Imperva WAF Capture Guide For Unified aiFObserve

Best Capture Source

Use Imperva Cloud WAF log integration or SIEM export in CEF, JSON, or another structured format. CEF is supported by the converter.

Basic Logging

• event timestamp
• request ID or event ID
• source/client IP
• destination/origin IP or host
• request method
• URL or request path
• response status
• action
• rule ID or policy ID
• attack type or violation category
• severity
• user agent
• bytes in and bytes out, if available

Extended Logging

• account/site/application identifiers
• data center or region
• country/geolocation
• incident ID
• matched parameter, matched value, or signature detail, sanitized as needed
• bot, DDoS, account takeover, and API security labels
• request headers selected for identity and tenant evidence
• response size and request size
• origin server or protected application name

User And App Identity

• identity headers from upstream SSO/API gateway
• site/application name
• host and URI
• account ID
• user agent

Do not log raw credentials, tokens, or full authorization headers.

AI Provider And Location Evidence

Keep site/application name, host, origin, region/data center, and client country. These fields make compliance evidence stronger.

Source

• Imperva Cloud Application Security Log Integration