@extends('layouts.main') @section('title', 'Cybersecurity Dashboard') @section('breadcrumb')

Cybersecurity Dashboard

@endsection @inject('splunk_searches', '\App\Models\SplunkSearches') @php $dashboard = 'Cybersecurity Dashboard'; $wCyberCondition = $splunk_searches::getIdByName('Global Cybersecurity Condition', $dashboard); $wThreatLevel = $splunk_searches::getIdByName('Threat Level', $dashboard); $wActiveGNEs = $splunk_searches::getIdByName('Active Critical/High GNEs', $dashboard); $wExposure = $splunk_searches::getIdByName('Exposure Pressure', $dashboard); $wProtection = $splunk_searches::getIdByName('Protection Effectiveness', $dashboard); $wWorkflow = $splunk_searches::getIdByName('Cybersecurity Workflow Health', $dashboard); $wRiskDrivers = $splunk_searches::getIdByName('Active Risk Drivers', $dashboard); $wThreatIntel = $splunk_searches::getIdByName('Threat & Validation Intelligence', $dashboard); $wControlMatrix = $splunk_searches::getIdByName('Protection Effectiveness Control Matrix', $dashboard); $wExposureIntel = $splunk_searches::getIdByName('Exposure Intelligence', $dashboard); $wRemediation = $splunk_searches::getIdByName('Remediation Execution', $dashboard); $wBottlenecks = $splunk_searches::getIdByName('Operational Bottlenecks', $dashboard); $wPersistentPress = $splunk_searches::getIdByName('Persistent Threat Pressure', $dashboard); $wIdentity = $splunk_searches::getIdByName('Identity & Access Intelligence', $dashboard); $wIoT = $splunk_searches::getIdByName('IoT/OT Exposure', $dashboard); $tooltips = [ 'Global Cybersecurity Condition' => 'Overall cybersecurity posture in one 0-100 score. Blends active risk/exposure, validated protection gaps, threat pressure, and case-workflow execution. Higher is worse; the color shows the condition band.', 'Threat Level' => 'Current threat intensity for this client: severity-weighted open GNEs plus the severity mix of attacks blocked in the last 7 days. 0-100, higher is worse.', 'Active Critical/High GNEs' => 'Number of open critical/high GLESEC Notable Events (GNEs) for this client right now. The arrow shows the change vs 24 hours ago. Higher is worse.', 'Exposure Pressure' => 'Pressure from critical/high vulnerabilities on this client\'s internet-facing assets, weighted by CAD business impact, with a minor IoT-risk component. 0-100, higher is worse.', 'Protection Effectiveness' => 'Protection GAP validated by breach-and-attack simulation: how much of the latest Cymulate testing was NOT prevented. 0-100, higher is worse (a gap score, not an effectiveness percent).', 'Cybersecurity Workflow Health' => 'Whether security cases (GNE-driven Notable Event Alerts) are being answered and closed on time. Blends resolution SLA, overdue open cases, queue pressure, and backlog growth into one 0-100 score. Higher is worse.', 'Active Risk Drivers' => 'The top 10 active security cases ranked by priority, age, persistent attack overlap, and vulnerability pressure - what needs action now.', 'Threat & Validation Intelligence' => 'The malware families and threat actors most relevant to this client per MSS-INT correlation, with the client\'s current Risk Score / Threat Risk Score (RS/TRS).', 'Protection Effectiveness Control Matrix' => 'Per-control protection status: breach-and-attack-validated risk per control, deployment from the client\'s service stack, and firewall/IPS activity. Higher gap score is worse.', 'Exposure Intelligence' => 'Top exposures across three classes - external/internal vulnerabilities, IoT/OT devices, and the discovered internet domain surface - ranked by score with CAD business impact.', 'Remediation Execution' => 'Weekly cases created vs closed over the last 12 weeks - is remediation keeping pace with inflow?', 'Operational Bottlenecks' => 'Where case execution is stuck: unanswered and stalled cases by service, with worst age and 7-day backlog growth. Degraded = a critical-priority case past SLA.', 'Persistent Threat Pressure' => 'The attacker-to-target pairs hitting this client repeatedly over the last 30 days: blocked volume, share of total, trend vs the prior 30 days, and target business impact.', 'Identity & Access Intelligence' => 'Identity risk from Duo two-factor telemetry over the last 7 days: a 0-100 risk score plus auth failures, denied rate, lockouts, fraud flags, and at-risk users.', 'IoT/OT Exposure' => 'Inventoried IoT/OT devices with risk, management status, and business impact; flags unmanaged critical devices, with a fleet summary row.', ]; @endphp @section('content') {{-- Report / Docs buttons --}}
@include('dashboards.ecsm.incl_report_button', ['report_name' => 'Cybersecurity Dashboard Report']) @include('dashboards.ecsm.incl_docs_button', ['docs' => \App\Models\SplunkDashboards::getDocuments('Cybersecurity Dashboard')])
{{-- Global Time Range Selector --}}
{{-- TOP ROW: 6 Gauge Widgets --}}
@foreach([ $wCyberCondition => 'Global Cybersecurity Condition', $wThreatLevel => 'Threat Level', $wActiveGNEs => 'Active Critical/High GNEs', $wExposure => 'Exposure Pressure', $wProtection => 'Protection Effectiveness', $wWorkflow => 'Cybersecurity Workflow Health', ] as $wId => $wName) @if($wId)

{{ $wName }} @if(!empty($tooltips[$wName])) @endif

{!! $splunk_searches::getCodeArray([$wId], $from, $to) !!}
@endif @endforeach
{{-- /top row gauges --}} {{-- BOTTOM WIDGETS --}}
@php $bottomWidgets = [ // Row 2 — 3 widgets ['id' => $wRiskDrivers, 'name' => 'Active Risk Drivers', 'class' => 'col-xl-4', 'scroll' => true], ['id' => $wThreatIntel, 'name' => 'Threat & Validation Intelligence', 'class' => 'col-xl-4'], ['id' => $wControlMatrix, 'name' => 'Protection Effectiveness Control Matrix', 'class' => 'col-xl-4'], // Row 3 — 3 widgets ['id' => $wExposureIntel, 'name' => 'Exposure Intelligence', 'class' => 'col-xl-4', 'scroll' => true], ['id' => $wRemediation, 'name' => 'Remediation Execution', 'class' => 'col-xl-4', 'chart' => true], ['id' => $wBottlenecks, 'name' => 'Operational Bottlenecks', 'class' => 'col-xl-4'], // Row 4 — 3 widgets ['id' => $wPersistentPress, 'name' => 'Persistent Threat Pressure', 'class' => 'col-xl-4', 'scroll' => true], ['id' => $wIdentity, 'name' => 'Identity & Access Intelligence', 'class' => 'col-xl-4'], ['id' => $wIoT, 'name' => 'IoT/OT Exposure', 'class' => 'col-xl-4', 'scroll' => true], ]; @endphp @foreach($bottomWidgets as $w) @if($w['id'])

{{ $w['name'] }} @if(!empty($tooltips[$w['name']])) @endif

{!! $splunk_searches::getCodeArray([$w['id']], $from, $to) !!}
@endif @endforeach
{{-- /bottom widgets --}} {{-- News --}}
@include('dashboards.ecsm.news_top')
@endsection @section('scripts') @endsection @section('top_scripts') @endsection