AkamaiProlexic

Collects DDoS detection critical events and general events from Akamai Prolexic Analytics for Cortex XSIAM.

Analytics & SIEM · Akamai Prolexic

Details

IDAkamaiProlexic
ProviderAkamai Technologies
CategoryAnalytics & SIEM
From Version8.4.0
Docker Imagedemisto/auth-utils:1.0.0.11671917
Supported ModulesXSIAM

README

Collects DDoS detection critical events and general events from Akamai Prolexic Analytics for Cortex XSIAM.
This integration was integrated and tested with version v2 of the Akamai Prolexic Analytics API.

Configure Akamai Prolexic in Cortex

Parameter Description Required
Server URL The Akamai API host (the value of the “host” field in your .edgerc file). Example: https://akab-h05tnam3wl42son7nktnlnnx-kbob3i3v.luna.akamaiapis.net True
Contract ID The policy domain name of the data center or proxy that the events belong to. True
Client Token The EdgeGrid client token, taken from the “client_token” field of your .edgerc file. True
Client Secret The EdgeGrid client secret, taken from the “client_secret” field of your .edgerc file. True
Access Token The EdgeGrid access token, taken from the “access_token” field of your .edgerc file. True
Account Switch Key The account switch key used to run operations against a managed account, for customers managing more than one account. The Identity and Access Management API provides a list of available account switch keys. False
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch events   False
Event types to fetch The Akamai Prolexic event sources to collect. Each selected source is fetched and deduplicated independently. True
First fetch time The point in time from which to start fetching events on the first run. Examples: “1 day”, “12 hours”. False
Maximum events per fetch The maximum number of events to fetch per source, per fetch. Maximum allowed: 10000. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

akamai-prolexic-get-events

Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.

Base Command

akamai-prolexic-get-events

Input

Argument Name Description Required
limit The maximum number of events to retrieve per source. Default is 50. Optional
event_type A comma-separated list of event types to retrieve. If empty, uses the integration configuration. Possible values are: Critical Events, Events. Optional
start_time The lower-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., “2026-04-20T10:00:00Z”) or relative time expressions (e.g., “3 days ago”). If omitted, the integration’s “First fetch time” value is used. Optional
end_time The upper-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., “2026-04-20T18:00:00Z”) or relative time expressions (e.g., “1 hour ago”). If omitted, no upper bound is applied. Optional
should_push_events Whether to push the retrieved events to Cortex XSIAM. If false, the events are only displayed. Possible values are: true, false. Default is false. Required

Context Output

There is no context output for this command.

Command example

!akamai-prolexic-get-events limit=2 event_type="Critical Events" should_push_events=false

Context Example

{}

Human Readable Output

Akamai Prolexic Events

_time event_type source_log_type _ENTRY_STATUS id firstOccur recentOccur severity description
2026-04-20T10:00:00.000000Z Critical Events CRITICAL_EVENTS new ce-1 2026-04-20T10:00:00Z 2026-04-20T10:00:00Z high DDoS detected on policy A
2026-04-20T11:30:00.000000Z Critical Events CRITICAL_EVENTS updated ce-2 2026-04-20T11:30:00Z 2026-04-20T12:00:00Z critical Volumetric attack on policy B

Configuration parameters

  • url — Server URL (required)
  • contract_id — Contract ID (required)
  • client_token_creds — (required)
  • client_secret_creds — (required)
  • access_token_creds — (required)
  • account_switch_key — Account Switch Key
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • isFetchEvents — Fetch events
  • event_types_to_fetch — Event types to fetch (required)
  • first_fetch — First fetch time
  • max_events_per_fetch — Maximum events per fetch

Commands (1)

  • akamai-prolexic-get-events

    Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.

Source

AkamaiProlexic.py AkamaiProlexic_test.py AkamaiProlexic.yml AkamaiProlexic_description.md command_examples.txt
Download History Raw 
!akamai-prolexic-get-events limit=10 should_push_events=false
!akamai-prolexic-get-events limit=10 event_type="Critical Events" should_push_events=false
!akamai-prolexic-get-events limit=10 event_type="Events" start_time="3 days ago" end_time="1 hour ago" should_push_events=false