Engineering guide: Web App Shield connections

Plan connections for logs, response workflows, configuration, identity and optional database-security products. The examples need validation against the selected product, version and licence.

Start with the connection overview, then choose a section for the task you need. Each section contains an interface or configuration example; check its prerequisites and limits before using it.

Connection overview →

Protection scopePer serviceConfirm the product, sites and enabled features.
Database coverageProduct-specificVerify supported engines for the chosen version.
Log deliveryMeasure in testsCheck delay, completeness and failure handling.
AccessLeast privilegeConfigure credentials and certificate responsibilities.

1 Dual-plane security architecture

Distinguish website-traffic protection from separately licensed database-security products. Select a component to inspect the interface and data format relevant to the planned connection.

Plane and component inspector

Pick a plane, then a component, to see its function, egress protocol and data model.

Edge Application Plane topology150+ global PoPs
Cloud WAF coreAppSec

Performs single-pass traffic inspection across 150+ PoPs, neutralising the OWASP Top 10, custom rules and zero-day threats inline.

Primary egress protocol
HTTPS / TLS 1.3
Data model / schema
CEF / LEEF / JSON

2 Telemetry egress and protocols

Choose a supported log-delivery channel, format and destination. The latency chart is illustrative: measure end-to-end delivery and completeness in the acceptance test.

Latency per delivery channel

Average log-transport latency, in seconds — lower is faster.

  • Splunk HEC12 s
  • Kafka streaming1 s
  • Syslog TLS3 s
  • S3 object push45 s
  • SIEM pull API180 s

Takeaway: push mechanisms (Splunk HEC, Kafka) ingest in under 15 seconds; API polling incurs batch delays and rate limiting (HTTP 429).

Log format field mapper

CEF:0|Imperva|Incapsula|1.0|20001|SQL Injection Attempt|7|cs12=BLOCK cs17=CVE-2023-1234 fileType=SQLi filePermission=Rule_1092 c-ip=198.51.100.45 cn1=403 cs-sessionid=sess_8893412a

Mapped vendor extension fields

  • cs12 / cs-responseactionFinal mitigation decision enforced (PASSED, BLOCK, CAPTCHA).
  • cs17 / cs-cveCVE correlated by Threat Research.
  • fileType / filePermissionAttack classification (SQLi, XSS) and triggered signature ID.
  • c-ip / cn1Source client IP and HTTP status code returned.

Hybrid cryptographic envelope

Edge PoPs compress and symmetrically encrypt raw logs, then wrap the payload key with your public RSA key.

  1. Payload compressionRaw logs compressed into micro-batches at the edge PoP.
  2. AES-256 symmetric encryptionEach batch encrypted with a generated symmetric session key.
  3. RSA key wrappingThe session key encrypted with the enterprise-provided RSA public key.
  4. MD5 integrity checkFile header carries an MD5 checksum to detect tampering.

3 SIEM and security data lakes

Choose the investigation platform and verify its supported connector, data mapping and access. The steps below are configuration examples, not evidence that a connection is already operating.

Microsoft Sentinel integration pipeline

Serverless extraction pipeline: an Azure Function App deployed in the customer's tenant pulls logs from the Imperva SIEM API and normalises them into Log Analytics.

  1. Timer trigger and Key Vault lookupThe Azure Function runs on schedule and retrieves the API credentials and the RSA private key from Azure Key Vault.
  2. API pull and payload decryptionConnects to the Imperva SIEM API over TLS, downloads the compressed log batch and decrypts it in memory.
  3. Log Analytics ingestionStreams the normalised CEF records into the Azure Monitor Ingestion API, targeted at the Log Analytics workspace.
  4. ASIM parser normalisationThe ImpervaWAFCloud parser maps raw CEF fields to the CommonSecurityLog schema for cross-workload hunting.

Technical specifications

Integration pattern
Azure Function App (Python), timer trigger
Data normalisation model
ASIM (CommonSecurityLog table)
Authentication
API ID + key; RSA private key in Key Vault
Telemetry scope
Cloud WAF, bot, ATO, DDoS, audit logs

4 Bidirectional SOAR and automated response

Agree which events can trigger a workflow and which actions need approval. The sample payloads demonstrate a message structure; validate authentication, retries and permitted actions before use.

Incident response playbook simulator

Pick an attack to walk through detection, webhook dispatch, enrichment and enforcement.

  1. Step 1: DetectionAttack Analytics engineAttack Analytics clusters a 45,000 RPS burst across 12 countries into one active L7 DDoS narrative.Engine: Attack Analytics
  2. Step 2: DispatchOutbound webhookThe outbound HTTPS webhook fires with its shared-secret authentication token.Protocol: HTTPS webhook
  3. Step 3: EnrichmentSOAR playbook queryThe Cortex XSOAR playbook queries the Imperva REST API for the most attacked URL paths.Target: SOAR platform
  4. Step 4: EnforcementDynamic policy shiftAn API command shifts the WAF rule from alert-only to an active dynamic JavaScript challenge.Status: mitigated
Outbound webhook payloadTLS 1.3 · shared secret verified
{
  "event_type": "WebsiteDdosStart",
  "account_id": "10023456",
  "site_name": "checkout.enterprise.com",
  "threat_level": "CRITICAL",
  "rps_peak": 45000,
  "mitigation_method": "Dynamic Adaptive Challenge"
}

5 DevSecOps, IaC and CI/CD

Review and test configuration changes before applying them. The generated code is a starting example; confirm provider versions, parameters, credentials and a recovery path.

Terraform HCL generator

Set the parameters; the HCL on the right follows.

imperva/incapsula Terraform provider (v3.39.0)Declarative IaC
resource "incapsula_site_v3" "production_site" {
  name       = "api.enterprise.com"
  type       = "PUBLIC_CLOUD"
  cloud_type = "AWS"
}

resource "incapsula_data_centers_configuration" "dc_config" {
  site_id = incapsula_site_v3.production_site.id

  data_center {
    name       = "primary_origin"
    ip_or_host = "10.0.12.44"
    server {
      ip     = "10.0.12.44"
      active = true
    }
  }
}

resource "incapsula_waf_security_rule" "custom_protection" {
  site_id     = incapsula_site_v3.production_site.id
  rule_action = "api.rule_action.block"
  name        = "Enforce-Security-Policy"
  filter      = "Header.User-Agent == 'BadBotEngine' | Header.Authorization == ''"
}

Managing site creation, SSL certificate validation and rule provisioning through Terraform removes configuration drift from the CI/CD pipeline.

OpenAPI schema sync and positive security

In the deployment pipeline (GitLab CI, GitHub Actions), developers push the updated OpenAPI (Swagger) specification to the Imperva API Security module through its REST API.

  • Enforces valid routes, HTTP methods and parameter types at the edge.
  • Detects shadow APIs: undocumented endpoints that are active.
  • Identifies zombie APIs: deprecated routes still receiving traffic.

RASP in-app workload sensors

Runtime Application Self-Protection (RASP) micro-agents deploy inside the application runtime (JVM, .NET CLR, Node.js, Kubernetes pods) without edge network rules.

  • Monitors memory buffers, file-system access and raw database queries.
  • Neutralises zero-day exploits (deserialisation, SQL injection) in real time.
  • In-thread mitigation, no round trip to the edge.

6 Identity federation, enterprise PKI and two-tier mTLS

Separate administrator sign-in from transport authentication. Verify the selected product’s identity and certificate support, including the two connections in any mutual-TLS design.

Two-tier mTLS flow

Pick a stage of the handshake for the client authentication and header-injection mechanics.

Tier 1: client-to-Imperva mTLSHigh-assurance identity ingress

Designed for mobile banking applications, B2B enterprise APIs and IoT networks. The connecting client establishes a TLS 1.3 mutual handshake with the nearest Imperva edge PoP. The PoP checks the certificate revocation lists (CRLs) and authenticates the client certificate authority.

Injected forwarding header:

X-Imperva-Client-Cert-SAN: SubjectAltName: email:api-client@enterprise.com, CN=MobileAppClientV2

SAML 2.0 identity federation

Federates administrative authentication across Microsoft Entra ID, Okta and ADFS. Attribute assertions map corporate directory security groups to granular role-based access control (RBAC) tiers and to Data Security Fabric Data Level Security (DLS) compliance scopes.

Verify cryptographic support

Confirm protocol versions, certificate handling and supported algorithms for every connection against current vendor documentation. Do not infer a post-quantum feature from a conventional encryption label.

7 Data Security Fabric and the database estate

Database audit integration is a separate product scope from website protection. Confirm engine support, licensing, permissions and export options against the current vendor documentation.

Database scope distribution

Storage categories monitored across agent and agentless architectures.

  • Relational (Oracle, SQL Server)45 %
  • Cloud DBaaS (RDS, Azure SQL)25 %
  • Big data (Snowflake, BigQuery)18 %
  • NoSQL (MongoDB, Cassandra)12 %

Key capability: the DSF Hub sonargd engine runs user and entity behaviour analytics (UEBA) to detect privileged-user anomalies and schema tampering without burdening the SIEM licence.

Database support catalogue

  • Oracle (RAC and Exadata)Agent / agentless
    Monitors local shared-memory IPC and cloud database instances.
  • Microsoft SQL ServerAgent / agentless
    Full audit tracking for on-premise SQL Server and Azure SQL.
  • Amazon RDS and AuroraAgentless gateway
    Ingests CloudWatch audit streams without host software.
  • PostgreSQL and AlloyDBAgent / agentless
    Deep SQL parsing across open-source and enterprise PostgreSQL.
  • SnowflakeAgentless gateway
    Audit collection for cloud enterprise data warehousing.
  • MongoDB and CouchbaseAgentless / agent
    Document-store JSON query monitoring and UEBA analytics.
  • Google BigQueryAgentless gateway
    Serverless data-warehouse audit ingestion through GCP APIs.
  • Apache CassandraAgent gateway
    Distributed NoSQL ring activity tracking.
  • SAP HANAAgent gateway
    In-memory database audit and policy enforcement.
  • Databricks and HadoopAgentless gateway
    Big-data lake query auditing and data-loss prevention.

Kafka streaming broker and business-intelligence egress

Beyond SIEM log shipping, the DSF Hub acts as an enterprise data broker: the built-in rsyslog-kafka engine streams enriched audit records into Apache Kafka or Azure Event Hubs topics, while Tableau and Power BI connect through ODBC/JDBC for multi-year compliance reporting.

Sub-second Kafka egressJSON-formatted database telemetry delivered to Apache Kafka for real-time fraud engines.
ODBC / JDBC connectivityCompliance officers query historical access trails directly from Power BI and Tableau.
Long-term cold vaultPartitioned, compressed audit files exported to S3 or Blob storage for seven-year regulatory mandates (SOX, PCI).

8 Master integration matrix and roadmap

Use the matrix to plan interfaces, directions and formats. Agree acceptance checks and ownership for each rollout phase; sample values are not service commitments.

Architectural integration matrix

DomainTarget systemDirectionProtocol / interfaceData formatArchitectural objective
SIEMSplunk Enterprise / CloudOutboundHTTPS / HEC APIJSON, CEFRaw security event ingestion and Splunk CIM mapping
SIEMMicrosoft SentinelInboundREST API (Azure Function)CEF (ASIM)Automated log retrieval and Defender telemetry correlation
SIEMIBM QRadarOutboundSyslog over TLS (TCP 6514)LEEFThreat-intelligence feed and Sense Analytics offences
SIEMElastic SecurityInboundFilebeat / S3 pluginJSON (ECS)Log storage in Elasticsearch for threat hunting
StorageAmazon S3OutboundS3 REST object APICompressed JSON / CEFEncrypted cold storage and decoupled data-lake feeds
SOARPalo Alto Cortex XSOARBidirectionalREST API / webhooksJSONAutomated IP blocking, session invalidation, triage
SOARSplunk SOAR / ChronicleBidirectionalREST API / webhooksJSONAutomated threat-containment playbooks
IaCHashiCorp TerraformInboundProvider API (imperva/incapsula)HCL / JSON stateDeclarative provisioning of sites, rules and SSL certificates
CI/CDGitLab / GitHub ActionsInboundREST API / OpenAPIJSON / YAMLPositive security sync and shadow-API discovery
WorkloadKubernetes / pod RASPIn-appRASP micro-sensorNative system callsIn-runtime zero-day exploit neutralisation
ITSMServiceNowBidirectionalServiceNow Table APIJSONAutomated SIR incident creation and CMDB sync
ITSMJira Service ManagementOutboundJira REST APIJSONScript authorisation tracking for PCI DSS compliance
IdentityOkta / Entra IDInboundSAML 2.0 / SCIMXML assertionsAdministrative SSO and RBAC role mapping
PKIThales CipherTrustBidirectionalNative registration tokenCrypto objectsDatabase key lifecycle management and tokenisation
PKIGlobalSign CAInboundAutomated ACME / DNSX.509 certificatesEdge SSL/TLS certificate issuance and renewal
SASECato NetworksPeeringRemote port forwardingEncapsulated TCP/IPSecuring private origin resources without public IPs
StreamingApache KafkaOutboundKafka protocol / rsyslogJSON / audit logsHigh-throughput database audit streaming to analytics
BITableau / Power BIInboundODBC / JDBCSQL tabularMulti-year compliance audit reporting

Four-phase implementation

  1. Phase 1Identity and PKI foundation
    • SAML 2.0 SSO federation
    • Two-tier mTLS origin shield
    • GlobalSign ACME SSL setup
    • PQC cryptographic preparation
  2. Phase 2Telemetry and SOC activation
    • Object-storage push pipelines
    • SIEM parsers (ASIM / CIM)
    • Outbound webhooks for SOAR
    • Real-time ChatOps alerts
  3. Phase 3DevSecOps and policy as code
    • Terraform provider deployment
    • OpenAPI schema sync in CI/CD
    • RASP in-app workload sensors
    • Shadow-API auto-discovery
  4. Phase 4DSF hybrid data expansion
    • DSF Hub core infrastructure
    • Cloud agentless gateways
    • On-premise host-agent rollout
    • Kafka sub-second streaming

Source: Thales Cyber Security — Enterprise Security & Data Fabric Ecosystem. Vendor figures as published. ALT-F1 is the Belgian partner for Imperva: we open the account, tune the rules and build these integrations with your teams. The original document is kept in the site repository (docs/imperva/).

Ask how it fits your organisation Web Application Security

Acronyms used here: WAF, DDoS, API, DNS, CDN, SIEM, SOAR, TLS
WAF — Web Application Firewall
A filter that checks requests to your website and blocks suspicious ones before they reach the application.
DDoS — Distributed Denial of Service
An attack that uses many sources to overwhelm a website or service with traffic.
API — Application Programming Interface
An agreed way for one application to request data or actions from another application.
DNS — Domain Name System
Connects a name such as alt-f1.be to the address of the service a visitor needs to reach.
CDN — Content Delivery Network
A network that can keep copies of website content nearer to visitors to deliver it faster.
SIEM — Security Information and Event Management
Collects security logs from different systems so people can search them and connect related events.
SOAR — Security Orchestration, Automation and Response
Links security tools and automates repeatable response steps, such as opening a case or blocking an address.
TLS — Transport Layer Security
Encrypts a connection between systems, such as a browser and a website.

All acronyms and explanations →