Mensajes de sucesos de ejemplo de Akamai Kona

Utilice estos mensajes de suceso de ejemplo como una forma de verificar una integración satisfactoria con QRadar.

La tabla siguiente proporciona un mensaje de suceso de ejemplo cuando se utiliza el protocolo API REST de Akamai Kona para el DSM Akamai KONA :
Nota: Cada suceso puede contener varios ID de suceso y nombres.
Tabla 1. Mensaje de ejemplo Akamai KONA soportado por la API REST de Akamai Kona.
Nombre de suceso Categoría de bajo nivel Mensaje de registro de ejemplo
La aplicación no está disponible-Denegar regla Aviso 
{"type":"akamai_siem","format":"json","version":"1.0","attackData":{"configId":"<Config Id>","policyId":"<Policy Id>","clientIP":"192.0.2.0","rules":"970901","ruleVersions":"1","ruleMessages":"Application is not Available (HTTP 5XX)","ruleTags":"AKAMAI/BOT/UNKNOWN_BOT","ruleData":"Vector Score: 4, DENY threshold: 2, Alert Rules: 3990001:970901, Deny Rule: , Last Matched Message: Application is not Available (HTTP 5XX)","ruleSelectors":"","ruleActions":"monitor"},"httpMessage":{"requestId":"<Request Id>","start":"1517337032","protocol":"HTTP/1.1","method":"GET","host":"siem-sample.csi.edgesuite.net","port":"80","path":"path","requestHeaders":"User-Agent: curl/7.35.0Host: siem-sample.csi.edgesuite.netAccept: */*edge_maprule: ksd","status":"403","bytes":"298","responseHeaders":"Server: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 298Expires: Tue, 30 Jan 2018 18:30:32 GMTDate: Tue, 30 Jan 2018 18:30:32 GMTConnection: close"},"geo":{"continent":"<Continent>","country":"<Country>","city":"<City>","regionCode":"<Region Code>","asn":"<asn>"}}
Se ha superado la puntuación de anomalía para salida Actividad sospechosa 
{"type":"akamai_siem","format":"json","version":"1.0","attackData":{"configId":"<Config Id>","policyId":"<Policy Id>","clientIP":"192.0.2.0","rules":"OUTBOUND-ANOMALY","ruleVersions":"4","ruleMessages":"Anomaly Score Exceeded for Outbound","ruleTags":"AKAMAI/POLICY/OUTBOUND_ANOMALY","ruleData":"curl_85D6E381D300243323148F63983BD735","ruleSelectors":"","ruleActions":"alert"},"httpMessage":{"requestId":"<Request Id>","start":"1517337032","protocol":"HTTP/1.1","method":"GET","host":"siem-sample.csi.edgesuite.net","port":"80","path":"path","requestHeaders":"User-Agent: curl/7.35.0Host: siem-sample.csi.edgesuite.netAccept: */*edge_maprule: ksd","status":"403","bytes":"298","responseHeaders":"Server: AkamaiGHostMime-Version: 1.0Content-Type: text/htmlContent-Length: 298Expires: Tue, 30 Jan 2018 18:30:32 GMTDate: Tue, 30 Jan 2018 18:30:32 GMTConnection: close"},"geo":{"continent":"<Continent>","country":"<Country>","city":"<City>","regionCode":"<Region Code>","asn":"<asn>"}}