Unit 8: APIs and how modern apps talk · Lesson 4 of 5 · 20 min

Project: read the API access log

Find the client that ignored the rate limit and the app that keeps failing to authenticate.

mission

You are
The analyst on call for the shop's API.
Situation
The morning's API log from 14 October is loaded in the log console. Two things look wrong: a burst of refused requests and a run of failed sign-ins.
Goal
Identify both sources and describe what each was doing.
Hand in
Two short incident notes: who, what, when and the recommended action.

One log line

198.51.100.23 - - [14/Oct/2026:09:12:05 +0000] "GET /api/v1/products HTTP/1.1" 429 21 "-" "price-scraper/2.1"
  1. 1198.51.100.23client address
  2. 2[14/Oct/2026:09:12:05 +0000]time
  3. 3"GET /api/v1/products HTTP/1.1"request line
  4. 4429status
  5. 5"price-scraper/2.1"user agent
01

Find the refusals

Search the log for 429 . Note the address and the user agent.

you should see Every 429 comes from one address.

02

Measure the burst

Search for that address alone, then for it with " 200 " and with " 429 ".

you should see A short burst: ten requests served, then the rest refused.

03

Find the failed sign-ins

Search for 401 .

you should see One internal address with an old app version, failing on /api/v1/me every two seconds.

defender tip Not every alert is an attack. An outdated app retrying with a stale token looks noisy but needs a fix in the client, not a block.

What a defender takes away

  1. 1Status codes and user agents are the fastest way to group log lines.
  2. 2The rate limit worked: the scraper got ten answers and then refusals.
  3. 3Write notes that separate abuse from broken clients.

Questions

0 of 4 solved

Answer each one from what you find on your lab machine.