Imperva Cloud WAF

{
    "@timestamp": "2025-08-26T09:17:33.442Z",
    "agent": {
        "ephemeral_id": "c2af9640-ea28-4ab7-b766-c5391d82b759",
        "id": "f8329c43-eb4d-4aab-a20e-a39db67260a4",
        "name": "elastic-agent-34907",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "data_stream": {
        "dataset": "imperva_cloud_waf.event",
        "namespace": "44486",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "f8329c43-eb4d-4aab-a20e-a39db67260a4",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "web"
        ],
        "code": "1",
        "dataset": "imperva_cloud_waf.event",
        "end": "2019-08-20T11:31:10.892Z",
        "ingested": "2025-08-26T09:17:36Z",
        "kind": "event",
        "original": "CEF:0|Incapsula|SIEMintegration|1|1|Normal|0| sourceServiceName=site123.abcd.info siteid=1509732 suid=50005477 requestClientApplication=Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0 deviceFacility=mia ccode=IL tag=www.elvis.com cicode=Rehovot cs7=31.8969 cs7Label=latitude cs8=34.8186 cs8Label=longitude Customer=CEFcustomer123 siteTag=my-site-tag start=1453290121336 request=site123.abcd.info/main.css ref=www.incapsula.com/lama requestmethod=GET cn1=200 app=HTTP deviceExternalID=33411452762204224 in=54 xff=44.44.44.44 cpt=443 src=12.12.12.12 ver=TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 end=1566300670892 additionalReqHeaders=[{\"Accept\":\"*/*\"},{\"x-v\":\"1\"},{\"x-fapi-interaction-id\":\"10.10.10.10\"}] additionalResHeaders=[{\"Content-Type\":\"text/html; charset\\=UTF-8\"}]",
        "severity": 0,
        "start": "2016-01-20T11:42:01.336Z",
        "type": [
            "info"
        ]
    },
    "http": {
        "request": {
            "method": "GET"
        },
        "response": {
            "status_code": 200
        }
    },
    "imperva_cloud_waf": {
        "event": {
            "device": {
                "event_class_id": "1",
                "product": "SIEMintegration",
                "vendor": "Incapsula",
                "version": "1"
            },
            "extensions": {
                "additional": {
                    "req_headers": [
                        {
                            "Accept": "*/*"
                        },
                        {
                            "x-v": "1"
                        },
                        {
                            "x-fapi-interaction-id": "10.10.10.10"
                        }
                    ],
                    "res_headers": [
                        {
                            "Content-Type": "text/html; charset=UTF-8"
                        }
                    ]
                },
                "application_protocol": "HTTP",
                "bytes_in": 54,
                "ccode": "IL",
                "cicode": "Rehovot",
                "cpt": 443,
                "cs7": 31.8969,
                "cs7Label": "latitude",
                "cs8": 34.8186,
                "cs8Label": "longitude",
                "customer": "CEFcustomer123",
                "device": {
                    "custom_number1": 200,
                    "externalId": "33411452762204224",
                    "facility": "mia"
                },
                "end_time": "2019-08-20T11:31:10.892Z",
                "ref": "www.incapsula.com/lama",
                "request": {
                    "client_application": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0",
                    "method": "GET",
                    "url": "site123.abcd.info/main.css"
                },
                "site": {
                    "id": "1509732",
                    "tag": "my-site-tag"
                },
                "source": {
                    "address": "12.12.12.12",
                    "service_name": "site123.abcd.info",
                    "user_id": "50005477"
                },
                "start_time": "2016-01-20T11:42:01.336Z",
                "tag": "www.elvis.com",
                "ver": "TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256",
                "xff": [
                    "44.44.44.44"
                ]
            },
            "name": "Normal",
            "severity": 0,
            "version": "0"
        }
    },
    "input": {
        "type": "cel"
    },
    "message": "Normal",
    "network": {
        "application": "http",
        "forwarded_ip": [
            "44.44.44.44"
        ]
    },
    "observer": {
        "product": "SIEMintegration",
        "vendor": "Incapsula",
        "version": "1"
    },
    "related": {
        "ip": [
            "12.12.12.12",
            "44.44.44.44"
        ],
        "user": [
            "50005477"
        ]
    },
    "source": {
        "bytes": 54,
        "geo": {
            "country_iso_code": "IL",
            "location": {
                "lat": 31.8969,
                "lon": 34.8186
            }
        },
        "ip": "12.12.12.12",
        "port": 443,
        "service": {
            "name": "site123.abcd.info"
        },
        "user": {
            "id": "50005477"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "imperva_cloud_waf-event"
    ],
    "tls": {
        "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
        "version": "1.2"
    },
    "url": {
        "domain": "site123.abcd.info",
        "extension": "css",
        "original": "http://site123.abcd.info/main.css",
        "path": "/main.css",
        "scheme": "http"
    },
    "user_agent": {
        "device": {
            "name": "Other"
        },
        "name": "Firefox",
        "original": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0",
        "os": {
            "full": "Windows 7",
            "name": "Windows",
            "version": "7"
        },
        "version": "40.0"
    }
}