KQL Search

Query Details

APIM AI Gateway - Unusual API operation combination

APIM Unusual Operation Combination

Query

let recentWindow=1h;
let baselineWindow=14d;
let sensitiveVerbs=dynamic(["admin", "export", "delete", "remove", "drop", "update", "patch", "create", "disable", "reset", "grant", "revoke", "purge", "write", "send"]);
let Baseline=AppRequests
| where TimeGenerated between (ago(baselineWindow) .. ago(recentWindow))
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), Operation=tolower(coalesce(tostring(Properties["Operation Name"]), Name))
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller)
| distinct AgentKey, Operation;
let Recent=AppRequests
| where TimeGenerated > ago(recentWindow)
| where SDKVersion startswith "apim:" or tostring(Properties["Service Type"]) =~ "API Management"
| extend Caller=coalesce(UserAuthenticatedId, UserId, tostring(Properties["Subscription ID"]), tostring(Properties["SubscriptionId"]), tostring(Properties["subscriptionId"]), ClientIP, "unknown"), APIName=coalesce(tostring(Properties["API Name"]), Name), Operation=tolower(coalesce(tostring(Properties["Operation Name"]), Name))
| extend AgentKey=coalesce(tostring(Properties["AgentId"]), tostring(Properties["Agent ID"]), tostring(Properties["ApplicationId"]), tostring(Properties["Application ID"]), AppRoleName, Caller);
let NewOperations=Recent
| join kind=leftanti Baseline on AgentKey, Operation
| summarize NewOperationCount=dcount(Operation), NewOperations=make_set(Operation, 25) by AgentKey;
Recent
| summarize Requests=sum(ItemCount), DistinctOperations=dcount(Operation), Operations=make_set(Operation, 50), SensitiveOperations=make_set_if(Operation, Operation has_any (sensitiveVerbs), 25), APIs=make_set(APIName, 15), Failures=sum(iff(Success == false, ItemCount, 0)), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Caller=take_any(Caller), ClientIP=take_any(ClientIP) by AgentKey
| extend SensitiveOperationCount=array_length(SensitiveOperations)
| join kind=leftouter NewOperations on AgentKey
| extend NewOperationCount=coalesce(NewOperationCount, 0), NewOperations=coalesce(NewOperations, dynamic([]))
| where DistinctOperations >= 5 and (NewOperationCount >= 2 or SensitiveOperationCount >= 1)
| extend FailureRate=round(100.0 * todouble(Failures) / max_of(todouble(Requests), 1.0), 2)
| project LastSeen, AgentKey, Caller, ClientIP, Requests, DistinctOperations, NewOperationCount, NewOperations, SensitiveOperationCount, SensitiveOperations, APIs, Operations, Failures, FailureRate, FirstSeen
| order by NewOperationCount desc, DistinctOperations desc

Explanation

This query is designed to detect unusual behavior in API operations by analyzing recent activity and comparing it to a baseline of past behavior. Here's a simplified breakdown:

  1. Time Frames:

    • Recent Window: The last hour of API activity.
    • Baseline Window: The past 14 days of API activity, excluding the last hour.

  2. Sensitive Operations: The query focuses on operations that are considered sensitive, such as "admin", "delete", "update", etc.

  3. Data Collection:

    • Baseline Data: Collects distinct API operations performed by agents over the past 14 days, excluding the last hour.
    • Recent Data: Collects API operations performed in the last hour.

  4. New Operations Detection:

    • Identifies operations in the recent data that were not present in the baseline data, marking them as new operations.

  5. Analysis:

    • Summarizes recent activity by counting requests, distinct operations, sensitive operations, and failures.
    • Calculates the failure rate of operations.
    • Filters for agents with unusual behavior, defined as having at least 5 distinct operations and either 2 or more new operations or at least 1 sensitive operation.

  6. Output:

    • Provides a list of agents with their recent activity details, including the number of new and sensitive operations, failure rate, and other relevant metrics.
    • Orders the results by the number of new operations and distinct operations.

  7. Purpose:

    • The query aims to identify potential security threats by flagging agents that show unusual combinations of API operations, especially those involving sensitive actions.

  8. Tags and Techniques:

    • The query is tagged for use in security analytics, particularly in the context of API management and behavioral analysis, and is associated with specific security tactics and techniques.

In essence, this query helps security analysts spot potentially malicious or unauthorized API usage patterns by highlighting deviations from normal behavior.