Skip to content

[Akamai] - Migrated SIEM data stream from HTTPJSON to CEL input #15713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 9 commits into
base: main
Choose a base branch
from
Open

[Akamai] - Migrated SIEM data stream from HTTPJSON to CEL input #15713

wants to merge 9 commits into from
+180 −112

Conversation

@ShourieG
Copy link
Contributor

@ShourieG ShourieG commented Oct 22, 2025 •
edited
Loading

Type of change

  • Enhancement

Proposed commit message

Migrated SIEM data stream from HTTPJSON to CEL input with 
with necessary reworks and working system tests. Updated 
minimum stack version to 8.18 to allow usage of required CEL functions.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@ShourieG ShourieG self-assigned this Oct 22, 2025
@ShourieG ShourieG added enhancement New feature or request Integration:akamai Akamai (Community supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Oct 22, 2025
@ShourieG ShourieG requested a review from efd6 October 22, 2025 13:58
@ShourieG ShourieG marked this pull request as ready for review October 24, 2025 11:50
@ShourieG ShourieG requested a review from a team as a code owner October 24, 2025 11:50
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6
efd6 reviewed Oct 26, 2025
View reviewed changes
packages/akamai/changelog.yml Outdated
# newer versions go on top
- version: "2.29.0"
changes:
- description: Migrated siem data stream from Httpjson to CEL.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- description: Migrated siem data stream from Httpjson to CEL.
- description: Migrated siem data stream from HTTP JSON to CEL.

packages/akamai/data_stream/siem/agent/stream/cel.yml.hbs Outdated
program: |
state.with(
(
state.?cursor.?recovery_mode.orValue(false) ?
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
state.?cursor.?recovery_mode.orValue(false) ?
state.?cursor.recovery_mode.orValue(false) ?

similar throughout; after a .? operator, all the subsequent accesses are on optional types, so after the first the ? is redundant.

packages/akamai/data_stream/siem/agent/stream/cel.yml.hbs Outdated
Comment on lines 63 to 70
(
"GET\t" +
string(u.Scheme) + "\t" +
string(u.Host) + "\t" +
string(u.Path) + "?" +
string(u.RawQuery) +
"\t\t\t" + sig_base
).as(to_sign,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

use sprintf

packages/akamai/data_stream/siem/agent/stream/cel.yml.hbs
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

run celfmt on this

packages/akamai/data_stream/siem/agent/stream/cel.yml.hbs Outdated
"cursor": {
?"last_offset": lines.size() > 0 ?
lines[lines.size() - 1].decode_json().as(lastEvent,
has(lastEvent.offset) ? optional.of(lastEvent.offset) : optional.none()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
has(lastEvent.offset) ? optional.of(lastEvent.offset) : optional.none()
lastEvent.?offset

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @ShourieG

@ShourieG
Copy link
Contributor Author

@efd6, addressed all the changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@efd6 efd6 efd6 left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@ShourieG ShourieG

Labels

enhancement New feature or request Integration:akamai Akamai (Community supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Akamai] - Add option for a CEL based agent and integrate automatic error recovery.

3 participants

@ShourieG @elasticmachine @efd6