QCrypton PQC Engine for Sentinel Solution

.script/tests/KqlvalidationsTests/CustomTables/PQCEngine_CL.json

@@ -0,0 +1,92 @@
+{ "Name": "PQCEngine_CL",
+"Properties":[
+  {
+    "Name": "TenantId",
+    "Type": "String"
+  },
+  {
+    "Name": "SourceSystem",
+    "Type": "String"
+  },
+  {
+    "Name": "MG",
+    "Type": "String"
+  },
+  {
+    "Name": "ManagementGroupName",
+    "Type": "String"
+  },
+  {
+    "Name": "TimeGenerated",
+    "Type": "DateTime"
+  },
+  {
+    "Name": "Computer",
+    "Type": "String"
+  },
+  {
+    "Name": "RawData",
+    "Type": "String"
+  },
+  {
+    "Name": "InstanceId",
+    "Type": "String"
+  },
+  {
+    "Name": "Hostname",
+    "Type": "String"
+  },
+  {
+    "Name": "EventType",
+    "Type": "String"
+  },
+  {
+    "Name": "Algorithm",
+    "Type": "String"
+  },
+  {
+    "Name": "Operation",
+    "Type": "String"
+  },
+  {
+    "Name": "PeerGroups",
+    "Type": "String"
+  },
+  {
+    "Name": "NegotiatedGroup",
+    "Type": "String"
+  },
+  {
+    "Name": "CipherSuite",
+    "Type": "String"
+  },
+  {
+    "Name": "ClientClass",
+    "Type": "String"
+  },
+  {
+    "Name": "PQCOffered",
+    "Type": "Int32"
+  },
+  {
+    "Name": "PQCNegotiated",
+    "Type": "Int32"
+  },
+  {
+    "Name": "Success",
+    "Type": "Int32"
+  },
+  {
+    "Name": "Detail",
+    "Type": "String"
+  },
+  {
+    "Name": "Metadata",
+    "Type": "String"
+  },
+  {
+    "Name": "_ResourceId",
+    "Type": "String"
+  }
+]
+}

.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

@@ -370,5 +370,7 @@
   "RedRaysSAPSecurityFindings",
   "NetcraftIntegrationGatewayDefinition",
   "HoneyForge",
-  "QCryptonPQCScanner"
+  "QCryptonPQCScanner",
+  "QCryptonPQCEngine",
+  "QCryptonPQCVPNOverlay"
 ]

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Analytic_Rules/HighClassicalClientRate.yaml

@@ -0,0 +1,37 @@
+id: ad4e5f6a-7b8c-4d9e-0f1a-2b3c4d5e6f7a
+name: High percentage of classical-only clients on PQC Engine
+description: |
+  More than 50% of TLS handshakes on a PQC Engine instance in the last 24 hours were from
+  classical-only clients that did not offer any post-quantum key exchange groups. These
+  connections are not protected against harvest-now-decrypt-later attacks. Consider requiring
+  PQC-capable TLS libraries or upgrading connecting services to OpenSSL 3.5+ or BoringSSL with
+  ML-KEM support.
+severity: Informational
+requiredDataConnectors:
+  - connectorId: QCryptonPQCEngine
+    dataTypes:
+      - PQCEngine_CL
+queryFrequency: P1D
+queryPeriod: P1D
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Discovery
+relevantTechniques:
+  - T1082
+query: |
+  PQCEngine_CL
+  | where TimeGenerated > ago(1d)
+  | where EventType == "handshake"
+  | summarize Total = count(), Classical = countif(ClientClass in ("classical", "legacy")) by Hostname, InstanceId
+  | extend ClassicalPct = round(100.0 * Classical / Total, 1)
+  | where ClassicalPct > 50
+  | project Hostname, InstanceId, Total, Classical, ClassicalPct
+  | order by ClassicalPct desc
+entityMappings:
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: Hostname
+version: 1.0.0
+kind: Scheduled

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Analytic_Rules/KEMOperationFailureSpike.yaml

@@ -0,0 +1,36 @@
+id: be5f6a7b-8c9d-4e0f-1a2b-3c4d5e6f7a8b
+name: KEM operation failure spike on PQC Engine
+description: |
+  An elevated rate of KEM (Key Encapsulation Mechanism) operation failures was detected on a
+  PQC Engine instance. This may indicate incompatible ML-KEM implementations between client and
+  server, corrupted key material, memory constraints on the F5 BIG-IP, or a misconfigured PQC
+  Engine provider. Investigate the failing algorithm and operation type.
+severity: Medium
+requiredDataConnectors:
+  - connectorId: QCryptonPQCEngine
+    dataTypes:
+      - PQCEngine_CL
+queryFrequency: PT1H
+queryPeriod: PT1H
+triggerOperator: gt
+triggerThreshold: 5
+tactics:
+  - Impact
+relevantTechniques:
+  - T1499
+query: |
+  PQCEngine_CL
+  | where TimeGenerated > ago(1h)
+  | where EventType == "kem_op"
+  | where Success == 0
+  | summarize FailureCount = count(), Algorithms = make_set(Algorithm, 5), Operations = make_set(Operation, 5) by Hostname, InstanceId
+  | where FailureCount > 5
+  | project Hostname, InstanceId, FailureCount, Algorithms, Operations
+  | order by FailureCount desc
+entityMappings:
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: Hostname
+version: 1.0.0
+kind: Scheduled

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Analytic_Rules/PQCDowngradeOnEngine.yaml

@@ -0,0 +1,36 @@
+id: 9c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f
+name: PQC downgrade on engine -- client offered hybrid but classical negotiated
+description: |
+  A TLS handshake completed where the client offered post-quantum hybrid key exchange groups but
+  the F5 BIG-IP negotiated a classical-only group. This may indicate PQC Engine misconfiguration,
+  an intermediate device stripping PQC groups from the ClientHello, or the engine running in
+  monitor mode rather than enforce mode. Investigate the negotiated vs offered groups.
+severity: High
+requiredDataConnectors:
+  - connectorId: QCryptonPQCEngine
+    dataTypes:
+      - PQCEngine_CL
+queryFrequency: PT1H
+queryPeriod: PT1H
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - InitialAccess
+  - Collection
+relevantTechniques:
+  - T1557
+  - T1040
+query: |
+  PQCEngine_CL
+  | where TimeGenerated > ago(1h)
+  | where EventType == "handshake"
+  | where PQCOffered == 1 and PQCNegotiated == 0
+  | project TimeGenerated, Hostname, InstanceId, NegotiatedGroup, PeerGroups, CipherSuite, ClientClass, Detail
+  | order by TimeGenerated desc
+entityMappings:
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: Hostname
+version: 1.0.0
+kind: Scheduled

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Analytic_Rules/PolicyBlockDetected.yaml

@@ -0,0 +1,33 @@
+id: 7a1b2c3d-4e5f-4a6b-7c8d-9e0f1a2b3c4d
+name: PQC Engine policy blocked a TLS handshake
+description: |
+  The PQC Engine crypto policy enforcement blocked a TLS handshake that did not meet minimum
+  requirements. This may indicate a client attempting to connect with banned cipher suites,
+  blocked key exchange groups, or TLS versions below the policy minimum. Review the blocked
+  algorithm and client to determine if policy adjustment or client upgrade is needed.
+severity: High
+requiredDataConnectors:
+  - connectorId: QCryptonPQCEngine
+    dataTypes:
+      - PQCEngine_CL
+queryFrequency: PT1H
+queryPeriod: PT1H
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - InitialAccess
+relevantTechniques:
+  - T1190
+query: |
+  PQCEngine_CL
+  | where TimeGenerated > ago(1h)
+  | where EventType == "policy_block"
+  | project TimeGenerated, Hostname, InstanceId, Algorithm, NegotiatedGroup, CipherSuite, ClientClass, Detail
+  | order by TimeGenerated desc
+entityMappings:
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: Hostname
+version: 1.0.0
+kind: Scheduled

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Analytic_Rules/PolicyUpgradeActivity.yaml

@@ -0,0 +1,34 @@
+id: cf6a7b8c-9d0e-4f1a-2b3c-4d5e6f7a8b9c
+name: PQC Engine policy upgraded cipher selection
+description: |
+  The PQC Engine policy engine upgraded the cipher selection for one or more TLS handshakes.
+  This occurs when the engine is in enforce mode and the initial negotiation would have used a
+  weaker algorithm than the policy allows. The engine intervened to select a stronger (typically
+  PQ-hybrid) algorithm. This is an expected and positive signal when enforcement is enabled.
+severity: Informational
+requiredDataConnectors:
+  - connectorId: QCryptonPQCEngine
+    dataTypes:
+      - PQCEngine_CL
+queryFrequency: P1D
+queryPeriod: P1D
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - DefenseEvasion
+relevantTechniques:
+  - T1600
+query: |
+  PQCEngine_CL
+  | where TimeGenerated > ago(1d)
+  | where EventType == "policy_upgrade"
+  | summarize UpgradeCount = count(), Algorithms = make_set(Algorithm, 10) by Hostname, InstanceId
+  | project Hostname, InstanceId, UpgradeCount, Algorithms
+  | order by UpgradeCount desc
+entityMappings:
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: Hostname
+version: 1.0.0
+kind: Scheduled

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Analytic_Rules/VulnerableAlgorithmDetected.yaml

@@ -0,0 +1,34 @@
+id: 8b2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
+name: Vulnerable classical algorithm detected in TLS negotiation
+description: |
+  The PQC Engine vulnerability database flagged a quantum-vulnerable algorithm during a TLS
+  handshake or cryptographic operation on F5 BIG-IP. Algorithms such as RSA-2048, ECDSA P-256,
+  or Ed25519 are vulnerable to Shor's algorithm on a cryptographically relevant quantum computer.
+  Migrate to PQ-hybrid algorithms (X25519+ML-KEM-768) to protect against harvest-now-decrypt-later
+  attacks.
+severity: High
+requiredDataConnectors:
+  - connectorId: QCryptonPQCEngine
+    dataTypes:
+      - PQCEngine_CL
+queryFrequency: PT1H
+queryPeriod: PT1H
+triggerOperator: gt
+triggerThreshold: 0
+tactics:
+  - Collection
+relevantTechniques:
+  - T1040
+query: |
+  PQCEngine_CL
+  | where TimeGenerated > ago(1h)
+  | where EventType == "vuln_detected"
+  | project TimeGenerated, Hostname, InstanceId, Algorithm, Operation, ClientClass, PQCOffered, Detail
+  | order by TimeGenerated desc
+entityMappings:
+  - entityType: Host
+    fieldMappings:
+      - identifier: HostName
+        columnName: Hostname
+version: 1.0.0
+kind: Scheduled

Solutions/QCryptonPQCEngine/pqc-engine/sentinel-solution/Data/Solution_QCryptonPQCEngine.json

@@ -0,0 +1,24 @@
+{
+  "Name": "QCryptonPQCEngine",
+  "Author": "QCrypton, Inc.",
+  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/qcrypton.svg\" width=\"75px\" height=\"75px\">",
+  "Description": "Runtime cryptographic telemetry from QCrypton PQC Engine, an OpenSSL 3.x provider for F5 BIG-IP that adds ML-KEM-768/1024 and ML-DSA-65/87 post-quantum algorithms. Ingests handshake negotiations, KEM operations, policy enforcement events, vulnerable algorithm detections, and client classification into the **PQCEngine_CL** table via the Codeless Connector Framework (RestApiPoller). Ships with 1 data connector, 6 analytic rules, workbook, and Teams-notification playbook.\n\n  **Underlying Microsoft Technologies used:** \n\n This solution takes a dependency on the following technologies, and some of these dependencies either may be in [Preview](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) state or might result in additional ingestion or operational costs:\n\n• [Microsoft Sentinel Codeless Connector Framework](https://aka.ms/Sentinel-CCP_Platform)",
+  "Data Connectors": [
+    "Data_Connectors/QCryptonPQCEngine_CCF/QCryptonPQCEngine_ConnectorDefinition.json"
+  ],
+  "Workbooks": ["Workbooks/QCryptonPQCEnginePosture.json"],
+  "Analytic Rules": [
+    "Analytic_Rules/PolicyBlockDetected.yaml",
+    "Analytic_Rules/VulnerableAlgorithmDetected.yaml",
+    "Analytic_Rules/PQCDowngradeOnEngine.yaml",
+    "Analytic_Rules/HighClassicalClientRate.yaml",
+    "Analytic_Rules/KEMOperationFailureSpike.yaml",
+    "Analytic_Rules/PolicyUpgradeActivity.yaml"
+  ],
+  "Playbooks": ["Playbooks/QCryptonPQCEngine-Notify/azuredeploy.json"],
+  "Metadata": "SolutionMetadata.json",
+  "BasePath": "Solutions/QCryptonPQCEngine",
+  "Version": "1.0.0",
+  "TemplateSpec": true,
+  "Is1PConnector": false
+}