topic Re: Splunk Akamai API in Security

Splunk Akamai API

RahulMisra1 — Wed, 08 May 2024 09:26:11 GMT

Hi ,

I am trying to achieve an automation whereon i will be running a query and then passing the IP's which i need to send to akamai via POST API. I know, edgegridauth library can be used to achieve the same but got stuck on how the action would be configured . Can someone help.

Re: Splunk Akamai API

deepakc — Wed, 08 May 2024 10:59:30 GMT

In Splunk you need to configure alert actions, as you can see many come out of the box for your use case, you have a few options that you can explore.

1. Use this Add-on - it may help with some config/testing so needs to be installed - https://splunkbase.splunk.com/app/5520
2. Develop your own Action - https://dev.splunk.com/enterprise/docs/devtools/customalertactions/

Re: Splunk Akamai API

RahulMisra1 — Fri, 10 May 2024 08:53:18 GMT

Thanks! This help me to move forward, just one thing if you can help. I have all done all, just not sure on what should i be putting on html (https://dev.splunk.com/enterprise/docs/devtools/customalertactions/createuicaa/) so that i can pass the IP to Akamai API.

Re: Splunk Akamai API

deepakc — Fri, 10 May 2024 14:22:17 GMT

Have a look at this example it may help, other than that work through the documentation

splunk-app-examples/custom_alert_actions/slack_alerts/default/data/ui/alerts/slack.html at master · splunk/splunk-app-examples · GitHub

Re: Splunk Akamai API

RahulMisra1 — Fri, 10 May 2024 15:46:17 GMT

I had a look at that one but i am not really an expert so couldn’t get much idea there.

Like Where would be my api credentials reaide and how do i call the api from custom alert action?

Re: Splunk Akamai API

deepakc — Fri, 10 May 2024 16:10:52 GMT

As your not an expert then it might be better for you to explore Splunks Add-on builder which will have options to create what you need and with credentials, have a look at the below as it may help.

https://docs.splunk.com/Documentation/AddonBuilder/4.2.0/UserGuide/CreateAlertActions

https://docs.splunk.com/Documentation/AddonBuilder/4.2.0/UserGuide/ConfigureDataCollection