Akamai SIEM collector

Configuration requirements

To run this collector, there are some configurations detailed below that you need to consider.

Overview

The Akamai SIEM Collector is designed to retrieve and aggregate security event data from the Akamai platform. Using Akamai's SIEM Integration API, it enables seamless collection of security logs and events, allowing organizations to centralize this critical information in their SIEM systems. This ensures streamlined analysis and improved threat detection by providing real-time, actionable insights into security-related activities across their infrastructure.

2.x to 3.x migrating guide

If you are migrating from v2.x to v3.x, you can find a complete guide in this article.

Devo collector features

Data sources

This collector extracts data from the Akamai SIEM log service:

• Akamai SIEM security events: Retrieves security event data using an offset to ensure seamless data collection, starting from the last message pulled.

For more information on how the events are parsed, visit our page

Flattening preprocessing

This collector does not implement flattening

Vendor setup

To configure the Akamai SIEM Collector Service, follow these steps:

1. Access Akamai Control Center:

   • Log in to your Akamai Control Center.

2. Assign the Manage SIEM Role:

   • Navigate to the Identity and Access Management section.

   • Ensure that the Manage SIEM user role is assigned to your account.

   • For detailed instructions, refer to the Role-based access controls.

3. Create Authentication Credentials:

   • In the API Credentials section, create new credentials.

   • Select the API service named SIEM and set the access level to READ-WRITE.

   • Generate and securely store the following credentials:

     • Client Token

     • Client Secret

     • Access Token

   • Detailed steps can be found in the Get started guide.

4. Configure the SIEM API Endpoint:

   • Identify the appropriate hostname for the API endpoint.

   • Ensure Akamai’s connector is configured to communicate with this endpoint.

5. Implement the EdgeGrid Authentication Scheme:

   • Ensure that Akamai’s connector supports the Akamai EdgeGrid authentication scheme.

   • Configure Akamai’s connector with the Client Token, Client Secret, and Access Token obtained earlier.

   • For implementation details, refer to the SIEM Integration API.

6. Enable SIEM Integration:

   • In the Akamai Control Center, navigate to the SIEM Integration section of your security configuration.

   • Turn on SIEM Integration and enable data collection.

   • Refer to the SIEM Integration Guide for detailed instructions.

Minimum configuration required for basic pulling

Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.

Accepted authentication methods

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Collector services detail

This section is intended to explain how to proceed with specific actions for services.

Security events service

Collector operations

This section is intended to explain how to proceed with specific operations of this collector.

Change log