KQL Search

Query Details

APIM AI Gateway - Full request and response body investigation

APIM Request Response Body Investigation

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"])
| where isnotempty(RequestBody) or isnotempty(ResponseBody)
| extend RequestJson=parse_json(RequestBody), ResponseJson=parse_json(ResponseBody)
| extend Input=tostring(RequestJson.input), Instructions=tostring(RequestJson.instructions), Model=tostring(RequestJson.model), Tools=tostring(RequestJson.tools), ToolChoice=tostring(RequestJson.tool_choice), Stream=tostring(RequestJson.stream), PolicyStatus=tostring(ResponseJson.statusCode), PolicyMessage=tostring(ResponseJson.message), APIName=tostring(Properties["API Name"]), RequestId=tostring(Properties["Request Id"]), Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown")
| project TimeGenerated, Success, ResultCode, PolicyStatus, PolicyMessage, Caller, APIName, Name, Url, Model, Stream, ToolChoice, Input, Instructions, Tools, RequestBody, ResponseBody, RequestId, OperationId, DurationMs
| order by TimeGenerated desc
| take 500

Explanation

This query is designed to investigate full request and response bodies in an API Management (APIM) environment, specifically focusing on AI Gateway interactions. Here's a simple breakdown of what the query does:

  1. Data Source: It starts by looking at application requests (AppRequests) that are either using the APIM SDK or are identified as API Management services.

  2. Extracting Information: It extracts the request and response bodies from these requests and ensures that at least one of them is not empty.

  3. Parsing JSON: The request and response bodies are parsed as JSON to extract specific fields such as input, instructions, model, tools, and tool choices from the request, and status code and message from the response.

  4. Additional Details: It also gathers additional information like the API name, request ID, and caller identity (which could be a user ID, client IP, or marked as unknown if not available).

  5. Output: The query then selects specific fields to display, including timestamps, success status, result codes, and various extracted and original properties.

  6. Sorting and Limiting: The results are sorted by the time they were generated in descending order, and only the most recent 500 entries are taken.

  7. Purpose: This query is useful for discovering and collecting detailed information about API interactions, particularly for monitoring and troubleshooting purposes in environments using AI and APIM.

  8. Tags and Techniques: It is tagged for use with Sentinel-As-Code, custom solutions, APIM, and AI, and is associated with specific tactics and techniques related to discovery and collection activities.