{
    "id": "PRODAFTUstaIoCUploadIndicators",
    "title": "PRODAFT USTA - IoC Threat Intelligence",
    "publisher": "PRODAFT",
    "descriptionMarkdown": "The PRODAFT USTA IoC Threat Intelligence connector ingests indicators of compromise (malicious URLs, malware hashes, and phishing sites) from the PRODAFT USTA platform into Microsoft Sentinel's Threat Intelligence as STIX indicators via the Upload STIX Objects API. Ingestion is performed by the import playbooks shipped with this solution (one per IoC feed); where a record carries resolved `ip_addresses`, those addresses are added to the same indicator's pattern as `ipv4-addr`/`ipv6-addr` observables; indicators appear in the Threat Intelligence blade and in the `ThreatIntelIndicators` table under a per-feed `SourceSystem` — `PRODAFT USTA - Malicious URLs`, `PRODAFT USTA - Malware Hashes` and `PRODAFT USTA - Phishing Sites` — so `SourceSystem startswith 'PRODAFT USTA'` selects every USTA indicator. After installing the solution, deploy and authorize the import playbooks by following the guidance in the Manage solution view.",
    "graphQueries": [
        {
            "metricName": "Total indicators received",
            "legend": "PRODAFT USTA indicators",
            "baseQuery": "ThreatIntelIndicators | where SourceSystem startswith 'PRODAFT USTA'"
        }
    ],
    "sampleQueries": [
        {
            "description": "All PRODAFT USTA indicators",
            "query": "ThreatIntelIndicators | where SourceSystem startswith 'PRODAFT USTA' | sort by TimeGenerated desc"
        },
        {
            "description": "PRODAFT USTA indicators by type",
            "query": "ThreatIntelIndicators | where SourceSystem startswith 'PRODAFT USTA' | extend IndicatorType = replace(@'\\[|\\]|\\\"', '', tostring(split(ObservableKey, ':', 0))) | summarize count() by IndicatorType"
        }
    ],
    "dataTypes": [
        {
            "name": "ThreatIntelIndicators",
            "lastDataReceivedQuery": "ThreatIntelIndicators | where isnotempty(TimeGenerated) and SourceSystem startswith 'PRODAFT USTA' | summarize Time = max(TimeGenerated)"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "ThreatIntelIndicators | where SourceSystem startswith 'PRODAFT USTA' | summarize LastLogReceived = max(TimeGenerated) | project IsConnected = LastLogReceived > ago(30d)"
            ]
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions on the workspace are required.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "write": true,
                    "read": true,
                    "delete": false
                }
            }
        ],
        "customs": [
            {
                "name": "Workspace role assignments for the playbooks",
                "description": "Every import and backfill playbook uses a system-assigned managed identity, which needs the **Microsoft Sentinel Contributor** role on the workspace to call the Upload STIX Objects API. The three **import** playbooks additionally read their ingestion watermark from the `ThreatIntelIndicators` table and therefore also need **Log Analytics Reader** on the workspace — Microsoft Sentinel Contributor does not cover the `Microsoft.OperationalInsights/workspaces/read` action that read performs."
            },
            {
                "name": "PRODAFT USTA API key",
                "description": "A long-lived PRODAFT USTA API key with access to the Security Intelligence IoC endpoints is required."
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "1. Install the core Threat Intelligence solution",
            "description": "This connector lands indicators in the `ThreatIntelIndicators` table and the Threat Intelligence blade. Install the Microsoft **Threat Intelligence** solution from the Content hub first, so the blade and the source-agnostic TI-map analytic rules are available."
        },
        {
            "title": "2. Deploy the PRODAFT USTA import playbooks",
            "description": "This solution ships three hourly import playbooks — **PRODAFTUstaIoC-ImportMaliciousUrls**, **PRODAFTUstaIoC-ImportMalwareHashes**, and **PRODAFTUstaIoC-ImportPhishingSites** — plus a matching on-demand backfill playbook per feed (**PRODAFTUstaIoC-BackfillMaliciousUrls**, **-BackfillMalwareHashes**, **-BackfillPhishingSites**) for loading history. Deploy them from the Manage solution view (or the Automation blade), supplying your USTA base URL, USTA API key, and the name of your Microsoft Sentinel workspace."
        },
        {
            "title": "3. Authorize the playbooks' managed identity",
            "description": "Each playbook uses a system-assigned managed identity. On the **Log Analytics workspace** → Access control (IAM) → Add role assignment — open IAM on the workspace, **not** on the Logic App, or the assignment is scoped to the playbook and grants no workspace access — grant that identity **Microsoft Sentinel Contributor** (needed by every playbook, for the Upload STIX Objects call) and, for the three **import** playbooks, also **Log Analytics Reader** (needed for the watermark query — without it the run fails with `AuthorizationFailed` on `Microsoft.OperationalInsights/workspaces/read`). Once granted, the playbooks poll USTA hourly and push new indicators; the connector shows **Connected** after the first indicators arrive."
        }
    ]
}