Imperva Plugin for Threat Exchange

This document explains how to configure the Imperva v1.0.0 plugin in the Cloud Exchange platform. This plugin is used to fetch the IoCs of type IPv4 from the Application > Attack Analytics > Incidents page on the Imperva platform. This plugin does not support sharing of IoCs to the Imperva platform. This plugin supports retraction of IoCs pulled from the Imperva platform.

Prerequisites

To complete this configuration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A URL List on your Netskope tenant.
• A Netskope Cloud Exchange tenant with the Tenant plugin and Threat Exchange plugin already configured.
• Connectivity to the Imperva platform.
• A subscription for Imperva Threat Response Module services.
• Need a user with Manage API Key role to generate an API Key.
• Connectivity to the following host: https://api.imperva.com

Imperva Plugin Support

This plugin is used to fetch the IoCs of type IPv4 from the Application > Attack Analytics > Incidents page on the Imperva platform. This plugin does not support sharing of IoCs to the Imperva platform. This plugin supports retraction of IoCs pulled from the Imperva platform.

IoC Retraction

IoC Retraction (Pull) Indicators will be fetched from Imperva and in the subsequent pull cycles if some indicators are deleted on Imperva then they will be marked as Retracted in Netskope Cloud Exchange.

Mappings

Pull Mappings

Severity Mappings for Pull

Permissions

Users should have the Manage API Key Role to generate API Key.

[
    {
        "id": "db0cfbe0-d8ca-11f0-1f46-8bef9ba73c98",
        "main_sentence": "Illegal Resource Access attack by a single IP from Bulgaria using Go HTTP library HackingTool ",
        "secondary_sentence": "On host \"imperva1.cdsys.io\" ",
        "false_positive": false,
        "events_count": 6,
        "events_blocked_percent": 0,
        "first_event_time": 1765702422735,
        "last_event_time": 1765702621854,
        "severity": "MINOR",
        "severity_explanation": "High risk, High confidence",
        "dominant_attack_country": {
            "country": "Bulgaria",
            "country_code": "BG",
            "dominance": "DOMINANT"
        },
        "dominant_attack_ip": {
            "ip": "195.178.110.158",
            "reputation": [
                "IP reputation Medium risk"
            ],
            "dominance": "STRONGLY_DOMINANT"
        },
        "dominant_attacked_host": {
            "value": "imperva1.cdsys.io",
            "dominance": "STRONGLY_DOMINANT"
        },
        "dominant_attack_tool": {
            "name": "Go HTTP library",
            "type": "Suspicious",
            "dominance": "STRONGLY_DOMINANT"
        },
        "dominant_attack_violation": "Illegal Resource Access",
        "only_custom_rule_based": true,
        "how_common": "SPRAY_AND_PRAY",
        "incident_type": "REGULAR"
    }
]

Performance Matrix

This reading is conducted on a Large Cloud Exchange Stack with these specs by pulling 100k IoCs from Imperva.

User Agent

netskope-ce-6.0.0-cte-imperva-v1.0.0

Workflow

1. Create an API Key on Imperva.
2. Configure the Imperva Plugin.
3. Add a Business Rule for Imperva.
4. Configure Sharing for Imperva.
5. Validate the Imperva plugin.

Watch a Video

Click play to watch a video.

Create API Key on Imperva

1. Log in to Imperva.
2. Go to Account > Account Management from the top right corner.

   

3. Go to User Management > My Profile.

   

4. Scroll down to API Keys and click Add API Key.

   

5. Enter a Name and the API key will expire in time and enable the status. Click Create.

   

6. Copy the API ID and API Key and then click Close.

Configure the Imperva Plugin

1. In Cloud Exchange go to Settings > Plugin Store.
2. Search for and select the Imperva v1.0.0 (CTE) plugin box.

   

2. Enter the Basic Information:
   • Configuration Name: Unique name for the configuration.
   • Sync Interval: Interval to fetch data from this plugin and share data to this plugin from other sources.
   • Aging Criteria: Expiry time of the plugin in days (Default: 90).
   • Override Reputation: Set a value to override the reputation of indicators received from this configuration.
   • Enable SSL Validation: Enable SSL Certificate validation.
   • Use System Proxy: Enable if the proxy is required for communication.

   Note

   It is better to have a larger value for Sync Interval if you want to pull IoCs in large numbers.

   

3. Click Next and enter the Configuration Parameters:
   • Account ID: Unique identifier of your account.
   • API ID: API ID generated from your Imperva instance.
   • API Key: API Key generated from your Imperva instance.
   • Enable Tagging: Enable/Disable tagging functionality.
   • Retraction Interval: Specify the number of days for which IoC retraction should be run for Imperva IoCs. Note that this parameter is applicable only for Netskope CE version 5.1.0 or later, and if IoC(s) Retraction is enabled in your Threat Exchange Settings. Value must be between 1 and 1800.
   • Initial Range: Number of days to pull the data for the initial run. Value must be between 1 and 1800.

5. Click Save.

   

Add a Threat Exchange Business Rule for Imperva Plugin

To share indicators fetched from the Imperva to the Netskope CE, you will need to have a business rule that will filter out the indicators that you want to share. To configure a business rule, follow the below steps:

1. In Threat Exchange go to Business Rules and click Create New Rule.
2. Add the filter according to your requirement in the rule and click Save.

   

Configure Threat Exchange Sharing for Imperva

The Imperva plugin does not support sharing of IoCs, but the IoCs pulled from this plugin can be shared to the Netskope Tenant or other 3rd-party platforms.

To share IoCs from Imperva to Cloud Exchange:

1. In Threat Exchange go to Sharing and click Add Sharing Configuration.
2. Select your Source Configuration (CTE Imperva), a Business Rule, the Destination Configuration (CTE Netskope), and Target.
3. Click Save.

Validate the Imperva Plugin

Validate the Pull

Pulled data will be listed on the Threat IoCs page. You can filter the IoCs pulled from the platform using the filter: sources.source Like “<plugin configuration name>”.

To verify pulled logs on Cloud Exchange, go to Logging and search logs from the Imperva plugin.
Filter: message Like “CTE Imperva”

To verify the data available for pulling on the Imperva platform, log in to Imperva and go to Application > Attack Analytics > Incidents.

To verify the details of a particular incident, click More details.

To verify the Retracted IoCs, check the logs for IoC Retraction. Example: message Like [Retraction]:

You can filter the retracted IoCs from the platform using the filter: sources.source Is equal “<plugin configuration name>” && sources.retracted Is equal true

Validate the Push

Here you can see IoCs were added to the URL list on your Netskope Tenant.

Some of the shared IoCs got marked as retracted, so it was deleted from the list.

Troubleshooting the Imperva Plugin

Unable to pull IoCs from the Imperva platform

After the plugin configuration, if the IoCs are not pulled from the platform, it might be due to one of these reasons:

• No IOCs are available on the platform to pull.
• IoCs are not available for the given configuration parameters (like Initial Range).

What to do: Identity your root cause from above and follow the appropriate steps to resolve the issue.

No IOCs are available on the platform to pull:

Check if the IoCs are available on the platform to pull. If available, check the resolution for the next point.

IoCs are not available for the given time range

If the IoCs are available on the platform to pull, but the plugin has not pulled the IoCs in Cloud Exchange, check the number of days mentioned in the initial range parameter of the plugin configuration. On the Imperva platform, check if you have data for the given time range.