| Column Name | Column Data Type |
|---|
max_items Required Input Column
The number of requests that you want WAF to return from among the first 5,000 requests that your Amazon Web Services resource received during the time range. If your resource received fewer requests than the value of MaxItems, GetSampledRequests returns information about all of them. | BIGINT |
rule_metric_name Required Input Column
The metric name assigned to the Rule or RuleGroup dimension for which you want a sample of requests. | VARCHAR |
scope Required Input Column
Specifies whether this is for an Amazon CloudFront distribution or for a regional application. A regional application can be an Application Load Balancer (ALB), an Amazon API Gateway REST API, an AppSync GraphQL API, an Amazon Cognito user pool, an App Runner service, or an Amazon Web Services Verified Access instance. To work with CloudFront, you must also specify the Region US East (N. Virginia) as follows: -
CLI - Specify the Region when you use the CloudFront scope: --scope=CLOUDFRONT --region=us-east-1. -
API and SDKs - For all calls, use the Region endpoint us-east-1. | VARCHAR |
time_window Required Input Column
Usually, TimeWindow is the time range that you specified in the GetSampledRequests request. However, if your Amazon Web Services resource received more than 5,000 requests during the time range that you specified in the request, GetSampledRequests returns the time range for the first 5,000 requests. Times are in Coordinated Universal Time (UTC) format. | STRUCT(
"start_time" TIMESTAMP_S,
"end_time" TIMESTAMP_S
) |
Show child fields- time_window.end_time
The end of the time range from which you want GetSampledRequests to return a sample of the requests that your Amazon Web Services resource received. You must specify the times in Coordinated Universal Time (UTC) format. UTC format includes the special designator, Z. For example, "2016-09-27T14:50Z". You can specify any time range in the previous three hours. - time_window.start_time
The beginning of the time range from which you want GetSampledRequests to return a sample of the requests that your Amazon Web Services resource received. You must specify the times in Coordinated Universal Time (UTC) format. UTC format includes the special designator, Z. For example, "2016-09-27T14:50Z". You can specify any time range in the previous three hours.
|
web_acl_arn Required Input Column
The Amazon resource name (ARN) of the WebACL for which you want a sample of requests. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
population_size
The total number of requests from which GetSampledRequests got a sample of MaxItems requests. If PopulationSize is less than MaxItems, the sample includes every request that your Amazon Web Services resource received during the specified time range. | BIGINT |
sampled_requests
A complex type that contains detailed information about each of the requests in the sample. | STRUCT(
"request" STRUCT(
"client_ip" VARCHAR,
"country" VARCHAR,
"uri" VARCHAR,
"method" VARCHAR,
"http_version" VARCHAR,
"headers" STRUCT(
"name" VARCHAR,
"value" VARCHAR
)[]
),
"weight" BIGINT,
"timestamp" TIMESTAMP_S,
"action" VARCHAR,
"rule_name_within_rule_group" VARCHAR,
"request_headers_inserted" STRUCT(
"name" VARCHAR,
"value" VARCHAR
)[],
"response_code_sent" BIGINT,
"labels" STRUCT(
"name" VARCHAR
)[],
"captcha_response" STRUCT(
"response_code" BIGINT,
"solve_timestamp" BIGINT,
"failure_reason" VARCHAR
),
"challenge_response" STRUCT(
"response_code" BIGINT,
"solve_timestamp" BIGINT,
"failure_reason" VARCHAR
),
"overridden_action" VARCHAR
)[] |
Show child fields- sampled_requests[]
Show child fields- sampled_requests[].action
The action that WAF applied to the request. - sampled_requests[].captcha_response
The CAPTCHA response for the request. Show child fields- sampled_requests[].captcha_response.failure_reason
The reason for failure, populated when the evaluation of the token fails. - sampled_requests[].captcha_response.response_code
The HTTP response code indicating the status of the CAPTCHA token in the web request. If the token is missing, invalid, or expired, this code is 405 Method Not Allowed. - sampled_requests[].captcha_response.solve_timestamp
The time that the CAPTCHA was last solved for the supplied token.
- sampled_requests[].challenge_response
The Challenge response for the request. Show child fields- sampled_requests[].challenge_response.failure_reason
The reason for failure, populated when the evaluation of the token fails. - sampled_requests[].challenge_response.response_code
The HTTP response code indicating the status of the challenge token in the web request. If the token is missing, invalid, or expired, this code is 202 Request Accepted. - sampled_requests[].challenge_response.solve_timestamp
The time that the challenge was last solved for the supplied token.
- sampled_requests[].labels[]
Show child fields- sampled_requests[].labels[].name
The label string.
- sampled_requests[].overridden_action
Used only for rule group rules that have a rule action override in place in the web ACL. This is the action that the rule group rule is configured for, and not the action that was applied to the request. The action that WAF applied is the Action value. - sampled_requests[].request
A complex type that contains detailed information about the request. Show child fields- sampled_requests[].request.client_ip
The IP address that the request originated from. If the web ACL is associated with a CloudFront distribution, this is the value of one of the following fields in CloudFront access logs: -
c-ip, if the viewer did not use an HTTP proxy or a load balancer to send the request -
x-forwarded-for, if the viewer did use an HTTP proxy or a load balancer to send the request - sampled_requests[].request.country
The two-letter country code for the country that the request originated from. For a current list of country codes, see the Wikipedia entry ISO 3166-1 alpha-2. - sampled_requests[].request.headers[]
Show child fields- sampled_requests[].request.headers[].name
The name of the HTTP header. - sampled_requests[].request.headers[].value
The value of the HTTP header.
- sampled_requests[].request.http_version
The HTTP version specified in the sampled web request, for example, HTTP/1.1. - sampled_requests[].request.method
The HTTP method specified in the sampled web request. - sampled_requests[].request.uri
The URI path of the request, which identifies the resource, for example, /images/daily-ad.jpg.
- sampled_requests[].request_headers_inserted[]
Show child fields- sampled_requests[].request_headers_inserted[].name
The name of the HTTP header. - sampled_requests[].request_headers_inserted[].value
The value of the HTTP header.
- sampled_requests[].response_code_sent
The response code that was sent for the request. - sampled_requests[].rule_name_within_rule_group
The name of the Rule that the request matched. For managed rule groups, the format for this name is <vendor name>#<managed rule group name>#<rule name>. For your own rule groups, the format for this name is <rule group name>#<rule name>. If the rule is not in a rule group, this field is absent. - sampled_requests[].timestamp
The time at which WAF received the request from your Amazon Web Services resource, in Unix time format (in seconds). - sampled_requests[].weight
A value that indicates how one result in the response relates proportionally to other results in the response. For example, a result that has a weight of 2 represents roughly twice as many web requests as a result that has a weight of 1.
|