Skip to main content
Flarehawk discovers Akamai properties, provisions managed DataStream 2 delivery, and polls SIEM security events through one encrypted EdgeGrid credential profile.
The Akamai connector is in beta. Exact-IP response is manual-only while Akamai production activation cannot be pinned to a reviewed Network List sync point. Flarehawk never calls the write API for these actions.

​
Connect Akamai

1

Create an EdgeGrid API client

In Akamai Control Center, create an API client with the SIEM, DataStream Config, Property Manager, and Application Security permissions described in the connection wizard. Akamai response remains a console-run manual workflow, so Flarehawk does not require Network Lists write permission.
2

Enter the EdgeGrid credentials

Paste the API hostname, client token, client secret, and access token from the .edgerc profile. Flarehawk validates the credentials before any connection is saved.
3

Select properties and telemetry

Select the exact Akamai properties to monitor, then enable DataStream HTTP logs and SIEM edge-security events as appropriate.
4

Create and verify

Create the connection, generate traffic, and confirm that the connection is active and recent events appear under Logs.

​
Optional exact-IP response preparation

Flarehawk does not create a Network List or attach one to a policy. Complete that change in Akamai as a reviewed onboarding operation:
  1. Create one dedicated, writable IP Network List per opted-in property.
  2. Name it with a Flarehawk prefix.
  3. Attach it to the intended production blocking policy for that property and activate the list in production.
  4. Set its description to flarehawk-response-list:<propertyId>:<securityConfigId>:<policyId>, using the exact prp_… property ID, AppSec security configuration ID, and reviewed policy ID.
  5. Record the reviewed binding for the operator who will execute manual response. If you also want Flarehawk to verify read-only readiness metadata, enter it in Response Network List bindings:
Testing or saving the connection verifies the list ID, name, ownership marker, type, write access, latest production activation, and its deny-list attachment to the policy in the AppSec configuration’s production-active version. Flarehawk then stores a nonsecret, server-written readiness marker. A browser-supplied marker is discarded, and a binding that does not match the incident’s exact property is never eligible for live response. Suggestions accept one exact public IPv4 or IPv6 address and provide bounded, property-specific console steps. CIDR blocks, ASNs, countries, and arbitrary expressions are rejected. Before activation, the operator must re-read the latest list, preserve every unrelated entry, and confirm the intended exact IP change. Flarehawk does not load Akamai write credentials or mutate the provider for a manual action.