Collect Akamai WAF logs

Parser Version: 32.0

This document explains how to ingest Akamai WAF logs to Google Security Operations using the Akamai CEF Connector and Bindplane. Akamai WAF is a cloud-based web application firewall that protects web applications and APIs against threats including SQL injection, cross-site scripting (XSS), and DDoS attacks. The Akamai CEF Connector pulls security events from the Akamai SIEM API in near real time and converts them from JSON to Common Event Format (CEF), which is then forwarded to Bindplane via syslog.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance.
• A Windows 2016 or later or Linux host with systemd for Bindplane agent installation.
• A Linux server (CentOS, RHEL, or Ubuntu recommended) with at least 2 CPU cores, 6 GB RAM, and 2 GB free disk space for the Akamai CEF Connector.
• Java 8 (JRE 1.8) or later installed on the CEF Connector host.
• If running behind a proxy, ensure firewall ports are open per the Bindplane agent requirements, and that the proxy allowlists *.cloudsecurity.akamaiapis.net and *.luna.akamaiapis.net.
• Privileged access to Akamai Control Center.
• An Akamai security configuration with App & API Protector, Kona Site Defender, Web Application Protector, Bot Manager, or Account Protector enabled.

Get Google SecOps ingestion authentication file

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Collection Agents.
3. Download the Ingestion Authentication File.
   • Save the file securely on the system where Bindplane will be installed.

Get Google SecOps customer ID

1. Sign in to the Google SecOps console.
2. Go to SIEM Settings > Profile.
3. Copy and save the Customer ID from the Organization Details section.

Enable SIEM integration in Akamai Control Center

1. Sign in to Akamai Control Center.
2. Go to WEB & DATA CENTER SECURITY > Security Configuration.
3. Open the security configuration and the appropriate version for which you want to collect SIEM data.
4. Click Advanced Settings and expand Data collection for SIEM Integrations.
5. Click On to enable SIEM.
6. Choose the security policies for which you want to export data:
   • All Security policies: Sends SIEM data for events that violate any security policy within the security configuration.
   • Specific security policies: Sends data for one or more specific security policies. Select the appropriate policies from the dropdown list.
7. Copy the value in the Web Security Configuration ID field. Save this ID for later use.

8. Click Activate to push your security configuration changes to the production network. Under Network, click Production, and then click Activate.

Set up a user to manage SIEM in Akamai Control Center

1. In Akamai Control Center, go to ACCOUNT ADMIN > Identity & access.
2. On the Users and API Clients tab, find the user you want to assign the role to or click Create user.
3. To assign the SIEM role to an existing user:
   1. Open the user's account and click the Edit roles tab.
   2. Find the appropriate group, click the Roles dropdown, and select the Manage SIEM role.
   3. Click Submit.

4. To assign the SIEM role to a new user:

   1. Click Create user.
   2. Enter basic information for the user and scroll down to the Assign Roles section.
   3. Find the appropriate group, click the Roles dropdown, and select the Manage SIEM role.
   4. Click Save.

Provision SIEM API credentials in Akamai Control Center

1. Visit the Create authentication credentials page in Akamai documentation.
2. Follow the steps to provision the SIEM API for the user you assigned to manage SIEM.

3. Copy and save the following credentials securely:

   • Access Token
   • Client Token
   • Client Secret
   • Base URL (host)

Install the Akamai CEF Connector

1. On your Linux server, download the latest CEF Connector distribution package from the Akamai SIEM Integration Connector Packages GitHub repository.
2. Transfer the package to your server if needed.
3. Verify the SHA256 hash of the downloaded file to ensure integrity.

4. Unzip the distribution package:

   unzip CEFConnector-<version>.zip
   

5. Navigate to the extracted directory:

   cd CEFConnector-<version>
   

6. Create a symbolic link to the startup script to install the service:

   sudo ln -s /path/to/CEFConnector-<version>/bin/AkamaiCEFConnector.sh /etc/init.d/AkamaiCEFConnector
   

Configure the Akamai CEF Connector

1. Navigate to the config directory within the CEF Connector installation:

   cd /path/to/CEFConnector-<version>/config
   

2. Open the CEFConnector.properties file using a text editor:

   sudo nano CEFConnector.properties
   

3. Configure the following required parameters:

   # Pull rate from Akamai source (in seconds, positive integer)
   connector.pull.interval=60
   
   # Security Configuration IDs (semicolon-separated for multiple)
   akamai.data.configs=<YOUR_SECURITY_CONFIG_ID>
   
   # API Credentials
   akamai.data.accesstoken=<YOUR_ACCESS_TOKEN>
   akamai.data.clienttoken=<YOUR_CLIENT_TOKEN>
   akamai.data.clientsecret=<YOUR_CLIENT_SECRET>
   akamai.data.baseurl=<YOUR_BASE_URL>
   
   # Offset-based mode (recommended for continuous collection)
   akamai.data.timebased=false
   
   # Maximum number of events per API call
   akamai.data.limit=200000
   
   # Proxy Configuration (leave blank if no proxy)
   # connector.proxy.host=
   # connector.proxy.port=
   

4. Replace the following placeholders with your actual values:

   • <YOUR_SECURITY_CONFIG_ID>: The Web Security Configuration ID you copied in the Enable SIEM section. For multiple configurations, separate IDs with semicolons (for example, 12345;67890).
   • <YOUR_ACCESS_TOKEN>: The access token from Akamai API credentials.
   • <YOUR_CLIENT_TOKEN>: The client token from Akamai API credentials.
   • <YOUR_CLIENT_SECRET>: The client secret from Akamai API credentials.
   • <YOUR_BASE_URL>: The base URL (host) from Akamai API credentials (for example, akab-xxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx.luna.akamaiapis.net).

5. Save and close the file.

Configure CEF Connector logging to forward syslog to Bindplane

1. Navigate to the config directory within the CEF Connector installation.

2. Open the log4j2.xml file using a text editor:

   sudo nano /path/to/CEFConnector-<version>/config/log4j2.xml
   

3. In the Properties section near the top of the file, set the remote syslog server parameters to point to the Bindplane agent:

   <!-- Syslog Appender Configuration -->
   <Syslog name="SyslogAppender" 
           host="<BINDPLANE_IP_ADDRESS>" 
           port="<BINDPLANE_PORT>" 
           protocol="<PROTOCOL>" 
           facility="LOCAL0"
           format="RFC 5424">
       <PatternLayout pattern="%m%n"/>
   </Syslog>
   

4. Replace the following placeholders:

   • <BINDPLANE_IP_ADDRESS>: The IP address of the server where the Bindplane agent is installed (for example, 192.168.1.100).
   • <BINDPLANE_PORT>: The port number where the Bindplane agent listens (for example, 514 for UDP or 601 for TCP).
   • Set CEFProtocol to UDP or TCP to match your Bindplane receiver configuration.

5. Save and close the file.

Start the Akamai CEF Connector

1. Start the CEF Connector service:

   sudo /etc/init.d/AkamaiCEFConnector start
   

2. Verify the service is running:

   sudo /etc/init.d/AkamaiCEFConnector status
   

3. Monitor the logs to ensure the connector is pulling events from Akamai and forwarding them:

   tail -f /path/to/CEFConnector-<version>/bin/logs/cefconnector.log
   

Install the Bindplane agent

Install the Bindplane agent on your Windows or Linux operating system according to the following instructions.

Windows installation

1. Open the Command Prompt or PowerShell as an administrator.

2. Run the following command:

   msiexec /i "https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi" /quiet
   

Linux installation

1. Open a terminal with root or sudo privileges.

2. Run the following command:

   sudo sh -c "$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)" install_unix.sh
   

Additional installation resources

For additional installation options, consult this installation guide.

Configure the Bindplane agent to ingest Syslog and send to Google SecOps

1. Access the Configuration File:

   • Locate the config.yaml file. Typically, it's in the /status observiq-otel-collector/ directory on Linux or in the installation directory on Windows.
   • Open the file using a text editor (for example, nano, vi, or Notepad).

2. Edit the config.yaml file as follows:

   receivers:
     udplog:
       # Replace the port and IP address as required
       listen_address: "0.0.0.0:514"
   
   exporters:
     chronicle/chronicle_w_labels:
       compression: gzip
       # Adjust the path to the credentials file you downloaded in the Get ingestion authentication file section
       creds_file_path: '/path/to/ingestion-authentication-file.json'
       # Replace with your actual customer ID from the Get customer ID section
       customer_id: <PLACEHOLDER_CUSTOMER_ID>
       endpoint: malachiteingestion-pa.googleapis.com
       # Add optional ingestion labels for better organization
       log_type: 'AKAMAI_WAF'
       raw_log_field: body
       ingestion_labels:
   
   service:
     pipelines:
       logs/source0__chronicle_w_labels-0:
         receivers:
           - udplog
         exporters:
           - chronicle/chronicle_w_labels
   

• Replace the port and IP address as required in your infrastructure.
• Replace <PLACEHOLDER_CUSTOMER_ID> with the actual Customer ID.
• Update /path/to/ingestion-authentication-file.json to the file path where the authentication file was saved in the Get Google SecOps ingestion authentication file section.

Restart the Bindplane agent to apply the changes

To restart the Bindplane agent in Linux:

1. Run the following command:

   sudo systemctl restart observiq-otel-collector
   

2. Verify the service is running:

   sudo systemctl status observiq-otel-collector
   

3. Check logs for errors:

   sudo journalctl -u observiq-otel-collector -f
   

To restart the Bindplane agent in Windows:

1. Choose one of the following options:

   • Command Prompt or PowerShell as administrator:

   net stop observiq-otel-collector && net start observiq-otel-collector
   

   • Services console:
     1. Press Win+R, type services.msc, and press Enter.
     2. Locate observIQ OpenTelemetry Collector.
     3. Right-click and select Restart.

2. Verify the service is running:

   sc query observiq-otel-collector
   

3. Check logs for errors:

   type "C:\Program Files\observIQ OpenTelemetry Collector\log\collector.log"
   

UDM mapping table

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.