Overview

This guide provides an overview of the different EAA data feeds generated by Enterprise Application Access (EAA) and how to consume them either using API, or with your SIEM. It also describes the contents from each log field and explain their meanings in a dictionary of data available in the logs.

The Enterprise Application Access application has a full suite of APIs. You need to build scripts to interact with the service. You can either write your own code to interact with the service or use pre-existing tools such as our Akamai Unified Log Streamer (ULS), or EAA package for Akamai CLI.

For using legacy EAA Splunk App for Splunk 7, see Splunkbase.

In case of any issues contact support.

Use Unified Log Streamer to integrate EAA and SIEM

You can integrate Enterprise Application Access (EAA) with any Security and Event Management (SIEM) using the Unified Log Streamer (ULS). The ULS is designed to simplify SIEM integrations for all ​Akamai​ Secure Enterprise Access Products:

• Enterprise Application Access (EAA)

• ​Enterprise Threat Protector​ (ETP)

• ​Akamai​ Multi Factor Authenticator (MFA)

The modular design of ULS allows out-of-the-box integration with many SIEM solutions such as Splunk, Graylog, or Sumologic platform.

The ULS tool does REST API calls to ​Akamai​ Enterprise APIs and transports the data or security events which can be easily alerted by the customer's SIEM environment.

It is very flexible to deploy and operate the ULS. It can be run as a docker container or hosted standalone in your environment. It also supports the Helm deployment tool for Kubernetes, output Filter, Transformation, and Hooks, including the popular, flat "File" format. ULS can send data into any SIEM that supports either TCP, UDP or HTTP ingestion, both on-premises and cloud. Also, it is easy to get started since no coding or learning of the EAA APIs are required.

In Enterprise Application Access (EAA), we provide different data feeds like:

• EAA access logs

• EAA admin audit logs

• EAA connector health

• EAA Device Posture Inventory

You can choose any or all of these data feeds for your preferred SIEM solution.

You can find more information about the ULS open-source code on github at ULS repository.

You can find more information about documentation for any of the SIEM platforms at: SIEM repository.

To use the ULS tool in your SIEM environment:

• You will need to setup EAA API credentials for ULS

• Clone the binary from github ULS repository. Host it either as a Docker container or as a standalone binary on a host machine running Linux, macOS (Intel CPU).

  🚧

  Windows OS is not supported.

• Configure any of the different feeds that you want to observe in your SIEM platform and obtain alerts for.

EAA Data feed adopted by SIEM solutions

Here you can find examples in RAW and in JSON formats and descriptions of the different log fields for EAA user access logs, EAA authentication logs, Admin audit logs, and Connector health logs.

Access logs

In the table below you can find fields of RAW log lines definitions from EAA user access logs, authentication details, limitations, examples, and extraction for Splunk environment.

There are two levels of separators used in these files: blank space and - (a hyphen). A hyphen replaces any space in a country name or date (for example in United-States). A space separates each field in the log line. For example, 2019-06-24T18:33:08<space>username.

📘

Note

Blank rows like 2, 4, 6, 12, 14, and so on, indicate a space.

📘

Note

For Edge Transport based tunnel applications, you will see additional rows from 83 through 113 in the access logs.

📘

Important Note

For error code, EAA gives the main error code, and in some scenarios, it also gives a sub error code. Please refer to Application response codes, login events, and errors for the sub-error codes.

Access Log examples for Edge Transport based applications

RAW format:

2025-11-17T14:23:38.916000 employee1 sample-app-akamai-com.go.akamai-access.com - - 100 SENTRY| 111.222.3.4 - - - 2025-11-17T19:23:38.916Z - 1.2.3.4:443 5374 - Chrome-142-0 Mac-OS-X-10-15 Mac Cambridge Massachusetts MA US United-States sample.akamai.com:443 - secGroupAUsers,secGroupBUsers f09fc169-38c1-42fb-c2d2-95cca224883b 1294a3c56c1fe1b39fb53a5252fc977a1b707a321f4920716fe0174e4551273e - 5374 12274 - e0c6e815-a56d-4c6f-a03f-309cd2946e92 - 0 Google-Chrome-Helper 7.2.2 A - dad00531-d1cd-9a61-69b1-35ab6f3204fd darwin-amd64 TCP-terminated New-Jersey New-York 27000 15000 45 ALLOW 2025-11-17T19:23:23.354Z 93 Virginia Virginia pe-report

JSON format:

{
"local_datetime": "2025-11-17T14:23:38.916000", 
"username": "employee1", 
"apphost": "sample-app-akamai-com.go.akamai-access.com", 
"http_method": "", 
"referer": "-", 
"status_code": 100, 
"idpinfo": "SENTRY|", 
"clientip": "111.222.3.4", 
"http_verb2": "-", 
"total_resp_time": "-", 
"connector_resp_time": "-", 
"datetime": "2025-11-17T19:23:38.916Z", 
"origin_resp_time": "-", 
"origin_host": "1.2.3.4:443", 
"req_size": 5374, 
"content_type": "-", 
"user_agent": "Chrome-142-0", 
"device_type": "Mac-OS-X-10-15", 
"device_os": "Mac", 
"geo_city": "Cambridge", 
"geo_state": "Massachusetts", 
"geo_statecode": "MA", 
"geo_countrycode": "US", 
"geo_country": "United-States", 
"internal_host": "sample.akamai.com:443", 
"session_info": "-", 
"groups": "secGroupAUsers,secGroupBUsers", 
"session_id": "f09fc169-38c1-42fb-c2d2-95cca224883b", 
"Client_id": "1294a3c56c1fe1b39fb53a5252fc977a1b707a321f4920716fe0174e4551273e", "deny_reason": "-", 
"bytes_out": 5374, 
"bytes_in": 12274, 
"con_uuid": "e0c6e815-a56d-4c6f-a03f-309cd2946e92", 
"cloud_zone": "-", 
"error_code": 0, 
"client_process": "Google-Chrome-Helper", 
"client_version": "7.2.2", 
"srvty": "A", 
"idp.app": "-", 
"eaaclient.txid": "dad00531-d1cd-9a61-69b1-35ab6f3204fd", 
"eaaclient.os": "darwin-amd64", 
"eaaclientinfo.proto": "TCP-terminated", 
"client_ghost_addr_geo.region_name": "New-Jersey", "connector_ghost_addr_geo.region_name": "New-York", 
"crtt": "27000", 
"drtt": "15000", 
"ortt": "45", 
"PE.decision": "ALLOW", 
"PE.start_time": "2025-11-17T19:23:23.354Z", 
"PE.duration": "93", 
"PE.geoip.region_name": "Virginia", 
"stitcher.geoip.region_name": "Virginia", 
  "log_type": "pe-report"
}

Access log examples

RAW format:

2022-09-22T15:28:31.450000 employee3 sjclientyahoo.stage.akamai-access.com GET-/-HTTP/1.1 - 101 SENTRY|V 147.92.90.233 GET 67.736 67.736 2022-09-22T22:28:31+00:00 67.736 66.218.87.15 6017 text/plain Chrome-105-0 Mac-OS-X-10-15 Mac Fremont California CA US United-States geo.yahoo.com:443 bearer-valid - 75cc22e0-fd34-4c85-cce2-8ef8ef6f2c66 ac7da8d27cbd38d3d9b765ba74d0054528c99091e509b44a40f3d2987f5b642d bearer-valid 6017 3000 10.22.2.232 e19afcd5-c12b-4198-8884-4b5b5b2ea2e2 DPOP-Alpha-East-U18 0 Google-Chrome-Helper 2.8.0.22060101

JSON format:

{
"local_datetime": "2022-09-22T15:28:31.450000", 
"username": "employee3", 
"apphost": "sjclientyahoo.stage.akamai-access.com", 
"http_method": "GET", "url_path": "/", 
"http_ver": "HTTP/1.1", 
"referer": "-", 
"status_code": 101, 
"idpinfo": "SENTRY|V", 
"clientip": "147.92.90.233", 
"http_verb2": "GET", 
"total_resp_time": 67.872, 
"connector_resp_time": 67.872, 
"datetime": "2022-09-22T22:28:31+00:00", 
"origin_resp_time": 67.872, 
"origin_host": "69.147.92.11", 
"req_size": 1602, 
"content_type": "text/plain", 
"user_agent": "Chrome-105-0", 
"device_type": "Mac-OS-X-10-15", 
"device_os": "Mac", 
"geo_city": "Fremont", 
"geo_state": "California", 
"geo_statecode": "CA", 
"geo_countrycode": "US", 
"geo_country": "United-States", 
"internal_host": "beap-bc.yahoo.com:443", 
"session_info": "bearer-valid", 
"groups": "-", 
"session_id": "75cc22e0-fd34-4c85-cce2-8ef8ef6f2c66", 
"client_id": "ac7da8d27cbd38d3d9b765ba74d0054528c99091e509b44a40f3d2987f5b642d", 
"deny_reason": "bearer-valid", 
"bytes_out": 1602, 
"bytes_in": 2780, 
"con_uuid": "e19afcd5-c12b-4198-8884-4b5b5b2ea2e2", 
"cloud_zone": "DPOP-Alpha-East-U18", 
"error_code": 0, 
"client_process": "Google-Chrome-Helper", 
"client_version": "2.8.0.22060101"
}

EAA authentication details in user access logs

Authentication details can be found in the following log lines: access proxy, login server, and directory server. The latest logs are JSON formatted at the source and composed of key value pairs, where the value is a string or a dictionary of key value pairs.

The following table describes JSON keys relevant for the authentication event logs.

User authentication examples

RAW format:

2021-07-23T09:40:05.575000 - login.akamaidemo.net GET-/oidc/oauth?client_id=3cd24...-HTTP/1.1 - 302 LOGIN|I 123.123.123.123 GET 0.002 - 2021-07-23T16:40:05+00:00 - - 827 text/html My-User-Agent Other Other Ashburn Virginia VA US United-States - sso-cookie-no-cookie-value - -

JSON format:

{
    "username": "-",
    "apphost": "login.akamaidemo.net",
    "http_method": "GET",
    "url_path": "/oidc/oauth?client_id=3cd24...",
    "http_ver": "HTTP/1.1",
    "referer": "-",
    "status_code": 302,
    "idpinfo": "LOGIN|I",
    "clientip": "123.123.123.123",
    "http_verb2": "GET",
    "total_resp_time": 0.002,
    "connector_resp_time": "-",
    "datetime": "2021-07-23T16:40:05+00:00",
    "origin_resp_time": "-",
    "origin_host": "-",
    "req_size": 827,
    "content_type": "text/html",
    "user_agent": "My-User-Agent",
    "device_os": "Other",
    "device_type": "Other",
    "geo_city": "Ashburn",
    "geo_state": "Virginia",
    "geo_statecode": "VA",
    "geo_countrycode": "US",
    "geo_country": "United-States",
    "internal_host": "-",
    "session_info": "sso-cookie-no-cookie-value",
    "groups": "-",
    "session_id": "-"
}

Limitations

There are some limitations related to the use of IP Application Accelerator. If you are using the IPA acceleration service, the Client IP and related geo information (lines 43-51 in the above table) represents the closest IPA gateway, not the actual user location.

Go to IP Application Accelerator to learn more about the acceleration service.

👍

The data retention policy is 365 days.

Extract EAA Access Log fields

Set up RAW log field extraction with Splunk. EAA API delivers the access log event in a space separated text line (RAW format) and both CLI-EAA and ULS can deliver the same event also in a structured JSON format.
Most SIEM support extraction using regular expression. Please check your SIEM documentation for more details, or choose the JSON format instead. This is EAA extract regular expression for EAA log lines:

^([^\s]*)\s(?P<username>[\w\-]*)\s(?P<apphost>[\w\.\-]+)\s(?P<http_method>[A-Z]+)-(?P<url_path>.*)\-(?P<http_ver>HTTP/[0-9\.]*)\s(?P<referer>[^\s]*)\s(?P<status_code>[0-9]*)\s(?P<idpinfo>[^\s]*)\s(?P<clientip>[^\s]*)\s(?P<http_verb2>[^\s]*)\s(?P<total_resp_time>[^\s]*)\s(?P<connector_resp_time>[^\s]*)\s(?P<datetime>[^\s]*)\s(?P<origin_resp_time>[^\s]*)\s(?P<origin_host>[^\s]*)\s(?P<req_size>[^\s]*)\s(?P<content_type>[^\s]*)\s(?P<user_agent>[^\s]*)\s(?P<device_os>[^\s]*)\s(?P<device_type>[^\s]*)\s(?P<geo_city>[^\s]*)\s(?P<geo_state>[^\s]*)\s(?P<geo_statecode>[^\s]*)\s(?P<geo_countrycode>[^\s]*)\s(?P<geo_country>[^\s]*)\s(?P<internal_host>[^\s]*)\s(?P<session_info>[^\s]*)\s(?P<groups>[^\s]*)\s(?P<session_id>.*)[\s.*|]

Prerequisite:
An account in Splunk. To download Splunk, go to Splunk page. For more details on downloading and installation, see Splunk installation manual.

1. In your Splunk account, select Settings > Fields > Field Extractions.

2. Click New to create a new field extraction.
   The Add new window appears.

3. In Extraction/Transform paste the extract.

4. Click Save.
   After you save the changes, you can see how you can use the extracted regular expression in Splunk SIEM.

Admin logs

Fields definition and examples of Admin logs:

RAW format:

% akamai eaa log admin --start $(( $(date +%s) - 30000 ))
#DatetimeUTC,AdminID,ResourceType,Resource,Event,EventType
2023-09-01T15:42:09+00:00,user1@akamai.com,users, user1@akamai.com,login,login
2023-09-01T09:17:29+00:00, user2@akamai.com,users, user2@akamai.com,login,login
2023-09-01T08:31:09+00:00, user3@akamai.com,users, user3@akamai.com,login,login
2023-09-01T07:43:03+00:00, user3@akamai.com,users, user3@akamai.com,login,login
# Start: 09/01/2023 07:39:14 UTC (EPOCH 1693553954)
# End: 09/01/2023 15:49:14 UTC (EPOCH 1693583354)
# Total: 4 event(s), 0 error(s), 395 bytes written

JSON format:

% akamai eaa --section akamaidemo log admin --start $(( $(date +%s) - 30000 )) --json
#DatetimeUTC,AdminID,ResourceType,Resource,Event,EventType
{
      "datetime": "2023-09-01T15:42:09+00:00", 
      "username": user1@akamai.com, 
      "resource_type": "users", 
      "resource": user1@akamai.com, 
      "event": "login", 
      "event_type": "login"
}

Connector health

Fields definition and examples illustrating the health of the connector:

RAW format:

% akamai eaa connector list --perf
#Connector-id,name,reachable,status,version,privateip,publicip,debug,last_upd,CPU%,Mem%,Disk%,NetworkMbps,do_total,do_idle,do_active
con://cht3_GEjQWyMW9LEk7KQfg,demo-v2-con-1-amer,1,1,21.01.0-152,10.1.4.206,123.123.123.123,Y,2021-07-23T18:06:35.676Z,1.3,32.4,34.4,0.06,1304,1302,1

JSON format:

% akamai eaa connector list --perf --json | jq
{
    "connector_uuid": "cht3_GEjQWyMW9LEk7KQfg",
    "name": "demo-v2-con-1-amer",
    "reachable": 1,
    "status": 1,
    "version": "21.01.0-152",
    "privateip": "10.1.4.206",
    "publicip": "123.123.123.123",
    "debugchan": "Y",
    "ts": "2021-07-23T18:06:35.676Z",
    "cpu": 1.3,
    "disk": 34.4,
    "mem": 32.4,
    "network": 0.06,
    "dialout_total": 1304,
    "dialout_idle": 1302,
    "dialout_active": 1
}

SIEM support with Unified Log Streamer

It's common for organizations with mature security environment to have a Security Operations Center (SOC) that leverages security information and event management (SIEM) tools. SIEM provides a centralized view for security teams to access and analyze security information from a large number of sources, and prioritize mitigation efforts based on risk profiles.

EAA Unified Log Streamer allows you to stream EAA data feeds into your SIEM, no need to learn the API, it immediately gets you started.

Key features:

• Continuous streaming to SIEM using TCP, UDP, HTTP, or flat File

• Highly customizable

  • Choose between different EAA feeds

  • Filter any data you want to discard before sending it to SIEM

• Operate as standalone script, service, Docker Container Image, or Kubernetes/Helm

• No extra charge

The ULS GitHub project contains the detailed instructions to setup and operate ULS with your SIEM.