diff --git a/modules/ROOT/nav.adoc b/modules/ROOT/nav.adoc index ae8df838..457dba10 100644 --- a/modules/ROOT/nav.adoc +++ b/modules/ROOT/nav.adoc @@ -22,14 +22,17 @@ *** xref:model-proxy-semantic-service.adoc[] *** xref:model-proxy-token-reports.adoc[] *** xref:model-proxy-try-out.adoc[] + ** xref:exp-akamai-risk-correlation.adoc[] ** xref:exp-scanners-add-from-providers.adoc[] *** xref:exp-scanners-manage.adoc[] + ** xref:exp-scanners-prerequisites-reference.adoc[] + ** xref:exp-scanners-view-details.adoc[] ** xref:exp-providers-manage.adoc[] ** xref:exp-instances-add.adoc[] ** xref:exp-governance-work-with-strategies.adoc[] - *** xref:exp-governance-create-strategy.adoc[] - *** xref:exp-governance-manage-strategies.adoc[] - *** xref:exp-governance-view-cost-and-token-usage.adoc[] + *** xref:exp-governance-create-strategy.adoc[] + *** xref:exp-governance-manage-strategies.adoc[] + *** xref:exp-governance-view-cost-and-token-usage.adoc[] ** xref:exp-services-monitoring.adoc[] ** xref:exp-services-view-detailed-metrics.adoc[] ** xref:exp-alerts-configure-notifications.adoc[] diff --git a/modules/ROOT/pages/exp-akamai-risk-correlation.adoc b/modules/ROOT/pages/exp-akamai-risk-correlation.adoc new file mode 100644 index 00000000..1341b951 --- /dev/null +++ b/modules/ROOT/pages/exp-akamai-risk-correlation.adoc @@ -0,0 +1,132 @@ += Using Akamai for Risk Correlation +:keywords: akamai api security scanner, akamai integration, security risk, vulnerability findings, incident correlation, portfolio catalogs + +Use Akamai for risk correlation to map external security findings to the right services in *Portfolio*. Teams get one view to triage risk, track incidents, and remediate faster. To enable this correlation, configure an Akamai API Security scanner that connects your Akamai account, runs scheduled scans, and surfaces mapped findings on related services in *Portfolio*. The scanner does not import or register third-party services. It correlates risk scores, findings, and incidents for APIs and MCP services in one governance workflow. + +The integration relies on a bidirectional sync between your MuleSoft and Akamai API Security tenants: you connect the two tenants with credentials in each direction, Akamai reads your API assets and instances from MuleSoft so it can match its security observations to the correct APIs, and the scanner pulls the resulting findings and incidents back into *Portfolio*. + +== How Akamai Scanner Differs from Import Scanners + +Most provider scanners discover metadata in external platforms and import services into *Portfolio* catalogs. The Akamai API Security scanner works differently. It enriches existing services with security data from Akamai instead of creating new services. + +== Before You Begin + +Before setting up the Akamai scanner, make sure you have: + +* Exchange Administrator permission in the target business group. +* Akamai Security base URL, client ID, and client secret. +* Access to apply Akamai correlation policy in the environments you want to scan. +* Existing APIs and MCP services in *Portfolio* catalogs for correlation targets. + +For credential and role details, see xref:exp-scanners-prerequisites-reference.adoc[]. + +== Set Up Tenant Connectivity + +The integration uses a bidirectional sync between your MuleSoft tenant and your Akamai API Security tenant. You provision and configure both tenants. Each MuleSoft customer tenant (root organization) connects to one Akamai API Security tenant (for example, `mulesoft-partner.example.com`). + +Setup involves credentials in both directions: + +* A *service account* in Akamai, which you configure on the MuleSoft side so the scanner can read findings and incidents from Akamai. +* A *connected app* in MuleSoft, which you configure on the Akamai side so Akamai can pull API asset and instance information from MuleSoft. + +Complete these steps as an organization administrator: + +. *Create a service account in Akamai API Security.* In your Akamai API Security tenant, create a service account and note its client ID, client secret, and organization ID. +. *Configure the scanner in MuleSoft.* Add an Akamai scanner and enter the Akamai service account credentials (client ID, client secret, and organization ID) and the Akamai base URL, along with a scan frequency. See <>. +. *Create a connected app in MuleSoft.* In Anypoint Platform, go to *Access Management* > *Connected Apps* and create an app that acts on its own behalf (client credentials). Add the *Exchange Viewer* or *Asset Viewer* scope so Akamai can read API instance and asset information, then save. Copy the client ID and client secret. +. *Configure the Akamai-side sync.* In your Akamai API Security tenant, enter the MuleSoft connected app client ID and client secret so Akamai can pull API asset and instance information from MuleSoft. + +== Set Up the Akamai Scanner + +Before you set up the scanner, review the prerequisites for Akamai scanners in xref:exp-scanners-prerequisites-reference.adoc[]. + +. From *Platform* > *Providers*, select *Akamai*. +. Enter connection values, and test the connection. +. Enter scanner metadata, such as scanner name, description, frequency, and time. +. Apply the Akamai correlation policy to selected environments. +. Save the scanner and run a discovery scan. + +== How the Sync Works + +After both tenants are connected, data flows in two directions: + +MuleSoft to Akamai:: +Akamai periodically pulls API instance and asset information from MuleSoft (typically every few hours) and adds it to its API security inventory. Akamai correlates these API instances with the north-south traffic it observes, so it can attach MuleSoft context — such as organization ID, environment ID, and API instance ID — to the endpoints it monitors. The pull runs at the root organization level. + +Akamai to MuleSoft:: +The scanner pulls security findings and incidents from Akamai on the schedule you set, then correlates and stores them so they appear on the related services in *Portfolio*. + +For Akamai to observe and correlate traffic, the Akamai correlation policy must be applied to your API instances. This out-of-the-box policy (for Flex Gateway and Mule gateways) stamps correlation headers on API responses so Akamai can match observed traffic to the correct MuleSoft API. Akamai observes north-south traffic only for domains you own and control; MuleSoft-owned domains such as `cloudhub.io` are excluded. + +== Review Scanner Detail Tabs + +After you select a configured Akamai scanner from the provider list, use scanner detail tabs to monitor scanner status, related services, and configuration values. + +For common tab behavior across scanners, see xref:exp-scanners-view-details.adoc[]. +For Akamai scanners, the *Overview* tab highlights correlation policy status and shows whether existing services are being updated with Akamai risk, findings, and incident data. +The *Services* tab lists services associated with the scanner and shows which existing services are receiving correlated Akamai security data. +The *Settings* tab shows scanner configuration values, including schedule and provider connection values, and provides options to edit or delete the scanner. + +== Apply Missing Correlation Policies + +If some environments show that correlation policy isn't applied, you can apply missing policies from the scanner detail page: + +. Open *Platform* > *Providers* and select the configured Akamai scanner. +. In *Overview*, check the *Akamai Correlation Policy* status. +. If status shows missing environments, click *Check again* to apply policy only to those environments. +. Wait for status to change to *Applied* and confirm all target environments are covered. + +If policy application fails, verify your Admin API write permissions and environment access, then retry. + +== Where Security Results Appear + +After a successful run, Akamai results appear on existing services: + +* API list views show values in the *Security Risk* column. +* API detail pages show Akamai security data in *Conformance*. +* Security sections display violation totals, findings, incidents, and endpoint context. +* Finding detail views show fields such as status, type, endpoint path, and mapped frameworks. + +== Interpret Risk Status Levels + +The *Security Risk* column shows the risk level assigned to correlated Akamai findings: + +Low:: +Lower urgency risk. Review and remediate in your normal security lifecycle. + +Medium:: +Moderate risk. Prioritize remediation after high-risk issues. + +High:: +Elevated risk. Investigate and remediate first. + +Critical:: +Highest urgency risk. Remediate immediately. + +== Remediate Risks from the API Conformance Tab + +Use the API *Conformance* tab in *Portfolio* to triage and remediate Akamai findings: + +. Open the API from the *APIs* catalog in *Portfolio*. +. Select *Conformance* and review the *Akamai* section, including findings and incidents. +. Select a finding to open details, such as endpoint, severity, and mapped standards. +. Apply recommended remediation policies directly from the finding detail view when available. +. Re-run the scanner after remediation to confirm updated findings and risk levels. + +If no direct remediation policy is available for a finding, use the finding details to update the API configuration in your gateway or upstream system, then scan again to verify the result. + +== Troubleshoot Missing Akamai Findings + +If a scan completes but results don't appear: + +* Verify correlation policy is applied in the same environment as the service instance. +* Confirm the target service already exists in *Portfolio* catalogs. +* Confirm scanner scope and business group match the service location. +* Re-run the scanner after connection or policy changes. + +== See Also + +* xref:exp-scanners-add-from-providers.adoc[] +* xref:exp-providers-manage.adoc[] +* xref:exp-scanners-view-details.adoc[] +* xref:exp-scanners-manage.adoc[] diff --git a/modules/ROOT/pages/exp-governance-manage-strategies.adoc b/modules/ROOT/pages/exp-governance-manage-strategies.adoc index 129d17a3..6cd55811 100644 --- a/modules/ROOT/pages/exp-governance-manage-strategies.adoc +++ b/modules/ROOT/pages/exp-governance-manage-strategies.adoc @@ -5,7 +5,7 @@ Keep governance strategies aligned with your portfolio by adjusting scope, rules == Display Governance Strategies -Go to *Governance* > *Governance Strategies* to view all strategies. Check the name, type, status, governed services, and last modified time. +Go to *Governance* > *Governance Strategies* to view all strategies. Check the strategy name, type, environment, target, status, governed services count, and last modified time. == Available Strategy Actions @@ -19,7 +19,7 @@ Go to *Governance* > *Governance Strategies* to view all strategies. Check the n Use the controls above the table to narrow the list: -* Use the strategy type filter to select *All*, *Controls*, or *Automated Policies*. +* Use the strategy type tabs to show *All*, *Controls*, or *Automated Policies*. * Use the status filter to select *Any Status*, *Active*, or *Disabled*. * Enter text in the search field to match strategy names. @@ -35,6 +35,10 @@ Review the summary cards: Use these cards to spot governance gaps quickly. +== Akamai-Generated Strategy + +When you connect Akamai API Security as a provider, the system automatically creates a pre-configured Akamai security strategy in the strategy list. This strategy attributes Akamai security findings to your MuleSoft APIs and MCP servers. Don't delete it unless you also remove the Akamai scanner. Deleting the strategy stops security findings from appearing in conformance reports. + == When to Adjust a Strategy Edit or disable a strategy when: diff --git a/modules/ROOT/pages/exp-governance-work-with-strategies.adoc b/modules/ROOT/pages/exp-governance-work-with-strategies.adoc index 382d8d1a..49fda78d 100644 --- a/modules/ROOT/pages/exp-governance-work-with-strategies.adoc +++ b/modules/ROOT/pages/exp-governance-work-with-strategies.adoc @@ -38,6 +38,38 @@ Work with your governance lead when strategy changes affect production or compli * Review conformance reporting for xref:exp-overview.adoc[supported catalog types]. * Apply policies to services from *Portfolio*. See xref:exp-services-view-details.adoc[]. +== Akamai Security Findings in Conformance Reports + +When Akamai API Security is connected as a provider, the *Violations*, *Warnings*, and *Info* counts in the conformance report include Akamai security findings alongside governance rule results. A service can show a *Non-Conformant* status even when no governance rules are violated, if Akamai findings contribute violations. + +The Conformance tab includes a dedicated Akamai section with two tables: + +* *Security Findings*: Individual security issues detected by Akamai through live traffic inspection, broken down per instance and per endpoint. +* *Incidents*: Recurring threats aggregated over time, with first- and last-seen timestamps and occurrence counts. + +Both tables have these sortable columns: *Finding*, *Instance*, *Endpoint*, and *Risk*. + +Akamai severity levels map to conformance tiers as follows: + +* Critical and High map to violations. +* Medium maps to warnings. +* Low and Info map to informational findings. + +The *Severity* filter at the top of the Conformance tab applies to both the governance rule results and the Akamai tables. + +=== Review a Finding + +Select a row in the *Security Findings* table to open the finding detail panel, which shows: + +* *Triggered On*: The endpoint path where the issue was detected. +* *Risk*: The severity level. +* *Exposure*: Whether the endpoint is internet-facing. +* *Remediation Opportunities*: Curated recommended policies for this finding type. Select *Apply This Policy* to open the policy-apply flow with the policy pre-selected. Select *Browse in Policy Library* if no curated policy is listed. After a policy is applied, Akamai re-inspects live traffic and updates the finding status automatically. + +=== Review an Incident + +Select a row in the *Incidents* table to open the incident detail panel, which shows: *Detection Time*, *Type*, *Triggered On*, *Severity*, *Occurrences*, *Exposure*, OWASP tags, and Compliance Frameworks. + == See Also * xref:exp-governance-create-strategy.adoc[] diff --git a/modules/ROOT/pages/exp-providers-manage.adoc b/modules/ROOT/pages/exp-providers-manage.adoc index 5e295b5c..7dd211e1 100644 --- a/modules/ROOT/pages/exp-providers-manage.adoc +++ b/modules/ROOT/pages/exp-providers-manage.adoc @@ -15,7 +15,7 @@ Before getting started, make sure you have: ** Exchange: Exchange Contributor ** API Manager: API Creator ** API Manager: Manage Policies --- +-- + For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. @@ -24,7 +24,7 @@ For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experien . Sign in to the enhanced experience through your organization's entry point. . In the navigation, select *Platform* > *Providers*. -The Providers page displays the provider list and scanner lists. +The Providers page displays the provider list and scanner list. == Provider List @@ -53,42 +53,51 @@ To view scanners for a specific provider, select the provider from the sidebar. == View Scanner Details -To see detailed information about a scanner, including scan history and settings, select the scanner name in the scanner list. The scanner detail page opens with two tabs: - -Overview:: -Displays services count, instances count, and scan history. Each scan history entry shows status (Success, Failed), timestamp, and number of new services discovered. +To see detailed information about a scanner, including scan history and configuration, select the scanner name in the scanner list. The scanner detail page includes *Overview*, *Services*, and *Settings* tabs. -Settings:: -Shows scanner configuration including provider, created date, last scanned time, and services count. Use this tab to modify scanner settings or delete the scanner. +For detailed tab behavior and scanner-type differences, see xref:exp-scanners-view-details.adoc[]. For information about managing scanners, see xref:exp-scanners-manage.adoc[]. +For Akamai-specific setup and result interpretation, see xref:exp-akamai-risk-correlation.adoc[]. == Connect a New Provider To add a provider connection: . From *Platform* > *Providers*, select a provider from the *Not Connected* section. -. Follow the connection workflow to authenticate and configure scanner settings. +. Follow the connection workflow to authenticate and configure scanner settings. The wizard walks through three steps: *Choose Provider*, *Connect to Provider*, and *Connection Setup*. For detailed scanner setup instructions, see xref:exp-scanners-add-from-providers.adoc[]. +== Akamai API Security Data in Portfolio + +When Akamai API Security is connected and scans have completed, security risk data appears on the detail pages of scanned APIs: + +* A *Security Risk* column in the *Instances* tab shows a color-coded risk level per instance: Low, Medium, High, or Critical. +* An *Akamai* section in the *Conformance Report* tab shows full findings and incidents from the scan. + +In list and card views, the numeric value shows Akamai correlation policy coverage (applied policies compared to total required policies), while the color-coded *Security Risk* label (Low, Medium, High, or Critical) shows the severity level of correlated security findings. + == Supported Providers The enhanced experience supports connections to these providers: +* Akamai * Amazon * Anthropic * Databricks -* GoDaddy ANS -* Google Cloud -* Kong Konnect -* Langchain +* GoDaddy +* Google +* Kong +* LangChain * Microsoft * Snowflake [NOTE] ==== -When scanning Kong Konnect, the enhanced experience discovers gateway-level plugin information in addition to services. +When scanning Kong, the enhanced experience discovers gateway-level plugin information in addition to services. + +*Akamai API Security* is available only when your administrator has enabled the feature for your organization. When enabled, it appears in the *Not Connected* section of the Providers sidebar. ==== The specific providers available depend on your organization's enabled products and enhanced experience configuration. @@ -96,6 +105,8 @@ The specific providers available depend on your organization's enabled products == See Also * xref:exp-services-connect-providers-to-add.adoc[] +* xref:exp-akamai-risk-correlation.adoc[] +* xref:exp-scanners-view-details.adoc[] * xref:exp-scanners-add-from-providers.adoc[] * xref:exp-scanners-manage.adoc[] * xref:exp-services-add-to-portfolio.adoc[] diff --git a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc index 8a18607b..ba23ab39 100644 --- a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc +++ b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc @@ -20,6 +20,7 @@ Before getting started, make sure you have: -- + For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. +For provider-specific roles, credentials, and permission scopes, see xref:exp-scanners-prerequisites-reference.adoc[]. == Benefits of Provider Scanners @@ -43,11 +44,35 @@ Start from the general *Add Services* area and choose the path that connects a p * *Providers* + Use the area dedicated to provider and scanner management if your navigation includes it. Add or refine scanners alongside other provider work. ++ +The Akamai API Security scanner does not import services; it scans third-party provider security policies and surfaces vulnerability findings for related APIs, agents, and MCP services already in *Portfolio* catalogs. * *Portfolio* + -Open the catalog that matches the service type you want (*Agents*, *APIs*, *MCP Servers*, and others your tenant supports). Use that catalog's add control—the label indicates the type (for example *Add API*)—then choose provider connection to scan and discover services to add to that catalog. +Open the catalog that matches the service type you want (*Agents*, *APIs*, *MCP Servers*, and others your tenant supports). Use that catalog's add control—the label indicates the type (for example *Add API*)—then choose provider connection to scan and discover services to add to that catalog. Not all services have a catalog. If the service doesn't have a catalog, you can still add it to the system by using the *Add Service* button on the *Providers* page. + + +include::_partials/exp-navigation-labels.adoc[tag=ExpNavigationLabels] + + +== Akamai API Security Scanner + +The Akamai API Security scanner behaves differently from import-based scanners. It does not discover and import services from third-party providers into *Portfolio* catalogs. Instead, it scans third-party provider security policies and observed security data, correlates those results to existing services, and surfaces risk scores and vulnerability findings in related *Portfolio* catalogs. *Akamai API Security* appears in the provider list only when your administrator has enabled the Akamai API Security feature for your organization. + +When you save an Akamai API Security scanner, the system automatically starts *Akamai Correlation Policy* application. This policy is required for Akamai to attribute security findings to your MuleSoft APIs by stamping correlation headers on API responses. + +For setup details, policy behavior, and result interpretation, see xref:exp-akamai-risk-correlation.adoc[]. + +=== Monitor Correlation Policy Status + +After creating an Akamai scanner, the scanner detail page shows an *Akamai Correlation Policy* section with the live policy application status: + +* *Correlation policy not applied* — amber warning with an *Apply policy now* button. +* Partial — a progress indicator showing how many environments are covered while the apply workflow runs. +* *Applied* — green badge confirming all environments are covered. + +When the policy is applied, the section shows a table with one row per (environment, runtime) combination. Columns: Environment, Runtime (Flex Gateway or Mule 4), Status (Applied or Disabled), APIM Policy ID, and Asset Version. -include::partial$exp-navigation-labels.adoc[tag=ExpNavigationLabels] +If some environments show no policy binding, select *Check again* to retry the policy application for those environments only. The operation is safe to repeat. == Scanner Configuration Overview @@ -61,6 +86,8 @@ For ongoing operations (pause, edit, or delete), see xref:exp-scanners-manage.ad == See Also +* xref:exp-scanners-prerequisites-reference.adoc[] +* xref:exp-akamai-risk-correlation.adoc[] * xref:exp-services-connect-providers-to-add.adoc[] * xref:exp-scanners-manage.adoc[] * xref:exp-services-add-to-portfolio.adoc[] diff --git a/modules/ROOT/pages/exp-scanners-manage.adoc b/modules/ROOT/pages/exp-scanners-manage.adoc index f5a8685d..aa6a4668 100644 --- a/modules/ROOT/pages/exp-scanners-manage.adoc +++ b/modules/ROOT/pages/exp-scanners-manage.adoc @@ -5,21 +5,26 @@ After you configure scanners, you run them day to day. Most of that work happens == Available Scanner Actions -* Run discovery on demand. +* *Run Discovery Scan* + Start a manual scan when you want fresh metadata without waiting for the next scheduled window. Successful runs update or add services in the matching *Portfolio* catalogs according to your rules. -* Review status and history. +* *View Scanner* + Inspect connection health, the last completed run, and scan history to verify whether discovery is healthy, slow, or failing authentication. -* Pause scheduled scans. +* *Pause Scheduled Runs* + Temporarily stop scheduled triggers when you need a quiet period—for example during maintenance or while you fix credentials—without deleting the scanner. -* Edit configuration. +* *Resume Scheduled Runs* + -Change names, descriptions, credentials, provider scope, or scan-related settings your product exposes, then save so future runs use the new definition. -* Delete a scanner. +Re-enable scheduled scanning after a pause. +* *Scanner Settings* ++ +Change names, descriptions, credentials, provider scope, or scan-related settings your product exposes, then save, so future runs use the new definition. +* *Delete Scanner* + Remove the scanner from *Providers* when the provider link is no longer authorized or useful. Consider the impact on discovered services in *Portfolio* and on dependent teams before you delete the scanner. ++ +NOTE: When you delete an Akamai API Security scanner, the system attempts to remove the Akamai correlation policy from the scanner's environments. If the removal fails, the correlation policy may remain applied; check *Automated Policies* to verify. Discovered services remain in your portfolio regardless. == How Scanners Run diff --git a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc new file mode 100644 index 00000000..77d7deb1 --- /dev/null +++ b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc @@ -0,0 +1,207 @@ += Scanner Prerequisites by Provider +:keywords: scanner prerequisites, exchange scanners, provider scanners, required roles, required credentials, scanner setup + +Scanner prerequisites by provider help you confirm required roles, credentials, and permissions before creating a scanner. Use this reference to prevent connection test failures and incomplete discovery by validating provider-specific access in advance. Each scanner still requires Exchange Administrator permission and the correct business group context. + +== Before You Begin + +Before adding any scanner, make sure you have: + +* Exchange Administrator permission. +* Access to, and active context in, the business group where you want to add the scanner. + +== Scanner Prerequisites Cross-Reference + +[cols="1,1,3",options="header"] +|=== +| Provider +| Scanner Type +| Required Credentials, Roles, and Setup + +| Amazon Bedrock +| Agent +a| +*Credentials:* Access key ID and secret access key; AWS region + +*Permissions:* + +* `bedrock:ListAgents` +* `bedrock:GetAgent` +* `bedrock:ListAgentAliases` +* `bedrock:GetAgentAlias` +* `bedrock:ListAgentVersions` +* `bedrock:GetAgentVersion` + +*Optional (for agent invocation workflows):* + +* `bedrock:InvokeModel` +* `bedrock:InvokeAgent` +* `bedrock:InvokeInlineAgent` + +*Setup:* Agents must have an alias linked to a version and an invocable URL + +| Amazon Bedrock AgentCore Runtime +| Agent +a| +*Credentials:* Access key ID and secret access key; AWS region + +*Account:* Active AWS account with AgentCore access + +*Permissions:* + +* `bedrock-agentcore:ListAgentRuntimes` +* `bedrock-agentcore:ListAgentRuntimeEndpoints` +* `bedrock-agentcore:GetAgentCard` +* `bedrock-agentcore:GetAgentRuntime` +* `bedrock-agentcore:ListAgentRuntimeVersions` +* `bedrock:GetAgent` +* `bedrock:ListAgents` + +*Setup:* Agents must be published with an active endpoint/version + +| Anthropic Claude Managed Agents +| Agent +a| +*Credentials:* Claude API key + +*Account:* Paid Anthropic account + +| Databricks Agent Bricks +| Agent +a| +*Credentials:* Workspace URL; client ID and client secret + +*Account:* Databricks workspace access + +*Permissions:* Service principal `CAN_QUERY` on serving endpoints; `CAN_VIEW` or higher on endpoint metadata APIs + +*Setup:* Discoverable agents must be custom Unity Catalog models in `READY` state + +| GoDaddy ANS +| Agent +a| +*Credentials:* API key and API secret + +| Google Gemini Agent Enterprise Platform +| Agent +a| +*Credentials:* GCP project ID; service account email; private key + +*Role:* Vertex AI Viewer + +| LangChain LangSmith +| Agent +a| +*Credentials:* LangSmith API key; LangSmith workspace ID + +*Account:* LangSmith Plus plan (or higher) workspace + +*Setup:* Optional API host for region routing (for example, US or EU cloud host) + +| Microsoft Azure Copilot +| Agent +a| +*Credentials:* Azure app registration; tenant ID, client ID, client secret + +*Role:* Copilot Studio Scanner + +*Setup:* App added as an Application User in Power Platform; scope set to Dataverse environment URL + +| Microsoft Foundry +| Agent +a| +*Credentials:* Azure app registration; tenant ID, client ID, client secret + +*Account:* Active Azure subscription + +*Role:* Azure AI Developer + +*Setup:* Project endpoint URLs (discovery is project-specific) + +| Snowflake Cortex AI +| Agent +a| +*Credentials:* Snowflake account URL; programmatic access token (PAT) + +*Account:* Snowflake account with Cortex Agents enabled (Enterprise edition) + +*Role:* `ACCOUNTADMIN`, for one-time setup only + +*Setup:* At least one Cortex Agent created in a schema to be scanned; scanner egress IP ranges from your Anypoint deployment team (``) + +| Amazon API Gateway +| API +a| +*Credentials:* Access key ID and secret access key; AWS region + +*Permissions:* IAM read-only policy for API Gateway (for example, `apigateway:GET`) + +| Azure API Management +| API +a| +*Credentials:* Tenant ID; client ID; client secret; subscription ID; resource group; service name + +*Role:* API Management Service Reader + +| Google Apigee +| API +a| +*Credentials:* GCP project ID; service account email; private key + +*Role:* Apigee Read-only Admin + +| Kong Gateway +| API +a| +*Credentials:* Personal access token (PAT); Kong Gateway region + +*Role:* Kong Control Plane Viewer + +| Akamai Security +| API Security +a| +*Credentials:* Akamai Security base URL; client ID; client secret; organization ID + +*Permissions:* Access to create service accounts in Akamai Security; access to apply Akamai correlation policy in target environments + +*Setup:* Existing services in *Portfolio* catalogs for correlation targets; create a connected app in MuleSoft; configure Akamai-side sync with the MuleSoft connected app. For details, see xref:exp-akamai-risk-correlation.adoc[]. + +| Amazon Bedrock AgentCore MCP +| MCP +a| +*Credentials:* Access key ID and secret access key; AWS region + +*Account:* Active AWS account + +*Permissions:* IAM user with an inline policy that allows: + +* `bedrock-agentcore:ListAgentRuntimes` +* `bedrock-agentcore:GetAgentRuntime` +* `bedrock-agentcore:ListAgentRuntimeVersions` +* `bedrock-agentcore:ListAgentRuntimeEndpoints` +* `bedrock-agentcore:InvokeAgentRuntime` + +| Azure API Management MCP Server +| MCP +a| +*Credentials:* Tenant ID; client ID; client secret; subscription ID; resource group; service name + +*Role:* API Management Service Reader + +| Snowflake MCP Server +| MCP +a| +*Credentials:* Snowflake account URL; programmatic access token (PAT) + +*Account:* Snowflake Enterprise account with MCP servers enabled + +*Role:* `ACCOUNTADMIN` + +|=== + +== See Also + +* xref:exp-scanners-add-from-providers.adoc[] +* xref:exp-providers-manage.adoc[] +* xref:exp-scanners-manage.adoc[] +* xref:exp-akamai-risk-correlation.adoc[] diff --git a/modules/ROOT/pages/exp-scanners-view-details.adoc b/modules/ROOT/pages/exp-scanners-view-details.adoc new file mode 100644 index 00000000..7c7f0a7a --- /dev/null +++ b/modules/ROOT/pages/exp-scanners-view-details.adoc @@ -0,0 +1,45 @@ += Viewing Scanner Details +:keywords: scanner detail tabs, scanner overview tab, scanner services tab, scanner settings tab, provider scanners + +View details about a scanner and its scan history by selecting a configured scanner from the provider list. Scanner details show information about the provider, when it was created, last completed scan, and scan history. After you select a configured scanner, use *Overview*, *Services*, and *Settings* tabs to review scanner state and configuration, noting that tab content varies by scanner type and provider capabilities. + +== Open Scanner Detail Tabs + +. From *Platform* > *Providers*, open a connected provider. +. Select a configured scanner from the scanner list. +. Use the tabs to review scanner results and configuration. + +== Overview Tab + +Use *Overview* to check scanner summary information, such as: + +* Services and instances counts. +* Scan history and run status. +* Last scan time and scanner health indicators. + +For Akamai API Security scanners, the overview represents correlation and security enrichment activity for existing services. Akamai scanners don't import new services. + +== Services Tab + +Use *Services* to review services linked to the scanner and open service details for investigation. The tab reflects scanner-managed output for those services. + +For import scanners, this tab reflects discovered services imported by scan runs. For Akamai API Security scanners, it reflects existing services associated with correlated security data. + +== Settings Tab + +Use *Settings* to review and update scanner configuration values, such as provider connection details, run schedule, and scanner metadata. You can also delete the scanner from this tab. + +== How Tab Content Varies by Scanner Type + +Import scanners:: +Show imported discovery activity in scanner tabs, including newly discovered services. + +Akamai API Security scanner:: +Shows correlation and governance enrichment activity for existing services, including risk and findings signals. + +== See Also + +* xref:exp-providers-manage.adoc[] +* xref:exp-scanners-add-from-providers.adoc[] +* xref:exp-akamai-risk-correlation.adoc[] +* xref:exp-scanners-manage.adoc[] diff --git a/modules/ROOT/pages/exp-services-add-to-portfolio.adoc b/modules/ROOT/pages/exp-services-add-to-portfolio.adoc index 0ae22df8..2210a678 100644 --- a/modules/ROOT/pages/exp-services-add-to-portfolio.adoc +++ b/modules/ROOT/pages/exp-services-add-to-portfolio.adoc @@ -10,6 +10,9 @@ Your *Portfolio* is organized into catalogs: *Agents*, *MCP Servers*, *Model Pro |xref:exp-services-connect-providers-to-add.adoc[] |You add a provider scanner from *Home* or from a catalog in *Portfolio*. Scans discover services on supported cloud platforms and register them in the matching catalog. +|xref:exp-akamai-risk-correlation.adoc[] +|Akamai API Security scanner does not import or register services. It correlates Akamai security data to existing services and surfaces risk scores, findings, and incidents in catalog views. + |xref:exp-services-register-manually.adoc[] |You start an *Add …* workflow from *Home* or from the catalog for that service type. You supply metadata, specifications, endpoints, or cards to register the service without a provider scanner. |=== @@ -63,6 +66,8 @@ For more information about registering any of these types, see xref:exp-services == See Also +* xref:exp-scanners-prerequisites-reference.adoc[] +* xref:exp-akamai-risk-correlation.adoc[] * xref:exp-services-connect-providers-to-add.adoc[] * xref:exp-services-register-manually.adoc[] * xref:exp-scanners-add-from-providers.adoc[] diff --git a/modules/ROOT/pages/exp-services-view-details.adoc b/modules/ROOT/pages/exp-services-view-details.adoc index 74584ec6..a9a86ba5 100644 --- a/modules/ROOT/pages/exp-services-view-details.adoc +++ b/modules/ROOT/pages/exp-services-view-details.adoc @@ -33,7 +33,7 @@ The page is organized into tabs. The following table lists each tab, what it sho |Yes |Yes |Yes |Yes |Yes |*Instances* -|Deployed instances, environments (for example production or sandbox), and gateways when that catalog type supports instances. +|Deployed instances, environments (for example production or sandbox), and gateways when that catalog type supports instances. When Akamai API Security is enabled and scan data is available for this service, the table also shows a *Security Risk* column with a color-coded risk level per instance (Low, Medium, High, or Critical). Risk levels are per-instance — the same API can show different risk levels across environments. |Yes |Yes |Yes |Each Model Proxy is exactly one instance so there is no *Instances* tab. |No |*Policies* @@ -44,8 +44,8 @@ The page is organized into tabs. The following table lists each tab, what it sho |Runtime metrics and analytics for health and usage when the system surfaces them for the service or gateway you are viewing. |Yes |Yes |Yes |Yes |No -|*Conformance Report* -|Compliance score and rule-level analysis for conformance reporting where that tab is available. +|*Conformance* +|Compliance score and rule-level analysis for conformance reporting where that tab is available. When Akamai API Security is enabled, the tab includes an *Akamai* section with a risk score overview, a findings table (endpoint-level vulnerabilities with severity, OWASP API Top-10 tags, and compliance framework tags), and an incidents table (aggregated security incidents). Select a finding to view details and see recommended remediation policies you can apply directly from this page. |Yes |Yes |Yes |No |No |=== @@ -53,7 +53,7 @@ The page is organized into tabs. The following table lists each tab, what it sho ==== * *Instances* tab is available on *Agents*, *MCP Servers*, and *APIs*; *Model Proxies* and *Gateways* do not include an *Instances* tab. See xref:exp-overview.adoc[]. -* *Conformance Report* on the detail page aligns with *Agents*, *APIs*, and *MCP Servers*; for gateways, compliance work is framed through *Governance* and related flows at the scope the system supports. See xref:exp-overview.adoc[]. +* *Conformance* on the detail page aligns with *Agents*, *APIs*, and *MCP Servers*; for gateways, compliance work is framed through *Governance* and related flows at the scope the system supports. See xref:exp-overview.adoc[]. ==== == Open a Service Detail Page