{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# PRODAFT USTA — Account Takeover Prevention\n\nMonitors compromised corporate credentials ingested from the PRODAFT USTA Account Takeover Prevention API. Passwords are never stored — only strength signals (score and length) are retained at ingestion.\n\nTime filtering uses **Created** (the event time reported by USTA) so historical backfilled tickets appear on the correct date."
      },
      "name": "title"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "804f74be-6505-4d37-8113-051548c0cbb4",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 7776000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters"
    },
    {
      "type": 1,
      "content": {
        "json": "## Compromised Credentials (ATP)"
      },
      "name": "header-atp"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| summarize Credentials = count() by bin(Created, 1d)\n| sort by Created asc",
        "size": 0,
        "title": "Compromised credentials over time",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "50",
      "name": "atp-timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| extend Scope = iff(IsCorporate == true, \"Corporate\", \"Personal\")\n| summarize Count = count() by Scope",
        "size": 0,
        "title": "Corporate vs personal",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "atp-scope"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| summarize Credentials = count() by CompanyName\n| top 10 by Credentials desc",
        "size": 0,
        "title": "Top affected companies",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "atp-companies"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| where isnotempty(VictimMalware)\n| summarize Credentials = count() by VictimMalware\n| top 10 by Credentials desc",
        "size": 0,
        "title": "Top infostealer families",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "atp-malware"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| where isnotempty(Source)\n| summarize Credentials = count() by Source",
        "size": 0,
        "title": "Credentials by leak source",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "atp-source"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| where isnotempty(PasswordScore)\n| summarize Credentials = count() by PasswordScore\n| sort by Credentials desc",
        "size": 0,
        "title": "Password strength of exposed credentials",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "atp-password-strength"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCredentials\n| where Created {TimeRange}\n| where IsCorporate == true\n| project Created, CompanyName, Username, Source, PasswordScore, VictimComputerName, VictimCountry, VictimMalware, InfectionDate, Status\n| sort by Created desc\n| take 100",
        "size": 0,
        "title": "Recent corporate credential tickets",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "atp-grid"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-PRODAFTUstaATPWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}