STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API Gateway must generate audit records of what type of events occurred.

DISA Rule

SV-274522r1143515_rule

Vulnerability Number

V-274522

Group Title

SRG-APP-000095

Rule Version

SRG-APP-000095-API-001735

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

Build or configure the API Gateway to audit what type of events occurred.

Check Contents

If an API Gateway is not in use, this is Not Applicable.

Verify the API Gateway generates audit records of what type of events occurred.

1. Inspect the API Gateway's configuration settings and verify logging is enabled and audit records are being generated for key events such as authentication, authorization, data access, and errors.

2. Make a valid API request and verify successful events are logged.

3. Simulate system errors by causing the API to fail under specific conditions (e.g., database unavailability, timeout errors, internal exceptions).

4. Check the audit or access logs in the API Gateway or logging platform (e.g., AWS CloudWatch, Splunk, ELK stack). Verify the logs contain entries for the triggered events.

5. Inspect the log entries for the following:
- Event Type: The event’s description or category (e.g., authentication attempt, data access, system error).

If the API Gateway does not generate audit records for the type of event, this is a finding.

Vulnerability Number

V-274522

Documentable

False

Rule Version

SRG-APP-000095-API-001735

Severity Override Guidance

If an API Gateway is not in use, this is Not Applicable.

Verify the API Gateway generates audit records of what type of events occurred.

1. Inspect the API Gateway's configuration settings and verify logging is enabled and audit records are being generated for key events such as authentication, authorization, data access, and errors.

2. Make a valid API request and verify successful events are logged.

3. Simulate system errors by causing the API to fail under specific conditions (e.g., database unavailability, timeout errors, internal exceptions).

4. Check the audit or access logs in the API Gateway or logging platform (e.g., AWS CloudWatch, Splunk, ELK stack). Verify the logs contain entries for the triggered events.

5. Inspect the log entries for the following:
- Event Type: The event’s description or category (e.g., authentication attempt, data access, system error).

If the API Gateway does not generate audit records for the type of event, this is a finding.

Check Content Reference

M

Target Key

5703