Skip to content

Imperva SecureSphere

Imperva SecureSphere


Imperva SecureSphere management products deliver superior performance, scalability and unified management capabilities for any size deployment. Whether you’re running on-prem or in AWS, managing a small site or a large number of business units, SecureSphere management solutions give you the visibility and control to minimize administrative overhead and ensure a strong data security posture.

Product Details

Vendor URL: Imperva

Product Type: Data Security Management

Product Tier: Tier II

Integration Method: Syslog

Integration URL: Imperva SecureSphere Management

Parser Details

Log Format: CEF

Expected Normalization Rate: 95-100%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
cs10 metadata.product_log_id
USER_RESOURCE_ACCESS metadata.event_type
IMPERVA metadata.vendor_name
SECURESPHERE metadata.product_name
custom filter metadata.product_version
smb_stage1 additional.smb_stage1
smb_uid additional.smb_uid
smb_host additional.smb_host
src principal.ip
spt principal.port
src principal.asset.ip
duser target.user.userid
dst target.ip
dpt target.port
cs4 target.application
dst target.asset.ip
custom filter observer.hostname
custom filter observer.asset.hostname
cat security_result.category_details
cs7 security_result.summary
custom filter security_result.severity
custom filter security_result.rule_id

Product Event Types

Event UDM Event Classification

Log Sample

Apr 22 09:05:40 hostname1 CEF: 0|Imperva Inc.|SecureSphere|13.6.0|Custom|Custom Violation|Informative|act=None dst= dpt=80 duser=username1 src= spt=80 rt=Apr 22 2022 09:05:40 cat=Alert cs1=Multiple Query Errors cs1Label=Policy cs2=Custom Rule Violation:rule-name Multiple Query Errors,rule-id=-2222111113333 Custom Rule Violation:rule-name=Failed SQL,rule-id=-2222111113333 cs2Label=Metadata cs4=MSSQL cs4Label=ServiceName cs5=MSSQL Default cs5Label=ApplicationName cs6=microsoft jdbc driver for sql server cs6Label=SrcApp cs7=Distributed Multiple Query Errors, Distributed Failed SQL cs7Label=AlertDesc cs8=1686 cs8Label=AggregateInfo cs9=231082 cs9Label=AlertID cs10=1111222233333344444 cs10Label=EventID cs11=hostname2 cs11Label=DatabaseName cs12= cs12Label=OSUser cs13=9f1f4444-f41c-aaaa-2eef-0511 cs13Label=HostName cs14=svs5557cdc cs14Label=Gateway cs15=0 cs15Label=AffectedRows cs16=EXEC BACKUP_UPDATE_RETRY @P0,@P1 cs16Label=RawQuery cs17=2812 cs17Label=Error smb_host=aaa-0000 smb_stage1=111122223333 smb_uid=aaaaaabbbbbbccccccc11111 smb_timezone=EDT

Sample Parsing

metadata.product_log_id = "1111222233333344444"
metadata.event_timestamp = "2022-04-22T13:05:40Z"
metadata.event_type = "USER_RESOURCE_ACCESS"
metadata.vendor_name = "IMPERVA"
metadata.product_name = "SECURESPHERE"
metadata.product_version = "13.6.0"
additional.smb_host = "aaa-0000"
additional.smb_uid = "aaaaaabbbbbbccccccc11111"
additional.smb_stage1 = "111122223333"
principal.ip = ""
principal.port = 80
principal.asset.ip = ""
target.user.userid = "username1"
target.process.command_line = "EXEC BACKUP_UPDATE_RETRY"
target.ip = ""
target.port = 80
target.application = "MSSQL"
target.asset.ip = ""
observer.hostname = "hostname1"
observer.asset.hostname = "hostname1"
security_result.category_details = "Alert"
security_result.summary = "Distributed SCHW Multiple Query Errors, Distributed SCHW Failed SQL"
security_result.severity = "INFORMATIONAL"
security_result.rule_id = "Custom Violation"

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon