Investigate API Access Logs with Azure Application Insights
Get hands-on with Azure Application Insights as you investigate requests to an API. You’ll generate successful and blocked requests, then use KQL to see which requests the API allowed and which it denied. We’ll walk through connecting application logs to HTTP request records, building alerts for repeated denials, and testing those alerts. To finish, you’ll write a short mock incident report to practice explaining your findings to a teammate. Along the way, you’ll learn what to look for in the logs and how to turn what you find into a useful detection.
- 8 guided tasks
Scenario
Now that we've got an API in production and it's getting requests for important internal documents, I'd like you to take the lead on setting up logging, monitoring, and alerting.
Start with a few controlled requests so you know what you’re looking for. Follow that activity in Application Insights with KQL, then build an alert to help our team spot repeated denials. Test it with simulated requests to make sure it triggers alerts as expected.
When you’re done, put together a short mock incident report for practice. Walk me through what you found and how the alert helps us catch this activity. Thanks for taking this on!
- Your Manager
What you will learn
- Send allowed and denied requests to a live CloudOps API.
- Use KQL to investigate how the API handled your requests.
- Connect application events to their HTTP request records.
- Build an Azure Monitor log alert and trigger it with your test traffic.
Investigate API Access Logs with Azure Application Insights
Included in Cybr Premium.