Configuring an alert action for Imperva SecureSphere

Configure your Imperva SecureSphere appliance to forward syslog events for firewall policy alerts to QRadar.

About this task

Use the following list to define a message string in the Message field for each event type you want to forward:
Tip: Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters. Paste as a single line in the Custom Format column.
Database alerts (V9.5 and V10 to V13)
LEEF:1.0|Imperva|SecureSphere|${SecureSphereVersion}|${Alert.alertType} ${Alert.immediateAction}|Alert ID=${Alert.dn}|devTimeFormat=[see note]|devTime=${Alert.createTime}|Alert type=${Alert.alertType}|src=${Alert.sourceIp}|usrName=${Event.struct.user.user}|Application name=${Alert.applicationName}|dst=${Event.destInfo.serverIp}|Alert Description=${Alert.description}|Severity=${Alert.severity}|Immediate Action=${Alert.immediateAction}|SecureSphere Version=${SecureSphereVersion}
File server alerts (V9.5 and V10 to V13)
LEEF:1.0|Imperva|SecureSphere|${SecureSphereVersion}|${Alert.alertType} ${Alert.immediateAction}|Alert ID={Alert.dn}|devTimeFormat=[see note]|devTime=${Alert.createTime}|Alert type=${Alert.alertType}|src=${Alert.sourceIp} |usrName=${Event.struct.user.username}|Domain=${Event.struct.user.domain}|Application name=${Alert.applicationName}|dst=${Event.destInfo.serverIp}|Alert Description=${Alert.description}|Severity=${Alert.severity} |Immediate Action=${Alert.immediateAction} |SecureSphere Version=${SecureSphereVersion}
Web application firewall alerts (V9.5 and V10 to V13)
LEEF:1.0|Imperva|SecureSphere|${SecureSphereVersion}|${Alert.alertType} ${Alert.immediateAction}|Alert ID=${Alert.dn}|devTimeFormat=[see note]|devTime=${Alert.createTime}|Alert type=${Alert.alertType}|src=${Alert.sourceIp}|srcPort=$!{Event.sourceInfo.sourcePort}|usrName=${Alert.username}|Application name=${Alert.applicationName}|dst=${Event.destInfo.serverIp}|dstPort=$!{Event.destInfo.serverPort}|Service name=${Alert.serviceName}|Event Description=${Alert.description}|Severity=${Alert.severity}|Simulation Mode=${Alert.simulationMode}|Immediate Action=${Alert.immediateAction}
All alerts (V6.2 and V7 to V13 Release Enterprise Edition)
DeviceType=ImpervaSecuresphere Alert|an=$!{Alert.alertMetadata.alertName}|at=SecuresphereAlert|sp=$!{Event.sourceInfo.sourcePort}|s=$!{Event.sourceInfo.sourceIp}|d=$!{Event.destInfo.serverIp}|dp=$!{Event.destInfo.serverPort}|u=$!{Alert.username}|g=$!{Alert.serverGroupName}|ad=$!{Alert.description}
Tip: The devTimeFormat parameter does not include a value because you can configure the time format on the SecureSphere appliance. Review the time format of your SecureSphere appliance and specify the appropriate time format.

Procedure

  1. Log in to SecureSphere by using administrative privileges.
  2. Click the Policies tab.
  3. Click the Action Sets tab.
  4. Generate events for each alert that the SecureSphere device generates:
    1. Click New to create a new action set for an alert.
    2. Move the action to the Selected Actions list.
    3. Expand the System Log action group.
    4. In the Action Name field, type a name for your alert action.
    5. From the Apply to event type list, select Any event type.
    6. In the Syslog host field, type the IP address of the QRadar appliance to which you want to send events.
    7. In the Syslog log level list, select INFO.
    8. In the Message field, define a message string for your event type.
    9. In the Facility field, type syslog.
    10. Select the Run on Every Event check box.
    11. Click Save.
  5. To trigger syslog events, associate each of your firewall policies to an alert action:
    1. From the navigation menu, click Policies > Security > Firewall Policy.
    2. Select the policy that you want to use for the alert action.
    3. Click the Policy tab.
    4. From the Followed Action list, select your new action and configure the parameters.
      Tip: Configure established connections as either blocked, inbound, or outbound. Always allow applicable service ports.
    5. Ensure that your policy is configured as enabled and is applied to the appropriate server groups.
    6. Click Save.