Can WAF Log Protection Events?

WAF stores protection event logs generated over the last 30 days for free. You can check them on the WAF console.

If you want to store WAF protection logs for a long time, enable Log Tank Service (LTS) at additional costs and authorize it for WAF logging. Logs can be stored in LTS for seven days by default but you can configure LTS for up to 30 days if needed. Logs earlier than 30 days are automatically deleted. However, you can configure LTS to dump those logs to an Object Storage Service (OBS) bucket or enable Data Ingestion Service (DIS) for long-term storage.

For details about how to configure LTS for WAF, see Using LTS to Log WAF Activities.