Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Cortex CloudCortex CLI

Cortex CLI for API Security

API Security testing is implemented in Cortex XSIAM through the Cortex CLI.

This testing evaluates APIs for vulnerabilities and misconfigurations using fuzzing techniques to ensure secure data transmission, prevent unauthorized access, and to ensure that the API behaves as expected under unexpected or malformed input.

Prerequisite

  • Ensure you have the required user permissions. Refer to Cortex CLI for more information

  • Onboard and install the Cortex CLI. Refer to Connect Cortex CLI for more information

  • Ensure your application exposes APIs and provides a corresponding OpenAPI Specification file

  • Ensure that you have installed Java v 11 and above

Authentication

The authentication file schema defines the authentication method (such as JWT, Basic) used to authorize connections to your scanned application. The following example provides configurations examples for common methods, including Basic authentication, API Keys and bearer tokens.

Example

type: headers
creds:
    name: <header name>
    value: <header value>
------------------------------------
For basic auth
type: basic
creds:
    username: {USERNAME}
    password: {PASSWORD}
------------------------------------
For API Keys
type: headers
creds:
    name: x-api-key
    value: {API key}
------------------------------------
For Bearer tokens
type: headers
creds:
    name: Authorization
    value: Bearer {BEARER_TOKEN}

Running API Security scans

To scan API Security, run:

Output

The API Security scan generates a detailed scan report that includes:

  • Findings: These include vulnerabilities and risks identified in the scanned application's APIs, such as SQL Injection, sensitive data leaks, and other issues

  • Errors: This section lists error responses returned by the scanned application

  • Metadata: Information such as runtime details, scan status (success or failure), scan duration, hostname and scan parameters

The following schema defines the structure and format of API Security scan reports.

Read more...

The following is an example of API Security scan output.

Read more...

Cortex CLI API Security command line reference guide

This reference guide describes the dedicated API Security commands and flags, including the structure of base commands and subcommands. Refer to Cortex CLI common command line reference guide for Cortex CLI commands common to all supported modules.

Value
Command

--scanned-app-url (string)

Base URL of the app to scan (required)

--api-spec-file

(string)

Path to the API specification file (required)

--api-spec-type

(string)

Type of the API specification ('openapi) (default "openapi")

--auth-file

(string)

Path to the authentication file (optional). For more information on authentication, refer to Cortex CLI for API Security

--concurrency

(int)

Concurrency limit for scan requests (default 5)

--java-location

(string)

Path to the Java (version >= 11) binary file (default: Java)

--no-publish

(boolean)

Avoid publish results to Cortex

--output-file

(string)

Output path for the report file (optional)

--timeout

(int)

Scan timeout in seconds (default 300)

--zap-port

(int)

Listening port to be used by ZAP (default 35391)

PreviousCortex CLI common command line reference guide
NextCortex CLI for Cloud Workload Protection

Last updated

Was this helpful?