Анализ логов API Gateway на угрозы безопасности

★ 8.4 · security

analyzing-api-gateway-access-logs is a Claude Code skill that parses API Gateway access logs from AWS API Gateway, Kong, and Nginx to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. It applies pandas for statistical pattern analysis — for instance, grouping by user_id and endpoint to flag resource ID enumeration exceeding 50 unique values, or spotting 401 surges from a single source IP that indicate credential scanning. The skill also catches unusual HTTP methods like DELETE or PATCH on read-only endpoints and flags excessive data exposure patterns. It is intended for SOC analysts investigating API abuse and for engineers building API-specific threat detection rules; requires Python 3.8+ and JSON-formatted log files.