Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.
Start a fresh conversation. Replace the highlighted placeholders.
Use the analyzing-api-gateway-access-logs skill to review this authorized log sample: [path to or pasted excerpt from AWS API Gateway, Kong, or Nginx access logs]. First describe the available fields and data limitations, then look for a small set of supported indicators: sequential resource-ID access consistent with BOLA/IDOR, 401 surges consistent with credential scanning, injection attempts, rate-limit bypass patterns, and unusual write methods on read-only endpoints. Return a concise prioritized findings summary with supporting log evidence; do not change gateway configuration.
Required inputs
Path to or excerpt from authorized API-gateway access logs
Log source and format
Field definitions for user, endpoint, resource ID, status code, source IP, headers, and HTTP method where available
Suggested template by Skill Leaderboard, grounded in the linked source. Task evidence ↗
SKILL.md
name: analyzing-api-gateway-access-logsdescription: 'Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules. 'domain: cybersecuritysubdomain: security-operationstags: - api-security- access-log-analysis- aws-api-gateway- kong- nginx- bola-detection- rate-limit-bypass- security-operationsversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - DE.CM-01- RS.MA-01- GV.OV-01- DE.AE-02mitre_attack: - T1190- T1110.004- T1078.004- T1119
Analyzing API Gateway Access Logs
When to Use
When investigating security incidents that require analyzing api gateway access logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Parse API gateway access logs to identify attack patterns including broken object
level authorization (BOLA), excessive data exposure, and injection attempts.
import pandas as pd
df = pd.read_json("api_gateway_logs.json", lines=True)
# Detect BOLA: same user accessing many different resource IDs
bola = df.groupby(["user_id", "endpoint"]).agg(
unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]
Key detection patterns:
BOLA/IDOR: sequential resource ID enumeration
Rate limit bypass via header manipulation
Credential scanning (401 surges from single source)
SQL/NoSQL injection in query parameters
Unusual HTTP methods (DELETE, PATCH) on read-only endpoints