Imperva Cyber Community

communities_1.jpg
 View Only
  • 1.  I want to add fields when exporting to csv.

    Posted 01-25-2023 03:56
    Hello. 

    If you run monitor > alerts > save as alert csv, I can see the fields as below.

    Alert No. Num. of Events Alert Description Alert Start Time Alert End Time Alert Flag Alert Type Immediate Action Server Group Session ID Severity Source IP URL User Agent User Name (DB) User Name (Applicative) Additional Applicative User Name.

    I want to add httpRequest.url.path and httpRequest.url.queryString here.

    Is it possible to create a csv by adding the above two fields in the web ui or console?

    Thank you.

    #On-PremisesWAF(formerlySecuresphere)

    ------------------------------
    Seungyeon han
    ceo
    Yeungnam University College
    Seoul
    ------------------------------


  • 2.  RE: I want to add fields when exporting to csv.

    Posted 01-25-2023 10:05
    Hi Seugyeon,

    While these columns cannot be added to the alert view, we can get this data from a custom report. 

    Access Main > Reports > Manage Reports.

    Click the green plus icon at the top right and select Alerts.

    Fig 1.



    Enter a name, description (optional) and select From Scratch. (the default)

    Fig. 2


    With this new report selected, in the right hand pane, scroll down to the Report Format section and select CSV.

    Fig. 3



    By default, the Data Scope (tab) will be the Last 3 days. Adjust if desired.

    Fig. 4


    Click the Tabular tab. This is where we will define the columns. Within the Available Columns field, select the details you could like to see and click the green arrow to move them into the Selected column on the right hand side as seen in Fig 5.

    Fig 5.

    Additionally, you may select a method by which to sort. I have chosen Alert Name in the example above, but you can sort by any column available.

    Optionally place a checkmark in Generate group headers.

    Click the Save icon at the top right.
    Fig. 6

    Click the General Details tab, then scroll down to the bottom and click Run Report Now.


    This will create a good starting point. You may find that you want to add or remove additional details. Adjust as needed until you achieve the desired output. 

    You may also want to schedule the report to run automatically. This is accomplished by specifying a schedule under the Scheduling tab.

    Also, under the Generals Detail tab you may have the report emailed to you by selecting a Followed Action (based on the Schedule in the scheduling tab) if you have an email Action Set defined.

    Fig 7.

    Lastly, you can review any past reports run by accessing Main > Reports > View Results.










    ------------------------------
    JairedAnderson
    Imperva
    ------------------------------