Akamai SIEM connector

Class: akamai — source only. Pulls Akamai SIEM security events over EdgeGrid-signed HTTPS, streams multi-JSON (one object per line), and publishes each akamai_siem event to a stream. The trailing offset context line is not an event.

Do not configure Akamai SIEM as http. HTTP sources expect one JSON document, bearer/basic/api_key, and a static URL with no SIEM cursor.

Create and edit under Sources. There is no Akamai sink.

Source behavior

Role	Behavior
Source	EdgeGrid GET /siem/v1/configs/{configId} with opaque offset (omitted on first fetch) and limit. Streams the body; emits SIEM JSON as received onto the connector stream.
Sink	Not supported.
Streams	Size this ingest stream for fat JSON: WAL on, buffer.mode = block (or a long timeout — not shipped 50 ms timeout-drop). Align stream ids with tasks / pipelines (Streams).

Required fields

Every connector row

Field	Required	Notes
name	Yes	Display name; id derived from it.
class	Yes	Must be akamai.
stream	Yes	Resolved stream id.
type	Yes	source only.
config	Yes	Class-specific object; see below.

Class akamai — required configuration

Setting	Required	Notes
host	Yes	EdgeGrid host (.edgerc host), without scheme.
config_id	Yes	SIEM config id. Prefer one connector per id (independent cursors).
client_token	Yes	EdgeGrid client token (secret).
client_secret	Yes	EdgeGrid client secret.
access_token	Yes	EdgeGrid access token (secret).

Optional poll knobs (Core defaults): limit 2000 (max 10000), timeout_seconds 120, interval_ms 5000 (idle only — skipped between full pages), max_line_bytes 1 MiB, tls.verify_cert true.

Create connector

1. Open Sources → Create.
2. Set Class to Akamai, set name, stream behavior, and Enabled.
3. Enter host, config id, and EdgeGrid client token / client secret / access token.
4. Keep TLS verification on in production; raise limit only if you accept larger GETs (never Akamai’s 600000 cap).
5. Save, deploy to a Core, then wire the stream into tasks / pipelines.

UI field	Connector setting
Host	host
Config ID	config_id
Client token / secret / access token	client_token, client_secret, access_token

Runtime behavior

• Offset is stored after a page is published without drop. A crash before checkpoint re-fetches the same page (duplicates are expected; at-least-once).
• Full pages (total ≥ requested limit) poll immediately; short/empty pages wait interval_ms.
• HTTP 416 (offset-too-old) fails closed — the connector errors; it does not skip the gap or auto-switch to time-based from/to (not in this release).
• Prefer lag over drop. Pause fetch when downstream is slow rather than discarding SIEM events.

Performance and operational notes

• Treat EdgeGrid tokens as secrets; they are stripped on GET and encrypted at rest.
• One owner per config_id. Scale-out = more connectors on different ids, not two processes sharing one cursor.
• Throughput is bytes (large JSON), not syslog EPS. Shrink stream max_events so slots × mean event size fits RAM.

Related pages

• Sources
• HTTP connector — generic REST; not SIEM
• Architecture — Connectors
• Streams (advanced) — WAL / buffer mode for this ingest stream