Akamai Security Events integration

Overview

Akamai offers a cloud-based security platform that protects applications and APIs from web threats such as DDoS attacks, SQL injection, and credential abuse. The Akamai Security Events connector enables the retrieval of security logs generated by Akamai products such as Kona Site Defender, App & API Protector, Web Application Protector, and Bot Manager. These logs provide insights into detected attacks, malicious bot activity, suspicious client reputation data, and more.

The connector uses the SIEM API to fetch logs for further analysis and monitoring.

Prerequisites

• Access to Akamai Control Center
• Akamai security products (Kona Site Defender, App & API Protector, Web Application Protector, or Bot Manager)
• Bloo platform access credentials

Configuration Steps

1. Obtain API Credentials

To authenticate and access the Akamai Security Events API, you will need three pieces of information:

• Access Token
• Client Token
• Client Secret

These credentials are managed through Akamai's Identity and Access Management.

2. Generate API Credentials

1. Log in to the Akamai Control Center
2. Navigate to Identity and Access > API Clients
3. Click Create API Client
4. Choose the appropriate group and product (e.g., SIEM API, Read-only access)
5. Provide a name for the client and assign the relevant permissions
6. Upon creation, you will be presented with the Access Token, Client Token, and Client Secret
7. Save these credentials securely, the Client Secret is shown only once

Note: Ensure the API client has permission to access the SIEM APIs and any other relevant services associated with your Akamai security products.

For more details, refer to Akamai API Client Credentials.

3. Configure Connector Settings

The following configurations are required to forward Akamai Security Events logs to DNIF:

Field	Description
Connector Name	Enter a unique name for the connector
Host	Enter the Akamai SIEM endpoint (e.g., akbk-<customer>.akamai.com)
Access Token	Enter the Access Token generated from Akamai
Client Token	Enter the Client Token generated from Akamai
Client Secret	Enter the Client Secret generated from Akamai
Configuration ID	Provide the specific configuration ID tied to your Akamai product setup

4. Test Connection

Once all the required fields are filled:

1. After entering all required details, click Next
2. If successful, a "SUCCESS" message will appear along with a timestamp
3. If the test fails, an error message will be shown

Supported Akamai Products

• Kona Site Defender: Web application firewall and DDoS protection
• App & API Protector: Advanced application and API security
• Web Application Protector: Web application security monitoring
• Bot Manager: Bot detection and management

Security Considerations

• Store API credentials securely
• Use read-only access permissions when possible
• Regularly rotate API credentials
• Monitor API usage and rate limits
• Ensure proper network access to Akamai endpoints

Troubleshooting

For additional help, refer to:

• Troubleshooting Connector Validations
• Akamai API Client Credentials
• Akamai SIEM API documentation
• Bloo platform support documentation