STIGQter STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

The API Gateway must audit execution time and performance metrics.

DISA Rule

SV-274531r1143559_rule

Vulnerability Number

V-274531

Group Title

SRG-APP-000095

Rule Version

SRG-APP-000095-API-001780

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Build or configure the API Gateway to log execution times and track key performance metrics, including thresholds for alerts.

Check Contents

If an API Gateway is not in use, this is Not Applicable.

Verify the API Gateway audits execution time and performance metrics.

1. Inspect the API Gateway's logs to verify they capture performance-related data, such as execution times, request latency, and throughput.

2. Simulate various requests and monitor the execution times, verifying performance metrics are logged for each request or operation.

3. Verify the API Gateway is configured to log execution times and track key performance metrics, including thresholds for alerts.

4. Review the API Gateway's documentation to ensure auditing of execution time and performance metrics is properly configured and operational.

If the API Gateway is not auditing execution time and performance metrics, this is a finding.

Vulnerability Number

V-274531

Documentable

False

Rule Version

SRG-APP-000095-API-001780

Severity Override Guidance

If an API Gateway is not in use, this is Not Applicable.

Verify the API Gateway audits execution time and performance metrics.

1. Inspect the API Gateway's logs to verify they capture performance-related data, such as execution times, request latency, and throughput.

2. Simulate various requests and monitor the execution times, verifying performance metrics are logged for each request or operation.

3. Verify the API Gateway is configured to log execution times and track key performance metrics, including thresholds for alerts.

4. Review the API Gateway's documentation to ensure auditing of execution time and performance metrics is properly configured and operational.

If the API Gateway is not auditing execution time and performance metrics, this is a finding.

Check Content Reference

M

Target Key

5703