API Observer¶

API Observer is an open-source application security platform for monitoring API traffic, detecting security issues, and analyzing application behavior across distributed systems.

How API Observer Works?¶

API Observer collects and analyzes ModSecurity logs using API Collector, allowing users to inspect API traffic, query historical requests and responses, and generate findings using configurable rule sets.

API Collector runs alongside the protected application and reads ModSecurity audit logs. Historical log records are streamed to API Observer over gRPC, where they can be viewed in Log Explorer or reprocessed through custom rule sets in Analysis.

The Rule Engine evaluates request and response data and produces findings that can be attached to matching log records. This allows users to investigate both current and historical API activity without requiring API Observer to directly access the application's local log files.

flowchart TD
    subgraph Collector_1 [API Collector Node 1]
        App1[Application] -->|HTTP Traffic| ModSecurity1[ModSecurity]
        ModSecurity1 -->|Audit Logs| Collector1[API Collector]
    end

    subgraph Collector_2 [API Collector Node 2]
        App2[Application] -->|HTTP Traffic| ModSecurity2[ModSecurity]
        ModSecurity2 -->|Audit Logs| Collector2[API Collector]
    end

    subgraph Collector_3 [API Collector Node 3]
        App3[Application] -->|HTTP Traffic| ModSecurity3[ModSecurity]
        ModSecurity3 -->|Audit Logs| Collector3[API Collector]
    end

    subgraph Observer [API Observer]
        direction TD

        Merge[Distributed Log Streaming]

        subgraph LogViewer [Log Processing]
            direction LR

            subgraph Explorer [Log Explorer]
                direction TD

                ExplorerLogs[Historical Logs]
                ExplorerRuleEngine[Rule Engine]
                ExplorerFindings[Findings]

                ExplorerLogs --> ExplorerRuleEngine
                ExplorerRuleEngine --> ExplorerFindings
            end

            subgraph Analysis [Analysis]
                direction TD

                AnalysisLogs[Historical Logs]
                CustomRules[Custom Rule Set]
                AnalysisRuleEngine[Rule Engine]
                AnalysisFindings[Findings]

                AnalysisLogs --> AnalysisRuleEngine
                CustomRules --> AnalysisRuleEngine
                AnalysisRuleEngine --> AnalysisFindings
            end
        end

        Merge --> ExplorerLogs
        Merge --> AnalysisLogs
    end

    Collector1 -->|gRPC Log Stream| Observer
    Collector2 -->|gRPC Log Stream| Observer
    Collector3 -->|gRPC Log Stream| Observer