--- title: "Connect Web App Shield to your existing tools" description: "The Imperva integration architecture explained box by box, with the tools that can fill each one — open source included: Wazuh, Grafana, Keycloak, Shuffle, MISP… and the commercial ones." url: https://www.alt-f1.be/en/imperva/integrations/ organization: ALT-F1 SRL, Brussels (VAT BE 0830.560.718) --- # Connect Web App Shield to your existing tools Connect website protection to the tools your team uses for alerts, investigation and access. Choose a group to see its purpose and possible tools. ## Connection overview Read left to right, then top to bottom. Numbers 1–14 match the descriptions below; they identify parts of the system, not fourteen successive steps. Domain lookup finds the website address. This example shows optional content delivery, Web App Shield and application servers. Relevant events go to collection, investigation, agreed response and alerts. Monitoring, storage, configuration and access controls support the service. Domain lookup finds the protected address; it does not carry website requests. Content delivery is optional, and its position depends on your setup. Event handling, service operation and access controls support the website in parallel. Open the full technical drawing (SVG) in a new page: https://www.alt-f1.be/docs/imperva-external-integrations/fig-1.svg ## Read the connection labels - Native: confirm the documented interface for the selected product and version. - Partner: confirm the vendor connector and its supported version. - Adapter: integration code and operating responsibilities must be agreed. - Yours: an existing company system to connect. - Open source. ## Find your tools ### 1. Domain routing — Domain names and validation (Native) Change the records that route visitors and validate domain ownership. **Correct records direct traffic to the intended service.** Confirm registrar access, validation records and a rollback plan before changing DNS. - [Cloudflare](https://www.cloudflare.com/) - [PowerDNS](https://www.powerdns.com/) — open source - [IBM NS1 Connect](https://www.ibm.com/products/ns1-connect) ### 2. Content delivery — Optional delivery network or proxy (Native) Connect an existing content delivery network where the selected topology is supported. **Routing order and visitor-address forwarding affect protection.** Validate the topology, certificates and client-address handling before rollout. - [Cloudflare](https://www.cloudflare.com/) - [Akamai](https://www.akamai.com/) - [Fastly](https://www.fastly.com/) ### 3. Website protection — Inspect website requests (Native) Check requests before they reach the application using the selected Imperva protection features. **The filtering rules and service scope determine what is checked.** Web App Shield is operated by ALT-F1; confirm the selected product and plan. - [Imperva Cloud WAF](https://www.imperva.com/products/web-application-firewall-waf/) - [Thales](https://cpl.thalesgroup.com/) ### 4. Your servers — Restrict direct application access (Yours) Allow the intended protection route to reach the application server while restricting unwanted direct access. **Public filtering can be bypassed if the server remains reachable through an unrestricted alternative path.** Agree firewall or reverse-proxy rules, health checks and any necessary exceptions. - [Caddy](https://caddyserver.com/) — open source - [nginx](https://nginx.org/) — open source - [FortiGate](https://www.fortinet.com/products/next-generation-firewall) ### 5. Collect events — Log collection and approved changes (Adapter) Collect logs, receive notifications and pass approved changes between services. **Small adapters connect documented interfaces to the way your team works.** Agree who runs each adapter, the access it needs and how failures are handled. - [Imperva logs downloader](https://github.com/imperva/incapsula-logs-downloader) — open source - [Fluent Bit](https://fluentbit.io/) — open source - [Vector](https://vector.dev/) — open source - [GitLab issues](https://about.gitlab.com/) — open source ### 6. Investigate events — Security monitoring and investigation (Native) Search security records and relate website events to other systems. **A shared timeline helps the team examine what happened.** Examples include Splunk, Wazuh and OpenSearch. The delivery method depends on the product and connector. - [Wazuh](https://wazuh.com/) — open source - [OpenSearch](https://opensearch.org/) — open source - [Elastic Security](https://www.elastic.co/security) - [Splunk](https://www.splunk.com/) - [Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/data-connectors-reference) - [Sophos XDR](https://docs.sophos.com/fusion/customer/help/en-us/ManageYourProducts/XDRSecOps/Integrations/Products/Imperva/CloudWAF/Setup/index.html) - [Secureworks Taegis](https://docs.taegis.secureworks.com/integration/connectCloud/imperva_cloud_waf/) ### 7. Response steps — Automated response workflows (Partner) Run agreed steps after an alert, such as opening a case or requesting an address block. **Automation needs permissions, approval rules and a record of each action.** Examples include Cortex XSOAR, Shuffle and TheHive. Confirm available connectors and supported actions. - [Shuffle](https://shuffler.io/) — open source - [TheHive](https://strangebee.com/thehive/) — open source - [MISP](https://www.misp-project.org/) — open source - [OpenCTI](https://filigran.io/solutions/open-cti/) — open source - [Cortex XSOAR](https://xsoar.pan.dev/docs/reference/integrations/incapsula) ### 8. Alerts and tickets — Messages, tickets and on-call contact (Adapter) Send relevant events to the people and tools responsible for response. **A useful message identifies the service, event and next action.** Adapters can connect existing ticketing, chat and paging tools; escalation arrangements are agreed. - [GitLab issues](https://about.gitlab.com/) — open source - [Zammad](https://zammad.com/) — open source - [Mattermost](https://mattermost.com/) — open source - [ServiceNow](https://www.servicenow.com/) - [Jira Service Management](https://www.atlassian.com/software/jira/service-management) - [Slack](https://slack.com/) - [PagerDuty](https://www.pagerduty.com/) ### 9. Service health — Traffic metrics and availability (Adapter) Review request counts, blocks, errors and response times alongside service availability. **Measurements help distinguish a protection event from a service fault.** An exporter can supply dashboards. Agree collection intervals and an external availability check. - [Grafana](https://grafana.com/) — open source - [Prometheus](https://prometheus.io/) — open source - [Uptime Kuma](https://uptime.kuma.pet/) — open source - [Datadog](https://www.datadoghq.com/) ### 10. Record storage — Store and review security records (Native) Keep useful records with controlled access and a defined retention purpose. **Storage should support investigation without keeping all identifiable data indefinitely.** Confirm the supported export destination and the purpose-specific retention and deletion arrangements. - [Amazon S3](https://aws.amazon.com/s3/) - [MinIO](https://min.io/) — open source - [Apache Superset](https://superset.apache.org/) — open source - [Power BI](https://www.microsoft.com/power-platform/products/power-bi) ### 11. Configuration — Review and release configuration (Native) Record proposed protection changes, review them and apply the approved version. **History and review make configuration changes easier to explain and reverse.** Use supported automation interfaces with least-privilege credentials and an agreed recovery process. - [GitLab issues](https://about.gitlab.com/) — open source - [Terraform (Imperva provider)](https://registry.terraform.io/providers/imperva/incapsula/latest/docs) - [OpenTofu](https://opentofu.org/) — open source - [Ansible](https://www.ansible.com/) — open source ### 12. Company sign-in — Company accounts and roles (Native) Use company identities, suitable roles and additional sign-in proof for administrators. **Access should follow the person’s current responsibilities.** Confirm supported single sign-on, account removal and emergency-access arrangements. - [Keycloak](https://www.keycloak.org/) — open source - [authentik](https://goauthentik.io/) — open source - [Microsoft Entra ID](https://www.microsoft.com/security/business/identity-access/microsoft-entra-id) - [Okta](https://www.okta.com/) ### 13. Certificates — Manage certificates and private keys (Native) Issue, renew and monitor certificates and decide how private keys are held. **A certificate or key problem can interrupt a connection.** Confirm product support and renewal responsibilities; dedicated key hardware is an option where required. - [Let's Encrypt](https://letsencrypt.org/) — open source - [DigiCert](https://docs.digicert.com/en/trust-lifecycle-manager/integration-guides.html) - [Keyfactor](https://github.com/Keyfactor/imperva-orchestrator) - [Venafi](https://venafi.com/) - [Fortanix DSM (HSM)](https://www.fortanix.com/) ### 14. Access keys — Store passwords and access keys (Yours) Keep integration credentials in an approved encrypted store and control who can use them. **An integration should have only the access needed for its task.** Use your organisation’s supported secret-management approach; agree rotation, recovery and audit records. - [sops + age](https://github.com/getsops/sops) — open source - [OpenBao](https://openbao.org/) — open source - [HashiCorp Vault](https://www.hashicorp.com/products/vault) - [Infisical](https://infisical.com/) — open source ## Plan your setup Tell us which tools you already use and the outcome you need. We reply within one working day. [Get a quote](https://www.alt-f1.be/en/quote.md)