{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Crypto Dashboard\n---\n\nThis crypto dashboard provides information about your cryptographic health status."
      },
      "name": "text - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## Cryptographic Health Summary\r\nThe following charts summarize the health of the different cryptographic artifacts discovered."
            },
            "name": "text - Summary"
          },
          {
            "type": 1,
            "content": {
              "json": "### Cryptographic Keys"
            },
            "customWidth": "30",
            "name": "text - Keys"
          },
          {
            "type": 1,
            "content": {
              "json": "### Machine Identities"
            },
            "customWidth": "30",
            "name": "text - Identities"
          },
          {
            "type": 1,
            "content": {
              "json": "### Cryptographic Libraries"
            },
            "customWidth": "30",
            "name": "text - Libraries"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where (severity_score_s  == \"High\" or severity_score_s  == \"Medium\" or severity_score_s  == \"Low\") and not(key_type_s == \"\")\r\n| summarize Count=dcount(object_fingerprint_s) by severity_score_s;  ",
              "size": 3,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "label": "Low Severity",
                    "color": "green"
                  },
                  {
                    "seriesName": "Medium",
                    "label": "Medium Serverity",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "label": "High Severity",
                    "color": "redBright"
                  }
                ]
              }
            },
            "customWidth": "30",
            "name": "query - 1"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where (severity_score_s  == \"High\" or severity_score_s  == \"Medium\" or severity_score_s  == \"Low\") and not(basic_constraints_subject_type_s== \"\")\r\n| summarize Count=dcount(certificatesha256fingerprint_s) by severity_score_s;  ",
              "size": 3,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "label": "Low Severity",
                    "color": "green"
                  },
                  {
                    "seriesName": "Medium",
                    "label": "Medium Serverity",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "label": "High Severity",
                    "color": "redBright"
                  }
                ]
              }
            },
            "customWidth": "33",
            "name": "query - 1 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where not(library_severity_description_s == \"\") and not(library_severity_description_s == \"Not Defined\")\r\n| summarize Count=dcount(object_fingerprint_s) by library_severity_description_s;  ",
              "size": 3,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "label": "Low Severity",
                    "color": "green"
                  },
                  {
                    "seriesName": "Medium",
                    "label": "Medium Serverity",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "label": "High Severity",
                    "color": "redBright"
                  },
                  {
                    "seriesName": "Not Defined",
                    "color": "blue"
                  },
                  {
                    "seriesName": "OpenSSL - End-of-Life",
                    "color": "orange"
                  },
                  {
                    "seriesName": "OpenSSL - Current",
                    "color": "green"
                  },
                  {
                    "seriesName": "OpenSSL - Heartbleed",
                    "color": "redBright"
                  }
                ]
              }
            },
            "customWidth": "33",
            "name": "query - 1 - Copy - Copy"
          },
          {
            "type": 1,
            "content": {
              "json": "### Classical Crypto State"
            },
            "customWidth": "30",
            "name": "text - CryptoState"
          },
          {
            "type": 1,
            "content": {
              "json": "### Quantum Threat State"
            },
            "customWidth": "70",
            "name": "text - QuantumState"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where severity_ISG_Modern_Security_s  == \"High\" or severity_ISG_Modern_Security_s  == \"Medium\" or severity_ISG_Modern_Security_s  == \"Low\"\r\n| summarize Count=dcount(object_fingerprint_s) by severity_ISG_Modern_Security_s;  ",
              "size": 3,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "label": "Low Severity",
                    "color": "green"
                  },
                  {
                    "seriesName": "Medium",
                    "label": "Medium Serverity",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "label": "High Severity",
                    "color": "redBright"
                  },
                  {
                    "seriesName": "Not Defined",
                    "color": "blue"
                  },
                  {
                    "seriesName": "OpenSSL - End-of-Life",
                    "color": "orange"
                  },
                  {
                    "seriesName": "OpenSSL - Current",
                    "color": "green"
                  },
                  {
                    "seriesName": "OpenSSL - Heartbleed",
                    "color": "redBright"
                  }
                ]
              }
            },
            "customWidth": "30",
            "name": "Crypto - Classical"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where severity_ISG_PostQuantum_Security_s  == \"High\" or severity_ISG_PostQuantum_Security_s  == \"Medium\" or severity_ISG_PostQuantum_Security_s  == \"Low\"\r\n| summarize Count=dcount(object_fingerprint_s) by severity_ISG_PostQuantum_Security_s;  ",
              "size": 3,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "label": "Low Severity",
                    "color": "green"
                  },
                  {
                    "seriesName": "Medium",
                    "label": "Medium Serverity",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "label": "High Severity",
                    "color": "redBright"
                  },
                  {
                    "seriesName": "Not Defined",
                    "color": "blue"
                  },
                  {
                    "seriesName": "OpenSSL - End-of-Life",
                    "color": "orange"
                  },
                  {
                    "seriesName": "OpenSSL - Current",
                    "color": "green"
                  },
                  {
                    "seriesName": "OpenSSL - Heartbleed",
                    "color": "redBright"
                  }
                ]
              }
            },
            "customWidth": "70",
            "name": "PQC Chart"
          },
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": []
            },
            "name": "group - 4"
          }
        ]
      },
      "name": "group - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "# Cryptographic Vulnerabilities\r\nThe follow table shows the distribution between the different cryptographic vulnerabilities identified."
            },
            "name": "text - 3"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where severity_score_s  == \"High\"\r\n| summarize Count=dcount(object_fingerprint_s) by severity_description_s;\r\n",
              "size": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "barchart",
              "graphSettings": {
                "type": 0,
                "topContent": {
                  "columnMatch": "agentidentity_s",
                  "formatter": 1
                },
                "centerContent": {
                  "columnMatch": "Count",
                  "formatter": 1,
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              }
            },
            "name": "query - 0"
          }
        ]
      },
      "name": "group - 2"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 1,
            "content": {
              "json": "## Hosts Summary"
            },
            "name": "text - 0"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where severity_score_s  == \"High\" or severity_score_s  == \"Medium\" or severity_score_s  == \"Low\"\r\n| distinct agentidentity_s, severity_score_s\r\n| summarize count() by agentidentity_s, severity_score_s\r\n| render columnchart kind=stacked;",
              "size": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "tileSettings": {
                "showBorder": false,
                "titleContent": {
                  "columnMatch": "agentidentity_s",
                  "formatter": 1
                },
                "leftContent": {
                  "columnMatch": "Count",
                  "formatter": 12,
                  "formatOptions": {
                    "palette": "auto"
                  },
                  "numberFormat": {
                    "unit": 17,
                    "options": {
                      "maximumSignificantDigits": 3,
                      "maximumFractionDigits": 2
                    }
                  }
                }
              },
              "chartSettings": {
                "xAxis": "agentidentity_s",
                "group": "severity_score_s",
                "createOtherGroup": 0,
                "showLegend": true,
                "seriesLabelSettings": [
                  {
                    "seriesName": "Low",
                    "color": "green"
                  },
                  {
                    "seriesName": "Medium",
                    "color": "orange"
                  },
                  {
                    "seriesName": "High",
                    "color": "redBright"
                  }
                ],
                "ySettings": {
                  "numberFormatSettings": {
                    "unit": 17,
                    "options": {
                      "style": "decimal",
                      "useGrouping": true
                    }
                  }
                }
              }
            },
            "name": "query - 1 - Copy"
          }
        ]
      },
      "name": "group - 3"
    },
    {
      "type": 12,
      "content": {
        "version": "NotebookGroup/1.0",
        "groupType": "editable",
        "items": [
          {
            "type": 12,
            "content": {
              "version": "NotebookGroup/1.0",
              "groupType": "editable",
              "items": [
                {
                  "type": 1,
                  "content": {
                    "json": "## Cryptographic artifacts"
                  },
                  "name": "text - 9"
                }
              ]
            },
            "name": "group - 4"
          },
          {
            "type": 1,
            "content": {
              "json": "### Key Types"
            },
            "customWidth": "33",
            "name": "text - 13"
          },
          {
            "type": 1,
            "content": {
              "json": "### Machine Identities Types"
            },
            "customWidth": "33",
            "name": "text - 13 - Copy"
          },
          {
            "type": 1,
            "content": {
              "json": "### Crypto Libraries Types"
            },
            "customWidth": "33",
            "name": "text - 13 - Copy - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where not(key_type_s == \"\")\r\n| summarize Count=dcount(uri_filename_s) by CryptoKey =key_type_s, keysize_s\r\n",
              "size": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "createOtherGroup": 10
              }
            },
            "customWidth": "33",
            "name": "query - 10"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where not(basic_constraints_subject_type_s== \"\")\r\n| summarize Count=dcount(certificatesha256fingerprint_s) by MachineIdentityType=certificate_usage_s;  \r\n",
              "size": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "createOtherGroup": 10
              }
            },
            "customWidth": "33",
            "name": "query - 10 - Copy"
          },
          {
            "type": 3,
            "content": {
              "version": "KqlItem/1.0",
              "query": "InfoSecAnalytics_CL \r\n| where not(library_severity_description_s == \"\") and classifiertype_s == \"symbol\"\r\n| summarize Count=dcount(object_fingerprint_s) by classifieralgorithm_s;",
              "size": 2,
              "queryType": 0,
              "resourceType": "microsoft.operationalinsights/workspaces",
              "visualization": "piechart",
              "chartSettings": {
                "createOtherGroup": 10
              }
            },
            "customWidth": "33",
            "name": "query - 10 - Copy - Copy"
          }
        ]
      },
      "name": "group - 8"
    },
    {
      "type": 1,
      "content": {
        "json": "## Files Summary"
      },
      "name": "text - 5"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "InfoSecAnalytics_CL\r\n| summarize Count=dcount(uri_filename_s) by uri_filepath_s\r\n| limit 50;",
        "size": 0,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table",
        "gridSettings": {
          "sortBy": [
            {
              "itemKey": "Count",
              "sortOrder": 2
            }
          ]
        },
        "sortBy": [
          {
            "itemKey": "Count",
            "sortOrder": 2
          }
        ],
        "tileSettings": {
          "showBorder": false
        },
        "graphSettings": {
          "type": 0
        },
        "mapSettings": {
          "locInfo": "LatLong",
          "sizeSettings": "Count",
          "sizeAggregation": "Sum",
          "legendMetric": "Count",
          "legendAggregation": "Sum",
          "itemColorSettings": {
            "type": "heatmap",
            "colorAggregation": "Sum",
            "nodeColorField": "Count",
            "heatmapPalette": "greenRed"
          }
        }
      },
      "customWidth": "60",
      "name": "query - 6"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "InfoSecAnalytics_CL\r\n| summarize Count=dcount(uri_filename_s) by uri_fileextension_s;",
        "size": 0,
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "customWidth": "40",
      "name": "query - 7"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-InfoSecGlobalWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}