defensive-graphql

What problem does it solve?

GraphQL endpoints are often exposed to unauthenticated or misconfigured clients, enabling introspection leakage and abuse through poorly constrained queries. This skill provides detection rules and hardening guidance to curb introspection exposure, batch queries, and deeply nested queries, reducing risk exposure.

Core Features & Use Cases

• Detect introspection requests from untrusted sources and disable them in production.
• Identify batch/DoS patterns and unusual aliasing in mutations to prevent brute-force and resource exhaustion.
• Provide Sigma (SIEM) detection rules and KQL queries for monitoring GraphQL activity in cloud deployments.
• Use cases include API security monitoring, threat-hunting workflows, and proactive GraphQL hardening.

Quick Start

Use this skill to enable detection and hardening rules for your GraphQL endpoint.