KQL Search

Query Details

APIM AI Gateway - Payload logging coverage

APIM Payload Logging Coverage

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"])
| summarize Total=count(), WithRequestBody=countif(isnotempty(RequestBody)), WithResponseBody=countif(isnotempty(ResponseBody)), WithBoth=countif(isnotempty(RequestBody) and isnotempty(ResponseBody)) by APIName=tostring(Properties["API Name"]), ServiceName=tostring(Properties["Service Name"])
| extend RequestBodyPct=round(100.0*WithRequestBody/Total,1), ResponseBodyPct=round(100.0*WithResponseBody/Total,1)
| order by Total desc

Explanation

This query is designed to analyze and measure the coverage of request and response body logging in an API Management (APIM) environment. Here's a simple breakdown of what it does:

  1. Data Source: It starts by looking at application requests (AppRequests) that are either using a specific SDK version starting with "apim:" or are identified as "API Management" in their properties.

  2. Extracting Data: It extracts the request and response bodies from the properties of these requests.

  3. Summarizing Data: The query then summarizes the data by counting:

    • The total number of requests.
    • The number of requests that include a request body.
    • The number of requests that include a response body.
    • The number of requests that include both a request and a response body.

    This summarization is done for each API and service name.

  4. Calculating Percentages: It calculates the percentage of requests that have a request body and the percentage that have a response body, relative to the total number of requests.

  5. Ordering Results: Finally, it orders the results by the total number of requests in descending order.

The purpose of this query is to assess how well the request and response bodies are being logged and to identify any potential exposure of sensitive telemetry data. It is tagged with tactics and techniques related to data collection and is part of a custom solution for monitoring APIM environments.