RISK-BASED OPTIMIZATION OF WEB APPLICATION FIREWALL POLICIES USING SIEM-DRIVEN LOG ANALYTICS IN DATA CENTER SECURITY

This article examines a risk-based approach to optimizing Web Application Firewall (WAF) policies through SIEM-driven log analytics in data center security environments. The study aims to develop a methodological framework for improving WAF rule effectiveness by correlating web traffic events, security logs, detected anomalies, and risk indicators collected through Security Information and Event Management systems. The proposed approach focuses on reducing false positives, identifying obsolete or overly permissive rules, prioritizing high-risk attack patterns, and adapting WAF policies to dynamically changing threat conditions. The research is based on the analysis of WAF event logs, SIEM correlation mechanisms, risk scoring principles, and policy optimization procedures. Particular attention is paid to the integration of log analytics with rule tuning, event prioritization, and incident response processes. The study shows that risk-based policy management can improve the precision of web application protection by enabling security teams to distinguish between low-impact anomalies and critical attack vectors. The proposed framework also supports continuous monitoring and iterative adjustment of WAF rules based on threat severity, asset criticality, and observed attack behavior. The results indicate that combining SIEM analytics with WAF policy optimization can strengthen data center cybersecurity, improve incident detection quality, and support more efficient security resource allocation.