---
url: https://docs.realmsec.info/integration/imperva_cloud_waf.md
---

# Imperva Cloud WAF Integration

Imperva Cloud WAF (Cloud Application Security) can deliver Web Application Firewall and other cloud service logs to Realm using Imperva's **Near Real-Time SIEM Log Integration**, configured from the Imperva Cloud Security Console. Choose a transport method based on your environment:

| Transport | Best for |
|---|---|
| [Amazon S3](#amazon-s3) | Delivering log files to an S3 bucket in your own AWS account, which Realm reads via SQS notification |
| [Splunk HEC](#splunk-hec) | Pushing logs directly to a Realm Splunk HTTP Event Collector (HEC)-compatible endpoint, without intermediate storage |
| [Generic HTTP Push (Beta)](#generic-http-push-beta) | Pushing logs directly to a Realm Cloud HTTP webhook endpoint, configured via the Imperva API |

> **Note:** Imperva also offers **Amazon S3 ARN** (IAM role-based S3 authentication), **Imperva API** (a pull-based method where you retrieve logs from Imperva's Log Server), and **SFTP (Legacy)** delivery methods. These are not covered in this guide.

## Prerequisites

* Administrator (or Account Admin) access to the Imperva Cloud Security Console at [my.imperva.com](https://my.imperva.com)
* Access to the Realm Security console
* If your infrastructure enforces IP-based access restrictions, allowlist Imperva's Near Real-Time SIEM IP addresses on the destination (S3 bucket, Splunk instance, or Realm Cloud HTTP endpoint). See [Allowlist Imperva IP addresses](https://docs.imperva.com/howto/c85245b7).
  > **Important:** Do not add these IP addresses to Allowlist Policies in the Imperva Cloud Security Console itself — they are used by Imperva to connect *to* your infrastructure, not the reverse.

## Create a Source in Realm

Before configuring any transport, create a source in Realm:

1. In Realm, go to **Sources > Add Source**.
2. Enter a name for your source.
3. Set **Product Format** to **Imperva Cloud WAF**.
4. Click **Save**.

Then follow the section below for your chosen transport method.

***

## Amazon S3

Use this transport when you want Imperva to write log files to an S3 bucket in your own AWS account, which Realm then reads via SQS notification.

### Create the AWS Resources

Create an S3 bucket in the region of your choice, then follow the [AWS S3 source setup guide](/integration/aws-s3#aws-s3-as-a-source) to configure the SQS queue, IAM policy, IAM user, and S3 event notifications that let Realm read new log objects as they arrive.

> **Note:** Imperva currently only supports the default **SSE-S3** (Amazon S3-managed keys) bucket encryption. If the bucket uses any other encryption type, Imperva will not be able to deliver logs to it.

### Add an AWS S3 Input Feed in Realm

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **AWS S3** and give it a name.
3. Enter the AWS credentials and S3/SQS configuration:

> **Access Key ID:** `<iam_access_key>`\
> **Secret Access Key:** `<iam_secret_key>`\
> **SQS Queue URL:** `<sqs_queue_url>`\
> **S3 Bucket Name:** `<bucket_name>`\
> **AWS Region:** `<region>`

4. Click **Save**.

### Configure the Connection in Imperva

1. Log in to [my.imperva.com](https://my.imperva.com).
2. On the top menu bar, click **Account > Account Management**.
3. On the sidebar, click **SIEM Logs > Log Configuration**.
4. In the **Connections** table, click **Add connection**.
5. (Optional) Select a supported SIEM vendor, or skip this step and select a delivery method directly.
6. Select **Amazon S3** as the delivery method.
7. Fill in the connection details:

> **Connection name:** A descriptive name for the connection\
> **Access key:** The IAM access key created above\
> **Secret key:** The IAM secret access key created above\
> **Path:** `<bucket_name>/<log_folder>` (for example, `MyBucket/MyImpervaLogFolder`)

8. Click **Test connection** to verify Imperva can reach and write to your bucket. The connection status should read **Available**.
9. Click **Save**.

### Select Log Types

1. In the Connections table, click **Add log type** on the connection you just created.
2. Fill in the configuration details:

> **Configuration name:** A unique, descriptive name\
> **Select service:** The Imperva service to collect logs from (for example, Cloud WAF)\
> **Select log types:** One or more log types for the selected service\
> **Format:** The log format to send is CEF\
> **Compress logs:** `On` or `Off`\
> **Encryption:** `Off` (**required**)

3. Before saving, confirm that **Encryption** is set to `Off`.
4. Save the configuration. Its **State** should show **Enabled**.

> **Warning:** Encryption **must be turned off**. Imperva enables it by default, and Realm cannot decrypt Imperva-encrypted log files. If encryption is left on, Realm cannot read any of the delivered logs. Do not enable encryption on any log configuration that sends to Realm.

> **Note:** **Compress logs** can be left on or turned off. Realm supports compressed Imperva logs, with one exception: the [Splunk HEC](#splunk-hec) transport only supports gzip compression.

Imperva will begin writing unencrypted log files to the configured S3 path, and Realm will pick them up via the SQS queue.

***

## Splunk HEC

Use this transport when you want Imperva to push logs directly to a Splunk HTTP Event Collector (HEC) endpoint, without intermediate storage.

### Add a Splunk HEC Input Feed in Realm

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Splunk HEC** and give it a name.
3. Enter a token if you have one, or leave it empty to have the system generate a random token for you.
4. Click **Save**.
5. Click **`...` > Edit** on the newly created input feed.
6. Click the eye icon in the token field to view the token value.
7. Copy the **HEC Endpoint URL** and **Token** — you will need these when configuring the connection in Imperva. Note the host name and port from the endpoint URL separately, as Imperva asks for them in separate fields.

### Configure the Connection in Imperva

1. Log in to [my.imperva.com](https://my.imperva.com).
2. On the top menu bar, click **Account > Account Management**.
3. On the sidebar, click **SIEM Logs > Log Configuration**.
4. In the **Connections** table, click **Add connection**.
5. Select **Splunk HEC** as the delivery method.
6. Fill in the connection details:

> **Connection name:** A descriptive name for the connection\
> **Host Name / IP:** The host name from the Realm HEC Endpoint URL\
> **Port:** The port of the Realm HEC endpoint (`443` for HTTPS)\
> **HEC token:** The token copied from the Realm input feed above (must be in UUID v4 format)

7. Click **Test connection** to verify Imperva can reach the endpoint. The connection status should read **Available**.
8. Click **Save**.

### Select Log Types

Follow the [Select Log Types](#select-log-types) steps from the Amazon S3 section above to add a log type configuration to this connection.

> **Warning:** Encryption **must be turned off** for this connection. Realm cannot read encrypted Imperva logs. If you enable **Compress logs**, the compression format must be gzip — the Splunk HEC transport does not support any other compression format.

> **Note:** Imperva expects a response from the HEC endpoint within 30 seconds of a completed transfer, or delivery is considered failed and retried (which may result in duplicate events). If the endpoint is unreachable for more than 4 hours, Imperva sends a service-impaired email notification; after 48 hours it stops retrying and deletes the backlog.

For full HEC endpoint details and troubleshooting, see the [Splunk HEC Source guide](/integration/splunk-hec). For Imperva's side of this connector, see [Splunk HEC SIEM Connector](https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/siem-hec-connector.htm).

***

## Generic HTTP Push (Beta)

> **Note:** This Imperva connector is currently in Beta and is API-only — it is not yet available in the Cloud Security Console UI. It supports header-based authentication only (OAuth is not supported), and does not support encryption or compression for Cloud WAF/Attack Analytics logs. See Imperva's [Beta Feature Statement](https://docs.imperva.com/howto/271d6b9b) and the [Generic HTTP Push Connector](https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/settings/generic-http-push-connector.htm) documentation for details.

Use this transport when you want Imperva to push logs directly to an arbitrary HTTPS endpoint without intermediate storage, configured through Imperva's Connections API.

### Add a Cloud HTTP Input Feed in Realm

1. On the **Select Transport Method** step in the Add Source flow, or from the source page, click **Add Input Feed**.
2. Select **Cloud HTTP** and give it a name.
3. Enter a token if you have one, or leave it empty to have the system generate a random token for you.
4. Click **Save**.
5. Click **`...` > Edit** on the newly created input feed.
6. Click the eye icon in the token field to view the token value.
7. Copy the **Webhook URL** and **Token** — you will need these to configure the connection through the Imperva API.

### Configure the Connection via the Imperva API

Using your Imperva API ID and Key, call the **Connections API** to create a connection with `storageType` set to `CUSTOMER_HTTP`, using the Realm webhook URL and token from the previous step:

```json
{
  "connectionName": "Realm Cloud HTTP",
  "storageType": "CUSTOMER_HTTP",
  "connectionInfo": {
    "url": "<realm_webhook_url>",
    "authentication": {
      "type": "HEADERS",
      "authHeaders": [
        {
          "headerName": "Authorization",
          "secretFormat": "Bearer {secret}",
          "secret": "<realm_input_feed_token>"
        }
      ]
    },
    "headers": {
      "Content-Type": "application/json"
    },
    "disableCertVerification": false
  }
}
```

Then call the **Log Configurations API** to select which logs to deliver over this connection, referencing the `connectionId` returned above:

```json
{
  "configurationName": "Realm Cloud WAF Logs",
  "provider": "CLOUD_WAF",
  "datasets": ["WAF_RAW_LOGS", "CLOUD_WAF_ACCESS"],
  "enabled": true,
  "connectionId": "<connection_id>",
  "format": "CEF",
  "compressLogs": false,
  "payload": {
    "batchPackaging": {
      "type": "NONE"
    }
  }
}
```

> **Note:** Set `payload.batchPackaging.type` to `NONE` so Realm receives clean log records without Imperva's legacy metadata prefix and `|==|` separator. The `provider` and `datasets` values vary by Imperva service (Cloud WAF, Advanced Bot Protection, Account Takeover Protection, Client-Side Protection, DDoS Protection, Audit Trail) — see the API reference below for the full list.

For the complete API reference, see the [SIEM Log Connections API](https://docs-cybersec.thalesgroup.com/bundle/api-docs/page/siem-log-api-definition.htm?operationId=operations-Connections-getAll1) and [SIEM Log Configurations API](https://docs-cybersec.thalesgroup.com/bundle/api-docs/page/siem-log-api-definition.htm?operationId=operations-Log_Configurations-getAll) documentation.

***

## Troubleshooting

If Imperva can't reach your destination, you'll be notified by email (per your Imperva notification settings — confirm SIEM storage notifications are enabled). Check:

* Are the required Imperva IP addresses allowed access to your destination?
* Is there a current network issue preventing the connection?
* Is **Encryption** turned off on the log configuration? Realm cannot read encrypted Imperva logs.
* (Amazon S3 only) Are the bucket permissions and encryption settings (SSE-S3 only) correct? Does the bucket have sufficient storage capacity?

Imperva retries delivery for 48 hours before it stops and deletes the backlog. Cloud WAF security events remain available in the Cloud Security Console for 90 days regardless of delivery status.

For more background on the underlying integration, see Imperva's [Near Real-Time SIEM Log Integration](https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/siem-log-overview.htm) and [Configure the SIEM Log Integration](https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/siem-log-configuration.htm) documentation.