Analyzing Api Gateway Access Logs

Parses API Gateway access logs from AWS, Kong, or Nginx to spot BOLA attacks, rate limit bypasses, credential scanning, and injection attempts. You get pandas-based detection patterns for things like users enumerating resource IDs, 401 surges from single IPs, and suspicious HTTP methods on read-only endpoints. Useful when you're investigating API abuse or building threat detection rules and need structured procedures instead of ad-hoc log queries. The examples are straightforward, grouping operations that flag anomalies like users hitting 50+ unique resource IDs or IPs generating 100+ auth failures. Maps to MITRE T1190 and NIST detection functions if you need compliance alignment.

skills.sh installs: 782
GitHub stars: 35.9K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-api-gateway-access-logs --agent claude-code

Installs into .claude/skills of the current project.

Files

Analyzing API Gateway Access Logs

When to Use

When investigating security incidents that require analyzing api gateway access logs
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Parse API gateway access logs to identify attack patterns including broken object level authorization (BOLA), excessive data exposure, and injection attempts.

import pandas as pd

df = pd.read_json("api_gateway_logs.json", lines=True)
# Detect BOLA: same user accessing many different resource IDs
bola = df.groupby(["user_id", "endpoint"]).agg(
    unique_ids=("resource_id", "nunique")).reset_index()
suspicious = bola[bola["unique_ids"] > 50]

SKILL.md on GitHub