We've reorganized our documentation navigation structure to align directly with your operational workflows. See the release notes and the walkthrough video for more information.

Collect Imperva WAF logs

Supported in:

Google secops SIEM

This document explains how to collect Imperva WAF logs by setting up a Google Security Operations feed using the Third Party API or Amazon S3.

Imperva WAF is a cloud-based web application firewall that protects websites and applications from web-based attacks, including SQL injection, cross-site scripting (XSS), and DDoS threats. Imperva WAF analyzes incoming HTTP/HTTPS traffic in real time, applying security rules and bot mitigation policies to block malicious requests before they reach the origin server.

Collection method differences

The Imperva WAF integration with Google SecOps supports the following methods for log ingestion:

API collection: Google SecOps pulls the logs directly from the Imperva API. This is a direct connection, it only supports the IMPERVA_WAF log type, and it only collects audit logs, as described in Imperva Audit Trail. Google SecOps queries the Imperva Audit Trail API every 24 hours.
Amazon S3 V2 bucket collection: Imperva WAF pushes logs into a designated Amazon S3 bucket, and Google SecOps then pulls the logs from this bucket. This method collects the security events and access logs generated by the Cloud WAF, as described in Imperva log integration. Because the bucket can receive logs from many sources, this method also supports other Imperva log types, provided you configure those logs to be pushed to the bucket explicitly.

Before you begin

Make sure you have the following prerequisites:

A Google SecOps instance
Privileged access to the Imperva Cloud Security Console (my.imperva.com)
An Imperva account administrator, to create an API key for another user. A user without administrator permissions can create an API key only for their own account.
For the Amazon S3 method: privileged access to AWS (S3, IAM)

Configure Imperva WAF API access

The API collection method authenticates against api.imperva.com with an Imperva API ID and API Key. Generate these credentials in the Imperva Cloud Security Console.

Generate API credentials

Sign in to the Imperva Cloud Security Console at my.imperva.com.
On the top menu bar, click Account > Account Management.
On the sidebar, click User Management > Users.
Locate the user that the feed uses, click the ellipsis in the Actions column, and then click Edit.
Click the API keys tab.
Click Add API key. Add a name and a description that identify what the key is used for.
Copy and save the following values from the popup window:
- API ID: your unique API identifier (for example, 12345).
- API Key: your API key (for example, abcdef-123456-ghijkl-789012).
Note: After you close the popup window, you can't retrieve the API key again. You can only regenerate it.

Alternatively, a user without administrator permissions can generate a key for their own account. On the top menu bar, click Account > My Profile, and then, under API keys, click Add API Key.

Configure a feed in Google SecOps to ingest Imperva WAF logs

Go to SIEM Settings > Feeds.
Click Add New Feed.
On the next page, click Configure a single feed.
In the Feed name field, enter a name for the feed (for example, Imperva WAF Logs).
Select Third Party API as the Source type.
Select Imperva as the Log type.
Click Next.
Specify values for the following input parameters:
- Authentication HTTP header: Enter the authentication credentials in the following format:
```
x-API-Id:your-api-id-value
x-API-Key:your-api-key-value
```
  Each credential must be on a separate line in key:value format.
  
  Enter the header names exactly as shown. The Imperva Audit Trail API accepts the API ID and API Key only as the x-API-Id and x-API-Key HTTP headers.
- Asset namespace: The asset namespace.
- Ingestion labels: The label to be applied to the events from this feed.
Click Next.
Review your new feed configuration in the Finalize screen, and then click Submit.

After setup, the feed retrieves Imperva Audit Trail events, which record the actions performed in your account by account users, system processes, and Imperva administrators. To collect Cloud WAF security events and access logs, use the Amazon S3 method described in the following section.

Collect Imperva WAF logs using Amazon S3

Configure AWS IAM and S3

Create an Amazon S3 bucket following this user guide: Creating a bucket
Save the bucket Name and Region for later use.
Create a User following this user guide: Creating an IAM user.
Select the created User.
Select the Security credentials tab.
Click Create Access Key in the Access Keys section.
Select Third-party service as the Use case.
Click Next.
Optional: Add a description tag.
Click Create access key.
Click Download .csv file and save the Access Key and Secret Access Key for later use.
Click Done.
Select the Permissions tab.
Click Add permissions in the Permissions policies section.
Select Add permissions.
Select Attach policies directly.
Search for and select the AmazonS3FullAccess policy.
Click Next.
Click Add permissions.

Configure Imperva WAF Amazon S3 connection

Sign in to the Imperva Cloud Security Console at my.imperva.com with a privileged account.
On the top menu bar, click Account > Account Management.
On the sidebar, click SIEM Logs > Log Configuration.
In the Connections table, click Add connection.
Optional: Select a SIEM vendor. Google SecOps isn't offered as a SIEM vendor, so skip this step and select the delivery method instead.

Note: If you select a SIEM vendor, Imperva only displays the delivery methods that the vendor supports.
Select Amazon S3 as the delivery method.
Provide the following configuration details:
- Access key: the access key of the IAM user that you created.
- Secret key: the secret access key of the IAM user that you created.
- Path: the bucket path, in the <bucket-name>/<folder> format (for example, imperva-waf-logs/logs).
Click Test connection to run a full test cycle in which a test file is transferred to the folder that you specified.
Click Add log type, and then select the Cloud WAF service.
Provide the following configuration details:
- Configuration name: enter a name that is unique within your account.
- Select log types: Imperva provides Cloud WAF security logs and access logs together.
- Format: select CEF. The parser also reads LEEF, but it doesn't read W3C.
- Compress logs: clear this option. Imperva compresses log files by default, and the parser can't decompress them.
- Encryption: leave encryption disabled. The parser can't decrypt encrypted log files.
- State: set to Enabled.
Save the log type configuration.

Configure a feed in Google SecOps to ingest Imperva WAF logs from Amazon S3 V2

Go to SIEM Settings > Feeds.
Click Add New Feed.
In the Feed name field, enter a name for the feed (for example, Imperva WAF Logs).
Select Amazon S3 V2 as the Source type.
Select Imperva as the Log type.
Click Next.
Specify values for the following input parameters:
- S3 URI: the bucket URI.
```
s3://your-log-bucket-name/
```
  Replace your-log-bucket-name with the actual name of the bucket.
- Source deletion options: Select the deletion option according to your preference.
  
  Note: If you select the Delete transferred files or Delete transferred files and empty directories option, make sure that you granted appropriate permissions to the service account.
- Maximum File Age: Include files modified in the last number of days. Default is 180 days.
- Access Key ID: User access key with access to the S3 bucket.
- Secret Access Key: User secret key with access to the S3 bucket.
- Asset namespace: The asset namespace.
- Ingestion labels: The label to be applied to the events from this feed.
Click Next.
Review your new feed configuration in the Finalize screen, and then click Submit.

UDM mapping table

Log Field	UDM Mapping	Logic
`csv_message`	`about`	Mapped: `CEF:` → `about`
`csv_message`	`about.asset.ip`	Mapped: `CEF:` → `kv.dvc`
`kv.dvc`	`about.asset.ip`	Merged
`csv_message`	`about.ip`	Mapped: `CEF:` → `kv.dvc`
`kv.dvc`	`about.ip`	Merged
`additional_devicedata`	`additional.fields`	Merged
`additional_factors_label`	`additional.fields`	Merged
`additional_severity`	`additional.fields`	Merged
`cn1_value_label`	`additional.fields`	Merged
`csv_message`	`additional.fields`	Mapped: `CEF:` → `additional_severity`, `CEF:` → `cn1_value_label`
`random_id_label`	`additional.fields`	Merged
`site_id_label`	`additional.fields`	Merged
`site_name_label`	`additional.fields`	Merged
`zuid_labels`	`additional.fields`	Merged
`csv_message`	`extensions.vulns.vulnerabilities`	Mapped: `CEF:` → `vuln`
`message`	`extensions.vulns.vulnerabilities`	Mapped: `LEEF:` → `vuln`
`vuln`	`extensions.vulns.vulnerabilities`	Merged
`message`	`intermediary`	Mapped: `LEEF:` → `intermediary`
`forwardedIp`	`intermediary.asset.hostname`	Directly mapped
`forwardedIp`	`intermediary.asset.ip`	Merged
`xff`	`intermediary.asset.ip`	Merged
`forwardedIp`	`intermediary.hostname`	Directly mapped
`forwardedIp`	`intermediary.ip`	Merged
`log.mx-ip`	`intermediary.ip`	Merged
`xff`	`intermediary.ip`	Merged
`popName`	`intermediary.location.country_or_region`	Renamed/mapped
`csv.description`	`metadata.description`	Mapped when `csv_message` =~ `CEF:`
`log.message`	`metadata.description`	Mapped when `json_array` != ``
`deviceReceiptTime`	`metadata.event_timestamp`	Parsed as `MMM dd HH:mm:ss`
`log.@timestamp`	`metadata.event_timestamp`	Parsed as `UNIX_MS`
`log.time`	`metadata.event_timestamp`	Parsed as `UNIX`
`log_timestamp`	`metadata.event_timestamp`	Parsed as `UNIX_MS`
`start`	`metadata.event_timestamp`	Parsed as `UNIX_MS`
`timestamp`	`metadata.event_timestamp`	Parsed as `MMM dd yyyy HH:mm:ss`
`csv_message`	`metadata.event_type`	Mapped values (6 total, e.g. `CEF:` → `NETWORK_HTTP`, `CEF:` → `SCAN_UNCATEGORIZED`, `CEF:` ...
`has_principal`	`metadata.event_type`	Mapped: `true` → `NETWORK_CONNECTION`
`message`	`metadata.event_type`	Mapped: `LEEF:` → `NETWORK_HTTP`
`principal_present`	`metadata.event_type`	Mapped: `true` → `NETWORK_HTTP`, `true` → `NETWORK_CONNECTION`, `true` → `STATUS_UPDATE`
`csv.event_id`	`metadata.product_event_type`	Directly mapped
`log.type_key`	`metadata.product_event_type`	Mapped when `json_array` != ``
`log.imperva.ids.account_id`	`metadata.product_log_id`	Mapped when `json_array` != ``
`log.header.product-version`	`metadata.product_version`	Mapped when `json_array` != ``
`product_version`	`metadata.product_version`	Mapped when `csv_message` =~ `CEF:`
`csv_message`	`network.application_protocol`	Mapped: `CEF:` → `HTTPS`, `CEF:` → `HTTP`
`proto`	`network.application_protocol`	Renamed/mapped
`deviceExternalId`	`network.community_id`	Renamed/mapped
`message`	`network.direction`	Mapped: `LEEF:` → `INBOUND`
`kv.cs8`	`network.http.method`	Mapped when `csv_message` =~ `CEF:`
`kv.requestMethod`	`network.http.method`	Renamed/mapped
`log.http.request.method`	`network.http.method`	Mapped when `json_array` != ``
`requestMethod`	`network.http.method`	Renamed/mapped
`http_user_agent`	`network.http.parsed_user_agent`	Renamed/mapped
`log.http.request.user-agent`	`network.http.parsed_user_agent`	Renamed/mapped
`log.imperva.abp.headers_referer`	`network.http.referral_url`	Mapped when `json_array` != ``
`log.imperva.referrer`	`network.http.referral_url`	Mapped when `json_array` != ``
`ref`	`network.http.referral_url`	Renamed/mapped
`cn1`	`network.http.response_code`	Renamed/mapped
`cn1_value`	`network.http.response_code`	Renamed/mapped
`kv.flexString1`	`network.http.response_code`	Renamed/mapped
`kv.flexString2`	`network.http.response_code`	Renamed/mapped
`log.http.response.code`	`network.http.response_code`	Renamed/mapped
`kv.requestClientApplication`	`network.http.user_agent`	Mapped when `csv_message` =~ `CEF:`
`log.http.request.user-agent`	`network.http.user_agent`	Mapped when `json_array` != ``
`requestClientApplication`	`network.http.user_agent`	Renamed/mapped
`user_agent`	`network.http.user_agent`	Renamed/mapped
`kv.proto`	`network.ip_protocol`	Renamed/mapped
`log.protocol`	`network.ip_protocol`	Mapped when `json_array` != ``
`message`	`network.ip_protocol`	Mapped: `LEEF:` → `TCP`
`kv.Customer`	`network.organization_name`	Mapped when `csv_message` =~ `CEF:`
`csv_message`	`network.received_bytes`	Mapped: `CEF:` → `uinteger`
`in`	`network.received_bytes`	Renamed/mapped
`kv.in`	`network.received_bytes`	Mapped when `csv_message` =~ `CEF:`
`message`	`network.received_bytes`	Mapped: `LEEF:` → `uinteger`
`log.http.request.body.bytes`	`network.sent_bytes`	Renamed/mapped
`fileId`	`network.session_id`	Renamed/mapped
`log.http.session-id`	`network.session_id`	Mapped when `json_array` != ``
`log.imperva.abp.customer_request_id`	`network.session_id`	Mapped when `json_array` != ``
`log.imperva.request_session_id`	`network.session_id`	Mapped when `json_array` != ``
`tls_cipher`	`network.tls.cipher`	Renamed/mapped
`tls_version`	`network.tls.version`	Renamed/mapped
`cs6`	`principal.application`	Renamed/mapped
`log.client.domain`	`principal.asset.hostname`	Mapped when `json_array` != ``
`csv_message`	`principal.asset.ip`	Mapped: `CEF:` → `kvsrc`
`kvsrc`	`principal.asset.ip`	Merged
`log.client.ip`	`principal.asset.ip`	Merged
`log.source-ip`	`principal.asset.ip`	Merged
`message`	`principal.asset.ip`	Mapped: `LEEF:` → `src`
`src`	`principal.asset.ip`	Merged
`log.client.domain`	`principal.hostname`	Mapped when `json_array` != ``
`csv_message`	`principal.ip`	Mapped: `CEF:` → `kvsrc`
`kvsrc`	`principal.ip`	Merged
`log.client.ip`	`principal.ip`	Merged
`log.source-ip`	`principal.ip`	Merged
`message`	`principal.ip`	Mapped: `LEEF:` → `src`
`src`	`principal.ip`	Merged
`request_type_label`	`principal.labels`	Merged
`cicode`	`principal.location.city`	Renamed/mapped
`kv.cicode`	`principal.location.city`	Mapped when `csv_message` =~ `CEF:`
`calCountryOrRegion`	`principal.location.country_or_region`	Renamed/mapped
`kv.ccode`	`principal.location.country_or_region`	Mapped when `csv_message` =~ `CEF:`
`log.client.geo.country_iso_code`	`principal.location.country_or_region`	Mapped when `json_array` != ``
`log.imperva.country`	`principal.location.country_or_region`	Mapped when `json_array` != ``
`cs7`	`principal.location.region_latitude`	Renamed/mapped
`csv_message`	`principal.location.region_latitude`	Mapped: `CEF:` → `float`
`kv.cs7`	`principal.location.region_latitude`	Renamed/mapped
`message`	`principal.location.region_latitude`	Mapped: `LEEF:` → `float`
`cs8`	`principal.location.region_longitude`	Renamed/mapped
`csv_message`	`principal.location.region_longitude`	Mapped: `CEF:` → `float`
`kv.cs8`	`principal.location.region_longitude`	Renamed/mapped
`message`	`principal.location.region_longitude`	Mapped: `LEEF:` → `float`
`log.source-port`	`principal.port`	Renamed/mapped
`port`	`principal.port`	Mapped when `csv_message` =~ `CEF:`
`srcPort`	`principal.port`	Renamed/mapped
`log.imperva.path`	`principal.process.file.full_path`	Mapped when `json_array` != ``
`log.imperva.abp.pid`	`principal.process.pid`	Mapped when `json_array` != ``
`header_map_label`	`principal.resource.attribute.labels`	Merged
`log.user.email`	`principal.user.email_addresses`	Merged
`log.user_details`	`principal.user.email_addresses`	Merged
`log.event.provider`	`principal.user.user_display_name`	Mapped when `json_array` != ``
`log.http.user-name`	`principal.user.userid`	Mapped when `json_array` != ``
`log.user_id`	`principal.user.userid`	Mapped when `json_array` != ``
`user_name`	`principal.user.userid`	Mapped when `json_array` != ``
`csv_message`	`security_result`	Mapped: `CEF:` → `security_result`
`message`	`security_result`	Mapped: `LEEF:` → `security_result`
`_action`	`security_result.action`	Merged
`action`	`security_result.action`	Merged
`csv_message`	`security_result.action`	Mapped: `CEF:` → `action`
`message`	`security_result.action`	Mapped: `LEEF:` → `_action`
`security_action`	`security_result.action`	Merged
`cat`	`security_result.action_details`	Directly mapped
`kv.act`	`security_result.action_details`	Directly mapped
`kv.cat`	`security_result.action_details`	Directly mapped
`log.action`	`security_result.action_details`	Directly mapped
`csv_message`	`security_result.category_details`	Mapped: `CEF:` → `kv.cat`
`dproc`	`security_result.category_details`	Merged
`kv.cat`	`security_result.category_details`	Merged
`message`	`security_result.category_details`	Mapped: `LEEF:` → `dproc`
`log.description`	`security_result.description`	Directly mapped
`log.imperva.abp.tls_fingerprint`	`security_result.description`	Directly mapped
`log.imperva.risk_reason`	`security_result.description`	Directly mapped
`accept_encoding_label`	`security_result.detection_fields`	Merged
`accept_language_label`	`security_result.detection_fields`	Merged
`apollo_rule`	`security_result.detection_fields`	Merged
`behavior`	`security_result.detection_fields`	Merged
`class_label`	`security_result.detection_fields`	Merged
`cn1_field`	`security_result.detection_fields`	Merged
`cn2_field`	`security_result.detection_fields`	Merged
`condition_id`	`security_result.detection_fields`	Merged
`condition_name`	`security_result.detection_fields`	Merged
`cs10Label_field`	`security_result.detection_fields`	Merged
`cs11_field`	`security_result.detection_fields`	Merged
`cs12Label_field`	`security_result.detection_fields`	Merged
`cs1_field`	`security_result.detection_fields`	Merged
`cs2_field`	`security_result.detection_fields`	Merged
`cs3_field`	`security_result.detection_fields`	Merged
`cs4_field`	`security_result.detection_fields`	Merged
`cs5Label_field`	`security_result.detection_fields`	Merged
`cs5_field`	`security_result.detection_fields`	Merged
`cs6_field`	`security_result.detection_fields`	Merged
`cs8_label`	`security_result.detection_fields`	Merged
`cs97Label_field`	`security_result.detection_fields`	Merged
`cs98_field`	`security_result.detection_fields`	Merged
`cs99_field`	`security_result.detection_fields`	Merged
`cs9_field`	`security_result.detection_fields`	Merged
`cs9_label`	`security_result.detection_fields`	Merged
`csv_message`	`security_result.detection_fields`	Mapped values (30 total, e.g. `CEF:` → `flexString1_field`, `CEF:` → `cs1_field`, `CEF:` → `...
`detection_fields_domain_risk`	`security_result.detection_fields`	Merged
`detection_fields_event_action`	`security_result.detection_fields`	Merged
`detection_fields_event_context`	`security_result.detection_fields`	Merged
`detection_fields_significant_domain_name`	`security_result.detection_fields`	Merged
`detection_fields_violated_directive`	`security_result.detection_fields`	Merged
`deviceExternalId_label`	`security_result.detection_fields`	Merged
`deviceFacility_field`	`security_result.detection_fields`	Merged
`dproc_label`	`security_result.detection_fields`	Merged
`end_label`	`security_result.detection_fields`	Merged
`filePermission_field`	`security_result.detection_fields`	Merged
`fileType_field`	`security_result.detection_fields`	Merged
`flexNumber1_field`	`security_result.detection_fields`	Merged
`flexString1_field`	`security_result.detection_fields`	Merged
`flexString2_field`	`security_result.detection_fields`	Merged
`fname_field`	`security_result.detection_fields`	Merged
`gateway_name_label`	`security_result.detection_fields`	Merged
`headers_connection_label`	`security_result.detection_fields`	Merged
`hsig`	`security_result.detection_fields`	Merged
`log_imperva_classified_client_field`	`security_result.detection_fields`	Merged
`log_imperva_credentials_leaked_field`	`security_result.detection_fields`	Merged
`log_imperva_declared_client_field`	`security_result.detection_fields`	Merged
`log_imperva_failed_logins_last_24h_field`	`security_result.detection_fields`	Merged
`log_imperva_fingerprint_field`	`security_result.detection_fields`	Merged
`log_imperva_successful_logins_last_24h_field`	`security_result.detection_fields`	Merged
`message`	`security_result.detection_fields`	Mapped values (11 total, e.g. `LEEF:` → `siteid_label`, `LEEF:` → `start_label`, `LEEF:` → `...
`policy_id`	`security_result.detection_fields`	Merged
`policy_label`	`security_result.detection_fields`	Merged
`policy_name`	`security_result.detection_fields`	Merged
`postbody_field`	`security_result.detection_fields`	Merged
`postbody_label`	`security_result.detection_fields`	Merged
`request_user_label`	`security_result.detection_fields`	Merged
`selector`	`security_result.detection_fields`	Merged
`selector_derived_id`	`security_result.detection_fields`	Merged
`siteTag_field`	`security_result.detection_fields`	Merged
`siteid_label`	`security_result.detection_fields`	Merged
`start_label`	`security_result.detection_fields`	Merged
`tag_label`	`security_result.detection_fields`	Merged
`triggered_condition_id`	`security_result.detection_fields`	Merged
`triggered_condition_name`	`security_result.detection_fields`	Merged
`violation`	`security_result.detection_fields`	Merged
`violation_id_label`	`security_result.detection_fields`	Merged
`violation_type_label`	`security_result.detection_fields`	Merged
`cs9`	`security_result.rule_name`	Directly mapped
`kv.cs9`	`security_result.rule_name`	Directly mapped
`fileType`	`security_result.rule_type`	Mapped when `message` =~ `LEEF:`
`kv.fileType`	`security_result.rule_type`	Directly mapped
`csv_message`	`security_result.severity`	Mapped: `CEF:` → `HIGH`, `CEF:` → `MEDIUM`, `CEF:` → `LOW`, `CEF:` → `UNKNOWN_SEVERITY`
`log.severity`	`security_result.severity`	Directly mapped
`severity`	`security_result.severity`	Mapped: `High` → `HIGH`, `Medium` → `MEDIUM`, `Low` → `LOW`, `Unknown` → `UNKNOWN_SEVERITY`
`sevs`	`security_result.severity`	Mapped: `"error", "warning"` → `HIGH`, `critical` → `CRITICAL`, `"medium","notice"` → `MED...
`log.imperva.risk_level`	`security_result.severity_details`	Directly mapped
`severity`	`security_result.threat_id`	Directly mapped
`description`	`security_result.threat_name`	Directly mapped
`log.application-name`	`target.application`	Mapped when `json_array` != ``
`kv.dhost`	`target.asset.hostname`	Mapped when `csv_message` =~ `CEF:`
`kv.sourceServiceName`	`target.asset.hostname`	Mapped when `csv_message` =~ `CEF:`
`log.server.domain`	`target.asset.hostname`	Mapped when `json_array` != ``
`csv_message`	`target.asset.ip`	Mapped: `CEF:` → `kv.dst`, `CEF:` → `kv.sip`
`dst`	`target.asset.ip`	Merged
`kv.dst`	`target.asset.ip`	Merged
`kv.sip`	`target.asset.ip`	Merged
`log.dest-ip`	`target.asset.ip`	Merged
`message`	`target.asset.ip`	Mapped: `LEEF:` → `dst`
`kv.dhost`	`target.hostname`	Mapped when `csv_message` =~ `CEF:`
`kv.sourceServiceName`	`target.hostname`	Mapped when `csv_message` =~ `CEF:`
`log.server.domain`	`target.hostname`	Mapped when `json_array` != ``
`sourceServiceName`	`target.hostname`	Renamed/mapped
`csv_message`	`target.ip`	Mapped: `CEF:` → `kv.dst`, `CEF:` → `kv.sip`
`dst`	`target.ip`	Merged
`kv.dst`	`target.ip`	Merged
`kv.sip`	`target.ip`	Merged
`log.dest-ip`	`target.ip`	Merged
`message`	`target.ip`	Mapped: `LEEF:` → `dst`
`log.server.geo.name`	`target.location.name`	Mapped when `json_array` != ``
`dstPort`	`target.port`	Renamed/mapped
`kv.cpt`	`target.port`	Renamed/mapped
`kv.dpt`	`target.port`	Renamed/mapped
`log.dest-port`	`target.port`	Renamed/mapped
`kv.deviceProcessName`	`target.process.file.full_path`	Mapped when `csv_message` =~ `CEF:`
`log.url.path`	`target.process.file.full_path`	Mapped when `json_array` != ``
`header_map_label`	`target.resource.attribute.labels`	Merged
`server_group_label`	`target.resource.attribute.labels`	Merged
`server_group_simulation_mode_label`	`target.resource.attribute.labels`	Merged
`service_label`	`target.resource.attribute.labels`	Merged
`log.resource_id`	`target.resource.id`	Mapped when `json_array` != ``
`log.context_key`	`target.resource.name`	Mapped when `json_array` != ``
`log.imperva.audit_trail.resource_name`	`target.resource.name`	Mapped when `json_array` != ``
`kv.fileId`	`target.resource.product_object_id`	Mapped when `csv_message` =~ `CEF:`
`log.imperva.abp.token_id`	`target.resource.product_object_id`	Mapped when `json_array` != ``
`log.resource_type_key`	`target.resource.type`	Mapped when `json_array` != ``
`kv.request`	`target.url`	Renamed/mapped
`url`	`target.url`	Renamed/mapped
`Customer`	`target.user.user_display_name`	Renamed/mapped
`log.imperva.ids.account_name`	`target.user.user_display_name`	Mapped when `json_array` != ``
`kv.duser`	`target.user.userid`	Renamed/mapped
`kv.suid`	`target.user.userid`	Mapped when `csv_message` =~ `CEF:`
`log.account_id`	`target.user.userid`	Mapped when `json_array` != ``
`suid`	`target.user.userid`	Renamed/mapped
N/A	`metadata.event_type`	Constant: `NETWORK_HTTP`
N/A	`network.direction`	Constant: `INBOUND`
N/A	`network.ip_protocol`	Constant: `TCP`
N/A	`security_result.severity`	Constant: `HIGH`

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.