メニュー
Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/AgentFlocks/flocks --skill implementing-api-threat-protection-with-apigeeコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
深信服 EDR 登录态管理、首页仪表盘、威胁资产分析和资产清点分类统计 API 采集。用户提到深信服 EDR、EDR、资产清点或 sangfor EDR 时必须先加载本 skill。
统一处理浏览器使用任务，支持可见浏览器 CDP 直连、专用 headless CDP、agent-browser。Use when the user asks to browse websites, interact with pages, fill forms, capture screenshots, reuse an existing Chrome/Chromium/Edge login session, work with an already-open browser/sidebar browser, access login-only/internal/dynamic pages, or automate browser actions.
用于处理 OneSEC/OneDNS 终端安全平台相关任务，支持通过API或者结合浏览器进行操作。只要用户提到 OneSEC、微步 EDR等相关操纵需求时，必须先加载本 skill。本 skill 是 OneSEC 平台操作的唯一决策入口：在未阅读本 skill 并完成模式判断前，不要直接调用任何 `onesec_*` tool。
| name | implementing-api-threat-protection-with-apigee |
| description | Implement API threat protection using Google Apigee policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security for OWASP Top 10 defense. |
| domain | cybersecurity |
| subdomain | api-security |
| tags | ["apigee","api-gateway","threat-protection","json-threat-protection","xml-threat-protection","spike-arrest","oauth2","google-cloud","owasp-api-top-10"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01"] |
Google Apigee is an enterprise API management platform that provides native security policies for threat protection, including JSON and XML content validation, OAuth 2.0 enforcement, SpikeArrest rate limiting, regular expression threat protection, and Advanced API Security for detecting malicious clients and API abuse patterns. Apigee operates as a reverse proxy that intercepts all API traffic, applying security policies before requests reach backend services, effectively shielding APIs against the OWASP API Security Top 10 threats.
Protects against JSON-based denial-of-service attacks by limiting structural depth, entry counts, and string lengths:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<JSONThreatProtection name="JSON-Threat-Protection-1">
<DisplayName>JSON Threat Protection</DisplayName>
<Source>request</Source>
<!-- Maximum nesting depth of JSON structure -->
<ObjectEntryNameLength>50</ObjectEntryNameLength>
<ObjectEntryCount>25
100
5
500
Shields against XML bombs, XXE attacks, and oversized XML payloads:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<XMLThreatProtection name="XML-Threat-Protection-1">
<DisplayName>XML Threat Protection</DisplayName>
<Source>request</Source>
<NameLimits>
<Element>50</Element>
<Attribute>50</Attribute>
<NamespacePrefix>20</NamespacePrefix>
<ProcessingInstructionTarget>50</ProcessingInstructionTarget>
</NameLimits>
<ValueLimits>
<Text>1000</Text>
<Attribute>500</Attribute>
<NamespaceURI>256</NamespaceURI>
<Comment>256</Comment>
<ProcessingInstructionData>256</ProcessingInstructionData>
</ValueLimits>
<StructureLimits>
<NodeDepth>5</NodeDepth>
<AttributeCountPerElement>5</AttributeCountPerElement>
<NamespaceCountPerElement>3</NamespaceCountPerElement>
<ChildCount>25</ChildCount>
</StructureLimits>
</XMLThreatProtection>
Detects SQL injection, XSS, and other injection patterns in request parameters:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<RegularExpressionProtection name="RegEx-Threat-Protection-1">
<DisplayName>Regex Injection Protection</DisplayName>
<Source>request</Source>
<IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
<!-- SQL Injection patterns -->
<QueryParam name="*">
<Pattern>[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update)|(\bor\b))</Pattern>
</QueryParam>
<!-- XSS patterns -->
<QueryParam name="*">
<Pattern>[\s]*<\s*script\b[^>]*>[^<]+<\s*/\s*script\s*></Pattern>
</QueryParam>
<!-- Header injection -->
<Header name="*">
<Pattern>[\r\n]</Pattern>
</Header>
<!-- URI path traversal -->
<URIPath>
<Pattern>(/\.\.)|(\.\./)</Pattern>
</URIPath>
<!-- JSON body injection -->
<JSONPayload>
<JSONPath>$.*</JSONPath>
<Pattern>[\s]*((delete)|(exec)|(drop\s*table)|(insert)|(shutdown)|(update))</Pattern>
</JSONPayload>
</RegularExpressionProtection>
Prevents traffic spikes from overwhelming backend services:
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SpikeArrest name="Spike-Arrest-1">
<DisplayName>API Spike Arrest</DisplayName>
<Rate>30ps</Rate> <!-- 30 per second smoothed -->
<Identifier ref="request.header.x-api-key"/>
<MessageWeight ref="request.header.x-request-weight"/>
<UseEffectiveCount>true</UseEffectiveCount>
</SpikeArrest>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<OAuthV2 name="Verify-OAuth-Token">
<DisplayName>Verify OAuth 2.0 Access Token</DisplayName>
<Operation>VerifyAccessToken</Operation>
<ExternalAuthorization>false</ExternalAuthorization>
<ExternalAccessToken>request.header.Authorization</ExternalAccessToken>
<SupportedGrantTypes>
<GrantType>authorization_code</GrantType>
<GrantType>client_credentials</GrantType>
</SupportedGrantTypes>
<Scope>read write</Scope>
<GenerateResponse enabled="true"/>
</OAuthV2>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<VerifyAPIKey name="Verify-API-Key-1">
<DisplayName>Verify API Key</DisplayName>
<APIKey ref="request.header.x-api-key"/>
</VerifyAPIKey>
<!-- apiproxy/proxies/default.xml -->
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<ProxyEndpoint name="default">
<PreFlow name="PreFlow">
<Request>
<!-- Step 1: Verify API Key or OAuth token -->
<Step>
<Name>Verify-OAuth-Token</Name>
</Step>
<!-- Step 2: Rate limiting -->
<Step>
<Name>Spike-Arrest-1</Name>
</Step>
<!-- Step 3: Threat protection -->
<Step>
<Name>JSON-Threat-Protection-1</Name>
<Condition>request.header.Content-Type = "application/json"</Condition>
</Step>
<Step>
<Name>XML-Threat-Protection-1</Name>
<Condition>request.header.Content-Type = "text/xml"</Condition>
</Step>
<!-- Step 4: Injection prevention -->
<Step>
<Name>RegEx-Threat-Protection-1</Name>
</Step>
<!-- Step 5: CORS enforcement -->
<Step>
<Name>CORS-Policy</Name>
</Step>
</Request>
<Response>
<!-- Remove internal headers from response -->
<Step>
<Name>Remove-Internal-Headers</Name>
</Step>
<!-- Add security headers -->
<Step>
<Name>Add-Security-Headers</Name>
</Step>
</Response>
</PreFlow>
<Flows>
<Flow name="sensitive-operations">
<Description>Additional protection for sensitive endpoints</Description>
<Request>
<Step>
<Name>Quota-Strict</Name>
</Step>
</Request>
<Condition>(proxy.pathsuffix MatchesPath "/admin/**") or
(proxy.pathsuffix MatchesPath "/users/*/sensitive")</Condition>
</Flow>
</Flows>
<HTTPProxyConnection>
<BasePath>/v1</BasePath>
<VirtualHost>secure</VirtualHost>
</HTTPProxyConnection>
<RouteRule name="default">
<TargetEndpoint>default</TargetEndpoint>
</RouteRule>
</ProxyEndpoint>
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<AssignMessage name="Add-Security-Headers">
<DisplayName>Add Security Response Headers</DisplayName>
<Set>
<Headers>
<Header name="X-Content-Type-Options">nosniff</Header>
<Header name="X-Frame-Options">DENY</Header>
<Header name="Strict-Transport-Security">max-age=31536000; includeSubDomains</Header>
<Header name="Cache-Control">no-store, no-cache, must-revalidate</Header>
<Header name="Content-Security-Policy">default-src 'none'</Header>
<Header name="X-Request-ID">{messageid}</Header>
</Headers>
</Set>
<Remove>
<Headers>
<Header name="X-Powered-By"/>
<Header name="Server"/>
</Headers>
</Remove>
<IgnoreUnresolvedVariables>false</IgnoreUnresolvedVariables>
<AssignTo createNew="false" transport="http" type="response"/>
</AssignMessage>
Enable Apigee's Advanced API Security add-on for machine-learning-based threat detection:
# Enable Advanced API Security on Apigee X instance
gcloud apigee organizations update $ORG_NAME \
--advanced-api-security-config=enabled
# View detected abuse alerts
gcloud apigee apis security-reports list \
--organization=$ORG_NAME \
--environment=$ENV_NAME
# Create security action to block suspicious traffic
gcloud apigee security-actions create \
--organization=$ORG_NAME \
--environment=$ENV_NAME \
--action-type=DENY \
--condition-type=IP_ADDRESS \
--condition-values="192.168.1.100,10.0.0.50" \
--description="Block identified malicious IPs"
# Deploy proxy bundle with security policies
gcloud apigee apis deploy \
--api=$API_NAME \
--environment=$ENV_NAME \
--revision=$REVISION \
--organization=$ORG_NAME
# Validate deployment
gcloud apigee apis list-deployments \
--api=$API_NAME \
--organization=$ORG_NAME