KQL Search

Query Details

APIM AI Gateway - Repeated unauthorized requests

APIM Repeated Unauthorized Requests

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| where ResultCode in ("401", "403")
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name)
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| summarize DeniedRequests=sum(ItemCount), DistinctOperations=dcount(Name), Operations=make_set(Name, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Caller=take_any(Caller), ClientIP=take_any(ClientIP), Country=take_any(ClientCountryOrRegion) by bin(TimeGenerated, 5m), AgentKey, APIName, ResultCode
| where DeniedRequests >= 10
| extend Signal=case(ResultCode == "401", "REPEATED AUTHENTICATION FAILURES", "REPEATED POLICY OR AUTHORIZATION DENIALS")
| project TimeGenerated, Signal, AgentKey, Caller, ClientIP, Country, APIName, ResultCode, DeniedRequests, DistinctOperations, Operations, FirstSeen, LastSeen
| order by DeniedRequests desc

Explanation

This query is designed to detect repeated unauthorized access attempts to an API Management (APIM) AI gateway. Here's a simplified breakdown:

  • Purpose: The query identifies instances where there are at least 10 unauthorized access attempts (HTTP status codes 401 or 403) from a single agent or caller within a five-minute window. This could indicate issues such as invalid credentials or policy denials.

  • Data Source: It uses data from Application Insights, specifically the AppRequests data type.

  • Frequency: The query runs every 15 minutes and looks back over the past hour.

  • Severity: The alert generated is of medium severity.

  • Detection Logic:

    • It filters requests to those related to API Management.
    • It checks for HTTP status codes 401 (authentication failures) and 403 (authorization or policy denials).
    • It groups the data by five-minute intervals and counts the number of denied requests.
    • If there are 10 or more denied requests from the same agent or caller, it triggers an alert.

  • Output: The query outputs details such as the time of the event, the type of repeated denial, the agent or caller involved, their IP address, the API name, and the number of denied requests.

  • Incident Management: If an alert is triggered, it creates an incident and groups related alerts by account for better incident management.

  • Tags and Metadata: The query is tagged for easy identification and is part of a scheduled monitoring routine.

Overall, this query helps in identifying potential security issues related to unauthorized API access, allowing for timely investigation and response.