{
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "apiVersion": "2023-02-01",
  "name": "PRODAFTUstaATPCCPDefinition",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "PRODAFTUstaATPCCPDefinition",
      "title": "PRODAFT USTA - Account Takeover Prevention (via Codeless Connector Framework)",
      "publisher": "PRODAFT",
      "descriptionMarkdown": "The PRODAFT USTA Account Takeover Prevention data connector ingests compromised-credential tickets from the PRODAFT USTA platform into Microsoft Sentinel. Sensitive values are redacted at ingestion: plaintext passwords are never stored — only password strength signals (score and length) are retained for triage.",
      "graphQueriesTableName": "PRODAFTUstaCompromisedCredentials_CL",
      "graphQueries": [
        {
          "metricName": "Compromised credential tickets",
          "legend": "PRODAFTUstaCompromisedCredentials_CL",
          "baseQuery": "PRODAFTUstaCompromisedCredentials_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Recently compromised corporate credentials",
          "query": "PRODAFTUstaCompromisedCredentials\n| where IsCorporate == true\n| sort by Created desc"
        },
        {
          "description": "Top infostealer families",
          "query": "PRODAFTUstaCompromisedCredentials\n| where isnotempty(VictimMalware)\n| summarize Count = count() by VictimMalware\n| sort by Count desc"
        }
      ],
      "dataTypes": [
        {
          "name": "PRODAFTUstaCompromisedCredentials_CL",
          "lastDataReceivedQuery": "PRODAFTUstaCompromisedCredentials_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "status": 1,
        "isPreview": false
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "read": true,
              "write": true,
              "delete": true
            }
          }
        ],
        "customs": [
          {
            "name": "PRODAFT USTA API key",
            "description": "A long-lived PRODAFT USTA API key with access to the Account Takeover Prevention endpoint is required."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect PRODAFT USTA Account Takeover Prevention to Microsoft Sentinel",
          "description": "Enter your USTA base URL and a long-lived API key, then select Connect. The connector authenticates to USTA with the `Authorization: Bearer <api-key>` header and polls every minute. To load history from before the connection time, deploy the **PRODAFTUstaATP-Backfill** playbook shipped with this solution.",
          "instructions": [
            {
              "type": "Textbox",
              "parameters": {
                "label": "USTA Base URL",
                "placeholder": "https://usta.prodaft.com",
                "type": "text",
                "name": "ustaBaseUrl",
                "required": true
              }
            },
            {
              "type": "Textbox",
              "parameters": {
                "label": "API Key",
                "placeholder": "Enter your USTA API key",
                "type": "password",
                "name": "apiKey",
                "required": true
              }
            },
            {
              "type": "ConnectionToggleButton",
              "parameters": {
                "connectLabel": "Connect",
                "name": "connect"
              }
            }
          ]
        }
      ]
    }
  }
}