1. Expel Help Center
  2. Connect Your Technology
  3. Cloud Integrations

Thales Imperva WAF Setup for Workbench

This article explains how to connect Imperva WAF to Workbench.

In this article

Note
Expel integration with the Imperva WAF uses two values from your Imperva account:

  • X-API-ID

  • X-API-KEY

Step 1: Create an Expel SOC account in the Imperva Cloud Security Console

  1. Log into your Imperva Cloud Security Console as an Administrator.

  2. Navigate to Account > Account Management.

    Screenshot_2023-07-24_at_10_45_10_PM.png

  3. On the left side, click Users.

    Screenshot_2023-07-24_at_10_45_19_PM.png

  4. Click Add User, then fill out the Name and Email for the Expel SOC Account.

    Use “soc+<Your Organization Name>@expel.io”.

    Assign the Reader role to the account, then click Save.

    Screenshot_2023-07-24_at_10_45_27_PM.png

Step 2: Generate an API key for the Expel SOC user

  1. Click the new user you just created, a Settings menu will appear on the right.

    Click the API keys drop-down, then click Add API key.

    Screenshot_2023-07-24_at_10_45_38_PM.png

  2. Add a Name and Description for the API Key.

    Select the Never expire option.

    Click the Status slider to Enabled, then click Save.

    Screenshot_2023-07-24_at_10_45_47_PM.png

  3. Your API ID and API Key will show on the screen.

    Copy and store the API ID and API Key to a secure location to send to Expel for Integration Onboarding.

    Note
    This is the ONLY time these values are shown.

    Screenshot_2023-07-24_at_10_45_59_PM.png

You can see if the device is healthy on the Security Devices page. It may take a few minutes to see the device listed as healthy.

To check if alerts are coming through, navigate to the Alerts Analysis page. Scroll to the device you want to check and click View alerts. Switch to grid view, then check the list for device alerts. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.

Step 3: Edit the device to add console access

Expel needs console access to your device to allow our SOC analysts to dig deeper during incident investigations. Additionally, our engineering teams use this access to investigate potential health issues, including proper alert ingestion.

Note
Expel secures all login information our SOC analysts need about your devices in an MFA password product. Access to this login information is protected using our internal MFA processes. To learn more about the IP addresses all Expel traffic comes from, go here.

  1. Open Workbench. Go to Organization Settings > Security Devices. Next to the device you just connected, click the down arrow and click Edit.

  2. In the Console Login area, type these details:

    • Console URL: type the console URL from the Server address in the Connection Settings area above. At the end of the URL, type /login.

    • Username: type the user name you created above.

    • Password: type the password you created above.

    • Two-factor secret key (32-character code): depending on how your organization enforces log-ins, this field may not apply to you. In these cases, you can leave it blank. This field is optional and if you have questions or concerns, reach out to your engagement manager or to support.

  3. Click Save.

  • Was this article helpful?

  • 0 out of 0 found this helpful

Related articles