Fastly WAF logging (original)

IMPORTANT

As announced, April 30, 2023 marks the formal retirement of the Fastly WAF (WAF Legacy and WAF 2020). Our Fastly Next-Gen WAF offers similar functionality. It monitors for suspicious and anomalous web traffic and protects, in real-time, against attacks directed at the applications and origin servers that you specify.

Fastly provides a number of WAF-specific logging variables to help you monitor and identify potentially malicious traffic. These variables provide specific details about the actions Fastly WAF performed on a request.

Setting up a logging endpoint

To begin monitoring requests for potential malicious activity, set up remote logging so you can log WAF variables. You can use an existing logging endpoint or add a new endpoint specially for Fastly WAF. You'll use the information provided in the logs to monitor WAF events.

OWASP rules

A single request can trigger multiple OWASP rules. By default, logging occurs in vcl_deliver or vcl_log. When logs are captured in vcl_deliver or vcl_log, it will show the last WAF rule triggered and the cumulative anomaly score.

waf_debug_log

The waf_debug_log subroutine allows logging of each OWASP rule triggered for a single request. You can use the web interface or the API to update the logging placement parameter to waf_debug.

Using the web interface

Follow these instructions to set a logging endpoint's placement parameter to waf_debug:

  1. Log in to the Fastly web interface.
  2. From the Home page, select the appropriate service. You can use the search box to search by ID, name, or domain.
  3. Click Edit configuration and then select the option to clone the active version.
  4. Click Logging.

  5. Click the name of a logging endpoint to edit it.

  6. Click Advanced options.

  7. In the Placement section, select waf_debug (waf_debug_log).

    the logging placement setting

  8. Click Update.

  9. Click Activate to deploy your configuration changes.

Using the API

You can also update the logging placement parameter to waf_debug by running the following curl command in a terminal application:

$ curl -X PUT -H 'Fastly-Key: FASTLY_API_TOKEN' -H 'Content-Type: application/json' 'https://api.fastly.com/service/<your Fastly service ID>/version/<version_id>/logging/<logging_integration>/<logging_name>' --data-binary '{"placement":"waf_debug"}'
  • waf_debug_log accepts the logging format via the web interface only
  • waf_debug_log is called in vcl_miss and vcl_pass. The logging format can include request headers and WAF variables. Response headers will result in an error message.
  • <logging_integration> can be found listed in our remote logging API.

We recommended creating a request_id header to track a single request through multiple OWASP rules:

set req.http.x-request-id = digest.hash_sha256(now randomstr(64) req.http.host req.url req.http.Fastly-Client-IP server.identity);

Using WAF-specific variables

Fastly provides a number of WAF-specific logging variables to help you monitor and identify potentially malicious traffic. These variables provide specific details about the actions Fastly WAF performed on a request:

  • Whether or not Fastly WAF inspected a request. Fastly WAF only inspects traffic that is forwarded to your origin server (e.g., MISS or PASS requests for content that is not already cached).
  • Whether or not a rule matched the request. When Fastly WAF inspects a request, it checks to see if the request matches any of the rules in your rule set.
  • The severity of the rule that matched. If the request matches a rule, the log indicates the severity of the rule.
  • The action taken, if any. If the request matches a rule or OWASP threshold, the log indicates whether Fastly WAF simply logged the request or blocked it.

You can use the following variables to examine Fastly WAF log events.

VariableDescription
waf.executedA response header indicating if WAF was executed or not. Appears as 1 (true) when executed or 0 (false) when not.
waf.blockedSet to true when the request matches and the specific rule or OWASP threshold is configured to block. Will appear in log files as 1 (true) when blocked or 0 (false) when not.
waf.loggedSet to true when the request matches and the specific rule or OWASP threshold is configured to log. In active (blocking) mode, set to true when waf.blocked is also true. Will show up in the logs as 1 (true) or 0 (false).
waf.failuresA request exits the WAF rule set due to a failure to evaluate. Will show up in the logs as 1 (true) or 0 (false).
waf.logdataWhy (specifically) this rule matched. Includes the portion of the request that triggered the match, so it may look different depending on the rule.
waf.messageA message describing the generic condition this rule matched. For example, SLR: Arbitrary File Upload in Wordpress Gravity Forms plugin.
waf.rule_idThe rule ID for this rule.
waf.severityThe severity of the rule. 0 is the highest severity and 7 is the lowest severity. 99 indicates that severity is not applicable (e.g., the request did not match any rules).
waf.anomaly_scoreCumulative score returned if request triggers OWASP rules. Check out OWASP category score variables.
waf.passedIndicates if the request doesn't match any rules in the WAF rule set. Will show up in the logs as 1 (true) or 0 (false). waf.passed is readable in vcl_deliver and vcl_log. It is not readable in waf_debug_log. The value is determined after the request has gone through the WAF rule set.

OWASP category score variables

As a request goes through the OWASP rules, it can trigger different rule IDs from different attack categories. OWASP category score variables track which categories were triggered and the scoring that contributed to the cumulative score. They can be used to get a sense of minimum, average, and maximum values for a specific attack category and set thresholds individually. When in active (block) mode, if a request exceeds the category threshold, it will be blocked.

  • waf.sql_injection_score
  • waf.rfi_score
  • waf.lfi_score
  • waf.rce_score
  • waf.php_injection_score
  • waf.session_fixation_score
  • waf.http_violation_score
  • waf.xss_score
Was this guide helpful?

Do not use this form to send sensitive information. If you need assistance, contact support. This form is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.