Cortex Cloud API endpoints provide an overview of the API assets across cloud providers and data sources (for example: API Gateway, API specification), enabling you to analyze, assess, and implement security measures to safeguard against security risks and potential vulnerabilities.
In addition to observing API traffic, Cortex Cloud scans AWS and Azure API gateway, and extracts the API specification files. Once the specification files are in the inventory, Cortex Cloud scans them for misconfigurations and vulnerabilities, providing insights into your API landscape.
At a glance, we see a graphical representation of the APIs per cloud provider, including On-prem, and APIs per discovery source, including XDR agent.
You can filter in by provider or by discovery source.
The following table lists the fields that are available for each API endpoint.
Field | Description |
|---|---|
Server | Hosting server of the API. |
Path | API endpoint path is used by applications to communicate with the server, enabling you to access data and execute actions. |
API Category | Associated category of the API. For example, the API could be associated with Payment. |
HTTP method | The HTTP methods supported include:
|
Risk factors | Indication of the risk type associated with the API:
|
API spec name | API specification name is obtained from the |
API spec conformance | Indicates if the endpoint was found/not found in the specification.
|
Provider | Gateway provider:
|
Source | Indicates the service from which the data was obtained:
|
Inspected | Number of requests or connections that have been analyzed and verified by Cortex Cloud. |
Request/Response Sensitive Data | Shows the sensitive data type in the request/response, such as passwords, credit card numbers, SSNs, or bank account numbers. Refer to What is Cortex Cloud Data Classification? for more information. NoteData classification findings are only available for enabled profiles. |
Request/Response Content Types | Data format sent/received in the request/response of the API calls.
|
Request/Response Data Patterns | Data pattern types such as Credit Card Numbers, SSN, Email Addresses, API Keys. |
Request/Response Data Profiles | Data profile types such as PCI, GDPR, PII, HIPAA. |
Schema | Protocol used to access the API resource:
|
Authentication Types | Authentication methods include the following options:
|
Discovery Method | Based on asset discovery:
|
Asset Status | The API's status is Active only when both an API gateway and an API specification are present; otherwise, it's deleted. An Inactive status means the endpoint is defined in the specification but isn't receiving traffic via the gateway. |
Cloud | Cloud provider where the agent is running. In case of on-prem, this field shows On-prem. |
Provider Type | Indicates the cloud service provider:
|
Region | Region of the hosting server. |
When clicking on a specific API endpoint, a side card opens. Each tab includes detailed information as described.
Shows the highlights and properties of the API endpoint.
Field | Description |
|---|---|
Highlights | Provides an overview of the status of the asset, such as severity type, internet exposure status, and if it includes sensitive data. |
Asset ID | UAI (Unified Asset Inventory) ID |
Provider | API Gateway:
|
Asset Category | Either API Endpoint or API Specification. |
Cloud Region | Region of the cloud provider. |
Asset Groups | Assigned asset groups to the API endpoint. |
Applications | Shows the business applications related to the API endpoint. Clicking the application opens the business application page. NoteTo link APIs to business applications, the two prerequisites must be met:
|
Relations | The Relations graph shows the connections between the API endpoint, API gateway, and VMs. This mirrors what's shown in the Graph Search. Click the API Gateway or API Endpoint to view more details about the asset. |
Account ID | Cloud account ID. |
Cases/Issues/Findings | The link from the number opens the page where you can review the details. Refer to Cases and issues for detailed information. You can view all API security issues and cases detected by Cortex Cloud. |
Related Assets Shows the data from the source of the traffic.
| |
Type | API specification |
Name | Name of the API specification. |
Provider | Cloud provider of the API specification. |
An issue is generated when the following Detection Method is triggered:
Deployment option | Detection Method and Type | Description |
|---|---|---|
Agentless for Posture | Detection Method: API Posture Scanner | If Cortex Cloud detects security vulnerabilities or compliance issues in the posture of an API during scanning, an issue is generated. |
Agentless | Detection Method: API Traffic Scanner | If Cortex Cloud detects anomalies, suspicious activities, or potential security threats in the network traffic of the APIs, an issue is generated. |
Agent-based | Type: Security Detection Method: XDR Agent | If Cortex Cloud detects threats from cloud workloads, an issue is generated. |