MELTr
Home Vendors Search Download
Login
Vendors / Amazon Web Services / AWS WAF / AWS WAF allow with valid CAPTCHA
Amazon Web Services logo

Event type

AWS WAF allow with valid CAPTCHA

WAF v1 ALLOW default action with valid non-terminating CAPTCHA, redacted cookie, registry client/API and coherent time/trace fields.

JSON 93 fields Generator

aws waf captcha
Preview Sample View Schema
CLI Install
meltr templates install aws

Overview

What this event covers

One documented APIGW request profile with valid CAPTCHA and redacted cookie. Requires source-specific entities: entities/aws/waf/web-acl-traffic.yaml; example configuration: configs/aws/waf/web-acl-traffic.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

  • ›A valid CAPTCHA permits continued evaluation and default ALLOW.

Security relevance

Informational

Frequency notes

One event/second local test rate; independent requests, no token/session lifecycle.

Resources

Docs and tools

Complete scenario example official Field definitions official Supported logging redaction official Trace ID time and hex components official

Generation

Configuration

Base frequency
3600 events/hour
Business hours
1.0x
Night hours
1.0x
Weekend
1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

timestamp
Integer Optional

Single now() → unix_timestamp × 1000 → int: epoch milliseconds.

Source: Single now() → unix_timestamp × 1000 → int: epoch milliseconds.

Example 1790894870700
formatVersion
Integer Optional

Fixed 1.

Source: Fixed 1.

Example 1
webaclId
String Optional

Named service waf-api.webacl_id; pinned to the sample ACL.

Source: Named service waf-api.webacl_id; pinned to the sample ACL.

Example arn:aws:wafv2:us-east-1:111122223333:regional/webacl/example-captcha/fbafb30f-345b-5618-8cd9-4bb0d8f19448
terminatingRuleId
String Optional

Fixed "Default_Action".

Source: Fixed "Default_Action".

Example Default_Action
terminatingRuleType
String Optional

Fixed "REGULAR".

Source: Fixed "REGULAR".

Example REGULAR
action
String Optional

Fixed "ALLOW".

Source: Fixed "ALLOW".

Example ALLOW
terminatingRuleMatchDetails
Array Optional

Exactly 0 item(s) in this profile.

Source: Exactly 0 item(s) in this profile.

Example []
httpSourceName
String Optional

Fixed "APIGW".

Source: Fixed "APIGW".

Example APIGW
httpSourceId
String Optional

Same service http_source_id; pinned to sample account/API/stage.

Source: Same service http_source_id; pinned to sample account/API/stage.

Example 111122223333:abc123def4:lab
ruleGroupList
Array Optional

Exactly 0 item(s) in this profile.

Source: Exactly 0 item(s) in this profile.

Example []
rateBasedRuleList
Array Optional

Exactly 0 item(s) in this profile.

Source: Exactly 0 item(s) in this profile.

Example []
nonTerminatingMatchingRules
Array Optional

Exactly 1 item(s) in this profile.

Source: Exactly 1 item(s) in this profile.

Example [{"action":"CAPTCHA","captchaResponse":{"responseCode":0,"solveTimestamp":1790894865},"ruleId":"captcha-rule","ruleMatchDetails":[]}]
nonTerminatingMatchingRules[0]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"action":"CAPTCHA","captchaResponse":{"responseCode":0,"solveTimestamp":1790894865},"ruleId":"captcha-rule","ruleMatchDetails":[]}
nonTerminatingMatchingRules[0].ruleId
String Optional

Fixed "captcha-rule".

Source: Fixed "captcha-rule".

Example captcha-rule
nonTerminatingMatchingRules[0].action
String Optional

Fixed "CAPTCHA".

Source: Fixed "CAPTCHA".

Example CAPTCHA
nonTerminatingMatchingRules[0].ruleMatchDetails
Array Optional

Exactly 0 item(s) in this profile.

Source: Exactly 0 item(s) in this profile.

Example []
nonTerminatingMatchingRules[0].captchaResponse
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"responseCode":0,"solveTimestamp":1790894865}
nonTerminatingMatchingRules[0].captchaResponse.responseCode
Integer Optional

Fixed 0.

Source: Fixed 0.

Example 0
nonTerminatingMatchingRules[0].captchaResponse.solveTimestamp
Integer Optional

Same clock truncated to seconds minus five.

Source: Same clock truncated to seconds minus five.

Example 1790894865
requestHeadersInserted
Array Optional

Exactly 1 item(s) in this profile.

Source: Exactly 1 item(s) in this profile.

Example [{"name":"x-amzn-waf-test-header-name","value":"test-header-value"}]
requestHeadersInserted[0]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"x-amzn-waf-test-header-name","value":"test-header-value"}
requestHeadersInserted[0].name
String Optional

Fixed "x-amzn-waf-test-header-name".

Source: Fixed "x-amzn-waf-test-header-name".

Example x-amzn-waf-test-header-name
requestHeadersInserted[0].value
String Optional

Fixed "test-header-value".

Source: Fixed "test-header-value".

Example test-header-value
responseCodeSent
Null Optional

Fixed null.

Source: Fixed null.

Example null
httpRequest
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"args":"","clientIp":"192.0.2.41","country":"US","headers":[{"name":"X-Forwarded-For","value":"192.0.2.41"},{"name":"X-Forwarded-Proto","value":"https"},{"name":"X-Forwarded-Port","value":"443"},{"name":"Host","value":"abc123def4.execute-api.us-east-1.amazonaws.com"},{"name":"X-Amzn-Trace-Id","value":"Root=1-6abee316-fcef3751758c51565657973f"},{"name":"cache-control","value":"max-age=0"},{"name":"sec-ch-ua","value":"\"Chromium\";v=\"94\", \"Google Chrome\";v=\"94\", \";Not A Brand\";v=\"99\""},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"sec-ch-ua-platform","value":"\"Windows\""},{"name":"upgrade-insecure-requests","value":"1"},{"name":"user-agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.54 Safari/537.36"},{"name":"accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"},{"name":"sec-fetch-site","value":"same-origin"},{"name":"sec-fetch-mode","value":"navigate"},{"name":"sec-fetch-user","value":"?1"},{"name":"sec-fetch-dest","value":"document"},{"name":"referer","value":"https://abc123def4.execute-api.us-east-1.amazonaws.com/lab/pets"},{"name":"accept-encoding","value":"gzip, deflate, br"},{"name":"accept-language","value":"en-US,en;q=0.9"},{"name":"cookie","value":"REDACTED"}],"httpMethod":"GET","httpVersion":"HTTP/1.1","requestId":"58c67959a50fff0f","uri":"/lab/pets"}
httpRequest.clientIp
String Optional

Selected device ip_address.

Source: Selected device ip_address.

Example 192.0.2.41
httpRequest.country
String Optional

Fixed "US".

Source: Fixed "US".

Example US
httpRequest.headers
Array Optional

Exactly 20 item(s) in this profile.

Source: Exactly 20 item(s) in this profile.

Example [{"name":"X-Forwarded-For","value":"192.0.2.41"},{"name":"X-Forwarded-Proto","value":"https"},{"name":"X-Forwarded-Port","value":"443"},{"name":"Host","value":"abc123def4.execute-api.us-east-1.amazonaws.com"},{"name":"X-Amzn-Trace-Id","value":"Root=1-6abee316-fcef3751758c51565657973f"},{"name":"cache-control","value":"max-age=0"},{"name":"sec-ch-ua","value":"\"Chromium\";v=\"94\", \"Google Chrome\";v=\"94\", \";Not A Brand\";v=\"99\""},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"sec-ch-ua-platform","value":"\"Windows\""},{"name":"upgrade-insecure-requests","value":"1"},{"name":"user-agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.54 Safari/537.36"},{"name":"accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"},{"name":"sec-fetch-site","value":"same-origin"},{"name":"sec-fetch-mode","value":"navigate"},{"name":"sec-fetch-user","value":"?1"},{"name":"sec-fetch-dest","value":"document"},{"name":"referer","value":"https://abc123def4.execute-api.us-east-1.amazonaws.com/lab/pets"},{"name":"accept-encoding","value":"gzip, deflate, br"},{"name":"accept-language","value":"en-US,en;q=0.9"},{"name":"cookie","value":"REDACTED"}]
httpRequest.headers[0]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"X-Forwarded-For","value":"192.0.2.41"}
httpRequest.headers[0].name
String Optional

Fixed "X-Forwarded-For".

Source: Fixed "X-Forwarded-For".

Example X-Forwarded-For
httpRequest.headers[0].value
String Optional

Same selected device ip_address; equals clientIp.

Source: Same selected device ip_address; equals clientIp.

Example 192.0.2.41
httpRequest.headers[1]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"X-Forwarded-Proto","value":"https"}
httpRequest.headers[1].name
String Optional

Fixed "X-Forwarded-Proto".

Source: Fixed "X-Forwarded-Proto".

Example X-Forwarded-Proto
httpRequest.headers[1].value
String Optional

Fixed "https".

Source: Fixed "https".

Example https
httpRequest.headers[2]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"X-Forwarded-Port","value":"443"}
httpRequest.headers[2].name
String Optional

Fixed "X-Forwarded-Port".

Source: Fixed "X-Forwarded-Port".

Example X-Forwarded-Port
httpRequest.headers[2].value
String Optional

Fixed "443".

Source: Fixed "443".

Example 443
httpRequest.headers[3]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"Host","value":"abc123def4.execute-api.us-east-1.amazonaws.com"}
httpRequest.headers[3].name
String Optional

Fixed "Host".

Source: Fixed "Host".

Example Host
httpRequest.headers[3].value
String Optional

Fixed "abc123def4.execute-api.us-east-1.amazonaws.com".

Source: Fixed "abc123def4.execute-api.us-east-1.amazonaws.com".

Example abc123def4.execute-api.us-east-1.amazonaws.com
httpRequest.headers[4]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"X-Amzn-Trace-Id","value":"Root=1-6abee316-fcef3751758c51565657973f"}
httpRequest.headers[4].name
String Optional

Fixed "X-Amzn-Trace-Id".

Source: Fixed "X-Amzn-Trace-Id".

Example X-Amzn-Trace-Id
httpRequest.headers[4].value
String Optional

Root=1- + eight-digit lowercase hex epoch seconds + 24 Faker hex digits.

Source: Root=1- + eight-digit lowercase hex epoch seconds + 24 Faker hex digits.

Example Root=1-6abee316-fcef3751758c51565657973f
httpRequest.headers[5]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"cache-control","value":"max-age=0"}
httpRequest.headers[5].name
String Optional

Fixed "cache-control".

Source: Fixed "cache-control".

Example cache-control
httpRequest.headers[5].value
String Optional

Fixed "max-age=0".

Source: Fixed "max-age=0".

Example max-age=0
httpRequest.headers[6]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-ch-ua","value":"\"Chromium\";v=\"94\", \"Google Chrome\";v=\"94\", \";Not A Brand\";v=\"99\""}
httpRequest.headers[6].name
String Optional

Fixed "sec-ch-ua".

Source: Fixed "sec-ch-ua".

Example sec-ch-ua
httpRequest.headers[6].value
String Optional

Fixed "\"Chromium\";v=\"94\", \"Google Chrome\";v=\"94\", \";Not A Brand\";v=\"99\"".

Source: Fixed "\"Chromium\";v=\"94\", \"Google Chrome\";v=\"94\", \";Not A Brand\";v=\"99\"".

Example "Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"
httpRequest.headers[7]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-ch-ua-mobile","value":"?0"}
httpRequest.headers[7].name
String Optional

Fixed "sec-ch-ua-mobile".

Source: Fixed "sec-ch-ua-mobile".

Example sec-ch-ua-mobile
httpRequest.headers[7].value
String Optional

Fixed "?0".

Source: Fixed "?0".

Example ?0
httpRequest.headers[8]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-ch-ua-platform","value":"\"Windows\""}
httpRequest.headers[8].name
String Optional

Fixed "sec-ch-ua-platform".

Source: Fixed "sec-ch-ua-platform".

Example sec-ch-ua-platform
httpRequest.headers[8].value
String Optional

Fixed "\"Windows\"".

Source: Fixed "\"Windows\"".

Example "Windows"
httpRequest.headers[9]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"upgrade-insecure-requests","value":"1"}
httpRequest.headers[9].name
String Optional

Fixed "upgrade-insecure-requests".

Source: Fixed "upgrade-insecure-requests".

Example upgrade-insecure-requests
httpRequest.headers[9].value
String Optional

Fixed "1".

Source: Fixed "1".

Example 1
httpRequest.headers[10]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"user-agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.54 Safari/537.36"}
httpRequest.headers[10].name
String Optional

Fixed "user-agent".

Source: Fixed "user-agent".

Example user-agent
httpRequest.headers[10].value
String Optional

Fixed "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.54 Safari/537.36".

Source: Fixed "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.54 Safari/537.36".

Example Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.54 Safari/537.36
httpRequest.headers[11]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"}
httpRequest.headers[11].name
String Optional

Fixed "accept".

Source: Fixed "accept".

Example accept
httpRequest.headers[11].value
String Optional

Fixed "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9".

Source: Fixed "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9".

Example text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
httpRequest.headers[12]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-fetch-site","value":"same-origin"}
httpRequest.headers[12].name
String Optional

Fixed "sec-fetch-site".

Source: Fixed "sec-fetch-site".

Example sec-fetch-site
httpRequest.headers[12].value
String Optional

Fixed "same-origin".

Source: Fixed "same-origin".

Example same-origin
httpRequest.headers[13]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-fetch-mode","value":"navigate"}
httpRequest.headers[13].name
String Optional

Fixed "sec-fetch-mode".

Source: Fixed "sec-fetch-mode".

Example sec-fetch-mode
httpRequest.headers[13].value
String Optional

Fixed "navigate".

Source: Fixed "navigate".

Example navigate
httpRequest.headers[14]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-fetch-user","value":"?1"}
httpRequest.headers[14].name
String Optional

Fixed "sec-fetch-user".

Source: Fixed "sec-fetch-user".

Example sec-fetch-user
httpRequest.headers[14].value
String Optional

Fixed "?1".

Source: Fixed "?1".

Example ?1
httpRequest.headers[15]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"sec-fetch-dest","value":"document"}
httpRequest.headers[15].name
String Optional

Fixed "sec-fetch-dest".

Source: Fixed "sec-fetch-dest".

Example sec-fetch-dest
httpRequest.headers[15].value
String Optional

Fixed "document".

Source: Fixed "document".

Example document
httpRequest.headers[16]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"referer","value":"https://abc123def4.execute-api.us-east-1.amazonaws.com/lab/pets"}
httpRequest.headers[16].name
String Optional

Fixed "referer".

Source: Fixed "referer".

Example referer
httpRequest.headers[16].value
String Optional

Fixed "https://abc123def4.execute-api.us-east-1.amazonaws.com/lab/pets".

Source: Fixed "https://abc123def4.execute-api.us-east-1.amazonaws.com/lab/pets".

Example https://abc123def4.execute-api.us-east-1.amazonaws.com/lab/pets
httpRequest.headers[17]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"accept-encoding","value":"gzip, deflate, br"}
httpRequest.headers[17].name
String Optional

Fixed "accept-encoding".

Source: Fixed "accept-encoding".

Example accept-encoding
httpRequest.headers[17].value
String Optional

Fixed "gzip, deflate, br".

Source: Fixed "gzip, deflate, br".

Example gzip, deflate, br
httpRequest.headers[18]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"accept-language","value":"en-US,en;q=0.9"}
httpRequest.headers[18].name
String Optional

Fixed "accept-language".

Source: Fixed "accept-language".

Example accept-language
httpRequest.headers[18].value
String Optional

Fixed "en-US,en;q=0.9".

Source: Fixed "en-US,en;q=0.9".

Example en-US,en;q=0.9
httpRequest.headers[19]
Object Optional

Required container; keys exactly as shown below.

Source: Required container; keys exactly as shown below.

Example {"name":"cookie","value":"REDACTED"}
httpRequest.headers[19].name
String Optional

Fixed "cookie".

Source: Fixed "cookie".

Example cookie
httpRequest.headers[19].value
String Optional

Fixed "REDACTED".

Source: Fixed "REDACTED".

Example REDACTED
httpRequest.uri
String Optional

Fixed "/lab/pets".

Source: Fixed "/lab/pets".

Example /lab/pets
httpRequest.args
String Optional

Fixed "".

Source: Fixed "".

httpRequest.httpVersion
String Optional

Fixed "HTTP/1.1".

Source: Fixed "HTTP/1.1".

Example HTTP/1.1
httpRequest.httpMethod
String Optional

Fixed "GET".

Source: Fixed "GET".

Example GET
httpRequest.requestId
String Optional

Faker hexify: 16 lowercase hex characters, local synthetic nonempty-string subset.

Source: Faker hexify: 16 lowercase hex characters, local synthetic nonempty-string subset.

Example 58c67959a50fff0f