Integrate imperva logs in wazuh / Integrar logs de imperva en wazuh

[Pablo Viveros]

Integrate imperva logs in wazuh

Dear, does anyone know how to integrate imperva logs in Wazuh? I have searched for information on the internet and they say that there is a way to install imperva in Wazuh, but there is not much information about it. Could someone help me with a step-by-step manual or installation guide?

Kind regards,

Pablo

--------------------------------------------------------------------------------------------------------------------------------------------------

Estimados , alguien sabe como integrar los logs de imperva en Wazuh?, he buscado informacion por internet y dicen que sale la forma en instalar imperva en Wazuh, pero no existe mucha informacion al respecto. Alguien me podria ayudar con algun manual del paso a paso o guia de instalacion ?

Saludos cordiales,

Pablo

[Federico Damian Lo Iacono]

Hi Pablo! Thank you for choosing Wazuh.

There are known cases of integrating Imperva logs with Wazuh. I will study those and research a little more about Imperva and get back with you with as complete a procedure as possible.

I just ask of you a little patience.

Best Regards,
Federico.

[Federico Damian Lo Iacono]

Hi Pablo. Hope to find you well.

I've been reading about shipping logs from Imperva to other applications, and I found several sources regarding this topic. This raised the question: which application are you shipping your logs from?

I've found references for Cloud WAF Log Integration (and its more up-to-date version, Near Real-Time SIEM Log Integration), and Data Risk Analytics SIEM Integration. Do any of these apply to your case? If not, please kindly provide the log source and I'll investigate the correct approach for it.

TIA.

[Jose Campos]

Hi there

You can use this script to pull the logs

https://github.com/imperva/incapsula-logs-downloader

And then use logstash or beats to send your logs to wazuh-elastic.

Regards

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/d315218a-4b02-47aa-be80-b4de432b42b9n%40googlegroups.com.

--

Jose Campos | Cyber Seguridad S.A.
Vía 3 1-01 zona 4, Ed. Campus Tecnológico III Oficina 501, Guatemala 01004

CERT Cyberseg | http://www.first.org/members/teams/cert_cyberseg

jca...@cyberseg.com | Tel. (502) 2360-2700 - 2360-3261

La información contenida en este correo electrónico es confidencial y podrá ser usada únicamente por los destinatarios.