Hi everyone! I've been tasked with setting up our new Akamai Prolexic reports for the security team, and I'm a bit stuck on the "actionable" part. The dashboard graphs are nice for a high-level view, but our analysts keep asking for data they can actually *do* something with—like lists of blocked IPs to add to our own blocklists, or specific attack patterns tied to our application endpoints.
Right now, I'm pulling data via the Reporting API into a Snowflake table (using a Python script orchestrated with Airflow). I can get the raw logs, but turning them into something useful feels... messy. For example:
* The security team wants a daily digest of top attacking countries, but filtered to only show incidents that targeted our production subnets.
* They also want a simple CSV of suspicious IPs from the last 24 hours that exceeded a certain request threshold, ready for our firewall team.
I've got the connection working, but my SQL queries are getting super complex and the output still needs a lot of manual cleaning. 😅
Has anyone built a similar pipeline? I'm wondering:
* Do you process the raw logs directly, or use a specific Prolexic report type as a starting point?
* How do you structure the data (maybe in a star schema?) to make it easier to slice by our internal assets?
* Any tips on automating the generation of those "ready-to-use" CSV reports?
I'm probably overcomplicating this. Grateful for any pointers or even screenshots of how you've structured your queries or tables!
null