--- updatedAt: 2026-08-25T16:18:04.000Z agentTools: siteIndex: https://techdocs.akamai.com/llms.txt projectIndex: https://techdocs.akamai.com/edge-dns/llms.txt --- # Examples of event data sent to a destination This topic shows examples of structured data that Infrastructure Security Analytics sends to a configured destination based on the product schema. To see a data type example, go to the section for your destination. * [Google SecOps](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#google-secops) * [Microsoft Sentinel](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#microsoft-sentinel) * [ServiceNow](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#servicenow) * [Splunk](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#splunk) * [Custom HTTP endpoint](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#custom-http-endpoint) # Google SecOps These examples show the data structure of events that are sent to Google SecOps. Go to the section for a specific data type. * [NXDOMAIN spikes](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#nxdomain-spikes) * [Dangling CNAMEs](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#dangling-cnames) * [Prolexic attack and alert events](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-attack-and-alert-events) * [Prolexic traffic](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-traffic) * [Related domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#related-domains) * [Hijacked domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#hijacked-domains) ### NXDOMAIN spikes This example shows the data structure for NXDOMAIN spikes. ``` [ { "metadata": { "event_timestamp": "2024-07-20T10:00:00Z", "event_type": "GENERIC_EVENT", "product_name": "Edge DNS", "product_event_type": "ZONE_NXDOMAIN_SPIKE", "vendor_name": "Akamai", "log_type": "AKAMAI_DNS" }, "principal": { "application": "Security Analytics" }, "target": { "asset_id": "cs:example.com" }, "security_result": { "action": "ALLOW", "description": "An NXDOMAIN spike occurred", "category": "NETWORK_DENIAL_OF_SERVICE", "outcomes": [ { "key": "total_nxdomains", "value": "50000" }, { "key": "total_requests", "value": "80000" }, { "key": "top_nxdomain_country", "value": "US" } ], "first_discovered_time": "2024-07-20T10:00:00Z", "last_discovered_time": "2023-07-20T12:00:00Z", "threat_name": "ZONE_NXDOMAIN_SPIKE", "threat_id": "1", "url_back_to_product": "https://control.akamai.com/apps/analytics", "rule_type": "ABSOLUTE", "rule_labels": { "key": "threshold", "value": "10000.0" } } } ] ``` ### Dangling CNAMEs This example shows the data structure for dangling CNAMEs. ``` [ { "metadata": { "event_timestamp": "2024-07-20T10:30:00Z", "event_type": "GENERIC_EVENT", "product_name": "Edge DNS", "product_event_type": "ZONE_DANGLING_CNAME", "vendor_name": "Akamai", "log_type": "AKAMAI_DNS" }, "principal": { "application": "Security Analytics", "artifact": { "network": { "dns": { "answers": { "data": "1.example.com", "name": "1-example.azurewebsites.net" } } } } }, "target": { "asset_id": "cs:example.com" }, "security_result": { "description": "A dangling CNAME was detected", "category": "UNKNOWN_CATEGORY", "alert_state": "ALERTING", "first_discovered_time": "2024-07-20T10:30:00Z", "threat_name": "ZONE_DANGLING_CNAME", "url_back_to_product": "https://control.akamai.com/apps/analytics" } } ] ``` ### Prolexic attack and alert events This example shows the data structure for Prolexic attack and alert events. ``` { "events": [ { "metadata": { "event_timestamp": "2023-10-09T00:10:15Z", "event_type": "GENERIC_EVENT", "product_name": "Prolexic", "product_event_type": "PROLEXIC_ALERT", "vendor_name": "Akamai", "log_type": "AKAMAI_DNS" }, "principal": { "application": "Security Analytics" }, "target": { "asset_id": "cs:customer123" }, "security_result": { "description": "Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g", "category": "UNKNOWN_CATEGORY", "variables": { "observationSubcategory": { "type": "OUTCOME", "string_val": "80" }, "isDuration": { "type": "OUTCOME", "string_val": "false" }, "ip": { "type": "OUTCOME", "string_val": "28.15.12.19" }, "source": { "type": "OUTCOME", "string_val": "fbm" }, "isActive": { "type": "OUTCOME", "string_val": "false" }, "uri": { "type": "OUTCOME", "string_val": "plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0" }, "customerRealm": { "type": "OUTCOME", "string_val": "customer123" }, "shortMessage": { "type": "OUTCOME", "string_val": "Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g" }, "observationCategory": { "type": "OUTCOME", "string_val": "alert" }, "startTime": { "type": "OUTCOME", "string_val": "1696810215000" }, "details": { "type": "OUTCOME", "string_val": "[plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0]" }, "endTime": { "type": "OUTCOME", "string_val": "1696896615000" }, "longMessage": { "type": "OUTCOME", "string_val": "
Attack IdSummaryLast OccurredLocation
01abc--28.15.12.19::CRIT:1696262181:abc1.0Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g2023-10-02 16:10:00 UTC
" }, "observationOn": { "type": "OUTCOME", "string_val": "plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0" }, "customer": { "type": "OUTCOME", "string_val": "customer123" } }, "alert_state": "UNSPECIFIED", "first_discovered_time": "2023-10-09T00:10:15Z", "last_discovered_time": "2023-10-10T00:10:15Z", "threat_name": "PROLEXIC_ALERT", "url_back_to_product": "https://control.akamai.com/apps/analytics" } } ], "customer_id": "customer123" } ``` ### Prolexic traffic This example shows the data structure for Prolexic traffic. ``` [ { "metadata": { "event_timestamp": "2025-01-06T15:44:00Z", "event_type": "GENERIC_EVENT", "product_name": "Prolexic", "product_event_type": "PROLEXIC_PREM_TRAFFIC", "vendor_name": "Akamai", "log_type": "AKAMAI_DNS" }, "principal": { "application": "Security Analytics" }, "target": { "asset_id": "cs:testAccount" }, "security_result": { "description": "Prolexic pre-mitigation traffic exists", "category": "UNKNOWN_CATEGORY", "outcomes": [ { "key": "pre_mitigation_bps", "value": "232632" }, { "key": "pre_mitigation_pps", "value": "632" } ], "alert_state": "UNSPECIFIED", "first_discovered_time": "2025-01-06T15:44:00Z", "last_discovered_time": "2025-01-06T15:44:00Z", "threat_name": "PROLEXIC_PREM_TRAFFIC", "url_back_to_product": "https://control.akamai.com/apps/analytics" } } ] ``` ### Related domains This example shows the data structure for related domains. ``` [ { "metadata": { "event_timestamp": "2023-10-09T00:10:15Z", "event_type": "GENERIC_EVENT", "product_name": "Zone Protection", "product_event_type": "RELATED_DOMAIN", "vendor_name": "Akamai", "log_type": "AKAMAI_DNS" }, "principal": { "application": "Security Analytics" }, "target": { "asset_id": "cs:testaccount" }, "security_result": { "description": "A related domain was detected", "category": "UNKNOWN_CATEGORY", "outcomes": [ { "key": "name", "value": "example.threat.com" }, { "key": "zones", "value": "[\"example.com\", \"abc.com\"]" }, { "key": "tags", "value": "[\"mobile\"]" }, { "key": "customerPriorityLevelLabel", "value": "high" }, { "key": "domainRegistration", "value": "high" }, { "key": "customerPriorityLevel", "value": "5" }, { "key": "delegationSet", "value": "2" }, { "key": "domainWhoIs", "value": "{\"name\":\"\",\"domainStatus\":[\"clientTransferProhibited https://icann.org/epp#clientTransferProhibited\",\"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\",\"addPeriod https://icann.org/epp#addPeriod\"],\"regContact\":{\"organization\":\"Nimbus Innovations Ltd.\",\"street\":\"42 Waverley Crescent\",\"city\":\"Lichfield\",\"stateProvince\":\"Staffordshire\",\"postalCode\":\"WS13 7AB\",\"country\":\"GB\",\"phone\":\"+44 1543 567890\",\"fax\":\"+44 1543 567891\",\"emails\":[\"foobar@gmail.com\"]},\"adminContact\":{\"name\":\"Alicia Testington\",\"organization\":\"Fakester Corp.\",\"street\":\"123 Imaginary Lane\",\"city\":\"Nowhereville\",\"stateProvince\":\"East Fakeshire\",\"postalCode\":\"ZZ99 1ZZ\",\"country\":\"GB\",\"phone\":\"+44 1234 000000\",\"fax\":\"+44 1234 000001\",\"emails\":[\"foobar@gmail.com\"]},\"techContact\":{\"organization\":\"Quantum Pickles Ltd.\",\"street\":\"404 Phantom Street\",\"city\":\"Faketon\",\"stateProvince\":\"West Nonsensehire\",\"postalCode\":\"FA1 2KE\",\"country\":\"GB\",\"phone\":\"+44 0000 123456\",\"fax\":\"+44 0000 654321\",\"emails\":[\"foobar@gmail.com\"]},\"registryDomainId\":\"e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR\",\"registrarWHOISServer\":\"http://whois.paragonnames.net\",\"registrar\":\"Paragon Internet Group Ltd t/a Paragon Names\",\"registrarId\":\"12345\",\"registrarEmail\":\"foobar@gmail.com\",\"registrarPhone\":\"549-214-2194\",\"dnsSecStatus\":\"unsigned\"}" }, { "key": "domainDns", "value": "{\"name\":\"\",\"domainRecords\":[\"example.com A 123.45.203.8\",\"example.com A 123.45.93.26\",\"1234:4700:1231::1234:5d1a\",\"1234:4700:1421::bk43:cb08\"],\"nameServers\":[\"ns23.control.com\",\"ns24.control.com\"]}" } ], "alert_state": "UNSPECIFIED", "first_discovered_time": "2023-10-09T00:10:15Z", "last_discovered_time": "2023-10-10T00:10:15Z", "threat_name": "RELATED_DOMAIN", "url_back_to_product": "https://control.akamai.com/apps/analytics" } } ] ``` ### Hijacked domains This example shows the data structure for hijacked domains. ``` [ { "metadata": { "event_timestamp": "2025-06-03T10:15:30Z", "event_type": "GENERIC_EVENT", "product_name": "Edge DNS", "product_event_type": "ZONE_HIJACKED_DOMAIN", "vendor_name": "Akamai", "log_type": "AKAMAI_DNS" }, "principal": { "application": "Security Analytics", "artifact": { "network": { "dns": { "answers": { "data": "198.51.100.1", "name": "www.example.com" } } } } }, "target": { "asset_id": "cs:example.com" }, "security_result": { "description": "A hijacked domain was detected", "category": "UNKNOWN_CATEGORY", "alert_state": "ALERTING", "severity": "HIGH" }, "additional": { "fields": { "nameserverIp": { "string_value": "192.0.2.1" }, "countryCode": { "string_value": "US" }, "type": { "string_value": "HIJACK" } } } } ] ``` # Microsoft Sentinel These examples show the data structure of events that are sent to Microsoft Sentinel. Go to the section for a specific data type. * [NXDOMAIN spikes](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#nxdomain-spikes-1) * [Dangling CNAMEs](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#dangling-cnames-1) * [Prolexic attack and alert events](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-attack-and-alert-events-1) * [Prolexic traffic](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-traffic-1) * [Related domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#related-domains-1) * [Hijacked domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#hijacked-domains-1) > 📘 > > Microsoft Sentinel requires a `TimeGenerated` field in the event data. You need to create a transformation that maps the field with a timestamp in the provided examples to Sentinel's `TimeGenerated` field. > >
\ > > For more information, see [Custom data ingestion and transformation in Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/data-transformation). ### NXDOMAIN spikes This example shows the data structure for NXDOMAIN spikes. ``` [ { "accountId": "acc-123456", "zoneName": "example.com", "algo": "DYNAMIC", "threshold": 0.25, "startTime": "2025-06-03T10:00:00Z", "endTime": "2025-06-03T10:15:00Z", "totalQueries": 62000, "totalNxdomains": 20000, "topCountryIsoCode": "US" } ] ``` ### Dangling CNAMEs This example shows the data structure for dangling CNAMEs. ``` [ { "zoneName": "example.com", "aliasName": "test.example.com", "canonicalName": "unresolved.external-service.com", "status": "DETECTED", "detectedAt": "2025-06-03T10:15:30Z", "clearedAt": "2025-06-03T11:00:00Z" } ] ``` ### Prolexic attack and alert events This example shows the data structure for Prolexic attack and alert events ``` [ { "uri": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc.0", "startTime": 1783327020000, "endTime": 1783327200000, "startTimeUtc": "2026-07-06T08:37:00Z", "endTimeUtc": "2026-07-06T08:40:00Z", "shortMessage": "Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC", "longMessage": "
Attack IdSummaryLast OccurredLocation
01abc--18.13.3.4::CRIT:1783327020:thor1.0Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC2026-07-06 08:40:00 UTC
", "observationCategory": "alert", "observationSubcategory": "80", "isActive": false, "isDuration": false, "customerRealm": "abc_abc", "customer": "abc_abc", "observationOn": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc1.0", "source": "fbm", "ip": "18.13.3.4", "details": [ "plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0" ] } ] ``` ### Prolexic traffic This example shows the data structure for Prolexic traffic. ``` [ { "timestamp": 1748952000000, "timestampUtc": "2025-06-03T12:00:00Z", "preMitigationBps": 4321, "preMitigationPps": 2100 }, { "timestamp": 1748952300000, "timestampUtc": "2025-06-03T12:05:00Z", "preMitigationBps": 3890, "preMitigationPps": 1985 }, { "timestamp": 1748952600000, "timestampUtc": "2025-06-03T12:10:00Z", "preMitigationBps": 4102, "preMitigationPps": 2055 } ] ``` ### Related domains This example shows the data structure for related domains. ``` [ { "name": "example-threat.com", "zones": [ "example.com" ], "tags": [ "mobile" ], "domainRegistration": { "name": "example.com", "status": "clientTransferProhibited", "createDate": "2024-02-28T12:28:35Z", "updateDate": "2024-02-28T12:28:43Z", "dnsSec": false }, "customerPriorityLevel": 5, "customerPriorityLevelLabel": "low", "delegationSet": 2, "domainWhoIs": { "name": "", "domainStatus": [ "clientTransferProhibited https://icann.org/epp#clientTransferProhibited", "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited", "addPeriod https://icann.org/epp#addPeriod" ], "regContact": { "organization": "Nimbus Innovations Ltd.", "street": "42 Waverley Crescent", "city": "Lichfield", "stateProvince": "Staffordshire", "postalCode": "WS13 7AB", "country": "GB", "phone": "+44 1543 567890", "fax": "+44 1543 567891", "emails": [ "foobar@gmail.com" ] }, "adminContact": { "name": "Alicia Testington", "organization": "Fakester Corp.", "street": "123 Imaginary Lane", "city": "Nowhereville", "stateProvince": "East Fakeshire", "postalCode": "ZZ99 1ZZ", "country": "GB", "phone": "+44 1234 000000", "fax": "+44 1234 000001", "emails": [ "foobar@gmail.com" ] }, "techContact": { "organization": "Quantum Pickles Ltd.", "street": "404 Phantom Street", "city": "Faketon", "stateProvince": "West Nonsensehire", "postalCode": "FA1 2KE", "country": "GB", "phone": "+44 0000 123456", "fax": "+44 0000 654321", "emails": [ "foobar@gmail.com" ] }, "registryDomainId": "e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR", "registrarWHOISServer": "http://whois.paragonnames.net", "registrar": "Paragon Internet Group Ltd t/a Paragon Names", "registrarId": "12345", "registrarEmail": "foobar@gmail.com", "registrarPhone": "549-214-2194", "dnsSecStatus": "unsigned" }, "domainDns": { "name": "", "domainRecords": [ "example.com A 123.45.203.8", "example.com A 123.45.93.26", "1234:4700:1231::1234:5d1a", "1234:4700:1421::bk43:cb08" ], "nameServers": [ "ns23.control.com", "ns24.control.com" ] }, "timestamp": "2023-08-01T18:24:00.000Z" } ] ``` ### Hijacked domains This example shows the data structure for hijacked domains. ``` [ { "zoneName": "example.com", "domainName": "www.example.com", "nameserverIp": "192.0.2.1", "countryCode": "US", "answer": "198.51.100.1", "type": "HIJACK", "detectedAt": "2025-06-03T10:15:30Z" } ] ``` # ServiceNow These examples show the data structure of events that are sent to ServiceNow. Go to the section for a specific data type. * [NXDOMAIN spikes](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#nxdomain-spikes-2) * [Dangling CNAMEs](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#dangling-cnames-2) * [Prolexic attack and alert events](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-attack-and-alert-events-2) * [Prolexic traffic](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-traffic-2) * [Related domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#related-domains-2) * [Hijacked domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#hijacked-domains-2) ### NXDOMAIN Spikes This example shows the data structure for NXDOMAIN spikes. ``` { "shortDescription": "An NXDOMAIN spike was detected from Akamai - Infrastructure Security Analytics", "comments": "[{\"accountId\":\"acc-123456\",\"zoneName\":\"example.com\",\"algo\":\"DYNAMIC\",\"threshold\":0.25,\"startTime\":\"2025-06-03T10:00:00Z\",\"endTime\":\"2025-06-03T10:15:00Z\",\"totalQueries\":62000,\"totalNxdomains\":20000,\"topCountryIsoCode\":\"US\"}]" } ``` ### Dangling CNAMEs This example shows the data structure for dangling CNAMEs. ``` { "shortDescription": "A dangling CNAME was detected from Akamai - Infrastructure Security Analytics", "comments": "[{\"zoneName\":\"example.com\",\"aliasName\":\"test.example.com\",\"canonicalName\":\"unresolved.external-service.com\",\"status\":\"DETECTED\",\"detectedAt\":\"2025-06-03T10:15:30Z\",\"clearedAt\":\"2025-06-03T11:00:00Z\"}]" } ``` ### Prolexic attack and alert events This example shows the data structure for Prolexic attack and alert events. ``` { "shortDescription": "A Prolexic event was detected from Akamai - Infrastructure Security Analytics", "comments": "[\"uri\":\"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0\",\"customer\":\"test_name_1\",\"details\":[\"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0\"],\"source\":\"fbm\",\"ip\":\"28.15.12.19\",\"start_time\":1696810215000,\"end_time\":1696896615000,\"short_message\":\"Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g\",\"long_message\":\"
Attack IdSummaryLast OccurredLocation
01abc--28.15.12.19::CRIT:1696262181:abc1.0Akamai Flow Anomaly for test_customer_name_2, destination_ip 28.15.12.19 with top talker ABC-ABC05g2023-10-02 16:10:00 UTC
\",\"observation_category\":\"alert\",\"observation_subcategory\":\"80\",\"is_active\":false,\"is_duration\":false,\"customer_realm\":\"test_name_1\",\"observation_on\":\"plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0\"]" } ``` ### Prolexic traffic This example shows the data structure for Prolexic traffic. ``` { "shortDescription": "Prolexic traffic was detected in Akamai - Infrastructure Security Analytics", "comments": "[{\"timestamp\":1748952000000,\"timestampUtc\":\"2025-06-03T12:00:00Z\",\"preMitigationBps\":4321,\"preMitigationPps\":2100},{\"timestamp\":1748952300000,\"timestampUtc\":\"2025-06-03T12:05:00Z\",\"preMitigationBps\":3890,\"preMitigationPps\":1985},{\"timestamp\":1748952600000,\"timestampUtc\":\"2025-06-03T12:10:00Z\",\"preMitigationBps\":4102,\"preMitigationPps\":2055}]" } ``` ### Related domains This example shows the data structure for related domains. ``` { "shortDescription": "A related domain was detected from Akamai - Infrastructure Security Analytics", "comments": "[{\"name\":\"example-threat.com\",\"zones\":[\"example.com\"],\"timestamp\":\"2023-08-01T18:24:00.000Z\",\"tags\":[\"mobile\"],\"domainRegistration\":{\"name\":\"example.com\",\"status\":\"clientTransferProhibited\",\"createDate\":\"2024-02-28T12:28:35Z\",\"updateDate\":\"2024-02-28T12:28:43Z\",\"dnsSec\":false},\"customerPriorityLevel\":5,\"customerPriorityLevelLabel\":\"low\",\"delegationSet\":2,\"domainWhoIs\":{\"name\":\"\",\"domainStatus\":[\"clientTransferProhibited https://icann.org/epp#clientTransferProhibited\",\"clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited\",\"addPeriod https://icann.org/epp#addPeriod\"],\"regContact\":{\"organization\":\"Nimbus Innovations Ltd.\",\"street\":\"42 Waverley Crescent\",\"city\":\"Lichfield\",\"stateProvince\":\"Staffordshire\",\"postalCode\":\"WS13 7AB\",\"country\":\"GB\",\"phone\":\"+44 1543 567890\",\"fax\":\"+44 1543 567891\",\"emails\":[\"foobar@gmail.com\"]},\"adminContact\":{\"name\":\"Alicia Testington\",\"organization\":\"Fakester Corp.\",\"street\":\"123 Imaginary Lane\",\"city\":\"Nowhereville\",\"stateProvince\":\"East Fakeshire\",\"postalCode\":\"ZZ99 1ZZ\",\"country\":\"GB\",\"phone\":\"+44 1234 000000\",\"fax\":\"+44 1234 000001\",\"emails\":[\"foobar@gmail.com\"]},\"techContact\":{\"organization\":\"Quantum Pickles Ltd.\",\"street\":\"404 Phantom Street\",\"city\":\"Faketon\",\"stateProvince\":\"West Nonsensehire\",\"postalCode\":\"FA1 2KE\",\"country\":\"GB\",\"phone\":\"+44 0000 123456\",\"fax\":\"+44 0000 654321\",\"emails\":[\"foobar@gmail.com\"]},\"registryDomainId\":\"e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR\",\"registrarWHOISServer\":\"http://whois.paragonnames.net\",\"registrar\":\"Paragon Internet Group Ltd t/a Paragon Names\",\"registrarId\":\"12345\",\"registrarEmail\":\"foobar@gmail.com\",\"registrarPhone\":\"549-214-2194\",\"dnsSecStatus\":\"unsigned\"},\"domainDns\":{\"name\":\"\",\"domainRecords\":[\"example.com A 123.45.203.8\",\"example.com A 123.45.93.26\",\"1234:4700:1231::1234:5d1a\",\"1234:4700:1421::bk43:cb08\"],\"nameServers\":[\"ns23.control.com\",\"ns24.control.com\"]}}]" } ``` ### Hijacked domains This example shows the data structure for hijacked domains. ``` { "shortDescription": "A hijacked domain was detected from Akamai - Infrastructure Security Analytics", "comments": "[{\"zoneName\":\"example.com\",\"domainName\":\"www.example.com\",\"nameserverIp\":\"192.0.2.1\",\"countryCode\":\"US\",\"answer\":\"198.51.100.1\",\"type\":\"HIJACK\",\"detectedAt\":\"2025-06-03T10:15:30Z\"}]" } ``` # Splunk These examples show the data structure of events that are sent to Splunk. Go to the section for a specific data type. * [NXDOMAIN spikes](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#nxdomain-spikes-3) * [Dangling CNAMEs](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#dangling-cnames-3) * [Prolexic attack and alert events](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-attack-and-alert-events-3) * [Prolexic traffic](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-traffic-3) * [Related domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#related-domains-3) * [Hijacked domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#hijacked-domains-3) ### NXDOMAIN spikes This data shows the data structure for NXDOMAIN spikes. ``` [ { "time": 1748951400, "index": "akamai-infrastructure-security-analytics", "source": "main", "sourcetype": "NXDOMAIN_SPIKE", "event": { "accountId": "acc-654321", "zoneName": "example.net", "algo": "DYNAMIC", "threshold": 0.4, "startTime": "2025-06-03T11:50:00Z", "endTime": "2025-06-03T12:10:00Z", "totalQueries": 64000, "totalNxdomains": 25500, "topCountryIsoCode": "DE" } } ] ``` ### Dangling CNAMEs This data shows the data structure for dangling CNAMEs. ``` [ { "time": 1748955600, "index": "akamai-infrastructure-security-analytics", "source": "main", "sourcetype": "DANGLING_CNAME", "event": { "zoneName": "example.com", "aliasName": "test.example.com", "canonicalName": "unresolved.external-service.com", "status": "NEWLY_DANGLING", "detectedAt": "2025-06-03T12:20:00Z", "clearedAt": "2025-06-03T13:00:00Z" } } ] ``` ### Prolexic attack and alert events This data shows the data structure for Prolexic attack and alert events ``` [ { "time": 1696119015, "index": "akamai-infrastructure-security-analytics", "source": "main", "sourcetype": "PROLEXIC_ALERT", "event": { "uri": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc.0", "startTime": 1783327020000, "endTime": 1783327200000, "shortMessage": "Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC", "longMessage": "
Attack IdSummaryLast OccurredLocation
01abc--18.13.3.4::CRIT:1783327020:thor1.0Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC2026-07-06 08:40:00 UTC
", "observationCategory": "alert", "observationSubcategory": "80", "isActive": false, "isDuration": false, "customerRealm": "abc_abc", "customer": "abc_abc", "observationOn": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc1.0", "source": "fbm", "ip": "18.13.3.4", "details": ["plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0"] } } ] ``` ### Prolexic traffic This example shows the data structure for Prolexic traffic. ``` [ { "time": 1748952000, "index": "akamai-infrastructure-security-analytics", "source": "main", "sourcetype": "PROLEXIC_PREM_TRAFFIC", "event": { "timestamp": 1748952000000, "preMitigationBps": 4100, "preMitigationPps": 1500 } } ] ``` ### Related domains This example shows the data structure for related domains. ``` [ { "time": 1748949600, "index": "akamai-infrastructure-security-analytics", "source": "main", "sourcetype": "RELATED_DOMAIN", "event": { "name": "example-threat.com", "zones": [ "example.com" ], "tags": [ "mobile" ], "domainRegistration": { "name": "example.com", "status": "clientTransferProhibited", "createDate": "2024-02-28T12:28:35Z", "updateDate": "2024-02-28T12:28:43Z", "dnsSec": false }, "customerPriorityLevel": 5, "customerPriorityLevelLabel": "low", "delegationSet": 2, "domainWhoIs": { "name": "", "domainStatus": [ "clientTransferProhibited https://icann.org/epp#clientTransferProhibited", "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited", "addPeriod https://icann.org/epp#addPeriod" ], "regContact": { "organization": "Nimbus Innovations Ltd.", "street": "42 Waverley Crescent", "city": "Lichfield", "stateProvince": "Staffordshire", "postalCode": "WS13 7AB", "country": "GB", "phone": "+44 1543 567890", "fax": "+44 1543 567891", "emails": [ "foobar@gmail.com" ] }, "adminContact": { "name": "Alicia Testington", "organization": "Fakester Corp.", "street": "123 Imaginary Lane", "city": "Nowhereville", "stateProvince": "East Fakeshire", "postalCode": "ZZ99 1ZZ", "country": "GB", "phone": "+44 1234 000000", "fax": "+44 1234 000001", "emails": [ "foobar@gmail.com" ] }, "techContact": { "organization": "Quantum Pickles Ltd.", "street": "404 Phantom Street", "city": "Faketon", "stateProvince": "West Nonsensehire", "postalCode": "FA1 2KE", "country": "GB", "phone": "+44 0000 123456", "fax": "+44 0000 654321", "emails": [ "foobar@gmail.com" ] }, "registryDomainId": "e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR", "registrarWHOISServer": "http://whois.paragonnames.net", "registrar": "Paragon Internet Group Ltd t/a Paragon Names", "registrarId": "12345", "registrarEmail": "foobar@gmail.com", "registrarPhone": "549-214-2194", "dnsSecStatus": "unsigned" }, "domainDns": { "name": "", "domainRecords": [ "example.com A 123.45.203.8", "example.com A 123.45.93.26", "1234:4700:1231::1234:5d1a", "1234:4700:1421::bk43:cb08" ], "nameServers": [ "ns23.control.com", "ns24.control.com" ] }, "timestamp": "2023-08-01T18:24:00.000Z" } } ] ``` ### Hijacked domains This example shows the data structure for hijacked domains. ``` [ { "time": 1748955600, "index": "akamai-infrastructure-security-analytics", "source": "main", "sourcetype": "HIJACKED_DOMAIN", "event": { "zoneName": "example.com", "domainName": "www.example.com", "nameserverIp": "192.0.2.1", "countryCode": "US", "answer": "198.51.100.1", "type": "HIJACK", "detectedAt": "2025-06-03T10:15:30Z" } } ] ``` # Custom HTTP endpoint These examples show the data structure of events that are sent to a custom HTTP endpoint. Go to the section for a specific data type. * [NXDOMAIN spikes](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#nxdomain-spikes-4) * [Dangling CNAMEs](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#dangling-cnames-4) * [Prolexic attack and alert events](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-attack-and-alert-events-4) * [Prolexic traffic](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#prolexic-traffic-4) * [Related domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#related-domains-4) * [Hijacked domains](https://techdocs.akamai.com/edge-dns/docs/examples-event-data#hijacked-domains-4) ### NXDOMAIN spikes This example shows the data structure for NXDOMAIN spikes. ``` [ { "accountId": "acc-123456", "zoneName": "example.com", "algo": "DYNAMIC", "threshold": 0.25, "startTime": "2025-06-03T10:00:00Z", "endTime": "2025-06-03T10:15:00Z", "totalQueries": 62000, "totalNxdomains": 20000, "topCountryIsoCode": "US" } ] ``` ### Dangling CNAMEs This example shows the data structure for dangling CNAMEs. ``` [ { "zoneName": "example.com", "aliasName": "test.example.com", "canonicalName": "unresolved.external-service.com", "status": "DETECTED", "detectedAt": "2025-06-03T10:15:30Z", "clearedAt": "2025-06-03T11:00:00Z" } ] ``` ### Prolexic attack and alert events This example shows the data structure for Prolexic attack and alert events. ``` [ { "uri": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc.0", "startTime": 1783327020000, "endTime": 1783327200000, "startTimeUtc": "2026-07-06T08:37:00Z", "endTimeUtc": "2026-07-06T08:40:00Z", "shortMessage": "Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC", "longMessage": "
Attack IdSummaryLast OccurredLocation
01abc--18.13.3.4::CRIT:1783327020:thor1.0Akamai Flow Anomaly for abc_xyz, destination_ip 18.13.3.4 with top talker ABC_LLC2026-07-06 08:40:00 UTC
", "observationCategory": "alert", "observationSubcategory": "80", "isActive": false, "isDuration": false, "customerRealm": "abc_abc", "customer": "abc_abc", "observationOn": "plx://observation/ede-alerts/ede.sev80/01abc--18.13.3.4::CRIT:1783327020:abc1.0", "source": "fbm", "ip": "18.13.3.4", "details": [ "plx://observation/ede-alerts/ede.sev80/01abc--28.15.12.19::CRIT:1696262181:abc1.0" ] } ] ``` ### Prolexic traffic This example shows the data structure for Prolexic traffic. ``` [ { "timestamp": 1748952000000, "timestampUtc": "2025-06-03T12:00:00Z", "preMitigationBps": 4321, "preMitigationPps": 2100 } ] ``` ### Related domains This example shows the data structure for related domains. ``` [ { "name": "example-threat.com", "zones": [ "example.com" ], "tags": [ "mobile" ], "domainRegistration": { "name": "example.com", "status": "clientTransferProhibited", "createDate": "2024-02-28T12:28:35Z", "updateDate": "2024-02-28T12:28:43Z", "dnsSec": false }, "customerPriorityLevel": 5, "customerPriorityLevelLabel": "low", "delegationSet": 2, "domainWhoIs": { "name": "", "domainStatus": [ "clientTransferProhibited https://icann.org/epp#clientTransferProhibited", "clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited", "addPeriod https://icann.org/epp#addPeriod" ], "regContact": { "organization": "Nimbus Innovations Ltd.", "street": "42 Waverley Crescent", "city": "Lichfield", "stateProvince": "Staffordshire", "postalCode": "WS13 7AB", "country": "GB", "phone": "+44 1543 567890", "fax": "+44 1543 567891", "emails": [ "foobar@gmail.com" ] }, "adminContact": { "name": "Alicia Testington", "organization": "Fakester Corp.", "street": "123 Imaginary Lane", "city": "Nowhereville", "stateProvince": "East Fakeshire", "postalCode": "ZZ99 1ZZ", "country": "GB", "phone": "+44 1234 000000", "fax": "+44 1234 000001", "emails": [ "foobar@gmail.com" ] }, "techContact": { "organization": "Quantum Pickles Ltd.", "street": "404 Phantom Street", "city": "Faketon", "stateProvince": "West Nonsensehire", "postalCode": "FA1 2KE", "country": "GB", "phone": "+44 0000 123456", "fax": "+44 0000 654321", "emails": [ "foobar@gmail.com" ] }, "registryDomainId": "e3a9b6f0c18d4a2b9e7c5f1a2d3b8c4e-LROR", "registrarWHOISServer": "http://whois.paragonnames.net", "registrar": "Paragon Internet Group Ltd t/a Paragon Names", "registrarId": "12345", "registrarEmail": "foobar@gmail.com", "registrarPhone": "549-214-2194", "dnsSecStatus": "unsigned" }, "domainDns": { "name": "", "domainRecords": [ "example.com A 123.45.203.8", "example.com A 123.45.93.26", "1234:4700:1231::1234:5d1a", "1234:4700:1421::bk43:cb08" ], "nameServers": [ "ns23.control.com", "ns24.control.com" ] }, "timestamp": "2023-08-01T18:24:00.000Z" } ] ```
### Hijacked domains This example shows the data structure for hijacked domains. ``` [ { "zoneName": "example.com", "domainName": "www.example.com", "nameserverIp": "192.0.2.1", "countryCode": "US", "answer": "198.51.100.1", "type": "HIJACK", "detectedAt": "2025-06-03T10:15:30Z" } ] ``` # Sibling pages * [NXDOMAIN spike detection](https://techdocs.akamai.com/edge-dns/docs/nxdomain-spike-detection.md) * [Dangling CNAME detection](https://techdocs.akamai.com/edge-dns/docs/dangling-cname-detection.md) * [DNS hijacking detection](https://techdocs.akamai.com/edge-dns/docs/dns-hijacking-detection.md) * [Related domain detection](https://techdocs.akamai.com/edge-dns/docs/related-domain-detection.md) * [Manage the related domains report](https://techdocs.akamai.com/edge-dns/docs/manage-related-domains.md) * [Manage infrastructure security analytics](https://techdocs.akamai.com/edge-dns/docs/manage-security-analytics.md) * [Create a destination in Infrastructure Security Analytics](https://techdocs.akamai.com/edge-dns/docs/create-destination-sa.md)