Imperva WAF

1 About the Device
2 Device Information
3 Collection Method
4 Port Requirements
5 Device Configuration
6 Integration Parameters

About the Device

Imperva, cloud-based website security solution features the industry’s leading WAF technology, as well as provides strong two-factor authentication and bot access control. Imperva’s advanced client classification engine analyzes all incoming traffic to protected site, preventing access to malicious and unwanted visitors.

Imperva Web Application Security solutions protect Web applications from cyber attacks. SecureSphere continuously adapts to evolving threats and enables security professionals, network managers, and application developers to mitigate the risk of a data breach and address key compliance requirements such as PCI 6.6.

Device Information

Entity	Particulars

Entity

Particulars

Vendor Name

Imperva

Product Name

Cloud WAF (Previously Known as Imperva Incapsula WAF)

Web Application Firewall (Previously known as SecureSphere WAF)

Type of Device

Cloud (Imperva Cloud WAF)

Hosted (Imperva WAF)

Collection Method

Log Type	Ingestion label	Preferred Logging Protocol - Format	Log Collection Method

Log Type

Ingestion label

Preferred Logging Protocol - Format

Log Collection Method

Imperva

IMPERVA_WAF

API Pull - CEF

Syslog - CEF

CyberHub

Port Requirements

Source	Destination	Port

Source	Destination	Port
Imperva WAF	CyberHub	514 (UDP)
Imperva Cloud WAF	CyberHub	443

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To configure Imperva Cloud WAF Log

The customer must first set up log integration.

To configure log integration

Sign in to your my.imperva.com account and navigate to the WAF Logs Setup
On the top menu bar, click Account > Account Management.
On the sidebar, click SIEM Logs > WAF Log Setup.
Click Activate logs.

To obtain API URL, API Key and API ID

Log in to your Imperva Cloud WAF console.
On the sidebar, click Logs > Log Setup.
For Connection. Select Imperva API.

From this window copy and keep API Key handy, this will be required for further Integration configuration.
Copy API ID and Log Server URI.

Configure the additional options:
Select the Format for the log files as CEF
Compress logs: By default, log files are compressed.
Click Save

Copy API ID, API Key and Log URL and share it with Adaptive MxDR Service Delivery Lead.

On the sidebar, click Log Levels.

Select a log level for each site to enable logging or leave disabled. There are two levels of logs:
a) Security Logs include the Imperva security events log.
b) All Logs comprises a comprehensive log of every request and response (access logs), as well as the security events log. (Select All Logs)

Logs are typically synchronized within 10 minutes, although it may take up to 30 minutes or more depending on system load.

To configure Imperva WAF Log

Configure the SecureSphere WAF server to send syslog messages in the Common Event Format (CEF) standard when an alert or a system event occurs

To configure the Imperva Admin interface

Click Admin in SecureSphere.
Navigate to System Definitions.
In left panel, in Management Server Settings, click Action Interfaces.
In right panel, select the following events:

Log custom security event to System Log (syslog) using the CEF standard.
Log network security event to System Log (syslog) using the CEF standard.
Log security event to System Log (syslog) using the CEF standard.

Edit the message field for all the above 3 events and add the following.

#Log custom security event to System Log (syslog) using the CEF standard.
#Log network security event to System Log (syslog) using the CEF standard.
#Log security event to System Log (syslog) using the CEF standard.
CEF:0|Imperva Inc.|SecureSphere|${SecureSphereVersion}|#cefEscapeMessage(${Rule.parent.displayName})|#cefEscapeMessage(${Rule.parent.displayName})|${Alert.severity}|act=${Alert.immediateAction} dst=${Event.destInfo.serverIp} dpt=${Event.destInfo.serverPort} duser=#cefEscapeExtension(${Alert.username}) src=${Event.sourceInfo.sourceIp} spt=${Event.sourceInfo.sourcePort} proto=${Event.sourceInfo.ipProtocol} rt=#arcsightDate(${Event.createTime}) cat=Alert cs1=#cefEscapeExtension(${Rule.parent.displayName}) cs1Label=Policy cs2=#cefEscapeExtension(${Alert.serverGroupName}) cs2Label=ServerGroup cs3=#cefEscapeExtension(${Alert.serviceName}) cs3Label=ServiceName cs4=#cefEscapeExtension(${Alert.applicationName}) cs4Label=ApplicationName cs5=#cefEscapeExtension(${Alert.description}) cs5Label=Description cs8=#cefEscapeExtension(${Event.struct.httpRequest.url.method}) cs8Label=HTTPMethod cs9=#cefEscapeExtension(${Event.struct.httpRequest.url.fullPath}) cs9Label=HTTPFullpath cs10=#cefEscapeExtension(${Event.struct.httpRequest.url.queryString}) cs10Label=QueryString cs11=#cefEscapeExtension(${Event.struct.httpResponse.responseCode}) cs11Label=HTTPResponseCode cs12=#cefEscapeExtension(${Event.struct.networkDirection}) cs12Label=NetworkDirection

6. Select the following System event:

Log System event to System Log (syslog) using the CEF standard.

7. Edit the message field and add the following.

#Log custom System event to System Log (syslog) using the CEF standard
CEF:0|ImpervaInc.|SecureSphere|${SecureSphereVersion}|${Event.eventType}|#cefEscapeMessage(${Event.message})|${Event.severity.displayName}|suser=#cefEscapeExtension(${Event.username}) rt=#arcsightDate(${Event.createTime}) cat=SystemEvent

Click Save.

To configure Imperva on the Main interface

Click Main in SecureSphere.
Navigate to Policies > Action Sets to create a new action set.
In the left panel, in Select, click +.
In creating a new action set, specify a name and select the event type for which you want to apply the action set.
In the right panel, from Available Action Interfaces select the following events:

Server System Log > Log custom security event to System Log (syslog) using the CEF standard.
Server System Log > Log network security event to System Log (syslog) using the CEF standard.
Server System Log > Log security event to System Log (syslog) using the CEF standard.
Server System Log > Log system event to System Log (syslog) using the CEF standard.

For each action interface, specify the name and values:
1. Syslog Host → CyberHub IP
2. Log Level → Info
3. Facility → KERN
(Optional) You can select the Run on Every Event.
Click Save.
To apply the action interface, click the green arrow to move it to the selected interface.

To apply action set to the policies:

Navigate to Policies > Security.
For all the policies, select the created action set name from the Followed Action list.

Integration Parameters

Imperva WAF:

Property	Default Value	Description

Property	Default Value	Description
IP Address	Imperva WAF interface IP address	Hostname or IP address of the device which forwards logs to the CyberHub

Imperva Cloud WAF:

Property	Default Value	Description

Property	Default Value	Description
Log Server URL	https://logs1.incapsula.com/<Repo_ID>	URL generated in Log Configuration section, Shared by customer.
API ID		API ID Shared by Customer.
API Key		API Key Shared by Customer.

Accenture Adaptive Managed Detection and Response - Configuration Quick Start Guides