⚠️ PRODAFT USTA - Payment Card Fraud Intelligence

⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	PRODAFT
Support Tier	Partner
Support Link	https://www.prodaft.com
Categories	Security - Threat Intelligence
Version	3.0.0
Author	PRODAFT - integration@prodaft.com
First Published	2026-07-08
Solution Folder	PRODAFT USTA - Payment Card Fraud Intelligence

The PRODAFT USTA - Payment Card Fraud Intelligence solution ingests compromised payment cards from the PRODAFT USTA platform into Microsoft Sentinel via a codeless (Codeless Connector Framework) data connector. The full card number (PAN) is dropped at ingestion — only the BIN (first 6), the last 4 digits, the card brand, and the length are retained for triage. Includes analytic rules to alert on newly exposed payment cards and on non-expired (still-usable) exposed cards, a hunting query, an overview workbook, and an on-demand backfill playbook for loading historical data.

Data Connectors
Tables Used
Content Items
Additional Documentation

Data Connectors

This solution provides 1 data connector(s):

PRODAFT USTA - Payment Card Fraud Intelligence (via Codeless Connector Framework)

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`PRODAFTUstaCompromisedCards_CL`	PRODAFT USTA - Payment Card Fraud Intelligence (via Codeless Connector Framework)	Analytics, Hunting, Workbooks

Content Items

This solution includes 6 content item(s):

Content Type	Count
Analytic Rules	2
Hunting Queries	1
Workbooks	1
Playbooks	1
Parsers	1

Analytic Rules

Name	Severity	Tactics	Tables Used
PRODAFT USTA - Non-expired payment card exposed	High	Impact	`PRODAFTUstaCompromisedCards_CL`
PRODAFT USTA - Payment card exposed	Medium	Impact	`PRODAFTUstaCompromisedCards_CL`

Hunting Queries

Name	Tactics	Tables Used
PRODAFT USTA - Payment card exposure by company	-	`PRODAFTUstaCompromisedCards_CL`

Workbooks

Name	Tables Used
PRODAFTUstaPCFIOverview	`PRODAFTUstaCompromisedCards_CL`

Playbooks

Name	Description	Tables Used
PRODAFTUstaPCFI-Backfill	On-demand backfill playbook for PRODAFT USTA - Payment Card Fraud Intelligence. Pages through the US...	-

Parsers

Name	Description	Tables Used
PRODAFTUstaCompromisedCards	-	`PRODAFTUstaCompromisedCards_CL` (read)

Additional Documentation

📄 Source: PRODAFT USTA - Payment Card Fraud Intelligence/README.md

Ingests compromised payment cards from the PRODAFT USTA Payment Card Fraud Intelligence API into Microsoft Sentinel via a codeless (Codeless Connector Framework) data connector. The full card number (PAN) is never stored - the DCR transform drops it at ingestion and retains only the BIN (first 6), the last 4 digits, the card brand, and the length.

Content	Items
Data connector (CCF)	`Data Connectors/PRODAFTUstaPCFI_ccp/` - ConnectorDefinition, PollingConfig, DCR, Table
Parser	`PRODAFTUstaCompromisedCards` - query-time dedup (one row per `TicketId`)
Analytic rules	Payment card exposed; Non-expired payment card exposed
Hunting query	Payment card exposure by company
Workbook	`PRODAFTUstaPCFIOverview`
Playbook	`PRODAFTUstaPCFI-Backfill` - on-demand historical backfill

Deployment

From the portal (Content Hub)

Once published, install PRODAFT USTA - Payment Card Fraud Intelligence from Microsoft Sentinel → Content hub.
Open Configuration → Data connectors → PRODAFT USTA - Payment Card Fraud Intelligence (via Codeless Connector Framework), enter the USTA base URL and your API key, and select Connect. The connector polls every minute going forward.
To load history, deploy and run the PRODAFTUstaPCFI-Backfill playbook once - see Playbooks/PRODAFTUstaPCFI-Backfill/readme.md.

Via scripts (this repository)

Generate the deployable package with the repo's packaging tool (creates Package/mainTemplate.json + Package/createUiDefinition.json). The tool is a PowerShell 7 script and runs the same on Windows, Linux, and macOS via pwsh. One-time setup (see Tools/Create-Azure-Sentinel-Solution/README.md): PowerShell 7.1+, Node.js, and the YAML module (pwsh -Command 'Install-Module powershell-yaml -Scope CurrentUser').
```
# from the repository root - pass the ABSOLUTE path to this solution's Data folder
# (the tool rejects paths that start with "Solutions/")
pwsh Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 \
  -SolutionDataFolderPath "$(pwd)/Solutions/PRODAFT USTA - Payment Card Fraud Intelligence/Data" \
  -VersionMode local -VersionBump patch
```
-VersionMode local versions from this solution's Data file and bumps it on every run (patch/minor/major), writing the new version back. The default catalog mode looks the offer up in the Content Hub catalog and, for unpublished solutions, falls back to 3.0.0. Package versions must be 3.x: the tool aborts on 1.x versions and 2.x builds only the deprecated templateSpec format, so the Content Hub packaging format (contentSchemaVersion 3) requires 3.x - which is why the initial release is 3.0.0.
Deploy from scratch - creates the resource group and the Log Analytics workspace,

[Content truncated...]

Release Notes

PRODAFT USTA - Payment Card Fraud Intelligence - Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.0	08-07-2026	Initial Solution Release. Codeless (CCF) data connector for compromised payment-card tickets with ingestion-time PAN redaction (only BIN, last 4 digits, brand, and length are stored). Two Analytic Rules (payment card exposed; non-expired payment card exposed), one Hunting Query, an overview Workbook, a query-time dedup Parser, and an on-demand backfill Playbook (Logs Ingestion API via managed identity) for loading historical data.