Akamai_WAF Parsing Rule

Details

Rules (XQL)

[INGEST:vendor="Akamai", product="WAF", target_dataset="akamai_waf_raw", no_hit=keep]
// Support only 10 digit epoch date time format. For example: "1669420445".
alter start = to_integer(httpMessage -> start)
| alter _time = to_timestamp (start, "SECONDS")
| alter haIntegrationEventID = httpMessage -> requestId;