Connect Web App Shield to your existing tools
Connect website protection to the tools your team uses for alerts, investigation and access. Choose a group to see its purpose and possible tools.
Connection overview
Read left to right, then top to bottom. Numbers 1–14 match the descriptions below; they identify parts of the system, not fourteen successive steps.
Scroll sideways to see the full drawing.
Domain lookup finds the protected address; it does not carry website requests. Content delivery is optional, and its position depends on your setup. Event handling, service operation and access controls support the website in parallel.
Read the connection labels
- Native confirm the documented interface for the selected product and version.
- Partner confirm the vendor connector and its supported version.
- Adapter integration code and operating responsibilities must be agreed.
- Yours an existing company system to connect.
- OSS Open source.
Find your tools
- 1
Domain routing
Domain names and validation Native
Change the records that route visitors and validate domain ownership.
Correct records direct traffic to the intended service.
Confirm registrar access, validation records and a rollback plan before changing DNS.
- 2
Content delivery
Optional delivery network or proxy Native
Connect an existing content delivery network where the selected topology is supported.
Routing order and visitor-address forwarding affect protection.
Validate the topology, certificates and client-address handling before rollout.
- 3
Website protection
Inspect website requests Native
Check requests before they reach the application using the selected Imperva protection features.
The filtering rules and service scope determine what is checked.
Web App Shield is operated by ALT-F1; confirm the selected product and plan.
- 4
Your servers
Restrict direct application access Yours
Allow the intended protection route to reach the application server while restricting unwanted direct access.
Public filtering can be bypassed if the server remains reachable through an unrestricted alternative path.
Agree firewall or reverse-proxy rules, health checks and any necessary exceptions.
- 5
Collect events
Log collection and approved changes Adapter
Collect logs, receive notifications and pass approved changes between services.
Small adapters connect documented interfaces to the way your team works.
Agree who runs each adapter, the access it needs and how failures are handled.
- 6
Investigate events
Security monitoring and investigation Native
Search security records and relate website events to other systems.
A shared timeline helps the team examine what happened.
Examples include Splunk, Wazuh and OpenSearch. The delivery method depends on the product and connector.
- 7
Response steps
Automated response workflows Partner
Run agreed steps after an alert, such as opening a case or requesting an address block.
Automation needs permissions, approval rules and a record of each action.
Examples include Cortex XSOAR, Shuffle and TheHive. Confirm available connectors and supported actions.
- 8
Alerts and tickets
Messages, tickets and on-call contact Adapter
Send relevant events to the people and tools responsible for response.
A useful message identifies the service, event and next action.
Adapters can connect existing ticketing, chat and paging tools; escalation arrangements are agreed.
- 9
Service health
Traffic metrics and availability Adapter
Review request counts, blocks, errors and response times alongside service availability.
Measurements help distinguish a protection event from a service fault.
An exporter can supply dashboards. Agree collection intervals and an external availability check.
- 10
Record storage
Store and review security records Native
Keep useful records with controlled access and a defined retention purpose.
Storage should support investigation without keeping all identifiable data indefinitely.
Confirm the supported export destination and the purpose-specific retention and deletion arrangements.
- 11
Configuration
Review and release configuration Native
Record proposed protection changes, review them and apply the approved version.
History and review make configuration changes easier to explain and reverse.
Use supported automation interfaces with least-privilege credentials and an agreed recovery process.
- 12
Company sign-in
Company accounts and roles Native
Use company identities, suitable roles and additional sign-in proof for administrators.
Access should follow the person’s current responsibilities.
Confirm supported single sign-on, account removal and emergency-access arrangements.
- 13
Certificates
Manage certificates and private keys Native
Issue, renew and monitor certificates and decide how private keys are held.
A certificate or key problem can interrupt a connection.
Confirm product support and renewal responsibilities; dedicated key hardware is an option where required.
- 14
Access keys
Store passwords and access keys Yours
Keep integration credentials in an approved encrypted store and control who can use them.
An integration should have only the access needed for its task.
Use your organisation’s supported secret-management approach; agree rotation, recovery and audit records.
Plan your setup
Tell us which tools you already use and the outcome you need. We reply within one working day.
The engineering guide contains interface and configuration examples. Confirm product support, prerequisites and licensing for the version you choose. The technical reference →
Acronyms used here: WAF, DDoS, API, DNS, CDN, SIEM, SOAR, TLS
- WAF — Web Application Firewall
- A filter that checks requests to your website and blocks suspicious ones before they reach the application.
- DDoS — Distributed Denial of Service
- An attack that uses many sources to overwhelm a website or service with traffic.
- API — Application Programming Interface
- An agreed way for one application to request data or actions from another application.
- DNS — Domain Name System
- Connects a name such as alt-f1.be to the address of the service a visitor needs to reach.
- CDN — Content Delivery Network
- A network that can keep copies of website content nearer to visitors to deliver it faster.
- SIEM — Security Information and Event Management
- Collects security logs from different systems so people can search them and connect related events.
- SOAR — Security Orchestration, Automation and Response
- Links security tools and automates repeatable response steps, such as opening a case or blocking an address.
- TLS — Transport Layer Security
- Encrypts a connection between systems, such as a browser and a website.