Imperva WAF
Telemetry Evidence
These values show how indexed rules identify Imperva WAF telemetry.Kusto
ImpervaWAFCloud
Detection Rules
Kusto #
- Imperva - Abnormal protocol usage source medium: 'Detects abnormal protocol usage.'
T1133,T1190 - Imperva - Critical severity event not blocked source high: 'Detects when critical severity event was not blocked.'
T1133,T1190 - Imperva - Forbidden HTTP request method in request source medium: 'Detects connections with unexpected HTTP request method.'
T1133,T1190 - Imperva - Malicious Client source high: 'Detects connections from known malicious clients.'
T1133,T1190 - Imperva - Malicious user agent source high: 'Detects requests containing known malicious user agent strings.'
T1133,T1190 - Imperva - Multiple user agents from same source source medium: ''Detects suspicious number of user agents from the same IP address.'
T1133,T1190 - Imperva - Possible command injection source high: 'Detects requests with commands in URI.'
T1133,T1190 - Imperva - Request from unexpected countries source high: 'Detects request attempts from unexpected countries.'
T1133,T1190 - Imperva - Request from unexpected IP address to admin panel source high: 'Detects requests from unexpected IP addresses to admin panel.'
T1133,T1190 - Imperva - Request to unexpected destination port source high: 'Detects request attempts to unexpected destination ports.'
T1133,T1190