category: Network Security
provider: Thales Group
commonfields:
  id: Imperva WAF
  version: -1
configuration:
- display: Server URL (e.g., https://example.net)
  name: url
  required: true
  type: 0
- display: Username
  name: credentials
  required: true
  type: 9
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
description: Use the Imperva WAF integration to manage IP groups and web security policies in Imperva WAF.
display: Imperva WAF
name: Imperva WAF
script:
  commands:
  - description: Gets a list of the existing IP group names.
    name: imperva-waf-ip-group-list
    outputs:
    - contextPath: ImpervaWAF.IpGroup.Name
      description: The name of the IP group.
      type: String
  - arguments:
    - description: The name of the IP group.
      name: ip-group-name
      required: true
    description: Returns a list of the entries in the requested IP group.
    name: imperva-waf-ip-group-list-entries
    outputs:
    - contextPath: ImpervaWAF.IpGroup.Entries.Type
      description: The type of address (single, range, or network).
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.CidrMask
      description: The network significant bits of the IP group.
      type: Number
    - contextPath: ImpervaWAF.IpGroup.Entries.NetworkAddress
      description: The network address of the IP group.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.IpAddressTo
      description: The end IP address of the IP group.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.IpAddressFrom
      description: The start IP address of the IP group.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Name
      description: The name of the IP group.
      type: String
  - arguments:
    - description: The name of the IP group.
      name: ip-group-name
      required: true
    description: Removes all the entries from the IP group indicated by the group name.
    name: imperva-waf-ip-group-remove-entries
  - description: Returns a list of the names of all sites in the system.
    name: imperva-waf-sites-list
    outputs:
    - contextPath: ImpervaWAF.Site.Name
      description: The name of the site.
      type: String
  - arguments:
    - description: The name of the site.
      name: site-name
      required: true
    description: Returns a list of all server group names in the specified site.
    name: imperva-waf-server-group-list
    outputs:
    - contextPath: ImpervaWAF.ServerGroup.Name
      description: The name of the server group.
      type: String
    - contextPath: ImpervaWAF.ServerGroup.SiteName
      description: The name of the parent site of the server groups to access.
      type: String
  - arguments:
    - description: The site name.
      name: site-name
      required: true
    - description: The server group name.
      name: server-group-name
      required: true
    description: Returns a list of the server groups that applied the web security policies.
    name: imperva-waf-server-group-list-policies
    outputs:
    - contextPath: ImpervaWAF.SecurityPolicy.PolicyName
      description: The security policy name.
      type: String
    - contextPath: ImpervaWAF.SecurityPolicy.PolicyType
      description: The security policy type.
      type: String
    - contextPath: ImpervaWAF.SecurityPolicy.ServerGroup
      description: The server group name.
      type: String
    - contextPath: ImpervaWAF.SecurityPolicy.SiteName
      description: The site name.
      type: String
    - contextPath: ImpervaWAF.SecurityPolicy.System
      description: Indicates whether there is an Fi policy.
      type: Boolean
  - description: Returns a list of names of all web service custom policies in the system.
    name: imperva-waf-web-service-custom-policy-list
    outputs:
    - contextPath: ImpervaWAF.CustomWebPolicy.Name
      description: The name of the custom web policy.
      type: String
  - arguments:
    - description: The name of the custom web policy.
      name: policy-name
      required: true
    description: Returns a web service custom policy indicated by the policy name.
    name: imperva-waf-web-service-custom-policy-get
    outputs:
    - contextPath: ImpervaWAF.CustomWebPolicy.Enabled
      description: Indicates whether the custom web policy is enabled.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.FollowedAction
      description: The name of the action set.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.Name
      description: The name of the custom web policy.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.OneAlertPerSession
      description: Indicates whether to allow only one alert to be created for every web session.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.DisplayResponsePage
      description: Indicates whether to show the response page in alerts.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.Action
      description: The custom web policy action.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.Severity
      description: The custom web policy alert severity.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.serverGroupName
      description: The name of the server group to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.siteName
      description: The name of the site to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.webServiceName
      description: The name of the web service to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.operation
      description: The match operation for values.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.type
      description: The match criterion type.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.ipGroups.Group name
      description: The name of the IP group in which to search.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.userDefined.IP Address
      description: The IP address in which to search.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.values.country
      description: The country name to match.
      type: String
  - arguments:
    - description: The group name to create.
      name: group-name
      required: true
    - auto: PREDEFINED
      description: The type of address (single, range, or network).
      name: entry-type
      predefined:
      - range
      - single
      - network
      required: true
    - description: 'The start IP address. Mandatory for types: single, range.'
      name: ip-address-from
    - description: 'The end IP address. Mandatory for type: range.'
      name: ip-address-to
    - description: 'The network address. Mandatory for type: network.'
      name: network-address
    - description: 'Network significant bits. Mandatory for type: network.'
      name: cidr-mask
    - description: 'A list of entry values in JSON format. For example: [{"type":"single","ipAddressFrom":"1.2.3.4"}].'
      name: json-entries
    description: Create an IP group.
    name: imperva-waf-ip-group-create
    outputs:
    - contextPath: ImpervaWAF.IpGroup.Entries.Type
      description: The type of address (single, range, or network).
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.CidrMask
      description: The network significant bits.
      type: Number
    - contextPath: ImpervaWAF.IpGroup.Entries.NetworkAddress
      description: The network address.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.IpAddressTo
      description: The end IP address.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.IpAddressFrom
      description: The start IP address.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Name
      description: The name of the IP group.
      type: String
  - arguments:
    - description: The group name to update.
      name: group-name
      required: true
    - auto: PREDEFINED
      description: The type of address (single, range, or network).
      name: entry-type
      predefined:
      - range
      - single
      - network
      required: true
    - description: 'The start IP address. Mandatory for types: single, range.'
      name: ip-address-from
    - description: 'The end IP address. Mandatory for type: range.'
      name: ip-address-to
    - description: 'The network address. Mandatory for type: network.'
      name: network-address
    - description: 'The network significant bits. Mandatory for type: network.'
      name: cidr-mask
    - auto: PREDEFINED
      description: 'The operation to apply on the entry. Options: add, remove.'
      name: operation
      predefined:
      - add
      - remove
      required: true
    - description: 'A list of entry values in JSON format. For example: [{"operation":"add","type":"single","ipAddressFrom":"1.2.3.4"}].'
      name: json-entries
    description: Adds or removes rows in the IP group indicated by the IP group name.
    name: imperva-waf-ip-group-update-entries
    outputs:
    - contextPath: ImpervaWAF.IpGroup.Entries.Type
      description: Type of address (single, range, or network).
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.CidrMask
      description: The network significant bits.
      type: Number
    - contextPath: ImpervaWAF.IpGroup.Entries.NetworkAddress
      description: The network address.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.IpAddressTo
      description: The end IP address.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Entries.IpAddressFrom
      description: The start IP address.
      type: String
    - contextPath: ImpervaWAF.IpGroup.Name
      description: The name of the IP group.
      type: String
  - arguments:
    - description: The group name to delete.
      name: group-name
      required: true
    description: Deletes the IP group indicated by the group name.
    name: imperva-waf-ip-group-delete
  - arguments:
    - description: The name of the policy to create.
      name: policy-name
      required: true
    - auto: PREDEFINED
      defaultValue: 'True'
      description: 'Indicates whether the policy is enabled. Default: True.'
      name: enabled
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: 'The alert severity. Options: high, medium, low, informative, noAlert. Default: medium. '
      name: severity
      predefined:
      - high
      - medium
      - low
      - informative
      - noAlert
    - auto: PREDEFINED
      defaultValue: none
      description: 'The policy action. Options: block, none. Default: none.'
      name: action
      predefined:
      - block
      - none
    - description: The name of the action that was set.
      name: followed-action
    - auto: PREDEFINED
      defaultValue: 'False'
      description: 'Indicates whether to allow only one alert to be created for every web session. Default: False.'
      name: one-alert-per-session
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      defaultValue: 'False'
      description: 'Indicates whether to show the response page in alerts. Default: False.'
      name: display-response-page
      predefined:
      - 'True'
      - 'False'
    - description: Name of the site to apply.
      name: site-name-to-apply
      required: true
    - description: Name of the server group to apply.
      name: server-group-name-to-apply
      required: true
    - description: Name of the web service to apply.
      name: web-service-name-to-apply
      required: true
    - auto: PREDEFINED
      description: 'Match operation for source geolocation. Options: atLeastOne, excludeAll.'
      name: geo-location-criteria-operation
      predefined:
      - atLeastOne
      - excludeAll
    - description: Comma separated list of names of IP groups in which to search.
      name: ip-groups
    - description: Comma separated list of IP addresses in which to search.
      name: ip-addresses
    - description: Comma separated list of country names in which to search. Mandatory when geo-location-criteria-operation is set.
      name: country-names
    - auto: PREDEFINED
      description: 'Match operation for source IP addresses. Options: atLeastOne, excludeAll.'
      name: ip-addresses-criteria-operation
      predefined:
      - atLeastOne
      - excludeAll
    - description: 'List of match criteria in JSON format, e.g., [{"type": "sourceIpAddresses","operation": "atLeastOne","userDefined": ["1.2.3.4"]}].'
      name: match-criteria-json
    description: Create a web service custom policy.
    name: imperva-waf-web-service-custom-policy-create
    outputs:
    - contextPath: ImpervaWAF.CustomWebPolicy.Enabled
      description: Indicates whether the policy is enabled.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.FollowedAction
      description: The name of the action set.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.Name
      description: The name of the policy.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.OneAlertPerSession
      description: Indicates whether to allow only one alert to be created for every web session.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.DisplayResponsePage
      description: Indicates whether to show the response page in the alerts.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.Action
      description: The custom web policy action.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.Severity
      description: The custom web policy alert severity.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.serverGroupName
      description: The name of the server group to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.siteName
      description: The name of the site to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.webServiceName
      description: The name of the web service to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.operation
      description: The match operation for values.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.type
      description: The match criterion name.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.ipGroups.Group name
      description: The name of the IP group in which to search.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.userDefined.IP Address
      description: The IP address in which to search.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.values.country
      description: Country name to match.
      type: String
  - arguments:
    - description: The name of the policy to update.
      name: policy-name
      required: true
    - auto: PREDEFINED
      description: Indicates whether the policy is enabled.
      name: enabled
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: 'The alert severity. Options: high, medium, low, informative, noAlert.'
      name: severity
      predefined:
      - high
      - medium
      - low
      - informative
      - noAlert
    - auto: PREDEFINED
      description: 'The policy action. Options: block, none.'
      name: action
      predefined:
      - block
      - none
    - description: The name of the action set.
      name: followed-action
    - auto: PREDEFINED
      description: Indicates whether to allow only one alert to be created for every web session.
      name: one-alert-per-session
      predefined:
      - 'True'
      - 'False'
    - auto: PREDEFINED
      description: Indicates whether to show the response page in alerts.
      name: display-response-page
      predefined:
      - 'True'
      - 'False'
    - description: The name of the site to apply.
      name: site-name-to-apply
    - description: The name of the server group to apply.
      name: server-group-name-to-apply
    - description: The name of the web service to apply.
      name: web-service-name-to-apply
    - auto: PREDEFINED
      description: The match operation for the source geolocation.
      name: geo-location-criteria-operation
      predefined:
      - atLeastOne
      - excludeAll
    - description: Comma-separated list of names of the IP groups in which to search.
      name: ip-groups
    - description: Comma-separated list of IP addresses in which to search.
      name: ip-addresses
    - description: Comma-separated list of country names in which to search. Mandatory when geo-location-criteria-operation is set.
      name: country-names
    - auto: PREDEFINED
      description: 'The match operation for source IP addresses. Options: atLeastOne, excludeAll.'
      name: ip-addresses-criteria-operation
      predefined:
      - atLeastOne
      - excludeAll
    - auto: PREDEFINED
      description: 'Operation to apply. Options: add, remove.'
      name: apply-operation
      predefined:
      - add
      - remove
    - description: List of match criteria in JSON format, e.g., [{"type":"sourceIpAddresses","operation":"atLeastOne","userDefined":["1.2.3.4"]}].
      name: match-criteria-json
    description: Update a web service custom policy.
    name: imperva-waf-web-service-custom-policy-update
    outputs:
    - contextPath: ImpervaWAF.CustomWebPolicy.Enabled
      description: Indicates whether the policy is enabled.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.FollowedAction
      description: The name of the action set.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.Name
      description: The name of the policy.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.OneAlertPerSession
      description: Indicates whether to allow only one alert to be created for every web session.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.DisplayResponsePage
      description: Indicates whether to show the response page in alerts.
      type: Boolean
    - contextPath: ImpervaWAF.CustomWebPolicy.Action
      description: The policy action.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.Severity
      description: The alert severity.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.serverGroupName
      description: Name of the server group to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.siteName
      description: Name of the site to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.ApplyTo.webServiceName
      description: The name of the web service to apply.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.operation
      description: The match operation for values.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.type
      description: The match criterion name.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.ipGroups.Group name
      description: The name of the IP Group in which to search.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.userDefined.IP Address
      description: The IP address in which to search.
      type: String
    - contextPath: ImpervaWAF.CustomWebPolicy.MatchCriteria.values.country
      description: The country name to match.
      type: String
  - arguments:
    - description: The name of the policy to delete.
      name: policy-name
      required: true
    description: Deletes a web service custom policy indicated by the policy name.
    name: imperva-waf-web-service-custom-policy-delete
  dockerimage: demisto/python3:3.12.13.10116658
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Imperva WAF - Test
fromversion: 5.0.0