diff --git a/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardFactorHistory_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardFactorHistory_CL.json new file mode 100644 index 00000000000..cd15247a4d8 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardFactorHistory_CL.json @@ -0,0 +1,12 @@ +{ + "Name": "SecurityScorecardFactorHistory_CL", + "Properties": [ + { "Name": "TimeGenerated", "Type": "datetime" }, + { "Name": "score_date", "Type": "datetime" }, + { "Name": "factors", "Type": "dynamic" }, + { "Name": "domain", "Type": "string" }, + { "Name": "industry", "Type": "string" }, + { "Name": "portfolio_name", "Type": "string" }, + { "Name": "portfolio_id", "Type": "string" } + ] +} diff --git a/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardIssuesHistory_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardIssuesHistory_CL.json new file mode 100644 index 00000000000..847a321c017 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardIssuesHistory_CL.json @@ -0,0 +1,20 @@ +{ + "Name": "SecurityScorecardIssuesHistory_CL", + "Properties": [ + { "Name": "TimeGenerated", "Type": "datetime" }, + { "Name": "id", "Type": "long" }, + { "Name": "issue_date", "Type": "datetime" }, + { "Name": "event_type", "Type": "string" }, + { "Name": "group_status", "Type": "string" }, + { "Name": "issue_count", "Type": "long" }, + { "Name": "total_score_impact", "Type": "real" }, + { "Name": "issue_type", "Type": "string" }, + { "Name": "severity", "Type": "string" }, + { "Name": "factor", "Type": "string" }, + { "Name": "detail_url", "Type": "string" }, + { "Name": "domain", "Type": "string" }, + { "Name": "industry", "Type": "string" }, + { "Name": "portfolio_name", "Type": "string" }, + { "Name": "portfolio_id", "Type": "string" } + ] +} diff --git a/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardRatingsHistory_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardRatingsHistory_CL.json new file mode 100644 index 00000000000..b37f27d587d --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardRatingsHistory_CL.json @@ -0,0 +1,12 @@ +{ + "Name": "SecurityScorecardRatingsHistory_CL", + "Properties": [ + { "Name": "TimeGenerated", "Type": "datetime" }, + { "Name": "score_date", "Type": "datetime" }, + { "Name": "score", "Type": "long" }, + { "Name": "domain", "Type": "string" }, + { "Name": "industry", "Type": "string" }, + { "Name": "portfolio_name", "Type": "string" }, + { "Name": "portfolio_id", "Type": "string" } + ] +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json index 3902ff6aecf..02710e74df7 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json @@ -1,8 +1,8 @@ { "id": "SecurityScorecardFactorAzureFunctions", - "title": "SecurityScorecard Factor", + "title": "[DEPRECATED] SecurityScorecard Factor", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Factors (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Microsoft Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.", "graphQueries": [ { "metricName": "Total Factor data received", @@ -32,7 +32,7 @@ ], "availability": { "status": 1, - "isPreview": true + "isPreview": false }, "permissions": { "resourceProvider": [ diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DCR.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DCR.json new file mode 100644 index 00000000000..aa823b8d375 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DCR.json @@ -0,0 +1,59 @@ +{ + "name": "SecurityScorecardFactorDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-SecurityScorecardFactorHistory_CL": { + "columns": [ + { + "name": "domain", + "type": "string" + }, + { + "name": "factors", + "type": "dynamic" + }, + { + "name": "date", + "type": "datetime" + }, + { + "name": "portfolio_id", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "industry", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SecurityScorecardFactorHistory_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend TimeGenerated = todatetime(['date']), score_date = todatetime(['date']), domain = tostring(domain), industry = tostring(industry), factors = todynamic(factors) | project TimeGenerated, score_date, factors, domain, industry, portfolio_id, portfolio_name", + "outputStream": "Custom-SecurityScorecardFactorHistory_CL" + } + ] + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DataConnectorDefinition.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DataConnectorDefinition.json new file mode 100644 index 00000000000..f30654816e1 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DataConnectorDefinition.json @@ -0,0 +1,173 @@ +{ + "name": "SecurityScorecardFactorCCPDefinition", + "apiVersion": "2025-07-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardFactorCCPDefinition", + "title": "SecurityScorecard Factors (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Factors (Codeless) connector ingests company factor-score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw rows land in `SecurityScorecardFactorHistory_CL`; query via the `SecurityScorecardFactor` parser to get day-over-day deltas with factor metadata, matching the legacy Function App schema.", + "graphQueriesTableName": "SecurityScorecardFactorHistory_CL", + "graphQueries": [ + { + "metricName": "Total Factor history rows received", + "legend": "SecurityScorecard factor history", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Day-over-day factor change (parser)", + "query": "SecurityScorecardFactor\n | sort by TimeGenerated desc" + }, + { + "description": "Raw factor history", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator, create a bot user with Read Only permission and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the factor-score history for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's factor scores (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_PollingConfig.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_PollingConfig.json new file mode 100644 index 00000000000..44571e80ca2 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_PollingConfig.json @@ -0,0 +1,148 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardFactor', uniqueString(parameters('PortfolioId')))]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardFactorCCPDefinition", + "dataType": "SecurityScorecardFactorHistory_CL", + "addOnAttributes": { + "portfolio_id": "[[parameters('PortfolioId')]", + "portfolio_name": "[[parameters('PortfolioName')]", + "domain": "$company_domain$", + "industry": "$company_industry$" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardFactorHistory_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/portfolios/', parameters('PortfolioId'), '/companies')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "factorHistory", + "stepPlaceholdersParsingKql": "source | extend res = parse_json(data) | project company_domain = tostring(res['domain']), company_industry = tostring(res['industry'])" + } + ] + }, + "stepCollectorConfigs": { + "factorHistory": { + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/$company_domain$/history/factors/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardFactorOwn', uniqueString(parameters('Domain')))]", + "location": "{{location}}", + "kind": "RestApiPoller", + "condition": "[[and(not(empty(parameters('Domain'))), not(equals(parameters('Domain'), 'Domain')))]", + "properties": { + "connectorDefinitionName": "SecurityScorecardFactorCCPDefinition", + "dataType": "SecurityScorecardFactorHistory_CL", + "addOnAttributes": { + "portfolio_id": "NA", + "portfolio_name": "My Scorecard", + "domain": "[[parameters('Domain')]", + "industry": "NA" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardFactorHistory_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/', parameters('Domain'), '/history/factors/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } +] diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_tables.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_tables.json new file mode 100644 index 00000000000..f5c7cc4ea11 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_tables.json @@ -0,0 +1,41 @@ +{ + "name": "SecurityScorecardFactorHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "{{location}}", + "properties": { + "schema": { + "name": "SecurityScorecardFactorHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "score_date", + "type": "datetime" + }, + { + "name": "factors", + "type": "dynamic" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue/SecurityScorecardIssue_API_FunctionApp.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue/SecurityScorecardIssue_API_FunctionApp.json index be57877172a..702380f5f33 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue/SecurityScorecardIssue_API_FunctionApp.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue/SecurityScorecardIssue_API_FunctionApp.json @@ -1,8 +1,8 @@ { "id": "SecurityScorecardIssueAzureFunctions", - "title": "SecurityScorecard Issue", + "title": "[DEPRECATED] SecurityScorecard Issue", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Issues data connector provides the ability for Sentinel to import SecurityScorecard issue data as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when new cybersecurity issues are discovered.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Issues (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Issues data connector provides the ability for Microsoft Sentinel to import SecurityScorecard issue data as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when new cybersecurity issues are discovered.", "graphQueries": [ { "metricName": "Total Issue data received", @@ -32,7 +32,7 @@ ], "availability": { "status": 1, - "isPreview": true + "isPreview": false }, "permissions": { "resourceProvider": [ diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DCR.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DCR.json new file mode 100644 index 00000000000..56fbb49f668 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DCR.json @@ -0,0 +1,91 @@ +{ + "name": "SecurityScorecardIssueDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-SecurityScorecardIssuesHistory_CL": { + "columns": [ + { + "name": "id", + "type": "long" + }, + { + "name": "date", + "type": "datetime" + }, + { + "name": "event_type", + "type": "string" + }, + { + "name": "group_status", + "type": "string" + }, + { + "name": "issue_count", + "type": "long" + }, + { + "name": "total_score_impact", + "type": "real" + }, + { + "name": "issue_type", + "type": "string" + }, + { + "name": "severity", + "type": "string" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "detail_url", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "company_domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SecurityScorecardIssuesHistory_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | where tostring(issue_type) != 'breach' | extend TimeGenerated = todatetime(['date']), issue_date = todatetime(['date']), domain = iff(isnotempty(tostring(company_domain)), tostring(company_domain), extract('companies/([^/]+)/', 1, tostring(detail_url))), industry = tostring(industry) | project TimeGenerated, id, issue_date, event_type, group_status, issue_count, total_score_impact, issue_type, severity, factor, detail_url, domain, industry, portfolio_id, portfolio_name", + "outputStream": "Custom-SecurityScorecardIssuesHistory_CL" + } + ] + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DataConnectorDefinition.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DataConnectorDefinition.json new file mode 100644 index 00000000000..1e87a187cfd --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DataConnectorDefinition.json @@ -0,0 +1,169 @@ +{ + "name": "SecurityScorecardIssueCCPDefinition", + "apiVersion": "2025-07-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardIssueCCPDefinition", + "title": "SecurityScorecard Issues (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Issues (Codeless) connector ingests issue history events from the companies in a SecurityScorecard portfolio into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per portfolio you want to monitor — each connection is managed independently in the grid below. Replaces the Function App connector.", + "graphQueriesTableName": "SecurityScorecardIssuesHistory_CL", + "graphQueries": [ + { + "metricName": "Total Issue data received", + "legend": "SecurityScorecard issues", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "All SecurityScorecard issues", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required. See [SecurityScorecard docs](https://securityscorecard.readme.io/) for how to provision a bot user token." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator in SecurityScorecard, navigate to My Settings then Users, create a bot user with Read Only permission, and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the issue-history events for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's issue events (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_PollingConfig.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_PollingConfig.json new file mode 100644 index 00000000000..1669dbebb73 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_PollingConfig.json @@ -0,0 +1,148 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardIssues', uniqueString(parameters('PortfolioId')))]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardIssueCCPDefinition", + "dataType": "SecurityScorecardIssuesHistory_CL", + "addOnAttributes": { + "portfolio_id": "[[parameters('PortfolioId')]", + "portfolio_name": "[[parameters('PortfolioName')]", + "company_domain": "$company_domain$", + "industry": "$company_industry$" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardIssuesHistory_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/portfolios/', parameters('PortfolioId'), '/companies')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "issueDetails", + "stepPlaceholdersParsingKql": "source | extend res = parse_json(data) | project company_domain = tostring(res['domain']), company_industry = tostring(res['industry'])" + } + ] + }, + "stepCollectorConfigs": { + "issueDetails": { + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/$company_domain$/history/events')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "date_from": "{_QueryWindowStartTime}", + "date_to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardIssuesOwn', uniqueString(parameters('Domain')))]", + "location": "{{location}}", + "kind": "RestApiPoller", + "condition": "[[and(not(empty(parameters('Domain'))), not(equals(parameters('Domain'), 'Domain')))]", + "properties": { + "connectorDefinitionName": "SecurityScorecardIssueCCPDefinition", + "dataType": "SecurityScorecardIssuesHistory_CL", + "addOnAttributes": { + "portfolio_id": "NA", + "portfolio_name": "My Scorecard", + "company_domain": "[[parameters('Domain')]", + "industry": "NA" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardIssuesHistory_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/', parameters('Domain'), '/history/events')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "date_from": "{_QueryWindowStartTime}", + "date_to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } +] diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_tables.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_tables.json new file mode 100644 index 00000000000..e8a1a7af35e --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_tables.json @@ -0,0 +1,73 @@ +{ + "name": "SecurityScorecardIssuesHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "{{location}}", + "properties": { + "schema": { + "name": "SecurityScorecardIssuesHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "id", + "type": "long" + }, + { + "name": "issue_date", + "type": "datetime" + }, + { + "name": "event_type", + "type": "string" + }, + { + "name": "group_status", + "type": "string" + }, + { + "name": "issue_count", + "type": "long" + }, + { + "name": "total_score_impact", + "type": "real" + }, + { + "name": "issue_type", + "type": "string" + }, + { + "name": "severity", + "type": "string" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "detail_url", + "type": "string" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings/SecurityScorecardRatings_API_FunctionApp.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings/SecurityScorecardRatings_API_FunctionApp.json index 6e06281635a..d0ab5370295 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings/SecurityScorecardRatings_API_FunctionApp.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings/SecurityScorecardRatings_API_FunctionApp.json @@ -1,8 +1,8 @@ { "id": "SecurityScorecardRatingsAzureFunctions", - "title": "SecurityScorecard Cybersecurity Ratings", + "title": "[DEPRECATED] SecurityScorecard Cybersecurity Ratings", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) data connector provides the ability for Sentinel to import SecurityScorecard ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when scores change or drop. SecurityScorecard ratings are updated daily based on evidence collected across the web.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Ratings (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) data connector provides the ability for Microsoft Sentinel to import SecurityScorecard ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when scores change or drop. SecurityScorecard ratings are updated daily based on evidence collected across the web.", "graphQueries": [ { "metricName": "Total Ratings data received", @@ -32,7 +32,7 @@ ], "availability": { "status": 1, - "isPreview": true + "isPreview": false }, "permissions": { "resourceProvider": [ diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DCR.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DCR.json new file mode 100644 index 00000000000..70871ef8740 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DCR.json @@ -0,0 +1,59 @@ +{ + "name": "SecurityScorecardRatingsDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-SecurityScorecardRatingsHistory_CL": { + "columns": [ + { + "name": "date", + "type": "datetime" + }, + { + "name": "score", + "type": "long" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SecurityScorecardRatingsHistory_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend TimeGenerated = todatetime(['date']), score_date = todatetime(['date']), domain = tostring(domain), industry = tostring(industry) | project TimeGenerated, score_date, score, domain, industry, portfolio_id, portfolio_name", + "outputStream": "Custom-SecurityScorecardRatingsHistory_CL" + } + ] + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DataConnectorDefinition.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DataConnectorDefinition.json new file mode 100644 index 00000000000..4a41bcec0eb --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DataConnectorDefinition.json @@ -0,0 +1,173 @@ +{ + "name": "SecurityScorecardRatingsCCPDefinition", + "apiVersion": "2025-07-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardRatingsCCPDefinition", + "title": "SecurityScorecard Ratings (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Ratings (Codeless) connector ingests overall company score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw daily score rows land in `SecurityScorecardRatingsHistory_CL`; query via the `SecurityScorecardRatings` parser for day-over-day deltas matching the legacy Function App schema.", + "graphQueriesTableName": "SecurityScorecardRatingsHistory_CL", + "graphQueries": [ + { + "metricName": "Total Ratings history rows received", + "legend": "SecurityScorecard ratings history", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Day-over-day rating change (parser)", + "query": "SecurityScorecardRatings\n | sort by TimeGenerated desc" + }, + { + "description": "Raw ratings history", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator in SecurityScorecard, navigate to My Settings then Users, create a bot user with Read Only permission, and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the overall company scores for a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's scorecard (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_PollingConfig.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_PollingConfig.json new file mode 100644 index 00000000000..6203d924657 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_PollingConfig.json @@ -0,0 +1,146 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardRatings', uniqueString(parameters('PortfolioId')))]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardRatingsCCPDefinition", + "dataType": "SecurityScorecardRatingsHistory_CL", + "addOnAttributes": { + "portfolio_id": "[[parameters('PortfolioId')]", + "portfolio_name": "[[parameters('PortfolioName')]", + "domain": "$company_domain$", + "industry": "$company_industry$" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardRatingsHistory_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/portfolios/', parameters('PortfolioId'), '/companies')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "ratingsHistory", + "stepPlaceholdersParsingKql": "source | extend res = parse_json(data) | project company_domain = tostring(res['domain']), company_industry = tostring(res['industry'])" + } + ] + }, + "stepCollectorConfigs": { + "ratingsHistory": { + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/$company_domain$/history/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2024-09-01", + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardRatingsOwn', uniqueString(parameters('Domain')))]", + "location": "{{location}}", + "kind": "RestApiPoller", + "condition": "[[and(not(empty(parameters('Domain'))), not(equals(parameters('Domain'), 'Domain')))]", + "properties": { + "connectorDefinitionName": "SecurityScorecardRatingsCCPDefinition", + "dataType": "SecurityScorecardRatingsHistory_CL", + "addOnAttributes": { + "portfolio_id": "NA", + "portfolio_name": "My Scorecard", + "domain": "[[parameters('Domain')]", + "industry": "NA" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardRatingsHistory_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/', parameters('Domain'), '/history/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } +] diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_tables.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_tables.json new file mode 100644 index 00000000000..f3430c85ac0 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_tables.json @@ -0,0 +1,41 @@ +{ + "name": "SecurityScorecardRatingsHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "{{location}}", + "properties": { + "schema": { + "name": "SecurityScorecardRatingsHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "score_date", + "type": "datetime" + }, + { + "name": "score", + "type": "long" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Data/Solution_SecurityScorecard.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Data/Solution_SecurityScorecard.json index dcabd081f9e..e407239357c 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Data/Solution_SecurityScorecard.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Data/Solution_SecurityScorecard.json @@ -1,19 +1,27 @@ { - "Name": "SecurityScorecard Cybersecurity Ratings", - "Author": "SecurityScorecard - integrations@securityscorecard.io", - "Logo": "", - "Description": "This package includes three data connectors and an associated workbook for the SecurityScorecard offering within Microsoft Sentinel. These connectors are able to import 11 company scores from SecurityScorecard (overall score and 10 factor scores) as well as new issue events.", - "Workbooks": [ - "Workbooks/SecurityScorecardWorkbook.json" - ], - "Data Connectors": [ - "Data Connectors/SecurityScorecardRatings/SecurityScorecardRatings_API_FunctionApp.json", - "Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json", - "Data Connectors/SecurityScorecardIssue/SecurityScorecardIssue_API_FunctionApp.json" - ], - "BasePath": "C:\\Azure-Sentinel\\Solutions\\SecurityScorecard Cybersecurity Ratings", - "Version": "2.0.0", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false -} \ No newline at end of file + "Name": "SecurityScorecard Cybersecurity Ratings", + "Author": "SecurityScorecard - integrations@securityscorecard.io", + "Logo": "", + "Description": "This package includes three Codeless Connector Framework (CCF) data connectors, three KQL parsers, and an associated workbook for the SecurityScorecard offering within Microsoft Sentinel. The CCF connectors ingest 11 company scores from SecurityScorecard (overall score and 10 factor scores) as well as new issue events without requiring an Azure Function deployment. The legacy Function App connectors are retained but marked Deprecated.", + "Workbooks": [ + "Workbooks/SecurityScorecardWorkbook.json" + ], + "Data Connectors": [ + "Data Connectors/SecurityScorecardRatings/SecurityScorecardRatings_API_FunctionApp.json", + "Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json", + "Data Connectors/SecurityScorecardIssue/SecurityScorecardIssue_API_FunctionApp.json", + "Data Connectors/SecurityScorecardIssue_ccp/SecurityScorecardIssue_DataConnectorDefinition.json", + "Data Connectors/SecurityScorecardRatings_ccp/SecurityScorecardRatings_DataConnectorDefinition.json", + "Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DataConnectorDefinition.json" + ], + "Parsers": [ + "Parsers/SecurityScorecardIssue.yaml", + "Parsers/SecurityScorecardRatings.yaml", + "Parsers/SecurityScorecardFactor.yaml" + ], + "BasePath": "C:\\Azure-Sentinel\\Solutions\\SecurityScorecard Cybersecurity Ratings", + "Version": "3.0.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Package/3.0.0.zip b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/3.0.0.zip new file mode 100644 index 00000000000..40f6f3aae81 Binary files /dev/null and b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/3.0.0.zip differ diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Package/createUiDefinition.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/createUiDefinition.json index fb4e8cec536..b48398ddee1 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Package/createUiDefinition.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** _There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing._\n\nThis package includes three data connectors and an associated workbook for the SecurityScorecard offering within Microsoft Sentinel. These connectors are able to import 11 company scores from SecurityScorecard (overall score and 10 factor scores) as well as new issue events.\n\n**Data Connectors:** 3, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/SecurityScorecard%20Cybersecurity%20Ratings/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThis package includes three Codeless Connector Framework (CCF) data connectors, three KQL parsers, and an associated workbook for the SecurityScorecard offering within Microsoft Sentinel. The CCF connectors ingest 11 company scores from SecurityScorecard (overall score and 10 factor scores) as well as new issue events without requiring an Azure Function deployment. The legacy Function App connectors are retained but marked Deprecated.\n\n**Data Connectors:** 6, **Parsers:** 3, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,25 +60,66 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for SecurityScorecard Cybersecurity Ratings. You can get SecurityScorecard Cybersecurity Ratings custom log data in your Microsoft Sentinel workspace. Configure and enable this data connector in the Data Connector gallery after this Solution deploys. This data connector creates custom log table(s) SecurityScorecardRatings_CL in your Microsoft Sentinel / Azure Log Analytics workspace." + "text": "This Solution installs the data connector for SecurityScorecard Cybersecurity Ratings. You can get SecurityScorecard Cybersecurity Ratings custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for SecurityScorecard Cybersecurity Ratings. You can get SecurityScorecard Cybersecurity Ratings custom log data in your Microsoft Sentinel workspace. Configure and enable this data connector in the Data Connector gallery after this Solution deploys. This data connector creates custom log table(s) SecurityScorecardFactor_CL in your Microsoft Sentinel / Azure Log Analytics workspace." + "text": "This Solution installs the data connector for SecurityScorecard Cybersecurity Ratings. You can get SecurityScorecard Cybersecurity Ratings custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for SecurityScorecard Cybersecurity Ratings. You can get SecurityScorecard Cybersecurity Ratings custom log data in your Microsoft Sentinel workspace. Configure and enable this data connector in the Data Connector gallery after this Solution deploys. This data connector creates custom log table(s) SecurityScorecardIssues_CL in your Microsoft Sentinel / Azure Log Analytics workspace." + "text": "This Solution installs the data connector for SecurityScorecard Cybersecurity Ratings. You can get SecurityScorecard Cybersecurity Ratings custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "dataconnectors-link2", + "name": "dataconnectors4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for SecurityScorecard Issues (Codeless). You can get SecurityScorecard Issues (Codeless) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link4", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + }, + { + "name": "dataconnectors5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for SecurityScorecard Ratings (Codeless). You can get SecurityScorecard Ratings (Codeless) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link5", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + }, + { + "name": "dataconnectors6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for SecurityScorecard Factors (Codeless). You can get SecurityScorecard Factors (Codeless) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link6", "type": "Microsoft.Common.TextBlock", "options": { "link": { @@ -102,7 +143,7 @@ "name": "workbooks-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Microsoft Sentinel Solution installs workbooks. Workbooks provide a flexible canvas for data monitoring, analysis, and the creation of rich visual reports within the Azure portal. They allow you to tap into one or many data sources from Microsoft Sentinel and combine them into unified interactive experiences." + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." } }, { @@ -114,6 +155,20 @@ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" } } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "SecurityScorecard", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Workbook provides immediate insight into the data coming from SecurityScorecard's data connectors within Microsoft Sentinel: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues." + } + } + ] } ] } diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Package/mainTemplate.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/mainTemplate.json index c31c9d34a9a..87941ca7d3c 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Package/mainTemplate.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/mainTemplate.json @@ -35,73 +35,114 @@ "metadata": { "description": "Name for the workbook" } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } }, "variables": { - "solutionId": "SecurityScorecard.SecurityScorecard", - "_solutionId": "[variables('solutionId')]", "email": "integrations@securityscorecard.io", "_email": "[variables('email')]", + "_solutionName": "SecurityScorecard Cybersecurity Ratings", + "_solutionVersion": "3.0.0", + "solutionId": "securityscorecard.securityscorecard", + "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", "workbookContentId1": "SecurityScorecardWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1')))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "uiConfigId1": "SecurityScorecardRatingsAzureFunctions", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "SecurityScorecardRatingsAzureFunctions", "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", "_dataConnectorId1": "[variables('dataConnectorId1')]", - "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1')))]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", "uiConfigId2": "SecurityScorecardFactorAzureFunctions", "_uiConfigId2": "[variables('uiConfigId2')]", "dataConnectorContentId2": "SecurityScorecardFactorAzureFunctions", "_dataConnectorContentId2": "[variables('dataConnectorContentId2')]", "dataConnectorId2": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", "_dataConnectorId2": "[variables('dataConnectorId2')]", - "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2')))]", + "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", + "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", "uiConfigId3": "SecurityScorecardIssueAzureFunctions", "_uiConfigId3": "[variables('uiConfigId3')]", "dataConnectorContentId3": "SecurityScorecardIssueAzureFunctions", "_dataConnectorContentId3": "[variables('dataConnectorContentId3')]", "dataConnectorId3": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", "_dataConnectorId3": "[variables('dataConnectorId3')]", - "dataConnectorTemplateSpecName3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId3')))]", - "dataConnectorVersion3": "1.0.0" + "dataConnectorTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId3'))))]", + "dataConnectorVersion3": "1.0.0", + "_dataConnectorcontentProductId3": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId3'),'-', variables('dataConnectorVersion3'))))]", + "dataConnectorCCPVersion": "3.0.0", + "_dataConnectorContentIdConnectorDefinition4": "SecurityScorecardIssueCCPDefinition", + "dataConnectorTemplateNameConnectorDefinition4": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition4')))]", + "_dataConnectorContentIdConnections4": "SecurityScorecardIssueCCPDefinitionConnections", + "dataConnectorTemplateNameConnections4": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections4')))]", + "dataCollectionEndpointId4": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", + "_dataConnectorContentIdConnectorDefinition5": "SecurityScorecardRatingsCCPDefinition", + "dataConnectorTemplateNameConnectorDefinition5": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition5')))]", + "_dataConnectorContentIdConnections5": "SecurityScorecardRatingsCCPDefinitionConnections", + "dataConnectorTemplateNameConnections5": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections5')))]", + "dataCollectionEndpointId5": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "_dataConnectorContentIdConnectorDefinition6": "SecurityScorecardFactorCCPDefinition", + "dataConnectorTemplateNameConnectorDefinition6": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition6')))]", + "_dataConnectorContentIdConnections6": "SecurityScorecardFactorCCPDefinitionConnections", + "dataConnectorTemplateNameConnections6": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections6')))]", + "dataCollectionEndpointId6": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','SecurityScorecardIssue')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardIssue')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('SecurityScorecardIssue-Parser')))]", + "parserVersion1": "2.0.3", + "parserContentId1": "SecurityScorecardIssue-Parser" + }, + "parserObject2": { + "_parserName2": "[concat(parameters('workspace'),'/','SecurityScorecardRatings')]", + "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardRatings')]", + "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('SecurityScorecardRatings-Parser')))]", + "parserVersion2": "2.0.3", + "parserContentId2": "SecurityScorecardRatings-Parser" + }, + "parserObject3": { + "_parserName3": "[concat(parameters('workspace'),'/','SecurityScorecardFactor')]", + "_parserId3": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardFactor')]", + "parserTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('SecurityScorecardFactor-Parser')))]", + "parserVersion3": "2.0.3", + "parserContentId3": "SecurityScorecardFactor-Parser" + }, + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, - "properties": { - "description": "SecurityScorecard Cybersecurity Ratings Workbook with template", - "displayName": "SecurityScorecard Cybersecurity Ratings workbook template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('workbookTemplateSpecName1'),'/',variables('workbookVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "Workbook" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('workbookTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SecurityScorecardWorkbookWorkbook Workbook with template version 2.0.0", + "description": "SecurityScorecardWorkbook Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -115,11 +156,11 @@ "kind": "shared", "apiVersion": "2021-08-01", "metadata": { - "description": "This Workbook provides immediate insight into the data coming from SecurityScorecard’s three Sentinel data connectors: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues." + "description": "This Workbook provides immediate insight into the data coming from SecurityScorecard's data connectors within Microsoft Sentinel: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues." }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"06ba5a8f-fe93-4285-9bb4-15fd5c96befe\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"My Scorecard\",\"subTarget\":\"My Scorecard\",\"style\":\"link\"},{\"id\":\"ce6e0294-f130-4450-9005-8aa9924e6b86\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Vendor Scores\",\"subTarget\":\"Vendor Scores\",\"style\":\"link\"},{\"id\":\"26959e65-a53f-4468-8d14-d0b43d1b899d\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Active Issues\",\"subTarget\":\"Active Issues\",\"style\":\"link\"},{\"id\":\"97757d2a-eba1-4ee9-909b-47e9653e1407\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Issues per Vendor (CVE)\",\"subTarget\":\"Issues per Vendor (CVE)\",\"style\":\"link\"},{\"id\":\"73e85106-4dde-4c92-8479-c8720d8604de\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Issues per Vendor (Ransomware)\",\"subTarget\":\"Issues per Vendor (Ransomware)\",\"style\":\"link\"},{\"id\":\"c915da0c-4bfc-4595-8e1a-700a602f3412\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Spotlight\",\"subTarget\":\"Spotlight\",\"style\":\"link\"}]},\"name\":\"Tabs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# My Scorecard\",\"style\":\"{setTab}\"},\"name\":\"text - 1\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"309cabc5-5a32-4c1a-b905-cb578ee0e667\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ac778abc-2101-4e66-92da-d11d4b4a8629\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Domain\",\"type\":1,\"description\":\"Provide your company name\",\"isRequired\":true,\"query\":\"SecurityScorecardRatings_CL\\r\\n| where portfolioName_s == \\\"NA\\\"\\r\\n| distinct subject_s\\r\\n| limit 1\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"cisco.com\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 9\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where body_s == 'OverAll' and subject_s == '{Domain}'\\r\\n| summarize arg_max(ingestion_time(),*)\\r\\n| extend gradeToday = case((scoreToday_d>=90), \\\"A\\\",(scoreToday_d>=80 and scoreToday_d<=89), \\\"B\\\",(scoreToday_d>=70 and scoreToday_d<=79), \\\"C\\\",(scoreToday_d>=60 and scoreToday_d<=69), \\\"D\\\",isempty(scoreToday_d),\\\"\\\",\\\"F\\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \\r\\n| project gradeToday, scoreToday_d, Details\",\"size\":4,\"showAnalytics\":true,\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"gradeToday\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"Top Level Grade\"}]}},\"leftContent\":{\"columnMatch\":\"gradeToday\",\"formatter\":18,\"formatOptions\":{\"linkColumn\":\"Details\",\"linkTarget\":\"Url\",\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"25\",\"name\":\"Top Level Grade\",\"styleSettings\":{\"maxWidth\":\"100\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where body_s == 'OverAll' and subject_s == '{Domain}'\\r\\n| summarize arg_max(ingestion_time(), *) by subject_s \\r\\n| extend Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \\r\\n| project scoreToday_d, subject_s, Details\\r\\n| limit 1\",\"size\":4,\"showAnalytics\":true,\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"scoreToday_d\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"Top Level Score\"}]}},\"leftContent\":{\"columnMatch\":\"scoreToday_d\",\"formatter\":18,\"formatOptions\":{\"linkColumn\":\"Details\",\"linkTarget\":\"Url\",\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"25\",\"name\":\"Top Level Score\",\"styleSettings\":{\"maxWidth\":\"100\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where body_s == 'OverAll'and subject_s == '{Domain}'\\r\\n| project-rename Date = dateToday_s , Score = scoreToday_d \\r\\n| summarize arg_max(ingestion_time(), *) by Date \\r\\n| project Date=format_datetime(todatetime(Date), 'yyyy-MM-dd'), Score\\r\\n| sort by Date asc\\r\\n| limit 10\",\"size\":0,\"showAnalytics\":true,\"title\":\"Score Trend\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showMetrics\":false,\"customThresholdLine\":\"{Score}\",\"customThresholdLineStyle\":4,\"showDataPoints\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}},\"max\":100}}},\"customWidth\":\"50\",\"name\":\"Score Trend\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardFactor_CL\\r\\n| where body_s == 'Factor' and subject_s == '{Domain}'\\r\\n| summarize arg_max(ingestion_time(),*) by dateToday_s, factorDescription_s\\r\\n| summarize arg_max(dateToday_s,*) by factorDescription_s\\r\\n| extend gradeToday=case((scoreToday_d >= 90),\\\"A\\\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\\\"B\\\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\\\"C\\\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\\\"D\\\",\\\"F\\\"), gradeYesterday=case((scoreYesterday_d >= 90),\\\"A\\\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\\\"B\\\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\\\"C\\\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\\\"D\\\",\\\"F\\\") \\r\\n| project Factor_Name_s, factorDescription_s, gradeToday, scoreToday_d, scoreChange_d, gradeYesterday, scoreYesterday_d, dateToday_s \\r\\n| project-rename Description =factorDescription_s, [\\\"Current Grade\\\"] = gradeToday, [\\\"Current Score\\\"] = scoreToday_d, [\\\"Latest Score Change\\\"] = scoreChange_d, [\\\"Last Updated Grade\\\"] = gradeYesterday, [\\\"Last Updated Score\\\"] = scoreYesterday_d, [\\\"Date of Current Score\\\"] = dateToday_s, Factor = Factor_Name_s \",\"size\":0,\"showAnalytics\":true,\"title\":\"My Scorecard Factors\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Current Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Current Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Last Updated Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Last Updated Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Date of Current Score\",\"formatter\":6}],\"sortBy\":[{\"itemKey\":\"Factor\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Factor\",\"sortOrder\":1}]},\"name\":\"My Scorecard Factors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where subject_s == '{Domain}'\\r\\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| extend Factor=strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\") \\r\\n| summarize [\\\"Issue Count\\\"]= count() by Factor \",\"size\":0,\"showAnalytics\":true,\"title\":\"Issue Count by Factor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"name\":\"Issue Types by Factor\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where subject_s == '{Domain}'\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| extend issue_name=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), serverity_priority = case(severity_value_s == \\\"high\\\",1,severity_value_s == \\\"medium\\\",2,severity_value_s == \\\"low\\\",3,severity_value_s == \\\"info\\\",4,5)\\r\\n| summarize count() by severity_value_s, serverity_priority\\r\\n| sort by serverity_priority asc\\r\\n| project-away serverity_priority\\r\\n| render barchart\\r\\n\",\"size\":0,\"title\":\"Issue Types by Severity\",\"timeContextFromParameter\":\"Timer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"severity_value_s\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"adware installation\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"high\",\"label\":\"High\"},{\"seriesName\":\"medium\",\"label\":\"Medium\"},{\"seriesName\":\"low\",\"label\":\"Low\"},{\"seriesName\":\"info\",\"label\":\"Info\"},{\"seriesName\":\"positive\",\"label\":\"Positive\"}],\"customThresholdLine\":\"{issue_name}\",\"customThresholdLineStyle\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"adware installation\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"adware installation\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"adware installation\",\"heatmapPalette\":\"greenRed\"}}},\"name\":\"Issue Types by Severity\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"My Scorecard\"},\"name\":\"My Scorecard\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Vendor Scores\",\"style\":\"{setTab}\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8ebc23fe-ade3-4318-8635-24bb841f718b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"72d22203-f3dd-4557-9605-5b6ca4a4e6c0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Domain\",\"type\":1,\"description\":\"Provide your company name\",\"isRequired\":true,\"query\":\"SecurityScorecardRatings_CL\\r\\n| where portfolioName_s == \\\"NA\\\"\\r\\n| distinct subject_s\\r\\n| limit 1\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"value\":\"cisco.com\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 13\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"624e2391-ad46-416c-9af4-f735c1114b84\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where isnotempty(portfolioId_g)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"91c18b81-401d-4b6a-a9ba-e6780c6fee61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c603e74f-d591-4788-b95b-1370a2b98024\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where body_s == \\\"OverAll\\\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and subject_s != '{Domain}'\\r\\n| summarize arg_max(ingestion_time(), *) by dateToday_s, subject_s, portfolioName_s\\r\\n| summarize arg_max(dateToday_s, *) by subject_s, portfolioName_s \\r\\n| extend [\\\"Current Grade\\\"]=case((scoreToday_d >= 90),\\\"A\\\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\\\"B\\\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\\\"C\\\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\\\"D\\\",\\\"F\\\"), [\\\"Last Updated Grade\\\"]=case((scoreYesterday_d >= 90),\\\"A\\\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\\\"B\\\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\\\"C\\\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\\\"D\\\",\\\"F\\\"), Industry=strcat_array(split(industry_s,\\\"_\\\"),\\\" \\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors')\\r\\n| project subject_s, portfolioName_s, Industry, [\\\"Date of Current Score\\\"] = format_datetime(todatetime(dateToday_s), 'yyyy-MM-dd'), scoreToday_d, [\\\"Current Grade\\\"], scoreYesterday_d, ['Last Updated Grade'], Details \\r\\n| project-rename Company = subject_s , [\\\"Current Score\\\"] = scoreToday_d, [\\\"Last Updated Score\\\"] = scoreYesterday_d \\r\\n| sort by Company asc, portfolioName_s asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Level Grade and Score by Company\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Current Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Current Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Last Updated Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Last Updated Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\",\"linkIsContextBlade\":false}}],\"rowLimit\":10000,\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Current Score_3\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Current Score_3\",\"sortOrder\":1}]},\"name\":\"Top Level Grade and Score by Company\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a38a4cff-47df-431d-a31e-e5a7b9739786\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Factor\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardFactor_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct Factor_Name_s\\r\\n| sort by Factor_Name_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0fe3d2b0-fcbd-4c3f-80e6-29e39f047743\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Grade\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"A\\\", \\\"label\\\":\\\"A\\\"},\\r\\n { \\\"value\\\":\\\"B\\\", \\\"label\\\":\\\"B\\\"},\\r\\n { \\\"value\\\":\\\"C\\\", \\\"label\\\":\\\"C\\\"},\\r\\n { \\\"value\\\":\\\"D\\\", \\\"label\\\":\\\"D\\\" },\\r\\n { \\\"value\\\":\\\"F\\\", \\\"label\\\":\\\"F\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardFactor_CL\\r\\n| where body_s == \\\"Factor\\\" and subject_s != '{Domain}' and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| summarize arg_max(ingestion_time(), *) by dateToday_s, subject_s, Factor_Name_s, portfolioName_s\\r\\n| summarize arg_max(dateToday_s, *) by subject_s, Factor_Name_s, portfolioName_s\\r\\n| extend [\\\"Current Grade\\\"] = case(scoreToday_d>=90, \\\"A\\\", scoreToday_d>=80 and scoreToday_d<=89, \\\"B\\\", scoreToday_d>=70 and scoreToday_d<=79, \\\"C\\\", scoreToday_d>=60 and scoreToday_d<=69, \\\"D\\\", \\\"F\\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors') \\r\\n| where ('*' in ({Factor}) or Factor_Name_s in ({Factor})) and [\\\"Current Grade\\\"] in ({Grade})\\r\\n| project subject_s, portfolioName_s, Factor_Name_s, factorDescription_s , scoreToday_d, [\\\"Current Grade\\\"], Details \\r\\n| project-rename Company = subject_s, Factor = Factor_Name_s, Description = factorDescription_s, [\\\"Current Score\\\"] = scoreToday_d\\r\\n| sort by Factor asc, Company asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Level Grade and Score by Factor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Current Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Current Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}}],\"rowLimit\":10000}},\"name\":\"Top Level Grade and Score by Factor\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f952c797-c056-446e-8ce1-4495673c337d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"IssueType\",\"label\":\"Issue Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| extend issue_type = strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\") \\r\\n| distinct issue_type\\r\\n| sort by issue_type asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 9\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"73302a85-fb1b-43cf-8c7f-dfbebd6eb167\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"low\\\", \\\"label\\\":\\\"Low\\\" },\\r\\n { \\\"value\\\":\\\"medium\\\", \\\"label\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"high\\\", \\\"label\\\":\\\"high\\\" },\\r\\n { \\\"value\\\":\\\"positive\\\", \\\"label\\\":\\\"Positive\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == 'Issue' and groupStatus_s == 'active' and subject_s != '{Domain}' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and severity_value_s in ({Severity})\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Findings Count\\\"] = sum(findingsCount_d), [\\\"Issue Count\\\"] = count(issueName_s), src = arg_max(date_s,Factor_s) by issueType_s, subject_s, severity_value_s\\r\\n| extend [\\\"Issue Type\\\"]=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\") , Severity=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\\r\\n| where ('*' in ({IssueType}) or [\\\"Issue Type\\\"] in ({IssueType})) \\r\\n| project subject_s, Severity, [\\\"Issue Type\\\"], [\\\"Findings Count\\\"], [\\\"Issue Count\\\"], Details \\r\\n| order by [\\\"Issue Type\\\"] asc, subject_s asc\\r\\n| project-rename Company=subject_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issues per Vendor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}}],\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"Issue Type\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Issue Type\",\"sortOrder\":1}]},\"name\":\"Issues per Vendor\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Vendor Scores\"},\"name\":\"Vendor Scores\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Active Issues\",\"style\":\"{setTab}\"},\"name\":\"Active Issues\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6239b6b6-1b0c-4d82-9599-bcb3155a8869\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"99a0579a-77d5-4693-a099-c1b7dd688c0d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where isnotempty(portfolioId_g)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e6981875-d72c-486f-baea-52e1e762143f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"95c35610-dd13-45f0-bdf4-dae3008215a7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Factor\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| extend factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\")\\r\\n| distinct value=Factor_s, lable=factor\\r\\n| sort by lable asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Factor\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"34f6058c-86eb-45e1-8684-ad1db584019a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bd48be36-fe76-4b7d-be98-fc3ac56f6759\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"low\\\", \\\"label\\\":\\\"Low\\\" },\\r\\n { \\\"value\\\":\\\"medium\\\", \\\"label\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"high\\\", \\\"label\\\":\\\"high\\\" },\\r\\n { \\\"value\\\":\\\"positive\\\", \\\"label\\\":\\\"Positive\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"Active Issues will only encompass those that have appeared since the feed was turned on.\",\"style\":\"info\"},\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and ('*' in ({Severity}) or severity_value_s in ({Severity}))\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize arg_max(date_s,*), src = arg_max(date_s,Factor_s),[\\\"Findings Count\\\"] = sum(findingsCount_d), Active = sumif(findingsCount_d, groupStatus_s == \\\"active\\\"), Resolved = sumif(findingsCount_d, groupStatus_s == \\\"resolved\\\") by issueType_s\\r\\n| join kind=leftouter (SecurityScorecardFactor_CL \\r\\n | distinct Factor_s,factorDescription_s\\r\\n | project Factor_s, factorDescription_s) on Factor_s\\r\\n| extend severity_index=case((severity_value_s == \\\"high\\\"),1,(severity_value_s == \\\"medium\\\"),2,(severity_value_s == \\\"low\\\"),3,(severity_value_s == \\\"info\\\"),4,5), severity_value_s=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s), Factor=strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\"), [\\\"Issue type\\\"]=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s)\\r\\n| sort by severity_index asc, findingsCount_d desc\\r\\n| project [\\\"Issue type\\\"], Factor, severity_value_s, factorDescription_s, [\\\"Findings Count\\\"], Active, Resolved, Details\\r\\n| project-rename Description = factorDescription_s, Severity = severity_value_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Issues\",\"timeContextFromParameter\":\"Timer\",\"exportParameterName\":\"activeissues\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}},{\"columnMatch\":\"Sevirity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000}},\"name\":\"Active Issues\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == 'Issue' and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\\r\\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Issue Count\\\"] = count(issueType_s) by Factor_s \\r\\n| extend Factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\")\\r\\n| project Factor, [\\\"Issue Count\\\"] \\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issue Types by Factor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"showLegend\":true}},\"name\":\"Issue Types by Factor\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == \\\"Issue\\\" and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize count() by severity_value_s \\r\\n| extend severity_value_s = case((severity_value_s == 'info'), \\\"Info\\\",(severity_value_s == 'low'), \\\"Low\\\",(severity_value_s == 'medium'), \\\"Medium\\\",(severity_value_s == 'high'), \\\"High\\\", (severity_value_s == 'positive'), \\\"Positive\\\", severity_value_s)\\r\\n| render piechart\",\"size\":3,\"showAnalytics\":true,\"title\":\"Count by Severity\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"Count by Severity\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Active Issues\"},\"name\":\"Active Issues\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Issues per Vendor (CVE)\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a30af542-54cd-4a92-ac85-e094c9cc1c43\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a3195f85-f04f-422c-b233-f9bd8a357b8b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CVE\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"service_vuln_host_high\\\", \\\"label\\\":\\\"Service Vuln Host High\\\"},\\r\\n { \\\"value\\\":\\\"service_vuln_host_low\\\", \\\"label\\\":\\\"Service Vuln Host Low\\\" },\\r\\n { \\\"value\\\":\\\"service_vuln_host_medium\\\", \\\"label\\\":\\\"Service Vuln Host Medium\\\"},\\r\\n { \\\"value\\\":\\\"patching_cadence_high\\\", \\\"label\\\":\\\"Patching Cadence High\\\" },\\r\\n { \\\"value\\\":\\\"patching_cadence_low\\\", \\\"label\\\":\\\"Patching Cadence Low\\\"},\\r\\n { \\\"value\\\":\\\"patching_cadence_medium\\\", \\\"label\\\":\\\"Patching Cadence Medium\\\" },\\r\\n { \\\"value\\\":\\\"web_vuln_host_high\\\", \\\"label\\\":\\\"Web Vuln Host High\\\"},\\r\\n { \\\"value\\\":\\\"web_vuln_host_low\\\", \\\"label\\\":\\\"Web Vuln Host Low\\\" },\\r\\n { \\\"value\\\":\\\"web_vuln_host_medium\\\", \\\"label\\\":\\\"Web Vuln Host Medium\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"CVE\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0f2ad534-e343-44c2-a3ff-0d1d2c7916c5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where isnotempty(portfolioId_g)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"55320f6b-3583-440d-977f-33ceffc07d94\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"070f384d-1ff0-49c9-8f3f-f121e78811a2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"Issues per Vendor will only encompass those that have appeared since the feed was turned on.\",\"style\":\"info\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and issueType_s in ({CVE}) and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Findings Count\\\"] = sum(findingsCount_d), [\\\"Issue Count\\\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \\\"active\\\"), Resolved = sumif(findingsCount_d, groupStatus_s == \\\"resolved\\\") by issueType_s, subject_s, severity_value_s\\r\\n| extend CVE=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), severity_priority = case(severity_value_s == \\\"high\\\",1,severity_value_s == \\\"medium\\\",2,severity_value_s == \\\"low\\\",3,severity_value_s == \\\"info\\\",4,5), Severity=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\", severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s), Factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\")\\r\\n| sort by CVE asc, severity_priority asc, subject_s asc\\r\\n| project subject_s, CVE, Factor, Severity, ['Findings Count'], [\\\"Issue Count\\\"], Active, Resolved, Details\\r\\n| project-rename Company = subject_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issues per Vendor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"turquoise\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Issues per Vendor\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Issues per Vendor (CVE)\"},\"name\":\"Issues per Vendor (CVE)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Issues per Vendor (Ransomware)\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c9b54d32-38cd-4b08-8dd6-4be29b019c80\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"168555cd-afbe-457a-81c1-a68663c51823\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Ransomware\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"tls_weal_cipher\\\", \\\"label\\\":\\\"Tls Weal Cipher\\\"},\\r\\n { \\\"value\\\":\\\"exposed_personal_information_info\\\", \\\"label\\\":\\\"Exposed Personal Information Info\\\" },\\r\\n { \\\"value\\\":\\\"outdated_browser\\\", \\\"label\\\":\\\"Outdated Browser\\\"},\\r\\n { \\\"value\\\":\\\"csp_no_policy_v2\\\", \\\"label\\\":\\\"Csp No Policy V2\\\" },\\r\\n { \\\"value\\\":\\\"exposed_personal_information\\\", \\\"label\\\":\\\"Exposed Personal Information\\\"},\\r\\n { \\\"value\\\":\\\"ip_count_means\\\", \\\"label\\\":\\\"Ip Count Means\\\" },\\r\\n { \\\"value\\\":\\\"service_vuln_host_medium\\\", \\\"label\\\":\\\"Service Vuln Host Medium\\\"},\\r\\n { \\\"value\\\":\\\"hsts_incorrect_v2\\\", \\\"label\\\":\\\"Hsts Incorrect V2\\\" },\\r\\n { \\\"value\\\":\\\"unsafe_sri_v2\\\", \\\"label\\\":\\\"Unsafe Sri V2\\\"},\\r\\n { \\\"value\\\":\\\"leaked_credentials\\\", \\\"label\\\":\\\"Leaked Credentials\\\"},\\r\\n { \\\"value\\\":\\\"x_frame_options_incorrect_v2\\\", \\\"label\\\":\\\"X Frame Options Incorrect V2\\\"},\\r\\n { \\\"value\\\":\\\"x_xss_protection_incorrect_v2\\\", \\\"label\\\":\\\"X Xss Protection Incorrect V2\\\"},\\r\\n { \\\"value\\\":\\\"x_content_type_options_incorrect_v2\\\", \\\"label\\\":\\\"X Content Type Options Incorrect V2\\\"},\\r\\n { \\\"value\\\":\\\"tlscert_no_revocation\\\", \\\"label\\\":\\\"Tlscert No Revocation\\\"},\\r\\n { \\\"value\\\":\\\"tlscert_expired\\\", \\\"label\\\":\\\"Tlscert Expired\\\"},\\r\\n { \\\"value\\\":\\\"outdated_os\\\", \\\"label\\\":\\\"Outdated Os\\\"},\\r\\n { \\\"value\\\":\\\"tls_weak_protocol\\\", \\\"label\\\":\\\"Tls Weak Protocol\\\"},\\r\\n { \\\"value\\\":\\\"domain_missing_https_v2\\\", \\\"label\\\":\\\"Domain Missing Https V2\\\"},\\r\\n { \\\"value\\\":\\\"tlscert_excessive_expiration\\\", \\\"label\\\":\\\"Tlscert Excessive Expiration\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":604800000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Ransomware\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7bf4c309-6e2b-4619-9253-e85808486e75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where isnotempty(portfolioId_g)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ee929211-b34e-4369-905b-cb4d87bf6364\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8d9dcdcc-8c93-4b47-a2e1-880ffea2a31e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"Issues per Vendor will only encompass those that have appeared since the feed was turned on.\",\"style\":\"info\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and issueType_s in ({Ransomware})\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Findings Count\\\"] = sum(findingsCount_d),[\\\"Issue Count\\\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \\\"active\\\"), Resolved = sumif(findingsCount_d, groupStatus_s == \\\"resolved\\\") by issueType_s, subject_s, severity_value_s \\r\\n| extend Ransomware=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), Severity=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\\r\\n| project subject_s, Ransomware, Severity, ['Findings Count'], ['Issue Count'], Active, Resolved, Details\\r\\n| project-rename Company = subject_s\\r\\n| sort by Ransomware asc, Company asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issues per Vendor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}},{\"columnMatch\":\"drilldown_url\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"details\"}}],\"rowLimit\":10000}},\"name\":\"Issues per Vendor\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Issues per Vendor (Ransomware)\"},\"name\":\"Issues per Vendor (Ransomware)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Spotlight\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"73978413-5a37-4814-b4fc-4143999f13ec\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"73bc33a2-eb41-4433-9b1d-59930d7ddf3d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where isnotempty(portfolioId_g)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ae9eff1e-6b7b-4d64-9516-30ea5bc5fb17\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d9274665-9d9c-417b-9d3f-03162538cf92\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Factor\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| extend label = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\"),value = Factor_s\\r\\n| distinct value, label\\r\\n| sort by label asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Factor\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"485b4de7-9cd5-4e5e-b2d4-da7f921ff61c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings_CL\\r\\n| where body_s =='OverAll' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| summarize arg_max(dateToday_s,*) by subject_s\\r\\n| extend Grade = case((scoreToday_d >= 90), \\\"A\\\",(scoreToday_d>=80 and scoreToday_d<=89), \\\"B\\\",(scoreToday_d>=70 and scoreToday_d<=79), \\\"C\\\",(scoreToday_d>=60 and scoreToday_d<=69), \\\"D\\\",isempty(scoreToday_d),\\\"\\\",\\\"F\\\") \\r\\n| project Grade, subject_s, scoreToday_d\\r\\n| project-rename Company = subject_s, Score = scoreToday_d\\r\\n| sort by Score asc\\r\\n| limit 10\",\"size\":0,\"showAnalytics\":true,\"title\":\"Worst Performing Companies\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"40\",\"name\":\"Worst Performing Companies\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL\\r\\n| where body_s == 'Issue' and groupStatus_s == \\\"active\\\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\\r\\n| summarize arg_max(date_s,*), [\\\"Company Count\\\"] = dcount(subject_s,4) by issueName_s, severity_value_s, issueType_s, Factor_s\\r\\n| extend serverity_priority = case(severity_value_s == \\\"high\\\",1,severity_value_s == \\\"medium\\\",2,severity_value_s == \\\"low\\\",3,severity_value_s == \\\"info\\\",4,5), severity_value=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s) \\r\\n| extend Issues=trim(@\\\"'\\\",issueName_s), Factor=strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\") \\r\\n| sort by serverity_priority asc, [\\\"Company Count\\\"] desc\\r\\n| project Severity = severity_value, Issues, Factor = Factor, [\\\"Company Count\\\"]\",\"size\":0,\"showAnalytics\":true,\"title\":\"Most Critical Issues\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"60\",\"name\":\"Most Critical Issues\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e316e111-37ee-404b-8feb-920a6147bf30\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"low\\\", \\\"label\\\":\\\"Low\\\" },\\r\\n { \\\"value\\\":\\\"medium\\\", \\\"label\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"high\\\", \\\"label\\\":\\\"high\\\" },\\r\\n { \\\"value\\\":\\\"positive\\\", \\\"label\\\":\\\"Positive\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":86400000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssues_CL \\r\\n| where body_s == \\\"Issue\\\" and groupStatus_s == \\\"active\\\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and severity_value_s in ({Severity})\\r\\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| extend totalcount = toscalar(SecurityScorecardIssues_CL | summarize dcount(subject_s))\\r\\n| summarize subject = dcount(subject_s), totalCount = max(totalcount) by issueName_s, issueType_s, Factor_s\\r\\n| extend [\\\"% of Portfolio Affected\\\"] = round((todouble(subject)/todouble(totalCount))*100,0)\\r\\n| extend Factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\") \\r\\n| project Factor, issueName_s, [\\\"% of Portfolio Affected\\\"]\\r\\n| sort by [\\\"% of Portfolio Affected\\\"] desc\\r\\n| project-rename Issues = issueName_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Most Common Issues\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"% of Portfolio Affected\",\"formatter\":3,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"redDark\"}}]}},\"name\":\"Most Common Issues\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Spotlight\"},\"name\":\"Spotlight\"}]},\"name\":\"Main\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-SecurityScorecardWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"tabs\",\"links\":[{\"id\":\"06ba5a8f-fe93-4285-9bb4-15fd5c96befe\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"My Scorecard\",\"subTarget\":\"My Scorecard\",\"style\":\"link\"},{\"id\":\"ce6e0294-f130-4450-9005-8aa9924e6b86\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Vendor Scores\",\"subTarget\":\"Vendor Scores\",\"style\":\"link\"},{\"id\":\"26959e65-a53f-4468-8d14-d0b43d1b899d\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Active Issues\",\"subTarget\":\"Active Issues\",\"style\":\"link\"},{\"id\":\"97757d2a-eba1-4ee9-909b-47e9653e1407\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Issues per Vendor (CVE)\",\"subTarget\":\"Issues per Vendor (CVE)\",\"style\":\"link\"},{\"id\":\"73e85106-4dde-4c92-8479-c8720d8604de\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Issues per Vendor (Ransomware)\",\"subTarget\":\"Issues per Vendor (Ransomware)\",\"style\":\"link\"},{\"id\":\"c915da0c-4bfc-4595-8e1a-700a602f3412\",\"cellValue\":\"setTab\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Spotlight\",\"subTarget\":\"Spotlight\",\"style\":\"link\"}]},\"name\":\"Tabs\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# My Scorecard\",\"style\":\"{setTab}\"},\"name\":\"text - 1\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"309cabc5-5a32-4c1a-b905-cb578ee0e667\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":2592000000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ac778abc-2101-4e66-92da-d11d4b4a8629\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Domain\",\"type\":2,\"description\":\"Your own company domain (My Scorecard). Vendor pages list everyone except this company.\",\"isRequired\":false,\"query\":\"SecurityScorecardRatings\\r\\n| where portfolioName_s in ('NA', 'My Scorecard')\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 9\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 3\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings\\r\\n| where body_s == 'OverAll' and subject_s == '{Domain}'\\r\\n| summarize arg_max(TimeGenerated,*)\\r\\n| extend gradeToday = case((scoreToday_d>=90), \\\"A\\\",(scoreToday_d>=80 and scoreToday_d<=89), \\\"B\\\",(scoreToday_d>=70 and scoreToday_d<=79), \\\"C\\\",(scoreToday_d>=60 and scoreToday_d<=69), \\\"D\\\",isempty(scoreToday_d),\\\"\\\",\\\"F\\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \\r\\n| project gradeToday, scoreToday_d, Details\",\"size\":4,\"showAnalytics\":true,\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"gradeToday\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"Top Level Grade\"}]}},\"leftContent\":{\"columnMatch\":\"gradeToday\",\"formatter\":18,\"formatOptions\":{\"linkColumn\":\"Details\",\"linkTarget\":\"Url\",\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"25\",\"name\":\"Top Level Grade\",\"styleSettings\":{\"maxWidth\":\"100\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings\\r\\n| where body_s == 'OverAll' and subject_s == '{Domain}'\\r\\n| summarize arg_max(TimeGenerated, *) by subject_s \\r\\n| extend Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \\r\\n| project scoreToday_d, subject_s, Details\\r\\n| limit 1\",\"size\":4,\"showAnalytics\":true,\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"scoreToday_d\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"Default\",\"representation\":\"lightBlue\",\"text\":\"Top Level Score\"}]}},\"leftContent\":{\"columnMatch\":\"scoreToday_d\",\"formatter\":18,\"formatOptions\":{\"linkColumn\":\"Details\",\"linkTarget\":\"Url\",\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]},\"numberFormat\":{\"unit\":17,\"options\":{\"style\":\"decimal\",\"maximumFractionDigits\":2,\"maximumSignificantDigits\":3}}},\"showBorder\":true,\"size\":\"full\"}},\"customWidth\":\"25\",\"name\":\"Top Level Score\",\"styleSettings\":{\"maxWidth\":\"100\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings\\r\\n| where body_s == 'OverAll'and subject_s == '{Domain}'\\r\\n| project-rename Date = dateToday_s , Score = scoreToday_d \\r\\n| summarize arg_max(TimeGenerated, *) by Date \\r\\n| project Date=format_datetime(todatetime(Date), 'yyyy-MM-dd'), Score\\r\\n| sort by Date asc\\r\\n| limit 10\",\"size\":0,\"showAnalytics\":true,\"title\":\"Score Trend\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showMetrics\":false,\"customThresholdLine\":\"{Score}\",\"customThresholdLineStyle\":4,\"showDataPoints\":true,\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true}},\"max\":100}}},\"customWidth\":\"50\",\"name\":\"Score Trend\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardFactor\\r\\n| where body_s == 'Factor' and subject_s == '{Domain}'\\r\\n| summarize arg_max(TimeGenerated,*) by dateToday_s, factorDescription_s\\r\\n| summarize arg_max(dateToday_s,*) by factorDescription_s\\r\\n| extend gradeToday=case((scoreToday_d >= 90),\\\"A\\\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\\\"B\\\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\\\"C\\\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\\\"D\\\",\\\"F\\\"), gradeYesterday=case((scoreYesterday_d >= 90),\\\"A\\\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\\\"B\\\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\\\"C\\\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\\\"D\\\",\\\"F\\\") \\r\\n| project Factor_Name_s, factorDescription_s, gradeToday, scoreToday_d, scoreChange_d, gradeYesterday, scoreYesterday_d, dateToday_s \\r\\n| project-rename Description =factorDescription_s, [\\\"Current Grade\\\"] = gradeToday, [\\\"Current Score\\\"] = scoreToday_d, [\\\"Latest Score Change\\\"] = scoreChange_d, [\\\"Last Updated Grade\\\"] = gradeYesterday, [\\\"Last Updated Score\\\"] = scoreYesterday_d, [\\\"Date of Current Score\\\"] = dateToday_s, Factor = Factor_Name_s \",\"size\":0,\"showAnalytics\":true,\"title\":\"My Scorecard Factors\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Current Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Current Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Last Updated Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Last Updated Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"\"}]}},{\"columnMatch\":\"Date of Current Score\",\"formatter\":6}],\"sortBy\":[{\"itemKey\":\"Factor\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Factor\",\"sortOrder\":1}]},\"name\":\"My Scorecard Factors\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where subject_s == '{Domain}'\\r\\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| extend Factor=strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\") \\r\\n| summarize [\\\"Issue Count\\\"]= count() by Factor \",\"size\":0,\"showAnalytics\":true,\"title\":\"Issue Count by Factor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"barchart\",\"chartSettings\":{\"showLegend\":true}},\"name\":\"Issue Types by Factor\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where subject_s == '{Domain}'\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| extend issue_name=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), serverity_priority = case(severity_value_s == \\\"high\\\",1,severity_value_s == \\\"medium\\\",2,severity_value_s == \\\"low\\\",3,severity_value_s == \\\"info\\\",4,5)\\r\\n| summarize count() by severity_value_s, serverity_priority\\r\\n| sort by serverity_priority asc\\r\\n| project-away serverity_priority\\r\\n| render barchart\\r\\n\",\"size\":0,\"title\":\"Issue Types by Severity\",\"timeContextFromParameter\":\"Timer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"graphSettings\":{\"type\":0,\"topContent\":{\"columnMatch\":\"severity_value_s\",\"formatter\":1},\"centerContent\":{\"columnMatch\":\"adware installation\",\"formatter\":1,\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}}},\"chartSettings\":{\"showLegend\":true,\"seriesLabelSettings\":[{\"seriesName\":\"high\",\"label\":\"High\"},{\"seriesName\":\"medium\",\"label\":\"Medium\"},{\"seriesName\":\"low\",\"label\":\"Low\"},{\"seriesName\":\"info\",\"label\":\"Info\"},{\"seriesName\":\"positive\",\"label\":\"Positive\"}],\"customThresholdLine\":\"{issue_name}\",\"customThresholdLineStyle\":0},\"mapSettings\":{\"locInfo\":\"LatLong\",\"sizeSettings\":\"adware installation\",\"sizeAggregation\":\"Sum\",\"legendMetric\":\"adware installation\",\"legendAggregation\":\"Sum\",\"itemColorSettings\":{\"type\":\"heatmap\",\"colorAggregation\":\"Sum\",\"nodeColorField\":\"adware installation\",\"heatmapPalette\":\"greenRed\"}}},\"name\":\"Issue Types by Severity\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"My Scorecard\"},\"name\":\"My Scorecard\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Vendor Scores\",\"style\":\"{setTab}\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8ebc23fe-ade3-4318-8635-24bb841f718b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":2592000000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":2592000000},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"72d22203-f3dd-4557-9605-5b6ca4a4e6c0\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Domain\",\"type\":2,\"description\":\"Your own company domain (My Scorecard). Vendor pages list everyone except this company.\",\"isRequired\":false,\"query\":\"SecurityScorecardRatings\\r\\n| where portfolioName_s in ('NA', 'My Scorecard')\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"parameters - 13\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"624e2391-ad46-416c-9af4-f735c1114b84\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings\\r\\n| where isnotempty(portfolioName_s)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"91c18b81-401d-4b6a-a9ba-e6780c6fee61\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c603e74f-d591-4788-b95b-1370a2b98024\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings\\r\\n| where body_s == \\\"OverAll\\\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and subject_s != '{Domain}'\\r\\n| summarize arg_max(TimeGenerated, *) by dateToday_s, subject_s, portfolioName_s\\r\\n| summarize arg_max(dateToday_s, *) by subject_s, portfolioName_s \\r\\n| extend [\\\"Current Grade\\\"]=case((scoreToday_d >= 90),\\\"A\\\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\\\"B\\\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\\\"C\\\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\\\"D\\\",\\\"F\\\"), [\\\"Last Updated Grade\\\"]=case((scoreYesterday_d >= 90),\\\"A\\\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\\\"B\\\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\\\"C\\\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\\\"D\\\",\\\"F\\\"), Industry=strcat_array(split(industry_s,\\\"_\\\"),\\\" \\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors')\\r\\n| project subject_s, portfolioName_s, Industry, [\\\"Date of Current Score\\\"] = format_datetime(todatetime(dateToday_s), 'yyyy-MM-dd'), scoreToday_d, [\\\"Current Grade\\\"], scoreYesterday_d, ['Last Updated Grade'], Details \\r\\n| project-rename Company = subject_s , [\\\"Current Score\\\"] = scoreToday_d, [\\\"Last Updated Score\\\"] = scoreYesterday_d \\r\\n| sort by Company asc, portfolioName_s asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Level Grade and Score by Company\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Current Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Current Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Last Updated Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Last Updated Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\",\"linkIsContextBlade\":false}}],\"rowLimit\":10000,\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Current Score_3\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"$gen_thresholds_Current Score_3\",\"sortOrder\":1}]},\"name\":\"Top Level Grade and Score by Company\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a38a4cff-47df-431d-a31e-e5a7b9739786\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Factor\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardFactor\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct Factor_Name_s\\r\\n| sort by Factor_Name_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 11\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0fe3d2b0-fcbd-4c3f-80e6-29e39f047743\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Grade\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"A\\\", \\\"label\\\":\\\"A\\\"},\\r\\n { \\\"value\\\":\\\"B\\\", \\\"label\\\":\\\"B\\\"},\\r\\n { \\\"value\\\":\\\"C\\\", \\\"label\\\":\\\"C\\\"},\\r\\n { \\\"value\\\":\\\"D\\\", \\\"label\\\":\\\"D\\\" },\\r\\n { \\\"value\\\":\\\"F\\\", \\\"label\\\":\\\"F\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":2592000000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 12\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardFactor\\r\\n| where body_s == \\\"Factor\\\" and subject_s != '{Domain}' and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| summarize arg_max(TimeGenerated, *) by dateToday_s, subject_s, Factor_Name_s, portfolioName_s\\r\\n| summarize arg_max(dateToday_s, *) by subject_s, Factor_Name_s, portfolioName_s\\r\\n| extend [\\\"Current Grade\\\"] = case(scoreToday_d>=90, \\\"A\\\", scoreToday_d>=80 and scoreToday_d<=89, \\\"B\\\", scoreToday_d>=70 and scoreToday_d<=79, \\\"C\\\", scoreToday_d>=60 and scoreToday_d<=69, \\\"D\\\", \\\"F\\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors') \\r\\n| where ('*' in ({Factor}) or Factor_Name_s in ({Factor})) and [\\\"Current Grade\\\"] in ({Grade})\\r\\n| project subject_s, portfolioName_s, Factor_Name_s, factorDescription_s , scoreToday_d, [\\\"Current Grade\\\"], Details \\r\\n| project-rename Company = subject_s, Factor = Factor_Name_s, Description = factorDescription_s, [\\\"Current Score\\\"] = scoreToday_d\\r\\n| sort by Factor asc, Company asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Top Level Grade and Score by Factor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Current Score\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\">=\",\"thresholdValue\":\"90\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"80\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"70\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\">=\",\"thresholdValue\":\"60\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"<=\",\"thresholdValue\":\"59\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Current Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}}],\"rowLimit\":10000}},\"name\":\"Top Level Grade and Score by Factor\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"f952c797-c056-446e-8ce1-4495673c337d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"IssueType\",\"label\":\"Issue Type\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| extend issue_type = strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\") \\r\\n| distinct issue_type\\r\\n| sort by issue_type asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 9\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"73302a85-fb1b-43cf-8c7f-dfbebd6eb167\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"low\\\", \\\"label\\\":\\\"Low\\\" },\\r\\n { \\\"value\\\":\\\"medium\\\", \\\"label\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"high\\\", \\\"label\\\":\\\"high\\\" },\\r\\n { \\\"value\\\":\\\"positive\\\", \\\"label\\\":\\\"Positive\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == 'Issue' and groupStatus_s == 'active' and subject_s != '{Domain}' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and severity_value_s in ({Severity})\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Findings Count\\\"] = sum(findingsCount_d), [\\\"Issue Count\\\"] = count(issueName_s), src = arg_max(date_s,Factor_s) by issueType_s, subject_s, severity_value_s\\r\\n| extend [\\\"Issue Type\\\"]=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\") , Severity=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\\r\\n| where ('*' in ({IssueType}) or [\\\"Issue Type\\\"] in ({IssueType})) \\r\\n| project subject_s, Severity, [\\\"Issue Type\\\"], [\\\"Findings Count\\\"], [\\\"Issue Count\\\"], Details \\r\\n| order by [\\\"Issue Type\\\"] asc, subject_s asc\\r\\n| project-rename Company=subject_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issues per Vendor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}}],\"rowLimit\":10000,\"filter\":true,\"sortBy\":[{\"itemKey\":\"Issue Type\",\"sortOrder\":1}]},\"sortBy\":[{\"itemKey\":\"Issue Type\",\"sortOrder\":1}]},\"name\":\"Issues per Vendor\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Vendor Scores\"},\"name\":\"Vendor Scores\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Active Issues\",\"style\":\"{setTab}\"},\"name\":\"Active Issues\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"6239b6b6-1b0c-4d82-9599-bcb3155a8869\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":2592000000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":2592000000},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"99a0579a-77d5-4693-a099-c1b7dd688c0d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where isnotempty(portfolioName_s)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e6981875-d72c-486f-baea-52e1e762143f\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"95c35610-dd13-45f0-bdf4-dae3008215a7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Factor\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| extend factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\")\\r\\n| distinct value=Factor_s, label=factor\\r\\n| sort by label asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Factor\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"34f6058c-86eb-45e1-8684-ad1db584019a\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"bd48be36-fe76-4b7d-be98-fc3ac56f6759\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"low\\\", \\\"label\\\":\\\"Low\\\" },\\r\\n { \\\"value\\\":\\\"medium\\\", \\\"label\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"high\\\", \\\"label\\\":\\\"high\\\" },\\r\\n { \\\"value\\\":\\\"positive\\\", \\\"label\\\":\\\"Positive\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":2592000000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"Active Issues will only encompass those that have appeared since the feed was turned on.\",\"style\":\"info\"},\"name\":\"text - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and ('*' in ({Severity}) or severity_value_s in ({Severity}))\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize arg_max(date_s,*), src = arg_max(date_s,Factor_s),[\\\"Findings Count\\\"] = sum(findingsCount_d), Active = sumif(findingsCount_d, groupStatus_s == \\\"active\\\"), Resolved = sumif(findingsCount_d, groupStatus_s == \\\"resolved\\\") by issueType_s\\r\\n| join kind=leftouter (SecurityScorecardFactor \\r\\n | distinct Factor_s,factorDescription_s\\r\\n | project Factor_s, factorDescription_s) on Factor_s\\r\\n| extend severity_index=case((severity_value_s == \\\"high\\\"),1,(severity_value_s == \\\"medium\\\"),2,(severity_value_s == \\\"low\\\"),3,(severity_value_s == \\\"info\\\"),4,5), severity_value_s=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s), Factor=strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\"), [\\\"Issue type\\\"]=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s)\\r\\n| sort by severity_index asc, findingsCount_d desc\\r\\n| project [\\\"Issue type\\\"], Factor, severity_value_s, factorDescription_s, [\\\"Findings Count\\\"], Active, Resolved, Details\\r\\n| project-rename Description = factorDescription_s, Severity = severity_value_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Active Issues\",\"timeContextFromParameter\":\"Timer\",\"exportParameterName\":\"activeissues\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}},{\"columnMatch\":\"Sevirity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000}},\"name\":\"Active Issues\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == 'Issue' and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\\r\\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Issue Count\\\"] = count(issueType_s) by Factor_s \\r\\n| extend Factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\")\\r\\n| project Factor, [\\\"Issue Count\\\"] \\r\\n\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issue Types by Factor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"categoricalbar\",\"chartSettings\":{\"showLegend\":true}},\"name\":\"Issue Types by Factor\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == \\\"Issue\\\" and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize count() by severity_value_s \\r\\n| extend severity_value_s = case((severity_value_s == 'info'), \\\"Info\\\",(severity_value_s == 'low'), \\\"Low\\\",(severity_value_s == 'medium'), \\\"Medium\\\",(severity_value_s == 'high'), \\\"High\\\", (severity_value_s == 'positive'), \\\"Positive\\\", severity_value_s)\\r\\n| render piechart\",\"size\":3,\"showAnalytics\":true,\"title\":\"Count by Severity\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"Count by Severity\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Active Issues\"},\"name\":\"Active Issues\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Issues per Vendor (CVE)\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a30af542-54cd-4a92-ac85-e094c9cc1c43\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":2592000000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a3195f85-f04f-422c-b233-f9bd8a357b8b\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CVE\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"service_vuln_host_high\\\", \\\"label\\\":\\\"Service Vuln Host High\\\"},\\r\\n { \\\"value\\\":\\\"service_vuln_host_low\\\", \\\"label\\\":\\\"Service Vuln Host Low\\\" },\\r\\n { \\\"value\\\":\\\"service_vuln_host_medium\\\", \\\"label\\\":\\\"Service Vuln Host Medium\\\"},\\r\\n { \\\"value\\\":\\\"patching_cadence_high\\\", \\\"label\\\":\\\"Patching Cadence High\\\" },\\r\\n { \\\"value\\\":\\\"patching_cadence_low\\\", \\\"label\\\":\\\"Patching Cadence Low\\\"},\\r\\n { \\\"value\\\":\\\"patching_cadence_medium\\\", \\\"label\\\":\\\"Patching Cadence Medium\\\" },\\r\\n { \\\"value\\\":\\\"web_vuln_host_high\\\", \\\"label\\\":\\\"Web Vuln Host High\\\"},\\r\\n { \\\"value\\\":\\\"web_vuln_host_low\\\", \\\"label\\\":\\\"Web Vuln Host Low\\\" },\\r\\n { \\\"value\\\":\\\"web_vuln_host_medium\\\", \\\"label\\\":\\\"Web Vuln Host Medium\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":2592000000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"CVE\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"0f2ad534-e343-44c2-a3ff-0d1d2c7916c5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where isnotempty(portfolioName_s)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"55320f6b-3583-440d-977f-33ceffc07d94\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"070f384d-1ff0-49c9-8f3f-f121e78811a2\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"Issues per Vendor will only encompass those that have appeared since the feed was turned on.\",\"style\":\"info\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and issueType_s in ({CVE}) and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Findings Count\\\"] = sum(findingsCount_d), [\\\"Issue Count\\\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \\\"active\\\"), Resolved = sumif(findingsCount_d, groupStatus_s == \\\"resolved\\\") by issueType_s, subject_s, severity_value_s\\r\\n| extend CVE=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), severity_priority = case(severity_value_s == \\\"high\\\",1,severity_value_s == \\\"medium\\\",2,severity_value_s == \\\"low\\\",3,severity_value_s == \\\"info\\\",4,5), Severity=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\", severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s), Factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\")\\r\\n| sort by CVE asc, severity_priority asc, subject_s asc\\r\\n| project subject_s, CVE, Factor, Severity, ['Findings Count'], [\\\"Issue Count\\\"], Active, Resolved, Details\\r\\n| project-rename Company = subject_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issues per Vendor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"turquoise\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}}],\"rowLimit\":10000,\"filter\":true}},\"name\":\"Issues per Vendor\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Issues per Vendor (CVE)\"},\"name\":\"Issues per Vendor (CVE)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Issues per Vendor (Ransomware)\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"c9b54d32-38cd-4b08-8dd6-4be29b019c80\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":2592000000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"168555cd-afbe-457a-81c1-a68663c51823\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Ransomware\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"tls_weal_cipher\\\", \\\"label\\\":\\\"Tls Weal Cipher\\\"},\\r\\n { \\\"value\\\":\\\"exposed_personal_information_info\\\", \\\"label\\\":\\\"Exposed Personal Information Info\\\" },\\r\\n { \\\"value\\\":\\\"outdated_browser\\\", \\\"label\\\":\\\"Outdated Browser\\\"},\\r\\n { \\\"value\\\":\\\"csp_no_policy_v2\\\", \\\"label\\\":\\\"Csp No Policy V2\\\" },\\r\\n { \\\"value\\\":\\\"exposed_personal_information\\\", \\\"label\\\":\\\"Exposed Personal Information\\\"},\\r\\n { \\\"value\\\":\\\"ip_count_means\\\", \\\"label\\\":\\\"Ip Count Means\\\" },\\r\\n { \\\"value\\\":\\\"service_vuln_host_medium\\\", \\\"label\\\":\\\"Service Vuln Host Medium\\\"},\\r\\n { \\\"value\\\":\\\"hsts_incorrect_v2\\\", \\\"label\\\":\\\"Hsts Incorrect V2\\\" },\\r\\n { \\\"value\\\":\\\"unsafe_sri_v2\\\", \\\"label\\\":\\\"Unsafe Sri V2\\\"},\\r\\n { \\\"value\\\":\\\"leaked_credentials\\\", \\\"label\\\":\\\"Leaked Credentials\\\"},\\r\\n { \\\"value\\\":\\\"x_frame_options_incorrect_v2\\\", \\\"label\\\":\\\"X Frame Options Incorrect V2\\\"},\\r\\n { \\\"value\\\":\\\"x_xss_protection_incorrect_v2\\\", \\\"label\\\":\\\"X Xss Protection Incorrect V2\\\"},\\r\\n { \\\"value\\\":\\\"x_content_type_options_incorrect_v2\\\", \\\"label\\\":\\\"X Content Type Options Incorrect V2\\\"},\\r\\n { \\\"value\\\":\\\"tlscert_no_revocation\\\", \\\"label\\\":\\\"Tlscert No Revocation\\\"},\\r\\n { \\\"value\\\":\\\"tlscert_expired\\\", \\\"label\\\":\\\"Tlscert Expired\\\"},\\r\\n { \\\"value\\\":\\\"outdated_os\\\", \\\"label\\\":\\\"Outdated Os\\\"},\\r\\n { \\\"value\\\":\\\"tls_weak_protocol\\\", \\\"label\\\":\\\"Tls Weak Protocol\\\"},\\r\\n { \\\"value\\\":\\\"domain_missing_https_v2\\\", \\\"label\\\":\\\"Domain Missing Https V2\\\"},\\r\\n { \\\"value\\\":\\\"tlscert_excessive_expiration\\\", \\\"label\\\":\\\"Tlscert Excessive Expiration\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":604800000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Ransomware\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"7bf4c309-6e2b-4619-9253-e85808486e75\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where isnotempty(portfolioName_s)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ee929211-b34e-4369-905b-cb4d87bf6364\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"8d9dcdcc-8c93-4b47-a2e1-880ffea2a31e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":1,\"content\":{\"json\":\"Issues per Vendor will only encompass those that have appeared since the feed was turned on.\",\"style\":\"info\"},\"name\":\"text - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and issueType_s in ({Ransomware})\\r\\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| summarize [\\\"Findings Count\\\"] = sum(findingsCount_d),[\\\"Issue Count\\\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \\\"active\\\"), Resolved = sumif(findingsCount_d, groupStatus_s == \\\"resolved\\\") by issueType_s, subject_s, severity_value_s \\r\\n| extend Ransomware=strcat_array(split(issueType_s,\\\"_\\\"),\\\" \\\"), Severity=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\\r\\n| project subject_s, Ransomware, Severity, ['Findings Count'], ['Issue Count'], Active, Resolved, Details\\r\\n| project-rename Company = subject_s\\r\\n| sort by Ransomware asc, Company asc\",\"size\":0,\"showAnalytics\":true,\"title\":\"Issues per Vendor\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"Details\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Click to view details\"}},{\"columnMatch\":\"drilldown_url\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"details\"}}],\"rowLimit\":10000}},\"name\":\"Issues per Vendor\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Issues per Vendor (Ransomware)\"},\"name\":\"Issues per Vendor (Ransomware)\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Spotlight\"},\"name\":\"text - 0\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"73978413-5a37-4814-b4fc-4143999f13ec\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Timer\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":300000},{\"durationMs\":900000},{\"durationMs\":1800000},{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":2592000000},{\"durationMs\":172800000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2419200000},{\"durationMs\":2592000000},{\"durationMs\":5184000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":2592000000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Timerparameter\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"73bc33a2-eb41-4433-9b1d-59930d7ddf3d\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Portfolio\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings\\r\\n| where isnotempty(portfolioName_s)\\r\\n| distinct portfolioName_s\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Portfolio\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"ae9eff1e-6b7b-4d64-9516-30ea5bc5fb17\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Company\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\\r\\n| distinct subject_s\\r\\n| sort by subject_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Company\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"d9274665-9d9c-417b-9d3f-03162538cf92\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Factor\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardIssue\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| extend label = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\"),value = Factor_s\\r\\n| distinct value, label\\r\\n| sort by label asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Factor\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"485b4de7-9cd5-4e5e-b2d4-da7f921ff61c\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Industry\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"SecurityScorecardRatings\\r\\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| distinct industry_s\\r\\n| sort by industry_s asc\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"Timer\",\"defaultValue\":\"value::all\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"0\",\"name\":\"Industry\"},{\"type\":1,\"content\":{\"json\":\"
\"},\"name\":\"text - 6\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardRatings\\r\\n| where body_s =='OverAll' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\\r\\n| summarize arg_max(dateToday_s,*) by subject_s\\r\\n| extend Grade = case((scoreToday_d >= 90), \\\"A\\\",(scoreToday_d>=80 and scoreToday_d<=89), \\\"B\\\",(scoreToday_d>=70 and scoreToday_d<=79), \\\"C\\\",(scoreToday_d>=60 and scoreToday_d<=69), \\\"D\\\",isempty(scoreToday_d),\\\"\\\",\\\"F\\\") \\r\\n| project Grade, subject_s, scoreToday_d\\r\\n| project-rename Company = subject_s, Score = scoreToday_d\\r\\n| sort by Score asc\\r\\n| limit 10\",\"size\":0,\"showAnalytics\":true,\"title\":\"Worst Performing Companies\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Grade\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"A\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"B\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"C\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"D\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"F\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"blue\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"40\",\"name\":\"Worst Performing Companies\",\"styleSettings\":{\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue\\r\\n| where body_s == 'Issue' and groupStatus_s == \\\"active\\\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\\r\\n| summarize arg_max(date_s,*), [\\\"Company Count\\\"] = dcount(subject_s,4) by issueName_s, severity_value_s, issueType_s, Factor_s\\r\\n| extend serverity_priority = case(severity_value_s == \\\"high\\\",1,severity_value_s == \\\"medium\\\",2,severity_value_s == \\\"low\\\",3,severity_value_s == \\\"info\\\",4,5), severity_value=case((severity_value_s == \\\"info\\\"),\\\"Info\\\",(severity_value_s == \\\"low\\\"),\\\"Low\\\",(severity_value_s == \\\"medium\\\"),\\\"Medium\\\",(severity_value_s == \\\"high\\\"),\\\"High\\\",(severity_value_s == \\\"positive\\\"),\\\"Positive\\\",severity_value_s) \\r\\n| extend Issues=trim(@\\\"'\\\",issueName_s), Factor=strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\") \\r\\n| sort by serverity_priority asc, [\\\"Company Count\\\"] desc\\r\\n| project Severity = severity_value, Issues, Factor = Factor, [\\\"Company Count\\\"]\",\"size\":0,\"showAnalytics\":true,\"title\":\"Most Critical Issues\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Severity\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"red\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Info\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Positive\",\"representation\":\"lightBlue\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000,\"filter\":true}},\"customWidth\":\"60\",\"name\":\"Most Critical Issues\",\"styleSettings\":{\"showBorder\":true}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"e316e111-37ee-404b-8feb-920a6147bf30\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"\",\"showDefault\":false},\"jsonData\":\"[\\r\\n { \\\"value\\\":\\\"info\\\", \\\"label\\\":\\\"Info\\\"},\\r\\n { \\\"value\\\":\\\"low\\\", \\\"label\\\":\\\"Low\\\" },\\r\\n { \\\"value\\\":\\\"medium\\\", \\\"label\\\":\\\"Medium\\\"},\\r\\n { \\\"value\\\":\\\"high\\\", \\\"label\\\":\\\"high\\\" },\\r\\n { \\\"value\\\":\\\"positive\\\", \\\"label\\\":\\\"Positive\\\"}\\r\\n]\",\"timeContext\":{\"durationMs\":2592000000},\"defaultValue\":\"value::all\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 10\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"SecurityScorecardIssue \\r\\n| where body_s == \\\"Issue\\\" and groupStatus_s == \\\"active\\\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and severity_value_s in ({Severity})\\r\\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\\r\\n| extend totalcount = toscalar(SecurityScorecardIssue | summarize dcount(subject_s))\\r\\n| summarize subject = dcount(subject_s), totalCount = max(totalcount) by issueName_s, issueType_s, Factor_s\\r\\n| extend [\\\"% of Portfolio Affected\\\"] = round((todouble(subject)/todouble(totalCount))*100,0)\\r\\n| extend Factor = strcat_array(split(Factor_s,\\\"_\\\"),\\\" \\\") \\r\\n| project Factor, issueName_s, [\\\"% of Portfolio Affected\\\"]\\r\\n| sort by [\\\"% of Portfolio Affected\\\"] desc\\r\\n| project-rename Issues = issueName_s\",\"size\":0,\"showAnalytics\":true,\"title\":\"Most Common Issues\",\"timeContextFromParameter\":\"Timer\",\"showExportToExcel\":true,\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"% of Portfolio Affected\",\"formatter\":3,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"redDark\"}}]}},\"name\":\"Most Common Issues\",\"styleSettings\":{\"showBorder\":true}}]},\"conditionalVisibility\":{\"parameterName\":\"setTab\",\"comparison\":\"isEqualTo\",\"value\":\"Spotlight\"},\"name\":\"Spotlight\"}]},\"name\":\"Main\",\"styleSettings\":{\"showBorder\":true}}],\"fromTemplateId\":\"sentinel-SecurityScorecardWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -130,7 +171,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": "@{workbookKey=SecurityScorecardWorkbook; logoFileName=; description=This Workbook provides immediate insight into the data coming from SecurityScorecard’s three Sentinel data connectors: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=SecurityScorecard; templateRelativePath=SecurityScorecardWorkbook.json; subtitle=; provider=SecurityScorecard}.description", + "description": "@{workbookKey=SecurityScorecardWorkbook; logoFileName=SecurityScorecard-Cybersecurity-Ratings.svg; description=This Workbook provides immediate insight into the data coming from SecurityScorecard's data connectors within Microsoft Sentinel: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=SecurityScorecard; templateRelativePath=SecurityScorecardWorkbook.json; subtitle=; provider=SecurityScorecard}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", @@ -165,6 +206,18 @@ "contentId": "SecurityScorecardRatings_CL", "kind": "DataType" }, + { + "contentId": "SecurityScorecardFactorHistory_CL", + "kind": "DataType" + }, + { + "contentId": "SecurityScorecardIssuesHistory_CL", + "kind": "DataType" + }, + { + "contentId": "SecurityScorecardRatingsHistory_CL", + "kind": "DataType" + }, { "contentId": "SecurityScorecardFactorAzureFunctions", "kind": "DataConnector" @@ -176,43 +229,48 @@ { "contentId": "SecurityScorecardRatingsAzureFunctions", "kind": "DataConnector" + }, + { + "contentId": "SecurityScorecardFactorCCPDefinition", + "kind": "DataConnector" + }, + { + "contentId": "SecurityScorecardIssueCCPDefinition", + "kind": "DataConnector" + }, + { + "contentId": "SecurityScorecardRatingsCCPDefinition", + "kind": "DataConnector" } ] } } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "SecurityScorecard Cybersecurity Ratings data connector with template", - "displayName": "SecurityScorecard Cybersecurity Ratings template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName1'),'/',variables('dataConnectorVersion1'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName1'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SecurityScorecard Cybersecurity Ratings data connector with template version 2.0.0", + "description": "SecurityScorecard Cybersecurity Ratings data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -228,9 +286,9 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId1')]", - "title": "SecurityScorecard Cybersecurity Ratings (using Azure Function)", + "title": "[DEPRECATED] SecurityScorecard Cybersecurity Ratings (using Azure Functions)", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) data connector provides the ability for Sentinel to import SecurityScorecard ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when scores change or drop. SecurityScorecard ratings are updated daily based on evidence collected across the web.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Ratings (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) data connector provides the ability for Microsoft Sentinel to import SecurityScorecard ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when scores change or drop. SecurityScorecard ratings are updated daily based on evidence collected across the web.", "graphQueries": [ { "metricName": "Total Ratings data received", @@ -349,7 +407,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", @@ -374,12 +432,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[DEPRECATED] SecurityScorecard Cybersecurity Ratings (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId1')]" @@ -415,9 +484,9 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "SecurityScorecard Cybersecurity Ratings (using Azure Function)", + "title": "[DEPRECATED] SecurityScorecard Cybersecurity Ratings (using Azure Functions)", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) data connector provides the ability for Sentinel to import SecurityScorecard ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when scores change or drop. SecurityScorecard ratings are updated daily based on evidence collected across the web.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Ratings (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) data connector provides the ability for Microsoft Sentinel to import SecurityScorecard ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when scores change or drop. SecurityScorecard ratings are updated daily based on evidence collected across the web.", "graphQueries": [ { "metricName": "Total Ratings data received", @@ -536,33 +605,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "SecurityScorecard Cybersecurity Ratings data connector with template", - "displayName": "SecurityScorecard Cybersecurity Ratings template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName2'),'/',variables('dataConnectorVersion2'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName2'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SecurityScorecard Cybersecurity Ratings data connector with template version 2.0.0", + "description": "SecurityScorecard Cybersecurity Ratings data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -578,9 +629,9 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId2')]", - "title": "SecurityScorecard Factor (using Azure Function)", + "title": "[DEPRECATED] SecurityScorecard Factor (using Azure Functions)", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Factors (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Microsoft Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.", "graphQueries": [ { "metricName": "Total Factor data received", @@ -699,7 +750,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", @@ -724,12 +775,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[DEPRECATED] SecurityScorecard Factor (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId2')]" @@ -765,9 +827,9 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "SecurityScorecard Factor (using Azure Function)", + "title": "[DEPRECATED] SecurityScorecard Factor (using Azure Functions)", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Factors (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Microsoft Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.", "graphQueries": [ { "metricName": "Total Factor data received", @@ -886,33 +948,15 @@ } }, { - "type": "Microsoft.Resources/templateSpecs", - "apiVersion": "2021-05-01", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", "name": "[variables('dataConnectorTemplateSpecName3')]", "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, - "properties": { - "description": "SecurityScorecard Cybersecurity Ratings data connector with template", - "displayName": "SecurityScorecard Cybersecurity Ratings template" - } - }, - { - "type": "Microsoft.Resources/templateSpecs/versions", - "apiVersion": "2021-05-01", - "name": "[concat(variables('dataConnectorTemplateSpecName3'),'/',variables('dataConnectorVersion3'))]", - "location": "[parameters('workspace-location')]", - "tags": { - "hidden-sentinelWorkspaceId": "[variables('workspaceResourceId')]", - "hidden-sentinelContentType": "DataConnector" - }, "dependsOn": [ - "[resourceId('Microsoft.Resources/templateSpecs', variables('dataConnectorTemplateSpecName3'))]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SecurityScorecard Cybersecurity Ratings data connector with template version 2.0.0", + "description": "SecurityScorecard Cybersecurity Ratings data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion3')]", @@ -928,9 +972,9 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId3')]", - "title": "SecurityScorecard Issue (using Azure Function)", + "title": "[DEPRECATED] SecurityScorecard Issue (using Azure Functions)", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Issues data connector provides the ability for Sentinel to import SecurityScorecard issue data as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when new cybersecurity issues are discovered.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Issues (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Issues data connector provides the ability for Microsoft Sentinel to import SecurityScorecard issue data as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when new cybersecurity issues are discovered.", "graphQueries": [ { "metricName": "Total Issue data received", @@ -1049,7 +1093,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", "properties": { "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", @@ -1074,12 +1118,23 @@ } } ] - } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId3')]", + "contentKind": "DataConnector", + "displayName": "[DEPRECATED] SecurityScorecard Issue (using Azure Functions)", + "contentProductId": "[variables('_dataConnectorcontentProductId3')]", + "id": "[variables('_dataConnectorcontentProductId3')]", + "version": "[variables('dataConnectorVersion3')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "apiVersion": "2023-04-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", "dependsOn": [ "[variables('_dataConnectorId3')]" @@ -1115,9 +1170,9 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "SecurityScorecard Issue (using Azure Function)", + "title": "[DEPRECATED] SecurityScorecard Issue (using Azure Functions)", "publisher": "SecurityScorecard", - "descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Issues data connector provides the ability for Sentinel to import SecurityScorecard issue data as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when new cybersecurity issues are discovered.", + "descriptionMarkdown": "

NOTE: This data connector has been deprecated. Consider moving to the SecurityScorecard Issues (Codeless) CCF data connector available in the solution, which replaces ingestion via the deprecated HTTP Data Collector API.

\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Issues data connector provides the ability for Microsoft Sentinel to import SecurityScorecard issue data as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when new cybersecurity issues are discovered.", "graphQueries": [ { "metricName": "Total Issue data received", @@ -1236,52 +1291,3020 @@ } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition4'), variables('dataConnectorCCPVersion'))]", "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "version": "2.0.0", - "kind": "Solution", - "contentSchemaVersion": "2.0.0", - "contentId": "[variables('_solutionId')]", - "parentId": "[variables('_solutionId')]", - "source": { - "kind": "Solution", - "name": "SecurityScorecard Cybersecurity Ratings", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "SecurityScorecard", - "email": "[variables('_email')]" - }, - "support": { - "name": "SecurityScorecard", - "email": "support@securityscorecard.io", - "tier": "Partner", - "link": "https://support.securityscorecard.com/hc/en-us/requests/new" - }, - "dependencies": { - "operator": "AND", - "criteria": [ + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition4')]", + "displayName": "SecurityScorecard Issues (Codeless)", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition4'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardIssueCCPDefinition", + "title": "SecurityScorecard Issues (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Issues (Codeless) connector ingests issue history events from the companies in a SecurityScorecard portfolio into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per portfolio you want to monitor — each connection is managed independently in the grid below. Replaces the Function App connector.", + "graphQueriesTableName": "SecurityScorecardIssuesHistory_CL", + "graphQueries": [ + { + "metricName": "Total Issue data received", + "legend": "SecurityScorecard issues", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "All SecurityScorecard issues", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required. See [SecurityScorecard docs](https://securityscorecard.readme.io/) for how to provision a bot user token." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator in SecurityScorecard, navigate to My Settings then Users, create a bot user with Read Only permission, and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the issue-history events for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's issue events (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } }, { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition4')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition4'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition4')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections4')]", + "kind": "ResourcesDataConnector" + } + ] + } + } }, { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId2')]", - "version": "[variables('dataConnectorVersion2')]" + "name": "SecurityScorecardIssueDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId4')]", + "streamDeclarations": { + "Custom-SecurityScorecardIssuesHistory_CL": { + "columns": [ + { + "name": "id", + "type": "long" + }, + { + "name": "date", + "type": "datetime" + }, + { + "name": "event_type", + "type": "string" + }, + { + "name": "group_status", + "type": "string" + }, + { + "name": "issue_count", + "type": "long" + }, + { + "name": "total_score_impact", + "type": "real" + }, + { + "name": "issue_type", + "type": "string" + }, + { + "name": "severity", + "type": "string" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "detail_url", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "company_domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SecurityScorecardIssuesHistory_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | where tostring(issue_type) != 'breach' | extend TimeGenerated = todatetime(['date']), issue_date = todatetime(['date']), domain = iff(isnotempty(tostring(company_domain)), tostring(company_domain), extract('companies/([^/]+)/', 1, tostring(detail_url))), industry = tostring(industry) | project TimeGenerated, id, issue_date, event_type, group_status, issue_count, total_score_impact, issue_type, severity, factor, detail_url, domain, industry, portfolio_id, portfolio_name", + "outputStream": "Custom-SecurityScorecardIssuesHistory_CL" + } + ] + } }, { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId3')]", - "version": "[variables('dataConnectorVersion3')]" + "name": "SecurityScorecardIssuesHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "SecurityScorecardIssuesHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "id", + "type": "long" + }, + { + "name": "issue_date", + "type": "datetime" + }, + { + "name": "event_type", + "type": "string" + }, + { + "name": "group_status", + "type": "string" + }, + { + "name": "issue_count", + "type": "long" + }, + { + "name": "total_score_impact", + "type": "real" + }, + { + "name": "issue_type", + "type": "string" + }, + { + "name": "severity", + "type": "string" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "detail_url", + "type": "string" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } + }, + { + "name": "SecurityScorecardFactorHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "SecurityScorecardFactorHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "score_date", + "type": "datetime" + }, + { + "name": "factors", + "type": "dynamic" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } + }, + { + "name": "SecurityScorecardRatingsHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "SecurityScorecardRatingsHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "score_date", + "type": "datetime" + }, + { + "name": "score", + "type": "long" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition4'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition4'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardIssueCCPDefinition", + "title": "SecurityScorecard Issues (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Issues (Codeless) connector ingests issue history events from the companies in a SecurityScorecard portfolio into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per portfolio you want to monitor — each connection is managed independently in the grid below. Replaces the Function App connector.", + "graphQueriesTableName": "SecurityScorecardIssuesHistory_CL", + "graphQueries": [ + { + "metricName": "Total Issue data received", + "legend": "SecurityScorecard issues", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "All SecurityScorecard issues", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required. See [SecurityScorecard docs](https://securityscorecard.readme.io/) for how to provision a bot user token." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator in SecurityScorecard, navigate to My Settings then Users, create a bot user with Read Only permission, and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the issue-history events for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's issue events (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition4')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition4'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition4')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections4')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections4'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections4')]", + "displayName": "SecurityScorecard Issues (Codeless)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "SecurityScorecard Issues (Codeless)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "BaseUrl": { + "defaultValue": "BaseUrl", + "type": "securestring", + "minLength": 1 + }, + "ApiToken": { + "defaultValue": "ApiToken", + "type": "securestring", + "minLength": 1 + }, + "PortfolioId": { + "defaultValue": "PortfolioId", + "type": "securestring", + "minLength": 1 + }, + "PortfolioName": { + "defaultValue": "PortfolioName", + "type": "securestring", + "minLength": 1 + }, + "Domain": { + "defaultValue": "", + "type": "securestring" + } + }, + "variables": { + "_dataConnectorContentIdConnections4": "[variables('_dataConnectorContentIdConnections4')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections4')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections4'))]", + "contentId": "[variables('_dataConnectorContentIdConnections4')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + }, + { + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardIssues', uniqueString(parameters('PortfolioId')))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardIssueCCPDefinition", + "dataType": "SecurityScorecardIssuesHistory_CL", + "addOnAttributes": { + "portfolio_id": "[[parameters('PortfolioId')]", + "portfolio_name": "[[parameters('PortfolioName')]", + "company_domain": "$company_domain$", + "industry": "$company_industry$" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardIssuesHistory_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/portfolios/', parameters('PortfolioId'), '/companies')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "issueDetails", + "stepPlaceholdersParsingKql": "source | extend res = parse_json(data) | project company_domain = tostring(res['domain']), company_industry = tostring(res['industry'])" + } + ] + }, + "stepCollectorConfigs": { + "issueDetails": { + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/$company_domain$/history/events')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "date_from": "{_QueryWindowStartTime}", + "date_to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } + } + }, + { + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardIssuesOwn', uniqueString(parameters('Domain')))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardIssueCCPDefinition", + "dataType": "SecurityScorecardIssuesHistory_CL", + "addOnAttributes": { + "portfolio_id": "NA", + "portfolio_name": "My Scorecard", + "company_domain": "[[parameters('Domain')]", + "industry": "NA" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardIssuesHistory_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/', parameters('Domain'), '/history/events')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "date_from": "{_QueryWindowStartTime}", + "date_to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + }, + "condition": "[[and(not(empty(parameters('Domain'))), not(equals(parameters('Domain'), 'Domain')))]" + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections4'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition5'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition5')]", + "displayName": "SecurityScorecard Ratings (Codeless)", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition5'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardRatingsCCPDefinition", + "title": "SecurityScorecard Ratings (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Ratings (Codeless) connector ingests overall company score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw daily score rows land in `SecurityScorecardRatingsHistory_CL`; query via the `SecurityScorecardRatings` parser for day-over-day deltas matching the legacy Function App schema.", + "graphQueriesTableName": "SecurityScorecardRatingsHistory_CL", + "graphQueries": [ + { + "metricName": "Total Ratings history rows received", + "legend": "SecurityScorecard ratings history", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Day-over-day rating change (parser)", + "query": "SecurityScorecardRatings\n | sort by TimeGenerated desc" + }, + { + "description": "Raw ratings history", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator in SecurityScorecard, navigate to My Settings then Users, create a bot user with Read Only permission, and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the overall company scores for a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's scorecard (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition5')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition5'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition5')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections5')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "SecurityScorecardRatingsDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId5')]", + "streamDeclarations": { + "Custom-SecurityScorecardRatingsHistory_CL": { + "columns": [ + { + "name": "date", + "type": "datetime" + }, + { + "name": "score", + "type": "long" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SecurityScorecardRatingsHistory_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend TimeGenerated = todatetime(['date']), score_date = todatetime(['date']), domain = tostring(domain), industry = tostring(industry) | project TimeGenerated, score_date, score, domain, industry, portfolio_id, portfolio_name", + "outputStream": "Custom-SecurityScorecardRatingsHistory_CL" + } + ] + } + }, + { + "name": "SecurityScorecardRatingsHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "SecurityScorecardRatingsHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "score_date", + "type": "datetime" + }, + { + "name": "score", + "type": "long" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition5'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition5'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardRatingsCCPDefinition", + "title": "SecurityScorecard Ratings (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Ratings (Codeless) connector ingests overall company score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw daily score rows land in `SecurityScorecardRatingsHistory_CL`; query via the `SecurityScorecardRatings` parser for day-over-day deltas matching the legacy Function App schema.", + "graphQueriesTableName": "SecurityScorecardRatingsHistory_CL", + "graphQueries": [ + { + "metricName": "Total Ratings history rows received", + "legend": "SecurityScorecard ratings history", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Day-over-day rating change (parser)", + "query": "SecurityScorecardRatings\n | sort by TimeGenerated desc" + }, + { + "description": "Raw ratings history", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator in SecurityScorecard, navigate to My Settings then Users, create a bot user with Read Only permission, and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the overall company scores for a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's scorecard (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition5')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition5'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition5')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections5')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections5'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections5')]", + "displayName": "SecurityScorecard Ratings (Codeless)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "SecurityScorecard Ratings (Codeless)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "BaseUrl": { + "defaultValue": "BaseUrl", + "type": "securestring", + "minLength": 1 + }, + "ApiToken": { + "defaultValue": "ApiToken", + "type": "securestring", + "minLength": 1 + }, + "PortfolioId": { + "defaultValue": "PortfolioId", + "type": "securestring", + "minLength": 1 + }, + "PortfolioName": { + "defaultValue": "PortfolioName", + "type": "securestring", + "minLength": 1 + }, + "Domain": { + "defaultValue": "", + "type": "securestring" + } + }, + "variables": { + "_dataConnectorContentIdConnections5": "[variables('_dataConnectorContentIdConnections5')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections5')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections5'))]", + "contentId": "[variables('_dataConnectorContentIdConnections5')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + }, + { + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardRatings', uniqueString(parameters('PortfolioId')))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardRatingsCCPDefinition", + "dataType": "SecurityScorecardRatingsHistory_CL", + "addOnAttributes": { + "portfolio_id": "[[parameters('PortfolioId')]", + "portfolio_name": "[[parameters('PortfolioName')]", + "domain": "$company_domain$", + "industry": "$company_industry$" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardRatingsHistory_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/portfolios/', parameters('PortfolioId'), '/companies')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "ratingsHistory", + "stepPlaceholdersParsingKql": "source | extend res = parse_json(data) | project company_domain = tostring(res['domain']), company_industry = tostring(res['industry'])" + } + ] + }, + "stepCollectorConfigs": { + "ratingsHistory": { + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/$company_domain$/history/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } + } + }, + { + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardRatingsOwn', uniqueString(parameters('Domain')))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardRatingsCCPDefinition", + "dataType": "SecurityScorecardRatingsHistory_CL", + "addOnAttributes": { + "portfolio_id": "NA", + "portfolio_name": "My Scorecard", + "domain": "[[parameters('Domain')]", + "industry": "NA" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardRatingsHistory_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/', parameters('Domain'), '/history/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + }, + "condition": "[[and(not(empty(parameters('Domain'))), not(equals(parameters('Domain'), 'Domain')))]" + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections5'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition6'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "displayName": "SecurityScorecard Factors (Codeless)", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition6'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardFactorCCPDefinition", + "title": "SecurityScorecard Factors (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Factors (Codeless) connector ingests company factor-score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw rows land in `SecurityScorecardFactorHistory_CL`; query via the `SecurityScorecardFactor` parser to get day-over-day deltas with factor metadata, matching the legacy Function App schema.", + "graphQueriesTableName": "SecurityScorecardFactorHistory_CL", + "graphQueries": [ + { + "metricName": "Total Factor history rows received", + "legend": "SecurityScorecard factor history", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Day-over-day factor change (parser)", + "query": "SecurityScorecardFactor\n | sort by TimeGenerated desc" + }, + { + "description": "Raw factor history", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator, create a bot user with Read Only permission and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the factor-score history for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's factor scores (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition6'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "SecurityScorecardFactorDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId6')]", + "streamDeclarations": { + "Custom-SecurityScorecardFactorHistory_CL": { + "columns": [ + { + "name": "domain", + "type": "string" + }, + { + "name": "factors", + "type": "dynamic" + }, + { + "name": "date", + "type": "datetime" + }, + { + "name": "portfolio_id", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "industry", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-SecurityScorecardFactorHistory_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend TimeGenerated = todatetime(['date']), score_date = todatetime(['date']), domain = tostring(domain), industry = tostring(industry), factors = todynamic(factors) | project TimeGenerated, score_date, factors, domain, industry, portfolio_id, portfolio_name", + "outputStream": "Custom-SecurityScorecardFactorHistory_CL" + } + ] + } + }, + { + "name": "SecurityScorecardFactorHistory_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "SecurityScorecardFactorHistory_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "score_date", + "type": "datetime" + }, + { + "name": "factors", + "type": "dynamic" + }, + { + "name": "domain", + "type": "string" + }, + { + "name": "industry", + "type": "string" + }, + { + "name": "portfolio_name", + "type": "string" + }, + { + "name": "portfolio_id", + "type": "string" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition6'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition6'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "SecurityScorecardFactorCCPDefinition", + "title": "SecurityScorecard Factors (Codeless)", + "publisher": "SecurityScorecard", + "descriptionMarkdown": "The SecurityScorecard Factors (Codeless) connector ingests company factor-score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw rows land in `SecurityScorecardFactorHistory_CL`; query via the `SecurityScorecardFactor` parser to get day-over-day deltas with factor metadata, matching the legacy Function App schema.", + "graphQueriesTableName": "SecurityScorecardFactorHistory_CL", + "graphQueries": [ + { + "metricName": "Total Factor history rows received", + "legend": "SecurityScorecard factor history", + "baseQuery": "{{graphQueriesTableName}}" + } + ], + "sampleQueries": [ + { + "description": "Day-over-day factor change (parser)", + "query": "SecurityScorecardFactor\n | sort by TimeGenerated desc" + }, + { + "description": "Raw factor history", + "query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "{{graphQueriesTableName}}", + "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "SecurityScorecard API token", + "description": "A SecurityScorecard API token is required." + } + ] + }, + "instructionSteps": [ + { + "title": "STEP 1 - Create a SecurityScorecard API token", + "description": "As an administrator, create a bot user with Read Only permission and generate the API token." + }, + { + "title": "STEP 2 - Add a portfolio connection", + "description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the factor-score history for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's factor scores (My Scorecard), enter your company domain in the optional field on one connection.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Portfolio Name", + "columnValue": "properties.addOnAttributes.portfolio_name" + }, + { + "columnName": "Portfolio ID", + "columnValue": "properties.addOnAttributes.portfolio_id" + } + ], + "menuItems": [ + "DeleteConnector" + ] + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add portfolio", + "title": "Add a SecurityScorecard portfolio", + "subtitle": "Connect one SecurityScorecard portfolio", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Base URL", + "placeholder": "https://api.securityscorecard.io", + "type": "text", + "name": "BaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "API Token", + "placeholder": "Enter your SecurityScorecard API token", + "type": "password", + "name": "ApiToken", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio ID", + "placeholder": "Enter the SecurityScorecard portfolio ID", + "type": "text", + "name": "PortfolioId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Portfolio Name", + "placeholder": "A friendly name for this portfolio (shown in reports and the workbook)", + "type": "text", + "name": "PortfolioName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Your Company Domain (optional - My Scorecard)", + "placeholder": "e.g. yourcompany.com - leave blank if not needed", + "type": "text", + "name": "Domain", + "validations": { + "required": false + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition6'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections6'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "displayName": "SecurityScorecard Factors (Codeless)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "SecurityScorecard Factors (Codeless)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "BaseUrl": { + "defaultValue": "BaseUrl", + "type": "securestring", + "minLength": 1 + }, + "ApiToken": { + "defaultValue": "ApiToken", + "type": "securestring", + "minLength": 1 + }, + "PortfolioId": { + "defaultValue": "PortfolioId", + "type": "securestring", + "minLength": 1 + }, + "PortfolioName": { + "defaultValue": "PortfolioName", + "type": "securestring", + "minLength": 1 + }, + "Domain": { + "defaultValue": "", + "type": "securestring" + } + }, + "variables": { + "_dataConnectorContentIdConnections6": "[variables('_dataConnectorContentIdConnections6')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections6'))]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + }, + { + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardFactor', uniqueString(parameters('PortfolioId')))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardFactorCCPDefinition", + "dataType": "SecurityScorecardFactorHistory_CL", + "addOnAttributes": { + "portfolio_id": "[[parameters('PortfolioId')]", + "portfolio_name": "[[parameters('PortfolioName')]", + "domain": "$company_domain$", + "industry": "$company_industry$" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardFactorHistory_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/portfolios/', parameters('PortfolioId'), '/companies')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "factorHistory", + "stepPlaceholdersParsingKql": "source | extend res = parse_json(data) | project company_domain = tostring(res['domain']), company_industry = tostring(res['industry'])" + } + ] + }, + "stepCollectorConfigs": { + "factorHistory": { + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/$company_domain$/history/factors/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + } + } + } + }, + { + "name": "[[concat('parameters('workspace')', '/Microsoft.SecurityInsights/SecurityScorecardFactorOwn', uniqueString(parameters('Domain')))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "SecurityScorecardFactorCCPDefinition", + "dataType": "SecurityScorecardFactorHistory_CL", + "addOnAttributes": { + "portfolio_id": "NA", + "portfolio_name": "My Scorecard", + "domain": "[[parameters('Domain')]", + "industry": "NA" + }, + "dcrConfig": { + "streamName": "Custom-SecurityScorecardFactorHistory_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + }, + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('ApiToken')]", + "ApiKeyName": "Authorization", + "ApiKeyIdentifier": "Token" + }, + "request": { + "apiEndpoint": "[[concat(parameters('BaseUrl'), '/companies/', parameters('Domain'), '/history/factors/score')]", + "httpMethod": "GET", + "queryWindowInMin": 1440, + "queryTimeFormat": "yyyy-MM-dd", + "rateLimitQPS": 1, + "retryCount": 3, + "timeoutInSeconds": 60, + "logResponseContent": false, + "headers": { + "Content-Type": "application/json", + "Accept": "application/json; charset=utf-8", + "X-SSC-Application-Name": "Microsoft Sentinel", + "X-SSC-Application-Version": "1.0" + }, + "queryParameters": { + "from": "{_QueryWindowStartTime}", + "to": "{_QueryWindowEndTime}", + "timing": "daily" + } + }, + "response": { + "format": "json", + "eventsJsonPaths": [ + "$.entries" + ] + } + }, + "condition": "[[and(not(empty(parameters('Domain'))), not(equals(parameters('Domain'), 'Domain')))]" + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections6'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject1').parserTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SecurityScorecardIssue Data Parser with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject1').parserVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject1')._parserName1]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for SecurityScorecard Issues", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SecurityScorecardIssue", + "query": "let SecurityScorecardIssueLegacy = view () {\n SecurityScorecardIssues_CL\n | extend\n body_s = tostring(column_ifexists(\"body_s\", \"Issue\")),\n eventID_d = todouble(column_ifexists(\"eventID_d\", real(null))),\n Factor_s = tostring(column_ifexists(\"Factor_s\", \"\")),\n subject_s = tostring(column_ifexists(\"subject_s\", \"\")),\n date_s = tostring(column_ifexists(\"date_s\", \"\")),\n issueType_s = tostring(column_ifexists(\"issueType_s\", \"\")),\n issueName_s = tostring(column_ifexists(\"issueName_s\", \"\")),\n findingsCount_d = todouble(column_ifexists(\"findingsCount_d\", real(null))),\n groupStatus_s = tostring(column_ifexists(\"groupStatus_s\", \"\")),\n totalScoreImpact_d = todouble(column_ifexists(\"totalScoreImpact_d\", real(null))),\n severity_value_s = tostring(column_ifexists(\"severity_value_s\", \"\")),\n detail_url_s = tostring(column_ifexists(\"detail_url_s\", \"\")),\n ss_time_t = todatetime(column_ifexists(\"ss_time_t\", column_ifexists(\"ss_time_s\", \"\"))),\n industry_s = tostring(column_ifexists(\"industry_s\", \"\")),\n portfolioId_g = toguid(column_ifexists(\"portfolioId_s\", \"\")),\n portfolioName_s = tostring(column_ifexists(\"portfolioName_s\", \"\"))\n | project\n TimeGenerated,\n body_s,\n eventID_d,\n Factor_s,\n subject_s,\n date_s,\n issueType_s,\n issueName_s,\n findingsCount_d,\n groupStatus_s,\n totalScoreImpact_d,\n severity_value_s,\n detail_url_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nlet SecurityScorecardIssueCCF = view () {\n SecurityScorecardIssuesHistory_CL\n | where TimeGenerated > ago(365d)\n | summarize arg_max(TimeGenerated, *) by id, portfolio_id, domain, issue_date\n | extend\n body_s = \"Issue\",\n eventID_d = todouble(id),\n Factor_s = tostring(factor),\n subject_s = tostring(domain),\n date_s = tostring(issue_date),\n issueType_s = tostring(issue_type),\n issueName_s = strcat_array(split(tostring(issue_type), \"_\"), \" \"),\n findingsCount_d = todouble(issue_count),\n groupStatus_s = tostring(group_status),\n totalScoreImpact_d = todouble(total_score_impact),\n severity_value_s = tostring(severity),\n detail_url_s = tostring(detail_url),\n ss_time_t = todatetime(issue_date),\n industry_s = tostring(industry),\n portfolioId_g = toguid(portfolio_id),\n portfolioName_s = tostring(portfolio_name)\n | project\n TimeGenerated,\n body_s,\n eventID_d,\n Factor_s,\n subject_s,\n date_s,\n issueType_s,\n issueName_s,\n findingsCount_d,\n groupStatus_s,\n totalScoreImpact_d,\n severity_value_s,\n detail_url_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nunion isfuzzy=true SecurityScorecardIssueLegacy, SecurityScorecardIssueCCF\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", + "dependsOn": [ + "[variables('parserObject1')._parserId1]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardIssue')]", + "contentId": "[variables('parserObject1').parserContentId1]", + "kind": "Parser", + "version": "[variables('parserObject1').parserVersion1]", + "source": { + "name": "SecurityScorecard Cybersecurity Ratings", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject1').parserContentId1]", + "contentKind": "Parser", + "displayName": "Parser for SecurityScorecard Issues", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '2.0.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '2.0.3')))]", + "version": "[variables('parserObject1').parserVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject1')._parserName1]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for SecurityScorecard Issues", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SecurityScorecardIssue", + "query": "let SecurityScorecardIssueLegacy = view () {\n SecurityScorecardIssues_CL\n | extend\n body_s = tostring(column_ifexists(\"body_s\", \"Issue\")),\n eventID_d = todouble(column_ifexists(\"eventID_d\", real(null))),\n Factor_s = tostring(column_ifexists(\"Factor_s\", \"\")),\n subject_s = tostring(column_ifexists(\"subject_s\", \"\")),\n date_s = tostring(column_ifexists(\"date_s\", \"\")),\n issueType_s = tostring(column_ifexists(\"issueType_s\", \"\")),\n issueName_s = tostring(column_ifexists(\"issueName_s\", \"\")),\n findingsCount_d = todouble(column_ifexists(\"findingsCount_d\", real(null))),\n groupStatus_s = tostring(column_ifexists(\"groupStatus_s\", \"\")),\n totalScoreImpact_d = todouble(column_ifexists(\"totalScoreImpact_d\", real(null))),\n severity_value_s = tostring(column_ifexists(\"severity_value_s\", \"\")),\n detail_url_s = tostring(column_ifexists(\"detail_url_s\", \"\")),\n ss_time_t = todatetime(column_ifexists(\"ss_time_t\", column_ifexists(\"ss_time_s\", \"\"))),\n industry_s = tostring(column_ifexists(\"industry_s\", \"\")),\n portfolioId_g = toguid(column_ifexists(\"portfolioId_s\", \"\")),\n portfolioName_s = tostring(column_ifexists(\"portfolioName_s\", \"\"))\n | project\n TimeGenerated,\n body_s,\n eventID_d,\n Factor_s,\n subject_s,\n date_s,\n issueType_s,\n issueName_s,\n findingsCount_d,\n groupStatus_s,\n totalScoreImpact_d,\n severity_value_s,\n detail_url_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nlet SecurityScorecardIssueCCF = view () {\n SecurityScorecardIssuesHistory_CL\n | where TimeGenerated > ago(365d)\n | summarize arg_max(TimeGenerated, *) by id, portfolio_id, domain, issue_date\n | extend\n body_s = \"Issue\",\n eventID_d = todouble(id),\n Factor_s = tostring(factor),\n subject_s = tostring(domain),\n date_s = tostring(issue_date),\n issueType_s = tostring(issue_type),\n issueName_s = strcat_array(split(tostring(issue_type), \"_\"), \" \"),\n findingsCount_d = todouble(issue_count),\n groupStatus_s = tostring(group_status),\n totalScoreImpact_d = todouble(total_score_impact),\n severity_value_s = tostring(severity),\n detail_url_s = tostring(detail_url),\n ss_time_t = todatetime(issue_date),\n industry_s = tostring(industry),\n portfolioId_g = toguid(portfolio_id),\n portfolioName_s = tostring(portfolio_name)\n | project\n TimeGenerated,\n body_s,\n eventID_d,\n Factor_s,\n subject_s,\n date_s,\n issueType_s,\n issueName_s,\n findingsCount_d,\n groupStatus_s,\n totalScoreImpact_d,\n severity_value_s,\n detail_url_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nunion isfuzzy=true SecurityScorecardIssueLegacy, SecurityScorecardIssueCCF\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", + "dependsOn": [ + "[variables('parserObject1')._parserId1]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardIssue')]", + "contentId": "[variables('parserObject1').parserContentId1]", + "kind": "Parser", + "version": "[variables('parserObject1').parserVersion1]", + "source": { + "kind": "Solution", + "name": "SecurityScorecard Cybersecurity Ratings", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject2').parserTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SecurityScorecardRatings Data Parser with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject2').parserVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject2')._parserName2]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for SecurityScorecard Ratings (day-over-day overall score change)", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SecurityScorecardRatings", + "query": "let SecurityScorecardRatingsLegacy = view () {\n SecurityScorecardRatings_CL\n | extend\n body_s = tostring(column_ifexists(\"body_s\", \"OverAll\")),\n src_s = tostring(column_ifexists(\"src_s\", \"OverallScore\")),\n subject_s = tostring(column_ifexists(\"subject_s\", \"\")),\n dateYesterday_s = tostring(column_ifexists(\"dateYesterday_s\", \"\")),\n dateToday_s = tostring(column_ifexists(\"dateToday_s\", \"\")),\n scoreYesterday_d = todouble(column_ifexists(\"scoreYesterday_d\", real(null))),\n scoreToday_d = todouble(column_ifexists(\"scoreToday_d\", real(null))),\n scoreChange_d = todouble(column_ifexists(\"scoreChange_d\", real(null))),\n diff_d = todouble(column_ifexists(\"diff_d\", real(null))),\n ss_time_t = todatetime(column_ifexists(\"ss_time_t\", column_ifexists(\"ss_time_s\", \"\"))),\n industry_s = tostring(column_ifexists(\"industry_s\", \"\")),\n portfolioId_g = toguid(column_ifexists(\"portfolioId_s\", \"\")),\n portfolioName_s = tostring(column_ifexists(\"portfolioName_s\", \"NA\")),\n severity_s = tostring(column_ifexists(\"severity_s\", \"NA\"))\n | project\n TimeGenerated,\n body_s,\n src_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s,\n severity_s\n};\nlet SecurityScorecardRatingsCCF = view () {\n SecurityScorecardRatingsHistory_CL\n | where TimeGenerated > ago(365d)\n | summarize arg_max(TimeGenerated, *) by domain, score_date, portfolio_id\n | sort by domain asc, portfolio_id asc, score_date asc\n | serialize\n | extend\n prev_domain = prev(domain, 1),\n prev_portfolio = prev(portfolio_id, 1),\n prev_date = prev(score_date, 1),\n prev_score = prev(score, 1)\n | extend has_prev = (domain == prev_domain and portfolio_id == prev_portfolio)\n | extend\n body_s = \"OverAll\",\n src_s = \"OverallScore\",\n subject_s = domain,\n dateYesterday_s = iff(has_prev, tostring(prev_date), \"\"),\n dateToday_s = tostring(score_date),\n scoreYesterday_d = iff(has_prev, todouble(prev_score), real(null)),\n scoreToday_d = todouble(score),\n scoreChange_d = iff(has_prev, todouble(score - prev_score), real(null)),\n diff_d = iff(has_prev, todouble(score - prev_score), real(null)),\n ss_time_t = score_date,\n industry_s = tostring(industry),\n portfolioId_g = toguid(portfolio_id),\n portfolioName_s = tostring(portfolio_name),\n severity_s = \"NA\"\n | project\n TimeGenerated,\n body_s,\n src_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s,\n severity_s\n};\nunion isfuzzy=true SecurityScorecardRatingsLegacy, SecurityScorecardRatingsCCF\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", + "dependsOn": [ + "[variables('parserObject2')._parserId2]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardRatings')]", + "contentId": "[variables('parserObject2').parserContentId2]", + "kind": "Parser", + "version": "[variables('parserObject2').parserVersion2]", + "source": { + "name": "SecurityScorecard Cybersecurity Ratings", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject2').parserContentId2]", + "contentKind": "Parser", + "displayName": "Parser for SecurityScorecard Ratings (day-over-day overall score change)", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '2.0.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '2.0.3')))]", + "version": "[variables('parserObject2').parserVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject2')._parserName2]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for SecurityScorecard Ratings (day-over-day overall score change)", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SecurityScorecardRatings", + "query": "let SecurityScorecardRatingsLegacy = view () {\n SecurityScorecardRatings_CL\n | extend\n body_s = tostring(column_ifexists(\"body_s\", \"OverAll\")),\n src_s = tostring(column_ifexists(\"src_s\", \"OverallScore\")),\n subject_s = tostring(column_ifexists(\"subject_s\", \"\")),\n dateYesterday_s = tostring(column_ifexists(\"dateYesterday_s\", \"\")),\n dateToday_s = tostring(column_ifexists(\"dateToday_s\", \"\")),\n scoreYesterday_d = todouble(column_ifexists(\"scoreYesterday_d\", real(null))),\n scoreToday_d = todouble(column_ifexists(\"scoreToday_d\", real(null))),\n scoreChange_d = todouble(column_ifexists(\"scoreChange_d\", real(null))),\n diff_d = todouble(column_ifexists(\"diff_d\", real(null))),\n ss_time_t = todatetime(column_ifexists(\"ss_time_t\", column_ifexists(\"ss_time_s\", \"\"))),\n industry_s = tostring(column_ifexists(\"industry_s\", \"\")),\n portfolioId_g = toguid(column_ifexists(\"portfolioId_s\", \"\")),\n portfolioName_s = tostring(column_ifexists(\"portfolioName_s\", \"NA\")),\n severity_s = tostring(column_ifexists(\"severity_s\", \"NA\"))\n | project\n TimeGenerated,\n body_s,\n src_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s,\n severity_s\n};\nlet SecurityScorecardRatingsCCF = view () {\n SecurityScorecardRatingsHistory_CL\n | where TimeGenerated > ago(365d)\n | summarize arg_max(TimeGenerated, *) by domain, score_date, portfolio_id\n | sort by domain asc, portfolio_id asc, score_date asc\n | serialize\n | extend\n prev_domain = prev(domain, 1),\n prev_portfolio = prev(portfolio_id, 1),\n prev_date = prev(score_date, 1),\n prev_score = prev(score, 1)\n | extend has_prev = (domain == prev_domain and portfolio_id == prev_portfolio)\n | extend\n body_s = \"OverAll\",\n src_s = \"OverallScore\",\n subject_s = domain,\n dateYesterday_s = iff(has_prev, tostring(prev_date), \"\"),\n dateToday_s = tostring(score_date),\n scoreYesterday_d = iff(has_prev, todouble(prev_score), real(null)),\n scoreToday_d = todouble(score),\n scoreChange_d = iff(has_prev, todouble(score - prev_score), real(null)),\n diff_d = iff(has_prev, todouble(score - prev_score), real(null)),\n ss_time_t = score_date,\n industry_s = tostring(industry),\n portfolioId_g = toguid(portfolio_id),\n portfolioName_s = tostring(portfolio_name),\n severity_s = \"NA\"\n | project\n TimeGenerated,\n body_s,\n src_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s,\n severity_s\n};\nunion isfuzzy=true SecurityScorecardRatingsLegacy, SecurityScorecardRatingsCCF\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]", + "dependsOn": [ + "[variables('parserObject2')._parserId2]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardRatings')]", + "contentId": "[variables('parserObject2').parserContentId2]", + "kind": "Parser", + "version": "[variables('parserObject2').parserVersion2]", + "source": { + "kind": "Solution", + "name": "SecurityScorecard Cybersecurity Ratings", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject3').parserTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "SecurityScorecardFactor Data Parser with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject3').parserVersion3]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject3')._parserName3]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for SecurityScorecard Factor scores (day-over-day per-factor change with metadata)", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SecurityScorecardFactor", + "query": "let FactorMetadata = datatable(key:string, name:string, description:string) [\n \"application_security\", \"Application Security\", \"Detects common website application vulnerabilities and security issues.\",\n \"cubit_score\", \"Cubit Score\", \"Proprietary algorithms checking for implementation of security best practices.\",\n \"dns_health\", \"DNS Health\", \"Detects DNS misconfigurations and proper configuration of email security.\",\n \"endpoint_security\", \"Endpoint Security\", \"Detects measures used to protect employee workstations, laptops, mobile devices.\",\n \"hacker_chatter\", \"Hacker Chatter\", \"Monitors hacker forums and chat rooms for company mentions.\",\n \"ip_reputation\", \"IP Reputation\", \"Detects suspicious activity from company IP addresses, such as malware infections.\",\n \"leaked_information\", \"Information Leak\", \"Identifies if information leaks have occurred on internet sites.\",\n \"network_security\", \"Network Security\", \"Detects insecure network settings.\",\n \"patching_cadence\", \"Patching Cadence\", \"Analyzes how quickly a company reacts to vulnerabilities they may be exposed to.\",\n \"social_engineering\", \"Social Engineering\", \"Determines an organization's susceptibility to a targeted social engineering attack.\"\n];\nlet SecurityScorecardFactorLegacy = view () {\n SecurityScorecardFactor_CL\n | extend\n body_s = tostring(column_ifexists(\"body_s\", \"Factor\")),\n Factor_s = tostring(column_ifexists(\"Factor_s\", \"\")),\n Factor_Name_s = tostring(column_ifexists(\"Factor_Name_s\", \"Not Available\")),\n subject_s = tostring(column_ifexists(\"subject_s\", \"\")),\n dateYesterday_s = tostring(column_ifexists(\"dateYesterday_s\", \"\")),\n dateToday_s = tostring(column_ifexists(\"dateToday_s\", \"\")),\n scoreYesterday_d = todouble(column_ifexists(\"scoreYesterday_d\", real(null))),\n scoreToday_d = todouble(column_ifexists(\"scoreToday_d\", real(null))),\n scoreChange_d = todouble(column_ifexists(\"scoreChange_d\", real(null))),\n diff_d = todouble(column_ifexists(\"diff_d\", real(null))),\n factorDescription_s = tostring(column_ifexists(\"factorDescription_s\", \"data is not there\")),\n ss_time_t = todatetime(column_ifexists(\"ss_time_t\", column_ifexists(\"ss_time_s\", \"\"))),\n industry_s = tostring(column_ifexists(\"industry_s\", \"\")),\n portfolioId_g = toguid(column_ifexists(\"portfolioId_s\", \"\")),\n portfolioName_s = tostring(column_ifexists(\"portfolioName_s\", \"NA\"))\n | project\n TimeGenerated,\n body_s,\n Factor_s,\n Factor_Name_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n factorDescription_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nlet SecurityScorecardFactorCCF = view () {\n SecurityScorecardFactorHistory_CL\n | where TimeGenerated > ago(365d)\n | mv-expand factor = factors\n | extend\n factor_name = tostring(factor[\"name\"]),\n factor_score = toreal(factor[\"score\"])\n | summarize arg_max(TimeGenerated, *) by domain, factor_name, score_date, portfolio_id\n | sort by domain asc, factor_name asc, portfolio_id asc, score_date asc\n | serialize\n | extend\n prev_domain = prev(domain, 1),\n prev_factor = prev(factor_name, 1),\n prev_portfolio = prev(portfolio_id, 1),\n prev_date = prev(score_date, 1),\n prev_score = prev(factor_score, 1)\n | extend has_prev = (domain == prev_domain and factor_name == prev_factor and portfolio_id == prev_portfolio)\n | lookup kind=leftouter FactorMetadata on $left.factor_name == $right.key\n | extend\n body_s = \"Factor\",\n Factor_s = factor_name,\n Factor_Name_s = coalesce(name, \"Not Available\"),\n subject_s = domain,\n dateYesterday_s = iff(has_prev, tostring(prev_date), \"\"),\n dateToday_s = tostring(score_date),\n scoreYesterday_d = iff(has_prev, todouble(prev_score), real(null)),\n scoreToday_d = todouble(factor_score),\n scoreChange_d = iff(has_prev, todouble(factor_score - prev_score), real(null)),\n diff_d = iff(has_prev, todouble(factor_score - prev_score), real(null)),\n factorDescription_s = coalesce(description, \"data is not there\"),\n ss_time_t = score_date,\n industry_s = tostring(industry),\n portfolioId_g = toguid(portfolio_id),\n portfolioName_s = tostring(portfolio_name)\n | project\n TimeGenerated,\n body_s,\n Factor_s,\n Factor_Name_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n factorDescription_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nunion isfuzzy=true SecurityScorecardFactorLegacy, SecurityScorecardFactorCCF\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject3')._parserId3,'/'))))]", + "dependsOn": [ + "[variables('parserObject3')._parserId3]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardFactor')]", + "contentId": "[variables('parserObject3').parserContentId3]", + "kind": "Parser", + "version": "[variables('parserObject3').parserVersion3]", + "source": { + "name": "SecurityScorecard Cybersecurity Ratings", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject3').parserContentId3]", + "contentKind": "Parser", + "displayName": "Parser for SecurityScorecard Factor scores (day-over-day per-factor change with metadata)", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '2.0.3')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject3').parserContentId3,'-', '2.0.3')))]", + "version": "[variables('parserObject3').parserVersion3]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject3')._parserName3]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for SecurityScorecard Factor scores (day-over-day per-factor change with metadata)", + "category": "Microsoft Sentinel Parser", + "functionAlias": "SecurityScorecardFactor", + "query": "let FactorMetadata = datatable(key:string, name:string, description:string) [\n \"application_security\", \"Application Security\", \"Detects common website application vulnerabilities and security issues.\",\n \"cubit_score\", \"Cubit Score\", \"Proprietary algorithms checking for implementation of security best practices.\",\n \"dns_health\", \"DNS Health\", \"Detects DNS misconfigurations and proper configuration of email security.\",\n \"endpoint_security\", \"Endpoint Security\", \"Detects measures used to protect employee workstations, laptops, mobile devices.\",\n \"hacker_chatter\", \"Hacker Chatter\", \"Monitors hacker forums and chat rooms for company mentions.\",\n \"ip_reputation\", \"IP Reputation\", \"Detects suspicious activity from company IP addresses, such as malware infections.\",\n \"leaked_information\", \"Information Leak\", \"Identifies if information leaks have occurred on internet sites.\",\n \"network_security\", \"Network Security\", \"Detects insecure network settings.\",\n \"patching_cadence\", \"Patching Cadence\", \"Analyzes how quickly a company reacts to vulnerabilities they may be exposed to.\",\n \"social_engineering\", \"Social Engineering\", \"Determines an organization's susceptibility to a targeted social engineering attack.\"\n];\nlet SecurityScorecardFactorLegacy = view () {\n SecurityScorecardFactor_CL\n | extend\n body_s = tostring(column_ifexists(\"body_s\", \"Factor\")),\n Factor_s = tostring(column_ifexists(\"Factor_s\", \"\")),\n Factor_Name_s = tostring(column_ifexists(\"Factor_Name_s\", \"Not Available\")),\n subject_s = tostring(column_ifexists(\"subject_s\", \"\")),\n dateYesterday_s = tostring(column_ifexists(\"dateYesterday_s\", \"\")),\n dateToday_s = tostring(column_ifexists(\"dateToday_s\", \"\")),\n scoreYesterday_d = todouble(column_ifexists(\"scoreYesterday_d\", real(null))),\n scoreToday_d = todouble(column_ifexists(\"scoreToday_d\", real(null))),\n scoreChange_d = todouble(column_ifexists(\"scoreChange_d\", real(null))),\n diff_d = todouble(column_ifexists(\"diff_d\", real(null))),\n factorDescription_s = tostring(column_ifexists(\"factorDescription_s\", \"data is not there\")),\n ss_time_t = todatetime(column_ifexists(\"ss_time_t\", column_ifexists(\"ss_time_s\", \"\"))),\n industry_s = tostring(column_ifexists(\"industry_s\", \"\")),\n portfolioId_g = toguid(column_ifexists(\"portfolioId_s\", \"\")),\n portfolioName_s = tostring(column_ifexists(\"portfolioName_s\", \"NA\"))\n | project\n TimeGenerated,\n body_s,\n Factor_s,\n Factor_Name_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n factorDescription_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nlet SecurityScorecardFactorCCF = view () {\n SecurityScorecardFactorHistory_CL\n | where TimeGenerated > ago(365d)\n | mv-expand factor = factors\n | extend\n factor_name = tostring(factor[\"name\"]),\n factor_score = toreal(factor[\"score\"])\n | summarize arg_max(TimeGenerated, *) by domain, factor_name, score_date, portfolio_id\n | sort by domain asc, factor_name asc, portfolio_id asc, score_date asc\n | serialize\n | extend\n prev_domain = prev(domain, 1),\n prev_factor = prev(factor_name, 1),\n prev_portfolio = prev(portfolio_id, 1),\n prev_date = prev(score_date, 1),\n prev_score = prev(factor_score, 1)\n | extend has_prev = (domain == prev_domain and factor_name == prev_factor and portfolio_id == prev_portfolio)\n | lookup kind=leftouter FactorMetadata on $left.factor_name == $right.key\n | extend\n body_s = \"Factor\",\n Factor_s = factor_name,\n Factor_Name_s = coalesce(name, \"Not Available\"),\n subject_s = domain,\n dateYesterday_s = iff(has_prev, tostring(prev_date), \"\"),\n dateToday_s = tostring(score_date),\n scoreYesterday_d = iff(has_prev, todouble(prev_score), real(null)),\n scoreToday_d = todouble(factor_score),\n scoreChange_d = iff(has_prev, todouble(factor_score - prev_score), real(null)),\n diff_d = iff(has_prev, todouble(factor_score - prev_score), real(null)),\n factorDescription_s = coalesce(description, \"data is not there\"),\n ss_time_t = score_date,\n industry_s = tostring(industry),\n portfolioId_g = toguid(portfolio_id),\n portfolioName_s = tostring(portfolio_name)\n | project\n TimeGenerated,\n body_s,\n Factor_s,\n Factor_Name_s,\n subject_s,\n dateYesterday_s,\n dateToday_s,\n scoreYesterday_d,\n scoreToday_d,\n scoreChange_d,\n diff_d,\n factorDescription_s,\n ss_time_t,\n industry_s,\n portfolioId_g,\n portfolioName_s\n};\nunion isfuzzy=true SecurityScorecardFactorLegacy, SecurityScorecardFactorCCF\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject3')._parserId3,'/'))))]", + "dependsOn": [ + "[variables('parserObject3')._parserId3]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'SecurityScorecardFactor')]", + "contentId": "[variables('parserObject3').parserContentId3]", + "kind": "Parser", + "version": "[variables('parserObject3').parserVersion3]", + "source": { + "kind": "Solution", + "name": "SecurityScorecard Cybersecurity Ratings", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "SecurityScorecard Cybersecurity Ratings", + "publisherDisplayName": "SecurityScorecard", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

This package includes three Codeless Connector Framework (CCF) data connectors, three KQL parsers, and an associated workbook for the SecurityScorecard offering within Microsoft Sentinel. The CCF connectors ingest 11 company scores from SecurityScorecard (overall score and 10 factor scores) as well as new issue events without requiring an Azure Function deployment. The legacy Function App connectors are retained but marked Deprecated.

\n

Data Connectors: 6, Parsers: 3, Workbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "SecurityScorecard Cybersecurity Ratings", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "SecurityScorecard", + "email": "[variables('_email')]" + }, + "support": { + "name": "SecurityScorecard", + "email": "support@securityscorecard.io", + "tier": "Partner", + "link": "https://support.securityscorecard.com/hc/en-us/requests/new" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId3')]", + "version": "[variables('dataConnectorVersion3')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections4')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections5')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject2').parserContentId2]", + "version": "[variables('parserObject2').parserVersion2]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject3').parserContentId3]", + "version": "[variables('parserObject3').parserVersion3]" } ] }, @@ -1292,7 +4315,7 @@ ], "categories": { "domains": [ - "Security", + "Security - Others", "Security - Network", "Security - Vulnerability Management" ] diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Package/testParameters.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/testParameters.json new file mode 100644 index 00000000000..537f125258d --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Package/testParameters.json @@ -0,0 +1,46 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "SecurityScorecard", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + } +} diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardFactor.yaml b/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardFactor.yaml new file mode 100644 index 00000000000..6495f08c8a1 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardFactor.yaml @@ -0,0 +1,110 @@ +id: ee795930-e709-48fc-9fa7-d67708a3eeb5 +Function: + Title: Parser for SecurityScorecard Factor scores (day-over-day per-factor change with metadata) + Version: '2.0.3' + LastUpdated: '2026-06-26' +Category: Microsoft Sentinel Parser +FunctionName: SecurityScorecardFactor +FunctionAlias: SecurityScorecardFactor +FunctionQuery: | + let FactorMetadata = datatable(key:string, name:string, description:string) [ + "application_security", "Application Security", "Detects common website application vulnerabilities and security issues.", + "cubit_score", "Cubit Score", "Proprietary algorithms checking for implementation of security best practices.", + "dns_health", "DNS Health", "Detects DNS misconfigurations and proper configuration of email security.", + "endpoint_security", "Endpoint Security", "Detects measures used to protect employee workstations, laptops, mobile devices.", + "hacker_chatter", "Hacker Chatter", "Monitors hacker forums and chat rooms for company mentions.", + "ip_reputation", "IP Reputation", "Detects suspicious activity from company IP addresses, such as malware infections.", + "leaked_information", "Information Leak", "Identifies if information leaks have occurred on internet sites.", + "network_security", "Network Security", "Detects insecure network settings.", + "patching_cadence", "Patching Cadence", "Analyzes how quickly a company reacts to vulnerabilities they may be exposed to.", + "social_engineering", "Social Engineering", "Determines an organization's susceptibility to a targeted social engineering attack." + ]; + let SecurityScorecardFactorLegacy = view () { + SecurityScorecardFactor_CL + | extend + body_s = tostring(column_ifexists("body_s", "Factor")), + Factor_s = tostring(column_ifexists("Factor_s", "")), + Factor_Name_s = tostring(column_ifexists("Factor_Name_s", "Not Available")), + subject_s = tostring(column_ifexists("subject_s", "")), + dateYesterday_s = tostring(column_ifexists("dateYesterday_s", "")), + dateToday_s = tostring(column_ifexists("dateToday_s", "")), + scoreYesterday_d = todouble(column_ifexists("scoreYesterday_d", real(null))), + scoreToday_d = todouble(column_ifexists("scoreToday_d", real(null))), + scoreChange_d = todouble(column_ifexists("scoreChange_d", real(null))), + diff_d = todouble(column_ifexists("diff_d", real(null))), + factorDescription_s = tostring(column_ifexists("factorDescription_s", "data is not there")), + ss_time_t = todatetime(column_ifexists("ss_time_t", column_ifexists("ss_time_s", ""))), + industry_s = tostring(column_ifexists("industry_s", "")), + portfolioId_g = toguid(column_ifexists("portfolioId_s", "")), + portfolioName_s = tostring(column_ifexists("portfolioName_s", "NA")) + | project + TimeGenerated, + body_s, + Factor_s, + Factor_Name_s, + subject_s, + dateYesterday_s, + dateToday_s, + scoreYesterday_d, + scoreToday_d, + scoreChange_d, + diff_d, + factorDescription_s, + ss_time_t, + industry_s, + portfolioId_g, + portfolioName_s + }; + let SecurityScorecardFactorCCF = view () { + SecurityScorecardFactorHistory_CL + | where TimeGenerated > ago(365d) + | mv-expand factor = factors + | extend + factor_name = tostring(factor["name"]), + factor_score = toreal(factor["score"]) + | summarize arg_max(TimeGenerated, *) by domain, factor_name, score_date, portfolio_id + | sort by domain asc, factor_name asc, portfolio_id asc, score_date asc + | serialize + | extend + prev_domain = prev(domain, 1), + prev_factor = prev(factor_name, 1), + prev_portfolio = prev(portfolio_id, 1), + prev_date = prev(score_date, 1), + prev_score = prev(factor_score, 1) + | extend has_prev = (domain == prev_domain and factor_name == prev_factor and portfolio_id == prev_portfolio) + | lookup kind=leftouter FactorMetadata on $left.factor_name == $right.key + | extend + body_s = "Factor", + Factor_s = factor_name, + Factor_Name_s = coalesce(name, "Not Available"), + subject_s = domain, + dateYesterday_s = iff(has_prev, tostring(prev_date), ""), + dateToday_s = tostring(score_date), + scoreYesterday_d = iff(has_prev, todouble(prev_score), real(null)), + scoreToday_d = todouble(factor_score), + scoreChange_d = iff(has_prev, todouble(factor_score - prev_score), real(null)), + diff_d = iff(has_prev, todouble(factor_score - prev_score), real(null)), + factorDescription_s = coalesce(description, "data is not there"), + ss_time_t = score_date, + industry_s = tostring(industry), + portfolioId_g = toguid(portfolio_id), + portfolioName_s = tostring(portfolio_name) + | project + TimeGenerated, + body_s, + Factor_s, + Factor_Name_s, + subject_s, + dateYesterday_s, + dateToday_s, + scoreYesterday_d, + scoreToday_d, + scoreChange_d, + diff_d, + factorDescription_s, + ss_time_t, + industry_s, + portfolioId_g, + portfolioName_s + }; + union isfuzzy=true SecurityScorecardFactorLegacy, SecurityScorecardFactorCCF diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardIssue.yaml b/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardIssue.yaml new file mode 100644 index 00000000000..42ad496c7ac --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardIssue.yaml @@ -0,0 +1,88 @@ +id: 5e71c965-6875-4348-b98e-5ba38186be2e +Function: + Title: Parser for SecurityScorecard Issues + Version: '2.0.3' + LastUpdated: '2026-06-26' +Category: Microsoft Sentinel Parser +FunctionName: SecurityScorecardIssue +FunctionAlias: SecurityScorecardIssue +FunctionQuery: | + let SecurityScorecardIssueLegacy = view () { + SecurityScorecardIssues_CL + | extend + body_s = tostring(column_ifexists("body_s", "Issue")), + eventID_d = todouble(column_ifexists("eventID_d", real(null))), + Factor_s = tostring(column_ifexists("Factor_s", "")), + subject_s = tostring(column_ifexists("subject_s", "")), + date_s = tostring(column_ifexists("date_s", "")), + issueType_s = tostring(column_ifexists("issueType_s", "")), + issueName_s = tostring(column_ifexists("issueName_s", "")), + findingsCount_d = todouble(column_ifexists("findingsCount_d", real(null))), + groupStatus_s = tostring(column_ifexists("groupStatus_s", "")), + totalScoreImpact_d = todouble(column_ifexists("totalScoreImpact_d", real(null))), + severity_value_s = tostring(column_ifexists("severity_value_s", "")), + detail_url_s = tostring(column_ifexists("detail_url_s", "")), + ss_time_t = todatetime(column_ifexists("ss_time_t", column_ifexists("ss_time_s", ""))), + industry_s = tostring(column_ifexists("industry_s", "")), + portfolioId_g = toguid(column_ifexists("portfolioId_s", "")), + portfolioName_s = tostring(column_ifexists("portfolioName_s", "")) + | project + TimeGenerated, + body_s, + eventID_d, + Factor_s, + subject_s, + date_s, + issueType_s, + issueName_s, + findingsCount_d, + groupStatus_s, + totalScoreImpact_d, + severity_value_s, + detail_url_s, + ss_time_t, + industry_s, + portfolioId_g, + portfolioName_s + }; + let SecurityScorecardIssueCCF = view () { + SecurityScorecardIssuesHistory_CL + | where TimeGenerated > ago(365d) + | summarize arg_max(TimeGenerated, *) by id, portfolio_id, domain, issue_date + | extend + body_s = "Issue", + eventID_d = todouble(id), + Factor_s = tostring(factor), + subject_s = tostring(domain), + date_s = tostring(issue_date), + issueType_s = tostring(issue_type), + issueName_s = strcat_array(split(tostring(issue_type), "_"), " "), + findingsCount_d = todouble(issue_count), + groupStatus_s = tostring(group_status), + totalScoreImpact_d = todouble(total_score_impact), + severity_value_s = tostring(severity), + detail_url_s = tostring(detail_url), + ss_time_t = todatetime(issue_date), + industry_s = tostring(industry), + portfolioId_g = toguid(portfolio_id), + portfolioName_s = tostring(portfolio_name) + | project + TimeGenerated, + body_s, + eventID_d, + Factor_s, + subject_s, + date_s, + issueType_s, + issueName_s, + findingsCount_d, + groupStatus_s, + totalScoreImpact_d, + severity_value_s, + detail_url_s, + ss_time_t, + industry_s, + portfolioId_g, + portfolioName_s + }; + union isfuzzy=true SecurityScorecardIssueLegacy, SecurityScorecardIssueCCF diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardRatings.yaml b/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardRatings.yaml new file mode 100644 index 00000000000..f5f49d355f2 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Parsers/SecurityScorecardRatings.yaml @@ -0,0 +1,88 @@ +id: d45021a4-1e09-4246-9739-1c37738df1aa +Function: + Title: Parser for SecurityScorecard Ratings (day-over-day overall score change) + Version: '2.0.3' + LastUpdated: '2026-06-26' +Category: Microsoft Sentinel Parser +FunctionName: SecurityScorecardRatings +FunctionAlias: SecurityScorecardRatings +FunctionQuery: | + let SecurityScorecardRatingsLegacy = view () { + SecurityScorecardRatings_CL + | extend + body_s = tostring(column_ifexists("body_s", "OverAll")), + src_s = tostring(column_ifexists("src_s", "OverallScore")), + subject_s = tostring(column_ifexists("subject_s", "")), + dateYesterday_s = tostring(column_ifexists("dateYesterday_s", "")), + dateToday_s = tostring(column_ifexists("dateToday_s", "")), + scoreYesterday_d = todouble(column_ifexists("scoreYesterday_d", real(null))), + scoreToday_d = todouble(column_ifexists("scoreToday_d", real(null))), + scoreChange_d = todouble(column_ifexists("scoreChange_d", real(null))), + diff_d = todouble(column_ifexists("diff_d", real(null))), + ss_time_t = todatetime(column_ifexists("ss_time_t", column_ifexists("ss_time_s", ""))), + industry_s = tostring(column_ifexists("industry_s", "")), + portfolioId_g = toguid(column_ifexists("portfolioId_s", "")), + portfolioName_s = tostring(column_ifexists("portfolioName_s", "NA")), + severity_s = tostring(column_ifexists("severity_s", "NA")) + | project + TimeGenerated, + body_s, + src_s, + subject_s, + dateYesterday_s, + dateToday_s, + scoreYesterday_d, + scoreToday_d, + scoreChange_d, + diff_d, + ss_time_t, + industry_s, + portfolioId_g, + portfolioName_s, + severity_s + }; + let SecurityScorecardRatingsCCF = view () { + SecurityScorecardRatingsHistory_CL + | where TimeGenerated > ago(365d) + | summarize arg_max(TimeGenerated, *) by domain, score_date, portfolio_id + | sort by domain asc, portfolio_id asc, score_date asc + | serialize + | extend + prev_domain = prev(domain, 1), + prev_portfolio = prev(portfolio_id, 1), + prev_date = prev(score_date, 1), + prev_score = prev(score, 1) + | extend has_prev = (domain == prev_domain and portfolio_id == prev_portfolio) + | extend + body_s = "OverAll", + src_s = "OverallScore", + subject_s = domain, + dateYesterday_s = iff(has_prev, tostring(prev_date), ""), + dateToday_s = tostring(score_date), + scoreYesterday_d = iff(has_prev, todouble(prev_score), real(null)), + scoreToday_d = todouble(score), + scoreChange_d = iff(has_prev, todouble(score - prev_score), real(null)), + diff_d = iff(has_prev, todouble(score - prev_score), real(null)), + ss_time_t = score_date, + industry_s = tostring(industry), + portfolioId_g = toguid(portfolio_id), + portfolioName_s = tostring(portfolio_name), + severity_s = "NA" + | project + TimeGenerated, + body_s, + src_s, + subject_s, + dateYesterday_s, + dateToday_s, + scoreYesterday_d, + scoreToday_d, + scoreChange_d, + diff_d, + ss_time_t, + industry_s, + portfolioId_g, + portfolioName_s, + severity_s + }; + union isfuzzy=true SecurityScorecardRatingsLegacy, SecurityScorecardRatingsCCF diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/ReleaseNotes.md b/Solutions/SecurityScorecard Cybersecurity Ratings/ReleaseNotes.md new file mode 100644 index 00000000000..87dc24de922 --- /dev/null +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/ReleaseNotes.md @@ -0,0 +1,4 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------------------------------------------------------------------| +| 3.0.0 | 28-07-2026 | Migrated the SecurityScorecard Ratings, Factor, and Issue data connectors to the Codeless Connector Framework (CCF) with multi-instance support and Azure Function feature parity: each connector uses a DataConnectorsGrid + ContextPane for one independently-managed connection per portfolio (scoped server-side by Portfolio ID), an optional own-company "My Scorecard" domain, real dated score/factor/issue history, and company industry enrichment. Deprecated the Python Function App connectors; added KQL parsers unifying legacy (`*_CL`) and CCF (`*History_CL`) data; and updated the workbook. | +| 2.0.0 | 01-10-2022 | Solution release with three Azure Function App data connectors (Ratings, Factor, Issue) and the SecurityScorecard workbook. | diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/SolutionMetadata.json b/Solutions/SecurityScorecard Cybersecurity Ratings/SolutionMetadata.json index 51f4861f2e1..5df9bc8c4e4 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/SolutionMetadata.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/SolutionMetadata.json @@ -1,11 +1,11 @@ { - "publisherId": "SecurityScorecard", - "offerId": "SecurityScorecard", + "publisherId": "securityscorecard", + "offerId": "securityscorecard", "firstPublishDate": "2022-10-01", "lastPublishDate": "2022-10-01", "providers": ["SecurityScorecard"], "categories": { - "domains" : ["Security", "Security - Network", "Security - Vulnerability Management"] + "domains" : ["Security - Others", "Security - Network", "Security - Vulnerability Management"] }, "support": { "name": "SecurityScorecard", diff --git a/Solutions/SecurityScorecard Cybersecurity Ratings/Workbooks/SecurityScorecardWorkbook.json b/Solutions/SecurityScorecard Cybersecurity Ratings/Workbooks/SecurityScorecardWorkbook.json index 57ab68a078d..f5c86c1c1e4 100644 --- a/Solutions/SecurityScorecard Cybersecurity Ratings/Workbooks/SecurityScorecardWorkbook.json +++ b/Solutions/SecurityScorecard Cybersecurity Ratings/Workbooks/SecurityScorecardWorkbook.json @@ -115,7 +115,7 @@ "durationMs": 43200000 }, { - "durationMs": 86400000 + "durationMs": 2592000000 }, { "durationMs": 172800000 @@ -145,7 +145,7 @@ "allowCustom": true }, "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 } } ], @@ -165,17 +165,16 @@ "id": "ac778abc-2101-4e66-92da-d11d4b4a8629", "version": "KqlParameterItem/1.0", "name": "Domain", - "type": 1, - "description": "Provide your company name", - "isRequired": true, - "query": "SecurityScorecardRatings_CL\r\n| where portfolioName_s == \"NA\"\r\n| distinct subject_s\r\n| limit 1", + "type": 2, + "description": "Your own company domain (My Scorecard). Vendor pages list everyone except this company.", + "isRequired": false, + "query": "SecurityScorecardRatings\r\n| where portfolioName_s in ('NA', 'My Scorecard')\r\n| distinct subject_s\r\n| sort by subject_s asc", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "value": "cisco.com" + "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", @@ -196,7 +195,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardRatings_CL\r\n| where body_s == 'OverAll' and subject_s == '{Domain}'\r\n| summarize arg_max(ingestion_time(),*)\r\n| extend gradeToday = case((scoreToday_d>=90), \"A\",(scoreToday_d>=80 and scoreToday_d<=89), \"B\",(scoreToday_d>=70 and scoreToday_d<=79), \"C\",(scoreToday_d>=60 and scoreToday_d<=69), \"D\",isempty(scoreToday_d),\"\",\"F\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \r\n| project gradeToday, scoreToday_d, Details", + "query": "SecurityScorecardRatings\r\n| where body_s == 'OverAll' and subject_s == '{Domain}'\r\n| summarize arg_max(TimeGenerated,*)\r\n| extend gradeToday = case((scoreToday_d>=90), \"A\",(scoreToday_d>=80 and scoreToday_d<=89), \"B\",(scoreToday_d>=70 and scoreToday_d<=79), \"C\",(scoreToday_d>=60 and scoreToday_d<=69), \"D\",isempty(scoreToday_d),\"\",\"F\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \r\n| project gradeToday, scoreToday_d, Details", "size": 4, "showAnalytics": true, "timeContextFromParameter": "Timer", @@ -286,7 +285,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardRatings_CL\r\n| where body_s == 'OverAll' and subject_s == '{Domain}'\r\n| summarize arg_max(ingestion_time(), *) by subject_s \r\n| extend Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \r\n| project scoreToday_d, subject_s, Details\r\n| limit 1", + "query": "SecurityScorecardRatings\r\n| where body_s == 'OverAll' and subject_s == '{Domain}'\r\n| summarize arg_max(TimeGenerated, *) by subject_s \r\n| extend Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \r\n| project scoreToday_d, subject_s, Details\r\n| limit 1", "size": 4, "showAnalytics": true, "timeContextFromParameter": "Timer", @@ -376,7 +375,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardRatings_CL\r\n| where body_s == 'OverAll'and subject_s == '{Domain}'\r\n| project-rename Date = dateToday_s , Score = scoreToday_d \r\n| summarize arg_max(ingestion_time(), *) by Date \r\n| project Date=format_datetime(todatetime(Date), 'yyyy-MM-dd'), Score\r\n| sort by Date asc\r\n| limit 10", + "query": "SecurityScorecardRatings\r\n| where body_s == 'OverAll'and subject_s == '{Domain}'\r\n| project-rename Date = dateToday_s , Score = scoreToday_d \r\n| summarize arg_max(TimeGenerated, *) by Date \r\n| project Date=format_datetime(todatetime(Date), 'yyyy-MM-dd'), Score\r\n| sort by Date asc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Score Trend", @@ -412,7 +411,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardFactor_CL\r\n| where body_s == 'Factor' and subject_s == '{Domain}'\r\n| summarize arg_max(ingestion_time(),*) by dateToday_s, factorDescription_s\r\n| summarize arg_max(dateToday_s,*) by factorDescription_s\r\n| extend gradeToday=case((scoreToday_d >= 90),\"A\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\"B\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\"C\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\"D\",\"F\"), gradeYesterday=case((scoreYesterday_d >= 90),\"A\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\"B\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\"C\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\"D\",\"F\") \r\n| project Factor_Name_s, factorDescription_s, gradeToday, scoreToday_d, scoreChange_d, gradeYesterday, scoreYesterday_d, dateToday_s \r\n| project-rename Description =factorDescription_s, [\"Current Grade\"] = gradeToday, [\"Current Score\"] = scoreToday_d, [\"Latest Score Change\"] = scoreChange_d, [\"Last Updated Grade\"] = gradeYesterday, [\"Last Updated Score\"] = scoreYesterday_d, [\"Date of Current Score\"] = dateToday_s, Factor = Factor_Name_s ", + "query": "SecurityScorecardFactor\r\n| where body_s == 'Factor' and subject_s == '{Domain}'\r\n| summarize arg_max(TimeGenerated,*) by dateToday_s, factorDescription_s\r\n| summarize arg_max(dateToday_s,*) by factorDescription_s\r\n| extend gradeToday=case((scoreToday_d >= 90),\"A\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\"B\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\"C\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\"D\",\"F\"), gradeYesterday=case((scoreYesterday_d >= 90),\"A\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\"B\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\"C\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\"D\",\"F\") \r\n| project Factor_Name_s, factorDescription_s, gradeToday, scoreToday_d, scoreChange_d, gradeYesterday, scoreYesterday_d, dateToday_s \r\n| project-rename Description =factorDescription_s, [\"Current Grade\"] = gradeToday, [\"Current Score\"] = scoreToday_d, [\"Latest Score Change\"] = scoreChange_d, [\"Last Updated Grade\"] = gradeYesterday, [\"Last Updated Score\"] = scoreYesterday_d, [\"Date of Current Score\"] = dateToday_s, Factor = Factor_Name_s ", "size": 0, "showAnalytics": true, "title": "My Scorecard Factors", @@ -623,7 +622,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where subject_s == '{Domain}'\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend Factor=strcat_array(split(Factor_s,\"_\"),\" \") \r\n| summarize [\"Issue Count\"]= count() by Factor ", + "query": "SecurityScorecardIssue\r\n| where subject_s == '{Domain}'\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend Factor=strcat_array(split(Factor_s,\"_\"),\" \") \r\n| summarize [\"Issue Count\"]= count() by Factor ", "size": 0, "showAnalytics": true, "title": "Issue Count by Factor", @@ -645,7 +644,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where subject_s == '{Domain}'\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend issue_name=strcat_array(split(issueType_s,\"_\"),\" \"), serverity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5)\r\n| summarize count() by severity_value_s, serverity_priority\r\n| sort by serverity_priority asc\r\n| project-away serverity_priority\r\n| render barchart\r\n", + "query": "SecurityScorecardIssue\r\n| where subject_s == '{Domain}'\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend issue_name=strcat_array(split(issueType_s,\"_\"),\" \"), serverity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5)\r\n| summarize count() by severity_value_s, serverity_priority\r\n| sort by serverity_priority asc\r\n| project-away serverity_priority\r\n| render barchart\r\n", "size": 0, "title": "Issue Types by Severity", "timeContextFromParameter": "Timer", @@ -772,7 +771,7 @@ "durationMs": 43200000 }, { - "durationMs": 86400000 + "durationMs": 2592000000 }, { "durationMs": 172800000 @@ -802,7 +801,7 @@ "allowCustom": true }, "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 }, "value": { "durationMs": 604800000 @@ -825,17 +824,16 @@ "id": "72d22203-f3dd-4557-9605-5b6ca4a4e6c0", "version": "KqlParameterItem/1.0", "name": "Domain", - "type": 1, - "description": "Provide your company name", - "isRequired": true, - "query": "SecurityScorecardRatings_CL\r\n| where portfolioName_s == \"NA\"\r\n| distinct subject_s\r\n| limit 1", + "type": 2, + "description": "Your own company domain (My Scorecard). Vendor pages list everyone except this company.", + "isRequired": false, + "query": "SecurityScorecardRatings\r\n| where portfolioName_s in ('NA', 'My Scorecard')\r\n| distinct subject_s\r\n| sort by subject_s asc", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "value": "cisco.com" + "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", @@ -859,7 +857,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardRatings_CL\r\n| where isnotempty(portfolioId_g)\r\n| distinct portfolioName_s", + "query": "SecurityScorecardRatings\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -897,7 +895,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardRatings_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", + "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -935,7 +933,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardRatings_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", + "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -970,7 +968,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardRatings_CL\r\n| where body_s == \"OverAll\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and subject_s != '{Domain}'\r\n| summarize arg_max(ingestion_time(), *) by dateToday_s, subject_s, portfolioName_s\r\n| summarize arg_max(dateToday_s, *) by subject_s, portfolioName_s \r\n| extend [\"Current Grade\"]=case((scoreToday_d >= 90),\"A\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\"B\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\"C\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\"D\",\"F\"), [\"Last Updated Grade\"]=case((scoreYesterday_d >= 90),\"A\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\"B\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\"C\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\"D\",\"F\"), Industry=strcat_array(split(industry_s,\"_\"),\" \"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors')\r\n| project subject_s, portfolioName_s, Industry, [\"Date of Current Score\"] = format_datetime(todatetime(dateToday_s), 'yyyy-MM-dd'), scoreToday_d, [\"Current Grade\"], scoreYesterday_d, ['Last Updated Grade'], Details \r\n| project-rename Company = subject_s , [\"Current Score\"] = scoreToday_d, [\"Last Updated Score\"] = scoreYesterday_d \r\n| sort by Company asc, portfolioName_s asc", + "query": "SecurityScorecardRatings\r\n| where body_s == \"OverAll\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and subject_s != '{Domain}'\r\n| summarize arg_max(TimeGenerated, *) by dateToday_s, subject_s, portfolioName_s\r\n| summarize arg_max(dateToday_s, *) by subject_s, portfolioName_s \r\n| extend [\"Current Grade\"]=case((scoreToday_d >= 90),\"A\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\"B\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\"C\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\"D\",\"F\"), [\"Last Updated Grade\"]=case((scoreYesterday_d >= 90),\"A\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\"B\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\"C\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\"D\",\"F\"), Industry=strcat_array(split(industry_s,\"_\"),\" \"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors')\r\n| project subject_s, portfolioName_s, Industry, [\"Date of Current Score\"] = format_datetime(todatetime(dateToday_s), 'yyyy-MM-dd'), scoreToday_d, [\"Current Grade\"], scoreYesterday_d, ['Last Updated Grade'], Details \r\n| project-rename Company = subject_s , [\"Current Score\"] = scoreToday_d, [\"Last Updated Score\"] = scoreYesterday_d \r\n| sort by Company asc, portfolioName_s asc", "size": 0, "showAnalytics": true, "title": "Top Level Grade and Score by Company", @@ -1200,7 +1198,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardFactor_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct Factor_Name_s\r\n| sort by Factor_Name_s asc", + "query": "SecurityScorecardFactor\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct Factor_Name_s\r\n| sort by Factor_Name_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -1246,7 +1244,7 @@ }, "jsonData": "[\r\n { \"value\":\"A\", \"label\":\"A\"},\r\n { \"value\":\"B\", \"label\":\"B\"},\r\n { \"value\":\"C\", \"label\":\"C\"},\r\n { \"value\":\"D\", \"label\":\"D\" },\r\n { \"value\":\"F\", \"label\":\"F\"}\r\n]", "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 }, "defaultValue": "value::all" } @@ -1262,7 +1260,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardFactor_CL\r\n| where body_s == \"Factor\" and subject_s != '{Domain}' and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(ingestion_time(), *) by dateToday_s, subject_s, Factor_Name_s, portfolioName_s\r\n| summarize arg_max(dateToday_s, *) by subject_s, Factor_Name_s, portfolioName_s\r\n| extend [\"Current Grade\"] = case(scoreToday_d>=90, \"A\", scoreToday_d>=80 and scoreToday_d<=89, \"B\", scoreToday_d>=70 and scoreToday_d<=79, \"C\", scoreToday_d>=60 and scoreToday_d<=69, \"D\", \"F\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors') \r\n| where ('*' in ({Factor}) or Factor_Name_s in ({Factor})) and [\"Current Grade\"] in ({Grade})\r\n| project subject_s, portfolioName_s, Factor_Name_s, factorDescription_s , scoreToday_d, [\"Current Grade\"], Details \r\n| project-rename Company = subject_s, Factor = Factor_Name_s, Description = factorDescription_s, [\"Current Score\"] = scoreToday_d\r\n| sort by Factor asc, Company asc", + "query": "SecurityScorecardFactor\r\n| where body_s == \"Factor\" and subject_s != '{Domain}' and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(TimeGenerated, *) by dateToday_s, subject_s, Factor_Name_s, portfolioName_s\r\n| summarize arg_max(dateToday_s, *) by subject_s, Factor_Name_s, portfolioName_s\r\n| extend [\"Current Grade\"] = case(scoreToday_d>=90, \"A\", scoreToday_d>=80 and scoreToday_d<=89, \"B\", scoreToday_d>=70 and scoreToday_d<=79, \"C\", scoreToday_d>=60 and scoreToday_d<=69, \"D\", \"F\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors') \r\n| where ('*' in ({Factor}) or Factor_Name_s in ({Factor})) and [\"Current Grade\"] in ({Grade})\r\n| project subject_s, portfolioName_s, Factor_Name_s, factorDescription_s , scoreToday_d, [\"Current Grade\"], Details \r\n| project-rename Company = subject_s, Factor = Factor_Name_s, Description = factorDescription_s, [\"Current Score\"] = scoreToday_d\r\n| sort by Factor asc, Company asc", "size": 0, "showAnalytics": true, "title": "Top Level Grade and Score by Factor", @@ -1392,7 +1390,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend issue_type = strcat_array(split(issueType_s,\"_\"),\" \") \r\n| distinct issue_type\r\n| sort by issue_type asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend issue_type = strcat_array(split(issueType_s,\"_\"),\" \") \r\n| distinct issue_type\r\n| sort by issue_type asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -1456,7 +1454,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == 'Issue' and groupStatus_s == 'active' and subject_s != '{Domain}' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and severity_value_s in ({Severity})\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d), [\"Issue Count\"] = count(issueName_s), src = arg_max(date_s,Factor_s) by issueType_s, subject_s, severity_value_s\r\n| extend [\"Issue Type\"]=strcat_array(split(issueType_s,\"_\"),\" \") , Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\r\n| where ('*' in ({IssueType}) or [\"Issue Type\"] in ({IssueType})) \r\n| project subject_s, Severity, [\"Issue Type\"], [\"Findings Count\"], [\"Issue Count\"], Details \r\n| order by [\"Issue Type\"] asc, subject_s asc\r\n| project-rename Company=subject_s", + "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and groupStatus_s == 'active' and subject_s != '{Domain}' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and severity_value_s in ({Severity})\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d), [\"Issue Count\"] = count(issueName_s), src = arg_max(date_s,Factor_s) by issueType_s, subject_s, severity_value_s\r\n| extend [\"Issue Type\"]=strcat_array(split(issueType_s,\"_\"),\" \") , Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\r\n| where ('*' in ({IssueType}) or [\"Issue Type\"] in ({IssueType})) \r\n| project subject_s, Severity, [\"Issue Type\"], [\"Findings Count\"], [\"Issue Count\"], Details \r\n| order by [\"Issue Type\"] asc, subject_s asc\r\n| project-rename Company=subject_s", "size": 0, "showAnalytics": true, "title": "Issues per Vendor", @@ -1597,7 +1595,7 @@ "durationMs": 43200000 }, { - "durationMs": 86400000 + "durationMs": 2592000000 }, { "durationMs": 172800000 @@ -1627,7 +1625,7 @@ "allowCustom": true }, "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 }, "value": { "durationMs": 604800000 @@ -1655,7 +1653,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where isnotempty(portfolioId_g)\r\n| distinct portfolioName_s", + "query": "SecurityScorecardIssue\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -1693,7 +1691,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -1731,7 +1729,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| distinct value=Factor_s, lable=factor\r\n| sort by lable asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| distinct value=Factor_s, label=factor\r\n| sort by label asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -1769,7 +1767,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -1816,7 +1814,7 @@ }, "jsonData": "[\r\n { \"value\":\"info\", \"label\":\"Info\"},\r\n { \"value\":\"low\", \"label\":\"Low\" },\r\n { \"value\":\"medium\", \"label\":\"Medium\"},\r\n { \"value\":\"high\", \"label\":\"high\" },\r\n { \"value\":\"positive\", \"label\":\"Positive\"}\r\n]", "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 }, "defaultValue": "value::all" } @@ -1846,7 +1844,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and ('*' in ({Severity}) or severity_value_s in ({Severity}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize arg_max(date_s,*), src = arg_max(date_s,Factor_s),[\"Findings Count\"] = sum(findingsCount_d), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s\r\n| join kind=leftouter (SecurityScorecardFactor_CL \r\n | distinct Factor_s,factorDescription_s\r\n | project Factor_s, factorDescription_s) on Factor_s\r\n| extend severity_index=case((severity_value_s == \"high\"),1,(severity_value_s == \"medium\"),2,(severity_value_s == \"low\"),3,(severity_value_s == \"info\"),4,5), severity_value_s=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Factor=strcat_array(split(Factor_s,\"_\"),\" \"), [\"Issue type\"]=strcat_array(split(issueType_s,\"_\"),\" \"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s)\r\n| sort by severity_index asc, findingsCount_d desc\r\n| project [\"Issue type\"], Factor, severity_value_s, factorDescription_s, [\"Findings Count\"], Active, Resolved, Details\r\n| project-rename Description = factorDescription_s, Severity = severity_value_s", + "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and ('*' in ({Severity}) or severity_value_s in ({Severity}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize arg_max(date_s,*), src = arg_max(date_s,Factor_s),[\"Findings Count\"] = sum(findingsCount_d), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s\r\n| join kind=leftouter (SecurityScorecardFactor \r\n | distinct Factor_s,factorDescription_s\r\n | project Factor_s, factorDescription_s) on Factor_s\r\n| extend severity_index=case((severity_value_s == \"high\"),1,(severity_value_s == \"medium\"),2,(severity_value_s == \"low\"),3,(severity_value_s == \"info\"),4,5), severity_value_s=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Factor=strcat_array(split(Factor_s,\"_\"),\" \"), [\"Issue type\"]=strcat_array(split(issueType_s,\"_\"),\" \"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s)\r\n| sort by severity_index asc, findingsCount_d desc\r\n| project [\"Issue type\"], Factor, severity_value_s, factorDescription_s, [\"Findings Count\"], Active, Resolved, Details\r\n| project-rename Description = factorDescription_s, Severity = severity_value_s", "size": 0, "showAnalytics": true, "title": "Active Issues", @@ -1966,7 +1964,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == 'Issue' and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Issue Count\"] = count(issueType_s) by Factor_s \r\n| extend Factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| project Factor, [\"Issue Count\"] \r\n", + "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Issue Count\"] = count(issueType_s) by Factor_s \r\n| extend Factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| project Factor, [\"Issue Count\"] \r\n", "size": 0, "showAnalytics": true, "title": "Issue Types by Factor", @@ -1988,7 +1986,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == \"Issue\" and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize count() by severity_value_s \r\n| extend severity_value_s = case((severity_value_s == 'info'), \"Info\",(severity_value_s == 'low'), \"Low\",(severity_value_s == 'medium'), \"Medium\",(severity_value_s == 'high'), \"High\", (severity_value_s == 'positive'), \"Positive\", severity_value_s)\r\n| render piechart", + "query": "SecurityScorecardIssue\r\n| where body_s == \"Issue\" and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize count() by severity_value_s \r\n| extend severity_value_s = case((severity_value_s == 'info'), \"Info\",(severity_value_s == 'low'), \"Low\",(severity_value_s == 'medium'), \"Medium\",(severity_value_s == 'high'), \"High\", (severity_value_s == 'positive'), \"Positive\", severity_value_s)\r\n| render piechart", "size": 3, "showAnalytics": true, "title": "Count by Severity", @@ -2061,7 +2059,7 @@ "durationMs": 43200000 }, { - "durationMs": 86400000 + "durationMs": 2592000000 }, { "durationMs": 172800000 @@ -2091,7 +2089,7 @@ "allowCustom": true }, "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 } } ], @@ -2124,7 +2122,7 @@ }, "jsonData": "[\r\n { \"value\":\"service_vuln_host_high\", \"label\":\"Service Vuln Host High\"},\r\n { \"value\":\"service_vuln_host_low\", \"label\":\"Service Vuln Host Low\" },\r\n { \"value\":\"service_vuln_host_medium\", \"label\":\"Service Vuln Host Medium\"},\r\n { \"value\":\"patching_cadence_high\", \"label\":\"Patching Cadence High\" },\r\n { \"value\":\"patching_cadence_low\", \"label\":\"Patching Cadence Low\"},\r\n { \"value\":\"patching_cadence_medium\", \"label\":\"Patching Cadence Medium\" },\r\n { \"value\":\"web_vuln_host_high\", \"label\":\"Web Vuln Host High\"},\r\n { \"value\":\"web_vuln_host_low\", \"label\":\"Web Vuln Host Low\" },\r\n { \"value\":\"web_vuln_host_medium\", \"label\":\"Web Vuln Host Medium\"}\r\n]", "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 }, "defaultValue": "value::all" } @@ -2150,7 +2148,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where isnotempty(portfolioId_g)\r\n| distinct portfolioName_s", + "query": "SecurityScorecardIssue\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2188,7 +2186,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2226,7 +2224,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2269,7 +2267,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and issueType_s in ({CVE}) and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d), [\"Issue Count\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s, subject_s, severity_value_s\r\n| extend CVE=strcat_array(split(issueType_s,\"_\"),\" \"), severity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5), Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\", severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s), Factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| sort by CVE asc, severity_priority asc, subject_s asc\r\n| project subject_s, CVE, Factor, Severity, ['Findings Count'], [\"Issue Count\"], Active, Resolved, Details\r\n| project-rename Company = subject_s", + "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and issueType_s in ({CVE}) and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d), [\"Issue Count\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s, subject_s, severity_value_s\r\n| extend CVE=strcat_array(split(issueType_s,\"_\"),\" \"), severity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5), Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\", severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s), Factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| sort by CVE asc, severity_priority asc, subject_s asc\r\n| project subject_s, CVE, Factor, Severity, ['Findings Count'], [\"Issue Count\"], Active, Resolved, Details\r\n| project-rename Company = subject_s", "size": 0, "showAnalytics": true, "title": "Issues per Vendor", @@ -2400,7 +2398,7 @@ "durationMs": 43200000 }, { - "durationMs": 86400000 + "durationMs": 2592000000 }, { "durationMs": 172800000 @@ -2430,7 +2428,7 @@ "allowCustom": true }, "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 } } ], @@ -2489,7 +2487,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where isnotempty(portfolioId_g)\r\n| distinct portfolioName_s", + "query": "SecurityScorecardIssue\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2527,7 +2525,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2565,7 +2563,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2608,7 +2606,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and issueType_s in ({Ransomware})\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d),[\"Issue Count\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s, subject_s, severity_value_s \r\n| extend Ransomware=strcat_array(split(issueType_s,\"_\"),\" \"), Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\r\n| project subject_s, Ransomware, Severity, ['Findings Count'], ['Issue Count'], Active, Resolved, Details\r\n| project-rename Company = subject_s\r\n| sort by Ransomware asc, Company asc", + "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and issueType_s in ({Ransomware})\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d),[\"Issue Count\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s, subject_s, severity_value_s \r\n| extend Ransomware=strcat_array(split(issueType_s,\"_\"),\" \"), Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\r\n| project subject_s, Ransomware, Severity, ['Findings Count'], ['Issue Count'], Active, Resolved, Details\r\n| project-rename Company = subject_s\r\n| sort by Ransomware asc, Company asc", "size": 0, "showAnalytics": true, "title": "Issues per Vendor", @@ -2745,7 +2743,7 @@ "durationMs": 43200000 }, { - "durationMs": 86400000 + "durationMs": 2592000000 }, { "durationMs": 172800000 @@ -2775,7 +2773,7 @@ "allowCustom": true }, "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 } } ], @@ -2800,7 +2798,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardRatings_CL\r\n| where isnotempty(portfolioId_g)\r\n| distinct portfolioName_s", + "query": "SecurityScorecardRatings\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2838,7 +2836,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardRatings_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", + "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2876,7 +2874,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardIssues_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend label = strcat_array(split(Factor_s,\"_\"),\" \"),value = Factor_s\r\n| distinct value, label\r\n| sort by label asc", + "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend label = strcat_array(split(Factor_s,\"_\"),\" \"),value = Factor_s\r\n| distinct value, label\r\n| sort by label asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2914,7 +2912,7 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "SecurityScorecardRatings_CL\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", + "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" @@ -2949,7 +2947,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardRatings_CL\r\n| where body_s =='OverAll' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(dateToday_s,*) by subject_s\r\n| extend Grade = case((scoreToday_d >= 90), \"A\",(scoreToday_d>=80 and scoreToday_d<=89), \"B\",(scoreToday_d>=70 and scoreToday_d<=79), \"C\",(scoreToday_d>=60 and scoreToday_d<=69), \"D\",isempty(scoreToday_d),\"\",\"F\") \r\n| project Grade, subject_s, scoreToday_d\r\n| project-rename Company = subject_s, Score = scoreToday_d\r\n| sort by Score asc\r\n| limit 10", + "query": "SecurityScorecardRatings\r\n| where body_s =='OverAll' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(dateToday_s,*) by subject_s\r\n| extend Grade = case((scoreToday_d >= 90), \"A\",(scoreToday_d>=80 and scoreToday_d<=89), \"B\",(scoreToday_d>=70 and scoreToday_d<=79), \"C\",(scoreToday_d>=60 and scoreToday_d<=69), \"D\",isempty(scoreToday_d),\"\",\"F\") \r\n| project Grade, subject_s, scoreToday_d\r\n| project-rename Company = subject_s, Score = scoreToday_d\r\n| sort by Score asc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Worst Performing Companies", @@ -3019,7 +3017,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL\r\n| where body_s == 'Issue' and groupStatus_s == \"active\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s,*), [\"Company Count\"] = dcount(subject_s,4) by issueName_s, severity_value_s, issueType_s, Factor_s\r\n| extend serverity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5), severity_value=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s) \r\n| extend Issues=trim(@\"'\",issueName_s), Factor=strcat_array(split(Factor_s,\"_\"),\" \") \r\n| sort by serverity_priority asc, [\"Company Count\"] desc\r\n| project Severity = severity_value, Issues, Factor = Factor, [\"Company Count\"]", + "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and groupStatus_s == \"active\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s,*), [\"Company Count\"] = dcount(subject_s,4) by issueName_s, severity_value_s, issueType_s, Factor_s\r\n| extend serverity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5), severity_value=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s) \r\n| extend Issues=trim(@\"'\",issueName_s), Factor=strcat_array(split(Factor_s,\"_\"),\" \") \r\n| sort by serverity_priority asc, [\"Company Count\"] desc\r\n| project Severity = severity_value, Issues, Factor = Factor, [\"Company Count\"]", "size": 0, "showAnalytics": true, "title": "Most Critical Issues", @@ -3107,7 +3105,7 @@ }, "jsonData": "[\r\n { \"value\":\"info\", \"label\":\"Info\"},\r\n { \"value\":\"low\", \"label\":\"Low\" },\r\n { \"value\":\"medium\", \"label\":\"Medium\"},\r\n { \"value\":\"high\", \"label\":\"high\" },\r\n { \"value\":\"positive\", \"label\":\"Positive\"}\r\n]", "timeContext": { - "durationMs": 86400000 + "durationMs": 2592000000 }, "defaultValue": "value::all" } @@ -3122,7 +3120,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityScorecardIssues_CL \r\n| where body_s == \"Issue\" and groupStatus_s == \"active\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and severity_value_s in ({Severity})\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend totalcount = toscalar(SecurityScorecardIssues_CL | summarize dcount(subject_s))\r\n| summarize subject = dcount(subject_s), totalCount = max(totalcount) by issueName_s, issueType_s, Factor_s\r\n| extend [\"% of Portfolio Affected\"] = round((todouble(subject)/todouble(totalCount))*100,0)\r\n| extend Factor = strcat_array(split(Factor_s,\"_\"),\" \") \r\n| project Factor, issueName_s, [\"% of Portfolio Affected\"]\r\n| sort by [\"% of Portfolio Affected\"] desc\r\n| project-rename Issues = issueName_s", + "query": "SecurityScorecardIssue \r\n| where body_s == \"Issue\" and groupStatus_s == \"active\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and severity_value_s in ({Severity})\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend totalcount = toscalar(SecurityScorecardIssue | summarize dcount(subject_s))\r\n| summarize subject = dcount(subject_s), totalCount = max(totalcount) by issueName_s, issueType_s, Factor_s\r\n| extend [\"% of Portfolio Affected\"] = round((todouble(subject)/todouble(totalCount))*100,0)\r\n| extend Factor = strcat_array(split(Factor_s,\"_\"),\" \") \r\n| project Factor, issueName_s, [\"% of Portfolio Affected\"]\r\n| sort by [\"% of Portfolio Affected\"] desc\r\n| project-rename Issues = issueName_s", "size": 0, "showAnalytics": true, "title": "Most Common Issues", diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 5fe1cb19c7b..7609cd23bff 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -6071,16 +6071,22 @@ { "workbookKey": "SecurityScorecardWorkbook", "logoFileName": "SecurityScorecard-Cybersecurity-Ratings.svg", - "description": "This Workbook provides immediate insight into the data coming from SecurityScorecard's three Sentinel data connectors: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues.", + "description": "This Workbook provides immediate insight into the data coming from SecurityScorecard's data connectors within Microsoft Sentinel: SecurityScorecard Cybersecurity Ratings, SecurityScorecard Cybersecurity Ratings - Factors, and SecurityScorecard Cybersecurity Ratings - Issues.", "dataTypesDependencies": [ "SecurityScorecardFactor_CL", "SecurityScorecardIssues_CL", - "SecurityScorecardRatings_CL" + "SecurityScorecardRatings_CL", + "SecurityScorecardFactorHistory_CL", + "SecurityScorecardIssuesHistory_CL", + "SecurityScorecardRatingsHistory_CL" ], "dataConnectorsDependencies": [ "SecurityScorecardFactorAzureFunctions", "SecurityScorecardIssueAzureFunctions", - "SecurityScorecardRatingsAzureFunctions" + "SecurityScorecardRatingsAzureFunctions", + "SecurityScorecardFactorCCPDefinition", + "SecurityScorecardIssueCCPDefinition", + "SecurityScorecardRatingsCCPDefinition" ], "previewImagesFileNames": [ "SecurityScorecardBlack1.png",