KQL Search

Query Details

APIM AI Gateway - Request to dependency correlation

APIM Request Dependency Correlation

Query

let Requests=AppRequests
| where TimeGenerated > ago(24h)
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name), RequestId=tostring(Properties["Request Id"])
| project RequestTime=TimeGenerated, OperationId, RequestId, Caller, ClientIP, APIName, RequestOperation=Name, RequestUrl=Url, RequestResult=ResultCode, RequestSuccess=Success, RequestDurationMs=DurationMs;
let Dependencies=AppDependencies
| where TimeGenerated > ago(24h)
| project DependencyTime=TimeGenerated, OperationId, DependencyName=Name, DependencyTarget=Target, DependencyResult=ResultCode, DependencySuccess=Success, DependencyDurationMs=DurationMs, DependencyType, Agent=tostring(Properties["gen_ai.agent.name"]), Model=tostring(Properties["gen_ai.request.model"]), Tool=tostring(Properties["gen_ai.tool.name"]);
Requests
| join kind=inner Dependencies on OperationId
| project RequestTime, DependencyTime, OperationId, RequestId, Caller, ClientIP, APIName, RequestOperation, RequestUrl, RequestResult, RequestSuccess, RequestDurationMs, DependencyName, DependencyTarget, DependencyType, DependencyResult, DependencySuccess, DependencyDurationMs, Agent, Model, Tool
| order by RequestTime desc, DependencyTime asc
| take 500

Explanation

This KQL query is designed to analyze and correlate API Management (APIM) frontend requests with downstream dependency calls. Here's a simplified breakdown of what the query does:

  1. Data Collection:

    • It gathers data from two sources: AppRequests and AppDependencies, focusing on the last 24 hours.

  2. Filtering and Transformation:

    • For AppRequests, it filters requests where the SDK version starts with "apim:" or the service type is "API Management".
    • It extracts and organizes relevant information such as the caller's identity, API name, request ID, and other request details.

  3. Dependency Data:

    • For AppDependencies, it collects details about dependencies, including the time, name, target, result, success status, duration, type, and additional properties related to AI agents and tools.

  4. Correlation:

    • It joins the two datasets (Requests and Dependencies) on the OperationId, which is a unique identifier for each operation, to correlate requests with their corresponding dependencies.

  5. Output:

    • The query projects a combined view of request and dependency data, including timestamps, operation IDs, caller information, API details, and dependency specifics.
    • It orders the results by request time (newest first) and dependency time (oldest first), and limits the output to the top 500 entries.

  6. Purpose:

    • This query helps in reconstructing the flow from API requests to backend dependencies, identifying failing dependencies, and linking gateway behavior with instrumented agent spans.

  7. Context:

    • The query is tagged with tactics and techniques related to discovery and is part of a custom solution for analyzing API Management and AI correlations in a security context.