Investigate API Security Threats Using the API Violations View

1. Access the API Violations page. On the left navigation bar, Select API Violations under AI Runtime. This action navigates you to the main Violations View, which serves as the central hub for threat investigation.

   Observe the Violation chart (Sankey chart) at the top of the page and the Violations Table below it. The Violation chart provides a high-level visual distribution of blocked transactions by content type, detector, and severity. The Violations Table lists individual scan requests that triggered violations.
2. Filter violations for specific analysis.

   1. Use the filter options at the top of the page to refine the displayed violations. Filtering allows you to narrow down the scope of your investigation to focus on specific types of threats or content, making analysis more efficient.
   2. Select Content Type (for example, Prompt, Code, Model Response, Tool call) from the drop-down menu. This filter helps you identify violations originating from specific parts of an API interaction, such as user prompts or model responses. Note that a prompt might contain embedded code, leading to code-related violations even when you filter by Prompt.

      A prompt might contain embedded code, leading to code-related violations even when you filter by Prompt.
   3. Select Threat Type (for example, Prompt Injection, Data Leak, URL Security) from the drop-down menu. This filter allows you to focus on specific categories of security threats detected by Prisma AIRS.
   4. Select Severity (for example, Critical, High, Medium, Low) from the drop-down menu. You can prioritize investigations by focusing on violations with higher severity levels, indicating a greater potential risk to your systems.

   Observe how the Violation chart and Violations Table dynamically update based on your selected filters. The real-time updates provide immediate feedback, allowing for interactive exploration and drill-down into the data.
3. Investigate a specific violation using the Transaction Overview flyout. In the Violations Table, Select the hyperlinked Scan ID for the violation you wish to examine in detail. Selecting the Scan ID opens a side panel (flyout) that provides granular details about that specific API scan request and its associated violations.

   1. Review the Transaction Overview panel.

      Observe the Violation Metadata section, which includes details such as Timestamp, Session ID, App name, Model Name, and Security Profile Name. This metadata provides essential context about when, where, and under what security policy the violation occurred.

      View the Count of policy violations by severity for this specific scan. This count summarizes the total number of individual detections (violations) within this single scan request, categorized by their severity.
   2. Examine the Threat Snippets & Payload by Content Type section. This section provides the critical evidence (snippets) that triggered the detection, helping you understand the exact nature of the threat to your systems:

      • Expand the accordion for each detector that fired to view specific details.
      • For Prompt Injection, review the Violated Snippet (an array of strings) to see the malicious parts of the prompt. Prompt Injection snippets highlight the specific text sequences within the prompt that were identified as malicious.
      • For URL Security, observe the URL that was flagged and its associated Categories. This provides the exact URL and its classification (for example, malware, phishing) that led to the violation.
      • For Data Leak Detection (DLP), identify the Data Pattern (for example, Credit Card Number), Confidence, Pattern Type, Occurrences, and the masked Violated Snippet.
        The Violated Snippet for DLP is only visible if the Mask DLP Patterns setting is not enabled in your security profile. DLP snippets provide detailed information about sensitive data exposure, including the type of data, the system's confidence in its detection, and the number of times it appeared. The masking setting protects sensitive information from being fully displayed.
      • For violations within a Tool content type, note the additional metadata such as Tool Name, Direction, Ecosystem, Method, and Server, alongside the violated snippet. This context is crucial for understanding threats that originate from or target specific tools used by the AI application.
        If a snippet is not available for a detector, the UI will indicate No snippet available. This message clarifies that while a threat was detected, the system does not currently support displaying the specific snippet for that detector.
4. Understand complex scan requests with multiple violations:

   1. Observe the Violation Severity Breakdown pop-over by hovering over the info icon in the Violations Table for a single scan request that triggered multiple threat detectors across different content types. This pop-over consolidates and displays all individual violations for a single, complex transaction, providing a comprehensive view of all threats detected within that request.

   Note how the UI aggregates and displays all violations for a single, complex transaction, even if they span different content types and detectors. This aggregation simplifies the analysis of multifaceted attacks or misconfigurations by presenting all relevant threat information for one transaction in a unified manner.