Pull data from the Akamai SIEM Integration API

Overview

Get a list of Akamai SIEM Integration security events through the SIEM Integration API using the HTTP Pull Listener.

HTTP Pull Listener configuration

In Falcon Onum, go to the Listeners area and click New Listener > HTTP Pull. Give a name to your new Listener and enter the following data:

Parameters

Add the following parameters:

• Name - domain

• Integration - Enter your Akamai SIEM Integration domain name.

• Name - configId

• Value - Enter your Akamai SIEM Integration configuration ID.

Secrets

You must define these credentials in Onum:

• clientSecret will reference your Akamai SIEM Integration Client Secret.

• accessToken will reference your Akamai SIEM Integration Access Token.

• clientToken will reference your Akamai SIEM Integration Client Token.

To do it, click Add element and enter a Name for the secret (in this case, clientSecret). Then, click the Value field and select New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the Value field list. Repeat the process for the accessToken and the clientToken.

Learn more about secrets in Onum in this article.

Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 30m
  offset: 30m
  tz: UTC
  format: Epoch
withAuthentication: true
authentication:
  type: akamai
  akamai:
    clientSecret: ${secrets.clientSecret}
    accessToken: ${secrets.accessToken}
    clientToken: ${secrets.clientToken}
withEnumerationPhase: false
collectionPhase:
  paginationType: "cursor"
  cursorSelector: .offset
  initialRequest:
    responseType: ndjson
    method: "GET"
    url: "https://${parameters.domain}/siem/v1/configs/${parameters.configId}"
    queryParams:
      - name: from
        value: ${temporalWindow.from}
      - name: to
        value: ${temporalWindow.to}
      - name: limit
        value: "1000"
  nextRequest:
    responseType: ndjson
    method: "GET"
    url: "https://${parameters.domain}/siem/v1/configs/${parameters.configId}"
    queryParams:
      - name: offset
        value: ${pagination.cursor}
      - name: limit
        value: "1000"
  output:
    select: "."
    filter: ".offset == null"
    outputMode: "element"

Manually configure

When you're done, click Create labels to move on to the next step and define the required Labels if needed.