Hi everyone,
I am looking for advice on the best architecture for ingesting Akamai WAF logs into Google SecOps. We are currently trying to find another way rather from using Bindplane.
We are checking with Akamai DataStream 2, but we are running into a visibility issue. The streams seem to be metrics-heavy and when we look at the WAF data, we are primarily seeing the "Rule Trigger" ( just the Rule ID and Action, e.g "securityRules": "ULnR_28976|3900000:3900001:3900005:3900006:BOT-ANOMALY-HEADER|" ).
In that case, we are missing the deeper forensic context we need for analysis, such as:
-
Payloads / Post Body details
-
The specific logic that caused the match
So I have some questions:
-
Is DataStream the wrong tool for this? Is it possible to configure DataStream 2 to include full request details, or is it strictly for high-level metrics and simple triggers?
-
SIEM Integration API: Is the "Akamai SIEM Integration" (the Pull API) considered the standard for getting the full verbose security events? If so, does anyone have a recommended way to pull these reliably without Bindplane?
-
LDS (Log Delivery Service): Is anyone using standard LDS for WAF analysis, or is the latency (non-real-time) too high for security operations?
I’m are looking for the "gold standard" to get full raw WAF logs out of Akamai without using a middle-man agent like Bindplane.
Thanks!
