Stream WAF events to a SIEM

Create a stream that sends the requests WAF analyzed to your SIEM, in Azion Console or with the Azion API, and confirm the delivery.

Last updated

View as Markdown Agent setup

You can send the events of Web Application Firewall (WAF) to a security information and event management (SIEM) platform from Azion Console or with the Azion API. To send the requests of your applications without WAF data, refer to Endpoints and the guide of your endpoint.

A Data Stream stream reads the WAF Events data source and shapes each event with the WAF Event Collector template. Each log line carries the score the request received, the WAF rules it matched, the attack family, and the action WAF took. For every variable, refer to WAF Events.

The example sends the events to an Apache Kafka topic that your SIEM reads. In the stream form, the endpoint is set in the field labeled Connector.

Select your interface once. The prerequisites and every task below show only that path.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • Firewall with WAF on the account, protecting a workload that receives requests. To set up WAF, refer to the WAF quickstart.
  • An endpoint that your SIEM reads. This guide uses an Apache Kafka cluster, with the host and port of its servers for the initial connection and the name of one topic. For the other endpoints a stream can send to, refer to Endpoints.

Create the stream

The stream collects the WAF events of the workload you choose, through a workload filter. Unlike sampling, a workload filter leaves your other streams active.

To create the stream with the API, send a POST request to https://api.azion.com/v4/workspace/stream/streams. Replace [TOKEN VALUE] with your personal token, <workload-id> with the ID of your workload, and the cluster values with your own:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "waf-to-siem",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "waf" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 4 } }
13 ],
14 "outputs": [
15 {
16 "type": "kafka",
17 "attributes": {
18 "bootstrap_servers": "kafka1.example.com:9092,kafka2.example.com:9092",
19 "kafka_topic": "azion.waf",
20 "use_tls": true
21 }
22 }
23 ]
24 }

The waf data source is WAF Events in the Console, and template 4 is WAF Event Collector. The API requires kafka_topic and use_tls: send true to encrypt the events with TLS, or false to send them unencrypted. A 201 answer carries the stored stream under data. Keep its id: it identifies the stream in every later request, such as /v4/workspace/stream/streams/<stream-id>. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: waf-to-siem.

Select the WAF Events data source

In the Input section, select WAF Events in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. In Available Workload, select the workload that WAF protects and move it to Chosen Workload with the arrow.

Select the template

In the Render Template section, select WAF Event Collector in Template. The Data Set field shows the keys of each log line.

Select the endpoint

In the Output section, select Apache Kafka in Connector. For another SIEM, select its option, such as Splunk, IBM QRadar, or Elasticsearch, and enter the fields that Endpoints lists for it.

Enter the bootstrap servers

In Bootstrap Servers, enter each server as host:port, separated by a comma and no space. For example: kafka1.example.com:9092,kafka2.example.com:9092.

Enter the topic

In Kafka Topic, enter the name of the topic your SIEM reads. For example: azion.waf.

(Optional) Turn on TLS

Turn on Enable Transport Layer Security (TLS) to send the events encrypted. The receiving servers need a certificate from a trusted certificate authority.

Keep the stream active

In the Status section, keep Active turned on.

Select Save

The Console shows Your data stream has been created. The stream appears in the Data Stream list with waf in the Source column and the Active status.

Saving the stream checks the format of each field and does not contact the cluster. A wrong server address or topic surfaces only when the stream sends. An activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events records every send of a stream, delivered or not, with the status code the endpoint returned. Send a few requests to the workload that WAF analyzes, then wait about a minute. A stream sends a batch every 60 seconds, or sooner when it reaches 2,000 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Replace the dates with a range that covers the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T11:30:00\", end: \"2026-01-01T13:00:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record for each send, the latest first. For a stream that sends to S3, a record reads as below. Your records carry the type of your endpoint in endpointType:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:00:00Z",
06 "endpointType": "S3",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A statusCode of 200 means the endpoint accepted the batch, whose size streamedLines gives in log lines and dataStreamed in bytes. An empty dataStreamedEvents list means the stream has not sent in the range. For every field, refer to Real-Time Events GraphQL fields.

To find the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Read the latest sends

Each row is one send. Find the rows whose Endpoint Type matches your endpoint, and read their Status Code.

A Status Code of 200 means the endpoint accepted the batch. Streamed Lines gives the number of log lines in the batch.

A status other than 200 is the answer of the endpoint, and 503 means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

At the SIEM, each log line carries the keys of the WAF Event Collector template. Read these keys to check that the events are the ones WAF analyzed:

  • waf_attack_action holds the action WAF took, such as $BLOCK or $PASS.
  • waf_attack_family holds the class of the infraction, such as SQL or XSS.
  • waf_score and waf_match hold the score of the request and the infractions it matched.
  • blocked reads 1 when WAF blocked the request. While waf_learning reads 1, WAF blocks no request.

To correlate these events with the request data of your applications in one log line, use the Applications data source with the Applications + WAF Event Collector template instead. For the tradeoff, refer to Best practices for Data Stream.

Next steps

Data sources and variablesRead what each variable of the WAF Events data source holds, with an example value.EndpointsFind the fields of the endpoint your SIEM reads, with their bounds and API names.Send logs to Apache KafkaSet the bootstrap servers, the topic, and TLS for an Apache Kafka endpoint.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.Block attackers automatically from SIEM detectionsA design where the SIEM's detections on these events come back as blocks in a network list.