Collect Imperva WAF logs

This document explains how to collect Imperva WAF logs by setting up a Google Security Operations feed using the Third Party API.

Imperva WAF is a cloud-based web application firewall that protects websites and applications from web-based attacks, including SQL injection, cross-site scripting (XSS), and DDoS threats. Imperva WAF analyzes incoming HTTP/HTTPS traffic in real time, applying security rules and bot mitigation policies to block malicious requests before they reach the origin server.

Collection method differences

The Imperva WAF integration with Google SecOps supports the following methods for log ingestion, both under the same ingestion label IMPERVA_WAF:

• API collection: With this method, Google SecOps pulls the logs directly from the Imperva API. This is a direct connection and only supports audit logs as described in Imperva Audit Trail .
• Amazon S3 V2 bucket collection: With this method, Imperva WAF pushes logs into a designated Amazon S3 bucket. Google SecOps then pulls the logs from this bucket. This allows collecting security events and access logs, generated by the Cloud WAF, as described in Imperva log integration.

Before you begin

Make sure that you have the following prerequisites:

• A Google SecOps instance
• Privileged access to the Imperva Cloud Security Console (my.imperva.com)
• An Imperva account with permissions to generate API keys

Configure Imperva WAF API access

To enable Google SecOps to retrieve WAF logs, you need to generate API credentials from the Imperva Cloud Security Console.

Generate API credentials

1. Sign in to the Imperva Cloud Security Console at my.imperva.com.
2. Go to Account > Account Settings.
3. Scroll down to the API Information section.

4. Copy and save the following values:

   • API ID: Your unique API identifier (for example, 12345).
   • API Key: Your API key (for example, abcdef-123456-ghijkl-789012).

Important: Store the API ID and API Key securely. These credentials provide access to your Imperva account data through the API.

Configure a feed in Google SecOps to ingest Imperva WAF logs

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed (for example, Imperva WAF Logs).
5. Select Third Party API as the Source type.
6. Select Imperva as the Log type.
7. Click Next.

8. Specify values for the following input parameters:

   • Authentication HTTP header: Enter the authentication credentials in the following format:

     apiId:your-api-id-value
     apiKey:your-api-key-value
     

     Each credential must be on a separate line in key:value format.

   • Asset namespace: The asset namespace.

   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalize screen, and then click Submit.

After setup, the feed begins to retrieve WAF event logs from the Imperva Cloud WAF instance.

Collect Imperva WAF logs using Amazon S3

Configure AWS IAM and S3

1. Create an Amazon S3 bucket following this user guide: Creating a bucket
2. Save the bucket Name and Region for later use.
3. Create a User following this user guide: Creating an IAM user.
4. Select the created User.
5. Select the Security credentials tab.
6. Click Create Access Key in the Access Keys section.
7. Select Third-party service as the Use case.
8. Click Next.
9. Optional: Add a description tag.
10. Click Create access key.
11. Click Download .csv file and save the Access Key and Secret Access Key for later use.
12. Click Done.
13. Select the Permissions tab.
14. Click Add permissions in the Permissions policies section.
15. Select Add permissions.
16. Select Attach policies directly.
17. Search for and select the AmazonS3FullAccess policy.
18. Click Next.
19. Click Add permissions.

Configure Imperva WAF Amazon S3 connection

1. Sign in to the Imperva Console with a privileged account.
2. Go to Logs > Log Setup.
3. Select Amazon S3.
4. Fill in the required fields:
   • Access key
   • Secret key
   • Path: enter the path in the following format: /; for example: MyBucket/MyIncapsulaLogFolder.
5. Click Test connection to perform a full testing cycle in which a test file is transferred to your designated folder.
6. Select the format for the log files as CEF.
7. By default, log files are compressed. Set the option to not compress files.

Configure a feed in Google SecOps to ingest Imperva WAF logs from Amazon S3 V2

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. In the Feed name field, enter a name for the feed; for example, Imperva WAF Logs.
4. Select Amazon S3 V2 as the Source type.
5. Select Imperva as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • S3 URI: the bucket URI.
     • s3://your-log-bucket-name/
       • Replace your-log-bucket-name with the actual name of the bucket.

   • Source deletion options: Select the deletion option according to your preference.

   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.

   • Access Key ID: User access key with access to the S3 bucket.

   • Secret Access Key: User secret key with access to the S3 bucket.

   • Asset namespace: The asset namespace.

   • Ingestion labels: The label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM mapping table

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.