USTA Account Takeover Prevention Sentinel Connector

Solution: PRODAFT USTA - Account Takeover Prevention

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	PRODAFT
Support Tier	Partner
Support Link	https://www.prodaft.com
Categories	Security - Threat Intelligence
Version	3.0.1
Author	PRODAFT - integration@prodaft.com
First Published	2026-07-06
Last Updated	2026-07-24
Solution Folder	PRODAFT USTA - Account Takeover Prevention
Marketplace	Azure Marketplace · Popularity: 🔵 Medium (68%)

The PRODAFT USTA - Account Takeover Prevention solution ingests compromised corporate credentials from the PRODAFT USTA platform into Microsoft Sentinel via a codeless (Codeless Connector Framework) data connector. Plaintext passwords are dropped at ingestion — only password strength signals (score and length) are retained for triage. Includes analytic rules to alert on newly exposed corporate credentials and on successful Entra ID sign-ins with known-compromised accounts, a hunting query, an overview workbook, and an on-demand backfill playbook for loading historical data.

Data Connectors
Tables Used
Content Items
Additional Documentation

Data Connectors

This solution provides 1 data connector(s):

PRODAFT USTA - Account Takeover Prevention (via Codeless Connector Framework)

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`PRODAFTUstaCompromisedCredentials_CL`	PRODAFT USTA - Account Takeover Prevention (via Codeless Connector Framework)	Analytics, Hunting, Workbooks

Content Items

This solution includes 6 content item(s):

Content Type	Count
Analytic Rules	2
Hunting Queries	1
Workbooks	1
Playbooks	1
Parsers	1

Analytic Rules

Name	Severity	Tactics	Tables Used
PRODAFT USTA - Compromised credential used in successful sign-in	High	CredentialAccess, InitialAccess	`PRODAFTUstaCompromisedCredentials_CL`
PRODAFT USTA - Corporate credential compromised	High	CredentialAccess, InitialAccess	`PRODAFTUstaCompromisedCredentials_CL`

Hunting Queries

Name	Tactics	Tables Used
PRODAFT USTA - Infostealer exposure across corporate identities	CredentialAccess	`PRODAFTUstaCompromisedCredentials_CL`

Workbooks

Name	Tables Used
PRODAFTUstaATPOverview	`PRODAFTUstaCompromisedCredentials_CL`

Playbooks

Name	Description	Tables Used
PRODAFTUstaATP-Backfill	On-demand backfill playbook for PRODAFT USTA - Account Takeover Prevention. Pages through the USTA c...	-

Parsers

Name	Description	Tables Used
PRODAFTUstaCompromisedCredentials	-	`PRODAFTUstaCompromisedCredentials_CL` (read)

Additional Documentation

📄 Source: PRODAFT USTA - Account Takeover Prevention/README.md

Ingests compromised corporate credentials from the PRODAFT USTA Account Takeover Prevention API into Microsoft Sentinel via a codeless (Codeless Connector Framework) data connector. Plaintext passwords are never stored — the DCR transform drops them at ingestion and retains only password strength signals (score and length).

Content	Items
Data connector (CCF)	`Data Connectors/PRODAFTUstaATP_ccp/` — ConnectorDefinition, PollingConfig, DCR, Table
Parser	`PRODAFTUstaCompromisedCredentials` — query-time dedup (one row per `TicketId`)
Analytic rules	Corporate credential compromised; Compromised credential used in successful sign-in
Hunting query	Infostealer exposure across corporate identities
Workbook	`PRODAFTUstaATPOverview`
Playbook	`PRODAFTUstaATP-Backfill` — on-demand historical backfill

Deployment

From the portal (Content Hub)

Once published, install PRODAFT USTA - Account Takeover Prevention from Microsoft Sentinel → Content hub.
Open Configuration → Data connectors → PRODAFT USTA - Account Takeover Prevention (via Codeless Connector Framework), enter the USTA base URL and your API key, and select Connect. The connector polls every minute going forward.
To load history, deploy and run the PRODAFTUstaATP-Backfill playbook once — see Playbooks/PRODAFTUstaATP-Backfill/readme.md.

Via scripts (this repository)

Generate the deployable package with the repo's packaging tool (creates Package/mainTemplate.json + Package/createUiDefinition.json). The tool is a PowerShell 7 script and runs the same on Windows, Linux, and macOS via pwsh. One-time setup (see Tools/Create-Azure-Sentinel-Solution/README.md): PowerShell 7.1+, Node.js, and the YAML module (pwsh -Command 'Install-Module powershell-yaml -Scope CurrentUser').
```
# from the repository root — pass the ABSOLUTE path to this solution's Data folder
# (the tool rejects paths that start with "Solutions/")
pwsh Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1 \
  -SolutionDataFolderPath "$(pwd)/Solutions/PRODAFT USTA - Account Takeover Prevention/Data" \
  -VersionMode local -VersionBump patch
```
-VersionMode local versions from this solution's Data file and bumps it on every run (patch/minor/major), writing the new version back. The default catalog mode looks the offer up in the Content Hub catalog and, for unpublished solutions, falls back to 3.0.0. Package versions must be 3.x: the tool aborts on 1.x versions and 2.x builds only the deprecated templateSpec format, so the Content Hub packaging format (contentSchemaVersion 3) requires 3.x — which is why the initial release is 3.0.0.
Deploy from scratch — creates the resource group and the Log Analytics workspace,

[Content truncated...]

Release Notes

PRODAFT USTA - Account Takeover Prevention — Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.1	27-07-2026	Updated the backfill Playbook to self-provision its Data Collection Endpoint (DCE) and Data Collection Rule (DCR) and to grant its managed identity the Monitoring Metrics Publisher role on the DCR. Removes the manual ingestion-endpoint URI and DCR immutable-ID setup previously required to run the backfill.
3.0.0	06-07-2026	Initial Solution Release. Codeless (CCF) data connector for compromised-credential tickets with ingestion-time password redaction (only strength signals are stored). Two Analytic Rules (corporate credential compromised; compromised credential used in a successful Entra ID sign-in), one Hunting Query, an overview Workbook, a query-time dedup Parser, and an on-demand backfill Playbook (Logs Ingestion API via managed identity) for loading historical data.