From 50bfc5b1e829585112aea535b6c00b8ab52689f1 Mon Sep 17 00:00:00 2001 From: Gunjan Jain Date: Thu, 29 Oct 2026 07:40:17 -0700 Subject: [PATCH] QCrypton PQC Scanner Agent for Microsoft Sentinel --- .script/idChangeValidator.d.ts.map | 2 +- .script/idChangeValidator.js.map | 2 +- .script/local-validation/validate.js | 2 +- .script/sampleDataValidator.js.map | 2 +- .../ValidConnectorIds.json | 3 +- .../sampleDataCheckers.d.ts.map | 2 +- .../sampleDataCheckers.js.map | 2 +- .script/yamlFileValidator.js.map | 2 +- .../Analytic Rules/AppServiceLegacyTLS.yaml | 4 +- .../CertExpiresAfter2030Classical.yaml | 4 +- .../NewQuantumVulnerableResource.yaml | 4 +- .../QuantumVulnerableEntraCert.yaml | 4 +- .../QuantumVulnerableKVKey.yaml | 4 +- .../Analytic Rules/WeakTLSCertOnGateway.yaml | 4 +- .../Package/createUiDefinition.json | 4 +- .../Package/mainTemplate.json | 57 +- .../QCryptonPQC-Notify/azuredeploy.json | 10 +- .../QCryptonPQCScanner/SolutionMetadata.json | 2 +- .../ApplianceCertExpiringSoon.yaml | 38 + .../AppliancePQCReadyDetected.yaml | 37 + .../ApplianceQuantumVulnerableCert.yaml | 42 + .../HighRiskInternalEndpoint.yaml | 39 + .../InternalEndpointWeakTLS.yaml | 36 + .../NewApplianceVulnerableResource.yaml | 38 + .../Data Connectors/PQReadiness_Table.json | 104 + ...onPQCScannerAgent_ConnectorDefinition.json | 136 ++ .../QCryptonPQCScannerAgent_DCR.json | 107 + ...QCryptonPQCScannerAgent_PollingConfig.json | 50 + .../Solution_QCryptonPQCScannerAgent.json | 24 + .../QCryptonPQCScannerAgent/Package/3.0.0.zip | Bin 0 -> 15652 bytes .../Package/createUiDefinition.json | 267 +++ .../Package/mainTemplate.json | 1895 +++++++++++++++++ .../Package/testParameters.json | 46 + .../QCryptonPQCScannerAgent-Notify/README.md | 21 + .../azuredeploy.json | 144 ++ .../QCryptonPQCScannerAgent/ReleaseNotes.md | 32 + .../SolutionMetadata.json | 16 + .../QCryptonPQCScannerAgentPostureBlack.png | Bin 0 -> 661 bytes .../QCryptonPQCScannerAgentPostureWhite.png | Bin 0 -> 661 bytes .../QCryptonPQCScannerAgentPosture.json | 113 + Workbooks/WorkbooksMetadata.json | 20 + 41 files changed, 3276 insertions(+), 43 deletions(-) create mode 100644 Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceCertExpiringSoon.yaml create mode 100644 Solutions/QCryptonPQCScannerAgent/Analytic Rules/AppliancePQCReadyDetected.yaml create mode 100644 Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceQuantumVulnerableCert.yaml create mode 100644 Solutions/QCryptonPQCScannerAgent/Analytic Rules/HighRiskInternalEndpoint.yaml create mode 100644 Solutions/QCryptonPQCScannerAgent/Analytic Rules/InternalEndpointWeakTLS.yaml create mode 100644 Solutions/QCryptonPQCScannerAgent/Analytic Rules/NewApplianceVulnerableResource.yaml create mode 100644 Solutions/QCryptonPQCScannerAgent/Data Connectors/PQReadiness_Table.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_ConnectorDefinition.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_DCR.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_PollingConfig.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Data/Solution_QCryptonPQCScannerAgent.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Package/3.0.0.zip create mode 100644 Solutions/QCryptonPQCScannerAgent/Package/createUiDefinition.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Package/mainTemplate.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Package/testParameters.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/README.md create mode 100644 Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/azuredeploy.json create mode 100644 Solutions/QCryptonPQCScannerAgent/ReleaseNotes.md create mode 100644 Solutions/QCryptonPQCScannerAgent/SolutionMetadata.json create mode 100644 Solutions/QCryptonPQCScannerAgent/Workbooks/Images/Preview/QCryptonPQCScannerAgentPostureBlack.png create mode 100644 Solutions/QCryptonPQCScannerAgent/Workbooks/Images/Preview/QCryptonPQCScannerAgentPostureWhite.png create mode 100644 Solutions/QCryptonPQCScannerAgent/Workbooks/QCryptonPQCScannerAgentPosture.json diff --git a/.script/idChangeValidator.d.ts.map b/.script/idChangeValidator.d.ts.map index be591569f2f..b22729bbb9a 100644 --- a/.script/idChangeValidator.d.ts.map +++ b/.script/idChangeValidator.d.ts.map @@ -1 +1 @@ -{"version":3,"file":"idChangeValidator.d.ts","sourceRoot":"","sources":["idChangeValidator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAU/C,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuExE"} \ No newline at end of file +{"version":3,"file":"idChangeValidator.d.ts","sourceRoot":"","sources":["idChangeValidator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAU/C,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyExE"} \ No newline at end of file diff --git a/.script/idChangeValidator.js.map b/.script/idChangeValidator.js.map index af7cf11ad16..0697825da52 100644 --- a/.script/idChangeValidator.js.map +++ b/.script/idChangeValidator.js.map @@ -1 +1 @@ -{"version":3,"file":"idChangeValidator.js","sourceRoot":"","sources":["idChangeValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,IAAmB,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,MAAM,UAAU,GAAW,OAAO,CAAC,GAAG,EAAE,CAAC;AACzC,MAAM,SAAS,GAAW,iFAAiF,CAAC;AAC5G,MAAM,eAAe,GAAW,QAAQ,SAAS,aAAa,CAAC;AAC/D,MAAM,GAAG,GAAc,IAAI,CAAC,UAAU,CAAC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IAEjD,MAAM,2BAA2B,GAAG,UAAU,GAAG,sEAAsE,CAAC;IACxH,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,2BAA2B,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QACxE,QAAQ,GAAG,UAAU,GAAG,GAAG,GAAG,QAAQ,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtB,IAAI,OAAO,EAAE,KAAK,WAAW,EAAE;YAC3B,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC1F,+BAAsB;SACzB;QAED,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACrC,IAAI;gBACA,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,yBAAyB,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;aAC9I;YAAC,OAAO,CAAC,EAAE;gBACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;gBACnE,+BAAsB;aACzB;SACJ;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACrC,IAAI;gBACI,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,yBAAyB,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAG,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;aACnJ;YAAC,OAAO,CAAC,EAAE;gBACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;gBACnE,+BAAsB;aACzB;SACJ;QAED,MAAM,OAAO,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,CAAC;QAEpC,IAAI,YAAY,EAAE;YAEd,oHAAoH;YACpH,+BAA+B;YAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,iFAAiF,EAAE,GAAG,CAAC,CAAC;YAC7G,IAAI,MAAM,CAAC;YACX,IAAI,KAAK,GAAW,EAAE,CAAC;YACvB,IAAI,KAAK,GAAW,EAAE,CAAC;YAEvB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,KAAK,IAAI,EAAE,EAAE;oBACb,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB;qBAAM;oBACH,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB;aACJ;YACD,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,KAAK,GAAG,CAAC,CAAC;YAE5C,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE;gBACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,mCAAmC,CAAC,CAAC;gBAC5D,gCAAwB;aAC3B;iBAAM;gBACH,IAAI,KAAK,KAAK,KAAK,EAAE;oBACjB,MAAM,IAAI,KAAK,EAAE,CAAC;iBACrB;aACJ;SACJ;KACJ;IACD,gCAAwB;AAC5B,CAAC;AAED,IAAI,SAAS,GAAG,CAAC,UAAU,CAAC,CAAC;AAC7B,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC/C,IAAI,sBAAsB,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACzD,IAAI,YAAY,GAAG;IACf,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;QAC9B,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,CAAM,EAAE,QAAgB,EAAE,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,QAAQ,gEAAgE,CAAC,CAAC;IACjH,CAAC;IACD,aAAa,EAAE,KAAK,IAAI,EAAE;QACtB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IAC/D,CAAC;CACJ,CAAC;AAEF,wBAAwB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC"} \ No newline at end of file +{"version":3,"file":"idChangeValidator.js","sourceRoot":"","sources":["idChangeValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAExD,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,IAAmB,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,MAAM,UAAU,GAAW,OAAO,CAAC,GAAG,EAAE,CAAC;AACzC,MAAM,SAAS,GAAW,iFAAiF,CAAC;AAC5G,MAAM,eAAe,GAAW,QAAQ,SAAS,aAAa,CAAC;AAC/D,MAAM,GAAG,GAAc,IAAI,CAAC,UAAU,CAAC,CAAC;AAExC,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IAEjD,MAAM,2BAA2B,GAAG,UAAU,GAAG,sEAAsE,CAAC;IACxH,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,2BAA2B,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAEtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QACxE,QAAQ,GAAG,UAAU,GAAG,GAAG,GAAG,QAAQ,CAAC;QACvC,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtB,IAAI,OAAO,EAAE,KAAK,WAAW,EAAE;YAC3B,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC1F,+BAAsB;SACzB;QAED,oFAAoF;QACpF,MAAM,YAAY,GAAG,gBAAgB,CAAC;QACtC,MAAM,YAAY,GAAG,gBAAgB,CAAC;QACtC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;YACtC,IAAI;gBACA,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,yBAAyB,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC;aAC/I;YAAC,OAAO,CAAC,EAAE;gBACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;gBACnE,+BAAsB;aACzB;SACJ;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE;YACtC,IAAI;gBACI,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,yBAAyB,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAG,EAAE,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC;aACpJ;YAAC,OAAO,CAAC,EAAE;gBACR,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC;gBACnE,+BAAsB;aACzB;SACJ;QAED,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,UAAU,GAAG,CAAC,CAAC;QAEpC,IAAI,YAAY,EAAE;YAEd,oHAAoH;YACpH,+BAA+B;YAE/B,MAAM,KAAK,GAAG,MAAM,CAAC,iFAAiF,EAAE,GAAG,CAAC,CAAC;YAC7G,IAAI,MAAM,CAAC;YACX,IAAI,KAAK,GAAW,EAAE,CAAC;YACvB,IAAI,KAAK,GAAW,EAAE,CAAC;YAEvB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE;gBAChD,IAAI,KAAK,IAAI,EAAE,EAAE;oBACb,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB;qBAAM;oBACH,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACrB;aACJ;YACD,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,QAAQ,KAAK,GAAG,CAAC,CAAC;YAE5C,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE;gBACjC,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,mCAAmC,CAAC,CAAC;gBAC5D,gCAAwB;aAC3B;iBAAM;gBACH,IAAI,KAAK,KAAK,KAAK,EAAE;oBACjB,MAAM,IAAI,KAAK,EAAE,CAAC;iBACrB;aACJ;SACJ;KACJ;IACD,gCAAwB;AAC5B,CAAC;AAED,IAAI,SAAS,GAAG,CAAC,UAAU,CAAC,CAAC;AAC7B,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAC/C,IAAI,sBAAsB,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;AACzD,IAAI,YAAY,GAAG;IACf,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;QAC9B,OAAO,cAAc,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,CAAM,EAAE,QAAgB,EAAE,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,mBAAmB,QAAQ,gEAAgE,CAAC,CAAC;IACjH,CAAC;IACD,aAAa,EAAE,KAAK,IAAI,EAAE;QACtB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IAC/D,CAAC;CACJ,CAAC;AAEF,wBAAwB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC"} \ No newline at end of file diff --git a/.script/local-validation/validate.js b/.script/local-validation/validate.js index 8e054f8e044..2adc8b5d895 100644 --- a/.script/local-validation/validate.js +++ b/.script/local-validation/validate.js @@ -999,7 +999,7 @@ async function runDotNetValidator(projectPath, validatorName, selectedContentRoo const testOut = execFileSync("dotnet", ["test", projectPath, "--configuration", "Release", "--verbosity", "minimal"], { encoding: "utf8", stdio: "pipe", - timeout: 300000, // 5 minute timeout + timeout: 300000, env: { ...process.env, SENTINEL_VALIDATION_CONTENT_ROOT: selectedContentRoot, diff --git a/.script/sampleDataValidator.js.map b/.script/sampleDataValidator.js.map index 4567e7e380c..a2453591026 100644 --- a/.script/sampleDataValidator.js.map +++ b/.script/sampleDataValidator.js.map @@ -1 +1 @@ -{"version":3,"file":"sampleDataValidator.js","sourceRoot":"","sources":["sampleDataValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,GAC9B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,6BAA6B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IACD,gCAAwB;AAC1B,CAAC;AAGD,IAAI,gBAAgB,GAAG,CAAC,MAAM,CAAC,CAAC;AAChC,IAAI,sBAAsB,GAAG,CAAC,aAAa,CAAC,CAAC;AAC7C,IAAI,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtC,IAAI,YAAY,GAAG;IACjB,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;QAChC,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,CAAM,EAAE,QAAgB,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,6CAA6C,QAAQ,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,aAAa,EAAE,KAAK,IAAI,EAAE;QACxB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC;AAEF,wBAAwB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC"} \ No newline at end of file +{"version":3,"file":"sampleDataValidator.js","sourceRoot":"","sources":["sampleDataValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,iBAAiB,EACjB,6BAA6B,GAC9B,MAAM,kDAAkD,CAAC;AAE1D,OAAO,EACL,qBAAqB,EACrB,4BAA4B,EAC5B,6BAA6B,GAC9B,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE;QAC1C,6BAA6B,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;KACnD;SAAM;QACL,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KAC7B;IACD,gCAAwB;AAC1B,CAAC;AAGD,IAAI,gBAAgB,GAAG,CAAC,MAAM,CAAC,CAAC;AAChC,IAAI,sBAAsB,GAAG,CAAC,aAAa,CAAC,CAAC;AAC7C,IAAI,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtC,IAAI,YAAY,GAAG;IACjB,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;QAChC,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,CAAM,EAAE,QAAgB,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,6CAA6C,QAAQ,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,aAAa,EAAE,KAAK,IAAI,EAAE;QACxB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC;AAEF,wBAAwB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,sBAAsB,CAAC,CAAC"} \ No newline at end of file diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 880727c1fef..76cb27fa68c 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -370,5 +370,6 @@ "RedRaysSAPSecurityFindings", "NetcraftIntegrationGatewayDefinition", "HoneyForge", - "QCryptonPQCScanner" + "QCryptonPQCScannerCCPDefinition", + "QCryptonPQCScannerAgentCCPDefinition" ] diff --git a/.script/utils/sampleDataCheckers/sampleDataCheckers.d.ts.map b/.script/utils/sampleDataCheckers/sampleDataCheckers.d.ts.map index c81bcec06ac..d00393d0378 100644 --- a/.script/utils/sampleDataCheckers/sampleDataCheckers.d.ts.map +++ b/.script/utils/sampleDataCheckers/sampleDataCheckers.d.ts.map @@ -1 +1 @@ -{"version":3,"file":"sampleDataCheckers.d.ts","sourceRoot":"","sources":["sampleDataCheckers.ts"],"names":[],"mappings":"AAEA,wBAAgB,iBAAiB,CAAC,iBAAiB,EAAE,MAAM,WAcxD"} \ No newline at end of file +{"version":3,"file":"sampleDataCheckers.d.ts","sourceRoot":"","sources":["sampleDataCheckers.ts"],"names":[],"mappings":"AAwBA,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAwB5D;AAWD,wBAAgB,6BAA6B,CAC3C,iBAAiB,EAAE,OAAO,EAC1B,QAAQ,SAAK,GACZ,OAAO,CAyCT;AAED,wBAAgB,iBAAiB,CAAC,iBAAiB,EAAE,GAAG,WAkBvD"} \ No newline at end of file diff --git a/.script/utils/sampleDataCheckers/sampleDataCheckers.js.map b/.script/utils/sampleDataCheckers/sampleDataCheckers.js.map index fbb89eef048..1ca6da92bbe 100644 --- a/.script/utils/sampleDataCheckers/sampleDataCheckers.js.map +++ b/.script/utils/sampleDataCheckers/sampleDataCheckers.js.map @@ -1 +1 @@ -{"version":3,"file":"sampleDataCheckers.js","sourceRoot":"","sources":["sampleDataCheckers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,UAAU,iBAAiB,CAAC,iBAAyB;IACxD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAErC,IAAG,iBAAiB,CAAC,MAAM,GAAC,CAAC,IAAI,iBAAiB,CAAC,MAAM,IAAE,SAAS,EACpE;QACI,MAAM,IAAI,yBAAyB,CAAC,qDAAqD,CAAC,CAAC;KAC9F;IACD,IAAI,KAAK,GAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAE,CAAC;IAC/D,IAAI,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,IAAE,QAAQ,CAAC,CAAA;IAC5C,IAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAE,CAAC,EAC/C;QACC,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;KAC7E;IACF,OAAO,IAAI,CAAC;AACb,CAAC;AACD,SAAS,aAAa,CAAE,iBAAyB;IAG9C,OAAO,iBAAiB,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;AAC3F,CAAC;AAAA,CAAC"} \ No newline at end of file +{"version":3,"file":"sampleDataCheckers.js","sourceRoot":"","sources":["sampleDataCheckers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAElE,MAAM,QAAQ,GAAG,yBAAyB,CAAC;AAC3C,MAAM,qBAAqB,GAAG,4EAA4E,CAAC;AAE3G,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,yBAAyB;IACzB,kBAAkB;IAClB,mBAAmB;IACnB,gCAAgC;CACjC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,eAAe;IACf,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,aAAa;IACb,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;AAE/E,MAAM,UAAU,4BAA4B,CAAC,QAAgB;IAC3D,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;QAC1C,OAAO,IAAI,CAAC;KACb;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,OAAO,IAAI,CAAC,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE;QACrD,OAAO,KAAK,CAAC;KACd;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QACvC,OAAO,IAAI,CAAC;KACb;IACD,KAAK,MAAM,aAAa,IAAI,uBAAuB,EAAE;QACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,aAAa,EAAE,CAAC,EAAE;YACxC,OAAO,IAAI,CAAC;SACb;KACF;IACD,KAAK,MAAM,WAAW,IAAI,sBAAsB,EAAE;QAChD,IAAI,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;YACnE,OAAO,IAAI,CAAC;SACb;KACF;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,MAAM,GAAG,CAAC,CACzD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,iBAA0B,EAC1B,QAAQ,GAAG,EAAE;IAEb,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,EAAE;QAC7C,MAAM,IAAI,yBAAyB,CACjC,kEAAkE,CACnE,CAAC;KACH;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,cAAc,GAClB,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,cAAc,KAAK,eAAe,CAAC;IAElF,IAAI,cAAc,EAAE;QAClB,MAAM,UAAU,GACd,iBAAiB,CAAC,KAAK;YACvB,iBAAiB,CAAC,SAAS;YAC3B,iBAAiB,CAAC,IAAI,CAAC;QACzB,MAAM,aAAa,GACjB,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,MAAM,YAAY,GAChB,iBAAiB,CAAC,OAAO;YACzB,iBAAiB,CAAC,MAAM;YACxB,iBAAiB,CAAC,MAAM,CAAC;QAC3B,MAAM,kBAAkB,GACtB,qBAAqB,CAAC,YAAY,CAAC;YACnC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE3D,IAAI,CAAC,aAAa,IAAI,CAAC,kBAAkB,EAAE;YACzC,MAAM,IAAI,yBAAyB,CACjC,kGAAkG,CACnG,CAAC;SACH;KACF;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE;QAC5B,MAAM,IAAI,yBAAyB,CACjC,iIAAiI,CAClI,CAAC;KACH;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,iBAAsB;IACtD,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAEtC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACjC,iBAAiB,CAAC,MAAM,IAAI,CAAC;QAC7B,iBAAiB,CAAC,MAAM,IAAI,SAAS,EACrC;QACA,MAAM,IAAI,yBAAyB,CACjC,qDAAqD,CACtD,CAAC;KACH;IACD,IAAI,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7D,IAAI,QAAQ,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;QACjD,MAAM,IAAI,yBAAyB,CAAC,uCAAuC,CAAC,CAAC;KAC9E;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,iBAAyB;IAC9C,OAAO,iBAAiB,CAAC,KAAK,CAC5B,sDAAsD,CACvD,CAAC;AACJ,CAAC"} \ No newline at end of file diff --git a/.script/yamlFileValidator.js.map b/.script/yamlFileValidator.js.map index 5540b3614cc..f135870fa03 100644 --- a/.script/yamlFileValidator.js.map +++ b/.script/yamlFileValidator.js.map @@ -1 +1 @@ -{"version":3,"file":"yamlFileValidator.js","sourceRoot":"","sources":["yamlFileValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD,gCAAwB;AAC1B,CAAC;AAED,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACvC,IAAI,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtC,IAAI,YAAY,GAAG;IACjB,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;QAChC,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,CAAM,EAAE,QAAgB,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,mCAAmC,QAAQ,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,aAAa,EAAE,KAAK,IAAI,EAAE;QACxB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC;AAEF,wBAAwB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC"} \ No newline at end of file +{"version":3,"file":"yamlFileValidator.js","sourceRoot":"","sources":["yamlFileValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,MAAM,mBAAmB,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,gCAAwB;AAC1B,CAAC;AAED,IAAI,gBAAgB,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACvC,IAAI,SAAS,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACtC,IAAI,YAAY,GAAG;IACjB,WAAW,EAAE,CAAC,QAAgB,EAAE,EAAE;QAChC,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IACD,WAAW,EAAE,KAAK,EAAE,CAAM,EAAE,QAAgB,EAAE,EAAE;QAC9C,OAAO,CAAC,GAAG,CAAC,mCAAmC,QAAQ,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,aAAa,EAAE,KAAK,IAAI,EAAE;QACxB,MAAM,CAAC,QAAQ,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC;AAEF,wBAAwB,CAAC,YAAY,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC"} \ No newline at end of file diff --git a/Solutions/QCryptonPQCScanner/Analytic Rules/AppServiceLegacyTLS.yaml b/Solutions/QCryptonPQCScanner/Analytic Rules/AppServiceLegacyTLS.yaml index c8b4cb4764a..03b104c1d85 100644 --- a/Solutions/QCryptonPQCScanner/Analytic Rules/AppServiceLegacyTLS.yaml +++ b/Solutions/QCryptonPQCScanner/Analytic Rules/AppServiceLegacyTLS.yaml @@ -7,7 +7,7 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: QCryptonPQCScanner + - connectorId: QCryptonPQCScannerCCPDefinition dataTypes: - PQReadiness_CL queryFrequency: 1d @@ -35,5 +35,5 @@ entityMappings: fieldMappings: - identifier: HostName columnName: ResourceName -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/QCryptonPQCScanner/Analytic Rules/CertExpiresAfter2030Classical.yaml b/Solutions/QCryptonPQCScanner/Analytic Rules/CertExpiresAfter2030Classical.yaml index 8c764e3a299..cf04e7587a4 100644 --- a/Solutions/QCryptonPQCScanner/Analytic Rules/CertExpiresAfter2030Classical.yaml +++ b/Solutions/QCryptonPQCScanner/Analytic Rules/CertExpiresAfter2030Classical.yaml @@ -7,7 +7,7 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: QCryptonPQCScanner + - connectorId: QCryptonPQCScannerCCPDefinition dataTypes: - PQReadiness_CL queryFrequency: 1d @@ -31,5 +31,5 @@ entityMappings: fieldMappings: - identifier: ResourceId columnName: ResourceId -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/QCryptonPQCScanner/Analytic Rules/NewQuantumVulnerableResource.yaml b/Solutions/QCryptonPQCScanner/Analytic Rules/NewQuantumVulnerableResource.yaml index 8e9cb196395..19f264f56e0 100644 --- a/Solutions/QCryptonPQCScanner/Analytic Rules/NewQuantumVulnerableResource.yaml +++ b/Solutions/QCryptonPQCScanner/Analytic Rules/NewQuantumVulnerableResource.yaml @@ -7,7 +7,7 @@ description: | severity: Informational status: Available requiredDataConnectors: - - connectorId: QCryptonPQCScanner + - connectorId: QCryptonPQCScannerCCPDefinition dataTypes: - PQReadiness_CL queryFrequency: 1d @@ -33,5 +33,5 @@ entityMappings: fieldMappings: - identifier: ResourceId columnName: ResourceId -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableEntraCert.yaml b/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableEntraCert.yaml index 701e3680bd4..27a3044843b 100644 --- a/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableEntraCert.yaml +++ b/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableEntraCert.yaml @@ -9,7 +9,7 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: QCryptonPQCScanner + - connectorId: QCryptonPQCScannerCCPDefinition dataTypes: - PQReadiness_CL queryFrequency: 1d @@ -33,5 +33,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: ResourceName -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableKVKey.yaml b/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableKVKey.yaml index c8b891229ee..0b4d8a3a5ed 100644 --- a/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableKVKey.yaml +++ b/Solutions/QCryptonPQCScanner/Analytic Rules/QuantumVulnerableKVKey.yaml @@ -8,7 +8,7 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: QCryptonPQCScanner + - connectorId: QCryptonPQCScannerCCPDefinition dataTypes: - PQReadiness_CL queryFrequency: 1h @@ -36,5 +36,5 @@ entityMappings: fieldMappings: - identifier: Url columnName: AssetIdentifier -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/QCryptonPQCScanner/Analytic Rules/WeakTLSCertOnGateway.yaml b/Solutions/QCryptonPQCScanner/Analytic Rules/WeakTLSCertOnGateway.yaml index 50e95b55faf..3dfda036de6 100644 --- a/Solutions/QCryptonPQCScanner/Analytic Rules/WeakTLSCertOnGateway.yaml +++ b/Solutions/QCryptonPQCScanner/Analytic Rules/WeakTLSCertOnGateway.yaml @@ -8,7 +8,7 @@ description: | severity: High status: Available requiredDataConnectors: - - connectorId: QCryptonPQCScanner + - connectorId: QCryptonPQCScannerCCPDefinition dataTypes: - PQReadiness_CL queryFrequency: 1h @@ -35,5 +35,5 @@ entityMappings: fieldMappings: - identifier: Url columnName: AssetIdentifier -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/QCryptonPQCScanner/Package/createUiDefinition.json b/Solutions/QCryptonPQCScanner/Package/createUiDefinition.json index 99b85502eb6..401fed2315d 100644 --- a/Solutions/QCryptonPQCScanner/Package/createUiDefinition.json +++ b/Solutions/QCryptonPQCScanner/Package/createUiDefinition.json @@ -44,7 +44,7 @@ "placeholder": "Select a workspace", "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", "constraints": { - "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(concat('/resourcegroups/', resourceGroup().name, '/')))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", "required": true }, "visible": true @@ -259,7 +259,7 @@ } ], "outputs": { - "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(concat('/resourcegroups/', resourceGroup().name, '/'))),equals(filter.name,basics('workspace')))), (item) => item.location))]", "location": "[location()]", "workspace": "[basics('workspace')]" } diff --git a/Solutions/QCryptonPQCScanner/Package/mainTemplate.json b/Solutions/QCryptonPQCScanner/Package/mainTemplate.json index 49b439b4471..c493a829945 100644 --- a/Solutions/QCryptonPQCScanner/Package/mainTemplate.json +++ b/Solutions/QCryptonPQCScanner/Package/mainTemplate.json @@ -290,7 +290,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" }, @@ -679,7 +679,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" }, @@ -768,7 +768,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -888,7 +888,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" }, @@ -960,7 +960,7 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "QCryptonPQCScanner", + "connectorId": "QCryptonPQCScannerCCPDefinition", "dataTypes": [ "PQReadiness_CL" ] @@ -1014,7 +1014,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1072,7 +1072,7 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "QCryptonPQCScanner", + "connectorId": "QCryptonPQCScannerCCPDefinition", "dataTypes": [ "PQReadiness_CL" ] @@ -1117,7 +1117,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1175,7 +1175,7 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "QCryptonPQCScanner", + "connectorId": "QCryptonPQCScannerCCPDefinition", "dataTypes": [ "PQReadiness_CL" ] @@ -1220,7 +1220,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1278,7 +1278,7 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "QCryptonPQCScanner", + "connectorId": "QCryptonPQCScannerCCPDefinition", "dataTypes": [ "PQReadiness_CL" ] @@ -1332,7 +1332,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1390,7 +1390,7 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "QCryptonPQCScanner", + "connectorId": "QCryptonPQCScannerCCPDefinition", "dataTypes": [ "PQReadiness_CL" ] @@ -1444,7 +1444,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1502,7 +1502,7 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "QCryptonPQCScanner", + "connectorId": "QCryptonPQCScannerCCPDefinition", "dataTypes": [ "PQReadiness_CL" ] @@ -1547,7 +1547,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1660,6 +1660,14 @@ "parameters": { "$connections": { "type": "Object" + }, + "TeamsGroupId": { + "defaultValue": "", + "type": "String" + }, + "TeamsChannelId": { + "defaultValue": "", + "type": "String" } }, "triggers": { @@ -1705,7 +1713,12 @@ "azuresentinel": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", "connectionName": "[[variables('AzureSentinelConnectionName')]", - "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]" + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } }, "teams": { "connectionId": "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]", @@ -1713,6 +1726,12 @@ "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]" } } + }, + "TeamsGroupId": { + "value": "[[parameters('TeamsGroupId')]" + }, + "TeamsChannelId": { + "value": "[[parameters('TeamsChannelId')]" } } }, @@ -1739,7 +1758,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } @@ -1810,7 +1829,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" }, diff --git a/Solutions/QCryptonPQCScanner/Playbooks/QCryptonPQC-Notify/azuredeploy.json b/Solutions/QCryptonPQCScanner/Playbooks/QCryptonPQC-Notify/azuredeploy.json index 168e6361baa..8a612a31952 100644 --- a/Solutions/QCryptonPQCScanner/Playbooks/QCryptonPQC-Notify/azuredeploy.json +++ b/Solutions/QCryptonPQCScanner/Playbooks/QCryptonPQC-Notify/azuredeploy.json @@ -96,7 +96,9 @@ "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", "contentVersion": "1.0.0.0", "parameters": { - "$connections": { "defaultValue": {}, "type": "Object" } + "$connections": { "defaultValue": {}, "type": "Object" }, + "TeamsGroupId": { "defaultValue": "", "type": "String" }, + "TeamsChannelId": { "defaultValue": "", "type": "String" } }, "triggers": { "Microsoft_Sentinel_incident": { @@ -144,6 +146,12 @@ "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/teams')]" } } + }, + "TeamsGroupId": { + "value": "[parameters('TeamsGroupId')]" + }, + "TeamsChannelId": { + "value": "[parameters('TeamsChannelId')]" } } } diff --git a/Solutions/QCryptonPQCScanner/SolutionMetadata.json b/Solutions/QCryptonPQCScanner/SolutionMetadata.json index eb7a525c48b..1dee6969e18 100644 --- a/Solutions/QCryptonPQCScanner/SolutionMetadata.json +++ b/Solutions/QCryptonPQCScanner/SolutionMetadata.json @@ -9,7 +9,7 @@ }, "support": { "name": "QCrypton, Inc.", - "email": "support@qcryptonapp.com", + "email": "support@qcrypton.com", "tier": "Partner", "link": "https://www.qcrypton.com/contact.html" } diff --git a/Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceCertExpiringSoon.yaml b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceCertExpiringSoon.yaml new file mode 100644 index 00000000000..a8787b75b5a --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceCertExpiringSoon.yaml @@ -0,0 +1,38 @@ +id: f6a7b8c9-d0e1-4f2a-3b4c-5d6e7f8a9b0c +name: Appliance certificate expiring within 30 days with classical algorithm +description: | + A network appliance TLS certificate is expiring within the next 30 days and uses a classical + (quantum-vulnerable) signature algorithm. Certificate renewal is an ideal time to migrate to a + PQ-hybrid certificate. If the certificate is renewed with a classical algorithm, the + harvest-now-decrypt-later exposure window resets for the new validity period. +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: QCryptonPQCScannerAgentCCPDefinition + dataTypes: + - PQReadiness_CL +queryFrequency: 1d +queryPeriod: 1d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Persistence +relevantTechniques: + - T1556 +query: | + PQReadiness_CL + | where TimeGenerated > ago(1d) + | where AssetKind == "tls-cert" + | where QuantumPosture == "vulnerable" + | where isnotnull(ExpiresOn) and ExpiresOn between (now() .. ago(-30d)) + | where ResourceType has_any ("F5", "CheckPoint", "PaloAlto", "Cisco", "Fortinet") + or Metadata contains "certificate_expiring" + | project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, SignatureAlgorithm, ExpiresOn, RiskScore, PostureReason, SubscriptionId, ResourceGroup + | order by ExpiresOn asc +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: ResourceName +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/QCryptonPQCScannerAgent/Analytic Rules/AppliancePQCReadyDetected.yaml b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/AppliancePQCReadyDetected.yaml new file mode 100644 index 00000000000..e4560aca1ec --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/AppliancePQCReadyDetected.yaml @@ -0,0 +1,37 @@ +id: d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a +name: PQC-ready appliance detected -- quantum-safe posture confirmed +description: | + A network appliance has been confirmed as post-quantum ready. This may indicate a QCrypton PQC + Engine deployment on F5 BIG-IP, a hybrid key exchange (X25519MLKEM768) negotiation, or an + ML-DSA/ML-KEM certificate in use. This is a positive signal -- the appliance is protected against + harvest-now-decrypt-later attacks. +severity: Informational +status: Available +requiredDataConnectors: + - connectorId: QCryptonPQCScannerAgentCCPDefinition + dataTypes: + - PQReadiness_CL +queryFrequency: 1d +queryPeriod: 1d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - DefenseEvasion +relevantTechniques: + - T1600 +query: | + PQReadiness_CL + | where TimeGenerated > ago(1d) + | where QuantumPosture == "compliant" + | where Metadata contains "pqc_hybrid_key_exchange" + or Metadata contains "f5_pqc_engine_active" + or Metadata contains "f5_cert_pqc_ready" + or Metadata contains "pqc_cert_ready" + | project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, Algorithm, PostureReason, SubscriptionId, ResourceGroup +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: ResourceName +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceQuantumVulnerableCert.yaml b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceQuantumVulnerableCert.yaml new file mode 100644 index 00000000000..059c3feb4c0 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/ApplianceQuantumVulnerableCert.yaml @@ -0,0 +1,42 @@ +id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d +name: Network appliance serving quantum-vulnerable certificate +description: | + A network appliance (F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, or Fortinet) is presenting a + TLS certificate signed with a classical algorithm (RSA/ECDSA) that is vulnerable to quantum attack. + These appliances terminate TLS for critical internal traffic and are prime harvest-now-decrypt-later + targets. Migrate to PQ-hybrid certificates or deploy QCrypton PQC Engine to front the appliance. +severity: High +status: Available +requiredDataConnectors: + - connectorId: QCryptonPQCScannerAgentCCPDefinition + dataTypes: + - PQReadiness_CL +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - InitialAccess + - Collection +relevantTechniques: + - T1190 + - T1557 +query: | + PQReadiness_CL + | where TimeGenerated > ago(1h) + | where AssetKind == "tls-cert" + | where QuantumPosture == "vulnerable" + | where ResourceType has_any ("F5", "CheckPoint", "PaloAlto", "Cisco", "Fortinet") + | project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, Algorithm, SignatureAlgorithm, KeySize, ExpiresOn, RiskScore, PostureReason, SubscriptionId, ResourceGroup + | order by RiskScore desc +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: ResourceName + - entityType: Url + fieldMappings: + - identifier: Url + columnName: AssetIdentifier +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/QCryptonPQCScannerAgent/Analytic Rules/HighRiskInternalEndpoint.yaml b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/HighRiskInternalEndpoint.yaml new file mode 100644 index 00000000000..c9c37ae3500 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/HighRiskInternalEndpoint.yaml @@ -0,0 +1,39 @@ +id: e5f6a7b8-c9d0-4e1f-2a3b-4c5d6e7f8a9b +name: High-risk internal endpoint with critical quantum vulnerability +description: | + An internal endpoint or network appliance has a risk score above 20, indicating critical or high + severity quantum vulnerabilities. This may include expired certificates on appliances, RSA keys + shorter than 2048 bits, or multiple compounding vulnerabilities on the same endpoint. Immediate + remediation is recommended. +severity: High +status: Available +requiredDataConnectors: + - connectorId: QCryptonPQCScannerAgentCCPDefinition + dataTypes: + - PQReadiness_CL +queryFrequency: 1h +queryPeriod: 1h +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Impact +relevantTechniques: + - T1565 +query: | + PQReadiness_CL + | where TimeGenerated > ago(1h) + | where QuantumPosture == "vulnerable" + | where RiskScore > 20 + | project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, AssetKind, Algorithm, KeySize, SignatureAlgorithm, PostureReason, RiskScore, ExpiresOn, SubscriptionId, ResourceGroup + | order by RiskScore desc +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: ResourceName + - entityType: Url + fieldMappings: + - identifier: Url + columnName: AssetIdentifier +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/QCryptonPQCScannerAgent/Analytic Rules/InternalEndpointWeakTLS.yaml b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/InternalEndpointWeakTLS.yaml new file mode 100644 index 00000000000..1869aaa4c4e --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/InternalEndpointWeakTLS.yaml @@ -0,0 +1,36 @@ +id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e +name: Internal endpoint using TLS protocol below 1.3 +description: | + A VNet-internal Azure endpoint or network appliance is accepting TLS below version 1.3. Only + TLS 1.3 supports negotiation of hybrid post-quantum key exchange groups (X25519MLKEM768). Internal + endpoints on legacy TLS cannot be upgraded to PQ without a protocol change. Upgrade the minimum + TLS version to 1.3 to enable PQC readiness. +severity: Medium +status: Available +requiredDataConnectors: + - connectorId: QCryptonPQCScannerAgentCCPDefinition + dataTypes: + - PQReadiness_CL +queryFrequency: 1d +queryPeriod: 1d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - InitialAccess +relevantTechniques: + - T1190 +query: | + PQReadiness_CL + | where TimeGenerated > ago(1d) + | where AssetKind == "tls-config" + | where QuantumPosture in ("vulnerable", "partial") + | where Metadata contains "TLSv1.0" or Metadata contains "TLSv1.1" or Metadata contains "TLSv1.2" + | project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, PostureReason, RiskScore, SubscriptionId, ResourceGroup + | order by RiskScore desc +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: ResourceName +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/QCryptonPQCScannerAgent/Analytic Rules/NewApplianceVulnerableResource.yaml b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/NewApplianceVulnerableResource.yaml new file mode 100644 index 00000000000..ff4001c1922 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Analytic Rules/NewApplianceVulnerableResource.yaml @@ -0,0 +1,38 @@ +id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f +name: New quantum-vulnerable appliance or internal resource appeared +description: | + A network appliance or internal Azure endpoint with quantum-vulnerable posture appeared that + was not observed in the previous 24-hour scan cycle. This may indicate a new deployment, a + configuration change, or a newly discovered endpoint that should have been provisioned with + PQ-hybrid cryptography. +severity: Informational +status: Available +requiredDataConnectors: + - connectorId: QCryptonPQCScannerAgentCCPDefinition + dataTypes: + - PQReadiness_CL +queryFrequency: 1d +queryPeriod: 2d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Discovery +relevantTechniques: + - T1082 +query: | + let previous = PQReadiness_CL + | where TimeGenerated between (ago(2d) .. ago(1d)) + | where QuantumPosture == "vulnerable" + | distinct AssetIdentifier; + PQReadiness_CL + | where TimeGenerated > ago(1d) + | where QuantumPosture == "vulnerable" + | where AssetIdentifier !in (previous) + | project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, AssetKind, Algorithm, PostureReason, RiskScore, SubscriptionId, ResourceGroup +entityMappings: + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: ResourceName +version: 1.0.0 +kind: Scheduled diff --git a/Solutions/QCryptonPQCScannerAgent/Data Connectors/PQReadiness_Table.json b/Solutions/QCryptonPQCScannerAgent/Data Connectors/PQReadiness_Table.json new file mode 100644 index 00000000000..4f655d4ac60 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Data Connectors/PQReadiness_Table.json @@ -0,0 +1,104 @@ +{ + "name": "PQReadiness_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2025-02-01", + "properties": { + "retentionInDays": 90, + "schema": { + "name": "PQReadiness_CL", + "description": "Post-quantum cryptography readiness findings from QCrypton Scanner Agent. Contains scan results for internal network appliances (F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, Fortinet), VNet-internal Azure endpoints, TLS certificate posture, and PQC readiness status.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Timestamp when the finding was generated by the scanner agent." + }, + { + "name": "ResourceId", + "type": "string", + "description": "Azure Resource Manager resource ID of the scanned resource, or appliance identifier for network devices." + }, + { + "name": "ResourceType", + "type": "string", + "description": "Resource type (e.g., F5/LTM, CheckPoint/Certificate, PaloAlto/Certificate, Cisco/Certificate, Fortinet/Certificate, Azure/AppService, Azure/ContainerApp)." + }, + { + "name": "ResourceName", + "type": "string", + "description": "Display name or hostname of the scanned resource or appliance." + }, + { + "name": "SubscriptionId", + "type": "string", + "description": "Azure subscription ID containing the scanner agent deployment." + }, + { + "name": "ResourceGroup", + "type": "string", + "description": "Resource group containing the scanned resource." + }, + { + "name": "Location", + "type": "string", + "description": "Azure region of the scanned resource." + }, + { + "name": "AssetKind", + "type": "string", + "description": "Classification of the cryptographic asset (tls-cert, tls-config)." + }, + { + "name": "AssetIdentifier", + "type": "string", + "description": "Unique identifier for the cryptographic asset (host:port)." + }, + { + "name": "Algorithm", + "type": "string", + "description": "Cryptographic algorithm in use (e.g., RSA, ECDSA, Ed25519, ML-DSA, TLS_AES_256_GCM_SHA384)." + }, + { + "name": "KeySize", + "type": "int", + "description": "Key size in bits (e.g., 2048, 4096). 0 for non-key assets." + }, + { + "name": "Curve", + "type": "string", + "description": "Elliptic curve name if applicable (e.g., P-256, P-384)." + }, + { + "name": "SignatureAlgorithm", + "type": "string", + "description": "Signature algorithm of the certificate (e.g., SHA256WithRSA, ECDSAWithSHA384)." + }, + { + "name": "QuantumPosture", + "type": "string", + "description": "Quantum readiness posture: vulnerable, partial, or compliant." + }, + { + "name": "PostureReason", + "type": "string", + "description": "Human-readable explanation for the quantum posture classification." + }, + { + "name": "RiskScore", + "type": "int", + "description": "Numeric risk score (0-30) reflecting quantum vulnerability severity." + }, + { + "name": "ExpiresOn", + "type": "datetime", + "description": "Expiry date of the certificate. Null for non-certificate assets." + }, + { + "name": "Metadata", + "type": "string", + "description": "JSON metadata: {scanId, rule, protocol}. Rule identifies the finding type (e.g., quantum_vulnerable_cert, f5_pqc_engine_active, checkpoint_cert_quantum_vulnerable)." + } + ] + } + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_ConnectorDefinition.json b/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_ConnectorDefinition.json new file mode 100644 index 00000000000..3e295d4ff96 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_ConnectorDefinition.json @@ -0,0 +1,136 @@ +{ + "name": "QCryptonPQCScannerAgentCCPDefinition", + "apiVersion": "2025-03-01", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "QCryptonPQCScannerAgentCCPDefinition", + "title": "QCrypton Scanner Agent (via Codeless Connector Framework)", + "publisher": "QCrypton, Inc.", + "descriptionMarkdown": "The [QCrypton Scanner Agent](https://www.qcrypton.com/) data connector ingests post-quantum cryptography readiness findings from internal network scans into Microsoft Sentinel through the QCrypton API. The Scanner Agent probes TLS posture on VNet-internal Azure endpoints and network appliances including F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, and Fortinet FortiGate. Findings include quantum-vulnerable certificates, weak TLS configurations, classical key exchanges, and PQC readiness status.", + "graphQueries": [ + { + "metricName": "Total internal network PQ readiness findings received", + "legend": "PQReadiness_CL", + "baseQuery": "PQReadiness_CL\n| where Metadata contains '\"source\":\"scanner-agent\"' or ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')" + } + ], + "sampleQueries": [ + { + "description": "All quantum-vulnerable internal findings in the last 24h", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where QuantumPosture == 'vulnerable'\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet', 'Azure/AppService', 'Azure/ContainerApp', 'Azure/FrontDoor', 'Azure/ApiManagement')\n| project TimeGenerated, ResourceName, ResourceType, AssetKind, Algorithm, PostureReason, RiskScore\n| order by RiskScore desc" + }, + { + "description": "Appliance TLS posture summary by vendor", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Vulnerable = countif(QuantumPosture == 'vulnerable'), Compliant = countif(QuantumPosture == 'compliant') by ResourceType" + }, + { + "description": "Endpoints with PQC hybrid key exchange negotiated", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where QuantumPosture == 'compliant'\n| where Metadata contains 'pqc_hybrid_key_exchange' or Metadata contains 'f5_pqc_engine_active'\n| project TimeGenerated, ResourceName, ResourceType, Algorithm, PostureReason" + } + ], + "dataTypes": [ + { + "name": "PQReadiness_CL", + "lastDataReceivedQuery": "PQReadiness_CL\n| where Metadata contains '\"source\":\"scanner-agent\"' or ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "QCrypton API Key", + "description": "A QCrypton Scanner Agent API key is required. Obtain one from the [QCrypton Portal](https://portal.qcrypton.com)." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect QCrypton Scanner Agent to Microsoft Sentinel", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "This connector polls the QCrypton Scanner Agent API to retrieve post-quantum cryptography readiness findings from internal network scans and ingest them into the **PQReadiness_CL** table in your Log Analytics workspace." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 1. Deploy the Scanner Agent\nDeploy the QCrypton Scanner Agent as an Azure Container App in your VNet. Follow the [deployment guide](https://www.qcrypton.com/docs/scanner-agent) to configure appliance targets (F5 BIG-IP, Check Point, Palo Alto, Cisco, Fortinet) and Azure endpoint discovery." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 2. API Key\nObtain your QCrypton API key from the [QCrypton Portal](https://portal.qcrypton.com). Navigate to **Settings > API Keys** and generate a key with read access to agent scan findings." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 3. API Server URL\nEnter the base URL of your QCrypton API server. The default is `https://api.qcrypton.com`. If you use a dedicated or regional instance, enter the URL provided by QCrypton." + } + }, + { + "type": "Textbox", + "parameters": { + "label": "QCrypton API Key", + "placeholder": "Enter your QCrypton API key", + "type": "password", + "name": "apiKey", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "QCrypton API Server URL", + "placeholder": "https://api.qcrypton.com", + "type": "text", + "name": "apiServerUrl", + "description": "Enter the QCrypton API base URL. Do not include a trailing slash or path.", + "validations": { + "required": true + } + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "name": "toggle" + } + } + ] + } + ] + } + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_DCR.json b/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_DCR.json new file mode 100644 index 00000000000..b64c644b100 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_DCR.json @@ -0,0 +1,107 @@ +{ + "name": "QCryptonPQCScannerAgentDCR", + "apiVersion": "2023-03-11", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-PQReadiness_CL": { + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "ResourceId", + "type": "string" + }, + { + "name": "ResourceType", + "type": "string" + }, + { + "name": "ResourceName", + "type": "string" + }, + { + "name": "SubscriptionId", + "type": "string" + }, + { + "name": "ResourceGroup", + "type": "string" + }, + { + "name": "Location", + "type": "string" + }, + { + "name": "AssetKind", + "type": "string" + }, + { + "name": "AssetIdentifier", + "type": "string" + }, + { + "name": "Algorithm", + "type": "string" + }, + { + "name": "KeySize", + "type": "int" + }, + { + "name": "Curve", + "type": "string" + }, + { + "name": "SignatureAlgorithm", + "type": "string" + }, + { + "name": "QuantumPosture", + "type": "string" + }, + { + "name": "PostureReason", + "type": "string" + }, + { + "name": "RiskScore", + "type": "int" + }, + { + "name": "ExpiresOn", + "type": "datetime" + }, + { + "name": "Metadata", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-PQReadiness_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-PQReadiness_CL", + "transformKql": "source | extend TimeGenerated = iff(isnull(TimeGenerated), now(), TimeGenerated) | project TimeGenerated, ResourceId, ResourceType, ResourceName, SubscriptionId, ResourceGroup, Location, AssetKind, AssetIdentifier, Algorithm, KeySize, Curve, SignatureAlgorithm, QuantumPosture, PostureReason, RiskScore, ExpiresOn, Metadata" + } + ] + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_PollingConfig.json b/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_PollingConfig.json new file mode 100644 index 00000000000..ddc468ca333 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Data Connectors/QCryptonPQCScannerAgent_PollingConfig.json @@ -0,0 +1,50 @@ +{ + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-03-01", + "name": "QCryptonPQCScannerAgentCCP", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('apiKey')]", + "ApiKeyName": "X-API-Key", + "IsApiKeyInPostPayload": false + }, + "request": { + "apiEndpoint": "[[concat(parameters('apiServerUrl'),'/v1/agent/findings')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 60, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 120, + "headers": { + "Accept": "application/json", + "User-Agent": "MicrosoftSentinel-QCryptonPQCScannerAgentCCP" + }, + "queryParameters": { + "scanDateAfter": "{_QueryWindowStartTime}", + "scanDateBefore": "{_QueryWindowEndTime}" + } + }, + "response": { + "eventsJsonPaths": [ + "$.findings" + ], + "format": "json" + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.nextPageToken", + "nextPageParaName": "pageToken" + }, + "connectorDefinitionName": "QCryptonPQCScannerAgentCCPDefinition", + "dataType": "PQReadiness_CL", + "dcrConfig": { + "streamName": "Custom-PQReadiness_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + } + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Data/Solution_QCryptonPQCScannerAgent.json b/Solutions/QCryptonPQCScannerAgent/Data/Solution_QCryptonPQCScannerAgent.json new file mode 100644 index 00000000000..31dffe707b1 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Data/Solution_QCryptonPQCScannerAgent.json @@ -0,0 +1,24 @@ +{ + "Name": "QCryptonPQCScannerAgent", + "Author": "QCrypton, Inc.", + "Logo": "", + "Description": "Post-quantum cryptography readiness for internal networks and appliances. The QCrypton Scanner Agent deploys as an Azure Container App inside your VNet and probes TLS posture on network appliances (F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, Fortinet) and internal Azure endpoints unreachable from the public internet. Findings flow into the **PQReadiness_CL** table via the Codeless Connector Framework (RestApiPoller). Ships with 1 data connector, 6 analytic rules, workbook, and Teams-notification playbook.\n\n **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n• [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)", + "Data Connectors": [ + "Data Connectors/QCryptonPQCScannerAgent_ConnectorDefinition.json" + ], + "Workbooks": ["Workbooks/QCryptonPQCScannerAgentPosture.json"], + "Analytic Rules": [ + "Analytic Rules/ApplianceQuantumVulnerableCert.yaml", + "Analytic Rules/InternalEndpointWeakTLS.yaml", + "Analytic Rules/NewApplianceVulnerableResource.yaml", + "Analytic Rules/AppliancePQCReadyDetected.yaml", + "Analytic Rules/HighRiskInternalEndpoint.yaml", + "Analytic Rules/ApplianceCertExpiringSoon.yaml" + ], + "Playbooks": ["Playbooks/QCryptonPQCScannerAgent-Notify/azuredeploy.json"], + "Metadata": "SolutionMetadata.json", + "BasePath": "Solutions/QCryptonPQCScannerAgent", + "Version": "3.0.0", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/QCryptonPQCScannerAgent/Package/3.0.0.zip b/Solutions/QCryptonPQCScannerAgent/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..1050d7456fdb25f8ab38a89477ec162efba4f6f4 GIT binary patch literal 15652 zcmZ{LV{|4kyKQa0wQbv)+O}=mQ`@%Px0v) z>U_Gaa{|7F6dMP-aAXOin(`8!_%l4*Jl1?{xZ)2fJx$GdQ94MSp+KQPC~CT=9!RcW zujb##x!@Dg#mA*{sfiW?0WlC*T`}8V9*upD&mh6Q+0?_akP#@Qe~*rwm~RvZVx`lK z!WY6XmVcOHSJnDiLiz3nc+Jgn%y7>@OX6k?7bwO%Pf)b!jo;Lwqzlas1maPA10JlZ zQ^&Om%d2L*O4F28@sRRP!a;;Q!q=QAtS=_izU*h%C+CVe`$;}LkU@weQ*-Z1zYtNJ z?t{N4-0<-SQei{7&xS*B2pNRjXHD3Xjyf2qKKW(=%)CDQb(_Vj{BrH`G1A6Lk}^6j zh&;oqJKvWHN;-_n2&@+LXZ=+&sW`u*A4uC|!Y$Hc!87ky$`eNWHIeUgoIz;r$Xgz- z9YPgU^l&Fb3#lHqsFf3GB7~d1 zUOoezb~oDY0CkLWljT)YlM3clZFe4vwGy=#cxeMuJF7`;w;!wX)Fvv$gp|~mg}Fo1 zs20u{>|iRVtm1KrjgWFEb#-OgvO6Q_^6D!b@N8_%hf8T^BXLh5U5O>Fv9gx@uMv2a zOJ^cIS3P!{wj|c>b+MPdw3*G~Pyxe$={q-2TxPUxEdd)A^B1xZrrCGzOr%6)?@O&ot+#Ism=;SIVch| zvxrk2@+21NBBiB6W3-zgl6~Z8@RMY7VZw{xtggjNEm%HL^lbiB^aXd3JoJab3|2o~ z53a6Qr1`7KaR+V#kUcyNQ(e*(!~e)(v7-qDh$YO*dIu20cJqptQu~@5&CaZ#g#YtfB4!8m>_@DgT|6qg2 z)B0tXc+9X{ay%lPS>vg0JrST$Euf@j28EcuSJ&bpUlB@~s9C zb_A&w9Z_1v`f7iFcJ9&^@$0NPOw6$k7@hMRA`p(AV822Ws{Yg@^HHdhTE(S*e90!6DT-XQS%K5&5y5t*?&E00Ny&AenMYgk0|-dMLT{L%+M)J?w+ z(DvjPT;W?ezxLnUUf(|LLHMiL?D@Vny=}i5ua-`OLui{uRMTOHglQKXEa507%%~Mw z1!!a{lWq;i`?f>~7K^;*X$g>)1t-@ju?B3W4tJa1*2HibQEOE-;!8PcYuCEJ8!r)D zY?<};;yxpk=H1`n4^6rd8JJ=zD|hsrjn!9CtBh-YJ5y{h3~O7Cj3ctZRX^GU_IWmM z7h<1=-!Q2Q50%OaUNelG50%w_|Ao&o7Y=96)mds&e-U7{n?R$zs$>@(rwlI64EFzX zHD284CO;$qstRG9Z;MJ`)*&z9tsz<3Tz&)_;x4SNm&FP|&K73w8{#jhY$P-m z!jVQvuvnI75lve05+3TzHKC5*Om?5+b$-$81DXU7EbFw=BMWI$`PnF^OD*?Uu5v&I z`Mj{tc-E8IuqCszHb6U_bz&*wQsY*Dy%u&$Fz}3|;OD7>kE&T^QP#c(qYX3f<1R}K zv~AJ;B@g--Ap4PS?f`|A)%fJ|=g;Lf({>Ke`ShN|QLPTzy3ve0n?H)HgW8qDl=k_< zYL;tDMaP04Sd2C!HV5*y4s6G!B2kKsqWKx@vYHkpF7#Wsn8e#M@wu8aL(5dpH)G=|-;S`8n-1 z+KYI$E|>Bqc3ZZ51^=CZUtFSXK1r$E?A%I^+I>Lm6?35?ed*`|YaX%t+^kozbgR14 zS8V|!W%j5%8RF~E^Lqy0@V%wvjTog~=XJS`^f{VXnR`s!TK{eOgJ;AX&x+1Tu3ArR zJl2HHQl6=mxq2ytoKhvvMZ|L(9y4?Sozcl$dEn$N9K(l?uroM)G;>>;<8RrCe6kM8 z&`_aAYnmLGBl+)i!Fgd~iw%+%BXSi5Dxs)f&f)kbACxwp-ppl8LzArBx zMyV_f1>QRGezd5WY7;@uqo(wQio;i+yR)X2v2~Ctvd6GIfp|8`tXs6|sS4@B2)!pE zjp1bQ)3G{=ndhj_5Y|*r$r&pZRQt1zZEu^jW;#y5PYyfeqiM)X`^3d&hv*^(y&Edb zSm|uS!Ad^j>1hzSY4kXo38lMQ{B)|MOb!41o4Iqy2v#}J*B=rfGtDMC-EM^nTk5Lm zuo1YKg(EDhD%c;*;au1wojk|?5 zL>f`G_*h#m2V<+zyVz*OiJ$&qL_aBG6gB(TTd1ZoAZ&BJc}otNaMXoj_y1?cxw>pX)C>Is!s&mz-MbUrQKh-)^`E zwTmT2Ra}+)Qd4WE@a*+r2`ZPsh;pQSDRdUFtpm4)zts)qC0p11!&Xv7CL;@_GH59F z6Xf_80x!6f8@N~mIGgg5)>suydKe4(^j6b~!TO#-=9BoC1JdcnQ(41}ODErMaR}hJ zWNGHqrm;deCq(v$4}(4;Ibyr~3Ns`duCUL~#1=7k3v=ND>mH5YCzC}VPgiL<9NQ>b zJ<@v43)9^qar3bDziXEta-Rm1dP)AA{zd zE1n$OY3yBn+j>k|!=A3nvji)fHOH^W z#?$?z_ZG*S+w$D_^GfqpHnXy+55uLT1~N%;z?w>~@~XWf?;(!okE9hC5{X3sJK`BD z(g)o&rn2p|ko5E*M3{mfpCBaXL{s^RG_CQ89J~BRl6-vgRGTzUH<@x#qg^lc+ESgZ zLUFyOe4m?J`!iPomThhOiG7d9iC4*T;8?B;pG-%-LR$9J+fM=t{9n+pIFACA<;$C4 z-{OXfu%k#vO5fYaC_lyq*aUAyrCyH6bD=k$*G{H>b&+;cJHffLNICCzu_^c?-?m$@ z--(jn=k@Y*G&CM3-FV6II|vA${HkQ{BgqFS{7Bb0f8z`_=|aqo|j4Ur)23Boa(!bB`09WO_sjm#G??bGsNp#>iC<}C|ef26n>?94U# zM{oyvp!!InJYrL=1gW4FpgbG{i41;$te297eV}bBR0@csl0<|)gmYV=zo{mD9J0u; z3fBzGTHe-M8HU!Hc)PE0YzHH*pLSpRavtdd+sx==2PBj1NhvSIJYYrhkW3&DKx3iM zQ-Vn)^h^dFfgU#0x(u)Ww!ZJ8VGGrD7J0FM)g_lbn-~vvt<9d8K3RC58u*TvEKWRr z{0KHs=6lEz+B*sM%JmrvLoyGY1?xt_$?=b?FiQ%c(-It8SvoVvu|fzFvtg`6&q4fC zoO8Z!GSa5Cqta8B-qNyJrhwPt5h~BFs>lGXY^nUG?+<06Q*jhSmGlgRz_S*9FBroSVH8Rzq0N{XxMq@FpN z1lmJZil2*L^dOnoVtg2K#Vs1E9Z3y9B>TKmH))ZrR1-qcg)GD}iuM#^kLSEh?g zsjLOauI?>(=3Co(CX?R@Oib<7xD;o=0hSy%@OKN`=k`@3l90*TO1jJ2QSrf7ZwLM4 z!_h2I)X$U`ODBGCtQ7sxn$q6oU~=b!a}Q~I8F*rHty2rX9YOBYDBr3xsDUT`J&q{n zq<9O0dUo6^tE2i3v}1FpwoOeMH-4f0)Tk9z7Y(38JSHXPY}OZuQC@opUip=H=S`|m zqi^llHpuF`2v>(h=YL+6uc9f&68PJe8`Ul_Oa(OM1QX2kHaRC?j9C; zl`Co$T88lyV^dGea3ox%O;9CfT>L^$Q(Wji$J%<9YyjRDR-?CKUfZ8~b#RRJayQ&w zmBry{j5f3@#P_HCU)vwy)Q136=?TJSXLbZz1M-N{`Tva+ew#yRf~Hr zpRTt&Y^#=5Jf3OoJnLI8qf?V2O9qhwxc!z^GfZnzqFXr{)c#1#h+6CGe zzcPQ2>F^NVEfA^d8u^he_f8x8b>78bY`|`ywwq%YXgFc)r@(4}IzwCy3?A`gmPF2< zvQrzmd7n?x(40@wb^MICb0#qN6ICAlp`+gRv8q+8>++GF8>}mN(yi3)Wb;z}phw$C zRsQqUS(V~GhSeHEjVI>p`sulNE=d6;8BfMxG4+<@s7X}VK2}0f1!(WO^&rOJyHO*? zt##c3MkRuhRkcI{dW-**lkpJz@*?m$6b1dKbTnMo2U=~5gF-UgUaeIvku%}amLKyl zlb$Iq^d+$pBQ!wxheFz*{;hY@)wu7Tgr%4Dy9m4r)F5}DN$g%0XjB!b{iaf^f?q^? zC`&4OOup#4aE)D!`H0Dvi~z|=6>UzoLv$4tkf!A1&9wTiiPrSopI~2oy#WRBk>_6j zs8H}-eLiZ8sD(j;ry5J}d78G?Q~Gn}$}~?_#)W@zR_Wh*kiWgMlca*c)L8ciw>`|I`~(S>}qJ{AdD+cs!_To z_iv96-Fe6iwBW6C^Y;ddh^Na-dw@9U$USE;lB6^p=~*1?J_4lReqI9G#qBD(IL`

L_Xe(1(#CmC;{GlO+e?Y_#0+kj)@X5XLhaceW*R9yl4!H?YL4iA} zRkHm$@k2yt(PReJk2-Cs#Oop<1GFt^8v!Vyut@$;$rV?Cv=d4@x-W{Xq`-P!(9+2( z=-crsQ{Jz8PTnk(cicSD5l-IGx`cTBtG0Pq^VWoTrug;Z_TvDUru&l&!@k9$<0i!7 zVA$yOT30q#0YI=a86JX{n7x*D^E^ZU@(&E%m2-OBjM_LmEH(-Ii(*?=$%7Pu{y7}w z&0|M})O1VydmJ|G$dd{#Hh@apV2V&D3#p4DEOM3B4t&iWk4KEY@0Wxn6iFkjn4!%u zAgs$wu2?zn>j+4{b9PY1Gm63n);SfE1+~>{My-SY2q{0o@`!DNSUYxzTw4;97L|sp z#c&WIRj0*x3@U;)RoB2JsS7-YZcxO4BDnzl0*e6&LD~K(-N&?mt+Vc;pY$2EH`XLH zK0#JOI=I+J0q?2B*nYXqFIGZ+gH$|O@ zHLD0jeUP;IR!qE{(;S=TUqDu2L& zi4zsR+g1w=om3PK`MYhyaVZbEUw=^I+Ma)T>%N19kFcm_4vl@dpp~_|dh1c*kf0BC~v)KHiRh_HkG*zlowrUKW65%I}KC%~aWdd6yil28l!@ox#uA#Ded zdKF!%i4lc7w+36FCMmZO3sGFdWF$+O14O3Kay%mTZ!lb=nAMzz+Os3Tr_4dWEU-nn zlWp2Ts)#z%okkW2`^gFM9qq@|Q#Q=Tcjqc}up-~K7xcpS3vc^MXF41B#2g{(wkzkh z2}#utcCQ8&IMg${#JV=!q%mcm6Ru4MGN>Z%LGi+e^# zl-$R0mx6sddf{9jr|)g;HzKDOQ(1v?#*c@!w5nmW`lHZSZEwt^?S{aUcoZIb@7Q|& zu77$BZE%q(o?vbP?z9`zY4d=)J;$Oqekk~MI|@J0f!(2K-hDAjB)*uiug*A7EZFEB zf|}4^KbUze2*_iS@Z1CKS&d(f;e`^$0Tgd<_uzZY_RU5Kf;1xwihfBg>dPHOf$Y85 zP*3#*P6P~qPP;7>=(|x)pk|D+xI~f(Ye7G87qxpa^vRDHC$^wUAAq3lVHASr_|l9J zJi^i2MSNBKagUCP7_x8Yj;0N&u|eC8TfSAEwT9MEmsa62f@*&ht)T7Jo7w&OH}M{- zYbomI~;znbV3nWr8InhjPh^e-4F-<(a}=k2Ppyn)JCHR+q?UFcpI_ zAEYu6hY-blN$z{7u2BOiy*Fs%A*<9`b08bEt+kppI9P|(xcAzp3g|4|V-~F#oZ>~V zP(PE34ppvo^qJ9HhgBkU;3R{hhJMKp5=!(9G5J*UdoT<7HA%?Iif^ckJ`Fpucf9e7#9t$s2K7H z5~wv}!Ij)~cNt9_AtPD$v{ZGJHWPG((t?_t-11x5)Tl$O+_@0ek3ZM57Mnj(wV&I+8S+8r!yP9(<#ck1@iiV|GU=@j_GSxN0= zFA^|Gn9co#>nsg85S~WF+FznGlBXo8S9whiI>r#uZ&O?w;9Lz0k^naW(73ypQ!G>48zvz(CZ3&?F)5 z!|CmO6vir&+wD6Hg8TR&SgC-R7uQ}HioBuYq@VNdV;y+u!8yuV9g8a9dWTxPdNO~} z$@UK@sRucu31l-JWnqJ(T@X76UtsJV{S#j&Q^r+!fDtybTwF~Y zGl6pH<0S6vZzPv>E<#=4%#TQn&fA%b=84@oOdmyt3JQB;j?arOp5UhGdRz#KYhrR) zr^0q-qzxL)xFXCi@zK9ZBNkW+$2+cR&+RWCQf#$n7UnFI;|8 zTqusimb8()cn^rA6x^S`_OYG7UW~>7!fG*ag|aq(SXSHxL%+lX`$igOptQX%FIF6S ztt^m{`DlyOn5>o2X#fF+x^>^hFzhMbby^uVsSe8K3PUaCyBg^3sTeRVsNrk#n4a3u z<#(Kb-YDT^_4mw9?w#VZFUCygyOacF^P3-%PWc@!0(A4WVSMa05w+04`6ThI`T1J| zv{$R+RWGBbMEDPcZSyr51h@T%lQA{>mROpfA%iuB3I_W6zqz-3n|seFD}%Y%oRsx1 z11VgGcA9V>=MsNRxtBTydVVY8U0w?cZd?^_S`F{|62P2d=y#t%O7ggLT5Suu>c0$1 zaH11Ur@5g|hqSiSq15fqiF8k2)?;ic7oyAnQ*wG9!|blfK+$`0NdV=$}7<=k_oWDtW^H?)h@vKiR>a>% zL|f*s#z={l%uFja&3g6ticLy`{n#?+f$f@VxXVJz0L~h()Zep|8h`&%n=DAt^3BQd zML5J>#-?UO>9tRC=^EZC15})~a0p;D1khNLUeTkKgoloThs{@wEo*h4hr-r#X0X1@3_YE(TF*o;;pHe(w;? zp3ZpYSqd{S)o^VzV6YU~Y=xTf`6+;i+xB=QJ@@`dUTFd2 z7gZsQxPQjyh4%07103?5XeIB|3LNN_!O+{b)%!el$;5VMcdDlWIDy?~4~Xr2h+Hh5 z%c1EslmrVY(Td{saGplZF)Gum@x4=F@+A3_>cbSpb(At-%IOVsxR!tC^|0~_VrP=J zhim5!$3^;as7d{*;Q6FX+{>4vUOD-?>IaK{2A%qnw#NTg&C(1vf@Qbcbs$(YTsfKfwE z&1ftETr;q8vBQpLn{G6wHi#|a7V=J)7q^(La?M*EHjC>voy1o!xCa?0?Krx>_s!e< z!txFXi2L2`2)jQDDi9HtNSXU9`T}|+f(A*_CeSayf)}kR{;+e*r(m8`2NLIWq{Pl; z|Ai=T|NfVPIKhPc3z^xeYJMX(5E?Y(*z4+zRAmh1&=f|MbZU$*9=w{-ss*Z!u{qRx z`@v&K`6iwpl9Ll2VM#Mo(Qm$`m%nR?D#Z0T!%gNj=N|qX=CLJeXtDje^7y6Aa*GZw z+@sxA0d_ZF_R}dk%;f&nZ_E3!dY?Ok$pBxzLNfNVLIiVQ@D-My(T<=-3JFNz^mDX9oh1^_pDwt47mW3F zX!bT!?`?U=>FKyix->iSnMl7rz=0X^bR(Etmcf5&N8*0nyo37$7jy=rD=_R*8BV=` zx)B0cqn1FIWd$mxsy-THjqap4g4A~l%Cki9GYX?`d zbFDOreg3`>!&Uuouiu+1h49hChNkx}5|^o1-A;>(9Wp+hP1S7SFhfIV)cEthV_^B5 zls?M|n=%jnsl8qcwLwReFrH6^=@!v??p|mvUq2*F93=ZqiZn%J;?18(sHxZHbLk3J zcJa{J1zsc2Kux8}*$}_=Er3EG&=Bu)8N@yjdv@VU-NDgb6{{ ziR{9>(XPJR|2<)o^Z7O}-^yv3E0@wL+ePIdd^Ut3H?G_Mhg#(iEiLL5YYG>pBT+P{ z9u;6FOZ@8{W9j|GDG)0_aCF>!$RjlsRcpTg2CY32on3Wc%UJJc$H@m*MAv%)g5e`F z;q$O&SAme<*9XbsU2(rw>*+IXw&0?iNdZmI_$HT}AK6bO{F1!Aq=2og<%$z?H7il8Zzth7Dkn^3=5vN zPnCYQrc2T%qaB^|gv-!IhjE&xds(BHgOODC#pe#^nSARncIawX5KqHhg4F8dE*qy? zse>?HG}`^jTaE1u=?W2Fz2E~wZO86V2HaRB{P=n}&Gz*Z$$3wnnU$ak<0NJjq48Ty z7_Ns>%sBD8D^WKzB7u2SU19C8QGz+N$1LbH4P1e70mY<8q~al$UZ+!NI5IQ2!iZKe z)cI-RLi`Pb8hvLW5W3zBjWnMt5gInoxpVOYbj@Y60E%%M2$~?uj`+mcR7?O|fM7cr zSFh{70>hfw7!GU`X4Ykx%OZcED`}*_@u>@ey>u~QxFp1ymDnK79CPiWU`PTd_MeX{ zMD|}TVXHpJy#e9+ zmQ8gbhFnhv1-=aaOF7Jr+fJddq#e)(x^d}HeXD?SCv@1lSH~lS=Cy}|zD{V%lCa0k zM%f>A@d?=xWj?_Ar35s^Tvfk*t8KF~Q^iO&*OsXvS;A>fy-Y$ZWRM&|McB3#021|t z5=ycaGOL8w&S62RnHz$lXH-$hzNCcR1+C+(U3WM47V7nc9hqQ%@S0@*R(kWWcnMjZF3Ha)U zSdxxxMrKZ}Ar>!udt$1lyqb-LIH~^pP>7oJO%r9<$_ke0o1D>fhGUbxunAOp zs0ow?&K^MIBne<6BXGdlkWYkA%ZaN+a|ZZiaL#zqZCE+cw5|iUrGc{;oE+v=qZDaz zzmW^->Udx{1PEFRfROmycEIpGUsUoj%`*8i#ahowOO?Dhx&C<7Ln`$V85K{z&Qv2M z501KL7wn6N<3P`%4AijB<}cl6fh`fw+39HrfQ5}+oP_<$DVn?Q0sug<%lt)M5agxj z(FN{DzNvfv78ztqHBGaBsPqOz;xUxv*xAW;M5Kwe7>L$CqqNpZgC=qH=sM5sjh80J#oiZ& zwW%~x=5VvOq>rs3Bi>p^S*s7<;Q7boRwsCxPT4C2s~&;LUk0uY|_jETKNCG}qIpG9^dH`{uRbNoV(4!;T`?dRX=Ly$ro+Pn*eOJVu zIIJw;WU$+pR8K{k_dm0v{V#SRPk8HBNubl5@5k9;{j7lizhCpF{M7}*Z+70<=S10& zm3;UjBcfebc5*AsSWyJAdoWGRlD`Gcp($MP%4)h;pM+)TFSn^aZoD}XGE$rEOb@$) z(MkqEf>g8KOCs4RlM>Q+vzd0IV)>OKzMI`lQA~UoFHP-E`oYYq$ik)=CQx$RJ<=$m z1LYupgWO;5_9Q~-&IXmtgALS!1ITx28!Q(m0}Vl>1h4b{1|=bmtD(GNIG@P1?XUEW z-C2T@v9;=CdWAsNqrz|P^@-VA?sPjG7MUjWmkOpMjshUYAM0dM^Gq&hl{ z8>_^HIl^nd8*?W#n>8Z>t_05<=VlS#UR#O_UNLU7emxJ*&vqZqDaOG~78k^6OxcPE zonNZ$sc@ZG-u)60;yO8oE8(~04IVDx*K7vrfFN>IrK2}4WB((u4&ZWkmlMLTGz*K~ z@z~wemmvOq=s?u3(d-T#4ZX$(&Her}jDunNju|xPU&1v@^Cb^ngf>O`levgZEYn<+ z6%w(S@RwTsF7ode!T_66l$5FlLL;2pEZDm#NzZEKV$_vW#NV1sd=*%ueDww%0sc?4 zgMPvS?4|&fuoX3we6X@IV)4E@V((ccFfli{0QM_XLQx13A}@*f;7rsajh~hicv%|9 zLyQtq$-9ZEnJx=2o*1`P;6!Lo${4;&VFtJ-l4K3&Szw&*^re5aA+Tr;(Bkxx1Z536 zJLi2rA~IQD3RPkLIYZ)tOBI{jxGY7 z$=w2Z$kj>)nxw2sDDHI<=X`Y2+LsUk*&lX^bBKV>ALPyDWLoI3`kRzCpwvsHx++5f zrqs>GNpv^ihC=8*N}yqcc7<~kMM}h(Auo9!kI&cGu+w<@xyp_I?haT1W}o}qy=^4G zSs9h}VcRAs(eNG)>Clk40sn&|%-MA-1ri(H!31Ts7YZ4%8O!-)jiyvapRJy3Jnc;yns5bVP~}~ zoJ_gMG51lIsg5^SPWjIQF8;dm31LLbS0#Y0<{@3Yaaaz2cN_H2CgL@Oe?DdJ<1{3Y z@pkfRh+5uY&Tz<-?bRpe>Ma#=Me5;B_HDpVu2DADCU2Wh4rGvW=mu)&ok5Mu2XIPV zL5=H^B+E_nG@e&% zy$n2eUt>>9>;79(mR3j92?6%b|14>04XFKny{R&0P|eSf;PFw-2Z6h&l5YKj9Uio6 z^=WM5vwLlDCht2wNYJ*D_Jv4z;Q=Rox8fx%K*GjAiIx(5F;b9c;|>n}Rf+Z61jdZs zfa1O9{Hhd8=AsC??%RYWUQ?QQ(?9lWR`^c$jOU9%kBlTYs^WJsW`{V}N*NOIa!@3D zE%=iSQ41q`hux{w786`x!HNP_fV}K8N@oM`!T%;Sy6@hx4L}+^vsG6}s&)NKkD|Xx zW?6r{PFH`-Zd3A4hF1&SJJ@@;t^2*%vVRb8);QTb*Nan|#KYgIy}yo258RNBF~_i= zfG5HbKSMwdDdSIN13lxq)n^Z;Uh7s54WoO=B&86Zo=3=J9ZCl96b5tHT(iei7bKsf zDihs#1v~#gM}BV^YBm@Z!T*~VdEiNn-a;8+)I~~|KjQPqJRSJg_bv(zSuDM)jm=W_ zhn3}wMvVh_%i36j!Ky=v#(1#!8fa_%tyXGD^Ek%+<|>?#)?jtX{o1h`yX3L+Vjy2- z4LjxQh7RHEWKm5P>_GA~Y8N?~!vuGG>0a_22^qiZ>pwCk>Fh7lkzz2x89lX#lvfjs za8t%t=GqB2OyW|nZQ5+uY9~-OxI%6RYe1g!@9(683~qe1c(J_s5E-i&H2zHq%ZivW zf7YN@_ul3Mr?L$)2gIVZUYVVbT8m(?C$Kr%g!bFP{UybG&HyGZSq7F;t=xtbSIKH| zc*$b>-sFWML#;)X{pXpgYj>a3J&(-by#8{;Dk3|3Pi-V!TN*T_Gr8@g-S~&6V)S8f z^y3huN4>LtBtVM?spSDabn2y9c3tF$uBNznYV;BlM^;+>`*R1X7_uhyHj`>k{kUDN z;pTDM)+DT^S3dC4A-DaH1jDtcb>sMt0p{22U*-4yrK!B9in3Ino@b@?_I8OfdG#@5 z0adEJC%4VJ98@l^VOrM>zkF9#83a}H7>AY=7;bsiTpOpdFZ>1W7tzU3Lxg{y$t6%vkF)^<;v#{RLlI@`D=fbT>ooklRLI)>-UoF z3DBy@r&&U$xe7T>5^8_`YRU(*K_AecZrWR_vNdlHA#%|43f>DT=2)=InM`C4QW%;Wdf7;Hyg}O;^EoAuGHI2kDej{|Yis*GxRqcHR>d2LAKWyLqJ%s+e-56+}Z05@aZtqWvUKcyrQN8?sp zlFqR2L^qsej!tjQBs$^SuXqG}<#@GTCvI=&=k?|3BzUc+sA4Qw+dBqsMcqbsYNM%% zo5jZkrAh0IYA;Epbo#+;L{S!2U3DPnV@iE3-dGQS;p{t5^V$ug{PB8NoVlTSd%a#E z_+Iop(p~?4>N$j`+J3unyw*KMr~5ic?J9lTy;mG`IzAQmi+ih7M!mahp+BT2JeNG7 zilrpM5x~)spGfK1d!DoRf8lS)|H4FR7l}U@x?MyH=qy}iympU1H~Fmccooxk%x-ls zY5#MQ%Szb2aauXp1A|;^4_Q?e$icTZ;BZ6-x+h0zm8%@8`T^!|tJA`?Rnfv#V<>G% z>9xnZA$1s^xZh~3%U%>O`a2$905+2eYzr-GKrIxay0jBj(bm?c-*Q4wC8|1i z69kIDN~Eu2(qGLfTZAzw&N@H-ZTo+9tsCt{t7<7*MEqkEm0MMAI5?fkrreldKlSIQnT`4L)E}hN-r44`%;oXC({pOdt-4Y{M1WX;CXI% ztL4ZH{XlH-p48-Ih3ogj5G;54%e`T%E>aT0V9<(@M$2jU75JHwLYEMV z&|8ZAi{G!;-w|8UJ>%p`C^Q}EII4nKh{LoJ!YK2BDcws*$grzfCL_}AWV+dx*lX6u zz&&7>s-=-YoRG*KnQ$E|t3mX7M4v1-IqvQa$Cbird?<1$?#0@@qrk*UY(vna+DBNi zP!UwSEZj4K_`NW^N_gpsJvus`myX@C1L;x68*kj3SBqD*#KtXvOD9EK#!r;H^B`w| z1`L`^BwSs$*~*9*#2qGk5N#{)H>F-GYUo!Yv-7N06S8GNCu$p8QhWZYgcAo^|K=1Y z;F)#)cGwwj+&9Z!xpErPh`k zzqvqSI6Wnh2Ka>zmr#T%WHteE(vlJ;&lsYE zSX;paizL7vN5f;Or@dBPN&kjbt!ZX59`AS_ttg?xYa&BA2tc;VUo3@r4gI64vzhC0 z;2K!G$YN3iWS5R~>`L0tVgZaCX8J2#1Q@)T7F?3!F?p~NYMrF>`rVls3Gl-RBGR*y zF!xgg3IW^RnCtB1=0bTQJlYI7HLai8k5;Lw3RTE2liAi14#L>%8e1q%JkQ-dP7yth z%ew9$J@%`?l=Wb5FG%st`*9&$=Y{{?o?p01Vmd)5CGMS_2(GT~>;tegH>@+K=atzg z>Gsg2EOaWzn?tA4JzVN8Fmd~HRTxgwa;(TLqg}XXN`t0=+7Mi5-5+}bJPuF_e60=VAH$1Cd3vH|KsWrZAdvy=?BR_h1En5C% z;ixa3)zNY;E_=bKvbLlS^2?WJ0cyoVmTfh$$Z%N$2uUC+oNFzjr!6$n0UqN(s@NK4 zNbHuKFZzvW21a9iBE~xmP&wIRU}cDcUf@w7M1VaW+K8}yUTFpzjGgH5yl4fFo0>IU zls?7SY_tLcouk%|>0(%hz!CGvwPWZ4qK|(n0Z=e>@c&(l{7)+IA6FXmU%~&PO#YvZ o{7VXFQW|9TPv-ppNe`4{A))@O2-rU#`Y(*;|F6{l0ipp>FaQ7m literal 0 HcmV?d00001 diff --git a/Solutions/QCryptonPQCScannerAgent/Package/createUiDefinition.json b/Solutions/QCryptonPQCScannerAgent/Package/createUiDefinition.json new file mode 100644 index 00000000000..404fcb27db7 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Package/createUiDefinition.json @@ -0,0 +1,267 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/QCryptonPQCScannerAgent/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nPost-quantum cryptography readiness for internal networks and appliances. The QCrypton Scanner Agent deploys inside your VNet and probes TLS posture on F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, Fortinet, and internal Azure endpoints. Ships with data connector, 6 analytic rules, workbook, and Teams-notification playbook.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 6, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows" + ] + }, + "location": { + "metadata": { + "hidden": "Hiding location, we get it from the log analytics workspace" + }, + "visible": false + }, + "resourceGroup": { + "allowExisting": true + } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(concat('/resourcegroups/', resourceGroup().name, '/')))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for QCrypton Scanner Agent (via Codeless Connector Framework). You can get QCrypton Scanner Agent (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link1", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + }, + { + "name": "workbooks", + "label": "Workbooks", + "subLabel": { + "preValidation": "Configure the workbooks", + "postValidation": "Done" + }, + "bladeTitle": "Workbooks", + "elements": [ + { + "name": "workbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + } + }, + { + "name": "workbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" + } + } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": "QCrypton PQC Scanner Agent Posture", + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Displays post-quantum cryptographic readiness posture for internal network appliances and endpoints scanned by the QCrypton PQC Scanner Agent." + } + } + ] + } + ] + }, + { + "name": "analytics", + "label": "Analytics", + "subLabel": { + "preValidation": "Configure the analytics", + "postValidation": "Done" + }, + "bladeTitle": "Analytics", + "elements": [ + { + "name": "analytics-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." + } + }, + { + "name": "analytics-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "Network appliance serving quantum-vulnerable certificate", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A network appliance (F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, or Fortinet) is presenting a\nTLS certificate signed with a classical algorithm (RSA/ECDSA) that is vulnerable to quantum attack.\nThese appliances terminate TLS for critical internal traffic and are prime harvest-now-decrypt-later\ntargets. Migrate to PQ-hybrid certificates or deploy QCrypton PQC Engine to front the appliance." + } + } + ] + }, + { + "name": "analytic2", + "type": "Microsoft.Common.Section", + "label": "Internal endpoint using TLS protocol below 1.3", + "elements": [ + { + "name": "analytic2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A VNet-internal Azure endpoint or network appliance is accepting TLS below version 1.3. Only\nTLS 1.3 supports negotiation of hybrid post-quantum key exchange groups (X25519MLKEM768). Internal\nendpoints on legacy TLS cannot be upgraded to PQ without a protocol change. Upgrade the minimum\nTLS version to 1.3 to enable PQC readiness." + } + } + ] + }, + { + "name": "analytic3", + "type": "Microsoft.Common.Section", + "label": "New quantum-vulnerable appliance or internal resource appeared", + "elements": [ + { + "name": "analytic3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A network appliance or internal Azure endpoint with quantum-vulnerable posture appeared that\nwas not observed in the previous 24-hour scan cycle. This may indicate a new deployment, a\nconfiguration change, or a newly discovered endpoint that should have been provisioned with\nPQ-hybrid cryptography." + } + } + ] + }, + { + "name": "analytic4", + "type": "Microsoft.Common.Section", + "label": "PQC-ready appliance detected -- quantum-safe posture confirmed", + "elements": [ + { + "name": "analytic4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A network appliance has been confirmed as post-quantum ready. This may indicate a QCrypton PQC\nEngine deployment on F5 BIG-IP, a hybrid key exchange (X25519MLKEM768) negotiation, or an\nML-DSA/ML-KEM certificate in use. This is a positive signal -- the appliance is protected against\nharvest-now-decrypt-later attacks." + } + } + ] + }, + { + "name": "analytic5", + "type": "Microsoft.Common.Section", + "label": "High-risk internal endpoint with critical quantum vulnerability", + "elements": [ + { + "name": "analytic5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "An internal endpoint or network appliance has a risk score above 20, indicating critical or high\nseverity quantum vulnerabilities. This may include expired certificates on appliances, RSA keys\nshorter than 2048 bits, or multiple compounding vulnerabilities on the same endpoint. Immediate\nremediation is recommended." + } + } + ] + }, + { + "name": "analytic6", + "type": "Microsoft.Common.Section", + "label": "Appliance certificate expiring within 30 days with classical algorithm", + "elements": [ + { + "name": "analytic6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A network appliance TLS certificate is expiring within the next 30 days and uses a classical\n(quantum-vulnerable) signature algorithm. Certificate renewal is an ideal time to migrate to a\nPQ-hybrid certificate. If the certificate is renewed with a classical algorithm, the\nharvest-now-decrypt-later exposure window resets for the new validity period." + } + } + ] + } + ] + }, + { + "name": "playbooks", + "label": "Playbooks", + "subLabel": { + "preValidation": "Configure the playbooks", + "postValidation": "Done" + }, + "bladeTitle": "Playbooks", + "elements": [ + { + "name": "playbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the Playbook templates to help implement your Security Orchestration, Automation and Response (SOAR) operations. After installing the solution, these will be deployed under Playbook Templates in the Automation blade in Microsoft Sentinel. They can be configured and managed from the Manage solution view in Content Hub." + } + }, + { + "name": "playbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + } + ] + } + ], + "outputs": { + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(concat('/resourcegroups/', resourceGroup().name, '/'))),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" + } + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Package/mainTemplate.json b/Solutions/QCryptonPQCScannerAgent/Package/mainTemplate.json new file mode 100644 index 00000000000..e6cf01d7ee9 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Package/mainTemplate.json @@ -0,0 +1,1895 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "author": "QCrypton, Inc.", + "comments": "Solution template for QCryptonPQCScannerAgent" + }, + "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "QCryptonPQCScannerAgentPosture", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } + }, + "variables": { + "_solutionName": "QCryptonPQCScannerAgent", + "_solutionVersion": "3.0.0", + "solutionId": "qcryptoninc1788706847984.qcrypton-pqc-scanner-agent-sentinel", + "_solutionId": "[variables('solutionId')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "3.0.0", + "_dataConnectorContentIdConnectorDefinition1": "QCryptonPQCScannerAgentCCPDefinition", + "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", + "_dataConnectorContentIdConnections1": "QCryptonPQCScannerAgentCCPDefinitionConnections", + "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", + "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", + "workbookVersion1": "1.0.0", + "workbookContentId1": "QCryptonPQCScannerAgentPostureWorkbook", + "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.0", + "_analyticRulecontentId1": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d','-', '1.0.0')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.0", + "_analyticRulecontentId2": "b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e','-', '1.0.0')))]" + }, + "analyticRuleObject3": { + "analyticRuleVersion3": "1.0.0", + "_analyticRulecontentId3": "c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f','-', '1.0.0')))]" + }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.0", + "_analyticRulecontentId4": "d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d4e5f6a7-b8c9-4d0e-1f2a-3b4c5d6e7f8a','-', '1.0.0')))]" + }, + "analyticRuleObject5": { + "analyticRuleVersion5": "1.0.0", + "_analyticRulecontentId5": "e5f6a7b8-c9d0-4e1f-2a3b-4c5d6e7f8a9b", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e5f6a7b8-c9d0-4e1f-2a3b-4c5d6e7f8a9b')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e5f6a7b8-c9d0-4e1f-2a3b-4c5d6e7f8a9b')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e5f6a7b8-c9d0-4e1f-2a3b-4c5d6e7f8a9b','-', '1.0.0')))]" + }, + "analyticRuleObject6": { + "analyticRuleVersion6": "1.0.0", + "_analyticRulecontentId6": "f6a7b8c9-d0e1-4f2a-3b4c-5d6e7f8a9b0c", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f6a7b8c9-d0e1-4f2a-3b4c-5d6e7f8a9b0c')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f6a7b8c9-d0e1-4f2a-3b4c-5d6e7f8a9b0c')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a7b8c9-d0e1-4f2a-3b4c-5d6e7f8a9b0c','-', '1.0.0')))]" + }, + "QCryptonPQCScannerAgent-Notify": "QCryptonPQCScannerAgent-Notify", + "_QCryptonPQCScannerAgent-Notify": "[variables('QCryptonPQCScannerAgent-Notify')]", + "playbookVersion1": "1.0", + "playbookContentId1": "QCryptonPQCScannerAgent-Notify", + "_playbookContentId1": "[variables('playbookContentId1')]", + "playbookId1": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId1'))]", + "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]", + "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "displayName": "QCrypton Scanner Agent (via Codeless Connector Framework)", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "QCryptonPQCScannerAgentCCPDefinition", + "title": "QCrypton Scanner Agent (via Codeless Connector Framework)", + "publisher": "QCrypton, Inc.", + "descriptionMarkdown": "The [QCrypton Scanner Agent](https://www.qcrypton.com/) data connector ingests post-quantum cryptography readiness findings from internal network scans into Microsoft Sentinel through the QCrypton API. The Scanner Agent probes TLS posture on VNet-internal Azure endpoints and network appliances including F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, and Fortinet FortiGate. Findings include quantum-vulnerable certificates, weak TLS configurations, classical key exchanges, and PQC readiness status.", + "graphQueries": [ + { + "metricName": "Total internal network PQ readiness findings received", + "legend": "PQReadiness_CL", + "baseQuery": "PQReadiness_CL\n| where Metadata contains '\"source\":\"scanner-agent\"' or ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')" + } + ], + "sampleQueries": [ + { + "description": "All quantum-vulnerable internal findings in the last 24h", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where QuantumPosture == 'vulnerable'\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet', 'Azure/AppService', 'Azure/ContainerApp', 'Azure/FrontDoor', 'Azure/ApiManagement')\n| project TimeGenerated, ResourceName, ResourceType, AssetKind, Algorithm, PostureReason, RiskScore\n| order by RiskScore desc" + }, + { + "description": "Appliance TLS posture summary by vendor", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Vulnerable = countif(QuantumPosture == 'vulnerable'), Compliant = countif(QuantumPosture == 'compliant') by ResourceType" + }, + { + "description": "Endpoints with PQC hybrid key exchange negotiated", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where QuantumPosture == 'compliant'\n| where Metadata contains 'pqc_hybrid_key_exchange' or Metadata contains 'f5_pqc_engine_active'\n| project TimeGenerated, ResourceName, ResourceType, Algorithm, PostureReason" + } + ], + "dataTypes": [ + { + "name": "PQReadiness_CL", + "lastDataReceivedQuery": "PQReadiness_CL\n| where Metadata contains '\"source\":\"scanner-agent\"' or ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "QCrypton API Key", + "description": "A QCrypton Scanner Agent API key is required. Obtain one from the [QCrypton Portal](https://portal.qcrypton.com)." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect QCrypton Scanner Agent to Microsoft Sentinel", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "This connector polls the QCrypton Scanner Agent API to retrieve post-quantum cryptography readiness findings from internal network scans and ingest them into the **PQReadiness_CL** table in your Log Analytics workspace." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 1. Deploy the Scanner Agent\nDeploy the QCrypton Scanner Agent as an Azure Container App in your VNet. Follow the [deployment guide](https://www.qcrypton.com/docs/scanner-agent) to configure appliance targets (F5 BIG-IP, Check Point, Palo Alto, Cisco, Fortinet) and Azure endpoint discovery." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 2. API Key\nObtain your QCrypton API key from the [QCrypton Portal](https://portal.qcrypton.com). Navigate to **Settings > API Keys** and generate a key with read access to agent scan findings." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 3. API Server URL\nEnter the base URL of your QCrypton API server. The default is `https://api.qcrypton.com`. If you use a dedicated or regional instance, enter the URL provided by QCrypton." + } + }, + { + "type": "Textbox", + "parameters": { + "label": "QCrypton API Key", + "placeholder": "Enter your QCrypton API key", + "type": "password", + "name": "apiKey", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "QCrypton API Server URL", + "placeholder": "https://api.qcrypton.com", + "type": "text", + "name": "apiServerUrl", + "description": "Enter the QCrypton API base URL. Do not include a trailing slash or path.", + "validations": { + "required": true + } + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "name": "toggle" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "QCryptonPQCScannerAgentDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]", + "streamDeclarations": { + "Custom-PQReadiness_CL": { + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime" + }, + { + "name": "ResourceId", + "type": "string" + }, + { + "name": "ResourceType", + "type": "string" + }, + { + "name": "ResourceName", + "type": "string" + }, + { + "name": "SubscriptionId", + "type": "string" + }, + { + "name": "ResourceGroup", + "type": "string" + }, + { + "name": "Location", + "type": "string" + }, + { + "name": "AssetKind", + "type": "string" + }, + { + "name": "AssetIdentifier", + "type": "string" + }, + { + "name": "Algorithm", + "type": "string" + }, + { + "name": "KeySize", + "type": "int" + }, + { + "name": "Curve", + "type": "string" + }, + { + "name": "SignatureAlgorithm", + "type": "string" + }, + { + "name": "QuantumPosture", + "type": "string" + }, + { + "name": "PostureReason", + "type": "string" + }, + { + "name": "RiskScore", + "type": "int" + }, + { + "name": "ExpiresOn", + "type": "datetime" + }, + { + "name": "Metadata", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-PQReadiness_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-PQReadiness_CL", + "transformKql": "source | extend TimeGenerated = iff(isnull(TimeGenerated), now(), TimeGenerated) | project TimeGenerated, ResourceId, ResourceType, ResourceName, SubscriptionId, ResourceGroup, Location, AssetKind, AssetIdentifier, Algorithm, KeySize, Curve, SignatureAlgorithm, QuantumPosture, PostureReason, RiskScore, ExpiresOn, Metadata" + } + ] + } + }, + { + "name": "PQReadiness_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "retentionInDays": 90, + "schema": { + "name": "PQReadiness_CL", + "description": "Post-quantum cryptography readiness findings from QCrypton Scanner Agent. Contains scan results for internal network appliances (F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, Fortinet), VNet-internal Azure endpoints, TLS certificate posture, and PQC readiness status.", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Timestamp when the finding was generated by the scanner agent." + }, + { + "name": "ResourceId", + "type": "string", + "description": "Azure Resource Manager resource ID of the scanned resource, or appliance identifier for network devices." + }, + { + "name": "ResourceType", + "type": "string", + "description": "Resource type (e.g., F5/LTM, CheckPoint/Certificate, PaloAlto/Certificate, Cisco/Certificate, Fortinet/Certificate, Azure/AppService, Azure/ContainerApp)." + }, + { + "name": "ResourceName", + "type": "string", + "description": "Display name or hostname of the scanned resource or appliance." + }, + { + "name": "SubscriptionId", + "type": "string", + "description": "Azure subscription ID containing the scanner agent deployment." + }, + { + "name": "ResourceGroup", + "type": "string", + "description": "Resource group containing the scanned resource." + }, + { + "name": "Location", + "type": "string", + "description": "Azure region of the scanned resource." + }, + { + "name": "AssetKind", + "type": "string", + "description": "Classification of the cryptographic asset (tls-cert, tls-config)." + }, + { + "name": "AssetIdentifier", + "type": "string", + "description": "Unique identifier for the cryptographic asset (host:port)." + }, + { + "name": "Algorithm", + "type": "string", + "description": "Cryptographic algorithm in use (e.g., RSA, ECDSA, Ed25519, ML-DSA, TLS_AES_256_GCM_SHA384)." + }, + { + "name": "KeySize", + "type": "int", + "description": "Key size in bits (e.g., 2048, 4096). 0 for non-key assets." + }, + { + "name": "Curve", + "type": "string", + "description": "Elliptic curve name if applicable (e.g., P-256, P-384)." + }, + { + "name": "SignatureAlgorithm", + "type": "string", + "description": "Signature algorithm of the certificate (e.g., SHA256WithRSA, ECDSAWithSHA384)." + }, + { + "name": "QuantumPosture", + "type": "string", + "description": "Quantum readiness posture: vulnerable, partial, or compliant." + }, + { + "name": "PostureReason", + "type": "string", + "description": "Human-readable explanation for the quantum posture classification." + }, + { + "name": "RiskScore", + "type": "int", + "description": "Numeric risk score (0-30) reflecting quantum vulnerability severity." + }, + { + "name": "ExpiresOn", + "type": "datetime", + "description": "Expiry date of the certificate. Null for non-certificate assets." + }, + { + "name": "Metadata", + "type": "string", + "description": "JSON metadata: {scanId, rule, protocol}. Rule identifies the finding type (e.g., quantum_vulnerable_cert, f5_pqc_engine_active, checkpoint_cert_quantum_vulnerable)." + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "QCryptonPQCScannerAgentCCPDefinition", + "title": "QCrypton Scanner Agent (via Codeless Connector Framework)", + "publisher": "QCrypton, Inc.", + "descriptionMarkdown": "The [QCrypton Scanner Agent](https://www.qcrypton.com/) data connector ingests post-quantum cryptography readiness findings from internal network scans into Microsoft Sentinel through the QCrypton API. The Scanner Agent probes TLS posture on VNet-internal Azure endpoints and network appliances including F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, and Fortinet FortiGate. Findings include quantum-vulnerable certificates, weak TLS configurations, classical key exchanges, and PQC readiness status.", + "graphQueries": [ + { + "metricName": "Total internal network PQ readiness findings received", + "legend": "PQReadiness_CL", + "baseQuery": "PQReadiness_CL\n| where Metadata contains '\"source\":\"scanner-agent\"' or ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')" + } + ], + "sampleQueries": [ + { + "description": "All quantum-vulnerable internal findings in the last 24h", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where QuantumPosture == 'vulnerable'\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet', 'Azure/AppService', 'Azure/ContainerApp', 'Azure/FrontDoor', 'Azure/ApiManagement')\n| project TimeGenerated, ResourceName, ResourceType, AssetKind, Algorithm, PostureReason, RiskScore\n| order by RiskScore desc" + }, + { + "description": "Appliance TLS posture summary by vendor", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Vulnerable = countif(QuantumPosture == 'vulnerable'), Compliant = countif(QuantumPosture == 'compliant') by ResourceType" + }, + { + "description": "Endpoints with PQC hybrid key exchange negotiated", + "query": "PQReadiness_CL\n| where TimeGenerated > ago(24h)\n| where QuantumPosture == 'compliant'\n| where Metadata contains 'pqc_hybrid_key_exchange' or Metadata contains 'f5_pqc_engine_active'\n| project TimeGenerated, ResourceName, ResourceType, Algorithm, PostureReason" + } + ], + "dataTypes": [ + { + "name": "PQReadiness_CL", + "lastDataReceivedQuery": "PQReadiness_CL\n| where Metadata contains '\"source\":\"scanner-agent\"' or ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + } + ], + "customs": [ + { + "name": "QCrypton API Key", + "description": "A QCrypton Scanner Agent API key is required. Obtain one from the [QCrypton Portal](https://portal.qcrypton.com)." + } + ] + }, + "instructionSteps": [ + { + "title": "Connect QCrypton Scanner Agent to Microsoft Sentinel", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "This connector polls the QCrypton Scanner Agent API to retrieve post-quantum cryptography readiness findings from internal network scans and ingest them into the **PQReadiness_CL** table in your Log Analytics workspace." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 1. Deploy the Scanner Agent\nDeploy the QCrypton Scanner Agent as an Azure Container App in your VNet. Follow the [deployment guide](https://www.qcrypton.com/docs/scanner-agent) to configure appliance targets (F5 BIG-IP, Check Point, Palo Alto, Cisco, Fortinet) and Azure endpoint discovery." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 2. API Key\nObtain your QCrypton API key from the [QCrypton Portal](https://portal.qcrypton.com). Navigate to **Settings > API Keys** and generate a key with read access to agent scan findings." + } + }, + { + "type": "Markdown", + "parameters": { + "content": "#### 3. API Server URL\nEnter the base URL of your QCrypton API server. The default is `https://api.qcrypton.com`. If you use a dedicated or regional instance, enter the URL provided by QCrypton." + } + }, + { + "type": "Textbox", + "parameters": { + "label": "QCrypton API Key", + "placeholder": "Enter your QCrypton API key", + "type": "password", + "name": "apiKey", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "QCrypton API Server URL", + "placeholder": "https://api.qcrypton.com", + "type": "text", + "name": "apiServerUrl", + "description": "Enter the QCrypton API base URL. Do not include a trailing slash or path.", + "validations": { + "required": true + } + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "name": "toggle" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "displayName": "QCrypton Scanner Agent (via Codeless Connector Framework)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "QCrypton Scanner Agent (via Codeless Connector Framework)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "apiKey": { + "defaultValue": "apiKey", + "type": "securestring", + "minLength": 1 + }, + "apiServerUrl": { + "defaultValue": "apiServerUrl", + "type": "securestring", + "minLength": 1 + } + }, + "variables": { + "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'QCryptonPQCScannerAgentCCP', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "APIKey", + "ApiKey": "[[parameters('apiKey')]", + "ApiKeyName": "X-API-Key", + + "IsApiKeyInPostPayload": false + }, + "request": { + "apiEndpoint": "[[concat(parameters('apiServerUrl'),'/v1/agent/findings')]", + "httpMethod": "GET", + "rateLimitQPS": 2, + "queryWindowInMin": 60, + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", + "retryCount": 3, + "timeoutInSeconds": 120, + "headers": { + "Accept": "application/json", + "User-Agent": "MicrosoftSentinel-QCryptonPQCScannerAgentCCP" + }, + "queryParameters": { + "scanDateAfter": "{_QueryWindowStartTime}", + "scanDateBefore": "{_QueryWindowEndTime}" + } + }, + "response": { + "eventsJsonPaths": [ + "$.findings" + ], + "format": "json" + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.nextPageToken", + "nextPageParaName": "pageToken" + }, + "connectorDefinitionName": "QCryptonPQCScannerAgentCCPDefinition", + "dataType": "PQReadiness_CL", + "dcrConfig": { + "streamName": "Custom-PQReadiness_CL", + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "QCryptonPQCScannerAgentPosture Workbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "" + }, + "properties": { + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# QCrypton Scanner Agent \u2014 Internal Network PQ Readiness\\n\\nPost-quantum cryptography posture across internal network appliances and VNet endpoints. Data source: `PQReadiness_CL`.\"},\"name\":\"title\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"timeRange\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"value\":{\"durationMs\":86400000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000}]}}]},\"name\":\"params\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PQReadiness_CL\\n| where TimeGenerated {TimeRange}\\n| summarize Count = count() by QuantumPosture\\n| render piechart\",\"size\":0,\"title\":\"Overall quantum posture distribution\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"postureDistribution\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PQReadiness_CL\\n| where TimeGenerated {TimeRange}\\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\\n| summarize Vulnerable = countif(QuantumPosture == 'vulnerable'), Compliant = countif(QuantumPosture == 'compliant'), Partial = countif(QuantumPosture == 'partial') by ResourceType\\n| order by Vulnerable desc\",\"size\":0,\"title\":\"Appliance posture by vendor\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"appliancePosture\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PQReadiness_CL\\n| where TimeGenerated {TimeRange}\\n| where QuantumPosture == 'vulnerable'\\n| summarize Vulnerable = count() by bin(TimeGenerated, 1h), ResourceType\\n| render timechart\",\"size\":0,\"title\":\"Vulnerable findings over time by resource type\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"vulnTrend\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PQReadiness_CL\\n| where TimeGenerated {TimeRange}\\n| where QuantumPosture == 'vulnerable'\\n| summarize Latest = arg_max(TimeGenerated, *) by AssetIdentifier\\n| project Resource = ResourceName, Type = ResourceType, AssetKind, Algorithm, KeySize, Reason = PostureReason, Risk = RiskScore, Expires = ExpiresOn, Subscription = SubscriptionId\\n| order by Risk desc\",\"size\":0,\"title\":\"Top vulnerable assets (ordered by risk)\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"topVuln\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PQReadiness_CL\\n| where TimeGenerated {TimeRange}\\n| where QuantumPosture == 'compliant'\\n| where Metadata contains 'pqc_hybrid_key_exchange' or Metadata contains 'f5_pqc_engine_active' or Metadata contains 'pqc_cert_ready'\\n| summarize Latest = arg_max(TimeGenerated, *) by AssetIdentifier\\n| project Resource = ResourceName, Type = ResourceType, Algorithm, Reason = PostureReason, TimeGenerated\\n| order by TimeGenerated desc\",\"size\":0,\"title\":\"PQC-ready endpoints (quantum-safe confirmed)\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"pqcReady\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"PQReadiness_CL\\n| where TimeGenerated {TimeRange}\\n| where AssetKind == 'tls-cert' and isnotnull(ExpiresOn)\\n| where QuantumPosture == 'vulnerable'\\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\\n| project ResourceName, AssetIdentifier, ResourceType, SignatureAlgorithm, ExpiresOn, RiskScore\\n| order by ExpiresOn asc\",\"size\":0,\"title\":\"Appliance certificates by expiry date\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"certExpiry\"}],\"fromTemplateId\":\"QCrypton-ScannerAgentPosture\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "properties": { + "description": ".description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "ApplianceQuantumVulnerableCert_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "A network appliance (F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, or Fortinet) is presenting a\nTLS certificate signed with a classical algorithm (RSA/ECDSA) that is vulnerable to quantum attack.\nThese appliances terminate TLS for critical internal traffic and are prime harvest-now-decrypt-later\ntargets. Migrate to PQ-hybrid certificates or deploy QCrypton PQC Engine to front the appliance.", + "displayName": "Network appliance serving quantum-vulnerable certificate", + "enabled": false, + "query": "PQReadiness_CL\n| where TimeGenerated > ago(1h)\n| where AssetKind == \"tls-cert\"\n| where QuantumPosture == \"vulnerable\"\n| where ResourceType has_any (\"F5\", \"CheckPoint\", \"PaloAlto\", \"Cisco\", \"Fortinet\")\n| project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, Algorithm, SignatureAlgorithm, KeySize, ExpiresOn, RiskScore, PostureReason, SubscriptionId, ResourceGroup\n| order by RiskScore desc\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "QCryptonPQCScannerAgentCCPDefinition", + "dataTypes": [ + "PQReadiness_CL" + ] + } + ], + "tactics": [ + "InitialAccess", + "Collection" + ], + "techniques": [ + "T1190", + "T1557" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "ResourceName", + "identifier": "HostName" + } + ] + }, + { + "entityType": "Url", + "fieldMappings": [ + { + "columnName": "AssetIdentifier", + "identifier": "Url" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", + "properties": { + "description": "QCryptonPQCScannerAgent Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "Network appliance serving quantum-vulnerable certificate", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "InternalEndpointWeakTLS_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "A VNet-internal Azure endpoint or network appliance is accepting TLS below version 1.3. Only\nTLS 1.3 supports negotiation of hybrid post-quantum key exchange groups (X25519MLKEM768). Internal\nendpoints on legacy TLS cannot be upgraded to PQ without a protocol change. Upgrade the minimum\nTLS version to 1.3 to enable PQC readiness.", + "displayName": "Internal endpoint using TLS protocol below 1.3", + "enabled": false, + "query": "PQReadiness_CL\n| where TimeGenerated > ago(1d)\n| where AssetKind == \"tls-config\"\n| where QuantumPosture in (\"vulnerable\", \"partial\")\n| where Metadata contains \"TLSv1.0\" or Metadata contains \"TLSv1.1\" or Metadata contains \"TLSv1.2\"\n| project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, PostureReason, RiskScore, SubscriptionId, ResourceGroup\n| order by RiskScore desc\n", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "QCryptonPQCScannerAgentCCPDefinition", + "dataTypes": [ + "PQReadiness_CL" + ] + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "ResourceName", + "identifier": "HostName" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", + "properties": { + "description": "QCryptonPQCScannerAgent Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "contentKind": "AnalyticsRule", + "displayName": "Internal endpoint using TLS protocol below 1.3", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "NewApplianceVulnerableResource_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "A network appliance or internal Azure endpoint with quantum-vulnerable posture appeared that\nwas not observed in the previous 24-hour scan cycle. This may indicate a new deployment, a\nconfiguration change, or a newly discovered endpoint that should have been provisioned with\nPQ-hybrid cryptography.", + "displayName": "New quantum-vulnerable appliance or internal resource appeared", + "enabled": false, + "query": "let previous = PQReadiness_CL\n | where TimeGenerated between (ago(2d) .. ago(1d))\n | where QuantumPosture == \"vulnerable\"\n | distinct AssetIdentifier;\nPQReadiness_CL\n| where TimeGenerated > ago(1d)\n| where QuantumPosture == \"vulnerable\"\n| where AssetIdentifier !in (previous)\n| project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, AssetKind, Algorithm, PostureReason, RiskScore, SubscriptionId, ResourceGroup\n", + "queryFrequency": "P1D", + "queryPeriod": "P2D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "QCryptonPQCScannerAgentCCPDefinition", + "dataTypes": [ + "PQReadiness_CL" + ] + } + ], + "tactics": [ + "Discovery" + ], + "techniques": [ + "T1082" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "ResourceName", + "identifier": "HostName" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", + "properties": { + "description": "QCryptonPQCScannerAgent Analytics Rule 3", + "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "contentKind": "AnalyticsRule", + "displayName": "New quantum-vulnerable appliance or internal resource appeared", + "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "AppliancePQCReadyDetected_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "A network appliance has been confirmed as post-quantum ready. This may indicate a QCrypton PQC\nEngine deployment on F5 BIG-IP, a hybrid key exchange (X25519MLKEM768) negotiation, or an\nML-DSA/ML-KEM certificate in use. This is a positive signal \u2014 the appliance is protected against\nharvest-now-decrypt-later attacks.", + "displayName": "PQC-ready appliance detected \u2014 quantum-safe posture confirmed", + "enabled": false, + "query": "PQReadiness_CL\n| where TimeGenerated > ago(1d)\n| where QuantumPosture == \"compliant\"\n| where Metadata contains \"pqc_hybrid_key_exchange\"\n or Metadata contains \"f5_pqc_engine_active\"\n or Metadata contains \"f5_cert_pqc_ready\"\n or Metadata contains \"pqc_cert_ready\"\n| project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, Algorithm, PostureReason, SubscriptionId, ResourceGroup\n", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Informational", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "QCryptonPQCScannerAgentCCPDefinition", + "dataTypes": [ + "PQReadiness_CL" + ] + } + ], + "tactics": [ + "DefenseEvasion" + ], + "techniques": [ + "T1600" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "ResourceName", + "identifier": "HostName" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", + "properties": { + "description": "QCryptonPQCScannerAgent Analytics Rule 4", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "contentKind": "AnalyticsRule", + "displayName": "PQC-ready appliance detected \u2014 quantum-safe posture confirmed", + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "HighRiskInternalEndpoint_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "An internal endpoint or network appliance has a risk score above 20, indicating critical or high\nseverity quantum vulnerabilities. This may include expired certificates on appliances, RSA keys\nshorter than 2048 bits, or multiple compounding vulnerabilities on the same endpoint. Immediate\nremediation is recommended.", + "displayName": "High-risk internal endpoint with critical quantum vulnerability", + "enabled": false, + "query": "PQReadiness_CL\n| where TimeGenerated > ago(1h)\n| where QuantumPosture == \"vulnerable\"\n| where RiskScore > 20\n| project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, AssetKind, Algorithm, KeySize, SignatureAlgorithm, PostureReason, RiskScore, ExpiresOn, SubscriptionId, ResourceGroup\n| order by RiskScore desc\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "QCryptonPQCScannerAgentCCPDefinition", + "dataTypes": [ + "PQReadiness_CL" + ] + } + ], + "tactics": [ + "Impact" + ], + "techniques": [ + "T1565" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "ResourceName", + "identifier": "HostName" + } + ] + }, + { + "entityType": "Url", + "fieldMappings": [ + { + "columnName": "AssetIdentifier", + "identifier": "Url" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", + "properties": { + "description": "QCryptonPQCScannerAgent Analytics Rule 5", + "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "contentKind": "AnalyticsRule", + "displayName": "High-risk internal endpoint with critical quantum vulnerability", + "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "ApplianceCertExpiringSoon_AnalyticalRules Analytics Rule with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "A network appliance TLS certificate is expiring within the next 30 days and uses a classical\n(quantum-vulnerable) signature algorithm. Certificate renewal is an ideal time to migrate to a\nPQ-hybrid certificate. If the certificate is renewed with a classical algorithm, the\nharvest-now-decrypt-later exposure window resets for the new validity period.", + "displayName": "Appliance certificate expiring within 30 days with classical algorithm", + "enabled": false, + "query": "PQReadiness_CL\n| where TimeGenerated > ago(1d)\n| where AssetKind == \"tls-cert\"\n| where QuantumPosture == \"vulnerable\"\n| where isnotnull(ExpiresOn) and ExpiresOn between (now() .. ago(-30d))\n| where ResourceType has_any (\"F5\", \"CheckPoint\", \"PaloAlto\", \"Cisco\", \"Fortinet\")\n or Metadata contains \"certificate_expiring\"\n| project TimeGenerated, ResourceName, ResourceType, AssetIdentifier, SignatureAlgorithm, ExpiresOn, RiskScore, PostureReason, SubscriptionId, ResourceGroup\n| order by ExpiresOn asc\n", + "queryFrequency": "P1D", + "queryPeriod": "P1D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "QCryptonPQCScannerAgentCCPDefinition", + "dataTypes": [ + "PQReadiness_CL" + ] + } + ], + "tactics": [ + "Persistence" + ], + "techniques": [ + "T1556" + ], + "entityMappings": [ + { + "entityType": "Host", + "fieldMappings": [ + { + "columnName": "ResourceName", + "identifier": "HostName" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", + "properties": { + "description": "QCryptonPQCScannerAgent Analytics Rule 6", + "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "contentKind": "AnalyticsRule", + "displayName": "Appliance certificate expiring within 30 days with classical algorithm", + "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('playbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "QCryptonPQCScannerAgent-Notify Playbook with template version 3.0.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('playbookVersion1')]", + "parameters": { + "PlaybookName": { + "type": "string", + "defaultValue": "QCryptonPQCScannerAgent-Notify", + "metadata": { + "description": "Name of the Logic App playbook." + } + }, + "TeamsGroupId": { + "type": "string", + "metadata": { + "description": "Target Teams group (team) ID." + } + }, + "TeamsChannelId": { + "type": "string", + "metadata": { + "description": "Target Teams channel ID." + } + } + }, + "variables": { + "AzureSentinelConnectionName": "[[concat('azuresentinel-', parameters('PlaybookName'))]", + "TeamsConnectionName": "[[concat('teams-', parameters('PlaybookName'))]", + "connection-1": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "_connection-1": "[[variables('connection-1')]", + "connection-2": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]", + "_connection-2": "[[variables('connection-2')]", + "workspace-location-inline": "[concat('[resourceGroup().locatio', 'n]')]", + "workspace-name": "[parameters('workspace')]", + "workspaceResourceId": "[[resourceId('microsoft.OperationalInsights/Workspaces', variables('workspace-name'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('AzureSentinelConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('AzureSentinelConnectionName')]", + "api": { + "id": "[[variables('_connection-1')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[[variables('TeamsConnectionName')]", + "location": "[[variables('workspace-location-inline')]", + "kind": "V1", + "properties": { + "displayName": "[[variables('TeamsConnectionName')]", + "api": { + "id": "[[variables('_connection-2')]" + } + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2019-05-01", + "name": "[[parameters('PlaybookName')]", + "location": "[[variables('workspace-location-inline')]", + "identity": { + "type": "SystemAssigned" + }, + "dependsOn": [ + "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "type": "Object" + }, + "TeamsGroupId": { + "defaultValue": "", + "type": "String" + }, + "TeamsChannelId": { + "defaultValue": "", + "type": "String" + } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Post_message_to_Teams": { + "type": "ApiConnection", + "inputs": { + "host": { + "connection": { + "name": "@parameters('$connections')['teams']['connectionId']" + } + }, + "method": "post", + "path": "/v3/beta/teams/@{encodeURIComponent(parameters('TeamsGroupId'))}/channels/@{encodeURIComponent(parameters('TeamsChannelId'))}/messages", + "body": { + "body": { + "contentType": "html", + "content": "QCrypton Scanner Agent alert: @{triggerBody()?['object']?['properties']?['title']}
Severity: @{triggerBody()?['object']?['properties']?['severity']}
Incident: Open in Sentinel" + } + } + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "connectionName": "[[variables('AzureSentinelConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "teams": { + "connectionId": "[[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]", + "connectionName": "[[variables('TeamsConnectionName')]", + "id": "[[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', variables('workspace-location-inline'), '/managedApis/teams')]" + } + } + }, + "TeamsGroupId": { + "value": "[[parameters('TeamsGroupId')]" + }, + "TeamsChannelId": { + "value": "[[parameters('TeamsChannelId')]" + } + } + }, + "tags": { + "hidden-SentinelWorkspaceId": "[[variables('workspaceResourceId')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Playbook-', last(split(variables('playbookId1'),'/'))))]", + "properties": { + "parentId": "[variables('playbookId1')]", + "contentId": "[variables('_playbookContentId1')]", + "kind": "Playbook", + "version": "[variables('playbookVersion1')]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } + } + } + ], + "metadata": { + "title": "QCrypton Scanner Agent \u2014 notify on vulnerable appliance finding", + "description": "Logic App playbook: on Microsoft Sentinel incident trigger, post a card to a Microsoft Teams channel summarizing the quantum-vulnerable appliance or internal endpoint finding.", + "prerequisites": "A Teams channel + webhook, or a Teams connection API auth.", + "postDeployment": [ + "After deployment, authorize the Teams connection in the Logic App designer." + ], + "lastUpdateTime": "2026-10-28T00:00:00Z", + "entities": [ + "Host" + ], + "tags": [ + "Notification", + "PQC", + "NetworkSecurity" + ], + "releaseNotes": { + "version": "1.0", + "title": "[variables('blanks')]", + "notes": [ + "Initial version" + ] + } + } + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_playbookContentId1')]", + "contentKind": "Playbook", + "displayName": "QCryptonPQCScannerAgent-Notify", + "contentProductId": "[variables('_playbookcontentProductId1')]", + "id": "[variables('_playbookcontentProductId1')]", + "version": "[variables('playbookVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "QCrypton PQC Scanner Agent", + "publisherDisplayName": "QCrypton, Inc.", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

\u2022 Review the solution Release Notes

\n

\u2022 There may be known issues pertaining to this Solution, please refer to them before installing.

\n

Post-quantum cryptography readiness for internal networks and appliances. The QCrypton Scanner Agent deploys inside your VNet and probes TLS posture on F5 BIG-IP, Check Point, Palo Alto, Cisco ASA, Fortinet, and internal Azure endpoints. Ships with data connector, 6 analytic rules, workbook, and Teams-notification playbook.

\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 6, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", + "source": { + "kind": "Solution", + "name": "QCryptonPQCScannerAgent", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "QCrypton, Inc." + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections1')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" + }, + { + "kind": "Playbook", + "contentId": "[variables('_QCryptonPQCScannerAgent-Notify')]", + "version": "[variables('playbookVersion1')]" + } + ] + }, + "firstPublishDate": "2026-10-28", + "providers": [ + "QCrypton, Inc." + ], + "categories": { + "domains": [ + "Security - Cloud Security", + "Security - Network", + "Security - Threat Protection" + ] + } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" + } + ], + "outputs": {} +} \ No newline at end of file diff --git a/Solutions/QCryptonPQCScannerAgent/Package/testParameters.json b/Solutions/QCryptonPQCScannerAgent/Package/testParameters.json new file mode 100644 index 00000000000..da7acdc9aa7 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Package/testParameters.json @@ -0,0 +1,46 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": null, + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/README.md b/Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/README.md new file mode 100644 index 00000000000..4585c5e22f9 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/README.md @@ -0,0 +1,21 @@ +# QCryptonPQCScannerAgent-Notify + +## Overview + +This playbook posts a notification card to a Microsoft Teams channel when a Microsoft Sentinel incident is created by one of the QCrypton Scanner Agent analytic rules. The card includes the incident title, severity, and a direct link to the incident in the Sentinel portal. + +## Prerequisites + +- A Microsoft Teams team and channel where notifications should be posted. +- The Teams Group ID and Channel ID for the target channel (obtainable from the Teams admin center or the Microsoft Graph API). +- The Logic App managed identity must be granted the **Microsoft Sentinel Responder** role on the resource group containing the Sentinel workspace. + +## Post-Deployment Instructions + +1. After deployment, open the Logic App in the Azure portal. +2. Authorize the **Teams** API connection in the Logic App designer. +3. The **Azure Sentinel** connection uses managed identity and does not require manual authorization. + +## Deploy the Playbook + +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FQCryptonPQCScannerAgent%2FPlaybooks%2FQCryptonPQCScannerAgent-Notify%2Fazuredeploy.json) diff --git a/Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/azuredeploy.json b/Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/azuredeploy.json new file mode 100644 index 00000000000..fecba81edf6 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Playbooks/QCryptonPQCScannerAgent-Notify/azuredeploy.json @@ -0,0 +1,144 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "QCrypton Scanner Agent — notify on vulnerable appliance finding", + "description": "Logic App playbook: on Sentinel incident trigger, post a card to a Microsoft Teams channel summarizing the quantum-vulnerable appliance or internal endpoint finding.", + "prerequisites": "A Teams channel + webhook, or a Teams connection API auth.", + "postDeployment": ["After deployment, authorize the Teams connection in the Logic App designer."], + "lastUpdateTime": "2026-10-28T00:00:00.000Z", + "entities": ["Host"], + "tags": ["Notification", "PQC", "NetworkSecurity"], + "support": { + "tier": "Community", + "armtemplate": "Generated from https://github.com/qcrypton/scanner-agent" + }, + "author": { "name": "QCrypton, Inc." } + }, + "parameters": { + "PlaybookName": { + "type": "string", + "defaultValue": "QCryptonPQCScannerAgent-Notify", + "metadata": { "description": "Name of the Logic App playbook." } + }, + "TeamsGroupId": { + "type": "string", + "metadata": { "description": "Target Teams group (team) ID." } + }, + "TeamsChannelId": { + "type": "string", + "metadata": { "description": "Target Teams channel ID." } + } + }, + "variables": { + "AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]", + "TeamsConnectionName": "[concat('teams-', parameters('PlaybookName'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('AzureSentinelConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('AzureSentinelConnectionName')]", + "parameterValueType": "Alternative", + "customParameterValues": {}, + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('TeamsConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('TeamsConnectionName')]", + "customParameterValues": {}, + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/teams')]" + } + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2019-05-01", + "name": "[parameters('PlaybookName')]", + "location": "[resourceGroup().location]", + "identity": { "type": "SystemAssigned" }, + "dependsOn": [ + "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { "defaultValue": {}, "type": "Object" }, + "TeamsGroupId": { "defaultValue": "", "type": "String" }, + "TeamsChannelId": { "defaultValue": "", "type": "String" } + }, + "triggers": { + "Microsoft_Sentinel_incident": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { "callback_url": "@{listCallbackUrl()}" }, + "host": { "connection": { "name": "@parameters('$connections')['azuresentinel']['connectionId']" } }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Post_message_to_Teams": { + "type": "ApiConnection", + "inputs": { + "host": { "connection": { "name": "@parameters('$connections')['teams']['connectionId']" } }, + "method": "post", + "path": "/v3/beta/teams/@{encodeURIComponent(parameters('TeamsGroupId'))}/channels/@{encodeURIComponent(parameters('TeamsChannelId'))}/messages", + "body": { + "body": { + "contentType": "html", + "content": "QCrypton Scanner Agent alert: @{triggerBody()?['object']?['properties']?['title']}
Severity: @{triggerBody()?['object']?['properties']?['severity']}
Incident: Open in Sentinel" + } + } + } + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "connectionName": "[variables('AzureSentinelConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "teams": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('TeamsConnectionName'))]", + "connectionName": "[variables('TeamsConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/teams')]" + } + } + }, + "TeamsGroupId": { + "value": "[parameters('TeamsGroupId')]" + }, + "TeamsChannelId": { + "value": "[parameters('TeamsChannelId')]" + } + } + } + } + ] +} diff --git a/Solutions/QCryptonPQCScannerAgent/ReleaseNotes.md b/Solutions/QCryptonPQCScannerAgent/ReleaseNotes.md new file mode 100644 index 00000000000..2ddb4570a5d --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/ReleaseNotes.md @@ -0,0 +1,32 @@ +# QCrypton Scanner Agent for Microsoft Sentinel — Release Notes + +## v3.0.0 (28-10-2026) + +Initial release of the QCrypton Scanner Agent Sentinel Content Hub solution. + +### Components + +- **1 Data Connector** — Codeless Connector Framework (RestApiPoller) polling QCrypton API for internal network scan findings +- **6 Analytic Rules:** + - Network appliance serving quantum-vulnerable certificate (High) + - Internal endpoint using TLS below 1.3 (Medium) + - New quantum-vulnerable appliance or internal resource appeared (Informational) + - PQC-ready appliance detected — quantum-safe posture confirmed (Informational) + - High-risk internal endpoint with critical quantum vulnerability (High) + - Appliance certificate expiring within 30 days with classical algorithm (Medium) +- **1 Workbook** — Internal Network PQ Readiness dashboard with vendor breakdown, trend analysis, and certificate expiry tracking +- **1 Playbook** — Teams notification on Sentinel incidents + +### Supported Appliances + +- F5 BIG-IP (LTM, virtual servers, client/server SSL profiles) +- Check Point (certificates, HTTPS inspection rules, gateways) +- Palo Alto PAN-OS (certificates, decryption profiles) +- Cisco ASA/FTD (identity/CA certificates, SSL settings, VPN profiles) +- Fortinet FortiGate (certificates, SSL profiles, firewall policies) + +### Azure Endpoints Discovered + +- App Services, Function Apps +- Front Door, Application Gateways +- API Management, Container Apps diff --git a/Solutions/QCryptonPQCScannerAgent/SolutionMetadata.json b/Solutions/QCryptonPQCScannerAgent/SolutionMetadata.json new file mode 100644 index 00000000000..61825f290ad --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/SolutionMetadata.json @@ -0,0 +1,16 @@ +{ + "publisherId": "qcryptoninc1788706847984", + "offerId": "qcrypton-pqc-scanner-agent-sentinel", + "firstPublishDate": "2026-10-28", + "providers": ["QCrypton, Inc."], + "categories": { + "domains": ["Security - Cloud Security", "Security - Network Security", "Security - Threat Protection"], + "verticals": [] + }, + "support": { + "name": "QCrypton, Inc.", + "email": "support@qcrypton.com", + "tier": "Partner", + "link": "https://www.qcrypton.com/support" + } +} diff --git a/Solutions/QCryptonPQCScannerAgent/Workbooks/Images/Preview/QCryptonPQCScannerAgentPostureBlack.png b/Solutions/QCryptonPQCScannerAgent/Workbooks/Images/Preview/QCryptonPQCScannerAgentPostureBlack.png new file mode 100644 index 0000000000000000000000000000000000000000..4fc2f5c4f92143424bfaac20d1773cd2aff1392c GIT binary patch literal 661 zcmeAS@N?(olHy`uVBq!ia0y~yU~~YoPjD~+NwKu`e;62;Vmw_OLn`LHy==(KV8C-= zgOX@UL$ua-{ literal 0 HcmV?d00001 diff --git a/Solutions/QCryptonPQCScannerAgent/Workbooks/Images/Preview/QCryptonPQCScannerAgentPostureWhite.png b/Solutions/QCryptonPQCScannerAgent/Workbooks/Images/Preview/QCryptonPQCScannerAgentPostureWhite.png new file mode 100644 index 0000000000000000000000000000000000000000..7e0b9cee9cb1f737ec2fd5bdd9bf51b9a216a204 GIT binary patch literal 661 zcmeAS@N?(olHy`uVBq!ia0y~yU~~YoPjD~+NwKu`e;62;Vmw_OLn`LHy==(KV8C-= z!>8xB_se|qnV7>;X~dm!_C3Rcxs8fv4hWy;Ynm`GhlX}F)BP7CioKs Z`_}3YEGh4NC4k9|!PC{xWt~$(699wa$_4-c literal 0 HcmV?d00001 diff --git a/Solutions/QCryptonPQCScannerAgent/Workbooks/QCryptonPQCScannerAgentPosture.json b/Solutions/QCryptonPQCScannerAgent/Workbooks/QCryptonPQCScannerAgentPosture.json new file mode 100644 index 00000000000..bcaed042560 --- /dev/null +++ b/Solutions/QCryptonPQCScannerAgent/Workbooks/QCryptonPQCScannerAgentPosture.json @@ -0,0 +1,113 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 1, + "content": { + "json": "# QCrypton Scanner Agent — Internal Network PQ Readiness\n\nPost-quantum cryptography posture across internal network appliances and VNet endpoints. Data source: `PQReadiness_CL`." + }, + "name": "title" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "timeRange", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "type": 4, + "value": { "durationMs": 86400000 }, + "typeSettings": { + "selectableValues": [ + { "durationMs": 3600000 }, + { "durationMs": 86400000 }, + { "durationMs": 604800000 }, + { "durationMs": 2592000000 } + ] + } + } + ] + }, + "name": "params" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "PQReadiness_CL\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by QuantumPosture\n| render piechart", + "size": 0, + "title": "Overall quantum posture distribution", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "50", + "name": "postureDistribution" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "PQReadiness_CL\n| where TimeGenerated {TimeRange}\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| summarize Vulnerable = countif(QuantumPosture == 'vulnerable'), Compliant = countif(QuantumPosture == 'compliant'), Partial = countif(QuantumPosture == 'partial') by ResourceType\n| order by Vulnerable desc", + "size": 0, + "title": "Appliance posture by vendor", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "50", + "name": "appliancePosture" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "PQReadiness_CL\n| where TimeGenerated {TimeRange}\n| where QuantumPosture == 'vulnerable'\n| summarize Vulnerable = count() by bin(TimeGenerated, 1h), ResourceType\n| render timechart", + "size": 0, + "title": "Vulnerable findings over time by resource type", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "vulnTrend" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "PQReadiness_CL\n| where TimeGenerated {TimeRange}\n| where QuantumPosture == 'vulnerable'\n| summarize Latest = arg_max(TimeGenerated, *) by AssetIdentifier\n| project Resource = ResourceName, Type = ResourceType, AssetKind, Algorithm, KeySize, Reason = PostureReason, Risk = RiskScore, Expires = ExpiresOn, Subscription = SubscriptionId\n| order by Risk desc", + "size": 0, + "title": "Top vulnerable assets (ordered by risk)", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "topVuln" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "PQReadiness_CL\n| where TimeGenerated {TimeRange}\n| where QuantumPosture == 'compliant'\n| where Metadata contains 'pqc_hybrid_key_exchange' or Metadata contains 'f5_pqc_engine_active' or Metadata contains 'pqc_cert_ready'\n| summarize Latest = arg_max(TimeGenerated, *) by AssetIdentifier\n| project Resource = ResourceName, Type = ResourceType, Algorithm, Reason = PostureReason, TimeGenerated\n| order by TimeGenerated desc", + "size": 0, + "title": "PQC-ready endpoints (quantum-safe confirmed)", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "pqcReady" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "PQReadiness_CL\n| where TimeGenerated {TimeRange}\n| where AssetKind == 'tls-cert' and isnotnull(ExpiresOn)\n| where QuantumPosture == 'vulnerable'\n| where ResourceType has_any ('F5', 'CheckPoint', 'PaloAlto', 'Cisco', 'Fortinet')\n| project ResourceName, AssetIdentifier, ResourceType, SignatureAlgorithm, ExpiresOn, RiskScore\n| order by ExpiresOn asc", + "size": 0, + "title": "Appliance certificates by expiry date", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "certExpiry" + } + ], + "styleSettings": {}, + "fromTemplateId": "QCrypton-ScannerAgentPosture", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 35d2aa0831e..5ca4deb41ce 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -11887,6 +11887,26 @@ "templateRelativePath": "QCryptonPQReadiness.json", "subtitle": "", "provider": "QCrypton, Inc." + }, + { + "workbookKey": "QCryptonPQCScannerAgentPostureWorkbook", + "logoFileName": "qcrypton.svg", + "description": "Internal network post-quantum cryptography posture workbook for Microsoft Sentinel. Visualises quantum-vulnerable certificates, weak TLS configurations, and classical key exchanges across internal network appliances and VNet endpoints from QCrypton Scanner Agent findings.", + "dataTypesDependencies": [ + "PQReadiness_CL" + ], + "dataConnectorsDependencies": [ + "QCryptonPQCScannerAgentCCPDefinition" + ], + "previewImagesFileNames": [ + "QCryptonPQCScannerAgentPostureWhite.png", + "QCryptonPQCScannerAgentPostureBlack.png" + ], + "version": "1.0.0", + "title": "QCrypton Scanner Agent Posture", + "templateRelativePath": "QCryptonPQCScannerAgentPosture.json", + "subtitle": "", + "provider": "QCrypton, Inc." }, { "workbookKey": "IISServersMonitoringSecurity",