Set up Web and API Security profiles - Web and API Security profiles provide comprehensive real-time detection and protection for web-based applications and APIs running on Linux-based workloads. - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

XSS

When Cortex XSIAM detects cross-site scripting (XSS) injection, it performs the configured action.

XSS attacks are attacks in which malicious JavaScript snippets are injected into otherwise benign and trusted websites. In such attacks, attackers try to trick the browser into switching to a JavaScript context and executing arbitrary code.

SQL Injection

When Cortex XSIAM detects SQL injection (SQLi) attempts, it performs the configured action.

(SQLi) attacks can occur when an attacker successfully inserts a malicious SQL query into the input fields of a web application. A successful attack can read sensitive data from the database, modify data in the database, or run arbitrary commands.

Injection Attacks

When Cortex XSIAM detects injection attacks, it performs the configured action.

Injection attacks are a form of attacks in which attackers attempt to insert malicious input into an application to manipulate its execution. Command and code payloads can either be injected as part of HTTP requests, or are included from local or remote files (also known as File Inclusion attacks).

CVE Exploits

When Cortex XSIAM detects known vulnerabilities (Common Vulnerabilities and Exposures (CVEs)), it performs the configured action.

Sensitive Data Exposure

When Cortex XSIAM protects workloads from exposing sensitive data, it performs the configured action.

This module protects workloads from providing responses that could expose sensitive data found in critical system files, including password hashes (/etc/shadow), user account information (/etc/passwd), and private encryption keys.

Authentication Bypass

When Cortex XSIAM detects attempts to bypass authentication controls, it performs the configured action.

This module protects against attacks that attempt to circumvent authentication controls through session manipulation, token exploitation, or credential abuse.

Advanced Threat Protection

When Cortex XSIAM detects evolving threats, it performs the configured action.

Advanced Threat Protection (ATP) is a comprehensive security feature designed to detect, prevent, and respond to sophisticated web and API threats, ensuring robust protection for workloads against evolving risks.

Offensive Tools

Cortex XSIAM can identify offensive tools that scan web applications for known security vulnerabilities and misconfiguration, and exploit them. When such tools are found, this module can block or report them.

Malformed Traffic

When Cortex XSIAM detects HTTP requests with anomalies that are not expected from common web browsers, it performs the configured action.

Automation Tools

When Cortex XSIAM detects automated tools, it performs the configured action.

Malicious automated tools or services can scrape website contents such as Scriptable headless web browsers, command line tools, or HTTP libraries.

Known Bots

When Cortex XSIAM detects known bots, it performs the configured action.

Cortex XSIAM can identify legitimate bots that properly declare their identity and purpose, such as search engine crawlers and authorized web indexers. These bots follow standard protocols and provide verifiable operator information, however some of them might cause undesirable behaviors, such as spam, and you might prefer to block such bots.