Classification:

attack

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects web application attacks identified and analyzed by Imperva Attack Analytics.

Strategy

This rule monitors Imperva Attack Analytics events ingested from @service:imperva-attack-analysis. Imperva Attack Analytics is a security intelligence service that aggregates and correlates web application attack data across the Imperva network, providing enriched analysis of attack patterns, sources, and targeted assets. Signals are created based on the severity assigned by Imperva — CRITICAL events generate High severity signals, MAJOR events generate Medium, and MINOR events generate Low. Alerts are grouped by the targeted host (@dominant_attacked_host.value) and the attack description (@main_sentence). Alerts where @events_blocked_percent is 100 are excluded, as fully blocked attacks pose no risk of successful exploitation.

Triage and Response

• Review the {{@main_sentence}} attack description to understand the nature and scope of the attack targeting {{@dominant_attacked_host.value}}.
• Examine the Imperva console for the full attack analysis including attack vectors, source IPs, and whether the requests were blocked or permitted to reach the origin server.
• Check application access logs on {{@dominant_attacked_host.value}} for requests matching the attack pattern to determine if any malicious traffic bypassed Imperva and reached the application.
• Review application error logs and backend service logs around the time of the alert for anomalous behavior such as unexpected query patterns, authentication failures, or elevated error rates that may indicate successful exploitation.
• Identify if similar attack patterns have been observed against other hosts to determine whether this is part of a broader campaign targeting the environment.