mcpField
A
analyzing-api-gateway-access-logs

analyzing-api-gateway-access-logs

github.com/mukul975Security35.2k767 installsUpdated 8w ago
Repository

About analyzing-api-gateway-access-logs

A security-analysis skill for SOC analysts and security teams working with API gateway access logs. It provides Python-based procedures for spotting patterns such as BOLA, injection attempts, and credential scanning.

Key features

  1. 01BOLA and IDOR detection patterns
  2. 02Credential scanning indicators
  3. 03Injection and rate-limit checks
  4. 04Python log-analysis examples

Use cases

  1. 01Investigating API gateway security incidents
  2. 02Developing threat-hunting queries
  3. 03Reviewing monitoring coverage for API attacks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mukul975/anthropic-cybersecurity-skills --skill analyzing-api-gateway-access-logs

After installing, type/analyzing-api-gateway-access-logsin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

LICENSE
references/
api-reference.md
scripts/
agent.py

Details

From the project README

Analyzing API Gateway Access Logs

When to Use

  • When investigating security incidents that require analyzing api gateway access logs
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Familiarity with security operations concepts and tools
  • Access to a test or lab environment for safe execution
  • Python 3.8+ with required dependencies installed
  • Appropriate authorization for any testing activities

Instructions

Parse API gateway access logs to identify attack patterns including broken object level authorization (BOLA), excessive data exposure, and injection attempts.

import pandas as pd

df = pd.read_json("api_gateway_logs.json", lines=True)
# Detect BOLA: same user accessing many different resource IDs
bola = df.groupby(["user_id", "endpoint"]).agg(
    unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]

Key detection patterns:

  1. BOLA/IDOR: sequential resource ID enumeration
  2. Rate limit bypass via header manipulation
  3. Credential scanning (401 surges from single source)
  4. SQL/NoSQL injection in query parameters
  5. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints

Examples

# Detect 401 surges indicating credential scanning
auth_failures = df[df["status_code"] == 401]
scanner_ips = auth_failures.groupby("source_ip").size()
scanners = scanner_ips[scanner_ips > 100]

Comments

Markdown supported