name: AkamaiProlexic
display: Akamai Prolexic
category: Analytics & SIEM
provider: Akamai Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: AkamaiProlexic
  version: -1
description: Collects DDoS detection critical events and general events from Akamai Prolexic Analytics for Cortex XSIAM.
fromversion: 8.4.0
configuration:
- name: url
  display: Server URL
  additionalinfo: 'The Akamai API host (the value of the "host" field in your .edgerc file). Example: https://akab-h05tnam3wl42son7nktnlnnx-kbob3i3v.luna.akamaiapis.net'
  required: true
  type: 0
  section: Connect
- name: contract_id
  display: Contract ID
  additionalinfo: The policy domain name of the data center or proxy that the events belong to.
  required: true
  type: 0
  section: Connect
- name: client_token_creds
  displaypassword: Client Token
  additionalinfo: The EdgeGrid client token, taken from the "client_token" field of your .edgerc file.
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- name: client_secret_creds
  displaypassword: Client Secret
  additionalinfo: The EdgeGrid client secret, taken from the "client_secret" field of your .edgerc file.
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- name: access_token_creds
  displaypassword: Access Token
  additionalinfo: The EdgeGrid access token, taken from the "access_token" field of your .edgerc file.
  hiddenusername: true
  required: true
  type: 9
  section: Connect
- name: account_switch_key
  display: Account Switch Key
  additionalinfo: 'The account switch key used to run operations against a managed account, for customers managing more than one account. The Identity and Access Management API provides a list of available account switch keys.'
  required: false
  type: 0
  section: Connect
  advanced: true
- name: insecure
  display: Trust any certificate (not secure)
  required: false
  type: 8
  section: Connect
  advanced: true
- name: proxy
  display: Use system proxy settings
  required: false
  type: 8
  section: Connect
  advanced: true
- name: isFetchEvents
  display: Fetch events
  type: 8
  required: false
  section: Collect
- name: event_types_to_fetch
  display: Event types to fetch
  type: 16
  defaultvalue: Critical Events,Events
  additionalinfo: The Akamai Prolexic event sources to collect. Each selected source is fetched and deduplicated independently.
  options:
  - Critical Events
  - Events
  required: true
  section: Collect
- name: first_fetch
  display: First fetch time
  defaultvalue: now
  additionalinfo: 'The point in time from which to start fetching events on the first run. Examples: "1 day", "12 hours".'
  required: false
  type: 0
  section: Collect
- name: max_events_per_fetch
  display: Maximum events per fetch
  defaultvalue: '1000'
  additionalinfo: 'The maximum number of events to fetch per source, per fetch. Maximum allowed: 10000.'
  required: false
  type: 0
  section: Collect
script:
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/auth-utils:1.0.0.11671917
  isfetchevents: true
  runonce: false
  commands:
  - name: akamai-prolexic-get-events
    description: Gets events from Akamai Prolexic. This command is used for developing and debugging and is to be used with caution, as it can create duplicate events in the dataset.
    arguments:
    - name: limit
      description: The maximum number of events to retrieve per source.
      type: number
      defaultValue: '50'
      required: false
    - name: event_type
      description: A comma-separated list of event types to retrieve. If empty, uses the integration configuration.
      auto: PREDEFINED
      predefined:
      - Critical Events
      - Events
      isArray: true
      required: false
    - name: start_time
      description: 'The lower-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., "2026-04-20T10:00:00Z") or relative time expressions (e.g., "3 days ago"). If omitted, the integration''s "First fetch time" value is used.'
      type: date
      required: false
    - name: end_time
      description: 'The upper-bound timestamp for events to retrieve. Supports ISO 8601 (e.g., "2026-04-20T18:00:00Z") or relative time expressions (e.g., "1 hour ago"). If omitted, no upper bound is applied.'
      type: date
      required: false
    - name: should_push_events
      description: Whether to push the retrieved events to Cortex XSIAM. If false, the events are only displayed.
      auto: PREDEFINED
      type: boolean
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
      required: true
    outputs: []
marketplaces:
- marketplacev2
- platform
supportedModules:
- xsiam
tests:
- No tests (auto formatted)