We typically like to introduce new services during peaceful times at companies, but in this case it was wartime. The airline had already suffered a number of DDoS attacks.”

Darragh Doherty, Account Executive, Akamai

July 2024 marks the one year anniversary of TrafficPeak, Akamai’s managed observability service that’s powered by Hydrolix. Since its launch, TrafficPeak has solved the economic, visibility and speed challenges that come with ingesting, retaining and analyzing massive amounts of data.

For one customer, a large airline, TrafficPeak gave them full visibility and granularity into attack and delivery traffic, from the origin and outside. They were data insights the customer desperately needed.

During its peak trading season, the airline was the victim of three DDoS attacks that had brought down its infrastructure. Because of the timing, the company’s senior leadership went all hands on deck to find out how much visibility it had into its data. The company asked Akamai to perform an assessment, which revealed that it had visibility into the origin infrastructure but near zero visibility outside the origin.

The airline wanted to see 100% of everything, which included which requests were going through, and which IPs they were coming from. It was already using an observability service, so Akamai rushed to ingest security logs into the platform. However, the volume of requests was overwhelming. The team struggled to ingest all of the data due to capacity limitations. The SIEM feed also kept breaking because of visibility rules that were designed to look at non-attack traffic in the attack portal. The feed couldn’t handle the abundance of traffic.

“They were drowning in data,” said Darragh Doherty, the Akamai Account Executive who supported the airline. “They needed a real-time granular view of attack and non-attack traffic, but designed so that they could ingest and query all data without anything breaking.”

That meant setting up a DataStream 2 (DS2) feed for non-attack traffic, and only using the SIEM feed for attack traffic.

The airline’s Security Operations Center (SOC) team managed the observability service. At first, the team considered ingesting the Akamai DS2 logs into the platform however airline executives turned down the idea because of the potential cost.

“Which was costing us more?” They asked. “The DDoS attacks or our observability service?”

The team needed to find another option before the attacks became worse.

“We told the airline that with the volume of requests going through, now may be a good time to try TrafficPeak,” said Doherty. “We explained that we could get traffic in the DS2 feed where there was less capacity limitation and they could get immediate visibility.”

The airline kicked off a trial, which was led by its operations team. Within minutes, Akamai created a unified dashboard so the airline could see all traffic in one view. The team layered in DS2 data and deactivated the SIEM rules so that the airline could see traffic that had not been blocked.

“TrafficPeak was an attractive option because we could reduce traffic going into the SIEM feed by setting up the DS2 ingest. The stuff we didn’t need would go through DS2. And it was a fraction of the cost of the observability service,” said Doherty.

Appreciating the simplicity and fast results from TrafficPeak, the airline went beyond looking for volumetric based attacks. It also used TrafficPeak to help spot credential stuffing and abuse attacks by running queries against IP addresses. Now, the team is looking for more use cases.

One includes using TrafficPeak for attack drill exercises. The service can help find weak areas of runbooks. It can also alert on live incidents, and help the airline make sure those alerts go to the right responders so that mitigation can start instantly.

“If the airline is under attack again we want TrafficPeak to add value early on,” said Doherty. “We want to get them visibility and make sure the right alerts are going to the right people as part of their mitigation efforts.”

The airline’s TrafficPeak instance also helps Akamai because the security team can see the indicators of compromise and other attack information so that they can spot potential threats against other customers, and gain long term traffic visibility.

“By having an easy way to access all that data, in a granular, unified view we can see incidents that may be impacting other customers too, and we can look at our historical data to better pinpoint timeframes and root causes.”

View All Customer Stories