{
  "Name": "PRODAFT USTA - IoC Threat Intelligence",
  "Author": "PRODAFT - integration@prodaft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/PRODAFTUstaIoC.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The **PRODAFT USTA - IoC Threat Intelligence** solution ingests indicators of compromise (malicious URLs, malware hashes, and phishing sites) from the PRODAFT USTA platform into Microsoft Sentinel **Threat Intelligence** as STIX 2.1 indicators via the Upload STIX Objects API. Ingestion is performed by import playbooks (one per IoC feed) using a system-assigned managed identity; resolved `ip_addresses` on a record are added to the same indicator as `ipv4-addr`/`ipv6-addr` observables; indicators appear in the Threat Intelligence blade and the `ThreatIntelIndicators` table under a per-feed `SourceSystem` (`PRODAFT USTA - Malicious URLs`, `PRODAFT USTA - Malware Hashes`, `PRODAFT USTA - Phishing Sites`), so `SourceSystem startswith 'PRODAFT USTA'` selects them all. Includes three TI-map analytic rules that match ingested indicators against your logs, an overview workbook, and an on-demand backfill playbook for loading historical indicators.",
  "Workbooks": [
    "Workbooks/PRODAFTUstaIoCOverview.json"
  ],
  "WorkbookDescription": "Monitors indicators of compromise ingested from PRODAFT USTA IoC Threat Intelligence: indicators over time, by type, active vs expired, and confidence.",
  "Analytic Rules": [
    "Analytic Rules/TIMapUrlToSyslog.yaml",
    "Analytic Rules/TIMapDomainToDnsEvents.yaml",
    "Analytic Rules/TIMapFileHashToCommonSecurityLog.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/PRODAFTUstaIoC_UploadIndicatorsAPI.json"
  ],
  "Playbooks": [
    "Playbooks/PRODAFTUstaIoC-ImportMaliciousUrls/azuredeploy.json",
    "Playbooks/PRODAFTUstaIoC-ImportMalwareHashes/azuredeploy.json",
    "Playbooks/PRODAFTUstaIoC-ImportPhishingSites/azuredeploy.json",
    "Playbooks/PRODAFTUstaIoC-BackfillMaliciousUrls/azuredeploy.json",
    "Playbooks/PRODAFTUstaIoC-BackfillMalwareHashes/azuredeploy.json",
    "Playbooks/PRODAFTUstaIoC-BackfillPhishingSites/azuredeploy.json"
  ],
  "PlaybooksBladeDescription": "This solution installs the PRODAFT USTA IoC import playbooks (one per feed, hourly) and a matching on-demand backfill playbook per feed for loading history. After installing the solution, deploy them from the Manage solution view; each uses a system-assigned managed identity that must be granted Microsoft Sentinel Contributor on the workspace, plus Log Analytics Reader for the three import playbooks (they read their ingestion watermark, which Microsoft Sentinel Contributor does not cover).",
  "Version": "3.0.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1PConnector": false
}