Real-Life Microsoft Defender for APIs

Early this year Microsoft has announced a new solution called Azure Defender for APIs that brings security insights, ML-based detections to APIs that are exposed via Azure API Management. We mirrored to Defender some production traffic for a total of 300M requests; let’s see which kind of insights we got.

How does it work?

Actually it’s pretty straightforward. It all starts by enabling Defender for APIs on your subscription(s). Once enabled, Defender will generate a set of recommendations indicating the APIs available in the different API Management services discovered in your subscription. To complete the API onboarding on Defender you need to select the API and remediate the recommendation.

We can imagine that, under the hood, a ‘log-to-eventhub’ policy is transparently injected into your APIM instance. This policy streams your inbound and outbound data to a Microsoft internal event hub, from which it is ingested into the Defender.

The changes applied by Defender are not visible in your APIM policies and there is no impact either on your code or your release pipeline.

Microsoft Defender For API

Security Alerts

Defender for APIs comes with some interesting features like API inventory, security recommendations and more. In this post I want to focus on the runtime anomaly detection by looking at some security alerts surfaced by the Defender.

All the alerts below come with additional details like timestamps, involved API endpoints, HTTP status code and more.

1️⃣ Suspicious spike in API traffic from a single IP address

This detection alerts when a single IP is observed calling many distinct API endpoints in a given time window. The detection system used historical traffic patterns to establish a baseline for routine API traffic volume to the endpoint coming from a specific IP to the endpoint. The detection system flagged an unusual deviation from this baseline leading to the detection of suspicious activity.

Alert example

  • Event of Interest: Client IP 80.81.82.83 recently made 348 API calls to POST https://whatever.net/something/v1/this/thing with status code of 2XX in a 20 minute time window.
  • Historical behavior:  In the past 30 days, distinct IPs accessing POST https://whatever.net/something/v1/this/thing made an average (mean) of 7.47 API calls to this endpoint with a status code of 2XX across 20 minute time windows.
  • Deviation from historical behavior: The event of interest (348 API calls with status code of 2XX) is several multiples higher than the observed mean for individual users accessing this endpoint.

2️⃣ Suspicious population-level spike in API traffic 

This detection alerts on spikes in request traffic to a single endpoint. The detection system used historical traffic patterns to establish a baseline for routine API traffic volume between all IPs and the endpoint, with the baseline being specific to API traffic for each status code (such as 200 Success). The detection system flagged an unusual deviation from this baseline leading to the detection of suspicious activity.

Alert example

  • Event of interest : The aggregate user population (all IPs) made 4448 API calls to POST https://whatever.net/something/v1/this/or/that with status code of 2XX in a 20 minute time window.
  • Historical behavior : In the past 30 days, the aggregate user population (all IPs) made an average (mean) of 296.26 API calls to POST https://whatever.net/something/v1/this/or/that with a status code of 2XX across 20 minute time windows. Across 20 minute periods, the standard deviation for the number of API calls was 289.44.
  • Deviation from historical behavior: The event of interest (4448 API calls with status code of 2XX) is  several standard deviations higher than the observed mean.

3️⃣ Suspicious IP address

This detection alerts when an API is accessed from an IP that Microsoft Threat Intelligence has associated with suspicious activity. This event may represent an attacker who is attempting to probe your API for vulnerabilities. The attacker may be seeking access to confidential data on your system, or they might be aiming to take over your system as a springboard for further attacks. Due to the transient nature of IP addresses, it is also possible that this traffic is innocuous, but be on the lookout for any questionable activity originating from this IP.

Alert example:  Client IP 80.81.82.83 has been identified as having a high-probability of being involved in malicious activity.

4️⃣ Unusually large request body transmitted between a single IP address and an API endpoint

This detection alerts on suspicious spike in API request body size was observed for traffic between a single IP and one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the typical API request body size between a specific IP and API endpoint. The learned baseline is specific to API traffic for each status code (e.g., 200 Success). The alert is triggered when the API request size deviated significantly from the historical baseline.

Alert example

  • Event of Interest:  Client IP IP 80.81.82.83 recently made an API call (status code 204)  with payload size (383.66 KB) to POST https://whatever.net/something/v1/example
  • Historical behavior:  In the past 30 days, distinct IPs accessing POST https://whatever.net/something/v1/example made API calls (with status code 204) with an average (mean) payload size of 1.0 KB to this endpoint.
  • Deviation from historical behavior: The event of interest (API Payload Size 383.66 KB) is several multiples higher than the observed mean for individual users accessing this endpoint.

5️⃣ Parameter value(s) with anomalous data types in an API call 

This detection alerts when a single IP is observed accessing one of your API endpoints and using parameter values of a low probability data type (e.g., string, integer, etc.). Based on historical traffic patterns from the last 30 days, Defender for APIs learns the expected data types for each API parameter. 

Alert example

  • Event of Interest: Client IP 80.81.82.83 recently called PUT https://whatever.net/something/v1/example/things/ABC  and used the following parameters and types. URL path parameters: “things”, types:“STRING”. The following parameters were highly anomalous: URL path anomalous parameters: “things”.
  • Historical behavior: Based on historical activity from users accessing PUT https://whatever.net/something/v1/example/things/3088 in the past 30 days, the highly anomalous parameters had the following historical type percentages. Anomalous URL Path Parameters History (“things” ): NUMBER: 100.0%, BOOLEAN: 0.0%, DATE_TIME: 0.0%, STRING: 0.0%, UUID: 0.0%, EMPTY: 0.0%

‍6️⃣ Distributed parameter enumeration on an API endpoint

This detection alerts when the aggregate user population (all IPs) is observed enumerating parameters when accessing one of the API endpoints. Based on historical traffic patterns from the last 30 days, Defender for APIs learns a baseline that represents the typical number of distinct parameter values used by the user population (all IPs) when accessing an endpoint across 20-minute windows.

Alert example

  • Event of interest : The aggregate user population (all IPs) recently called GET https://whatever.net/something/v1/this/{bag}/things and used an average 1837.0 distinct values for parameter “bag” across several requests in a 20 minute time-window.
  • Historical behavior : In the past 30 days, the aggregate user population (all IPs) called GET https://whatever.net/something/v1/this/{bag}/things and used an average (mean) of 107.95 distinct values for parameter “bag” across 20 minute time windows. Across 20 minute periods, the standard deviation for the distinct number of values used for parameter “bag” was 101.68.
  • Deviation from historical behavior : The event of interest (API calls using 1837.0 distinct values for parameter “bag”) is several standard deviations higher than the observed mean.

About the data mirrored to the Defender

  • Data is retained within the geo boundary**.** For EU customers, data does not leave the EU boundaries. For sensitive data (i.e., customer data), this will include the IP address in the HTTP request, along with the API request/response bodies. IP addresses are retained for a period of 30 days. API request and response bodies are retained for a period of 48 hours (only used for the data classification capability).
  • The raw HTTP traffic logs are processed by Microsoftbackend systems. Only resulting metadata (e.g., data classifications, security insights) are displayed to the customer.  In the case of security alerts, the security alerts themselves will contain the attributed “suspicious” IP address to be used by the customer SOC teams for investigation & remediation.
  • Defender for APIs does honor GDPR requirements. For GDPR DSR Delete requests – No data in-scope for GDPR is retained for longer than 30 days (i.e., all in-scope data already has a max retention for 30 days, so no separate process required to initiate GDPR DSR Delete requests). For GDPR DSR Export requests – Only applicable to in-scope data retained >48 hrs. (i.e., only the IP address).

Conclusion

Azure Defender for APIs provides a robust selection of security alerts generated through real-time observation. These alerts cover various scenarios and they are extremely useful in pinpointing misconfigurations and misuse. It is great to see the progress made with this solution and we are excited about the additional features the future may hold. Happy security everyone!

Photo by Nik Shuliahin on Unsplash