Akamai Security Events (via Codeless Connector Framework)

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index

Attribute Value
Connector ID AkamaiSIEMConnector
Publisher Akamai
Used in Solutions Akamai DDOS Protection
Collection Method CCF
Connector Definition Files AkamaiDDOSProtection_ConnectorDefinition.json
DCR Definition Files AkamaiDDOSProtection_DCR.json
CCF Configuration AkamaiDDOSProtection_PollerConfig.json
CCF Capabilities EdgeGrid, Paging

The Akamai SIEM Connector ingests web application firewall (WAF) security events from the Akamai SIEM Integration API into Microsoft Sentinel. The connector collects detailed security event data including attack information, geographic context, and HTTP request/response metadata. Authentication uses Akamai EdgeGrid - provide your three EdgeGrid credentials (client_token, access_token, client_secret) plus the API hostname from your .edgerc file. The platform runtime computes a fresh HMAC-SHA-256 signed Authorization header on every poll request per the EdgeGrid specification.

Tables Ingested

This connector ingests data into the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
AkamaiSIEMEvent_CL ? ✓ ?

💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.

Permissions

Resource Provider Permissions:

Custom Permissions:

Setup Instructions

⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.

1. Step 1 - Enable Data Collection for SIEM in Akamai Security Center

Turn on SIEM integration in your Akamai security configuration and note the Web Security Configuration ID.

  1. Log in to Akamai Security Center.
  2. Select your security configuration and open the SIEM Integration section.
  3. Set Data collection for SIEM to On.
  4. Under Turn on SIEM integration for, select the security policies to monitor (or choose All Security Policies).
  5. Choose a SIEM Event Version (SIEM Version 01 is recommended).
  6. Copy the Web Security Configuration ID shown on the page - you will need it in Step 3 below.

2. Step 2 - Provision EdgeGrid API credentials

Create an Akamai EdgeGrid API client with the Manage SIEM role and download the .edgerc credentials file.

  1. In Akamai Control Center, go to Identity & Access > Users.
  2. Create a new user (or select an existing service account) and assign the Manage SIEM role.
  3. Go to Identity & Access > API Clients and click Create API client > Quick.
  4. Select the SIEM API service and grant READ access.
  5. Click Create and then Download to save the .edgerc file.
  6. The .edgerc file contains the four values you will enter in Step 3:
[default]
client_secret = <your-client-secret>
host = <your-host>.luna.akamaiapis.net
access_token = akab-<your-access-token>
client_token = akab-<your-client-token>

The connector platform computes a fresh HMAC-SHA-256 signed Authorization header on every poll - you do not need to sign anything manually.

3. Step 3 - Connect Akamai SIEM to Microsoft Sentinel Multi-tenant support: This connector supports ingesting security events from multiple Akamai security configurations in parallel. Click Add Connection once per configuration, supplying that configuration's EdgeGrid credentials, hostname, and Config ID. Each connection is tracked and managed independently in the grid below. Connector Management Interface

This section is an interactive interface in the Microsoft Sentinel portal that allows you to manage your data collectors.

📊 View Existing Collectors: A management table displays all currently configured data collectors with the following information:

➕ Add New Collector: Click the "Add new collector" button to configure a new data collector (see configuration form below).

🔧 Manage Collectors: Use the actions menu to delete or modify existing collectors.

💡 Portal-Only Feature: This configuration interface is only available when viewing the connector in the Microsoft Sentinel portal. You cannot configure data collectors through this static documentation.

Configure Akamai SIEM API Connection

Connect to an Akamai security configuration to ingest WAF events

When you click the "Add Connection" button in the portal, a configuration form will open. You'll need to provide:

💡 Portal-Only Feature: This configuration form is only available in the Microsoft Sentinel portal.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index