Overview
This repo contains the scripts necessary to parse Akamai property and redirect configs and ingest them into Neo4j. It is a starting point to help visualize your external attack surface within Akamai.
Setup Neo4j
- Download and install Neo4j: https://neo4j.com/docs/desktop-manual/current/installation/download-installation/
- Create and start database (version 5.7.0: https://neo4j.com/docs/desktop-manual/current/operations/create-dbms/
- Install APOC: https://neo4j.com/docs/apoc/5/installation/
Download Akamai credentials
- Create and download akamai credentials: https://techdocs.akamai.com/developer/docs/set-up-authentication-credentials
NOTE: These values will be used in your .env
Install and run the app
- Install python3: https://www.python.org/downloads/
- Install poetry: https://python-poetry.org/docs/#installation
- Install nodestream: https://nodestream-proj.github.io/nodestream/0.5/docs/tutorial/
- Generate a new nodestream project
- Add
nodestream-akamaito your project dependencies in your nodestream projects pyproject.toml file. - Install necessary dependencies:
poetry install - In
nodestream.yamladd the following:
plugin_config:
akamai:
base_url: !env AKAMAI_BASE_URL
client_token: !env AKAMAI_CLIENT_TOKEN
client_secret: !env AKAMAI_CLIENT_SECRET
access_token: !env AKAMAI_ACCESS_TOKEN
# If you are using an akamai account key add the following line:
account_key: !env AKAMAI_ACCOUNT_KEY
targets:
my-db:
database: neo4j
uri: bolt://localhost:7687
username: neo4j
password: neo4j123
- Set environment variables in your terminal session for:
AKAMAI_BASE_URL,AKAMAI_CLIENT_TOKEN,AKAMAI_CLIENT_SECRET,AKAMAI_ACCESS_TOKENand if using an akamai account keyAKAMAI_ACCOUNT_KEY. - Verify nodestream has loaded the pipelines:
poetry run nodestream show - Use nodestream to run the pipelines:
poetry run nodestream run <pipeline-name> --target my-db
Property rule pipeline: AkamaiPropertyRule keying
As of 0.16.2 the property-rule pipeline keys AkamaiPropertyRule nodes on the
rule's position in the Akamai rule tree: (proxy_id, rule_path), where
rule_path is the ordinal index path from the root (ROOT, 3.0, 3.0.1, …).
The rule's human-readable name breadcrumb is stored as the full_path property.
Previously these nodes were keyed on (proxy_id, rule_name, hostname), which is
not unique — Akamai rule names repeat across a property's tree and most rules
have no hostname criterion — so the NODE KEY constraint could not be created
(Neo.DatabaseError.Schema.ConstraintCreationFailed). A path-eligible rule is
also now written as a Path node only (never both a Path and an
AkamaiPropertyRule).
If a database was loaded by an older plugin version that used the old key, do
not just rerun the pipeline: the old nodes have no rule_path, so a rerun
creates a parallel set of correctly-keyed nodes and leaves the old ones behind.
Instead, drop the plugin-owned AkamaiPropertyRule subgraph, (re)create the
constraint, then rerun the pipeline so nodes repopulate under the new key.
Find databases that still hold old property-rule nodes:
MATCH (r:AkamaiPropertyRule)
WHERE r.rule_path IS NULL
RETURN count(r) AS old_rule_nodes
Using make
- Install make (ie.
brew install make) - Run
make run
Install Bloom visualization
- For detailed instructions on how to import a perspective: https://neo4j.com/docs/bloom-user-guide/current/bloom-perspectives/perspective-creation/
- Download the perspective to a file https://github.com/ccloes/neo4j-akamai/blob/main/Bloom_Perspective.json
Using the saved cypher queries
- Type
show endpoint <some.fqdn.com>(this will show that endpoint and the relationships to it)
- Type
show akamai graph(this will show the current akamai data loaded in the graph)
- Type
show schema(this will show the graph schema and how the nodes relate and their relationships)
Schema visualization
Authors
- Zach Probst
- Chad Cloes
- Bryan Norman
- Gabe Gallagher
- Stuart Macleod
- Grant Hoffman
Metadata
Release files for nodestream-plugin-akamai 0.16.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| nodestream_plugin_akamai-0.16.2.tar.gz | 43.4 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| nodestream_plugin_akamai-0.16.2-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 112.6 kB
Release files / nodestream_plugin_akamai-0.16.2.tar.gz
| Download URL | nodestream_plugin_akamai-0.16.2.tar.gz |
|---|---|
| Size | 43.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
8d3513d1fb3021fa404df134369d4147aac6d6237cc69093471267e71fa893e5
|
|
BLAKE2b-256 checksum How to use checksums |
cb9de82c6c8536a4342277b05418ae1d1381d06ee26a33ad416da2fbd0fdbc90
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 1, 2026.
Transparency logRelease files / nodestream_plugin_akamai-0.16.2-py3-none-any.whl
| Download URL | nodestream_plugin_akamai-0.16.2-py3-none-any.whl |
|---|---|
| Size | 69.2 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
1c2c8b0be92eea84deb9a89b3760a4f6a3b94d97ea7c90dad33add1eaffbfdc5
|
|
BLAKE2b-256 checksum How to use checksums |
b270b8091e14e45b47f9fb7d373f2d664cfbaa66e8ad1b8a181ccbc870dad5b2
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 1, 2026.
Transparency logSecurity for nodestream-plugin-akamai 0.16.2
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for nodestream_plugin_akamai-0.16.2.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 1, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
