defensive-graphql

Name: defensive-graphql
Availability: InStock
Author: riparino

Detect GraphQL introspection abuse, batch attacks, and deep-nested queries.

1|Updated Apr 27, 2026

Search Tags:#security #graphql #introspection #detection #hardening #dos #batch-attack

Ready to run

npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-graphql

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: defensive-graphql
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-graphql
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-graphql

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

GraphQL endpoints are often exposed to unauthenticated or misconfigured clients, enabling introspection leakage and abuse through poorly constrained queries. This skill provides detection rules and hardening guidance to curb introspection exposure, batch queries, and deeply nested queries, reducing risk exposure.

Core Features & Use Cases

Detect introspection requests from untrusted sources and disable them in production.
Identify batch/DoS patterns and unusual aliasing in mutations to prevent brute-force and resource exhaustion.
Provide Sigma (SIEM) detection rules and KQL queries for monitoring GraphQL activity in cloud deployments.
Use cases include API security monitoring, threat-hunting workflows, and proactive GraphQL hardening.

Quick Start

Use this skill to enable detection and hardening rules for your GraphQL endpoint.

Frequently Asked Questions about defensive-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect GraphQL introspection abuse in production APIs?▼

Detect GraphQL introspection abuse by applying Sigma-based SIEM rules to monitor for untrusted introspection requests. You can harden API security by disabling introspection in production environments to prevent schema leakage.

How do I prevent batch attacks and deep-nested queries in GraphQL?▼

Prevent batch attacks and deep-nested queries in GraphQL by enforcing depth and complexity limits. Identifying unusual aliasing in mutations helps stop brute-force attempts and resource exhaustion caused by malicious payloads.

Can I monitor GraphQL API activity using KQL queries in Azure?▼

You can monitor GraphQL API activity in Azure using KQL queries for Azure Gateways. These detection rules track large batch bodies and unusual mutation aliasing to identify potential denial-of-service patterns.

What is the best way to harden GraphQL endpoints against denial of service?▼

The best way to harden GraphQL endpoints against denial of service is combining proactive monitoring with strict query constraints. Disabling introspection and enforcing query depth limits effectively reduces the risk of resource exhaustion.

Does this skill provide Sigma rules for threat hunting GraphQL misuse?▼

This skill provides Sigma-based detection rules specifically for threat hunting GraphQL misuse. These rules integrate into existing SIEM workflows to alert on introspection exposure, batch attacks, and suspicious mutation aliasing.

When should I enforce complexity limits on GraphQL mutations?▼

You should enforce complexity limits on GraphQL mutations whenever endpoints are exposed to unauthenticated or misconfigured clients. Limiting query depth and complexity mitigates the risk of deep-nested queries causing API resource exhaustion.