AWS Network Firewall Suspicious TLD Monitoring

Lawton Pittenger@lawtonpittenger

•updated Nov 21, 2025•0•37

This rule monitors AWS Network Firewall for HTTP and TLS connections to domains with uncommon TLDs to identify anomalous behavior without blocking traffic, providing visibility rather than specific threat detection.