Imperva WAF Blocked Requests by Organization
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
Microsoft Sentinel (KQL)
