Ticket summary
On 8 April 2026 the LumenBay SOC opened IR-2026-0408-022 after CloudFront/WAF XSS COUNT and BLOCK metrics spiked on shop.lumenbay.io. No customer report of a popup or account takeover has been confirmed. You are the investigating analyst.
LumenBay serves the public shopfront through CloudFront, with AWS WAF inspecting viewer requests before they reach the Application Load Balancer and lumenbay-web. Several XSS managed rules remain in COUNT from a tuning window last week.
The ticket includes three exports covering the afternoon window: CloudFront/WAF JSON, ALB access logs, and a short application log slice from lumenbay-web. Your job is to identify the operator, the targeted parameter, how WAF handled the campaign, and whether any payload actually exploited the application.
A WAF detection is not the same as a successful exploit. Correlate request IDs from WAF to ALB to the application before you conclude impact.