Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat

Analyzing API Gateway Access Logs When to Use When investigating security incidents that require analyzing api gateway access logs When building detection rules or threat hunting queries for this domain When SOC analysts need structured procedures for this analysis type When validating security monitoring coverage for related attack techniques Prerequisites Familiarity with security operations concepts and tools Access to a test or lab environment for safe execution Python 3.8+ with required dependencies installed Appropriate authorization for any testing activities Instructions Parse API gateway access logs to identify attack patterns including broken object level authorization (BOLA), excessive data exposure, and injection attempts. Key detection patterns: 1. BOLA/IDOR: sequential resource ID enumeration 2. Rate limit bypass via header manipulation 3. Credential scanning (401 surges from single source) 4. SQL/NoSQL injection in query parameters 5. Unusual HTTP methods (DELETE, PATCH) on read only endpoints Examples

analyzing-api-gateway-access-logs