Just built a custom dashboard for our Azure spend vs. security posture - here's the config.

After several quarters of correlating our cloud security findings with financial operations data, a persistent gap became evident: our security and finance teams were effectively speaking different languages, using disparate dashboards that prevented a unified view of cost-to-risk ratios. While Prisma Cloud's native Compliance and Asset Inventory dashboards are excellent for pure security posture analysis, they lack the inherent ability to layer in Azure Cost Management data for a true FinSecOps perspective. I've addressed this by constructing a custom integration that marries Prisma Cloud's CSPM findings with Azure's billing APIs.

The objective was to create a single pane of glass to answer questions like: "Which resource groups with critical vulnerabilities are incurring the highest monthly compute spend?" or "What percentage of our total Azure bill is attributable to resources missing foundational security controls?" The implementation involves three core components:

1. **Data Extraction:** Scheduled scripts to pull normalized data from both sources.
* From Prisma Cloud's API, I fetch asset inventory with critical/high severity findings, grouped by Azure subscription ID and resource group.
* From Azure Cost Management API, I pull amortized cost data for the same period, broken down by the same dimensions.

2. **Transformation & Enrichment:** A middleware service (written in Python) joins the datasets on subscription and resource group, calculating key metrics.
```python
# Example join logic for the key metric: Cost-at-Risk
for rg in prisma_asset_data:
rg_cost = azure_cost_data.get(rg.id, 0)
# Weight findings: Critical=1.0, High=0.7
risk_score = sum(f.weight for f in rg.findings)
rg.cost_at_risk = rg_cost * (risk_score / max(1, rg.resource_count))
aggregated_data.append(rg)
```

3. **Visualization:** The enriched data is pushed to a Grafana instance, configured with the following primary panels:
* A time-series graph showing "Monthly Spend" vs. "Resources with Critical Findings" over the last 6 months.
* A top-N table of resource groups ranked by the derived `cost_at_risk` metric.
* A breakdown pie chart showing the proportion of total spend covered by resources that are `compliant` vs. `non-compliant` with our internal security benchmark.

Initial results have been revealing. We identified three development resource groups accounting for 22% of our monthly Azure compute spend, yet they contained over 60% of the critical cloud security findings (primarily publicly accessible storage containers and unencrypted managed disks). This data-driven insight allowed us to prioritize remediation with a clear financial impact statement, securing immediate stakeholder buy-in for the engineering effort.

The primary limitation remains the latency of the data; this is not real-time but a daily snapshot, which is sufficient for trend analysis. I am interested in whether other community members have undertaken similar integrations, particularly if you've found ways to incorporate Prisma Cloud's alert-based event data (rather than just inventory snapshots) for a more dynamic view of "active threat cost exposure." Furthermore, any experiences with benchmarking the typical `cost_at_risk` percentage for a well-governed Azure environment would provide a valuable reference point for our maturity assessment.

— Isabella G.