detecting-sql-injection-via-waf-logs

Detect SQL injection in WAF logs by parsing request data and applying regex rules to identify malicious patterns. The Skill extracts IPs and rule IDs to classify injections and outputs structured findings for security operations.

Yes, AWS WAF and Cloudflare logs are supported alongside ModSecurity audit logs. The Skill parses JSON WAF logs and correlates multiple requests by source IP to identify coordinated SQLi campaigns across these platforms.

Source IP correlation groups multiple WAF log requests originating from the same address to detect coordinated SQLi campaigns. This process transforms isolated event logs into structured campaign findings with human-readable reports.

The best way to extract rule IDs and requests from ModSecurity audit logs is using modular parsing logic. This approach isolates relevant transaction fields, enabling regex-based SQLi detection and accurate mapping to standard injection types.

You do not need to manually provide outputs; the Skill generates both human-readable reports and machine-readable JSON files. Running the agent against your WAF log file automatically produces a structured sqli_report.json.

Limitations in mapping to standard injection types stem from regex rule coverage and log format variations. If WAF logs lack complete request payloads, modular parsing cannot fully classify complex or obfuscated SQLi patterns.