Akamai Unified Log Streamer (ULS)

Introduction

The Unified Log Streamer (ULS) is designed to simplify SIEM integrations for Akamai Secure Enterprise Access Products

• Enterprise Application Access (EAA)
• Secure Internet Access Enterprise (SIA)
• Akamai MFA (MFA)
• Guardicore Micro Segmentation

Thanks to its modular design, ULS allows the connection of many SIEM solutions out-of-the-box.
ULS can send data into any SIEM that supports either file, TCP, UDP or HTTP ingestion.

ULS can be run directly as Python code, as a Docker container, through docker compose scripts or through helm within kubernetes.
Running ULS on Windows (python) is also supported (but not extensively tested, yet).

Table of contents

• Akamai Unified Log Streamer (ULS)
  • Introduction
  • Key Features
  • Documentation
    • Generic Requirements
    • Command Line Usage
    • Docker
    • Docker-compose
    • Kubernetes
  • Development
  • Changelog
  • Support
  • LINKS / REFERENCES

Key Features

• Supported Inputs

  • Enterprise Application Access (EAA)
    • ACCESS
    • ADMIN
    • CONHEALTH
    • DEVINV
    • DIRHEALTH
  • Secure Internet Access Enterprise (SIA) (formerly Enterprise Threat Protector)
    • THREAT
    • AUP
    • DNS
    • PROXY
    • NETCON
  • Akamai Phish-proof Multi Factor Authenticator (AKAMAI-MFA)
    • EVENT
  • Akamai Guardicore Segmentation (beta)
    • NETLOG
    • INCIDENT
    • AGENT
    • SYSTEM
    • AUDIT
  • Linode (experimental)
    • AUDIT
  • Akamai Control Center (experimental)
    • EVENTS

• Supported data outputs

  • TCP Socket (tcp://host:port) --output tcp
  • UDP Socket (udp://host:port) --output udp
  • HTTP and HTTPS URL (http(s)://host:port/path) (supporting Authentication) --output http
  • RAW (>STDOUT) --output raw
  • FILE (writes log to a file on the local filesystem and rotates them) --output file
    The full output documentation can be found here.

• Operation types

  • python (command line)
  • docker
  • docker-compose
  • kubernetes / k8s

• Additional Features

  • Monitoring output
  • Debug information (log level adjustment)
  • HTTP CA CERT verification skipping
  • Adoptable HTTP - POST format
  • Output filter (to reduce number of log lines sent to SIEM)
  • Output transformation (to produce other log formats i.e. for 3rd party integrations)
  • Auto - Resume
  • File - Post Processing

Documentation

ULS can be operated in many ways.
Before setting up ULS, please understand your SIEM ingestion capabilities and configure an ingest method on your SIEM.
ULS is designed as an abstraction layer to easily ship log data to most SIEMs on the market. It does not create any dashboards / data extractions.
Anyway, details for some specific SIEM solutions can be found in this directory and in your SIEM documentation.

Generic Requirements

• Python 3.9+ OR docker / docker-compose OR kubernetes / helm
• AKAMAI .edgerc file (see further documentation here)
• Outbound Internet access (Akamai API, Dockerhub OR Python repositories)
• Compute resource footprint is minimal: 1 vCPU, 1 GB RAM, 500 MB free disk. See also High availability doc.
• NTP synchronized time on the OS ULS will be executed.

Command Line Usage

Example commands:

# ETP - THREAT to console
python3.9 bin/uls.py --input etp --feed threat --output raw

# EAA - ACCESS to TCP
python3.9  bin/uls.py --input eaa --feed access --output tcp --host 10.99.10.99 --port 8081

For more information, please visit this document

Docker

For more information, please visit this document

Docker-compose

For more information, please visit this document

Kubernetes

For more information, please visit this document

Development

For the latest stable version of this software, please check the release section of the repo. The main branch will retain the stable versions. To ensure a continuous development of this tool, all new updates will first go into the development branch of this repo.
The development branch can be subject to change and could also represent a broken version of this software. In parallel, all new versions within the "main" branch will also be available on the ULS docker hub space.

Contributions to this software can be provided via Pull Requests and will get merged after successful review.

Changelog

Find a full Changelog of all added Features and fixed Bugs here:
ULS - Changelog

Support

Akamai ULS is provided "as-is". It is not supported by Akamai Support. Akamai is neither liable for the function nor for any caused problems that come along with the usage or caused by this tool. Please refer to the LICENSE document for more information.

To report an issue, feature request or bug, please open a new issue into the GitHub Issues page. This software is released under the "Apache License". Please read the frequently asked questions and visit the troubleshooting and debugging instructions before opening a ticket.

Pull requests to improve the code or enhance the functionality are welcome.

LINKS / REFERENCES

The ULS Project on GitHub
The ULS Project on Dockerhub