{ "version": "Notebook/1.0", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "06ba5a8f-fe93-4285-9bb4-15fd5c96befe", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "My Scorecard", "subTarget": "My Scorecard", "style": "link" }, { "id": "ce6e0294-f130-4450-9005-8aa9924e6b86", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Vendor Scores", "subTarget": "Vendor Scores", "style": "link" }, { "id": "26959e65-a53f-4468-8d14-d0b43d1b899d", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Active Issues", "subTarget": "Active Issues", "style": "link" }, { "id": "97757d2a-eba1-4ee9-909b-47e9653e1407", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Issues per Vendor (CVE)", "subTarget": "Issues per Vendor (CVE)", "style": "link" }, { "id": "73e85106-4dde-4c92-8479-c8720d8604de", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Issues per Vendor (Ransomware)", "subTarget": "Issues per Vendor (Ransomware)", "style": "link" }, { "id": "c915da0c-4bfc-4595-8e1a-700a602f3412", "cellValue": "setTab", "linkTarget": "parameter", "linkLabel": "Spotlight", "subTarget": "Spotlight", "style": "link" } ] }, "name": "Tabs" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# My Scorecard", "style": "{setTab}" }, "name": "text - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "309cabc5-5a32-4c1a-b905-cb578ee0e667", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 2592000000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Timerparameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ac778abc-2101-4e66-92da-d11d4b4a8629", "version": "KqlParameterItem/1.0", "name": "Domain", "type": 2, "description": "Your own company domain (My Scorecard). Vendor pages list everyone except this company.", "isRequired": false, "query": "SecurityScorecardRatings\r\n| where portfolioName_s in ('NA', 'My Scorecard')\r\n| distinct subject_s\r\n| sort by subject_s asc", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "parameters - 9" }, { "type": 1, "content": { "json": "
" }, "name": "text - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardRatings\r\n| where body_s == 'OverAll' and subject_s == '{Domain}'\r\n| summarize arg_max(TimeGenerated,*)\r\n| extend gradeToday = case((scoreToday_d>=90), \"A\",(scoreToday_d>=80 and scoreToday_d<=89), \"B\",(scoreToday_d>=70 and scoreToday_d<=79), \"C\",(scoreToday_d>=60 and scoreToday_d<=69), \"D\",isempty(scoreToday_d),\"\",\"F\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \r\n| project gradeToday, scoreToday_d, Details", "size": 4, "showAnalytics": true, "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "gradeToday", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "lightBlue", "text": "Top Level Grade" } ] } }, "leftContent": { "columnMatch": "gradeToday", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "Url", "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "full" } }, "customWidth": "25", "name": "Top Level Grade", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardRatings\r\n| where body_s == 'OverAll' and subject_s == '{Domain}'\r\n| summarize arg_max(TimeGenerated, *) by subject_s \r\n| extend Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s) \r\n| project scoreToday_d, subject_s, Details\r\n| limit 1", "size": 4, "showAnalytics": true, "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "scoreToday_d", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "Default", "representation": "lightBlue", "text": "Top Level Score" } ] } }, "leftContent": { "columnMatch": "scoreToday_d", "formatter": 18, "formatOptions": { "linkColumn": "Details", "linkTarget": "Url", "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "80", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "70", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "60", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "59", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 17, "options": { "style": "decimal", "maximumFractionDigits": 2, "maximumSignificantDigits": 3 } } }, "showBorder": true, "size": "full" } }, "customWidth": "25", "name": "Top Level Score", "styleSettings": { "maxWidth": "100" } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardRatings\r\n| where body_s == 'OverAll'and subject_s == '{Domain}'\r\n| project-rename Date = dateToday_s , Score = scoreToday_d \r\n| summarize arg_max(TimeGenerated, *) by Date \r\n| project Date=format_datetime(todatetime(Date), 'yyyy-MM-dd'), Score\r\n| sort by Date asc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Score Trend", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { "showMetrics": false, "customThresholdLine": "{Score}", "customThresholdLineStyle": 4, "showDataPoints": true, "ySettings": { "numberFormatSettings": { "unit": 0, "options": { "style": "decimal", "useGrouping": true } }, "max": 100 } } }, "customWidth": "50", "name": "Score Trend", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardFactor\r\n| where body_s == 'Factor' and subject_s == '{Domain}'\r\n| summarize arg_max(TimeGenerated,*) by dateToday_s, factorDescription_s\r\n| summarize arg_max(dateToday_s,*) by factorDescription_s\r\n| extend gradeToday=case((scoreToday_d >= 90),\"A\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\"B\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\"C\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\"D\",\"F\"), gradeYesterday=case((scoreYesterday_d >= 90),\"A\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\"B\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\"C\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\"D\",\"F\") \r\n| project Factor_Name_s, factorDescription_s, gradeToday, scoreToday_d, scoreChange_d, gradeYesterday, scoreYesterday_d, dateToday_s \r\n| project-rename Description =factorDescription_s, [\"Current Grade\"] = gradeToday, [\"Current Score\"] = scoreToday_d, [\"Latest Score Change\"] = scoreChange_d, [\"Last Updated Grade\"] = gradeYesterday, [\"Last Updated Score\"] = scoreYesterday_d, [\"Date of Current Score\"] = dateToday_s, Factor = Factor_Name_s ", "size": 0, "showAnalytics": true, "title": "My Scorecard Factors", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Current Grade", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ] } }, { "columnMatch": "Current Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "80", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "70", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "60", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "59", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ] } }, { "columnMatch": "Last Updated Grade", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ] } }, { "columnMatch": "Last Updated Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "80", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "70", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "60", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "59", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "text": "" } ] } }, { "columnMatch": "Date of Current Score", "formatter": 6 } ], "sortBy": [ { "itemKey": "Factor", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Factor", "sortOrder": 1 } ] }, "name": "My Scorecard Factors", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where subject_s == '{Domain}'\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend Factor=strcat_array(split(Factor_s,\"_\"),\" \") \r\n| summarize [\"Issue Count\"]= count() by Factor ", "size": 0, "showAnalytics": true, "title": "Issue Count by Factor", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "showLegend": true } }, "name": "Issue Types by Factor", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where subject_s == '{Domain}'\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend issue_name=strcat_array(split(issueType_s,\"_\"),\" \"), serverity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5)\r\n| summarize count() by severity_value_s, serverity_priority\r\n| sort by serverity_priority asc\r\n| project-away serverity_priority\r\n| render barchart\r\n", "size": 0, "title": "Issue Types by Severity", "timeContextFromParameter": "Timer", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "graphSettings": { "type": 0, "topContent": { "columnMatch": "severity_value_s", "formatter": 1 }, "centerContent": { "columnMatch": "adware installation", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "showLegend": true, "seriesLabelSettings": [ { "seriesName": "high", "label": "High" }, { "seriesName": "medium", "label": "Medium" }, { "seriesName": "low", "label": "Low" }, { "seriesName": "info", "label": "Info" }, { "seriesName": "positive", "label": "Positive" } ], "customThresholdLine": "{issue_name}", "customThresholdLineStyle": 0 }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "adware installation", "sizeAggregation": "Sum", "legendMetric": "adware installation", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "adware installation", "heatmapPalette": "greenRed" } } }, "name": "Issue Types by Severity", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "My Scorecard" }, "name": "My Scorecard" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Vendor Scores", "style": "{setTab}" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8ebc23fe-ade3-4318-8635-24bb841f718b", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 2592000000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 2592000000 }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Timerparameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "72d22203-f3dd-4557-9605-5b6ca4a4e6c0", "version": "KqlParameterItem/1.0", "name": "Domain", "type": 2, "description": "Your own company domain (My Scorecard). Vendor pages list everyone except this company.", "isRequired": false, "query": "SecurityScorecardRatings\r\n| where portfolioName_s in ('NA', 'My Scorecard')\r\n| distinct subject_s\r\n| sort by subject_s asc", "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "parameters - 13" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "624e2391-ad46-416c-9af4-f735c1114b84", "version": "KqlParameterItem/1.0", "name": "Portfolio", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardRatings\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Portfolio" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "91c18b81-401d-4b6a-a9ba-e6780c6fee61", "version": "KqlParameterItem/1.0", "name": "Company", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Company" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c603e74f-d591-4788-b95b-1370a2b98024", "version": "KqlParameterItem/1.0", "name": "Industry", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Industry" }, { "type": 1, "content": { "json": "
" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardRatings\r\n| where body_s == \"OverAll\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and subject_s != '{Domain}'\r\n| summarize arg_max(TimeGenerated, *) by dateToday_s, subject_s, portfolioName_s\r\n| summarize arg_max(dateToday_s, *) by subject_s, portfolioName_s \r\n| extend [\"Current Grade\"]=case((scoreToday_d >= 90),\"A\",((scoreToday_d >= 80) and (scoreToday_d <= 89)),\"B\",((scoreToday_d >= 70) and (scoreToday_d <= 79)),\"C\",((scoreToday_d >= 60) and (scoreToday_d <= 69)),\"D\",\"F\"), [\"Last Updated Grade\"]=case((scoreYesterday_d >= 90),\"A\",((scoreYesterday_d >= 80) and (scoreYesterday_d <= 89)),\"B\",((scoreYesterday_d >= 70) and (scoreYesterday_d <= 79)),\"C\",((scoreYesterday_d >= 60) and (scoreYesterday_d <= 69)),\"D\",\"F\"), Industry=strcat_array(split(industry_s,\"_\"),\" \"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors')\r\n| project subject_s, portfolioName_s, Industry, [\"Date of Current Score\"] = format_datetime(todatetime(dateToday_s), 'yyyy-MM-dd'), scoreToday_d, [\"Current Grade\"], scoreYesterday_d, ['Last Updated Grade'], Details \r\n| project-rename Company = subject_s , [\"Current Score\"] = scoreToday_d, [\"Last Updated Score\"] = scoreYesterday_d \r\n| sort by Company asc, portfolioName_s asc", "size": 0, "showAnalytics": true, "title": "Top Level Grade and Score by Company", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Current Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "80", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "70", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "60", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "59", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Current Grade", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Last Updated Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "80", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "70", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "60", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "59", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Last Updated Grade", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to view details", "linkIsContextBlade": false } } ], "rowLimit": 10000, "sortBy": [ { "itemKey": "$gen_thresholds_Current Score_3", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "$gen_thresholds_Current Score_3", "sortOrder": 1 } ] }, "name": "Top Level Grade and Score by Company", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a38a4cff-47df-431d-a31e-e5a7b9739786", "version": "KqlParameterItem/1.0", "name": "Factor", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardFactor\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct Factor_Name_s\r\n| sort by Factor_Name_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0fe3d2b0-fcbd-4c3f-80e6-29e39f047743", "version": "KqlParameterItem/1.0", "name": "Grade", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"A\", \"label\":\"A\"},\r\n { \"value\":\"B\", \"label\":\"B\"},\r\n { \"value\":\"C\", \"label\":\"C\"},\r\n { \"value\":\"D\", \"label\":\"D\" },\r\n { \"value\":\"F\", \"label\":\"F\"}\r\n]", "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardFactor\r\n| where body_s == \"Factor\" and subject_s != '{Domain}' and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(TimeGenerated, *) by dateToday_s, subject_s, Factor_Name_s, portfolioName_s\r\n| summarize arg_max(dateToday_s, *) by subject_s, Factor_Name_s, portfolioName_s\r\n| extend [\"Current Grade\"] = case(scoreToday_d>=90, \"A\", scoreToday_d>=80 and scoreToday_d<=89, \"B\", scoreToday_d>=70 and scoreToday_d<=79, \"C\", scoreToday_d>=60 and scoreToday_d<=69, \"D\", \"F\"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/',subject_s,'/factors') \r\n| where ('*' in ({Factor}) or Factor_Name_s in ({Factor})) and [\"Current Grade\"] in ({Grade})\r\n| project subject_s, portfolioName_s, Factor_Name_s, factorDescription_s , scoreToday_d, [\"Current Grade\"], Details \r\n| project-rename Company = subject_s, Factor = Factor_Name_s, Description = factorDescription_s, [\"Current Score\"] = scoreToday_d\r\n| sort by Factor asc, Company asc", "size": 0, "showAnalytics": true, "title": "Top Level Grade and Score by Factor", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "formatters": [ { "columnMatch": "Current Score", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": ">=", "thresholdValue": "90", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "80", "representation": "yellow", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "70", "representation": "orange", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "60", "representation": "redBright", "text": "{0}{1}" }, { "operator": "<=", "thresholdValue": "59", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Current Grade", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to view details" } } ], "rowLimit": 10000 } }, "name": "Top Level Grade and Score by Factor", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "f952c797-c056-446e-8ce1-4495673c337d", "version": "KqlParameterItem/1.0", "name": "IssueType", "label": "Issue Type", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend issue_type = strcat_array(split(issueType_s,\"_\"),\" \") \r\n| distinct issue_type\r\n| sort by issue_type asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 9" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "73302a85-fb1b-43cf-8c7f-dfbebd6eb167", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"info\", \"label\":\"Info\"},\r\n { \"value\":\"low\", \"label\":\"Low\" },\r\n { \"value\":\"medium\", \"label\":\"Medium\"},\r\n { \"value\":\"high\", \"label\":\"high\" },\r\n { \"value\":\"positive\", \"label\":\"Positive\"}\r\n]", "timeContext": { "durationMs": 604800000 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "50", "name": "parameters - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and groupStatus_s == 'active' and subject_s != '{Domain}' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and severity_value_s in ({Severity})\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d), [\"Issue Count\"] = count(issueName_s), src = arg_max(date_s,Factor_s) by issueType_s, subject_s, severity_value_s\r\n| extend [\"Issue Type\"]=strcat_array(split(issueType_s,\"_\"),\" \") , Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\r\n| where ('*' in ({IssueType}) or [\"Issue Type\"] in ({IssueType})) \r\n| project subject_s, Severity, [\"Issue Type\"], [\"Findings Count\"], [\"Issue Count\"], Details \r\n| order by [\"Issue Type\"] asc, subject_s asc\r\n| project-rename Company=subject_s", "size": 0, "showAnalytics": true, "title": "Issues per Vendor", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Info", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Positive", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to view details" } } ], "rowLimit": 10000, "filter": true, "sortBy": [ { "itemKey": "Issue Type", "sortOrder": 1 } ] }, "sortBy": [ { "itemKey": "Issue Type", "sortOrder": 1 } ] }, "name": "Issues per Vendor", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Vendor Scores" }, "name": "Vendor Scores" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Active Issues", "style": "{setTab}" }, "name": "Active Issues" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "6239b6b6-1b0c-4d82-9599-bcb3155a8869", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 2592000000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 2592000000 }, "value": { "durationMs": 604800000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Timerparameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "99a0579a-77d5-4693-a099-c1b7dd688c0d", "version": "KqlParameterItem/1.0", "name": "Portfolio", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Portfolio" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e6981875-d72c-486f-baea-52e1e762143f", "version": "KqlParameterItem/1.0", "name": "Company", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Company" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "95c35610-dd13-45f0-bdf4-dae3008215a7", "version": "KqlParameterItem/1.0", "name": "Factor", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| distinct value=Factor_s, label=factor\r\n| sort by label asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Factor" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "34f6058c-86eb-45e1-8684-ad1db584019a", "version": "KqlParameterItem/1.0", "name": "Industry", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) or ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Industry" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bd48be36-fe76-4b7d-be98-fc3ac56f6759", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"info\", \"label\":\"Info\"},\r\n { \"value\":\"low\", \"label\":\"Low\" },\r\n { \"value\":\"medium\", \"label\":\"Medium\"},\r\n { \"value\":\"high\", \"label\":\"high\" },\r\n { \"value\":\"positive\", \"label\":\"Positive\"}\r\n]", "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 11" }, { "type": 1, "content": { "json": "
" }, "name": "text - 6" }, { "type": 1, "content": { "json": "Active Issues will only encompass those that have appeared since the feed was turned on.", "style": "info" }, "name": "text - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and ('*' in ({Severity}) or severity_value_s in ({Severity}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize arg_max(date_s,*), src = arg_max(date_s,Factor_s),[\"Findings Count\"] = sum(findingsCount_d), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s\r\n| join kind=leftouter (SecurityScorecardFactor \r\n | distinct Factor_s,factorDescription_s\r\n | project Factor_s, factorDescription_s) on Factor_s\r\n| extend severity_index=case((severity_value_s == \"high\"),1,(severity_value_s == \"medium\"),2,(severity_value_s == \"low\"),3,(severity_value_s == \"info\"),4,5), severity_value_s=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Factor=strcat_array(split(Factor_s,\"_\"),\" \"), [\"Issue type\"]=strcat_array(split(issueType_s,\"_\"),\" \"), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s)\r\n| sort by severity_index asc, findingsCount_d desc\r\n| project [\"Issue type\"], Factor, severity_value_s, factorDescription_s, [\"Findings Count\"], Active, Resolved, Details\r\n| project-rename Description = factorDescription_s, Severity = severity_value_s", "size": 0, "showAnalytics": true, "title": "Active Issues", "timeContextFromParameter": "Timer", "exportParameterName": "activeissues", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Info", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Positive", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to view details" } }, { "columnMatch": "Sevirity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Positive", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] } } ], "rowLimit": 10000 } }, "name": "Active Issues", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Issue Count\"] = count(issueType_s) by Factor_s \r\n| extend Factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| project Factor, [\"Issue Count\"] \r\n", "size": 0, "showAnalytics": true, "title": "Issue Types by Factor", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "categoricalbar", "chartSettings": { "showLegend": true } }, "name": "Issue Types by Factor", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == \"Issue\" and groupStatus_s == 'active' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize count() by severity_value_s \r\n| extend severity_value_s = case((severity_value_s == 'info'), \"Info\",(severity_value_s == 'low'), \"Low\",(severity_value_s == 'medium'), \"Medium\",(severity_value_s == 'high'), \"High\", (severity_value_s == 'positive'), \"Positive\", severity_value_s)\r\n| render piechart", "size": 3, "showAnalytics": true, "title": "Count by Severity", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "name": "Count by Severity", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Active Issues" }, "name": "Active Issues" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Issues per Vendor (CVE)" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a30af542-54cd-4a92-ac85-e094c9cc1c43", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 2592000000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Timerparameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "a3195f85-f04f-422c-b233-f9bd8a357b8b", "version": "KqlParameterItem/1.0", "name": "CVE", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"service_vuln_host_high\", \"label\":\"Service Vuln Host High\"},\r\n { \"value\":\"service_vuln_host_low\", \"label\":\"Service Vuln Host Low\" },\r\n { \"value\":\"service_vuln_host_medium\", \"label\":\"Service Vuln Host Medium\"},\r\n { \"value\":\"patching_cadence_high\", \"label\":\"Patching Cadence High\" },\r\n { \"value\":\"patching_cadence_low\", \"label\":\"Patching Cadence Low\"},\r\n { \"value\":\"patching_cadence_medium\", \"label\":\"Patching Cadence Medium\" },\r\n { \"value\":\"web_vuln_host_high\", \"label\":\"Web Vuln Host High\"},\r\n { \"value\":\"web_vuln_host_low\", \"label\":\"Web Vuln Host Low\" },\r\n { \"value\":\"web_vuln_host_medium\", \"label\":\"Web Vuln Host Medium\"}\r\n]", "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "CVE" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "0f2ad534-e343-44c2-a3ff-0d1d2c7916c5", "version": "KqlParameterItem/1.0", "name": "Portfolio", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Portfolio" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "55320f6b-3583-440d-977f-33ceffc07d94", "version": "KqlParameterItem/1.0", "name": "Company", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Company" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "070f384d-1ff0-49c9-8f3f-f121e78811a2", "version": "KqlParameterItem/1.0", "name": "Industry", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Industry" }, { "type": 1, "content": { "json": "
" }, "name": "text - 6" }, { "type": 1, "content": { "json": "Issues per Vendor will only encompass those that have appeared since the feed was turned on.", "style": "info" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and issueType_s in ({CVE}) and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d), [\"Issue Count\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s, subject_s, severity_value_s\r\n| extend CVE=strcat_array(split(issueType_s,\"_\"),\" \"), severity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5), Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\", severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',Factor_s,'/',issueType_s), Factor = strcat_array(split(Factor_s,\"_\"),\" \")\r\n| sort by CVE asc, severity_priority asc, subject_s asc\r\n| project subject_s, CVE, Factor, Severity, ['Findings Count'], [\"Issue Count\"], Active, Resolved, Details\r\n| project-rename Company = subject_s", "size": 0, "showAnalytics": true, "title": "Issues per Vendor", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "Info", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Positive", "representation": "turquoise", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to view details" } } ], "rowLimit": 10000, "filter": true } }, "name": "Issues per Vendor", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Issues per Vendor (CVE)" }, "name": "Issues per Vendor (CVE)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Issues per Vendor (Ransomware)" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "c9b54d32-38cd-4b08-8dd6-4be29b019c80", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 2592000000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Timerparameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "168555cd-afbe-457a-81c1-a68663c51823", "version": "KqlParameterItem/1.0", "name": "Ransomware", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "showDefault": false }, "jsonData": "[\r\n { \"value\":\"tls_weal_cipher\", \"label\":\"Tls Weal Cipher\"},\r\n { \"value\":\"exposed_personal_information_info\", \"label\":\"Exposed Personal Information Info\" },\r\n { \"value\":\"outdated_browser\", \"label\":\"Outdated Browser\"},\r\n { \"value\":\"csp_no_policy_v2\", \"label\":\"Csp No Policy V2\" },\r\n { \"value\":\"exposed_personal_information\", \"label\":\"Exposed Personal Information\"},\r\n { \"value\":\"ip_count_means\", \"label\":\"Ip Count Means\" },\r\n { \"value\":\"service_vuln_host_medium\", \"label\":\"Service Vuln Host Medium\"},\r\n { \"value\":\"hsts_incorrect_v2\", \"label\":\"Hsts Incorrect V2\" },\r\n { \"value\":\"unsafe_sri_v2\", \"label\":\"Unsafe Sri V2\"},\r\n { \"value\":\"leaked_credentials\", \"label\":\"Leaked Credentials\"},\r\n { \"value\":\"x_frame_options_incorrect_v2\", \"label\":\"X Frame Options Incorrect V2\"},\r\n { \"value\":\"x_xss_protection_incorrect_v2\", \"label\":\"X Xss Protection Incorrect V2\"},\r\n { \"value\":\"x_content_type_options_incorrect_v2\", \"label\":\"X Content Type Options Incorrect V2\"},\r\n { \"value\":\"tlscert_no_revocation\", \"label\":\"Tlscert No Revocation\"},\r\n { \"value\":\"tlscert_expired\", \"label\":\"Tlscert Expired\"},\r\n { \"value\":\"outdated_os\", \"label\":\"Outdated Os\"},\r\n { \"value\":\"tls_weak_protocol\", \"label\":\"Tls Weak Protocol\"},\r\n { \"value\":\"domain_missing_https_v2\", \"label\":\"Domain Missing Https V2\"},\r\n { \"value\":\"tlscert_excessive_expiration\", \"label\":\"Tlscert Excessive Expiration\"}\r\n]", "timeContext": { "durationMs": 604800000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Ransomware" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7bf4c309-6e2b-4619-9253-e85808486e75", "version": "KqlParameterItem/1.0", "name": "Portfolio", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Portfolio" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ee929211-b34e-4369-905b-cb4d87bf6364", "version": "KqlParameterItem/1.0", "name": "Company", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Company" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "8d9dcdcc-8c93-4b47-a2e1-880ffea2a31e", "version": "KqlParameterItem/1.0", "name": "Industry", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Industry" }, { "type": 1, "content": { "json": "
" }, "name": "text - 6" }, { "type": 1, "content": { "json": "Issues per Vendor will only encompass those that have appeared since the feed was turned on.", "style": "info" }, "name": "text - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and (groupStatus_s == 'active' or groupStatus_s == 'resolved') and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and issueType_s in ({Ransomware})\r\n| summarize arg_max(date_s,*) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| summarize [\"Findings Count\"] = sum(findingsCount_d),[\"Issue Count\"] = count(), src = arg_max(date_s,Factor_s), Active = sumif(findingsCount_d, groupStatus_s == \"active\"), Resolved = sumif(findingsCount_d, groupStatus_s == \"resolved\") by issueType_s, subject_s, severity_value_s \r\n| extend Ransomware=strcat_array(split(issueType_s,\"_\"),\" \"), Severity=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s), Details = strcat('https://platform.securityscorecard.io/#/scorecard/', subject_s,'/issues/',src,'/',issueType_s)\r\n| project subject_s, Ransomware, Severity, ['Findings Count'], ['Issue Count'], Active, Resolved, Details\r\n| project-rename Company = subject_s\r\n| sort by Ransomware asc, Company asc", "size": 0, "showAnalytics": true, "title": "Issues per Vendor", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Positive", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] } }, { "columnMatch": "Details", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "Click to view details" } }, { "columnMatch": "drilldown_url", "formatter": 7, "formatOptions": { "linkTarget": "Url", "linkLabel": "details" } } ], "rowLimit": 10000 } }, "name": "Issues per Vendor", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Issues per Vendor (Ransomware)" }, "name": "Issues per Vendor (Ransomware)" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "# Spotlight" }, "name": "text - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "73978413-5a37-4814-b4fc-4143999f13ec", "version": "KqlParameterItem/1.0", "name": "Timer", "label": "Time Range", "type": 4, "isRequired": true, "value": { "durationMs": 604800000 }, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 2592000000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 2592000000 } } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Timerparameter" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "73bc33a2-eb41-4433-9b1d-59930d7ddf3d", "version": "KqlParameterItem/1.0", "name": "Portfolio", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardRatings\r\n| where isnotempty(portfolioName_s)\r\n| distinct portfolioName_s", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Portfolio" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "ae9eff1e-6b7b-4d64-9516-30ea5bc5fb17", "version": "KqlParameterItem/1.0", "name": "Company", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio}))\r\n| distinct subject_s\r\n| sort by subject_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Company" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "d9274665-9d9c-417b-9d3f-03162538cf92", "version": "KqlParameterItem/1.0", "name": "Factor", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardIssue\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| extend label = strcat_array(split(Factor_s,\"_\"),\" \"),value = Factor_s\r\n| distinct value, label\r\n| sort by label asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Factor" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "485b4de7-9cd5-4e5e-b2d4-da7f921ff61c", "version": "KqlParameterItem/1.0", "name": "Industry", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "SecurityScorecardRatings\r\n| where ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| distinct industry_s\r\n| sort by industry_s asc", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "Timer", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "Industry" }, { "type": 1, "content": { "json": "
" }, "name": "text - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardRatings\r\n| where body_s =='OverAll' and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company}))\r\n| summarize arg_max(dateToday_s,*) by subject_s\r\n| extend Grade = case((scoreToday_d >= 90), \"A\",(scoreToday_d>=80 and scoreToday_d<=89), \"B\",(scoreToday_d>=70 and scoreToday_d<=79), \"C\",(scoreToday_d>=60 and scoreToday_d<=69), \"D\",isempty(scoreToday_d),\"\",\"F\") \r\n| project Grade, subject_s, scoreToday_d\r\n| project-rename Company = subject_s, Score = scoreToday_d\r\n| sort by Score asc\r\n| limit 10", "size": 0, "showAnalytics": true, "title": "Worst Performing Companies", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Grade", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "A", "representation": "green", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "B", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "C", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "D", "representation": "redBright", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "F", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "representation": "blue", "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "40", "name": "Worst Performing Companies", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue\r\n| where body_s == 'Issue' and groupStatus_s == \"active\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor}))\r\n| summarize arg_max(date_s,*), [\"Company Count\"] = dcount(subject_s,4) by issueName_s, severity_value_s, issueType_s, Factor_s\r\n| extend serverity_priority = case(severity_value_s == \"high\",1,severity_value_s == \"medium\",2,severity_value_s == \"low\",3,severity_value_s == \"info\",4,5), severity_value=case((severity_value_s == \"info\"),\"Info\",(severity_value_s == \"low\"),\"Low\",(severity_value_s == \"medium\"),\"Medium\",(severity_value_s == \"high\"),\"High\",(severity_value_s == \"positive\"),\"Positive\",severity_value_s) \r\n| extend Issues=trim(@\"'\",issueName_s), Factor=strcat_array(split(Factor_s,\"_\"),\" \") \r\n| sort by serverity_priority asc, [\"Company Count\"] desc\r\n| project Severity = severity_value, Issues, Factor = Factor, [\"Company Count\"]", "size": 0, "showAnalytics": true, "title": "Most Critical Issues", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Severity", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", "representation": "red", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", "representation": "yellow", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Info", "representation": "blue", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Positive", "representation": "lightBlue", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "60", "name": "Most Critical Issues", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e316e111-37ee-404b-8feb-920a6147bf30", "version": "KqlParameterItem/1.0", "name": "Severity", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "", "showDefault": false }, "jsonData": "[\r\n { \"value\":\"info\", \"label\":\"Info\"},\r\n { \"value\":\"low\", \"label\":\"Low\" },\r\n { \"value\":\"medium\", \"label\":\"Medium\"},\r\n { \"value\":\"high\", \"label\":\"high\" },\r\n { \"value\":\"positive\", \"label\":\"Positive\"}\r\n]", "timeContext": { "durationMs": 2592000000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "SecurityScorecardIssue \r\n| where body_s == \"Issue\" and groupStatus_s == \"active\" and ('*' in ({Industry}) or industry_s in ({Industry})) and ('*' in ({Portfolio}) or portfolioName_s in ({Portfolio})) and ('*' in ({Company}) or subject_s in ({Company})) and ('*' in ({Factor}) or Factor_s in ({Factor})) and severity_value_s in ({Severity})\r\n| summarize arg_max(date_s, *) by eventID_d, Factor_s, subject_s, date_s, issueType_s, groupStatus_s, findingsCount_d, issueName_s, totalScoreImpact_d, severity_value_s, industry_s, portfolioId_g\r\n| extend totalcount = toscalar(SecurityScorecardIssue | summarize dcount(subject_s))\r\n| summarize subject = dcount(subject_s), totalCount = max(totalcount) by issueName_s, issueType_s, Factor_s\r\n| extend [\"% of Portfolio Affected\"] = round((todouble(subject)/todouble(totalCount))*100,0)\r\n| extend Factor = strcat_array(split(Factor_s,\"_\"),\" \") \r\n| project Factor, issueName_s, [\"% of Portfolio Affected\"]\r\n| sort by [\"% of Portfolio Affected\"] desc\r\n| project-rename Issues = issueName_s", "size": 0, "showAnalytics": true, "title": "Most Common Issues", "timeContextFromParameter": "Timer", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "% of Portfolio Affected", "formatter": 3, "formatOptions": { "min": 0, "max": 100, "palette": "redDark" } } ] } }, "name": "Most Common Issues", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "setTab", "comparison": "isEqualTo", "value": "Spotlight" }, "name": "Spotlight" } ] }, "name": "Main", "styleSettings": { "showBorder": true } } ], "fromTemplateId": "sentinel-SecurityScorecardWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }