[Gunjan Jain (gunjanmj)]

Summary

• New Sentinel Content Hub solution for QCrypton PQC Proxy — a hybrid post-quantum TLS 1.3 reverse proxy (X25519MLKEM768) that protects traffic against harvest-now-decrypt-later attacks
• Ingests TLS handshake telemetry into a new PQCProxy_CL custom table via Codeless Connector Framework (RestApiPoller)
• Ships with 1 data connector, 6 analytic rules, 1 workbook, and 1 Teams-notification playbook

Components

Data Connector: CCF (RestApiPoller) polling QCrypton API for proxy handshake telemetry → PQCProxy_CL

6 Analytic Rules:

• PQC downgrade detected — client offered hybrid but classical was negotiated (High)
• PQC Proxy certificate expiring within 30 days (Medium)
• PQC Proxy certificate expiring within 7 days — immediate renewal required (High)
• TLS handshake failure spike on PQC Proxy (Medium)
• Upstream backend connection failures on PQC Proxy (Medium)
• High percentage of clients connecting without PQC support (Informational)

Workbook: Hybrid Post-Quantum TLS Dashboard — PQC adoption rate, key exchange group distribution, downgrade trends, per-proxy summary, certificate health, error trends

Playbook: Logic App triggered on Sentinel incidents, posts alert card to Microsoft Teams

[Gunjan Jain (gunjanmj)]

v-atulyadav v-skharode v-maheshbh (@v-maheshbh)