Skip to main content
Akamai Workforce Protector, formerly LayerX, is a browser security product. It raises alerts when people use AI tools, put sensitive data in AI prompts, install risky browser extensions or visit malicious pages. Connect it to send those alerts to Living Security. This is a push integration: Workforce Protector sends alerts to a Living Security URL, and Living Security does not call Workforce Protector.

What this integration contributes

Each alert is kept as it arrives. Alerts become activities on the person involved and feed your signals, risk scores and Playbooks.
While the mapping for Workforce Protector alerts is being finished, the page shows Receiving · mapping in progress. Alerts received in that time are kept and become activities when the mapping is ready. You do not need to send them again.

Before you begin

You need:
  • permission to add a SIEM destination in the Workforce Protector console
  • permission to manage integrations in Living Security
  • a secure place to keep the push key until you paste it into Workforce Protector

1. Turn it on in Living Security

1

Open Workforce Protector

Go to Settings → Integrations → Catalog and search for Workforce Protector or LayerX. Select Connect on Akamai Workforce Protector.
2

Turn it on

Select Turn on. Living Security creates a push destination and a push key for your organization. The key can send Workforce Protector data only. It cannot read anything.
3

Copy the URL and the push key

In Send Data, keep the Splunk HEC tab open and copy the HEC URL and the Push key.
The push key is shown only once. If you lose it, select Rotate key to get a new one. The old key stops working at once.
The page already shows the URL for your organization’s region. For reference, the HEC URLs are:
  • United States: https://api.us-east-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events/services/collector/event
  • European Union: https://api.eu-west-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events/services/collector/event
Use the URL for the region your Living Security organization is in. A key from one region does not work in the other.

2. Add the Splunk destination in Workforce Protector

In the Workforce Protector console, open the SIEM or log export settings and add a Splunk destination. Menu labels can differ between console versions; Akamai’s documentation for the console is authoritative for where the setting is. Configure the destination: Save the destination. If the console has a connection test, run it: Living Security answers the Splunk HEC health check.

Use an HTTPS JSON webhook instead

If your export is an HTTPS webhook that sends JSON or NDJSON and lets you set a header, open the HTTPS JSON tab in Send Data and use: The endpoints are:
  • United States: https://api.us-east-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events
  • European Union: https://api.eu-west-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events

3. Check Push History

  1. In Living Security, open Settings → Integrations → Catalog and select Manage on Akamai Workforce Protector.
  2. The status shows Waiting for data until the first push arrives. The first pushes usually show within 15 minutes of saving the destination.
  3. In Push History, confirm recent pushes on the events stream with the status Loaded or Pending and the record counts you expect.
  4. Set Status to Rejected to list pushes Living Security refused. Open a rejected push to see the HTTP status and the error returned to Workforce Protector.
Pushes with a missing or wrong key cannot be matched to your organization, so they do not appear in Push History. If nothing arrives after an hour, check the URL and the key in Workforce Protector.

Rotate the key or turn it off

  • Rotate key issues a new key and stops the old one at once. Paste the new key into the Workforce Protector destination to keep alerts arriving.
  • Turn off stops the key at once, so Workforce Protector pushes are rejected. Alerts already received stay. Select Turn on again later to get a new key.

Troubleshooting

Requests are limited to 10 MB and 10,000 records each. See Custom Push Source API for the full response and retry contract.

Custom Push Source API

Review authentication, payload limits, responses, retries and run verification.

Integrations overview

Find and connect other providers.