Actions

Actions refer to the automated tasks that can be performed on the API. You can create an action against an API. The action can be triggered by an event or you can set up an action that is triggered by a schedule.

Create an action

1. Navigate to the APIs tab on the dashboard.
2. Select the API you want to create the action against.
3. Click Actions. Then click Create Action.
4. Select to create an Event Driven Action or a Scheduled Action.

Create an Event Driven Action

Fill out the Event Driven Action form:

• ‍Name: Enter a name for the action.
• ‍Description: Enter a description for the action.
• ‍Events: Select which event or events will trigger the action.
• ‍Integration Type: Chose from Custom or Managed:
  • ‍Custom: Select from a previously created Lambda or Webhook integration. Alternatively, click Create to create a new one.
  • Managed:
    • API CVE Detection - Scan the entered endpoint for CVEs.
    • SSL Vulnerabilities Detection - Scan the entered endpoint for SSL vulnerabilities.
    • Data Exposure Detection - Scan the entered endpoint for data exposure.
    • Default Login Detection - Scan the entered endpoint to check if you are hosting any services using default login credentials.
    • Fuzzing Detection - Fuzz the entered endpoint.

Note: See below for further information on each of the managed actions.

Scheduled action

Set up an Action to trigger on a schedule. Fill out the Event Driven Action form:

• ‍Name: Enter a name for the action.
• ‍Description: Enter a description for the action.
• ‍Scheduled rate minutes: The rate in minutes at which the action should be run.
• ‍Integration Type: Chose from Custom or Managed:
  • ‍Custom: Select from a previously created Lambda or Webhook integration. Alternatively, click Create to create a new one.
  • ‍Managed:
    • API CVE Detection - Scan the entered endpoint for CVEs.
    • SSL Vulnerabilities Detection - Scan the entered endpoint for SSL vulnerabilities.
    • Data Exposure Detection - Scan the entered endpoint for data exposure.
    • Default Login Detection - Scan the entered endpoint to check if you are hosting any services using default login credentials.
    • Fuzzing Detection - Fuzz the entered endpoint.

Note: See below for further information on each of the managed actions.

Custom integration example

Below is a FireTail actions event payload. See the GitHub Repo for details on how to call back to FireTail with your own findings.

{
    'api_details': {
        'UUID': 'ded296d8-daed-450c-b83f-b4b8d89cbe95',
        'api_appUUID': 'cca39d04-7b6e-4727-9688-3f908492b620',
        'api_orgUUID': '665002ee-0066-435f-9654-20eb209cdd18',
        'api_type': 'rest',
        'createdBy': 'example@example.com',
        'dateAddedInMicroSeconds': 1710854022659491,
        'g_apiUUID': 'ded296d8-daed-450c-b83f-b4b8d89cbe95',
        'g_appUUID': 'cca39d04-7b6e-4727-9688-3f908492b620',
        'g_orgUUID': '665002ee-0066-435f-9654-20eb209cdd18',
        'name': 'api name'
    },
    'action_type': 'api_schedule_action',
    'invoke_epoch_time': 1712227639,
    'jwt_token': 'example.example.example',
    'action_details': {
        'UUID': '13eec790-73a7-4612-ab09-c122240b52b7',
        'actionType': 'api_schedule_action',
        'actionVersion': 'v0.0.1',
        'action_apiUUID': 'ded296d8-daed-450c-b83f-b4b8d89cbe95',
        'action_appUUID': 'cca39d04-7b6e-4727-9688-3f908492b620',
        'action_orgUUID': '665002ee-0066-435f-9654-20eb209cdd18',
        'createdBy': 'example@example.com',
        'dateAddedInMicroSeconds': 1711050404116639,
        'description': '',
        'enabled': True,
        'g_orgUUID': '665002ee-0066-435f-9654-20eb209cdd18',
        'integrationType': 'custom',
        'integrationUUID': 'd0b7faa9-6ec6-41dd-ae58-e6f528908252',
        'itemType': 'action',
        'name': 'lambda function',
        'scheduledRate': 15,
    },
    'context': {
        'inputs': {
            'api_endpoint': 'https://example.com/health'
        }
    },
    'callback_url': 
    'https://api.saas.eu-west-1.prod.firetail.app
    /organisations/665002ee-0066-435f-9654-20eb209cdd18/
    actions/13eec790-73a7-4612-ab09-c122240b52b7/callback'
}

API CVE Detection

This managed action scans your endpoint for CVEs (common vulnerabilities and exposures) and generates observations. CVEs are identified by the year in which the vulnerability was discovered or publicly disclosed. Each CVE entry receives a unique identifier number. In total, 2302 checks are made. See the table below for some examples of CVEs that are scanned for in this managed action.

‍

SSL Vulnerabilities Detection

This managed action will scan your endpoint for SSL Vulnerabilities and generate observations. SSL (Secure Sockets Layer) vulnerabilities refer to weaknesses or flaws in the SSL protocol or implementations that could potentially compromise the security of data transmitted over the internet. SSL is a cryptographic protocol used to establish secure connections between a web server and a client, typically a web browser, ensuring that data exchanged between them is encrypted and protected from interception or tampering. In total, 24 SSL checks are made. See the table below for examples of SSL vulnerability detections:

SSL examples:

‍

Data Exposure Detection

This managed action will scan your endpoint for data exposure and generate observations. In total, 467 data exposure checks are made. See the table below for examples of data exposure detections:

‍

Default Login Detection

This managed action will scan your endpoint to see if you are hosting any services using default login credentials and generate observations. In total, 173 default login checks are made. See the table below for some examples of default login detections:

‍

FUZZING Detection

This managed action will fuzz your endpoint and generate observations.

Fuzzing  an endpoint  involves sending a large volume of invalid, unexpected, or random data inputs to the endpoint, to identify vulnerabilities, crashes, or unexpected behavior. This technique aims to discover security flaws, such as buffer overflows, injection vulnerabilities, or parsing errors, that may not be identified through traditional testing methods. In total, 11 fuzzing checks are made. See the table below for some examples:

‍