// Illustrative; not executed against a live workspace. Azure Monitor Logs, not Defender XDR.
// Resource-specific ApiManagementGatewayLogs must already be enabled; replace both identifiers.
// UserId is an APIM user identifier, not proof of the application's authenticated principal.
let Start = ago(24h);
let End = now();
let TargetResource = "REPLACE_WITH_APIM_RESOURCE_ID";
let TargetApi = "REPLACE_WITH_API_ID";
ApiManagementGatewayLogs
| where TimeGenerated between (Start .. End)
| where _ResourceId =~ TargetResource and ApiId == TargetApi
| extend Path = tostring(parse_url(Url).Path)
| project TimeGenerated, CorrelationId, OperationId, Method, Path,
          ResponseCode, ResponseSize, CallerIpAddress, UserId, ApimSubscriptionId, Cache, Region
| order by TimeGenerated desc
| take 250