// Illustrative; not executed against a live workspace. Azure Monitor Logs, resource-specific ApiManagementGatewayLogs.
// Callers that collect many denials across many routes in an hour, and whether they then succeed: the token,
// header and route probing JPCERT/CC describes in JPCERT-AT-2026-0030 (case B). Review candidates, not verdicts.
let Start = ago(7d);
let TargetResource = "REPLACE_WITH_APIM_RESOURCE_ID";
let TrustedEgress = dynamic(["REPLACE_WITH_CORPORATE_EGRESS_IP"]);
ApiManagementGatewayLogs
| where TimeGenerated >= Start
| where _ResourceId =~ TargetResource
| where not(CallerIpAddress in (TrustedEgress))
| extend Route = replace_regex(tostring(parse_url(Url).Path), @"/[0-9A-Fa-f-]{8,}|/\d+", "/{id}")
| summarize Denied = countif(ResponseCode in (401, 403)), NotFound = countif(ResponseCode == 404),
    Succeeded = countif(ResponseCode between (200 .. 299)), Routes = dcount(Route),
    DeniedRoutes = make_set_if(Route, ResponseCode in (401, 403), 20),
    FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by CallerIpAddress, Hour = bin(TimeGenerated, 1h)
| where Denied + NotFound >= 50 and Routes >= 10
| extend ThenSucceeded = Succeeded > 0
| order by ThenSucceeded desc, Denied desc