{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# PRODAFT USTA — IoC Threat Intelligence\n\nMonitors indicators of compromise (malicious URLs, malware hashes, and phishing sites) ingested from the PRODAFT USTA platform into Microsoft Sentinel Threat Intelligence. Indicators are stored as STIX objects in the `ThreatIntelIndicators` table under a per-feed `SourceSystem` (`PRODAFT USTA - Malicious URLs`, `PRODAFT USTA - Malware Hashes`, `PRODAFT USTA - Phishing Sites`) and appear in the Threat Intelligence blade."
      },
      "name": "title"
    },
    {
      "type": 9,
      "content": {
        "version": "KqlParameterItem/1.0",
        "parameters": [
          {
            "id": "b7c1d2e3-0a1b-4c2d-9e3f-4a5b6c7d8e90",
            "version": "KqlParameterItem/1.0",
            "name": "TimeRange",
            "label": "Time range",
            "type": 4,
            "isRequired": true,
            "value": {
              "durationMs": 2592000000
            },
            "typeSettings": {
              "selectableValues": [
                { "durationMs": 86400000 },
                { "durationMs": 604800000 },
                { "durationMs": 2592000000 },
                { "durationMs": 7776000000 }
              ]
            }
          }
        ],
        "style": "pills",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces"
      },
      "name": "parameters"
    },
    {
      "type": 1,
      "content": {
        "json": "## PRODAFT USTA Indicators"
      },
      "name": "header-ioc"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ThreatIntelIndicators\n| where SourceSystem startswith \"PRODAFT USTA\"\n| where TimeGenerated {TimeRange}\n| summarize Indicators = count() by bin(TimeGenerated, 1d)\n| sort by TimeGenerated asc",
        "size": 0,
        "title": "Indicators ingested over time",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "timechart"
      },
      "customWidth": "50",
      "name": "ioc-timechart"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ThreatIntelIndicators\n| where SourceSystem startswith \"PRODAFT USTA\"\n| where TimeGenerated {TimeRange}\n| extend IndicatorType = replace_regex(tostring(split(ObservableKey, \":\")[0]), @'[\\[\\]\"]', \"\")\n| summarize Count = count() by IndicatorType",
        "size": 0,
        "title": "Indicators by type",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "ioc-by-type"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ThreatIntelIndicators\n| where SourceSystem startswith \"PRODAFT USTA\"\n| where TimeGenerated {TimeRange}\n| extend State = iff(IsActive and (ValidUntil > now() or isempty(ValidUntil)), \"Active\", \"Expired\")\n| summarize Count = count() by State",
        "size": 0,
        "title": "Active vs expired",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "piechart"
      },
      "customWidth": "50",
      "name": "ioc-validity"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ThreatIntelIndicators\n| where SourceSystem startswith \"PRODAFT USTA\"\n| where TimeGenerated {TimeRange}\n| summarize Count = count() by tostring(Confidence)\n| sort by Count desc",
        "size": 0,
        "title": "Indicators by confidence",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "barchart"
      },
      "customWidth": "50",
      "name": "ioc-confidence"
    },
    {
      "type": 3,
      "content": {
        "version": "KqlItem/1.0",
        "query": "ThreatIntelIndicators\n| where SourceSystem startswith \"PRODAFT USTA\"\n| where TimeGenerated {TimeRange}\n| extend IndicatorType = replace_regex(tostring(split(ObservableKey, \":\")[0]), @'[\\[\\]\"]', \"\")\n| project TimeGenerated, IndicatorType, ObservableValue, Confidence, ValidUntil, IsActive\n| sort by TimeGenerated desc\n| take 100",
        "size": 0,
        "title": "Recent indicators",
        "queryType": 0,
        "resourceType": "microsoft.operationalinsights/workspaces",
        "visualization": "table"
      },
      "name": "ioc-grid"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-PRODAFTUstaIoCWorkbook",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}