Web Application Firewall:API security risks and events

A security risk is a vulnerability in an interface caused by bugs in development, management, or configuration. A security risk does not mean an attack has occurred, whereas a security event is an alert generated by an attack. You can view details about detected risks by clicking the Risk Detection tab or the View More button in the upper-right corner of the Risk Site Statistics table.

Page features

On the API Security page, go to the Risk Detection tab to view statistical data from API risk analysis and perform conditional searches. This tab has three main modules: Risk Statistics, the risk type list on the left, and API Risk Details.

View and manage API risks

After you find a specific API risk, you can view and manage it using the following methods:

• Modify the API risk status

  Click the icon in the Status column, select a threat status, and click OK.

• View the API asset involved in the risk

  Click the source API of a specific risk to view the API asset on the API details page. For a detailed description of the API details page, see 3. API details.

• View API risk details

  In the Actions column for the target risk ID, click View Details. The risk details page displays the following information:

  • Basic Information

    • View information such as API, Risk ID, First Discovered, Risk Description, Recommended Action, Domain Name, Business Purpose, Status, and AI Analysis.

  • Risk Status Description

    • The initial risk status is To Be Confirmed. You can change this status to Confirmed, To Be Fixed, Pending System Verification, Fixed (Manual Verification), or Ignore and add remarks.

    • When you set the risk status to Pending System Verification, the system automatically determines whether the risk is fixed based on the following rules. If the conditions are met, the status changes to Fixed (System Verification). Otherwise, the status changes to Verification Failed:

      • The Unauthenticated Access to Sensitive API risk is resolved when the system detects that the API has implemented authentication or no longer transmits sensitive data.

      • For the Unauthorized Access to Internal API risk, the system detects if the API is no longer internal or if authentication has been added.

      • Other risks are identified if the Last Detection Time was more than 7 days ago and the API was accessed within the last 7 days.

      • Other risks are flagged if the Last Detection Time is more than one day ago and the number of visits today is greater than 100.

    • Security and business teams can refer to the following flowchart to establish a standard workflow for handling risk statuses.

      

• Risk Verification

  On the Risk Verification tab, you can view the request sample and perform the following operations:

  • On the Risk Verification tab, you can view the request sample.

  • Click Open In Browser to run the GET request in a browser.

  • Click Command Line to convert the sample request to a command-line format. Click Copy to copy the request for manual execution.

  • Click Copy Code to copy the sample request.

• Operation Record

  On the Operation Record tab, you can view the operation records for the risk event.

Export API risk data

1. Click the icon in the upper-right corner of API Risk Details to create an export task.

2. In the upper-right corner of the API Security page, click Export History. Find the file that you want to download and click Download in the corresponding Actions column.

View and manage API security events

After you find a specific API security event, you can manage it using the following methods:

• Modify the API security event status

  Find the row with the target security event ID, click the icon in the Status column, select a new status, and click OK.

• Add an IP address or account to the whitelist

  In the Actions column of the target event, click Add to Whitelist. This action adds the IP address or account that triggered the event to a whitelist. The event status changes to Confirmed, and the policy type of the event is not checked by default.

• Add an IP address to the blacklist

  In the Actions column for the target event, click Block IP Address. This adds the IP address that triggered the event to the blacklist. By default, the event status changes to Handled.

• View API security event details

  In the Actions column for the target event, click View Details. On the event details page, you can view the following information:

  • Basic Information

    • View information such as Event ID, Start/End Time, and Status.

    • Modify the security event status.

      When you set a security event's status to Confirmed, Handled, or Ignored, you can add notes.

  • Attack Details: View information such as data samples and event trends.

    • To query logs for IP security events, click Log Query in the Actions column of the Attack Source Analysis section.

    • For account security events, you can query the logs by clicking Log Query in the Actions column of the API Distribution section.

  • Recommended Action: View recommended actions for handling the security event.

  • Operation Record: View the history of operations performed on the security event.

Export API security event data

1. Click the icon in the upper-right corner of API Security Event Details to create an export task.

2. In the upper-right corner of the API Security page, click Export History. Then, find the file that you want to download and click Download in the Actions column.