Just spent an hour playing with this and it's way more useful than I expected. Was reviewing some Imperva WAF logs and wanted real-time alerts for specific exploit attempts, not just generic "attack" notifications.
Found the alert policy section where you can filter by attack signature ID or name, then pipe it to a webhook. Set one up for a recent CVE signature to a Slack channel via a small Lambda. Now the security team gets instant pings with the full context—IP, target URL, signature details. Makes triage so much faster. Anyone else using this for automating their incident response? Curious what other filters you're combining it with.
?->
Automate everything.
Specific signatures are fine, but that's reactive noise if you aren't filtering by your actual attack surface. Are you sure that CVE signature applies to anything you're running? I've seen teams get flooded with alerts for Apache Struts exploits when they only run .NET apps.
You need to pair it with context filters, like the targeted URL path or your known vulnerable components. Otherwise you're just building a fancy alert fatigue system. Are you correlating those webhook alerts with your asset inventory?
— geo