> ## Documentation Index > Fetch the complete documentation index at: https://docs.livingsecurity.com/llms.txt > Use this file to discover all available pages before exploring further. # Akamai Workforce Protector setup > Send Akamai Workforce Protector (formerly LayerX) browser alerts to Living Security through a Splunk HEC destination. Akamai Workforce Protector, formerly LayerX, is a browser security product. It raises alerts when people use AI tools, put sensitive data in AI prompts, install risky browser extensions or visit malicious pages. Connect it to send those alerts to Living Security. This is a push integration: Workforce Protector sends alerts to a Living Security URL, and Living Security does not call Workforce Protector. > [!NOTE] > > Don't see **Akamai Workforce Protector** in **Catalog**? It's rolling out gradually. Contact your account manager to request access. ## What this integration contributes Each alert is kept as it arrives. Alerts become activities on the person involved and feed your signals, risk scores and Playbooks. | Alert | Counts as | | - | - | | Sensitive data in an AI prompt | Risk | | Unapproved AI tool used | Risk | | Paste or upload blocked | Risk | | Risky browser extension | Risk | | Malicious page visited | Risk | | AI tool or site used | Context | > [!NOTE] > > While the mapping for Workforce Protector alerts is being finished, the page > shows **Receiving · mapping in progress**. Alerts received in that time are > kept and become activities when the mapping is ready. You do not need to send > them again. ## Before you begin You need: * permission to add a SIEM destination in the Workforce Protector console * permission to manage integrations in Living Security * a secure place to keep the push key until you paste it into Workforce Protector ## 1. Turn it on in Living Security **1. Open Workforce Protector** Go to **Settings → Integrations → Catalog** and search for **Workforce Protector** or **LayerX**. Select **Connect** on **Akamai Workforce Protector**. **2. Turn it on** Select **Turn on**. Living Security creates a push destination and a push key for your organization. The key can send Workforce Protector data only. It cannot read anything. **3. Copy the URL and the push key** In **Send Data**, keep the **Splunk HEC** tab open and copy the **HEC URL** and the **Push key**. > [!WARNING] > > The push key is shown only once. If you lose it, select **Rotate key** to get > a new one. The old key stops working at once. The page already shows the URL for your organization's region. For reference, the HEC URLs are: * United States: `https://api.us-east-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events/services/collector/event` * European Union: `https://api.eu-west-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events/services/collector/event` Use the URL for the region your Living Security organization is in. A key from one region does not work in the other. ## 2. Add the Splunk destination in Workforce Protector In the Workforce Protector console, open the SIEM or log export settings and add a **Splunk** destination. Menu labels can differ between console versions; Akamai's documentation for the console is authoritative for where the setting is. Configure the destination: | Workforce Protector field | Value | | - | - | | Destination type | **Splunk** (HTTP Event Collector) | | HEC URL | The **HEC URL** from Living Security | | HEC token | The **Push key** from Living Security | | Index | Leave empty | | Source type | Leave empty | | Events to send | **Alerts and policy events**. Page views are not needed. | Save the destination. If the console has a connection test, run it: Living Security answers the Splunk HEC health check. ### Use an HTTPS JSON webhook instead If your export is an HTTPS webhook that sends JSON or NDJSON and lets you set a header, open the **HTTPS JSON** tab in **Send Data** and use: | Setting | Value | | - | - | | URL | The **Endpoint** from Living Security | | Header | `Authorization` = `Bearer ` | | Content type | `application/json` for a JSON array of objects; `application/x-ndjson` for NDJSON, one object per line | The endpoints are: * United States: `https://api.us-east-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events` * European Union: `https://api.eu-west-1.livingsecurity.ai/api/v1/push-ingest/akamai-workforce-protector/events` ## 3. Check Push History 1. In Living Security, open **Settings → Integrations → Catalog** and select **Manage** on **Akamai Workforce Protector**. 2. The status shows **Waiting for data** until the first push arrives. The first pushes usually show within 15 minutes of saving the destination. 3. In **Push History**, confirm recent pushes on the `events` stream with the status **Loaded** or **Pending** and the record counts you expect. 4. Set **Status** to **Rejected** to list pushes Living Security refused. Open a rejected push to see the HTTP status and the error returned to Workforce Protector. Pushes with a missing or wrong key cannot be matched to your organization, so they do not appear in Push History. If nothing arrives after an hour, check the URL and the key in Workforce Protector. ## Rotate the key or turn it off * **Rotate key** issues a new key and stops the old one at once. Paste the new key into the Workforce Protector destination to keep alerts arriving. * **Turn off** stops the key at once, so Workforce Protector pushes are rejected. Alerts already received stay. Select **Turn on again** later to get a new key. ## Troubleshooting | Symptom | Check | | - | - | | Nothing in Push History after an hour | The destination is saved and enabled, the HEC URL is the one shown in Living Security, and the HEC token is the current push key | | Workforce Protector reports `Invalid token` or `401` | The key was rotated or the integration was turned off. Rotate the key and paste the new one | | The console adds `/services/collector/event` to the URL itself | Paste the **Endpoint** from the **HTTPS JSON** tab, which ends in `/events`, as the base URL | | `400` with `No data` or `Invalid data format` | The destination sends an empty or non-HEC body. Use the Splunk HEC format, or switch to the HTTPS JSON tab | | `503` with `Server is busy` | Living Security is shedding load. Workforce Protector retries; keep its retry setting on | | Rejected pushes listed in Push History | Open the push to see the HTTP status and error message | Requests are limited to 10 MB and 10,000 records each. See [Custom Push Source API](https://docs.livingsecurity.com/integrations/custom-push-source.md) for the full response and retry contract. ## Related > [card] [Custom Push Source API](https://docs.livingsecurity.com/integrations/custom-push-source.md) > > Review authentication, payload limits, responses, retries and run verification. > [card] [Integrations overview](https://docs.livingsecurity.com/integrations/overview.md) > > Find and connect other providers. ## Related topics - [Integrations Overview](https://docs.livingsecurity.com/integrations/overview.md) - [NINJIO integration setup](https://docs.livingsecurity.com/integrations/ninjio.md) - [Adaptive Security integration setup](https://docs.livingsecurity.com/integrations/adaptive.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.