Files

 main

/

Container scan events coverage.json

Copy path

Blame

Blame

Latest commit

christophpre-dynatrace

Update security dashboards to be compatible with new semantic diction…

Oct 30, 2024

24d9841 · Oct 30, 2024

History

History

1075 lines (1075 loc) · 56.8 KB

/

Container scan events coverage.json

Top

File metadata and controls

• Code
• Blame

1075 lines (1075 loc) · 56.8 KB

Raw

{ "version": 17, "variables": [ { "key": "Product", "type": "query", "visible": true, "input": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type == \"CONTAINER_IMAGE\"\n| summarize rawValues = arrayRemoveNulls(arraySort(collectDistinct(event.provider)))\n| fieldsAdd values = if(arraySize(rawValues) > 0, rawValues, else:\"None\")", "multiple": true, "defaultValue": [ "3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*" ] }, { "key": "Registry", "type": "query", "visible": true, "input": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type == \"CONTAINER_IMAGE\"\n| summarize rawValues = arrayRemoveNulls(arraySort(collectDistinct(container_image.registry)))\n| fieldsAdd values = if(arraySize(rawValues) > 0, rawValues, else:\"None\")", "multiple": true, "defaultValue": [ "3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*" ] }, { "key": "Repository", "type": "query", "visible": true, "input": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type == \"CONTAINER_IMAGE\"\n| summarize rawValues = arrayRemoveNulls(arraySort(collectDistinct(container_image.repository)))\n| fieldsAdd values = if(arraySize(rawValues) > 0, rawValues, else:\"None\")", "multiple": true, "defaultValue": [ "3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*" ] }, { "key": "Tag", "type": "query", "visible": true, "input": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type == \"CONTAINER_IMAGE\"\n| summarize rawValues = arrayRemoveNulls(arraySort(collectDistinct(container_image.tags, expand:true)))\n| fieldsAdd values = if(arraySize(rawValues) > 0, rawValues, else:\"None\")", "multiple": true, "defaultValue": [ "3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*" ] }, { "key": "RuntimeStatus", "type": "query", "visible": true, "input": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n AND event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_FINDING\"\n AND object.type == \"CONTAINER_IMAGE\"\n AND isNotNull(component.name)\n| dedup {object.id, vulnerability.id, component.name,\n container_image.registry, container_image.repository, container_image.tags}, sort: {timestamp desc}\n// dashboard variables\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, \n container_image.name=containerImageName, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| summarize rawValues = arrayRemoveNulls(arraySort(collectDistinct(containerStatus)))\n| fieldsAdd values = if(arraySize(rawValues) > 0, rawValues, else:\"None\")", "multiple": true, "defaultValue": [ "3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*" ] }, { "key": "ProductStage", "type": "query", "visible": true, "input": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n AND event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_FINDING\"\n AND object.type == \"CONTAINER_IMAGE\"\n AND isNotNull(component.name)\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| summarize rawValues = arrayRemoveNulls(arraySort(collectDistinct(releasesStage)))\n| fieldsAdd values = if(arraySize(rawValues) > 0, rawValues, else:\"None\")", "multiple": true, "defaultValue": [ "3420b2ac-f1cf-4b24-b62d-61ba1ba8ed05*" ] } ], "tiles": { "0": { "type": "data", "title": "Most recent container image scan events", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n// unique fields\n| dedup {object.id}, sort: {timestamp desc}\n// variable fields\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| sort {timestamp, direction:\"descending\"}\n// fields to be displayed\n| fields `Ingest time`=timestamp, `Scanning product`=event.provider, \n Registry=container_image.registry, Repository=container_image.repository,\n Tags=container_image.tags, `Container image`=container_image.digest\n| limit 50", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "table", "visualizationSettings": { "thresholds": [ { "id": 1, "field": "Risk level", "title": "", "isEnabled": true, "rules": [ { "id": 2, "color": { "Default": "var(--dt-colors-charts-loglevel-emergency-default, #9033a3)" }, "comparator": "=", "label": "", "value": "CRITICAL" }, { "id": 3, "color": { "Default": "var(--dt-colors-charts-categorical-color-12-default, #cd3741)" }, "comparator": "=", "label": "", "value": "HIGH" }, { "id": 4, "color": { "Default": "var(--dt-colors-charts-categorical-color-14-default, #d56b1a)" }, "comparator": "=", "label": "", "value": "MEDIUM" } ] } ], "chartSettings": { "xAxisScaling": "analyzedTimeframe", "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "relative", "groupingThresholdValue": 0, "valueType": "relative" }, "categoryOverrides": {}, "categoricalBarChartSettings": { "categoryAxisLabel": "Scanning product,Registry,Repository,Affected object", "valueAxisLabel": "", "categoryAxis": [ "Scanning product", "Registry", "Repository", "Affected object" ], "valueAxis": [], "tooltipVariant": "single" }, "hiddenLegendFields": [], "truncationMode": "middle" }, "singleValue": { "showLabel": true, "label": "", "prefixIcon": "", "recordField": "timestamp", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [ [ "Repository" ] ], "columnWidths": { "[\"event.provider_product\"]": 187.3975830078125, "[\"affected_entity.id\"]": 574.390625, "[\"container_image.registry\"]": 230.46875, "[\"container_image.repository\"]": 269.65625, "[\"container_image.tag\"]": 208.75, "[\"timestamp\"]": 170.96875, "[\"critical\"]": 113.125, "[\"high\"]": 97.78125, "[\"vulnerabilities\"]": 176, "[\"Id\"]": 211.38751220703125, "[\"Repository\"]": 264.375 } }, "honeycomb": { "shape": "square", "dataMappings": { "value": "Scanning product" }, "legend": "auto", "displayedFields": [ "Scanning product", "Registry", "Repository", "Affected object" ], "colorMode": "color-palette", "colorPalette": "categorical" }, "histogram": { "dataMappings": [], "variant": "single", "displayedFields": [ "Scanning product", "Registry", "Repository" ] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "1": { "type": "markdown", "title": "", "content": "# Coverage report for container image scan events\n\nSummary of vulnerability scan events from container image scans, reported by various products." }, "4": { "type": "data", "title": "Container image coverage by product", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| dedup {event.provider, object.id}, sort: {timestamp desc}\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| summarize {images=countDistinctExact(container_image.digest)}, by: {event.provider}\n| sort images desc", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "categoricalBarChart", "visualizationSettings": { "thresholds": [], "chartSettings": { "xAxisScaling": "analyzedTimeframe", "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "number-of-slices", "groupingThresholdValue": 10, "valueType": "relative" }, "categoryOverrides": {}, "categoricalBarChartSettings": { "categoryAxis": "event.provider", "categoryAxisLabel": "Scanning product", "valueAxis": [ "images" ], "valueAxisLabel": "Container images", "tooltipVariant": "single", "layout": "horizontal", "groupMode": "stacked", "isCategoryLabelVisible": true }, "hiddenLegendFields": [], "truncationMode": "middle" }, "singleValue": { "showLabel": true, "label": "", "prefixIcon": "", "recordField": "container_image.registry", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [], "columnWidths": {} }, "honeycomb": { "shape": "square", "dataMappings": { "value": "images" }, "legend": "auto", "displayedFields": [ "event.provider" ], "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "images", "rangeAxis": "" } ], "variant": "single", "displayedFields": [ "event.provider" ] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "11": { "type": "data", "title": "Registries", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| dedup {object.id}, sort: {timestamp desc}\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| summarize {registries=countDistinctExact(container_image.registry)}", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "singleValue", "visualizationSettings": { "thresholds": [], "chartSettings": { "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "absolute", "groupingThresholdValue": 0, "valueType": "absolute" }, "categoryOverrides": { "NOT_AVAILABLE": { "color": "var(--dt-colors-charts-logstatus-none-default, #2c2f3f)", "added": 1713354177614 } }, "categoricalBarChartSettings": { "categoryAxisLabel": "vulnerability.risk.level", "valueAxisLabel": "registries" }, "hiddenLegendFields": [], "colorPalette": "security-risk-level" }, "singleValue": { "showLabel": false, "label": "", "prefixIcon": "", "recordField": "registries", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [], "columnWidths": {} }, "honeycomb": { "shape": "square", "dataMappings": {}, "displayedFields": [], "legend": { "hidden": false, "position": "auto" }, "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "registries", "rangeAxis": "" } ], "variant": "single", "displayedFields": [] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "12": { "type": "data", "title": "Container repositories", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| dedup {object.id}, sort: {timestamp desc}\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| summarize {artifacts=countDistinctExact(container_image.repository)}", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "singleValue", "visualizationSettings": { "thresholds": [], "chartSettings": { "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "absolute", "groupingThresholdValue": 0, "valueType": "absolute" }, "categoryOverrides": { "NOT_AVAILABLE": { "color": "var(--dt-colors-charts-logstatus-none-default, #2c2f3f)", "added": 1713354177614 } }, "categoricalBarChartSettings": { "categoryAxisLabel": "vulnerability.risk.level", "valueAxisLabel": "registries" }, "hiddenLegendFields": [], "colorPalette": "security-risk-level" }, "singleValue": { "showLabel": false, "label": "", "prefixIcon": "", "recordField": "artifacts", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [], "columnWidths": {} }, "honeycomb": { "shape": "square", "dataMappings": {}, "displayedFields": [], "legend": { "hidden": false, "position": "auto" }, "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "artifacts", "rangeAxis": "" } ], "variant": "single", "displayedFields": [] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "13": { "type": "data", "title": "Container images", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| dedup {object.id}, sort: {timestamp desc}\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| summarize {artifacts=countDistinctExact(container_image.digest)}", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "singleValue", "visualizationSettings": { "thresholds": [], "chartSettings": { "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "absolute", "groupingThresholdValue": 0, "valueType": "absolute" }, "categoryOverrides": { "NOT_AVAILABLE": { "color": "var(--dt-colors-charts-logstatus-none-default, #2c2f3f)", "added": 1713354177614 } }, "categoricalBarChartSettings": { "categoryAxisLabel": "vulnerability.risk.level", "valueAxisLabel": "registries" }, "hiddenLegendFields": [], "colorPalette": "security-risk-level" }, "singleValue": { "showLabel": false, "label": "", "prefixIcon": "", "recordField": "artifacts", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [], "columnWidths": {} }, "honeycomb": { "shape": "square", "dataMappings": {}, "displayedFields": [], "legend": { "hidden": false, "position": "auto" }, "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "artifacts", "rangeAxis": "" } ], "variant": "single", "displayedFields": [] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "14": { "type": "data", "title": "Scanning products", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| dedup {object.id}, sort: {timestamp desc}\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| summarize {products=countDistinctExact(event.provider)}", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "singleValue", "visualizationSettings": { "thresholds": [], "chartSettings": { "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "absolute", "groupingThresholdValue": 0, "valueType": "absolute" }, "categoryOverrides": { "NOT_AVAILABLE": { "color": "var(--dt-colors-charts-logstatus-none-default, #2c2f3f)", "added": 1713354177614 } }, "categoricalBarChartSettings": { "categoryAxisLabel": "vulnerability.risk.level", "valueAxisLabel": "registries" }, "hiddenLegendFields": [], "colorPalette": "security-risk-level" }, "singleValue": { "showLabel": false, "label": "", "prefixIcon": "", "recordField": "products", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [], "columnWidths": {} }, "honeycomb": { "shape": "square", "dataMappings": {}, "displayedFields": [], "legend": { "hidden": false, "position": "auto" }, "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "products", "rangeAxis": "" } ], "variant": "single", "displayedFields": [] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "15": { "type": "markdown", "title": "", "content": "\n----\n## Coverage overview\n---" }, "16": { "type": "data", "title": "Scan events over time by product", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// get the latest vulnerability finding report for the affected entity and the component of the repository in the registry\n| makeTimeseries count(), time:{timestamp}, interval: 24h, by:{event.provider}", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "areaChart", "visualizationSettings": { "thresholds": [], "chartSettings": { "xAxisScaling": "analyzedTimeframe", "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "relative", "groupingThresholdValue": 0, "valueType": "relative" }, "categoryOverrides": {}, "categoricalBarChartSettings": { "categoryAxisLabel": "event.provider", "valueAxisLabel": "interval", "categoryAxis": [ "event.provider" ], "valueAxis": [ "interval" ], "tooltipVariant": "single" }, "hiddenLegendFields": [], "fieldMapping": { "timestamp": "timeframe", "leftAxisValues": [ "count()" ], "leftAxisDimensions": [ "event.provider" ] }, "leftYAxisSettings": { "scale": "linear" }, "truncationMode": "middle", "valueRepresentation": "absolute" }, "singleValue": { "showLabel": true, "label": "", "prefixIcon": "", "recordField": "timestamp", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": true } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [ [ "Repository" ] ], "columnWidths": { "[\"event.provider_product\"]": 187.3975830078125, "[\"affected_entity.id\"]": 574.390625, "[\"container_image.registry\"]": 230.46875, "[\"container_image.repository\"]": 269.65625, "[\"container_image.tag\"]": 208.75, "[\"timestamp\"]": 170.96875, "[\"critical\"]": 113.125, "[\"high\"]": 97.78125, "[\"vulnerabilities\"]": 176, "[\"Id\"]": 211.38751220703125, "[\"Repository\"]": 264.375 } }, "honeycomb": { "shape": "square", "dataMappings": { "value": "interval" }, "legend": "auto", "displayedFields": [ "event.provider" ], "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "interval", "rangeAxis": "" } ], "variant": "single", "displayedFields": [ "event.provider" ] }, "autoSelectVisualization": false }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "17": { "type": "data", "title": "Total scan events", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize the events\n| summarize {scanEvents=count()}", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "singleValue", "visualizationSettings": { "thresholds": [], "chartSettings": { "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "absolute", "groupingThresholdValue": 0, "valueType": "absolute" }, "categoryOverrides": { "NOT_AVAILABLE": { "color": "var(--dt-colors-charts-logstatus-none-default, #2c2f3f)", "added": 1713354177614 } }, "categoricalBarChartSettings": { "categoryAxisLabel": "vulnerability.risk.level", "valueAxisLabel": "registries" }, "hiddenLegendFields": [], "colorPalette": "security-risk-level" }, "singleValue": { "showLabel": false, "label": "", "prefixIcon": "", "recordField": "scanEvents", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [], "columnWidths": {} }, "honeycomb": { "shape": "square", "dataMappings": { "value": "scanEvents" }, "displayedFields": [ null ], "legend": { "hidden": false, "position": "auto" }, "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "scanEvents", "rangeAxis": "" } ], "variant": "single", "displayedFields": [] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "18": { "type": "data", "title": "Repository coverage based on products and number of scans", "query": "fetch events\n| filter dt.system.bucket == \"default_security_custom_events\"\n| filter event.kind == \"SECURITY_EVENT\"\n AND event.type == \"VULNERABILITY_SCAN\"\n AND object.type==\"CONTAINER_IMAGE\"\n// variable fields\n| filter in(event.provider, $Product)\n AND in(container_image.registry, $Registry)\n AND in(container_image.repository, $Repository)\n AND iAny(in(container_image.tags[], $Tag))\n// now enrich the runtime context\n| join [\n fetch dt.entity.container_group_instance, from:now()-3h\n | fieldsAdd entity.name, containerImageDigest, containerImageName, workloadName, containerStatus, processes=contains[dt.entity.process_group_instance]\n | expand dt.entity.process=processes\n | fieldsRemove processes\n | join [\n fetch dt.entity.process_group_instance, from:now()-3h\n ], on:{left[dt.entity.process]==right[id]}, kind:leftOuter, fields:{releasesProduct, releasesStage}\n], on:{left[container_image.digest]==right[containerImageDigest]}, kind:leftOuter,\n fields:{container_instance.id=id, container_instance.name=entity.name, container_image.name=containerImageName,\n releasesProduct, releasesStage, containerStatus}\n| parse containerStatus, \"\"\"LD* \"state=\" LD:containerStatus (\"}\" | \",\")\"\"\"\n| fieldsAdd containerStatus=if(isNull(containerStatus),\"not running\",else:containerStatus)\n| fieldsAdd releasesStage=if(isNull(releasesStage), \"None\", else:releasesStage)\n| filter in(containerStatus, $RuntimeStatus) AND in(releasesStage,$ProductStage)\n// summarize findings\n| summarize {`Scan events`=count(), \n `Scanning products`=collectDistinct(event.provider)}, \n by:{\n Repository=container_image.repository, \n Tags=container_image.tags}\n| sort `Scan events` desc\n| limit 50", "davis": { "enabled": false, "davisVisualization": { "isAvailable": true } }, "visualization": "table", "visualizationSettings": { "thresholds": [ { "id": 1, "field": "Risk level", "title": "", "isEnabled": true, "rules": [ { "id": 2, "color": { "Default": "var(--dt-colors-charts-loglevel-emergency-default, #9033a3)" }, "comparator": "=", "label": "", "value": "CRITICAL" }, { "id": 3, "color": { "Default": "var(--dt-colors-charts-categorical-color-12-default, #cd3741)" }, "comparator": "=", "label": "", "value": "HIGH" }, { "id": 4, "color": { "Default": "var(--dt-colors-charts-categorical-color-14-default, #d56b1a)" }, "comparator": "=", "label": "", "value": "MEDIUM" } ] } ], "chartSettings": { "xAxisScaling": "analyzedTimeframe", "gapPolicy": "connect", "circleChartSettings": { "groupingThresholdType": "relative", "groupingThresholdValue": 0, "valueType": "relative" }, "categoryOverrides": {}, "categoricalBarChartSettings": { "categoryAxisLabel": "Repository", "valueAxisLabel": "Scan events", "categoryAxis": "Repository", "valueAxis": [ "Scan events" ], "tooltipVariant": "single" }, "hiddenLegendFields": [], "truncationMode": "middle" }, "singleValue": { "showLabel": true, "label": "", "prefixIcon": "", "recordField": "timestamp", "autoscale": true, "alignment": "center", "colorThresholdTarget": "value", "trend": { "trendType": "auto", "isVisible": false } }, "table": { "rowDensity": "condensed", "enableSparklines": false, "hiddenColumns": [], "lineWrapIds": [ [ "Repository" ] ], "columnWidths": { "[\"event.provider_product\"]": 187.3975830078125, "[\"affected_entity.id\"]": 574.390625, "[\"container_image.registry\"]": 230.46875, "[\"container_image.repository\"]": 269.65625, "[\"container_image.tag\"]": 208.75, "[\"timestamp\"]": 170.96875, "[\"critical\"]": 113.125, "[\"high\"]": 97.78125, "[\"vulnerabilities\"]": 176, "[\"Id\"]": 211.38751220703125, "[\"Repository\"]": 264.375 } }, "honeycomb": { "shape": "square", "dataMappings": { "value": "Scan events" }, "legend": "auto", "displayedFields": [ "Repository" ], "colorMode": "color-palette", "colorPalette": "blue" }, "histogram": { "dataMappings": [ { "valueAxis": "Scan events", "rangeAxis": "" } ], "variant": "single", "displayedFields": [ "Repository" ] } }, "querySettings": { "maxResultRecords": 1000, "defaultScanLimitGbytes": 500, "maxResultMegaBytes": 100, "defaultSamplingRatio": 10, "enableSampling": false } }, "19": { "type": "markdown", "title": "", "content": "##### Most recent container image scan events\n----" } }, "layouts": { "0": { "x": 0, "y": 21, "w": 24, "h": 13 }, "1": { "x": 0, "y": 0, "w": 24, "h": 2 }, "4": { "x": 3, "y": 8, "w": 10, "h": 12 }, "11": { "x": 0, "y": 11, "w": 3, "h": 3 }, "12": { "x": 0, "y": 14, "w": 3, "h": 3 }, "13": { "x": 0, "y": 17, "w": 3, "h": 3 }, "14": { "x": 0, "y": 8, "w": 3, "h": 3 }, "15": { "x": 0, "y": 6, "w": 24, "h": 2 }, "16": { "x": 3, "y": 2, "w": 21, "h": 4 }, "17": { "x": 0, "y": 2, "w": 3, "h": 4 }, "18": { "x": 13, "y": 8, "w": 11, "h": 12 }, "19": { "x": 0, "y": 20, "w": 24, "h": 1 } }, "importedWithCode": false, "settings": { "defaultTimeframe": { "value": { "from": "now()-7d", "to": "now()" }, "enabled": true } } }

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

1002

1003

1004

1005

1006

1007

1008

1009

1010

1011

1012

1013

1014

1015

1016

1017

1018

1019

1020

1021

1022

1023

1024

1025

1026

1027

1028

1029

1030

1031

1032

1033

1034

1035

1036

1037

1038

1039

1040

1041

1042

1043

1044

1045

1046

1047

1048

1049

1050

1051

1052

1053

1054

1055

1056

1057

1058

1059

1060

1061

1062

1063

1064

1065

1066

1067

1068

1069

1070

1071

1072

1073

1074

1075