Akamai App & API Protector

About the Device

App & API Protector is a single solution for web application firewall, bot mitigation, API security, and DDoS, including Layer 7 DDoS protection. Quickly identify vulnerabilities and mitigate threats across the most complicated web and API architectures. The leading attack detection solution on the market, App & API Protector is easy to implement and use, with automatic security updates and holistic visibility into traffic and attacks.

Device Information

Collection Method

Device Configuration

Pre-Requisite:

1. Make sure that you have access to your Akamai Luna Control center (https://control.akamai.com) to configure and provision the SIEM integration

Step 1: Turn on SIEM integration

1. Visit https://control.akamai.com/ and log in.

2. In ​Control Center​, in WEB & DATA CENTER SECURITY, click Security Configuration.

3. Open the security configuration (and the appropriate version of that configuration) for which you want to collect SIEM data.

4. Click Advanced Settings and expand Data collection for SIEM Integrations.

5. Click On to enable SIEM.

6. Choose the security policies for which you want to export data.

   • Select All Security policies if you want to send SIEM data for events that violate any or all security policies within the security configuration.

   • Select Specific security policies if you want data regarding one or more specific security policies. Select the appropriate policies from the dropdown list.

7. To include events generated by Bot Manager, set Include Bot Manager Events to Yes. To exclude Bot Manager events, choose No. To include Bot Manager Events, you also need to switch your security configuration to use the Bot Score detection set

8. To include events generated by Account Protector, set Include user-risk-only events to Yes. To exclude those events, choose No. This options adds user-risk events that trigger account protection detections alone. When a request triggers both account protection and web application rules, SIEM generates a security even which inclused both. Turn this option on to get all user-risk events

9. If you use Account Protector and want to include the unencrypted Username, set Include username to Yes. To exclude the username, choose No. When you include username, anyone with access to your SIEM output can potentially see this value and its associated risk score.

10. Skip the SIEM Event Version field for now.

11. Copy the value in the Web Security Configuration ID field. You’ll need this later in the configuration process.

12. Push your security configuration changes to the production network. On the Security Configuration page, click Activate. Under Network, click Production, and then click Activate.

If you want to enable SIEM integration for additional security configurations, repeat the preceding process for each configuration before continuing to Step 2.

Step 2: Set up a user to manage SIEM

Add or assign a user to manage your SIEM APIs.

1. In ​Control Center​, under ACCOUNT ADMIN, click Identity & access.

2. On the Users and API Clients tab, find the user you want to assign the role to or click the Create user button.

3. To assign the SIEM role to an existing user, open the user's account and click the Edit roles tab. Find the appropriate group, click the Roles dropdown, and select the Manage SIEM role. Click Submit.

   • To assign the SIEM role to a new user, click Create user. Enter basic information for the user and scroll down to the Assign Roles section. Find the appropriate group, click the Roles dropdown, and select the Manage SIEM role. Click Save.

     Note: Only the Manage SIEM role has the proper permissions: don't assign this user any other role.

   • If you want to assign the Manage SIEM role for another group, select the group and repeat the preceding process. Note that, if you have multiple groups and users in your account, you must assign a user the Manage SIEM role for each group that contains a security configuration included in your SIEM results. This must be the same person you associate with the API credentials in Step 3.

Step 3: Provision SIEM API and get access tokens:

1. In Control Center, select ☰ > ACCOUNT ADMIN > Identity & access.

2. In Users and API Clients, click Create API client.

3. Click Quick to create an API client with access levels, group roles, and permissions identical to your current login.

4. Click Show additional details to verify the APIs you can access.
   Enter the API service's name in the Filter field to verify that it's included and that you have the proper level of access.

Open

5. Click Hide additional details to return to the Details and Credentials information.

6. Click Download in the Credentials section.

Open

7. You will get Host, Client Token, Client Secret & Access Token in this file. You also need to provide Security Configuration Key also along with the this file to AMxDR on-boarding team.

Integration Parameters