Skip to content

Add Censys Supplier Risk solution - #15490

Draft
harsh-maradia wants to merge 18 commits into
Azure:masterfrom
harsh-maradia:censys-sr
Draft

harsh-maradia wants to merge 18 commits into
Azure:masterfrom
harsh-maradia:censys-sr

Conversation

@harsh-maradia

@harsh-maradia harsh-maradia commented Oct 29, 2026 •

Copy link
Copy Markdown
Contributor

Change(s):

  • Adds the new Censys Supplier Risk solution (solution version 3.0.0), which brings the Censys supplier risk-events feed into Microsoft Sentinel.
  • Data connector (Azure Function App, Flex Consumption, Python 3.14): timer functions that ingest risk events into CensysRiskEvents_CL with the Logs Ingestion API and keep supplier and risk names for the optional filters. Includes the ARM template, connector page, CensysSR100.zip and a README.
  • Parsers: CensysRiskEvents, CensysRisks.
  • Analytic rule: Censys SR - Risk State Change. One incident per risk instance, by default for opened and reopened CRITICAL/HIGH risks, with the full life cycle and extra filters as commented options.
  • Workbook: Censys Supplier Risk.
  • Outside the solution folder: the workbook entry in WorkbooksMetadata.json, two preview images, the table schema CustomTables/CensysRiskEvents_CL.json and the sample data Sample Data/Custom/CensysRiskEvents_CL.csv.

Reason for Change(s):

  • New solution to monitor supplier (third-party) risk from Censys in Microsoft Sentinel: ingestion, incidents and a workbook.

Version Updated:

  • Yes
  • New analytic rule Censys SR - Risk State Change, version 1.0.0. Solution version 3.0.0 (first release).

Testing Completed:

  • Yes

Checked that the validations are passing and have addressed any issues that are present:

  • No, yet to be checked. Any issue reported by the PR validations (KQL, detection template schema, non-ASCII, Sonar and the others) will be addressed.

harsh-maradia and others added 18 commits October 20, 2026 14:52
Function based data connector (own table, data collection endpoint and rule),
CCF connector files, parsers, workbook, analytic rule and generated package.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…dation

Supplier names (separated by *) replace supplier ids. A second function keeps the
supplier ids and names in a storage table, and the main function looks the ids
up at the start of every run. Settings are validated in one place, every problem
is logged with the setting name, and log lines use the standard format.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…ensysRisks parser

Add a Status filter, show fewer columns in the panels and the details, sort the
New vs. Resolved Risks chart by day, set column widths, and read the current state
of each risk from the new CensysRisks parser (replaces CensysOpenRisks).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…nerated package

Rename the connector configuration fields (Censys prefix, clearer schedule and log
level names), change the severity panel of the workbook to a pie chart and rearrange
the first row, and update the generated package files.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…uieter logs, code cleanup

Add the Censys Table Name input, send a User-Agent header, log the request
parameters only at debug level, wrap the code to 120 columns, add the missing
docstrings, fix wording in code and texts, and update the generated package.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… to SR)

Rename the solution folder, workbook, function app code, connector id,
templates and metadata. Package is not regenerated yet.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… 30 minutes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
… a table, RiskNames replaces RiskTypeIds

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…s schedule setting to SuppliersAndRisksSchedule

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…tic rule, regenerate package

Workbook: event based counts, click-through for every panel.
Analytic rule: commented optional filter lines.
WorkbooksMetadata: new workbook description.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…y default, full lifecycle and filters as optional comments; regenerate package

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…; analytic rule: severity follows the Censys severity only

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…tor field names

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

# Conflicts:
#	Workbooks/WorkbooksMetadata.json
…um, LOW to Low; connector: User-Agent and ts headers; regenerate package

- Alert severity follows the Censys severity for every change type, resolved events included; any other severity is Informational.
- Censys API requests send a stable User-Agent (CensysSRMSSentinel/1.0.0) and a ts header with the epoch time of each request.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…d supporting files

- Remove the CCF connector folder; the solution delivers the Azure Function App connector only.
- Use the aka.ms short links for the function package (CensysSR100) and the Deploy to Azure template, and add CensysSR100.zip (Python 3.14 packages).
- Add the connector README, the CensysRiskEvents_CL table schema and sample data, and the workbook preview images.
- Mention that supplier and risk names can be picked from the Censys Supplier Risk UI, and add a 10 minute warning to both schedules.
- Set the publish dates, and regenerate the package.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@github-actions github-actions Bot added ISV Solution 3P / ISV Partner-authored or Partner-integrated Sentinel solution Solution Solution specialty review needed labels Oct 29, 2026
@harsh-maradia harsh-maradia changed the title Censys sr Add Censys Supplier Risk solution Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ISV Solution 3P / ISV Partner-authored or Partner-integrated Sentinel solution Solution Solution specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants