APIM AI Gateway - Abnormal request volume by agent or caller

APIM Abnormal Request Volume

Query

let recentWindow=1h;
let baselineWindow=7d;
let Historical=AppRequests
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| summarize HourRequests=sum(ItemCount) by AgentKey, APIName, bin(TimeGenerated, 1h)
| summarize BaselineMedian=percentile(HourRequests, 50), BaselineP95=percentile(HourRequests, 95), BaselineHours=count() by AgentKey, APIName;
let Current=AppRequests
| where TimeGenerated > ago(recentWindow)
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| summarize CurrentRequests=sum(ItemCount), Operations=dcount(Name), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Caller=take_any(Caller), ClientIP=take_any(ClientIP) by AgentKey, APIName;
Current
| join kind=inner Historical on AgentKey, APIName
| extend MedianRatio=round(todouble(CurrentRequests) / max_of(todouble(BaselineMedian), 1.0), 2), P95Ratio=round(todouble(CurrentRequests) / max_of(todouble(BaselineP95), 1.0), 2)
| where BaselineHours >= 6 and CurrentRequests >= 50 and MedianRatio >= 3.0 and P95Ratio >= 1.5
| extend TimeGenerated=LastSeen, Signal="ABNORMAL API CONSUMPTION"
| project TimeGenerated, Signal, AgentKey, Caller, ClientIP, APIName, CurrentRequests, BaselineMedian, BaselineP95, MedianRatio, P95Ratio, BaselineHours, Operations, FirstSeen, LastSeen
| order by MedianRatio desc

Explanation

This query is designed to detect unusual activity in an API Management (APIM) AI gateway by monitoring the request volume from different agents or callers. Here's a simple breakdown of what it does:

Purpose: It identifies agents or callers that have a sudden spike in API requests, which could indicate issues like runaway automation, denial-of-wallet attacks, or abuse. However, legitimate activities like batch jobs or load tests might also trigger this alert.
Criteria for Alert:
- The agent or caller must have made at least 50 requests in the last hour.
- This request volume must be at least three times higher than their median hourly request volume over the past seven days.
- It must also be 1.5 times higher than their 95th percentile request volume over the same period.
- There must be at least six hours of historical data available for comparison.
Data Source: The query uses data from Application Insights, specifically focusing on API requests.
Process:
- It calculates the median and 95th percentile of hourly request volumes for each agent or caller over the past seven days.
- It then compares these historical metrics to the request volume in the last hour.
- If the criteria are met, it flags the activity as "ABNORMAL API CONSUMPTION."
Output: The query outputs details such as the time of detection, the agent or caller's identifier, their IP address, the API name, the number of requests, and the calculated ratios.
Alert Management: If an abnormal pattern is detected, it creates an incident and groups related alerts to manage them efficiently.
Severity and Tactics: The alert is classified with medium severity and is associated with tactics like "Impact," referencing specific techniques (T1496, T1499) related to resource consumption and denial-of-service activities.

Overall, this query helps in monitoring and managing API usage to prevent potential misuse or unexpected spikes in activity.