About Infrastructure Security Analytics

Infrastructure Security Analytics is an analytics solution that detects and analyzes threats across your Akamai infrastructure security portfolio. It monitors your Edge DNS zones, Global Traffic Management (GTM) domains, Shield NS53 configurations, and your Prolexic setup. You can also configure it to deliver data to your preferred SIEM or security tool.

Infrastructure Security Analytics scans and reports on the following:

• Nonexistent domain (NXDOMAIN) spikes for zones, shields, and GTM domains. Indicates there’s an increase in responses from DNS servers that cannot resolve a nonexistent domain. These spikes can signal a DNS resource exhaustion attack where an attacker attempts to flood DNS infrastructure. If you are using Shield NS53, you can also enable NXDOMAIN spike detection for a shield configuration. For more information, see NXDOMAIN spike detection.
• Dangling canonical name (CNAME) records for zones. Indicates CNAME records point to domains that do not exist. This can lead to subdomain takeover where an attacker redirects traffic. For more information, see Dangling CNAME detection.
• Hijacked domains for zones. Indicates domains resolve to answers that are not authoritatively defined for a zone or domains are blocked and resolve to an NXDOMAIN. To carry out DNS hijacking, an attacker compromises the DNS resolution process, such as the public name server to redirect traffic, block access, steal information, and more. For more information, see DNS hijacking detection.
• Related domains for zones. Indicates there are domains that resemble or look like one of your domains. These domains can be fake domains that attackers use for phishing, brand impersonation, trademark infringement, and more. For more information, see Related domain detection.
• Prolexic configuration and DDoS protection coverage. Dashboard that shows high-level configuration metrics, traffic analytics, and event data across your Prolexic environment and products including Prolexic Routed and Prolexic Network Cloud Firewall. The dashboard also shows data from the Prolexic Network Observability Analytics (NOA) reports to identify the hosts that are generating the most traffic. For more information, see Prolexic executive summary dashboard.

📘

You can run specific reports for Infrastructure Security Analytics in Control Center reports. On the Infrastructure Security Analytics dashboard, click Reports or from the Control Center menu, click Analytics & monitor > Reporting. To learn more about these reports, see Infrastructure Security Analytics reports.