Collect Imperva WAF logs

This document explains how to collect logs from the Imperva Web Application Firewall (WAF) to Google Security Operations using either an API or Amazon S3. The parser transforms logs from SYSLOG+KV, JSON, CEF, and LEEF formats into a unified data model (UDM). It processes various log structures, extracts relevant fields, normalizes them into UDM attributes, and enriches the data with contextual information for enhanced security analysis.

Collection method differences

The Imperva WAF integration with Google SecOps supports the following methods for log ingestion, both under the same ingestion label IMPERVA_WAF:

• API collection: With this method, Google SecOps pulls the logs directly from the Imperva API. This is a direct connection and only supports audit logs as described in Imperva Audit Trail .
• Amazon S3 V2 bucket collection: With this method, Imperva WAF pushes logs into a designated Amazon S3 bucket. Google SecOps then pulls the logs from this bucket. This allows collecting security events and access logs, generated by the Cloud WAF, as described in Imperva log integration.

Before you begin

Ensure that you have the following prerequisites:

• Ingestion type (API or Amazon S3) that best fits your configuration requirements.
• Google SecOps instance.
• Privileged access to AWS.
• Privileged access to Imperva WAF.

Collect Imperva WAF logs using API

Configure a Read-Only user for Imperva WAF

1. Sign in to the Imperva Console with a privileged account.
2. Go to Settings > Users & Roles.
3. Click Add User.
4. Fill in the required fields:
   • Username: enter a unique username.
   • Password: set a strong password.
   • Email: provide the user's email address.
   • In the Roles section, select the Reader role.
5. Click Save to create the user with read-only access.

Optional: Configure Reader user as API-Only

1. In the Users list, locate the newly created user.
2. Click the Actions button (three dots) next to the user's name.
3. Select Set as API-only user.

Generate the API ID and API key

1. In the Users list, select the newly created user.
2. Select Settings and click API Keys.
3. Click Add API Key.
4. Fill in the required fields:
   • Name: enter a descriptive name for the API key.
   • Optional: Description: provide an optional description.
   • In the API key will expire in list, select Never.
   • To enable, select Status.
5. Click Save.

The system displays the API ID and API Key. Copy and save these credentials, as they won't be displayed again.

Set up feeds

To configure a feed, follow these steps:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed; for example, Imperva Incapsula WAF Logs.
5. Select Third party API as the Source type.
6. Select Imperva as the Log type.
7. Click Next.
8. Specify values for the following input parameters:
   • Authentication HTTP header: enter the Imperva API ID and Key in two lines: apiId:<YOUR_API_ID> and apiKey:<YOUR_API_KEY>.
9. Click Next.
10. Review the feed configuration in the Finalize screen, and then click Submit.

Collect Imperva WAF logs using Amazon S3

Configure AWS IAM and S3

1. Create an Amazon S3 bucket following this user guide: Creating a bucket
2. Save the bucket Name and Region for later use.
3. Create a User following this user guide: Creating an IAM user.
4. Select the created User.
5. Select the Security credentials tab.
6. Click Create Access Key in the Access Keys section.
7. Select Third-party service as the Use case.
8. Click Next.
9. Optional: Add a description tag.
10. Click Create access key.
11. Click Download .csv file and save the Access Key and Secret Access Key for later use.
12. Click Done.
13. Select the Permissions tab.
14. Click Add permissions in the Permissions policies section.
15. Select Add permissions.
16. Select Attach policies directly.
17. Search for and select the AmazonS3FullAccess policy.
18. Click Next.
19. Click Add permissions.

Configure Imperva WAF Amazon S3 connection

1. Sign in to the Imperva Console with a privileged account.
2. Go to Logs > Log Setup.
3. Select Amazon S3.
4. Fill in the required fields:
   • Access key
   • Secret key
   • Path: enter the path in the following format: <Amazon S3 bucket name>/<log folder>; for example: MyBucket/MyIncapsulaLogFolder.
5. Click Test connection to perform a full testing cycle in which a test file is transferred to your designated folder.
6. Select the format for the log files as CEF.
7. By default, log files are compressed. Set the option to not compress files.

Configure a feed in Google SecOps to ingest Imperva WAF logs from Amazon S3 V2

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. In the Feed name field, enter a name for the feed; for example, Imperva WAF Logs.
4. Select Amazon S3 V2 as the Source type.
5. Select Imperva as the Log type.
6. Click Next.

7. Specify values for the following input parameters:

   • S3 URI: the bucket URI.
     • s3://your-log-bucket-name/
       • Replace your-log-bucket-name with the actual name of the bucket.

   • Source deletion options: Select the deletion option according to your preference.

   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.

   • Access Key ID: User access key with access to the S3 bucket.

   • Secret Access Key: User secret key with access to the S3 bucket.

   • Asset namespace: The asset namespace.

   • Ingestion labels: The label to be applied to the events from this feed.

8. Click Next.

9. Review your new feed configuration in the Finalize screen, and then click Submit.

UDM Mapping Table

Need more help? Get answers from Community members and Google SecOps professionals.