Akamai SIEM Integration
Splunk AppInspect Passed
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
It’s common for companies with mature security organizations to have a Security Operations Center (SOC) that leverages security information and event management (SIEM) tools. SIEM provides a centralized view for security teams to easily access and analyze security information from a large number of sources, and prioritize mitigation efforts based on risk profiles.
SIEM Integration is a comprehensive solution for capture, retention, and delivery of security information and events in real-time to SIEM applications. Customers using Kona Site Defender, Client Reputation, Web Application, or Bot Manager (BETA) can analyze security events generated on the Akamai platform and correlate them with security events generated from other sources.
System Requirements
Akamai’s Splunk Connector requires Sun JRE 1.8+ to be installed. Download the latest from the Sun Java site (Java Platform, Standard Edition) or install from a software distribution package on Linux.
You must have Java installed on the host running Splunk Enterprise https://java.com/en/download/
Also, check to make sure that splunk forwarder is NOT installed on your Splunk Enterprise host machine.
Proxy server
To access the SIEM API from behind a proxy server, ensure that your proxy:
whitelists the domains *.cloudsecurity.akamaiapis.net
does not interfere with HTTP request headers for those domains. If, due to a strict enterprise security policy, your proxy does change these headers, make sure that at a minimum you allow and don't change the Host and Authorization headers.
Hardware Requirements
This application is has been tested with the following operating systems:
CentOS 7
Windows Server 2012 R2
Mac OS X El Capitan Version 10.11.6
Some additional hardware requirements:
4 CPU cores
16 GB RAM
2GB Free Disk Space
SIEM Integration is a comprehensive solution for capture, retention, and delivery of security information and events in real-time to SIEM applications. Customers using Kona Site Defender, Client Reputation, Web Application, or Bot Manager (BETA) can analyze security events generated on the Akamai platform and correlate them with security events generated from other sources.
System Requirements
Akamai’s Splunk Connector requires Sun JRE 1.8+ to be installed. Download the latest from the Sun Java site (Java Platform, Standard Edition) or install from a software distribution package on Linux.
You must have Java installed on the host running Splunk Enterprise https://java.com/en/download/
Also, check to make sure that splunk forwarder is NOT installed on your Splunk Enterprise host machine.
Proxy server
To access the SIEM API from behind a proxy server, ensure that your proxy:
whitelists the domains *.cloudsecurity.akamaiapis.net
does not interfere with HTTP request headers for those domains. If, due to a strict enterprise security policy, your proxy does change these headers, make sure that at a minimum you allow and don't change the Host and Authorization headers.
Hardware Requirements
This application is has been tested with the following operating systems:
CentOS 7
Windows Server 2012 R2
Mac OS X El Capitan Version 10.11.6
Some additional hardware requirements:
4 CPU cores
16 GB RAM
2GB Free Disk Space
Release Notes
Version 1.4.7
June 19, 2019
>**Update:** Version 1.4.7 of the sample Splunk Connector was released in June 2019. Changes include:
>* Bug fix "Incorrect parsing of header fields"
Version 1.4.6
Jan. 18, 2019
>**Update:** Version 1.4.6 of the sample Splunk Connector was released in Jan 2019. Changes include:
>* Changes for Splunk cloud certification
Version 1.4.5
Jan. 8, 2019
>**Update:** Version 1.4.5 of the sample Splunk Connector was released in Jan 2019. Changes include:
>* Bug fix "java.io.EOFException: Unexpected end of ZLIB input stream"
Version 1.4.4
Nov. 30, 2018
>**Update:** Version 1.4.4 of the sample Splunk Connector was released in Sept 2018. Changes include:
>* Uploaded in Splunk, With some minor changes to connector