Skip to main content
Skip table of contents

Akamai Security Events

Vendor Documentation

Classification

Rule Name

Rule Type

Common Event

Classification

Akamai Security Events

Base Rule

General Security

Other Security

Mapping with LogRhythm Schema

Device Key in Log Message

LogRhythm Schema

Data Type

Schema Description

N/A

N/A

N/A

N/A

N/A

N/A

N/A

Device Vendor

N/A

<vendorinfo>

Text/String

Device Product

N/A

<version>

Text/String

Device Version

N/A

<vmid>

Text/String

Device Event Class ID

N/A

<subject>

Text/String

Name

N/A

<severity>

Number

Severity

act

<action>

Text/String

appliedAction

app

<protname>

Text/String

httpMessage.protocol

c6a2

N/A

N/A

IP v6 address of the source. Only populated if $attackData.clientIP is in IP v6 format.

c6a2Label

N/A

N/A

N/A

cs1

N/A

N/A

Rule IDs of rules that triggered for this request.

cs1Label

N/A

N/A

N/A

cs2

<reason>

Text/String

Messages of rules that triggered for this request

cs2Label

N/A

N/A

N/A

cs3

N/A

N/A

User data of rules that triggered for this request.

cs3Label

N/A

N/A

N/A

cs4

N/A

N/A

Selectors of rules that triggered for this request.

cs4Label

N/A

N/A

N/A

cs5

N/A

N/A

Client IP scores for Client Reputation.

cs5Label

N/A

N/A

N/A

cs6

N/A

N/A

API ID for API Protection.

cs6Label

N/A

N/A

N/A

devicePayloadId

N/A

N/A

Globally unique ID of the message.

dhost

<dname>

Text/String

Value of the HOST header of the incoming client request.

dpt

<dport>

Number

Port number used by the incoming request. Should be equal to the value of AK_IN_PORT

flexString1

N/A

N/A

ID of the Security Configuration applied to this request.

flexString1Label

N/A

N/A

N/A

flexString2

<policy>

Text/String

ID of the Firewall Policy applied to this request .

flexString2Label

N/A

N/A

N/A

out

<bytesout>

Number

Content bytes served in the client response.

request

<url>

Text/String

requestURL

requestMethod

<command>

Text/String

HTTP method of the incoming request.

src

<sip>

IP Address

IP address of the client that made the request.

start

N/A

N/A

Time, in epoch format (and to millisecond precision), when the Edge Server initiated the connection for the message exchange being monitored.

AkamaiSiemSlowPostAction

N/A

N/A

Action taken if a Slow POST attack is detected: either W for Warn or A for deny (abort).

AkamaiSiemSlowPostRate

N/A

N/A

Recorded rate of a detected Slow POST attack.

AkamaiSiemRuleVersions

N/A

N/A

Base64-encoded versions of rules that triggered for this request.

AkamaiSiemRuleTags

N/A

N/A

Base64-encoded tags of rules that triggered for this request

AkamaiSiemApiKey

N/A

N/A

API Key for API Protection.

AkamaiSiemTLSVersion

N/A

N/A

TLS version, if applicable.

AkamaiSiemRequestHeaders

N/A

N/A

All request headers collected.

AkamaiSiemResponseHeaders

N/A

N/A

All response headers collected.

AkamaiSiemResponseStatus

<responsecode>

Number

HTTP Response status sent to the client.

AkamaiSiemContinent

N/A

N/A

2-letter code for the continent that the IP address maps to.

AkamaiSiemCountry

N/A

N/A

2-letter ISO-3166 code for the country the IP address maps to.

AkamaiSiemCity

N/A

N/A

City that the IP address maps to.

AkamaiSiemRegion

N/A

N/A

2-letter ISO-3166 code for the state, province, or region the IP address maps to.

AkamaiSiemASN

N/A

N/A

Autonomous System Number (or numbers) that the IP address belongs to.

AkamaiSiemUuid

N/A

N/A

Unique identifier of the user whose risk data is being provided.

AkamaiSiemUsername

<login>

Text/String

The unencrypted username value.

AkamaiSiemOriginUserId

N/A

N/A

The unencrypted Origin User Id value.

AkamaiSiemStatus

<status>

Text/String

Status code indicating any errors that occurred when calculating the risk score. See the User Score Status section of this page for details.

AkamaiSiemScore

N/A

N/A

Calculated risk scores. Scores range from 0 (no risk) to 100 (the highest possible risk).

AkamaiSiemRisk

N/A

N/A

Indicators that increased the calculated risk score. For example, the value udfp represents the risk of the device fingerprint based on the user's behavioral profile.

AkamaiSiemTrust

N/A

N/A

Indicators that were trusted. For example, the value ugp indicates that the user’s country or area is trusted.

AkamaiSiemGeneral

N/A

N/A

Indicators of general behavior observed for relevant attributes. For example, duc_1h represents the number of users recorded on a specific device in the past hour.

AkamaiSiemAllow

N/A

N/A

Indicates whether the user is on the allow list. A 0 indicates that the user was not on the list; a 1 indicates that the user was on the list.

AkamaiAppBundleId

N/A

N/A

Unique identifier of the app bundle. An app bundle contains both the software itself and the accompanying configuration information.

AkamaiAppVersion

N/A

N/A

Version number of the app.

AkamaiTelemetryType

<object>

Number

Specifies the telemetry type in use. Allowed values are:

0 -- Web client (standard telemetry)
1 -- Web client (inline telemetry)
2 -- Native app (SDK)

AkamaiBotScore

N/A

N/A

Score assigned to the request by Botman Manager.

AkamaiResponseSegment

N/A

N/A

Numeric response segment indicator. Segments are used to group and categorize bot scores. Allowed values are:

0 -- Human
1 -- Cautious response
2 -- Strict response
3 -- Aggressive response
4 -- safeguard

AkamaiSiemCustomData

N/A

N/A

Custom base-64-encoded value. The custom data size limit is 2KB.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.