AWS WAF v2New PlanAdvancedFeature / Spec.
The Bot Dashboard is a feature that extracts requests that match a specific use case within a given time period and identifies common characteristics from those requests. It is useful when a large number of requests are occurring and you want to extract shared values to use as conditions for blocking requests.
When used together with the AWS WAF Bot Control rule group, which is provided as an AWS managed rule, you can view information related to requests originating from bots.
To use this feature, a paid subscription to the Log Intelligence option is required.
First, make sure that the Log Intelligence option is enabled. On the account page, if the Log Intelligence option shows [Subscribed], it indicates that the option is active. If it shows [Not Subscribed], it has not been enabled yet. In that case, please update your option settings from the account page.
Next, enable WAF log integration from the [Log and Notification Configuration] settings of the WAF Config. For details, see How to configure WAF log integration (new method) for AWS WAF v2 Advanced.
To use the Bot Dashboard, click [Bot Dashboard] under [Analytics] in the left menu.
In the [Log Extraction View], specify the target WAF Config, the use case for the WAF logs you want to extract, and the extraction period. Data that matches the specified conditions will appear under [Extraction Results]. Selecting an individual value from [Extraction Results] opens the [Detailed Analysis View].
The items displayed in the [Log Extraction View] are as follows.
The displayed date and time are shown in the local time zone by default. If you want to search using UTC, select [Use UTC].
Example:
If the end date and time is set to November 1 at 10:00 and the extraction period is 1 hour, WAF logs from November 1, 9:00 to 10:00 will be extracted.
The items shown in the [Extraction Results] are as follows.
country value in the WAF logs).clientIp field in the WAF logs.Clicking any of the aggregated items (Bot Identification Label, Bot Signal Label, ASNs, Country Codes, IPs, or JA4 Fingerprints) updates the Timeline to reflect the data for the selected aggregate.
Additionally, clicking any aggregated value opens a list of the WAF logs matching that value in the right-hand panel, displayed as the [Detailed Analysis View].
If no applicable values exist for an aggregated item, [N/A] is shown. Items labeled [N/A] cannot be clicked.
The items shown in the [Detailed Analysis View] are as follows.
If you would like to request a customization based on the extracted conditions, you can use the provided inquiry template, which includes the extraction conditions and other relevant information. After copying the template, paste it into the message field of the inquiry form, fill in the necessary details, and submit it.
For more information about customization, see About rule customization (AWS WAF v2).
For example, if the detection condition is set to Country Code = "US," the following template will be copied to your clipboard.
The name of the target WAF Config and the detection condition (in this example, the country "US") are pre-filled. Please complete the remaining fields before submitting your inquiry.
- Target WAF Config: "{selected WAF Config name}"
- Detection Condition: Country Codes = "US"
- [Optional] Additional Conditions: (e.g., URI, headers, etc.; multiple values allowed)
- Rule Action: (Choose one: Count, Block, CAPTCHA, Challenge, or Allow)
For rate-based rules, please also provide the following:
- Rate Limit: (Valid range: 10 to 2,000,000,000)
- Evaluation Window: (Valid values: 1, 2, 5, or 10 minutes)
- Request Aggregation: (e.g., Source IP, IP address in header, etc.)If you want to block requests where the country is “US” and the URI begins with “/example,” adjust the template as shown below. Since this is not a rate-based rule, the section beginning with “For rate-based rules, please also provide the following:” has been removed.
- Target WAF Config: "{selected WAF Config name}"
- Detection Condition: Country Codes = "US"
[Optional] Additional Conditions: URI begins with "/example"
- Rule Action: BlockIf you want to enforce the restriction using a rate-based rule, please fill out the template as shown below. In this case, the filtering (scope-down) conditions remain “country is ‘US’ and URI begins with ‘/example’,” but the template will also include rate-based rule–specific settings such as the threshold and the aggregation key.
- Target WAF Config: "{selected WAF Config name}"
- Detection Condition: Country Codes = "US"
[Optional] Additional Conditions: URI begins with "/example"
- Rule Action: Block
For rate-based rules, please also provide the following:
- Rate Limit: 100
- Evaluation Window: 5 minutes
- Request Aggregation: Source IPIf multiple WAF Configs are involved, please list all applicable WAF Config names next to “Target WAF Config.”
Because this is only a template, feel free to include any additional conditions you would like to combine. Please provide as much detail as possible about what you want to achieve when submitting your inquiry. It is not necessary to follow the template format exactly.