API Security Observatory

Active API Blocking, API Risk Scoring, and SOC-Style Observability Lab

A defensive API security lab built with Kong Gateway, Flask, Prometheus, Loki, Promtail, and Grafana.

---

Overview

API Security Observatory is a local Docker-based cybersecurity project that demonstrates how API traffic can be protected, monitored, scored, logged, and investigated using a modern gateway and observability stack.

The project places Kong API Gateway in front of a Flask API, applies API key authentication to protected routes, blocks suspicious request patterns at the gateway layer, generates API risk scores, and sends logs and metrics into a SOC-style monitoring workflow using Grafana, Loki, Promtail, and Prometheus.

This repository is designed as a professional portfolio lab for API security, detection engineering, and DevSecOps-style validation.

---

Key Capabilities

Area	Capability
API Gateway Security	Kong routing, API key authentication, rate limiting, request filtering
Active Blocking	Gateway-level blocking for suspicious payload indicators
API Risk Scoring	Rule-based risk scoring for incoming API requests
Observability	Centralized logs, metrics, and dashboard visibility
SOC Monitoring	Blocked attack feed, investigation workflow, and alert logic
Validation Evidence	Curl, Burp Suite, and OWASP ZAP-style validation documentation
Compliance Support	Evidence-based reporting and security control documentation
Project Audit	Repository cleanup, encoding checks, link checks, and quality review

---

Verified Local Behavior

Validation Test	Result
Docker stack starts successfully	Verified
Kong Gateway runs healthy	Verified
Public /health route works without API key	Verified
Protected /api/echo route requires API key	Verified
Valid API key reaches the Flask API	Verified
Normal request returns LOW risk score	Verified
SQL injection keyword UNION is blocked by Kong	Verified
Observability stack containers run successfully	Verified

---

Architecture

Recommended visual ratio for GitHub architecture images: 1:1.618, approximately 3:5.

Suggested banner sizes:

1200 x 742 px
1500 x 927 px

flowchart LR
    Client["Client / Tester"] --> Kong["Kong API Gateway"]

    Kong --> Route["Route Matching"]
    Route --> Auth["API Key Authentication"]
    Auth --> RateLimit["Rate Limiting"]
    RateLimit --> Blocker["Active Blocking Logic"]

    Blocker -->|Allowed Request| API["Flask API Service"]
    Blocker -->|Blocked Request| Deny["403 Blocked Response"]

    API --> Risk["Risk Scoring Engine"]
    Risk --> Response["JSON Response"]

    Kong --> KongLogs["Kong Logs"]
    API --> AppLogs["Application Logs"]

    KongLogs --> Promtail["Promtail"]
    AppLogs --> Promtail

    Promtail --> Loki["Loki"]

    Kong --> Metrics["Gateway Metrics"]
    Metrics --> Prometheus["Prometheus"]

    Loki --> Grafana["Grafana Dashboards"]
    Prometheus --> Grafana

    Grafana --> SOC["SOC-Style Monitoring View"]

Loading

---

Security Event Flow

sequenceDiagram
    participant Client as Client
    participant Kong as Kong Gateway
    participant Blocker as Blocking Logic
    participant API as Flask API
    participant Risk as Risk Engine
    participant Logs as Loki / Grafana

    Client->>Kong: Send HTTP request
    Kong->>Kong: Match route

    alt Public health route
        Kong-->>Client: Health response
    else Protected API route
        Kong->>Kong: Validate API key
        Kong->>Blocker: Inspect request payload

        alt Suspicious pattern detected
            Blocker-->>Client: 403 blocked response
            Blocker->>Logs: Store blocked attack event
        else Request allowed
            Kong->>API: Forward request
            API->>Risk: Calculate risk score
            Risk-->>API: Return risk result
            API-->>Client: JSON response
            API->>Logs: Store API event
        end
    end

Loading

---

Technology Stack

Layer	Technology
API Gateway	Kong Gateway
Backend API	Python Flask
Risk Engine	Custom Python rule-based engine
Metrics	Prometheus
Logging	Loki
Log Collection	Promtail
Visualization	Grafana
Containerization	Docker Compose
Validation	Curl, Burp Suite, OWASP ZAP-style testing
Documentation	Markdown

---

Repository Structure

api-security-observatory/
|-- README.md
|-- PROJECT-OVERVIEW.md
|-- ARCHITECTURE.md
|-- QUICK-START-GUIDE.md
|-- SECURITY-DISCLAIMER.md
|-- CONTRIBUTING.md
|-- LICENSE
|-- docker-compose.yml
|-- .env.example
|-- .gitignore
|
|-- 01-INFRASTRUCTURE/
|-- 02-API-SERVICE/
|-- 03-KONG-GATEWAY/
|-- 04-OWASP-API-TOP-10-DETECTION/
|-- 05-OBSERVABILITY-STACK/
|-- 06-DETECTION-ENGINEERING/
|-- 07-GRAFANA-DASHBOARDS/
|-- 08-SECURITY-VALIDATION/
|-- 09-COMPLIANCE-REPORTING/
|-- 10-EVIDENCE-VAULT/
|-- 11-AUTOMATION-SCRIPTS/
|-- 12-OPERATIONS-RUNBOOKS/
|-- 13-PROJECT-DOCUMENTATION/
|-- 14-ARCHITECTURE-ASSETS/
|-- 15-TOOLS-VERSION-REFERENCE/
|-- 16-ROADMAP/
`-- 17-PROJECT-AUDIT/

---

Core Components

1. Kong API Gateway

Kong acts as the front security layer for the API service.

It handles:

• API routing
• API key authentication
• Rate limiting
• Gateway-level request inspection
• Active blocking
• Security event logging

Current route behavior:

Route	Behavior
/health	Public health check
/api/*	API key protected
Suspicious /api/* payloads	Blocked at gateway layer

---

2. Flask API Service

The Flask API provides:

• Health endpoint
• Echo endpoint
• Request metadata visibility
• Risk scoring integration
• JSON response output

Primary tested endpoint:

/api/echo

---

3. Risk Scoring Engine

The risk engine evaluates API requests using transparent rule-based logic.

It considers:

• HTTP method
• Query string
• Request body
• Authentication context
• Suspicious keywords
• OWASP-style category mapping

Example risk response:

{
  "risk": {
    "risk_level": "LOW",
    "risk_score": 5,
    "reasons": [
      "Normal GET request baseline risk",
      "Authenticated request context present"
    ],
    "owasp_categories": []
  }
}

---

4. Active Blocking Logic

The gateway blocks suspicious request indicators before they reach the backend API.

Pattern	Detection Meaning
UNION	SQL injection keyword
<script>	XSS script tag
javascript:	JavaScript URI
../	Path traversal
/etc/passwd	Linux sensitive file access
whoami	Command injection keyword
curl	Suspicious command/download tool
wget	Suspicious command/download tool
cmd.exe	Windows command shell
powershell	PowerShell execution indicator
bash -c	Linux shell execution indicator

---

5. Observability Stack

The observability stack supports security monitoring and investigation.

Component	Purpose
Grafana	Dashboards and alert visualization
Loki	Log aggregation
Promtail	Log shipping
Prometheus	Metrics collection

Dashboard focus areas include:

• Blocked API attack feed
• Top suspicious payloads
• Total blocked requests
• API risk score visibility
• Gateway activity
• Alert rule documentation

---

Quick Start

1. Start the stack

docker compose up -d --build

2. Check running containers

docker compose ps

Expected services:

observatory-api
observatory-kong
observatory-grafana
observatory-loki
observatory-prometheus
observatory-promtail

3. Test public health route

curl http://localhost:8000/health

Expected:

{"status":"healthy"}

---

Local Access

Service	URL
Kong Proxy	http://localhost:8000
Kong Admin API	http://localhost:8001
Grafana	http://localhost:3000
Loki	http://localhost:3100
Prometheus	http://localhost:9090

---

Validation Commands

Public Health Check

curl http://localhost:8000/health

Expected:

{"status":"healthy"}

---

Protected API Without API Key

curl http://localhost:8000/api/echo

Expected:

{
  "message": "No API key found in request"
}

---

Protected API With API Key

Header-based request:

curl -H "apikey: observatory-demo-key" "http://localhost:8000/api/echo?q=hello"

Alternative local demo request:

curl "http://localhost:8000/api/echo?apikey=observatory-demo-key&q=hello"

Expected result:

Request reaches the Flask API and returns a LOW risk score.

---

Active Blocking Test

curl -H "apikey: observatory-demo-key" "http://localhost:8000/api/echo?q=UNION"

Expected:

{
  "detected_attack": "SQL injection keyword UNION",
  "message": "Request blocked by API Security Observatory"
}

---

Example Output

Normal request:

{
  "body": "",
  "method": "GET",
  "path": "/api/echo",
  "query_string": "q=hello",
  "risk": {
    "risk_level": "LOW",
    "risk_score": 5,
    "reasons": [
      "Normal GET request baseline risk",
      "Authenticated request context present"
    ],
    "owasp_categories": []
  }
}

Blocked request:

{
  "detected_attack": "SQL injection keyword UNION",
  "message": "Request blocked by API Security Observatory"
}

---

Evidence and Documentation

The repository includes documentation and evidence for:

• API gateway configuration
• Active blocking policy
• API endpoint behavior
• Risk scoring methodology
• Observability stack setup
• Grafana dashboard guidance
• Security validation test cases
• Compliance-style reporting
• Operations runbooks
• Demo evidence
• Repository audit checks

Key folders:

Folder	Purpose
03-KONG-GATEWAY/	Gateway routing, authentication, blocking, rate limiting
04-OWASP-API-TOP-10-DETECTION/	OWASP-style detection mapping
05-OBSERVABILITY-STACK/	Grafana, Loki, Promtail, Prometheus
06-DETECTION-ENGINEERING/	Detection and anomaly methodology
08-SECURITY-VALIDATION/	Validation test cases
10-EVIDENCE-VAULT/	Screenshots, demo evidence, validation output
12-OPERATIONS-RUNBOOKS/	Investigation and response workflows
16-ROADMAP/	Future enhancement plans
17-PROJECT-AUDIT/	Repository quality checks and cleanup reports

---

Future Enhancements

Planned improvements include:

• OAuth2 and JWT authentication
• mTLS-based service security
• Kubernetes deployment manifests
• Cloud deployment option
• SIEM integration
• CI/CD security validation workflow
• Verified Grafana alert delivery
• Stronger authorization test cases
• More automated compliance evidence generation

These are future enhancement areas and are documented separately in 16-ROADMAP/.

---

Scope Notes

This project is designed as a local Docker-based API security lab. A production deployment would require additional hardening, including secure secret management, hardened gateway configuration, stronger authentication, centralized SIEM integration, tested alert delivery, production-grade deployment architecture, and operational monitoring controls.

---

Security Disclaimer

This repository is intended for defensive cybersecurity education, local lab testing, and portfolio demonstration.

Do not use this project to test, scan, attack, or monitor systems that you do not own or do not have explicit permission to assess.

---

License

This project is released under the MIT License.

See:

LICENSE

---

Author

Bommali Mallesu

Cybersecurity-focused Computer Science graduate building hands-on projects in API security, SOC monitoring, detection engineering, and DevSecOps-style validation.