Fastly WAF Security Logs

Fastly Web Application Firewall (WAF) logs capture security events and threat detection data from Fastly’s edge security services. These logs include information about HTTP requests, response states, client information, and geographic data that helps protect web applications from various cyber threats.

Ingest Methods

Setup the ingestion of this source using one of the following guides:

• AWS S3 Bucket
• AWS S3 Bucket with Custom SQS
• Azure Blob Storage
• Google Cloud Storage
• Cloudflare R2 Bucket

arn:aws:sns:<REGION>:253602268883:runreveal_fastlywaf

Setup

Setting up Fastly WAF logs requires the use of Fastly’s log streaming service to send logs to your object storage bucket. For a detailed guide on collecting logs from a storage bucket review the links under Ingest Methods above.

Fastly Log Streaming Configuration

Configure Fastly to stream WAF logs to your chosen storage bucket using Fastly’s real-time log streaming feature. This provides immediate delivery of security events for real-time monitoring and analysis.

Supported Storage Providers

Source Configuration

When setting up your Fastly WAF source, provide:

• Source Name: A descriptive name for your Fastly WAF source
• Object Storage Configuration: Based on your chosen storage method
• Health Check Duration: Configure how often to check source health (default: 1 day)
• Notification Channels: Set up alerts for when the source stops receiving events

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.

Helpful Links

• Fastly Official Website
• Fastly NGWAF Data Flows Documentation - Example Logs
• Fastly Integrations Documentation
• Fastly Log Streaming Endpoints