Imperva WAF Application Security Integration with TEM

Overview

Imperva Web Application Firewall (WAF Application Security) integrates with Threat Exposure Management (TEM) to enhance visibility, reduce exposures, and automate security operations. The integration uses Imperva API credentials to pull site data, assess misconfigurations, and push Indicators of Compromise (IoCs) to WAF Application Security rules.

Supported Capabilities

  1. Indicators - Manages threat intelligence across all integrated security controls, ensuring consistent alignment and protection across the organization.

  2. Security Hygiene - This capability strengthens system security by identifying and correcting misconfigurations. It focuses on making proper configuration changes to fix exposures at their source. These are typically one-time corrections that remain effective unless new misconfigurations occur.

Integrating Imperva WAF with TEM

Step 1 - Generating API Credentials

  1. Log in to the Imperva Dashboard.

  2. Navigate to Account > My Profile.

    Note - Ensure the user has the Administrator Role assigned.

  3. Navigate to the API Keys section and click Add API Key.

  4. In the Add API keys pop-up that appears, enter the following details:

    1. In the Name field, enter a name for the API key.

    2. (Optional) In the Description field, enter a description to identify the purpose of the key.

    3. In the API key will expire in field, set the expiration date for the key.

    4. Ensure the Status toggle is enabled.

  5. Click Create.

    Note - Copy and securely store the API ID and API Key before closing the pop-up. Once the pop-up is closed, the API key cannot be viewed again.

Step 2 - Configuring the TEM Portal

  1. Log in to the TEM portal.

  2. Go to Settings > Integrations > Catalog > Imperva Web Application Firewall.

  3. In the Imperva Web Application Firewall pop-up that appears, navigate to the Connection tab and enter the following details.

    1. In the Connection Name field, enter a name for this connection.

    2. In the API ID field, enter the API ID copied from the Imperva dashboard.

    3. In the API Key field, enter the API key generated from the Imperva dashboard.

    4. (Optional) Enable the Customer Proxy checkbox if the integration traffic must be routed through your organization’s proxy server.

  4. Click Next.

  5. (Optional) In the Connection Preferences section, configure the integration behavior:

    1. Push IOCs – Enable the Select all sites toggle to allow TEM to push indicators to Imperva.

    2. Monitor WAF Misconfigurations – Enable the Select all sites toggle to assess Imperva WAF Application Security settings.

      Note - The Select All sites toggle applies protection across all available sites. Alternatively, specific sites can be selected to apply protection only to the chosen environments.

  6. Click Create.

  7. (Optional) In the Configuration section, enable the Import Indicators created before this integration was set up checkbox to backfill existing indicators into the integration.

  8. Click Connect to establish a connection.