Ingest Azure APIM - Administrator Guide - Cortex XDR - Cortex - Security Operations

You can create a policy on a specific API or choose to create a policy on all APIs.

From Inbound Processing, click .

The Policies screen opens. There are three sections:

The <inbound> includes the request before it's sent to the <outbound>. The parameters are saved before they're sent.

Add the following inside the <inbound>:

 <!-- Save the request body and headers to be sent to Cortex. This should always be placed at the very beginning of the inbound element. -->
        <set-variable name="requestBody" value="@((context.Request?.Body?.As<string>(preserveContent: true)) ?? string.Empty)" />
        <set-variable name="requestHeaders" value="@(JsonConvert.SerializeObject(context.Request.Headers))" />
        <!-- End of setting variables for sending to Cortex --><!-- Save the request body and headers to be sent to Cortex. This should always be placed at the very beginning of the inbound element. -->
        <set-variable name="requestBody" value="@((context.Request?.Body?.As<string>(preserveContent: true)) ?? string.Empty)" />
        <set-variable name="requestHeaders" value="@(JsonConvert.SerializeObject(context.Request.Headers))" />
        <!-- End of setting variables for sending to Cortex -->

The <outbound> includes the request before it returns a response.

Add the following inside the <outbound> element, at the end, after the other child elements:

 <!-- Send data to Cortex. This should always be placed at the very end of the outbound element. -->
        <send-request mode="new" response-variable-name="mirrorMessage">
            <set-url>{{cortex-api-url}}</set-url>
            <set-method>POST</set-method>
            <set-header name="Content-Type" exists-action="override">
                <value>application/json</value>
            </set-header>
            <set-header name="Authorization" exists-action="override">
                <value>{{cortex-api-key}}</value>
            </set-header>
           <set-body>@{
                        string requestBody = context.Variables.GetValueOrDefault<string>("requestBody");
                        string responseBody = context.Response.Body.As<string>(preserveContent: true);
                        int bodySizeLimit = {{cortex-http-body-size-limit-bytes}};
                        bool requestBodySizeExceedsLimit = requestBody.Length > bodySizeLimit;
                        bool responseBodySizeExceedsLimit = responseBody.Length > bodySizeLimit;

                        return JsonConvert.SerializeObject(new {
                            accountId               = "{{cloud-account-id}}",
                            serviceId               = context.Deployment.ServiceId,
                            requestId               = context.RequestId,
                            url                     = context.Request.OriginalUrl,
                            httpMethod              = context.Request.Method,
                            requestBody             = requestBodySizeExceedsLimit ? requestBody.Substring(0, bodySizeLimit) : requestBody,
                            requestBodyTruncated    = requestBodySizeExceedsLimit,
                            requestHeaders          = JsonConvert.DeserializeObject(context.Variables.GetValueOrDefault<string>("requestHeaders")),
                            timestamp               = new DateTimeOffset(context.Timestamp).ToUnixTimeMilliseconds(),
                            requestIpAddress        = context.Request.IpAddress,
                            statusCode              = context.Response.StatusCode,
                            responseBody            = responseBodySizeExceedsLimit ? responseBody.Substring(0, bodySizeLimit) : responseBody,
                            responseBodyTruncated   = responseBodySizeExceedsLimit,
                            responseHeaders         = context.Response.Headers,
                            region                  = context.Deployment.Region,
                            subscription            = context.Subscription,
                        });
                    }
            </set-body>
        </send-request>
        <!-- End of sending data to Cortex -->

Click Save. Your APIM traffic collection is now configured.

Request and response data for the configured endpoints are sent to Cortex XDR for inspection by API security modules.