Ingest Apigee Proxy - Administrator Guide - Cortex CLOUD

Edit deploy.sh and add values for the following:

Check that the GCP user running the script has IAM permissions.

apigee.resourcefiles.list
apigee.resourcefiles.create
apigee.resourcefiles.update
apigee.sharedflows.get
apigee.sharedflows.create
apigee.deployments.create
apigee.sharedflowrevisions.deploy
apigee.flowhooks.attachSharedFlow
apigee.keyvaluemaps.create
apigee.keyvaluemaps.delete
apigee.keyvaluemapentries.create

Run the deploy.sh script:

chmod +x
./deploy.sh

Verify that the JavaScript policies have been added to the shared flows:

Go to Apigee → Proxy development → Shared Flows and check that the following policies have been added.

Validate data ingestion:

Send a request to the gateway and go to Apigee data source to validate that the data has been received from Apigee.

(Optional) Exclude unwanted domains from being tracked by APIsec:

1. Uncomment: DOMAIN_EXCLUSION_LIST.

2. Add the domains to exclude.

3. Edit deploy.sh and set the following variables:

   export DOMAIN_EXCLUSION_LIST="domain1,domain2"

Discontinue the integration:

1. Edit undeploy.sh:

   export PROJECT_ID=example-project-id
   export ORG=$PROJECT_ID
   export ENVIRONMENT=example-env

2. Run the undeploy.sh script:

   chmod +x
   ./undeploy.sh

   Go to Apigee → Proxy development → Shared Flows and check that the following policies have been removed.

   • sf-api-sec-extension-postflow

   • sf-api-sec-extension-preflow

Edit panw-api-sec-extension-configuration.properties file:

Upload the edited property set:

1. Get a token to upload updates via an API request. For more information, refer to property sets.

   Input:

   gcloud config config-helper --force-auth-refresh --format

   Output:

   configuration:
     active_configuration: 
     properties:
       compute:
         region: 
         zone:     
   core:
         account: 
         disable_usage_reporting: 
         project: 
   credential:
     access_token: <Copy this value>
     id_token: 
     token_expiry: 
   sentinels:
     config_sentinel: 
   

2. Copy the <access_token> value from the output.

Upload the property set to Apigee:

curl --silent -X GET 
"https://apigee.googleapis.com/v1/organizations/
<ORG>/environments/<ENVIRONMENT>/resourcefiles/
properties" -H 
"Authorization: Bearer <access_token from above>"

Generate Key Value Map (KVM), which stores the Cortex API key that's encrypted

curl --silent -X POST 
"https://apigee.googleapis.com/v1/organizations/
<ORG>/environments/<ENVIRONMENT>/keyvaluemaps" -H 
"Authorization: Bearer <access_token from above>" 
-H "Content-Type: application/json" --data-raw 
'{"name": "'"APISec-KVM"'", "encrypted": true}'

If there's an error when creating the KVM because of an existing name, delete the KVM and recreate.

curl --silent -X DELETE 
"https://apigee.googleapis.com/v1/organizations/
<ORG>/environments/<ENVIRONMENT>/keyvaluemaps/
$APISEC_KVM_NAME" -H "Authorization: Bearer 
<access_token from above>"

Add the Cortex API key entry to the created KVM.

curl --silent -X POST "https://apigee.googleapis.com/
v1/organizations/<ORG>/environments/<ENVIRONMENT>/
keyvaluemaps/$APISEC_KVM_NAME/entries" -H 
"Authorization: Bearer <access_token from above>" 
-H "Content-Type: application/json" --data-raw 
'{"name": "api-key","value": "'"<Generated key 
from cortex env>"'"}'

Upload the shared flows:

Shared flows:

Upload

Replace the <sf> with the shared flows:

curl --silent -X POST --data-binary "<sf>.zip" -H 
"Content-Type: application/octet-stream" -H 
"Authorization: Bearer <access_token from above>" 
"https://apigee.googleapis.com/v1/organizations/$ORG/
sharedflows?action=import&name=<sf>"

Deploy

Input:

curl --silent -X GET "https://apigee.googleapis.com/
v1/organizations/<ORG>/sharedflows/<sf>" -H 
"Authorization: Bearer <access_token from above>"

Output:

{
  "metaData": {
    "createdAt": "1736952161610",
    "lastModifiedAt": "1736952161610",
    "subType": "SharedFlow"
  },
  "name": "sf-api-sec-extension-postflow",
  "revision": [
    "1" // This is the revision number
  ],
  "latestRevisionId": "1"
}

Deploy <sf>:

curl --silent -X POST -H "Authorization: 
Bearer <access_token from above>" 
"https://apigee.googleapis.com/
v1/organizations/$ORG/environments/<ENVIRONMENT>/
sharedflows/$sf/revisions/<REVISION>/
deployments?override=true"

Verify API security shared flows were created:

Go to Apigee → Proxy development → Shared Flows and check that the following policies have been added.

Check for existing flow hooks.

1. Go to Apigee → Management → Environments and select the environment to hook the shared flow.

2. In the Flow Hooks tab, select the relevant flow hook.

Configure policy for shared flow to the existing hook.

1. Go to Apigee → Proxy development → Shared Flows and select the flow hook from the relevant environment.

   Note

   Start with the hook in pre-proxy.

2. From the Develop tab, expand Policies and select Flow Callout.

3. Enter a meaningful name and select the Sharedflow: sf-api-sec-extension-preflow , and then click Create.

4. From the Develop tab, select Shared flows and expand Default.

5. From Select policy, select Select existing policy, and select the policy just created and then click Add.

6. Repeat the previous steps for the post-proxy hook. Select the Sharedflow: sf-api-sec-extension-postflow.

7. Click Save and Deploy.

The steps automatically run without linking to the hooks.

Limitations: