Examples of event data sent to a destination
This topic shows examples of structured data that Infrastructure Security Analytics sends to a configured destination based on the product schema. To see a data type example, go to the section for your destination.
Google SecOps
These examples show the data structure of events that are sent to Google SecOps. Go to the section for a specific data type.
- NXDOMAIN spikes
- Dangling CNAMEs
- Prolexic attack and alert events
- Prolexic traffic
- Related domains
- Hijacked domains
NXDOMAIN spikes
This example shows the data structure for NXDOMAIN spikes.
[
{
"metadata": {
"event_timestamp": "2024-07-20T10:00:00Z",
"event_type": "GENERIC_EVENT",
"product_name": "Edge DNS",
"product_event_type": "ZONE_NXDOMAIN_SPIKE",
"vendor_name": "Akamai",
"log_type": "AKAMAI_DNS"
},
"principal": {
"application": "Security Analytics"
},
"target": {
"asset_id": "cs:example.com"
},
"security_result": {
"action": "ALLOW",
"description": "An NXDOMAIN spike occurred",
"category": "NETWORK_DENIAL_OF_SERVICE",
"outcomes": [
{
"key": "total_nxdomains",
"value": "50000"
},
{
"key": "total_requests",
"value": "80000"
},
{
"key": "top_nxdomain_country",
"value": "US"
}
],
"first_discovered_time": "2024-07-20T10:00:00Z",
"last_discovered_time": "2023-07-20T12:00:00Z",
"threat_name": "ZONE_NXDOMAIN_SPIKE",
"threat_id": "1",
"url_back_to_product": "https://control.akamai.com/apps/analytics",
"rule_type": "ABSOLUTE",
"rule_labels": {
"key": "threshold",
"value": "10000.0"
}
}
}
]
Dangling CNAMEs
This example shows the data structure for dangling CNAMEs.
[
{
"metadata": {
"event_timestamp": "2024-07-20T10:30:00Z",
"event_type": "GENERIC_EVENT",
"product_name": "Edge DNS",
"product_event_type": "ZONE_DANGLING_CNAME",
"vendor_name": "Akamai",
"log_type": "AKAMAI_DNS"
},
"principal": {
"application": "Security Analytics",
"artifact": {
"network": {
"dns": {
"answers": {
"data": "1.example.com",
"name": "1-example.azurewebsites.net"
}
}
}
}
},
"target": {
"asset_id": "cs:example.com"
},
"security_result": {
"description": "A dangling CNAME was detected",
"category": "UNKNOWN_CATEGORY",
"alert_state": "ALERTING",
"first_discovered_time": "2024-07-20T10:30:00Z",
"threat_name": "ZONE_DANGLING_CNAME",
"url_back_to_product": "https://control.akamai.com/apps/analytics"
}
}
]
Prolexic attack and alert events
This example shows the data structure for Prolexic attack and alert events.
{
"events": [
{
"metadata": {
"event_timestamp": "2023-10-09T00:10:15Z",
"event_type": "GENERIC_EVENT",
"product_name": "Prolexic",
"product_event_type": "PROLEXIC_ALERT",
"vendor_name": "Akamai",
"log_type": "AKAMAI_DNS"
},
"principal": {
"application": "Security Analytics"
},
"target": {
"asset_id": "cs:customer123"
},
"security_result": {
"description": "Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g",
"category": "UNKNOWN_CATEGORY",
"variables": {
"observationSubcategory": {
"type": "OUTCOME",
"string_val": "80"
},
"isDuration": {
"type": "OUTCOME",
"string_val": "false"
},
"ip": {
"type": "OUTCOME",
"string_val": "28.15.12.19"
},
"source": {
"type": "OUTCOME",
"string_val": "fbm"
},
"isActive": {
"type": "OUTCOME",
"string_val": "false"
},
"uri": {
"type": "OUTCOME",
"string_val": "plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0"
},
"customerRealm": {
"type": "OUTCOME",
"string_val": "customer123"
},
"shortMessage": {
"type": "OUTCOME",
"string_val": "Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g"
},
"observationCategory": {
"type": "OUTCOME",
"string_val": "alert"
},
"startTime": {
"type": "OUTCOME",
"string_val": "1696810215000"
},
"details": {
"type": "OUTCOME",
"string_val": "[plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0]"
},
"endTime": {
"type": "OUTCOME",
"string_val": "1696896615000"
},
"longMessage": {
"type": "OUTCOME",
"string_val": "<table class='plx-ob-table'><tr><th>Attack Id</th><th align=left>Summary</th><th align=left>Last Occurred</th><th align=left>Location</th></tr><tr><td>01abc--28.15.12.19::CRIT:1696262181:abc1.0</td><td>Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g</td><td>2023-10-02 16:10:00 UTC</td><td></td></tr></table>"
},
"observationOn": {
"type": "OUTCOME",
"string_val": "plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0"
},
"customer": {
"type": "OUTCOME",
"string_val": "customer123"
}
},
"alert_state": "UNSPECIFIED",
"first_discovered_time": "2023-10-09T00:10:15Z",
"last_discovered_time": "2023-10-10T00:10:15Z",
"threat_name": "PROLEXIC_ALERT",
"url_back_to_product": "https://control.akamai.com/apps/analytics"
}
}
],
"customer_id": "customer123"
}
Prolexic traffic
This example shows the data structure for Prolexic traffic.
[
{
"metadata": {
"event_timestamp": "2025-01-06T15:44:00Z",
"event_type": "GENERIC_EVENT",
"product_name": "Prolexic",
"product_event_type": "PROLEXIC_PREM_TRAFFIC",
"vendor_name": "Akamai",
"log_type": "AKAMAI_DNS"
},
"principal": {
"application": "Security Analytics"
},
"target": {
"asset_id": "cs:testAccount"
},
"security_result": {
"description": "Prolexic pre-mitigation traffic exists",
"category": "UNKNOWN_CATEGORY",
"outcomes": [
{
"key": "pre_mitigation_bps",
"value": "232632"
},
{
"key": "pre_mitigation_pps",
"value": "632"
}
],
"alert_state": "UNSPECIFIED",
"first_discovered_time": "2025-01-06T15:44:00Z",
"last_discovered_time": "2025-01-06T15:44:00Z",
"threat_name": "PROLEXIC_PREM_TRAFFIC",
"url_back_to_product": "https://control.akamai.com/apps/analytics"
}
}
]
Related domains
This example shows the data structure for related domains.
[
{
"metadata": {
"event_timestamp": "2023-10-09T00:10:15Z",
"event_type": "GENERIC_EVENT",
"product_name": "Zone Protection",
"product_event_type": "RELATED_DOMAIN",
"vendor_name": "Akamai",
"log_type": "AKAMAI_DNS"
},
"principal": {
"application": "Security Analytics"
},
"target": {
"asset_id": "cs:testaccount"
},
"security_result": {
"description": "A related domain was detected",
"category": "UNKNOWN_CATEGORY",
"outcomes": [
{
"key": "name",
"value": "example.threat.com"
},
{
"key": "zones",
"value": "[\"example.com\", \"abc.com\"]"
},
{
"key": "tags",
"value": "[\"mobile\"]"
},
{
"key": "customerPriorityLevelLabel",
"value": "high"
},
{
"key": "domainRegistration",
"value": "high"
},
{
"key": "customerPriorityLevel",
"value": "5"
},
{
"key": "delegationSet",
"value": "2"
},
{
"key": "domainWhoIs",
"value": "{\"name\":\"\",\"domainStatus\":[\"clientTransferProhibited https://icann.org/epp#clientTransferProhibited\",\"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\",\"addPeriod https://icann.org/epp#addPeriod\"],\"regContact\":{\"organization\":\"Nimbus Innovations Ltd.\",\"street\":\"42 Waverley Crescent\",\"city\":\"Lichfield\",\"stateProvince\":\"Staffordshire\",\"postalCode\":\"WS13 7AB\",\"country\":\"GB\",\"phone\":\"+44 1543 567890\",\"fax\":\"+44 1543 567891\",\"emails\":[\"foobar@gmail.com\"]},\"adminContact\":{\"name\":\"Alicia Testington\",\"organization\":\"Fakester Corp.\",\"street\":\"123 Imaginary Lane\",\"city\":\"Nowhereville\",\"stateProvince\":\"East Fakeshire\",\"postalCode\":\"ZZ99 1ZZ\",\"country\":\"GB\",\"phone\":\"+44 1234 000000\",\"fax\":\"+44 1234 000001\",\"emails\":[\"foobar@gmail.com\"]},\"techContact\":{\"organization\":\"Quantum Pickles Ltd.\",\"street\":\"404 Phantom Street\",\"city\":\"Faketon\",\"stateProvince\":\"West Nonsensehire\",\"postalCode\":\"FA1 2KE\",\"country\":\"GB\",\"phone\":\"+44 0000 123456\",\"fax\":\"+44 0000 654321\",\"emails\":[\"foobar@gmail.com\"]},\"registryDomainId\":\"e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR\",\"registrarWHOISServer\":\"http://whois.paragonnames.net\",\"registrar\":\"Paragon Internet Group Ltd t/a Paragon Names\",\"registrarId\":\"12345\",\"registrarEmail\":\"foobar@gmail.com\",\"registrarPhone\":\"549-214-2194\",\"dnsSecStatus\":\"unsigned\"}"
},
{
"key": "domainDns",
"value": "{\"name\":\"\",\"domainRecords\":[\"example.com A 123.45.203.8\",\"example.com A 123.45.93.26\",\"1234:4700:1231::1234:5d1a\",\"1234:4700:1421::bk43:cb08\"],\"nameServers\":[\"ns23.control.com\",\"ns24.control.com\"]}"
}
],
"alert_state": "UNSPECIFIED",
"first_discovered_time": "2023-10-09T00:10:15Z",
"last_discovered_time": "2023-10-10T00:10:15Z",
"threat_name": "RELATED_DOMAIN",
"url_back_to_product": "https://control.akamai.com/apps/analytics"
}
}
]
Hijacked domains
This example shows the data structure for hijacked domains.
[
{
"metadata": {
"event_timestamp": "2025-06-03T10:15:30Z",
"event_type": "GENERIC_EVENT",
"product_name": "Edge DNS",
"product_event_type": "ZONE_HIJACKED_DOMAIN",
"vendor_name": "Akamai",
"log_type": "AKAMAI_DNS"
},
"principal": {
"application": "Security Analytics",
"artifact": {
"network": {
"dns": {
"answers": {
"data": "198.51.100.1",
"name": "www.example.com"
}
}
}
}
},
"target": {
"asset_id": "cs:example.com"
},
"security_result": {
"description": "A hijacked domain was detected",
"category": "UNKNOWN_CATEGORY",
"alert_state": "ALERTING",
"severity": "HIGH"
},
"additional": {
"fields": {
"nameserverIp": {
"string_value": "192.0.2.1"
},
"countryCode": {
"string_value": "US"
},
"type": {
"string_value": "HIJACK"
}
}
}
}
]
Microsoft Sentinel
These examples show the data structure of events that are sent to Microsoft Sentinel. Go to the section for a specific data type.
- NXDOMAIN spikes
- Dangling CNAMEs
- Prolexic attack and alert events
- Prolexic traffic
- Related domains
- Hijacked domains
Microsoft Sentinel requires a
TimeGeneratedfield in the event data. You need to create a transformation that maps the field with a timestamp in the provided examples to Sentinel'sTimeGeneratedfield.
For more information, see Custom data ingestion and transformation in Microsoft Sentinel.
NXDOMAIN spikes
This example shows the data structure for NXDOMAIN spikes.
[
{
"accountId": "acc-123456",
"zoneName": "example.com",
"algo": "DYNAMIC",
"threshold": 0.25,
"startTime": "2025-06-03T10:00:00Z",
"endTime": "2025-06-03T10:15:00Z",
"totalQueries": 62000,
"totalNxdomains": 20000,
"topCountryIsoCode": "US"
}
]
Dangling CNAMEs
This example shows the data structure for dangling CNAMEs.
[
{
"zoneName": "example.com",
"aliasName": "test.example.com",
"canonicalName": "unresolved.external-service.com",
"status": "DETECTED",
"detectedAt": "2025-06-03T10:15:30Z",
"clearedAt": "2025-06-03T11:00:00Z"
}
]
Prolexic attack and alert events
This example shows the data structure for Prolexic attack and alert events
[
{
"uri": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc.0",
"startTime": 1783327020000,
"endTime": 1783327200000,
"startTimeUtc": "2026-07-06T08:37:00Z",
"endTimeUtc": "2026-07-06T08:40:00Z",
"shortMessage": "Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC",
"longMessage": "<table class='plx-ob-table'><tr><th>Attack Id</th><th align=left>Summary</th><th align=left>Last Occurred</th><th align=left>Location</th></tr><tr><td>01abc--18.13.3.4::CRIT:1783327020:thor1.0</td><td>Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC</td><td>2026-07-06 08:40:00 UTC</td><td></td></tr></table>",
"observationCategory": "alert",
"observationSubcategory": "80",
"isActive": false,
"isDuration": false,
"customerRealm": "abc_abc",
"customer": "abc_abc",
"observationOn": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc1.0",
"source": "fbm",
"ip": "18.13.3.4",
"details": [
"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0"
]
}
]
Prolexic traffic
This example shows the data structure for Prolexic traffic.
[
{
"timestamp": 1748952000000,
"timestampUtc": "2025-06-03T12:00:00Z",
"preMitigationBps": 4321,
"preMitigationPps": 2100
},
{
"timestamp": 1748952300000,
"timestampUtc": "2025-06-03T12:05:00Z",
"preMitigationBps": 3890,
"preMitigationPps": 1985
},
{
"timestamp": 1748952600000,
"timestampUtc": "2025-06-03T12:10:00Z",
"preMitigationBps": 4102,
"preMitigationPps": 2055
}
]
Related domains
This example shows the data structure for related domains.
[
{
"name": "example-threat.com",
"zones": [
"example.com"
],
"tags": [
"mobile"
],
"domainRegistration": {
"name": "example.com",
"status": "clientTransferProhibited",
"createDate": "2024-02-28T12:28:35Z",
"updateDate": "2024-02-28T12:28:43Z",
"dnsSec": false
},
"customerPriorityLevel": 5,
"customerPriorityLevelLabel": "low",
"delegationSet": 2,
"domainWhoIs": {
"name": "",
"domainStatus": [
"clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
"addPeriod https://icann.org/epp#addPeriod"
],
"regContact": {
"organization": "Nimbus Innovations Ltd.",
"street": "42 Waverley Crescent",
"city": "Lichfield",
"stateProvince": "Staffordshire",
"postalCode": "WS13 7AB",
"country": "GB",
"phone": "+44 1543 567890",
"fax": "+44 1543 567891",
"emails": [
"foobar@gmail.com"
]
},
"adminContact": {
"name": "Alicia Testington",
"organization": "Fakester Corp.",
"street": "123 Imaginary Lane",
"city": "Nowhereville",
"stateProvince": "East Fakeshire",
"postalCode": "ZZ99 1ZZ",
"country": "GB",
"phone": "+44 1234 000000",
"fax": "+44 1234 000001",
"emails": [
"foobar@gmail.com"
]
},
"techContact": {
"organization": "Quantum Pickles Ltd.",
"street": "404 Phantom Street",
"city": "Faketon",
"stateProvince": "West Nonsensehire",
"postalCode": "FA1 2KE",
"country": "GB",
"phone": "+44 0000 123456",
"fax": "+44 0000 654321",
"emails": [
"foobar@gmail.com"
]
},
"registryDomainId": "e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR",
"registrarWHOISServer": "http://whois.paragonnames.net",
"registrar": "Paragon Internet Group Ltd t/a Paragon Names",
"registrarId": "12345",
"registrarEmail": "foobar@gmail.com",
"registrarPhone": "549-214-2194",
"dnsSecStatus": "unsigned"
},
"domainDns": {
"name": "",
"domainRecords": [
"example.com A 123.45.203.8",
"example.com A 123.45.93.26",
"1234:4700:1231::1234:5d1a",
"1234:4700:1421::bk43:cb08"
],
"nameServers": [
"ns23.control.com",
"ns24.control.com"
]
},
"timestamp": "2023-08-01T18:24:00.000Z"
}
]
Hijacked domains
This example shows the data structure for hijacked domains.
[
{
"zoneName": "example.com",
"domainName": "www.example.com",
"nameserverIp": "192.0.2.1",
"countryCode": "US",
"answer": "198.51.100.1",
"type": "HIJACK",
"detectedAt": "2025-06-03T10:15:30Z"
}
]
ServiceNow
These examples show the data structure of events that are sent to ServiceNow. Go to the section for a specific data type.
- NXDOMAIN spikes
- Dangling CNAMEs
- Prolexic attack and alert events
- Prolexic traffic
- Related domains
- Hijacked domains
NXDOMAIN Spikes
This example shows the data structure for NXDOMAIN spikes.
{
"shortDescription": "An NXDOMAIN spike was detected from Akamai - Infrastructure Security Analytics",
"comments": "[{\"accountId\":\"acc-123456\",\"zoneName\":\"example.com\",\"algo\":\"DYNAMIC\",\"threshold\":0.25,\"startTime\":\"2025-06-03T10:00:00Z\",\"endTime\":\"2025-06-03T10:15:00Z\",\"totalQueries\":62000,\"totalNxdomains\":20000,\"topCountryIsoCode\":\"US\"}]"
}
Dangling CNAMEs
This example shows the data structure for dangling CNAMEs.
{
"shortDescription": "A dangling CNAME was detected from Akamai - Infrastructure Security Analytics",
"comments": "[{\"zoneName\":\"example.com\",\"aliasName\":\"test.example.com\",\"canonicalName\":\"unresolved.external-service.com\",\"status\":\"DETECTED\",\"detectedAt\":\"2025-06-03T10:15:30Z\",\"clearedAt\":\"2025-06-03T11:00:00Z\"}]"
}
Prolexic attack and alert events
This example shows the data structure for Prolexic attack and alert events.
{
"shortDescription": "A Prolexic event was detected from Akamai - Infrastructure Security Analytics",
"comments": "[\"uri\":\"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0\",\"customer\":\"test_name_1\",\"details\":[\"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0\"],\"source\":\"fbm\",\"ip\":\"28.15.12.19\",\"start_time\":1696810215000,\"end_time\":1696896615000,\"short_message\":\"Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g\",\"long_message\":\"<table class='plx-ob-table'><tr><th>Attack Id</th><th align=left>Summary</th><th align=left>Last Occurred</th><th align=left>Location</th></tr><tr><td>01abc--28.15.12.19::CRIT:1696262181:abc1.0</td><td>Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g</td><td>2023-10-02 16:10:00 UTC</td><td></td></tr></table>\",\"observation_category\":\"alert\",\"observation_subcategory\":\"80\",\"is_active\":false,\"is_duration\":false,\"customer_realm\":\"test_name_1\",\"observation_on\":\"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0\"]"
}
Prolexic traffic
This example shows the data structure for Prolexic traffic.
{
"shortDescription": "Prolexic traffic was detected in Akamai - Infrastructure Security Analytics",
"comments": "[{\"timestamp\":1748952000000,\"timestampUtc\":\"2025-06-03T12:00:00Z\",\"preMitigationBps\":4321,\"preMitigationPps\":2100},{\"timestamp\":1748952300000,\"timestampUtc\":\"2025-06-03T12:05:00Z\",\"preMitigationBps\":3890,\"preMitigationPps\":1985},{\"timestamp\":1748952600000,\"timestampUtc\":\"2025-06-03T12:10:00Z\",\"preMitigationBps\":4102,\"preMitigationPps\":2055}]"
}
Related domains
This example shows the data structure for related domains.
{
"shortDescription": "A related domain was detected from Akamai - Infrastructure Security Analytics",
"comments": "[{\"name\":\"example-threat.com\",\"zones\":[\"example.com\"],\"timestamp\":\"2023-08-01T18:24:00.000Z\",\"tags\":[\"mobile\"],\"domainRegistration\":{\"name\":\"example.com\",\"status\":\"clientTransferProhibited\",\"createDate\":\"2024-02-28T12:28:35Z\",\"updateDate\":\"2024-02-28T12:28:43Z\",\"dnsSec\":false},\"customerPriorityLevel\":5,\"customerPriorityLevelLabel\":\"low\",\"delegationSet\":2,\"domainWhoIs\":{\"name\":\"\",\"domainStatus\":[\"clientTransferProhibited https://icann.org/epp#clientTransferProhibited\",\"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\",\"addPeriod https://icann.org/epp#addPeriod\"],\"regContact\":{\"organization\":\"Nimbus Innovations Ltd.\",\"street\":\"42 Waverley Crescent\",\"city\":\"Lichfield\",\"stateProvince\":\"Staffordshire\",\"postalCode\":\"WS13 7AB\",\"country\":\"GB\",\"phone\":\"+44 1543 567890\",\"fax\":\"+44 1543 567891\",\"emails\":[\"foobar@gmail.com\"]},\"adminContact\":{\"name\":\"Alicia Testington\",\"organization\":\"Fakester Corp.\",\"street\":\"123 Imaginary Lane\",\"city\":\"Nowhereville\",\"stateProvince\":\"East Fakeshire\",\"postalCode\":\"ZZ99 1ZZ\",\"country\":\"GB\",\"phone\":\"+44 1234 000000\",\"fax\":\"+44 1234 000001\",\"emails\":[\"foobar@gmail.com\"]},\"techContact\":{\"organization\":\"Quantum Pickles Ltd.\",\"street\":\"404 Phantom Street\",\"city\":\"Faketon\",\"stateProvince\":\"West Nonsensehire\",\"postalCode\":\"FA1 2KE\",\"country\":\"GB\",\"phone\":\"+44 0000 123456\",\"fax\":\"+44 0000 654321\",\"emails\":[\"foobar@gmail.com\"]},\"registryDomainId\":\"e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR\",\"registrarWHOISServer\":\"http://whois.paragonnames.net\",\"registrar\":\"Paragon Internet Group Ltd t/a Paragon Names\",\"registrarId\":\"12345\",\"registrarEmail\":\"foobar@gmail.com\",\"registrarPhone\":\"549-214-2194\",\"dnsSecStatus\":\"unsigned\"},\"domainDns\":{\"name\":\"\",\"domainRecords\":[\"example.com A 123.45.203.8\",\"example.com A 123.45.93.26\",\"1234:4700:1231::1234:5d1a\",\"1234:4700:1421::bk43:cb08\"],\"nameServers\":[\"ns23.control.com\",\"ns24.control.com\"]}}]"
}
Hijacked domains
This example shows the data structure for hijacked domains.
{
"shortDescription": "A hijacked domain was detected from Akamai - Infrastructure Security Analytics",
"comments": "[{\"zoneName\":\"example.com\",\"domainName\":\"www.example.com\",\"nameserverIp\":\"192.0.2.1\",\"countryCode\":\"US\",\"answer\":\"198.51.100.1\",\"type\":\"HIJACK\",\"detectedAt\":\"2025-06-03T10:15:30Z\"}]"
}
Splunk
These examples show the data structure of events that are sent to Splunk. Go to the section for a specific data type.
- NXDOMAIN spikes
- Dangling CNAMEs
- Prolexic attack and alert events
- Prolexic traffic
- Related domains
- Hijacked domains
NXDOMAIN spikes
This data shows the data structure for NXDOMAIN spikes.
[
{
"time": 1748951400,
"index": "akamai-infrastructure-security-analytics",
"source": "main",
"sourcetype": "NXDOMAIN_SPIKE",
"event": {
"accountId": "acc-654321",
"zoneName": "example.net",
"algo": "DYNAMIC",
"threshold": 0.4,
"startTime": "2025-06-03T11:50:00Z",
"endTime": "2025-06-03T12:10:00Z",
"totalQueries": 64000,
"totalNxdomains": 25500,
"topCountryIsoCode": "DE"
}
}
]
Dangling CNAMEs
This data shows the data structure for dangling CNAMEs.
[
{
"time": 1748955600,
"index": "akamai-infrastructure-security-analytics",
"source": "main",
"sourcetype": "DANGLING_CNAME",
"event": {
"zoneName": "example.com",
"aliasName": "test.example.com",
"canonicalName": "unresolved.external-service.com",
"status": "NEWLY_DANGLING",
"detectedAt": "2025-06-03T12:20:00Z",
"clearedAt": "2025-06-03T13:00:00Z"
}
}
]
Prolexic attack and alert events
This data shows the data structure for Prolexic attack and alert events
[
{
"time": 1696119015,
"index": "akamai-infrastructure-security-analytics",
"source": "main",
"sourcetype": "PROLEXIC_ALERT",
"event": {
"uri": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc.0",
"startTime": 1783327020000,
"endTime": 1783327200000,
"shortMessage": "Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC",
"longMessage": "<table class='plx-ob-table'><tr><th>Attack Id</th><th align=left>Summary</th><th align=left>Last Occurred</th><th align=left>Location</th></tr><tr><td>01abc--18.13.3.4::CRIT:1783327020:thor1.0</td><td>Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC</td><td>2026-07-06 08:40:00 UTC</td><td></td></tr></table>",
"observationCategory": "alert",
"observationSubcategory": "80",
"isActive": false,
"isDuration": false,
"customerRealm": "abc_abc",
"customer": "abc_abc",
"observationOn": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc1.0",
"source": "fbm",
"ip": "18.13.3.4",
"details": ["plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0"]
}
}
] Prolexic traffic
This example shows the data structure for Prolexic traffic.
[
{
"time": 1748952000,
"index": "akamai-infrastructure-security-analytics",
"source": "main",
"sourcetype": "PROLEXIC_PREM_TRAFFIC",
"event": {
"timestamp": 1748952000000,
"preMitigationBps": 4100,
"preMitigationPps": 1500
}
}
]
Related domains
This example shows the data structure for related domains.
[
{
"time": 1748949600,
"index": "akamai-infrastructure-security-analytics",
"source": "main",
"sourcetype": "RELATED_DOMAIN",
"event": {
"name": "example-threat.com",
"zones": [
"example.com"
],
"tags": [
"mobile"
],
"domainRegistration": {
"name": "example.com",
"status": "clientTransferProhibited",
"createDate": "2024-02-28T12:28:35Z",
"updateDate": "2024-02-28T12:28:43Z",
"dnsSec": false
},
"customerPriorityLevel": 5,
"customerPriorityLevelLabel": "low",
"delegationSet": 2,
"domainWhoIs": {
"name": "",
"domainStatus": [
"clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
"addPeriod https://icann.org/epp#addPeriod"
],
"regContact": {
"organization": "Nimbus Innovations Ltd.",
"street": "42 Waverley Crescent",
"city": "Lichfield",
"stateProvince": "Staffordshire",
"postalCode": "WS13 7AB",
"country": "GB",
"phone": "+44 1543 567890",
"fax": "+44 1543 567891",
"emails": [
"foobar@gmail.com"
]
},
"adminContact": {
"name": "Alicia Testington",
"organization": "Fakester Corp.",
"street": "123 Imaginary Lane",
"city": "Nowhereville",
"stateProvince": "East Fakeshire",
"postalCode": "ZZ99 1ZZ",
"country": "GB",
"phone": "+44 1234 000000",
"fax": "+44 1234 000001",
"emails": [
"foobar@gmail.com"
]
},
"techContact": {
"organization": "Quantum Pickles Ltd.",
"street": "404 Phantom Street",
"city": "Faketon",
"stateProvince": "West Nonsensehire",
"postalCode": "FA1 2KE",
"country": "GB",
"phone": "+44 0000 123456",
"fax": "+44 0000 654321",
"emails": [
"foobar@gmail.com"
]
},
"registryDomainId": "e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR",
"registrarWHOISServer": "http://whois.paragonnames.net",
"registrar": "Paragon Internet Group Ltd t/a Paragon Names",
"registrarId": "12345",
"registrarEmail": "foobar@gmail.com",
"registrarPhone": "549-214-2194",
"dnsSecStatus": "unsigned"
},
"domainDns": {
"name": "",
"domainRecords": [
"example.com A 123.45.203.8",
"example.com A 123.45.93.26",
"1234:4700:1231::1234:5d1a",
"1234:4700:1421::bk43:cb08"
],
"nameServers": [
"ns23.control.com",
"ns24.control.com"
]
},
"timestamp": "2023-08-01T18:24:00.000Z"
}
}
]
Hijacked domains
This example shows the data structure for hijacked domains.
[
{
"time": 1748955600,
"index": "akamai-infrastructure-security-analytics",
"source": "main",
"sourcetype": "HIJACKED_DOMAIN",
"event": {
"zoneName": "example.com",
"domainName": "www.example.com",
"nameserverIp": "192.0.2.1",
"countryCode": "US",
"answer": "198.51.100.1",
"type": "HIJACK",
"detectedAt": "2025-06-03T10:15:30Z"
}
}
]
Custom HTTP endpoint
These examples show the data structure of events that are sent to a custom HTTP endpoint. Go to the section for a specific data type.
- NXDOMAIN spikes
- Dangling CNAMEs
- Prolexic attack and alert events
- Prolexic traffic
- Related domains
- Hijacked domains
NXDOMAIN spikes
This example shows the data structure for NXDOMAIN spikes.
[
{
"accountId": "acc-123456",
"zoneName": "example.com",
"algo": "DYNAMIC",
"threshold": 0.25,
"startTime": "2025-06-03T10:00:00Z",
"endTime": "2025-06-03T10:15:00Z",
"totalQueries": 62000,
"totalNxdomains": 20000,
"topCountryIsoCode": "US"
}
]
Dangling CNAMEs
This example shows the data structure for dangling CNAMEs.
[
{
"zoneName": "example.com",
"aliasName": "test.example.com",
"canonicalName": "unresolved.external-service.com",
"status": "DETECTED",
"detectedAt": "2025-06-03T10:15:30Z",
"clearedAt": "2025-06-03T11:00:00Z"
}
]
Prolexic attack and alert events
This example shows the data structure for Prolexic attack and alert events.
[
{
"uri": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc.0",
"startTime": 1783327020000,
"endTime": 1783327200000,
"startTimeUtc": "2026-07-06T08:37:00Z",
"endTimeUtc": "2026-07-06T08:40:00Z",
"shortMessage": "Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC",
"longMessage": "<table class='plx-ob-table'><tr><th>Attack Id</th><th align=left>Summary</th><th align=left>Last Occurred</th><th align=left>Location</th></tr><tr><td>01abc--18.13.3.4::CRIT:1783327020:thor1.0</td><td>Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC</td><td>2026-07-06 08:40:00 UTC</td><td></td></tr></table>",
"observationCategory": "alert",
"observationSubcategory": "80",
"isActive": false,
"isDuration": false,
"customerRealm": "abc_abc",
"customer": "abc_abc",
"observationOn": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc1.0",
"source": "fbm",
"ip": "18.13.3.4",
"details": [
"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0"
]
}
]Prolexic traffic
This example shows the data structure for Prolexic traffic.
[
{
"timestamp": 1748952000000,
"timestampUtc": "2025-06-03T12:00:00Z",
"preMitigationBps": 4321,
"preMitigationPps": 2100
}
]
Related domains
This example shows the data structure for related domains.
[
{
"name": "example-threat.com",
"zones": [
"example.com"
],
"tags": [
"mobile"
],
"domainRegistration": {
"name": "example.com",
"status": "clientTransferProhibited",
"createDate": "2024-02-28T12:28:35Z",
"updateDate": "2024-02-28T12:28:43Z",
"dnsSec": false
},
"customerPriorityLevel": 5,
"customerPriorityLevelLabel": "low",
"delegationSet": 2,
"domainWhoIs": {
"name": "",
"domainStatus": [
"clientTransferProhibited https://icann.org/epp#clientTransferProhibited",
"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited",
"addPeriod https://icann.org/epp#addPeriod"
],
"regContact": {
"organization": "Nimbus Innovations Ltd.",
"street": "42 Waverley Crescent",
"city": "Lichfield",
"stateProvince": "Staffordshire",
"postalCode": "WS13 7AB",
"country": "GB",
"phone": "+44 1543 567890",
"fax": "+44 1543 567891",
"emails": [
"foobar@gmail.com"
]
},
"adminContact": {
"name": "Alicia Testington",
"organization": "Fakester Corp.",
"street": "123 Imaginary Lane",
"city": "Nowhereville",
"stateProvince": "East Fakeshire",
"postalCode": "ZZ99 1ZZ",
"country": "GB",
"phone": "+44 1234 000000",
"fax": "+44 1234 000001",
"emails": [
"foobar@gmail.com"
]
},
"techContact": {
"organization": "Quantum Pickles Ltd.",
"street": "404 Phantom Street",
"city": "Faketon",
"stateProvince": "West Nonsensehire",
"postalCode": "FA1 2KE",
"country": "GB",
"phone": "+44 0000 123456",
"fax": "+44 0000 654321",
"emails": [
"foobar@gmail.com"
]
},
"registryDomainId": "e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR",
"registrarWHOISServer": "http://whois.paragonnames.net",
"registrar": "Paragon Internet Group Ltd t/a Paragon Names",
"registrarId": "12345",
"registrarEmail": "foobar@gmail.com",
"registrarPhone": "549-214-2194",
"dnsSecStatus": "unsigned"
},
"domainDns": {
"name": "",
"domainRecords": [
"example.com A 123.45.203.8",
"example.com A 123.45.93.26",
"1234:4700:1231::1234:5d1a",
"1234:4700:1421::bk43:cb08"
],
"nameServers": [
"ns23.control.com",
"ns24.control.com"
]
},
"timestamp": "2023-08-01T18:24:00.000Z"
}
]
Hijacked domains
This example shows the data structure for hijacked domains.
[
{
"zoneName": "example.com",
"domainName": "www.example.com",
"nameserverIp": "192.0.2.1",
"countryCode": "US",
"answer": "198.51.100.1",
"type": "HIJACK",
"detectedAt": "2025-06-03T10:15:30Z"
}
]
Updated about 6 hours ago
Did this page help you?