---
title: Imperva Attack Analytics alert
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > Imperva Attack Analytics alert
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Imperva Attack Analytics alert
Classification:attack 
## Goal{% #goal %}

Detects web application attacks identified and analyzed by Imperva Attack Analytics.

## Strategy{% #strategy %}

This rule monitors Imperva Attack Analytics events ingested from `@service:imperva-attack-analysis`. Imperva Attack Analytics is a security intelligence service that aggregates and correlates web application attack data across the Imperva network, providing enriched analysis of attack patterns, sources, and targeted assets. Signals are created based on the severity assigned by Imperva — `CRITICAL` events generate High severity signals, `MAJOR` events generate Medium, and `MINOR` events generate Low. Alerts are grouped by the targeted host (`@dominant_attacked_host.value`) and the attack description (`@main_sentence`). Alerts where `@events_blocked_percent` is `100` are excluded, as fully blocked attacks pose no risk of successful exploitation.

## Triage and Response{% #triage-and-response %}

- Review the `{{@main_sentence}}` attack description to understand the nature and scope of the attack targeting `{{@dominant_attacked_host.value}}`.
- Examine the Imperva console for the full attack analysis including attack vectors, source IPs, and whether the requests were blocked or permitted to reach the origin server.
- Check application access logs on `{{@dominant_attacked_host.value}}` for requests matching the attack pattern to determine if any malicious traffic bypassed Imperva and reached the application.
- Review application error logs and backend service logs around the time of the alert for anomalous behavior such as unexpected query patterns, authentication failures, or elevated error rates that may indicate successful exploitation.
- Identify if similar attack patterns have been observed against other hosts to determine whether this is part of a broader campaign targeting the environment.