Collect Imperva Audit Trail logs

This document explains how to ingest Imperva Audit Trail logs to Google Security Operations using Amazon S3. Imperva Audit Trail provides comprehensive logging of all administrative actions performed in your Imperva account, including user logins, configuration changes, policy modifications, and system events. This integration lets you send these audit logs to Google SecOps for compliance monitoring and security analysis.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Privileged access to AWS
• Privileged access to Imperva Console

Collect Imperva Audit Trail prerequisites (API credentials)

1. Sign in to the Imperva Consoleat my.imperva.com .
2. Go to Account > Account Management.
3. On the sidebar, click SIEM Logs > Log Configuration.
4. Click Add connection.
5. Select Amazon S3as the delivery method.
6. Configure the connection for Amazon S3:
   • Connection name: Enter a descriptive name (for example, Google SecOps Integration ).
   • Access key: Your S3 access key.
   • Secret key: Your S3 secret key.
   • Path: The bucket path in format <bucket-name>/<folder> (for example, imperva-audit-trail-logs/chronicle ).

Configure AWS S3 bucket and IAM for Google SecOps

1. Create Amazon S3 bucketfollowing this user guide: Creating a bucket .
2. Save bucket Nameand Regionfor future reference (for example, imperva-audit-trail-logs ).
3. Create a Userfollowing this user guide: Creating an IAM user .
4. Select the created User.
5. Select Security credentialstab.
6. Click Create Access Keyin section Access Keys.
7. Select Third-party serviceas Use case.
8. Click Next.
9. Optional: Add a description tag.
10. Click Create access key.
11. Click Download CSV fileto save the Access Keyand Secret Access Keyfor future reference.
12. Click Done.
13. Select Permissionstab.
14. Click Add permissionsin section Permissions policies.
15. Select Add permissions.
16. Select Attach policies directly.
17. Search for AmazonS3FullAccesspolicy.
18. Select the policy.
19. Click Next.
20. Click Add permissions.

Configure the IAM policy and role for S3 uploads

1. In the AWS console, go to IAM > Policies.
2. Click Create policy > JSON tab.

3. Enter the following policy:

     { 
     
    "Version" 
    : 
     
    "2012-10-17" 
    , 
     
    "Statement" 
    : 
     
    [ 
     
    { 
     
    "Sid" 
    : 
     
    "AllowPutObjects" 
    , 
     
    "Effect" 
    : 
     
    "Allow" 
    , 
     
    "Action" 
    : 
     
    "s3:PutObject" 
    , 
     
    "Resource" 
    : 
     
    "arn:aws:s3:::imperva-audit-trail-logs/*" 
     
    }, 
     
    { 
     
    "Sid" 
    : 
     
    "AllowGetObjects" 
    , 
     
    "Effect" 
    : 
     
    "Allow" 
    , 
     
     
    "Action" 
    : 
     
    "s3:GetObject" 
    , 
     
    "Resource" 
    : 
     
    "arn:aws:s3:::imperva-audit-trail-logs/*" 
     
    }, 
     
    { 
     
    "Sid" 
    : 
     
    "AllowListBucket" 
    , 
     
    "Effect" 
    : 
     
    "Allow" 
    , 
     
    "Action" 
    : 
     
    "s3:ListBucket" 
    , 
     
     
    "Resource" 
    : 
     
    "arn:aws:s3:::imperva-audit-trail-logs" 
     
    } 
     
    ] 
    } 
    
   

   • Replace imperva-audit-trail-logs if you entered a different bucket name.

4. Click Next > Create policy.

5. Go to IAM > Roles > Create role > AWS service > Lambda.

6. Attach the newly created policy.

7. Name the role imperva-audit-trail-s3-role and click Create role.

Configure Imperva Audit Trail S3 connection

1. Return to the Imperva ConsoleSIEM Logs configuration.
2. Update the Amazon S3 connection with the AWS credentials:
   • Access key: The User access key with access to the S3 bucket.
   • Secret key: The User secret key with access to the S3 bucket.
   • Path: Enter the path in format imperva-audit-trail-logs/chronicle .
3. Click Test connectionto verify connectivity.
4. Ensure the connection status shows Available.

Configure Audit Trail log export

1. In the Connections table, expand your Amazon S3 connection.
2. Click Add log type.
3. Provide the following configuration details:
   • Configuration name: Enter a descriptive name (for example, Audit Trail Logs to Chronicle ).
   • Select service: Choose Audit Trail.
   • Select log types: Select AUDIT_TRAILlog type.
   • Format: JSON (structured format for audit trail logs).
   • State: Set to Enabled.
4. Click Add log typeto save the configuration.

Optional: Create read-only IAM user & keys for Google SecOps

1. Go to AWS Console > IAM > Users.
2. Click Add users.
3. Provide the following configuration details:
   • User: Enter secops-reader .
   • Access type: Select Access key – Programmatic access.
4. Click Create user.
5. Attach minimal read policy (custom): Users > secops-reader > Permissions > Add permissions > Attach policies directly > Create policy.

6. In the JSON editor, enter the following policy:

     { 
     
    "Version" 
    : 
     
    "2012-10-17" 
    , 
     
    "Statement" 
    : 
     
    [ 
     
    { 
     
    "Effect" 
    : 
     
    "Allow" 
    , 
     
    "Action" 
    : 
     
    [ 
    "s3:GetObject" 
    ], 
     
    "Resource" 
    : 
     
    "arn:aws:s3:::imperva-audit-trail-logs/*" 
     
    }, 
     
    { 
     
    "Effect" 
    : 
     
    "Allow" 
    , 
     
    "Action" 
    : 
     
    [ 
    "s3:ListBucket" 
    ], 
     
    "Resource" 
    : 
     
    "arn:aws:s3:::imperva-audit-trail-logs" 
     
    } 
     
    ] 
    } 
    
   

7. Set the name to secops-reader-policy .

8. Go to Create policy > search/select > Next > Add permissions.

9. Go to Security credentials > Access keys > Create access key.

10. Download the CSV(these values are entered into the feed).

Configure a feed in Google SecOps to ingest Imperva Audit Trail logs

1. Go to SIEM Settings > Feeds.
2. Click + Add New Feed.
3. In the Feed namefield, enter a name for the feed (for example, Imperva Audit Trail logs ).
4. Select Amazon S3 V2as the Source type.
5. Select Imperva Audit Trailas the Log type.
6. Click Next.
7. Specify values for the following input parameters:
   • S3 URI: s3://imperva-audit-trail-logs/chronicle/
   • Source deletion options: Select deletion option according to your preference.
   • Maximum File Age: Include files modified in the last number of days. Default is 180 days.
   • Access Key ID: User access key with access to the S3 bucket.
   • Secret Access Key: User secret key with access to the S3 bucket.
   • Asset namespace: The asset namespace .
   • Ingestion labels: The label applied to the events from this feed.
8. Click Next.
9. Review your new feed configuration in the Finalizescreen, and then click Submit.

Need more help? Get answers from Community members and Google SecOps professionals.