Table of Contents
- 1. Introduction
- 2. About WAF Log Retention Enhancements
- 3. About the Log Intelligence Option
- 4. Conclusion
1. Introduction
On December 10, 2025 (JST), WafCharm released two new features for AWS users: the Log Intelligence option and an enhancement to WAF log retention.
The enhanced WAF log retention functionality allows you to extend the retention period when using the new method for WAF log integration.
The Log Intelligence option provides features that make it easier to analyze WAF logs.
This article provides an overview of each feature.
2. About WAF Log Retention Enhancements
When you enable WAF log integration using the new method, you can use not only existing features such as monthly reports and WAF log alerts (detection notifications), but also features like the WAF log search and detection status on the Dashboard page. However, depending on your WafCharm account plan, there has been a fixed limit on the number of WAF logs that can be viewed. As a result, in some cases, the WAF logs you wanted to review did not appear in search results.
In response to requests from customers who wanted to view more WAF logs, we have released an enhancement that allows WAF logs to be retained based on a time period rather than a fixed number of entries, using a pay-as-you-go model.
To use this enhancement, you must first change the WAF log storage mode for your WafCharm account from the traditional count-based limit (Fixed mode) to a period-based limit (Expanded mode). After that, specify the retention period for each WAF Config in the WAF log integration settings on the [Log and Notification Configuration] tab.
The selected WAF log storage mode also affects the number of WAF logs that can be analyzed in the Bot Dashboard, which is described later in this article. When Fixed mode is applied, only WAF logs up to the limit defined by your plan are included for use in the Bot Dashboard. In Expanded mode, WAF logs within the specified retention period can be used, regardless of the total number of logs.
For pricing details related to WAF log retention, see WafCharm AWS Marketplace version pricing table.
For more information about the functionality, see About WAF Log Retention Period.
3. About the Log Intelligence Option
The Log Intelligence option is a paid add-on that, when subscribed to, provides extended functionality for analyzing WAF logs.
At the time of this release, it includes the Bot Dashboard, a feature that uses WAF logs to help analyze sudden increases in request volume, such as those caused by DoS or DDoS attacks, as well as suspicious requests.
For pricing details, see WafCharm AWS Marketplace version pricing table.
In the Bot Dashboard, request characteristics are derived from integrated WAF logs based on selected use cases. The values that can be analyzed vary depending on your web ACL rule configuration. Currently, the Bot Dashboard supports analysis based on Bot identification labels, Bot signal labels, ASN, country codes, and JA4 fingerprints.
For example, this feature can be useful when there is a temporary spike in request volume during a specific time period and you want to identify values that could be used in a blocking rule to suppress the traffic as quickly as possible. When request volume appears higher than on the previous day, you could extract WAF logs from a recent time range, such as the past one or two days, and review the characteristics of requests with particularly high volumes. If the Bot Dashboard analysis indicates that a large number of requests originate from a specific JA4 fingerprint and those requests also appear suspicious, temporarily blocking that value may help reduce load.
Please note that, as described in AWS WAF Can Now Inspect ASN (Autonomous System Numbers), ASN values are not included in WAF logs unless rules related to ASN inspection are configured. If you want to include ASN values in the analysis, you must add rules that inspect ASN separately.
For more details, see About Bot Dashboard.
4. Conclusion
In this update, we introduced new enhancements to help you make better use of your WAF logs.
The Bot Dashboard can be particularly useful when you want to quickly analyze request activity. By switching the WAF log storage mode, you can continue using existing WAF log integration–related features while also enabling the Bot Dashboard to analyze a larger volume of WAF logs than before.
Because these features may affect your usage costs, please contact your sales representative if you have any questions or would like to discuss whether they are a good fit for your needs.
