Skill UI

This tool parses API Gateway access logs from various providers (AWS, Kong, Nginx). It performs statistical analysis using pandas to detect critical security threats such as Broken Object Level Authorization (BOLA/IDOR), credential stuffing, rate limit bypass attempts, and injection vulnerabilities. Ideal for SOC analysts or security engineers investigating API abuse and building advanced threat detection rules.

This skill provides structured methods for detecting credential stuffing attacks by analyzing authentication logs. It focuses on identifying complex patterns such as login velocity anomalies, high IP diversity, password spray techniques, and suspicious geographical distributions of failed logins. It is essential for SOC analysts conducting threat hunting or building robust detection rules against account takeover attempts.