{
  "Name": "PRODAFT USTA - Payment Card Fraud Intelligence",
  "Author": "PRODAFT - integration@prodaft.com",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/PRODAFTUstaPCFI.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The **PRODAFT USTA - Payment Card Fraud Intelligence** solution ingests compromised payment cards from the PRODAFT USTA platform into Microsoft Sentinel via a codeless (Codeless Connector Framework) data connector. The full card number (PAN) is dropped at ingestion — only the BIN (first 6), the last 4 digits, the card brand, and the length are retained for triage. Includes analytic rules to alert on newly exposed payment cards and on non-expired (still-usable) exposed cards, a hunting query, an overview workbook, and an on-demand backfill playbook for loading historical data.",
  "Workbooks": [
    "Workbooks/PRODAFTUstaPCFIOverview.json"
  ],
  "WorkbookDescription": "Monitors compromised payment cards ingested from PRODAFT USTA Payment Card Fraud Intelligence: exposure over time, affected companies, card brands, ticket status, and validity (expired vs still-valid).",
  "Analytic Rules": [
    "Analytic Rules/PaymentCardExposed.yaml",
    "Analytic Rules/NonExpiredPaymentCardExposed.yaml"
  ],
  "Hunting Queries": [
    "Hunting Queries/PaymentCardExposureByCompany.yaml"
  ],
  "Parsers": [
    "Parsers/PRODAFTUstaCompromisedCards.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/PRODAFTUstaPCFI_ccp/PRODAFTUstaPCFI_ConnectorDefinition.json"
  ],
  "Playbooks": [
    "Playbooks/PRODAFTUstaPCFI-Backfill/azuredeploy.json"
  ],
  "Version": "3.0.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": true,
  "Is1PConnector": false
}