Realm.Security Documentation

Appearance

Imperva Cloud WAF Integration ​

Imperva Cloud WAF (Cloud Application Security) can deliver Web Application Firewall and other cloud service logs to Realm using Imperva's Near Real-Time SIEM Log Integration, configured from the Imperva Cloud Security Console. Choose a transport method based on your environment:

TransportBest for
Amazon S3Delivering log files to an S3 bucket in your own AWS account, which Realm reads via SQS notification
Splunk HECPushing logs directly to a Realm Splunk HTTP Event Collector (HEC)-compatible endpoint, without intermediate storage
Generic HTTP Push (Beta)Pushing logs directly to a Realm Cloud HTTP webhook endpoint, configured via the Imperva API

Note: Imperva also offers Amazon S3 ARN (IAM role-based S3 authentication), Imperva API (a pull-based method where you retrieve logs from Imperva's Log Server), and SFTP (Legacy) delivery methods. These are not covered in this guide.

Prerequisites ​

  • Administrator (or Account Admin) access to the Imperva Cloud Security Console at my.imperva.com
  • Access to the Realm Security console
  • If your infrastructure enforces IP-based access restrictions, allowlist Imperva's Near Real-Time SIEM IP addresses on the destination (S3 bucket, Splunk instance, or Realm Cloud HTTP endpoint). See Allowlist Imperva IP addresses.

    Important: Do not add these IP addresses to Allowlist Policies in the Imperva Cloud Security Console itself — they are used by Imperva to connect to your infrastructure, not the reverse.

Create a Source in Realm ​

Before configuring any transport, create a source in Realm:

  1. In Realm, go to Sources > Add Source.
  2. Enter a name for your source.
  3. Set Product Format to Imperva Cloud WAF.
  4. Click Save.

Then follow the section below for your chosen transport method.

Amazon S3 ​

Use this transport when you want Imperva to write log files to an S3 bucket in your own AWS account, which Realm then reads via SQS notification.

Create the AWS Resources ​

Create an S3 bucket in the region of your choice, then follow the AWS S3 source setup guide to configure the SQS queue, IAM policy, IAM user, and S3 event notifications that let Realm read new log objects as they arrive.

Note: Imperva currently only supports the default SSE-S3 (Amazon S3-managed keys) bucket encryption. If the bucket uses any other encryption type, Imperva will not be able to deliver logs to it.

Add an AWS S3 Input Feed in Realm ​

  1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
  2. Select AWS S3 and give it a name.
  3. Enter the AWS credentials and S3/SQS configuration:

Access Key ID: <iam_access_key>
Secret Access Key: <iam_secret_key>
SQS Queue URL: <sqs_queue_url>
S3 Bucket Name: <bucket_name>
AWS Region: <region>

  1. Click Save.

Configure the Connection in Imperva ​

  1. Log in to my.imperva.com.
  2. On the top menu bar, click Account > Account Management.
  3. On the sidebar, click SIEM Logs > Log Configuration.
  4. In the Connections table, click Add connection.
  5. (Optional) Select a supported SIEM vendor, or skip this step and select a delivery method directly.
  6. Select Amazon S3 as the delivery method.
  7. Fill in the connection details:

Connection name: A descriptive name for the connection
Access key: The IAM access key created above
Secret key: The IAM secret access key created above
Path: <bucket_name>/<log_folder> (for example, MyBucket/MyImpervaLogFolder)

  1. Click Test connection to verify Imperva can reach and write to your bucket. The connection status should read Available.
  2. Click Save.

Select Log Types ​

  1. In the Connections table, click Add log type on the connection you just created.
  2. Fill in the configuration details:

Configuration name: A unique, descriptive name
Select service: The Imperva service to collect logs from (for example, Cloud WAF)
Select log types: One or more log types for the selected service
Format: The log format to send is CEF
Compress logs: On or Off
Encryption: Off (required)

  1. Before saving, confirm that Encryption is set to Off.
  2. Save the configuration. Its State should show Enabled.

Warning: Encryption must be turned off. Imperva enables it by default, and Realm cannot decrypt Imperva-encrypted log files. If encryption is left on, Realm cannot read any of the delivered logs. Do not enable encryption on any log configuration that sends to Realm.

Note: Compress logs can be left on or turned off. Realm supports compressed Imperva logs, with one exception: the Splunk HEC transport only supports gzip compression.

Imperva will begin writing unencrypted log files to the configured S3 path, and Realm will pick them up via the SQS queue.

Splunk HEC ​

Use this transport when you want Imperva to push logs directly to a Splunk HTTP Event Collector (HEC) endpoint, without intermediate storage.

Add a Splunk HEC Input Feed in Realm ​

  1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
  2. Select Splunk HEC and give it a name.
  3. Enter a token if you have one, or leave it empty to have the system generate a random token for you.
  4. Click Save.
  5. Click ... > Edit on the newly created input feed.
  6. Click the eye icon in the token field to view the token value.
  7. Copy the HEC Endpoint URL and Token — you will need these when configuring the connection in Imperva. Note the host name and port from the endpoint URL separately, as Imperva asks for them in separate fields.

Configure the Connection in Imperva ​

  1. Log in to my.imperva.com.
  2. On the top menu bar, click Account > Account Management.
  3. On the sidebar, click SIEM Logs > Log Configuration.
  4. In the Connections table, click Add connection.
  5. Select Splunk HEC as the delivery method.
  6. Fill in the connection details:

Connection name: A descriptive name for the connection
Host Name / IP: The host name from the Realm HEC Endpoint URL
Port: The port of the Realm HEC endpoint (443 for HTTPS)
HEC token: The token copied from the Realm input feed above (must be in UUID v4 format)

  1. Click Test connection to verify Imperva can reach the endpoint. The connection status should read Available.
  2. Click Save.

Select Log Types ​

Follow the Select Log Types steps from the Amazon S3 section above to add a log type configuration to this connection.

Warning: Encryption must be turned off for this connection. Realm cannot read encrypted Imperva logs. If you enable Compress logs, the compression format must be gzip — the Splunk HEC transport does not support any other compression format.

Note: Imperva expects a response from the HEC endpoint within 30 seconds of a completed transfer, or delivery is considered failed and retried (which may result in duplicate events). If the endpoint is unreachable for more than 4 hours, Imperva sends a service-impaired email notification; after 48 hours it stops retrying and deletes the backlog.

For full HEC endpoint details and troubleshooting, see the Splunk HEC Source guide. For Imperva's side of this connector, see Splunk HEC SIEM Connector.

Generic HTTP Push (Beta) ​

Note: This Imperva connector is currently in Beta and is API-only — it is not yet available in the Cloud Security Console UI. It supports header-based authentication only (OAuth is not supported), and does not support encryption or compression for Cloud WAF/Attack Analytics logs. See Imperva's Beta Feature Statement and the Generic HTTP Push Connector documentation for details.

Use this transport when you want Imperva to push logs directly to an arbitrary HTTPS endpoint without intermediate storage, configured through Imperva's Connections API.

Add a Cloud HTTP Input Feed in Realm ​

  1. On the Select Transport Method step in the Add Source flow, or from the source page, click Add Input Feed.
  2. Select Cloud HTTP and give it a name.
  3. Enter a token if you have one, or leave it empty to have the system generate a random token for you.
  4. Click Save.
  5. Click ... > Edit on the newly created input feed.
  6. Click the eye icon in the token field to view the token value.
  7. Copy the Webhook URL and Token — you will need these to configure the connection through the Imperva API.

Configure the Connection via the Imperva API ​

Using your Imperva API ID and Key, call the Connections API to create a connection with storageType set to CUSTOMER_HTTP, using the Realm webhook URL and token from the previous step:

json
{
  "connectionName": "Realm Cloud HTTP",
  "storageType": "CUSTOMER_HTTP",
  "connectionInfo": {
    "url": "<realm_webhook_url>",
    "authentication": {
      "type": "HEADERS",
      "authHeaders": [
        {
          "headerName": "Authorization",
          "secretFormat": "Bearer {secret}",
          "secret": "<realm_input_feed_token>"
        }
      ]
    },
    "headers": {
      "Content-Type": "application/json"
    },
    "disableCertVerification": false
  }
}

Then call the Log Configurations API to select which logs to deliver over this connection, referencing the connectionId returned above:

json
{
  "configurationName": "Realm Cloud WAF Logs",
  "provider": "CLOUD_WAF",
  "datasets": ["WAF_RAW_LOGS", "CLOUD_WAF_ACCESS"],
  "enabled": true,
  "connectionId": "<connection_id>",
  "format": "CEF",
  "compressLogs": false,
  "payload": {
    "batchPackaging": {
      "type": "NONE"
    }
  }
}

Note: Set payload.batchPackaging.type to NONE so Realm receives clean log records without Imperva's legacy metadata prefix and |==| separator. The provider and datasets values vary by Imperva service (Cloud WAF, Advanced Bot Protection, Account Takeover Protection, Client-Side Protection, DDoS Protection, Audit Trail) — see the API reference below for the full list.

For the complete API reference, see the SIEM Log Connections API and SIEM Log Configurations API documentation.

Troubleshooting ​

If Imperva can't reach your destination, you'll be notified by email (per your Imperva notification settings — confirm SIEM storage notifications are enabled). Check:

  • Are the required Imperva IP addresses allowed access to your destination?
  • Is there a current network issue preventing the connection?
  • Is Encryption turned off on the log configuration? Realm cannot read encrypted Imperva logs.
  • (Amazon S3 only) Are the bucket permissions and encryption settings (SSE-S3 only) correct? Does the bucket have sufficient storage capacity?

Imperva retries delivery for 48 hours before it stops and deletes the backlog. Cloud WAF security events remain available in the Cloud Security Console for 90 days regardless of delivery status.

For more background on the underlying integration, see Imperva's Near Real-Time SIEM Log Integration and Configure the SIEM Log Integration documentation.