AkamaiProlexic

Details

ID	`AkamaiProlexic`
Provider	Akamai Technologies
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/auth-utils:1.0.0.11671917`
Supported Modules	XSIAM

README

Collects DDoS detection critical events and general events from Akamai Prolexic Analytics for Cortex XSIAM.
This integration was integrated and tested with version v2 of the Akamai Prolexic Analytics API.

Configure Akamai Prolexic in Cortex

Parameter	Description	Required
Server URL	The Akamai API host (the value of the “host” field in your .edgerc file). Example: https://akab-h05tnam3wl42son7nktnlnnx-kbob3i3v.luna.akamaiapis.net	True
Contract ID	The policy domain name of the data center or proxy that the events belong to.	True
Client Token	The EdgeGrid client token, taken from the “client_token” field of your .edgerc file.	True
Client Secret	The EdgeGrid client secret, taken from the “client_secret” field of your .edgerc file.	True
Access Token	The EdgeGrid access token, taken from the “access_token” field of your .edgerc file.	True
Account Switch Key	The account switch key used to run operations against a managed account, for customers managing more than one account. The Identity and Access Management API provides a list of available account switch keys.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch events		False
Event types to fetch	The Akamai Prolexic event sources to collect. Each selected source is fetched and deduplicated independently.	True
First fetch time	The point in time from which to start fetching events on the first run. Examples: “1 day”, “12 hours”.	False
Maximum events per fetch	The maximum number of events to fetch per source, per fetch. Maximum allowed: 10000.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

akamai-prolexic-get-events

Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.

Base Command

akamai-prolexic-get-events

Input

Argument Name	Description	Required
limit	The maximum number of events to retrieve per source. Default is 50.	Optional
event_type	A comma-separated list of event types to retrieve. If empty, uses the integration configuration. Possible values are: Critical Events, Events.	Optional
start_time	The lower-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., “2026-04-20T10:00:00Z”) or relative time expressions (e.g., “3 days ago”). If omitted, the integration’s “First fetch time” value is used.	Optional
end_time	The upper-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., “2026-04-20T18:00:00Z”) or relative time expressions (e.g., “1 hour ago”). If omitted, no upper bound is applied.	Optional
should_push_events	Whether to push the retrieved events to Cortex XSIAM. If false, the events are only displayed. Possible values are: true, false. Default is false.	Required

Context Output

There is no context output for this command.

Command example

!akamai-prolexic-get-events limit=2 event_type="Critical Events" should_push_events=false

Context Example

{}

Human Readable Output

Akamai Prolexic Events

_time event_type source_log_type _ENTRY_STATUS id firstOccur recentOccur severity description

2026-04-20T10:00:00.000000Z Critical Events CRITICAL_EVENTS new ce-1 2026-04-20T10:00:00Z 2026-04-20T10:00:00Z high DDoS detected on policy A

2026-04-20T11:30:00.000000Z Critical Events CRITICAL_EVENTS updated ce-2 2026-04-20T11:30:00Z 2026-04-20T12:00:00Z critical Volumetric attack on policy B

_time	event_type	source_log_type	_ENTRY_STATUS	id	firstOccur	recentOccur	severity	description
2026-04-20T10:00:00.000000Z	Critical Events	CRITICAL_EVENTS	new	ce-1	2026-04-20T10:00:00Z	2026-04-20T10:00:00Z	high	DDoS detected on policy A
2026-04-20T11:30:00.000000Z	Critical Events	CRITICAL_EVENTS	updated	ce-2	2026-04-20T11:30:00Z	2026-04-20T12:00:00Z	critical	Volumetric attack on policy B

Configuration parameters

url — Server URL (required)
contract_id — Contract ID (required)
client_token_creds — (required)
client_secret_creds — (required)
access_token_creds — (required)
account_switch_key — Account Switch Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
event_types_to_fetch — Event types to fetch (required)
first_fetch — First fetch time
max_events_per_fetch — Maximum events per fetch

Commands (1)

akamai-prolexic-get-events
Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.

Source

AkamaiProlexic.py AkamaiProlexic_test.py AkamaiProlexic.yml AkamaiProlexic_description.md command_examples.txt

Download History Raw

name: AkamaiProlexic
display: Akamai Prolexic
category: Analytics & SIEM
provider: Akamai Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: AkamaiProlexic
  version: -1
description: Collects DDoS detection critical events and general events from Akamai Prolexic Analytics for Cortex XSIAM.
fromversion: 8.4.0
configuration:
- name: url
  display: Server URL
  additionalinfo: 'The Akamai API host (the value of the "host" field in your .edgerc file). Example: https://akab-h05tnam3wl42son7nktnlnnx-kbob3i3v.luna.akamaiapis.net'
  required: true
  type: 0
  section: Connect
- name: contract_id
  display: Contract ID
  additionalinfo: The policy domain name of the data center or proxy that the events belong to.
  required: true
  type: 0
  section: Connect
- name: client_token_creds
  displaypassword: Client Token
  additionalinfo: The EdgeGrid client token, taken from the "client_token" field of your .edgerc file.
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- name: client_secret_creds
  displaypassword: Client Secret
  additionalinfo: The EdgeGrid client secret, taken from the "client_secret" field of your .edgerc file.
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- name: access_token_creds
  displaypassword: Access Token
  additionalinfo: The EdgeGrid access token, taken from the "access_token" field of your .edgerc file.
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- name: account_switch_key
  display: Account Switch Key
  additionalinfo: 'The account switch key used to run operations against a managed account, for customers managing more than one account. The Identity and Access Management API provides a list of available account switch keys.'
  required: false
  type: 0
  section: Connect
  advanced: true
- name: insecure
  display: Trust any certificate (not secure)
  required: false
  type: 8
  section: Connect
  advanced: true
- name: proxy
  display: Use system proxy settings
  required: false
  type: 8
  section: Connect
  advanced: true
- name: isFetchEvents
  display: Fetch events
  type: 8
  required: false
  section: Collect
- name: event_types_to_fetch
  display: Event types to fetch
  type: 16
  defaultvalue: Critical Events,Events
  additionalinfo: The Akamai Prolexic event sources to collect. Each selected source is fetched and deduplicated independently.
  options:
  - Critical Events
  - Events
  required: true
  section: Collect
- name: first_fetch
  display: First fetch time
  defaultvalue: now
  additionalinfo: 'The point in time from which to start fetching events on the first run. Examples: "1 day", "12 hours".'
  required: false
  type: 0
  section: Collect
- name: max_events_per_fetch
  display: Maximum events per fetch
  defaultvalue: '1000'
  additionalinfo: 'The maximum number of events to fetch per source, per fetch. Maximum allowed: 10000.'
  required: false
  type: 0
  section: Collect
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/auth-utils:1.0.0.11671917
  isfetchevents: true
  runonce: false
  commands:
  - name: akamai-prolexic-get-events
    description: Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.
    arguments:
    - name: limit
      description: The maximum number of events to retrieve per source.
      type: number
      defaultValue: '50'
      required: false
    - name: event_type
      description: A comma-separated list of event types to retrieve. If empty, uses the integration configuration.
      auto: PREDEFINED
      predefined:
      - Critical Events
      - Events
      isArray: true
      required: false
    - name: start_time
      description: 'The lower-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., "2026-04-20T10:00:00Z") or relative time expressions (e.g., "3 days ago"). If omitted, the integration''s "First fetch time" value is used.'
      type: date
      required: false
    - name: end_time
      description: 'The upper-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., "2026-04-20T18:00:00Z") or relative time expressions (e.g., "1 hour ago"). If omitted, no upper bound is applied.'
      type: date
      required: false
    - name: should_push_events
      description: Whether to push the retrieved events to Cortex XSIAM. If false, the events are only displayed.
      auto: PREDEFINED
      type: boolean
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
      required: true
    outputs: []
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam
tests:
- No tests (auto formatted)