Imperva WAF
Network Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Imperva WAF connector integrates with Imperva Cloud Application Security (Cloud WAF) to synchronize protected websites, their domains, WAF policies, custom/rate rules, policy-to-site coverage, and security-activity alerts into Brinqa. It is categorized as a Network Security connector.
Data retrieved from Imperva WAF
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Site | Yes | Site |
| Domain | Yes | Site |
| Policy | Yes | Policy |
| Rule | Yes | Rule |
Model relationships
For detailed steps on how to view the data retrieved from Imperva WAF in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Imperva WAF from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | Yes | https://api.imperva.com | Imperva API URL (e.g. https://api.imperva.com) |
| API ID | Yes | — | Imperva API ID created in the Imperva Cloud Security Console |
| API key | Yes | — | Imperva API key created in the Imperva Cloud Security Console |
| Page size | No | 100 | Maximum number of records to get per API request |
| Parallel requests | No | min(4, CPU cores) | Maximum number of parallel API requests |
| Maximum retries | No | 5 | Maximum number of retry attempts before giving up a request |
| Request timeout (secs) | No | 120 | Maximum seconds allotted before a request will time out |
Authentication
The connector uses API key authentication. Imperva API credentials (an API ID and an API key) are created in the Imperva Cloud Security Console and sent on every request as HTTP headers. There is no token-exchange step.
Request Headers
| Header | Value |
|---|---|
x-API-Id | The Imperva API ID |
x-API-Key | The Imperva API key |
Accept | application/json |
Usage
Every request to the Imperva API includes both credential headers:
x-API-Id: <api-id>
x-API-Key: <api-key>
The caller's tenant (account, and any sub-accounts) is determined by the credentials; no account-specific URL is required.
How to obtain Imperva WAF credentials
Obtain the required credentials (url, apiId, apiKey) from your Imperva WAF administrator or the Imperva WAF admin console, then enter them in the connection settings above.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Site
| Source Field Name | SDM Attribute |
|---|---|
| constant Web Application | CATEGORIES |
SiteResource.acceleration_level | ACCELERATION_LEVEL |
SiteResource.account_id | ACCOUNT_ID |
SiteResource.active | SOURCE_STATUS |
SiteResource.active (active → active, bypass → inactive) | STATUS |
SiteResource.display_name (falls back to domain, then site_id) | NAME |
SiteResource.domain | DOMAIN |
SiteResource.domain | HOSTNAMES |
SiteResource.ips | IP_ADDRESSES |
SiteResource.ips (private subset) | PRIVATE_IP_ADDRESSES |
SiteResource.ips (public subset) | PUBLIC_IP_ADDRESSES |
SiteResource.site_creation_date | SOURCE_CREATED_DATE |
SiteResource.site_id | UID |
SiteResource.status | PROVIDER_STATUS |
| sync timestamp | LAST_CAPTURED |
Domain
| Source Field Name | SDM Attribute |
|---|---|
| constant Domain | CATEGORIES |
DomainResource.arecords | IP_ADDRESSES |
DomainResource.arecords (private subset) | PRIVATE_IP_ADDRESSES |
DomainResource.arecords (public subset) | PUBLIC_IP_ADDRESSES |
DomainResource.cname | CNAME |
DomainResource.creationDate | SOURCE_CREATED_DATE |
DomainResource.domain | DNS_NAMES |
DomainResource.domain (falls back to id) | NAME |
DomainResource.domain (when private) | PRIVATE_DNS_NAMES |
DomainResource.domain (when public) | PUBLIC_DNS_NAMES |
DomainResource.id | UID |
DomainResource.siteId | RELATES_TO |
DomainResource.siteId | SITE_ID |
DomainResource.status | PROVIDER_STATUS |
DomainResource.status → active/inactive | SOURCE_STATUS |
DomainResource.status → active/inactive | STATUS |
| sync timestamp | LAST_CAPTURED |
Policy
| Source Field Name | SDM Attribute |
|---|---|
PolicyResource.accountId | ACCOUNT_ID |
PolicyResource.assetsIds | RELATES_TO |
PolicyResource.description | DESCRIPTION |
PolicyResource.enabled | ENABLED |
PolicyResource.enabled (true → active, false/absent → inactive) | STATUS |
PolicyResource.enabled (true → active, false/absent → inactive) | SOURCE_STATUS |
PolicyResource.id (falls back to policySettings[].policyId, then an MD5 of account + name) | UID |
PolicyResource.name (falls back to UID) | NAME |
PolicyResource.policySettings[] (multi-valued) | POLICY_SETTINGS |
PolicyResource.policyType | POLICY_TYPE |
| sync timestamp | LAST_CAPTURED |
Rule
| Source Field Name | SDM Attribute |
|---|---|
MD5 of site_id + RuleResource.id | UID |
RuleResource.action | ACTION |
RuleResource.context | CONTEXT |
RuleResource.enabled | ENABLED |
RuleResource.enabled (true/absent → active, false → inactive) | STATUS |
RuleResource.filter | FILTER |
RuleResource.id | RULE_ID |
RuleResource.internal_name | INTERNAL_NAME |
RuleResource.interval | INTERVAL |
RuleResource.name (falls back to UID) | NAME |
| same as STATUS | SOURCE_STATUS |
section the rule came from (security / rate) | RULE_CATEGORY |
site's account_id (from site context) | ACCOUNT_ID |
site_id (from site context) | SITE_ID |
site_id (from site context) | RELATES_TO |
| sync timestamp | LAST_CAPTURED |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Site
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
account_id | String | — | Numeric account ID to operate on (includes its sub-accounts). Defaults to the account tied to the API credentials |
pageSize | Integer | 100 | Records per page (page_size, max 100) |
maxRetries | Integer | 5 | Maximum retry attempts per request |
Delta sync
Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
POST /api/prov/v1/sites/list
- The
/api/prov/v1/sites/listendpoint returns HTTP 200 even for logical errors; a non-zeroresin the body fails the sync rather than being treated as an empty result.
Domain
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
caid | String | — | Imperva account/sub-account ID to operate on. Defaults to the account tied to the API credentials |
domain_ids | String | — | Comma-separated domain IDs; expanded to repeated domainIds query params. Only matching domains are returned |
names | String | — | Comma-separated domain names; expanded to repeated names query params. Only matching domains are returned |
site_ids | String | — | Comma-separated website IDs; expanded to repeated siteIds query params. Only domains of those sites returned |
pageSize | Integer | 100 | Records per page (size, max 500) |
maxRetries | Integer | 5 | Maximum retry attempts per request |
Delta sync
Not supported. The connector performs a full sync of Domain on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /site-domain-manager/v3/domains
Policy
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
caid | String | — | Imperva account/sub-account ID to operate on. Defaults to the account tied to the API credentials |
types | String | — | Comma-separated policy types (ACL, WHITELIST, WAF_RULES, FILE_UPLOAD), case-insensitive; repeated types params |
names | String | — | Comma-separated policy names; repeated names params |
policy_ids | String | — | Comma-separated policy IDs; repeated policyIds params |
asset_ids | String | — | Comma-separated website IDs; repeated assetIds params |
sub_acc_ids | String | — | Comma-separated sub-account IDs; repeated subAccIds params |
extended | Boolean | true | Sends extended so policySettings and assetsIds are returned. Set to false to omit them (loses site relations) |
pageSize | Integer | 100 | Records per page (size, max 100) |
maxRetries | Integer | 5 | Maximum retry attempts per request |
Delta sync
Not supported. The connector performs a full sync of Policy on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
GET /policies/v3/policies?extended=true
- The v3 response DTO does not declare a top-level
id; the connector uses the policy id carried onpolicySettings[].policyIdas a fallback, and a deterministic MD5 (account + name) as a last resort. extendeddefaults totruesopolicySettingsandassetsIdsare returned; it is exposed as an operation option and can be set tofalse, but the Policy → Site relation andPOLICY_SETTINGSdepend on those fields, so leaving it enabled is recommended.
Rule
Operation options
| Option | Type | Default | Description |
|---|---|---|---|
pageSize | Integer | 100 | Records per page (page_size, max 100) |
maxRetries | Integer | 5 | Maximum retry attempts per request |
Delta sync
Not supported. The connector performs a full sync of Rule on every run and applies no incremental date filter.
API
- Type: REST endpoint · Endpoint:
POST /api/prov/v1/sites/incapRules/list(per site)
- Only security (
incap_rules) and rate (rate_rules) rules are synced; delivery/AD rules are excluded viainclude_ad_rules=No. - The response groups rules by category (
{"All":[…]},{"Rates":[…]}); the connector flattens the groups. Security rules carry noenabledflag here, so theirSTATUSdefaults toactive. - Rules are fetched per site — sites are enumerated first (
sites/list), then each site's rules are fetched in parallel across sites viaParallelExecutor, bounded byparallelismLevel.UIDis a site-scoped MD5 ofsite_id+rule_id, so rule ids stay unique across sites. - Like
sites/list, this prov-API endpoint can answer HTTP 200 with a non-zeroreson a logical error; a non-zeroresfails the sync rather than being read as an empty (last) page, so a site's rules are never silently dropped.
Changelog
The Imperva WAF connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.0 | Overview The Imperva WAF connector integrates with Imperva Cloud Application Security to synchronize protected sites, their domains, and the security policies and rules applied to them. Category: Network Security Models | N/A |