Akamai logs to Splunk

[splunklearner]

Anyone please help me how to get Akamai logs to Splunk. We have clustered environment with syslog server uf installed in it and forwards data to our Deployment Server initially and then it deployes to Cluster Manager and Deployer. We have 6 indexers with 2 indexers in each site (3 site multi cluster). 3 search heads one in each site. How to proceed with this?

[kiran_panchavat]

@splunklearner 

Please check the pre-requisites . https://techdocs.akamai.com/siem-integration/docs/siem-splunk-connector 

[kiran_panchavat]

@splunklearnerIf you don't have a heavy forwarder and need to install the add-on, you can install it on the search head cluster. Please refer to the documentation below for more details and installation instructions.

Install an add-on in a distributed Splunk Enterprise deployment - Splunk Documentation

To deploy an add-on to the search head cluster members, use the deployer. https://docs.splunk.com/Documentation/Splunk/9.4.1/DistSearch/PropagateSHCconfigurationchanges 

[kiran_panchavat]

@splunklearner I recommend using the add-on. Akamai SIEM Integration | Splunkbase

[kiran_panchavat]

@splunklearner   

Install the add-on on your heavy forwarder and configure it. You have two options for sending logs to Splunk:

1. Install the add-on on your heavy forwarder and use it to send logs to Splunk.
2. If Akamai supports syslog, you can send logs to your syslog forwarder, which will then forward them to Splunk. In this case, please configure syslog-ng or rsyslog to capture Akamai logs in a specific directory and create the necessary inputs to onboard the logs into Splunk.

Configure the UF on your syslog server to monitor the log files. Update the inputs.conf file to specify the log file paths and the outputs.conf file to forward the data to your indexe

Example inputs.conf:

[monitor:///var/log/akamai/*.log]
index = akamai
sourcetype = akamaisiem

[kiran_panchavat]

@splunklearner 

Please follow this SIEM Splunk connector

[splunklearner]

I am stuck at this point --

Click the Akamai Security Incident Event Manager API.

I can't find this in data inputs after installing add-on.

[kiran_panchavat]

@splunklearner 

Go to Settings > Data Inputs, where you will find the Akamai data input.

[splunklearner]

Not able to find.

[kiran_panchavat]

@splunklearner 

Please verify the prerequisites. It's a Java issue, you need to make sure Splunk can access Java.  I can see some solutions that, they are able to see the data inputs using the below steps:

Fixed the issue by adding the config in inputs.conf"[TA-Akamai_SIEM]#disable the running introspection.

run_introspection=false