Configure an Akamai Kona Log Source by using the Akamai Kona REST API Protocol
Collect events from Akamai Kona in JSA by using the Akamai Kona REST API protocol.
Collect eventsfrom Akamai Kona REST API:
- If automatic updates are not enabled, download and install
the most recent version of the following RPMs from the https://support.juniper.net/support/downloads/ onto your JSA Console:
Protocol Common RPM
Akamai Kona REST API RPM
DSMCommon RPM
Akamai KONA DSM RPM
- Configure Akamai Kona to send Security events to JSA by using the Akamai Kona REST API protocol.
- Configure Akamai Kona to communicate with JSA.Note:
The Akamai KONA DSM supports only JSON formatted events. Akamai's sample CEF and Syslog connector does not work with the Akamai KONA DSM.
- Add a log source in JSA.
The following table describes the log source parameters that require specific values for Akamai KONA DSM event collection:
Table 1: Akamai KONA DSM Log Source Parameters Parameter
Value
Log source type
Akamai KONA.
Protocol Configuration
Akamai Kona REST API
Host
Provided during the SIEM OPEN API provisioning in the Akamai Luna Control Center. The Host is a unique base URL that contains information about the appropriate rights to query the security events. This parameter is a password field because part of the value contains secret information.
Client Token
One of the two security parameters. This token is paired with Client Secret to make the client credentials. This token can be found after you provision the Akamai SIEM OPEN API.
Client Secret
One of the two security parameters. This secret is paired with Client Token to make the client credentials. This token can be found after you provision the Akamai SIEM OPEN API.
Access Token
Security parameter that is used with client credentials to authorize API client access for retrieving the security events. This token can be found after you provision the Akamai SIEM OPEN API.
Security Configuration ID
ID for each security configuration that you want to retrieve security events for. This ID can be found in the SIEM Integration section of your Akamai Luna portal. You can specify multiple configuration IDs in a comma-separated list. For example: ConfigID1, configID2.
Use Proxy
If JSA accesses the Amazon Web Service by using a proxy, enable Use Proxy.
If the proxy requires authentication, configure the Proxy Server, Proxy Port, Proxy Username, and Proxy Password fields.
If the proxy does not require authentication, configure the Proxy Server and Proxy Port fields.
Automatically Acquire Server Certificate
Select Yes for JSA to automatically download the server certificate and begin trusting the target server.
Recurrence
The time interval between log source queries to the Akamai SIEM API for new events. The time interval can be in hours (H), minutes (M), or days (D).
The default is 1 minute.
EPS Throttle
The maximum number of events per second.
The default is 5000.
For more information about this protocol, see Configuring an Undocumented Protocol in Undocumented protocols.