Blocked connection reporting
API Behavioral Security (ABS) Blocked Connection REST application programming interface (API) reports all connections that are blocked by API Security Enforcer (ASE).
Two types of reports are provided:
-
Blocked Connection Summary Report
-
Blocked Connection Detail Report
The blocked connections are reported for the following categories:
-
API routing
-
DDoS flow control
-
ABS detected attacks
-
Custom blacklist
-
Decoy attacks
-
ASE detected attacks
Use the following ABS REST API for viewing the blocked connections report:
Blocked connection summary
URL: <ABS_IP>:port/v4/abs/bc?earlier_date=<>T<hh:mm>&later_date=<>T<hh:mm>
The following is a snippet of blocked connection summary report:
{
"company": "ping identity",
"name": "api_blockedconnections",
"description": " This report contains a summary of all API traffic blocked
by ASE for the following types: api_not_found, host_header_not_found,
backend_not_found, client_spike, server_spike, bytes_in_threshold,
bytes_out_threshold, quota_threshold, customer_blacklist,
abs_detected_attacks, ase_detected_attacks, decoy_detected_attacks",
"earlier_date": "Thu Jan 18 13:00:00:000 2018",
"later_date": "Thu Feb 22 18:00:00:000 2018",
"api_name": "global",
"total_blocked_connections": 21222,
"api_not_found": 0,
"host_header_not_found": 0,
"backend_not_found": 3501,
"client_spike": 237,
"server_spike": 6179,
"bytes_in_threshold": 5938,
"bytes_out_threshold": 18,
"quota_threshold": 0,
"customer_blacklist": 0,
"abs_detected_attacks": 4576,
"ase_detected_attacks": 773,
"decoy_detected_attacks": 0
Blocked Connection Details
URL: <ABS_IP>:port/v4/abs/bc?later_date=<>T<hh:mm>&earlier_date=<>
T<hh:mm>&details=true
The following is a snippet of blocked connection details report:
{
"company": "ping identity",
"name": "api_blockedconnections",
"description": "This report contains details of all API traffic blocked by
ASE for the following types: api_not_found, host_header_not_found,
backend_not_found, client_spike, server_spike, bytes_in_threshold,
bytes_out_threshold, quota_threshold, customer_blacklist,
abs_detected_attacks, ase_detected_attacks, decoy_detected_attacks,
"earlier_date": "Thu Jan 18 13:00:00:000 2018",
"later_date": "Thu Feb 22 18:00:00:000 2018",
"api_blocked_connections": [
{
"category": "api_routing",
"details": [
{
"source": "192.168.11.161",
"type": "backend_not_found",
"destination_api": "/v2/pet/55"
},
{
"source": "192.168.11.161",
"type": "backend_not_found",
"destination_api": "/v2/store/inventory"
}
]
},
{
"category": "ddos_flowcontrol",
"details": [
{
"source": "100.64.1.24",
"type": "bytes_in_threshold",
"destination_api": "/app/ws"
},
{
"source": "100.64.3.213",
"type": "protocol_violation",
"destination_api": ""
}
]
},
{
"category": "abs_detected_attacks",
"details": [
{
"source": "100.64.38.180",
"type": "ioc_abs_ip_port",
"destination_api": "/atmapp/zipcode"
},
{
"source": "100.64.38.180",
"type": "ioc_abs_ip_port",
"destination_api": "/atmapp/zipcode"
}
]
},
{
"category": "customer_blacklist",
"details": []
},
{
"category": "decoy_detected_attacks",
"details": []
},
{
"category": "ase_detected_attacks",
"details": [
{
"source": "100.64.8.252",
"type": "protocol_violation",
"destination_api": ""
},
{
"source": "100.64.36.93",
"type": "protocol_violation",
"destination_api": ""
}
]
},
]
}
]
}