Configure Imperva Cloud WAF for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform network-based response actions in your network using Imperva Cloud WAF®.

Imperva Cloud WAF supports these response actions:
  • Add/Remove IP from denylist

For more information, see Response action descriptions.

These resources are required:

  • An Imperva Cloud WAF parent account with the Administrator role.

  • One or more websites onboarded and protected by Imperva Cloud WAF.

  • Contact your CST to validate the Active Response integration. Have an IP address ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create an Active Response user role in Imperva Cloud WAF

  1. Sign in to the Imperva Cloud Console.
  2. In the top navigation bar, ensure that you are signed in to the parent account.
  3. In the top navigation bar, click Account > Account Management.
  4. In the sidebar, click User Management > Roles.
  5. Click New Role.
  6. Configure these settings:

    • Name — Enter a name for the role, for example, AWN Active Response Role.

    • Description — Enter a meaningful description for the role, for example, Role for Arctic Wolf Active Response.

  7. In the Permissions section, select the checkboxes for these permissions:

    • View policy

    • Edit policy

  8. Click Save.

Create a dedicated Active Response user in Imperva Cloud WAF

The Active Response user must be created and managed from the Imperva Cloud WAF parent account, not from a sub-account.

  1. Sign in to the Imperva Cloud Console.
  2. In the top navigation bar, ensure that you are signed in to the parent account.
  3. In the top navigation bar, click Account > Account Management.
  4. In the sidebar, click User Management > Users.
  5. Click Add New User.
  6. Configure these settings:
  7. Click Add user.
    An activation email is sent to the new user's email account.
  8. To activate the new user, follow the instructions in the activation email.

Generate API credentials in Imperva Cloud WAF

  1. Sign in to the Imperva Cloud Console.
  2. In the top navigation bar, ensure that you are signed in to the parent account.
  3. In the top navigation bar, click Account > Account Management.
  4. In the sidebar, click User Management > Users.
  5. Locate the Active Response user that you created in Create a dedicated Active Response user in Imperva Cloud WAF, and then, in the Actions column, click Edit.
  6. Click the API Keys tab.
  7. Click Add API Key.
  8. In the Name field, enter AWN Active Response Key.
  9. In the Description field, enter a description that clearly describes the purpose of the credential, for example, Arctic Wolf Active Response API credential.
  10. In the API Key will expire in list, select Never, as Arctic Wolf recommends.
    Note: If your organization requires API key rotation, select an expiry period from the available options instead.
  11. Toggle the Status to Enabled.
  12. Click Create.

    The API ID and API Key are displayed. Copy these values, and then save them in a safe, encrypted location.

    You will provide these values to Arctic Wolf later.

    Note: The API key is only shown once. If you lose it, you must generate a new one.

Create an IP blocking policy in Imperva Cloud WAF

  1. Sign in to the Imperva Cloud Console.
  2. In the top navigation bar, ensure that you are signed in to the parent account.
  3. In the top navigation bar, click Application.
  4. In the sidebar, click WAF > WAF Policies.
  5. Click Create Policy.
  6. In the General tab, configure these settings:

    • Policy Name — Enter AWN-Active-Response-Access-Control-Policy.

    • Description — Enter a description. Example: Dedicated ACL policy used by Arctic Wolf Active Response to manage blocked IP addresses.

    • Enable Policy — Toggle on.

    • Policy Type — Select ACL - Access control list.

  7. In the Configuration tab, in the Block IPs section, in the IP address field, add any placeholder IP address and then click +Add. Example: 192.0.2.1.
    Note: At least one placeholder IP address must be added initially to create and apply a policy. Once the integration is active, Arctic Wolf automatically manages adding and removing IP addresses from this list.
  8. In the Applied On tab, configure these settings:

    • Available for — Select All sub accounts, as Arctic Wolf recommends. This makes the policy available across the account structure so Active Response can apply response actions wherever protected sites are configured.

    • Apply to — Select All domains, as Arctic Wolf recommends. This ensures the policy can protect every onboarded website and prevents response actions from being missed because a website was not individually selected.

    • Enable as default policy — Select All accounts, as Arctic Wolf recommends. This applies the policy by default across accounts, helping ensure consistent Active Response coverage without requiring manual policy assignment for each account.

  9. Click Create.

    Copy the Policy Name, and then save it in a safe, encrypted location.

    You will provide this value to Arctic Wolf later.

Provide Imperva Cloud WAF Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click Imperva WAF.
  5. On the New Active Response Integration page, configure these settings:
  6. Click Save Integration.