STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API must enable monitoring and alerts.

DISA Rule

SV-274517r1143512_rule

Vulnerability Number

V-274517

Group Title

SRG-APP-000089

Rule Version

SRG-APP-000089-API-000120

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.

Weight

10

Fix Recommendation

Build or configure the API to enable monitoring and alerts.

Check Contents

Verify the API enables monitoring and alerts.

Confirm that the API logs security-relevant events and that alerts are configured for abnormal or suspicious activity, in accordance with organization-defined logging and alerting standards.

If monitoring is not enabled, logs are not collected, or alerts are not generated for events as defined by organizational policy or standards, this is a finding.

Vulnerability Number

V-274517

Documentable

False

Rule Version

SRG-APP-000089-API-000120

Severity Override Guidance

Verify the API enables monitoring and alerts.

Confirm that the API logs security-relevant events and that alerts are configured for abnormal or suspicious activity, in accordance with organization-defined logging and alerting standards.

If monitoring is not enabled, logs are not collected, or alerts are not generated for events as defined by organizational policy or standards, this is a finding.

Check Content Reference

M

Target Key

5703