that Amazon WAF has inspected. Additionally, if you have request sampling enabled for the web ACL, you can see a table view of a sample of the web requests that Amazon WAF has inspected. You can also retrieve sampled request information through the API call GetSampledRequests.

The sample of requests contains up to 100 requests that matched the criteria for a rule in the web ACL and another 100 requests for requests that didn't match any rules and had the web ACL default action applied. The requests in the sample come from all the protected resources that have received requests for your content in the previous three hours.

When a web request matches the criteria in a rule and the action for that rule doesn't terminate the request evaluation, Amazon WAF continues inspecting the web request using the subsequent rules in the web ACL. Because of this, a web request could appear multiple times. For information about rule action behaviors, see Using rule actions in Amazon WAF.

To view the all rules graph and sampled requests

  1. Sign in to the Amazon Web Services Management Console and open the Amazon WAF console at https://console.amazonaws.cn/wafv2/.

  2. In the navigation pane, choose Web ACLs.

  3. Choose the name of the web ACL for which you want to view requests. The console takes you to the web ACL's description, where you can edit it.

  4. In the Sampled requests tab, you can see the following:

    • All rules graph – This graph shows the matching rules and rule actions for all web request evaluations that were performed during the indicated time range.

      Note

      The time range for this graph is set in the web ACL's Traffic overview tab, in the Data filters section. For information, see Viewing the dashboards for a web ACL.

    • Sampled requests table – This table displays sampled request data for the last 3 hours. For each entry, the table displays the following data:

      Metric name

      The CloudWatch metric name for the rule in the web ACL that matched the request. If a web request doesn't match any rule in the web ACL, this value is Default.

      Note

      If you change the name of a rule and you want the rule's metric name to reflect the change, you must update the metric name as well. Amazon WAF doesn't automatically update the metric name for a rule when you change the rule name. You can change the metric name when you edit the rule in the console, by using the rule JSON editor. You can also change both names through the APIs and in any JSON listing that you use to define your web ACL or rule group.

      Source IP

      Either the IP address that the request originated from or, if the viewer used an HTTP proxy or an Application Load Balancer to send the request, the IP address of the proxy or Application Load Balancer.

      URI

      The part of a URL that identifies a resource, for example, /images/daily-ad.jpg.

      Rule inside rule group

      If the metric name identifies a rule group reference statement, this identifies the rule inside the rule group that matched the request.

      Action

      Indicates the action for the corresponding rule. For information about the possible rule actions, see Using rule actions in Amazon WAF.

      Time

      The time that Amazon WAF received the request from the protected resource.

      To display additional information about the components of a web request, choose the name of the URI in the row of the request.