analyzing-api-gateway-access-logs - SKILL.md Agent Skill

name: analyzing-api-gateway-access-logs description: 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

' domain: cybersecurity tags:

analyzing
api
gateway
access subdomain: security-operations version: '1.0' author: mahipal license: Apache-2.0 nist_csf:
DE.CM-01
RS.MA-01
GV.OV-01
DE.AE-02

Analyzing API Gateway Access Logs

When to Use

When investigating security incidents that require analyzing api gateway access logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Parse API gateway access logs to identify attack patterns including broken object level authorization (BOLA), excessive data exposure, and injection attempts.

import pandas as pd

df = pd.read_json("api_gateway_logs.json", lines=True)
# Detect BOLA: same user accessing many different resource IDs
bola = df.groupby(["user_id", "endpoint"]).agg(
    unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]

Key detection patterns:

BOLA/IDOR: sequential resource ID enumeration
Rate limit bypass via header manipulation
Credential scanning (401 surges from single source)
SQL/NoSQL injection in query parameters
Unusual HTTP methods (DELETE, PATCH) on read-only endpoints

Examples

# Detect 401 surges indicating credential scanning
auth_failures = df[df["status_code"] == 401]
scanner_ips = auth_failures.groupby("source_ip").size()
scanners = scanner_ips[scanner_ips > 100]

When NOT to Use

You need to perform the attack, not analyze it (use performing-* skills)
Task is about detection, not analysis (use detecting-* skills)
You need to implement controls (use implementing-* skills)
Task is about threat hunting, not post-incident analysis (use hunting-* skills)
You don't have access to the artifacts/logs to analyze
Task requires real-time monitoring (use SOC tools)

Red Flags

Performing actions without explicit written authorization from the asset owner
Testing against production systems without a defined scope and rules of engagement
Exceeding the authorized scope of the engagement
Leaving persistent access mechanisms without explicit approval
Causing denial-of-service on production systems during testing

Verification

All steps executed successfully against a test environment before production use
Output documented with screenshots or logs demonstrating expected behavior
All exploited vulnerabilities documented with reproduction steps
Scope boundaries confirmed — only authorized targets were tested
Remediation recommendations included for every finding

Overview

Section content — see SKILL.md body for full details.

Process

Analyze the task requirements
Apply domain expertise
Verify output quality