The ABS AI Engine works in tandem with ASE to automatically discover new and unknown APIs in your ecosystem. You can view the discovered APIs by using the ABS discovery REST API. You can also add the discovered APIs to ASE by using API Discovery in PingIntelligence for APIs Dashboard. For more information, see Discovered APIs.
- Enable ABS in ASE
- Define
root
API JSON in ASE. ABS discovers APIs only for aroot
API JSON in ASE. - Optionally, configure OAuth token and API Key parameters in
root
API JSON - Configure discovery related parameters in abs_init.js file.
When MongoDB is installed, the
abs_init.js
file is copied to MongoDB. Use theupdate.sh
script to edit the default values related to API discovery. For more information on update script, see Manage discovery intervals.
- Enable ABS in ASE Enable ABS by running the enable_abs command in ASE:To verify, run thestatus command in ASE:
./bin/cli.sh -u admin -p admin enable_abs ABS is now enabled
./bin/cli.sh status API Security Enforcer status : started mode : sideband http/ws : port 80 https/wss : port 443 firewall : enabled abs : enabled, ssl: enabled abs attack : disabled audit : enabled sideband authentication : disabled ase detected attack : disabled attack list memory : configured 128.00 MB, used 25.60 MB, free 102.40 MB google pubsub : disabled
-
Configure root API in ASE: ABS discovers APIs in your environment only when
root
API is defined in ASE. If you have configured other APIs in ASE along with theroot
API, ABS monitors traffic only on the root API for the discovery process.Aroot
API in ASE is an API for which the API JSON file hasurl
as“/”
andhostname
as“*”
. Following is a snippet ofroot
API JSON:
A sample{ "api_metadata": { "protocol": "http", "url": "/", "hostname": "*", "cookie": "", "oauth2_access_token": false, "apikey_qs": "", "apikey_header": "", "enable_blocking": false, "cookie_idle_timeout": "200m", "logout_api_enabled": false, "cookie_persistence_enabled": false, "login_url": "", "api_mapping": { "internal_url": "" },
root
API ships with ASE in /pingidentity/ase/config/api directory.Note: If API discovery is enabled in ABS withoutroot
API in ASE and you run thediscovery
REST API, it displays an error message:root API not configured in ASE. To discover APIs configure root API in ASE
. -
API JSON configuration (Optional ): You can optionally configure the settings for
cookie
,oauth2_access_token
,apikey_qs
, orapikey_header
in theroot
API JSON file in ASE.API discovery process discovers these parameters in an API only when you set these in the root API. API discovery reports these attributes of an API only when it receives at least 50% of traffic having these attributes. For example, if the root API receives 100 requests and 51 requests have OAuth token, then the OAuth token is reported in the discovered API. Similarly, if the same traffic has less than 50% traffic for API keys or cookies, then they are not reported in the discovered API.
api_discovery
parameter to true in abs_init.js
files.
db.global_config.insert({
"attack_initial_training": "24",
"attack_update_interval": "24",
"url_limit": "100",
"response_size": "100",
"job_frequency" : "10",
"window_length" : "24",
"enable_ssl": true,
"api_discovery": true,
"discovery_initial_period" : "1",
"discovery_subpath": "1",
"continuous_learning": true,
"discovery_update_interval": "1",
"attack_list_count": "500000",
"resource_monitor_interval" : "10",
"percentage_diskusage_limit" : "80",
"root_api_attack" : false,
"session_inactivity_duration" : "30"
});
abs_init.js
file. If you want update the values on an already
running system, use the update.sh
script. For more information on update
script, see Manage discovery intervals:Variable | Description |
api_discovery
|
Set this variable to true to switch on API discovery.
To switch off API discovery, set it to false . The default
value is true . |
discovery_initial_period
|
The initial time in hours during which APIs are discovered in your API ecosystem. The default and minimum value is 1-hour. |
discovery_update_interval
|
The time interval in hours at which any new discovered APIs are reported. The default and minimum value is 1-hour. |
discovery_subpath
|
The number of subpaths that is discovered in an API. The minimum value is 1 and maximum value is 6. For more information, see Discovery Subpaths. |
url_limit
|
Defines the maximum number of URLs that are reported in a discovered API. |