Overview

The dashboard page is the first page shown when you sign in to the WafCharm Console. It contains information such as the usage status of your resources.

Please keep in mind that the available information may vary depending on your plan, platform, and roles.

AWS

Depending on the configuration status, the information listed below will be available.

• WAF Config Status
• Web Monitoring Config Status (for the new plan/MP ver. only)
• Number of logs
• Billing Amount
• WAF Log Dashboard (for AWS WAF v2 only)

WAF Log Dashboard

The WAF log dashboard displays information about request activity based on the WAF logs that have been integrated. Availability and features of the WAF log dashboard vary depending on your subscription and usage. For details, please refer to the sections below and the relevant help pages.

Old plan

New plan

Note: The Advanced Rule policy, available only on the new plan, supports WAF log integration via the new method only.

Related Resources

• How to configure WAF log integration (new method) for AWS WAF v2 Advanced
• How to configure access logs/WAF log integration for AWS WAF v2 Legacy
• WafCharm AWS Marketplace version pricing table
• About WAF Log Retention Period

Information and items displayed on the WAF log

• Period
  • Sets the time range of WAF logs to display on the WAF log dashboard.
  • Starting from the specified end date, displays data going back over the selected period: last 24 hours, 7 days, 14 days, or 30 days.
    • If the WAF log storage format is set to fixed mode, only the last 24 hours is available. To use any other option, you will need to switch to expanded mode.
  • Dates and times are displayed in your local timezone by default. Checking the [Display in UTC] checkbox switches all dates and times to UTC.
• All WAF Configs (Top 20 WAF Log Counts)
  • Displays an overview of all WAF configs registered under the WafCharm account.
    • If there are 21 or more WAF configs registered, only the top 20 with the highest total number of WAF logs integrated with WafCharm are displayed.
  • The requests displayed vary depending on the value selected in [Target Log].
    • All Requests: all requests for the target WAF config are plotted on the graph.
    • Blocked Requests: blocked requests for the target WAF config are plotted on the graph.
    • Allowed Requests: allowed requests for the target WAF config are plotted on the graph.
    • Blocked and allowed requests are determined based on the action field in the WAF logs. Since Count is not recorded in this field, requests detected as Count cannot be tracked separately. The WAF configs analyzed remain the same — only the top 20 with the highest total number of WAF logs integrated with WafCharm are included.
• Individual WAF Config
  • Displays information for the selected WAF config.
  • Displays information for the WAF config selected from the [WAF Config] dropdown.
  • The requests displayed vary depending on the value selected in [Target Log].
    • All Requests: all requests for the target WAF config are plotted on the graph.
    • Blocked Requests: blocked requests for the target WAF config are plotted on the graph.
    • Allowed Requests: allowed requests for the target WAF config are plotted on the graph.
    • Blocked and allowed requests are determined based on the action field in the WAF logs. Since Count is not recorded in this field, requests detected as Count cannot be tracked separately.
    • Graphs for CAPTCHA and Challenge requests are not available.
• Below the line graph, the following information is displayed alongside pie charts, based on the relevant WAF logs.
  • Rule: This value is based on the ruleId under the terminatingRule field in the WAF logs. If a detection is triggered by a rule within a rule group, the name of the individual rule within that group will be displayed.
  • Country: the country field recorded in the WAF logs.
  • IP: the clientIp field recorded in the WAF logs.
  • URI: the uri field recorded in the WAF logs.

Limitations and Notes

• When you add or update a WAF Config, its status will change to [Applying] under the WAF Config Status panel. Once the application is completed successfully, the status will change to [Used].
• If there are errors in the configurations, you will see a [Config Error] in each panel.
• If the initial setup of the WAF Config has not been completed, no data is displayed for the log count (web request count) in the [Number of logs] section.
• When the WAF log storage mode is set to Expanded mode, the [Number of logs] section also displays [Average stored logs]. This field shows the average number of stored WAF logs. The value varies depending on the configured retention period and the actual number of WAF logs being stored.
• The [Estimated Next Billing Amount] section displayed on the Billing Amount panel is for reference only. It does not accurately include prorated deductions and other adjustments, so it may not match the actual billing amount.
• You can view a breakdown of past billing amounts by clicking the [Details] link in the [Billing Amount] panel.
• The WAF Log Dashboard is only available if WAF log retrieval (new method) is enabled.
  • If the WAF log retrieval is disabled or WAF logs are not outputted yet, the data will be unavailable.
• If the WAF log storage format is set to fixed mode, only data from the last 24 hours can be displayed on the WAF log dashboard. To use any other option, you will need to switch to expanded mode.
• All values searched and displayed in the WAF Log Dashboard feature are the values from the WAF logs.
  • Please refer to the Log fields page in the AWS document for more details on the values available in WAF logs.
• WafCharm uses WAF logs downloaded from your S3 bucket, so the features will not use the WAF logs saved on the S3 bucket in your AWS environment.
• It will take 5-10 minutes for WafCharm to download WAF logs using the WAF log retrieval method (the new method). If WAF logs of the day are saved on your S3 bucket, it should not affect WAF log-related features provided by WafCharm.