AkamaiProlexic

Details

ID	`AkamaiProlexic`
Provider	Akamai Technologies
Category	Analytics & SIEM
From Version	8.4.0
Docker Image	`demisto/auth-utils:1.0.0.11671917`
Supported Modules	XSIAM

README

Collects DDoS detection critical events and general events from Akamai Prolexic Analytics for Cortex XSIAM.
This integration was integrated and tested with version v2 of the Akamai Prolexic Analytics API.

Configure Akamai Prolexic in Cortex

Parameter	Description	Required
Server URL	The Akamai API host (the value of the “host” field in your .edgerc file). Example: https://akab-h05tnam3wl42son7nktnlnnx-kbob3i3v.luna.akamaiapis.net	True
Contract ID	The policy domain name of the data center or proxy that the events belong to.	True
Client Token	The EdgeGrid client token, taken from the “client_token” field of your .edgerc file.	True
Client Secret	The EdgeGrid client secret, taken from the “client_secret” field of your .edgerc file.	True
Access Token	The EdgeGrid access token, taken from the “access_token” field of your .edgerc file.	True
Account Switch Key	The account switch key used to run operations against a managed account, for customers managing more than one account. The Identity and Access Management API provides a list of available account switch keys.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch events		False
Event types to fetch	The Akamai Prolexic event sources to collect. Each selected source is fetched and deduplicated independently.	True
First fetch time	The point in time from which to start fetching events on the first run. Examples: “1 day”, “12 hours”.	False
Maximum events per fetch	The maximum number of events to fetch per source, per fetch. Maximum allowed: 10000.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

akamai-prolexic-get-events

Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.

Base Command

akamai-prolexic-get-events

Input

Argument Name	Description	Required
limit	The maximum number of events to retrieve per source. Default is 50.	Optional
event_type	A comma-separated list of event types to retrieve. If empty, uses the integration configuration. Possible values are: Critical Events, Events.	Optional
start_time	The lower-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., “2026-04-20T10:00:00Z”) or relative time expressions (e.g., “3 days ago”). If omitted, the integration’s “First fetch time” value is used.	Optional
end_time	The upper-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., “2026-04-20T18:00:00Z”) or relative time expressions (e.g., “1 hour ago”). If omitted, no upper bound is applied.	Optional
should_push_events	Whether to push the retrieved events to Cortex XSIAM. If false, the events are only displayed. Possible values are: true, false. Default is false.	Required

Context Output

There is no context output for this command.

Command example

!akamai-prolexic-get-events limit=2 event_type="Critical Events" should_push_events=false

Context Example

{}

Human Readable Output

Akamai Prolexic Events

_time event_type source_log_type _ENTRY_STATUS id firstOccur recentOccur severity description

2026-04-20T10:00:00.000000Z Critical Events CRITICAL_EVENTS new ce-1 2026-04-20T10:00:00Z 2026-04-20T10:00:00Z high DDoS detected on policy A

2026-04-20T11:30:00.000000Z Critical Events CRITICAL_EVENTS updated ce-2 2026-04-20T11:30:00Z 2026-04-20T12:00:00Z critical Volumetric attack on policy B

_time	event_type	source_log_type	_ENTRY_STATUS	id	firstOccur	recentOccur	severity	description
2026-04-20T10:00:00.000000Z	Critical Events	CRITICAL_EVENTS	new	ce-1	2026-04-20T10:00:00Z	2026-04-20T10:00:00Z	high	DDoS detected on policy A
2026-04-20T11:30:00.000000Z	Critical Events	CRITICAL_EVENTS	updated	ce-2	2026-04-20T11:30:00Z	2026-04-20T12:00:00Z	critical	Volumetric attack on policy B

Configuration parameters

url — Server URL (required)
contract_id — Contract ID (required)
client_token_creds — (required)
client_secret_creds — (required)
access_token_creds — (required)
account_switch_key — Account Switch Key
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
isFetchEvents — Fetch events
event_types_to_fetch — Event types to fetch (required)
first_fetch — First fetch time
max_events_per_fetch — Maximum events per fetch

Commands (1)

akamai-prolexic-get-events
Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.

Source

AkamaiProlexic.py AkamaiProlexic_test.py AkamaiProlexic.yml AkamaiProlexic_description.md command_examples.txt

Download History Raw

## Akamai Prolexic

### How to obtain the configuration parameters

You will need an Akamai API client with the **READ-ONLY** access level for the
*Prolexic Analytics* API, and your Prolexic *Contract ID*.

1. In **Akamai Control Center**, open
   **Identity and Access Management** and click **Create API client**.
   See the [Akamai documentation](https://techdocs.akamai.com/developer/docs/set-up-authentication-credentials)
   for detailed instructions.
2. Click **Quick** and then **Download** under *Credentials*. This places an
   `.edgerc` file in your home directory.
3. Open the file in a text editor — it will look like:

   ```ini
   [default]
   client_secret = [client-secret]
   host = akab-xxxxxxxxxxxxxxxx-yyyyyyyyyyyyyyyy.luna.akamaiapis.net
   access_token = [access-token]
   client_token = [client-token]
   ```

4. Use the values from the `.edgerc` file in this integration's configuration:

   | `.edgerc` field | Integration parameter |
   |---|---|
   | `host`          | **Server URL** (prefixed with `https://`) |
   | `client_token`  | **Client Token** |
   | `client_secret` | **Client Secret** |
   | `access_token`  | **Access Token** |

5. Provide your Prolexic **Contract ID** (the policy domain that the events
   belong to).

### Account Switch Key (multi-account customers)

If you manage more than one Akamai account, supply the **Account Switch Key**
parameter to run operations against a managed account. The Identity and
Access Management API provides the list of available switch keys.

### Rate limits

The Prolexic Analytics API is limited to **1000 requests per hour**. Configure
the **Maximum events per fetch** and **Events Fetch Interval** parameters to
stay below that ceiling.