At a guess you have a "rogue" event source configured to send events to Sentinel, the events of which are being identified (rightly or wrongly) as coming from "Imperva Secure Sphere", and this is causing a significant increase in EPS through your system.  I would try and identify the source as my guess is Sentinel is only reacting to what it is being sent.  You can open a Raw Data Tap on the problem Event Source and look at the incoming events and that might give you an idea.

In terms of remediation, the "Imperva Secure Sphere" Collector uses Syslog, which uses an Event Source Server (TCP, UDP, SSL?).  By default the Event Source Server has an "Allow and start" auto config policy.  This means that Event Sources get autoprovisioned and started when they start sending events into Sentinel.  That might explain why it appears you can't delete it i.e. you delete the collector but more events arrive and the Collector gets provisioned again.  Check the policy and change it to just Allow (so the event sources get created but not started).  That might alleviate the symptoms for you, but not the cause.

Hi Crof,

thank you,  this is rich information for me, I pinpoint the "culprit" but have no idea why it's willing to communicate with "Imperva" collector.

Because those packet are market eDirectory CEF !

Are you using the latest version 2011.r3 of the Imperva collector plugin?

I was unable to delete it,

when deleting it it was "reborning" like a Phoenix ;-)

at least manage to kill it...