Advanced API Security は、悪意のあるクライアントからの攻撃や不正使用などのセキュリティ上の脅威から API を保護するために、API を継続的にモニタリングします。Advanced API Security は、API トラフィックを分析して不審な API リクエストを特定し、必要に応じてブロックまたはフラグを設定するツールを提供します。さらに、Advanced API Security は API 構成を評価して API 構成がセキュリティ標準を満たしていることを確認し、必要に応じて改善するための推奨事項を提供します。
セキュリティ レポートは、API に対するセキュリティ上の脅威に関する詳細な分析が表示されます。たとえば、リクエストの送信元の国などのさまざまな項目別に、悪意のあるリクエストの数に関するレポートを作成できます。これらのレポートは、Apigee UI または API を使用して表示できます。
リスク評価
リスク評価は、セキュリティ標準に準拠していない API を特定するのに役立ちます。リスク評価では、API 構成を定期的に評価し、セキュリティ レベルを評価するためのスコアを計算します。低いスコアにより構成の問題が示されている場合、Advanced API Security は問題を解決するための推奨事項を提供します。
セキュリティ対策
セキュリティ対策を使用すると、[不正行為の検出] ページの情報に基づいて、検出されたトラフィックを Apigee が処理する方法を定義できます。たとえば、不正行為の発生源として識別された IP アドレスからのリクエストを拒否するセキュリティ対策を作成できます。
セキュリティ通知
Advanced API Security に関連するイベント（セキュリティ スコアやセキュリティ インシデントの変更など）が検出されたときに通知が届くようにセキュリティ通知を設定できます。
難読化が構成されている場合、Advanced API Security のチェック（不正行為の検出やセキュリティ アクションなど）は難読化の前に適用されます。たとえば、IP アドレスが難読化されている場合でも、特定の IP アドレスからの不正行為を検出できます。ただし、（クライアント IP アドレスなどの）難読化された値は、ユーザーが Advanced API Security の UI や API を通じてクリアテキスト（ハッシュ化されていない値）で見ることはできません。表示されるのはハッシュ化された値です。
Advanced API Security で使用するデータ値の難読化解除が必要な場合があります。たとえば、セキュリティ アクションを構成するためにクライアント IP アドレスが必要になる場合があります。値がすでに難読化されている場合、クリアテキストの IP アドレスを取得できません。データ難読化では 1 方向ハッシュが使用され、Advanced API Security ではハッシュ値をクリアテキスト値に戻すことができないため、セキュリティ アクションの構成で難読化された（ハッシュ化された）値を使用することはできません。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-08-18 UTC。"],[[["\u003cp\u003eAdvanced API Security is a paid add-on for Apigee and Apigee hybrid that protects APIs from security threats by monitoring traffic, identifying suspicious requests, and evaluating API configurations.\u003c/p\u003e\n"],["\u003cp\u003eTo utilize Advanced API Security, users must first provision Apigee and then enable the feature, which is available for Apigee Subscription, Pay-as-you-go, and hybrid Subscription organizations, as well as non-hybrid organizations with data residency enabled.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security presents its analysis of API traffic in the Apigee UI through Abuse detection, Security reports, and Risk assessment, allowing users to review and take actions.\u003c/p\u003e\n"],["\u003cp\u003eUsers can define how Apigee handles detected threats through Security actions, like blocking requests, and can set up Security alerts to receive notifications about security-related events.\u003c/p\u003e\n"],["\u003cp\u003eAdvanced API Security uses detection rules based on machine-learning algorithms to detect patterns of malicious activity, allowing for counter-measures to be put in place.\u003c/p\u003e\n"]]],[],null,["# Overview of Advanced API Security\n\n*This page\napplies to **Apigee** and **Apigee hybrid**.*\n\n\n*View [Apigee Edge](https://docs.apigee.com/api-platform/get-started/what-apigee-edge) documentation.*\n\n| **Note:** To use Advanced API Security you must first [provision Apigee](/apigee/docs/api-platform/get-started/provisioning-intro). When Apigee is successfully provisioned, you can [set up and enable Advanced API Security](./enable-security).\n\nAdvanced API Security continually monitors your APIs to protect them from security threats,\nincluding attacks from malicious clients and abuse. Advanced API Security analyzes your API traffic to\nidentify suspicious API requests, and provides tools to block or flag those requests\nif you decide to do so. In addition, Advanced API Security evaluates your API configurations to\nensure they meet security standards, and gives you recommendations for improving them if\nneeded.\n\nAdvanced API Security does not affect runtime traffic.\n\nThe diagram below illustrates how Advanced API Security works.\n\nAdvanced API Security uses the following process to protect your APIs:\n\n1. Advanced API Security collects data for recent traffic passing through your APIs.\n2. Advanced API Security analyzes the data to detect unusual traffic patterns that indicate a threat to your APIs.\n3. Advanced API Security presents the results of the analysis in following pages in the Apigee UI:\n - [Abuse detection](#abuse-detection)\n - [Security reports](#security-reports)\n - [Risk assessment](#risk-assessment)\n4. After reviewing the analysis, you can choose to block or flag requests from specific IP addresses using the [security actions](#security-actions) page. You can also create [security alerts](#security-alerts), which notify you of events related to Advanced API Security.\n\nNote that Advanced API Security does not support APIs running under\n[Apigee Adapter for Envoy](/apigee/docs/api-platform/envoy-adapter).\n\nUse Advanced API Security\n-------------------------\n\nAdvanced API Security is available as a paid add-on for the following organization types:\n\n- Apigee Subscription and Pay-as-you-go organizations\n- Apigee hybrid organizations\n- Apigee organizations with [data residency enabled.](/apigee/docs/api-platform/get-started/drz-concepts) See [Data residency and Apigee hybrid](/apigee/docs/api-platform/get-started/drz-concepts#data-residency-and-apigee-hybrid) for information on use with DRZ-enabled hybrid organizations.\n\nTo use Advanced API Security, you must first enable it, as described in the following sections:\n\n- [Manage Advanced API Security for Pay-as-you-go organizations](/apigee/docs/api-security/enable-security#manage-advanced-api-security-for-pay-as-you-go-organizations)\n- [Manage Advanced API Security for Subscription organizations](/apigee/docs/api-security/enable-security#manage-advanced-api-security-for-subscription-organizations)\n\nYou can try Advanced API Security for free in any trial organization. Contact [Apigee Sales](https://pages.apigee.com/contact-sales-reg.html) to learn more.\n\nAdvanced API Security features\n------------------------------\n\nThe following sections briefly describe the features of Advanced API Security.\n\n### Abuse detection\n\n[Abuse\ndetection](/apigee/docs/api-security/abuse-detection) shows you security incidents involving your APIs. A security incident is a group\nof detected security events that are related to each other. Advanced API Security uses\n[detection rules](/apigee/docs/api-security/detection-rules), based on\nGoogle's machine-learning algorithms, to identify patterns that are signs of malicious activity,\nincluding API scraping and anomalies. You can then take measures to counter those threats\nusing [security actions](#security-actions).\n\n### Security reports\n\n[Security reports](/apigee/docs/api-security/security-report-jobs) give you more in-depth analysis of security threats to your APIs.\nFor example, you can create reports for the number of malicious requests\nby various dimensions, such as the country of origin of the request. You can view these\nreports in the Apigee UI or via the API.\n\n### Risk assessment\n\n[Risk assessment](/apigee/docs/api-security/security-scores) helps you identify APIs\nthat don't conform to security standards. Risk assessment regularly evaluates your API configurations\nand calculates scores to rate their security level. When a low score indicates a configuration\nissue, Advanced API Security provides recommendations to resolve the problem.\n\n### Security actions\n\n[Security actions](/apigee/docs/api-security/security-actions) let you\ndefine how Apigee handles detected traffic, based on information from the Abuse detection page.\nFor example, you can create a security action to deny requests from an IP address that has been\nidentified as a source of abuse.\n\n### Security alerts\n\nYou can configure [security alerts](/apigee/docs/api-security/security-alerts)\nto send you notifications when Advanced API Security detects\nevents related to Advanced API Security, such as changes to your security scores or security incidents.\n\nData obfuscation with Advanced API Security\n-------------------------------------------\n\nAdvanced API Security works with data that is obfuscated to replace sensitive data with a hashed value. See\n[Obfuscate user data for Apigee API Analytics](/apigee/docs/api-platform/analytics/obfuscate-user-data-for-analytics)\nfor information on the data obfuscation functionality.\n\n\nWhen obfuscation is configured, Advanced API Security checks such as in [Abuse detection](#abuse-detection)\nand [Security actions](#security-actions) are applied before the obfuscation. For example,\nit's possible to detect abuse from a specific IP address even if the IP address is obfuscated. However,\nobfuscated values (such as client IP address) are not viewable to users in clear (unhashed) text within the\nAdvanced API Security UIs or APIs. The hashed values are shown.\n\n\nIn some cases you need to obtain an unobfuscated data value to use with Advanced API Security. For example,\nyou might need a client IP address to configure a Security action. If the value is already obfuscated, you\ncan't retrieve the clear text IP address. Using the obfuscated (hashed) value in the Security action\nconfiguration doesn't work since data obfuscation uses a one-way hash and Advanced API Security cannot\nconvert the hashed value back to the clear text value."]]
