analyzing-api-gateway-access-logs

1# Analyzing API Gateway Access Logs
2 
3 
4## When to Use
5 
6- When investigating security incidents that require analyzing api gateway access logs
7- When building detection rules or threat hunting queries for this domain
8- When SOC analysts need structured procedures for this analysis type
9- When validating security monitoring coverage for related attack techniques
10 
11## Prerequisites
12 
13- Familiarity with security operations concepts and tools
14- Access to a test or lab environment for safe execution
15- Python 3.8+ with required dependencies installed
16- Appropriate authorization for any testing activities
17 
18## Instructions
19 
20Parse API gateway access logs to identify attack patterns including broken object
21level authorization (BOLA), excessive data exposure, and injection attempts.
22 
23```python
24import pandas as pd
25 
26df = pd.read_json("api_gateway_logs.json", lines=True)
27# Detect BOLA: same user accessing many different resource IDs
28bola = df.groupby(["user_id", "endpoint"]).agg(
29    unique_ids=("resource_id", "nunique")).reset_index()
30suspicious = bola[bola["unique_ids"] > 50]
31```
32 
33Key detection patterns:
341. BOLA/IDOR: sequential resource ID enumeration
352. Rate limit bypass via header manipulation
363. Credential scanning (401 surges from single source)
374. SQL/NoSQL injection in query parameters
385. Unusual HTTP methods (DELETE, PATCH) on read-only endpoints
39 
40## Examples
41 
42```python
43# Detect 401 surges indicating credential scanning
44auth_failures = df[df["status_code"] == 401]
45…