We would like to announce a change in our Wallarm API Discovery module. Previously, we used the term "Removed endpoint" to indicate that an endpoint was excluded from the API inventory because there were no more requests for it. For each endpoint, the date it was excluded from the model was calculated based on statistics showing how often the endpoint was requested.

Going forward, we will be using the term "Unused endpoint" instead of "Removed endpoint" to better reflect the status of these endpoints. An unused endpoint will now be defined as an endpoint that has not been requested in the last 7 days.

Calculating a time interval for each endpoint based on statistics could be non-obvious and difficult to analyze. By simply setting a fixed time period of 7 days, we are simplifying the process and providing a clear and consistent standard for identifying unused endpoints.

We believe that this change will improve the clarity and usefulness of our API Discovery module, making it easier for you to manage your APIs and ensure their security.

You can find more detailed information on this integration in our documentation.

We're thrilled to announce some exciting improvements to our Vulnerability section!

We have made it easier than ever to work with all your vulnerabilities in one place. The new search capabilities in the Vulnerability section will streamline your workflow and eliminate the need to switch back and forth between the Events and Vulnerabilities sections. From finding and analyzing to remediating and managing your vulnerabilities, all of your tasks can now be completed within one window. 

In addition, we moved the Vulnerability Scanner settings to the Vulnerabilities section to make it easier to configure the types of vulnerabilities that are detected.

We hope you find these improvements helpful and look forward to providing an even better experience for our users.

We're excited to announce that our platform now offers improved API token management, which provides more flexibility and control over your API access to the Wallarm platform.

This new feature allows you to set token permissions at a granular level to limit access to specific data objects that Wallarm operates with: data on attacks or vulnerabilities, or nodes or API catalog, etc. It’s also possible now to set token expiration time based on your specific needs. 

You can easily assign and manage your own tokens, ensuring that you have the precise level of access required for different integrations with Wallarm. Administrators can also create shared tokens that are accessible to other admins, and even generate tokens based on existing roles, offering even more flexibility in access control.

The new API token management feature provides new opportunities for automating the deployment of Wallarm nodes, allowing you to create node groups and manage them more conveniently. 

Note: Existing tokens will remain valid, and all integrations that use them will continue to function normally. However, we recommend that you create new tokens for any new integrations to take advantage of the new functionality.

You can find more detailed information about API tokens in our documentation.

We're excited to announce that Wallarm node 4.6 is now available!

The most important thing about this new release is the API Rate Limiting feature. The lack of proper rate limiting has been a significant problem for API security, as attackers can launch high-volume requests that can cause a denial of service (DoS) or overload the system, which hurts legitimate users. Overall, the lack of API Rate Limiting feature can result in a poor user experience, frustration, and potential security risks for both the user and the API infrastructure.

The usual way of limiting the number of requests made to an API is by blocking the IP address. However, this method can sometimes wrongly identify legitimate users as malicious and prevent them from accessing the service. Consider a SaaS application that provides an API to its customers. Each customer has their unique API key to access the service. To ensure that API consumption is fair and prevent misuse, you decide to implement rate limiting. Traditional rate limiting that relies on IP addresses would not work well in this case because multiple customers may be sharing the same IP address. For example, this can happen when customers are behind a corporate firewall or using a VPN.

With our API Rate Limiting, security teams can effectively manage the service's load and prevent false alarms, ensuring the service is always available and secure for real users. This powerful feature gives security teams more control over protection against bad bots and other bad actors. 

Security teams can now set specific parameters and session settings to apply rate limit rules based on any request parameter, including JSON fields, base64 encoded data, cookies, XML fields, and more. 

You can also adjust settings like the rate, burst, delay, and response code to fine-tune the rate limit settings and apply session settings to specific requests. Configuration is done within the Wallarm Console.

It's important to note that with version 4.6, you can only register Wallarm nodes in the Wallarm Cloud using a token. Registering with user credentials is no longer supported. If you used any user credentials to deploy the Wallarm node, you need to generate a token that will be used to register the nodes in the Wallarm Cloud. Instructions for generating a token are provided in the documentation. 

A more detailed changelog and instructions on upgrade are published in the official documentation.

If you have any questions, feel free to contact our support team at support@wallarm.com  

Wallarm is pleased to announce a new native integration of the Wallarm End-to-End API Security solution with Microsoft Azure Sentinel, a powerful combination that delivers advanced security capabilities to safeguard your API. Azure Sentinel is a cloud-based service that collects large volumes of data from various sources, including user data, cloud services, and endpoints to help security teams detect, investigate, and respond to security threats using AI and ML. This integration offers real-time reporting about detected malicious requests, vulnerabilities, changes in security settings and other important events. All of this allows security teams to respond promptly and effectively to potential threats.

The integration of Wallarm with Microsoft Azure Sentinel provides a comprehensive and holistic approach to API security. By having all relevant events in one place, security teams gain deep visibility into their API landscape, enabling analysts to detect, investigate, and respond to threats proactively, reducing the risk of data breaches and other security incidents. 

At Wallarm, we understand the importance of protecting your APIs from potential threats. Our native integration with Microsoft Azure Sentinel provides security teams with a comprehensive view of their API landscape. Take advantage of this powerful combination for best-in-class API security today.

You can find more detailed information on this integration in our documentation.

We are thrilled to announce the release of the new API Discovery Dashboard. With this update, you can now more easily monitor sensitive data, track API changes, and identify risky endpoints.

Key new features of the API Discovery Dashboard to materially reduce your risk exposure include:

• Monitoring Sensitive Data. Get more in-depth insights into what kinds and how much sensitive data are sent in requests to applications and if there are any extra data that shouldn't be there.
• Tracking API Changes. Get better visibility into any unexpected or undocumented changes in your APIs across your entire portfolio.
• Identifying Risk Endpoints. Get a greater understanding of your API attack surface with customizable risk scoring to bring the most risky and most attacked endpoints to your immediate attention.

There are many other capabilities offered by the API Discovery module that can improve your API security. For instance, Security analysts and Security DevOps can receive notifications in Slack, SIEMs, SOARs, etc. about changes that occur in their APIs, so they can stay up-to-date and take action right away.

We are sure that the new API Discovery Dashboard and other important capabilities in the API Discovery module make it easier for you to monitor and secure your APIs.

You can find more information about these capabilities in our documentation.

Wallarm End-to-End API Security has taken another step forward in reducing organizational risk by improving our Server-side Request Forgery (SSRF) mitigation capabilities. With the rise of SSRF attacks, it's essential to stay ahead of potential security breaches and protect valuable assets. Wallarm's advanced features offer peace of mind and protection against these dangerous attack vectors.

SSRF attacks allow attackers to manipulate a server to make arbitrary requests, often to internal resources, resulting in access to sensitive information, execution of malicious code, and overall compromise of the system's security. As part of the OWASP Top 10 2021, SSRF attacks can bypass network security measures, making them difficult to detect and prevent. 

Recently, SSRF attacks have been a growing concern for businesses globally, with over 100,000 businesses being impacted since November 2022. Some well-known organizations that have fallen victim to SSRF include Azure services, Atlassian, and Exchange. One real-world example of an SSRF attack was on Azure services, where vulnerabilities were found that exposed internal endpoints and sensitive data. Another example is the Exchange zero-day vulnerabilities (CVE-2022-41040 and CVE-2022-41082), where SSRF was used to gain unauthorized access to internal systems.

Wallarm has improved our SSRF mitigation capabilities through a detailed analysis of the most widespread vulnerabilities and attacks. The improvements include enhanced validation of user-supplied URLs and attribution of SSRF attacks to specific vulnerabilities. By providing increased security against SSRF attacks, Wallarm helps businesses maintain the trust of their customers and protect against financial, reputational, and regulatory harms.

To take advantage of our improved SSRF mitigation capabilities, upgrade to the latest version of Wallarm Node (version 4.4.3 or higher). For more information, see the Wallarm documentation.

Today, Wallarm is introducing API Leak Management, a new feature to proactively protect your secrets and avoid related security breaches.

In recent months, enterprise companies like CircleCI, Slack, and LastPass have seen an escalation in attacks involving leaked API keys and other API secrets. API keys and secrets often leak due to developers' mistakes, missing repository access controls, insecure use of public services, and data disclosure accidents by contractors, partners, and users.

There are three main scenarios for proactive API Leak Management:

• Detect leaks. Wallarm continuously scans public sources for API secrets leaks: public repositories, mobile apps, Pastebin, and many other ways.
• Revoke/block tokens. Once a leak is detected, Wallarm remediates risks related to those leaks by blocking requests with compromised tokens and tracking them across all your API landscapes. 
• Track secret usage. Wallarm tracks when leaked secrets/credentials are used.

Next step

• Read more details in API Leak Management blog post
• Get a complimentary API Leaks Assessment. Get a thorough understanding of your risk exposure due to leaked API keys and other secrets by getting a free API leaks assessment. Register now.

We’ve improved the endpoint risk score feature in the Wallarm API Discovery module. Now you can set the rules for calculating the score for yourself. You can include and exclude risk factors from the calculation, change their weights and change the calculation formula.

The Wallarm security research team has created default calculation rules based on our extensive experience in Cyber Security. You can now modify these calculations based on your specific needs. For example, you can add more weight to the presence of sensitive data or open vulnerabilities.

See our documentation for more details.

To make sure that your Wallarm security service works as you expect, you need to be aware of changes in its settings. In addition to the Activity log, it's a good practice to receive notifications of critical changes made by your team to keep everyone in the loop.

Wallarm can send you notifications about important changes in your settings, such as:

• granting user account administrator rights
• removing an important security rule
• changing a BOLA or Brute Force trigger

Notifications are sent to any service convenient for you, for example, Slack, Splunk or Datadog.

See the Wallarm documentation for more details.