KQL Search

Query Details

APIM AI Gateway - Content safety blocks by model

APIM Content Safety By Model

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"]), RequestJson=parse_json(tostring(Properties["Request-Body"])), ResponseJson=parse_json(tostring(Properties["Response-Body"]))
| extend PolicyMessage=coalesce(tostring(ResponseJson.message),ResponseBody), Model=tostring(RequestJson.model), Caller=coalesce(UserAuthenticatedId,UserId,ClientIP,"unknown"), APIName=tostring(Properties["API Name"])
| where ResultCode == "403" and PolicyMessage has "content safety"
| summarize Blocks=count(), Operations=dcount(OperationId), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by APIName, Model, Caller, Name
| order by Blocks desc

Explanation

This query is designed to analyze and summarize instances where content safety measures have blocked requests in an API Management (APIM) environment. Here's a simplified breakdown of what the query does:

  1. Data Source: It starts by looking at data from AppRequests, focusing on requests related to API Management (APIM).

  2. Filtering: It filters the requests to only include those where the result code is "403" (indicating a forbidden request) and the response message contains "content safety". This means the request was blocked due to content safety concerns.

  3. Data Extraction: It extracts and processes various pieces of information from the request and response bodies, such as the model used, the caller's identity, and the API name.

  4. Aggregation: The query then aggregates the data to count how many times content safety blocks occurred (Blocks), how many unique operations were involved (Operations), and the time range during which these blocks were first and last seen.

  5. Sorting: Finally, it sorts the results by the number of blocks in descending order, so the APIs with the most blocks appear first.

  6. Purpose: This helps in identifying which APIs, models, or callers are most frequently encountering content safety blocks, aiding in understanding and potentially mitigating these issues.

The query is tagged with tactics and techniques related to defense evasion, indicating its relevance in security contexts, particularly for monitoring and responding to content safety issues in AI-driven API environments.