W-23349163 akamai scanner ga jh #498

sparshagarwal-nonemu · 2026-07-30T19:01:41Z

do we have this feature? i dont think we have correlation policies

hi @sparshagarwal-nonemu, yes. In this integration, we use correlation policies to make sure the security findings we see in Akamai are attributed to the exact API instance in MuleSoft.

-Original file line number
+Diff line change
@@ Expand Up / @@ -21,16 +21,20 @@ @@
         *** xref:model-proxy-request.adoc[]
         *** xref:model-proxy-semantic-service.adoc[]
         *** xref:model-proxy-try-out.adoc[]
+      ** xref:exp-akamai-risk-correlation.adoc[]
       ** xref:exp-scanners-add-from-providers.adoc[]
         *** xref:exp-scanners-manage.adoc[]
+      ** xref:exp-scanners-prerequisites-reference.adoc[]
+      ** xref:exp-scanners-view-details.adoc[]
       ** xref:exp-providers-manage.adoc[]
       ** xref:exp-governance-view-cost-and-token-usage.adoc[]
         *** xref:model-proxy-token-reports.adoc[]
         *** xref:exp-models-manage-costs.adoc[]
       ** xref:exp-instances-add.adoc[]
       ** xref:exp-governance-work-with-strategies.adoc[]
-       *** xref:exp-governance-create-strategy.adoc[]
-       *** xref:exp-governance-manage-strategies.adoc[]
+        *** xref:exp-governance-create-strategy.adoc[]
+        *** xref:exp-governance-manage-strategies.adoc[]
+        *** xref:exp-governance-view-cost-and-token-usage.adoc[]
       ** xref:exp-services-monitoring.adoc[]
       ** xref:exp-services-view-detailed-metrics.adoc[]
       ** xref:exp-alerts-configure-notifications.adoc[]
@@ Expand Down @@

-Original file line number
+Diff line change
@@ -0,0 +1,133 @@
+    = Using Akamai for Risk Correlation
+    :keywords: akamai api security scanner, akamai integration, security risk, vulnerability findings, incident correlation, portfolio catalogs
+    Use Akamai for risk correlation to map external security findings to the right services in *Portfolio*. Teams get one view to triage risk, track incidents, and remediate faster. To enable this correlation, configure an Akamai API Security scanner that connects your Akamai account, runs scheduled scans, and surfaces mapped findings on related services in *Portfolio*. The scanner doesn't import or register third-party services. It correlates risk scores, findings, and incidents for APIs and MCP services in one governance workflow.
+    The integration relies on a bidirectional sync between your MuleSoft and Akamai API Security tenants. You connect the two tenants with credentials in each direction: Akamai reads your API assets and instances from MuleSoft so it can match its security observations to the correct APIs, and the scanner pulls the resulting findings and incidents back into *Portfolio*.
+    == How the Akamai Scanner Differs from Import Scanners
+    Most provider scanners discover metadata in external platforms and import services into *Portfolio* catalogs. The Akamai API Security scanner works differently: instead of creating new services, it enriches existing ones with Akamai security data.
+    == Before You Begin
+    Before setting up the Akamai scanner, make sure you have:
+    * Exchange Administrator permission in the target business group.
+    * Akamai Security base URL, client ID, and client secret.
+    * Access to apply Akamai correlation policy in the environments you want to scan.
+    * Existing APIs and MCP services in *Portfolio* catalogs for correlation targets.
+    For credential and role details, see xref:exp-scanners-prerequisites-reference.adoc[].
+    == Set Up Tenant Connectivity
+    The integration uses a bidirectional sync between your MuleSoft tenant and your Akamai API Security tenant. You provision and configure both tenants. Each MuleSoft customer tenant (root organization) connects to one Akamai API Security tenant (for example, `<tenant>.nonamesec.com`).
+    Setup involves credentials in both directions:
+    * A *service account* in Akamai, which you configure on the MuleSoft side so the scanner can read findings and incidents from Akamai.
+    * A *connected app* in MuleSoft, which you configure on the Akamai side so Akamai can pull API asset and instance information from MuleSoft.
+    Complete these steps as an organization administrator:
+    . *Create a service account in Akamai API Security.* In your Akamai API Security tenant, create a service account and note its client ID and client secret.
+    . *Configure the scanner in MuleSoft.* Add an Akamai scanner and enter the Akamai service account credentials (client ID and client secret) and the Akamai base URL, along with a scan frequency. See <<Set Up the Akamai Scanner>>.
+    . *Create a connected app in MuleSoft.* In Anypoint Platform, go to *Access Management* > *Connected Apps* and create an app that acts on its own behalf (client credentials). Add the *Exchange Viewer* or *Asset Viewer* scope so Akamai can read API instance and asset information, then save. Copy the client ID and client secret.
+    . *Configure the Akamai-side sync.* In your Akamai API Security tenant, enter the MuleSoft connected app client ID and client secret so Akamai can pull API asset and instance information from MuleSoft.
+    == Set Up the Akamai Scanner
+    Before you set up the scanner, review the prerequisites for Akamai scanners in xref:exp-scanners-prerequisites-reference.adoc[].
+    . From *Platform* > *Providers*, select *Akamai*.
+    . Click *Add Scanner* and enter the connection values.
+    . Test the connection.
+    . Enter scanner metadata, such as scanner name, description, frequency, and time.
+    . Apply the Akamai correlation policy to selected environments.
+    . Save the scanner and run a discovery scan.
+    == How the Sync Works
+    After both tenants are connected, data flows in two directions:
+    MuleSoft to Akamai::
+    Akamai periodically pulls API instance and asset information from MuleSoft (typically every few hours) and adds it to its API security inventory. Akamai correlates these API instances with the north-south traffic it observes, so it can attach MuleSoft context — such as organization ID, environment ID, and API instance ID — to the endpoints it monitors. The pull runs at the root organization level.
+    Akamai to MuleSoft::
+    The scanner pulls security findings and incidents from Akamai on the schedule you set, then correlates and stores them so they appear on the related services in *Portfolio*.
+    For Akamai to observe and correlate traffic, the Akamai correlation policy must be applied to your API instances. This out-of-the-box policy (for Flex Gateway and Mule gateways) stamps correlation headers on API responses so Akamai can match observed traffic to the correct MuleSoft API. Akamai observes north-south traffic only for domains you own and control.
+    == Review Scanner Detail Tabs
+    After you select a configured Akamai scanner from the provider list, use scanner detail tabs to monitor scanner status, related services, and configuration values.
+    For common tab behavior across scanners, see xref:exp-scanners-view-details.adoc[].
+    For Akamai scanners, the *Overview* tab highlights correlation policy status and shows whether existing services are being updated with Akamai risk, findings, and incident data.
+    The *Services* tab lists services associated with the scanner and shows which existing services are receiving correlated Akamai security data.
+    The *Settings* tab shows scanner configuration values, including schedule and provider connection values, and provides options to edit or delete the scanner.
+    == Apply Missing Correlation Policies
+    If some environments show that correlation policy isn't applied, you can apply missing policies from the scanner detail page:
+    . Open *Platform* > *Providers* and select the configured Akamai scanner.
+    . In *Overview*, check the *Akamai Correlation Policy* status.
+    . If the status shows missing environments, click *Check again* to apply policy only to those environments.
+    . Wait for the status to change to *Applied* and confirm all target environments are covered.
+    If policy application fails, verify your Admin API write permissions and environment access, then retry.
+    == Where Security Results Appear
+    After a successful run, Akamai results appear on existing services:
+    * API list views show values in the *Security Risk* column.
+    * API detail pages show Akamai security data in *Conformance*.
+    * Security sections display violation totals, findings, incidents, and endpoint context.
+    * Finding detail views show fields such as status, type, endpoint path, and mapped frameworks.
+    == Interpret Risk Status Levels
+    The *Security Risk* column shows the risk level assigned to correlated Akamai findings:
+    Low::
+    Lower urgency risk. Review and remediate in your normal security lifecycle.
+    Medium::
+    Moderate risk. Prioritize remediation after high-risk issues.
+    High::
+    Elevated risk. Investigate and remediate first.
+    Critical::
+    Highest urgency risk. Remediate immediately.
+    == Remediate Risks from the API Conformance Tab
+    Use the API *Conformance* tab in *Portfolio* to triage and remediate Akamai findings:
+    . Open the API from the *APIs* catalog in *Portfolio*.
+    . Select *Conformance* and review the *Akamai* section, including findings and incidents.
+    . Select a finding to open details, such as endpoint, severity, and mapped standards.
+    . Apply recommended remediation policies directly from the finding detail view when available.
+    . Re-run the scanner after remediation to confirm updated findings and risk levels.
+    If no direct remediation policy is available for a finding, use the finding details to update the API configuration in your gateway or upstream system, then scan again to verify the result.
+    == Troubleshoot Missing Akamai Findings
+    If a scan completes but results don't appear:
+    * Verify the correlation policy is applied in the same environment as the service instance.
+    * Confirm the target service already exists in *Portfolio* catalogs.
+    * Confirm scanner scope and business group match the service location.
+    * Re-run the scanner after connection or policy changes.
+    == See Also
+    * xref:exp-scanners-add-from-providers.adoc[]
+    * xref:exp-providers-manage.adoc[]
+    * xref:exp-scanners-view-details.adoc[]
+    * xref:exp-scanners-manage.adoc[]

-Original file line number
+Diff line change
@@ Expand Up @@
     == Display Governance Strategies
-    Go to *Governance* > *Governance Strategies* to view all strategies. Check the name, type, status, governed services, and last modified time.
+    Go to *Governance* > *Governance Strategies* to view all strategies. Check the strategy name, type, environment, target, status, governed services count, and last modified time.
     == Available Strategy Actions
@@ Expand All @@
     Use the controls above the table to narrow the list:
-    * Use the strategy type filter to select *All*, *Controls*, or *Automated Policies*.
+    * Use the strategy type tabs to show *All*, *Controls*, or *Automated Policies*.
     * Use the status filter to select *Any Status*, *Active*, or *Disabled*.
     * Enter text in the search field to match strategy names.
@@ Expand All / @@ -35,6 +35,10 @@ Review the summary cards: @@
     Use these cards to spot governance gaps quickly.
+    == Akamai-Generated Strategy
+    When you connect Akamai API Security as a provider, the system automatically creates a pre-configured Akamai security strategy in the strategy list. This strategy attributes Akamai security findings to your MuleSoft APIs and MCP servers. Don't delete it unless you also remove the Akamai scanner. Deleting the strategy stops security findings from appearing in conformance reports.
     == When to Adjust a Strategy
     Edit or disable a strategy when:
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up @@
     * Review conformance reporting for xref:exp-overview.adoc[supported catalog types].
     * Apply policies to services from *Portfolio*. See xref:exp-services-view-details.adoc[].
+    == Akamai Security Findings in Conformance Reports
+    When Akamai API Security is connected as a provider, the *Violations*, *Warnings*, and *Info* counts in the conformance report include Akamai security findings alongside governance rule results. A service can show a *Non-Conformant* status even when no governance rules are violated, if Akamai findings contribute violations.
+    The Conformance tab includes a dedicated Akamai section with two tables:
+    * *Security Findings*: Individual security issues detected by Akamai through live traffic inspection, broken down per instance and per endpoint.
+    * *Incidents*: Recurring threats aggregated over time, with first- and last-seen timestamps and occurrence counts.
+    Both tables have these sortable columns: *Finding*, *Instance*, *Endpoint*, and *Risk*.
+    Akamai severity levels map to conformance tiers as follows:
+    * Critical and High map to violations.
+    * Medium maps to warnings.
+    * Low and Info map to informational findings.
+    The *Severity* filter at the top of the Conformance tab applies to both the governance rule results and the Akamai tables.
+    === Review a Finding
+    Select a row in the *Security Findings* table to open the finding detail panel, which shows:
+    * *Triggered On*: The endpoint path where the issue was detected.
+    * *Risk*: The severity level.
+    * *Exposure*: Whether the endpoint is internet-facing.
+    * *Remediation Opportunities*: Curated recommended policies for this finding type. Select *Apply This Policy* to open the policy-apply flow with the policy pre-selected. Select *Browse in Policy Library* if no curated policy is listed. After a policy is applied, Akamai re-inspects live traffic and updates the finding status automatically.
+    === Review an Incident
+    Select a row in the *Incidents* table to open the incident detail panel, which shows: *Detection Time*, *Type*, *Triggered On*, *Severity*, *Occurrences*, *Exposure*, OWASP tags, and Compliance Frameworks.
+    === Refresh Conformance Results
+    After a scan runs, the API listing and API detail pages don't automatically reflect the updated conformance status. To see the latest results, manually refresh in one of these ways:
+    * Refresh a single API: On the API detail page, open the *Conformance* tab and select *Refresh*.
+    * Refresh all APIs: On the *Governance Strategies* page, select *Refresh Report*.
     == See Also
     * xref:exp-governance-create-strategy.adoc[]
@@ Expand Down @@

-Original file line number
+Diff line change
@@ Expand Up / @@ -15,7 +15,7 @@ Before getting started, make sure you have: @@
     ** Exchange: Exchange Contributor
     ** API Manager: API Creator
     ** API Manager: Manage Policies
-    --
+    --
     +
     For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions].
@@ Expand All @@
     . Sign in to the enhanced experience through your organization's entry point.
     . In the navigation, select *Platform* > *Providers*.
-    The Providers page displays the provider list and scanner lists.
+    The *Providers* page displays the provider list and scanner list.
     == Provider List
@@ Expand All / @@ -49,53 +49,64 @@ The scanner list shows: @@
     == Filter Scanners by Provider
-    To view scanners for a specific provider, select the provider from the sidebar. The scanner list updates to show only scanners configured for that provider. The main panel displays the scanner list.
+    To view scanners for a specific provider, select the provider from the sidebar. The scanner list updates to show only scanners configured for that provider.
     == View Scanner Details
-    To see detailed information about a scanner, including scan history and settings, select the scanner name in the scanner list. The scanner detail page opens with two tabs:
-    Overview::
-    Displays services count, instances count, and scan history. Each scan history entry shows status (Success, Failed), timestamp, and number of new services discovered.
+    To see detailed information about a scanner, including scan history, activity log, and configuration, select the scanner name in the scanner list. The scanner detail page includes *Overview*, *Services*, and *Settings* tabs.
-    Settings::
-    Shows scanner configuration including provider, created date, last scanned time, and services count. Use this tab to modify scanner settings or delete the scanner.
+    For detailed tab behavior and scanner-type differences, see xref:exp-scanners-view-details.adoc[].
     For information about managing scanners, see xref:exp-scanners-manage.adoc[].
+    For Akamai-specific setup and result interpretation, see xref:exp-akamai-risk-correlation.adoc[].
     == Connect a New Provider
     To add a provider connection:
     . From *Platform* > *Providers*, select a provider from the *Not Connected* section.
-    . Follow the connection workflow to authenticate and configure scanner settings.
+    . Follow the connection workflow to authenticate and configure scanner settings. The wizard walks through three steps: *Choose Provider*, *Connect to Provider*, and *Connection Setup*.
     For detailed scanner setup instructions, see xref:exp-scanners-add-from-providers.adoc[].
+    == Akamai API Security Data in Portfolio
+    When Akamai API Security is connected and scans have completed, security risk data appears on the detail pages of scanned APIs:
+    * A *Security Risk* column in the *Instances* tab shows a color-coded risk level per instance: Low, Medium, High, or Critical.
+    * An *Akamai* section in the *Conformance Report* tab shows full findings and incidents from the scan.
+    In list and card views, the numeric value shows Akamai correlation policy coverage (applied policies compared to total required policies), while the color-coded *Security Risk* label (Low, Medium, High, or Critical) shows the severity level of correlated security findings.
     == Supported Providers
     The enhanced experience supports connections to these providers:
+    * Akamai
     * Amazon
     * Anthropic
     * Databricks
-    * GoDaddy ANS
-    * Google Cloud
-    * Kong Konnect
-    * Langchain
+    * GoDaddy
+    * Google
+    * Kong
+    * LangChain
     * Microsoft
     * Snowflake
     [NOTE]
     ====
-    When scanning Kong Konnect, the enhanced experience discovers gateway-level plugin information in addition to services.
+    When scanning Kong, the enhanced experience discovers gateway-level plugin information in addition to services.
+    *Akamai API Security* is available only when your administrator has enabled the feature for your organization. When enabled, it appears in the *Not Connected* section of the Providers sidebar.
     ====
     The specific providers available depend on your organization's enabled products and enhanced experience configuration.
     == See Also
     * xref:exp-services-connect-providers-to-add.adoc[]
+    * xref:exp-akamai-risk-correlation.adoc[]
+    * xref:exp-scanners-view-details.adoc[]
     * xref:exp-scanners-add-from-providers.adoc[]
     * xref:exp-scanners-manage.adoc[]
     * xref:exp-services-add-to-portfolio.adoc[]

Navigation Menu

Uh oh!

W-23349163 akamai scanner ga jh #498

Uh oh!

Diff view

Diff view

There are no files selected for viewing

sparshagarwal-nonemu Jul 30, 2026

Uh oh!

JennyHajee Jul 31, 2026

Uh oh!

Uh oh!

Uh oh!

W-23349163 akamai scanner ga jh #498

Uh oh!

W-23349163 akamai scanner ga jh #498

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

sparshagarwal-nonemu Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

JennyHajee Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!