Analyzing Api Gateway Access Logs

Parses API Gateway access logs from AWS, Kong, or Nginx to spot BOLA attacks, rate limit bypasses, credential scanning, and injection attempts. You get pandas-based detection patterns for things like users enumerating resource IDs, 401 surges from single IPs, and suspicious HTTP methods on read-only endpoints. Useful when you're investigating API abuse or building threat detection rules and need structured procedures instead of ad-hoc log queries. The examples are straightforward, grouping operations that flag anomalies like users hitting 50+ unique resource IDs or IPs generating 100+ auth failures. Maps to MITRE T1190 and NIST detection functions if you need compliance alignment.

Install to Claude Code

npx -y skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-api-gateway-access-logs --agent claude-code