![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Censys.svg\")
",
+ "Description": "Bring Censys Supplier Risk into Microsoft Sentinel. The solution collects supply chain risk events (risks opened, reopened and resolved for your suppliers) from the Censys platform, and provides a parser, a workbook and an analytic rule that raises incidents for new and reopened supplier risks and keeps resolved events with the incident of the same risk.",
+ "Data Connectors": [
+ "Data Connectors/CensysRiskEventsFunctionConnector/CensysSR_RiskEvents_FunctionApp.json"
+ ],
+ "Parsers": [
+ "Parsers/CensysRiskEvents.yaml",
+ "Parsers/CensysRisks.yaml"
+ ],
+ "Workbooks": [
+ "Workbooks/CensysSupplierRisk.json"
+ ],
+ "Analytic Rules": [
+ "Analytic Rules/CensysRiskStateChange.yaml"
+ ],
+ "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Censys Supplier Risk",
+ "Version": "3.0.0",
+ "Metadata": "SolutionMetadata.json",
+ "TemplateSpec": true,
+ "Is1PConnector": false
+}
diff --git a/Solutions/Censys Supplier Risk/Package/3.0.0.zip b/Solutions/Censys Supplier Risk/Package/3.0.0.zip
new file mode 100644
index 00000000000..663945f25ac
Binary files /dev/null and b/Solutions/Censys Supplier Risk/Package/3.0.0.zip differ
diff --git a/Solutions/Censys Supplier Risk/Package/createUiDefinition.json b/Solutions/Censys Supplier Risk/Package/createUiDefinition.json
new file mode 100644
index 00000000000..31144cf1a14
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/Package/createUiDefinition.json
@@ -0,0 +1,176 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+ "handler": "Microsoft.Azure.CreateUIDef",
+ "version": "0.1.2-preview",
+ "parameters": {
+ "config": {
+ "isWizard": false,
+ "basics": {
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Censys%20Supplier%20Risk/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nBring Censys Supplier Risk into Microsoft Sentinel. The solution collects supply chain risk events (risks opened, reopened and resolved for your suppliers) from the Censys platform, and provides a parser, a workbook and an analytic rule that raises incidents for new and reopened supplier risks and keeps resolved events with the incident of the same risk.\n\n**Data Connectors:** 1, **Parsers:** 2, **Workbooks:** 1, **Analytic Rules:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "subscription": {
+ "resourceProviders": [
+ "Microsoft.OperationsManagement/solutions",
+ "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+ "Microsoft.Insights/workbooks",
+ "Microsoft.Logic/workflows"
+ ]
+ },
+ "location": {
+ "metadata": {
+ "hidden": "Hiding location, we get it from the log analytics workspace"
+ },
+ "visible": false
+ },
+ "resourceGroup": {
+ "allowExisting": true
+ }
+ }
+ },
+ "basics": [
+ {
+ "name": "getLAWorkspace",
+ "type": "Microsoft.Solutions.ArmApiControl",
+ "toolTip": "This filters by workspaces that exist in the Resource Group selected",
+ "condition": "[greater(length(resourceGroup().name),0)]",
+ "request": {
+ "method": "GET",
+ "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+ }
+ },
+ {
+ "name": "workspace",
+ "type": "Microsoft.Common.DropDown",
+ "label": "Workspace",
+ "placeholder": "Select a workspace",
+ "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
+ "constraints": {
+ "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+ "required": true
+ },
+ "visible": true
+ }
+ ],
+ "steps": [
+ {
+ "name": "dataconnectors",
+ "label": "Data Connectors",
+ "bladeTitle": "Data Connectors",
+ "elements": [
+ {
+ "name": "dataconnectors1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This Solution installs the data connector for Censys Supplier Risk. You can get Censys Supplier Risk custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
+ }
+ },
+ {
+ "name": "dataconnectors-parser-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel."
+ }
+ },
+ {
+ "name": "dataconnectors-link1",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more about connecting data sources",
+ "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
+ }
+ }
+ }
+ ]
+ },
+ {
+ "name": "workbooks",
+ "label": "Workbooks",
+ "subLabel": {
+ "preValidation": "Configure the workbooks",
+ "postValidation": "Done"
+ },
+ "bladeTitle": "Workbooks",
+ "elements": [
+ {
+ "name": "workbooks-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view."
+ }
+ },
+ {
+ "name": "workbooks-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data"
+ }
+ }
+ },
+ {
+ "name": "workbook1",
+ "type": "Microsoft.Common.Section",
+ "label": "Censys Supplier Risk",
+ "elements": [
+ {
+ "name": "workbook1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Gain insight into supplier risk collected from Censys Supplier Risk: open risks by severity, risk events by category, opened and closed risks over time, top risks by open risk count, supplier risk ranking and rapid response events, with details one selection away."
+ }
+ }
+ ]
+ }
+ ]
+ },
+ {
+ "name": "analytics",
+ "label": "Analytics",
+ "subLabel": {
+ "preValidation": "Configure the analytics",
+ "postValidation": "Done"
+ },
+ "bladeTitle": "Analytics",
+ "elements": [
+ {
+ "name": "analytics-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view."
+ }
+ },
+ {
+ "name": "analytics-link",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more",
+ "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef"
+ }
+ }
+ },
+ {
+ "name": "analytic1",
+ "type": "Microsoft.Common.Section",
+ "label": "Censys SR - Risk State Change",
+ "elements": [
+ {
+ "name": "analytic1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "Creates one incident per supplier risk instance that is opened, or reopened, with CRITICAL or HIGH severity. Alerts are grouped by RiskInstanceId, so further events of the same risk instance within 24 hours are added to the same incident while it is open.\nAlert severity follows the Censys severity: CRITICAL and HIGH map to High, MEDIUM to Medium and LOW to Low. Resolved events follow the same mapping, and any other severity is Informational.\nBy default the rule alerts only on new CRITICAL and HIGH risks. The query holds commented lines to follow the whole life of a risk instead (reopened events of any severity and resolved events), see the comments in the query."
+ }
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "outputs": {
+ "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+ "location": "[location()]",
+ "workspace": "[basics('workspace')]"
+ }
+ }
+}
diff --git a/Solutions/Censys Supplier Risk/Package/mainTemplate.json b/Solutions/Censys Supplier Risk/Package/mainTemplate.json
new file mode 100644
index 00000000000..f24fefa6115
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/Package/mainTemplate.json
@@ -0,0 +1,1026 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "author": "Censys - support@censys.com",
+ "comments": "Solution template for Censys Supplier Risk"
+ },
+ "parameters": {
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": "Censys Supplier Risk",
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ }
+ },
+ "variables": {
+ "email": "support@censys.com",
+ "_email": "[variables('email')]",
+ "_solutionName": "Censys Supplier Risk",
+ "_solutionVersion": "3.0.0",
+ "solutionId": "censys.censys_supplier_risk",
+ "_solutionId": "[variables('solutionId')]",
+ "uiConfigId1": "CensysSRRiskEventsFunction",
+ "_uiConfigId1": "[variables('uiConfigId1')]",
+ "dataConnectorContentId1": "CensysSRRiskEventsFunction",
+ "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]",
+ "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "_dataConnectorId1": "[variables('dataConnectorId1')]",
+ "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]",
+ "dataConnectorVersion1": "1.0.0",
+ "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]",
+ "parserObject1": {
+ "_parserName1": "[concat(parameters('workspace'),'/','CensysRiskEvents')]",
+ "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CensysRiskEvents')]",
+ "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('CensysRiskEvents-Parser')))]",
+ "parserVersion1": "1.0.0",
+ "parserContentId1": "CensysRiskEvents-Parser"
+ },
+ "parserObject2": {
+ "_parserName2": "[concat(parameters('workspace'),'/','CensysRisks')]",
+ "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CensysRisks')]",
+ "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('CensysRisks-Parser')))]",
+ "parserVersion2": "1.0.0",
+ "parserContentId2": "CensysRisks-Parser"
+ },
+ "workbookVersion1": "1.0.0",
+ "workbookContentId1": "CensysSupplierRiskWorkbook",
+ "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]",
+ "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]",
+ "_workbookContentId1": "[variables('workbookContentId1')]",
+ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+ "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]",
+ "analyticRuleObject1": {
+ "analyticRuleVersion1": "1.0.0",
+ "_analyticRulecontentId1": "8a208922-5ef7-4721-ad8b-7f69e2163d79",
+ "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8a208922-5ef7-4721-ad8b-7f69e2163d79')]",
+ "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8a208922-5ef7-4721-ad8b-7f69e2163d79')))]",
+ "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8a208922-5ef7-4721-ad8b-7f69e2163d79','-', '1.0.0')))]"
+ },
+ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('dataConnectorTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "Censys Supplier Risk data connector with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorVersion1')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+ "apiVersion": "2021-03-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "GenericUI",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "[variables('_uiConfigId1')]",
+ "title": "Censys Supplier Risk (using Azure Functions)",
+ "publisher": "Censys",
+ "descriptionMarkdown": "The Censys Supplier Risk data connector brings the Censys risk-events change feed (`/v1/supplychains/default/risk-events`) into Microsoft Sentinel using Azure Functions and the [Logs Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview). The function runs on a schedule and remembers the `inserted_at` and `id` of the last event it ingested, so each run continues where the previous one stopped. Events are written to the table `CensysRiskEvents_CL` through a data collection endpoint and a data collection rule that the deployment template creates. Suppliers and risks can be selected by name; the connector keeps the supplier names and risk names with their ids in storage tables.",
+ "graphQueries": [
+ {
+ "metricName": "Total Censys risk events received",
+ "legend": "CensysRiskEvents_CL",
+ "baseQuery": "CensysRiskEvents_CL"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "All Censys risk events received, newest first.",
+ "query": "CensysRiskEvents_CL\n| sort by TimeGenerated desc"
+ },
+ {
+ "description": "Newly opened or reopened risks with critical or high severity.",
+ "query": "CensysRiskEvents_CL\n| where ChangeType in ('opened', 'reopened')\n| where Severity in ('CRITICAL', 'HIGH')\n| project TimeGenerated, Severity, RiskName, SupplierDisplayName, AssetIp, AssetHostname, PlatformUrl\n| order by TimeGenerated desc"
+ },
+ {
+ "description": "Rapid response findings (actively exploited).",
+ "query": "CensysRiskEvents_CL\n| where RapidResponse == true and ChangeType in ('opened', 'reopened')\n| project TimeGenerated, Severity, CveId, RiskName, SupplierDisplayName, AssetIp, Evidence, PlatformUrl"
+ },
+ {
+ "description": "Currently open risks per supplier (latest event per risk).",
+ "query": "CensysRiskEvents_CL\n| summarize arg_max(InsertedAt, *) by RiskInstanceId\n| where Status == 'open'\n| summarize OpenRisks = count() by SupplierDisplayName, Severity\n| order by OpenRisks desc"
+ },
+ {
+ "description": "Risk events mapped to known CVEs.",
+ "query": "CensysRiskEvents_CL\n| where isnotempty(CveId)\n| summarize AffectedAssets = dcount(RiskInstanceId) by CveId, Severity\n| order by AffectedAssets desc"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "CensysRiskEvents_CL",
+ "lastDataReceivedQuery": "CensysRiskEvents_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriterias": [
+ {
+ "type": "IsConnectedQuery",
+ "value": [
+ "CensysRiskEvents_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
+ ]
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "read and write permissions on the workspace are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "write": true,
+ "read": true,
+ "delete": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "name": "Microsoft.Web/sites permissions",
+ "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
+ },
+ {
+ "name": "REST API Credentials/permissions",
+ "description": "A Censys personal access token and the Censys Organization ID are required. Users on Starter, Search, and Core plans need the API Access role. [Create a token](https://accounts.censys.io/settings/personal-access-tokens)."
+ },
+ {
+ "name": "Microsoft Entra application",
+ "description": "An app registration with a client secret is required. Permission to create role assignments on the data collection rule (Owner or User Access Administrator) is required to give the application the Monitoring Metrics Publisher role."
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "description": ">**NOTE:** This connector uses Azure Functions to connect to the Censys API to pull risk events into Microsoft Sentinel using the [Logs Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview). The deployment template creates the table CensysRiskEvents_CL, a data collection endpoint and a data collection rule in the workspace. A second function, CensysSRSuppliersAndRisks, keeps the lists of supplier names and risk names, with their ids, in storage tables of the Function App (nothing is sent to Microsoft Sentinel), so supplier names and risk names can be used as an input. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
+ },
+ {
+ "description": ">**(Optional Step)** Securely store the Censys API token and the client secret in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
+ },
+ {
+ "description": "**STEP 1 - Steps to Create/Get a Censys Personal Access Token and Organization ID**\n\n Follow these instructions to get the values needed by this connector:\n 1. Sign in to Censys and open [Personal access tokens](https://accounts.censys.io/settings/personal-access-tokens).\n 2. Create a personal access token. Users on Starter, Search, and Core plans need the **API Access** role.\n 3. Copy the token. It is shown only once.\n 4. Copy the **Organization ID** (UUID) of the Censys organization you want to collect risk events for."
+ },
+ {
+ "description": "**STEP 2 - Get the name of the Log Analytics workspace**\n\n The deployment template creates the table, the data collection endpoint and the data collection rule in the workspace of Microsoft Sentinel, so deploy it in the resource group of that workspace. You need the **name** of the workspace (workspace Overview page)."
+ },
+ {
+ "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID are required as configuration parameters for the execution of the Censys SR data connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)"
+ },
+ {
+ "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of the Censys SR data connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of the Censys SR data connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)"
+ },
+ {
+ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **Azure_Entra_Object_Id** needed for your ARM template role assignment. The template gives this application the **Monitoring Metrics Publisher** role on the data collection rule, so no other role needs to be assigned."
+ },
+ {
+ "description": "**STEP 6 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Censys SR data connector, have the Censys API token, the organization ID, the workspace name and the Azure credentials (client ID, client secret, tenant ID, object ID) ready."
+ },
+ {
+ "description": "Use this method for automated deployment of the Censys SR connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[](https://aka.ms/sentinel-CensysSRRiskEventsFunction-azuredeploy)\n2. Select the preferred **Subscription** and **Resource Group**. Use the resource group of the Log Analytics workspace of Microsoft Sentinel. \n3. Enter the below information : \n\n\t a. **Censys SR Function Name** - Name prefix of the Azure Function App to be created, up to 10 characters. Default is CensysSR.\n\n\t b. **Censys Api Key** - Enter your Censys personal access token.\n\n\t c. **Censys Organization Id** - Enter the UUID of the Censys organization to collect risk events for, for example 00000000-0000-0000-0000-000000000000.\n\n\t d. **Censys Start Date Time** - Optional. UTC time to start collecting from, in the form 2026-10-01T00:00:00Z. It must not be in the future. Leave empty for full history (all events Censys still retains).\n\n\t e. **Censys Supplier Names** - Optional. Names of the suppliers to collect risk events for, separated by an asterisk (*). For example: OpenAI*Harvey*Acme, Inc. Names are not case-sensitive and can be picked from the Censys Supplier Risk UI. Names that are not found among your suppliers are skipped with a warning. Leave empty to collect all suppliers. A change applies from the next run and continues from the current position, so avoid changing it often. Maximum 500 characters.\n\n\t f. **Censys Risk Names** - Optional. Names of the risks to collect risk events for, separated by an asterisk (*). For example: Log4Shell*Exposed Redis. Names are not case-sensitive and must match the risk name shown in the Censys Supplier Risk UI. Names that are not found among the risks of your supply chain are skipped with a warning. Leave empty to collect all risks. A change applies from the next run and continues from the current position, so avoid changing it often. Maximum 500 characters.\n\n\t g. **Censys Change Types** - Optional. Comma-separated change types: opened, resolved, reopened. Other values stop the run with an error. Leave empty for all.\n\n\t h. **Censys Severity** - Optional. Comma-separated severities: CRITICAL, HIGH, MEDIUM, LOW. Other values stop the run with an error. Leave empty for all.\n\n\t i. **Censys Rapid Response** - Optional. Select true for rapid response findings only, false to exclude them. Leave empty for both.\n\n\t j. **Azure_Client_Id** - Enter the Azure client ID of the app registration you created.\n\n\t k. **Azure_Client_Secret** - Enter the client secret you created for the app registration.\n\n\t l. **Azure_Tenant_Id** - Enter the Azure tenant ID of your Microsoft Entra ID.\n\n\t m. **Azure_Entra_Object_Id** - Enter the object ID of your Microsoft Entra app (Enterprise application).\n\n\t n. **WorkspaceName** - Name of the Log Analytics workspace of Microsoft Sentinel. The deployment creates the table CensysRiskEvents_CL, a data collection endpoint and a data collection rule in it.\n\n\t o. **Location** - Region of the data collection endpoint and rule. It must be the region of the workspace. Default is the region of the resource group.\n\n\t p. **Censys Risk Events Table Name** - Name of the table in the workspace that the risk events are written to. Default is CensysRiskEvents_CL (the suffix _CL is added, or corrected, when it is missing or in another case). Maximum 52 characters. Warning: the parser, the workbook, the analytic rule and the connector status check of this solution read CensysRiskEvents_CL. If you use another name, update these resources to read the new table.\n\n\t q. **Censys Risk Events Collection Schedule** - Please enter a valid Quartz cron-expression, for example 0 */10 * * * *. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is 0 */10 * * * * (every 10 minutes).\n\n\t r. **Censys Supplier and Risk List Refresh Schedule** - Quartz cron-expression for how often the function that refreshes the lists of supplier names and risk names with their ids runs, for example 0 */30 * * * *. It also runs once when the app starts. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is every 30 minutes.\n\n\t s. **AppInsightsWorkspaceResourceID** - Use 'Log Analytic Workspace > Properties' blade having 'Resource ID' property value. This is a fully qualified resource ID which is in format '/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/workspaces/{workspace-name}'.\n\n\t t. **Censys SR Function Log Level** - Select log level or log severity value from DEBUG, INFO, ERROR. By default it is set to INFO.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.",
+ "title": "Option 1 - Azure Resource Manager (ARM) Template"
+ },
+ {
+ "description": "Use the following step-by-step instructions to deploy the Censys SR data connector manually with Azure Functions (Deployment via Visual Studio Code).",
+ "title": "Option 2 - Manual Deployment of Azure Functions"
+ },
+ {
+ "description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CensysSR100-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CensysSRXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.14 (the packages in the zip are built for it).\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration.\n8. In the Function App, enable the system-assigned managed identity if you want to use it for the function app storage.\n9. The manual method needs the table CensysRiskEvents_CL, a data collection endpoint and a data collection rule. Deploy the template of Option 1 once to create them, or create them yourself.\n10. Give the Microsoft Entra application the **Monitoring Metrics Publisher** role on the data collection rule: open the rule, select **Access control (IAM) > Add role assignment**, choose the role and select your application."
+ },
+ {
+ "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective values (case-sensitive): \n\n\t a. **CensysApiToken** - Enter your Censys personal access token.\n\n\t b. **OrganizationId** - Enter the UUID of the Censys organization, for example 00000000-0000-0000-0000-000000000000.\n\n\t c. **InitialStartTime** - Optional. UTC start time in the form 2026-10-01T00:00:00Z. It must not be in the future. Leave empty for all events Censys still retains.\n\n\t d. **SupplierNames** - Optional. Supplier names separated by an asterisk (*), for example OpenAI*Harvey*Acme, Inc. Pick the names from the Censys Supplier Risk UI. Maximum 500 characters.\n\n\t e. **RiskNames** - Optional. Risk names separated by an asterisk (*), for example Log4Shell*Exposed Redis. Pick the names from the Censys Supplier Risk UI. Maximum 500 characters.\n\n\t f. **ChangeTypes** - Optional. Comma-separated: opened, resolved, reopened. Other values stop the run with an error.\n\n\t g. **Severity** - Optional. Comma-separated: CRITICAL, HIGH, MEDIUM, LOW. Other values stop the run with an error.\n\n\t h. **RapidResponse** - Optional. true or false.\n\n\t i. **AZURE_CLIENT_ID** - Azure Client Id of your Microsoft Entra app.\n\n\t j. **AZURE_CLIENT_SECRET** - Client secret of your Microsoft Entra app.\n\n\t k. **AZURE_TENANT_ID** - Azure Tenant Id of your Microsoft Entra ID.\n\n\t l. **AZURE_DATA_COLLECTION_ENDPOINT** - Logs ingestion URL of the data collection endpoint created for this connector (Monitor > Data Collection Endpoints > the endpoint > Logs Ingestion).\n\n\t m. **AZURE_DATA_COLLECTION_RULE_ID** - Immutable ID of the data collection rule created for this connector (Monitor > Data Collection Rules > the rule > JSON View > immutableId).\n\n\t n. **StreamName** - Input stream of that data collection rule, Custom-CensysRiskEvents_CL.\n\n\t o. **SCOPE** - https://monitor.azure.com/.default\n\n\t p. **Schedule** - Quartz cron-expression, for example 0 */10 * * * *. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is 0 */10 * * * *.\n\n\t q. **SuppliersAndRisksSchedule** - Quartz cron-expression of the function that refreshes the supplier names and risk names with their ids. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is 0 */30 * * * *.\n\n\t r. **LogLevel** - DEBUG, INFO or ERROR. Default is INFO.\n\n4. Once all application settings have been entered, click **Save**."
+ }
+ ]
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "contentKind": "DataConnector",
+ "displayName": "Censys Supplier Risk (using Azure Functions)",
+ "contentProductId": "[variables('_dataConnectorcontentProductId1')]",
+ "id": "[variables('_dataConnectorcontentProductId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]",
+ "dependsOn": [
+ "[variables('_dataConnectorId1')]"
+ ],
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]",
+ "apiVersion": "2021-03-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "GenericUI",
+ "properties": {
+ "connectorUiConfig": {
+ "title": "Censys Supplier Risk (using Azure Functions)",
+ "publisher": "Censys",
+ "descriptionMarkdown": "The Censys Supplier Risk data connector brings the Censys risk-events change feed (`/v1/supplychains/default/risk-events`) into Microsoft Sentinel using Azure Functions and the [Logs Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview). The function runs on a schedule and remembers the `inserted_at` and `id` of the last event it ingested, so each run continues where the previous one stopped. Events are written to the table `CensysRiskEvents_CL` through a data collection endpoint and a data collection rule that the deployment template creates. Suppliers and risks can be selected by name; the connector keeps the supplier names and risk names with their ids in storage tables.",
+ "graphQueries": [
+ {
+ "metricName": "Total Censys risk events received",
+ "legend": "CensysRiskEvents_CL",
+ "baseQuery": "CensysRiskEvents_CL"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "CensysRiskEvents_CL",
+ "lastDataReceivedQuery": "CensysRiskEvents_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "connectivityCriterias": [
+ {
+ "type": "IsConnectedQuery",
+ "value": [
+ "CensysRiskEvents_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)"
+ ]
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "All Censys risk events received, newest first.",
+ "query": "CensysRiskEvents_CL\n| sort by TimeGenerated desc"
+ },
+ {
+ "description": "Newly opened or reopened risks with critical or high severity.",
+ "query": "CensysRiskEvents_CL\n| where ChangeType in ('opened', 'reopened')\n| where Severity in ('CRITICAL', 'HIGH')\n| project TimeGenerated, Severity, RiskName, SupplierDisplayName, AssetIp, AssetHostname, PlatformUrl\n| order by TimeGenerated desc"
+ },
+ {
+ "description": "Rapid response findings (actively exploited).",
+ "query": "CensysRiskEvents_CL\n| where RapidResponse == true and ChangeType in ('opened', 'reopened')\n| project TimeGenerated, Severity, CveId, RiskName, SupplierDisplayName, AssetIp, Evidence, PlatformUrl"
+ },
+ {
+ "description": "Currently open risks per supplier (latest event per risk).",
+ "query": "CensysRiskEvents_CL\n| summarize arg_max(InsertedAt, *) by RiskInstanceId\n| where Status == 'open'\n| summarize OpenRisks = count() by SupplierDisplayName, Severity\n| order by OpenRisks desc"
+ },
+ {
+ "description": "Risk events mapped to known CVEs.",
+ "query": "CensysRiskEvents_CL\n| where isnotempty(CveId)\n| summarize AffectedAssets = dcount(RiskInstanceId) by CveId, Severity\n| order by AffectedAssets desc"
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "read and write permissions on the workspace are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "write": true,
+ "read": true,
+ "delete": true
+ }
+ }
+ ],
+ "customs": [
+ {
+ "name": "Microsoft.Web/sites permissions",
+ "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)."
+ },
+ {
+ "name": "REST API Credentials/permissions",
+ "description": "A Censys personal access token and the Censys Organization ID are required. Users on Starter, Search, and Core plans need the API Access role. [Create a token](https://accounts.censys.io/settings/personal-access-tokens)."
+ },
+ {
+ "name": "Microsoft Entra application",
+ "description": "An app registration with a client secret is required. Permission to create role assignments on the data collection rule (Owner or User Access Administrator) is required to give the application the Monitoring Metrics Publisher role."
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "description": ">**NOTE:** This connector uses Azure Functions to connect to the Censys API to pull risk events into Microsoft Sentinel using the [Logs Ingestion API](https://learn.microsoft.com/azure/azure-monitor/logs/logs-ingestion-api-overview). The deployment template creates the table CensysRiskEvents_CL, a data collection endpoint and a data collection rule in the workspace. A second function, CensysSRSuppliersAndRisks, keeps the lists of supplier names and risk names, with their ids, in storage tables of the Function App (nothing is sent to Microsoft Sentinel), so supplier names and risk names can be used as an input. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details."
+ },
+ {
+ "description": ">**(Optional Step)** Securely store the Censys API token and the client secret in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App."
+ },
+ {
+ "description": "**STEP 1 - Steps to Create/Get a Censys Personal Access Token and Organization ID**\n\n Follow these instructions to get the values needed by this connector:\n 1. Sign in to Censys and open [Personal access tokens](https://accounts.censys.io/settings/personal-access-tokens).\n 2. Create a personal access token. Users on Starter, Search, and Core plans need the **API Access** role.\n 3. Copy the token. It is shown only once.\n 4. Copy the **Organization ID** (UUID) of the Censys organization you want to collect risk events for."
+ },
+ {
+ "description": "**STEP 2 - Get the name of the Log Analytics workspace**\n\n The deployment template creates the table, the data collection endpoint and the data collection rule in the workspace of Microsoft Sentinel, so deploy it in the resource group of that workspace. You need the **name** of the workspace (workspace Overview page)."
+ },
+ {
+ "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID are required as configuration parameters for the execution of the Censys SR data connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)"
+ },
+ {
+ "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of the Censys SR data connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of the Censys SR data connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)"
+ },
+ {
+ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **Azure_Entra_Object_Id** needed for your ARM template role assignment. The template gives this application the **Monitoring Metrics Publisher** role on the data collection rule, so no other role needs to be assigned."
+ },
+ {
+ "description": "**STEP 6 - Choose ONE from the following two deployment options to deploy the connector and the associated Azure Function**\n\n>**IMPORTANT:** Before deploying the Censys SR data connector, have the Censys API token, the organization ID, the workspace name and the Azure credentials (client ID, client secret, tenant ID, object ID) ready."
+ },
+ {
+ "description": "Use this method for automated deployment of the Censys SR connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[](https://aka.ms/sentinel-CensysSRRiskEventsFunction-azuredeploy)\n2. Select the preferred **Subscription** and **Resource Group**. Use the resource group of the Log Analytics workspace of Microsoft Sentinel. \n3. Enter the below information : \n\n\t a. **Censys SR Function Name** - Name prefix of the Azure Function App to be created, up to 10 characters. Default is CensysSR.\n\n\t b. **Censys Api Key** - Enter your Censys personal access token.\n\n\t c. **Censys Organization Id** - Enter the UUID of the Censys organization to collect risk events for, for example 00000000-0000-0000-0000-000000000000.\n\n\t d. **Censys Start Date Time** - Optional. UTC time to start collecting from, in the form 2026-10-01T00:00:00Z. It must not be in the future. Leave empty for full history (all events Censys still retains).\n\n\t e. **Censys Supplier Names** - Optional. Names of the suppliers to collect risk events for, separated by an asterisk (*). For example: OpenAI*Harvey*Acme, Inc. Names are not case-sensitive and can be picked from the Censys Supplier Risk UI. Names that are not found among your suppliers are skipped with a warning. Leave empty to collect all suppliers. A change applies from the next run and continues from the current position, so avoid changing it often. Maximum 500 characters.\n\n\t f. **Censys Risk Names** - Optional. Names of the risks to collect risk events for, separated by an asterisk (*). For example: Log4Shell*Exposed Redis. Names are not case-sensitive and must match the risk name shown in the Censys Supplier Risk UI. Names that are not found among the risks of your supply chain are skipped with a warning. Leave empty to collect all risks. A change applies from the next run and continues from the current position, so avoid changing it often. Maximum 500 characters.\n\n\t g. **Censys Change Types** - Optional. Comma-separated change types: opened, resolved, reopened. Other values stop the run with an error. Leave empty for all.\n\n\t h. **Censys Severity** - Optional. Comma-separated severities: CRITICAL, HIGH, MEDIUM, LOW. Other values stop the run with an error. Leave empty for all.\n\n\t i. **Censys Rapid Response** - Optional. Select true for rapid response findings only, false to exclude them. Leave empty for both.\n\n\t j. **Azure_Client_Id** - Enter the Azure client ID of the app registration you created.\n\n\t k. **Azure_Client_Secret** - Enter the client secret you created for the app registration.\n\n\t l. **Azure_Tenant_Id** - Enter the Azure tenant ID of your Microsoft Entra ID.\n\n\t m. **Azure_Entra_Object_Id** - Enter the object ID of your Microsoft Entra app (Enterprise application).\n\n\t n. **WorkspaceName** - Name of the Log Analytics workspace of Microsoft Sentinel. The deployment creates the table CensysRiskEvents_CL, a data collection endpoint and a data collection rule in it.\n\n\t o. **Location** - Region of the data collection endpoint and rule. It must be the region of the workspace. Default is the region of the resource group.\n\n\t p. **Censys Risk Events Table Name** - Name of the table in the workspace that the risk events are written to. Default is CensysRiskEvents_CL (the suffix _CL is added, or corrected, when it is missing or in another case). Maximum 52 characters. Warning: the parser, the workbook, the analytic rule and the connector status check of this solution read CensysRiskEvents_CL. If you use another name, update these resources to read the new table.\n\n\t q. **Censys Risk Events Collection Schedule** - Please enter a valid Quartz cron-expression, for example 0 */10 * * * *. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is 0 */10 * * * * (every 10 minutes).\n\n\t r. **Censys Supplier and Risk List Refresh Schedule** - Quartz cron-expression for how often the function that refreshes the lists of supplier names and risk names with their ids runs, for example 0 */30 * * * *. It also runs once when the app starts. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is every 30 minutes.\n\n\t s. **AppInsightsWorkspaceResourceID** - Use 'Log Analytic Workspace > Properties' blade having 'Resource ID' property value. This is a fully qualified resource ID which is in format '/subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.OperationalInsights/workspaces/{workspace-name}'.\n\n\t t. **Censys SR Function Log Level** - Select log level or log severity value from DEBUG, INFO, ERROR. By default it is set to INFO.\n\n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.",
+ "title": "Option 1 - Azure Resource Manager (ARM) Template"
+ },
+ {
+ "description": "Use the following step-by-step instructions to deploy the Censys SR data connector manually with Azure Functions (Deployment via Visual Studio Code).",
+ "title": "Option 2 - Manual Deployment of Azure Functions"
+ },
+ {
+ "description": "**1. Deploy a Function App**\n\n> **NOTE:** You will need to [prepare VS code](https://docs.microsoft.com/azure/azure-functions/functions-create-first-function-python#prerequisites) for Azure function development.\n\n1. Download the [Azure Function App](https://aka.ms/sentinel-CensysSR100-functionapp) file. Extract archive to your local development computer.\n2. Start VS Code. Choose File in the main menu and select Open Folder.\n3. Select the top level folder from extracted files.\n4. Choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose the **Deploy to function app** button.\nIf you aren't already signed in, choose the Azure icon in the Activity bar, then in the **Azure: Functions** area, choose **Sign in to Azure**\nIf you're already signed in, go to the next step.\n5. Provide the following information at the prompts:\n\n\ta. **Select folder:** Choose a folder from your workspace or browse to one that contains your function app.\n\n\tb. **Select Subscription:** Choose the subscription to use.\n\n\tc. Select **Create new Function App in Azure** (Don't choose the Advanced option)\n\n\td. **Enter a globally unique name for the function app:** Type a name that is valid in a URL path. The name you type is validated to make sure that it's unique in Azure Functions. (e.g. CensysSRXXXXX).\n\n\te. **Select a runtime:** Choose Python 3.14 (the packages in the zip are built for it).\n\n\tf. Select a location for new resources. For better performance and lower costs choose the same [region](https://azure.microsoft.com/regions/) where Microsoft Sentinel is located.\n\n6. Deployment will begin. A notification is displayed after your function app is created and the deployment package is applied.\n7. Go to Azure Portal for the Function App configuration.\n8. In the Function App, enable the system-assigned managed identity if you want to use it for the function app storage.\n9. The manual method needs the table CensysRiskEvents_CL, a data collection endpoint and a data collection rule. Deploy the template of Option 1 once to create them, or create them yourself.\n10. Give the Microsoft Entra application the **Monitoring Metrics Publisher** role on the data collection rule: open the rule, select **Access control (IAM) > Add role assignment**, choose the role and select your application."
+ },
+ {
+ "description": "**2. Configure the Function App**\n\n1. In the Function App, select the Function App Name and select **Configuration**.\n2. In the **Application settings** tab, select **+ New application setting**.\n3. Add each of the following application settings individually, with their respective values (case-sensitive): \n\n\t a. **CensysApiToken** - Enter your Censys personal access token.\n\n\t b. **OrganizationId** - Enter the UUID of the Censys organization, for example 00000000-0000-0000-0000-000000000000.\n\n\t c. **InitialStartTime** - Optional. UTC start time in the form 2026-10-01T00:00:00Z. It must not be in the future. Leave empty for all events Censys still retains.\n\n\t d. **SupplierNames** - Optional. Supplier names separated by an asterisk (*), for example OpenAI*Harvey*Acme, Inc. Pick the names from the Censys Supplier Risk UI. Maximum 500 characters.\n\n\t e. **RiskNames** - Optional. Risk names separated by an asterisk (*), for example Log4Shell*Exposed Redis. Pick the names from the Censys Supplier Risk UI. Maximum 500 characters.\n\n\t f. **ChangeTypes** - Optional. Comma-separated: opened, resolved, reopened. Other values stop the run with an error.\n\n\t g. **Severity** - Optional. Comma-separated: CRITICAL, HIGH, MEDIUM, LOW. Other values stop the run with an error.\n\n\t h. **RapidResponse** - Optional. true or false.\n\n\t i. **AZURE_CLIENT_ID** - Azure Client Id of your Microsoft Entra app.\n\n\t j. **AZURE_CLIENT_SECRET** - Client secret of your Microsoft Entra app.\n\n\t k. **AZURE_TENANT_ID** - Azure Tenant Id of your Microsoft Entra ID.\n\n\t l. **AZURE_DATA_COLLECTION_ENDPOINT** - Logs ingestion URL of the data collection endpoint created for this connector (Monitor > Data Collection Endpoints > the endpoint > Logs Ingestion).\n\n\t m. **AZURE_DATA_COLLECTION_RULE_ID** - Immutable ID of the data collection rule created for this connector (Monitor > Data Collection Rules > the rule > JSON View > immutableId).\n\n\t n. **StreamName** - Input stream of that data collection rule, Custom-CensysRiskEvents_CL.\n\n\t o. **SCOPE** - https://monitor.azure.com/.default\n\n\t p. **Schedule** - Quartz cron-expression, for example 0 */10 * * * *. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is 0 */10 * * * *.\n\n\t q. **SuppliersAndRisksSchedule** - Quartz cron-expression of the function that refreshes the supplier names and risk names with their ids. **Warning:** keep the frequency at least 10 minutes for a better experience. Default is 0 */30 * * * *.\n\n\t r. **LogLevel** - DEBUG, INFO or ERROR. Default is INFO.\n\n4. Once all application settings have been entered, click **Save**."
+ }
+ ],
+ "id": "[variables('_uiConfigId1')]"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('parserObject1').parserTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "CensysRiskEvents Data Parser with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('parserObject1').parserVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[variables('parserObject1')._parserName1]",
+ "apiVersion": "2025-07-01",
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for CensysRiskEvents",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CensysRiskEvents",
+ "query": "let CensysRiskEvents_view = view () {\n // The empty datatable keeps the parser working (returning no rows) when the table does not exist yet\n union isfuzzy=true\n (datatable(\n TimeGenerated:datetime,\n EventId:string,\n InsertedAt:datetime,\n OccurredAt:datetime,\n ChangeType:string,\n RiskInstanceId:string,\n SupplyChainId:string,\n AssetType:string,\n RiskTypeId:string,\n CveId:string,\n RiskCategory:string,\n RiskName:string,\n Description:string,\n Remediations:dynamic,\n Severity:string,\n Score:real,\n Confidence:real,\n Status:string,\n ResolveTime:datetime,\n ResolveReason:string,\n SupplierId:string,\n SupplierDisplayName:string,\n Suppliers:dynamic,\n AssetIp:string,\n AssetHostname:string,\n AssetPort:int,\n ServiceTransportProtocol:string,\n ServicePort:int,\n ServiceProtocol:string,\n Tags:dynamic,\n RapidResponse:bool,\n Evidence:string,\n FirstDetectedAt:datetime,\n LastDetectedAt:datetime,\n CreatedAt:datetime,\n PlatformUrl:string,\n IngestedAt:datetime\n )[]),\n (CensysRiskEvents_CL | extend IngestedAt = ingestion_time())\n // Treat every field as optional: a column that is missing from the table becomes empty instead of failing the query\n | extend\n TimeGenerated = column_ifexists('TimeGenerated', datetime(null)),\n EventId = column_ifexists('EventId', ''),\n InsertedAt = column_ifexists('InsertedAt', datetime(null)),\n OccurredAt = column_ifexists('OccurredAt', datetime(null)),\n ChangeType = column_ifexists('ChangeType', ''),\n RiskInstanceId = column_ifexists('RiskInstanceId', ''),\n SupplyChainId = column_ifexists('SupplyChainId', ''),\n AssetType = column_ifexists('AssetType', ''),\n RiskTypeId = column_ifexists('RiskTypeId', ''),\n CveId = column_ifexists('CveId', ''),\n RiskCategory = column_ifexists('RiskCategory', ''),\n RiskName = column_ifexists('RiskName', ''),\n Description = column_ifexists('Description', ''),\n Remediations = column_ifexists('Remediations', dynamic(null)),\n Severity = column_ifexists('Severity', ''),\n Score = column_ifexists('Score', real(null)),\n Confidence = column_ifexists('Confidence', real(null)),\n Status = column_ifexists('Status', ''),\n ResolveTime = column_ifexists('ResolveTime', datetime(null)),\n ResolveReason = column_ifexists('ResolveReason', ''),\n SupplierId = column_ifexists('SupplierId', ''),\n SupplierDisplayName = column_ifexists('SupplierDisplayName', ''),\n Suppliers = column_ifexists('Suppliers', dynamic(null)),\n AssetIp = column_ifexists('AssetIp', ''),\n AssetHostname = column_ifexists('AssetHostname', ''),\n AssetPort = column_ifexists('AssetPort', int(null)),\n ServiceTransportProtocol = column_ifexists('ServiceTransportProtocol', ''),\n ServicePort = column_ifexists('ServicePort', int(null)),\n ServiceProtocol = column_ifexists('ServiceProtocol', ''),\n Tags = column_ifexists('Tags', dynamic(null)),\n RapidResponse = column_ifexists('RapidResponse', bool(null)),\n Evidence = column_ifexists('Evidence', ''),\n FirstDetectedAt = column_ifexists('FirstDetectedAt', datetime(null)),\n LastDetectedAt = column_ifexists('LastDetectedAt', datetime(null)),\n CreatedAt = column_ifexists('CreatedAt', datetime(null)),\n PlatformUrl = column_ifexists('PlatformUrl', '')\n // Delivery is at-least-once, so keep one row per event: the first copy that was ingested\n | summarize arg_min(IngestedAt, *) by EventId\n | extend\n EventVendor = \"Censys\",\n EventProduct = \"Censys Supplier Risk\",\n ChangeType = tolower(ChangeType),\n Status = tolower(Status),\n Severity = toupper(Severity),\n SupplierId = coalesce(tostring(SupplierId), tostring(Suppliers[0].id)),\n SupplierDisplayName = coalesce(tostring(SupplierDisplayName), tostring(Suppliers[0].display_name)),\n AssetName = iff(isnotempty(AssetHostname), AssetHostname, AssetIp),\n IsOpen = tolower(Status) == \"open\",\n SeverityRank = case(\n toupper(Severity) == \"CRITICAL\", 4,\n toupper(Severity) == \"HIGH\", 3,\n toupper(Severity) == \"MEDIUM\", 2,\n toupper(Severity) == \"LOW\", 1,\n 0)\n | project\n TimeGenerated,\n IngestedAt,\n EventId,\n InsertedAt,\n OccurredAt,\n ChangeType,\n RiskInstanceId,\n SupplyChainId,\n RiskTypeId,\n CveId,\n RiskCategory,\n RiskName,\n Description,\n Remediations,\n Severity,\n SeverityRank,\n Score,\n Confidence,\n Status,\n IsOpen,\n ResolveTime,\n ResolveReason,\n SupplierId,\n SupplierDisplayName,\n Suppliers,\n AssetType,\n AssetName,\n AssetIp,\n AssetHostname,\n AssetPort,\n ServiceTransportProtocol,\n ServicePort,\n ServiceProtocol,\n Tags,\n RapidResponse,\n Evidence,\n FirstDetectedAt,\n LastDetectedAt,\n CreatedAt,\n PlatformUrl,\n EventVendor,\n EventProduct\n};\nCensysRiskEvents_view\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject1')._parserId1]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CensysRiskEvents')]",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "kind": "Parser",
+ "version": "[variables('parserObject1').parserVersion1]",
+ "source": {
+ "name": "Censys Supplier Risk",
+ "kind": "Solution",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "contentKind": "Parser",
+ "displayName": "Parser for CensysRiskEvents",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
+ "version": "[variables('parserObject1').parserVersion1]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "[variables('parserObject1')._parserName1]",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for CensysRiskEvents",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CensysRiskEvents",
+ "query": "let CensysRiskEvents_view = view () {\n // The empty datatable keeps the parser working (returning no rows) when the table does not exist yet\n union isfuzzy=true\n (datatable(\n TimeGenerated:datetime,\n EventId:string,\n InsertedAt:datetime,\n OccurredAt:datetime,\n ChangeType:string,\n RiskInstanceId:string,\n SupplyChainId:string,\n AssetType:string,\n RiskTypeId:string,\n CveId:string,\n RiskCategory:string,\n RiskName:string,\n Description:string,\n Remediations:dynamic,\n Severity:string,\n Score:real,\n Confidence:real,\n Status:string,\n ResolveTime:datetime,\n ResolveReason:string,\n SupplierId:string,\n SupplierDisplayName:string,\n Suppliers:dynamic,\n AssetIp:string,\n AssetHostname:string,\n AssetPort:int,\n ServiceTransportProtocol:string,\n ServicePort:int,\n ServiceProtocol:string,\n Tags:dynamic,\n RapidResponse:bool,\n Evidence:string,\n FirstDetectedAt:datetime,\n LastDetectedAt:datetime,\n CreatedAt:datetime,\n PlatformUrl:string,\n IngestedAt:datetime\n )[]),\n (CensysRiskEvents_CL | extend IngestedAt = ingestion_time())\n // Treat every field as optional: a column that is missing from the table becomes empty instead of failing the query\n | extend\n TimeGenerated = column_ifexists('TimeGenerated', datetime(null)),\n EventId = column_ifexists('EventId', ''),\n InsertedAt = column_ifexists('InsertedAt', datetime(null)),\n OccurredAt = column_ifexists('OccurredAt', datetime(null)),\n ChangeType = column_ifexists('ChangeType', ''),\n RiskInstanceId = column_ifexists('RiskInstanceId', ''),\n SupplyChainId = column_ifexists('SupplyChainId', ''),\n AssetType = column_ifexists('AssetType', ''),\n RiskTypeId = column_ifexists('RiskTypeId', ''),\n CveId = column_ifexists('CveId', ''),\n RiskCategory = column_ifexists('RiskCategory', ''),\n RiskName = column_ifexists('RiskName', ''),\n Description = column_ifexists('Description', ''),\n Remediations = column_ifexists('Remediations', dynamic(null)),\n Severity = column_ifexists('Severity', ''),\n Score = column_ifexists('Score', real(null)),\n Confidence = column_ifexists('Confidence', real(null)),\n Status = column_ifexists('Status', ''),\n ResolveTime = column_ifexists('ResolveTime', datetime(null)),\n ResolveReason = column_ifexists('ResolveReason', ''),\n SupplierId = column_ifexists('SupplierId', ''),\n SupplierDisplayName = column_ifexists('SupplierDisplayName', ''),\n Suppliers = column_ifexists('Suppliers', dynamic(null)),\n AssetIp = column_ifexists('AssetIp', ''),\n AssetHostname = column_ifexists('AssetHostname', ''),\n AssetPort = column_ifexists('AssetPort', int(null)),\n ServiceTransportProtocol = column_ifexists('ServiceTransportProtocol', ''),\n ServicePort = column_ifexists('ServicePort', int(null)),\n ServiceProtocol = column_ifexists('ServiceProtocol', ''),\n Tags = column_ifexists('Tags', dynamic(null)),\n RapidResponse = column_ifexists('RapidResponse', bool(null)),\n Evidence = column_ifexists('Evidence', ''),\n FirstDetectedAt = column_ifexists('FirstDetectedAt', datetime(null)),\n LastDetectedAt = column_ifexists('LastDetectedAt', datetime(null)),\n CreatedAt = column_ifexists('CreatedAt', datetime(null)),\n PlatformUrl = column_ifexists('PlatformUrl', '')\n // Delivery is at-least-once, so keep one row per event: the first copy that was ingested\n | summarize arg_min(IngestedAt, *) by EventId\n | extend\n EventVendor = \"Censys\",\n EventProduct = \"Censys Supplier Risk\",\n ChangeType = tolower(ChangeType),\n Status = tolower(Status),\n Severity = toupper(Severity),\n SupplierId = coalesce(tostring(SupplierId), tostring(Suppliers[0].id)),\n SupplierDisplayName = coalesce(tostring(SupplierDisplayName), tostring(Suppliers[0].display_name)),\n AssetName = iff(isnotempty(AssetHostname), AssetHostname, AssetIp),\n IsOpen = tolower(Status) == \"open\",\n SeverityRank = case(\n toupper(Severity) == \"CRITICAL\", 4,\n toupper(Severity) == \"HIGH\", 3,\n toupper(Severity) == \"MEDIUM\", 2,\n toupper(Severity) == \"LOW\", 1,\n 0)\n | project\n TimeGenerated,\n IngestedAt,\n EventId,\n InsertedAt,\n OccurredAt,\n ChangeType,\n RiskInstanceId,\n SupplyChainId,\n RiskTypeId,\n CveId,\n RiskCategory,\n RiskName,\n Description,\n Remediations,\n Severity,\n SeverityRank,\n Score,\n Confidence,\n Status,\n IsOpen,\n ResolveTime,\n ResolveReason,\n SupplierId,\n SupplierDisplayName,\n Suppliers,\n AssetType,\n AssetName,\n AssetIp,\n AssetHostname,\n AssetPort,\n ServiceTransportProtocol,\n ServicePort,\n ServiceProtocol,\n Tags,\n RapidResponse,\n Evidence,\n FirstDetectedAt,\n LastDetectedAt,\n CreatedAt,\n PlatformUrl,\n EventVendor,\n EventProduct\n};\nCensysRiskEvents_view\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject1')._parserId1]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CensysRiskEvents')]",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "kind": "Parser",
+ "version": "[variables('parserObject1').parserVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('parserObject2').parserTemplateSpecName2]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "CensysRisks Data Parser with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('parserObject2').parserVersion2]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[variables('parserObject2')._parserName2]",
+ "apiVersion": "2025-07-01",
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for Censys risks",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CensysRisks",
+ "query": "// Current state of every supplier risk: the latest event of each risk instance, whether the risk is open or closed\nlet CensysRisks_view = view () {\n CensysRiskEvents\n | summarize arg_max(InsertedAt, *) by RiskInstanceId\n};\nCensysRisks_view\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject2')._parserId2]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CensysRisks')]",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "kind": "Parser",
+ "version": "[variables('parserObject2').parserVersion2]",
+ "source": {
+ "name": "Censys Supplier Risk",
+ "kind": "Solution",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "contentKind": "Parser",
+ "displayName": "Parser for Censys risks",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]",
+ "version": "[variables('parserObject2').parserVersion2]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "[variables('parserObject2')._parserName2]",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for Censys risks",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CensysRisks",
+ "query": "// Current state of every supplier risk: the latest event of each risk instance, whether the risk is open or closed\nlet CensysRisks_view = view () {\n CensysRiskEvents\n | summarize arg_max(InsertedAt, *) by RiskInstanceId\n};\nCensysRisks_view\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject2')._parserId2]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CensysRisks')]",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "kind": "Parser",
+ "version": "[variables('parserObject2').parserVersion2]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('workbookTemplateSpecName1')]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "CensysSupplierRisk Workbook with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('workbookVersion1')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.Insights/workbooks",
+ "name": "[variables('workbookContentId1')]",
+ "location": "[parameters('workspace-location')]",
+ "kind": "shared",
+ "apiVersion": "2021-08-01",
+ "metadata": {
+ "description": "Gain insight into supplier risk collected from Censys Supplier Risk: open risks by severity, risk events by category, opened and closed risks over time, top risks by open risk count, supplier risk ranking and rapid response events, with details one selection away."
+ },
+ "properties": {
+ "displayName": "[parameters('workbook1-name')]",
+ "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Censys Supplier Risk Overview\\nOverview dashboard for Censys Supplier Risk risk events. All panels count risk events in the selected **Time Range**, one per event id, and every filter applies to every panel. Open counts use the status that each event carries, so a risk opened earlier than the Time Range with no event inside it will not appear.\"},\"name\":\"0a3c227f-21b3-55b9-b3d4-6c6d84922765\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"3980b3ca-3e47-5259-ae54-e9cf79f7aa97\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":1209600000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"531ff72e-136a-5683-8495-98755dec1185\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Severity\",\"label\":\"Severity\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":7776000000},\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"value\":[\"value::all\"],\"jsonData\":\"[{\\\"value\\\": \\\"LOW\\\", \\\"label\\\": \\\"Low\\\"}, {\\\"value\\\": \\\"MEDIUM\\\", \\\"label\\\": \\\"Medium\\\"}, {\\\"value\\\": \\\"HIGH\\\", \\\"label\\\": \\\"High\\\"}, {\\\"value\\\": \\\"CRITICAL\\\", \\\"label\\\": \\\"Critical\\\"}]\"},{\"id\":\"408ed010-0624-5802-be49-0b16ce3b0b55\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Supplier\",\"label\":\"Supplier\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"CensysRiskEvents\\n| where isnotempty(SupplierDisplayName)\\n| summarize by SupplierDisplayName\\n| project value = SupplierDisplayName, label = SupplierDisplayName\\n| order by label asc\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":7776000000},\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"value\":[\"value::all\"]},{\"id\":\"981f1274-a745-5685-9c0a-938042ba7b06\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"RiskCategory\",\"label\":\"Risk Category\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":7776000000},\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"value\":[\"value::all\"],\"jsonData\":\"[{\\\"value\\\": \\\"VULNERABILITY\\\", \\\"label\\\": \\\"Vulnerability\\\"}, {\\\"value\\\": \\\"MISCONFIGURATION\\\", \\\"label\\\": \\\"Misconfiguration\\\"}, {\\\"value\\\": \\\"EXPOSURE\\\", \\\"label\\\": \\\"Exposure\\\"}, {\\\"value\\\": \\\"THREAT\\\", \\\"label\\\": \\\"Threat\\\"}]\"},{\"id\":\"2a6c8d3e-7b1f-5f0e-9a44-3c2d9e8b1a77\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"Status\",\"label\":\"Status\",\"type\":2,\"isRequired\":true,\"multiSelect\":true,\"quote\":\"'\",\"delimiter\":\",\",\"query\":\"\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"timeContext\":{\"durationMs\":7776000000},\"typeSettings\":{\"additionalResourceOptions\":[\"value::all\"],\"selectAllValue\":\"*\",\"showDefault\":false},\"defaultValue\":\"value::all\",\"value\":[\"value::all\"],\"jsonData\":\"[{\\\"value\\\": \\\"open\\\", \\\"label\\\": \\\"Open\\\"}, {\\\"value\\\": \\\"closed\\\", \\\"label\\\": \\\"Closed\\\"}]\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"d242da61-ec90-533c-946e-20debc8b18b2\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b0aac801-3580-5807-8df7-7a5e49f3c503\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P1Severity\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"},{\"id\":\"9952c2a7-5e8b-5f2f-a19d-dc9d340ca4fe\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P2Date\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"},{\"id\":\"c97c3004-6c39-55d2-8b8a-a3c41ef751f5\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P2Status\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"},{\"id\":\"c070c984-7e2c-568c-8d8f-b6ca8ffaffd8\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P3Category\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"},{\"id\":\"b5d774c8-0c6d-5ffa-8e74-193a9f8dcd6e\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P4Risk\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"},{\"id\":\"6179b664-6feb-5562-9189-6351e12c6713\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P5Supplier\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"},{\"id\":\"c728699c-76e3-5dd5-b847-ed58b40037b7\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"P6Event\",\"type\":1,\"isRequired\":false,\"isHiddenWhenLocked\":true,\"value\":\"None\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"383c127f-e50f-5a35-8def-1a9f9987899b\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == \\\"open\\\"\\n| summarize [\\\"count\\\"] = count() by severity = Severity\\n| order by severity asc\",\"size\":3,\"title\":\"Open Risk Count by Severity\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"piechart\",\"exportFieldName\":\"series\",\"exportParameterName\":\"P1Severity\",\"exportDefaultValue\":\"None\",\"chartSettings\":{\"group\":\"severity\",\"seriesLabelSettings\":[{\"seriesName\":\"CRITICAL\",\"color\":\"redBright\"},{\"seriesName\":\"HIGH\",\"color\":\"orange\"},{\"seriesName\":\"MEDIUM\",\"color\":\"yellow\"},{\"seriesName\":\"LOW\",\"color\":\"blue\"},{\"seriesName\":\"UNSPECIFIED\",\"color\":\"gray\"}],\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumSignificantDigits\":15}}}}},\"name\":\"1b6bdd62-e666-568e-ad83-e6466e7d0772\",\"customWidth\":\"50\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| summarize [\\\"count\\\"] = count() by category = RiskCategory\\n| order by category asc\",\"size\":3,\"title\":\"Risk Events by Category\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"piechart\",\"chartSettings\":{\"group\":\"category\",\"ySettings\":{\"numberFormatSettings\":{\"unit\":0,\"options\":{\"style\":\"decimal\",\"useGrouping\":true,\"maximumSignificantDigits\":15}}}},\"exportFieldName\":\"series\",\"exportParameterName\":\"P3Category\",\"exportDefaultValue\":\"None\"},\"name\":\"ab26b647-f261-532b-937b-fc06058cd3f2\",\"customWidth\":\"50\"},{\"type\":1,\"content\":{\"json\":\"💡 _Click on a slice in the above 'Open Risk Count by Severity' chart to view more details_\\n\\n📝 _Counts open risk events by severity, one per event id._\"},\"name\":\"3408c688-c583-5070-b687-a6b6c057b141\",\"customWidth\":\"50\"},{\"type\":1,\"content\":{\"json\":\"💡 _Click on a slice in the above 'Risk Events by Category' chart to view more details_\\n\\n📝 _Counts risk events by category, one per event id._\"},\"name\":\"a91116af-f6ff-5304-8e46-14afb20ca027\",\"customWidth\":\"50\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == \\\"open\\\"\\n| where Severity == '{P1Severity}'\\n| order by InsertedAt desc\\n| project Time = InsertedAt, id = EventId, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Events - {P1Severity}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"27%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"15%\"}}],\"filter\":true,\"rowLimit\":10000}},\"name\":\"b4afc41f-40bd-50d8-a9f6-66f8d2b30133\",\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"P1Severity\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where RiskCategory == '{P3Category}'\\n| order by InsertedAt desc\\n| project Time = InsertedAt, id = EventId, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Events - {P3Category}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"27%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"15%\"}}],\"filter\":true,\"rowLimit\":10000}},\"name\":\"70e7cbe8-0bc7-571e-81e4-7d792f321c2b\",\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"P3Category\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let TotalHours = (todatetime({TimeRange:end}) - todatetime({TimeRange:start})) / 1h;\\n// Time span picked from the Time Range (at most about 100 points): 30 minutes, 1 hour or 1 day\\nlet Span = iff(TotalHours <= 50, 30m, iff(TotalHours <= 100, 1h, 1d));\\nlet Buckets = range Bucket from bin(todatetime({TimeRange:start}), Span) to todatetime({TimeRange:end}) step Span | extend k = 1;\\nlet Statuses = datatable(Series: string)[\\\"Opened\\\", \\\"Closed\\\"] | extend k = 1;\\nlet Counts = CensysRiskEvents\\n | where OccurredAt {TimeRange}\\n | where ('*' in ({Status}) or Status in ({Status}))\\n | where ('*' in ({Severity}) or Severity in ({Severity}))\\n | where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n | where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n | extend Series = case(Status == \\\"open\\\", \\\"Opened\\\", Status == \\\"closed\\\", \\\"Closed\\\", Status)\\n | summarize Total = count() by Bucket = bin(OccurredAt, Span), Series;\\nBuckets\\n| join kind=inner Statuses on k\\n| join kind=leftouter Counts on Bucket, Series\\n| project Time = iff(Span >= 1d, format_datetime(Bucket, 'yyyy-MM-dd'), format_datetime(Bucket, 'yyyy-MM-dd HH:mm')), Series, [\\\"Risk Count\\\"] = coalesce(Total, 0)\\n| order by Time asc, Series asc\",\"size\":0,\"title\":\"Opened vs. Closed Risks\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"timechart\",\"chartSettings\":{\"xAxis\":\"Time\",\"group\":\"Series\",\"xSettings\":{\"label\":\"Time\"},\"ySettings\":{\"label\":\"Risk Count\"}},\"exportedParameters\":[{\"fieldName\":\"x\",\"parameterName\":\"P2Date\",\"parameterType\":1,\"defaultValue\":\"None\"},{\"fieldName\":\"series\",\"parameterName\":\"P2Status\",\"parameterType\":1,\"defaultValue\":\"None\"}]},\"name\":\"4668c9cb-64a5-581d-b461-d8854d0f2409\",\"customWidth\":\"100\"},{\"type\":1,\"content\":{\"json\":\"💡 _Click on a data point in the above 'Opened vs. Closed Risks' chart to view more details_\\n\\n📝 _Counts risk events per day by their status (Opened or Closed), by when they occurred._\"},\"name\":\"c2beca44-a16d-5fa8-821b-d7aea664ec9f\",\"customWidth\":\"100\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let TotalHours = (todatetime({TimeRange:end}) - todatetime({TimeRange:start})) / 1h;\\n// Time span picked from the Time Range (at most about 100 points): 30 minutes, 1 hour or 1 day\\nlet Span = iff(TotalHours <= 50, 30m, iff(TotalHours <= 100, 1h, 1d));\\nCensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == iff('{P2Status}' == \\\"Opened\\\", \\\"open\\\", \\\"closed\\\")\\n| where OccurredAt >= todatetime(substring('{P2Date}', 0, 16)) and OccurredAt < todatetime(substring('{P2Date}', 0, 16)) + Span\\n| order by InsertedAt desc\\n| project Time = InsertedAt, id = EventId, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Events - {P2Status} on {P2Date}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"27%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"15%\"}}],\"filter\":true,\"rowLimit\":10000}},\"name\":\"50857b22-679b-5891-bd85-96262bd29d80\",\"customWidth\":\"100\",\"conditionalVisibilities\":[{\"parameterName\":\"P2Date\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"},{\"parameterName\":\"P2Status\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"}]},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == \\\"open\\\" and isnotempty(RiskName)\\n| summarize OpenRisks = count() by [\\\"Risk Name\\\"] = RiskName\\n| order by OpenRisks desc\\n| take 10\",\"size\":0,\"title\":\"Top 10 Risks by Open Risk Count\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"80%\"}},{\"columnMatch\":\"OpenRisks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}}],\"filter\":true,\"rowLimit\":10000},\"exportFieldName\":\"Risk Name\",\"exportParameterName\":\"P4Risk\",\"exportDefaultValue\":\"None\"},\"name\":\"4c44d1fa-a2d9-55b0-98e5-8030350c5f9d\",\"customWidth\":\"50\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == \\\"open\\\"\\n| summarize OpenRisks = count() by Supplier = SupplierDisplayName\\n| order by OpenRisks desc\",\"size\":0,\"title\":\"Supplier Risk Ranking\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"80%\"}},{\"columnMatch\":\"OpenRisks\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}}],\"filter\":true,\"rowLimit\":10000},\"exportFieldName\":\"Supplier\",\"exportParameterName\":\"P5Supplier\",\"exportDefaultValue\":\"None\"},\"name\":\"a5821846-0945-540c-9c97-849cad7afa8b\",\"customWidth\":\"50\"},{\"type\":1,\"content\":{\"json\":\"💡 _Click on a row in the above 'Top 10 Risks by Open Risk Count' grid to view more details_\\n\\n📝 _The 10 risk names with the most open risk events._\"},\"name\":\"cdf92177-e783-5d83-97d1-37d122085500\",\"customWidth\":\"50\"},{\"type\":1,\"content\":{\"json\":\"💡 _Click on a row in the above 'Supplier Risk Ranking' grid to view more details_\\n\\n📝 _Suppliers ranked by their number of open risk events._\"},\"name\":\"4e9590ae-6386-5f24-9ca0-f3a096994918\",\"customWidth\":\"50\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == \\\"open\\\"\\n| where RiskName == '{P4Risk}'\\n| order by InsertedAt desc\\n| project Time = InsertedAt, id = EventId, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Events - {P4Risk}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"27%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"15%\"}}],\"filter\":true,\"rowLimit\":10000}},\"name\":\"22004c2d-0bf3-5e3d-9870-78807252bd52\",\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"P4Risk\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where Status == \\\"open\\\"\\n| where SupplierDisplayName == '{P5Supplier}'\\n| order by InsertedAt desc\\n| project Time = InsertedAt, id = EventId, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Events - {P5Supplier}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"27%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"15%\"}}],\"filter\":true,\"rowLimit\":10000}},\"name\":\"67930e57-64b3-52a9-b227-bebac1f40c88\",\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"P5Supplier\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where RapidResponse == true\\n| order by InsertedAt desc\\n| project Time = InsertedAt, id = EventId, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Rapid Response Events\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"27%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"15%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"15%\"}}],\"filter\":true,\"rowLimit\":10000},\"exportFieldName\":\"id\",\"exportParameterName\":\"P6Event\",\"exportDefaultValue\":\"None\"},\"name\":\"d29db818-909d-5958-8ef4-89e50ee80542\",\"customWidth\":\"100\"},{\"type\":1,\"content\":{\"json\":\"💡 _Click on a row in the above 'Rapid Response Events' grid to view more details_\\n\\n📝 _Risk events flagged for rapid response (actively exploited), newest first._\"},\"name\":\"59f191f6-06f8-5ad8-b72b-8394af1f9a2a\",\"customWidth\":\"100\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CensysRiskEvents\\n| where OccurredAt {TimeRange}\\n| where ('*' in ({Status}) or Status in ({Status}))\\n| where ('*' in ({Severity}) or Severity in ({Severity}))\\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\\n| where EventId == '{P6Event}'\\n| project Time = InsertedAt, id = EventId, [\\\"Change Type\\\"] = ChangeType, Status, [\\\"Risk Name\\\"] = RiskName, Severity, Supplier = SupplierDisplayName, Asset = AssetName, [\\\"Service Port\\\"] = ServicePort, [\\\"Resolve Reason\\\"] = ResolveReason, [\\\"Platform URL\\\"] = PlatformUrl\\n| take 10000\",\"size\":0,\"title\":\"Event - {P6Event}\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"showRefreshButton\":true,\"showAnalytics\":true,\"showExportToExcel\":true,\"noDataMessage\":\"No data found for the selected filters.\",\"timeContext\":{\"durationMs\":7776000000},\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Time\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"12%\"}},{\"columnMatch\":\"id\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"16%\"}},{\"columnMatch\":\"Change Type\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"8%\"}},{\"columnMatch\":\"Status\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"7%\"}},{\"columnMatch\":\"Risk Name\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"20%\"}},{\"columnMatch\":\"Severity\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"7%\"}},{\"columnMatch\":\"Supplier\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"11%\"}},{\"columnMatch\":\"Asset\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"10%\"}},{\"columnMatch\":\"Service Port\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"4%\"}},{\"columnMatch\":\"Resolve Reason\",\"formatter\":0,\"formatOptions\":{\"customColumnWidthSetting\":\"5%\"}},{\"columnMatch\":\"Platform URL\",\"formatter\":7,\"formatOptions\":{\"linkTarget\":\"Url\",\"linkLabel\":\"Open in Censys\",\"customColumnWidthSetting\":\"10%\"}}],\"filter\":true,\"rowLimit\":10000}},\"name\":\"996c3d06-11cb-52d7-86a5-2a6444795041\",\"customWidth\":\"100\",\"conditionalVisibility\":{\"parameterName\":\"P6Event\",\"comparison\":\"isNotEqualTo\",\"value\":\"None\"}}],\"fromTemplateId\":\"sentinel-CensysSupplierRisk\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n",
+ "version": "1.0",
+ "sourceId": "[variables('workspaceResourceId')]",
+ "category": "sentinel"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]",
+ "properties": {
+ "description": "@{workbookKey=CensysSupplierRiskWorkbook; logoFileName=Censys.svg; description=Gain insight into supplier risk collected from Censys Supplier Risk: open risks by severity, risk events by category, opened and closed risks over time, top risks by open risk count, supplier risk ranking and rapid response events, with details one selection away.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Censys Supplier Risk; templateRelativePath=CensysSupplierRisk.json; subtitle=; provider=Censys}.description",
+ "parentId": "[variables('workbookId1')]",
+ "contentId": "[variables('_workbookContentId1')]",
+ "kind": "Workbook",
+ "version": "[variables('workbookVersion1')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "contentId": "CensysRiskEvents_CL",
+ "kind": "DataType"
+ },
+ {
+ "contentId": "CensysSRRiskEventsFunction",
+ "kind": "DataConnector"
+ }
+ ]
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('_workbookContentId1')]",
+ "contentKind": "Workbook",
+ "displayName": "[parameters('workbook1-name')]",
+ "contentProductId": "[variables('_workbookcontentProductId1')]",
+ "id": "[variables('_workbookcontentProductId1')]",
+ "version": "[variables('workbookVersion1')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "CensysRiskStateChange_AnalyticalRules Analytics Rule with template version 3.0.0",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "type": "Microsoft.SecurityInsights/AlertRuleTemplates",
+ "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "apiVersion": "2023-02-01-preview",
+ "kind": "Scheduled",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "description": "Creates one incident per supplier risk instance that is opened, or reopened, with CRITICAL or HIGH severity. Alerts are grouped by RiskInstanceId, so further events of the same risk instance within 24 hours are added to the same incident while it is open.\nAlert severity follows the Censys severity: CRITICAL and HIGH map to High, MEDIUM to Medium and LOW to Low. Resolved events follow the same mapping, and any other severity is Informational.\nBy default the rule alerts only on new CRITICAL and HIGH risks. The query holds commented lines to follow the whole life of a risk instead (reopened events of any severity and resolved events), see the comments in the query.",
+ "displayName": "Censys SR - Risk State Change",
+ "enabled": false,
+ "query": "// New events are selected by the time they reached Sentinel (IngestedAt), not by the Censys insert time,\n// so a delay between Censys and the connector can never make an event fall between two runs.\n// Each run covers 60 minutes that end 5 minutes ago, and consecutive runs are contiguous, so no event is alerted twice.\n//\n// OPTIONAL - follow the whole life of a risk instance (reopened events of any severity, and resolved events of risks that\n// were alerted before). To use it, uncomment the two \"let\" lines below, comment out the line \"Default\" in the query, uncomment\n// the line \"Full lifecycle\", and in the rule settings set the query period to 7 days and the incident grouping look-back to 7 days.\n// let Alertable = materialize(CensysRiskEvents | where ChangeType == \"reopened\" or (ChangeType == \"opened\" and Severity in (\"CRITICAL\", \"HIGH\")));\n// let TrackedRisks = Alertable | distinct RiskInstanceId;\nCensysRiskEvents\n| where IngestedAt between (ago(65m) .. ago(5m))\n// Default: opened or reopened risks with CRITICAL or HIGH severity\n| where ChangeType in (\"opened\", \"reopened\") and Severity in (\"CRITICAL\", \"HIGH\")\n// Full lifecycle (needs the optional \"let\" lines above):\n// | where (ChangeType == \"reopened\" or (ChangeType == \"opened\" and Severity in (\"CRITICAL\", \"HIGH\"))) or (ChangeType == \"resolved\" and RiskInstanceId in (TrackedRisks))\n//\n// Optional filters: remove the leading // of a line to use it. Each line narrows the alerts further, and several lines can be combined.\n// Do not remove or change the IngestedAt window above, it keeps every event alerted exactly once.\n// | where Confidence >= 0.8 // only findings with a confidence of 80% or more\n// | where Severity == \"CRITICAL\" // only CRITICAL risks (Censys severities: CRITICAL, HIGH, MEDIUM, LOW)\n// | where ChangeType == \"opened\" // only newly opened risks, skip reopened risks\n// | where RapidResponse == true // only actively exploited (rapid response) risks\n// | where RiskCategory == \"VULNERABILITY\" // VULNERABILITY, MISCONFIGURATION, EXPOSURE or THREAT\n// | where SupplierDisplayName in (\"OpenAI\", \"Harvey\") // only these suppliers\n// | where CveId != \"\" // only risks that have a CVE id\n// | where RiskName has \"Log4Shell\" // only risks whose name contains this text\n// | where AssetType == \"host\" // asset type: host or web\n| extend SentinelSeverity = case(\n Severity in (\"CRITICAL\", \"HIGH\"), \"High\",\n Severity == \"MEDIUM\", \"Medium\",\n Severity == \"LOW\", \"Low\",\n \"Informational\")\n| project TimeGenerated, IngestedAt, EventId, InsertedAt, OccurredAt, ChangeType, RiskInstanceId, Severity, SentinelSeverity,\n RiskCategory, RiskName, Description, CveId, RapidResponse, SupplierDisplayName,\n AssetName, AssetHostname, AssetIp, ServicePort, ServiceProtocol, Evidence, ResolveTime, ResolveReason, PlatformUrl\n",
+ "queryFrequency": "PT1H",
+ "queryPeriod": "P1D",
+ "severity": "Medium",
+ "suppressionDuration": "PT1H",
+ "suppressionEnabled": false,
+ "triggerOperator": "GreaterThan",
+ "triggerThreshold": 0,
+ "status": "Available",
+ "requiredDataConnectors": [
+ {
+ "connectorId": "CensysSRRiskEventsFunction",
+ "dataTypes": [
+ "CensysRiskEvents_CL"
+ ]
+ }
+ ],
+ "tactics": [
+ "InitialAccess"
+ ],
+ "techniques": [
+ "T1195"
+ ],
+ "entityMappings": [
+ {
+ "entityType": "Host",
+ "fieldMappings": [
+ {
+ "columnName": "AssetHostname",
+ "identifier": "HostName"
+ }
+ ]
+ },
+ {
+ "entityType": "IP",
+ "fieldMappings": [
+ {
+ "columnName": "AssetIp",
+ "identifier": "Address"
+ }
+ ]
+ },
+ {
+ "entityType": "URL",
+ "fieldMappings": [
+ {
+ "columnName": "PlatformUrl",
+ "identifier": "Url"
+ }
+ ]
+ }
+ ],
+ "eventGroupingSettings": {
+ "aggregationKind": "AlertPerResult"
+ },
+ "customDetails": {
+ "CensysSeverity": "Severity",
+ "RapidResponse": "RapidResponse",
+ "RiskInstanceId": "[if(true(), 'RiskInstanceId', 'RiskInstanceId')]",
+ "Evidence": "Evidence",
+ "RiskCategory": "RiskCategory",
+ "Supplier": "SupplierDisplayName",
+ "ResolveTime": "ResolveTime",
+ "CveId": "[if(true(), 'CveId', 'CveId')]",
+ "ChangeType": "ChangeType",
+ "ResolveReason": "ResolveReason"
+ },
+ "alertDetailsOverride": {
+ "alertDynamicProperties": [
+ {
+ "alertProperty": "AlertLink",
+ "value": "PlatformUrl"
+ }
+ ],
+ "alertSeverityColumnName": "SentinelSeverity",
+ "alertDisplayNameFormat": "Censys: {{ChangeType}} risk - {{RiskName}} ({{SupplierDisplayName}})",
+ "alertDescriptionFormat": "{{Description}} Asset: {{AssetName}}. Open in Censys: {{PlatformUrl}}"
+ },
+ "incidentConfiguration": {
+ "groupingConfiguration": {
+ "enabled": true,
+ "matchingMethod": "Selected",
+ "lookbackDuration": "P1D",
+ "groupByCustomDetails": [
+ "RiskInstanceId"
+ ],
+ "reopenClosedIncident": false
+ },
+ "createIncident": true
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]",
+ "properties": {
+ "description": "Censys Supplier Risk Analytics Rule 1",
+ "parentId": "[variables('analyticRuleObject1').analyticRuleId1]",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "kind": "AnalyticsRule",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "contentKind": "AnalyticsRule",
+ "displayName": "Censys SR - Risk State Change",
+ "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+ "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "version": "3.0.0",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "Censys Supplier Risk",
+ "publisherDisplayName": "Censys Support",
+ "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nBring Censys Supplier Risk into Microsoft Sentinel. The solution collects supply chain risk events (risks opened, reopened and resolved for your suppliers) from the Censys platform, and provides a parser, a workbook and an analytic rule that raises incidents for new and reopened supplier risks and keeps resolved events with the incident of the same risk.
\nData Connectors: 1, Parsers: 2, Workbooks: 1, Analytic Rules: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Censys Supplier Risk",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Censys",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('_dataConnectorContentId1')]",
+ "version": "[variables('dataConnectorVersion1')]"
+ },
+ {
+ "kind": "Parser",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "version": "[variables('parserObject1').parserVersion1]"
+ },
+ {
+ "kind": "Parser",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "version": "[variables('parserObject2').parserVersion2]"
+ },
+ {
+ "kind": "Workbook",
+ "contentId": "[variables('_workbookContentId1')]",
+ "version": "[variables('workbookVersion1')]"
+ },
+ {
+ "kind": "AnalyticsRule",
+ "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]",
+ "version": "[variables('analyticRuleObject1').analyticRuleVersion1]"
+ }
+ ]
+ },
+ "firstPublishDate": "2026-10-29",
+ "lastPublishDate": "2026-10-29",
+ "providers": [
+ "Censys"
+ ],
+ "categories": {
+ "domains": [
+ "Security - Network",
+ "Security - Cloud Security"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
diff --git a/Solutions/Censys Supplier Risk/Package/testParameters.json b/Solutions/Censys Supplier Risk/Package/testParameters.json
new file mode 100644
index 00000000000..855e4aba240
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/Package/testParameters.json
@@ -0,0 +1,32 @@
+{
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "workbook1-name": {
+ "type": "string",
+ "defaultValue": "Censys Supplier Risk",
+ "minLength": 1,
+ "metadata": {
+ "description": "Name for the workbook"
+ }
+ }
+}
diff --git a/Solutions/Censys Supplier Risk/Parsers/CensysRiskEvents.yaml b/Solutions/Censys Supplier Risk/Parsers/CensysRiskEvents.yaml
new file mode 100644
index 00000000000..7bee4a5733a
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/Parsers/CensysRiskEvents.yaml
@@ -0,0 +1,153 @@
+id: 5d2a8c1e-7b34-4f6a-9e0d-3c81a2b4f917
+Function:
+ Title: Parser for CensysRiskEvents
+ Version: "1.0.0"
+ LastUpdated: "2026-10-15"
+Category: Microsoft Sentinel Parser
+FunctionName: CensysRiskEvents
+FunctionAlias: CensysRiskEvents
+FunctionQuery: |
+ let CensysRiskEvents_view = view () {
+ // The empty datatable keeps the parser working (returning no rows) when the table does not exist yet
+ union isfuzzy=true
+ (datatable(
+ TimeGenerated:datetime,
+ EventId:string,
+ InsertedAt:datetime,
+ OccurredAt:datetime,
+ ChangeType:string,
+ RiskInstanceId:string,
+ SupplyChainId:string,
+ AssetType:string,
+ RiskTypeId:string,
+ CveId:string,
+ RiskCategory:string,
+ RiskName:string,
+ Description:string,
+ Remediations:dynamic,
+ Severity:string,
+ Score:real,
+ Confidence:real,
+ Status:string,
+ ResolveTime:datetime,
+ ResolveReason:string,
+ SupplierId:string,
+ SupplierDisplayName:string,
+ Suppliers:dynamic,
+ AssetIp:string,
+ AssetHostname:string,
+ AssetPort:int,
+ ServiceTransportProtocol:string,
+ ServicePort:int,
+ ServiceProtocol:string,
+ Tags:dynamic,
+ RapidResponse:bool,
+ Evidence:string,
+ FirstDetectedAt:datetime,
+ LastDetectedAt:datetime,
+ CreatedAt:datetime,
+ PlatformUrl:string,
+ IngestedAt:datetime
+ )[]),
+ (CensysRiskEvents_CL | extend IngestedAt = ingestion_time())
+ // Treat every field as optional: a column that is missing from the table becomes empty instead of failing the query
+ | extend
+ TimeGenerated = column_ifexists('TimeGenerated', datetime(null)),
+ EventId = column_ifexists('EventId', ''),
+ InsertedAt = column_ifexists('InsertedAt', datetime(null)),
+ OccurredAt = column_ifexists('OccurredAt', datetime(null)),
+ ChangeType = column_ifexists('ChangeType', ''),
+ RiskInstanceId = column_ifexists('RiskInstanceId', ''),
+ SupplyChainId = column_ifexists('SupplyChainId', ''),
+ AssetType = column_ifexists('AssetType', ''),
+ RiskTypeId = column_ifexists('RiskTypeId', ''),
+ CveId = column_ifexists('CveId', ''),
+ RiskCategory = column_ifexists('RiskCategory', ''),
+ RiskName = column_ifexists('RiskName', ''),
+ Description = column_ifexists('Description', ''),
+ Remediations = column_ifexists('Remediations', dynamic(null)),
+ Severity = column_ifexists('Severity', ''),
+ Score = column_ifexists('Score', real(null)),
+ Confidence = column_ifexists('Confidence', real(null)),
+ Status = column_ifexists('Status', ''),
+ ResolveTime = column_ifexists('ResolveTime', datetime(null)),
+ ResolveReason = column_ifexists('ResolveReason', ''),
+ SupplierId = column_ifexists('SupplierId', ''),
+ SupplierDisplayName = column_ifexists('SupplierDisplayName', ''),
+ Suppliers = column_ifexists('Suppliers', dynamic(null)),
+ AssetIp = column_ifexists('AssetIp', ''),
+ AssetHostname = column_ifexists('AssetHostname', ''),
+ AssetPort = column_ifexists('AssetPort', int(null)),
+ ServiceTransportProtocol = column_ifexists('ServiceTransportProtocol', ''),
+ ServicePort = column_ifexists('ServicePort', int(null)),
+ ServiceProtocol = column_ifexists('ServiceProtocol', ''),
+ Tags = column_ifexists('Tags', dynamic(null)),
+ RapidResponse = column_ifexists('RapidResponse', bool(null)),
+ Evidence = column_ifexists('Evidence', ''),
+ FirstDetectedAt = column_ifexists('FirstDetectedAt', datetime(null)),
+ LastDetectedAt = column_ifexists('LastDetectedAt', datetime(null)),
+ CreatedAt = column_ifexists('CreatedAt', datetime(null)),
+ PlatformUrl = column_ifexists('PlatformUrl', '')
+ // Delivery is at-least-once, so keep one row per event: the first copy that was ingested
+ | summarize arg_min(IngestedAt, *) by EventId
+ | extend
+ EventVendor = "Censys",
+ EventProduct = "Censys Supplier Risk",
+ ChangeType = tolower(ChangeType),
+ Status = tolower(Status),
+ Severity = toupper(Severity),
+ SupplierId = coalesce(tostring(SupplierId), tostring(Suppliers[0].id)),
+ SupplierDisplayName = coalesce(tostring(SupplierDisplayName), tostring(Suppliers[0].display_name)),
+ AssetName = iff(isnotempty(AssetHostname), AssetHostname, AssetIp),
+ IsOpen = tolower(Status) == "open",
+ SeverityRank = case(
+ toupper(Severity) == "CRITICAL", 4,
+ toupper(Severity) == "HIGH", 3,
+ toupper(Severity) == "MEDIUM", 2,
+ toupper(Severity) == "LOW", 1,
+ 0)
+ | project
+ TimeGenerated,
+ IngestedAt,
+ EventId,
+ InsertedAt,
+ OccurredAt,
+ ChangeType,
+ RiskInstanceId,
+ SupplyChainId,
+ RiskTypeId,
+ CveId,
+ RiskCategory,
+ RiskName,
+ Description,
+ Remediations,
+ Severity,
+ SeverityRank,
+ Score,
+ Confidence,
+ Status,
+ IsOpen,
+ ResolveTime,
+ ResolveReason,
+ SupplierId,
+ SupplierDisplayName,
+ Suppliers,
+ AssetType,
+ AssetName,
+ AssetIp,
+ AssetHostname,
+ AssetPort,
+ ServiceTransportProtocol,
+ ServicePort,
+ ServiceProtocol,
+ Tags,
+ RapidResponse,
+ Evidence,
+ FirstDetectedAt,
+ LastDetectedAt,
+ CreatedAt,
+ PlatformUrl,
+ EventVendor,
+ EventProduct
+ };
+ CensysRiskEvents_view
diff --git a/Solutions/Censys Supplier Risk/Parsers/CensysRisks.yaml b/Solutions/Censys Supplier Risk/Parsers/CensysRisks.yaml
new file mode 100644
index 00000000000..30043f8a6f8
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/Parsers/CensysRisks.yaml
@@ -0,0 +1,15 @@
+id: 821035be-713b-4be9-a568-87b8b0b62f41
+Function:
+ Title: Parser for Censys risks
+ Version: "1.0.0"
+ LastUpdated: "2026-10-21"
+Category: Microsoft Sentinel Parser
+FunctionName: CensysRisks
+FunctionAlias: CensysRisks
+FunctionQuery: |
+ // Current state of every supplier risk: the latest event of each risk instance, whether the risk is open or closed
+ let CensysRisks_view = view () {
+ CensysRiskEvents
+ | summarize arg_max(InsertedAt, *) by RiskInstanceId
+ };
+ CensysRisks_view
diff --git a/Solutions/Censys Supplier Risk/ReleaseNotes.md b/Solutions/Censys Supplier Risk/ReleaseNotes.md
new file mode 100644
index 00000000000..56d45fefe7d
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/ReleaseNotes.md
@@ -0,0 +1,3 @@
+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
+|-------------|--------------------------------|---------------------------------------------|
+| 3.0.0 | 29-10-2026 | Initial Solution Release |
diff --git a/Solutions/Censys Supplier Risk/SolutionMetadata.json b/Solutions/Censys Supplier Risk/SolutionMetadata.json
new file mode 100644
index 00000000000..ef692c69da8
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/SolutionMetadata.json
@@ -0,0 +1,17 @@
+{
+ "publisherId": "censys",
+ "offerId": "censys_supplier_risk",
+ "firstPublishDate": "2026-10-29",
+ "lastPublishDate": "2026-10-29",
+ "providers": ["Censys"],
+ "categories": {
+ "domains": ["Security - Network", "Security - Cloud Security"],
+ "verticals": []
+ },
+ "support": {
+ "name": "Censys Support",
+ "email": "support@censys.com",
+ "tier": "Partner",
+ "link": "https://docs.censys.com"
+ }
+}
\ No newline at end of file
diff --git a/Solutions/Censys Supplier Risk/Workbooks/CensysSupplierRisk.json b/Solutions/Censys Supplier Risk/Workbooks/CensysSupplierRisk.json
new file mode 100644
index 00000000000..5fd3f6cfdfb
--- /dev/null
+++ b/Solutions/Censys Supplier Risk/Workbooks/CensysSupplierRisk.json
@@ -0,0 +1,1097 @@
+{
+ "version": "Notebook/1.0",
+ "items": [
+ {
+ "type": 1,
+ "content": {
+ "json": "## Censys Supplier Risk Overview\nOverview dashboard for Censys Supplier Risk risk events. All panels count risk events in the selected **Time Range**, one per event id, and every filter applies to every panel. Open counts use the status that each event carries, so a risk opened earlier than the Time Range with no event inside it will not appear."
+ },
+ "name": "0a3c227f-21b3-55b9-b3d4-6c6d84922765"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "3980b3ca-3e47-5259-ae54-e9cf79f7aa97",
+ "version": "KqlParameterItem/1.0",
+ "name": "TimeRange",
+ "label": "Time Range",
+ "type": 4,
+ "isRequired": true,
+ "value": {
+ "durationMs": 604800000
+ },
+ "typeSettings": {
+ "selectableValues": [
+ {
+ "durationMs": 86400000
+ },
+ {
+ "durationMs": 259200000
+ },
+ {
+ "durationMs": 604800000
+ },
+ {
+ "durationMs": 1209600000
+ },
+ {
+ "durationMs": 2592000000
+ }
+ ],
+ "allowCustom": true
+ }
+ },
+ {
+ "id": "531ff72e-136a-5683-8495-98755dec1185",
+ "version": "KqlParameterItem/1.0",
+ "name": "Severity",
+ "label": "Severity",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "defaultValue": "value::all",
+ "value": [
+ "value::all"
+ ],
+ "jsonData": "[{\"value\": \"LOW\", \"label\": \"Low\"}, {\"value\": \"MEDIUM\", \"label\": \"Medium\"}, {\"value\": \"HIGH\", \"label\": \"High\"}, {\"value\": \"CRITICAL\", \"label\": \"Critical\"}]"
+ },
+ {
+ "id": "408ed010-0624-5802-be49-0b16ce3b0b55",
+ "version": "KqlParameterItem/1.0",
+ "name": "Supplier",
+ "label": "Supplier",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "CensysRiskEvents\n| where isnotempty(SupplierDisplayName)\n| summarize by SupplierDisplayName\n| project value = SupplierDisplayName, label = SupplierDisplayName\n| order by label asc",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "defaultValue": "value::all",
+ "value": [
+ "value::all"
+ ]
+ },
+ {
+ "id": "981f1274-a745-5685-9c0a-938042ba7b06",
+ "version": "KqlParameterItem/1.0",
+ "name": "RiskCategory",
+ "label": "Risk Category",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "defaultValue": "value::all",
+ "value": [
+ "value::all"
+ ],
+ "jsonData": "[{\"value\": \"VULNERABILITY\", \"label\": \"Vulnerability\"}, {\"value\": \"MISCONFIGURATION\", \"label\": \"Misconfiguration\"}, {\"value\": \"EXPOSURE\", \"label\": \"Exposure\"}, {\"value\": \"THREAT\", \"label\": \"Threat\"}]"
+ },
+ {
+ "id": "2a6c8d3e-7b1f-5f0e-9a44-3c2d9e8b1a77",
+ "version": "KqlParameterItem/1.0",
+ "name": "Status",
+ "label": "Status",
+ "type": 2,
+ "isRequired": true,
+ "multiSelect": true,
+ "quote": "'",
+ "delimiter": ",",
+ "query": "",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "typeSettings": {
+ "additionalResourceOptions": [
+ "value::all"
+ ],
+ "selectAllValue": "*",
+ "showDefault": false
+ },
+ "defaultValue": "value::all",
+ "value": [
+ "value::all"
+ ],
+ "jsonData": "[{\"value\": \"open\", \"label\": \"Open\"}, {\"value\": \"closed\", \"label\": \"Closed\"}]"
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "d242da61-ec90-533c-946e-20debc8b18b2"
+ },
+ {
+ "type": 9,
+ "content": {
+ "version": "KqlParameterItem/1.0",
+ "parameters": [
+ {
+ "id": "b0aac801-3580-5807-8df7-7a5e49f3c503",
+ "version": "KqlParameterItem/1.0",
+ "name": "P1Severity",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ },
+ {
+ "id": "9952c2a7-5e8b-5f2f-a19d-dc9d340ca4fe",
+ "version": "KqlParameterItem/1.0",
+ "name": "P2Date",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ },
+ {
+ "id": "c97c3004-6c39-55d2-8b8a-a3c41ef751f5",
+ "version": "KqlParameterItem/1.0",
+ "name": "P2Status",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ },
+ {
+ "id": "c070c984-7e2c-568c-8d8f-b6ca8ffaffd8",
+ "version": "KqlParameterItem/1.0",
+ "name": "P3Category",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ },
+ {
+ "id": "b5d774c8-0c6d-5ffa-8e74-193a9f8dcd6e",
+ "version": "KqlParameterItem/1.0",
+ "name": "P4Risk",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ },
+ {
+ "id": "6179b664-6feb-5562-9189-6351e12c6713",
+ "version": "KqlParameterItem/1.0",
+ "name": "P5Supplier",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ },
+ {
+ "id": "c728699c-76e3-5dd5-b847-ed58b40037b7",
+ "version": "KqlParameterItem/1.0",
+ "name": "P6Event",
+ "type": 1,
+ "isRequired": false,
+ "isHiddenWhenLocked": true,
+ "value": "None"
+ }
+ ],
+ "style": "pills",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces"
+ },
+ "name": "383c127f-e50f-5a35-8def-1a9f9987899b"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == \"open\"\n| summarize [\"count\"] = count() by severity = Severity\n| order by severity asc",
+ "size": 3,
+ "title": "Open Risk Count by Severity",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "piechart",
+ "exportFieldName": "series",
+ "exportParameterName": "P1Severity",
+ "exportDefaultValue": "None",
+ "chartSettings": {
+ "group": "severity",
+ "seriesLabelSettings": [
+ {
+ "seriesName": "CRITICAL",
+ "color": "redBright"
+ },
+ {
+ "seriesName": "HIGH",
+ "color": "orange"
+ },
+ {
+ "seriesName": "MEDIUM",
+ "color": "yellow"
+ },
+ {
+ "seriesName": "LOW",
+ "color": "blue"
+ },
+ {
+ "seriesName": "UNSPECIFIED",
+ "color": "gray"
+ }
+ ],
+ "ySettings": {
+ "numberFormatSettings": {
+ "unit": 0,
+ "options": {
+ "style": "decimal",
+ "useGrouping": true,
+ "maximumSignificantDigits": 15
+ }
+ }
+ }
+ }
+ },
+ "name": "1b6bdd62-e666-568e-ad83-e6466e7d0772",
+ "customWidth": "50"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| summarize [\"count\"] = count() by category = RiskCategory\n| order by category asc",
+ "size": 3,
+ "title": "Risk Events by Category",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "piechart",
+ "chartSettings": {
+ "group": "category",
+ "ySettings": {
+ "numberFormatSettings": {
+ "unit": 0,
+ "options": {
+ "style": "decimal",
+ "useGrouping": true,
+ "maximumSignificantDigits": 15
+ }
+ }
+ }
+ },
+ "exportFieldName": "series",
+ "exportParameterName": "P3Category",
+ "exportDefaultValue": "None"
+ },
+ "name": "ab26b647-f261-532b-937b-fc06058cd3f2",
+ "customWidth": "50"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "\ud83d\udca1 _Click on a slice in the above 'Open Risk Count by Severity' chart to view more details_\n\n\ud83d\udcdd _Counts open risk events by severity, one per event id._"
+ },
+ "name": "3408c688-c583-5070-b687-a6b6c057b141",
+ "customWidth": "50"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "\ud83d\udca1 _Click on a slice in the above 'Risk Events by Category' chart to view more details_\n\n\ud83d\udcdd _Counts risk events by category, one per event id._"
+ },
+ "name": "a91116af-f6ff-5304-8e46-14afb20ca027",
+ "customWidth": "50"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == \"open\"\n| where Severity == '{P1Severity}'\n| order by InsertedAt desc\n| project Time = InsertedAt, id = EventId, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Events - {P1Severity}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "27%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "15%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ }
+ },
+ "name": "b4afc41f-40bd-50d8-a9f6-66f8d2b30133",
+ "customWidth": "100",
+ "conditionalVisibility": {
+ "parameterName": "P1Severity",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where RiskCategory == '{P3Category}'\n| order by InsertedAt desc\n| project Time = InsertedAt, id = EventId, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Events - {P3Category}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "27%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "15%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ }
+ },
+ "name": "70e7cbe8-0bc7-571e-81e4-7d792f321c2b",
+ "customWidth": "100",
+ "conditionalVisibility": {
+ "parameterName": "P3Category",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let TotalHours = (todatetime({TimeRange:end}) - todatetime({TimeRange:start})) / 1h;\n// Time span picked from the Time Range (at most about 100 points): 30 minutes, 1 hour or 1 day\nlet Span = iff(TotalHours <= 50, 30m, iff(TotalHours <= 100, 1h, 1d));\nlet Buckets = range Bucket from bin(todatetime({TimeRange:start}), Span) to todatetime({TimeRange:end}) step Span | extend k = 1;\nlet Statuses = datatable(Series: string)[\"Opened\", \"Closed\"] | extend k = 1;\nlet Counts = CensysRiskEvents\n | where OccurredAt {TimeRange}\n | where ('*' in ({Status}) or Status in ({Status}))\n | where ('*' in ({Severity}) or Severity in ({Severity}))\n | where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n | where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n | extend Series = case(Status == \"open\", \"Opened\", Status == \"closed\", \"Closed\", Status)\n | summarize Total = count() by Bucket = bin(OccurredAt, Span), Series;\nBuckets\n| join kind=inner Statuses on k\n| join kind=leftouter Counts on Bucket, Series\n| project Time = iff(Span >= 1d, format_datetime(Bucket, 'yyyy-MM-dd'), format_datetime(Bucket, 'yyyy-MM-dd HH:mm')), Series, [\"Risk Count\"] = coalesce(Total, 0)\n| order by Time asc, Series asc",
+ "size": 0,
+ "title": "Opened vs. Closed Risks",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "timechart",
+ "chartSettings": {
+ "xAxis": "Time",
+ "group": "Series",
+ "xSettings": {
+ "label": "Time"
+ },
+ "ySettings": {
+ "label": "Risk Count"
+ }
+ },
+ "exportedParameters": [
+ {
+ "fieldName": "x",
+ "parameterName": "P2Date",
+ "parameterType": 1,
+ "defaultValue": "None"
+ },
+ {
+ "fieldName": "series",
+ "parameterName": "P2Status",
+ "parameterType": 1,
+ "defaultValue": "None"
+ }
+ ]
+ },
+ "name": "4668c9cb-64a5-581d-b461-d8854d0f2409",
+ "customWidth": "100"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "\ud83d\udca1 _Click on a data point in the above 'Opened vs. Closed Risks' chart to view more details_\n\n\ud83d\udcdd _Counts risk events per day by their status (Opened or Closed), by when they occurred._"
+ },
+ "name": "c2beca44-a16d-5fa8-821b-d7aea664ec9f",
+ "customWidth": "100"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "let TotalHours = (todatetime({TimeRange:end}) - todatetime({TimeRange:start})) / 1h;\n// Time span picked from the Time Range (at most about 100 points): 30 minutes, 1 hour or 1 day\nlet Span = iff(TotalHours <= 50, 30m, iff(TotalHours <= 100, 1h, 1d));\nCensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == iff('{P2Status}' == \"Opened\", \"open\", \"closed\")\n| where OccurredAt >= todatetime(substring('{P2Date}', 0, 16)) and OccurredAt < todatetime(substring('{P2Date}', 0, 16)) + Span\n| order by InsertedAt desc\n| project Time = InsertedAt, id = EventId, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Events - {P2Status} on {P2Date}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "27%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "15%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ }
+ },
+ "name": "50857b22-679b-5891-bd85-96262bd29d80",
+ "customWidth": "100",
+ "conditionalVisibilities": [
+ {
+ "parameterName": "P2Date",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ },
+ {
+ "parameterName": "P2Status",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ }
+ ]
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == \"open\" and isnotempty(RiskName)\n| summarize OpenRisks = count() by [\"Risk Name\"] = RiskName\n| order by OpenRisks desc\n| take 10",
+ "size": 0,
+ "title": "Top 10 Risks by Open Risk Count",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "80%"
+ }
+ },
+ {
+ "columnMatch": "OpenRisks",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ },
+ "exportFieldName": "Risk Name",
+ "exportParameterName": "P4Risk",
+ "exportDefaultValue": "None"
+ },
+ "name": "4c44d1fa-a2d9-55b0-98e5-8030350c5f9d",
+ "customWidth": "50"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == \"open\"\n| summarize OpenRisks = count() by Supplier = SupplierDisplayName\n| order by OpenRisks desc",
+ "size": 0,
+ "title": "Supplier Risk Ranking",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "80%"
+ }
+ },
+ {
+ "columnMatch": "OpenRisks",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ },
+ "exportFieldName": "Supplier",
+ "exportParameterName": "P5Supplier",
+ "exportDefaultValue": "None"
+ },
+ "name": "a5821846-0945-540c-9c97-849cad7afa8b",
+ "customWidth": "50"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "\ud83d\udca1 _Click on a row in the above 'Top 10 Risks by Open Risk Count' grid to view more details_\n\n\ud83d\udcdd _The 10 risk names with the most open risk events._"
+ },
+ "name": "cdf92177-e783-5d83-97d1-37d122085500",
+ "customWidth": "50"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "\ud83d\udca1 _Click on a row in the above 'Supplier Risk Ranking' grid to view more details_\n\n\ud83d\udcdd _Suppliers ranked by their number of open risk events._"
+ },
+ "name": "4e9590ae-6386-5f24-9ca0-f3a096994918",
+ "customWidth": "50"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == \"open\"\n| where RiskName == '{P4Risk}'\n| order by InsertedAt desc\n| project Time = InsertedAt, id = EventId, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Events - {P4Risk}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "27%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "15%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ }
+ },
+ "name": "22004c2d-0bf3-5e3d-9870-78807252bd52",
+ "customWidth": "100",
+ "conditionalVisibility": {
+ "parameterName": "P4Risk",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where Status == \"open\"\n| where SupplierDisplayName == '{P5Supplier}'\n| order by InsertedAt desc\n| project Time = InsertedAt, id = EventId, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Events - {P5Supplier}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "27%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "15%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ }
+ },
+ "name": "67930e57-64b3-52a9-b227-bebac1f40c88",
+ "customWidth": "100",
+ "conditionalVisibility": {
+ "parameterName": "P5Supplier",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ }
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where RapidResponse == true\n| order by InsertedAt desc\n| project Time = InsertedAt, id = EventId, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Rapid Response Events",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "27%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "15%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "15%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ },
+ "exportFieldName": "id",
+ "exportParameterName": "P6Event",
+ "exportDefaultValue": "None"
+ },
+ "name": "d29db818-909d-5958-8ef4-89e50ee80542",
+ "customWidth": "100"
+ },
+ {
+ "type": 1,
+ "content": {
+ "json": "\ud83d\udca1 _Click on a row in the above 'Rapid Response Events' grid to view more details_\n\n\ud83d\udcdd _Risk events flagged for rapid response (actively exploited), newest first._"
+ },
+ "name": "59f191f6-06f8-5ad8-b72b-8394af1f9a2a",
+ "customWidth": "100"
+ },
+ {
+ "type": 3,
+ "content": {
+ "version": "KqlItem/1.0",
+ "query": "CensysRiskEvents\n| where OccurredAt {TimeRange}\n| where ('*' in ({Status}) or Status in ({Status}))\n| where ('*' in ({Severity}) or Severity in ({Severity}))\n| where ('*' in ({Supplier}) or SupplierDisplayName in ({Supplier}))\n| where ('*' in ({RiskCategory}) or RiskCategory in ({RiskCategory}))\n| where EventId == '{P6Event}'\n| project Time = InsertedAt, id = EventId, [\"Change Type\"] = ChangeType, Status, [\"Risk Name\"] = RiskName, Severity, Supplier = SupplierDisplayName, Asset = AssetName, [\"Service Port\"] = ServicePort, [\"Resolve Reason\"] = ResolveReason, [\"Platform URL\"] = PlatformUrl\n| take 10000",
+ "size": 0,
+ "title": "Event - {P6Event}",
+ "queryType": 0,
+ "resourceType": "microsoft.operationalinsights/workspaces",
+ "showRefreshButton": true,
+ "showAnalytics": true,
+ "showExportToExcel": true,
+ "noDataMessage": "No data found for the selected filters.",
+ "timeContext": {
+ "durationMs": 7776000000
+ },
+ "visualization": "table",
+ "gridSettings": {
+ "formatters": [
+ {
+ "columnMatch": "Time",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "12%"
+ }
+ },
+ {
+ "columnMatch": "id",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "16%"
+ }
+ },
+ {
+ "columnMatch": "Change Type",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "8%"
+ }
+ },
+ {
+ "columnMatch": "Status",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "7%"
+ }
+ },
+ {
+ "columnMatch": "Risk Name",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "20%"
+ }
+ },
+ {
+ "columnMatch": "Severity",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "7%"
+ }
+ },
+ {
+ "columnMatch": "Supplier",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "11%"
+ }
+ },
+ {
+ "columnMatch": "Asset",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "10%"
+ }
+ },
+ {
+ "columnMatch": "Service Port",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "4%"
+ }
+ },
+ {
+ "columnMatch": "Resolve Reason",
+ "formatter": 0,
+ "formatOptions": {
+ "customColumnWidthSetting": "5%"
+ }
+ },
+ {
+ "columnMatch": "Platform URL",
+ "formatter": 7,
+ "formatOptions": {
+ "linkTarget": "Url",
+ "linkLabel": "Open in Censys",
+ "customColumnWidthSetting": "10%"
+ }
+ }
+ ],
+ "filter": true,
+ "rowLimit": 10000
+ }
+ },
+ "name": "996c3d06-11cb-52d7-86a5-2a6444795041",
+ "customWidth": "100",
+ "conditionalVisibility": {
+ "parameterName": "P6Event",
+ "comparison": "isNotEqualTo",
+ "value": "None"
+ }
+ }
+ ],
+ "fallbackResourceIds": [],
+ "fromTemplateId": "sentinel-CensysSupplierRisk",
+ "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
+}
diff --git a/Workbooks/Images/Preview/CensysSupplierRiskBlack1.png b/Workbooks/Images/Preview/CensysSupplierRiskBlack1.png
new file mode 100644
index 00000000000..8ae03395b1c
Binary files /dev/null and b/Workbooks/Images/Preview/CensysSupplierRiskBlack1.png differ
diff --git a/Workbooks/Images/Preview/CensysSupplierRiskWhite1.png b/Workbooks/Images/Preview/CensysSupplierRiskWhite1.png
new file mode 100644
index 00000000000..17905354d84
Binary files /dev/null and b/Workbooks/Images/Preview/CensysSupplierRiskWhite1.png differ
diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json
index 35d2aa0831e..faf7debc706 100644
--- a/Workbooks/WorkbooksMetadata.json
+++ b/Workbooks/WorkbooksMetadata.json
@@ -11614,6 +11614,26 @@
"subtitle": "",
"provider": "PRODAFT"
},
+ {
+ "workbookKey": "CensysSupplierRiskWorkbook",
+ "logoFileName": "Censys.svg",
+ "description": "Gain insight into supplier risk collected from Censys Supplier Risk: open risks by severity, risk events by category, opened and closed risks over time, top risks by open risk count, supplier risk ranking and rapid response events, with details one selection away.",
+ "dataTypesDependencies": [
+ "CensysRiskEvents_CL"
+ ],
+ "dataConnectorsDependencies": [
+ "CensysSRRiskEventsFunction"
+ ],
+ "previewImagesFileNames": [
+ "CensysSupplierRiskWhite1.png",
+ "CensysSupplierRiskBlack1.png"
+ ],
+ "version": "1.0.0",
+ "title": "Censys Supplier Risk",
+ "templateRelativePath": "CensysSupplierRisk.json",
+ "subtitle": "",
+ "provider": "Censys"
+ },
{
"workbookKey": "DelineaIdentityAuthOverview",
"logoFileName": "DelineaPlatformLogo.svg",