Akamai Prolexic DNS GTM and SIEM API (Unofficial)

Overview

Details

Unofficial Splunk add on for Akamai prolexic, DNS and GTM, and SIEM API ingestion.

akamai:json_metrics -> collect Prolexic metrics using Prolexic API docs

All data is logged as JSON objects. The ingestion is performed once for every run of the input but for only new or updated metrics. For each metric the input keeps track of the last epoch timestamp logged for each metric-contract/subnet and only the recents events are logged to avoid duplicates.

akamai:json_conf -> collects GTM and DNS zones using Akamai GTM and DNS API

All data is logged as JSON objects. The ingestion is performed once for every run of the input.

akamai:json_event -> collects Prolexic events using Prolexic API.

All data is logged as JSON objects. The ingestion is performed once for every run of the input but for only new or updated events. The input calculate and saves and hash for each events (using the helper checkpoint functions from Splunk or by falling back to a local file). Only events with new hashes are logged to avoid duplicates.

akamai:json_siem collects SIEM API events.

All data is logged as JSON objects. The ingestion is performed as long as the API return at least on event or the desidered time limit is reached. The input saves the offset provided by the API so in the next run it will start to collect new events (more details in the API docs). This is the input that usually is collecting a lot of data, be careful.

Details: https://github.com/garis/Akamai-Splunk-API-integration

Special thanks to https://github.com/Pastea

Code on Github

Release Notes

Version 1.3.2

March 31, 2022

Custom action for new casemanagement input

Version 1.3.1

March 30, 2022

Add ticket info logging

Version 1.3

March 12, 2022

Tried to make the SIEM log collection running in a multi process mode. Only multi thread worked but the performance are the same (roughly 5000 events per second).

Version 1.2.4

Nov. 12, 2021

commented logging of credentails to avoid logging cleartext credentials in _internal

Version 1.2.3

Oct. 23, 2021

Workaround for stuck inputs based on the CrowdStrike add-on approach with a custom alert action.
Each input is logging Input <INPUT_NAME> has started. every time is being called.
An alert can be constructed to trigger the custom action to disable and re-enable a specific input if this string is missing from the internal logs of Splunk for a while.

Version 1.2.2

Aug. 20, 2021

Fix SIEM API decoding errors

Version 1.2.1

July 29, 2021

Correction to avoid field with the name 'source'

Version 1.2.0

July 28, 2021

Added SIEM API input.

Small bug fixes.

Version 1.1.0

July 19, 2021

1.1.0
Unofficial Splunk add on for Akamai prolexic, DNS and GTM ingestion written in Python 3.7

1,220

Downloads

Share Subscribe

Version

Built by

Riccardo Gasparini

Support

Not Supported

Questions on Splunk Answers Flag as inappropriate

App Contents: Inputs, Alert Actions

App Contents: Inputs