Defender for APIs Threat Detection

Microsoft Defender for APIs is a cloud-native security solution that continuously monitors your APIs (both REST and GraphQL) for malicious activity and suspicious behavior. It is part of Microsoft Defender for Cloud's workload protection plans and is specifically designed to address the unique security challenges of APIs, such as injection attacks (SQL, NoSQL, command), broken authentication, excessive data exposure, and API abuse (DDoS, scraping).

Defender for APIs does not require agents or SDKs; it works by analyzing API traffic logs from Azure API Management (APIM) and Azure App Service (for Logic Apps). It uses machine learning models trained on Microsoft's global threat intelligence to detect anomalies and known attack patterns.

When an API request is processed by Azure API Management, APIM generates diagnostic logs that contain metadata about the request: source IP, user agent, request method (GET, POST, etc.), URL path, query parameters, headers, and response status code. These logs are sent to a Log Analytics workspace (if configured) and are ingested by Defender for APIs.

Defender for APIs performs the following steps:

2. Threat Detection: The service applies multiple detection methods: - Signature-based detection: Matches known attack patterns (e.g., SQL injection patterns like ' OR '1'='1, XSS payloads, path traversal sequences). - Anomaly detection: Uses machine learning to detect deviations from the learned baseline, such as unusual request rates, unexpected parameter values, or access from unusual geographies. - Behavioral analysis: Monitors for suspicious sequences of API calls, like credential stuffing (multiple failed authentications followed by a success) or data scraping (rapid enumeration of resource IDs). - Threat intelligence: Compares source IPs against Microsoft's threat intelligence feeds for known malicious actors (Tor exit nodes, known botnets, etc.).

To enable Defender for APIs:

az security pricing create --name 'Api' --tier 'Standard' --sub <subscription-id>

az monitor diagnostic-settings create --name "APIM-Defender" --resource <apim-resource-id> --workspace <workspace-id> --logs "[{\"category\":\"GatewayLogs\",\"enabled\":true}]" --metrics "[{\"category\":\"AllMetrics\",\"enabled\":true}]"

To view alerts:

az security alert list --subscription <subscription-id> --query "[?contains(alertDisplayName, 'API')]"

A large e-commerce company exposes APIs for product catalog, cart, and checkout. They use Azure API Management with rate limiting and OAuth2 authentication. However, they experienced a credential stuffing attack where attackers used stolen credentials to access user accounts and place fraudulent orders. Defender for APIs detected the attack by identifying a high number of failed authentication attempts (401 responses) from a single IP range followed by successful logins. The alert 'Brute force attack on API' was generated with medium severity. The security team used the alert details to block the offending IPs in the WAF and implemented CAPTCHA for login endpoints. Configuration: They ensured all API Management logs were sent to Log Analytics and enabled the Defender for APIs plan. The detection latency was about 10 minutes, which allowed the attackers to compromise 20 accounts before the alert. The team learned to combine Defender for APIs with Azure AD Identity Protection for real-time blocking. Performance: The platform handles 50 million API calls per day; Defender for APIs cost ~$125/day (at $2.50 per million). Misconfiguration: Initially, they forgot to enable 'GatewayLogs' for all API Management instances, missing coverage for some endpoints.

A bank uses Logic Apps with HTTP triggers to process loan applications. These APIs are internal but exposed over the internet for partner integrations. Defender for APIs detected a SQL injection attempt in a query parameter: ' OR 1=1--. The alert 'Suspicious API request detected' triggered at high severity. The bank had a WAF in front, but the WAF rule for SQL injection was not configured for the specific parameter. The alert allowed the security team to update the WAF rule and also identify that the attacker was scanning for vulnerabilities. They used the alert to trace the source IP and found it belonged to a known scanning service. They blocked the IP and added it to threat intelligence feeds. Configuration: They set up diagnostic logs for the Logic Apps (via App Service diagnostics) and enabled the Defender for APIs plan. They also integrated with Sentinel for automated response (runbook to block IP in WAF). Scale: The bank processes 1 million API calls per month; cost is minimal. Misconfiguration: They initially thought Defender for APIs would automatically block the request, but it only detects; they had to implement blocking separately.

A healthcare provider exposes a FHIR API for patient records. They require strict compliance with HIPAA. Defender for APIs detected an anomaly: a user downloaded 10,000 patient records in 5 minutes, which was 100x the normal rate. The alert 'Data exfiltration via API' triggered at high severity. The security team investigated and found that a legitimate partner's API key was compromised. They revoked the key and alerted the partner. This detection prevented a major data breach. Configuration: They used Defender for APIs with custom anomaly detection thresholds (default thresholds are tuned for general use; they adjusted sensitivity via feedback). They also enabled auditing of all API calls. Scale: 10 million calls per month. Misconfiguration: They initially had no rate limiting on the API, so the exfiltration was possible. They implemented rate limiting after the incident.