Next-Gen WAF configuration changes now recorded in the event log

The Event logs API now records Next-Gen WAF configuration changes no matter where they are made — through the Next-Gen WAF API, the Fastly control panel, the Next-Gen WAF control panel, or Terraform. Previously, only changes made through Fastly were recorded, so a workspace edited from the Next-Gen WAF control panel left no entry in your event log.

All Next-Gen WAF event types are now documented and can be used with filter[event_type] on list events. They cover workspaces, rules, lists, custom signals, redactions, virtual patches, thresholds, workspace alerts, header links, rate limited sources, custom dashboards, request reports, and agent keys. Some of these resources have no Next-Gen WAF API endpoint for changing them, but changes made to them elsewhere are recorded all the same.

The following event types are deprecated and are no longer recorded. Use the ngwaf.* equivalent instead — for example, ngwaf.rule.create in place of security.rule.create. Entries already in your event log keep their original event type.

• security.workspace.create, security.workspace.update, security.workspace.delete
• security.redaction.create, security.redaction.update, security.redaction.delete
• security.rule.create, security.rule.update, security.rule.delete
• security.virtual_patch.create, security.virtual_patch.update, security.virtual_patch.delete
• security.event.update