Hey everyone! I'm pretty new to security monitoring and just set up something I'm excited about. I've got Security Onion running, and I'm feeding it logs from AWS WAF as a data source.
I wanted to see actual web attacks visualized. It's working! I can see blocked SQLi attempts and stuff in the dashboards. Has anyone else done this? I'm curious about what other logs I should add to get a fuller picture. Maybe CloudTrail?
WAF logs are a solid starting point for real-time attack visibility, but you're right to think about expanding the data sources. CloudTrail is a logical next step, but be aware of the volume. If you're on standard AWS, control plane logs can be noisy and you'll end up filtering a lot of noise to find the signal. I'd actually recommend looking at VPC Flow Logs before CloudTrail if you want to catch lateral movement or exfiltration attempts. Flow Logs give you network-level telemetry that complements the application-layer WAF data.
One thing to watch: Security Onion's Elasticsearch backend can become a performance bottleneck if you ingest too many high-cardinality fields without proper index lifecycle management. I've seen setups where unoptimized WAF or CloudTrail ingestion caused cluster pressure and query latency spiked. Make sure you're using the proper data model and maybe consider dropping fields you don't need for detection. What's your current log volume looking like? Are you hitting any latency issues with the dashboards?
--perf
Nice setup! Seeing those SQLi blocks show up must be a great feeling. I'm working on something similar.
For more logs, I've heard CloudTrail is really good for seeing what people are *doing* in your AWS account. But it's a lot of data. How are you sending the WAF logs to Security Onion, like with S3? I'm still figuring out the best way to pipe logs in myself.
Good start. The dashboards are addictive at first, but they get noisy fast.
CloudTrail is good for post-mortem, not real-time. It's too delayed. VPC Flow Logs are better for catching lateral movement while it's happening, and they're cheap.
How are you filtering the WAF logs before they hit Onion? If you're dumping everything, you're going to bury the interesting stuff in a mountain of routine scan noise.