AppSec Executive Dashboard Starter

This repository is a Git-friendly Power BI starter for an executive application-security dashboard. It uses PBIP, PBIR, and TMDL so report logic, semantic-model definitions, SQL, and documentation can be reviewed like code instead of trapped in a binary .pbix.

Why this project exists

Security leaders need a dashboard that tells a clear operational story: how much risk is open, whether SLA compliance is improving, and where attention is needed next. This starter is designed to make that story easy to build, version, and explain.

It is also built to be easy to review in public or private GitHub workflows, which makes it useful for:

• recruiters who want to see measurable dashboard and data-modeling work
• leaders who want a reusable executive reporting pattern
• community members who want a clean, inspectable Power BI project starter

What is in the repo

• AppSec.Report - report definition pointer and generated PBIR content
• AppSec.SemanticModel - semantic model definition in TMDL
• data/sample - small sample CSVs for local prototyping
• docs - metric definitions, layout guidance, and build instructions
• powerbi/themes - custom Power BI theme JSON
• sql/views - warehouse view contract for production data

What to look at first

If you are reviewing this as a recruiter or hiring leader, start with:

1. docs/report-layout.md for the executive narrative and visual layout.
2. docs/metric-definitions.md for the KPIs and month-over-month measures.
3. sql/views/appsec_dashboard_views.sql for the reporting contract and aggregation logic.
4. README.md for the repository workflow and scope.

If you are using this as a community starter, the key files are:

• appsec-dashboard.pbip for opening the project in Power BI Desktop
• AppSec.SemanticModel/definition/ for the model metadata
• powerbi/themes/appsec-theme.json for the visual theme

Repository layout

.
├── AppSec.Report/
│   └── definition.pbir
├── AppSec.SemanticModel/
│   ├── .pbi/
│   │   └── editorSettings.json
│   ├── definition/
│   │   ├── database.tmdl
│   │   ├── model.tmdl
│   │   ├── relationships.tmdl
│   │   └── tables/
│   │       ├── Date.tmdl
│   │       └── Vulnerabilities.tmdl
│   └── definition.pbism
├── data/
│   └── sample/
├── docs/
├── powerbi/
│   └── themes/
├── sql/
│   └── views/
├── .gitignore
└── appsec-dashboard.pbip

What this dashboard demonstrates

• a Git-based workflow for Power BI assets
• executive KPIs for risk, SLA compliance, MTTR, and overdue findings
• a semantic model that can move from sample data to warehouse views
• layout and theme guidance that supports a polished leadership-facing report

Recommended workflow

1. Treat main as the review-ready baseline.
2. Create short-lived branches for each dashboard change.
3. Update the text assets first: TMDL, SQL, docs, and theme files all diff cleanly.
4. Open pull requests with screenshots so reviewers can check the visual story and the underlying model together.
5. Save Power BI Desktop changes often so generated PBIR files stay aligned with the report design.

Branch strategy

Branch	Purpose
main	Deployable baseline for the executive dashboard
feature/*	New visuals, measures, layout changes, or semantic-model updates
hotfix/*	Production fixes that should merge back to main quickly

Power BI Desktop authoring flow

1. Enable Power BI Project (.pbip) save option, Store semantic model using TMDL format, and Store reports using enhanced metadata format (PBIR) in Power BI Desktop preview features.
2. Open appsec-dashboard.pbip.
3. Refresh the semantic model from the sample CSVs or point the M queries to your governed source.
4. Build or refine report pages in Desktop.
5. Save the report in Desktop so Power BI generates the PBIR definition/ folder beneath AppSec.Report/.
6. Commit the resulting text files with the corresponding semantic-model and doc updates.

Publish guidance

• Desktop publish: use for fast iteration when a developer is actively authoring the report.
• Fabric Git Integration / deployment automation: preferred for controlled promotion because the repo remains the system of record.
• If you deploy reports through APIs, update AppSec.Report/definition.pbir to a byConnection reference for the target semantic model as part of the release process.

Starter assumptions

• Sample data is intentionally small and illustrative.
• SQL views assume you will load equivalent raw tables in your warehouse before wiring the dashboard to production data.
• The report folder starts with a valid definition.pbir pointer; detailed PBIR page and visual files are generated by Power BI Desktop after the first save.