API monitoring and alerting

In this final brief section, we will look at how to monitor an API within a SIEM and Security Operation Center (SOC) using as an example the 42Crunch API firewall and the Microsoft Sentinel SIEM.

The 42Crunch firewall emits logs to a local filesystem that can be collected by a log forwarder and forwarded to Azure Log Analytics for ingestion into Microsoft Sentinel. This simplified architecture is shown in Figure 11.20.

Figure 11.20 – 42Crunch firewall log ingestion in Sentinel

Using the 42Crunch marketplace extension, Sentinel can process the API logs and alert against 12 active API rules, as shown in Figure 11.21.

Figure 11.21 – Sample Sentinel API firewall rules

When a rule is triggered, this is recorded on Sentinel as an incident and annotated with all the instance data, such as source IP address, destination path and port, response and request bodies, and return status code...