The watchTowr Web Application Firewall (WAF) rules library is designed to work across multiple providers. However, the available rules may differ by WAF provider. For certain providers, including Imperva, the library may not have rules available.
Imperva's engine does not support regular expressions as matching criteria. Because of this, any rule in our library that depends on regular expressions to function correctly cannot be translated into an equivalent Imperva rule. In these cases, the affected rules will not be available to you when operating on the Imperva platform.
Rules that rely only on matching criteria supported by Imperva remain fully available and unaffected.
Adding a Rule
For more information about creating rules and the filter settings, see the Imperva Create Rules documentation page.
In watchTowr, navigate to the Findings page, and locate the finding you are addressing. Click to open the Finding page.
Locate the Action Panel, and click Active Defense Available to navigate to the corresponding page.
Select Imperva from the Select WAF Provider drop-down.
Click the Copy button to copy the rule to the clipboard.
Log into your my.imperva.com account.
On the top menu bar in Imperva, click Application.
In the sidebar, click Websites and click a website name.
In the sidebar, click Security > Rules.
Click Add Rule. Paste the filter rule into the Editor section of the Rule Filter.
Select Block Request from the Action drop-down in the Rule Action section.
Set a Rule Name.
The name of the rule is fully customizable, and does not impact the efficacy of the rule. Consider using the associated rule name from the watchTowr Platform.
Finding Rules in the Active Defense Library
Rules can also be located in the Active Defense Library. Navigate to the Active Defense page, and locate the rule you are copying.
Mitigations with an Imperva rule set will have the Imperva logo in the Provider column.
If you need assistance, don't hesitate to contact the watchTowr team. Our knowledgeable team is ready to help you navigate the watchTowr Platform and address any questions or concerns.