diff --git a/README.md b/README.md index f191662..cfe15e1 100644 --- a/README.md +++ b/README.md @@ -38,16 +38,18 @@ It can be run directly as Python code, as a provided Docker container or through - [Enterprise Threat Protectors (ETP)](https://www.akamai.com/us/en/products/security/enterprise-threat-protector.jsp) - [THREAT](docs/LOG_OVERVIEW.md#threat-log-threat) - [AUP](docs/LOG_OVERVIEW.md#accceptable-use-policy-logs-aup) + - [DNS](docs/LOG_OVERVIEW.md#dns) + - [PROXY](docs/LOG_OVERVIEW.md#proxy) - [Akamai Phish-proof Multi Factor Authenticator (AKAMAI-MFA)](https://www.akamai.com/us/en/products/security/akamai-mfa.jsp) - [AUTH](docs/LOG_OVERVIEW.md#authentication-logs-auth) - [POLICY](docs/LOG_OVERVIEW.md#policy-logs-policy) - Supported data outputs - - TCP Socket (tcp://host:port) - - UDP Socket (udp://host:port) - - HTTP(S) URL (http(s)://host:port/path) (supporting Authentication) - - RAW (>STDOUT) + - TCP Socket (tcp://host:port) `--output tcp` + - UDP Socket (udp://host:port) `--output udp` + - HTTP(S) URL (http(s)://host:port/path) (supporting Authentication) `--output http` + - RAW (>STDOUT) `--output raw` - Operation types diff --git a/bin/config/global_config.py b/bin/config/global_config.py index 50835f8..0d9bd5b 100644 --- a/bin/config/global_config.py +++ b/bin/config/global_config.py @@ -1,7 +1,7 @@ #!/usr/bin/env python3 # Common global variables / constants -__version__ = "0.9.0" +__version__ = "1.1.0" __tool_name_long__ = "Akamai Unified Log Streamer" __tool_name_short__ = "ULS" @@ -17,9 +17,13 @@ bin_eaa_cli = "ext/cli-eaa/bin/akamai-eaa" # Available EAA CLI feeds eaa_cli_feeds = ['ACCESS', 'ADMIN', 'CONHEALTH'] + # ETP -bin_etp_cli = "ext/cli-etp/bin/akamai-etp" # Path to the ETP CLI Executable -etp_cli_feeds = ['THREAT', 'AUP'] # Available ETP CLI feeds + # Path to the ETP CLI Executable +bin_etp_cli = "ext/cli-etp/bin/akamai-etp" + # Available ETP CLI feeds +etp_cli_feeds = ['THREAT', 'AUP', 'DNS', 'PROXY'] + # MFA bin_mfa_cli = "ext/cli-mfa/bin/akamai-mfa" # Path to the MFA CLI Executable mfa_cli_feeds = ['POLICY', 'AUTH'] # Available MFA CLI feeds diff --git a/bin/modules/UlsArgsParser.py b/bin/modules/UlsArgsParser.py index 003102b..8166093 100644 --- a/bin/modules/UlsArgsParser.py +++ b/bin/modules/UlsArgsParser.py @@ -70,7 +70,9 @@ def init(): dest='inproxy', type=str, default=(os.environ.get('ULS_INPUT_PROXY') or None), - help="Use a proxy Server for the INPUT requests (fetching data from AKAMAI API'S)") + help=argparse.SUPPRESS) + # We're surpressing this for now, as the param does not seem to work (mschiess-20210818 - see EME-498) + #help="Use a proxy Server for the INPUT requests (fetching data from AKAMAI API'S)") # RAWCMD input_group.add_argument('--rawcmd', action='store', diff --git a/bin/modules/UlsInputCli.py b/bin/modules/UlsInputCli.py index b7aedd9..6d7e5f1 100644 --- a/bin/modules/UlsInputCli.py +++ b/bin/modules/UlsInputCli.py @@ -43,10 +43,10 @@ def _feed_selector(self, feed, product_feeds): if feed in product_feeds: # feed matches the given list aka_log.log.debug(f'{self.name} - selected feed: {feed}') - elif not feed: + elif not feed or feed == "DEFAULT": # Set default (first of feeds) feed = product_feeds[0] - aka_log.log.debug(f'{self.name} - using default feed: {feed}') + aka_log.log.warning(f'{self.name} - using default feed: {feed}') else: aka_log.log.critical( f"{self.name} - Feed ({feed}) not available - Available: {product_feeds}") diff --git a/bin/modules/UlsOutput.py b/bin/modules/UlsOutput.py index 4054866..33eacb8 100644 --- a/bin/modules/UlsOutput.py +++ b/bin/modules/UlsOutput.py @@ -135,7 +135,7 @@ def connect(self, output_type: str, host: str, port: int, f'Use --httpurl instead of --host / --port') sys.exit(1) else: - aka_log.log.debug(f"{self.name} attempting to connect via HTTP to {http_url} ") + aka_log.log.debug(f"{self.name} attempting to connect via HTTP(S) to {http_url} ") # Let'S do an options request self.http_url = http_url diff --git a/bin/modules/UlsTools.py b/bin/modules/UlsTools.py index 7f2cf3b..a8a57cc 100644 --- a/bin/modules/UlsTools.py +++ b/bin/modules/UlsTools.py @@ -112,3 +112,17 @@ def uls_check_edgerc(configfile, configsection, configvalues): else: aka_log.log.debug(f"Required configuration value '{configvalue}' found.") return 0 + + +def uls_check_args(input, output): + missing = None + if not input: + missing = "INPUT" + elif not output: + missing = "OUTPUT" + if missing: + aka_log.log.critical(f"Required argument / ENV var not set: {missing}") + aka_log.log.critical(f"Please run `bin/uls.py --help` for additional information") + sys.exit(1) + else: + return 0 \ No newline at end of file diff --git a/bin/uls.py b/bin/uls.py old mode 100644 new mode 100755 index 1a413d7..85ffca4 --- a/bin/uls.py +++ b/bin/uls.py @@ -62,6 +62,9 @@ def main(): # Load the LOG system aka_log.init(uls_args.loglevel, uls_config.__tool_name_short__) + # Verify the given core params (at least input and output should be set) + UlsTools.uls_check_args(uls_args.input, uls_args.output) + # Check CLI Environment UlsTools.uls_check_sys() diff --git a/docs/AKAMAI_API_CREDENTIALS.md b/docs/AKAMAI_API_CREDENTIALS.md index 357a68b..b4c5ee7 100644 --- a/docs/AKAMAI_API_CREDENTIALS.md +++ b/docs/AKAMAI_API_CREDENTIALS.md @@ -27,6 +27,8 @@ This document describes how to create Akamai API credentials and configure them |Enterprise Application Access|EAA|HEALTH|[{OPEN} API / Enterprise Application Access](#eaa-open-api-for-connector-health-feed)| |Enterprise Threat Protector|ETP|THREAT|[{OPEN} API / ETP Report](#etp-open-api-reporting)| |Enterprise Threat Protector|ETP|AUP|[{OPEN} API / ETP Report](#etp-open-api-reporting)| +|Enterprise Threat Protector|ETP|DNS|[{OPEN} API / ETP Report](#etp-open-api-reporting)| +|Enterprise Threat Protector|ETP|PROXY|[{OPEN} API / ETP Report](#etp-open-api-reporting)| |Akamai MFA|MFA|AUTH|[MFA Integration](#mfa-integration-for-logging)| |Akamai MFA|MFA|POLICY|[MFA Integration](#mfa-integration-for-logging)| diff --git a/docs/ARGUMENTS_ENV_VARS.md b/docs/ARGUMENTS_ENV_VARS.md index 9806c4b..52f3aea 100644 --- a/docs/ARGUMENTS_ENV_VARS.md +++ b/docs/ARGUMENTS_ENV_VARS.md @@ -14,9 +14,9 @@ The following tables list all available command line parameters and their corres |Parameter|Env - Var|Options|Default|Description| |---|---|---|---|---| |-i
--input | ULS_INPUT | 'EAA', 'ETP', 'MFA' | None | Specify the desired INPUT source | -|--feed | ULS_FEED | EAA: 'ACCESS', 'ADMIN', 'CONHEALTH'
ETP: 'THREAT', 'AUP'
MFA: 'AUTH','POLICY' | None | Specify the desired INPUT feed | +|--feed | ULS_FEED | EAA: 'ACCESS', 'ADMIN', 'CONHEALTH'
ETP: 'THREAT', 'AUP', 'DNS', 'PROXY'
MFA: 'AUTH','POLICY' | None | Specify the desired INPUT feed | |--format | ULS_FORMAT | 'JSON', 'TEXT' | JSON | Specify the desired INPUT (=OUTPUT) format | -|--inproxy
--inputproxy | ULS_INPUT_PROXY | HOST:PORT| None | Adjust proxy usage for INPUT data collection (cli) | +|--inproxy
--inputproxy | ULS_INPUT_PROXY | HOST:PORT| None | Adjust proxy usage for INPUT data collection (cli)
There is a known issue in the usage, [please read more about it here](./FAQ.md#--inputproxy-proxy-does-not-work-as-expected)| |--rawcmd | ULS_RAWCMD | \ | None | USE with caution /!\
This is meant only to be used when told by AKAMAI [Click here for more information](ADDITIONAL_FEATURES.md#rawcmd---rawcmd-feature)| |--edgerc | ULS_EDGERC | /path/to/your/.edgerc | '~/.edgerc' | Specify the location of the .edgerc EDGE GRID AUTH file | |--section | ULS_SECTION | edgerc_config_section | 'default' | Specify the desired section within the .edgerc file | diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md index 74db884..6ab9bdf 100644 --- a/docs/CHANGELOG.md +++ b/docs/CHANGELOG.md @@ -1,5 +1,22 @@ # Version History +## v1.1.0 +||| +|---|---| +|Date|2021-08-18 +|Kind|Bugfix / Feature +|Author|mschiess@akamai.com +- Features + - Added **DNS** and **PROXY** feeds to ETP Input (<3 Sara) +- Minor improvements + - Version number fix (Stated 0.9.0 instead of 1.x.x) + - debug "message" fix ( changed HTTP to HTTP(S) to avoid misunderstanding) + - documented workaround for discovered proxy issue + - enabled json highlighting in [Log_overview](./LOG_OVERVIEW.md) + - added better error guidance when basic stuff is unset (input / output) + - moved docker-compose from root dir to /docs + - added `read_only: true` to the docker-compose.yml files (security enhancement) + ## v1.0.0 ||| |---|---| diff --git a/docs/DOCKER-COMPOSE_USAGE.md b/docs/DOCKER-COMPOSE_USAGE.md index 27e0b9f..1f3a7a6 100644 --- a/docs/DOCKER-COMPOSE_USAGE.md +++ b/docs/DOCKER-COMPOSE_USAGE.md @@ -52,8 +52,8 @@ docker compose up -d This will run the "simple" use case in foreground. The `docker-compose.yml` file will reference the `etp-threat.env` and provide the configuration from that file. **Files:** - - [docker-compose.yml](../docker-compose/simple/docker-compose.yml) - - [etp-threat.env](../docker-compose/simple/etp-threat.env) + - [docker-compose.yml](docker-compose/simple/docker-compose.yml) + - [etp-threat.env](docker-compose/simple/etp-threat.env) - Complex docker-compose setup delivering different streams to different endpoints @@ -63,7 +63,7 @@ docker compose up -d ``` This triggers a more complex setup consisting out of 3 different data feeds. **Files:** - - [docker-compose.yml](../docker-compose/complex/docker-compose.yml) - - [etp-threat.env](../docker-compose/complex/etp-threat.env) - - [eaa-admin.env](../docker-compose/complex/eaa-access.env) - - [eaa-access.env](../docker-compose/complex/eaa-access.env) \ No newline at end of file + - [docker-compose.yml](docker-compose/complex/docker-compose.yml) + - [etp-threat.env](docker-compose/complex/etp-threat.env) + - [eaa-admin.env](docker-compose/complex/eaa-access.env) + - [eaa-access.env](docker-compose/complex/eaa-access.env) \ No newline at end of file diff --git a/docs/FAQ.md b/docs/FAQ.md index 531ffc6..c4cc722 100644 --- a/docs/FAQ.md +++ b/docs/FAQ.md @@ -7,6 +7,7 @@ - [What command line Options are available ? ](#what-command-line-options-are-available-) - [What environmental variables (ENV VARS) are available](#what-environmental-variables-env-vars-are-available-#) - [--version does not show all versions](#ulspy---version-does-not-show-all-versions) +- [--inputproxy does not work as expected](#--inputproxy-proxy-does-not-work-as-expected) ---- ## FAQ @@ -38,11 +39,22 @@ There is a dedicated document explaining the [command line parameters and enviro There is a dedicated document explaining the [command line parameters and environment variables.](ARGUMENTS_ENV_VARS.md) --- -<<<<<<< HEAD ### `uls.py --version` does not show all versions This is (sadly) a known issue. It is a problem within some of the CLI's if no ".edgerc" file is provided. If you provide a `.edgerc`, the show is correct. --- -======= ->>>>>>> 2d20b502da2fcc131088bf0498ddcf56a12d531d +### `--inputproxy ` does not work as expected +This is (sadly) a known issue. +The good news is we do have a proper workaround for this. +Instead of setting the Option `--inputproxy ` or the ENV var `ULS_INPUT_PROXY` do the following: + +Set the ENV following ENV vars to your environment / container. +```text +HTTP_PROXY=http://your.proxy.internal:3128" +HTTPS_PROXY=http://your.proxy.internal:3128" +NO_PROXY="localhost,127.0.0.1,::1" +``` +Those can also be added to the .evn file when using docker / docker-compose. +**Please ensure, you are ADDING YOUR SIEM HOST IP to the NO_PROXY line when the SIEM is internal to avoid issues** +`NO_PROXY="localhost,127.0.0.1,::1,my_siem.host"` \ No newline at end of file diff --git a/docs/LOG_OVERVIEW.md b/docs/LOG_OVERVIEW.md index 0c33c6b..44f5c96 100644 --- a/docs/LOG_OVERVIEW.md +++ b/docs/LOG_OVERVIEW.md @@ -17,7 +17,7 @@ Here are some examples (per product) and links to additional information. ## Enterprise Application Access ### Access Logs (ACCESS) Additional information regarding the log fields can be found on [here](https://learn.akamai.com/en-us/webhelp/enterprise-application-access/eaa-logs-from-eaa-api-and-splunk/GUID-8F07B320-2DD7-4035-9A8E-4E7435DFA3EA.html) -```text +```json { "username": "user1", "apphost": "vault.akamaidemo.net", @@ -53,7 +53,7 @@ Additional information regarding the log fields can be found on [here](https://l ### Admin Logs (ADMIN) Additional information regarding the log fields can be found on [here](https://learn.akamai.com/en-us/webhelp/enterprise-application-access/eaa-logs-from-eaa-api-and-splunk/GUID-F772F01C-46D1-411C-A41F-D4B780D998FB.html). -```text +```json { "datetime": "2021-07-23T05:54:40", "username": "system", @@ -66,7 +66,7 @@ Additional information regarding the log fields can be found on [here](https://l ### Connector Health (CONHEALTH) Additional information regarding the log fields can be found on [here](https://learn.akamai.com/en-us/webhelp/enterprise-application-access/eaa-logs-from-eaa-api-and-splunk/GUID-A79FBF43-DE2C-405A-8900-0D77DC8CEAF4.html) -```text +```json { "connector_uuid": "cht3_GEjQWyMW9LEk7KQfg", "name": "demo-v2-con-1-amer", @@ -90,7 +90,7 @@ Additional information regarding the log fields can be found on [here](https://l ## Enterprise Threat Protector (ETP) ### Threat Log (THREAT) Additional information regarding the log fields can be found on [here](https://developer.akamai.com/api/enterprise_security/enterprise_threat_protector_reporting/v3.html#threatevent) -```text +```json { "pageInfo": { "totalRecords": 97913, @@ -481,7 +481,7 @@ Additional information regarding the log fields can be found on [here](https://d ### Accceptable Use Policy Logs (AUP) Additional information regarding the log fields can be found on [here](https://developer.akamai.com/api/enterprise_security/enterprise_threat_protector_reporting/v3.html#event) -```text +```json { "pageInfo": { "totalRecords": 97913, @@ -870,17 +870,1097 @@ Additional information regarding the log fields can be found on [here](https://d } ``` +### DNS +Additional information regarding the log fields can be found on [here](https://developer.akamai.com/api/enterprise_security/enterprise_threat_protector_reporting/v3.html#dnsactivityevent) +```json +{ + "pageInfo": { + "totalRecords": 685134, + "pageNumber": 1, + "pageSize": 5 + }, + "dataRows": [ + { + "id": "0", + "configId": "1041", + "hitCount": 1, + "alexaRanking": -1, + "query": { + "time": "2020-05-26T06:00:00Z", + "clientIp": "198.18.179.121", + "dnsIp": "198.18.193.241", + "domain": "1590448430.akamaietpmalwaretest.com.", + "queryType": "A", + "deviceId": "N/A", + "deviceName": "Not Available", + "resolved": [ + { + "type": "A", + "response": "34.193.182.244", + "asn": "14618", + "asname": "aws" + } + ] + }, + "event": { + "trigger": "null", + "siteId": "-1", + "siteName": "Unidentified IPs", + "policyId": "2240", + "policyName": "Default", + "confidenceName": "Unknown", + "actionId": "1", + "actionName": "Monitor", + "onRamp": "No", + "onrampType": "", + "internalClientIP": "N/A", + "clientRequestId": "", + "policyEvaluationSource": "dns", + "deepScanned": false + } + }, + { + "id": "1", + "configId": "1041", + "hitCount": 1, + "alexaRanking": 1000, + "query": { + "time": "2020-05-26T06:00:00Z", + "clientIp": "172.25.174.232", + "dnsIp": "198.18.193.241", + "domain": "spocs.getpocket.com.", + "queryType": "A", + "deviceId": "c37a4c4e-a7cd-400f-820d-b82762c52975", + "deviceName": "BOS-WPX5E", + "resolved": [ + { + "type": "A", + "response": "50.16.145.165", + "asn": "14618", + "asname": "aws" + }, + { + "type": "A", + "response": "35.169.67.87", + "asn": "14618", + "asname": "aws" + }, + { + "type": "A", + "response": "52.202.154.119", + "asn": "14618", + "asname": "aws" + }, + { + "type": "A", + "response": "52.204.41.228", + "asn": "14618", + "asname": "aws" + } + ] + }, + "event": { + "trigger": "null", + "siteId": "51284", + "siteName": "E2E WIN 174.232 site", + "policyId": "38307", + "policyName": "E2E-CML-test", + "confidenceName": "Unknown", + "actionId": "6", + "actionName": "Classify", + "onRamp": "Yes", + "onrampType": "etp-client", + "internalClientIP": "N/A", + "clientRequestId": "00019313", + "policyEvaluationSource": "dns", + "deepScanned": false + } + }, + { + "id": "2", + "configId": "1041", + "hitCount": 1, + "alexaRanking": 1000000, + "query": { + "time": "2020-05-26T06:00:00Z", + "clientIp": "172.25.162.210", + "dnsIp": "198.18.193.241", + "domain": "cme-linuscmewlhrwlhr-013-wlhr-public.wbx2.com.", + "queryType": "A", + "deviceId": "dc475a9e-c192-4b0b-a34e-a95c0f8dfcad", + "deviceName": "WIN81-ENT-210", + "resolved": [ + { + "type": "A", + "response": "62.109.242.31", + "asn": "13445", + "asname": "N/A" + } + ] + }, + "event": { + "trigger": "null", + "siteId": "5003", + "siteName": "Off Network ETP Clients", + "policyId": "32965", + "policyName": "Westford OFF Network policy", + "confidenceName": "Unknown", + "actionId": "10", + "actionName": "Bypass", + "onRamp": "No", + "onrampType": "", + "internalClientIP": "N/A", + "clientRequestId": "00019274", + "policyEvaluationSource": "dns", + "deepScanned": false + } + }, + { + "id": "3", + "configId": "1041", + "hitCount": 1, + "alexaRanking": -1, + "query": { + "time": "2020-05-26T06:00:00Z", + "clientIp": "198.18.179.121", + "dnsIp": "198.18.193.241", + "domain": "1590447770.akamaietpmalwaretest.com.", + "queryType": "A", + "deviceId": "N/A", + "deviceName": "Not Available", + "resolved": [ + { + "type": "A", + "response": "34.193.182.244", + "asn": "14618", + "asname": "aws" + } + ] + }, + "event": { + "trigger": "null", + "siteId": "-1", + "siteName": "Unidentified IPs", + "policyId": "2240", + "policyName": "Default", + "confidenceName": "Unknown", + "actionId": "1", + "actionName": "Monitor", + "onRamp": "No", + "onrampType": "", + "internalClientIP": "N/A", + "clientRequestId": "", + "policyEvaluationSource": "dns", + "deepScanned": false + } + }, + { + "id": "4", + "configId": "1041", + "hitCount": 1, + "alexaRanking": 1000000, + "query": { + "time": "2020-05-26T06:00:00Z", + "clientIp": "198.18.179.159", + "dnsIp": "198.18.193.241", + "domain": "e6589.dscb.akamaiedge.net.", + "queryType": "A", + "deviceId": "630ace6b-4f26-41df-b411-cd652512cb04", + "deviceName": "Lab-Mac-19818179159.local", + "resolved": [ + { + "type": "A", + "response": "23.204.70.172", + "asn": "20940", + "asname": "qwest" + } + ] + }, + "event": { + "trigger": "null", + "siteId": "51277", + "siteName": "E2E Mac 179.159 site", + "policyId": "38307", + "policyName": "E2E-CML-test", + "confidenceName": "Unknown", + "actionId": "10", + "actionName": "Bypass", + "onRamp": "No", + "onrampType": "", + "internalClientIP": "N/A", + "clientRequestId": "00032083", + "policyEvaluationSource": "dns", + "deepScanned": false + } + } + ] +} +``` + +### PROXY +Additional information regarding the log fields can be found on [here](https://developer.akamai.com/api/enterprise_security/enterprise_threat_protector_reporting/v3.html#proxytraffictransaction) +```json +{ + "pageInfo": { + "totalRecords": 44583, + "pageNumber": 1, + "pageSize": 5 + }, + "dataRows": [ + { + "id": "0", + "l7Protocol": "HTTP", + "isEvent": true, + "request": { + "startTime": 1590474813791, + "connectionId": "0x3706B3124FAFAF8C9574", + "domain": "statsfe2.ws.microsoft.com.", + "uri": "/ReportingWebService/ReportingWebService.asmx", + "method": "POST", + "clientPort": 48176, + "destinationIP": "52.183.47.176", + "destinationPort": 80, + "uuid": "1b72e77c-254a-4ba9-a456-2a1b4407d65b", + "clientIp": "172.25.162.210", + "queryStrings": [], + "headers": [ + { + "name": "Cache-Control", + "value": "no-cache" + }, + { + "name": "Content-Length", + "value": "2369" + }, + { + "name": "Content-Type", + "value": "text/xml; charset=utf-8" + }, + { + "name": "Host", + "value": "statsfe2.ws.microsoft.com" + }, + { + "name": "Pragma", + "value": "no-cache" + }, + { + "name": "User-Agent", + "value": "Windows-Update-Agent/7.9.9600.19670 Client-Protocol/1.21 EtpClient:3.0.0" + }, + { + "name": "X-Forwarded-For", + "value": "172.25.162.210, 172.25.162.210" + } + ] + }, + "response": { + "endTime": 1590474813793, + "hash": "", + "headers": [] + }, + "event": { + "correlatedSinkholeEvents": [ + { + "sinkholeId": "ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11", + "eventId": "1590113794976#ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11#28301", + "sourcePort": 48022, + "destinationPort": 80, + "l4Protocol": "TCP", + "hostname": "akamaietpcnctest.com", + "userAgent": "curl/7.47.0", + "l7Protocol": "HTTP", + "eventTime": "2020-05-22T02:16:34Z", + "url": "/", + "sinkholeName": "ETP_DNS_SINKHOLE", + "hitCount": 1, + "configId": 1041, + "internalIP": "198.18.179.187", + "sinkholeIP": "172.25.162.242", + "machineNames": [ + "N/A" + ] + } + ], + "trigger": "null", + "detectionTime": "2020-05-26T06:33:33Z", + "detectionType": "inline", + "siteId": "5003", + "siteName": "Off Network ETP Clients", + "policyId": "32965", + "policyName": "Westford OFF Network policy", + "listId": "-1", + "listName": "unknown", + "categoryId": "73", + "categoryName": "73", + "confidenceId": "-1", + "confidenceName": "Unknown", + "actionId": "4", + "actionName": "Block - Error Page", + "blockDescription": "The URL hosts malware.", + "reason": "Acceptable use policy", + "severityId": 0, + "severityLevel": "Unclassified", + "onrampType": "etp_offnet_client", + "internalClientIP": "172.25.162.210", + "clientRequestId": "dc475a9e-c192-4b0b-a34e-a95c0f8dfcad-15904747363383674-1195", + "deepscanReportPath": "", + "httpVersion": "1.1", + "httpUserAgent": "Windows-Update-Agent/7.9.9600.19670 Client-Protocol/1.21 EtpClient:3.0.0", + "deviceId": "dc475a9e-c192-4b0b-a34e-a95c0f8dfcad", + "deviceName": "WIN81-ENT-210", + "deepScanned": false, + "matchedGroups": [], + "listIdentifiers": [ + { + "listId": -1, + "categoryId": 73, + "confidenceId": -1, + "threatId": 0, + "listName": "unknown", + "categoryName": "73", + "confidenceName": "Unknown", + "threatName": "Unclassified" + } + ] + }, + "userIdentity": { + "encryptedUserID": "", + "encryptedUserName": "", + "groups": [] + } + }, + { + "id": "1", + "l7Protocol": "HTTPS", + "isEvent": false, + "request": { + "startTime": 1590474750161, + "connectionId": "0x3706B30F4FAEB4B27FB1", + "domain": "statics.teams.cdn.office.net.", + "uri": "/evergreen-assets/icons/1x1-000000ff.png", + "method": "GET", + "clientPort": 34656, + "destinationIP": "2600:1409:d000::17df:3490", + "destinationPort": 443, + "uuid": "38c91e98-37fc-40f0-876e-ba60104b4d35", + "clientIp": "172.25.174.232", + "queryStrings": [ + { + "name": "cb", + "value": "1590474712726" + } + ], + "headers": [ + { + "name": "Accept", + "value": "image/webp,image/apng,image/*,*/*;q=0.8" + }, + { + "name": "Accept-Encoding", + "value": "gzip, deflate, br" + }, + { + "name": "Accept-Language", + "value": "en-US" + }, + { + "name": "Connection", + "value": "keep-alive" + }, + { + "name": "Host", + "value": "statics.teams.cdn.office.net" + }, + { + "name": "Referer", + "value": "https://teams.microsoft.com/_" + }, + { + "name": "User-Agent", + "value": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.12058 Chrome/69.0.3497.128 Electron/4.2.12 Safari/537.36" + } + ] + }, + "response": { + "endTime": 1590474750226, + "hash": "", + "headers": [ + { + "name": "Access-Control-Allow-Origin", + "value": "*" + }, + { + "name": "Cache-Control", + "value": "public, max-age=604777" + }, + { + "name": "Connection", + "value": "keep-alive" + }, + { + "name": "Content-Length", + "value": "68" + }, + { + "name": "Content-MD5", + "value": "5E5+z+yZNWYywTzT6qPiUA==" + }, + { + "name": "Content-Type", + "value": "image/png" + }, + { + "name": "Date", + "value": "Tue, 26 May 2020 06:32:30 GMT" + }, + { + "name": "ETag", + "value": "\"0x8D6D3F4152295F5\"" + }, + { + "name": "Last-Modified", + "value": "Wed, 08 May 2019 20:30:59 GMT" + }, + { + "name": "Server", + "value": "Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0" + } + ] + }, + "event": { + "correlatedSinkholeEvents": [ + { + "sinkholeId": "ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11", + "eventId": "1590113794976#ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11#28301", + "sourcePort": 48022, + "destinationPort": 80, + "l4Protocol": "TCP", + "hostname": "akamaietpcnctest.com", + "userAgent": "curl/7.47.0", + "l7Protocol": "HTTP", + "eventTime": "2020-05-22T02:16:34Z", + "url": "/", + "sinkholeName": "ETP_DNS_SINKHOLE", + "hitCount": 1, + "configId": 1041, + "internalIP": "198.18.179.187", + "sinkholeIP": "172.25.162.242", + "machineNames": [ + "N/A" + ] + } + ], + "trigger": "null", + "detectionTime": "2020-05-26T06:32:30Z", + "detectionType": "N/A", + "siteId": "51284", + "siteName": "E2E WIN 174.232 site", + "policyId": "0", + "policyName": "0", + "listId": "-1", + "listName": "unknown", + "categoryId": "104", + "categoryName": "104", + "confidenceId": "-1", + "confidenceName": "Unknown", + "actionId": "5", + "actionName": "Allow", + "blockDescription": "The URL hosts malware.", + "reason": "Acceptable use policy", + "severityId": 0, + "severityLevel": "Unclassified", + "onrampType": "etp_client", + "internalClientIP": "172.25.174.232", + "clientRequestId": "c37a4c4e-a7cd-400f-820d-b82762c52975-15904747127323964-48715", + "deepscanReportPath": "", + "httpVersion": "1.1", + "httpUserAgent": "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.12058 Chrome/69.0.3497.128 Electron/4.2.12 Safari/537.36 EtpClient:3.0.0", + "deviceId": "c37a4c4e-a7cd-400f-820d-b82762c52975", + "deviceName": "BOS-WPX5E", + "deepScanned": false, + "matchedGroups": [], + "listIdentifiers": [ + { + "listId": -1, + "categoryId": 104, + "confidenceId": -1, + "threatId": 0, + "listName": "unknown", + "categoryName": "104", + "confidenceName": "Unknown", + "threatName": "Unclassified" + } + ] + }, + "userIdentity": { + "encryptedUserID": "", + "encryptedUserName": "", + "groups": [] + } + }, + { + "id": "2", + "l7Protocol": "HTTPS", + "isEvent": false, + "request": { + "startTime": 1590474718273, + "connectionId": "0x3706B3154FAE37181163A", + "domain": "clickstream-killswitch.hd-personalization-prod.gcp.example.com.", + "uri": "/clickstream-killswitch/v1/detail", + "method": "GET", + "clientPort": 42380, + "destinationIP": "130.211.21.250", + "destinationPort": 443, + "uuid": "a1d7f692-c932-466a-82f6-e4e85bba7864", + "clientIp": "172.25.174.232", + "queryStrings": [], + "headers": [ + { + "name": "Accept", + "value": "*/*" + }, + { + "name": "Accept-Encoding", + "value": "gzip, deflate, br" + }, + { + "name": "Accept-Language", + "value": "en-US,en;q=0.9" + }, + { + "name": "Connection", + "value": "keep-alive" + }, + { + "name": "content-type", + "value": "application/json" + }, + { + "name": "Host", + "value": "clickstream-killswitch.hd-personalization-prod.gcp.example.com" + }, + { + "name": "Origin", + "value": "https://www.example.com" + }, + { + "name": "Referer", + "value": "https://www.example.com/" + }, + { + "name": "User-Agent", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" + } + ] + }, + "response": { + "endTime": 1590474718348, + "hash": "", + "headers": [ + { + "name": "Access-Control-Allow-Origin", + "value": "https://www.example.com" + }, + { + "name": "Content-Length", + "value": "1329" + }, + { + "name": "Content-Type", + "value": "application/json;charset=UTF-8" + }, + { + "name": "Date", + "value": "Tue, 26 May 2020 06:31:57 GMT" + }, + { + "name": "Vary", + "value": "Origin, Access-Control-Request-Method, Access-Control-Request-Headers" + }, + { + "name": "Via", + "value": "1.1 google" + } + ] + }, + "event": { + "correlatedSinkholeEvents": [ + { + "sinkholeId": "ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11", + "eventId": "1590113794976#ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11#28301", + "sourcePort": 48022, + "destinationPort": 80, + "l4Protocol": "TCP", + "hostname": "akamaietpcnctest.com", + "userAgent": "curl/7.47.0", + "l7Protocol": "HTTP", + "eventTime": "2020-05-22T02:16:34Z", + "url": "/", + "sinkholeName": "ETP_DNS_SINKHOLE", + "hitCount": 1, + "configId": 1041, + "internalIP": "198.18.179.187", + "sinkholeIP": "172.25.162.242", + "machineNames": [ + "N/A" + ] + } + ], + "trigger": "null", + "detectionTime": "2020-05-26T06:31:58Z", + "detectionType": "N/A", + "siteId": "51284", + "siteName": "E2E WIN 174.232 site", + "policyId": "0", + "policyName": "0", + "listId": "-1", + "listName": "unknown", + "categoryId": "55", + "categoryName": "Streaming Websites", + "confidenceId": "-1", + "confidenceName": "Unknown", + "actionId": "5", + "actionName": "Allow", + "blockDescription": "The URL hosts malware.", + "reason": "Acceptable use policy", + "severityId": 0, + "severityLevel": "Unclassified", + "onrampType": "etp_client", + "internalClientIP": "172.25.174.232", + "clientRequestId": "c37a4c4e-a7cd-400f-820d-b82762c52975-15904746798952196-48708", + "deepscanReportPath": "", + "httpVersion": "1.1", + "httpUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 EtpClient:3.0.0", + "deviceId": "c37a4c4e-a7cd-400f-820d-b82762c52975", + "deviceName": "BOS-WPX5E", + "deepScanned": false, + "matchedGroups": [], + "listIdentifiers": [ + { + "listId": -1, + "categoryId": 55, + "confidenceId": -1, + "threatId": 0, + "listName": "unknown", + "categoryName": "Streaming Websites", + "confidenceName": "Unknown", + "threatName": "Unclassified" + }, + { + "listId": -1, + "categoryId": 73, + "confidenceId": -1, + "threatId": 0, + "listName": "unknown", + "categoryName": "73", + "confidenceName": "Unknown", + "threatName": "Unclassified" + } + ] + }, + "userIdentity": { + "encryptedUserID": "", + "encryptedUserName": "", + "groups": [] + } + }, + { + "id": "3", + "l7Protocol": "HTTPS", + "isEvent": true, + "request": { + "startTime": 1590474706144, + "connectionId": "0x3706B3154FAE084111637", + "domain": "c.go-mpulse.net.", + "uri": "/api/config.json", + "method": "GET", + "clientPort": 41176, + "destinationIP": "2600:1409:d000:38e::11a6", + "destinationPort": 443, + "uuid": "8e86b32f-9a83-4162-a008-3e2c58b09f87", + "clientIp": "172.25.174.232", + "queryStrings": [ + { + "name": "key", + "value": "FDSGP-LEB9B-T8Y2A-5V5ED-9WX2T" + }, + { + "name": "d", + "value": "www.akamai.com" + }, + { + "name": "t", + "value": "5301582" + }, + { + "name": "v", + "value": "1.667.0" + }, + { + "name": "if", + "value": "" + }, + { + "name": "sl", + "value": "0" + }, + { + "name": "si", + "value": "876aebf5-a115-47de-973b-9ac2ba2cdd1c-qaqswv" + }, + { + "name": "r", + "value": "" + }, + { + "name": "bcn", + "value": "%2F%2F173e2548.akstat.io%2F" + }, + { + "name": "acao", + "value": "" + }, + { + "name": "ak.ai", + "value": "593889" + } + ], + "headers": [ + { + "name": "Accept", + "value": "*/*" + }, + { + "name": "Accept-Encoding", + "value": "gzip, deflate, br" + }, + { + "name": "Accept-Language", + "value": "en-US,en;q=0.9" + }, + { + "name": "Connection", + "value": "keep-alive" + }, + { + "name": "Host", + "value": "c.go-mpulse.net" + }, + { + "name": "Origin", + "value": "https://www.akamai.com" + }, + { + "name": "User-Agent", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" + } + ] + }, + "response": { + "endTime": 1590474706146, + "hash": "", + "headers": [] + }, + "event": { + "correlatedSinkholeEvents": [ + { + "sinkholeId": "ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11", + "eventId": "1590113794976#ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11#28301", + "sourcePort": 48022, + "destinationPort": 80, + "l4Protocol": "TCP", + "hostname": "akamaietpcnctest.com", + "userAgent": "curl/7.47.0", + "l7Protocol": "HTTP", + "eventTime": "2020-05-22T02:16:34Z", + "url": "/", + "sinkholeName": "ETP_DNS_SINKHOLE", + "hitCount": 1, + "configId": 1041, + "internalIP": "198.18.179.187", + "sinkholeIP": "172.25.162.242", + "machineNames": [ + "N/A" + ] + } + ], + "trigger": "null", + "detectionTime": "2020-05-26T06:31:46Z", + "detectionType": "inline", + "siteId": "51284", + "siteName": "E2E WIN 174.232 site", + "policyId": "38307", + "policyName": "E2E-CML-test", + "listId": "-1", + "listName": "unknown", + "categoryId": "31", + "categoryName": "Chat Site", + "confidenceId": "-1", + "confidenceName": "Unknown", + "actionId": "4", + "actionName": "Block - Error Page", + "blockDescription": "The URL hosts malware.", + "reason": "Acceptable use policy", + "severityId": 0, + "severityLevel": "Unclassified", + "onrampType": "etp_client", + "internalClientIP": "172.25.174.232", + "clientRequestId": "c37a4c4e-a7cd-400f-820d-b82762c52975-15904746699129224-48707", + "deepscanReportPath": "", + "httpVersion": "1.1", + "httpUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 EtpClient:3.0.0", + "deviceId": "c37a4c4e-a7cd-400f-820d-b82762c52975", + "deviceName": "BOS-WPX5E", + "deepScanned": false, + "matchedGroups": [], + "listIdentifiers": [ + { + "listId": -1, + "categoryId": 31, + "confidenceId": -1, + "threatId": 0, + "listName": "unknown", + "categoryName": "Chat Site", + "confidenceName": "Unknown", + "threatName": "Unclassified" + } + ] + }, + "userIdentity": { + "encryptedUserID": "", + "encryptedUserName": "", + "groups": [] + } + }, + { + "id": "4", + "l7Protocol": "HTTPS", + "isEvent": false, + "request": { + "startTime": 1590474688053, + "connectionId": "0x3706B3124FADC2CF9570", + "domain": "d.la1-c2-ia4.salesforceliveagent.com.", + "uri": "/chat/rest/Visitor/Availability.jsonp", + "method": "GET", + "clientPort": 43149, + "destinationIP": "13.110.63.55", + "destinationPort": 443, + "uuid": "7b33eedd-8b7d-463b-80d9-996b74a0a9ee", + "clientIp": "172.25.174.232", + "queryStrings": [ + { + "name": "sid", + "value": "409d47de-bf85-433c-9c88-79add325835a" + }, + { + "name": "r", + "value": "906" + }, + { + "name": "Availability.prefix", + "value": "Visitor" + }, + { + "name": "Availability.ids", + "value": "[5730f000000HhB2,5730f000000HhAJ,5730f000000HhAY]" + }, + { + "name": "callback", + "value": "liveagent._.handlePing" + }, + { + "name": "deployment_id", + "value": "5720f0000009HUh" + }, + { + "name": "org_id", + "value": "00DA0000000Hu5a" + }, + { + "name": "version", + "value": "43" + } + ], + "headers": [ + { + "name": "Accept", + "value": "*/*" + }, + { + "name": "Accept-Encoding", + "value": "gzip, deflate, br" + }, + { + "name": "Accept-Language", + "value": "en-US,en;q=0.9" + }, + { + "name": "Connection", + "value": "keep-alive" + }, + { + "name": "Host", + "value": "d.la1-c2-ia4.salesforceliveagent.com" + }, + { + "name": "User-Agent", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36" + } + ] + }, + "response": { + "endTime": 1590474688139, + "hash": "", + "headers": [ + { + "name": "Access-Control-Allow-Origin", + "value": "*" + }, + { + "name": "Cache-Control", + "value": "no-cache" + }, + { + "name": "Connection", + "value": "close" + }, + { + "name": "Content-Encoding", + "value": "gzip" + }, + { + "name": "Content-Type", + "value": "text/javascript" + }, + { + "name": "Expires", + "value": "-1" + }, + { + "name": "Pragma", + "value": "no-cache" + }, + { + "name": "X-Content-Type-Options", + "value": "nosniff" + } + ] + }, + "event": { + "correlatedSinkholeEvents": [ + { + "sinkholeId": "ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11", + "eventId": "1590113794976#ac4bde1e-7d3d-4ff5-9cf8-772df0b1ce11#28301", + "sourcePort": 48022, + "destinationPort": 80, + "l4Protocol": "TCP", + "hostname": "akamaietpcnctest.com", + "userAgent": "curl/7.47.0", + "l7Protocol": "HTTP", + "eventTime": "2020-05-22T02:16:34Z", + "url": "/", + "sinkholeName": "ETP_DNS_SINKHOLE", + "hitCount": 1, + "configId": 1041, + "internalIP": "198.18.179.187", + "sinkholeIP": "172.25.162.242", + "machineNames": [ + "N/A" + ] + } + ], + "trigger": "null", + "detectionTime": "2020-05-26T06:31:28Z", + "detectionType": "N/A", + "siteId": "51284", + "siteName": "E2E WIN 174.232 site", + "policyId": "0", + "policyName": "0", + "listId": "-1", + "listName": "unknown", + "categoryId": "73", + "categoryName": "73", + "confidenceId": "-1", + "confidenceName": "Unknown", + "actionId": "5", + "actionName": "Allow", + "blockDescription": "The URL hosts malware.", + "reason": "Acceptable use policy", + "severityId": 0, + "severityLevel": "Unclassified", + "onrampType": "etp_client", + "internalClientIP": "172.25.174.232", + "clientRequestId": "c37a4c4e-a7cd-400f-820d-b82762c52975-15904746509095241-48705", + "deepscanReportPath": "", + "httpVersion": "1.1", + "httpUserAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 EtpClient:3.0.0", + "deviceId": "c37a4c4e-a7cd-400f-820d-b82762c52975", + "deviceName": "BOS-WPX5E", + "deepScanned": false, + "matchedGroups": [], + "listIdentifiers": [ + { + "listId": -1, + "categoryId": 73, + "confidenceId": -1, + "threatId": 0, + "listName": "unknown", + "categoryName": "73", + "confidenceName": "Unknown", + "threatName": "Unclassified" + } + ] + }, + "userIdentity": { + "encryptedUserID": "", + "encryptedUserName": "", + "groups": [] + } + } + ] +} +``` + ## Akamai MFA Additional information regarding the log fields can be found on [here](https://learn.akamai.com/en-us/webhelp/enterprise-mfa/akamai-mfa-logs-from-splunk-application/GUID-0F17296F-90F3-483E-AFDE-F98FBC51A8AC.html). ### Authentication Logs (AUTH) Authentication Events Example: -```text -{"uuid": "aud_JfNqdl6zSByrU0ovrbJ6m", "created_at": "2021-03-23T19:36:20.047688", "browser_ip": "49.207.58.115", "app_id": "app_3IyJXh2U9Jiws6bvxcf8X", "device": "push", "auth_method": "push", "user_id": "user_6Hy1v24DZIr8b0UHYi5dv3", "username": "nityagi", "is_success": true, "device_metadata": "Android", "receipt": "", "browser_type": "Chrome", "browser_version": "88.0.4324", "browser_os": "MacOS", "browser_os_version": "10.15.7", "device_os": "android", "device_os_version": "10.0.0", "browser_geo_location": "BANGALORE KA, IN", "device_geo_location": "BANGALORE KA, IN", "device_ip": "49.207.58.115"} +```json +{ + "uuid": "aud_JfNqdl6zS23456623434", + "created_at": "2021-03-23T19:36:20.047688", + "browser_ip": "49.103.18.124", + "app_id": "app_3IyJXh2345345345345f8X", + "device": "push", + "auth_method": "push", + "user_id": "user_6Hy1v241221541i5dv3", + "username": "mschiess", + "is_success": true, + "device_metadata": "Android", + "receipt": "", + "browser_type": "Chrome", + "browser_version": "88.0.4324", + "browser_os": "MacOS", + "browser_os_version": "10.15.7", + "device_os": "android", + "device_os_version": "10.0.0", + "browser_geo_location": "BANGALORE KA, IN", + "device_geo_location": "BANGALORE KA, IN", + "device_ip": "49.103.18.124" +} ``` ### Policy Logs (POLICY) Policy Denied Events Example: -```text -{"id": "aud_5mRypRCazgr8ucRJtICVJt", "created_at": "2021-03-23T17:20:50.524672", "user_id": "user_3CbCStOKG0uGdjRILocuxW", "principal_id": "Tenant", "policy_id": "policy_5iMncPFO8euHE8JRviQL4j", "policy_attribute_name": "Existing User"} +```json +{ + "id": "aud_5mRypRCa3456789VJt", + "created_at": "2021-03-23T17:20:50.524672", + "user_id": "user_3CbCStOKG0uGdjRILocuxW", + "principal_id": "Tenant", + "policy_id": "policy_5iMncPFO2345678QL4j", + "policy_attribute_name": "Existing User" +} ``` \ No newline at end of file diff --git a/docker-compose/README.md b/docs/docker-compose/README.md similarity index 58% rename from docker-compose/README.md rename to docs/docker-compose/README.md index fc4b153..ae79a21 100644 --- a/docker-compose/README.md +++ b/docs/docker-compose/README.md @@ -2,8 +2,8 @@ Within this directory, we provide some `docker compose` examples including example files. The docker-compose.yml controls the docker - relevant attributes like mounting the `.edgerc` file into the container. -The `.env` files control the ULS via dedicated [ENVIRONMENTAL VARIABLES](../docs/ARGUMENTS_ENV_VARS.md). +The `.env` files control the ULS via dedicated [ENVIRONMENTAL VARIABLES](../ARGUMENTS_ENV_VARS.md). -The [simple](./simple/README.md) directory provides a simple example running ULS via `docker compose` -The [complex](./complex/README.md) directory provides a more "real world" example combining multiple feeds and different outputs. +The [simple](simple/README.md) directory provides a simple example running ULS via `docker compose` +The [complex](complex/README.md) directory provides a more "real world" example combining multiple feeds and different outputs. The [example](examples/README.md) directory provides different configuration snippets. diff --git a/docker-compose/complex/README.md b/docs/docker-compose/complex/README.md similarity index 100% rename from docker-compose/complex/README.md rename to docs/docker-compose/complex/README.md diff --git a/docker-compose/complex/docker-compose.yml b/docs/docker-compose/complex/docker-compose.yml similarity index 84% rename from docker-compose/complex/docker-compose.yml rename to docs/docker-compose/complex/docker-compose.yml index 0438549..ca5d012 100644 --- a/docker-compose/complex/docker-compose.yml +++ b/docs/docker-compose/complex/docker-compose.yml @@ -8,6 +8,7 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true eaa-access: image: akamai/uls:latest restart: always @@ -16,6 +17,7 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true eaa-admin: image: akamai/uls:latest restart: always @@ -23,4 +25,5 @@ services: volumes: - type: bind source: /path/to/your/.edgerc - target: /opt/akamai-uls/.edgerc \ No newline at end of file + target: /opt/akamai-uls/.edgerc + read_only: true \ No newline at end of file diff --git a/docker-compose/complex/eaa-access.env b/docs/docker-compose/complex/eaa-access.env similarity index 100% rename from docker-compose/complex/eaa-access.env rename to docs/docker-compose/complex/eaa-access.env diff --git a/docker-compose/complex/etp-threat.env b/docs/docker-compose/complex/etp-threat.env similarity index 100% rename from docker-compose/complex/etp-threat.env rename to docs/docker-compose/complex/etp-threat.env diff --git a/docker-compose/complex/mfa-auth.env b/docs/docker-compose/complex/mfa-auth.env similarity index 100% rename from docker-compose/complex/mfa-auth.env rename to docs/docker-compose/complex/mfa-auth.env diff --git a/docker-compose/examples/README.md b/docs/docker-compose/examples/README.md similarity index 100% rename from docker-compose/examples/README.md rename to docs/docker-compose/examples/README.md diff --git a/docker-compose/examples/all_services_docker-compose.yml b/docs/docker-compose/examples/all_services_docker-compose.yml similarity index 66% rename from docker-compose/examples/all_services_docker-compose.yml rename to docs/docker-compose/examples/all_services_docker-compose.yml index 8ea40fc..a6e5c2d 100644 --- a/docker-compose/examples/all_services_docker-compose.yml +++ b/docs/docker-compose/examples/all_services_docker-compose.yml @@ -9,6 +9,7 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true # AUP etp-aup: image: akamai/uls:latest @@ -18,6 +19,27 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true + # DNS + etp-aup: + image: akamai/uls:latest + restart: always + env_file: etp-dns.env + volumes: + - type: bind + source: /path/to/your/.edgerc + target: /opt/akamai-uls/.edgerc + read_only: true + # PROXY + etp-aup: + image: akamai/uls:latest + restart: always + env_file: etp-proxy.env + volumes: + - type: bind + source: /path/to/your/.edgerc + target: /opt/akamai-uls/.edgerc + read_only: true # EAA # ACCESS eaa-access: @@ -28,6 +50,7 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true # ADMIN eaa-admin: image: akamai/uls:latest @@ -37,6 +60,7 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true # MFA # AUTH mfa-auth: @@ -47,6 +71,7 @@ services: - type: bind source: /path/to/your/.edgerc target: /opt/akamai-uls/.edgerc + read_only: true # POLICY mfa-policy: image: akamai/uls:latest @@ -55,4 +80,5 @@ services: volumes: - type: bind source: /path/to/your/.edgerc - target: /opt/akamai-uls/.edgerc \ No newline at end of file + target: /opt/akamai-uls/.edgerc + read_only: true \ No newline at end of file diff --git a/docker-compose/examples/example_env_file.env b/docs/docker-compose/examples/example_env_file.env similarity index 91% rename from docker-compose/examples/example_env_file.env rename to docs/docker-compose/examples/example_env_file.env index 2c7bc45..d62c333 100644 --- a/docker-compose/examples/example_env_file.env +++ b/docs/docker-compose/examples/example_env_file.env @@ -10,17 +10,17 @@ ULS_LOGLEVEL=DEBUG ULS_INPUT=ETP # THE INPUT FEED # EAA: [ ADMIN | ACCESS] - # ETP: [ THREAT | AUP ] + # ETP: [ THREAT | AUP | DNS | PROXY] # MFA: [ POLICY | AUTH ] ULS_FEED=THREAT - # INPUT FORRMAT + # INPUT FORMAT ULS_FORMAT=JSON # LOCATION OF THE AKAMAI .EDGERC FILE ULS_EDGERC='/opt/akamai-uls/.edgerc' # RELEVANT SECTION WITHIN THE EDGERC FILE ULS_SECTION=default # PROXY TO ACCESS AKAMAI API'S WHILE FETCHING THE LOGS - #ULS_INPUT_PROXY='None' + #ULS_INPUT_PROXY='None' (known issue - see FAQ.md) # OUTPUT CONFIGURATION # OUTPUT PATH [ TCP / UDP / HTTP ] diff --git a/docker-compose/simple/README.md b/docs/docker-compose/simple/README.md similarity index 100% rename from docker-compose/simple/README.md rename to docs/docker-compose/simple/README.md diff --git a/docker-compose/simple/docker-compose.yml b/docs/docker-compose/simple/docker-compose.yml similarity index 74% rename from docker-compose/simple/docker-compose.yml rename to docs/docker-compose/simple/docker-compose.yml index 3fe72f1..80f915a 100644 --- a/docker-compose/simple/docker-compose.yml +++ b/docs/docker-compose/simple/docker-compose.yml @@ -7,4 +7,5 @@ services: volumes: - type: bind source: /path/to/your/.edgerc - target: /opt/akamai-uls/.edgerc \ No newline at end of file + target: /opt/akamai-uls/.edgerc + read_only: true \ No newline at end of file diff --git a/docker-compose/simple/etp-threat.env b/docs/docker-compose/simple/etp-threat.env similarity index 100% rename from docker-compose/simple/etp-threat.env rename to docs/docker-compose/simple/etp-threat.env