KQL Search

Query Details

APIM AI Gateway - New API operation used by known agent or caller

APIM New Operation First Seen

Query

let recentWindow=1h;
let baselineWindow=30d;
let Baseline=AppRequests
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name), Operation=coalesce(tostring(Properties["Operation Name"]), Name)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| distinct AgentKey, APIName, Operation;
let KnownAgents=Baseline | distinct AgentKey;
let Recent=AppRequests
| where TimeGenerated > ago(recentWindow)
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name), Operation=coalesce(tostring(Properties["Operation Name"]), Name)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller);
Recent
| join kind=inner KnownAgents on AgentKey
| join kind=leftanti Baseline on AgentKey, APIName, Operation
| summarize Calls=sum(ItemCount), Failures=sum(iff(Success == false, ItemCount, 0)), ResultCodes=make_set(ResultCode, 10), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Caller=take_any(Caller), ClientIP=take_any(ClientIP), Country=take_any(ClientCountryOrRegion) by AgentKey, APIName, Operation
| where Calls >= 2
| extend TimeGenerated=LastSeen, FailureRate=round(100.0 * todouble(Failures) / max_of(todouble(Calls), 1.0), 2), Signal="FIRST-SEEN API OPERATION"
| project TimeGenerated, Signal, AgentKey, Caller, ClientIP, Country, APIName, Operation, Calls, Failures, FailureRate, ResultCodes, FirstSeen, LastSeen
| order by Calls desc

Explanation

This query is designed to detect unusual API usage patterns in an Application Insights environment, specifically focusing on known agents or callers. Here's a simplified breakdown:

  1. Objective: The query aims to identify instances where a known agent or caller uses an API operation that they haven't used in the past 30 days. This could indicate potential issues like unauthorized access, misuse, or new capabilities being exposed.

  2. Data Source: It uses data from Application Insights, specifically the AppRequests data type.

  3. Time Frame:

    • Baseline Window: Looks at API operations over the past 30 days to establish a baseline of known operations for each agent.
    • Recent Window: Examines API operations in the last hour to identify new or unusual usage patterns.

  4. Detection Logic:

    • Baseline: Identifies distinct API operations used by each agent in the past 30 days.
    • Recent Activity: Checks for API operations in the last hour by known agents.
    • Comparison: Finds operations in the recent activity that are not present in the baseline, indicating new usage.

  5. Alert Conditions: An alert is triggered if there are at least two calls of a new API operation by a known agent within the last hour.

  6. Output: The query provides details such as the time of detection, agent key, caller information, client IP, country, API name, operation, number of calls, failures, failure rate, and result codes.

  7. Severity and Tactics: The alert is classified as medium severity and is associated with tactics like Discovery and Execution, with relevant techniques being T1580 (Cloud Infrastructure Discovery) and T1059 (Command and Scripting Interpreter).

  8. Incident Management: If an alert is generated, it can create an incident, with settings to group related alerts and reopen closed incidents if similar activity is detected within a day.

  9. Tags and Versioning: The query is tagged for easy identification and is versioned for tracking changes.

Overall, this query helps in monitoring and detecting potential security threats or operational anomalies in API usage by known entities.