Page Comparison

...

To run this collector, there are some configurations detailed below that you need to consider.

Configuration	Details
Access token	The access token is required to authenticate requests to the Akamai SIEM API.
Client secret	The client secret is required for secure authentication alongside the access token.
Client token	The client token is necessary for identifying and authenticating API requests.
Host	The host specifies the endpoint for the Akamai SIEM API.

Info
Refer to the Vendor setup section to know more about these configurations.

...

If you are migrating from v1.x to v2.x, you can find a complete guide in this article.

Devo collector features

Feature	Details
Allow parallel downloading (`multipod`)	`not allowed`
Running environments	`collector server` `on-premise`
Populated Devo events	`table`
Flattening preprocessing	`no`

Data sources

This collector extracts data from the Akamai SIEM log service:

Akamai SIEM security events: Retrieves security event data using an offset to ensure seamless data collection, starting from the last message pulled.

Data Source	Description	API Endpoint	Collector Service Name	Devo Table	Available from release
Security events	Get security events from a determined offset. This offset specifies the last message pulled, for the first execution this value will be NULL and for successive requests will use the offset obtained in every response from the API.	`/siem/v1/configs`	`security_events`	`cdn.akamai.siem`	`v1.0.0`

For more information on how the events are parsed, visit our page

...

Info
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting	Details
`access_token`	The access token is required to authenticate requests to the Akamai SIEM API.
`client_secret`	The client secret is required for secure authentication alongside the access token.
`client_token`	The client token is necessary for identifying and authenticating API requests.
`host`	The host specifies the endpoint for the Akamai SIEM API, typically in the format `{host}`.
`configs_id`	The configuration ID identifies the specific set of logs or security events to retrieve.

Info
See the Accepted authentication methods section to verify what settings are required based on the desired authentication method.

Accepted authentication methods

EdgeGridAuth	Details
`access_token`	The access token is required to authenticate requests to the Akamai SIEM API.
`client_secret`	The client secret is required for secure authentication alongside the access token.
`client_token`	The client token is necessary for identifying and authenticating API requests.

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Rw ui tabs macro

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Note
Replace `<product_name>` with the proper value.

Editing the config.yaml file

Code Block

language	yaml

globals:
  debug: false
  id: not used
  name: akamai_siem
  persistence:
    type: filesystem
    config:
      directory_name: state
outputs:
  devo_1:
    type: devo_platform
    config:
      address: <devo_address>
      chain: <chain_filename>
      cert: <cert_filename>
      key: <key_filename>
inputs:
  akamai_siem:
    id: <short_unique_id>
    enabled: true
    credentials:
      access_token: <access_token_value>
      client_secret: <client_secret_value>
      client_token: <client_token_value>
    environment: <environment_value>
    services:
      security_events:
        host: <host_value>
        configs_id: <configs_id_value>
        override_base_tag: <override_base_tag_value>
        override_logs_limit: <override_logs_limit_value>
        override_decode_attack_data_rules: <override_decode_attack_data_rules_value>
        request_period_in_seconds: <request_period_in_seconds_value>

Example:

Code Block

language	yaml

globals:
  debug: false
  id: not_used
  name: akamai-siem-collector
  persistence:
    type: filesystem
    config:
      directory_name: state
outputs:
  devo_1:
    type: devo_platform
    config:
      address: collector-eu.devo.io
      port: 443
      type: SSL
      chain: chain.crt
      cert: example.crt
      key: example.key
inputs:
  akamai-siem:
    id: "123456"
    enabled: true
    environment: "prod"
    credentials:
      access_token: "your_access_token"
      client_secret: "your_client_secret"
      client_token: "your_client_token"
    services:
      security_events:
        host: "apiakamai.net"
        configs_id: "1234;5678;91011"

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Replace the placeholders with your required values following the description table below:

Parameter	Data Type	Requirement	Value Range / Format	Description
`<devo_address>`	`string`	`Mandatory`	Example: logs.example.devo.com	The Devo address where logs will be sent.
`<chain_filename>`	`string`	`Mandatory`	Min length: `4`	The filename of the chain certificate downloaded from Devo. Example: chain.crt.
`<cert_filename>`	`string`	`Mandatory`	Min length: `4`	The filename of your certificate downloaded from Devo. Example: your_domain.crt.
`<key_filename>`	`string`	`Mandatory`	Min length: `4`	The filename of your private key downloaded from Devo. Example: your_domain.key.
`<short_unique_id>`	`string`	`Mandatory`	Min length: `1`	Unique identifier for the collector instance.
`<enabled>`	`boolean`	`Mandatory`	`true`, `false`	Indicates whether the collector is active.
`<access_token_value>`	`string`	`Mandatory`	Min length: `1`	API access token for Akamai SIEM authentication.
`<client_secret_value>`	`string`	`Mandatory`	Min length: `1`	Secret key used for secure API requests.
`<client_token_value>`	`string`	`Mandatory`	Min length: `1`	Token used to identify the client in API requests.
`<environment_value>`	`string`	`Optional`	Example: `dev`, `prod`	Specifies the environment. Use `dev` for development or `prod` for production.
`<host_value>`	`integer`	`Mandatory`	Host URL when making endpoint requests.	Host URL when making endpoint requests.
`<configs_id_value>`	`string`	`Mandatory`	Example: `“1111` or `1111;2222;3333"`	List of security configuration IDs provided by the vendor.
`<override_base_tag_value>`	`string`	`Optional`	Example: `my.app.test`.`1`	Overrides the default collector tag (`cdn.akamai.siem`).
`<override_logs_limit_value>`	`integer`	`Optional`	Default: `10000`	Maximum number of logs to retrieve in one API request.
`<override_decode_attack_data_rules_value>`	`boolean`	`Optional`	`true`, `false`	Boolean flag to decode attackData.rule fields. Defaults to `false`.
`<request_period_in_seconds_value>`	`integer`	`Optional`	Default: `60`	Frequency of requests in seconds.

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
akamai-siem-docker-image.tgz	`453f394c7bd63490744cad963fec7db9008055793aec7b9675da2d7dbeeb66db`

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Note
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, get in touch with us and we will guide you through the configuration.

To enable the collector for a customer:

In the Collector Server GUI, access the domain in which you want this instance to be created
Click Add Collector and find the one you wish to add.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block

language	json

{
  "global_overrides": {
    "debug": false
  },
  "inputs": {
    "akamai_siem": {
      "id": "<short_unique_id>",
      "enabled": true,
      "credentials": {
        "access_token": "<access_token_value>",
        "client_secret": "<client_secret_value>",
        "client_token": "<client_token_value>"
      },
      "environment": "<environment_value>",
      "services": {
        "security_events": {
          "host": "<host_value>",
          "configs_id": "<configs_id_value>",
          "override_base_tag": "<override_base_tag_value>",
          "override_logs_limit": "<override_logs_limit_value>",
          "override_decode_attack_data_rules": "<override_decode_attack_data_rules_value>",
          "request_period_in_seconds": "<request_period_in_seconds_value>"
        }
      }
    }
  }
}

Example:

Code Block

language	json

{
  "global_overrides": {
    "debug": false
  },
  "inputs": {
    "example_input": {
      "id": "123456",
      "enabled": true,
      "credentials": {
        "access_token": "your_access_token",
        "client_secret": "your_client_secret",
        "client_token": "your_client_token"
      },
      "environment": "prod",
      "services": {
        "security_events": {
          "host": "apiakamai.net",
          "configs_id": "1234;5678;91011"
        }
      }
    }
  }
}

The following table outlines the parameters available for configuring the collector. Each parameter is categorized by its necessity (mandatory or optional), data type, acceptable values or formats, and a brief description.

Parameter	Data Type	Requirement	Value Range / Format	Description
`<short_unique_id>`	`string`	Mandatory	Min length: 1	Unique identifier for the collector instance.
`<enabled>`	`boolean`	Mandatory	true, false	Indicates whether the collector is active.
`<access_token_value>`	`string`	Mandatory	Min length: 1	API access token for Akamai SIEM authentication.
`<client_secret_value>`	`string`	Mandatory	Min length: 1	Secret key used for secure API requests.
`<client_token_value>`	`string`	Mandatory	Min length: 1	Token used to identify the client in API requests.
`<environment_value>`	`string`	Optional	Example: dev, prod	Specifies the environment. Use `dev` for development or `prod` for production.
`<host_value>`	`string`	Mandatory	Host URL when making endpoint requests.	Host URL when making endpoint requests.
`<configs_id_value>`	`string`	Mandatory	Example: 1111 or 1111;2222;3333	List of security configuration IDs provided by the vendor.
`<override_base_tag_value>`	`string`	Optional	Example: my.app.test.1	Overrides the default collector tag (`cdn.akamai.siem`).
`<override_logs_limit_value>`	`integer`	Optional	Default: 10000	Maximum number of logs to retrieve in one API request.
`<override_decode_attack_data_rules_value>`	`boolean`	Optional	true, false	Boolean flag to decode attackData.rule fields. Defaults to `false`.
`<request_period_in_seconds_value>`	`integer`	Optional	Default: 60	Frequency of requests in seconds.

...

Expand

title	Enable/disable the logging debug mode

Sometimes it is necessary to activate the debug mode of the collector's logging. This debug mode increases the verbosity of the log and allows you to print execution traces that are very helpful in resolving incidents or detecting bottlenecks in heavy download processes.

To enable this option you just need to edit the configuration file and change the debug_status parameter from false to true and restart the collector.
To disable this option, you just need to update the configuration file and change the debug_status parameter from true to false and restart the collector.

For more information, visit the configuration and parameterization section corresponding to the chosen deployment mode.

Change log

Release

Released on

Release type

Details

Recommendations

v3.0.0

10 Jan 2025

Status

colour	Red
title	BUG FIX

Status

colour	Green
title	IMPROVEMENT

Improvements:

Separated Security Events and Event Viewer services.
Refactored code using templates.
Enhanced pull logic and persistence.

Bug fixes:

Refactored collector freezing under high load.
Upgraded DCSDK from 1.10.3 to 1.13.1.

Recommended version

v2.1.0

15 Feb 2024

Status

colour	Red
title	BUG FIX

Status

colour	Green
title	IMPROVEMENT

Improvements:

Improved API limits to align with official documentation.
Upgraded DCSDK from 1.10.2 to 1.10.3.

Bug fixes:

Fixed API rate limits causing slowdowns.

Update

v2.0.0

18 Jan 2024

Status

colour	Green
title	IMPROVEMENT

Improvements:

Refactored source code.
Introduced new templates and enhanced logging
Upgraded DCSDK from 1.2.0 to 1.10.2.

Update

Version	Old Version 1	New Version 2
Changes made by	Andrea Vazquez Varela	Andrea Vazquez Varela
Saved on	Jan 14, 2025	Jan 14, 2025

Versions Compared

Key

Devo collector features

Data sources

Accepted authentication methods

Run the collector

Structure

Devo credentials

Editing the config.yaml file

Download the Docker image

Docker

Docker Compose

Editing the JSON configuration

Change log