Security Alerts:
%IMPERVA-Imperva,alert#=$!{Alert.dn},event#=$!{Event.dn},createTime=$!{Alert.createTime},updateTime=$!{Alert.lastUpdateTime},alertSev=$!{Alert.severity},group=$!{Alert.serverGroupName},ruleName="$!{Alert.alertMetadata.alertName}",evntDesc="$!{Alert.description}",category=$!{Alert.alertType},disposition=$!{Alert.immediateAction},eventType=$!{Event.eventType},proto=$!{Event.sourceInfo.ipProtocol},srcPort=$!{Event.sourceInfo.sourcePort},srcIP=$!{Event.sourceInfo.sourceIp},dstPort=$!{Event.destInfo.serverPort},dstIP=$!{Event.destInfo.serverIp},policyName="$!{Rule.parent.displayName}",occurrences=$!{Alert.aggregationInfo.occurrences},httpHost=$!{Event.struct.httpRequest.url.host},webMethod=$!{Event.struct.httpRequest.url.method},url="$!{Event.struct.httpRequest.url.path}",webQuery="$!{Event.struct.httpRequest.url.queryString}",soapAction=$!{Event.struct.httpRequest.soapAction.soapAction},resultCode=$!{Event.struct.httpResponse.responseCode},sessionID=$!{Event.struct.webCorrelationInfo.sessionId},username=$!{Alert.username},addUsername=$!{Event.struct.user.additionalUser},responseTime=$!{Event.struct.responseTime},responseSize=$!{Event.struct.responseSize},direction=$!{Event.struct.networkDirection},dbUsername=$!{Event.struct.rawUser.rawUser},queryGroup=$!{Event.struct.queryGroup.queryGroup},application="$!{Event.struct.application.application}",srcHost=$!{Event.struct.host.host},osUsername=$!{Event.struct.osUser.osUser},schemaName=$!{Event.struct.databases.schemaName},dbName=$!{Event.struct.databases.databaseName},hdrName=$!{Event.struct.httpRequest.headers.name},action="$!{Event.struct.query.parsedQuery}"


Security Events:
%IMPERVA-Imperva,event#=$!{Event.dn},createTime=$!{Event.createTime},eventType=$!{Event.eventType},eventSev=$!{Event.severity},username=$!{Event.username},subsystem=$!{Event.subsystem},message="$!{Event.message}"


Security Database Activity Monitoring:
%IMPERVA-Imperva,dstIP=$!{Event.destInfo.serverIp},dstPort=$!{Event.destInfo.serverPort},dbUsername=$!{Event.struct.user.user},srcIP=$!{Event.sourceInfo.sourceIp},srcPort=$!{Event.sourceInfo.sourcePort},creatTime=$!{Event.createTime},srvGroup=$!{Event.serverGroup},service=$!{Event.serviceName},appName=$!{Event.applicationName},event#=$!{Event.dn},eventType=$!{Event.struct.eventType},usrGroup=$!{Event.struct.userGroup},usrAuth=$!{Event.struct.user.authenticated},application="$!{Event.struct.application.application}",osUsername=$!{Event.struct.osUser.osUser},srcHost=$!{Event.struct.host.host},dbName=$!{Event.struct.databases.databaseName},schemaName=$!{Event.struct.databases.schemaName},bindVar=$!{Event.struct.rawData.bindVariables},sqlError=$!{Event.struct.complete.errorValue},respSize=$!{Event.struct.complete.responseSize},respTime=$!{Event.struct.complete.responseTime},affRows=$!{Event.struct.query.affectedRows},action="$!{Event.struct.query.parsedQuery}",rawQuery="$!{Event.struct.rawData.rawData}"