Realm.Security Documentation

Appearance

Radware Cloud Services DDoS ​

Realm Security integrates with Radware Cloud Services Management System (CSMS), enabling ingestion of DDoS security events and operational alerts from your Radware Cloud account into Realm Security Data Fabric.

Prerequisites ​

  • A Radware Cloud Services account with the Account Users Admin role
  • Your Infrastructure Protection ID (found in the Radware Cloud Services Portal)
  • An API Key generated from the Radware Cloud Portal

Note: Radware uses different Account IDs for different services. The Infrastructure Protection ID is required for this integration. It is distinct from the Application Protection ID used by WAF and Bot Manager APIs. Ensure you are using the correct one.

Overview ​

  1. Radware Portal: Generate an API Key
  2. Radware Portal: Locate your Infrastructure Protection ID
  3. Realm Console: Create a source and configure the input feed

1. Radware Portal: Generate an API Key ​

Realm uses a Radware API Key to authenticate with the Radware Cloud Services API.

  1. Log in to the Radware Cloud Services Portal.
  2. Navigate to Accounts > API Keys.
  3. Click the + icon to create a new API Key.
  4. Fill out the form in the pane that appears on the right and click Save. The Add New API Key dialog box will appear.
  5. Immediately copy the API Key value — it is only shown once and cannot be retrieved again. Store it securely before proceeding.
  6. Click Confirm to complete the creation of the API Key.

Important notes:

  • The API Key is displayed only once. If you lose it, you must generate a new one.
  • The API Key has an expiration date and will stop working after that date. Track expiry and rotate before it lapses.
  • Do not store the key where unauthorized users can access it. Anyone with this key can perform any action it authorizes.
  • The API Key is scoped to the permissions assigned at creation time. Ensure the key has read access to DDoS events and alerts.

2. Radware Portal: Locate your Infrastructure Protection ID ​

Your Infrastructure Protection ID is the account identifier Realm uses to scope API requests to your DDoS data.

  1. In the Radware Cloud Services Portal, navigate to Accounts > API Keys.
  2. Click the Account ID Details button.
  3. Copy the value labeled Infrastructure Protection ID (e.g. 582c604140d6dc499c0a708f).

Note: Do not use the Application Protection ID — that is a separate identifier used for WAF and application protection APIs. Using the wrong ID will result in empty or incorrect results.

3. Realm Console: Create a Source and Configure the Input Feed ​

Create a Source ​

  1. In Realm, go to Sources > Add Source.
  2. Enter a name for your source (e.g. Radware CSMS DDoS).
  3. Set Product Format to Radware CSMS DDoS.
  4. Click Save.

Add an Input Feed ​

  1. From the source page, click Add Input Feed.
  2. Select Radware CSMS DDoS and give it a name.
  3. Configure the following fields:
FieldRequiredDescription
Auth (API Key)YesThe API Key copied from the Radware Portal in Step 1.
Account IDYesYour Infrastructure Protection ID from Step 2 (e.g. 582c604140d6dc499c0a708f).
Poll IntervalNoHow frequently Realm checks for new events, in seconds. Defaults to a sensible value — most customers do not need to change this.
Backfill IntervalNoHow far back in time Realm will look for events on initial setup, in seconds. For example, 3600 pulls the last hour of events on first run. Defaults to a sensible value if left blank.
Page SizeNoNumber of events fetched per API request. Defaults to a sensible value — most customers do not need to change this.
  1. Click Save.

It takes about a minute to deploy the fabric update, after which Realm will begin polling Radware for new events.

What Data is Collected ​

Realm collects two types of events from your Radware CSMS account:

DDoS Security Events — attack events detected against your protected assets, including:

  • Source and destination IP addresses and ports
  • Attack protocol, vector, and category
  • Risk level (Info, Low, Medium, High, Critical)
  • Attack action taken (e.g. Drop, Forward)
  • Packet and bandwidth metrics
  • Site name and asset name

Operational Alerts — infrastructure alerts such as BGP peer down events, site health changes, and other platform notifications, including:

  • Alert code and type (e.g. BGP.Peer.Down)
  • Severity level (Low, Medium, High)
  • Site name and description
  • Timestamp

Note: There is an inherent latency of up to 2 hours between when events occur in Radware and when they appear in the Radware API. This is a Radware platform constraint and not specific to the Realm integration.

Troubleshooting ​

No events appearing after setup

Verify the following:

  • The Account ID field contains the Infrastructure Protection ID and not the Application Protection ID. These are separate values in the Radware portal — navigate to Accounts > API Keys > Account ID Details and confirm you copied the correct one.
  • The API Key has not expired. Navigate to Accounts > API Keys in the Radware portal to check the expiration date.
  • The API Key was created with sufficient permissions to read DDoS security events and operational alerts.

Authentication errors

Verify that the API Key value was copied correctly and completely. If in doubt, generate a new API Key from the Radware portal — the existing key cannot be retrieved once the creation dialog is closed.

Fewer events than expected

Radware imposes up to a 2-hour latency on event availability in the API. Events that occurred recently may not yet be queryable. Additionally, if this is a new integration, use the Backfill Interval field to pull historical data from before the feed was configured.

Resources ​