PingIntelligence Hardening Guide

PingIntelligence

PingIntelligence for APIs
PingIntelligence for APIs Overview
Release Notes
PingIntelligence 5.0.1 - August 2021
PingIntelligence 5.0 - June 2021
Previous releases
PingIntelligence PoC
PingIntelligence Docker PoC deployment
Docker PoC setup
Installation requirements
Download and untar Docker package
Configure Docker PoC for sideband
Install and load Docker images
Setup the PoC environment
Start the training
Generate sample attacks
API deception
API discovery
Access PingIntelligence Dashboard
API
Tune thresholds and unblock clients
Dashboard
Interactive blacklists
Dashboard time series
ABS detailed reporting
Shutdown the PoC environment
Appendix: Verify the Setup
PingIntelligence Kubernetes PoC deployment
PingIntelligence Kubernetes PoC
PingIntelligence Cloud service deployment
PingIntelligence Cloud service
Downloading and installing ASE software
ASE License
Configure PingIntelligence Cloud Connection
Obfuscate access and secret key
Start and stop ASE
Enable ASE to ABS engine communication
Integrate PingIntelligence into your API environment
Configure ASE and Dashboard
Add APIs to ASE
AI engine training
Connect to the PingIntelligence dashboard
Access ABS reporting
PingIntelligence Production Deployment
Automated deployment
PingIntelligence setup
PingIntelligence deployment modes
Prerequisites
Download the deployment package
Step 1 - User and authentication
Step 2 - Copy PingIntelligence license
Step 3 - Configure hosts file and download software
Manually download third-party components
Download PingIntelligence for APIs software
Checking SSH connectivity
Changing default settings
Change ASE default settings
Changing ABS default settings
Change Dashboard default settings
Change settings in dashboard-default.yml
Change settings in ilm.json
Step 4 - Configure system parameters
Step 5 - Install the PingIntelligence for APIs software
Install PingIntelligence as a systemd service
Verify PingIntelligence Installation
Next steps - Integrate PingIntelligence into your environment
Shut down the deployment
Logs
Manual deployment
PingIntelligence manual deployment
Part A – Install ABS and MongoDB
Install ABS AI engine software
ABS License
Obfuscate passwords
Import existing CA-signed certificates
Install MongoDB software
Change default settings
Connect ABS to MongoDB
Start and Stop ABS
Part B – Install ASE
ASE ports
ASE deployment modes
Install ASE
ASE license
Change default settings
Obfuscate keys and passwords
Tune host system for high performance
Start and Stop ASE
Configure SSL for client side connection or external APIs
Setup ASE cluster (optional)
Scale up the ASE cluster
Scale down the ASE cluster
Delete a cluster node
Stop ASE cluster
Part C – Integrate ASE and ABS
Connect ASE to ABS AI engine
Enable ASE to ABS engine communication
Add APIs to ASE
Train ABS AI engine
Part D – Install PingIntelligence Dashboard
Install PingIntelligence Dashboard
Start and stop Dashboard
Part E – Access ABS reporting
Install Postman with PingIntelligence for APIs Reports
Using ABS self-signed certificate with Postman
View ABS Reports in Postman
Part F - Integrate API gateways for sideband deployment
API Security Enforcer
Administration
ASE license
ASE interfaces
Customizing ASE ports
Configure time zone - ASE
Tune host system for high performance
Start and stop ASE
Change default settings
Obfuscate keys and passwords
Delete UUID to propagate changed password
PKCS#12 keystore
Directory structure
Administering an ASE cluster
Start ASE cluster
Scale up the ASE cluster
Scale down ASE cluster
Delete ASE cluster node
Stop ASE cluster
ASE Cluster SSL
Using the default certificate
Creating a new SSL certificate
Importing an existing certificate and key-pair
Restart ASE cluster
Configure API JSON files
Configure SSL for external APIs
Configure SSL for management APIs
Configure native and PAM authentication
ASE management, access and audit logs
Change management log levels
Purge log files
Configure syslog
Email alerts and reports
ASE alerts resolution
Sideband ASE
Sideband ASE configuration - ase.conf
API naming guidelines
Defining an API using API JSON configuration file in sideband mode
Activate API cybersecurity
ASE attack detection
Capture client identifiers
Extract user information from JWT in sideband mode
Extract username from custom header in sideband mode
Manage whitelist and blacklist
ASE generated error messages for blocked requests
Per API blocking
API deception environment
ABS AI-based security
Configure ASE to ABS connectivity
Manage ASE blocking of ABS detected attacks
Configure Google Pub/Sub
REST APIs for sideband token and authentication
CLI for sideband ASE
Inline ASE
Inline ASE configuration - ase.conf
API naming guidelines
Defining an API using API JSON configuration file in inline mode
API routing
Real-time API cybersecurity
ASE attack detection
API name mapping – hide internal URLs
Capturing client identifiers
Extract user information from JWT in inline mode
Extract username from custom header in inline mode
Manage whitelist and blacklist
Map server error messages to custom error messages
ASE generated error messages for blocked requests
Per API blocking
API deception environment
In-context decoy API
Out-of-context decoy API
Real-time API deception attack blocking
ASE DoS and DDoS protection
REST API protection from DoS and DDoS
WebSocket API protection from DoS and DDoS
Server connection queuing for REST and WebSocket APIs
ABS AI-based security
Configure ASE to ABS connectivity
Manage ASE blocking of ABS detected attacks
CLI for inline ASE
ASE REST APIs using Postman
ASE self-signed certificate with Postman
View ASE REST APIs in Postman
REST API for inline and sideband ASE
Audit log
Supported encryption protocols
Autoscaling ASE in AWS environment
Create an AMI for ASE
Creating an IAM role in the security, identity, and compliance
Create the security group
Creating launch configuration
Creating an auto-scale group
ASE log messages
ABS AI Engine
Administration
ABS License
Change default settings
Obfuscate passwords
ABS POC mode
Start and Stop ABS
ABS users for API reports
ABS directory structure
Configure SSL
Configure time zone - ABS
Import existing CA-signed certificates
ABS ports
ABS configuration - abs.properties
Connect ABS to API Security Enforcer
ABS cluster
ABS logs
Purge the processed access logs from ABS
Purge MongoDB data
Reset MongoDB
Add a member to an existing MongoDB replica set
Remove a member from a MongoDB replica set
Verify MongoDB SSL certificates
Email alerts and reports
ABS alerts
ABS reports
AI Engine training
Training the ABS model
AI Engine training variables
Training period status
Update the training variables
Tune thresholds for false positives
Resetting trained APIs
Disable attack detection
API discovery and configuration
API discovery process
Discovery Subpaths
ABS Discovery API
Manage discovery intervals
Global configuration update REST API
REST API attacks
REST API attack types
Attacks based on username activity
Attacks based on API Key activity
Attacks based on cookie activity
Attacks based on token activity
Attacks based on IP activity
WebSocket API attack detection
Attack detection on root API
Manage attack blocking
ABS blacklist reporting
Delete individual client identifiers
Bulk delete client identifiers
Enable or disable attack IDs
TTL for client identifiers in ABS
Automated ASE attack blocking
Attack management in ASE
Manage ASE whitelist
Manage ASE blacklist
Per API blocking in ASE
Attack reporting
Consolidated result of attack types
Real-time Detected attacks for inline ASE
Anomalous activity reporting
Deception and decoy API
Blocked connection reporting
API forensics reporting
API metrics reporting
Username based metrics
API Key based metrics
OAuth token based metrics
List valid URL
Hacker's URL
Backend error reporting
API DoS and DDoS threshold
API reports using Postman
Using an ABS self-signed certificate with Postman
View ABS reports in Postman
ABS CLI
ABS REST API format
ABS external REST APIs
Admin REST API
Discovery REST API
Decoy REST API
Threshold REST API
GET Threshold
PUT Threshold
Metrics REST API
API Key Metrics REST API
OAuth2 Token Metrics REST API
Username Metrics REST API
Anomalies REST API
Anomalies across APIs
OAuth2 Token Forensics REST API
IP Forensics REST API
Cookie Forensics REST API
Token Forensics REST API
API Key Forensics REST API
Username Forensics REST API
Attack Types REST and WebSocket APIs
Flow Control REST API
Blocked Connection REST API
Backend Error REST API
List Valid URLs REST API
List Hacker's URL REST API
Delete Blacklist REST API
Threshold range for Tn and Tx
ABS log messages
PingIntelligence Dashboard
Administration
Installation prerequisite
Install PingIntelligence Dashboard
Access PingIntelligence Dashboard
Start and stop Dashboard
Obfuscate keys and passwords
Configure time zone - PingIntelligence Dashboard
Configure Dashboard properties - dashboard.properties
Configure WebGUI properties - webgui.properties
Configure dashboard engine
Dashboard engine fast forward
Configure dashboard engine for syslog
Configure authentication - SSO with PingFederate
Configuring an OAuth client in PingFederate for PingIntelligence Dashboard SSO
Configuring Dashboard sso.properties for PingFederate
Configuring SSO with PingOne
Configuring an OIDC Application in PingOne for PingIntelligence Dashboard
Configuring Dashboard sso.properties for PingOne
Automatic rollover index
Splunk for PingIntelligence
Installing and configuring Splunk for PingIntelligence
Types of data captured
Installing and configuring the Splunk Universal Forwarder
Alert notification on Slack and Email
attack.log for Splunk
Dashboard log messages
Purge dashboard logs
Purge data from Elasticsearch
Purge Web GUI logs
Dashboard
Interactive blacklists
Dashboard time series
Per API activity
Forensic reports
Client forensic report
Cross API attacks and recently discovered APIs
Attack insights
API groups
Administering API groups
Creating and deleting API groups
Adding, deleting, and moving APIs
Merging a user-defined API group into the default API group
Searching or sorting API groups and APIs
Discovered APIs
Configure API discovery
Edit the discovered APIs
Viewing and managing Indicators of Attack
Enabling or disabling attacks
Determining the training status of an API
Configuring training settings
PingIntelligence Integrations
Akana API gateway sideband integration
Prerequisites
Add PingIntelligence ASE APIs
Secure PingIntelligence ASE APIs
Capture ASE details
Deploy PingIntelligence policies
PingIntelligence Apigee integration
Prerequisites to deploying PingIntelligence shared flow
Downloading and installing the automated policy tool
About Apigee properties file configuration
Resetting timeout configurations
Extract user information from access tokens
Deploying the PingIntelligence policy
Configuring PingIntelligence Flow Callout in Apigee
Changing the deployed policy mode
Add API definitions to ASE
Undeploying the PingIntelligence policy
Troubleshooting mismatch of self-signed certificates
AWS API gateway integration
PingIntelligence AWS API Gateway Integration
Prerequisites
Configure automated policy tool
Deploy PingIntelligence Policy for AWS
Next steps - Integrate into your API environment
Uninstall CloudFront sideband policy
Axway API gateway integration
Axway sideband integration
Prerequisites
Deploy PingIntelligence policy
Axway Policy Studio configuration
Configure ASE persistent connection
Axway API Manager configuration
API discovery
Axway API Manager configuration for PingIntelligence Dashboard
Configure tags in API Manager
Configure tags for decoy API
Axway XFF policy for decoy APIs
OAuth2 Token and API Keys
Azure API gateway integration
Azure APIM sideband integration
Prerequisites
Deploy PingIntelligence policy
Integrate PingIntelligence
Configure ASE persistent connection
CA API gateway integration
PingIntelligence - CA API gateway sideband integration
Prerequisite
Install and configure the PingIntelligence bundle
Import PingIntelligence policy
Configure ASE token and certificate
Apply PingIntelligence policy
Integrate PingIntelligence
F5 BIG-IP integration
F5 BIG-IP PingIntelligence integration
Prerequisites
Deploy PingIntelligence policy
Import and configure PingIntelligence policy
Create LX plugin
(Optional) Create backend server pool and frontend virtual server
Add PingIntelligence policy
IBM DataPower gateway integration
IBM DataPower Gateway sideband integration
Prerequisites
Deploy PingIntelligence policy
Add PingIntelligence policy components
Configure PingIntelligence policy components
Kong API gateway integration
PingIntelligence - Kong API gateway integration
Prerequisites
Deploy PingIntelligence policy
Extracting user information when OIDC plugin is used
Mulesoft API gateway integration
Mulesoft sideband integration
Prerequisites
Deploy PingIntelligence policy
PingIntelligence for Mulesoft 3.9
PingIntelligence for Mulesoft 4.x
Apply PingIntelligence policy
Remove existing PingIntelligence policy
Next steps - Integration
NGINX integration
NGINX sideband integration
Prerequisites
NGINX for RHEL 7.6
Configure NGINX for PingIntelligence
NGINX for Ubuntu 16.04
Configure NGINX for PingIntelligence
Next steps - integration
NGINX Plus integration
NGINX Plus sideband integration
Prerequisites
NGINX Plus for RHEL 7.6
Configure NGINX Plus for PingIntelligence
Configuring NGINX Plus with PingAccess agent for PingIntelligence
Configuring API JSON to extract user information
NGINX Plus for Ubuntu 16.0.4
Configure NGINX Plus for PingIntelligence
NGINX Plus for Debian 9
Configure NGINX Plus for PingIntelligence
PingAccess API gateway integration
PingAccess sideband integration
Prerequisites
Configure PingFederate to extract token attributes
Deploying the PingIntelligence policy
Configure ASE persistent connection
API discovery
Handle exceptions
PingFederate integration
PingFederate sideband integration
Prerequisites
Deploying the PingIntelligence policy
Configuring PingIntelligence servlet filter
Configuring API JSON
WSO2 API gateway integration
PingIntelligence WSO2 integration
PingIntelligence Docker toolkit
Untar the Docker toolkit
Build the PingIntelligence Docker images
Environment variables exposed in Docker images
ILM policy configuration in Dashboard
Using environment variables - example
PingIntelligence Hardening Guide
PingIntelligence security hardening guide
PingIntelligence Monitoring Guide
PingIntelligence Health Check Guide
PingIntelligence Troubleshooting Guide
Troubleshooting issues between on-premise ASE and PingOne API Intelligence
PingIntelligence Upgrade Guide
Step-1 Upgrading MongoDB
Step-2 Upgrading ABS AI Engine
Step-3 Upgrading PingIntelligence Dashboard
Step-4 Upgrading ASE
Verifying MongoDB indexes
PingIntelligence Usecases
Converting SSL certificates to ASE compatible format

Back to home page