KQL Search

Query Details

APIM AI Gateway - Content safety blocked request

APIM Content Safety Blocked Request

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"])
| extend RequestJson=parse_json(RequestBody), ResponseJson=parse_json(ResponseBody)
| extend PolicyMessage=coalesce(tostring(ResponseJson.message), ResponseBody), PolicyStatus=tostring(ResponseJson.statusCode)
| where ResultCode == "403" and PolicyMessage has "content safety"
| extend Input=tostring(RequestJson.input), Instructions=tostring(RequestJson.instructions), Model=tostring(RequestJson.model), Tools=tostring(RequestJson.tools), Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown"), RequestId=tostring(Properties["Request Id"]), APIName=tostring(Properties["API Name"]), ServiceName=tostring(Properties["Service Name"]), Region=tostring(Properties["Region"])
| project TimeGenerated, Signal="CONTENT SAFETY BLOCK", Caller, ResultCode, PolicyStatus, PolicyMessage, APIName, Name, Url, Model, Input, Instructions, Tools, RequestBody, ResponseBody, RequestId, OperationId, DurationMs, ServiceName, Region

Explanation

This query is designed to detect and alert on requests made to an API Management (APIM) service that are blocked due to failing a content safety check. Here's a simplified breakdown of what the query does:

  1. Purpose: It identifies API requests that return an HTTP 403 status code, indicating they were blocked, specifically due to content safety issues.

  2. Data Source: The query uses data from Application Insights, specifically the AppRequests data type.

  3. Frequency: It runs every hour and checks data from the past hour.

  4. Detection Logic:

    • It filters requests where the SDK version starts with "apim:" or the service type is "API Management".
    • It extracts and parses the request and response bodies to JSON format.
    • It checks if the response message contains "content safety" and if the result code is "403".
    • It gathers additional information such as input, instructions, model, tools, caller identity, request ID, API name, service name, and region.

  5. Output: The query projects various details about the blocked request, including the time it was generated, the caller, the result code, policy status and message, API and service names, and more.

  6. Alert Configuration:

    • If any such blocked request is detected, an alert is triggered.
    • The alert is classified under tactics like Defense Evasion and Execution, with techniques T1027 and T1059. - It creates an incident in the system, with settings to group similar alerts and potentially reopen closed incidents if similar activity is detected within a 12-hour lookback period.

  7. Entity Mappings: It maps certain fields to entities like Account, Cloud Application, and URL for better context in alerts.

  8. Tags and Metadata: The query is tagged for easy identification and is part of a scheduled detection rule in a security monitoring system.

Overall, this query helps security teams monitor and investigate potentially harmful API requests that are blocked due to content safety concerns.