You can stream EAA Access Logs to Elasticsearch SIEM to monitor access data for your applications.

📘

Note

This feature is in limited-availability (LA) and can be enabled in your contract by contacting Akamai support.

Follow the steps below to configure Elasticsearch and EAA SIEM.

Provide security privileges and create index in Elasticsearch

1. You must provide security privileges and create an index for EAA in your Elasticsearch account.
2. In your Elasticsearch account, navigate to your API keys section.
   Provide write and view_index_metadata security privileges to the eaa-logs API key:

3. To set up the index, go to the Dev Tools Console in Elasticsearch and create a PUT call to logs-eaasiem. You can provide any name of your choice and make a note of it. It will be needed in setting up the Elastic SIEM server in EAA.

Note the name of the index. In this example it is logs-eaasiem.

Send Access Logs to Elasticsearch SIEM provider

Follow this procedure to send Access Logs to SIEM provider:

1. Log in to the Enterprise Center.
2. In the Enterprise Center navigation menu, select Application Access > General Settings > Settings > Company Settings.
3. Go to the System monitoring SIEMs section.
4. Click Add SIEM.
5. For What do you want to stream? Select Logs
6. For Which SIEM? Select Elasticsearch.
7. For Enter your SIEM connection information provide the following:
   Index. Name of the eaa index in Elasticsearch. In this example, it is logs-eaasiem. Or if using another name, provide the same here.
   Endpoint. Provide the endpoint URL for your elasticsearch account.
   API Key. Provide your API keys for elasticseach account.
8. Click Test Connection, to make sure EAA can communicate with the SIM server successfully. After the connection is established successfully, click Next.
9. Check that the type of Logs is set to Access Logs.
10. Under Status, toggle the switch to SIEM is Enabled.
11. Click Save SIEM.
12. Under System monitoring SIEMs, you will see a new entry which shows the SIEM server, the integration type, the streamed data, and if the integration is enabled or not.

For example, Elasticsearch has been enabled to receive Access Logs:

Subscription to the SIEM is created. When users access an application, the access logs are sent to the Elasticsearch. You can go to the Discover tab in Elasticsearch, refresh it to access logs for the last 15 minutes, the access data is shown.