Skip to content

Migrate SecurityScorecard Cybersecurity Ratings solution to CCF (multi-instance + Azure Function parity) #14757

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sigmabaryon wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Migrate SecurityScorecard Cybersecurity Ratings solution to CCF (multi-instance + Azure Function parity) #14757

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
2a74a05
implement CCF for SSC ratings
sigmabaryon Jun 1, 2026
56c62ab
remove portfolio id filters, fix lookups, nested attributes
sigmabaryon Jun 1, 2026
57843e2
Add multi-instance and Azure Function feature parity to SecurityScore…
sigmabaryon Jul 17, 2026
2a5f42d
Fix CCF poller resource names by quoting the workspace parameter refe…
sigmabaryon Jul 21, 2026
9a317a8
Fix workbook Domain picker inverting the Vendor Scores filter
sigmabaryon Jul 21, 2026
9af76fb
Fix duplicated "(using Azure Functions)" suffix on deprecated connect…
sigmabaryon Jul 21, 2026
3c76822
Fix parity-audit blockers: optional Domain param, poll window, Issue …
sigmabaryon Jul 21, 2026
84c6288
Fix KqlValidations CI failure and workbook dropdown label typo
sigmabaryon Jul 27, 2026
88cfed7
Restore 2.0.0 package zip and add its release notes entry
sigmabaryon Jul 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardFactorHistory_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"Name": "SecurityScorecardFactorHistory_CL",
"Properties": [
{ "Name": "TimeGenerated", "Type": "datetime" },
{ "Name": "score_date", "Type": "datetime" },
{ "Name": "factors", "Type": "dynamic" },
{ "Name": "domain", "Type": "string" },
{ "Name": "industry", "Type": "string" },
{ "Name": "portfolio_name", "Type": "string" },
{ "Name": "portfolio_id", "Type": "string" }
]
}
20 changes: 20 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardIssuesHistory_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{
"Name": "SecurityScorecardIssuesHistory_CL",
"Properties": [
{ "Name": "TimeGenerated", "Type": "datetime" },
{ "Name": "id", "Type": "long" },
{ "Name": "issue_date", "Type": "datetime" },
{ "Name": "event_type", "Type": "string" },
{ "Name": "group_status", "Type": "string" },
{ "Name": "issue_count", "Type": "long" },
{ "Name": "total_score_impact", "Type": "real" },
{ "Name": "issue_type", "Type": "string" },
{ "Name": "severity", "Type": "string" },
{ "Name": "factor", "Type": "string" },
{ "Name": "detail_url", "Type": "string" },
{ "Name": "domain", "Type": "string" },
{ "Name": "industry", "Type": "string" },
{ "Name": "portfolio_name", "Type": "string" },
{ "Name": "portfolio_id", "Type": "string" }
]
}
12 changes: 12 additions & 0 deletions .script/tests/KqlvalidationsTests/CustomTables/SecurityScorecardRatingsHistory_CL.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
{
"Name": "SecurityScorecardRatingsHistory_CL",
"Properties": [
{ "Name": "TimeGenerated", "Type": "datetime" },
{ "Name": "score_date", "Type": "datetime" },
{ "Name": "score", "Type": "long" },
{ "Name": "domain", "Type": "string" },
{ "Name": "industry", "Type": "string" },
{ "Name": "portfolio_name", "Type": "string" },
{ "Name": "portfolio_id", "Type": "string" }
]
}
6 changes: 3 additions & 3 deletions ...ings/Data Connectors/SecurityScorecardFactor/SecurityScorecardFactor_API_FunctionApp.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
{
"id": "SecurityScorecardFactorAzureFunctions",
"title": "SecurityScorecard Factor",
"title": "[DEPRECATED] SecurityScorecard Factor",
"publisher": "SecurityScorecard",
"descriptionMarkdown": "SecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.",
"descriptionMarkdown": "<p><span style='color:red; font-weight:bold;'>NOTE</span>: This data connector has been deprecated. Consider moving to the <strong>SecurityScorecard Factors (Codeless)</strong> CCF data connector available in the solution, which replaces ingestion via the <a href='https://learn.microsoft.com/en-us/azure/azure-monitor/logs/custom-logs-migrate' style='color:#1890F1;'>deprecated HTTP Data Collector API</a>.</p>\n\nSecurityScorecard is the leader in cybersecurity risk ratings. The [SecurityScorecard](https://www.SecurityScorecard.com/) Factors data connector provides the ability for Microsoft Sentinel to import SecurityScorecard factor ratings as logs. SecurityScorecard provides ratings for over 12 million companies and domains using countless data points from across the internet. Maintain full awareness of any company's security posture and be able to receive timely updates when factor scores change or drop. SecurityScorecard factor ratings are updated daily based on evidence collected across the web.",
"graphQueries": [
{
"metricName": "Total Factor data received",
Expand Down Expand Up @@ -32,7 +32,7 @@
],
"availability": {
"status": 1,
"isPreview": true
"isPreview": false
},
"permissions": {
"resourceProvider": [
Expand Down
59 changes: 59 additions & 0 deletions ...rity Ratings/Data Connectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DCR.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
{
"name": "SecurityScorecardFactorDCR",
"apiVersion": "2021-09-01-preview",
"type": "Microsoft.Insights/dataCollectionRules",
"location": "{{location}}",
"properties": {
"dataCollectionEndpointId": "{{dataCollectionEndpointId}}",
"streamDeclarations": {
"Custom-SecurityScorecardFactorHistory_CL": {
"columns": [
{
"name": "domain",
"type": "string"
},
{
"name": "factors",
"type": "dynamic"
},
{
"name": "date",
"type": "datetime"
},
{
"name": "portfolio_id",
"type": "string"
},
{
"name": "portfolio_name",
"type": "string"
},
{
"name": "industry",
"type": "string"
}
]
}
},
"destinations": {
"logAnalytics": [
{
"workspaceResourceId": "{{workspaceResourceId}}",
"name": "clv2ws1"
}
]
},
"dataFlows": [
{
"streams": [
"Custom-SecurityScorecardFactorHistory_CL"
],
"destinations": [
"clv2ws1"
],
"transformKql": "source | extend TimeGenerated = todatetime(['date']), score_date = todatetime(['date']), domain = tostring(domain), industry = tostring(industry), factors = todynamic(factors) | project TimeGenerated, score_date, factors, domain, industry, portfolio_id, portfolio_name",
"outputStream": "Custom-SecurityScorecardFactorHistory_CL"
}
]
}
}
173 changes: 173 additions & 0 deletions ...nnectors/SecurityScorecardFactor_ccp/SecurityScorecardFactor_DataConnectorDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,173 @@
{
"name": "SecurityScorecardFactorCCPDefinition",
"apiVersion": "2025-07-01-preview",
"type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
"location": "{{location}}",
"kind": "Customizable",
"properties": {
"connectorUiConfig": {
"id": "SecurityScorecardFactorCCPDefinition",
"title": "SecurityScorecard Factors (Codeless)",
"publisher": "SecurityScorecard",
"descriptionMarkdown": "The SecurityScorecard Factors (Codeless) connector ingests company factor-score history into Microsoft Sentinel using the Codeless Connector Framework. Add one connection per SecurityScorecard portfolio you want to monitor — each connection is managed independently in the grid below. Raw rows land in `SecurityScorecardFactorHistory_CL`; query via the `SecurityScorecardFactor` parser to get day-over-day deltas with factor metadata, matching the legacy Function App schema.",
"graphQueriesTableName": "SecurityScorecardFactorHistory_CL",
"graphQueries": [
{
"metricName": "Total Factor history rows received",
"legend": "SecurityScorecard factor history",
"baseQuery": "{{graphQueriesTableName}}"
}
],
"sampleQueries": [
{
"description": "Day-over-day factor change (parser)",
"query": "SecurityScorecardFactor\n | sort by TimeGenerated desc"
},
{
"description": "Raw factor history",
"query": "{{graphQueriesTableName}}\n | sort by TimeGenerated desc"
}
],
"dataTypes": [
{
"name": "{{graphQueriesTableName}}",
"lastDataReceivedQuery": "{{graphQueriesTableName}}\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
}
],
"connectivityCriteria": [
{
"type": "HasDataConnectors"
}
],
"availability": {
"isPreview": false
},
"permissions": {
"resourceProvider": [
{
"provider": "Microsoft.OperationalInsights/workspaces",
"permissionsDisplayText": "Read and Write permissions are required.",
"providerDisplayName": "Workspace",
"scope": "Workspace",
"requiredPermissions": {
"write": true,
"read": true,
"delete": true
}
}
],
"customs": [
{
"name": "SecurityScorecard API token",
"description": "A SecurityScorecard API token is required."
}
]
},
"instructionSteps": [
{
"title": "STEP 1 - Create a SecurityScorecard API token",
"description": "As an administrator, create a bot user with Read Only permission and generate the API token."
},
{
"title": "STEP 2 - Add a portfolio connection",
"description": "Add one connection per SecurityScorecard portfolio. Each connection ingests the factor-score history for the companies in a single portfolio and is listed, managed, and deleted independently below. To also ingest your own company's factor scores (My Scorecard), enter your company domain in the optional field on one connection.",
"instructions": [
{
"type": "DataConnectorsGrid",
"parameters": {
"mapping": [
{
"columnName": "Portfolio Name",
"columnValue": "properties.addOnAttributes.portfolio_name"
},
{
"columnName": "Portfolio ID",
"columnValue": "properties.addOnAttributes.portfolio_id"
}
],
"menuItems": [
"DeleteConnector"
]
}
},
{
"type": "ContextPane",
"parameters": {
"label": "Add portfolio",
"title": "Add a SecurityScorecard portfolio",
"subtitle": "Connect one SecurityScorecard portfolio",
"contextPaneType": "DataConnectorsContextPane",
"instructionSteps": [
{
"instructions": [
{
"type": "Textbox",
"parameters": {
"label": "Base URL",
"placeholder": "https://api.securityscorecard.io",
"type": "text",
"name": "BaseUrl",
"validations": {
"required": true
}
}
},
{
"type": "Textbox",
"parameters": {
"label": "API Token",
"placeholder": "Enter your SecurityScorecard API token",
"type": "password",
"name": "ApiToken",
"validations": {
"required": true
}
}
},
{
"type": "Textbox",
"parameters": {
"label": "Portfolio ID",
"placeholder": "Enter the SecurityScorecard portfolio ID",
"type": "text",
"name": "PortfolioId",
"validations": {
"required": true
}
}
},
{
"type": "Textbox",
"parameters": {
"label": "Portfolio Name",
"placeholder": "A friendly name for this portfolio (shown in reports and the workbook)",
"type": "text",
"name": "PortfolioName",
"validations": {
"required": true
}
}
},
{
"type": "Textbox",
"parameters": {
"label": "Your Company Domain (optional - My Scorecard)",
"placeholder": "e.g. yourcompany.com - leave blank if not needed",
"type": "text",
"name": "Domain",
"validations": {
"required": false
}
}
}
]
}
]
}
}
]
}
]
}
}
}
Loading
Loading