Log Overview

ULS supports ingestion of different log streams into SIEM.

To get the highest value out of the ingested data, it is crucial to understand the delivered data.

Here are some examples (per product) and links to additional information.

Enterprise Application Access (EAA)

When configuring ULS to access EAA these feed, set input argument/variable to EAA and feed as indicated below in parathesis.

Access Logs (ACCESS)

Additional information regarding the log fields can be found on here

EAA access logs example (JSON)

{
    "username": "user1",
    "apphost": "vault.akamaidemo.net",
    "http_method": "GET",
    "url_path": "/v1/sys/health?standbycode=200&sealedcode=200&uninitcode=200&drsecondarycode=200&performancestandbycode=200",
    "http_ver": "HTTP/1.1",
    "referer": "https://vault.akamaidemo.net/ui/vault/secrets",
    "status_code": 200,
    "idpinfo": "SENTRY|V",
    "clientip": "84.189.50.66",
    "http_verb2": "GET",
    "total_resp_time": 0.011,
    "connector_resp_time": 0.011,
    "datetime": "2021-07-27T18:20:14+00:00",
    "origin_resp_time": 0.005,
    "origin_host": "10.11.52.131:8200",
    "req_size": 515,
    "content_type": "application/json",
    "user_agent": "Chrome-91-0",
    "device_os": "Mac-OS-X-10-15",
    "device_type": "Other",
    "geo_city": "Kummersbruck",
    "geo_state": "Bavaria",
    "geo_statecode": "BY",
    "geo_countrycode": "DE",
    "geo_country": "Germany",
    "internal_host": "-",
    "session_info": "cookie-valid",
    "groups": "-",
    "session_id": "1b1c728b-298e-4ebd-ce7c-0c1f99ad943f"
}

Admin Logs (ADMIN)

Additional information regarding the log fields can be found on here.

EAA admin logs example (JSON)

{
    "datetime": "2021-07-23T05:54:40",
    "username": "system",
    "resource_type": "connectors",
    "resource": "tmelab-bos",
    "event": "unreachable",
    "event_type": "system"
}

Connector Health (CONHEALTH)

Additional information regarding the log fields can be found on here

EAA connector health example (JSON)

{
    "connector_uuid": "cht3_GEjQWyMW9LEk7KQfg",
    "name": "demo-v2-con-1-amer",
    "reachable": 1,
    "status": 1,
    "version": "21.01.0-152",
    "privateip": "10.1.4.206",
    "publicip": "123.123.123.123",
    "debugchan": "Y",
    "datetime": "2021-07-23T18:06:35.676Z",
    "ts": "2021-07-23T18:06:35.676Z",
    "cpu": 1.3,
    "disk": 34.4,
    "mem": 32.4,
    "network": 0.06,
    "dialout_total": 1304,
    "dialout_idle": 1302,
    "dialout_active": 1
}

Device Posture Inventory (DEVINV)

When enabled, EAA can provide a full view on the device running EAA Client. A report is available in Akamai Control Center and can also be extracted using API. This feed uses the Device Posture Inventory in EAA API.

Each event will be one device as a JSON document, example provided with the cli-eaa command akamai eaa dp inventory|head -n1|jq .

View device inventory event example (JSON)

{
    "device_id": "5c98021e78e9c393b07145e388c20ace7733ca88ed63ba0790c09e7ed5c58cf7",
    "device_name": "sfo-mpw9c",
    "risk_posture_tiers": [
        {
        "passed": true,
        "name": "Low",
        "id": 13,
        "tier": true
        }
    ],
    "risk_posture_tags": [
        {
        "passed": true,
        "name": "Healthy iOS",
        "id": 597,
        "tier": false
        },
        {
        "passed": true,
        "name": "latest-of-latest",
        "id": 949,
        "tier": false
        },
        {
        "passed": true,
        "name": "ETP-Healthy-NotCompromised",
        "id": 1831,
        "tier": false
        },
        {
        "passed": false,
        "remediations": [
            "Unsupported operating system."
        ],
        "name": "Demo Tag - CB",
        "id": 2380,
        "tier": false
        },
        {
        "passed": false,
        "remediations": [
            "Unsupported operating system."
        ],
        "name": "Demo - Tag - Anti malware",
        "id": 2381,
        "tier": false
        },
        {
        "passed": true,
        "name": "Device - Not Compromised",
        "id": 2392,
        "tier": false
        },
        {
        "passed": true,
        "name": "Forrester Demo -",
        "id": 2402,
        "tier": false
        },
        {
        "passed": true,
        "name": "Demo - Anti Malware",
        "id": 2407,
        "tier": false
        },
        {
        "passed": true,
        "name": "Demo Tag",
        "id": 2408,
        "tier": false
        }
    ],
    "client_version": "2.7.1",
    "idp_username": "N/A",
    "user_id": "androcho",
    "browsers": [
        {
        "name": "Edge",
        "version": "101.0.1210.47"
        },
        {
        "name": "Chrome",
        "version": "101.0.4951.64"
        },
        {
        "name": "Safari",
        "version": "15.4"
        },
        {
        "name": "Firefox",
        "version": "100.0"
        }
],
"os_name": "macOS",
"os_version": "Monterey 12.3.1 (21E258)",
"signal_timestamp": "2022-05-16T20:21:33.321539+00:00",
"os_update_timestamp": "2022-04-15T20:18:43Z",
"os_auto_update": true,
"anti_malware_running": [
    "Sentinel Agent"
],
"anti_malware_status": [
    {
    "name": "Any Vendor",
    "passed": true
    }
],
"anti_malware_info": [
    {
    "name": "Sentinel Agent",
    "passed": true
    }
],
"firewall_status": "good",
"system_disk_encryption": true,
"etp_client_status": "installed",
"mobile_device": false,
"certificate_profile": [
    {
    "name": "cert",
    "passed": false
    }
],
"etp_signals": {
    "threat_detected": false
}
}

Directory Health (DIRHEALTH)

Each event will be one directory as a JSON document.
Examples provided can be obtained using cli-eaa command akamai eaa dir list --json|jq .
Schema is documented on the EAA Directory List API doc.

View directory health event example (JSON)

{
    "dir_id": "dir://49L59MSsQcyeaRz6N8iKmA",
    "service": "ActiveDirectory",
    "name": "gc-eaa-forrestor-ActiveDirectory",
    "datetime": "2023-10-06T22:02:00.112396+00:00",
    "status": 1,
    "connector_count": 1,
    "directory_status": "ok",
    "group_count": 3,
    "user_count": 8,
    "last_sync": "2023-10-06T15:55:31.026068",
    "sync_state": "Dirty",
    "conf_state": 1
}

Secure Internet Access Enterprise (SIA-E)

Formerly known as Enterprise Threat Protector (ETP).

For large volume of security events (multiple 100K per hour), configure the underlying cli-etp to issue concurrent API requests.

Depending on your ULS setup you need to pass the CLIETP_FETCH_CONCURRENT environment variable. We recommend to start with the value 2, observe, and increase up to 8 if you observe backlog.

This will have a small impact on CPU usage, while increasing the number of events.