Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection.
SkillScore9Maintained
Automatic
◆Security & AppSec pack
Last verified 7/27/2026
What it changes
Passed 2 of 22 test cases with the skill, and 0 of 22 without it.
Without skill0%
With skill9%
2 fixed0 passed either way20 still failing0 broke
Pass-rate lift
+9 pp
Tokens
-11%
Agent turns
0%
Response time
-30%
Model gemini-3.6-flashMeasured 7/27/2026v12 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
What's inside
The instructions your model reads when the skill loads.
SKILL.md47 lines3 filesincludes scripts
Analyzing API Gateway Access Logs
When to Use
When investigating security incidents that require analyzing api gateway access logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities
Instructions
Parse API gateway access logs to identify attack patterns including broken object
level authorization (BOLA), excessive data exposure, and injection attempts.
import pandas as pd
df = pd.read_json("api_gateway_logs.json", lines=True)
# Detect BOLA: same user accessing many different resource IDs
bola = df.groupby(["user_id", "endpoint"]).agg(
unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]
Key detection patterns:
BOLA/IDOR: sequential resource ID enumeration
Rate limit bypass via header manipulation
Credential scanning (401 surges from single source)
SQL/NoSQL injection in query parameters
Unusual HTTP methods (DELETE, PATCH) on read-only endpoints