Gartner defines API protection products as a category of specialized stand-alone security products focusing on protecting APIs from exploits, abuse and access violations, and assisting in remediating API exposures. These products offer features such as API discovery, API security testing, API posture management and runtime protection utilizing behavioral analysis. They should provide coverage for the internal- and external-facing APIs, and third-party APIs that organizations may consume. API protection products are delivered as cloud-based and on-premises solutions. Deployment can be offered in-line by intercepting ingress/egress API calls or out-of-band by deploying agents on application workloads and/or scanning code repositories.
Security information and event management (SIEM) is a configurable system of record that collects, aggregates and analyzes security event data from on-premises and cloud environments. SIEM processes security event data for the purposes of threat detection, investigation and response. It natively supports data normalization and offers user-configurable detection content and reporting to orchestrate threat mitigation and satisfy compliance requirements. These solutions are delivered via a SaaS platform or client-hosted on-premises or private cloud. The security information and event management (SIEM) system must assist with: 1. Aggregating and normalizing data from various IT and operational technology (OT) environments. 2. Designing and executing near real-time monitoring and alerting content. 3. Enriching and investigating security events of interest. 4. Supporting manual and automated response actions. 5. Maintaining and reporting on current and historical event data.