Akamai Kona-Beispielereignisnachrichten

Verwenden Sie diese Beispielereignisnachrichten als Methode zur Überprüfung einer erfolgreichen Integration mit QRadar.

Die folgende Tabelle enthält eine Beispielereignisnachricht bei Verwendung des Protokolls Akamai Kona REST API für das DSM Akamai KONA :
Hinweis Jedes Ereignis kann mehrere Ereignis-IDs und Namen enthalten.
Tabelle 1. Akamai KONA -Beispielnachricht, die von Akamai Kona REST APIunterstützt wird.
Ereignisname Untergeordnete Kategorie Beispielprotokollnachricht
Die Anwendung ist nicht verfügbar-Verweigerungsregel Warnung 
{"type":"akamai_siem","format":"json","version":"1.0","attackData":{"configId":"<Config Id>","policyId":"<Policy Id>","clientIP":"192.0.2.0","rules":"970901","ruleVersions":"1","ruleMessages":"Application is not Available (HTTP 5XX)","ruleTags":"AKAMAI/BOT/UNKNOWN_BOT","ruleData":"Vector Score: 4, DENY threshold: 2, Alert Rules: 3990001:970901, Deny Rule: , Last Matched Message: Application is not Available (HTTP 5XX)","ruleSelectors":"","ruleActions":"monitor"},"httpMessage":{"requestId":"<Request Id>","start":"1517337032","protocol":"HTTP/1.1","method":"GET","host":"siem-sample.csi.edgesuite.net","port":"80","path":"path","requestHeaders":"User-Agent: curl/7.35.0Host: siem-sample.csi.edgesuite.netAccept: */*edge_maprule: ksd","status":"403","bytes":"298","responseHeaders":"Server: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 298Expires: Tue, 30 Jan 2018 18:30:32 GMTDate: Tue, 30 Jan 2018 18:30:32 GMTConnection: close"},"geo":{"continent":"<Continent>","country":"<Country>","city":"<City>","regionCode":"<Region Code>","asn":"<asn>"}}
Anomaliebewertung für abgehende Daten überschritten Suspicious Activity 
{"type":"akamai_siem","format":"json","version":"1.0","attackData":{"configId":"<Config Id>","policyId":"<Policy Id>","clientIP":"192.0.2.0","rules":"OUTBOUND-ANOMALY","ruleVersions":"4","ruleMessages":"Anomaly Score Exceeded for Outbound","ruleTags":"AKAMAI/POLICY/OUTBOUND_ANOMALY","ruleData":"curl_85D6E381D300243323148F63983BD735","ruleSelectors":"","ruleActions":"alert"},"httpMessage":{"requestId":"<Request Id>","start":"1517337032","protocol":"HTTP/1.1","method":"GET","host":"siem-sample.csi.edgesuite.net","port":"80","path":"path","requestHeaders":"User-Agent: curl/7.35.0Host: siem-sample.csi.edgesuite.netAccept: */*edge_maprule: ksd","status":"403","bytes":"298","responseHeaders":"Server: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 298Expires: Tue, 30 Jan 2018 18:30:32 GMTDate: Tue, 30 Jan 2018 18:30:32 GMTConnection: close"},"geo":{"continent":"<Continent>","country":"<Country>","city":"<City>","regionCode":"<Region Code>","asn":"<asn>"}}