Generic WAF Capture Guide For Unified aiFObserve

Supported Raw Formats

• CSV
• JSON
• JSONL
• CEF
• key-value syslog
• access-log-like text that includes host, path, status, and byte fields

Basic Logging

Capture these fields with clear names:

• timestamp
• request ID or session ID
• client/source IP
• destination/origin IP or host
• source port and destination port, if known
• protocol
• HTTP method
• host
• URL or URI path
• response status
• action or outcome
• rule ID or rule name
• request bytes and response bytes
• user agent

Extended Logging

• tenant/account/application ID
• authenticated user or sanitized identity header
• WAF policy name and version
• attack category
• matched variable and matched value, sanitized as needed
• severity and confidence
• country, region, edge location, or data center
• upstream service, backend, origin, or protected application
• request headers selected for identity and trace correlation
• trace ID or correlation ID

Recommended Field Names

• timestamp
• src_ip, dst_ip
• src_port, dst_port
• host
• url
• uri
• method
• status
• action
• rule_id
• rule_name
• severity
• request_bytes
• response_bytes
• user
• tenant_id
• user_agent

User And App Identity

The _user_app_id converter looks for native user fields, identity headers, tenant fields, host/SNI/URL/app fields, and user-agent fields. Use explicit audit headers rather than logging secrets.

AI Provider And Location Evidence

Preserve host, URL, origin/backend, client country, edge region, and tenant. These fields are the strongest generic evidence for provider and data boundary analysis.