--- schema_version: "1" id: 3399a73e54d4d92f5942b482a2ef3a3f93decc9003b0c766e32e4a30b963f617 title: Correlating Risk Using Akamai API Security collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/general/exp-akamai-risk-correlation.md canonical_url: https://docs.mulesoft.com/general/exp-akamai-risk-correlation source_site: docs.mulesoft.com content_type: documentation content_hash: ff7d171fff4cd6a79ac9b19177e930af24c9cc819c7f931558cb82c419d7af25 description: MuleSoft Documentation Site latest: true --- --- product: Getting Started keywords: akamai api security scanner, akamai integration, security risk, vulnerability findings, incident correlation, portfolio catalogs --- # Correlating Risk Using Akamai API Security > For the full documentation index, see: https://docs.mulesoft.com/llms.txt Use Akamai for risk correlation to map external security findings to the right services in **Portfolio**. Teams get one view to triage risk, track incidents, and remediate faster. To enable this correlation, configure an Akamai API Security scanner that connects your Akamai account, runs scheduled scans, and surfaces mapped findings on related services in **Portfolio**. The scanner doesn’t import or register third-party services. It correlates risk scores, findings, and incidents for APIs and MCP services in one governance workflow. The integration relies on a bidirectional sync between your MuleSoft and Akamai API Security tenants. You connect the two tenants with credentials in each direction: Akamai reads your API assets and instances from MuleSoft so it can match its security observations to the correct APIs, and the scanner pulls the resulting findings and incidents back into **Portfolio**. ## Akamai Scanner vs. Import Scanners Most provider scanners discover metadata in external platforms and import services into **Portfolio** catalogs. The Akamai API Security scanner works differently: instead of creating new services, it enriches existing ones with Akamai security data. ## Before You Begin Before setting up the Akamai scanner, make sure you have: - Exchange Administrator permission in the target business group. - Akamai Security base URL, client ID, and client secret. - Access to apply the Akamai correlation policy in the environments you want to scan. - Existing APIs and MCP services in **Portfolio** catalogs for correlation targets. For credential and role details, see [Scanner Prerequisites by Provider](https://docs.mulesoft.com/general/exp-scanners-prerequisites-reference). ## Monitor Traffic Through Omni Gateway Akamai observes traffic at the Akamai edge, which is traffic between external clients and your APIs on domains you own and control. To also have Akamai analyze traffic that passes through Omni Gateway but isn’t inspected at the Akamai edge, apply the **Akamai API Security (Omni Gateway)** policy to your API instances. This traffic includes: - Internal traffic between services (east-west traffic). - External traffic to endpoints you can’t register at the Akamai edge, such as MuleSoft-managed CloudHub endpoints. The policy forwards this traffic to Akamai API Security in asynchronous batches. Forwarding doesn’t block requests. If the Akamai engine is unavailable, forwarding fails open and your API traffic isn’t affected. Akamai owns and maintains this policy, and it’s separate from the Akamai correlation policy that the scanner applies. For findings from forwarded traffic to appear on the related API in **Portfolio**, apply both policies to the API instance. The correlation policy adds the correlation data that Akamai uses to match a finding to its API, and the Akamai API Security (Omni Gateway) policy forwards that data with the traffic it captures. You create the policy in Akamai API Security, publish it to Anypoint Exchange, and apply it to your APIs in Anypoint API Manager. > [!IMPORTANT] To monitor traffic, set `PREVENTION_ENABLED` to `false` when you apply the policy. In > this capture-only configuration, the policy forwards traffic for analysis without blocking > requests. > > The policy can also block requests from attackers that Akamai API Security detects and return a > `403` response. Blocking is an opt-in control that runs synchronously in the request path, so > Akamai engine availability and the policy’s timeout settings can affect your API traffic. Before > you enable prevention, review the policy parameters in the Akamai documentation. ### Before You Apply the Policy Make sure you have: - API instances that run on Omni Gateway. - The Akamai correlation policy applied to those API instances. See [Set Up the Akamai Scanner](#set-up-the-akamai-scanner). - Network access from Omni Gateway to your Akamai API Security engine over HTTPS. - The Admin role in Akamai API Security with the Traffic Source & Prevention permission. - Permission to publish assets to Anypoint Exchange and apply policies in Anypoint API Manager. - Anypoint CLI with the PDK plugin, Node.js, and Rust installed on the machine where you install the policy. See [Prerequisites for Omni Gateway Policy Development Kit (PDK)](https://docs.mulesoft.com/pdk/latest/policies-pdk-prerequisites). ### Apply the Policy 1. In Akamai API Security, create a MuleSoft traffic source integration for Omni Gateway, and then download the policy. For instructions, see [MuleSoft Omni Gateway - Source and Prevention Integration](https://docs.nonamesecurity.com/docs/mulesoft-omni-gateway-source-and-prevention-integration) in the Akamai documentation. 2. In Anypoint Platform, create a connected app that acts on its own behalf (client credentials) with the **Exchange Contributor** scope, and then copy the client ID and client secret. This connected app is separate from the one Akamai uses to read API assets from MuleSoft. For instructions, see [Creating Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/creating-connected-apps-dev). 3. Configure Anypoint CLI with the connected app credentials, your business group ID, and your environment ID, and then run the installation script included in the policy download. The script publishes the policy to Anypoint Exchange. For the commands, see "Step 4: Deploy the Policy" in [MuleSoft Omni Gateway - Source and Prevention Integration](https://docs.nonamesecurity.com/docs/mulesoft-omni-gateway-source-and-prevention-integration) in the Akamai documentation. 4. In Anypoint API Manager, apply the **Akamai API Security (Omni Gateway)** policy in one of these ways: - To apply the policy to all APIs in an environment, add it as an automated policy. In **Advanced Options**, set **Rule of application** to **Omni gateways only**. See [Applying Automated Inbound Policies](https://docs.mulesoft.com/gateway/latest/policies-automated-applying). - To apply the policy to specific APIs, add it as an inbound policy on each API. To capture traffic without blocking requests, set `PREVENTION_ENABLED` to `false`. For instructions, see "Step 5: Apply the Policy" in [MuleSoft Omni Gateway - Source and Prevention Integration](https://docs.nonamesecurity.com/docs/mulesoft-omni-gateway-source-and-prevention-integration) in the Akamai documentation. 5. Move the **Akamai API Security (Omni Gateway)** policy to the top of the policy list, above the Akamai correlation policy. With this order, the correlation policy adds correlation data to the response before the Akamai API Security (Omni Gateway) policy captures it. If the order is reversed, Akamai receives the traffic without correlation data, so findings from that traffic don’t appear on the related API in **Portfolio**. No error is reported. For policy parameters and troubleshooting, see the [Akamai documentation for the MuleSoft Omni Gateway integration](https://docs.nonamesecurity.com/docs/mulesoft-omni-gateway-source-and-prevention-integration). You need an Akamai account to view this documentation. ## Set Up Tenant Connectivity The integration uses a bidirectional sync between your MuleSoft tenant and your Akamai API Security tenant. You provision and configure both tenants. Each MuleSoft customer tenant (root organization) connects to one Akamai API Security tenant (for example, `.nonamesec.com`). Setup involves credentials in both directions: - A service account in Akamai, which you configure on the MuleSoft side so the scanner can read findings and incidents from Akamai. - A connected app in MuleSoft, which you configure on the Akamai side so Akamai can pull API asset and instance information from MuleSoft. Complete these steps as an organization administrator: 1. Create a service account in Akamai API Security. In your Akamai API Security tenant, create a service account and note its client ID and client secret. 2. Configure the scanner in MuleSoft. Add an Akamai scanner and enter the Akamai service account credentials (client ID and client secret) and the Akamai base URL, along with a scan frequency. See [Set Up the Akamai Scanner](#set-up-the-akamai-scanner). 3. Create a connected app in MuleSoft. In Anypoint Platform, go to **Access Management** > **Connected Apps** and create an app that acts on its own behalf (client credentials). Add the **Exchange Viewer** or **Asset Viewer** scope so Akamai can read API instance and asset information, then save. Copy the client ID and client secret. For instructions, see [Creating Connected Apps in Anypoint Platform](https://docs.mulesoft.com/access-management/creating-connected-apps-dev). 4. Configure the sync on the Akamai side. In your Akamai API Security tenant, enter the MuleSoft connected app client ID and client secret so Akamai can pull API asset and instance information from MuleSoft. ## Set Up the Akamai Scanner Before you set up the scanner, review the prerequisites for Akamai scanners in [Scanner Prerequisites by Provider](https://docs.mulesoft.com/general/exp-scanners-prerequisites-reference). 1. From **Platform** > **Providers**, select **Akamai**. 2. Click **Add Scanner** and enter the connection values. 3. Test the connection. 4. Enter scanner metadata, such as scanner name, description, frequency, and time. 5. Apply the Akamai correlation policy to selected environments. 6. Save the scanner and run a discovery scan. ## How the Sync Works After both tenants are connected, data flows in two directions: MuleSoft to Akamai Akamai periodically pulls API instance and asset information from MuleSoft (typically every few hours) and adds it to its API security inventory. Akamai correlates these API instances with the north-south traffic it observes, so it can attach MuleSoft context — such as organization ID, environment ID, and API instance ID — to the endpoints it monitors. The pull runs at the root organization level. Akamai to MuleSoft The scanner pulls security findings and incidents from Akamai on the schedule you set, then correlates and stores them so they appear on the related services in **Portfolio**. For Akamai to observe and correlate traffic, the Akamai correlation policy must be applied to your API instances. This out-of-the-box policy (for Omni Gateway and Mule gateways) stamps correlation headers on API responses so Akamai can match observed traffic to the correct MuleSoft API. Akamai observes north-south traffic only for domains you own and control. ## Review Scanner Detail Tabs After you select a configured Akamai scanner from the provider list, use the scanner detail tabs to monitor scanner status, related services, and configuration values. For common tab behavior across scanners, see [Viewing Scanner History and Settings](https://docs.mulesoft.com/general/exp-scanners-view-details). For Akamai scanners, the **Overview** tab highlights correlation policy status and shows whether existing services are being updated with Akamai risk, findings, and incident data. The **Services** tab lists services associated with the scanner and shows which existing services are receiving correlated Akamai security data. The **Settings** tab shows scanner configuration values, including schedule and provider connection values, and provides options to edit or delete the scanner. ## Apply Missing Correlation Policies If some environments show that the correlation policy isn’t applied, you can apply missing policies from the scanner detail page: 1. Open **Platform** > **Providers** and select the configured Akamai scanner. 2. In **Overview**, check the **Akamai Correlation Policy** status. 3. If the status shows missing environments, click **Check again** to apply the policy only to those environments. 4. Wait for the status to change to **Applied** and confirm all target environments are covered. If policy application fails, verify your Admin API write permissions and environment access, then retry. ## Reviewing Akamai Security Results in the Enhanced Experience After a successful run, Akamai results appear on existing services: - API list views show values in the **Security Risk** column. - API detail pages show Akamai security data in **Conformance**. - Security sections display violation totals, findings, incidents, and endpoint context. - The **Akamai Security Findings** table lists each finding with columns for finding, instance, endpoint, API risk, scan status, and remediation progress. - Finding detail views show fields such as status, type, endpoint path, and mapped frameworks. ## Interpret Risk Status Levels The **Security Risk** column shows the risk level assigned to correlated Akamai findings: Low Lower-urgency risk. Review and remediate in your normal security lifecycle. Medium Moderate risk. Prioritize remediation after high-risk issues. High Elevated risk. Investigate and remediate first. Critical Highest-urgency risk. Remediate immediately. ## Track Remediation and Scan Status In the **Akamai Security Findings** table on the **Conformance** tab, two columns help you track remediation progress for each finding: Remediation Shows how many of the suggested remediation policies are applied on the finding’s instance, as an _applied/suggested_ count (for example, `1/3 remediations`). The suggested count reflects the remediation policies recommended for that finding type, and the applied count reflects how many of those policies are currently applied on the API instance. This count is tracked at the instance level, so two findings on different endpoints of the same instance that share a finding type show the same count. Scan Status Indicates whether remediation is underway for the finding: Open No remediation policy is applied yet for the finding. Rescan Confirmation At least one remediation policy is applied on the instance, but the finding still appears in the latest results. Re-run the scanner to confirm whether the finding is resolved. > [!NOTE] The **Akamai Security Findings** table lists only findings that are currently active. When > a finding is remediated and a rescan confirms the fix, the finding no longer appears in the table. ## Remediate Risks from the API Conformance Tab Use the API **Conformance** tab in **Portfolio** to triage and remediate Akamai findings: 1. Open the API from the **APIs** catalog in **Portfolio**. 2. Select **Conformance** and review the **Akamai** section, including findings and incidents. 3. Select a finding to open details, such as endpoint, severity, and mapped standards. 4. Apply recommended remediation policies directly from the finding detail view when available. 5. Re-run the scanner after remediation to confirm updated findings and risk levels. If no direct remediation policy is available for a finding, use the finding details to update the API configuration in your gateway or upstream system, then scan again to verify the result. ## Troubleshoot Missing Akamai Findings If a scan completes but results don’t appear: - Verify the correlation policy is applied in the same environment as the service instance. - Confirm the target service already exists in **Portfolio** catalogs. - Confirm scanner scope and business group match the service location. - For traffic forwarded by the Akamai API Security (Omni Gateway) policy, confirm the policy is above the Akamai correlation policy in the policy list. - Re-run the scanner after connection or policy changes. ## See Also - [Securing Services in Your Portfolio](https://docs.mulesoft.com/general/exp-securing-services) - [Adding Scanners from Providers](https://docs.mulesoft.com/general/exp-scanners-add-from-providers) - [Viewing and Managing Provider Connections](https://docs.mulesoft.com/general/exp-providers-manage) - [Viewing Scanner History and Settings](https://docs.mulesoft.com/general/exp-scanners-view-details) - [Running and Managing Scanners](https://docs.mulesoft.com/general/exp-scanners-manage)