What Changed
The Akamai DDOS Protection CCF Data Connector (v3.0.0 to v3.0.1) has been promoted from public preview to GA. Two functional changes accompany the promotion:
- isPreview set to false in AkamaiDDOSProtection_ConnectorDefinition.json – the connector is now production-supported in Content Hub.
- Polling timeout reduced from 120s to 35s in AkamaiDDOSProtection_PollerConfig.json.
- graphQueriesTableName field removed from the connector definition UI config block.
Security Impact (Visibility & Fidelity)
The timeout reduction is the operationally relevant change. The Akamai SIEM Integration API is polled every 5 minutes (queryWindowInMin: 5) using HMAC-SHA-256 signed EdgeGrid credentials. If the API response time exceeds 35 seconds – plausible under high-volume WAF event conditions or transient network latency – the poll will fail and WAF security events will not be ingested for that window.
Environments currently running v3.0.0 (preview) should validate that Akamai SIEM API response times are consistently under 35s before upgrading. If WAF event ingestion gaps appear in AkamaiSIEMEvent after the upgrade, the timeout is the first diagnostic target.
The connector ingests WAF security events from Akamai SIEM Integration API, including attack data, geographic context, and HTTP request/response metadata – this data underpins any DDoS and WAF-based detection coverage in the workspace.
Affected Files
Solutions/Akamai DDOS Protection/Data Connectors/AkamaiDDOSProtection_CCF/AkamaiDDOSProtection_ConnectorDefinition.json
Solutions/Akamai DDOS Protection/Data Connectors/AkamaiDDOSProtection_CCF/AkamaiDDOSProtection_PollerConfig.json
(packaging artefacts: 3.0.1.zip, ReleaseNotes.md, Solution_AkamaiDDOSProtection.json, mainTemplate.json)