[Gunjan Jain (gunjanmj)]

Change(s):

• Added QCrypton PQC (Post-Quantum Cryptography) Scanner solution for Microsoft Sentinel
• Added QCrypton logo (Logos/qcrypton.svg)
• Added 6 Analytic Rules: AppServiceLegacyTLS, CertExpiresAfter2030Classical, NewQuantumVulnerableResource,
  QuantumVulnerableKVKey, QuantumVulnerableEntraCert, WeakTLSCertOnGateway
• Added Data Connector for QCryptonPQCScanner
• Added QCryptonPQReadiness Workbook
• Added QCryptonPQC-Notify Playbook
• Added Solution package (mainTemplate.json, createUiDefinition.json)
• Added SolutionMetadata.json and ReleaseNotes.md

Reason for Change(s):

New solution submission — QCrypton PQC Scanner helps organizations identify quantum-vulnerable
cryptographic assets (certificates, keys, TLS configurations) in their Azure environment to prepare
for post-quantum cryptography migration.

Version Updated:

Yes — initial version 3.0.0

Testing Completed:

Yes — tested in a Microsoft Sentinel environment with no custom parsers, functions, or tables. All
analytic rules, data connector, workbook, and playbook validated successfully.

Checked that the validations are passing and have addressed any issues that are present:

Yes

[Gunjan Jain (gunjanmj)]

@microsoft-github-policy-service agree company="QCrypton, Inc"

[Copilot]

Note

Copilot was unable to run its full agentic suite in this review.

Pull request overview

Introduces the QCrypton PQC Scanner Microsoft Sentinel solution package, including a data connector, analytic rules, workbook, and Teams-notification playbook for tracking post-quantum cryptography readiness.

Changes:

• Added workbook, data connector, and 5 scheduled analytic rule templates targeting quantum-vulnerable assets.
• Added a Teams notification playbook (Logic App) and solution packaging artifacts (ARM template + UI definition).
• Added solution metadata + release notes.

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Solutions/QCryptonPQCScanner/Workbooks/QCryptonPQReadiness.json	Adds PQ readiness workbook with parameterized KQL visualizations.
Solutions/QCryptonPQCScanner/SolutionMetadata.json	Adds publisher/offer metadata and support contact details.
Solutions/QCryptonPQCScanner/ReleaseNotes.md	Adds initial release notes entry for the solution.
Solutions/QCryptonPQCScanner/Playbooks/QCryptonPQC-Notify/azuredeploy.json	Adds Logic App playbook template to post incidents to Teams.
Solutions/QCryptonPQCScanner/Package/testParameters.json	Adds ARM test parameters used for packaging/validation.
Solutions/QCryptonPQCScanner/Package/mainTemplate.json	Adds the solution’s main ARM template packaging connector/rules/workbook/playbook.
Solutions/QCryptonPQCScanner/Package/createUiDefinition.json	Adds install-time UI for selecting the Log Analytics workspace.
Solutions/QCryptonPQCScanner/Data/QCryptonPQCScanner.json	Adds solution manifest referencing included artifacts and version.
Solutions/QCryptonPQCScanner/Data Connectors/QCryptonPQCScanner.json	Adds Customizable data connector definition for PQReadiness_CL.
Solutions/QCryptonPQCScanner/Analytic Rules/*.yaml	Adds 5 analytic rule templates for vulnerable PQ posture detections.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[v-skharode]

We are putting your PR on hold because your solution is not Sentinel Codeless Connector Framework (CCF). We would be happy to work with you to migrate your solution to CCF. Please contact the Microsoft Sentinel Partners at AzureSentinelPartner@microsoft.com to discuss available options.

[v-skharode]

Follow-up:
We are awaiting your response to the review feedback shared earlier. Please provide an update on the requested changes and let us know once they have been addressed so we can continue the review process.

[Gunjan Jain (gunjanmj)]

Hello v-skharode thankyou for the feedback. working on the pull-based CCF-based solution. will update soon!

[Gunjan Jain (gunjanmj)]

v-skharode Could you please review the changes again? I have replaced push-based to pull-based CCF Solution.

[v-skharode]

Kindly add both black-and-white preview images to the workbook preview images folder and also add the images/logo under the Workbooks/Images/Preview path. Additionally, please also add the required README.md under QCryptonPQC-Notify, package the solution with version 3.0.0, and update the release notes accordingly.
Please regenerate the package after correcting the stale QCryptonPQC solution and logo references. Also provide the required Function App exception/approval evidence and deployment, invocation, and ingestion test results.

[Gunjan Jain (gunjanmj)]

v-skharode Addressed review comments in new commit. Could you please review the changes again? Thanks!

[Gunjan Jain (gunjanmj)]

v-skharode Could you please let me know updates on this PR?

[Gunjan Jain (gunjanmj)]

Gunjan Jain (Gunjan Jain (@gunjanmj)) Could you please share screenshots showing the connector in a running/connected state along with the corresponding ingestion/log evidence for validation?

v-skharode I do not have the connector in running/connected state.

v-skharode v-atulyadav any updates on this PR?

[v-skharode]

Gunjan Jain (@gunjanmj) Thanks for sharing the screenshots. The connector currently shows Disconnected, and the schema/analytics screenshots do not yet confirm successful data ingestion. Could you please share:

• A screenshot showing the connector in a Connected state
• Recent ingested records from PQCReadiness_CL with timestamps
• Confirmation that the package version mismatch has been resolved
• Confirmation that the empty ApiKeyIdentifier validation finding has been addressed and ARM-TTK passes after regeneration

These validations are still required before the review can be completed.

[Gunjan Jain (gunjanmj)]

• package version

v-skharode Attached are the screenshots.

Note: IDs Should Be Derived From ResourceIDs filtered out in CI pipeline.

[v-skharode]

Hi Gunjan Jain (@gunjanmj)
Thanks for the evidence. ARM-TTK reports 49/50 passed. Could you confirm the failed test is the documented ID check exception and that the ApiKeyIdentifier finding is resolved?

[Gunjan Jain (gunjanmj)]

Hi Gunjan Jain (Gunjan Jain (@gunjanmj)) Thanks for the evidence. ARM-TTK reports 49/50 passed. Could you confirm the failed test is the documented ID check exception and that the ApiKeyIdentifier finding is resolved?

[v-skharode]

hi again Gunjan Jain (@gunjanmj)
Thanks for sharing the updated ARM-TTK results. The remaining failure appears to match the documented ID-based exception. Could you share the filtered CI/wrapper result and confirm it was run against commit 7cf3a98 and package 3.0.0?

I verified that the package uses ApiKey/ApiKeyName and does not contain ApiKeyIdentifier, so that concern is resolved.

I still see the Entra certificate rule missing from the solution manifest, a Release Notes header mismatch, playbook metadata/authentication issues, and blank workbook preview images. Please address these items before approval.

[Gunjan Jain (gunjanmj)]

hi again Gunjan Jain (Gunjan Jain (@gunjanmj)) Thanks for sharing the updated ARM-TTK results. The remaining failure appears to match the documented ID-based exception. Could you share the filtered CI/wrapper result and confirm it was run against commit 7cf3a98 and package 3.0.0?

I verified that the package uses ApiKey/ApiKeyName and does not contain ApiKeyIdentifier, so that concern is resolved.

I still see the Entra certificate rule missing from the solution manifest, a Release Notes header mismatch, playbook metadata/authentication issues, and blank workbook preview images. Please address these items before approval.

[Gunjan Jain (gunjanmj)]

v-atulyadav v-skharode any updates on this PR? by when can this be merged?

[Gunjan Jain (gunjanmj)]

v-skharode v-atulyadav please approve the PR before you try to merge it. the pipeline will succeed.

[v-skharode]

Will run a final re-review for this PR before the approval.

[v-skharode]

Hey Gunjan Jain (@gunjanmj)
Everything else looks good, and the PR looks ready for approval once these two points are addressed:

• The source contains six analytic rules, but the deployment sandbox shows only five. Please regenerate the package and confirm all six appear under Analytics.
• The logo is not loading in the sandbox. Please verify the logo URL.

[Gunjan Jain (gunjanmj)]

Hey Gunjan Jain (Gunjan Jain (@gunjanmj)) Everything else looks good, and the PR looks ready for approval once these two points are addressed:

• The source contains six analytic rules, but the deployment sandbox shows only five. Please regenerate the package and confirm all six appear under Analytics.
• The logo is not loading in the sandbox. Please verify the logo URL.

v-skharode the logo url will load after merge in master branch. please re- review. thanks!

[v-skharode]

Thanks for the updates. Please address these two remaining points before approval:

• The logo is approximately 124 KB, exceeding the repository’s 5 KB limit. Please replace it with an optimized SVG; merging will resolve URL availability, but not the size issue.
• All six analytic rules are missing the required status field. Please add status: Available if they are production-ready.

[v-skharode]

Hey Gunjan Jain (@gunjanmj)
Thanks for addressing the feedback, Approving the PR. Please just also wire TeamsGroupId and TeamsChannelId into the workflow parameters, or substitute them using ARM expressions, so the Teams action can resolve these values. Thanks!!

[Gunjan Jain (gunjanmj)]

v-skharode v-atulyadav Thank you for merging the PR. QCrypton's solution integrates with Sentinel, Entra ID, and Defender. We meet all three MISA membership requirements — could you nominate QCrypton for MISA, or connect me with the right Program manager to initiate the nomination? Looking forward to continuing to build on this partnership.