From 5c816e5feb7d4f985378210140eeffd6f3217be4 Mon Sep 17 00:00:00 2001 From: moxarth-rathod Date: Mon, 6 Apr 2026 11:17:14 +0530 Subject: [PATCH 1/5] [Imperva Cloud WAF] Add agentless support --- packages/imperva_cloud_waf/_dev/build/docs/README.md | 5 +++++ packages/imperva_cloud_waf/changelog.yml | 5 +++++ .../event/elasticsearch/ingest_pipeline/default.yml | 11 +++++++++++ .../imperva_cloud_waf/data_stream/event/manifest.yml | 2 -- packages/imperva_cloud_waf/docs/README.md | 5 +++++ packages/imperva_cloud_waf/manifest.yml | 12 ++++++++++-- 6 files changed, 36 insertions(+), 4 deletions(-) diff --git a/packages/imperva_cloud_waf/_dev/build/docs/README.md b/packages/imperva_cloud_waf/_dev/build/docs/README.md index 365d0ae6b61..3183abe27e7 100644 --- a/packages/imperva_cloud_waf/_dev/build/docs/README.md +++ b/packages/imperva_cloud_waf/_dev/build/docs/README.md @@ -2,6 +2,11 @@ Imperva Cloud WAF is a cloud-based application delivery service that includes web security, DDoS protection, CDN, and load balancing. +## Agentless Enabled Integration + +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + ## Data streams This integration supports ingestion of events from Imperva Cloud WAF, via AWS S3 input or via [Imperva API](https://docs.imperva.com/bundle/cloud-application-security/page/settings/log-integration.htm). diff --git a/packages/imperva_cloud_waf/changelog.yml b/packages/imperva_cloud_waf/changelog.yml index 5e613373939..114bdceac0c 100644 --- a/packages/imperva_cloud_waf/changelog.yml +++ b/packages/imperva_cloud_waf/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.14.0" + changes: + - description: Enable Agentless deployment. + type: enhancement + link: https://github.com/elastic/integrations/pull/1 - version: "1.13.1" changes: - description: Downgrade the `format_version` to the minimum version that supports all the necessary features for the package. diff --git a/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml index 2e0b79f1a3b..f244d73bcef 100644 --- a/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -5,6 +5,17 @@ processors: field: ecs.version tag: set_ecs_version value: 8.11.0 + - remove: + field: + - organization + - division + - team + ignore_missing: true + if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String + tag: remove_agentless_tags + description: >- + Removes the fields added by Agentless as metadata, + as they can collide with ECS fields. - terminate: tag: data_collection_error if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null diff --git a/packages/imperva_cloud_waf/data_stream/event/manifest.yml b/packages/imperva_cloud_waf/data_stream/event/manifest.yml index 285fb519661..1132ce1a6a6 100644 --- a/packages/imperva_cloud_waf/data_stream/event/manifest.yml +++ b/packages/imperva_cloud_waf/data_stream/event/manifest.yml @@ -5,7 +5,6 @@ streams: title: Event logs description: Collect Event logs from Imperva Cloud WAF. template_path: cel.yml.hbs - enabled: false vars: - name: api_id type: password @@ -130,7 +129,6 @@ streams: title: Imperva Cloud WAF Events description: Collect Imperva Cloud WAF Events via AWS S3 input. template_path: aws-s3.yml.hbs - enabled: false vars: - name: collect_s3_logs required: true diff --git a/packages/imperva_cloud_waf/docs/README.md b/packages/imperva_cloud_waf/docs/README.md index 26ab5490667..25d99fd6e3e 100644 --- a/packages/imperva_cloud_waf/docs/README.md +++ b/packages/imperva_cloud_waf/docs/README.md @@ -2,6 +2,11 @@ Imperva Cloud WAF is a cloud-based application delivery service that includes web security, DDoS protection, CDN, and load balancing. +## Agentless Enabled Integration + +Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html). +Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features. + ## Data streams This integration supports ingestion of events from Imperva Cloud WAF, via AWS S3 input or via [Imperva API](https://docs.imperva.com/bundle/cloud-application-security/page/settings/log-integration.htm). diff --git a/packages/imperva_cloud_waf/manifest.yml b/packages/imperva_cloud_waf/manifest.yml index 3c07465fc1c..3d91ccff2f0 100644 --- a/packages/imperva_cloud_waf/manifest.yml +++ b/packages/imperva_cloud_waf/manifest.yml @@ -1,14 +1,14 @@ format_version: 3.3.2 name: imperva_cloud_waf title: Imperva Cloud WAF -version: "1.13.1" +version: "1.14.0" description: Collect logs from Imperva Cloud WAF with Elastic Agent. type: integration categories: - security conditions: kibana: - version: "^8.16.5 || ^9.0.0" + version: "^8.18.0 || ^9.0.0" elastic: subscription: basic screenshots: @@ -25,6 +25,14 @@ policy_templates: - name: imperva_cloud_waf title: Imperva Cloud WAF logs description: Collect logs from Imperva Cloud WAF instance. + deployment_modes: + default: + enabled: true + agentless: + enabled: true + organization: security + division: engineering + team: security-service-integrations inputs: - type: aws-s3 title: Collect Imperva Cloud WAF logs via AWS S3 or AWS SQS From 8018619f12cebdece61a15c7334293142c0af74e Mon Sep 17 00:00:00 2001 From: moxarth-rathod <96762084+moxarth-rathod@users.noreply.github.com> Date: Tue, 7 Apr 2026 20:09:28 +0530 Subject: [PATCH 2/5] Update packages/imperva_cloud_waf/changelog.yml Co-authored-by: Krishna Chaitanya Reddy Burri --- packages/imperva_cloud_waf/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/imperva_cloud_waf/changelog.yml b/packages/imperva_cloud_waf/changelog.yml index 114bdceac0c..b7213a2a725 100644 --- a/packages/imperva_cloud_waf/changelog.yml +++ b/packages/imperva_cloud_waf/changelog.yml @@ -3,7 +3,7 @@ changes: - description: Enable Agentless deployment. type: enhancement - link: https://github.com/elastic/integrations/pull/1 + link: https://github.com/elastic/integrations/pull/18227 - version: "1.13.1" changes: - description: Downgrade the `format_version` to the minimum version that supports all the necessary features for the package. From 6d0281055c388ed725c69c2718d38bcaa36d80dc Mon Sep 17 00:00:00 2001 From: moxarth-rathod Date: Mon, 13 Apr 2026 11:21:14 +0530 Subject: [PATCH 3/5] Update kibana version --- packages/imperva_cloud_waf/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/imperva_cloud_waf/manifest.yml b/packages/imperva_cloud_waf/manifest.yml index 3d91ccff2f0..269bc7a6ea6 100644 --- a/packages/imperva_cloud_waf/manifest.yml +++ b/packages/imperva_cloud_waf/manifest.yml @@ -8,7 +8,7 @@ categories: - security conditions: kibana: - version: "^8.18.0 || ^9.0.0" + version: "^8.19.2 || ^9.0.5" elastic: subscription: basic screenshots: From e94feea46243875e02649663b3e2eae1171b846f Mon Sep 17 00:00:00 2001 From: moxarth-rathod Date: Tue, 14 Apr 2026 14:13:42 +0530 Subject: [PATCH 4/5] Address PR comments --- .../event/elasticsearch/ingest_pipeline/default.yml | 11 ----------- .../imperva_cloud_waf/data_stream/event/manifest.yml | 1 + packages/imperva_cloud_waf/manifest.yml | 6 +++--- 3 files changed, 4 insertions(+), 14 deletions(-) diff --git a/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml b/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml index f244d73bcef..2e0b79f1a3b 100644 --- a/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml +++ b/packages/imperva_cloud_waf/data_stream/event/elasticsearch/ingest_pipeline/default.yml @@ -5,17 +5,6 @@ processors: field: ecs.version tag: set_ecs_version value: 8.11.0 - - remove: - field: - - organization - - division - - team - ignore_missing: true - if: ctx.organization instanceof String && ctx.division instanceof String && ctx.team instanceof String - tag: remove_agentless_tags - description: >- - Removes the fields added by Agentless as metadata, - as they can collide with ECS fields. - terminate: tag: data_collection_error if: ctx.error?.message != null && ctx.message == null && ctx.event?.original == null diff --git a/packages/imperva_cloud_waf/data_stream/event/manifest.yml b/packages/imperva_cloud_waf/data_stream/event/manifest.yml index 1132ce1a6a6..45e195b856e 100644 --- a/packages/imperva_cloud_waf/data_stream/event/manifest.yml +++ b/packages/imperva_cloud_waf/data_stream/event/manifest.yml @@ -129,6 +129,7 @@ streams: title: Imperva Cloud WAF Events description: Collect Imperva Cloud WAF Events via AWS S3 input. template_path: aws-s3.yml.hbs + enabled: false vars: - name: collect_s3_logs required: true diff --git a/packages/imperva_cloud_waf/manifest.yml b/packages/imperva_cloud_waf/manifest.yml index 269bc7a6ea6..2ee8f81bc44 100644 --- a/packages/imperva_cloud_waf/manifest.yml +++ b/packages/imperva_cloud_waf/manifest.yml @@ -34,12 +34,12 @@ policy_templates: division: engineering team: security-service-integrations inputs: - - type: aws-s3 - title: Collect Imperva Cloud WAF logs via AWS S3 or AWS SQS - description: Collecting logs from Imperva Cloud WAF via AWS S3 or AWS SQS. - type: cel title: Collect Imperva Cloud WAF logs via API description: Collecting Imperva Cloud WAF logs via API. + - type: aws-s3 + title: Collect Imperva Cloud WAF logs via AWS S3 or AWS SQS + description: Collecting logs from Imperva Cloud WAF via AWS S3 or AWS SQS. owner: github: elastic/security-service-integrations type: elastic From 1e3e7e442f8c053001bebf880bbb42cb1b24381f Mon Sep 17 00:00:00 2001 From: moxarth-rathod Date: Wed, 6 May 2026 14:22:54 +0530 Subject: [PATCH 5/5] Add `enabled: false` --- packages/imperva_cloud_waf/data_stream/event/manifest.yml | 1 + packages/imperva_cloud_waf/manifest.yml | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/packages/imperva_cloud_waf/data_stream/event/manifest.yml b/packages/imperva_cloud_waf/data_stream/event/manifest.yml index 45e195b856e..285fb519661 100644 --- a/packages/imperva_cloud_waf/data_stream/event/manifest.yml +++ b/packages/imperva_cloud_waf/data_stream/event/manifest.yml @@ -5,6 +5,7 @@ streams: title: Event logs description: Collect Event logs from Imperva Cloud WAF. template_path: cel.yml.hbs + enabled: false vars: - name: api_id type: password diff --git a/packages/imperva_cloud_waf/manifest.yml b/packages/imperva_cloud_waf/manifest.yml index 2ee8f81bc44..20e4c5e221f 100644 --- a/packages/imperva_cloud_waf/manifest.yml +++ b/packages/imperva_cloud_waf/manifest.yml @@ -8,7 +8,7 @@ categories: - security conditions: kibana: - version: "^8.19.2 || ^9.0.5" + version: "^8.19.16 || ~9.3.5 || ^9.4.1" elastic: subscription: basic screenshots: @@ -34,12 +34,12 @@ policy_templates: division: engineering team: security-service-integrations inputs: - - type: cel - title: Collect Imperva Cloud WAF logs via API - description: Collecting Imperva Cloud WAF logs via API. - type: aws-s3 title: Collect Imperva Cloud WAF logs via AWS S3 or AWS SQS description: Collecting logs from Imperva Cloud WAF via AWS S3 or AWS SQS. + - type: cel + title: Collect Imperva Cloud WAF logs via API + description: Collecting Imperva Cloud WAF logs via API. owner: github: elastic/security-service-integrations type: elastic