Monitor and investigate API threats - Administrator Guide - Cortex XDR - Cortex - Security Operations

Advanced Threat Protection

Advanced Threat Protection (ATP) is a comprehensive security feature designed to detect, prevent, and respond to sophisticated Web and API threats, ensuring robust protection for workloads against evolving risks.

Authentication bypass

The Cortex XDR authentication bypass module protects against attacks that attempt to circumvent authentication controls through session manipulation, token exploitation, or credential abuse.

Automation tools

Cortex XDR detects and protects against automated tools or services that scrape website contents such as Scriptable headless web browsers, command line tools, or HTTP libraries.

Cross-Site Scripting (XSS) injection

Cortex XDR protects against XSS attacks, in which malicious JavaScript snippets are injected into otherwise benign and trusted websites. In such attacks, attackers try to trick the browser into switching to a JavaScript context and executing arbitrary code.

CVE exploits

Cortex XDR protects against exploitation attempts of known vulnerabilities (Common Vulnerabilities and Exposures (CVEs)).

Malformed Traffic

Cortex XDR identifies and protects against HTTP requests with anomalies that are not expected from common web browsers.

Injection attacks

Injection attacks are a form of attacks in which attackers attempt to insert malicious input into an application to manipulate its execution. For example, a code injection attack injects code which is interpreted by the application or other runtimes. Command and code payloads can either be injected as part of HTTP requests, or are included from local or remote files (also known as File Inclusion attacks).

Known bots

Cortex XDR can identify legitimate bots that properly declare their identity and purpose, such as search engine crawlers and authorized web indexers. These bots follow standard protocols and provide verifiable operator information, however some of them might cause undesirable behaviors, such as spam, and you might prefer to block such bots.

Offensive tools

Cortex XDR identifies offensive tools that scan web applications for known security vulnerabilities and misconfiguration, and exploit them.

Sensitive data exposure

Cortex XDR protects workloads from providing responses that could expose sensitive data found in critical system files, including password hashes (/etc/shadow), user account information (/etc/password), and private encryption keys.

Such examples would be compromised accounts, credential stuffing, and ATO attacks.

SQL injection (SQLi)

Cortex XDR protects against SQLi attacks, which can occur when an attacker successfully inserts a malicious SQL query into the input fields of a web application. A successful attack can read sensitive data from the database, modify data in the database, or run arbitrary commands.

Identity-based attacks

Cortex XDR identifies and protects from compromised accounts, credential stuffing, and ATO attacks. These types of attacks involve exploiting stolen or weak login credentials to impersonate legitimate users and gain unauthorized access to accounts and systems.

The API inventory's category by type (e.g., login, sign-in, sign-up, register, create account, reset password) and sub-type (e.g., add to cart, show cart, general checkout page, add billing address, add credit card, gift card) is crucial. This enables a deeper investigation into potential discrepancies related to identity-based attacks.