Download SIEM event data (legacy customers only)

📘

The content on this page deals with a legacy feature of the Akamai Identity Cloud. If you are currently an Identity Cloud customer and are using SIEM event delivery, that feature is still supported. However, if you’re new to the Identity Cloud, SIEM event delivery is no longer available.

You must use SFTP (SSH File Transfer Protocol) and a valid public key in order to retrieve data from your Amazon S3 bucket. Currently Amazon Web Services supports the following SFTP clients:

• OpenSSH (Macintosh and Linux)
• WinSCP (Microsoft Windows-only)
• Cyberduck (Windows, Macintosh, and Linux)
• FileZilla (Windows, Macintosh, and Linux)

Note that SFTP is the only way to access the S3 bucket.

📘

We should also mention that Amazon’s SFTP Transfer service is not yet available in the China AWS region (although the service is expected soon).

If your organization needs to set up an allow list for data retrieval -- that is, if you need to limit data retrieval to a specific set of IP addresses -- ​Akamai​ has configured a pair of static IP addresses for each Identity Cloud region:

For example, in the US your allow list for SIEM data retrieval would include these two IP addresses:

• 3.209.201.47
• 52.208.55.204

When SIEM Event Delivery is activated, you’ll get back an API response similar to the following:

{  
    "message": "Your request has been accepted and is being  
    processed.",  
    "sftp":  
        {  
         "uri": "sftp://user_79y4mqf2rt3bxs378kw5479xdu@eventdelivery.multi.prod.va.janrain.com",  
         "user": "user_79y4mqf2rt3bxs378kw5479xd",  
         "host": "eventdelivery.multi.prod.va.janrain.com"  
       }  
}

As noted elsewhere, each organization is given a single user account (the user field). All users who access the S3 bucket must log on using this same username (as well as an SSH key associated with the S3 bucket).

Meanwhile, the uri property specifies the URL for your S3 bucket. In the preceding example, that URL is sftp://user_79y4mqf2rt3bxs378kw5479xdu@eventdelivery.multi.prod.va.janrain.com.

The exact steps required to access your S3 bucket depend on which SFTP client you use. For example, if you use Cyberduck you’ll need to follow a procedure similar to this:

1. Start Cyberduck and then click Open Connection:

   

2. In the dropdown dialog, set the protocol to SFTP (SSH File Transfer Protocol):

   

3. Type the value of the host property (e.g., eventdelivery.multi.prod.va.janrain.com) in the Server field and the port number for the S3 bucket in the Port field:

   

4. Enter the value of the user property (in this example, user_79y4mqf2rt3bxs378kw5479xd) in the Username field. Leave the Password field blank:

   

5. Click SSH Private Key and then select the private key you're using for S3 access. Keep in mind that the corresponding public key must already be associated with the S3 bucket:

   

6. When you are finished, click Connect:
   

After the connection is made, your SIEM event files will appear in the Cyberduck window.

To download a file, right click the file name and then click:

• Download (to download the file directly to your Downloads folder).
• Download As (which enables you to specify a different file name and/or download location).
• Download To (which lets you change the download location but not the file name).

To remove a file from the S3 bucket, right-click the file name and then click Delete. You must use SFTP (SSH File Transfer Protocol) and a valid public key in order to retrieve data from your Amazon S3 bucket. Currently Amazon Web Services supports the following SFTP clients:

• OpenSSH (Macintosh and Linux)
• WinSCP (Microsoft Windows-only)
• Cyberduck (Windows, Macintosh, and Linux)
• FileZilla (Windows, Macintosh, and Linux)

Note that SFTP is the only way to access the S3 bucket.

📘

We should also mention that Amazon’s SFTP Transfer service is not yet available in the China AWS region (although the service is expected soon).

If your organization needs to set up an allow list for data retrieval -- that is, if you need to limit data retrieval to a specific set of IP addresses -- ​Akamai​ has configured a pair of static IP addresses for each Identity Cloud region:

For example, in the US your allow list for SIEM data retrieval would include these two IP addresses:

• 3.209.201.47
• 52.208.55.204

When SIEM Event Delivery is activated, you’ll get back an API response similar to the following:

{  
    "message": "Your request has been accepted and is being  
    processed.",  
    "sftp":  
        {  
         "uri": "sftp://user_79y4mqf2rt3bxs378kw5479xdu@eventdelivery.multi.prod.va.janrain.com",  
         "user": "user_79y4mqf2rt3bxs378kw5479xd",  
         "host": "eventdelivery.multi.prod.va.janrain.com"  
       }  
}

As noted elsewhere, each organization is given a single user account (the user field). All users who access the S3 bucket must log on using this same username (as well as an SSH key associated with the S3 bucket).

Meanwhile, the uri property specifies the URL for your S3 bucket. In the preceding example, that URL is sftp://user_79y4mqf2rt3bxs378kw5479xdu@eventdelivery.multi.prod.va.janrain.com.

The exact steps required to access your S3 bucket depend on which SFTP client you use. For example, if you use Cyberduck you’ll need to follow a procedure similar to this:

1. Start Cyberduck and then click Open Connection:

   

2. In the dropdown dialog, set the protocol to SFTP (SSH File Transfer Protocol):

   

3. Type the value of the host property (e.g., eventdelivery.multi.prod.va.janrain.com) in the Server field and the port number for the S3 bucket in the Port field:

   

4. Enter the value of the user property (in this example, user_79y4mqf2rt3bxs378kw5479xd) in the Username field. Leave the Password field blank:

   

5. Click SSH Private Key and then select the private key you're using for S3 access. Keep in mind that the corresponding public key must already be associated with the S3 bucket:

   

6. When you are finished, click Connect:
   

After the connection is made, your SIEM event files will appear in the Cyberduck window.

To download a file, right click the file name and then click:

• Download (to download the file directly to your Downloads folder).
• Download As (which enables you to specify a different file name and/or download location).
• Download To (which lets you change the download location but not the file name).

To remove a file from the S3 bucket, right-click the file name and then click Delete.