name: Akamai WAF SIEM
display: Akamai WAF SIEM
category: Analytics & SIEM
provider: Akamai Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: Akamai WAF SIEM
  version: -1
configuration:
- defaultvalue: https://akaa-xxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx.luna.akamaiapis.net
  display: Server URL (e.g., https://akaa-xxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx.luna.akamaiapis.net)
  name: host
  required: true
  type: 0
  section: Connect
- display: Client token
  name: clientToken
  type: 4
  hidden: true
  required: false
  section: Connect
- name: clienttoken_creds
  type: 9
  displaypassword: Client token
  hiddenusername: true
  required: false
  section: Connect
- display: Access token
  name: accessToken
  type: 4
  hidden: true
  required: false
  section: Connect
- name: accesstoken_creds
  type: 9
  displaypassword: Access token
  hiddenusername: true
  required: false
  section: Connect
- display: Client secret
  name: clientSecret
  type: 4
  hidden: true
  required: false
  section: Connect
- name: clientsecret_creds
  type: 9
  displaypassword: Client secret
  hiddenusername: true
  required: false
  section: Connect
- name: configIds
  display: Config IDs to fetch
  required: true
  type: 0
  section: Collect
  additionalinfo: Your Akamai security configuration ID(s). Multiple IDs can be separated by semicolons (e.g., 12345;2345;3456). Config IDs are unique to your account.
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetchTime
  type: 0
  defaultvalue: 1 hours
  required: false
  section: Collect
- display: Incident fetch limit
  name: fetchLimit
  type: 0
  defaultvalue: '20'
  required: false
  additionalinfo: The maximum total number of incidents to retrieve per fetch. The maximum is 2000.
  section: Collect
  hidden:
  - marketplacev2
  - platform
- display: Events fetch limit
  name: eventsFetchLimit
  type: 0
  defaultvalue: '60000'
  required: false
  additionalinfo: The maximum total number of events to retrieve per fetch. The maximum is 80k.
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  advanced: false
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  required: false
  type: 8
  section: Connect
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
  hidden:
  - marketplacev2
  - platform
- display: Events Fetch Interval
  name: eventFetchInterval
  type: 19
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  defaultvalue: '1'
  advanced: false
- display: Fetch Events
  name: isFetchEvents
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  additionalinfo: Make sure this feature is not used with long running configured in the integration params and that there's no config ID used for 2 different instances / features.
- display: Skip events decoding
  name: should_skip_decode_events
  additionalinfo: Use this parameter to avoid decoding the http message and attack data fields and speed up the ingestion rate.
  type: 8
  required: false
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
- display: Long running instance
  name: longRunning
  additionalinfo: This is a beta feature for high performance fetch events. Use this param only if advised by CS. Make sure this feature is not used with fetch events configured in the integration params and that there's no config ID used for 2 different instances / features.
  type: 8
  required: false
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  section: Collect
  advanced: true
- display: Page Size - high performance mode
  name: beta_page_size
  type: 0
  defaultvalue: '200000'
  required: false
  additionalinfo: The number of events to fetch per request to akamai Default is 200k, maximum is 600k as per Akamai documentation. Use this only when using the long running beta feature.
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  advanced: true
- display: Max allowed concurrent tasks
  name: max_concurrent_tasks
  type: 0
  defaultvalue: '100'
  required: false
  additionalinfo: The number of tasks that can run concurrently - the higher the number, the bigger the gap between the ingested events and the events pulled from akamai can be. Maximum is 10k. Use this only when using the long running beta feature.
  section: Collect
  hidden:
  - xsoar
  supportedModules:
  - xsiam
  advanced: true
description: Use the Akamai WAF SIEM integration to retrieve security events from Akamai Web Application Firewall (WAF) service.
script:
  commands:
  - description: Reset the last offset to start fetching from the first fetch timestamp, use this command when the instance is disabled.
    name: akamai-siem-reset-offset
  - arguments:
    - description: 'Unique identifier for each security configuration. To report on more than one configuration, separate the integer identifiers with semicolons (;), for example: 12892;29182;82912.'
      name: config_ids
      required: true
    - description: This token denotes the last message. If specified, this operation fetches only security events that have occurred from the offset. This is a required parameter for offset mode and you can’t use it in time-based requests.
      name: offset
    - defaultValue: '30'
      description: Defines the maximum number of security events returned per fetch.
      name: limit
    - description: The start of a specified time range, expressed in Unix epoch seconds.
      name: from_epoch
    - description: The end of a specified time range, expressed in Unix epoch seconds.
      name: to_epoch
    - description: Timestamp of events (<number> <time unit>. For example, 12 hours, 7 days.
      name: time_stamp
    description: Get security events from Akamai WAF.
    name: akamai-siem-get-events
    outputs:
    - contextPath: Akamai.SIEM.AttackData.clientIP
      description: IP address involved in the attack.
      type: String
    - contextPath: Akamai.SIEM.AttackData.ConfigID
      description: Unique identifier of the security configuration involved.
      type: String
    - contextPath: Akamai.SIEM.AttackData.PolicyID
      description: Unique identifier of the policy configuration involved.
      type: String
    - contextPath: Akamai.SIEM.AttackData.PolicyID
      description: The policy ID that was triggered.
      type: String
    - contextPath: Akamai.SIEM.AttackData.Geo.Asn
      description: Geographic ASN location of the IP address involved in the attack.
      type: String
    - contextPath: Akamai.SIEM.AttackData.Geo.City
      description: City of the IP address involved in the attack.
      type: String
    - contextPath: Akamai.SIEM.AttackData.Geo.Continent
      description: Continent of the IP address involved in the attack.
      type: String
    - contextPath: Akamai.SIEM.AttackData.Geo.Country
      description: Country of the IP address involved in the attack.
      type: String
    - contextPath: Akamai.SIEM.AttackData.Geo.RegionCode
      description: Region code of the IP address involved in the attack.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Bytes
      description: HTTP messege size in bytes.
      type: Number
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Host
      description: HTTP messege host.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Method
      description: HTTP messege method.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Path
      description: HTTP messege path.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Port
      description: HTTP messege port.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Protocol
      description: HTTP messege protocol.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Query
      description: HTTP messege query.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.RequestHeaders
      description: HTTP messege request headers.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.RequestID
      description: HTTP messege request ID.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.ResponseHeaders
      description: HTTP message response headers.
      type: String
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Start
      description: HTTP messege epoch start time.
      type: Date
    - contextPath: Akamai.SIEM.AttackData.HttpMessage.Status
      description: HTTP messege status code.
      type: Number
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.ASN
      description: 'The autonomous system name for the IP address, for example: "AS8948"."'
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
  dockerimage: demisto/auth-utils:1.0.0.10133006
  isfetch: true
  isfetch:marketplacev2: false
  isfetchevents: true
  isfetchevents:xsoar: false
  longRunning: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Akamai_WAF_SIEM-Test
fromversion: 5.0.0