---
updatedAt: 2026-03-01T18:37:30.000Z
agentTools:
  siteIndex: https://techdocs.akamai.com/llms.txt
  projectIndex: https://techdocs.akamai.com/terraform/llms.txt
---

# SIEM settings

akamai_appsec_siem_settings

Update or delete Security Information and Event Management (SIEM) settings for a given security configuration. To delete a set of settings, run `terraform destroy`.

```json Declaration
resource "akamai_appsec_siem_settings" "my_siem_settings" {
  config_id               = 12345
  enable_siem             = true
  enable_for_all_policies = false
  siem_id                 = 1
  security_policy_ids     = ["siem_123456"]
  exceptions {
    rate = ["alert"]
  }
}
```

## Arguments

Pass each of the required items to set SIEM enablement status for your security configuration. Use the `exceptions` argument to manage any attack type exclusions.

<table>
  <thead>
    <th>Argument</th>
    <th>Required</th>
    <th>Description</th>
  </thead>
  <tbody>
    <tr>
      <td><code>config_id</code> </td>
      <td class="center-text">✔️</td>
      <td>Your security configuration's ID</td>
    </tr>
    <tr>
      <td><code>enable_siem</code></td>
      <td class="center-text">✔️</td>
      <td>Whether to enable SIEM settings in the given security configuration.</td>
    </tr>
    <tr>
      <td><code>enable_for_all_policies</code></td>
      <td class="center-text">✔️</td>
      <td>Whether your SIEM settings apply to all security policies. If you set this to <code>false</code>, list the security policies to cover in the <code>security_policy_ids</code> argument.</td>
    </tr>
    <tr>
      <td><code>siem_id</code></td>
      <td class="center-text">✔️</td>
      <td>SIEM settings definition version. Value is <code>1</code>. </td>
    </tr>
    <tr>
      <td><code>security_policy_ids</code></td>
      <td></td>
      <td>
        <p>Conditionally required: <code>enable_for_all_policies</code> is set to <code>false</code>.</p>
        <p>A JSON list of security policy IDs on which to enable your settings.</p>
      </td>
    </tr>
    <tr>
      <td><code>enable_botman_siem</code></td>
      <td></td>
      <td>Whether to include Bot Manager events in your SIEM events.<blockquote><strong>Important:</strong> While optional, use of this argument causes drift. Use with care.</blockquote></td>
    </tr>
    <tr>
      <td><code>include_ja4_fingerprint_to_siem</code></td>
      <td></td>
      <td>Whether to include JA4 Fingerprint in SIEM events.</td>
    <tr>
      <td><code>exceptions</code></td>
      <td></td>
      <td>
        <p>A list of attack exceptions to ignore in your SIEM settings. For each attack exception you include,  provide a <code>protection</code> argument with a value of an action type to ignore, <code>protection = ["action"]</code>.</p>
        <p>Available <code>protection</code> types: 
          <div class="Flex-two">
            <div class="Flex-item-two">
              <ul>
                <li><code>ip_geo</code></li>
                <li><code>rate</code></li>
                <li><code>url_protection</code></li>
                <li><code>slow_post</code></li>
                <li><code>custom_rules</code></li>
                <li><code>waf</code></li>
              </ul>
            </div>
            <div class="Flex-item-middle-two"></div>
            <div class="Flex-item-two">
              <ul>
                <li><code>api_request_constraints</code></li>
                <li><code>client_rep</code></li>
                <li><code>malware_protection</code></li>
                <li><code>bot_management</code></li>
                <li><code>apr_protection</code></li>
              </ul>
            </div>
          </div>
        <p>
        <p>Possible actions:
        <blockquote>To exclude all actions, pass a value of <code>*</code>.</blockquote>
        <div class="Flex-two">
          <div class="Flex-item-two">
            <ul>
              <li><code>alert</code></li>
              <li><code>deny</code></li>
              <li><code>all_custom</code></li>
              <li><code>abort</code></li>
              <li><code>allow</code></li>
            </ul>
          </div>
          <div class="Flex-item-middle-two"></div>
          <div class="Flex-item-two">
            <ul>
              <li><code>delay</code></li>
              <li><code>ignore</code></li>
              <li><code>monitor</code></li>
              <li><code>slow</code></li>
              <li><code>tarpit</code></li></ul>
            </ul>
          </div>
        </div>
      </p>
    </td>
  </tr>
</tbody>
</table>

## Attributes

There is no default standard output for this resource. Updates are reflected in your state file.

# Sibling pages

* [AAP selected hostnames](https://techdocs.akamai.com/terraform/docs/as-rc-aap-selected-hostnames.md)
* [AI rules](https://techdocs.akamai.com/terraform/docs/as-rc-waf-ai-rules.md)
* [Activations](https://techdocs.akamai.com/terraform/docs/as-rc-activations.md)
* [Advanced logging](https://techdocs.akamai.com/terraform/docs/as-rc-advanced-logging.md)
* [API constraints protection](https://techdocs.akamai.com/terraform/docs/as-rc-api-constraints-protection.md)
* [API request constraints](https://techdocs.akamai.com/terraform/docs/as-rc-api-request-constraints.md)
* [ASE penalty box settings](https://techdocs.akamai.com/terraform/docs/as-rc-ase-penalty-box-settings.md)
* [Attack group](https://techdocs.akamai.com/terraform/docs/as-rc-attack-group.md)
* [Attack payload logging](https://techdocs.akamai.com/terraform/docs/as-rc-attack-payload-logging.md)
* [Bypass network lists](https://techdocs.akamai.com/terraform/docs/as-rc-bypass-network-lists.md)
* [Configuration](https://techdocs.akamai.com/terraform/docs/as-rc-configuration.md)
* [Configuration rename](https://techdocs.akamai.com/terraform/docs/as-rc-configuration-rename.md)
* [Custom deny](https://techdocs.akamai.com/terraform/docs/as-rc-custom-deny.md)
* [Custom rule](https://techdocs.akamai.com/terraform/docs/as-rc-custom-rule.md)
* [Custom rule action](https://techdocs.akamai.com/terraform/docs/as-rc-custom-rule-action.md)
* [Eval](https://techdocs.akamai.com/terraform/docs/as-rc-eval.md)
* [Eval group](https://techdocs.akamai.com/terraform/docs/as-rc-eval-group.md)
* [Eval penalty box](https://techdocs.akamai.com/terraform/docs/as-rc-eval-penalty-box.md)
* [Eval penalty box conditions](https://techdocs.akamai.com/terraform/docs/as-rc-eval-penalty-box-conditions.md)
* [Eval rule](https://techdocs.akamai.com/terraform/docs/as-rc-eval-rule.md)
* [Evasive path match](https://techdocs.akamai.com/terraform/docs/as-rc-evasive-path-match.md)
* [IP Geo](https://techdocs.akamai.com/terraform/docs/as-rc-ip-geo.md)
* [IP Geo protection](https://techdocs.akamai.com/terraform/docs/as-rc-ip-geo-protection.md)
* [JA4 fingerprint](https://techdocs.akamai.com/terraform/docs/as-rc-ja4-fingerprint.md)
* [Match target sequence](https://techdocs.akamai.com/terraform/docs/as-rc-match-target-sequence.md)
* [Malware policy](https://techdocs.akamai.com/terraform/docs/as-rc-malware-policy.md)
* [Malware policy action](https://techdocs.akamai.com/terraform/docs/as-rc-malware-policy-action.md)
* [Malware policy actions](https://techdocs.akamai.com/terraform/docs/as-rc-malware-policy-actions.md)
* [Malware protection](https://techdocs.akamai.com/terraform/docs/as-rc-malware-protection.md)
* [Match target](https://techdocs.akamai.com/terraform/docs/as-rc-match-target.md)
* [Penalty box](https://techdocs.akamai.com/terraform/docs/as-rc-penalty-box.md)
* [Penalty box conditions](https://techdocs.akamai.com/terraform/docs/as-rc-penalty-box-conditions.md)
* [PII learning](https://techdocs.akamai.com/terraform/docs/as-rc-pii-learning.md)
* [Policy rename](https://techdocs.akamai.com/terraform/docs/as-rc-policy-rename.md)
* [Pragma header](https://techdocs.akamai.com/terraform/docs/as-rc-pragma-header.md)
* [Prefetch](https://techdocs.akamai.com/terraform/docs/as-rc-prefetch.md)
* [Rapid rules](https://techdocs.akamai.com/terraform/docs/as-rc-rapid-rules.md)
* [Rate policy](https://techdocs.akamai.com/terraform/docs/as-rc-rate-policy.md)
* [Rate policy action](https://techdocs.akamai.com/terraform/docs/as-rc-rate-policy-action.md)
* [Rate protection](https://techdocs.akamai.com/terraform/docs/as-rc-rate-protection.md)
* [Reputation profile](https://techdocs.akamai.com/terraform/docs/as-rc-reputation-profile.md)
* [Reputation profile action](https://techdocs.akamai.com/terraform/docs/as-rc-reputation-profile-action.md)
* [Reputation profile analysis](https://techdocs.akamai.com/terraform/docs/as-rc-reputation-analysis.md)
* [Reputation protection](https://techdocs.akamai.com/terraform/docs/as-rc-reputation-protection.md)
* [Request body settings](https://techdocs.akamai.com/terraform/docs/request-body-settings.md)
* [Rule](https://techdocs.akamai.com/terraform/docs/as-rc-rule.md)
* [Rule upgrade](https://techdocs.akamai.com/terraform/docs/as-rc-rule-upgrade.md)
* [Security policy](https://techdocs.akamai.com/terraform/docs/as-rc-security-policy.md)
* [Security policy default protections](https://techdocs.akamai.com/terraform/docs/as-rc-security-policy-default-protections.md)
* [Security policy protections](https://techdocs.akamai.com/terraform/docs/as-rc-security-policy-protections.md)
* [Slow POST](https://techdocs.akamai.com/terraform/docs/as-rc-slow-post.md)
* [Slow POST protection](https://techdocs.akamai.com/terraform/docs/as-rc-slow-post-protection.md)
* [Threat intel](https://techdocs.akamai.com/terraform/docs/as-rc-threat-intel.md)
* [Version notes](https://techdocs.akamai.com/terraform/docs/as-rc-version-notes.md)
* [WAF mode](https://techdocs.akamai.com/terraform/docs/as-rc-waf-mode.md)
* [WAF protections](https://techdocs.akamai.com/terraform/docs/as-rc-waf-protections.md)
* [WAF rule set](https://techdocs.akamai.com/terraform/docs/as-rc-waf-rule-set.md)
* [URL evasion defense](https://techdocs.akamai.com/terraform/docs/as-rc-url-evasion-defense.md)
* [URL protection action](https://techdocs.akamai.com/terraform/docs/as-rc-url-protection-action.md)
* [URL protection policy](https://techdocs.akamai.com/terraform/docs/as-rc-url-protection-policy.md)