{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# PRODAFT USTA — Payment Card Fraud Intelligence\n\nMonitors compromised payment cards ingested from the PRODAFT USTA Payment Card Fraud Intelligence API. The full card number is never stored — only the BIN (first 6), the last 4 digits, the brand, and the length are retained at ingestion.\n\nTime filtering uses **Created** (the event time reported by USTA) so historical backfilled tickets appear on the correct date."
      },
      "name": "title"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "804f74be-6505-4d37-8113-051548c0cbb4",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 7776000000
            },
            "typeSettings": {
              "selectableValues": [
                {
                  "durationMs": 86400000
                },
                {
                  "durationMs": 604800000
                },
                {
                  "durationMs": 2592000000
                },
                {
                  "durationMs": 7776000000
                }
              ]
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters"
    },
    {
      "type": 1,
      "content": {
        "json": "## Compromised Payment Cards (PCFI)"
      },
      "name": "header-pcfi"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCards\n| where Created {TimeRange}\n| summarize Cards = count() by bin(Created, 1d)\n| sort by Created asc",
        "size": 0,
        "title": "Exposed payment cards over time",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "50",
      "name": "pcfi-timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCards\n| where Created {TimeRange}\n| extend State = iff(ExpirationDate > now(), \"Valid\", \"Expired\")\n| summarize Count = count() by State",
        "size": 0,
        "title": "Valid vs expired",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "pcfi-validity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCards\n| where Created {TimeRange}\n| summarize Cards = count() by CompanyName\n| top 10 by Cards desc",
        "size": 0,
        "title": "Top affected companies",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "pcfi-companies"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCards\n| where Created {TimeRange}\n| where isnotempty(CardBrand)\n| summarize Cards = count() by CardBrand\n| sort by Cards desc",
        "size": 0,
        "title": "Exposed cards by brand",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "pcfi-brand"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCards\n| where Created {TimeRange}\n| where isnotempty(Status)\n| summarize Cards = count() by Status",
        "size": 0,
        "title": "Cards by ticket status",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "pcfi-status"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "PRODAFTUstaCompromisedCards\n| where Created {TimeRange}\n| project Created, CompanyName, CardBrand, CardMasked, CardLength, ExpirationDate, Status\n| sort by Created desc\n| take 100",
        "size": 0,
        "title": "Recent payment card tickets",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "pcfi-grid"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-PRODAFTUstaPCFIWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}