analyzing-api-gateway-access-logs

Group log entries by user ID or source IP and count the number of unique resource IDs each one accesses. Users accessing more than 50 unique resources are flagged as BOLA suspects with CRITICAL severity in the generated report.

Filter log entries with 401 or 403 status codes and group them by source IP. Any IP generating more than 100 authentication failures is flagged as a credential scanner, along with the number of distinct endpoints it probed.

The analysis script accepts JSON lines files and CSV files containing fields such as timestamp, source_ip, status_code, request_path, and resource_id. It covers AWS API Gateway, Kong, and Nginx access log structures.

Yes, the script applies regex patterns to query strings and request bodies to match SQL injection, NoSQL operators like $ne and $where, XSS payloads, and path traversal sequences. Matching requests are reported as HIGH severity injection attempts.

Fixed thresholds such as 50 unique resources or 100 requests per minute can miss low-and-slow attacks and may false-positive on legitimate high-volume clients. Thresholds should be tuned to the baseline traffic of the specific API.