KQL Search

Query Details

APIM AI Gateway - New country for known agent or caller

APIM New Country For Known Caller

Query

let recentWindow=1h;
let baselineWindow=30d;
let Baseline=AppRequests
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), Country=tostring(ClientCountryOrRegion)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| where isnotempty(Country)
| distinct AgentKey, Country;
let KnownAgents=Baseline | distinct AgentKey;
AppRequests
| where TimeGenerated > ago(recentWindow)
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), Country=tostring(ClientCountryOrRegion), City=tostring(ClientCity), APIName=coalesce(tostring(Properties["API Name"]), Name)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| where isnotempty(Country)
| join kind=inner KnownAgents on AgentKey
| join kind=leftanti Baseline on AgentKey, Country
| summarize Requests=sum(ItemCount), APIs=make_set(APIName, 10), Operations=make_set(Name, 20), Cities=make_set(City, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Caller=take_any(Caller), ClientIP=take_any(ClientIP) by AgentKey, Country
| where Requests >= 3
| extend TimeGenerated=LastSeen, Signal="NEW COUNTRY FOR KNOWN AGENT OR CALLER"
| project TimeGenerated, Signal, AgentKey, Caller, ClientIP, Country, Cities, Requests, APIs, Operations, FirstSeen, LastSeen
| order by Requests desc

Explanation

This query is designed to detect unusual activity from known agents or callers using an API Management (APIM) AI gateway. Here's a simple breakdown:

  1. Purpose: The query identifies if a known agent or caller makes at least three requests from a new country that hasn't been seen in their activity over the past 30 days.

  2. Data Source: It uses data from Application Insights, specifically focusing on API requests.

  3. Time Frame:

    • Baseline Period: Looks at the past 30 days to establish a history of countries from which the agent or caller has made requests.
    • Recent Activity: Monitors the last hour to detect new activity.

  4. Process:

    • Baseline Creation: Establishes a list of known agents and the countries they have accessed from in the past 30 days.
    • Current Monitoring: Checks recent requests to see if any known agent is accessing from a new country.
    • Comparison: Compares recent activity against the baseline to find new countries.

  5. Alert Criteria: Triggers an alert if an agent or caller makes three or more requests from a new country.

  6. Severity and Tactics:

    • The severity of the alert is considered low.
    • It relates to the "Initial Access" tactic, indicating potential unauthorized access attempts.

  7. Output: The query outputs details such as the agent key, caller, client IP, country, cities, number of requests, APIs accessed, and operations performed.

  8. Incident Management: If an alert is triggered, it can create an incident for further investigation, grouping related alerts by account.

  9. Tags and Metadata: The query is tagged for easy identification and is part of a scheduled monitoring routine.

This setup helps in identifying geographic anomalies in API usage, which could indicate potential security issues like unauthorized access or compromised accounts.