All Categories API Security Testing How do I get server APIs on my Beagle Security dashboard without third-party tools?

How do I get server APIs on my Beagle Security dashboard without third-party tools?

By Neda Ali
September 27, 2024

What is API discovery?  

API discovery is the process of identifying and cataloging the APIs available on a server or within an application.  

API Discovery helps create a comprehensive inventory of an organization’s internal and external API assets by identifying both existing and newly deployed APIs.  

It enables the development teams to identify, locate, manage, and monitor their organization’s APIs, including previously missed or unknown ones. 

How do I get server APIs on my Beagle Security dashboard? 

With Beagle Security, you can now seamlessly discover APIs from your server right from the dashboard, eliminating the need for any external tools.  

All the discovered APIs which can be included in the test will be displayed on the Beagle Security dashboard. From here, you can map the APIs to run the tests.  

This document provides detailed insights into API discovery and guides you through its configuration process. 

Follow the steps outlined to streamline the API discovery process: 

  1. Log into your Beagle Security dashboard and proceed to the settings 

Screenshot_2024-08-30_100432.png

  1. Select API Discovery from the left menu bar- here we start the API configuration process 

Screenshot_2024-08-30_100734.png 

  1. Click on the ‘+’ to create a new profile 

    Api_doc_1.png 

  2. Upon clicking, you can see a pop-up button to create the profile 

NB: There are two discoveries type available i.e., Istio mirroring and Kubernetes 

 Screenshot_2024-08-30_100918.png

  1. Select a discovery type 

  1. Give the Profile name and save 

NB: Configuration will be only available once you save it 

When choosing Kubernetes 

  1. Select Kubernetes, give your profile name and save 

 Screenshot_2024-08-30_101012.png

  1. Configuration is now starting, and a command will appear on the screen in the meantime. 

NB: To begin the discovery process, run this command on the machine with access to the cluster. 

Api_doc_1_6.png

  1. Copy the command from the screen 

  1. Paste and apply in the Kubernetes environment 

  1. The command will automatically run in the environment 

  1. Then, you can view all the discovered APIs on the Beagle Security dashboard.  

Api_doc_1.png

  1. From here, the first level of verification happens for the discovered APIs. It can further be mapped to the application and made to run the tests. 

  1. By clicking on the map to the application button you can map the APIs to the needed applications 

    Api_doc_1_2.png 

  2. Next, click on the Go to inventory button 

  1. The APIs that have been discovered, associated with the application will be appearing here.

    Api_doc_1_3.png 

  1. Every APIs discovered will automatically appear here by default. All listed APIs will undergo testing unless specifically excluded. 

What is API inventory and how can you view it?

Copy_of_help_doc_4.pngThe API inventory is the area where the discovered APIs which are mapped to the application will be shown. This list contains all the APIs-both existing and the newly discovered available for vulnerability scanning. All these APIs will be included in the test unless explicitly excluded. 

The list of things you can see in the API inventory list: 

  • API URL 

  • Request Method 

  • Request Headers 

  • Request Body 

  • Parameters 

 Copy_of_Copy_of_help_doc_4.png

Making changes to the discovered APIs

You can make changes to the discovered APIs. This is a very simple process. 

  1. Select the API you want to edit, click the import to APIs button to the right side of the screen 

  1. Now it will be imported to the REST API, and you can make the needed changes. 

 Api_doc_1_5.png

When choosing Istio

Screenshot_2024-08-30_100918.png

  1. Select Istio, give a profile name and save 

  1. Configuration is now starting, and a command will be displayed on the screen in the meantime. 

 Api_doc_1_8.png

  1. copy each command individually and paste them one by one into a terminal that has access to the Istio cluster.  

There will be two commands here. 

  • In the first command, make sure to activate the listener for capturing APIs, if it is not already enabled. This step is crucial for ensuring that all relevant API interactions are monitored and recorded 

  • In the second command the listener runs the process of directing the APIs to the Beagle dashboard. It is like application deployment 

  1. Then, you can view all the discovered APIs on the Beagle Security dashboard.  

    Api_doc_1.png

  2. Click on the Go to inventory button- the APIs that have been discovered, associated with the application, and included for testing will appear in this list. 

Was this article helpful?

Thanks for your feedback!