KQL Search

Query Details

APIM AI Gateway - Sensitive data in request body

APIM Sensitive Data In Request Body

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"])
| where isnotempty(RequestBody)
| extend Input=tostring(parse_json(RequestBody).input), Instructions=tostring(parse_json(RequestBody).instructions), Model=tostring(parse_json(RequestBody).model)
| extend HasAwsKey=RequestBody matches regex @"AKIA[0-9A-Z]{16}", HasPrivateKey=RequestBody contains "-----BEGIN" and RequestBody contains "PRIVATE KEY-----", HasJwt=RequestBody matches regex @"eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}", HasCredentialAssignment=RequestBody matches regex @"(?i)(password|secret|connectionstring|connstring|api[_ -]?key)\s*[:=]", HasCreditCard=RequestBody matches regex @"\b(?:\d[ \-]?){13,16}\b", EmailCount=array_length(extract_all(@"([A-Za-z0-9._%+\-]+@[A-Za-z0-9.\-]+\.[A-Za-z]{2,})", RequestBody))
| where HasAwsKey or HasPrivateKey or HasJwt or HasCredentialAssignment or HasCreditCard or EmailCount >= 10
| extend Signal=strcat(iff(HasAwsKey,"AWSAccessKey;",""),iff(HasPrivateKey,"PrivateKey;",""),iff(HasJwt,"JWT;",""),iff(HasCredentialAssignment,"CredentialAssignment;",""),iff(HasCreditCard,"CreditCardLike;",""),iff(EmailCount>=10,strcat("BulkEmails(",tostring(EmailCount),");"),"")), Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown"), RequestId=tostring(Properties["Request Id"]), APIName=tostring(Properties["API Name"])
| project TimeGenerated, Signal, Caller, Success, ResultCode, APIName, Name, Url, Model, Input, Instructions, RequestBody, ResponseBody, EmailCount, RequestId, OperationId

Explanation

This query is designed to detect sensitive information in the request bodies captured by Azure API Management (APIM). It specifically looks for indicators such as AWS access keys, private keys, JSON Web Tokens (JWTs), credentials, credit card numbers, and bulk email addresses. Here's a breakdown of what the query does:

  1. Data Source: It uses data from the Application Insights connector, focusing on application requests (AppRequests).

  2. Frequency and Period: The query runs every hour and checks data from the past hour.

  3. Detection Logic:

    • It filters requests where the SDK version starts with "apim:" or the service type is "API Management".
    • It extracts the request and response bodies and checks if the request body is not empty.
    • It parses the request body to identify specific fields like input, instructions, and model.
    • It searches for patterns indicating sensitive data:
      • AWS access keys
      • Private keys
      • JWTs
      • Credentials (like passwords or API keys)
      • Credit card numbers
      • Bulk email addresses (10 or more)

  4. Alert Generation: If any of these patterns are found, it generates an alert with details about the type of sensitive data detected, the caller, and other relevant information.

  5. Entity Mapping: It maps certain fields to entities like Account, CloudApplication, and URL for better context in alerts.

  6. Incident Management: It creates incidents for detected alerts, with settings for grouping related alerts and incidents.

  7. Severity and Tactics: The severity of the alert is marked as high, and it relates to tactics like Credential Access and Collection, with techniques T1552 and T1213.

  8. Additional Information: The query is part of a scheduled task, tagged with identifiers like Sentinel-As-Code, Custom, APIM, AI, and OWASP-LLM06. In summary, this query helps identify and alert on potential leaks of sensitive information in API requests managed by Azure API Management, aiding in the protection of sensitive data.