From 68bed83389da25fd046ae91c2d83d5f919b33ebf Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 7 Jul 2026 13:51:47 -0300 Subject: [PATCH 1/2] W-23263318 docs: doc-drift review for scanners, providers, services (Akamai branch) From 0819636833d78b6b2bb7449dc115e9c91b868e6e Mon Sep 17 00:00:00 2001 From: Luana Dos Santos Date: Tue, 7 Jul 2026 13:57:04 -0300 Subject: [PATCH 2/2] W-23263318 docs: fix doc drift for scanners, providers, services (Akamai branch) - scanners-add-from-providers: document Akamai correlation policy wizard step, scanner detail policy status section, feature flag prerequisite, retry behavior - providers-manage: add Akamai to supported providers list, add Services tab, add wizard step labels, add downstream risk data note - services-view-details: document Security Risk column in Instances tab and Akamai section in Conformance Report tab (findings, incidents, remediation) - scanners-manage: fix action labels, add Services tab, add Resume Scheduled Runs, add Akamai scanner delete note about correlation policy cleanup Co-Authored-By: Claude Sonnet 4.6 --- modules/ROOT/pages/exp-providers-manage.adoc | 17 ++++++++++-- .../exp-scanners-add-from-providers.adoc | 26 +++++++++++++++++++ modules/ROOT/pages/exp-scanners-manage.adoc | 15 +++++++---- .../ROOT/pages/exp-services-view-details.adoc | 4 +-- 4 files changed, 53 insertions(+), 9 deletions(-) diff --git a/modules/ROOT/pages/exp-providers-manage.adoc b/modules/ROOT/pages/exp-providers-manage.adoc index 5e295b5c6..54b6cf031 100644 --- a/modules/ROOT/pages/exp-providers-manage.adoc +++ b/modules/ROOT/pages/exp-providers-manage.adoc @@ -53,11 +53,14 @@ To view scanners for a specific provider, select the provider from the sidebar. == View Scanner Details -To see detailed information about a scanner, including scan history and settings, select the scanner name in the scanner list. The scanner detail page opens with two tabs: +To see detailed information about a scanner, including scan history and settings, select the scanner name in the scanner list. The scanner detail page opens with three tabs: Overview:: Displays services count, instances count, and scan history. Each scan history entry shows status (Success, Failed), timestamp, and number of new services discovered. +Services:: +Lists all services discovered by this scanner, organized by type: Agents, APIs, MCP Servers, and LLM Proxies. + Settings:: Shows scanner configuration including provider, created date, last scanned time, and services count. Use this tab to modify scanner settings or delete the scanner. @@ -68,14 +71,22 @@ For information about managing scanners, see xref:exp-scanners-manage.adoc[]. To add a provider connection: . From *Platform* > *Providers*, select a provider from the *Not Connected* section. -. Follow the connection workflow to authenticate and configure scanner settings. +. Follow the connection workflow to authenticate and configure scanner settings. The wizard walks through three steps: *Choose Provider*, *Connect to Provider*, and *Connection Setup*. For detailed scanner setup instructions, see xref:exp-scanners-add-from-providers.adoc[]. +== Akamai API Security Data in Portfolio + +When Akamai API Security is connected and scans have completed, security risk data appears on the detail pages of scanned APIs: + +* A *Security Risk* column in the *Instances* tab shows a color-coded risk level per instance: Low, Medium, High, or Critical. +* An *Akamai* section in the *Conformance Report* tab shows full findings and incidents from the scan. + == Supported Providers The enhanced experience supports connections to these providers: +* Akamai API Security * Amazon * Anthropic * Databricks @@ -89,6 +100,8 @@ The enhanced experience supports connections to these providers: [NOTE] ==== When scanning Kong Konnect, the enhanced experience discovers gateway-level plugin information in addition to services. + +*Akamai API Security* is available only when your administrator has enabled the feature for your organization. When enabled, it appears in the *Not Connected* section of the Providers sidebar. ==== The specific providers available depend on your organization's enabled products and enhanced experience configuration. diff --git a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc index 8a18607b4..4309df259 100644 --- a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc +++ b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc @@ -53,6 +53,32 @@ include::partial$exp-navigation-labels.adoc[tag=ExpNavigationLabels] Regardless of entry point, adding a scanner establishes trust and scope. You specify which provider platform to reach, how the system authenticates, and how you validate connectivity. You also name and schedule the scanner—or configure another trigger—so discovery runs on the cadence your team expects. Saving the configuration activates the scanner for the catalogs and features your administrator enabled. +NOTE: *Akamai API Security* appears in the provider list only when your administrator has enabled the Akamai API Security feature for your organization. + +== Akamai API Security Scanner + +When you add an Akamai API Security scanner, the wizard includes a final step — *Apply Akamai Correlation Policy* — after the scanner is saved. This step is required for Akamai to attribute its security findings back to your MuleSoft APIs. The policy stamps two correlation headers on API responses, so Akamai can match its scan results to the right instances. + +In this step: + +. Select the environments to apply the policy across. All environments are selected by default. +. Review the policy artifacts fetched live from Exchange (policy definition, Flex Gateway implementation, and Mule 4 implementation). The policy is zero-config and applies in the response phase only. +. Select *Apply policy & finish* to start the policy application, or *Skip — apply later* to proceed to the scanner detail page and apply from there. + +The time to apply varies by the number of API instances in the selected environments (typically one to six minutes for most organizations). API instances created after the policy is applied are automatically covered — no re-apply is needed. + +=== Monitor Correlation Policy Status + +After creating an Akamai scanner, the scanner detail page shows an *Akamai Correlation Policy* section with the live policy application status: + +* *Correlation policy not applied* — amber warning with an *Apply now* button. +* Partial — a progress indicator showing how many environments are covered while the apply workflow runs. +* *Applied* — green badge confirming all environments are covered. + +When the policy is applied, the section shows a table with one row per (environment, runtime) combination. Columns: Environment, Runtime (Flex Gateway or Mule 4), Status (Applied or Disabled), APIM Policy ID, and Asset Version. + +If some environments show no policy binding, select *Retry N missing* to retry the policy application for those environments only. The operation is safe to repeat. + == After the Scanner Runs When the scanner is active, it applies discovery results according to its settings and your organization's rules. You review outcomes on the *Providers* page and on scanner detail pages, and you manage discovered services from the relevant *Portfolio* catalogs. diff --git a/modules/ROOT/pages/exp-scanners-manage.adoc b/modules/ROOT/pages/exp-scanners-manage.adoc index f5a8685d9..485502d32 100644 --- a/modules/ROOT/pages/exp-scanners-manage.adoc +++ b/modules/ROOT/pages/exp-scanners-manage.adoc @@ -5,21 +5,26 @@ After you configure scanners, you run them day to day. Most of that work happens == Available Scanner Actions -* Run discovery on demand. +* *Run Discovery Scan* + Start a manual scan when you want fresh metadata without waiting for the next scheduled window. Successful runs update or add services in the matching *Portfolio* catalogs according to your rules. * Review status and history. + -Inspect connection health, the last completed run, and scan history to verify whether discovery is healthy, slow, or failing authentication. -* Pause scheduled scans. +Inspect the services count, instances count, and scan history to verify whether discovery is healthy, slow, or failing authentication. +* *Pause Scheduled Runs* + Temporarily stop scheduled triggers when you need a quiet period—for example during maintenance or while you fix credentials—without deleting the scanner. -* Edit configuration. +* *Resume Scheduled Runs* + -Change names, descriptions, credentials, provider scope, or scan-related settings your product exposes, then save so future runs use the new definition. +Re-enable scheduled scanning after a pause. +* *Edit Settings* ++ +Change names, descriptions, credentials, provider scope, or scan-related settings your product exposes, then save, so future runs use the new definition. * Delete a scanner. + Remove the scanner from *Providers* when the provider link is no longer authorized or useful. Consider the impact on discovered services in *Portfolio* and on dependent teams before you delete the scanner. ++ +NOTE: When you delete an Akamai API Security scanner, the system attempts to remove the Akamai correlation policy from the scanner's environments. If the removal fails, the correlation policy may remain applied; check *API Manager* > *Automated Policies* to verify. Discovered services remain in your portfolio regardless. == How Scanners Run diff --git a/modules/ROOT/pages/exp-services-view-details.adoc b/modules/ROOT/pages/exp-services-view-details.adoc index ec3023aa2..20f8c38d4 100644 --- a/modules/ROOT/pages/exp-services-view-details.adoc +++ b/modules/ROOT/pages/exp-services-view-details.adoc @@ -33,7 +33,7 @@ The page is organized into tabs. The following table lists each tab, what it sho |Yes |Yes |Yes |Yes |Yes |*Instances* -|Deployed instances, environments (for example production or sandbox), and gateways when that catalog type supports instances. +|Deployed instances, environments (for example production or sandbox), and gateways when that catalog type supports instances. When Akamai API Security is enabled and scan data is available for this service, the table also shows a *Security Risk* column with a color-coded risk level per instance (Low, Medium, High, or Critical). Risk levels are per-instance — the same API can show different risk levels across environments. |Yes |Yes |Yes |Each LLM Proxy is exactly one instance so there is no *Instances* tab. |No |*Policies* @@ -45,7 +45,7 @@ The page is organized into tabs. The following table lists each tab, what it sho |Yes |Yes |Yes |Yes |No |*Conformance Report* -|Compliance score and rule-level analysis for conformance reporting where that tab is available. +|Compliance score and rule-level analysis for conformance reporting where that tab is available. When Akamai API Security is enabled, the tab includes an *Akamai* section with a risk score overview, a findings table (endpoint-level vulnerabilities with severity, OWASP API Top-10 tags, and compliance framework tags), and an incidents table (aggregated security incidents). Select a finding to view details and see recommended remediation policies you can apply directly from this page. |Yes |Yes |Yes |No |No |===