What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Imperva account:- Users - every console user of the account and its sub-accounts, with name, email, creation date, and last sign-in. Oleria also shows each user’s MFA, SSO, sign-in methods, and last password change when the account’s audit trail from the last 90 days records them.
- Roles - the built-in Administrator and Reader roles and your custom roles, which users hold them, and in which account or sub-account each role is assigned.
- Resources - your Imperva account, its sub-accounts, and its websites, with the access each role grants to them.
- API keys - every user’s API keys (API ID and key) as non-human identities, with each key’s owner, status, expiry date, and last use. Oleria also discovers AI Application Security API keys. Oleria never reads key values.
- Credentials - API keys, TLS certificates with their expiry dates, and the secrets stored for SIEM log connections (S3, SFTP, and Splunk), for credential hygiene and expiry tracking.
- Activity - the Imperva audit trail, including sign-ins, failed sign-ins, SSO and two-factor authentication events, password changes, user and role changes, and API key changes.
Imperva has no user groups, so Oleria doesn’t discover groups. A role in Imperva grants access only in the account or sub-account where it’s assigned, so Oleria shows a role assigned in a sub-account with the sub-account’s name, for example
Reader (EU Apps).Prerequisites
- An Imperva user who can manage users and API keys, such as an account admin, to create the integration user and its API key.
- A parent-account API key. A key that belongs to a sub-account user only sees that sub-account and can’t read roles.
- Admin access on the Oleria platform to add a new integration.
- If your account or the integration user restricts access by IP address, add Oleria’s IP addresses to the allowed list. Imperva applies the restriction to API calls too. Contact support@oleria.com for the current list.
The exact location of these settings can change over time. If the steps below don’t match what you see, refer to the Imperva documentation on account users, roles, and API keys.
Create a role for the integration
An Imperva API key has exactly the permissions of the user it belongs to, so create a dedicated user with a role that grants what Oleria needs.1
Open Roles
In the Imperva Cloud Security Console, select Account > Account Management in the top menu bar, then select User Management > Roles in the sidebar.
2
Create the role
Select New Role, name it (for example,
Oleria integration), and select these permissions:Imperva has no view-only permission for users, so the integration user can always change users, even if you only want discovery. Every permission above is also used for discovery. If you leave out any permission other than Manage users, Oleria discovers less, as the table describes. The built-in Administrator role includes every permission.
Create the integration user and API key
1
Add the user
In User Management > Users, add a user for the integration, for example
oleria@yourcompany.com, and assign it the role you created in the parent account. If you use sub-accounts, the Manage account sub-accounts permission gives the user access to all of them.2
Create the API key
On the Account Users page, find the integration user, select the ellipsis in the Actions column, and select Edit. Open the API keys tab and select Add API key. Give the key a name, such as
Oleria, and choose an expiration that matches your rotation policy.3
Copy the API ID and API key
Imperva shows the API ID and API key in a popup.
Connect Imperva to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the Imperva tile.
2
Complete the connection form
Fill in the connection form:
3
Authenticate
Select Authenticate to validate the credentials and save the integration. Oleria checks that the key’s user can read the account’s users and API keys before saving. Imperva’s API is global, so you don’t need to choose a region.
Verify the integration
Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs users, roles, websites, API keys, and activity from Imperva on its regular sync schedule once the initial sync completes. The integration’s Capabilities tab lists the permissions the key’s user holds, when the user has View user roles, and flags any that are missing.Each connection covers one Imperva account and its sub-accounts. If you regenerate the API key, update it in Oleria by editing the integration. An update must use a key from the same Imperva account.
Remediation actions
The permissions of the integration user’s role authorize these actions:
Oleria never assigns or removes roles for, deletes, or removes sub-account access for the user whose API key the integration uses or the Imperva account admin, and it never disables the API key the integration uses. It can disable other API keys, including the account admin’s. Imperva can’t lock or disable users through its API, so Oleria offers deleting a user instead of disabling them - lock users in the Imperva console if you need a reversible block. Access to the parent account and to websites comes from roles, so remove the role to revoke it. A role with Manage account sub-accounts in the parent account gives access to every sub-account, so Oleria doesn’t remove a user from a sub-account while they hold one - remove the parent-account role instead. Oleria can disable account API keys, but not AI Application Security API keys, which Imperva can only delete.
Known limitations
- No groups. Imperva has no user group object, so Oleria doesn’t discover groups or group membership.
- User status isn’t available. Imperva’s API doesn’t report whether a user is locked, pending activation, or has an expired password, so Oleria shows every user as enabled.
- MFA, SSO, and password change dates come from the audit trail. Imperva’s API doesn’t expose them directly. Oleria reads the last 90 days of the audit trail, so a user who hasn’t signed in or changed their password in that time shows these as unavailable. This needs the View audit trail permission.
- API-only users appear as regular users. Imperva’s API doesn’t say which users are API-only.
- API key creation dates and creators aren’t available. Imperva doesn’t record them in its API. Each key’s owner is the user it belongs to.
- SIEM log connection secrets show as inactive. Imperva doesn’t report a status for them.
- Reseller managed accounts aren’t discovered. A reseller connection covers the reseller’s own account only.
- Accounts, sub-accounts, and websites are the only resources. Oleria doesn’t discover DNS zones, API Security APIs, or DDoS-protected networks, which have no per-user access.
- This integration hasn’t been verified against a live Imperva account yet. Before you rely on a remediation action, try it on a test user and confirm the result in Imperva.
- Changes in Imperva appear after the next sync.