Imperva Cyber Community

Are you ready to flex 💪 your brain? This thread will contain a list of IncapRules and be updated periodically. 

Use Case: Retrieve content from a 3rd party or location while masking the Origin. When a client accesses www.example.com/PathHere the content will be retrieved from destination.example.org/PathHere 

Your Site: www.example.com
3rd Party: destination.example.org

You must have the load balancing module to define data centers.

This can be accomplished using forward and rewrite rules.

Define destination.example.org as a Data Center and check the box to Support only forward rules.

Create a new Forward rule with the following filter criteria:

     URL == "/PathHere"

Adjust the match criteria as desired. For example, the statement above is a strict match ( == ) on "/PathHere" and will not match "/PathHere/".

For the Rule Action, select Forward to Data Center and select the destination.example.org Data Center.

Give the rule a name and click Save.

Imperva Cloud will now Forward all requests for www.example.com/PathHere (client facing) to destination.example.org/PathHere. (backend) and retrieve the content. The clients address bar will display www.example.com/PathHere.

Please note however that a Rewrite rule is also typically required in conjunction with a Forward rule. This is because the Origin Data Center usually won't respond because the original Host header is sent. Additionally, the SSL handshake can fail with the Origin server if the Host names do not match.

Create a Rewrite matching the same path as the Forward rule.

     URL == "/PathHere"

For the Rule Action, select Rewrite Header.

For the Header Name, enter Host

Leave the From empty and in the To enter destination.example.org

Enter a name for the rule and click Save.

Reply to this thread to share your IncapRules with the community! 👍

Helpful Links

IncapRule Syntax Guide
https://docs.imperva.com/bundle/cloud-application-security/page/rules/rule-syntax.htm

IncapRule Parameter List
https://docs.imperva.com/bundle/cloud-application-security/page/rules/rule-parameters.htm 

Simplified Redirect Rules

https://docs.imperva.com/bundle/cloud-application-security/page/rules/simplified-redirect.htm

Scheduler Syntax
https://docs.imperva.com/bundle/cloud-application-security/page/rules/scheduler.htm

Variable$ Galore!
https://docs.imperva.com/bundle/cloud-application-security/page/rules/create-rule.htm 

Custom Rate Rules

https://docs.imperva.com/bundle/cloud-application-security/page/rules/rates.htm

#CloudWAF(formerlyIncapsula)

⚠ WARNING: Please follow your organization's change control procedures, and always test rules before adding to production

📼 Cloud WAF Masterclass - Flexing with InCap Rules *Webinar Recording*

Is there a location to see logs of rules that were matched, including Time, client IP, browser, etc?

------------------------------
John Schoenstein
IT Security Analyst
Glendale AZ
------------------------------

Hi John,

There are 2 locations to review this information.

Within the UI under Security Events. The label will "Security Rules". Also, on the right, you can filter for specific Security Rules if desired.


Additionally, if you are gathering SIEM logs, it should be under the Request Result section for the security rule that is triggered. 

https://docs.imperva.com/bundle/cloud-application-security/page/more/log-file-structure.htm  

Original Message:
Sent: 06-22-2022 11:54
From: John Schoenstein
Subject: Flexing with IncapRules

Is there a location to see logs of rules that were matched, including Time, client IP, browser, etc?

------------------------------
John Schoenstein
IT Security Analyst
Glendale AZ
------------------------------

When Log4j Hit last year, I utilized IncapRules to implement quick restrictions.  Example:



------------------------------
David Gorman
eCommerce Service Manager
GlaxoSmithKline
Collegeville NJ
------------------------------

Use Case: Provide additional protection to a path. (eg: Login page)

Click Add Rule

The filter criteria will be:

     MaliciousIPList == TorIPs & MaliciousIPList == AnonymousProxyIPs & URL contains "^/login"

For rule action, select Require Javascript Support.

Summary: This rule requires any client originating from a TOR node or Anonymous Proxy to process a JS challenge if they are accessing the login page. 

This accomplishes two things:

1.) Keeps low level BOTs off your login page. Good BOTs (like search engine crawlers) will not be using TOR nodes or Anonymous Proxies.
2.) If there is a an advanced BOT or automation technique accessing your login page, we now have a fingerprint (via the JS challenge) that can be used to block it. 

Options: Taylor this rule to your liking. Perhaps you adopt an aggressive measure and require CAPTCHA support or block.


A variation of this rule would be:

     IPReputationRiskLevel >= High & URL contains "^/login"

Rule action: Require JavaScript Support or CAPTCHA

I just implemented a rule that blocks access to a certain URL if you are not coming from our internal IP ranges. Is this the best way to create this rule?

URL contains "^/<path>/" & ClientIP != x.x.x.0/24 & ClientIP != y.y.y.0/24 & ClientIP != z.z.z.0/24 & ClientIP != a.a.a.0/24

Also, could I get a link to the page that talks about using incap rules to facilitate a certification pass through? I have some sites that use this that I cannot onboard to the WAF and would love a possible workaround.

------------------------------
Caleb Larson
Information Security Engineer
Appleton MN
------------------------------

Hi Caleb,

That technically works, however, a more efficient method would be to leverage a ; as a separator for the IP/Network list. Also, please be aware that the Cloud WAF cannot "see" your internal IP addresses. Are you referring to your corporate network ranges? (NAT)

     URL contains "^/<path>/" & ClientIP != x.x.x.0/24;y.y.y.0/24;z.z.z.0/24;a.a.a.0/24

For information on configuring client-certificate support, please see:

• https://docs.imperva.com/bundle/cloud-application-security/page/more/client-certificate-support.htm 
• https://docs.imperva.com/bundle/cloud-application-security/page/manage-client-certificate.htm ("Delivery Rules" referenced in this document are IncapRules)

Thanks.
Original Message:
Sent: 06-23-2022 14:49
From: Caleb Larson
Subject: Flexing with IncapRules

I just implemented a rule that blocks access to a certain URL if you are not coming from our internal IP ranges. Is this the best way to create this rule?

URL contains "^/<path>/" & ClientIP != x.x.x.0/24 & ClientIP != y.y.y.0/24 & ClientIP != z.z.z.0/24 & ClientIP != a.a.a.0/24

Also, could I get a link to the page that talks about using incap rules to facilitate a certification pass through? I have some sites that use this that I cannot onboard to the WAF and would love a possible workaround.

------------------------------
Caleb Larson
Information Security Engineer
Appleton MN
------------------------------

Yes, I am referring to our corporate network ranges.

As for the client cert support in CWAF, I think the issue we ran into is that we need to use certain certs for certain paths, not just the entire site which is what the CWAF allows for if I am remembering correctly. I was wondering if there was a way that rules could help pass along certificate information to the origin. Is that what this section is talking about? Imperva Documentation Portal

------------------------------
Caleb Larson
Information Security Engineer
Appleton MN
------------------------------

Original Message:
Sent: 06-23-2022 15:19
From: Jaired Anderson
Subject: Flexing with IncapRules

Hi Caleb,

That technically works, however, a more efficient method would be to leverage a ; as a separator for the IP/Network list. Also, please be aware that the Cloud WAF cannot "see" your internal IP addresses. Are you referring to your corporate network ranges? (NAT)

     URL contains "^/<path>/" & ClientIP != x.x.x.0/24;y.y.y.0/24;z.z.z.0/24;a.a.a.0/24

For information on configuring client-certificate support, please see:

• https://docs.imperva.com/bundle/cloud-application-security/page/more/client-certificate-support.htm 
• https://docs.imperva.com/bundle/cloud-application-security/page/manage-client-certificate.htm ("Delivery Rules" referenced in this document are IncapRules)

Thanks.

Original Message:
Sent: 06-23-2022 14:49
From: Caleb Larson
Subject: Flexing with IncapRules

I just implemented a rule that blocks access to a certain URL if you are not coming from our internal IP ranges. Is this the best way to create this rule?

URL contains "^/<path>/" & ClientIP != x.x.x.0/24 & ClientIP != y.y.y.0/24 & ClientIP != z.z.z.0/24 & ClientIP != a.a.a.0/24

Also, could I get a link to the page that talks about using incap rules to facilitate a certification pass through? I have some sites that use this that I cannot onboard to the WAF and would love a possible workaround.

------------------------------
Caleb Larson
Information Security Engineer
Appleton MN

Ah, yes; you are correct. As it stands today, client certificate support is per domain and cannot be configured per URL.

I recommend submitting this as a feature request at https://imperva.uservoice.com/

Thanks.
Original Message:
Sent: 06-23-2022 16:00
From: Caleb Larson
Subject: Flexing with IncapRules

Yes, I am referring to our corporate network ranges.

As for the client cert support in CWAF, I think the issue we ran into is that we need to use certain certs for certain paths, not just the entire site which is what the CWAF allows for if I am remembering correctly. I was wondering if there was a way that rules could help pass along certificate information to the origin. Is that what this section is talking about? Imperva Documentation Portal

------------------------------
Caleb Larson
Information Security Engineer
Appleton MN
------------------------------


Original Message:
Sent: 06-23-2022 15:19
From: Jaired Anderson
Subject: Flexing with IncapRules

Hi Caleb,

That technically works, however, a more efficient method would be to leverage a ; as a separator for the IP/Network list. Also, please be aware that the Cloud WAF cannot "see" your internal IP addresses. Are you referring to your corporate network ranges? (NAT)

     URL contains "^/<path>/" & ClientIP != x.x.x.0/24;y.y.y.0/24;z.z.z.0/24;a.a.a.0/24

For information on configuring client-certificate support, please see:

• https://docs.imperva.com/bundle/cloud-application-security/page/more/client-certificate-support.htm 
• https://docs.imperva.com/bundle/cloud-application-security/page/manage-client-certificate.htm ("Delivery Rules" referenced in this document are IncapRules)

Thanks.

Original Message:
Sent: 06-23-2022 14:49
From: Caleb Larson
Subject: Flexing with IncapRules

I just implemented a rule that blocks access to a certain URL if you are not coming from our internal IP ranges. Is this the best way to create this rule?

URL contains "^/<path>/" & ClientIP != x.x.x.0/24 & ClientIP != y.y.y.0/24 & ClientIP != z.z.z.0/24 & ClientIP != a.a.a.0/24

Also, could I get a link to the page that talks about using incap rules to facilitate a certification pass through? I have some sites that use this that I cannot onboard to the WAF and would love a possible workaround.

------------------------------
Caleb Larson
Information Security Engineer
Appleton MN

Use Case: Redirect clients to specific path based on clients preferred language

Yes - we can do this - however, It's difficult to provide a copy/paste example for this scenario as there are many variables that may or may not apply to your environment.

Some common Imperva Parameters that are used to accomplish this are:

  - CountryCode
  - Accept-Language

Additionally, we can look for cookies or cookie values as well as header and header values. 

Summary: If clients connection originates from Mexico, then redirect to Spanish URL path.

Filter example: CountryCode == MX

Rule Action: Redirect

Response Code: 302

From: /*

To: /es/$1

The * creates a back reference that allows us to reorder the URL before redirecting.

Example request: www.example.com/products

will be redirected to

www.example.com/es/products

Hi InCap Rulers!

Just to let you know that @Jaired Anderson's session has been posted in the blog section. If you missed it you can check it out here:

Cloud WAF Masterclass - Flexing with InCap Rules *Webinar Recording*

​
We'd love to hear your feedback and questions so feel free to comment on the blog itself or on this thread.

Enjoy!

------------------------------
Sarah Lamont(csp)
Digital Community Manager
------------------------------

Use case: Restrict HTTP methods

Filter example: Method != HEAD;GET;POST

Rule Action: Block Request

This will block any HTTP method that does not equal HEAD, GET, or POST.

------------------------------
JairedAnderson
Imperva
------------------------------

Use Case: Enrich headers with Geolocation data.

Rule Filter: Leave this blank

Rule Action: Rewrite Request Header

Header Name: X-Loc     
Note: You can enter your own name for the header. X-Loc is an example. This will be the name of the custom header appended that contains the location data.

Add new if missing: Check this box

From: Leave this field blank

To: $latitude$longitude

Rule Name: Give the rule a name. Ex: Add lat long

Click Save.

The CWAF will now pass along the latitude and longitude of the client in a custom header. These coordinates can also be logged by your web servers.

------------------------------
JairedAnderson
Imperva
------------------------------

Did you know 🤔 IncapRules can be scheduled? 🕑

For example, the scheduler can be used to redirect requests to a backup site during a scheduled maintenance window to avoid downtime.

The rule is triggered when requests arrive during the specified times and match all other conditions of the rule filter.

For syntax, please see: https://docs.imperva.com/bundle/cloud-application-security/page/rules/scheduler.htm 

------------------------------
Jaired Anderson
Imperva
------------------------------

Original Message:
Sent: 08-05-2022 12:22
From: Jaired Anderson
Subject: Flexing with IncapRules

Use Case: Enrich headers with Geolocation data.

Rule Filter: Leave this blank

Rule Action: Rewrite Request Header

Header Name: X-Loc     
Note: You can enter your own name for the header. X-Loc is an example. This will be the name of the custom header appended that contains the location data.

Add new if missing: Check this box

From: Leave this field blank

To: $latitude$longitude

Rule Name: Give the rule a name. Ex: Add lat long

Click Save.

The CWAF will now pass along the latitude and longitude of the client in a custom header. These coordinates can also be logged by your web servers.

------------------------------
JairedAnderson
Imperva
------------------------------

Use Case: Prevent your site from being loaded in an i-frame

Rule Filter: Leave this blank

Rule Action: Rewrite Response Header

Header Name: X-Frame-Options    

Add new if missing: Check this box
Note: This will override an existing header if one is already set from the server/code

From: Leave this field blank

To: SAMEORIGIN
Alternatively, you may DENY. For all valid options, please see: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Rule Name: Give the rule a name. Ex: Block i-frames

Click Save.

------------------------------
Jaired Anderson
Imperva
------------------------------

Original Message:
Sent: 02-16-2023 12:05
From: Jaired Anderson
Subject: Flexing with IncapRules

Did you know 🤔 IncapRules can be scheduled? 🕑

For example, the scheduler can be used to redirect requests to a backup site during a scheduled maintenance window to avoid downtime.

The rule is triggered when requests arrive during the specified times and match all other conditions of the rule filter.

For syntax, please see: https://docs.imperva.com/bundle/cloud-application-security/page/rules/scheduler.htm 

------------------------------
Jaired Anderson
Imperva
------------------------------


Original Message:
Sent: 08-05-2022 12:22
From: Jaired Anderson
Subject: Flexing with IncapRules

Use Case: Enrich headers with Geolocation data.

Rule Filter: Leave this blank

Rule Action: Rewrite Request Header

Header Name: X-Loc     
Note: You can enter your own name for the header. X-Loc is an example. This will be the name of the custom header appended that contains the location data.

Add new if missing: Check this box

From: Leave this field blank

To: $latitude$longitude

Rule Name: Give the rule a name. Ex: Add lat long

Click Save.

The CWAF will now pass along the latitude and longitude of the client in a custom header. These coordinates can also be logged by your web servers.

------------------------------
JairedAnderson
Imperva

Did you know we added an AI BOT classification over one year ago? 🤔

 It's true! You can read all about it in the release notes from December 1st, 2024.

• https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/release-notes/2024-12-01.htm

Why am I mentioning this over one year later, you ask? Great question! We've taken it one step further 

Leveraging this same category with incap rules, you can now configure Monetization for AI Traffic via TollBit Integration.

Ref: https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/release-notes/2025-12-07.htm 

Transform how you manage and monetize AI bot and crawler traffic with our new TollBit integration. The Imperva-TollBit integration enables you to identify AI bots and seamlessly route them through Tollbit monetization paywall, ensuring AI agents pay for accessing your content according to your terms. Using TollBit, you gain full control over pricing, licensing policies, and detailed analytics on which AI agents accessed your content and the generated revenue.

How it works
The integration leverages Imperva's AI bot detection to identify AI agents, such as scrapers, crawlers, and LLM collectors, at the edge.

Using Imperva's open platform, you can flexibly shape traffic routes based on your needs. In this use case, you create a Cloud WAF rule that redirects identified AI traffic to TollBit's subdomains. Once routed, TollBit acts as a paywall that:

• Evaluates the AI agent
• Applies your licensing and pricing rules
• Collects payment for the access request
• Returns the requested content to the AI bot only after these steps are complete.

Imperva does not manage pricing, licensing policies, or payment flows.

Key benefits:

Revenue: Convert unauthorized scraping attempts into licensed, paid transactions.

Control: Set rules and pricing for which AI agents can access your content.

Visibility: Gain clear, AI-specific analytics on who is accessing your content and the resulting business impact.

Why the change:
To address the rapid growth of uncompensated AI scraping, this integration enables you to enforce access rules and pricing, turning content consumption by AI models into a licensed revenue stream.

Ready to get started?
To enable the Cloud WAF integration with TollBit for AI traffic monetization:

1. Log in or create your own Tollbit account on the TollBit platform and set your monetization controls.
2. Create custom rules in the Imperva Cloud WAF platform as instructed in the TollBit Guide.

------------------------------
Jaired Anderson
Imperva
https://www.imperva.com/
------------------------------

This is a fantastic update, @Jaired Anderson. Thank you for sharing!

Community members - keep us posted on your experience with these rules. We love to hear your updates!

And don't forget to share this post with your colleagues!

------------------------------
Sarah Lamont
Digital Community Manager
------------------------------

Original Message:
Sent: 12-08-2025 09:42
From: Jaired Anderson
Subject: Flexing with IncapRules

Did you know we added an AI BOT classification over one year ago? 🤔

 It's true! You can read all about it in the release notes from December 1st, 2024.

• https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/release-notes/2024-12-01.htm

Why am I mentioning this over one year later, you ask? Great question! We've taken it one step further 

Leveraging this same category with incap rules, you can now configure Monetization for AI Traffic via TollBit Integration.

Ref: https://docs-cybersec.thalesgroup.com/bundle/cloud-application-security/page/release-notes/2025-12-07.htm 

Transform how you manage and monetize AI bot and crawler traffic with our new TollBit integration. The Imperva-TollBit integration enables you to identify AI bots and seamlessly route them through Tollbit monetization paywall, ensuring AI agents pay for accessing your content according to your terms. Using TollBit, you gain full control over pricing, licensing policies, and detailed analytics on which AI agents accessed your content and the generated revenue.

How it works
The integration leverages Imperva's AI bot detection to identify AI agents, such as scrapers, crawlers, and LLM collectors, at the edge.

Using Imperva's open platform, you can flexibly shape traffic routes based on your needs. In this use case, you create a Cloud WAF rule that redirects identified AI traffic to TollBit's subdomains. Once routed, TollBit acts as a paywall that:

• Evaluates the AI agent
• Applies your licensing and pricing rules
• Collects payment for the access request
• Returns the requested content to the AI bot only after these steps are complete.

Imperva does not manage pricing, licensing policies, or payment flows.

Key benefits:

Revenue: Convert unauthorized scraping attempts into licensed, paid transactions.

Control: Set rules and pricing for which AI agents can access your content.

Visibility: Gain clear, AI-specific analytics on who is accessing your content and the resulting business impact.

Why the change:
To address the rapid growth of uncompensated AI scraping, this integration enables you to enforce access rules and pricing, turning content consumption by AI models into a licensed revenue stream.

Ready to get started?
To enable the Cloud WAF integration with TollBit for AI traffic monetization:

1. Log in or create your own Tollbit account on the TollBit platform and set your monetization controls.
2. Create custom rules in the Imperva Cloud WAF platform as instructed in the TollBit Guide.

------------------------------
Jaired Anderson
Imperva
https://www.imperva.com/
------------------------------