Akamai WAF
Stream Akamai Web Application Firewall security events into RAD Security via the SIEM Integration API.
This guide walks you through provisioning EdgeGrid API credentials, identifying the Akamai security configuration IDs to monitor, and configuring the integration in RAD Security so that Akamai Web Application Firewall (WAF) events flow into your workspace as security findings.
Akamai's SIEM Integration API exposes the security events generated by App & API Protector (Kona Site Defender / Web Application Protector) policies. Once configured, RAD Security polls Akamai on a schedule and ingests the events so you can correlate WAF detections with the rest of your runtime and cloud security data.
Prerequisites
Before you begin, ensure you have:
- Access to Akamai Control Center with permission to create API clients (Identity & Access role: API client manager or equivalent)
- One or more Akamai security configurations with WAF / App & API Protector policies that produce SIEM events
- Access to a RAD Security workspace with integration permissions
This integration is read-only. RAD Security calls the SIEM Integration API to fetch events; it does not modify Akamai security configurations or policies.
Step 1: Create an EdgeGrid API Client
Open Identity & Access
Sign in to Akamai Control Center and navigate to Identity & Access Management → API users (API clients for me).
Create a New API Client
- Click Create API client
- Choose Quick (single user) or Advanced (service account) depending on your policy
- Enter a name (e.g.
RAD Security - SIEM Integration) and description - Select the group / contract that owns the security configurations you want to monitor
Grant the SIEM Integration API
On the API services screen:
- Search for SIEM
- Select SIEM Integration and grant READ access
- Save the API client configuration
Without the SIEM Integration API the credentials will fail verification with a 403 Forbidden error.
Download the Credentials
Akamai displays the credentials only once when the client is created. Copy or download all four values:
- Host (e.g.
akab-xxxxxxxxxxxxxxxx.luna.akamaiapis.net) - Client Token
- Client Secret
- Access Token
Store the credentials securely. If you navigate away you will need to rotate the API client to retrieve new values.
Step 2: Identify Security Configuration IDs
The SIEM Integration API requires one or more security configuration IDs (sometimes called configIds) — these scope which WAF events are returned.
Open Application Security
In Akamai Control Center, navigate to Security → Application Security → Configurations.
Note the Config IDs
For each configuration you want RAD Security to ingest, copy its numeric Config ID from the list.
You can also retrieve the IDs programmatically via the Application Security API:
GET /appsec/v1/configs
Step 3: Configure in RAD Security
In your RAD Security workspace, add a new Akamai WAF integration with the values gathered above:
| Parameter | Description | Example |
|---|---|---|
| Host | EdgeGrid API host from the API client credentials | akab-xxxxxxxxxxxxxxxx.luna.akamaiapis.net |
| Client Token | EdgeGrid client_token | akab-... |
| Client Secret | EdgeGrid client_secret | xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx= |
| Access Token | EdgeGrid access_token | akab-... |
| Security Config IDs | Comma-separated list of security configuration IDs to poll | 12345,67890 |
The Host value is just the hostname — do not include https:// or a trailing slash. RAD Security signs each request using the EdgeGrid authentication scheme.
When you save the integration, RAD Security verifies the credentials against the SIEM Integration API and immediately schedules recurring polls.
Verify Integration
- Navigate to Data Sources → Integrations in RAD Security
- Locate your Akamai WAF integration
- Confirm the connection status shows as Connected
- After the first poll, open Security Findings and filter for the Akamai WAF source
Your Akamai WAF integration is now active. RAD Security will continue to pull new WAF events on its schedule.
What Data is Synced
Use Cases
Cross-Layer Correlation Correlate WAF detections at the edge with the runtime behavior of the backend services they protect.
Attacker Tracking Pivot from a denied WAF event to the workloads, identities, or cloud assets the same attacker may be probing.
Policy Tuning Use ingested events to identify noisy rules or repeat offenders and inform Akamai policy tuning.
Compliance Evidence Retain WAF events alongside other security telemetry in RAD Security for audit and reporting.
Troubleshooting
Security Best Practices
Dedicated API Client Create a service-account-style API client used only by RAD Security so its scope and audit history are isolated.
Least Privilege Grant only READ on SIEM Integration. Do not add unrelated Akamai APIs to the same client.
Scope to Required Groups Limit the client to the specific group / contract that owns the security configurations you intend to monitor.
Rotate Credentials Rotate the EdgeGrid credentials on a schedule that matches your security policy.
Additional Resources
SIEM Integration API
Official Akamai reference for the SIEM Integration API
EdgeGrid Authentication
Background on the EdgeGrid request-signing scheme