If your organization uses Akamai, you can use HUMAN’s Akamai EdgeWorker Enforcer to protect against malicious behavior. The Enforcer is installed using an Akamai EdgeWorker and deployed to your content delivery network (CDN). The Enforcer dictates how traffic should be handled per your organization’s standards.
You can learn how to install the Akamai EdgeWorker Enforcer with this article.
If your organization uses Akamai ESI, then the Enforcer installation process is slightly different. You can reference this information in our help article.
The Akamai installation consists of three parts. Be sure to complete each part in order.
From your Akamai account’s main menu, navigate to Origin Services > NetStorage > Storage Groups.
Select + Add Storage Group.
Complete the steps that appear to create your storage group. You can update fields as appropriate for your organization or leave them as their defaults. However, note the following exceptions:
If you do not name the directory px, then you will need to update all related rules matching this NetStorage path in the Property Manager with the different directory name that you chose.
Once you’ve uploaded your file, you’re ready to move on to EdgeWorker creation.
From your Akamai account’s main menu, navigate to CDN > EdgeWorkers.
Select Create EdgeWorker ID.
Complete the following fields:
Select Create EdgeWorker ID.
Select the ID of the EdgeWorker you just created.
Select Create Version.
Upload the tgz file provided by HUMAN and select Create version.
From the Actions menu, select Activate version.
Choose whether to activate it on your staging or production network.
We recommend activating on both staging and production. This way, when your Property Manager setup is complete, you can freely activate the configuration to either staging or production without going back to your EdgeWorker later.
If you do choose to activate on both, then you will need to do Steps 8 and 9 twice: once for each network.
Once your EdgeWorker is activated, you’re ready to move on to Property Manager setup.
There are two ways to set up your Property Manager:
We recommend letting HUMAN set up your Property Manager due to the manual nature of the process. This requires creating and sharing an API token with our team so we can access your Property Manager.
HUMAN will never access your account or configuration without your permission. In addition, you can pause or revoke Akamai API credentials access at any time, so you will always have the ability to control when our team can use your API credentials. You can do this from Account Admin > Identity & Access > Actions menu for the client.
Lock: Disables the client until you unlock it. If you anticipate that HUMAN will need to access your Property Manager again in the future, you can choose this option.
Deactivate all credentials: Permanently delete the client. This means the API will no longer be active and will not work for anyone even if HUMAN has the credentials.
To create credentials:
Once you’ve provided HUMAN with your Akamai token, we will configure the necessary parameters and rules for your Enforcer. After that’s complete, you can deploy the Enforcer at any time with the following:
Your Akamai Enforcer has been successfully installed with the minimum requirements to monitor activity on your CDN. You can further customize the Enforcer’s behavior by referencing our configuration options.
Once you finish installing, be sure to contact HUMAN to complete your tuning process.
If you opt not to have HUMAN set up your Akamai Property Manager, then you will need to provide all the necessary properties and rules yourself. You can learn what you need to include from the parameters listed below.
You can add new property variables by selecting Property Variables > + Variables. You must include all these variables.
You can add new property rules by selecting Property Configuration Settings > + Rules. You must include all the following rules.
Property manager rules should be created in the following hierarchy:
You can learn how to create each rule below. Click each heading to open it.
PXEnforcerRule
This is the parent rule for all the following rules.
PXBypassResponseProviderRule
This rule sets the bypass response provider variable in case you need to access the request body. It also should have the following rules nested inside it:
To create this rule:
Select the PXEnforcerRule you created earlier. This will nest PXBypassResponseProviderRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXBypassResponseProviderRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match.
Add the following criteria:
Select Save.
PXSetCIBypassResponseProviderRule
This rule sets the bypass response provider variable for Credential Intelligence. To create this rule:
Select the PXBypassResponseProviderRule you created earlier. This will nest PXSetCIBypassResponseProviderRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXSetCIBypassResponseProviderRule as the rule name.
Select Insert Rule.
In the Criteria section, you will create two criteria. Select + Match and add the following:
/login_routeIn the Behaviors section, select + Behavior > Standard Property Behavior.
Select Set Variable, then select Insert Behavior.
Complete the following fields:
Select Save.
PXSetGraphqlBypassResponseProviderRule
This rule sets the bypass response provider variable in cases of GraphQL. To create this rule:
Select the PXBypassResponseProviderRule you created earlier. This will nest PXSetGraphqlBypassResponseProviderRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXSetGraphqlBypassResponseProviderRule as the rule name.
Select Insert Rule.
In the Criteria section, you will create two criteria. Select + Match and add the following:
/In the Behaviors section, select + Behavior > Standard Property Behavior.
Select Set Variable, then select Insert Behavior.
Complete the following fields:
Select Save.
PXWorkerRule
This rule sets the bypass response provider variable in case you need to access the request body. To create this rule:
Select the PXEnforcerRule you created earlier. This will nest PXWorkerRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXWorkerRule as the rule name.
Select Insert Rule.
In the Criteria section, you will create three criteria. Select + Match and add the following:
app-id-without-px with your Application ID without PX in front of it):
/pxns/*, /app-id-without-px/init.js, /app-id-without-px/captcha/*, /app-id-without-px/xhr/*In the Behaviors section, you will create Set Variables and EdgeWorkers. Select + Behavior > Standard Property Behavior.
{{builtin.AK_CLIENT_REAL_IP}}{{builtin.AK_TLS_VERSION}}{{builtin.AK_TLS_CIPHER_NAME}}{{builtin.AK_TLS_PREFERRED_CIPHERS}}Select Save.
PXStaticContentWorkerRule
This rule is for non-GET static file requests. To create this rule:
Select the PXEnforcerRule you created earlier. This will nest PXStaticContentWorkerRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXStaticContentWorkerRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match for each of the following:
In the Behaviors section, you will create Set Variables and EdgeWorkers. Select + Behavior > Standard Property Behavior.
{{AK_CLIENT_REAL_IP}}{{builtin.AK_TLS_VERSION}}{{builtin.AK_TLS_CIPHER_NAME}}{{builtin.AK_TLS_PREFERRED_CIPHERS}}Select Save.
PXBlockRule
This rule redirects blocks to NetStorage. To create this rule:
Select the PXEnforcerRule you created earlier. This will nest PXStaticContentWorkerRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXStaticContentWorkerRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following:
/pxns/*In the Behaviors section, you will create Origin Servers and Modify Outgoing Request Paths. To add a new behavior, select + Behavior > Standard Property Behavior.
Select Save.
PXSapiRule
This rule handles all internal HUMAN requests. It also should have the following rules nested inside it:
To create this rule:
Select the PXEnforcerRule you created earlier. This will nest PXSapiRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXSapiRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following (be sure to replace app-id-without-px with your Application ID without PX in front of it):
/app-id-without-px/xhr/*, /app-id-without-px/captcha/*, /app-id-without-px/*, /px/risk, /px/activities, /px/telemetryIn the Behaviors section, select + Behavior > Standard Property Behavior.
Choose Origin Server and select Insert Behavior. Then complete the following:
sapi-{{user.PMUSER\_PX\_APP\_ID}}.perimeterx.net{{Origin Hostname}}, {{Forward Host Header}}Select Save.
PXFirstPartyClientRule
This rule handles first party client requests. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXFirstPartyClientRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXFirstPartyClientRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following (be sure to replace app-id-without-px with your Application ID without PX in front of it):
/app-id-without-px/init.jsIn the Behaviors section, you will create Modify Outgoing Request Paths and Modify Outgoing Request Headers. To add a new behavior, select + Behavior > Standard Property Behavior.
{{user.PMUSER\_PX\_APP\_ID}}/main.min.jsSelect Save.
PXFirstPartyCaptchaRule
This rule handles first party captcha requests. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXFirstPartyCaptchaRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXFirstPartyCaptchaRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following (make sure to replace app-id-without-px with your Application ID without PX in front of it):
/app-id-without-px/captcha/*In the Behaviors section, you will create Modify Outgoing Request Paths and Modify Outgoing Request Headers. To add a new behavior, select + Behavior > Standard Property Behavior.
Select Save.
PXNoCacheRule
This rule prevents caching from certain paths. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXNoCacheRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXNoCacheRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following:
/px/risk, /px/activities, /px/telemetry, /px/captcha/*, /px/clientIn the Behaviors section, select + Behavior > Standard Property Behavior.
Select Caching and Insert Behavior.
Set the Caching option to No store.
Select Save.
PXFirstPartyXHRRule
This rule handles first party XHR requests. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXFirstPartyXHRRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXFirstPartyXHRRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following (be sure to replace app-id-without-px with your Application ID without PX in front of it):
/app-id-without-px/xhr/*In the Behaviors section, you will create Allow POST, Modify Outgoing Request Paths, and Modify Outgoing Request Headers. To add a new behavior, select + Behavior > Standard Property Behavior.
app-id-without-px with your Application ID without PX in front of it):
/app-id-without-px/xhr/{{builtin.AK_CLIENT_REAL_IP}}Select Save.
PXTelemetryRule
This rule handles telemetry events. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXTelemetryRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXTelemetryRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following:
/px/telemetryIn the Behaviors section, select + Behavior > Standard Property Behavior.
Select Caching and Insert Behavior.
Select Modify Outgoing Request Path and select Insert Behavior. Then complete the following:
Select Save.
PXActivitiesRule
This rule handles async requests. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXActivitiesRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXActivitiesRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following:
/px/activitiesIn the Behaviors section, you will create Allow POST and Modify Outgoing Request Paths. To add a new behavior, select + Behavior > Standard Property Behavior.
Select Save.
PXRiskApiRule
This rule handles risk API calls. To create this rule:
Select the PXSapiRule you created earlier. This will nest PXRiskApiRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXRiskApiRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following:
/px/riskIn the Behaviors section, you will create Set Variable, Modify Outgoing Request Header, and Modify Outgoing Request Path. To add a new behavior, select + Behavior > Standard Property Behavior.
{{user.PMUSER\_PX\_EW\_IP}}Select Save.
PXResponseRule
This rule handles HTTP responses. It also should have the following rules nested inside it:
To create this rule:
Select the PXEnforcerRule you created earlier. This will nest PXResponseRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXResponseRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add the following:
In the Behaviors section, select + Behavior > Standard Property Behavior.
Select Set Variable and Insert Behavior. Then, complete the following:
{{builtin.AK\_EDGEWORKERS\_RP\_STATUS}}Select Save.
PXSetResponseProviderErrorRule
This rule sets the response provider error variable. To create this rule:
Select the PXResponseRule you created earlier. This will nest PXSetResponseProviderErrorRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXSetResponseProviderErrorRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add each of the criteria following:
*success*, *unimplementedHandler*In the Behaviors section, select + Behavior > Standard Property Behavior.
Select Set Variable and Insert Behavior. Then complete the following:
Select Save.
PXEdgeworkerFailureRule
This rule sets the response provider error variable. To create this rule:
Select the PXResponseRule you created earlier. This will nest PXEdgeworkerFailureRule inside when you create it.
Select + Rules.
Select the Blank Rule Template and enter PXEdgeworkerFailureRule as the rule name.
Select Insert Rule.
In the Criteria section, select + Match and add each of the following criteria:
In the Behaviors section, select + Behavior > Standard Property Behavior.
Select Site Failover and Insert Behavior. Then complete the following:
{{builtin.AK\_HOST}}Select Save.
Once you create all the necessary variables and rules, you’re ready to activate the Enforcer.
Your Akamai Enforcer has been successfully installed with the minimum requirements to monitor activity on your CDN. You can further customize the Enforcer’s behavior by referencing our configuration options.
Once you finish installing, be sure to contact HUMAN to complete your tuning process.