---
title: "Engineering guide: Web App Shield connections"
description: "Plan connections for logs, response workflows, configuration, identity and optional database-security products. The examples need validation against the selected product, version and licence."
url: https://www.alt-f1.be/en/imperva/integration-architecture/
organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718)
---

# Engineering guide: Web App Shield connections

How the Imperva platform plugs into your SIEM, SOAR, CI/CD, identity, PKI and databases.

Source: Thales Cyber Security — Enterprise Security & Data Fabric Ecosystem. Vendor figures as published. ALT-F1 is the Belgian partner for Imperva: we open the account, tune the rules and build these integrations with your teams. The original document is kept in the site repository (docs/imperva/).

## Key figures

- **Protection scope:** Per service — Confirm the product, sites and enabled features.
- **Database coverage:** Product-specific — Verify supported engines for the chosen version.
- **Log delivery:** Measure in tests — Check delay, completeness and failure handling.
- **Access:** Least privilege — Configure credentials and certificate responsibilities.

## 1. Dual-plane security architecture

The Imperva Security Ecosystem operates through two synchronised planes: the Edge Application Plane (single-pass traffic inspection across 150+ PoPs) and the Core Data Plane (the Data Security Fabric, uniting on-premise and cloud database auditing).

### Edge Application Plane topology (150+ global PoPs)

- **Cloud WAF core** (AppSec) — Performs single-pass traffic inspection across 150+ PoPs, neutralising the OWASP Top 10, custom rules and zero-day threats inline. Egress: HTTPS / TLS 1.3. Data model / schema: CEF / LEEF / JSON.
- **Advanced Bot Protection** (BotSec) — Browser telemetry analysis and dynamic challenge injection to neutralise malicious automation without user friction. Egress: HTTPS / JS fingerprinting. Data model / schema: JSON / event stream.
- **Account Takeover Protection** (Identity) — Evaluates compromised-credential feeds and behavioural anomalies to block credential stuffing and brute force. Egress: HTTPS / REST API. Data model / schema: JSON event payload.
- **Client-Side Protection** (WebSec) — Monitors third-party JavaScript executing in the browser to stop Magecart and formjacking attacks. Egress: HTTP / script inspector. Data model / schema: JSON / webhook.
- **DDoS mitigation engine** (Infra) — Mitigates volumetric L3/L4 and complex L7 application attacks within seconds, using global PoP capacity. Egress: L3/L4 BGP / L7 HTTP. Data model / schema: W3C / CEF.
- **RASP in-app sensor** (Workload) — Embeds inside application runtimes to stop SQL injection, command execution and unauthorised file access. Egress: Native JVM / .NET IPC. Data model / schema: Internal process audit.

### Core Data Security Fabric (DSF) plane (Agent & agentless gateways)

- **Agent gateway & host agent** (On-prem DB) — Monitors privileged local database-administrator activity directly on relational DB servers, local console sessions included. Egress: Local IPC / shared memory. Data model / schema: Raw audit log.
- **Agentless cloud gateway** (Cloud DBaaS) — Collects native cloud database audit streams across AWS RDS, Azure SQL and Google Cloud SQL without local agents. Egress: AWS CloudWatch / Event Hubs API. Data model / schema: Normalised cloud audit.
- **DSF Hub analytics core** (Central hub) — Central big-data server running UEBA analytics, compliance retention and enterprise policy management. Egress: TLS / HTTPS / gRPC. Data model / schema: sonargd data warehouse.
- **Data Risk Analytics (DRA)** (ML engine) — Machine learning over database audit trails to pinpoint high-risk data exposure and behavioural anomalies. Egress: Internal hub IPC. Data model / schema: Risk-score narrative.

## 2. Telemetry egress and protocols

Choose a supported log-delivery channel, format and destination. The latency chart is illustrative: measure end-to-end delivery and completeness in the acceptance test.

Average log-transport latency per channel:

- Splunk HEC: 12 s
- Kafka streaming: 1 s
- Syslog TLS: 3 s
- S3 object push: 45 s
- SIEM pull API: 180 s

Takeaway: push mechanisms (Splunk HEC, Kafka) ingest in under 15 seconds; API polling incurs batch delays and rate limiting (HTTP 429).

### CEF — sample

```
CEF:0|Imperva|Incapsula|1.0|20001|SQL Injection Attempt|7|cs12=BLOCK cs17=CVE-2023-1234 fileType=SQLi filePermission=Rule_1092 c-ip=198.51.100.45 cn1=403 cs-sessionid=sess_8893412a
```

- `cs12 / cs-responseaction` — Final mitigation decision enforced (PASSED, BLOCK, CAPTCHA).
- `cs17 / cs-cve` — CVE correlated by Threat Research.
- `fileType / filePermission` — Attack classification (SQLi, XSS) and triggered signature ID.
- `c-ip / cn1` — Source client IP and HTTP status code returned.

### LEEF — sample

```
LEEF:2.0|Imperva|Incapsula|1.0|WAF_BLOCK|dev01|src=198.51.100.45|usrName=john_doe|proto=HTTPS|action=BLOCK|cat=CrossSiteScripting|ruleId=89432
```

- `src / usrName` — Origin IP and authenticated user identity.
- `action / cat` — Enforced action and standardised threat category.
- `ruleId` — Security policy rule identifier in the Imperva engine.

### JSON — sample

```
{
  "timestamp": 1729864200,
  "client_ip": "198.51.100.45",
  "attack_type": "Bot_Automation",
  "action": "CAPTCHA_CHALLENGE",
  "cve_id": "CVE-2024-8891",
  "bot_classification": "Malicious_Scraper"
}
```

- `client_ip / timestamp` — Client IPv4/IPv6 origin and epoch timestamp.
- `bot_classification` — Fingerprint class (good bot, scraper, headless browser).
- `action` — Applied mitigation (PASSED, CHALLENGE, DROPPED).

### W3C — sample

```
2026-10-25 13:50:00 198.51.100.45 POST /api/checkout 403 1092 "Imperva_WAF_Block" "Mozilla/5.0"
```

- `date time c-ip` — UTC timestamp and connecting client IP.
- `cs-method cs-uri-stem` — HTTP verb and requested path.
- `sc-status cs(User-Agent)` — HTTP status code and client user agent.

### Hybrid cryptographic envelope

1. **Payload compression** — Raw logs compressed into micro-batches at the edge PoP.
2. **AES-256 symmetric encryption** — Each batch encrypted with a generated symmetric session key.
3. **RSA key wrapping** — The session key encrypted with the enterprise-provided RSA public key.
4. **MD5 integrity check** — File header carries an MD5 checksum to detect tampering.

## 3. SIEM and security data lakes

Choose the investigation platform and verify its supported connector, data mapping and access. The steps below are configuration examples, not evidence that a connection is already operating.

### Microsoft Sentinel integration pipeline

Serverless extraction pipeline: an Azure Function App deployed in the customer's tenant pulls logs from the Imperva SIEM API and normalises them into Log Analytics.

- Integration pattern: Azure Function App (Python), timer trigger
- Data model: ASIM (CommonSecurityLog table)
- Authentication: API ID + key; RSA private key in Key Vault
- Telemetry scope: Cloud WAF, bot, ATO, DDoS, audit logs

1. **Timer trigger and Key Vault lookup** — The Azure Function runs on schedule and retrieves the API credentials and the RSA private key from Azure Key Vault.
2. **API pull and payload decryption** — Connects to the Imperva SIEM API over TLS, downloads the compressed log batch and decrypts it in memory.
3. **Log Analytics ingestion** — Streams the normalised CEF records into the Azure Monitor Ingestion API, targeted at the Log Analytics workspace.
4. **ASIM parser normalisation** — The ImpervaWAFCloud parser maps raw CEF fields to the CommonSecurityLog schema for cross-workload hunting.

### Splunk Enterprise and Splunk Cloud

High-throughput streaming into the Splunk HTTP Event Collector (HEC) for edge events, paired with the jSonar add-on querying the DSF Hub sonargd database directly.

- Integration pattern: Splunk HEC push + jSonar DSF add-on
- Data model: Splunk CIM (Web and Network data models)
- Authentication: HEC token; mTLS, TLS 1.3
- Telemetry scope: WAAP edge access + DSF database audit trails


### IBM QRadar DSM integration path

LEEF-formatted events over Syslog TLS or REST API collection, mapped by the Imperva Device Support Module (DSM) into the QRadar Sense Analytics engine.

- Integration pattern: Syslog over TLS (TCP 6514) / cloud REST API
- Data model: LEEF event mapping
- Authentication: Mutual TLS, key-pair verification
- Telemetry scope: WAF threats, network protection, DSF alerts


### Google Security Operations (Chronicle)

Automated ingestion through Google Cloud Storage buckets into Google SecOps, normalising raw JSON payloads into Unified Data Model (UDM) events.

- Integration pattern: GCS export bucket / Chronicle ingestion API
- Data model: Unified Data Model (UDM)
- Authentication: GCP service-account key / OAuth 2.0
- Telemetry scope: Cloud WAF, bot protection, account takeover


### Elastic Security and Elasticsearch ingest pipeline

Filebeat or Elastic Agent consumes the S3/Blob log exports and passes records through Elastic ingest pipelines to populate Elastic Common Schema (ECS) fields.

- Integration pattern: Filebeat / Elastic Agent, S3 input plugin
- Data model: Elastic Common Schema (ECS)
- Authentication: AWS IAM role / Azure SAS token
- Telemetry scope: WAAP logs, bot fingerprints, RASP workload audit


## 4. Bidirectional SOAR and automated response

Agree which events can trigger a workflow and which actions need approval. The sample payloads demonstrate a message structure; validate authentication, retries and permitted actions before use.

### Volumetric L7 DDoS

1. **Detection:** Attack Analytics clusters a 45,000 RPS burst across 12 countries into one active L7 DDoS narrative.
2. **Dispatch:** The outbound HTTPS webhook fires with its shared-secret authentication token.
3. **Enrichment:** The Cortex XSOAR playbook queries the Imperva REST API for the most attacked URL paths.
4. **Enforcement:** An API command shifts the WAF rule from alert-only to an active dynamic JavaScript challenge.

```json
{
  "event_type": "WebsiteDdosStart",
  "account_id": "10023456",
  "site_name": "checkout.enterprise.com",
  "threat_level": "CRITICAL",
  "rps_peak": 45000,
  "mitigation_method": "Dynamic Adaptive Challenge"
}
```

### Account takeover

1. **Detection:** The ATO module identifies 12,000 credential-validation attempts from residential proxy IPs.
2. **Dispatch:** The webhook dispatches an account-takeover alert with the list of compromised usernames.
3. **Enrichment:** The SOAR playbook runs a cross-workload check in Entra ID for the affected accounts.
4. **Enforcement:** SOAR calls the API to terminate the active user sessions and block the offending IP ranges.

```json
{
  "event_type": "AccountTakeoverAlert",
  "target_endpoint": "/api/v1/auth/login",
  "attack_vector": "Credential_Stuffing",
  "compromised_accounts_detected": 142,
  "action_requested": "Invalidate_Sessions"
}
```

### Database exfiltration

1. **Detection:** DSF Data Risk Analytics detects an anomalous SELECT extracting 500,000 national-ID records.
2. **Dispatch:** A high-priority alert is dispatched to Splunk SOAR through the Kafka event broker.
3. **Enrichment:** The playbook retrieves the DBA identity and compares it with the scheduled maintenance tickets.
4. **Enforcement:** The DSF Hub applies a Data Level Security (DLS) restriction and revokes the service-account access.

```json
{
  "event_type": "DatabaseDataExfiltration",
  "database_instance": "prod-customer-db-aws",
  "db_user": "app_svc_reporting",
  "records_extracted": 500000,
  "action_taken": "Revoke_DLS_Permissions"
}
```

### Client-side script breach

1. **Detection:** Client-Side Protection detects an unauthorised external JavaScript file modified on the payment page.
2. **Dispatch:** The webhook dispatches a Magecart / script-violation alert to the DevSecOps pipeline.
3. **Enrichment:** The SOAR playbook creates a Jira ticket assigned to application-security engineering.
4. **Enforcement:** The Imperva API restricts the script domain pending manual authorisation, as PCI DSS 4.0 requires.

```json
{
  "event_type": "ClientSideScriptViolation",
  "page_url": "https://enterprise.com/checkout/pay",
  "script_source": "https://malicious-cdn.com/tracker.js",
  "compliance_impact": "PCI_DSS_Violation"
}
```

## 5. DevSecOps, IaC and CI/CD

Review and test configuration changes before applying them. The generated code is a starting example; confirm provider versions, parameters, credentials and a recovery path.

```hcl
resource "incapsula_site_v3" "production_site" {
  name       = "api.enterprise.com"
  type       = "PUBLIC_CLOUD"
  cloud_type = "AWS"
}

resource "incapsula_data_centers_configuration" "dc_config" {
  site_id = incapsula_site_v3.production_site.id

  data_center {
    name       = "primary_origin"
    ip_or_host = "10.0.12.44"
    server {
      ip     = "10.0.12.44"
      active = true
    }
  }
}

resource "incapsula_waf_security_rule" "custom_protection" {
  site_id     = incapsula_site_v3.production_site.id
  rule_action = "api.rule_action.block"
  name        = "Enforce-Security-Policy"
  filter      = "Header.User-Agent == 'BadBotEngine' | Header.Authorization == ''"
}
```

Managing site creation, SSL certificate validation and rule provisioning through Terraform removes configuration drift from the CI/CD pipeline.

### OpenAPI schema sync and positive security

In the deployment pipeline (GitLab CI, GitHub Actions), developers push the updated OpenAPI (Swagger) specification to the Imperva API Security module through its REST API.

- Enforces valid routes, HTTP methods and parameter types at the edge.
- Detects shadow APIs: undocumented endpoints that are active.
- Identifies zombie APIs: deprecated routes still receiving traffic.

### RASP in-app workload sensors

Runtime Application Self-Protection (RASP) micro-agents deploy inside the application runtime (JVM, .NET CLR, Node.js, Kubernetes pods) without edge network rules.

- Monitors memory buffers, file-system access and raw database queries.
- Neutralises zero-day exploits (deserialisation, SQL injection) in real time.
- In-thread mitigation, no round trip to the edge.

## 6. Identity federation, enterprise PKI and two-tier mTLS

Separate administrator sign-in from transport authentication. Verify the selected product’s identity and certificate support, including the two connections in any mutual-TLS design.

1. **Tier 1: client-to-Imperva mTLS** (High-assurance identity ingress) — Designed for mobile banking applications, B2B enterprise APIs and IoT networks. The connecting client establishes a TLS 1.3 mutual handshake with the nearest Imperva edge PoP. The PoP checks the certificate revocation lists (CRLs) and authenticates the client certificate authority. `X-Imperva-Client-Cert-SAN: SubjectAltName: email:api-client@enterprise.com, CN=MobileAppClientV2`
2. **Edge PoP inspection and header injection** (Identity extraction) — The Imperva PoP terminates the tier-1 TLS session, inspects the payload against the WAF, bot and rate-limiting rules, and extracts the verified client identity attributes (SAN, common name, issuer). It injects these attributes into an encrypted HTTP header before forwarding. `X-Imperva-Client-Cert-Verified: TRUE; Serial=883920192; Issuer=EnterpriseInternalCA`
3. **Tier 2: Imperva-to-origin mTLS** (Origin shielding egress) — To protect origin servers from direct network bypass, Imperva presents an enterprise-issued client certificate when opening the TCP connection to the backend origin load balancer. The origin drops any request that does not present this verified certificate. `Connection: TLS_AES_256_GCM_SHA384; ClientCertPresented: ImpervaOriginClientCertV3`

### SAML 2.0 identity federation

Federates administrative authentication across Microsoft Entra ID, Okta and ADFS. Attribute assertions map corporate directory security groups to granular role-based access control (RBAC) tiers and to Data Security Fabric Data Level Security (DLS) compliance scopes.

### Verify cryptographic support

Confirm protocol versions, certificate handling and supported algorithms for every connection against current vendor documentation. Do not infer a post-quantum feature from a conventional encryption label.

## 7. Data Security Fabric and the database estate

Database audit integration is a separate product scope from website protection. Confirm engine support, licensing, permissions and export options against the current vendor documentation. Key capability: the DSF Hub sonargd engine runs user and entity behaviour analytics (UEBA) to detect privileged-user anomalies and schema tampering without burdening the SIEM licence.

Database scope distribution:

- Relational (Oracle, SQL Server): 45 %
- Cloud DBaaS (RDS, Azure SQL): 25 %
- Big data (Snowflake, BigQuery): 18 %
- NoSQL (MongoDB, Cassandra): 12 %

Catalogue:

- **Oracle (RAC and Exadata)** (Agent / agentless) — Monitors local shared-memory IPC and cloud database instances.
- **Microsoft SQL Server** (Agent / agentless) — Full audit tracking for on-premise SQL Server and Azure SQL.
- **Amazon RDS and Aurora** (Agentless gateway) — Ingests CloudWatch audit streams without host software.
- **PostgreSQL and AlloyDB** (Agent / agentless) — Deep SQL parsing across open-source and enterprise PostgreSQL.
- **Snowflake** (Agentless gateway) — Audit collection for cloud enterprise data warehousing.
- **MongoDB and Couchbase** (Agentless / agent) — Document-store JSON query monitoring and UEBA analytics.
- **Google BigQuery** (Agentless gateway) — Serverless data-warehouse audit ingestion through GCP APIs.
- **Apache Cassandra** (Agent gateway) — Distributed NoSQL ring activity tracking.
- **SAP HANA** (Agent gateway) — In-memory database audit and policy enforcement.
- **Databricks and Hadoop** (Agentless gateway) — Big-data lake query auditing and data-loss prevention.

- **Sub-second Kafka egress** — JSON-formatted database telemetry delivered to Apache Kafka for real-time fraud engines.
- **ODBC / JDBC connectivity** — Compliance officers query historical access trails directly from Power BI and Tableau.
- **Long-term cold vault** — Partitioned, compressed audit files exported to S3 or Blob storage for seven-year regulatory mandates (SOX, PCI).

## 8. Master integration matrix and roadmap

| Domain | Target system | Direction | Protocol / interface | Data format | Objective |
|---|---|---|---|---|---|
| SIEM | Splunk Enterprise / Cloud | Outbound | HTTPS / HEC API | JSON, CEF | Raw security event ingestion and Splunk CIM mapping |
| SIEM | Microsoft Sentinel | Inbound | REST API (Azure Function) | CEF (ASIM) | Automated log retrieval and Defender telemetry correlation |
| SIEM | IBM QRadar | Outbound | Syslog over TLS (TCP 6514) | LEEF | Threat-intelligence feed and Sense Analytics offences |
| SIEM | Elastic Security | Inbound | Filebeat / S3 plugin | JSON (ECS) | Log storage in Elasticsearch for threat hunting |
| Storage | Amazon S3 | Outbound | S3 REST object API | Compressed JSON / CEF | Encrypted cold storage and decoupled data-lake feeds |
| SOAR | Palo Alto Cortex XSOAR | Bidirectional | REST API / webhooks | JSON | Automated IP blocking, session invalidation, triage |
| SOAR | Splunk SOAR / Chronicle | Bidirectional | REST API / webhooks | JSON | Automated threat-containment playbooks |
| IaC | HashiCorp Terraform | Inbound | Provider API (imperva/incapsula) | HCL / JSON state | Declarative provisioning of sites, rules and SSL certificates |
| CI/CD | GitLab / GitHub Actions | Inbound | REST API / OpenAPI | JSON / YAML | Positive security sync and shadow-API discovery |
| Workload | Kubernetes / pod RASP | In-app | RASP micro-sensor | Native system calls | In-runtime zero-day exploit neutralisation |
| ITSM | ServiceNow | Bidirectional | ServiceNow Table API | JSON | Automated SIR incident creation and CMDB sync |
| ITSM | Jira Service Management | Outbound | Jira REST API | JSON | Script authorisation tracking for PCI DSS compliance |
| Identity | Okta / Entra ID | Inbound | SAML 2.0 / SCIM | XML assertions | Administrative SSO and RBAC role mapping |
| PKI | Thales CipherTrust | Bidirectional | Native registration token | Crypto objects | Database key lifecycle management and tokenisation |
| PKI | GlobalSign CA | Inbound | Automated ACME / DNS | X.509 certificates | Edge SSL/TLS certificate issuance and renewal |
| SASE | Cato Networks | Peering | Remote port forwarding | Encapsulated TCP/IP | Securing private origin resources without public IPs |
| Streaming | Apache Kafka | Outbound | Kafka protocol / rsyslog | JSON / audit logs | High-throughput database audit streaming to analytics |
| BI | Tableau / Power BI | Inbound | ODBC / JDBC | SQL tabular | Multi-year compliance audit reporting |

## Four-phase implementation

1. **Identity and PKI foundation** — SAML 2.0 SSO federation; Two-tier mTLS origin shield; GlobalSign ACME SSL setup; PQC cryptographic preparation
2. **Telemetry and SOC activation** — Object-storage push pipelines; SIEM parsers (ASIM / CIM); Outbound webhooks for SOAR; Real-time ChatOps alerts
3. **DevSecOps and policy as code** — Terraform provider deployment; OpenAPI schema sync in CI/CD; RASP in-app workload sensors; Shadow-API auto-discovery
4. **DSF hybrid data expansion** — DSF Hub core infrastructure; Cloud agentless gateways; On-premise host-agent rollout; Kafka sub-second streaming

ALT-F1 is the Belgian partner for Imperva: we open the account, tune the rules and build these integrations with your teams. Quotes within one working day: https://www.alt-f1.be/en/quote/