KQL Search

Query Details

APIM AI Gateway - Unsafe active content returned

APIM Unsafe Active Content Response

Query

AppRequests
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| where Success == true or toint(ResultCode) between (200 .. 299)
| extend RequestBody=tostring(Properties["Request-Body"]), ResponseBody=tostring(Properties["Response-Body"])
| where isnotempty(ResponseBody)
| extend ActiveContent=extract(@"(?i)(<script(?:\s|>)|javascript\s*:|data\s*:\s*text/html|<iframe(?:\s|>)|<object(?:\s|>)|<embed(?:\s|>)|on(?:error|load|click)\s*=|document\.cookie|window\.location\s*=)", 0, ResponseBody)
| where isnotempty(ActiveContent)
| extend RequestJson=parse_json(RequestBody)
| extend Input=tostring(RequestJson.input), Instructions=tostring(RequestJson.instructions), Model=tostring(RequestJson.model), Tools=tostring(RequestJson.tools), Caller=coalesce(UserAuthenticatedId, UserId, ClientIP, "unknown"), RequestId=tostring(Properties["Request Id"]), APIName=tostring(Properties["API Name"])
| project TimeGenerated, Signal="UNSAFE ACTIVE CONTENT RETURNED", ActiveContent, Caller, ResultCode, APIName, Name, Url, Model, Input, Instructions, Tools, RequestBody, ResponseBody, RequestId, OperationId, DurationMs

Explanation

This query is designed to monitor and detect potentially unsafe content being returned by an API Management (APIM) AI Gateway. Here's a simplified breakdown:

  • Purpose: The query identifies successful responses from an APIM AI gateway that contain potentially harmful active content, such as HTML scripts, event handlers, or executable URIs. This is important because such content could be executed by a browser or automation tool, posing a security risk.

  • Severity: The alert generated by this query is considered of medium severity.

  • Data Source: It uses data from Application Insights, specifically focusing on application requests.

  • Frequency: The query runs every hour and looks at data from the past hour.

  • Trigger: An alert is triggered if there is more than zero instances of unsafe content detected.

  • Detection Logic:

    • It filters requests that are either marked as successful or have a result code between 200 and 299. - It checks the response body for active content patterns like <script>, javascript:, data:text/html, and others.
    • If such content is found, it extracts and logs details about the request and response, including who made the request and what API was called.

  • Output: The query projects various details such as the time the event was generated, the type of active content found, the caller, the result code, and other relevant information.

  • Entity Mappings: It maps certain fields to entities like Account, Cloud Application, and URL for better organization and analysis.

  • Incident Management: If an alert is generated, it creates an incident and groups related alerts to manage them effectively.

  • Tags and Version: The query is tagged for easy identification and is versioned as 1.0.0. Overall, this query helps in identifying and managing potential security risks related to unsafe content being returned by an AI gateway, ensuring that any such incidents are promptly detected and addressed.