> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/set-up-web-and-api-security-profiles.md). # Set up Web and API Security profiles {% hint style="info" %} ### Note Web and API Security profiles and policies are currently a Beta feature. {% endhint %} You can configure Web and API Security profiles to provide comprehensive real-time detection and protection for web-based applications and APIs running on Linux-based workloads. These profiles can be applied to policies for such workloads. For each setting that you want to override, clear the corresponding option to **Use Default**, and then select the setting of your choice. {% hint style="info" %} ### Note In this profile, the **Report** options configure the workload to report the corresponding malicious applications or APIs to Cortex XSIAM, without blocking them. The **Disabled** options configure the workloads to neither analyze nor report the corresponding malware or behavior. {% endhint %} 1. Add a new profile and define basic settings. 1. From Cortex XSIAM, select **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. Click **+Add Profile**, and select whether to create a new profile, or to import a profile from a file. 2. Select the **Linux** platform, and **Web & API Security** as the profile type. 3. Click **Next**. 4. Enter a unique **Profile Name** for the profile. The name can contain only letters, numbers, or spaces, and must be no more than 30 characters. The name will be visible from the list of profiles when you configure a policy rule. 5. (Optional) Enter a description that describes the intention or business purpose of the profile. 2. Configure **Action Mode** options. If you choose **Enable**, you can then configure each item separately. | Item | Options | More details | | -------------------------- | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Action Mode | | When set to **Enable**, Cortex XSIAM performs the configured action for each of the options. | | XSS | |

When Cortex XSIAM detects cross-site scripting (XSS) injection, it performs the configured action.

XSS attacks are attacks in which malicious JavaScript snippets are injected into otherwise benign and trusted websites. In such attacks, attackers try to trick the browser into switching to a JavaScript context and executing arbitrary code.

| | SQL Injection | |

When Cortex XSIAM detects SQL injection (SQLi) attempts, it performs the configured action.

(SQLi) attacks can occur when an attacker successfully inserts a malicious SQL query into the input fields of a web application. A successful attack can read sensitive data from the database, modify data in the database, or run arbitrary commands.

| | Injection Attacks | |

When Cortex XSIAM detects injection attacks, it performs the configured action.

Injection attacks are a form of attacks in which attackers attempt to insert malicious input into an application to manipulate its execution. Command and code payloads can either be injected as part of HTTP requests, or are included from local or remote files (also known as File Inclusion attacks).

| | CVE Exploits | | When Cortex XSIAM detects known vulnerabilities (Common Vulnerabilities and Exposures (CVEs)), it performs the configured action. | | Sensitive Data Exposure | |

When Cortex XSIAM protects workloads from exposing sensitive data, it performs the configured action.

This module protects workloads from providing responses that could expose sensitive data found in critical system files, including password hashes (/etc/shadow), user account information (/etc/passwd), and private encryption keys.

| | Authentication Bypass | |

When Cortex XSIAM detects attempts to bypass authentication controls, it performs the configured action.

This module protects against attacks that attempt to circumvent authentication controls through session manipulation, token exploitation, or credential abuse.

| | Advanced Threat Protection | |

When Cortex XSIAM detects evolving threats, it performs the configured action.

Advanced Threat Protection (ATP) is a comprehensive security feature designed to detect, prevent, and respond to sophisticated web and API threats, ensuring robust protection for workloads against evolving risks.

| | Offensive Tools | | Cortex XSIAM identifies offensive tools that scan web applications for known security vulnerabilities and misconfiguration, and exploit them. When such tools are found, this module can block or report them. | | Malformed Traffic | | When Cortex XSIAM detects HTTP requests with anomalies that are not expected from common web browsers, it performs the configured action. | | Automation Tools | |

When Cortex XSIAM detects automated tools, it performs the configured action.

Malicious automated tools or services can scrape website contents such as Scriptable headless web browsers, command line tools, or HTTP libraries.

| | Known Bots | |

When Cortex XSIAM detects known bots, it performs the configured action.

Cortex XSIAM can identify legitimate bots that properly declare their identity and purpose, such as search engine crawlers and authorized web indexers. These bots follow standard protocols and provide verifiable operator information, however some of them might cause undesirable behaviors, such as spam, and you might prefer to block such bots.

| 3. To save the profile, click **Create**. What to do next If you are ready to apply your new profile to endpoints, you do this by adding it to a policy rule. If you still need to define other profiles, you can do this later. During policy rule creation or editing, you select the endpoints to which to assign the policy. There are different ways of doing this, such as:
Create a policy rule from the Prevention Profiles page 1. Navigate to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles**. 2. Right-click your new profile, and select **Create a new policy rule using this profile**. 3. Configure the policy rule.
Edit an existing policy rule from the Policy Rules page 1. Navigate to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**. 2. Right click an existing policy and select **Edit**. 3. Add your new profile to the policy rule.
Create a new policy rule from the Policy Rules page 1. Navigate to **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Policy Rules**. 2. Click **Add Policy**. 3. Configure a new policy that includes your new profile.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/secure-your-api-landscape/configure-api-security-from-end-to-end/agent-based-protection/set-up-web-and-api-security-profiles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.