feat(SAFE-T1804): add API Data Harvest technique documentation#131
Open
geekysatbir wants to merge 10 commits intosafe-agentic-framework:mainfrom
Open
feat(SAFE-T1804): add API Data Harvest technique documentation#131geekysatbir wants to merge 10 commits intosafe-agentic-framework:mainfrom
geekysatbir wants to merge 10 commits intosafe-agentic-framework:mainfrom
Conversation
Added practical Python code examples demonstrating: - Simple loop detection using call history tracking - Basic loop prevention with iteration limits and convergence checks - Log pattern analysis for identifying loop indicators This addition helps beginners understand autonomous loop exploits through hands-on, runnable code examples. Signed-off-by: Satbir Singh <satbisin@cisco.com>
Signed-off-by: Satbir Singh <satbisin@cisco.com>
Signed-off-by: Satbir Singh <satbisin@cisco.com>
… documentation - Added comprehensive documentation for SAFE-T1004 technique - Includes attack vectors, technical details, detection methods, and mitigations - Created Sigma-format detection rule for identifying server impersonation attacks - Updated main README to link to new technique documentation This technique documents how attackers impersonate trusted MCP servers through name collision, DNS hijacking, and discovery service manipulation to gain initial access to MCP environments. Signed-off-by: Satbir Singh <satbir.taya84@gmail.com>
…us sections - Expanded Advanced Attack Techniques with more detailed explanations - Enhanced Current Status section with specific implementation details - Improved clarity and alignment with SAFE-T1008 format Signed-off-by: Satbir Singh <satbir.taya84@gmail.com>
Fixed relative paths to use absolute paths from repository root to resolve 404 errors in GitHub PR view. Signed-off-by: Satbir Singh <satbir.taya84@gmail.com>
Changed from absolute paths (techniques/SAFE-TXXXX/README.md) to relative paths (../SAFE-TXXXX/README.md) to match the format used by other techniques in the repository. This ensures links work correctly when viewing files in GitHub's web interface. Signed-off-by: Satbir Singh <satbir.taya84@gmail.com>
- Added comprehensive documentation for SAFE-T1804 technique - Includes attack vectors, technical details, detection methods, and mitigations - Created Sigma-format detection rule for identifying API harvesting attacks - Updated main README to link to new technique documentation - Focused on AIOps/observability use cases (Prometheus, Grafana, Datadog, etc.) This technique documents how attackers systematically harvest data from REST APIs through MCP tools by manipulating AI agents into making repetitive HTTP requests. Signed-off-by: Satbir Singh <satbir.taya84@gmail.com>
Fixed Mermaid diagram by replacing curly braces with quotes to avoid
conflict with Mermaid syntax. Changed {id} to ID in node labels to
prevent parse errors.
Signed-off-by: Satbir Singh <satbir.taya84@gmail.com>
- Resolved conflicts in README.md by accepting upstream version (more up-to-date table format) - Accepted upstream version for SAFE-T1004 (already merged by another contributor) - Kept local version for SAFE-T1804 (this PR's contribution) Signed-off-by: Satbir Singh <satbisin@cisco.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds comprehensive documentation for SAFE-T1804: API Data Harvest, a collection technique where adversaries systematically extract data by manipulating AI agents into making repetitive HTTP requests to REST API endpoints through MCP tools.
What's Included
Key Features
Related Techniques
Testing
Checklist