You can stream EAA Access Logs to different SIEM providers like DataDog,TrafficPeak, Splunk and Amazon CloudWatch to monitor the access logs for your application.

📘

Note

This feature is in limited-availability (LA) and can be enabled in your contract by contacting Akamai support.

Send Access Logs to SIEM provider

Follow this procedure to send Access Logs to SIEM provider namely Datadog, TrafficPeak, Splunk, and Amazon Cloudwatch:

1. Log in to the Enterprise Center.
2. In the Enterprise Center navigation menu, select Application Access > General Settings > Settings > Company Settings.
3. Go to the System monitoring SIEMs section.
4. Click Add SIEM.
5. Select what type of data you wish to stream: Logs, Metrics, or Logs and Metrics. Select Logs.
6. Select the type of SIEM: Datadog, TrafficPeak, Splunk or Amazon CloudWatch
7. Based on the type of SIEM provide the respective Integration Details:
   1. For Datadog and TrafficPeak, provide the Encryption Token, SIEM server URL which you used when you configured your SIEM server.
   2. For Splunk, provide the Encryption Token which is the HTTP Event Collector (HEC) encryption token, SIEM server endpoint which you used when you configured your SIEM server.
   3. For Amazon CloudWatch, provide the Region which is your Amazon region, Namespace which is the name of the log groups into which the EAA logs are streamed, Access Key, and Secret Key for the CloudWatch server.
8. Click Test Connection, to make sure EAA can communicate with the SIM server successfully. After the connection is established successfully, click Next.
9. Check that the type of Logs is set to Access Logs.
10. Under Status, toggle the switch to SIEM is Enabled.
11. Click Save SIEM.
12. Under System monitoring SIEMs, you will see a new entry which shows the SIEM server, the integration type, the streamed data, and if the integration is enabled or not.

For example, Datadog has been enabled to receive Access Logs:

When users access an application, the access logs are sent to the SIEM provider for visualization.

Wait for a few minutes for the scheduler to pick up the newly created subscription. Access your EAA application so that there is a log entry.

13. Go to the SIEM server to view the access logs.

Refer to the respective documentation for more details:

For DataDog see DataDog Log Explorer.

For Amazon CloudWatch, navigate to CloudWatch portal > Logs > Live Tail, select the log group that you set up in monitoring EAA logs. You can see the logs tailed here. Refer to Amazon CloudWatch Live Tail documentation for more details.

For Splunk there is a 30 second time range window for the logs to appear after you search for eaa index in the splunk enterprise portal. Refer to Splunk documentation for retrieving logs using Indexes.