SIEM Splunk connector

Combine Splunk and ‚ÄčAkamai‚Äč to gain insights into attacks. Watch the Analytics-driven Cloud Security at Scale with Splunk and ‚ÄčAkamai‚Äč video to learn more.

The sample Splunk connector is a Splunk add-on that captures security events from the ‚ÄčAkamai‚Äč Security Events Collector, which exposes a RESTful API that lets the connector pull events in JSON format. Akamai's Splunk add-on converts security event data from JSON into CIM format. The resulting data can then be imported into and analyzed by Splunk.

The Splunk ConnectorThe Splunk Connector

Install the Splunk connector

System requirements

  • Akamai Splunk Connector requires Oracle JRE 1.8+. Download the latest from the Oracle Java site (Java Platform, Standard Edition) or install it from a software distribution package on Linux.
  • Java is already installed on the host running Splunk Enterprise.
  • KVStore is already installed on the host machine where you want to install your connector.
  • Verify that splunk forwarder is not installed on your Splunk Enterprise host machine.

Hardware requirements

This application has been tested with the following operating systems:

  • CentOS 7
  • Windows Server 2012 R2
  • Mac OS X El Capitan Version 10.11.6

Some additional hardware requirements:

  • 4 CPU cores
  • 16 GB RAM
  • 2GB Free Disk Space

Proxy server

To access the SIEM API from behind a proxy server, ensure that your proxy:

  • Allows the domains *.cloudsecurity.akamaiapis.net and *.luna.akamaiapis.net.
  • Doesn't interfere with HTTP request headers for those domains. If, due to a strict enterprise security policy, your proxy changes these headers, make sure that, at a minimum, you allow and don't change the Host and Authorization headers.

Install

  1. Go to https://splunkbase.splunk.com/app/4310/ and download the connector.

    Tip: On Splunkbase, subscribe to this connector to be notified of future updates. If you want to view or modify the sample Splunk connector, find it on GitHub at https://github.com/TristanBaoui/siem-splunk-connector. Note that ‚ÄčAkamai‚Äč does not offer support for any modifications you make on your own.

  2. In Splunk, in the upper left of the screen, click the Splunk icon.

  3. Next to Apps at the top of the navigation bar, click the gear icon.

  4. Click Install app from file.

  5. Click Choose File.

  6. Browse to and select akamai-siem-integration_x.tgz (x being the latest version available) and then click Open.

  7. Click Upload.

  8. Restart Splunk.
    You see ‚ÄčAkamai‚Äč SIEM API (Security Information and Event Management):

    SIEM in SplunkSIEM in Splunk

  9. From the menu, click Settings > Data Inputs.

  10. Click the ‚ÄčAkamai‚Äč Security Incident Event Manager API.

  11. Click New and complete the following fields:

    • Name. Enter any name you want for the input.
    • Hostname. Enter the host URL copied when you provisioned the SIEM API.
    • Security Configuration(s). Enter the Configuration ID copied when you enabled SIEM in ‚ÄčAkamai Control Center‚Äč
    • Client Token, Client Secret, and Access Token. Enter the values copied when you provisioned the SIEM API.
    • proxy_host. Enter the proxy host name of your proxy server.
    • proxy_port. Enter the port number you use to connect to your proxy server.
    • Initial Epoch Time and Final Epoch Time. Leave these fields blank. If you encounter an issue with your events, you can later use these fields to retrieve security event data for a specific time period.
    • Limit. To limit the number of security events pulled with each API call, enter an integer value here. If not specified, the API retrieves a maximum of 150,000 records per call.
    • log level. Specifies the message types that are logged.¬†By default, the log level is set to¬†INFO, but you can change it to¬†WARN,¬†ERROR,¬†FATAL, or¬†DEBUG¬†to get more data for certain situations. For example, if you have a problem with the connector, use¬†DEBUG¬†to get more detailed messages that will help you troubleshoot.
    • Interval. Number of seconds between fetch requests. Enter 60 unless you have entered values in both the Initial Epoch Time and Final Epoch Time fields to retrieve security events for a specified time period. In that case, leave the Interval field blank. If it takes more than 60 seconds to fetch the data, increase the interval value to the amount of seconds you need to complete the task.
  12. Return to the Splunk homepage and click ‚ÄčAkamai‚Äč SIEM.
    If you see data then setup was successful:

    Sample SIEM SataSample SIEM Sata

  13. If you don't see data, go to the menu and click Debug > Akamai Logging dashboard.
    You see ‚ÄčAkamai‚Äč SIEM Errors on the right:

    Akamai Logging DashboardAkamai Logging Dashboard

    In the event of a fatal error that prevents data collection, review the logs and take corrective action. This log is also available in /{splunk_home}/var/log/splunk. Read how to retrieve past security events.

  14. To search for SIEM data in Splunk, use the search app. To use this app, fom the Splunk homepage click Search and Reporting app and enter the query sourcetype="akamaisiem".

ūüĎć

We strongly recommend installing the Splunk add-on app Lookup File Editor from within Splunk Apps. You need this add-on to switch retrieval mode .

After a data input has been enabled, you can't edit that input and then run it again. Instead, you must disable the input, clone it, make changes to the clone, then run the new, cloned input.

SIEM API data format for Splunk

CIM mapping list

Event TypeSource TypeObject TypeEvent Type Field or ExpressionCIM Mapping ModelsCIM Field
Akamai‚ÄčSecurity‚ÄčConfig‚ÄčEventakamai
siem
FIELD
ALIAS
attack‚ÄčData.clientIPVulnerabilities
Malware Attacks
All changes
Proxy
Src
Akamai‚ÄčSecurity‚ÄčConfig‚ÄčEventakama
isiem
FIELD
ALIAS
https‚ÄčMessage.bytesVulnerabilities
Malware Attacks
All changes
Proxy
bytes

Attack data

FieldDescriptionExampleNotes
configIdID of the Security Configuration applied to the request.6724
policyIdID of the Firewall policy applied to the request.scoe_5426
clientIPIP address of the client that made the request.
slowPostActionAction taken if a Slow POST attack is detected: W for Warn or A for deny (abort).W
slowPostRateRecorded rate of a detected Slow POST attack.10
rulesBase64-encoded rule IDs of rules triggered for the request.OTUwMDA0;O TkwMDExRepresents
[950004, 990011]
ruleVersionsBase64-encoded versions of rules triggered for the request.;Represents
[, ]
ruleMessagesBase64-encoded messages of rules that triggered for this requestQ3Jvc3Mtc2 l0ZSBTY3 J pcHRpbmcgK FhTUykgQXR 0YWNr; UmV xdWVzdCBJb mRpY2F0ZXM gYW4 gYXV0 b21hdGVkIH Byb2 dyYW0 gZXhwbG9yZ WQgdGhlIHN pdGURepresents a Cross-site Scripting (XSS) Attack, Request indicates an automated program explored the site.
ruleTagsBase64-encoded tags of rules that triggered for the request.V0VCX0FUVE FDSy9YU1M= ;QV VUT01B VElPTi9NSV NDRepresents
[WEB_ATTACK/ XSS,AUTOMATION/ MISC]

See WAF rules list for all tags
ruleDataBase64-encoded user data of rules that triggered for this request.YWxlcnQo;Y 3VybA==Represents
[alert(, curl]
ruleSelectorsBase64-encoded selectors of rules that triggered for the request.QVJHUzph;U kVRVUVTVF9 IRU FERVJT OlVzZXItQW dlbnQ=Represents
[ARGS:a, REQUEST_HEADERS: User-Agent]
ruleActionsBase64-encoded actions of rules that triggered for the request.QUxFUlQ;RE VOWQ==Represents
[ALERT, DENY]
clientReputationClient IP scores for Client ReputationID=172.19.185.64; WEBATCK=9; DOSATCK=9
apiIdAPI ID for API Protection.API_41
apiKeyAPI Key for API Protection.bkayZOMvuy 8aZOhIgxq94 K9Oe7Y70Hw 55

HTTP message data

NameDescriptionExample
requestIdGlobally unique ID of the message.2ab418ac8515f33
startTime, in epoch format (and to millisecond precision) when the Edge Server initiated the connection for the message exchange being monitored.1470923133.026
protocolProtocol of the transaction being monitored.http/2
tlsTLS version, if applicable. Should be equal to AK_TLS_VERSION.TLSv1.2
methodMethod of the incoming request.POST
hostValue of the incoming client request's HOST header.www.example.com
portPort number used by the incoming request. Should be equal to the value of AK_IN_PORT.80
pathPath used in the incoming URI from the client, not including query strings./examples/1/
queryQuery strings passed in the incoming URI from the client. a=../../../etc/passwd
requestHeadersAll request headers collected.
statusHTTP Response status sent to the client.301
bytesBytes served in the client response.34523
responseHeadersAll response headers collected.

Geo data

NameDescriptionExample
continent2-letter code for the continent that the IP address maps to.NA
country2-letter ISO-3166 code for the country the IP address maps to.US
cityCity that the IP address maps to.NEWYORK
regionCode2-letter ISO-3166 code for the state, province, or region the IP address maps to.NY
asnAutonomous System Number (or numbers) that the IP address belongs to.12271

userRiskData object

User information included in an event if: 1) you are using Account Protector and 2) the event occurs on a protected endpoint. If a client request is denied, user risk information might not be calculated and included in the event, depending on when that denial took place.

NameDescriptionExample
uuidUnique identifier of the user whose risk data is being provided.813d54f4-0821-4o0a-a2pp6-0101dd0ec23u
statusStatus code indicating any errors that might have occurred when calculating the risk score. See the User Score Status section of this page for details.0
scoreCalculated risk scores. Scores range from 0 (no risk) to 100 (the highest possible risk).75
riskIndicators that increased the calculated risk score. For example, the value udfp represents the risk of the device fingerprint based on the user's behavioral profile.udfp:1325gdg4g4343g/M
trustIndicators that were trusted. For example, the value ugp indicates that the user’s country or area is trusted.ugp:US
generalIndicators of general behavior observed for relevant attributes. For example, duc_1h represents the number of users recorded on a specific device in the past hour..duc_1h:10
allowIndicates whether the user is on the allow list. A 0 indicates that the user was not on the list; a 1 indicates that the user was on the list.0

clientData object

This data is included only if you are running Botman Premier and the request is matched as a resource purpose with bot protection enabled.

NameDescriptionExample
appBundleIdUnique identifier of the app bundle. An app bundle contains both the software itself and the accompanying configuration information.AXWDAA
appVersionVersion number of the app.1.1.2
telemetryTypeSpecifies the telemetry type in use. Allowed values are:

  • 0 -- Web client (standard telemetry)
  • 1 -- Web client (inline telemetry)
  • 2 -- Native app (SDK)
1
sdkVersionVersion number of the software developer's kit.1.4.10

botData object

‚ÄčAkamai‚Äč Bot Manager information associated with the event. This data is included only if you are running Botman Premier and the request is matched as a resource purpose with bot protection enabled.

NameDescriptionExample
botScoreScore assigned to the request by Botman Manager.65
responseSegmentNumeric response segment indicator. Segments are used to group and categorize bot scores. Allowed values are:

  • 0 -- Human
  • 1 -- Cautious response
  • 2 -- Strict response
  • 3 -- Aggressive response
  • 4 -- Safeguard
3

Custom data

NameValue
customBase64-encoded custom value. The size limit for custom data is 2KB.

Environment variables

Splunk connector v1.4.14 introduced a feature where customers have the choice to provide connection and socket timeouts. The customer can provide timeout values of their choice by making use of the environment variables AKAMAI_SIEM_HTTP_CONNECTION_TIMEOUT and AKAMAI_SIEM_HTTP_SOCKET_TIMEOUT. Both these variables expect respective timeouts to be provided in seconds. Note that you'll need to restart Splunk for these changes to take effect.

Retrieve past security events using the Splunk connector

The ‚ÄčAkamai‚Äč Splunk connector offers 2 modes of operation:

  • Offset-based. The most commonly used mode: the connector automatically logs security events as they‚Äôre collected. The connector operates in offset mode when the Initial Epoch Time and Final Epoch Time fields are blank.
  • Time-based. Enables you to retrieve only the events that occurred with a specified time period (requires the use of the¬†Initial Epoch Time¬†field and, optionally, the¬†Final Epoch Time¬†field). For example, if your SIEM connection is disrupted you can retrieve any (or all) security events that occurred within the last 12 hours.

To retrieve missing/past security events, switch from an offset-based to a time-based feed:

  1. Open your Splunk connector’s configuration and, in the Initial Epoch Time field, enter the start time (in epoch format) of the period for which you want to review security event data.
  2. (Optional) In the Final Epoch Time enter the end time for that period (in epoch format). The time window you set can be any interval within the 12 hours preceding the present moment. If this field is left blank, the connector pulls events up to the present and continues to log events as they’re collected.
  3. To return the connector to offset mode, clear the Initial Epoch Time and Final Epoch Time fields and save your changes.

If regular offset event collection occurred within the time window, you may see duplicate data in Splunk.

Don't see the data you expected? When you set the Initial Epoch Time and Final Epoch Time fields to retrieve security events for a specific time period, the connector makes only one call to the API. If the number of events in the specified time window exceeds the value in the Limit field (or the default limit of 150,000) the connector won't retrieve data. As a workaround, decrease the time period for retrieving events; for example, you might need to make one API call to retrieve events that occurred in the first 6 hours of your time period, and a second API call to retrieve events that occurred in the final 6 hours of your time period.

Update the sample Splunk connector

To be notified when a new version of the connector is released, go to the Splunkbase page for the SIEM connector app, and click Subscribe. When there's new release, Splunkbase notifies you via email. You can then upgrade directly from within your Splunk server web admin page by doing the following:

  1. Open Splunk.
  2. Next to Apps at the top of the navigation bar, click the gear icon.
  3. On the apps page, you see that the ‚ÄčAkamai‚Äč SIEM Integration app has a new release. Click Update.
  4. Accept the license agreement.
  5. Download and install. You may need to restart Splunk following the installation.

Did this page help you?