AWS WAF V2

eventName	Description	Sample	Rule
any	Catch-all entry for AWS WAF V2 rules that match the service but not a specific eventName.	N	N
DeleteIPSet	Deletes an IP set that specifies the IP addresses to allow or block in WAFv2.	Y	Y
DeleteRuleGroup	Permanently deletes an AWS WAF rule group, making it unavailable for use in web ACLs.	Y	Y
DeleteWebACL	Permanently deletes an AWS WAF web ACL; the web ACL must not be associated with any AWS resource before deletion.	Y	Y
UpdateIPSet	Updates the specified IP set with changes to the addresses it contains.	Y	Y
AssociateWebACL	Associates a web ACL with a resource, to protect the resource.	Y	N
CheckCapacity	Returns the web ACL capacity unit (WCU) requirements for a specified scope and set of rules.	Y	N
CreateAPIKey	Creates an API key that contains a set of token domains.	Y	N
CreateIPSet	Creates an IPSet, which you use to identify web requests that originate from specific IP addresses or ranges of IP addresses.	Y	Y
CreateRegexPatternSet	Creates a RegexPatternSet, which you reference in a RegexPatternSetReferenceStatement, to have WAF inspect a web request component for the specified patterns.	Y	N
CreateRuleGroup	Creates a RuleGroup per the specifications provided.	Y	N
CreateWebACL	Creates a WebACL per the specifications provided.	Y	N
DeleteAPIKey	Deletes the specified API key.	Y	N
DeleteFirewallManagerRuleGroups	Deletes all rule groups that are managed by Firewall Manager from the specified WebACL.	Y	N
DeleteLoggingConfiguration	Deletes the LoggingConfiguration from the specified web ACL.	Y	Y
DeletePermissionPolicy	Permanently deletes an IAM policy from the specified rule group.	Y	N
DeleteRegexPatternSet	Deletes the specified RegexPatternSet.	Y	N
DescribeAllManagedProducts	Provides high-level information for the Amazon Web Services Managed Rules rule groups and Amazon Web Services Marketplace managed rule groups.	Y	N
DescribeManagedProductsByVendor	Provides high-level information for the managed rule groups owned by a specific vendor.	Y	N
DescribeManagedRuleGroup	Provides high-level information for a managed rule group, including descriptions of the rules.	Y	N
DisassociateWebACL	Disassociates the specified resource from its web ACL association, if it has one.	Y	N
GenerateMobileSdkReleaseUrl	Generates a presigned download URL for the specified release of the mobile SDK.	Y	N
GetDecryptedAPIKey	Returns your API key in decrypted form.	Y	N
GetIPSet	Retrieves the specified IPSet.	Y	N
GetLoggingConfiguration	Returns the LoggingConfiguration for the specified web ACL.	Y	N
GetManagedRuleSet	Retrieves the specified managed rule set.	Y	N
GetMobileSdkRelease	Retrieves information for the specified mobile SDK release, including release notes and tags.	Y	N
GetPermissionPolicy	Returns the IAM policy that is attached to the specified rule group.	Y	N
GetRateBasedStatementManagedKeys	Retrieves the IP addresses that are currently blocked by a rate-based rule instance.	Y	N
GetRegexPatternSet	Retrieves the specified RegexPatternSet.	Y	N
GetRevenueStatistics	Retrieves ranked monetization statistics.	Y	N
GetRevenueStatisticsSummary	Retrieves a summary of monetization revenue for the specified time window.	Y	N
GetRevenueStatisticsTimeSeries	Retrieves time series data for monetization revenue.	Y	N
GetRuleGroup	Retrieves the specified RuleGroup.	Y	N
GetSampledRequests	Gets detailed information about a specified number of requests--a sample--that WAF randomly selects from among the first 5,000 requests that your Amazon Web Services resource received during a time range that you choose.	Y	N
GetTopPathStatisticsByTraffic	Retrieves aggregated statistics about the top URI paths accessed by bot traffic for a specified web ACL and time window.	Y	N
GetWebACL	Retrieves the specified WebACL.	Y	N
GetWebACLForResource	Retrieves the WebACL for the specified resource.	Y	N
ListAPIKeys	Retrieves a list of the API keys that you've defined for the specified scope.	Y	N
ListAvailableManagedRuleGroups	Retrieves an array of managed rule groups that are available for you to use.	Y	N
ListAvailableManagedRuleGroupVersions	Returns a list of the available versions for the specified managed rule group.	Y	N
ListIPSets	Retrieves an array of IPSetSummary objects for the IP sets that you manage.	Y	N
ListLoggingConfigurations	Retrieves an array of your LoggingConfiguration objects.	Y	N
ListManagedRuleSets	Retrieves the managed rule sets that you own.	Y	N
ListMobileSdkReleases	Retrieves a list of the available releases for the mobile SDK and the specified device platform.	Y	N
ListRegexPatternSets	Retrieves an array of RegexPatternSetSummary objects for the regex pattern sets that you manage.	Y	N
ListResourcesForWebACL	Retrieves an array of the Amazon Resource Names (ARNs) for the resources that are associated with the specified web ACL.	Y	N
ListRuleGroups	Retrieves an array of RuleGroupSummary objects for the rule groups that you manage.	Y	N
ListSettlementRecords	Retrieves individual settlement transaction records for monetization.	Y	N
ListTagsForResource	Retrieves the TagInfoForResource for the specified resource.	Y	N
ListWebACLs	Retrieves an array of WebACLSummary objects for the web ACLs that you manage.	Y	N
PutLoggingConfiguration	Enables the specified LoggingConfiguration, to start logging from a web ACL, according to the configuration provided.	Y	N
PutManagedRuleSetVersions	Defines the versions of your managed rule set that you are offering to the customers.	N	N
PutPermissionPolicy	Use this to share a rule group with other accounts.	Y	N
TagResource	Associates tags with the specified Amazon Web Services resource.	Y	N
UntagResource	Disassociates tags from an Amazon Web Services resource.	Y	N
UpdateManagedRuleSetVersionExpiryDate	Updates the expiration information for your managed rule set.	Y	N
UpdateRegexPatternSet	Updates the specified RegexPatternSet.	Y	N
UpdateRuleGroup	Updates the specified RuleGroup.	Y	N
UpdateWebACL	Updates the specified WebACL.	Y	N

any: AWS WAF V2 (catch-all)

Service: wafv2

Description

Catch-all entry for AWS WAF V2 rules that match the service but not a specific eventName.

DeleteIPSet

Service: wafv2

Description

Deletes an IP set that specifies the IP addresses to allow or block in WAFv2.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "55da5619-e68e-4c5b-9bf7-2b9a5156385f",
  "eventName": "DeleteIPSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:25:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b71b5a8f-ef2b-4bf0-9830-c2fbae7c3fe7",
  "requestParameters": {
    "id": "81f4165f-2bdc-470a-8eca-4cbab0ab4a74",
    "lockToken": "54f840ff-7f1d-4255-b99b-dbdd45dd5da2",
    "name": "dwfix-ipset",
    "scope": "REGIONAL"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

AWS Defense Evasion Impair Security Services source: The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include…T1685, T1685.002↳ also matches DeleteRuleGroup, DeleteWebACL, DeleteLoggingConfiguration

DeleteRuleGroup

Service: wafv2

Description

Permanently deletes an AWS WAF rule group, making it unavailable for use in web ACLs.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "bee33f37-d049-463a-8d61-049ea0455ede",
  "eventName": "DeleteRuleGroup",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:07Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "00fd8972-7bd5-449f-8121-2fd00737dd93",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS WAF Rule or Rule Group Deletion source medium: Identifies the deletion of an AWS Web Application Firewall (WAF) rule or rule group. WAF rules and rule groups enforce critical protections for web applications by filtering malicious HTTP requests, blocking known attack patterns, and enforcing access controls. Deleting these rules—even briefly—can expose applications to SQL injection, cross-site scripting, credential-stuffing bots, or targeted exploitation. Adversaries who have gained sufficient permissions may remove WAF protections as part of a broader defense evasion or impact strategy, often preceding data theft or direct application compromise.T1562, T1562.007

Splunk #

AWS Defense Evasion Impair Security Services source: The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include…T1685, T1685.002↳ also matches DeleteIPSet, DeleteWebACL, DeleteLoggingConfiguration

DeleteWebACL

Service: wafv2

Description

Permanently deletes an AWS WAF web ACL; the web ACL must not be associated with any AWS resource before deletion.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "6e9f21fe-5a08-4411-80bd-d64658b6fbca",
  "eventName": "DeleteWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "b6e360a6-6b0c-4a17-828a-ae0cb3e8b83f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS WAF Access Control List Deletion source medium: Identifies the deletion of an AWS Web Application Firewall (WAF) Web ACL. Web ACLs are the core enforcement objects in AWS WAF, defining which traffic is inspected, allowed, or blocked for protected applications. Deleting a Web ACL removes all associated rules, protections, and logging configurations. Adversaries who obtain sufficient privileges may delete a Web ACL to disable critical security controls, evade detection, or prepare for downstream attacks such as web-application compromise, data theft, or resource abuse. Because Web ACLs are rarely deleted outside of controlled maintenance or infrastructure updates, unexpected deletions may indicate potential defense evasion.T1562, T1562.007

Splunk #

AWS Defense Evasion Impair Security Services source: The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include…T1685, T1685.002↳ also matches DeleteIPSet, DeleteRuleGroup, DeleteLoggingConfiguration

UpdateIPSet

Service: wafv2

Description

Updates the specified IP set with changes to the addresses it contains.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "cf50ba26-03c3-465e-9d1f-77a09370e289",
  "eventName": "UpdateIPSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:25:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "68ec2936-75ea-4591-9276-1729fbdb78ad",
  "requestParameters": {
    "addresses": [
      "203.0.113.0/24"
    ],
    "id": "81f4165f-2bdc-470a-8eca-4cbab0ab4a74",
    "lockToken": "0f98bdd1-fc41-4d37-b2eb-42e5817445c6",
    "name": "dwfix-ipset",
    "scope": "REGIONAL"
  },
  "responseElements": {
    "nextLockToken": "54f840ff-7f1d-4255-b99b-dbdd45dd5da2"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS Trusted IPSet Modified source high: Detects creation and updates of the list of trusted IPs used by GuardDuty and WAF. Potentially to disable security alerts against malicious IPs.T1562↳ also matches CreateIPSet

AssociateWebACL

Service: wafv2

Description

Associates a web ACL with a resource, to protect the resource.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFUnavailableEntityException",
  "errorMessage": "AWS WAF couldn’t retrieve the resource that you requested. Retry your request.",
  "eventCategory": "Management",
  "eventID": "8858e962-26a6-448d-96fd-7f98b1dab62f",
  "eventName": "AssociateWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T21:01:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7039a5c6-9134-42c9-928c-ffda8390bc4e",
  "requestParameters": {
    "resourceArn": "arn:aws:elasticloadbalancing:us-west-1:123456789012:loadbalancer/app/dwfix-nonexistent/1234567890abcdef",
    "webACLArn": "arn:aws:wafv2:us-west-1:123456789012:regional/webacl/dwfix-webacl/6199cd2e-cf3d-4af0-bd31-e75a92ff4334"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,n,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CheckCapacity

Service: wafv2

Description

Returns the web ACL capacity unit (WCU) requirements for a specified scope and set of rules.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "4fce5007-7309-4ca7-a88f-b36358620e9c",
  "eventName": "CheckCapacity",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "663e738b-6355-4da8-9223-0a0403d4b16c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateAPIKey

Service: wafv2

Description

Creates an API key that contains a set of token domains.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b9df1855-e5f4-41c9-8b45-07733d243f59",
  "eventName": "CreateAPIKey",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T21:01:42Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8f146bcf-9164-4d85-974d-ad3abc595720",
  "requestParameters": {
    "scope": "REGIONAL",
    "tokenDomains": [
      "example.com"
    ]
  },
  "responseElements": {
    "aPIKey": "ddrIx/T0fgSW1sEJJGCKeDryz5ncDqx4qz08SzlUfMEtI3b0fw2ALDUPULrI1NHN/7o1FUlnxvQ2Mles64tsmlL/VOYWTZX9tEIO0CH3IR4QGbIQtduKnfgI0wwXsS49UMn/TzydgfiyfRpaB8FSr43+oEqz9D+Wn0Xa0/pkyklGJFjnm5ysYxE/XJ68ZGB8UJHjvQm1TEJTx7ELOKtINx8184opmF2TaVjBgnsv+ZnqCGvl41ZVjPJ7/nhaznYIYWPV3Rmi6pIDUovUAY0y5ehxkDpqx9w7f7t470uhqS4vIZAc1jXCmVShqT9GRxQ3oKs8JO1GjRSFLTM8wCy8/l8+UblOntTwlN7CUbe1kSnJfN3/mec0ukaeBZDLyZszn8sfpJe6mvXciYrVa6j6IasXqR+boGy5ncmQ25TCxBIbvsDYHlXJ+xcMiacH6Q6odpy2c3BpZYD25oq9CAvjg9zqF5ne3OXiLqL1jwfOQw5JkwUpJvey+oTXfV6Kr9KjNKBDs3laIhg5RZYei2OK3PUdF7XTCi0wvdY/8GLGIDeDOx5qdVdZWIFPxyBrKyBj+MLkdHLXtLZuX+nYmQIpJUiUUh3iOd5SQ6OPq9L4c1DAsEbiakDzLJD+zbEAOYJV9UQPB6VHHWuiPoZKcGtQRJoXkaTAen/xLcS8PjY7fus=_0_1"
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,n,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateIPSet

Service: wafv2

Description

Creates an IPSet, which you use to identify web requests that originate from specific IP addresses or ranges of IP addresses.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5c184705-aa0a-42de-bce1-c8011350a946",
  "eventName": "CreateIPSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:25:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7e44497d-679b-432f-b702-98e680cbec94",
  "requestParameters": {
    "addresses": [
      "198.51.100.0/24"
    ],
    "iPAddressVersion": "IPV4",
    "name": "dwfix-ipset",
    "scope": "REGIONAL"
  },
  "responseElements": {
    "summary": {
      "aRN": "arn:aws:wafv2:us-west-1:123456789012:regional/ipset/dwfix-ipset/81f4165f-2bdc-470a-8eca-4cbab0ab4a74",
      "description": "",
      "id": "81f4165f-2bdc-470a-8eca-4cbab0ab4a74",
      "lockToken": "0f98bdd1-fc41-4d37-b2eb-42e5817445c6",
      "name": "dwfix-ipset"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

AWS Trusted IPSet Modified source high: Detects creation and updates of the list of trusted IPs used by GuardDuty and WAF. Potentially to disable security alerts against malicious IPs.T1562↳ also matches UpdateIPSet

CreateRegexPatternSet

Service: wafv2

Description

Creates a RegexPatternSet, which you reference in a RegexPatternSetReferenceStatement, to have WAF inspect a web request component for the specified patterns.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "e72a27f6-b82e-4ce9-a617-6f8a871c1be5",
  "eventName": "CreateRegexPatternSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T20:00:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "7c1dea41-af35-4bc6-bcd0-ffe944ca8c77",
  "requestParameters": {
    "name": "dwfix-rps",
    "regularExpressionList": [
      {
        "regexString": "dw"
      }
    ],
    "scope": "REGIONAL"
  },
  "responseElements": {
    "summary": {
      "aRN": "arn:aws:wafv2:us-west-1:123456789012:regional/regexpatternset/dwfix-rps/0cd6dfa8-0190-405a-9f58-f10e154f3e72",
      "description": "",
      "id": "0cd6dfa8-0190-405a-9f58-f10e154f3e72",
      "lockToken": "9aab0ebe-7fb5-4549-9836-3a1cac8c8f70",
      "name": "dwfix-rps"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateRuleGroup

Service: wafv2

Description

Creates a RuleGroup per the specifications provided.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3aa2f31e-26c7-41a0-a3f5-edf0c6b6a0a9",
  "eventName": "CreateRuleGroup",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T20:00:57Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c52b6229-31d5-499c-ae28-02c056e8a462",
  "requestParameters": {
    "capacity": 1,
    "name": "dwfix-rg",
    "rules": [],
    "scope": "REGIONAL",
    "visibilityConfig": {
      "cloudWatchMetricsEnabled": false,
      "metricName": "dw",
      "sampledRequestsEnabled": false
    }
  },
  "responseElements": {
    "summary": {
      "aRN": "arn:aws:wafv2:us-west-1:123456789012:regional/rulegroup/dwfix-rg/233ee2b1-993a-445a-93e0-d1dfee551414",
      "description": "",
      "id": "233ee2b1-993a-445a-93e0-d1dfee551414",
      "lockToken": "6ff9aab1-4fd4-448d-a6e1-7844cb2844aa",
      "name": "dwfix-rg"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

CreateWebACL

Service: wafv2

Description

Creates a WebACL per the specifications provided.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "b3321d46-bb5d-4c91-b41d-65cddda0c9e2",
  "eventName": "CreateWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T20:00:58Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "4bd03f9a-e2da-4189-9408-f359f7c375dc",
  "requestParameters": {
    "defaultAction": {
      "allow": {}
    },
    "name": "dwfix-acl",
    "rules": [],
    "scope": "REGIONAL",
    "visibilityConfig": {
      "cloudWatchMetricsEnabled": false,
      "metricName": "dw",
      "sampledRequestsEnabled": false
    }
  },
  "responseElements": {
    "summary": {
      "aRN": "arn:aws:wafv2:us-west-1:123456789012:regional/webacl/dwfix-acl/82faff43-fe2e-4d26-a192-c395d42d5cec",
      "description": "",
      "id": "82faff43-fe2e-4d26-a192-c395d42d5cec",
      "lockToken": "d9a02925-2e8f-4746-a105-f90896cc587d",
      "name": "dwfix-acl"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,D,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteAPIKey

Service: wafv2

Description

Deletes the specified API key.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "c486ddab-fc2a-4427-a58e-ddd6ed22ddd1",
  "eventName": "DeleteAPIKey",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8bd903d2-4ada-44a3-991f-9df74347cc24",
  "requestParameters": {
    "aPIKey": "ddddd",
    "scope": "CLOUDFRONT"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteFirewallManagerRuleGroups

Service: wafv2

Description

Deletes all rule groups that are managed by Firewall Manager from the specified WebACL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "f67834d9-74ce-44ac-9308-320b60676401",
  "eventName": "DeleteFirewallManagerRuleGroups",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "efe404e3-7c3e-4b22-814d-6829c7f4a4b1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteLoggingConfiguration

Service: wafv2

Description

Deletes the LoggingConfiguration from the specified web ACL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "05bfb9d0-d63a-4178-860b-b9fd56bcc0cd",
  "eventName": "DeleteLoggingConfiguration",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d306a96d-8877-40b6-94ee-5cfd6f763876",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

AWS Defense Evasion Impair Security Services source: The following analytic detects attempts to impair or disable AWS security services by monitoring specific deletion operations across GuardDuty, AWS WAF (classic and v2), CloudWatch, Route 53, and CloudWatch Logs. These actions include…T1685, T1685.002↳ also matches DeleteIPSet, DeleteRuleGroup, DeleteWebACL

DeletePermissionPolicy

Service: wafv2

Description

Permanently deletes an IAM policy from the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "1c09c7fc-9dfe-4c41-8481-beafd0762df2",
  "eventName": "DeletePermissionPolicy",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:08Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "c5dcc8ad-c270-45d3-bc69-f36a3120b5ba",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteRegexPatternSet

Service: wafv2

Description

Deletes the specified RegexPatternSet.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "eb39d58b-a457-41b4-94c4-0e72420dd9af",
  "eventName": "DeleteRegexPatternSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "d9b10b4a-ead7-4a1f-94e4-e4e72a9b666e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeAllManagedProducts

Service: wafv2

Description

Provides high-level information for the Amazon Web Services Managed Rules rule groups and Amazon Web Services Marketplace managed rule groups.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "777e4d5c-1b36-4c3a-bc25-dfbac83b58b0",
  "eventName": "DescribeAllManagedProducts",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "285af904-f4f3-413d-90b1-6dd6ad33fd80",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeManagedProductsByVendor

Service: wafv2

Description

Provides high-level information for the managed rule groups owned by a specific vendor.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "f3c7ae42-630a-44e0-aa2d-4490e957406d",
  "eventName": "DescribeManagedProductsByVendor",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a9cd89f6-e330-4959-93cb-b68e8d72dd4f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DescribeManagedRuleGroup

Service: wafv2

Description

Provides high-level information for a managed rule group, including descriptions of the rules.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "4de4f2fb-1bb2-45f4-a4f4-7b906e539e06",
  "eventName": "DescribeManagedRuleGroup",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:27Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b47ab1ce-6735-46dd-8728-745d9f4eaf0d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisassociateWebACL

Service: wafv2

Description

Disassociates the specified resource from its web ACL association, if it has one.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "b9656ecc-5dd5-4aff-a1f0-7e36a924467c",
  "eventName": "DisassociateWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "907b0e44-1f86-4b5d-9cda-2fdb77ab66c5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GenerateMobileSdkReleaseUrl

Service: wafv2

Description

Generates a presigned download URL for the specified release of the mobile SDK.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidOperationException",
  "errorMessage": "This account is not authorized to use Mobile-SDK",
  "eventCategory": "Management",
  "eventID": "ac63d2ab-8450-4382-bd80-a3990c174591",
  "eventName": "GenerateMobileSdkReleaseUrl",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T21:01:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "ae19815e-ce22-4a92-a6c8-960f5d3f8e91",
  "requestParameters": {
    "platform": "IOS",
    "releaseVersion": "3.0.0"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,n,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetDecryptedAPIKey

Service: wafv2

Description

Returns your API key in decrypted form.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "0c91830f-53ea-49e3-9179-1934bd2ea542",
  "eventName": "GetDecryptedAPIKey",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "32a1064a-73be-4971-acc8-c38ff4323e54",
  "requestParameters": {
    "aPIKey": "ddddd",
    "scope": "CLOUDFRONT"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetIPSet

Service: wafv2

Description

Retrieves the specified IPSet.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "5105a83c-53ad-40e9-a249-58e0716c60c1",
  "eventName": "GetIPSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "75e13680-ec7b-4f4b-addb-449897042e57",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetLoggingConfiguration

Service: wafv2

Description

Returns the LoggingConfiguration for the specified web ACL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "49d1e5b9-57b5-4c73-b88d-7809e3ba6208",
  "eventName": "GetLoggingConfiguration",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "58a5642d-7ab0-4d41-bb56-97075024f15b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetManagedRuleSet

Service: wafv2

Description

Retrieves the specified managed rule set.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "1f363bdf-03c6-4ab4-8bb9-511b467cccc8",
  "eventName": "GetManagedRuleSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3e3cdf78-e8f2-4655-b06e-637d003a544f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetMobileSdkRelease

Service: wafv2

Description

Retrieves information for the specified mobile SDK release, including release notes and tags.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidOperationException",
  "errorMessage": "This account is not authorized to use Mobile-SDK",
  "eventCategory": "Management",
  "eventID": "1ac881fa-8e3c-476b-beec-041568979f05",
  "eventName": "GetMobileSdkRelease",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "53d24300-23d5-4938-9eae-8e67a8676ec9",
  "requestParameters": {
    "platform": "IOS",
    "releaseVersion": "ddddd"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetPermissionPolicy

Service: wafv2

Description

Returns the IAM policy that is attached to the specified rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "1d90171f-42c0-4e93-b0f1-7e6f319b0a80",
  "eventName": "GetPermissionPolicy",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "273eaedc-f5a8-4686-b407-85cd5d499a35",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRateBasedStatementManagedKeys

Service: wafv2

Description

Retrieves the IP addresses that are currently blocked by a rate-based rule instance.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "9eb72fb2-af80-40b9-8124-384f8621bbe5",
  "eventName": "GetRateBasedStatementManagedKeys",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "78be2edf-8e36-4632-99c3-df23df9ae9e0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRegexPatternSet

Service: wafv2

Description

Retrieves the specified RegexPatternSet.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "3ad6c7a8-4803-487c-8821-799490416a52",
  "eventName": "GetRegexPatternSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "32f2bdea-64ec-4fd4-b102-8cd63f8b875e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRevenueStatistics

Service: wafv2

Description

Retrieves ranked monetization statistics.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "eeb837e5-6d19-426a-8d02-1de009632e6e",
  "eventName": "GetRevenueStatistics",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e628c932-972f-4b27-ba41-a5324e5b7645",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRevenueStatisticsSummary

Service: wafv2

Description

Retrieves a summary of monetization revenue for the specified time window.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "7705bca7-3e5b-4bbc-9624-1b32c08d4e3e",
  "eventName": "GetRevenueStatisticsSummary",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "111c788d-86de-4e3b-938e-bd0aeabeec25",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRevenueStatisticsTimeSeries

Service: wafv2

Description

Retrieves time series data for monetization revenue.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "57942564-eae7-46c4-83f3-b4a85d6ca453",
  "eventName": "GetRevenueStatisticsTimeSeries",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "2508c366-c471-4c73-99a6-0fd511b721c5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetRuleGroup

Service: wafv2

Description

Retrieves the specified RuleGroup.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Critical information is missing in your request: GetRuleGroupRequest(name=null, scope=null, id=null, aRN=null).",
  "eventCategory": "Management",
  "eventID": "ce66aa10-265f-4b21-a6cd-82a694e1f792",
  "eventName": "GetRuleGroup",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:32:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b1775104-9edc-4017-aad9-106611d358de",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetSampledRequests

Service: wafv2

Description

Gets detailed information about a specified number of requests--a sample--that WAF randomly selects from among the first 5,000 requests that your Amazon Web Services resource received during a time range that you choose.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "b3fba9eb-2982-400a-a76c-e98b79d10c58",
  "eventName": "GetSampledRequests",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:29Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "79ad5bb6-6a77-4c28-99bb-5952d77acac9",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetTopPathStatisticsByTraffic

Service: wafv2

Description

Retrieves aggregated statistics about the top URI paths accessed by bot traffic for a specified web ACL and time window.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "7e857e8f-cdd2-4648-8e7f-ef0ca4220d3b",
  "eventName": "GetTopPathStatisticsByTraffic",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6cf06d71-6e88-4e70-af46-2f1baf931d6b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetWebACL

Service: wafv2

Description

Retrieves the specified WebACL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Critical information is missing in your request: GetWebACLRequest(name=null, scope=null, id=null, aRN=null).",
  "eventCategory": "Management",
  "eventID": "191d7d35-9a53-4594-80ee-b636aaf30e98",
  "eventName": "GetWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:32:47Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "f86c856f-ec11-419e-a9ec-dbaf081261ee",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetWebACLForResource

Service: wafv2

Description

Retrieves the WebACL for the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "96917d30-9dc8-4cde-ac18-98ae4591f3c9",
  "eventName": "GetWebACLForResource",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "3799f512-5e77-42e9-8cca-5337337a8917",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAPIKeys

Service: wafv2

Description

Retrieves a list of the API keys that you've defined for the specified scope.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "2a41e9ba-69b3-4928-9d6b-defa10a985ab",
  "eventName": "ListAPIKeys",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "95e47b21-455e-4da1-86b6-12ec70bc0143",
  "requestParameters": {
    "scope": "CLOUDFRONT"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAvailableManagedRuleGroups

Service: wafv2

Description

Retrieves an array of managed rule groups that are available for you to use.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "d995521c-04f3-4ca4-b22f-535a8bd7a713",
  "eventName": "ListAvailableManagedRuleGroups",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b2c60bfa-f0ca-4da2-85b8-060ee9d1e32a",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListAvailableManagedRuleGroupVersions

Service: wafv2

Description

Returns a list of the available versions for the specified managed rule group.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "9cac9477-0181-4b85-a346-01a4335744ae",
  "eventName": "ListAvailableManagedRuleGroupVersions",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:30Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "22f8be7c-c881-479c-a06d-c8a349aa256b",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListIPSets

Service: wafv2

Description

Retrieves an array of IPSetSummary objects for the IP sets that you manage.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "7f066c62-3cea-4174-9fa5-2a40d6bc4712",
  "eventName": "ListIPSets",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "921f4c40-0caf-486c-a43e-4b6d46b1c94f",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListLoggingConfigurations

Service: wafv2

Description

Retrieves an array of your LoggingConfiguration objects.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "Critical information is missing in your request: ListLoggingConfigurationsRequest(scope=null, nextMarker=null, limit=null).",
  "eventID": "6184be72-b54d-4150-9f34-8b634ffb829b",
  "eventName": "ListLoggingConfigurations",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2020-06-10T05:35:01Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "readOnly": true,
  "recipientAccountId": "811596193553",
  "requestID": "b166df37-f3d1-4fe9-be7c-250768133ca9",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

Sample log: flaws.cloud CloudTrail training logs

ListManagedRuleSets

Service: wafv2

Description

Retrieves the managed rule sets that you own.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "ab005a39-49ad-4d1a-a4da-1e1db0e62d49",
  "eventName": "ListManagedRuleSets",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "69eaf61a-524b-4d98-828d-671fe3485fe1",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListMobileSdkReleases

Service: wafv2

Description

Retrieves a list of the available releases for the mobile SDK and the specified device platform.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidOperationException",
  "errorMessage": "This account is not authorized to use Mobile-SDK",
  "eventCategory": "Management",
  "eventID": "03dc8146-7a29-4b44-9ca0-0a82347979b3",
  "eventName": "ListMobileSdkReleases",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "737b88d4-b8b4-406e-b9ab-9f33b5ee8cc7",
  "requestParameters": {
    "platform": "IOS"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListRegexPatternSets

Service: wafv2

Description

Retrieves an array of RegexPatternSetSummary objects for the regex pattern sets that you manage.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "147e3e99-fbcc-4255-8108-cf77c1bf50a7",
  "eventName": "ListRegexPatternSets",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "812c4386-1ab0-480f-9d89-049de594da39",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResourcesForWebACL

Service: wafv2

Description

Retrieves an array of the Amazon Resource Names (ARNs) for the resources that are associated with the specified web ACL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "70cefa40-7441-4ecf-a9dd-baa89c87a837",
  "eventName": "ListResourcesForWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:31Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "e61a96da-4fdc-4916-9141-45903deb516e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListRuleGroups

Service: wafv2

Description

Retrieves an array of RuleGroupSummary objects for the rule groups that you manage.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "8732bdd6-7f67-4a09-82c1-cb2a733990d7",
  "eventName": "ListRuleGroups",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "1ea13db7-8c1d-4337-a8cd-4f20050897ed",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListSettlementRecords

Service: wafv2

Description

Retrieves individual settlement transaction records for monetization.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "12dfeaab-9088-483d-ae1d-d17bc96ec4ad",
  "eventName": "ListSettlementRecords",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "734b2697-fd7b-4a0d-935b-81001d50e977",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTagsForResource

Service: wafv2

Description

Retrieves the TagInfoForResource for the specified resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "7f25dac3-6dd7-4e28-bbfc-911e90dda966",
  "eventName": "ListTagsForResource",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T18:46:32Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a7dafcb5-69ae-4340-bde6-2894b7addfcf",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListWebACLs

Service: wafv2

Description

Retrieves an array of WebACLSummary objects for the web ACLs that you manage.

Example CloudTrail Event #

{
  "awsRegion": "ap-southeast-2",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::731544447609:user/cloudsploit is not authorized to perform: wafv2:ListWebACLs on resource: arn:aws:wafv2:ap-southeast-2:731544447609:regional/webacl/*",
  "eventCategory": "Management",
  "eventID": "dff9d097-d607-46b2-844c-168247192689",
  "eventName": "ListWebACLs",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2021-04-13T11:35:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "731544447609",
  "requestID": "fbd4a9f5-7a6d-4a9c-a8f2-4e93a2659a1d",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "34.12.134.20",
  "userAgent": "aws-sdk-nodejs/2.885.0 linux/v14.16.1 callback",
  "userIdentity": {
    "accessKeyId": "AKIAYTOGP2RLGBSBSMH2",
    "accountId": "731544447609",
    "arn": "arn:aws:iam::731544447609:user/cloudsploit",
    "principalId": "AIDAYTOGP2RLMDEPWZWMJ",
    "type": "IAMUser",
    "userName": "cloudsploit"
  }
}

References #

Sample log: splunk/attack_data

PutLoggingConfiguration

Service: wafv2

Description

Enables the specified LoggingConfiguration, to start logging from a web ACL, according to the configuration provided.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: LOG_DESTINATION, parameter: arn:aws:firehose:us-west-1:123456789012:deliverystream/dwfix-nonexistent",
  "eventCategory": "Management",
  "eventID": "e36e382a-9aad-49f0-8dea-843d00518d1d",
  "eventName": "PutLoggingConfiguration",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T21:01:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e4baf829-eead-450f-b456-6913fcfc6c0b",
  "requestParameters": {
    "loggingConfiguration": {
      "logDestinationConfigs": [
        "arn:aws:firehose:us-west-1:123456789012:deliverystream/dwfix-nonexistent"
      ],
      "managedByFirewallManager": false,
      "resourceArn": "arn:aws:wafv2:us-west-1:123456789012:regional/webacl/dwfix-webacl/6199cd2e-cf3d-4af0-bd31-e75a92ff4334"
    }
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,n,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutManagedRuleSetVersions

Service: wafv2

Description

Defines the versions of your managed rule set that you are offering to the customers.

PutPermissionPolicy

Service: wafv2

Description

Use this to share a rule group with other accounts.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidPermissionPolicyException",
  "errorMessage": "The policy specification doesn't meet the requirements to be attached to an AWS WAF resource.",
  "eventCategory": "Management",
  "eventID": "362e6f40-b70f-411b-a601-834f2f8bcdd0",
  "eventName": "PutPermissionPolicy",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T21:01:43Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "33a8ee37-0d59-4b5e-aac7-32b8c9caaaf4",
  "requestParameters": {
    "policy": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::123456789012:root"
          },
          "Action": [
            "wafv2:CreateWebACL",
            "wafv2:UpdateWebACL",
            "wafv2:PutFirewallManagerRuleGroups"
          ],
          "Resource": "arn:aws:wafv2:us-west-1:123456789012:regional/rulegroup/dwfix-rulegroup/ae739efe-5e2a-4dea-977d-25146b5f7b24",
          "Condition": {
            "StringEquals": {
              "aws:PrincipalOrgID": "o-example00000"
            }
          }
        }
      ]
    },
    "resourceArn": "arn:aws:wafv2:us-west-1:123456789012:regional/rulegroup/dwfix-rulegroup/ae739efe-5e2a-4dea-977d-25146b5f7b24"
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,n,b,Z cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

TagResource

Service: wafv2

Description

Associates tags with the specified Amazon Web Services resource.

Example CloudTrail Event #

{
  "apiVersion": "2019-04-23",
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "9d2e5f41-ef4b-46ac-8972-c48254bb802a",
  "eventName": "TagResource",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:25:25Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "2a175f36-6e12-4dfb-93a5-12fc10d76815",
  "requestParameters": {
    "resourceARN": "arn:aws:wafv2:us-west-1:123456789012:regional/ipset/dwfix-ipset/81f4165f-2bdc-470a-8eca-4cbab0ab4a74",
    "tags": [
      {
        "key": "dw",
        "value": "f"
      }
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UntagResource

Service: wafv2

Description

Disassociates tags from an Amazon Web Services resource.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: arn:aws:iam::123456789012:role/dw-probe",
  "eventCategory": "Management",
  "eventID": "b1b13324-c6a6-4b09-8ccc-5be0c545cc87",
  "eventName": "UntagResource",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "8d53aff8-6df9-49b7-b300-8252ce631482",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateManagedRuleSetVersionExpiryDate

Service: wafv2

Description

Updates the expiration information for your managed rule set.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "9d875d47-1b1a-431a-b335-0e0d5d15b207",
  "eventName": "UpdateManagedRuleSetVersionExpiryDate",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "52514fca-dfc8-4ba7-bc47-6a5e7701c6a4",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRegexPatternSet

Service: wafv2

Description

Updates the specified RegexPatternSet.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "8f7b7fe3-4918-419f-95b3-42eb6bd04d4c",
  "eventName": "UpdateRegexPatternSet",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:09Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "cd195f9f-91af-45c8-bf85-59d1965d05f0",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateRuleGroup

Service: wafv2

Description

Updates the specified RuleGroup.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "c9d9a3a8-2b46-496c-92d3-14c8fcffcafb",
  "eventName": "UpdateRuleGroup",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "22272e80-eda7-4199-9970-f2416eabd6ce",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateWebACL

Service: wafv2

Description

Updates the specified WebACL.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "WAFInvalidParameterException",
  "errorMessage": "Error reason: The scope is not valid., field: SCOPE_VALUE, parameter: CLOUDFRONT",
  "eventCategory": "Management",
  "eventID": "cd96c514-ed1f-4a08-bd1b-362ec69965a0",
  "eventName": "UpdateWebACL",
  "eventSource": "wafv2.amazonaws.com",
  "eventTime": "2026-06-29T19:27:10Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "33f80480-ff70-4776-8f0f-e3daf303d710",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "wafv2.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/Z,D,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

AWS WAF V2

any: AWS WAF V2 (catch-all)

Description

DeleteIPSet

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Splunk #

DeleteRuleGroup

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

Splunk #

DeleteWebACL

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Elastic #

Splunk #

UpdateIPSet

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

AssociateWebACL

Description

Example CloudTrail Event #

CheckCapacity

Description

Example CloudTrail Event #

CreateAPIKey

Description

Example CloudTrail Event #

CreateIPSet

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Panther #

CreateRegexPatternSet

Description

Example CloudTrail Event #

CreateRuleGroup

Description

Example CloudTrail Event #

CreateWebACL

Description

Example CloudTrail Event #

DeleteAPIKey

Description

Example CloudTrail Event #

DeleteFirewallManagerRuleGroups

Description

Example CloudTrail Event #

DeleteLoggingConfiguration

Description

Example CloudTrail Event #

Related events #

Detection Rules #

Splunk #

DeletePermissionPolicy

Description

Example CloudTrail Event #

DeleteRegexPatternSet

Description

Example CloudTrail Event #

DescribeAllManagedProducts

Description

Example CloudTrail Event #

DescribeManagedProductsByVendor

Description

Example CloudTrail Event #

DescribeManagedRuleGroup

Description

Example CloudTrail Event #