The Neosec platform integrates with Kong Gateway Enterprise, an [API Management Solution](https://konghq.com/products/api-gateway-platform)API Management Solution, to provide automated and continuous API discovery, API risk posture alerting and API protection through behavioral analytics and response automation. And it does all that while being out of band, using the logs shipped from Kong to Neosec.
APIs, by definition, expose your applications to an open and to a large extent, a hostile environment. Malicious actors can breach your systems and data from many different perspectives: exuberant mechanisms like brute force attacks to DDoS, SQL injection, CSS and subtle phishing messages.
From the API consumption perspective, we could classify security policies in two main levels of abstraction:
[Kong plugins](https://docs.konghq.com/hub)Kong plugins are available to implement security mechanisms for the request-based policies, including:
The [Neosec platform](https://www.neosec.com)Neosec platform sanitizes and enriches all API activity data, performs big data behavioral analytics and stores it in a data lake. This allows you to immediately understand your API risk posture and get alerted on API attacks, as well as to query, investigate bugs and support cases, and hunt for threats.
You can create response policies in the Neosec platform to automatically respond to behavioral analytics alerts at the logical entity level.
In this blog post, we'll show how you can easily integrate Kong and Neosec and create automated response policies that respond to behavioral analytics alerts by performing actions on Kong consumers.
Diagram 1. Flow
Here's the flow of events in the environment:
Setting up a Neosec Collector to consume logs from Kong Gateway is trivial, as the Collector can run as a container, a serverless function or a system service. You only need to configure the in-built Kong [TCP Log](https://docs.konghq.com/hub/kong-inc/tcp-log)TCP Log plugin to send data to it.
[
Diagram 2. TCP Log Plugin Configuration
All you need to do is:
Now that data flows from the Kong data plane to the Neosec Cloud, the Neosec platform goes into action by automatically discovering all APIs and establishing baselines of activity and behavior.
Now that data flows from the Kong dataplane to Neosec; the Neosec will automatically discover all APIs and establish baselines of activity and behavior for each.
Since you are most likely managing authentication using Kong [security plugins](https://docs.konghq.com/hub/#security)security plugins like the ones listed above, the logs from the Kong dataplane already contain essential information about API consumers.
The Neosec Discovery page shows you all you need to know about the various services and endpoints discovered, including statistical data, classification of the data flowing over them, their risk posture, etc.
[
Diagram 3. Discovered APIs and Endpoints
The Neosec platform is now monitoring API activity for any sign of malicious activity. For example:
And while you can easily send these alerts to your SIEM or SOAR tools, the real trick is shutting down attacks as they happen. To do this, we turn to the other side of the Kong + Neosec integration: automated response policies.
The move from passive API analytics to taking a security counteraction is seamless and straightforward using Neosec automated response policies. The Neosec platform enables you to create detailed response policies, all the way down to specifying the services, endpoints and consumers involved.
In the Neosec platform, we set up an automated response policy to permanently block a consumer that triggers a request spike alert in the following example. The condition can be as detailed as you want it to be, and include references to consumer IDs or other alerted entities, APIs, endpoints, and so on.
In the action portion of the policy, we choose to block the consumer using the standard Kong [Request Termination](https://docs.konghq.com/hub/kong-inc/request-termination/#main)Request Termination plugin. We could set a timeout for that block, or we could decide to rate-limit the consumer.
[
Diagram 4. A Kong Automated Response Policy
Let's bombard an endpoint in a loop and wait for the Request Spike alert to trigger.
$ for (( i=0 ; i<100000 ; i+=1 ));
do echo &&
echo "----- $i -----" &&
curl -i http://$PROXY_ADDR/workshop/api/shop/products -H "Authorization: ${TOKEN}" ;
done
Diagram 5. API Call Loop Progressing and Getting Blocked
The instant the Request Spike alert triggered, the automated response policy shot into action. We can see this Request Spike alert in the Neosec UI:
[
Diagram 6. Request Spike Alert
We can also see the policy applied automatically in Kong to the malicious consumer in the Kong Manager:
[
Diagram 7. Kong Request Termination Plugin Set For Consumer
One of the benefits of having an enriched data lake in the Neosec Cloud is that you can pivot to any consumer's timeline (or any other entity's timeline) to see everything they did. When we investigate the Request Spike alert from Diagram 5, we see all the consumer's activity leading up to the alert triggering.
[
Diagram 8. The Offending Consumer's Timeline
The Neosec + Kong partnership adds an innovative API security platform to help Kong customers discover and protect their APIs. The SaaS platform from Neosec performs enterprise-wide discovery of the entire API estate and audits the risks found in each API. But the true power of Neosec is the ability to understand the behavior within each API.
To differentiate normal from abnormal behavior gives Kong customers unparalleled insight into their API traffic. Visibility is the first step, but automatically responding to bad behavior and enforcing remediation through the Kong API gateway brings Kong customers real control.
**Getting started is easy; you can request a free trial from both **[**Kong**](https://konghq.com/contact-sales)**Kong**** and **[**Neosec**](https://www.neosec.com/start-trial)**Neosec**** and follow the instructions above.**
As organizations build more APIs, manual processes and frequent handoffs in the API development workflow can lead to a slower time to market, higher development costs, and poor-quality APIs. They can also result in APIs being poorly documented, caus
[](https://konghq.com/blog/engineering/automating-api-delivery-with-apiops-and-kong)
Organizations today are looking to do more with less. The solution for many? Digital transformation. While digital transformation isn’t a new concept, the benefits of boosting efficiency, controlling costs, and delivering better customer experiences
[](https://konghq.com/blog/enterprise/transformation-with-api-automation)
At Kong, our mission is to deliver the best API lifecycle management experience for the cloud native era. Driven by our dedication to meeting the dynamic demands of modern end-to-end API management, we've introduced an array of new Kong Konnect feat
[](https://konghq.com/blog/product-releases/kong-konnect-april-graphql-support-secure-automation)
In the last blog post , we discussed the need for both speed and quality for your API delivery and how APIOps can help achieve both. In this part of our blog post series, we'll walk through what the API lifecycle looks like when following APIOps.
[](https://konghq.com/blog/enterprise/automating-api-lifecycle-apiops-part-2)Today, Application Programming Interfaces (APIs) and microservices are the de-facto standard for building and connecting modern applications. APIs are no longer just a delivery mechanism but have become the product itself . API lifecycle managem
[](https://konghq.com/blog/enterprise/automating-api-lifecycle-apiops)
If you could clone yourself, you could get your work done a lot faster, right? And that would free up time for you to pursue new projects and advance your career. It's an idea that Kong Vice President of Products Reza Shafii discussed recently as
[](https://konghq.com/blog/enterprise/clone-automation-next-job)
It is a truth universally acknowledged that the culture change side of any technology transformation program is the hardest and slowest part to get right. If you cannot efficiently operationalize a technology investment, that investment is wasted. T
[](https://konghq.com/blog/enterprise/what-is-apiops)