> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-azure-apim.md).

# Ingest Azure APIM

{% hint style="info" %}
**License**

Requires the Data Collection add-on.
{% endhint %}

Integrate Azure APIM with Cortex XDR to start scanning its APIs for potential threats and vulnerabilities.

You need to set up a policy that enables you to customize the behavior of managed APIs. You can configure the sending of HTTP request/response data to Cortex XDR. The data is saved and analyzed by API security modules, which provide information on the security risks associated with the APIs.

{% hint style="info" %}
**Note**

Microsoft Azure APIM service must be running before starting to configure the integration.
{% endhint %}

### Settings in Cortex XDR

In Cortex XDR, set up the Azure API Management data source to integrate with the Azure API Gateway.

1. From Settings → Data Sources & Integrations , click + Add New, search for Azure API Management, then hover over it and click Add or Add Instance.
2. In the APIM Collector wizard, enter a relevant name and then click Create and Proceed.
3. Copy the key and paste it somewhere so that you can access it for later. If you forget to record the key and close the window, you must generate a new key and repeat this process.
4. Click Close.

### Settings in Azure APIM policy

Configure an inbound and outbound policy to send HTTP traffic data of the APIs to Cortex XDR. You can configure a policy for individual operations (endpoints) or all operations of a single API.

Follow the steps to configure the policy.

1. Log in to [Microsoft Azure](https://portal.azure.com/).
2. Go to API Management services and select the relevant service.
3. From the left-hand menu, select APIs → Named values.

{% hint style="info" %}
**Note**

From the URL, save the UUID and the resource group - `/resource/subscriptions/<UUID>/resourceGroups/<ResourceGroup>`.

The UUID is the Azure account/subscription ID and the resource group, which is the group where the APIM Service is defined.
{% endhint %}

4. Configure the settings in each section. Follow the listed order.

{% hint style="info" %}
**Note**

Use search to navigate to each section.
{% endhint %}

**Named values**: Add these values:

* cloud-account-id
  * Type: Plain
  * Value: The UUID you saved from the previous step.
* cloud-resource-group
  * Type: Plain
  * Value: The resource group you saved from the previous step.
* cortex-api-key
  * Type: Secret
  * Value: The token that you saved from data sources in Cortex.
* cortex-api-url
  * Type: Plain
  * Value: The API URL from data sources in Cortex.
* cortex-http-body-size-limit-bytes
  * Type: Plain
  * Value: 131072

{% hint style="info" %}
**Note**

131072 bytes = 128 KB. This value determines the size (in bytes) of request and response bodies to send to Cortex. Any bytes beyond this limit are truncated.
{% endhint %}

**APIs**: From the left-hand menu, go to APIs → APIs.

1. You can create a policy on a specific API or choose to create a policy on all APIs.
2. From Inbound Processing, click [![code\_bracket.png](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAYCAYAAACbU/80AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQkSURBVEhL7VbPbxtFFP52bcebJk0aiyZVm5JfJSFAVCIVDqgS0AuCigqpKlCJSlUBFcSBK+IfQFwQJ66lElDopSWgiqjgiDhNXQ4pbaTGqRM1DXYSy2nSOE5sx7tevrcTqxHYawOHXvhWb2fnzY/3zXtvZlazCTxE6JvlQ8P/BP4hAUmXv6ZMgVJKXx2qJGBveR6gWLORh1nIkIq5Wd9Kx51YVbvA5tQauRacyTSnribWKDo8fBeRR4510WjOGJld16RfaVT0QHHVlmO0OJEY1SjK+HIKuDGewFxyGT7qC9igVkPeLjjG3VZYkYAaLq61kCOHPCW1ZmExfd/RrvMVvhrFp5+cxcDFq5hfWmPPbRQdG3l6gH3+A4ECHzFj0rVZRzM1BQz8MILI5CwJkcjSCsLXxmhlBxrrexC+EsflwVuYmwP8NRoyORuWJd4rDVcCir3E3kdXb8dC0sbApSAGfwkhsZhG1tRJzYt4Yh71Tduxp60L0ekkzpz9HsMj45j9w4LhV3lSDq4EVOJ5kcrquB6J4cxX3+Kn4I9o7WxFe3cPfFzhwmIOq/l1GIE8WjqBnqc7YHosEh3E0HAYsUQOOVM8WdoLrgQsinSIz+XwzblhjN2MoO/APrx69GV0duwkQeDO7CriyXl09QXQsgs4cLCd7Yfhr2vAz0NhXLh4GdksU9iW2f4OVwImmUuWT0UTGAlN4Ikn+/HueyfR093i5DmjgLt378Hrr8G2BjBLLGTMLA4f6cfRY8exvJxBMDgKq8AtWWYnuodgc5Df8MCo9WJycgq/XRtHjosRYibzMxZLoLGxETubm6jTsMMwcG8JuDIagq1tQPcKVUnk0nAl4PNwK7Hc3/8oXn/zBaRXU/j6y0s4f+5XJzwLCzZm7kwj0NSE7sceRx2ni84k8PlnX+D6WBi7dhv44MM3UFvPZLZLm3IloHZBAY/QvSdPPI+3Tx3jzrQRCo5gYnwRM9EZ5NYy6O7Yh0BDACscEBoaxe3IBHp79+KtE0dw8Nn9qPGJN/8FAYHaCYBBOXSoD6dPv4au9t1YTqRxP7kKD+O7R7Ivz4NqLQvD58MrL72Id04dx3PPPMUF2JxDPaXgeheIYRGJYDGH/ZRb0yka03H+uwu4cfN3fPTx++jrb4Nh+HhQzaO5uYVe07HOZKnlAB8XoZeh4EpAGoSACsUD0KNYWQcit6OIxafp7l7sbW2Dx8sGWvFQTIZKszXmEd3MwaIrhYq34VbjUnJeZYDlRj7Nw8jmUVVHohJNoZt3+mianJ7UUaWzKGO/iuuYrVxI8XPzrfwib7UhxYBc2ereAGrYKveiWr2DMgwqJqEMlBtRGbD4ZToRVVH1wmYS8k6iXrJEUSqi3Kq3oqofEgX1Z6A6Cxmh5XF+OASaJjqpiMg1LAQrkQD+BPLbwBrtdjoYAAAAAElFTkSuQmCC)](https://docs-cortex.paloaltonetworks.com/viewer/attachment/GD6sG6FlxDWxAn13_eZuUQ/8~Q_W_m502bg6wT3cEp9_Q-GD6sG6FlxDWxAn13_eZuUQ).

   The Policies screen opens. There are three sections:

   * `<inbound>`
   * `<backend>`
   * `<outbound>`

   The `<inbound>` includes the request before it's sent to the `<outbound>`. The parameters are saved before they're sent.

   Add the following inside the `<inbound>`:

   ```
    <!-- Save the request body and headers to be sent to Cortex. This should always be placed at the very beginning of the inbound element. -->
           <set-variable name="requestBody" value="@((context.Request?.Body?.As<string>(preserveContent: true)) ?? string.Empty)" />
           <set-variable name="requestHeaders" value="@(JsonConvert.SerializeObject(context.Request.Headers))" />
           <!-- End of setting variables for sending to Cortex --><!-- Save the request body and headers to be sent to Cortex. This should always be placed at the very beginning of the inbound element. -->
           <set-variable name="requestBody" value="@((context.Request?.Body?.As<string>(preserveContent: true)) ?? string.Empty)" />
           <set-variable name="requestHeaders" value="@(JsonConvert.SerializeObject(context.Request.Headers))" />
           <!-- End of setting variables for sending to Cortex -->
   ```

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If any other inbound policies should be added, they must be added after these elements.</p></div>

   \
   The `<outbound>` includes the request before it returns a response.

   \
   Add the following inside the \<outbound> element, at the end, after the other child elements:

   ```
    <!-- Send data to Cortex. This should always be placed at the very end of the outbound element. -->
           <send-request mode="new" response-variable-name="mirrorMessage">
               <set-url>{{cortex-api-url}}</set-url>
               <set-method>POST</set-method>
               <set-header name="Content-Type" exists-action="override">
                   <value>application/json</value>
               </set-header>
               <set-header name="Authorization" exists-action="override">
                   <value>{{cortex-api-key}}</value>
               </set-header>
              <set-body>@{
                           string requestBody = context.Variables.GetValueOrDefault<string>("requestBody");
                           string responseBody = context.Response.Body.As<string>(preserveContent: true);
                           int bodySizeLimit = {{cortex-http-body-size-limit-bytes}};
                           bool requestBodySizeExceedsLimit = requestBody.Length > bodySizeLimit;
                           bool responseBodySizeExceedsLimit = responseBody.Length > bodySizeLimit;

                           return JsonConvert.SerializeObject(new {
                               accountId               = "{{cloud-account-id}}",
                               serviceId               = context.Deployment.ServiceId,
                               requestId               = context.RequestId,
                               url                     = context.Request.OriginalUrl,
                               httpMethod              = context.Request.Method,
                               requestBody             = requestBodySizeExceedsLimit ? requestBody.Substring(0, bodySizeLimit) : requestBody,
                               requestBodyTruncated    = requestBodySizeExceedsLimit,
                               requestHeaders          = JsonConvert.DeserializeObject(context.Variables.GetValueOrDefault<string>("requestHeaders")),
                               timestamp               = new DateTimeOffset(context.Timestamp).ToUnixTimeMilliseconds(),
                               requestIpAddress        = context.Request.IpAddress,
                               statusCode              = context.Response.StatusCode,
                               responseBody            = responseBodySizeExceedsLimit ? responseBody.Substring(0, bodySizeLimit) : responseBody,
                               responseBodyTruncated   = responseBodySizeExceedsLimit,
                               responseHeaders         = context.Response.Headers,
                               region                  = context.Deployment.Region,
                               subscription            = context.Subscription,
                           });
                       }
               </set-body>
           </send-request>
           <!-- End of sending data to Cortex -->

   ```

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Important</strong></p><p>If you want to add additional data to the &#x3C;outbound>, add it at the start of the &#x3C;outbound> code.</p></div>

3\. Click Save. Your APIM traffic collection is now configured. Request and response data for the configured endpoints are sent to Cortex XDR for inspection by API security modules.

**5.** Go to Azure API Management data source to validate that data is ingested from Azure APIM.

**6.** Do the following to remove the integration of Azure APIM with Cortex XDR:

* Remove the snippets you added to the policies.
* Remove the named values from the API service.
* Delete the HTTP log collector from Data Sources & Integrations in Cortex.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/configure-cortex-xdr/cortex-xdr-data-sources/vendor-specific-data-sources/api-security/ingest-data-for-api-security/ingest-azure-apim.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.