Cortex Cloud Posture Badges
This dashboard visually tracks the achievement of crucial cloud security posture objectives, presented as a series of badges. Key metrics measure progress across security module adoption, risk reduction for attack paths and identity issues, and the efficiency of case and alert remediation.
Cortex Insights ENABLED
Details
| ID | 548583625c2a4479b6d125a098c6152d |
|---|---|
| From Version | 6.10.0 |
Screenshot
Widgets (15)
Exposure and Risk Management - BRONZE
This widget displays a status confirming if agentless scanning is active on at least one cloud account. This provides quick validation that the foundational step for gaining visibility into your cloud environment has been taken.
Custom XQL wordcloud
dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = "ADS" and classification= "Scanned", account, null)) as ads_enabled_accounts | alter ads_enabled_ratio = divide(ads_enabled_accounts , total_accounts ) | alter agentless_enabled_percentage = multiply(ads_enabled_ratio , 100) | alter agentless_enabled_percentage = round(agentless_enabled_percentage ) | alter status = if(agentless_enabled_percentage >0, "Achieved", "Not Currently Passing") | view graph type = wordcloud header = "Enable Agentless Scanning" xaxis = status yaxis = ads_enabled_accounts default_limit = `false` headcolor = "#eaeaeb" word_color = "#ab4141" multi_color = `true` font = "Arial Black" headerfontsize = 20
Exposure and Risk Management - SILVER
This widget displays the percentage reduction of risky attack paths by comparing the count from two consecutive time periods. It provides a quick visual indicator of whether security remediation efforts are effective in reducing the organization's overall attack surface.
Custom XQL wordcloud
config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", xdm.issue.observation_time ) | filter xdm.issue.category = "ATTACK_PATH" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues , previous_issues), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues , previous_issues) | alter status = if(percent_burndown < 0 and percent_burndown < -25, "Achieved", "Not Currently Passing" ) | filter previous_issues != null | view graph type = wordcloud header = "25% Reduction in Risky Attack Paths" xaxis = status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
Exposure and Risk Management - GOLD
This widget displays whether the goal of resolving 100% of all security cases from the last 30 days has been achieved. It provides a clear, at-a-glance indicator of the security team's effectiveness in meeting its complete case remediation target.
Custom XQL wordcloud
config timeframe = 30d | dataset = cases | top xdm.case.status_progress | filter xdm.case.status_progress = "RESOLVED" | alter status = if (top_percent != 100, "Not Currently Passing", "Achieved") | view graph type = wordcloud header = "Remediation of all Cases" xaxis = status yaxis = top_percent multi_color = `true` font = "Arial Black" headerfontsize = 20
Data Security - Bronze
This widget displays the percentage of connected cloud accounts with the Data Security Posture Management (DSPM) capability successfully enabled. This metric provides a foundational view of your data security posture, indicating the initial adoption of DSPM across your cloud assets.
Custom XQL wordcloud
dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = "DSPM" and classification= "Success", account, null)) as dspm_enabled_accounts | alter dspm_enabled_ratio = divide(dspm_enabled_accounts , total_accounts ) | alter dspm_enabled_percentage = multiply(dspm_enabled_ratio , 100) | alter dspm_enabled_percentage = round(dspm_enabled_percentage) | alter status = if(dspm_enabled_percentage >0, "Achieved", "Not Currently Passing") | view graph type = wordcloud header = "Cloud Connector enabled with DSPM" xaxis = status yaxis = dspm_enabled_percentage multi_color = `true` font = "Arial Black" headerfontsize = 20
Data Security - Silver
This widget displays the percentage of your organization's data stores that have been successfully classified. It provides a clear metric for your data classification coverage, which is essential for identifying and protecting sensitive information.
Custom XQL wordcloud
dataset = asset_inventory | join type = left (dataset = dspm_asset_data_profiles) as dspm xdm.asset.id = dspm.asset_id | filter xdm.asset.type.class = "Data" | comp count_distinct(asset_id ) as classified_assets, count_distinct(xdm.asset.id ) as total_dspm_assets | alter classified_dspm_assets_ratio = divide(classified_assets , total_dspm_assets ) | alter classified_dspm_assets_percentage = multiply(classified_dspm_assets_ratio , 100)| alter classified_dspm_assets_percentage = round(classified_dspm_assets_percentage ) | alter status = if(classified_dspm_assets_ratio > 75, "Achieved ", "Not Currently Passing") | view graph type = wordcloud header = "75% percent of data stores classified" xaxis = status yaxis = classified_dspm_assets_percentage multi_color = `true` font = "Arial Black" headerfontsize = 20
Data Security - Gold
This widget displays the percentage change of new data security issues, comparing the count from the most recent 16-day period to the previous one. It provides a key performance indicator to track progress against the goal of reducing new data-related issues period-over-period.
Custom XQL wordcloud
config timeframe = 30d | dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", xdm.issue.observation_time ) | filter xdm.issue.category = "DATA" and xdm.issue.status.progress = "NEW" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues , previous_issues ), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues , previous_issues ) | alter status = if(percent_burndown <0 and percent_burndown < -20, "Achieved", "Not Currently Passing") | filter previous_issues != null | view graph type = wordcloud header = "Number of Data Issues has gone down by 20%" xaxis = status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
Identity Management -Bronze
This widget displays the number of cloud accounts that have successfully enabled the Cloud Infrastructure Entitlement Management (CIEM) capability. This provides a foundational view of your CIEM adoption, confirming the initial step has been taken to gain visibility and control over cloud permissions.
Custom XQL wordcloud
dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = "Identity Security" and classification= "Success", account, null)) as ciem_enabled_accounts | alter ciem_enabled_ratio = divide(ciem_enabled_accounts , total_accounts ) | alter ciem_enabled_percentage = multiply(ciem_enabled_ratio , 100) | alter ciem_enabled_percentage = round(ciem_enabled_percentage) | alter status = if(ciem_enabled_percentage >0, "Achieved", "Not Currently Passing") | view graph type = wordcloud header = "Onboarded Cloud Data Source with CIEM" xaxis = status yaxis = ciem_enabled_accounts multi_color = `true` font = "Arial Black" headerfontsize = 20
Identity Management -Silver
This widget tracks the percentage of resolved identity management issues to indicate whether a 50% remediation target has been achieved. It provides a quick, at-a-glance measure of the team's operational effectiveness in handling identity-based alerts.
Custom XQL wordcloud
dataset = issues | filter xdm.issue.category = "IDENTITY" | comp count_distinct(xdm.issue.id ) as total_identity_issues, count_distinct(if(xdm.issue.status.progress = "RESOLVED",xdm.issue.id , 0)) as resolved_identity_issues | alter resolved_identity_issues_ratio = divide(resolved_identity_issues , total_identity_issues ) | alter resolved_identity_issues_percentage = multiply(resolved_identity_issues_ratio , 100) | alter resolved_identity_issues_percentage = round(resolved_identity_issues_percentage) |alter status = if(resolved_identity_issues_percentage > 50, "Achieved", "Not Currently Passing") | view graph type = wordcloud header = "50% of IAM Alerts Remediated" xaxis = status yaxis = resolved_identity_issues_percentage multi_color = `true` font = "Arial Black" headerfontsize = 20
Identity Management -Gold
This widget displays the percentage change in new identity-related issues between two consecutive periods within the last 30 days. It provides a clear visual indicator of whether the team has achieved its goal of reducing new identity issues by more than 20%.
Custom XQL wordcloud
config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", xdm.issue.observation_time ) | filter xdm.issue.category = "IDENTITY" and xdm.issue.status.progress = "NEW" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract( num_of_issues, previous_issues ), previous_issues),100)) | alter issues_resolved = subtract( num_of_issues, previous_issues ) | alter status = if(percent_burndown <0 and percent_burndown <-20, "Achieved", "Not Currently Passing") | filter previous_issues != null | view graph type = wordcloud header = "Number of Identity Issues has gone down by 20%" xaxis = status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
Remediation - Bronze
This widget displays the percentage change in Mean Time to Remediate (MTTR) by comparing the most recent period against the previous one. It provides a clear, at-a-glance status on remediation efficiency and tracks progress against the defined 30% improvement target.
Custom XQL wordcloud
config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,"DAY") < 31 | bin creation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , "DAY") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -30, "Achieved", "Not Currently Passing") | filter previous_MTTR != null | view graph type = wordcloud header = "30% change in Issue MTTR" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
Remediation - Silver
This widget displays whether the team has achieved the target of reducing incident Mean Time to Remediate (MTTR) by 60% over the last 30 days. It provides an at-a-glance assessment of remediation efficiency, helping to track progress against critical operational targets.
Custom XQL wordcloud
config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,"DAY") < 31 | bin creation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , "DAY") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -60, "Achieved", "Not Currently Passing") | filter previous_MTTR != null | view graph type = wordcloud header = "60% change in Issue MTTR" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
Remediation - Gold
This widget displays the period-over-period percentage change in Mean Time to Resolution (MTTR) for resolved incidents. This allows security operations to track performance against the "Gold" standard goal of reducing incident resolution times by 90%.
Custom XQL wordcloud
config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,"DAY") < 31 | bin creation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , "DAY") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -90, "Achieved", "Not Currently Passing") | filter previous_MTTR != null | view graph type = wordcloud header = "90% change in Issue MTTR" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
Visibility into the environment - Bronze
This widget displays an 'Achieved' status when two or more cloud accounts are successfully onboarded for security posture monitoring. Achieving this status provides immediate confirmation that the organization has established a foundational level of multi-account cloud visibility.
Custom XQL wordcloud
dataset = cloud_health_auditing | comp count_distinct(account) as cspm_enabled_accounts | filter cspm_enabled_accounts > 1 | alter status = if(cspm_enabled_accounts > 1, "Achieved", "Not Currently Passing") | view graph type = wordcloud header = "Onboard cloud accounts" xaxis = status yaxis = cspm_enabled_accounts multi_color = `true` font = "Arial Black" headerfontsize = 20
Visibility into the environment - Silver
This widget displays the percentage of unmanaged shadow IT assets relative to the total number of assets in your environment. It provides a clear, at-a-glance status of whether your organization is meeting the security goal of keeping unmanaged assets below a 30% threshold.
Custom XQL wordcloud
dataset = asset_inventory | comp count_distinct(xdm.asset.id ) as total_assets, count_distinct(if(xdm.asset.type.class = "External Surface", xdm.asset.id , null)) as shadow_asset_count | alter shadow_assets_ratio = divide(shadow_asset_count , total_assets ) | alter shadow_assets_percentage = multiply(shadow_assets_ratio , 100) | alter shadow_assets_percentage = round(shadow_assets_percentage) |alter status = if(shadow_assets_percentage > 30, "Not Currently Passing", "Achieved") | view graph type = wordcloud header = "Unmanaged/Shadow IT Assets are less than 30% of the assets" xaxis = status yaxis = shadow_assets_percentage multi_color = `true` font = "Arial Black" headerfontsize = 20
Visibility into the environment - Gold
This widget tracks the percentage change of new, critical configuration issues, comparing the most recent 16-day period to the previous one. This provides a direct measure of your team's effectiveness in reducing the introduction of high-risk misconfigurations to meet strategic burndown goals.
Custom XQL wordcloud
config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp("%Y/%m/%d %H:%M:%S", xdm.issue.observation_time ) | filter xdm.issue.category = "CONFIGURATION" and xdm.issue.severity = ENUM.CRITICAL and xdm.issue.status.progress = "NEW" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues, previous_issues), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues, previous_issues ) | alter status = if(percent_burndown < 0 and percent_burndown < 20, "Achieved", "Not Currently Passing") | filter previous_issues != null | view graph type = wordcloud header = "Reduction of Critical Misconfigurations by 20%" xaxis = status yaxis = percent_burndown multi_color = `true` font = "Arial Black" headerfontsize = 20
{ "dashboards_data": [ { "id": "548583625c2a4479b6d125a098c6152d", "name": "Cortex Cloud Posture Badges", "description": "This dashboard visually tracks the achievement of crucial cloud security posture objectives, presented as a series of badges. Key metrics measure progress across security module adoption, risk reduction for attack paths and identity issues, and the efficiency of case and alert remediation.", "status": "ENABLED", "layout": [ { "id": "row-1475", "data": [ { "key": "xql_1769493468661", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 453, "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = \"ADS\" and classification= \"Scanned\", account, null)) as ads_enabled_accounts | alter ads_enabled_ratio = divide(ads_enabled_accounts , total_accounts ) | alter agentless_enabled_percentage = multiply(ads_enabled_ratio , 100) | alter agentless_enabled_percentage = round(agentless_enabled_percentage ) | alter status = if(agentless_enabled_percentage >0, \"Achieved\", \"Not Currently Passing\")\n\n\n\n| view graph type = wordcloud header = \"Enable Agentless Scanning\" xaxis = status yaxis = ads_enabled_accounts default_limit = `false` headcolor = \"#eaeaeb\" word_color = \"#ab4141\" multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Enable Agentless Scanning\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "ads_enabled_accounts" } }, { "command": { "op": "=", "name": "default_limit", "value": "false" } }, { "command": { "op": "=", "name": "headcolor", "value": "\"#eaeaeb\"" } }, { "command": { "op": "=", "name": "word_color", "value": "\"#ab4141\"" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769546209438", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 453, "phrase": "config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"ATTACK_PATH\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues , previous_issues), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues , previous_issues) | alter status = if(percent_burndown < 0 and percent_burndown < -25, \"Achieved\", \"Not Currently Passing\" ) | filter previous_issues != null\n\n\n| view graph type = wordcloud header = \"25% Reduction in Risky Attack Paths\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"25% Reduction in Risky Attack Paths\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769547003370", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 453, "phrase": "config timeframe = 30d | dataset = cases | top xdm.case.status_progress | filter xdm.case.status_progress = \"RESOLVED\" | alter status = if (top_percent != 100, \"Not Currently Passing\", \"Achieved\")\n| view graph type = wordcloud header = \"Remediation of all Cases\" xaxis = status yaxis = top_percent multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Remediation of all Cases\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "top_percent" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } } ] }, { "id": "row-109", "data": [ { "key": "xql_1769551741051", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 453, "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = \"DSPM\" and classification= \"Success\", account, null)) as dspm_enabled_accounts | alter dspm_enabled_ratio = divide(dspm_enabled_accounts , total_accounts ) | alter dspm_enabled_percentage = multiply(dspm_enabled_ratio , 100) | alter dspm_enabled_percentage = round(dspm_enabled_percentage) | alter status = if(dspm_enabled_percentage >0, \"Achieved\", \"Not Currently Passing\")\n| view graph type = wordcloud header = \"Cloud Connector enabled with DSPM\" xaxis = status yaxis = dspm_enabled_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Cloud Connector enabled with DSPM\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "dspm_enabled_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769551966365", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 453, "phrase": "dataset = asset_inventory | join type = left (dataset = dspm_asset_data_profiles) as dspm xdm.asset.id = dspm.asset_id | filter xdm.asset.type.class = \"Data\" | comp count_distinct(asset_id ) as classified_assets, count_distinct(xdm.asset.id ) as total_dspm_assets | alter classified_dspm_assets_ratio = divide(classified_assets , total_dspm_assets ) | alter classified_dspm_assets_percentage = multiply(classified_dspm_assets_ratio , 100)| alter classified_dspm_assets_percentage = round(classified_dspm_assets_percentage ) | alter status = if(classified_dspm_assets_ratio > 75, \"Achieved \", \"Not Currently Passing\")\n\n| view graph type = wordcloud header = \"75% percent of data stores classified\" xaxis = status yaxis = classified_dspm_assets_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"75% percent of data stores classified\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "classified_dspm_assets_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769571329113", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 453, "phrase": "config timeframe = 30d | dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"DATA\" and xdm.issue.status.progress = \"NEW\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues , previous_issues ), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues , previous_issues ) | alter status = if(percent_burndown <0 and percent_burndown < -20, \"Achieved\", \"Not Currently Passing\") | filter previous_issues != null\n\n| view graph type = wordcloud header = \"Number of Data Issues has gone down by 20%\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Number of Data Issues has gone down by 20%\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } } ] }, { "id": "row-2000", "data": [ { "key": "xql_1769571788713", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = \"Identity Security\" and classification= \"Success\", account, null)) as ciem_enabled_accounts | alter ciem_enabled_ratio = divide(ciem_enabled_accounts , total_accounts ) | alter ciem_enabled_percentage = multiply(ciem_enabled_ratio , 100) | alter ciem_enabled_percentage = round(ciem_enabled_percentage) | alter status = if(ciem_enabled_percentage >0, \"Achieved\", \"Not Currently Passing\")\n\n| view graph type = wordcloud header = \"Onboarded Cloud Data Source with CIEM\" xaxis = status yaxis = ciem_enabled_accounts multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Onboarded Cloud Data Source with CIEM\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "ciem_enabled_accounts" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769572000809", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "dataset = issues | filter xdm.issue.category = \"IDENTITY\" | comp count_distinct(xdm.issue.id ) as total_identity_issues, count_distinct(if(xdm.issue.status.progress = \"RESOLVED\",xdm.issue.id , 0)) as resolved_identity_issues | alter resolved_identity_issues_ratio = divide(resolved_identity_issues , total_identity_issues ) | alter resolved_identity_issues_percentage = multiply(resolved_identity_issues_ratio , 100) | alter resolved_identity_issues_percentage = round(resolved_identity_issues_percentage) |alter status = if(resolved_identity_issues_percentage > 50, \"Achieved\", \"Not Currently Passing\")\n| view graph type = wordcloud header = \"50% of IAM Alerts Remediated\" xaxis = status yaxis = resolved_identity_issues_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"50% of IAM Alerts Remediated\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "resolved_identity_issues_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769572349743", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"IDENTITY\" and xdm.issue.status.progress = \"NEW\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract( num_of_issues, previous_issues ), previous_issues),100)) | alter issues_resolved = subtract( num_of_issues, previous_issues ) | alter status = if(percent_burndown <0 and percent_burndown <-20, \"Achieved\", \"Not Currently Passing\") | filter previous_issues != null\n\n| view graph type = wordcloud header = \"Number of Identity Issues has gone down by 20%\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Number of Identity Issues has gone down by 20%\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } } ] }, { "id": "row-7226", "data": [ { "key": "xql_1769572967342", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,\"DAY\") < 31 | bin creation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , \"DAY\") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -30, \"Achieved\", \"Not Currently Passing\") | filter previous_MTTR != null\n| view graph type = wordcloud header = \"30% change in Issue MTTR\" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"30% change in Issue MTTR\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "query_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769573124259", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,\"DAY\") < 31 | bin creation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , \"DAY\") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -60, \"Achieved\", \"Not Currently Passing\") | filter previous_MTTR != null\n| view graph type = wordcloud header = \"60% change in Issue MTTR\" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"60% change in Issue MTTR\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "query_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769573209373", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,\"DAY\") < 31 | bin creation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , \"DAY\") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -90, \"Achieved\", \"Not Currently Passing\") | filter previous_MTTR != null\n\n\n| view graph type = wordcloud header = \"90% change in Issue MTTR\" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"90% change in Issue MTTR\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "query_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } } ] }, { "id": "row-4995", "data": [ { "key": "xql_1769573426343", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as cspm_enabled_accounts | filter cspm_enabled_accounts > 1 | alter status = if(cspm_enabled_accounts > 1, \"Achieved\", \"Not Currently Passing\")\n\n| view graph type = wordcloud header = \"Onboard cloud accounts\" xaxis = status yaxis = cspm_enabled_accounts multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Onboard cloud accounts\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "cspm_enabled_accounts" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769573543727", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "dataset = asset_inventory | comp count_distinct(xdm.asset.id ) as total_assets, count_distinct(if(xdm.asset.type.class = \"External Surface\", xdm.asset.id , null)) as shadow_asset_count | alter shadow_assets_ratio = divide(shadow_asset_count , total_assets ) | alter shadow_assets_percentage = multiply(shadow_assets_ratio , 100) | alter shadow_assets_percentage = round(shadow_assets_percentage) |alter status = if(shadow_assets_percentage > 30, \"Not Currently Passing\", \"Achieved\")\n\n| view graph type = wordcloud header = \"Unmanaged/Shadow IT Assets are less than 30% of the assets\" xaxis = status yaxis = shadow_assets_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Unmanaged/Shadow IT Assets are less than 30% of the assets\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "shadow_assets_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } }, { "key": "xql_1769573665596", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 400, "phrase": "config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"CONFIGURATION\" and xdm.issue.severity = ENUM.CRITICAL and xdm.issue.status.progress = \"NEW\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues, previous_issues), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues, previous_issues ) | alter status = if(percent_burndown < 0 and percent_burndown < 20, \"Achieved\", \"Not Currently Passing\") | filter previous_issues != null\n| view graph type = wordcloud header = \"Reduction of Critical Misconfigurations by 20%\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Reduction of Critical Misconfigurations by 20%\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } } } ] } ], "default_dashboard_id": 1, "global_id": "548583625c2a4479b6d125a098c6152d", "metadata": { "params": [] } } ], "widgets_data": [ { "widget_key": "xql_1769573426343", "title": "Visibility into the environment - Bronze", "creation_time": 1769718599892, "description": "This widget displays an 'Achieved' status when two or more cloud accounts are successfully onboarded for security posture monitoring. Achieving this status provides immediate confirmation that the organization has established a foundational level of multi-account cloud visibility.", "data": { "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as cspm_enabled_accounts | filter cspm_enabled_accounts > 1 | alter status = if(cspm_enabled_accounts > 1, \"Achieved\", \"Not Currently Passing\")\n\n| view graph type = wordcloud header = \"Onboard cloud accounts\" xaxis = status yaxis = cspm_enabled_accounts multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Onboard cloud accounts\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "cspm_enabled_accounts" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "cloud_health_auditing" ], "query_uses_library": false } }, { "widget_key": "xql_1769571329113", "title": "Data Security - Gold", "creation_time": 1769718601185, "description": "This widget displays the percentage change of new data security issues, comparing the count from the most recent 16-day period to the previous one. It provides a key performance indicator to track progress against the goal of reducing new data-related issues period-over-period.", "data": { "phrase": "config timeframe = 30d | dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"DATA\" and xdm.issue.status.progress = \"NEW\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues , previous_issues ), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues , previous_issues ) | alter status = if(percent_burndown <0 and percent_burndown < -20, \"Achieved\", \"Not Currently Passing\") | filter previous_issues != null\n\n| view graph type = wordcloud header = \"Number of Data Issues has gone down by 20%\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Number of Data Issues has gone down by 20%\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "issues" ], "query_uses_library": false } }, { "widget_key": "xql_1769546209438", "title": "Exposure and Risk Management - SILVER", "creation_time": 1769718603637, "description": "This widget displays the percentage reduction of risky attack paths by comparing the count from two consecutive time periods. It provides a quick visual indicator of whether security remediation efforts are effective in reducing the organization's overall attack surface.", "data": { "phrase": "config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"ATTACK_PATH\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues , previous_issues), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues , previous_issues) | alter status = if(percent_burndown < 0 and percent_burndown < -25, \"Achieved\", \"Not Currently Passing\" ) | filter previous_issues != null\n\n\n| view graph type = wordcloud header = \"25% Reduction in Risky Attack Paths\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"25% Reduction in Risky Attack Paths\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "issues" ], "query_uses_library": false } }, { "widget_key": "xql_1769551741051", "title": "Data Security - Bronze", "creation_time": 1769718602440, "description": "This widget displays the percentage of connected cloud accounts with the Data Security Posture Management (DSPM) capability successfully enabled. This metric provides a foundational view of your data security posture, indicating the initial adoption of DSPM across your cloud assets.", "data": { "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = \"DSPM\" and classification= \"Success\", account, null)) as dspm_enabled_accounts | alter dspm_enabled_ratio = divide(dspm_enabled_accounts , total_accounts ) | alter dspm_enabled_percentage = multiply(dspm_enabled_ratio , 100) | alter dspm_enabled_percentage = round(dspm_enabled_percentage) | alter status = if(dspm_enabled_percentage >0, \"Achieved\", \"Not Currently Passing\")\n| view graph type = wordcloud header = \"Cloud Connector enabled with DSPM\" xaxis = status yaxis = dspm_enabled_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Cloud Connector enabled with DSPM\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "dspm_enabled_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "cloud_health_auditing" ], "query_uses_library": false } }, { "widget_key": "xql_1769547003370", "title": "Exposure and Risk Management - GOLD", "creation_time": 1769718599795, "description": "This widget displays whether the goal of resolving 100% of all security cases from the last 30 days has been achieved. It provides a clear, at-a-glance indicator of the security team's effectiveness in meeting its complete case remediation target.", "data": { "phrase": "config timeframe = 30d | dataset = cases | top xdm.case.status_progress | filter xdm.case.status_progress = \"RESOLVED\" | alter status = if (top_percent != 100, \"Not Currently Passing\", \"Achieved\")\n| view graph type = wordcloud header = \"Remediation of all Cases\" xaxis = status yaxis = top_percent multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Remediation of all Cases\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "top_percent" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "cases" ], "query_uses_library": false } }, { "widget_key": "xql_1769493468661", "title": "Exposure and Risk Management - BRONZE", "creation_time": 1769718600054, "description": "This widget displays a status confirming if agentless scanning is active on at least one cloud account. This provides quick validation that the foundational step for gaining visibility into your cloud environment has been taken.", "data": { "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = \"ADS\" and classification= \"Scanned\", account, null)) as ads_enabled_accounts | alter ads_enabled_ratio = divide(ads_enabled_accounts , total_accounts ) | alter agentless_enabled_percentage = multiply(ads_enabled_ratio , 100) | alter agentless_enabled_percentage = round(agentless_enabled_percentage ) | alter status = if(agentless_enabled_percentage >0, \"Achieved\", \"Not Currently Passing\")\n\n\n\n| view graph type = wordcloud header = \"Enable Agentless Scanning\" xaxis = status yaxis = ads_enabled_accounts default_limit = `false` headcolor = \"#eaeaeb\" word_color = \"#ab4141\" multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Enable Agentless Scanning\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "ads_enabled_accounts" } }, { "command": { "op": "=", "name": "default_limit", "value": "false" } }, { "command": { "op": "=", "name": "headcolor", "value": "\"#eaeaeb\"" } }, { "command": { "op": "=", "name": "word_color", "value": "\"#ab4141\"" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "cloud_health_auditing" ], "query_uses_library": false } }, { "widget_key": "xql_1769573543727", "title": "Visibility into the environment - Silver", "creation_time": 1769718602976, "description": "This widget displays the percentage of unmanaged shadow IT assets relative to the total number of assets in your environment. It provides a clear, at-a-glance status of whether your organization is meeting the security goal of keeping unmanaged assets below a 30% threshold.", "data": { "phrase": "dataset = asset_inventory | comp count_distinct(xdm.asset.id ) as total_assets, count_distinct(if(xdm.asset.type.class = \"External Surface\", xdm.asset.id , null)) as shadow_asset_count | alter shadow_assets_ratio = divide(shadow_asset_count , total_assets ) | alter shadow_assets_percentage = multiply(shadow_assets_ratio , 100) | alter shadow_assets_percentage = round(shadow_assets_percentage) |alter status = if(shadow_assets_percentage > 30, \"Not Currently Passing\", \"Achieved\")\n\n| view graph type = wordcloud header = \"Unmanaged/Shadow IT Assets are less than 30% of the assets\" xaxis = status yaxis = shadow_assets_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Unmanaged/Shadow IT Assets are less than 30% of the assets\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "shadow_assets_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "asset_inventory" ], "query_uses_library": false } }, { "widget_key": "xql_1769572967342", "title": "Remediation - Bronze", "creation_time": 1769718602789, "description": "This widget displays the percentage change in Mean Time to Remediate (MTTR) by comparing the most recent period against the previous one. It provides a clear, at-a-glance status on remediation efficiency and tracks progress against the defined 30% improvement target.", "data": { "phrase": "config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,\"DAY\") < 31 | bin creation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , \"DAY\") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -30, \"Achieved\", \"Not Currently Passing\") | filter previous_MTTR != null\n| view graph type = wordcloud header = \"30% change in Issue MTTR\" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"30% change in Issue MTTR\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "query_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "incidents" ], "query_uses_library": false } }, { "widget_key": "xql_1769573209373", "title": "Remediation - Gold", "creation_time": 1769718602220, "description": "This widget displays the period-over-period percentage change in Mean Time to Resolution (MTTR) for resolved incidents. This allows security operations to track performance against the \"Gold\" standard goal of reducing incident resolution times by 90%.", "data": { "phrase": "config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,\"DAY\") < 31 | bin creation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , \"DAY\") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -90, \"Achieved\", \"Not Currently Passing\") | filter previous_MTTR != null\n\n\n| view graph type = wordcloud header = \"90% change in Issue MTTR\" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"90% change in Issue MTTR\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "query_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "incidents" ], "query_uses_library": false } }, { "widget_key": "xql_1769551966365", "title": "Data Security - Silver", "creation_time": 1769718601885, "description": "This widget displays the percentage of your organization's data stores that have been successfully classified. It provides a clear metric for your data classification coverage, which is essential for identifying and protecting sensitive information.", "data": { "phrase": "dataset = asset_inventory | join type = left (dataset = dspm_asset_data_profiles) as dspm xdm.asset.id = dspm.asset_id | filter xdm.asset.type.class = \"Data\" | comp count_distinct(asset_id ) as classified_assets, count_distinct(xdm.asset.id ) as total_dspm_assets | alter classified_dspm_assets_ratio = divide(classified_assets , total_dspm_assets ) | alter classified_dspm_assets_percentage = multiply(classified_dspm_assets_ratio , 100)| alter classified_dspm_assets_percentage = round(classified_dspm_assets_percentage ) | alter status = if(classified_dspm_assets_ratio > 75, \"Achieved \", \"Not Currently Passing\")\n\n| view graph type = wordcloud header = \"75% percent of data stores classified\" xaxis = status yaxis = classified_dspm_assets_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"75% percent of data stores classified\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "classified_dspm_assets_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "dspm_asset_data_profiles", "asset_inventory" ], "query_uses_library": false } }, { "widget_key": "xql_1769571788713", "title": "Identity Management -Bronze", "creation_time": 1769718603156, "description": "This widget displays the number of cloud accounts that have successfully enabled the Cloud Infrastructure Entitlement Management (CIEM) capability. This provides a foundational view of your CIEM adoption, confirming the initial step has been taken to gain visibility and control over cloud permissions.", "data": { "phrase": "dataset = cloud_health_auditing | comp count_distinct(account) as total_accounts, count_distinct(if(capability = \"Identity Security\" and classification= \"Success\", account, null)) as ciem_enabled_accounts | alter ciem_enabled_ratio = divide(ciem_enabled_accounts , total_accounts ) | alter ciem_enabled_percentage = multiply(ciem_enabled_ratio , 100) | alter ciem_enabled_percentage = round(ciem_enabled_percentage) | alter status = if(ciem_enabled_percentage >0, \"Achieved\", \"Not Currently Passing\")\n\n| view graph type = wordcloud header = \"Onboarded Cloud Data Source with CIEM\" xaxis = status yaxis = ciem_enabled_accounts multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Onboarded Cloud Data Source with CIEM\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "ciem_enabled_accounts" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "cloud_health_auditing" ], "query_uses_library": false } }, { "widget_key": "xql_1769572000809", "title": "Identity Management -Silver", "creation_time": 1769718604283, "description": "This widget tracks the percentage of resolved identity management issues to indicate whether a 50% remediation target has been achieved. It provides a quick, at-a-glance measure of the team's operational effectiveness in handling identity-based alerts.", "data": { "phrase": "dataset = issues | filter xdm.issue.category = \"IDENTITY\" | comp count_distinct(xdm.issue.id ) as total_identity_issues, count_distinct(if(xdm.issue.status.progress = \"RESOLVED\",xdm.issue.id , 0)) as resolved_identity_issues | alter resolved_identity_issues_ratio = divide(resolved_identity_issues , total_identity_issues ) | alter resolved_identity_issues_percentage = multiply(resolved_identity_issues_ratio , 100) | alter resolved_identity_issues_percentage = round(resolved_identity_issues_percentage) |alter status = if(resolved_identity_issues_percentage > 50, \"Achieved\", \"Not Currently Passing\")\n| view graph type = wordcloud header = \"50% of IAM Alerts Remediated\" xaxis = status yaxis = resolved_identity_issues_percentage multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"50% of IAM Alerts Remediated\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "resolved_identity_issues_percentage" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "issues" ], "query_uses_library": false } }, { "widget_key": "xql_1769572349743", "title": "Identity Management -Gold", "creation_time": 1769718600474, "description": "This widget displays the percentage change in new identity-related issues between two consecutive periods within the last 30 days. It provides a clear visual indicator of whether the team has achieved its goal of reducing new identity issues by more than 20%.", "data": { "phrase": "config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"IDENTITY\" and xdm.issue.status.progress = \"NEW\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract( num_of_issues, previous_issues ), previous_issues),100)) | alter issues_resolved = subtract( num_of_issues, previous_issues ) | alter status = if(percent_burndown <0 and percent_burndown <-20, \"Achieved\", \"Not Currently Passing\") | filter previous_issues != null\n\n| view graph type = wordcloud header = \"Number of Identity Issues has gone down by 20%\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Number of Identity Issues has gone down by 20%\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "issues" ], "query_uses_library": false } }, { "widget_key": "xql_1769573124259", "title": "Remediation - Silver", "creation_time": 1769718603894, "description": "This widget displays whether the team has achieved the target of reducing incident Mean Time to Remediate (MTTR) by 60% over the last 30 days. It provides an at-a-glance assessment of remediation efficiency, helping to track progress against critical operational targets.", "data": { "phrase": "config timeframe = 30d | dataset = incidents | filter timestamp_diff(current_time(),creation_time,\"DAY\") < 31 | bin creation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", creation_time ) | filter resolved_ts != null and creation_time != null | alter resolution_time_in_days = timestamp_diff(resolved_ts, creation_time , \"DAY\") | comp avg(ceil(resolution_time_in_days)) as MTTR_in_days by creation_time | sort desc creation_time | windowcomp lag(MTTR_in_days ) sort asc creation_time as previous_MTTR | alter percent_burndown = round(multiply(divide(subtract(MTTR_in_days , previous_MTTR), previous_MTTR),100)) | alter issues_resolved = subtract(MTTR_in_days , previous_MTTR) | alter query_status = if(percent_burndown <0 and percent_burndown < -60, \"Achieved\", \"Not Currently Passing\") | filter previous_MTTR != null\n| view graph type = wordcloud header = \"60% change in Issue MTTR\" xaxis = query_status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"60% change in Issue MTTR\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "query_status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "incidents" ], "query_uses_library": false } }, { "widget_key": "xql_1769573665596", "title": "Visibility into the environment - Gold", "creation_time": 1769718604778, "description": "This widget tracks the percentage change of new, critical configuration issues, comparing the most recent 16-day period to the previous one. This provides a direct measure of your team's effectiveness in reducing the introduction of high-risk misconfigurations to meet strategic burndown goals.", "data": { "phrase": "config timeframe = 30d |dataset in (issues) | bin xdm.issue.observation_time span = 16d | alter date = format_timestamp(\"%Y/%m/%d %H:%M:%S\", xdm.issue.observation_time ) | filter xdm.issue.category = \"CONFIGURATION\" and xdm.issue.severity = ENUM.CRITICAL and xdm.issue.status.progress = \"NEW\" | comp count(xdm.issue.id) as num_of_issues by date | sort desc date | windowcomp lag(num_of_issues) sort asc date as previous_issues | alter percent_burndown = round(multiply(divide(subtract(num_of_issues, previous_issues), previous_issues),100)) | alter issues_resolved = subtract(num_of_issues, previous_issues ) | alter status = if(percent_burndown < 0 and percent_burndown < 20, \"Achieved\", \"Not Currently Passing\") | filter previous_issues != null\n| view graph type = wordcloud header = \"Reduction of Critical Misconfigurations by 20%\" xaxis = status yaxis = percent_burndown multi_color = `true` font = \"Arial Black\" headerfontsize = 20 ", "timeSpan": { "toTime": "now", "fromTime": "30d", "isRelative": true }, "time_frame": { "relativeTime": 86400000 }, "viewOptions": { "type": "wordcloud", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"Reduction of Critical Misconfigurations by 20%\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "status" } }, { "command": { "op": "=", "name": "yaxis", "value": "percent_burndown" } }, { "command": { "op": "=", "name": "multi_color", "value": "true" } }, { "command": { "op": "=", "name": "font", "value": "\"Arial Black\"" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "20" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [ "issues" ], "query_uses_library": false } } ], "fromVersion": "6.10.0" }