Radware CWAAP Audit Log Collector

The Radware CWAAP Audit Log Collector brings the Radware Cloud WAAP portal Activity Log into Splunk: logins, configuration and policy changes, user and API-key management, and every other action recorded by the portal. Each record is indexed as a JSON event (sourcetype radware:cwaap:audit) with the field names used by the legacy Radware CWAF Event Collector (app 5281) available as search-time aliases, so existing searches keep working. The audit log is available through the Radware Cloud API only. All other CWAAP log types (WAF and Web DDoS security events, access logs, bot events) are delivered by CWAAP Log Exporter to Amazon S3, Azure Blob Storage or SFTP; bring those into Splunk from there. This add-on deliberately collects nothing else. This add-on is provided as-is and is not covered by Radware support contracts.