From 506f9fb1aaea6d3c963190a55c39beae4c81050f Mon Sep 17 00:00:00 2001 From: Nitisha Bhandari Date: Fri, 17 Jan 2025 07:31:04 -0800 Subject: [PATCH 1/5] update feature flags --- ...ate_MicrosoftDefenderThreatIntelligence.json | 15 +++++++++------ ...miumMicrosoftDefenderThreatIntelligence.json | 17 ++++++++++------- ...late_ThreatIntelligenceUploadIndicators.json | 2 +- ...reatIntelligenceUploadIndicators_ForGov.json | 2 +- 4 files changed, 21 insertions(+), 15 deletions(-) diff --git a/Solutions/Threat Intelligence/Data Connectors/template_MicrosoftDefenderThreatIntelligence.json b/Solutions/Threat Intelligence/Data Connectors/template_MicrosoftDefenderThreatIntelligence.json index 86f57c35201..1c1c242a5e1 100644 --- a/Solutions/Threat Intelligence/Data Connectors/template_MicrosoftDefenderThreatIntelligence.json +++ b/Solutions/Threat Intelligence/Data Connectors/template_MicrosoftDefenderThreatIntelligence.json @@ -39,15 +39,18 @@ } ], "availability": { - "status": 2, - "isPreview": true, + "status": 3, + "isPreview": false, "featureFlag": { "feature": "msticonnector", "featureStates": { - "1": 1, - "2": 1, - "3": 1, - "4": 1 + "1": 3, + "2": 3, + "3": 3, + "4": 3, + "5": 3, + "6": 2, + "7": 2 } } }, diff --git a/Solutions/Threat Intelligence/Data Connectors/template_PremiumMicrosoftDefenderThreatIntelligence.json b/Solutions/Threat Intelligence/Data Connectors/template_PremiumMicrosoftDefenderThreatIntelligence.json index fe656115f67..c4bef5b2ee6 100644 --- a/Solutions/Threat Intelligence/Data Connectors/template_PremiumMicrosoftDefenderThreatIntelligence.json +++ b/Solutions/Threat Intelligence/Data Connectors/template_PremiumMicrosoftDefenderThreatIntelligence.json @@ -39,15 +39,18 @@ } ], "availability": { - "status": 2, - "isPreview": true, + "status": 3, + "isPreview": false, "featureFlag": { "feature": "premiummdticonnector", - "featureStates": { - "1": 1, - "2": 1, - "3": 1, - "4": 1 + "featureStates": { + "1": 3, + "2": 3, + "3": 3, + "4": 3, + "5": 3, + "6": 1, + "7": 1 } } }, diff --git a/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators.json b/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators.json index 0eff786764b..e0a71b6288a 100644 --- a/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators.json +++ b/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators.json @@ -31,7 +31,7 @@ } ], "availability": { - "status": 1, + "status": 2, "isPreview": true }, "permissions": { diff --git a/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators_ForGov.json b/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators_ForGov.json index 23cef753aa6..b6004188359 100644 --- a/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators_ForGov.json +++ b/Solutions/Threat Intelligence/Data Connectors/template_ThreatIntelligenceUploadIndicators_ForGov.json @@ -31,7 +31,7 @@ } ], "availability": { - "status": 1, + "status": 2, "isPreview": true }, "permissions": { From 55773b51f6901cec1a49a4f1a1c56c2e907cc0d4 Mon Sep 17 00:00:00 2001 From: Nitisha Bhandari Date: Fri, 17 Jan 2025 07:59:32 -0800 Subject: [PATCH 2/5] static id --- .../Data/Solution_ThreatIntelligenceFairfax.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence Solution for Azure Government/Data/Solution_ThreatIntelligenceFairfax.json b/Solutions/Threat Intelligence Solution for Azure Government/Data/Solution_ThreatIntelligenceFairfax.json index daef53714fe..bf143dd57ba 100644 --- a/Solutions/Threat Intelligence Solution for Azure Government/Data/Solution_ThreatIntelligenceFairfax.json +++ b/Solutions/Threat Intelligence Solution for Azure Government/Data/Solution_ThreatIntelligenceFairfax.json @@ -56,7 +56,7 @@ "Solutions/Threat Intelligence Solution for Azure Government/Analytic Rules/IPEntity_DuoSecurity.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel", - "Version": "3.0.3", + "Version": "3.0.4", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ From 59a38d60c75012fb30d640b8bbae55698ca1ecd2 Mon Sep 17 00:00:00 2001 From: Nitisha Bhandari Date: Fri, 17 Jan 2025 07:59:49 -0800 Subject: [PATCH 3/5] update package versions --- .../ReleaseNotes.md | 1 + .../Data/Solution_ThreatIntelligenceTemplateSpec.json | 5 +++-- Solutions/Threat Intelligence/ReleaseNotes.md | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/Solutions/Threat Intelligence Solution for Azure Government/ReleaseNotes.md b/Solutions/Threat Intelligence Solution for Azure Government/ReleaseNotes.md index 647e49e94c5..5d0a02a5cbe 100644 --- a/Solutions/Threat Intelligence Solution for Azure Government/ReleaseNotes.md +++ b/Solutions/Threat Intelligence Solution for Azure Government/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.0.4 | 01-15-2025 | Updated feature flags for PMDTI and MDTI for GA, and Upload API for PP. | | 3.0.3 | 28-11-2024 | Removed (Preview) from name for **Data Connectors** Microsoft Defender Threat Intelligence and Premium Microsoft Defender Threat Intelligence, make the MDTI and PMDTI data connctors available in gov solution, and update descriptions of data connectors. | | 3.0.2 | 19-08-2024 | Updated isConnectedQuery for **Data Connector** of "Threat Intelligence Upload Indicators API". | | 3.0.1 | 06-08-2024 | Updated the URL in **data connector** | diff --git a/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json b/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json index 3487118e055..0203af5621d 100644 --- a/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json +++ b/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json @@ -77,11 +77,12 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Threat Intelligence\\", - "Version": "3.0.8", + "Version": "3.0.10", "TemplateSpec": true, "StaticDataConnectorIds": [ "ThreatIntelligenceTaxii", "ThreatIntelligence", - "MicrosoftDefenderThreatIntelligence" + "MicrosoftDefenderThreatIntelligence", + "PremiumMicrosoftDefenderForThreatIntelligence" ] } \ No newline at end of file diff --git a/Solutions/Threat Intelligence/ReleaseNotes.md b/Solutions/Threat Intelligence/ReleaseNotes.md index 07462f00975..bf00a464127 100644 --- a/Solutions/Threat Intelligence/ReleaseNotes.md +++ b/Solutions/Threat Intelligence/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.0.10 | 01-15-2025 | Updated feature flags for PMDTI and MDTI for GA, and Upload API for PP. | | 3.0.9 | 04-12-2024 | Modified DomainEntity_EmailUrlInfo **Analytic Rule** to resolve memory issues | | 3.0.8 | 28-11-2024 | Removed (Preview) from name for **Data Connectors** Microsoft Defender Threat Intelligence and Premium Microsoft Defender Threat Intelligence, make the MDTI and PMDTI data connctors available in gov solution, and update descriptions of data connectors. | | 3.0.7 | 24-10-2024 | Updated Columns of **Analytical Rules** | From 7805574e126e96bc8464ea394275a839a68c52d6 Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Mon, 20 Jan 2025 14:09:00 +0530 Subject: [PATCH 4/5] Solution packaged --- ...lution_ThreatIntelligenceTemplateSpec.json | 2 +- .../Threat Intelligence/Package/3.1.0.zip | Bin 0 -> 55969 bytes .../Package/mainTemplate.json | 1197 ++++++++--------- 3 files changed, 545 insertions(+), 654 deletions(-) create mode 100644 Solutions/Threat Intelligence/Package/3.1.0.zip diff --git a/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json b/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json index 0203af5621d..709e189ba79 100644 --- a/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json +++ b/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json @@ -77,7 +77,7 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Threat Intelligence\\", - "Version": "3.0.10", + "Version": "3.1.0", "TemplateSpec": true, "StaticDataConnectorIds": [ "ThreatIntelligenceTaxii", diff --git a/Solutions/Threat Intelligence/Package/3.1.0.zip b/Solutions/Threat Intelligence/Package/3.1.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..f18e971c10e33623f4c08cf057f913bb51524fd9 GIT binary patch literal 55969 zcmZ^KW0WM@)@|A7vTd7Lwr#7+>auO4yKLKbb=kIUb=j}_-1FZ1etb6)BO^!Vjy2bs zYtB7(L?}puf}sLIeLWz5uxbJQj|~Zk5Xi>R!dB(GjlH#@(|3AHM>|_*H&`HGu)n|h z=S@`w9thGEHpa~T>oud}ZFcT$<+?T;fBfh<`HmP?XGTT_Cd%_vm%lQj!GdM;Hm&tw z@~EXp2gOQOK@~tGu@CiQ5os zog_>3;q`KL07>2yGmP9h z`~bI$eySB8oOGyrnnAC zi*uv1Y0xoO7UJ2ph!jZYGA!Y`weqfg0@H!QSpDqS4?H$g?{(NcnO6M_KknvsoPy6; z`)pvls1~^`-U;Bu7g|797kSNQ=zUY>bkxa%W&IR?bvS5OPb09zPkqfc9KPXcDVos7 zw@?hl^M7=G=yPRK*Nj_uN;fsJaq$K+3<7?1*-DV6Ch#9DP=^g34r_&G!xM?gQOS8D z^ajy%;~}E|XjqFVG__Oj*xK0o)R6NG*asQ?Q&@>S;)}Ltp)Bx|J}9}j(1q2RoC9_X z-jIGI!~8}F5U9E@KLS?FK^l2b5%*K^n-{YaSm!Eg8T$8=fU*{LuujTkkR>>#1c;~e zac?tLqB;{KWWlRP#Fmdl0d>vN1ece-QR&c3o)egAB0lRHN||bF-y%@7!XPN{ zyYi*D_v?pLn&^ENM3ub-#qSD%?}Kj_9_#yCr*Jo?+;IxNJIf{@A^k*duVwcV6&e zA#p6j&lrKeYw6Gmf{bT|a@9_&kjlfzk=9BBJBVr-Ywd0c7a*+>VnkMS?^gydJXFB4 zif|)t`mD$Lq1Xejd2pz(w8~3KXxps1sQswp-Q1Y*;;W5ZWc^UaWWXN_)3q8ktTeKN z+H56v62JRIpCM1`AJ*ZdwSi#NwYGY{uKN-=2*qg(W{=srVXzhU}(N{?5Pqy7AQQe42#Eev*zR%dyjf@)XN!!UiVt!4rS zcCDhlW&*ONW+DO>Fp=XXsdak)fL~!e1W5JZGeB@~bMna3I#c`5Y93vBp*F@4pw|C* z=7j!+_~ThSc&s~xO_WEH!PiPVxm(rnS=%|e`yME%TlL3tF&1jI5>6>kW}=m^JD%)1 z6ILP>?u{=nR!PIb+OuU3y*lXGwgOPC4&MGAxd4xdvjIj~pwS}g4QVC9xs58M3%Ikv zk}Bi_r~;&msB@gDLWfp6^ijD+;KEM<4t;2+v0no3@vz%J8Q#63z`{aX?%IQ;|BdGT zvWfoPHn?!Bvi+_d(cr|DhW?#3FvwTs!N&=u1Bq_*&CVAsYtc!3hggvzt3RUmkVRNOANbOayd6#)`x-uDh7*Rq@m;Vr6i^NZuTRU4*V;Jo6tCSn zt(|DLU8ENAox97)ER2s{#>sQXGwzu2N7yFBj2EkAlaq%)JLy1vuC5W z47;WVZiSDuCrcwng77b={H>M>r7Z-jT}UjGj$k0j)ns<8JLPASH|IZLxDVeuj0Nve zWqb$8OQ9ZAc`w>B`m`YWBv&C445gl*7Xnp{tg>1IrJg4_`&&&EscB4vlR0n<9(vVj zxt{yIYi0(LgcD+gq`e%GmeZ2EFJ_Hn#GL0i+EH{_@BhVxtp0!F@{ju`E>b$3g}CFS z@S2yBTvWqV)JY!O?z3p;YW@J>4qkSrWfJRU-jE{Mj#|JmqN8X_J20J&;oB*(7ez7N zFZ3!AQFtW1f!uBjI-Ov0$)Iw}9lcbj#~`RjDbW;mJS@;L+(&MYsYafS%k-j4r;I9F z_l+!Bi79&zwJNB`MT{NlJ#~zoP2TW-a%F$@A=-j0n*jAl9bw-s6ZE>ki`+ohscfHGOyw>s~CQ(4p!6u z?(;<6u~eD=wzKp8x8Q2u4D*$-*Nz#9*w@~bh)ivCmukh>os%`}?^wBoIfD@BI+yUG z$Ne`>G)T9S3tQyGSF!WLBpb3zEW z)LW{sv7Eu&VRxN>g=vYBBtx9TNkcib=0`W;#p+hCUByiMgM`lbpB&3g;T-D?k%X|F za@qP9Pb>?JSHXa=fjxHxxGW5pkPK^oYb+P}Njj{WX(MK_JXsS=h&T$K+T<)_bgwfz zV;JsU<9QdxhuKmS`>oyh4z3x1-ToZV;Xka424)HM$2<74EM8GOu9?t9J)BZ9Zb7mN zMvxwU6N|^gOm$|sp_0p`eY5Ad$7QFjjhA)XVD)0beaJCv59qJV4d| z!9(o!D=Y$RrK~DmTG&mjIwV?VO)In37^|pU8v^U32^?pr1XLq-J)Q$!vvabCwkDqA z+dz4M0K8yVHKQII^C{FH^!^)aq{fJ79qeJ27dBRAo3(pdE4ZQTVLz$&XJ!_rW zpJBabA%UPqJjBq4nx)`G^Q}Dn;vNs2wG@?8c*wrVmMdq7)&Of;!n(ha=zFiLoBT~D z-|KR~upU_+vEZfJr&H=~d5lnLs;m z#^C3b4-3b)m4D$3{|`8gLbGw2*efh_JB=kd@fK^7=F7FOHKTB20d!#es#tCso(9$r z(UayfZQ!B2j-c_K)KK%^_Fp5;RY~$=2<-$-s*x2Fmh$Sv=%de5o4%Q}>%>{C*=}7V z`hP#=#nBB8VOoR~MtMN$@m^;dY%+Ga1$X~1gAlH%g13HU!^J8Ey`j?Bb-Zfs3b?8d z0e#vp@T7!ezB7i4_@M+83d4LKUgV*SP(e8Eil$CII*L1>13bP{N~F?A>!;YmxE}mm zK+`>U3=1ZR!yptavRh0cB6Q9sR>Eb=l56N@jsS_>e=73Djrjk|jq@*Vpv~od9sWTy ztSx|WuBkH%z=&&fI_SnYZ?jf+hjilPX9Hc|LY$Ri(%)rO(b(T zYkhpy7)ck$4+bVDa$7j3#_e`o4__YR1p79e{#8pk$qEQ+t%_w4Z}#kLqiU{Kg7lo~xhS~NfB0{oq4u>^|HBHEzSV!oNjjIO ztr{my;+dqVOQOwFx77HOSzFoO$#jliw6+jxPrLxXy>9?lyy&k>IE)j1{)^;qIT-5H zga4KTExr>*q%tr5>;GzZ6MD}W#1$9Iq$K%(KX?8tn8y#p4fnZRj7~-x=r@BTL(G3V z(H9}Uu>VJeSN>JuzdfS%B-BsMP=}?uLi?yy)6~~xh%|O_9Ae|t1BdPQQo>K#lDhoR z(*)$npda_&_+1sOioH^QjvX*g?Ad>bP#IJ18bSifON)nB!{St-bmS&C<~WepP9@+}7MhjG$97i~aqLn>jqN z;nF$!@_%d5fdbb^E0z*8 z5Mr0FI4)KAzZ%52d~exX!>;qvtzeB@&wnx0yI>A$HN+}q!F72?GmcB z+3tZlUhya)j_#{xzEr#~OZTg$@I=E0`ik{UBxA=K-n+-0KkR@^r-y|-H~atSW!BoX zA1>3ioSFXb=|~_{e~(!G60H@}`@SqX+f6*|%brC@Z$$fxG~*4dWqMr2%q*@;%znzS z^Ob)C0ejx;`j;C2G>IDL`N~%^0ByT10b)fqymKHpo9Aa6NVV6(ns<#orp(7NkWGSO z56dIngY%mLCe{D3cw*0gE&gk)FN^=h=I~7B!Bc0ZQX9X*=Fvxl71N$|8O?a$G=Fjy zvvP8BINc~&y+m*?>BCpo8SZ&U{g3or5O;pfdH(v^S4OCjP4e5mymh5Me^~E%sJOzW zdh5y+^4))v0I^1HBPSnVyR>LHM+kwH5@=Zb-xN@)F23By%kqn9=X%k7da(y2+QO=% z7Iq3m1S|i0`191EonPI7C;Bk@K3q|`*YZ$v26xYt>rTYWnc@N=;tH2<2GF&FBLC~i z#C7Vxe;wKGORWD!Zu1p6(bq9)UjGV(%a>5N8}V8Jupf5Lx$N&1vk&C}yxs<$A{^m{ zD@|VC1^fRy5TSY(W9OH8BU(W*+gLq{_st9+A7@z@Fr{895VV+7 zxI$DJw{`NJpnHkh{1^EL7rgw^-L}lrfbrF|y-jmge7L(GuJbb&L~7k^;=10;1np|o zW+-c83`WZv|0!mbT=#!ub3L=`KNdthTo~V3r6?R{p`GrOvAK+Q%)2bs19$3jkED_I z(!(s)B$$!Av#%dA_wNv2Q@;Pnhk5FNuPUCUv4N#Fk%5N7$xh9|PeFKgSvlYJhQZwl zE?v05tzE>Pzc~PH{1+GeCj?v6m9w9)%r<9mvTOBGU7NK$DCn6hGnrjXi#tRb5?RKv z9dCXTuK%q!Tz>}O!Y7gc00-$C83oI_p@0)G)Rw(ZVqhX=${NVDO6ik!fHxVLKi8u} zufJaD6@0@Eu>tt%PsTUfaJ29(A7mJLts+HIf^iaHUb~et*qVav3>m$eiX9^49mo)m zL~Y3WTS{8V&Qc}_ACNI_|g-n_@0T`GJi|ufJtTCWCY(5 zr^pGifZvWUAdRpApmieXf^&5=+RPKqkK?gYJ$BM9#?fEiK%Zeuh%W7nFY?ty1}Xwp zCN+;=2^YXUge2d6Q;#4iBkV(&_cQi0p2eMfZYen6j2*E4LY5142{tr6#B5qU?A}p6(=GLO`G@ zNanQ|5*jB>iD2-=z)!(59_~K`IldYkPBmDM zJcNUO&hodG&h=Mj#b6ZuP;^|UUeN@5$G z+Mv2EiUcV8jY{>^4Ay+Vi(ip-L>r^-jS+6^)$e?{TctTLsVh0DDw6C!i*62C$pf@tCDue(-zKg zDP7%uQ{y9%KZXzG2@ViJfLh3q2yAk_CZqm0d4Q+upKL7wI#u{!#`(e9?X-OC1g=xE z^E9&RO3|nXuWtn3_$Hi-uFCC8?UpNUhh3>$oOiw%SYsp0U-_Joy)e)|F zt*yF&LY8_n1Rj4db{EYqgMdK|JO&1|>uu93+RPNKA`(0XfpoyFF3m6tRdReV-xOyf zm_mMre7{nq01z?W>d}7unRFy3FUk2F zhKA1bQ3eru4SfJdhnblyna|n?stLB}zAawee2$sU^A!`zxN2y)%_Ld(%#$>ps!Me5 zs;|B%`SDui@utWN>~;7y<<|!*0A~7I(}FyR8~y1W+(ai=EB_%ob0lFOQDn^|^=0z; z^p(p5H2UloH24UQ{#4bCuxVyt-(oi?(iroD4rAl>SLJPK)H=Vwr>=hA#~;_c&fDs6 zml9oo{^Ru!exEM2FD-Tp>)vdWiE?fb7KdVdfk6D9e3S@%&QpK^(kRQ2aIE#C$ z-1}5sFNx^he3$E1BKq}e&t@;i3yj>QHv8ED983iCRw$!??#4&ya&+kI5TAs%?eeo~ zM2BatlI55hA?qG!Uez`4?6Kg=nFPQ8{IDzG$R3vC*6YfMiL#L2?mLEA70LCD=C?DN z0HsJnJZYjKA<9~~GHtMXI{*I5+|B1Pm$y@Zw^2<-W~a4yb$#N}YVXmt0-6(%5h&`>VtwyKVFm)vP;DQMY3yqMzAWTyDSzOZ+a z){|QZ$+fZ5m7+Muzpv1Dc-+9p= zKDf8)rju?G4ezEzAp2*)yA6~;fq9_vKrtnjKlZofAIdbI2-yQgjaa_e-yTNps7@%Y zMlRJq4~(Ey=zJX+~riazBK zY^^MTTFgbIKV)M!f4nxrpL-lS+i})#BNF8b8aY=sK=56)$dZqefkiUT6H`ZW-Z$Sf7rUY?0v0`_i)62wepakQw)3Sh zG|WUNF&?lL*nxWa7>poui6=b;3Ez*2wd(tntq$I0CdOF-_b$nrT@N!8+#ZvSpNwrQ z$&@DOP6NY1ynx39k+I?d60g-*0yCy+t~g12L3AeT1r#28s_H~8)462UZiH>c1V|zp z%QC4gqtPK!^yBpe5DUD2AZLrks z!uJE8*n|F?a*fxn@w6|vv}LxVwZq0os(nC!s2})EJmQptRltFPN{u|Uh%YpG;x?=U za*BW`V(qr|Z-QGnejE{UvKGbn6<3}&e@hT@u-aY=q4e5dHw$HuL@;^0`gy_?{Vl6aEAi*&A8vn=X!m8CDGeh7A#!xvY5x0rC*%!e_0c>dU6xl zvxk}Ub92j0_v&bA4>d+o!g zI@!uug-?6J>ER_YZ+Q6FI{SLR(XI?X`BU8=lI8jE9MALZc0L`v=FNB|fbSxB3tfTC zHFw|c<=aIO#Sj5nQvg2wTQ#?_)Ke7EgB_6OQOtyJz45BY&^#by@LN0(Uw%cHSl|}! zAYS;~xQ~I~NrV*(rv#OCT~4mAFw%UK*%KG_gv#}&T&s6izTxpc#WqF5ivqE{%vs=R zrp2K6@#xSra$pK4)FbGro6D}TM0!84hvE(sJ=O82^7cl}gb^5jZis7xFTdxl)-ciw z7OwB;eFsZ6fTJaS7_Ow?Zi1cKhGB$DL0%}4!+kSv%!M>WQ=WGUFcjV;RHc?>_2lxW z!%^JoPe-APY?f={QRYQ6nfvAmS;q{|Rh{2l8r2ro`dN{e8PNQKcb-+^A6+vueX4^s zOQkM#c8bL%7#!K>NdY^hE@PGSpI6$_a_-kuTM_$-+GEf3^5`p0FRqEWe>f9`*%Lf< zsh|t={tRW3dh_(mpM}Qh*q4tiA4r0--PT^wO6G`Vxk{QUCIQk%Nj-qDL`1!4!*$WwDa0!l*xU-1TAc>lzo z+mJ3#`Ss+uhc0|S{@Tr6rueC?5W!8O!UQ`I0#tneb-I!+RdUD#?j?+pZnynCCP7|X z0^Y=<=7;Gzg}-N#Z*)k~AM+nr&%8bR5kwdm3h`&f65vWoX_WY!E}z@zZ^SJSUOVHm z4V{S`48OfiiB$H=n;uV}Hb(f6f2=jnG_cm$ug#nwO?jA`jN@)amIeWX!cPS)r)Gj< z5m3tVWdxdy7iIhBwK_cQ+;~Bj<`j#VQv2&VJ|sU@ps;f~AHt?!UVu-F9?G}sIMuO> zzfpAKOLPXmJdMdX`iPu=TlWi8QTA^eKFUDroPgfYRV_vGO*1+4lya}j_F#65;c6E` zSIYY30vH+pvbT}(FMCUEl{B6FvNw~%FMH!kb-%CQN~4;{YwYG=95@2II4-$ zckjZVrtOjzdMhOw`W)7*gB>L~H z0QJEqvEZiQ{DYjI_*UG)bN5l{2n}QCSx!1}?ZZptibjlr9rNksvwaeVU5O)pQ8c8_R=o>cULrAa2D>Rp25^E}AGA|3&^()GzWo zkPl>S{G$t3V7qNhBWPKVp0rp3MHPfnvcMm;?$~c2g`kwZj4XQRi41ee-gi$8KuG_1bev7qz7I2wWSG6=rk)U5Y zncKLaaJZVfL4DRtAG=Y|5r!2m63>2Tu^5Xj2=(JJ%MW-5k419z*@gZM=?E}2>B{Jg z*^BE}1VVD)1*F9cRA;dJF2zT+?8?n0oq1G_|J|3&D#XrO^%2lFm*0O!Ln zd7qCu0l-_m*)ygv)}u3*@7M)*$Qcr}ua3%3DxdJCVW8TCIbWW9GEC+;pP#{S_n1X4 zY(@~Iuek$)oG14e&B`lFT@Q);umoIn0K-s43@%U3FR5-};rXIrNtn;R=jXSK75%Nr zsi{=MKz^RN>+Vlcp|@gDUqg-3tzZ)&So+zeFr+9IsAuOm*p$wf$rs94#B!ah$uYbriHM2i?eAC*J=T$$pHmUd$& zU5$kLX*?WwQiedAiQSvw*3MG$nZjPCr){jxk0)CI^PPI#bIt3$=8P^+JU93SM@V+Z zm~AXI2ElipMSKkqS(|v#kbAWUy`K;?72n*24&2WV#`oAxuUJOeQaN%MDO+@5`bbbd zu@Rx~G$TLw(fyv@nA;?$v@O+6XnUb4bjD|Hf|a}oAE6La#wl{o^V{*zfm~!ddeW{@ z6v=o~Mq%Jkw^ zBE(scN;(RucZ7j|(4zCRVw3x{EDMhfAN!3Ptz3`a%9-i=wSLHSO-`5ehWupq%5FA6 z2d2f2tK&7NqYIngoA(I2-XkLs#x1WJ_DxKld=w{n5OXzY8|;~WU93T*USqp6EZ#dl z^uv6w5{8ho>j+rRr#P$xC2yg9aEV!lKd~{(vbS?)CW1khDYG5+j?G2|g_@uc438Jsx-#hGVfy6=wf~#n3wS zIZ+a`T7xe;bC-%$y?KVC_` zGpjMw=aByP{5DV~ z9C&j`9^y0gdE`7id+M7lf)A(XzHCzj-0(q0z}>=C^vpCd$?8PDydGBPL(e?KMQ_fL z3u`+(P0`w=>y2Ww-PyZK@!VX9%^G7y)5g`F{wX|Qcrh-;~Kj&5SQ1CUHWu`S&CM*jnjq8)cJ1%-8T-_wItJq z&_KQp9D(x5xID)GZa5eNKZTFU5?%qVIaG$D#Lg{O?joCXwJpD2{O2j&0AlDs2f`Cw)NFQm*F={H&Q@*b^=2ARD$9j$2H(h0TM^L&*had0@67rZbt&kpjzugh4EO!C62gb z^G!dk6n;$h=9cYiGV;Pha)Ztk^nkSKW3LlA{s|*hm_?LWCn(PM##=~SB^;H*m3X6$ zr&e?664j52+k@R-_}u@XM$wH!hG5$pqwwE_p z!OSO_vsAnfQn2#Zz40sN+<281hZW8cq856PAtR@h;2Rt)qIv0_{hZXb+jU zsr_f-6y7;HHx8n`0T#R+#R^d@R}b^PO24G?>=6BF{`}sDLm!Y^^N-Z^>p8k<2(b5S z!?hEm?+Y_V)>gPjEgjtG#)xaZZs+aeGywh-1o5DCxVFg?A4>x6{C)Ke51(pp1(Af^ zT*t`!q2P@fE_C{yxcSs}spJjSoWY{Dsy^SHPv3hC^$%2Xsg@-}h0PW9M7P)@t4Ah8NYqy5w%Hk$9a%_0 zpTH|Ce3#6PX~epKBjb`>0LEzKP|Y$RdU#gry5tYNgd z8PN1T8=>c@yv*bfY0n4@7qT3v-cT|6$pAQ$-QsfC9;;_&%72F7_>h3KE0OXVGX6$O z9S4KyVcfb8{Eq3!na16d?qM`?SI>`Fq(aWcj%kw*iNh$0!gF1mJp=5MiW{|23RDJk zcY`|pC+uvl{Kx8Q=oXMl4qoCJp`JVAxzP%KJm@P$9b@3uCN8ADJzMPo!d}Gfq#aPm zcgvbayk`-8v-PAJ_U%dr^lpNWx8_0?cMMVly73>wV!4Zt`ZFH|3@?4>Sm_}}n>|F} z@XKYEN3H~NRfgeKVMa2{umG|~cxzepo@?mT`lU7np3lMYUA^MlYIPNT0xdCD{dW0> zl+yYX;;F;$_E-feKX($mwmqT6oOW|C2rRb22IW}I&5Pf*274~x0ebpZ?IiNep7t%c z_b=WXn2!^i(|6}FW0`3+J-(5Yp00PwU^jU5OW**WfzYot*zfzFNvMb6P;ZPP$t2Js z>ru}aM_>%qdDStD6cXtS6mQqK$`bP5psNqu7_ZlvG&&~TIDy(An)vR*3UPv*h8_&o zaiTV&=LU!+VDdKY>2k$hjg7Q@AnOYy!NONKB2D$dyCSOSdxrun!!5G7emY(N`REAIw22r@l{olIZAMlNYdIc+=Gkiplh z&m*TEj=da8D-vQa#v%z#whlR-Yx!t%J5%Pjt|$svhuf=<_=auTRqSH{>#uC4+k}Iq zjPaOdwf5MW0`@nlN@LUmstq4GImgxgu5ID{PM;mm+iY_GSBvambve1xHLjSUl8+pI zS&(}lzMW2gn)`NTxsG5u^Fz?jIX7m$nVRBlWSq#Z5`OGStU;xdi2a;vO>hYd1sQY& z*YfzH472Dbf%9Y-VM7#pl_Nk3OE-bE$G$@$M!DitMN3)KYL@cya`A4dCpfzPqV_AX zh8%|7V1g-EP%zNc!^6x(dYmrf$(sc;YK7ZuK3Ad<2MFU- zLJa6*o3Y}Sh1-$QlEz?WY7n!La^uf}UP(7Qe)w4YyMsi$te)zOsUSU0$*xKB4wBiI z`2jyfs`ej)7Nci~Y<_!&1Zu!#@*Y~GlE-g#{e8mG?yYFwNaVrE?d36?;CyBZamJ5T zEm^mCdWGEY{eeB=M`mm+d?hZ4iC;ES^rBA|QuNqls-sgh#!kvSF_#Eu&9Tx?OKp@l zOw&DJ*5-B7i`F`)v5MqvN*~h;H)-!DXzwZ6qJ07na#1r{dowCdg@GNTiR$8m@kt65 zE3#IFIJj{%Pf+T%%}`$!4u~Lf4PLr$Mrc&Q%B5>}X(UDj)b=f<08>btsor6wsTf3> z=Ofj}2244$xW9tT48->$Stn&8(LtSN^3)@he{e;~y1c;oez))9H~S=R-nk>Ge_8Wp z#FjTW`+-Tg&Shmd4$>77xZ26W;clc8I{~fXI%&`30lXwHca^#Iix>M$R+LpnS{k_P z)}4!sE(PgSdb=vtGaDzE!?aU#7^K7Tatw|>Jyd;qu$5Gs8F36rsVyGMAm=jlF{2c` zgFn!aBB*+5*jh#oX!SAS0EPc8v?;@A_UCd*y&bZ)>;v0U_zFg9Vd|Vn5_T(ex*8;w z6BE(g*ucUj@wIIa`<*U$@*^T5e5)sq^z|IRvHhWfeEVo;i)R`;#jUXLSY5i02#*zJ z*Jt~hfm_nnTgSkpC{w#{o1uNZHG?Yq(NW~Wee`(wTfN(*A@@YNkR6Iu#Vn4{chZ%@ zMKGbyH@j{5R2<8W44D8jAMXT;ar=1;N90WFdT_I2>%nX*G|92h$ss5Or=OGYQ4-X@ zf%t!CZ|NwgAoyEhFt0$T<{!W>TfLkd-0Q8cD~uV^unAb+fvd?!5RHPq)wWR3vU57= z_58r%B~58_E1Ag6goK4LajZ)|@AT~^*kUN~_HV!IMSG7yBrw3VMIl2tv*KUEeEyhtl1rp5MWK=v)N*2OShiF$ML3s#%iltpz<-zHC&hh5S&a1w(HNWh9-%U= z#Wg}~+-M|KCu2c;p^};9*^E_^PItlN6t;GSP0~3xG;eCPe;hbzUK0Bn!i0Ipo4mY% z)|DO&A7SE+sK-YhGv-%Rs9zd%!i;ufUBEWv{s6n?)4g@pzqM?;B3}9Z_e3Lk3I1TF zvPD&yH;{r2?u$im6+Fi-H6JICv{qy{%8<3S5Pw|n25cX5-UsO^vaK-_2~PKbAsp}g zW^Rf8w$Q>yTtmLb5Uj6E*UJv^`kJ?Y_QH6+Q}RYqQ+spA3Wy zF@dQnp&OVxsCGMlu<_`qz{lRxeVMm>QI9KRbMBnGpR0G)yN8L3CrzMsaydn@_^x(& zqhJM$pIWhg?Ul9ze4D$ozrp*`w-Cx;NxnjK(78XkOxepcenHswHsYGY)fJRA7|XPnu(88=*0&5tzt@@=u#I68G8S6x5MiN5n!GUS<0?dCCt zA=U>tChgLJSK$X4tpHH@6mWt)_hYevFCg(=ptD<4;mo=ab5vu=UbpzOv|gi?e@kYO z@N+fQgW>%ITkR1erl0%PUW&n}44RSxncQ7g$q)n&qIZbkm`uH5=W?j8MHp7E6OLXO zeZfz?)DLMB5rl*kr`E3@dkc}g>mnN>3@5hEp}Qm_6z3Q0^Ka^P+A1gpp5Jeq&ce_^ zAxJ(qBmI%Qzjyl(AO5hOF{8ud%M%hOg>yzsX_8pC1fdbyL7W zwA>T4;VFrRZ2T`@+Qvho@$1bBdkEX_3*V=xpVkD9tc^&4HJJ7`4+lQc>Tuo;xK><~ z@`3?g+aUm}GAzfk6ApzqAN~NsvxB5(NFmtXj##ks?8zB6Q7xqq}lCwqWrPQ~YLBMFZ1pdDWAR#4r4tb21# z3KbSX1FF$zjuvY=$wP{fV%Q<>>Hi?IeV&MQ?!0T^MuYxVup0@dq!Wz>ny~ff$|X#I zPWL3{(PHR+Z8jFBJomu=l?@6b%Ghg`*-m4ok^Ms)`_>IRBG0-UZmeu$q`L}CY(86> zj}jb>%}f;>kt#T5jDIH2^}aAg5X-;Xr{K!CUtT|(Zpira%qQ}qFbgl#=ysxq7$fx|_tNcKQs};wA`Ez#Mx?9Z;NNk}I7b72?fZ zwM*ZHj}XXo-v=QRC{2Iv1`}KzJYsvTq9z-oCf!`FrjL1eWZ0vw z?4H8)>=MnQ|Lozv3*eYp;>$Qx%&FZI>4!@j)+i}V_Kd%BwQ@S#cs0i}-5h3h?D%}Z zw2OJwUUHLU{z(t~6Dow_c{z_&xj$|n@e2xFgQj+K#&C^K3_e-3K2unv;A)ZYgR>1-j(@1X4D|C%&AlE>vYG z6qoa~lJnP6QWLDG-J&&tO{hrZzQ+8Z5|K{paBxSXcnMMT3}D*&JgJu7ydARJ^>-XC zLLN;deav-JA#CqbBuXt>_+~p&MmBkj_^h&o0CEn2bxbzGifYffe~qFKxcRtWvsPMJ zFU{`rnAKvx3Wxg$J&%n=$V;bFdq$s>nHAoXul4;9M0k|l>aHp}$5Rar_Kb7|qj7xd zfQ6N&fbEFaQ2s5C4(`qCV1f(#fti-UM{l(`dwZsw4M4KZPJU6C>jBAbHbuPkP|@hL z*~}_0t>Ex-w9t`eoTm)M!5mZsfKyYGqBKI#r{N1XFZB$Xg2P-4^s_Myo)}Kcz3KII zL~bKFOdqDEAv<2YDG`-SKS-NwAml>nCbUhd(e*!VeZa@uOB>Cd~xI5E^o z<4>@yl72_84+wUz5HweWoN7`g6PKf&2DY7Ik{OEG>bWA8f)k3%@|*EzD`0TxC~9xQ zIv*uw8|O|9zR(*q4j0o+yJ{oS%biIi9;qgz3XtM%uBFn+iSz}M7)zQVkol5~+$}DQ zp!MNxCr9{hzeP$g5c)a|c?K6Dj z4;3hOuAlkHVB2!^fzR*(-*i?an_siMu6eUInsT+!F?%nm=%Sq9EiiZ+?9KXVpp7Sr=!BOnhDBuLv__beHalU*LQ+ixY{_5Tm*0wwpNM4yZ6M(`9OHJu!Rmb4C%y>R)KB#WV~*NU$D#7@L+7_l{V?=a#%Y__jR6oEWf@Jm*bex8A)TL->@n6`cjyAS|J?sORVb8$A?uBx1P0oP6?Hs^JsdQKg^%P| z3p@d+4v>Ygx)5cA9G2@95ka*l^^sW@&76b2FgPbUhu`FIj&)Z3!z)R$|3?59)qXjD zX^1PVcNZ-46fk`nSmys5DC~6!c zyg!u;%+K9!LJ6FL?gSwKm@g`V9HBnkh#iI6K?ZGx5c0m!U2JfqGm&HI->S{OS30)s zyTP~$VD6>x>S}omsb$gcDHn>2EFjZ;N^1c!Q|AR_w0)={c+-(Ej%MOG8(5%IFa)_; zf5PdqO4cOV-F;mK>EOBf{O!5dh@xkc=i^5+^`nagd)(=K$JVS1Y|MlZ`Er{ur+cJa z+FdNucXx{YyAe!zR$8Rv-HERSJdq$_dY|al*cjE#P+)1DKjKFBh;2r6Z78q>Z{)(1QrKYC?;(RH&30@1Iy;z2C}BQhXMpk1pS+j( zJc;ZYgsAB$_32eQ)peto)W zcN3HSs*RW%iZ^wvqqywvNc_O1@pQoO{eJ5|xO961`ZzFC0bHK9@2{61j!CSLqY^7` zN2SR&=a82JVDq2yIV3ruhMrTA)j=bzA~&JJ6RmI$Cibu2U5Uv9wi$k~XcVAi(QJKw z%l*~1OmwA3>(Y#~Y0v`qgWFte7^}K z!hT(~*)UI+GG0AeH@L##KW!2)KskLhT4M}A)+XPDfcFD8`oRlYg__tyPCvO}i0{fY ze;M1J67C<)!`LM;L2qGKBh6rB{j@ZQkqOI}w(W4($s=-C?*%*!z*c@6XFCJoaja{h^uXt!49h`9{WsAb_uYQPax#Cg7dI%_?+iPzug7r!kX3g7FC6C|=`orNB? z#;j}l-D5Dv@>cW!UiOh%T2b0GwAUtNdoytJkF2k}hA!bDSQosePipMA&a-&8`R^)k zGkGw$szH9;MN>3K3oW@t0!|UYh3NP~acfwEZxre{czO5Y<#~a{+R)p8njK<2n7#{* z!)j5zpCBj9m?eo4UiQTL@I~XD-JAv+uAg)n`zUtp@K2$26Dp58G!^6rTiPBO7=+qP}nwr$(CjhPq| zJDF%EwrzFn+yiXwD0NtKTr1XspAny4kgoVK*+o(yCTTyPRu*cHhs|2yISn}+-QpT1Iv&)9TO z1RzLi`kR!n_UeNPBv5PmJN85g@wdyD+!gLg(80%!E+N5PWRQ$C1IPowXr*p=c?Ev2=X0!)GJImi4}8mix)$_1;<zFFI1R3N%`sf zeLUQxFg2?jXdJf<0HOp!ry6Yv&@8H!` z8Xd-h+UNjwh5hfRPGwWwKQ-5Cr})0(zZ*BVAU6GGudg%Ce95mJq5kxN#ywuSitfAK z-YpzIO>ek(wUkkKc@LMI@@B*88$xDbN%_O(!zhYY$Lxq91O=)0-MHdx{+8os6Ln(` zp~=#Un|wD2_%s+#f@10mob`V=f|u-`$G)A<%}eczfp)6t6-U#i#XI<9RM0 zS_X4jmIG1BkR0|mVpraY{ko0E=RUL>BfUMEj`PZHwbjQ8)nViHfVL!+hBQpRLNG>k zrl(!HW4fWx4hm{r&bu_>Hl@TM#QnHyO)bIUpPQrT`Bq>E6%-hJ{>vU%0YjW|rP8<+ z>m0wVY4ugFpAY^u8zDpetd6J>p4o$)6e525F3)Li%*`B)W%c-`&E7!- zOo9EygRuc~`97g(bwR};kTK6S%VUkk`l1MJSiqxsrNp-3AlvS#S97k?qfhh+VJ9q7 zcuAo-NpnDd6%b$ z=y!61)&2S^tgmc;2pZVuX|Mg1X|LIWZ{BQF!)gPFf#)&5!0}=D2NJl`>g3r#DKSiv zEnt(5V!>G+8-6$%NZ3ul%Z=NU)yV{VS7< zzO!670l+_sL?}fpHRWvh)Bw|Jilb)&c zLmO1}W3qm5V~mb%8JfRP8*O)~FnJtn3z#QIDuh4F6c2qZ|MC;A`sps3 z;Wzur&X>>$(3bgn;&`1ZAWtgWHOCh=UCgKpy(6}G)ByY@+5RrcK#;BXd>FC}mV5SX%W#wIvVjiGEK@ zF*_+YqW`bUYK`30@PgN$hF1k8k#_J!Um=c5vo=nbW zQJ%*8n!v#Nlj*ft7QV|x{LntY&}6l|i!tNVNudc!t2aSydAMkd_PdV&bMUoif=Y+0 zi2Sal?1CdhS#`=vp<$+X%RX6MUN}XvKoP1&PUN3{qDSvqsv9p0l1D0!W+J6?qXKKx zV!h0(rZ5{%AjT@h4DK(f0^*t>otlJM<4Pn1i9b`)xOmR1e z4+e9QTQXc7;zD*rEWs=O=vH*c4U60M94M3HpWaIb;YpN8qHo(nS*oP_@K8bkjtIOU zg(k1NV+s7VnLnaW+Xc!&LDFtLEOGc^pYtd9u}3TQ01vV;rs)9nf$oCKm{25Cn{>qz z&D;CJ%Y%HUqg5?IY?6Q9U`bN@^J@^U>U7!rG6wHk8ECdAd@eNMMgyW0gmEvwN`K}! z*Fo=&dIM%15WiG~Ib&~5ooPpq?9~6#!2dmF zvFC=qzqwi?ORp}n7~Vt?4h?Ugt9I11KZ50o*1r*2Dns( zb}hbcz=?k3?M^2f;rq4RVGXor-$-j?W_h;w?8As$q>@tQ*N_*pNN&)=q*GRqP#&$} z9mt4WknCZS%z=|sMZ}-}Kk^ww4ERpZQh*9-?8ck_xY&@!hF>5o)XDkAju8{SM5(Vd z@uzQWRzoy2*ljW2g2yinlZ$K0#3^-_`fY!8y}?E1DJwsVsqIYHdjQL$t#*yOZ8dJfzn-2S;kKtR}4(Ji|1?kIMNN>m9!ZIshVU*)<-P#TbI+pS zDpUFaF5;kT%2y>O5uh2o!~M>cT9pWIY{p8JURh|+(lT_*&Y%us7qVEhgnnuH5lB6 ztyT#+<1}FcRl}pA5(Ei%9+Ak~V;d&Nkg@*hv?X9`^*g&z;5=@ttOZrV9#oN)3xedN zDso^d^Dq7v!V68#kG%od%)kLUQ@FYG@XShfak})(TT9)m%Es{aeKwaq&h04j_EK)+ zLwTFJ_57iI#g2*feHRTET1nlnsLRW;cj+cfOq}tWJklk~J^ex+xa32c9Vk)H5Z=@9 z*%-J^b9S*(kPubaw7d3Da8>;vvx_)u_LNC9?lAHp#EZaEkG(N>jX_-qa1O(-5_1Tu zGtu~uGoiL#>rsnIiylF`U;ZUFuWb;BNItgkzl;hrr<;w-w80ryh25}6aG0!N%)z{& z38d)24faaIDfj3>Y|2If6iY-D+vbg$RO`zA)+ivbIWm6PszdH1jWVM}r>29;D0iFA zlE-QeL?@QzOQErODtC%+1*|$!`v*8V$ST%R;n{q_`~{$TH4TFDv@{SeOLU!Dv>^j- zLE>}wSZG8H(+ij<6x{`p6`$2`Smeu>7^gT zz<5%1@;<1O>qW_1ki6&QOb$iUsI5-a@=1w9*u}sB;XsaiKQz^J^ASjw$1+)8GG1Pw z?{9jf5rO^G#B_H^)j6kZDJMgrD)bnepkL0NpofKBRv%7<}kw(U2-In9!?%!K9{rnTn3tEn~9g4?8te zotsCVS^EG;d{UD(ZF1xA$^F>O`1VfKF2```_KK7KQCBeCEXxD$b5?b}G{vvHJm~z1 z!%Jz+ckOKK#V1`iU0rsEWvpH*Vbck3XlJ}17TbxEW!k8VBed6stxZa%*H0>T?R9tXAk&-eO zx0Ck(cVz4pBpG$e+70BLA|w6%hm@jmEL2_VeXX0)DW&zw*5%qWSn1dk1;dmCdn{FC zqQz)AKOnQ9n|!yVkWU=vQ3=s4o(nPu`rL}}J9&sw8VXZquO12QWkX%*)_;G5 zSDMGb1}3CZz@E{=`Llx_b%7qWYTb^s+;A7$H{d91DmQuxcNX^FdV)=2e751+qbX;u zbATRE7Uy4ieS;qTw6!<@J;GP|fF(KNMHqA>g#F=5cWzjBC2TO+Pfraiv8S@ol{D2?@*UZqF;51edK;%u0g zY|yU$8w!334LT@=&A17Z4k;L(&-RPSJ67XQCWWd6?}0WUePZ`ag>j^e@kWssX=lXV z#y&leE*qGAsz(DRa&Wvjr;yo0QYf`M2{T6wL5E8_`772$8){ahaw9uuK<9`grPGJs z38`SSGyC?Uj_!4-FTSp5`Owz=t6DAQG${@}di>v!DynYkd|Jw)KWZqPAn#uGN?!JV zoYDh{IB+?A-d#t%Jz|A1lQVN9`;Gctja|L4F3UXjD@cFas%S*mpGD0qAOo=!oMIR5 zG(}pn4Fyy@n>BVe8A>t2|9)A9^!S&3IsBWe<#!JKA<_r*F4V0-`zQ*nlHq0L(e34=h0VY@0!1>8O;LXB>5;}F`H*qJTqb|9O;ClLH!X#f z$q;AcJT99;V*Ef-2L%AB+B``ipS#povqaePWm4~R=9#OZCHRjN70*ph6U-e)KWUa* zTqNEhOFyrX`k$zP5A&atlaN=`cB^cf}W77!J zC=4YpJC6Z|?ko@sw_j`qg;PforSqg9sF-LGGDy5`pi%eZD6a|%>r-S(ekfxLkEuwx zJy}pv>S@oaED{wHel$OXL)d+o><;dC?+k5eVk_stBeXFG98ts0DIqJw_^1q@6VbxD z>?k2=sI~c6stspPJW<1FA-A|!DOsd#SI8kbVno&gpNp{7HR?7MO_NEpyF@LO2@z1D z9Y6mTcQJDni$SzT72+(?O~9XX|fNwjM`b$~JG3CZNaTrbof#U2447U6Vr4j zt(GbE9<|dJ&9>NW>Xs&#jGoyL({0~J>x7os@AWL~0SV?1d>A_rfP8?`sn^XFJ{=yz ze&~~w3lguMi!q42+=qB1Abrh>vcEk>K4l}F|0JP@HuUxxADwuV=xMr%DDK3>mKBh% zvTtiW@^^JP3NQY0LR4d`l4y^qbw{8C+u4my0As<5ukT7i+h`Bz)|Bry*;>G0o zfy`rPwKSfC<&(jxdKI^VmF_b)Zo_5rAI+yOi+p6>bLh+_UL)m+u+}wv^PeW9Bdqh; z68MUG9NWzyoLIt?zJNIN!RH(A;+42CnQ?3iYLI6-`kAB^-}3B$+Jl^%cAPJcVVTzF=1 z(V$WqickSR$so)(fo8k!5DKnxBL3!ycCVMxq116*eElY1|M8mJp%gf#9UdCmwm^CA zGvY+$P--e38s;!h37i637f<6%0VWq4G>xUnKMRza3H!ClnkiCd;H6qZb)}4d5l*#1 zuS%*k9^~d}-xPF5j~8ea3uK(xb@&0MbT)Gb1n){D6{SVL&K3?&7~i9^RZAFuhfawM zKMu%-52VEd2O5~3kS_q4lMS=JH2k?Ef>20;HVMI>!@lU0s6W9q7#VTBo7}tOUIr z87a+uJ3H3PW}ZCEzRfb(=%+$e@gwFyQ$wQwb)+wbcM2-i9+H6-=*J)yQO zZ>{}Du%WFU!-w$))BW(h36`twe5LX~1JloHjdk@oj+DiaRpNLk+6Uuuw5y9waf*so zp>jJ5-tb9FP|3s;QkW4?Uo{0cvv**;@Bw{krzw-uCGSUi$EN}RANfVh3x{xz4KkQH zyOlfByC79~!Z!SFWl|RvE5j?$WlWK<2@(xs&`gEo+IP>JoqAvJSz6d9w0$r38-GnK zbG3R%_?;2=y|9_-c=Ui;-PgwjyG~rQ$o2$Z` z0g~V(!&rvzBd@QAqV;XYROkY)xoJo?y)O>*ezsWgesF{yy#95nb{Xt;p4^Z(E6Cgq zhlmMLY{g{j+4aTGDUz{p3877%5QHWRtDhQ|D0U;ldX$32X>nTb< zDOP9E=%>b!wt5WhtPIK`mcIp?A==S(G@$aGkP{+aCZCAnTVBwGHGc(cmko0DLm3+L!M7W*^CzbqBfU6ue8)^{#4wIE__+n)ggP? ztWr{GRv1Kepw5}g%a?qg6=_1#qAhEa%}TIZXB>a_LiSIhf-hdZsv113mPc)x*knDu zRh^P%Qa&~gk)+Srf5e<4ff7ADWjyQ=R8lHmjSd-;C$U00{g{t+lvr8s{hGn1p)!mq z801`wSK-4K_b*l{2ix&XHr1v2$A~U9x|N*$S;P1~?JcX88_Ptz_uok>lSipZT?ek8 z<*jm^m!=dgHA(EP-l=S?ee#I;$hDEkGoe%Nl@0pqHR@lvwX#nu~&`KCqOr z8q)xlGBb&46;QRwubELn;H5@F_jUi_k`fS?tojgSS$7~6jyI0kcEB;&GtOX;?{rG8ihjQeZNqgGcpFMtFynjCp&V6ssMV*|yjR_SNwLgD%L@5b=0f-(1 zg5Cj1&iTV2uIdmY-@_Bm4>2t zEu-;G_%kD{#D<^~lK0AZTGkFFx0FWwo=cgH@NqC0nZ=>px`k0c0fyl@u!edMpv%-d zWn*AuWhZ=Et))|ebc8pD4`4#lwQTs${258dGo`g?Ia&5lv@!RUx^gCBf6HTo4u%x; zMl+&Qn-gb^a~MBt(&N%FK~8e97TMm@3klWlnr>{L{FO<6uXD-OI^Cm0T z)%mwDulVXCW9$6q#~SNqRyNyWth*raucz=JuRDWw4O6ZQ^Y_6G&fhz^zL9zO5?~u*RMeh@OYe{rdwVnY^LH zVxFAPJedE3R@-8(iSnY@aam;D&3_-^n)|}I(Q-Kim=jwN&tKD>s4j|2m5Ra~nh}9H zaaknIBN>TQVm9w#y5;D`I44EWbkFb!m_|57eb<;)VievDv0#Cg`s)u|L|vDkO?ZK^DDamRpIXe-CxnV99{NTsHygug&^WfbL*)7ny&SL>h$t(@s)*P&n-aQd z!V7KGVs$ft+%={m=gJpCN$8}p4dFQ%Oh>N{+Je6Z=_pc;@{n~lUh`yG{P3306h#=> z7wpVl(l=B2I^E^_9j$=zWPes{d@VB-qTe*-%n3|qgegFX(D06#RH#NK*8 z0ZHG@aL%x9=!l4`ZNjDaJSUdSCx5fkU=a2}#KbJleym@{zwt|aMt4ylU-v2w4uUd` z7i!TMzsrI*CVRS4pt~9<+7+iuyS)tM1UJh@O{}Tapi2D2>Gut3Gv%s@!cAM!wpU|L z)6=t0o10pobXQ;tIi{q;s1m z=q;xo6xqJsK3!D{v4uI>hA>a&IVK<<;oVi zNgLt|s%->$kGIX!e1a_TC4YMmAIY*dd_T@!u5W7-tS~Z!)_E(hI9pKG_HKsm3dLE_ zC#aV=_O+7w1c@~F>w@oa#tm&Q@Gr_$`K$7ROWoUIAM)}rY&Iw03QA%vV60uKQczb} zs{R*ZVIASd^^-3W*KdXAVuv{Um3Z47Ucos^Ln?5b$BEI}<4{>hQjuhq#{j;vHk!2B z7)PsM_PHy{E`#$@@smx0vG#<-`O`YWT}{*`&*<*@?>o=X&5VF?d}p*{Af04#P5HL~ zh;Am==RYmBguRY-2VnQE^=V15ZA^cH_gsi=MKfaD68g_>P{aA+Da`sEh&VmnTVZqh z?~~lLzQj;i^2a2%r!=fAz>gbzB~cwR)WvSVd&>=P%5~@&e$=FXutK4moKo9LY{W>r z^Uh9$8uWt{p)&l0kWZQzfue95W+Ye%^g1%;c`Gu06GFN1r~2yCh+4q>lZ|?a{)e~1 zDQy8;7N7<3q#{J|scOU#^i)PCUOqrO7#Ne2?5LwmT+O(cERmUnVWMio&0%m(vc!I8 zBC@a5aZsWQCbm=_-C-*_O^-pPR^GLT^;#3Nu@c(ZY>;`jk?a%V*3zDTceDI#9P4^d zU=Au1m{nwMk&c#}(Z75QHKC)y!gt3Z>_aG;@`Q|*wjr4lmP{(HC`k?C9+kyT{kk@J zj*q)#)d`t1g_CM@Nd?-Q$9K?l(>F2^CN@jz90qffxp)n@VS2rucEeBnwHOQMn26Ob$NJi8$@;#v;%Zo@ugQhqz`$|@cWT1H-Ra$b6U zBgQHOn1t)9vWtuRQya7=)w*`-DvN*#nf;755-SKidm@{FL6jcUO4PtFJTyNJH+tP@ zW}0?7!E-fy=Mzel9WK_nYbSxn^`h&4+AeCgLo6)1xh)TGCUk%N7mDo5KhCseah4w1 z96=P$rV{_E+o3*5)1%Qt!XX36 zgGmhWSRr%E=r#Wb5@&qfRD@IY1^a$M?p%Cf(|VC9X*p`GA=VW06w$O&dS*A&ki_$m z%No557si3I3Z%Z!Lh7*T9Y`B3K&X?|nNzNX6~^0u&cJf5tH5zQ5OZ>Lku%UnSX7X6UmYi>}%s2Hz)tS}Y8{ ze-Mw+0^a#q_ocf#ML+sD7Za$}KyL=eZt9v}dY49SxCr}&JSYd}%u)CO;{m!)BX7-x z;)mOlE9W+lhxMOhXq{v4@1ZruFLFH}&rhMxrk@s40gWLam49B#>Rf<=ymTu(LVr}& zB-R$oeDRF}2<67l=Ijt8O}uoXjG+chJvc%ERtO&C^8?r*u400GYK(*Pj}Opnh-X2N zWOrQ1gdk999(`d`N@W)}96HJz!)C8N3~0aV+oMQGdC)|`1S@>DTN z+BTlUuZrHi*#$SP(_WT?e|dLgwA^QAnT|XU0g|!`(vNl8cLHodcy#ZDA~c5h7GarV zA5(Lfa=*(fSnnFd4ah;$!8RlLgEwdpi}vK?ny7U<1ZTXH_1KYj9Pa0oMwP0Zv!To> z23{23GB{^PL~Uy{wG>gz~NKRY}XxQ-Y`+kSP$ z^6XO9Gql<5uPf;DZ8*X0uV-jXRUWJ_eSH5K>A07UEt^}0Ww~Bg<|@^O=z$_S_&sI1 z>4^qp_2Tu2MZ_wV_-6|+g`37NsZdUT-!J*+f_B300>Hb_E=t+Q>jFCON_Mbry@|cG)3SMf>=@1GH4ul8yVI%Axk$pqs zDQ&mK|FtvN79!7@leeo{fYAiMpT{pNdKDyJsyILV($)MdWI!U!vJ`QA`o|DiM+Pyq z zCx-zJw|?+4g-p5EqS!Zm%VqsLf8Qopw*5b)Et(;Szh;nE(0L$a!ak9QU|xR&=D_4g zN0K!@N%NITxJdD-keDlm@ZF-9vKjdjIo(=R9}M(sS3P9=qL0Zgy#?;7Ui2OD16ImQ z&mxC1``k2>$;tY6B&7(nb!xrdex1*6uZCn8t#Cshtt?kKmm1QXCC9u`K@(bmWAZB_ z&n#-?zk-yNebZOgK@bP>@7PqhY-u4*4QR+m8Xxagq7svXlOt4Nmkw1t%Z`*zUAH)8 z*dV0%N^iO~oclx3z>|vYCEDRgr;)ORe@o}(E1k`_K!zoI=0*x9Mc2yJD$Cj7l1tX< zt`cw5ypX>#EP z6K3k4iwY$H1P;pKk_l&O50SF_$9gvWOAj`Db@AGwJ>>V&bZdPku#UVBmQ-t zR5mI`4PgvrFI5RtTst0exa@%u3scNKBsBR(6K?1;_~Aij{C(j4LeAs%x<4(st@mYM~ngs9n5c3LY# zDCPjkld^q@AVf9Xo(QNR7UN@X4db0dJXP49#aM|G`ttTpj2%jvPgXdKE^m3iDV{6f zAq*k4X8k>9=M)M1F&HHaU4mwu#f&*V?$Q_PTT3$DTrR9(V+qLgtPuuf(p(%N^%9V-*Lwe3nww@fXw^L z!HgXsQ=u6*H|0cn)mwb&$RbwF7|a4z57BZ zQS$*%=YTqV9N~{ZJH7&j`5dPf#NYG*k-sWU%rmaMs2B}aOpu1XFe<2MrqKM618K1B z#IudIU^6Bxyl&i?z;qH+GX3+cqe-7eXb54dS(%X^XX;N@P z;38N$ZUhOTYG0JKr^#x60xz_(0lp#!)C5AtdULv>@n7_&w__3o1&0eAApA~pwri#E zg!$gNqI=QgV=Gj>LRFVD+rwO|aRs3}#i%DG@OM<$ghnF&{S_v@gt&Nk_~2L-F6{_ZbV)gQMu(z6ri4S8D;DBF5v~xs!Z$45ipi(GtF5WzHKt&)ymmj_-Z-?z zrDz%nRD{MvUSuz%A!i+#Lg9hJsKG|_IZmMH$o}fO`D?iiU&O()PcNIbuzt`aho!1O zqY9dWdqrj&Q<1+HFDuOzdXjuu=N1;mN<(seH%++x*IKoPbx$-$dc#_FVgGZ~PCaiX z#R)SzlILMTf3AS^W`FwY5S}VobFS@TAj@ozc|RPZCxhHR*Vp+X98Te7-8di$j@X;^ z%Q;-dVO;rx&{ip728ljU!57iA`$pg!3SOYJVzLP^*V^n7U}`2>{C*l~16iLG7!D;) zq<~5>C8aYJd|H;F9`#E;Q}pi42)xr&L5vZH2WcxZ)7X?uvvrgSW=KzNb!^;#@^a;N zAFWo{b^uwTqB#;_&O!m6uoMq0a>-0vV86)Zk)QGxmA?#46?Dv#DAutXw%yCFiG^-? zk3emUZ6qNX+?KnqynPJ^sA}qk8CW?v46!Jwd^+5)_}m8$WvoeQxfoQ3O`k30WJ|L= zdIsuI4mFQU1OI39O{7L$~x9$ zV5>4ZUD;4e*|4XRiHX&OM-F+7;h<3jdOdlfsg@oj&$N}*5trki)%mr8wt5=7LDMvK zip<0;Y|w+b!WJn*ywYTEk-lnR4eBIenH=YyVc6S~mKQ>Y&S+0N)o*Oxh!?^SqVpQhI6?6G+tL`w+)`3;I15Ci{T#n&irvfNgDMF(yVgO>K1SqpGFE@L;@^sV% z^2vr8f)=W(v^5Z^l%#dU8mqFV(cuGppYEVeiRIQP!O$_`*Ua zQV`W*ofVpuMgNq~UU|j?W|76gM%(B;6jNjGTAw zSLprO!vM~4a!D_!I>a!&4&6WamT-!Cf)?^V<)xSj6g^fqbwss>ddJQ+kcJ(G40vU` zz8DdgS0f7QYcnq^k~d{ug(~&9vk7KcxdO-u?7w_m#{^sHBUc?7X4_*HEKa}>Wx2`c z%aj}HX}QK_8-%>aoX7dQVZ055^?@F?yi8e^8+Z6(=)<}N3h=5VIN|O8T%rPWNmP&0 zJn;?M4rD(MhLF8RlN$|`H@|3e?e7rcF_*=CI9lY zW`A;^uU@5jP%0<@Db1z6@{N0BFlX>Y6Spb~9C+;w9PAI8YZbOikqI?q zgp2f>A>EW*X#6{WMUuctC(H2GCFk|t4L1{4W?7USW+kD zrW)b=Vzee`VyVM9+PVevb#9<%_WZU!*ls0H?+H^z)N_Hf<<}KB$Q?X_V8PT@yX$tV z;`pszqh5YnE>mp@6M&hHzD-DG*-$KgWNoMOv*^G=%qYK%rq`_s@oK(UD(pJ?p-kO^ zXUff0LxXG^FjkPsvHFU!Ohs;{Q1*xR4GYV8Q4BPFGDT*@_@v@F0;NxQ!l*BiGOo#N zkCp|70fr21pWFRL=sB`psHdp2Xf6eS?GVQP+{PZ`e=BI>fDK^@hS_fS{EG|^R;O?? zVx~xKSRq{Q^Q%Cp-O8{3?dyG!{Azkm5VC0STw`nxK7+yeYAu2- ztO9IVaWbzbRA--CEq^c6K~f}E0*fclJtR>2&>pdJo^+=796G#d zg!p{2sO*rINf@QRv}MgYDV3ROQ)0p6O<0t@?)SC6hzc|IY2gL4|7XZbMpgGeq%k5g zo}pZd1=6M;+q|a%sLRwLEZ_HO= zNFvI}$pc+(KjRzq7qpyGl0in^2(;XS88ZV^3N1E!b(0v#9c&r%)q&@@&Q>rt!K%Jw zjAR~(VJM}59$^bvQx*&CF@|*%D?!nW8pcpl9xbL;Rh4wANzBq$czRIo&9D5wV5p*( zj};u1m-2UC!uo8gBVm=Dg`tfsvv6E6qCl=zSjGcUC?1q%7)O;_!6tX*wm5 zy;`a?!`pE`PJr(y=7w)`Y7utXA{>=0(#KR8G@NWrz6Ft7#`RSzqhO z$AVJtR_y;it{ARHtC9i(@N(GowOY+C0Hu{hT$S}E;UVrO&bjnCu9_CK-BrntVD)%%a(z9WuP1J z^AyPA{(^3k*&&GBGGA2y?t8feNV{bM+vuy{#@B-hS!(GsJ3MRYmuR!YEQO!zzM7=F z2paJJ6;FQ@j=wo}2(pma{drXRyU#AakSyt%CRytD(b3&&J1^Z$ZzEnI?lUi~2x2T# zo>EH;k7h4TCdw;@%Tk`=-G`ej$(omGD?`ScT?cI>UL`tyX^piTcbKUgLvnPtT*x#p za}ehaZ&YsD2aU@1l6aAMFHu^SG}Ab(c`L!|n@8vXa&>7W)i>U)x6(eI$WhNNSQP>7 zT#d&iNX zYB;rhk?X*XRn=7BMVaC(M-$^^`M-|{1A0YXonb#RngIqbQN>gkYXLF#Ja~@~rhT!k z6YL8I_7Dq>VyV9_078aNtC1DX!)-BCpDslXHXCPN4WN_=&=>%0@Qe7%M6 z+H94o)M$(rr?Dw{jBdasUS}zT9dm^c5H<wjoQ6lM0$4U2!NaFY@b;Nxs=&R(qY9G(>#PEPhhEjMXaI%QZ zL3B?0aG4+cwNb=Lzb$#FmT*yQ!GJR)8IZn(y5iUCSyh!V!ARgkSszGJmjRUs`VnfFlMxVoNHPxs77{W z5Y#e?Zq3&qr`Ga9RO|h>jgtOvXY1&(P_1VmwxtW^aS_4i);AEhk*U`HKc`=7Dz|t2 zKc}B(QZ6QOGtn!8khJU?vD|KsRCo~g8=rPs9sz*DM*NT*7n^NPm4!-`{U%m8o|*sm zL8EY>DFqSB4*lILY)qUhVtTo&yNP`%9cN2Y#IaTP70x$7W2rPy1OfhCB5{)tG&6X*pV7>=s8z|AT;t1S!@DI+1@}nXuV#nKw zDhgVs$kK@5h#S*IrOh#N79Z|-XrCs4XUe9#B$aPWOQ;@;(dY3Ej$e~!<4u$_P!a)^&h#h=Q+1*vmy|fV)4E9&$sr!_wJFpb0Iz1fG&lI1V zi1h=OLZxKoZ0H1Hb1}eDNP?=xriQaC6|t3GbZ!o~U~IY|sCob2f;oMdr{)z9o6`Z4 zI0@oG>R*eS@SmdLotqo8(srT)e$}gx#2M`QUN zkC#Y-xU+SvvzFH0m8ECyXrHzkJ}?Vfo1CUv1Wss}g{{d))+_!p1SNyF_vsd|k7ag1 z)@pkdCs9X0-?M7WnZ0SNn*D;o!lBpt>SJmSR=yKb8U_%BD3`OpHz&tS;C@d=P)j)mOwF{VvC|1LGl7tTzVe zh-FxN>|SC{p=m?igq5uCMnm}?rU@4zYSjDDNFMf(5n2tm+7KMtJM12CjW&3p!CSQd zJMFtHvmjNAw?G=q8JIG# zsMXgCIXn4%jaxqX0$~@339#WmjorUW+hrl@+PanE;d*t>{m&Piu~ida;eG9_XDpw@ z!an#ON>uPOswrdiTUH$Bo%nAx=aNxt%KpuY!3&6gustM8l}BNFO6cGIX`#!0oDsp% zp1@G{Kbul%Af95qz^HBHp~XDbK^z4RQ&LfkhJP}f2!#uYEyz@zi8rB(qi8BD@X*UG zsL-esR;Hm@>!2!7(XEbxv57(a!nu7<@P$0r8m7CgUBz~2_!c4fW+qff5awWC8h5Edijx| zSts!#c_xPoZ1d7Uj~P|uy5NFOv+VmgzQtXAG38IU;NP2HP*Yx)Yp0ldV&Y{m%W-quKjhWUQr^Rw$2--DeeNtq zjhC(Z!4b0vFwd$>63}owI+^oR_DHXizzxg-wXW{{dr$W=P>tfeDX@VEkLLnS7!M(q zld?!OraG#*&hLhpn++q|A!EV)C&o04n4utt_fHIu z^%tDEXtDYbv%98$-3JBn%hiMjQOYtqgrZlcB(=`r&*i~7QPrT_#kbL6#A&o4^S{%Y z@i?(JsY1(Ox`>8Dh&n@v4jZ;)BwRfh4~SyVI7g!q#A z-KRdId=^&+SJCEa@YEvd(OZnslP~H4>Y106pKyYnxb+H{nN-q$6k2fn;$UQVgzRD0 z5=D^)9#+h;soM2xG!b$pD?2MCIoV29q+;*7210_CzrlOlKQ)x(Ib24lmBQUIJ+>Y1 zePI0^LmNs54k{s>+SpvQhy@R7Vsw`g0^yo~bRFz!D-V2|1T8$SvnFNs;4}?~V2S}I z*gWC{wkHfRrh5y7T(v~i|Jtpwb17x!=njAmjt|*-C2~Dmb#^8IKoo{EgGac&dD+mn z^#Kn#K1g^M!2SEJM$tDEhd_Gqu}sNx!*~cQim%6k{(WKkr^s!IYuAmeWW#+&Ocdmu zOJomy=UdTu4&Zgm{;qxN^NZfJ-(abHbsqSrzMgk;lRjXPgcP`ZE=ch|VuRCiJJho;-Tg}{->k0!N=!AeU3u@ji?{mZ&SIYO4Gr@r!N0s|J;SMu}K8}TT`7dZ!bJ0{3v8WgtoU} z{DS~b8%#T~$EWn9gjrNpH!jMYqx^hrx&p%VSkNKqzk0sHCR9bjZx|ESx*G+h!CaFh zu?}6vjBW>BC7(nMjlxxE1q5L;#_x0AA&Iu}O*Oe>vn)l(NV1#=j=^eN9^}LVwPS3c zo^yq;I{y49R;WSWZL{(_o-nZ3J_7L!Rg*py|4e91pV-(?3Yn%3G)>?u-5H<>hrT~C zCrf^Lj#^BMI$nrvA>vbs~svISQOu!kjrwV zzNx~5>?w#_AVK94K*ZT;Zhu-UBfH$GMQs8oAXN8>oG~iVO&zzS3`58O#3LjqJJL%a zuMyb<{t1gv-4U3Tp`aG&(0k?wp+zoNRT|Df=pue%2IJYT8(opPMd?%l_VBc ztwkHo&H)D%S^5TDX4!{z4Mmh{PJ$_dP~l$m#aQ89tz<&!$EbeOS{GskutBYeO)cdr z!}$q-ulvYUinTQDx=lFP7WRew2klChojoz{m_QO-j47*(DYU=+`H#!Lm1ZZKm6jya zPO1*W^D#ygC1O1o1%l*0OPg!chZdm&=}D?Ake)EfeGVDJ+WK`^Mp7%Sh~S{+Bv;uN z?&NVYp>RZ8=%CgD8=9rc#NFTiyw==OxDvLapcDZTN>#&m9)qzb77Ved`gBkOGo|>} zP*gnT;NEH!4U>+6orRgKceS@bq@o>pm){j#tsi}KX?g6Eq3d&Dvw=Xx>^(@6A(R~} zOaaD^T=jUQ1Wzvq)~vO@l%X9nJNj0>KM0eDeMggyF*U5UZmdX*HWbY(mMnD*eS9?Q z`7aXf1?7knLp@ktXDmAf!C4ANpGMmu4zl?TwTB(~}>{*PJ(4 z)h__F>ozPV8yxZ0kIFeRrZPML@_3r#qso!hW+I~$@~A#-LuyC3FRLQizGc zU!m?x=&lZ6T?c>q1Z};ZS}3G+yo3eNHL0AH+}Y$#_n81yMZ!IyvULkVl!t9zcbmLBp-7WjDcVbbCYoc$jJtIb~hDc3q-vuYw{|}c{GrFhN z2PxGsH{p;HGdX17k2&a{b^VX3ZZUFO8~F)MS*E|WOC0DYeQvwO><<&FI$7}^y4V*rQa;-vRd z9;9tL_)A>Jnn2}E*s;KAj`Yrt@(n=eXl*)4sLD<<7w#?PmS#6{3X7fs*LDw#nbg<*X{EO z%LLfq8O8Q|_X)DFuvt+PZtU-xbZ=yRDOufdKN!QZIvN_?%Qz&gjYm~*(x?YpS_sL+mt zv<|ctw?U!hDQ7C-WXIKM)Mb``wjH-4*x0UZu<1;(@UC3*jHph?h}*l%3pu z%UJm*-HN0+1NdFRK|~VukQ%~--pQD7POJ{uxgohcvssU};tRhmUoD90dpPF)sd+AW zx@irp-NU_|NO&=z4eU{Z=VpEhL_f1f3oD}QAy9%S((a2s4q6H~vCV>5mf#io94_c& zOO8_pm$R-K|7L#gXYs z=N6L0Q}fMsZ|ky+)wS>c7Hs_q_A5t96-iAd>`P6NU}WP)E8We?3YXL@da4b41+zE>dCF=`%}^8@aky(F9M&O zl>PL_#CZyxNDP@kS8VFhIu0gJ6*rNIfEJ623w({D%Yb>C^tV0qApQohcD3#|jglj&b@tY1nWhssmaz@~e z%Q`r#lAA%LZ5%os{`e}Lx;I83H^uepx{)#7h9?BcA?}AB6P>+49A|KB=w#A+-R5d@ z>5i%Mn+&f>@y0{#mn>yH7|B5k<;W&s*}?+$KRC+peBWefNAR;?GJWcsfz;V&udQ%% zxx)tO!6DlYbk*PvwA~|`S`&fU8EqiLM!s{dS84+X(t~f8cG>3G;(h3%>jH#Y58!YU|dP*VUZQ8M;xpkJJ_|(K*RaCOW=C1QEjqmrRVW7mh7D9*Egk#Q-c?*1lQ=(&+ONY0Fbs zTZ|(3CusoO&{hG!jlZO8oS&o@t3}Jqf?n<-&-hyO{6Z95F0bGh))0iGwd^N9Zs$uV zN@55KxngrqG^)x_q;oTCVvJ`0W2cmYLOYKEaY-mBE zW~@cj>T`+jsZqI-9Mz62kH#tb7ylNTA=jSoD=I@o$RpoM$)lx9d;{67gg~W69U|n8 zREa&|L$kCsHIFtkG^*^TDNj`A|6JVs74(rO=$L`IMpJr*T z&xL$7tlWJ@SLjuMf7c8TyWV4jr6o3;VZ#pqOBw-^9 zeKR^FDP6g1GHSPal4@jp6$iM6C#ea+SE^~@+HHEk)%yXi{b<&BomxgN$wGBnqSN*|M!TTwg$Im3#VmJdWvkuOn} zm*expUQei$i!Qk>soL^dMNuL*_)pv5e(pos`D%en654N4p~od(oid@oE$2GpH!n-SmDgnZ`2g*>TLP%Jy1s z^bgjZl2;{=>Pn`ToC{#xlYkM<>${ZsVBKjxL`-{0v<3C#rsxK@;>%K1U>TGE>mE%D z2;WQ-dpX&M3&@hx#i+sKQfg!raZKFo&Ql{mf@D;}k?K&Ev)6jH7arQa{{}a#t~V=cQP{UuL3kIhEuO7#0VF?gzbJ(NuHA(j>!8}Z$j_Xl8R0_KuF#p+p z_g)$t8{hYpmkcf@n^$O36=kIV(G?aH_uNC844p`<7@D57%?e)R7#}Xap9MX0puER> zQq|0T)xpCtBa$iSaf!AbpD2Mm^T~twH?k7LJUmM=e0{{~ic0FK%B688mVsPdD$WdC zP>jATWIJ_zoiW(S?`U{09l=u%7KU8<1V2qQB{gTf3V#O>p zhBZWu4!Fhxx|ZLV6+T!e>u{zz1c_GIsS}*Yj zb>Kw_sHjGXhru$j3gQlrNzet65vQa+lDSAH4{Ie7k5ow#k8g(*ShG?S1?7^+{LWHW zsZ2D960l@>7L$JhrT@v>F9L3z3nElHF-Q7Gx?evX6@pQm7_$lnEr`)sHfy%cuUJ z{M0Uinn|Q^iOM&gHaU+IYm86lCqE&_44#Y+EYS2BeZbXS2r7HeGD?S?=}IVhVLpt3G z=2y1&J~-^;I_UkZwf=6Sz~|C!GV!7>EowAPsXKvwJ+uft$tr3@=%XvII!(kB0gegG zg$luN4QM~rOb=7;5zh6*N<;rv50Am5TqHQ_8H6#<{*A8tw1pgUD>ea|HUhE>30NSz zkO*r*gF|vA1@0Ysa~b7j9eoi(vK4EP#~_t?UmHnlKw{e!ArsBMt|DUXG2VXH4jb$b z{`RK9W~=?Ky4o>tz_nyR@-_yf^$`vMR3Q|>zJL4#D=ctD0C*k?0Dx!ReG!CDs=?y< zvy>9gd03mMA55{}2U9HWkUT)f!%i3&$qPj(!qR4aQ@psIngshF;t&u>q7WV_d!fk%|H|u zzU1C4vOf+4W_D{ZMs-VXnko4UE&4Kr3N3dn^qC1mvl!X;jMLk+YJ-mm5~fj`Uqg=N zC$zYkc+DB5C8q2p;QSb+<5g>f;LFtZK;+ODsND~Ba(_&rxhdP6yz|;- zEK$9EZn2Os<+6dT?KS!xGKZl;cTNM?X?Qx1{d#^pMa-0`K7j0V61*R{m$KzuCz5g()aWWz|15RkSQlRklnubdw2PE*CFr>_PN zmaa5KrUyOCKNj1UuWqzJ;UH1TTev^@ANywKjh0{B0dbe;_G3G}oayovbap0sC=XVn zRa@(g#E1*2#ca)F`8+K|Xra%u3t`m;bGcs7;rFw}sn|E6<`L4g0%7k4O+S^E_@cb< z1Bo(S(+n0TVsU4^mQ^%P(^(8>PLHxp7Xx>D>KJhuWWEsnqD#)bw)te6m?>F9V`XWm z`cIuW_^6$f11tP|W*ol`KIh9HE`wEr?y(R&T>37ST$&hzyQ!8Jt z0q8Jzr}di7@PiEY(Wz$MXz4BA?R_A3>IujByk z7*;7f#We2x@Xn-gBt7e{riA}xnS}eu(zfph#iUYA-BwLm{}D% zxMiNLevnur<)>u)yExo}v~(H7uQXxH~IFJGv8um6EDz{jW>t(k`rfL+^B z(tpKm{ldWH?1+MCks-Rr&@X2cz((o~MC@>RfT)&@v<-Yqtx>_T*I}OY#Zd?K3lPVl z3LWGgCyG2&JTJ>vgKvenzyx!XdJB97i9CFG0#qRs9%ZQX#ZoM>!$D~O#}91vH-N1| zUej21y+nZTGr;V#oJP3uW!OI-T^M(^wSH>e{eH!yLlhCGMINK^gG_Ruop>Qym;&LhOgbH_sZ!9zO@zWx4wx-;?taJPD+_; zc#mk5tA~pudlFKR_v1t1BM2kv=^v%ieYkv z__Xf%MhLQ%u-pT;#A7ytF%#&kl)2h0TN0sca2fM{?=_SfvNbyIo{(yW9%>qL=K|}z z|H7gBS9!u)NrVF^=S2HURS*$NyH1al{fhFByI=E(Pj{#w z7bq$qjPHM74|cs~A>GS$NNR|j{O!|=R=T)ozDx-i(y$V5BV@irvWfZ$^J5VaiF-Aq zVP?z$2jH6=aej;z8nKoHr_Ub4q$sUP_JjJce*SBREILRbO3|WM!B3fN9c&>~7rGYW z#;{TLAj=Wm1JRRA-anLhe+O6y`n+fXO#l6cNGSFnPo@F;*FfN!4Fs+zEd`(nxK zpgBh$P2g43_vOMcQ~n0CReI;{jo70ptHbL&{WU6mqzi0HH{r2$$Tix!q5CI2^?5b> z^ee8s<4?BF?1Zx9B=BMjh&^oKD?reX%AMMj8cx8>0Ar~JpRf|iT(@87ARi7+2_nsC zi3nbyDTkq4F$0$Yfjwlv8VrdB~sOTQvGINBYG+v|&B7@+xz7mbP)8FMOnUWZ{SR37*GtzJ( zpYJ(b%HrL%xN3c4wRpky?R}*poVp|#^H(T8*SD}?>R@#9#*N8H!-g_NZfW~0siMK2 zr2u}qT4&@98^i#P6*s1&3X>;6mYih)KSQ>LDc&O`s>%-X5KWhd*ZI2^d~s1MH|Rbb zZ!GGKHzQ|V)>O$`Is;vM$n1{YFzGq&%!tx?`WI{_3sG7sJ1Y`Qj4y=sn^60sA!L_Q zkVaL?H<Sh7Sy9sU-_W z&kbZ_0B^I_X;^am*t3(eQ7x-J zd#Dsfb==K2Ta-bTw?4=qDO~b=X(aXUJ}h90VTOG9+Gs*3twLQ>I~oS9CXZyKze_~$ zPP0NiCtXCH>REKFiG$D9YOy;w2!2em-LT;b^>98!gu-_zeRrSz9zW5|-9ol3`SR)g zI5v!1evalKU^nvi%MJHAHj>og$T0~8=Lx0Rpu)vpNFri{XrXloe8VqR5fww;0!ab; z+$5RY+TTB_Jk9c&--aOhl~qB^-}bPtMDg3@syJcJ&l|N3 zLI$m9QK3msy@2Wan^1tq*CnWq#r65hBR3H**Ejw3tLkP~v4sHny~_-0aMH`&?>L8s zsA?fwF6+=b)2*Nql;X5kEfNCn;FUZ>cX2-hk0@TDf+f;xJ6e`at1ZQSFVc-Hou47X zVGxIg1w%IR*eXnzqGi(NgLaaI@5redzk)HCE7dlPaYjEuG|yRDXa>H$dwTK;_`G(8 zRVlths=Prym_Yfr4K7-)ZQQ;dXpYG2u}gqcVar4f`~eYvvDmp&g;zW!Q`-|^G1TI_Kb&BDxn$&R1RVoJ|e|0vnz@>5}}b0 zPNpfksXzoAG^j!7APg2Qe9+;jmM-p9^3wPajf&zJ7LX5t5(Hg7vpPH*t zS$%yn=yJJ2qIzN6-?EMRm5cngUr?EeVk72qqQ0O@WWBmORg_)M0<>pKb_}gYz`e@o zwr6PGA=zU-mB--}kFtye^7lJfex$iV_JTL$5H15;A7CFQUBthgh-!;o-2l-!tKPD}Mk1vRE5diqo8>EsN59z6K%!vS3v zjB3(chT+I!=<8iWb6giD2mY(QmEV43L-b23vhaIe)7@P)@f}<|w8Zgf%rJ$a3X}l15B8=pS#rx>5po0? zB`-kQ*f1E+xAEf1ecEe{8rmf%F-OV`px_s!X@jtBq7~-_FmY)_u+BC+^`uSu;L}^# zPQij6&*`)*!Uo8dk$)EDY0l`CqkG8RCpKrz)NyO74RI+~OQ2-G1!z4&yO}WU+4c~tyrXg zy{*#~F-?l*gZZa~Ph^HF_EI*1YLg#PDb`Uwd(9!gN?%0Kkn_Myx~~d+LTpDHx&j4{ zh53o%C`#jjD_1CG-RQx&`O#UW2_v9GAT@ zo+9tt10nw^g3wyQ`qYQM@O?2sNeb677>;IjCQxoX`W)tgQfxR)&&?$Y_Wq*1^n z$}g5O+>Y))LJI9HYULL>XL=2WOJ*@e&QcL4JwFi1jiY{lC2M773H$BGM!D!)D6u?@ z(-xRum)|M!Z>Y{lF*;jP7A(!Z3CoN!xqIS-+fWadU+jjE@sNKiK)6g43}o?TrvB-f zJy$3sASzno3UH%&ga_+^bl*XO=aVvQocSSp;(iKkEKIx9=*Se!h67oA(ZvWEI+r9; z;a$$=N~;McOomf+KCFBlY;|!SzYVPvg-x_pl{<7zSQQRNxKhZHNhkF_Md0zOp2D}V zt~aZZqrEXS3NdalhP8HkpF7Z;S_0*St|!Ls8|rP1<02T z=xm8YOd1PL>zE3V@na3r`y5V#I~Ay+x})L>BKm_X7z&toOqpZ@6TfVM!0GwHt$N`U zWX~acP;8{z!S8Kh#!HBFIUSoIUwg9F{yOWb(X8scUn{XH`Mvhv|L|b-M8XyRV^d2| zG#xfieTbs~?!EDac1RPe|L&&OV$bQ&>p%Jdf_FeaVD~A(R(Ul}>vL~s=8_5a1z~SN z>*caPmju%I&#=~@o;y&n4OMn6?QWRiVi~Vlm>I7bFjbvLoVEiNoOsN1*mS6u97cet zs`ib?>|?4Xe@slLWbYk%apwL4bmX^CEhwl^7_5+-yddiM$u| z3&L%@j7?5qu$#o22y%A|RKS9?U}> zD}N1Z4mmTFCYk!tzyB063RyB?z;`D@cZAvEPq4tjIZ|05ByFZ^*Y^Tg{s$daG}94o zHRcG4d9+f$9{&-MR}59Df#n(T_fo0KC3U9dB}*ug-hV5msT)TZX`Key?f(7wjE~3n zqoe1?OLn_fcz?dD_jn<$!yU>8bqg2Inz~9b-cgIq(UrzfTDvmlZx|KacRXlVbV;;d ze*1d*cL}db8>9Ca;{Zy!mBM0M&aFlHt7QXnj)Rd>+wAbF$#)aipGS>aW3eZvGKz^O z4ED!8EHN8ju56=zk(~+sL9b$Yuld6fq|BtmqQo8V)D(S$R5W=y%FBb`W+tU5tg)mU zou_Aha|B`HT~&!t-O^oNP{#-TCrEFM5REA$J~LPA^3UzCkL^xJcL?{ihb%7$Kcxkn zDD%WY%P)UfsBFk1#0nwyM+A*yt%G zWYP`AgRy4t$ScTt1^~rBTo$1CmknkbZJ-m2pSQ$U)ycym9oh$Q_x2CmozyE?GG34! z>aQ$Z?e>!;njH+N=?2B^?PPm|&melOIfM-HPc|z75ulDBvV}IflkUWqAP})eT}WUp z@0d=Xh}rrpXC146{lyx|I>VvJQKiR{)R&i0b(g9m_-h5jOR4QzPYH#68#(@noy`Kf zB8AvTJ#Bup(Y&7P<-}=mpDd&E-|E0XTnCjbX$K7A5}x8|PWrntYS2OLr@innX|JDs z)7~ni1z78U3(=Hkt=;w~D@(c8D9n2JSao=&&V>p>5d@S8Jzb)glLvPd;pmimmp%*S z)>cA9{*LWkkx!6;Mo^+H<}X;=t}s+_c>I_Ax>lP!x1&8AM~KXke}Znu%!O>Kqqt`m z#b^*QPX{N{?w}rP`;JYQ0RJS$?9gYOZV{vAIFCQbr+O-(zGc&D@=gJ5&Qn zfL}LkweS1hC42q2!Y|v*&1k9=U0a6%e6d%ZZv7y1b2K27rDdzR<5k|K8rJV02xjfANs zN6QQ(PMDEu=VI91i!Sph3DrL#9&|tUmza*}UW}c+Y%mF`(g>`YZiUoA&8&-P#05~k zEdFs!@pz@Wol23p*jveum=>dYKU{Zc?q(RfNieV1rZ8_1nfN*;>`#|BF5I`{)29XP zmNcLuEaM!fH9zLtnNACX(6D-g;cs^2kw}Ub?VI7g+k@Um(^I`k4k)K#f{~)*e7ca{ zU*S6a1U1sd)rdbV@L>#tmGUEglgntTK8s}MOzO@NztCWxxV@wdycUzm$K1~;w1a~t?k{eB3O)=| z3zi_UvFA2ByenL*G(Qh{Mm15TJHx-zV|Q*Sl_Z=!>G`Kw0w|9|URWr?$9u9|;_z4l z-rG1?R7F%@$0y%UWHm_+v*YdGJ9=F134(~Q4_^Si8mGXBb+sEKrm7A4CRBQ}Tg+NF zG7nq#P*BY=f7IVXQ3T6#ld<<-UjjKpYUT3~ej$%yI!2;jNt0nK+Dt+DQ@-k)XY`59 zft&oOqbkZ}wRKpaERs!^XcO=0PlWpSgzt(+<)-_B{23ei; zSsn>7RWssd05dfN@lG?9%YN#o0EG)IUsM`W(D-_+04({O4TGQ>G&6*E1~M&jA5GjK z6)gV@mt~03!bA>D|kTee;>M!Zg zvV!pHxh_|rw?4M$M|Lhc(M-`q3B`Nzn-RkX)f9lO;z5D>a!|ZL-V{xmwxY}e!EoY& z0KT~cQSJ1hpIL|rNKu+G+{1um(1Kt{`UwrAp-2+ootk3qN0*504~CsPj;AN0P`07&Tz;TzZnOpwpk z^V=ZJd+oFM2;RgCPUPI?HZoP8^rU^lE4S~r_+NAR5h|2y{;uoK6E;gE82K?<&h}?4 zlz4Wn=R4PLO{D_8BmX|B#l}ann%vw_s9SE&98nV&jX}2Q7+vXS@MAOj#}+wg!{ZvX zfkUUq4#Pv^bRDL~P6Ac9nH6gg%it%nEf?K00bZ9J6;H6^D6k~mTJC;VPfm_LXTA!f zQ`C6Ds;FP@4(`?jcje3KMdgus&Zoh3to!MFnDQ17QeP76@J_?H8OCBJuo6HK!L_M4TCA0vhOHqARGR!r`e1iQ; z3u_2oQR75QbZLiVNDf-?(+({*cVcG(X;PCpD7KWtTDtQ@>9jP-aufZ5Wl8zJb!_<5 z7#w{LnCou5lw5}j_1bw&$q)~)tzLM(z9;!VW1sKzbqX@RE?Ar&*0$ct@}=-cA&n8DBgjr_pB zM>>_)RD#?P;j6PIbt1;+gsj54+%*K%C{byW+tZ{nH*ye>HLJ>5pCzs@*JWP7JJO3* zc{$h5--A}ImE;1m*HDR~ z(d;+ae<`xbF#oRYx|v~zCfh(0Pz0o3rOo}lA$JF_1%=}C*6P(^cMtkm5d0r?8zAsh z&T9Q19|3q%AAmPuuU9M$eOLS+Q~V!a5g~VqQG|v1m-WDR8gD~^!ky)#&NEhDT!;=N zUl!=Zuh0%vytlLxGiP6=Ycysd%I!wb1}-%RyE%KY(x)XdS4d`=yOT{?HC+!1DP6JB z6jPb1FDsK+GmEY=-H%=JV~hw0K%$(#;ese;&k|CCZ8X+N@Zb%a3&Sflt|*Ofi(=5x zG6$8P#I-LUw;28c_8G zZdV6-*Bjv4VQQ2}{Jdjb|3K7S94dGN`hjb|6*RAOZ4HsT!1QI3Ka-FX<>bc`)C!Lh zt~z5Kq{ev^@ebdzKSlG(|Hcks;lSmJ=~jef+JJrEQ8IkN7xtO_!RPmKw`F(%_4b<9 zzBT#${sblDb8ip%V7)0kzA$JXe`lXQu-+=P=5?j=uw)}-x&2ybyS1zm3pWja&fSmC zPyj1eMT`&S>dcI$L|AF5nl;a?(5S2zX8IA6xw|mgXXsKL`#Ju}=0oe{)WK+Of=wQ`n_kPA7}&O~*^=^Bm+o-;%ml9rY*Nh!B}D9QcErRbAC%(pCX? z4rx^OdPaI?@qJdKQFI9Z;$&RvWT)H7*)sYqUz}eB&64$T_h~ErdL{BOJ+K!=@eQ@>VSMpx^6%K0t;8g1B5!)t zjn*EEoA8cKf%Au*ywh0p3>$h3YIuEe)Jw)YNJ2x}!{6K`vs{;ingMI7B z-@4@@d<_MCtaA7l&*y6P8)HLApRk15XsRP!LAHh_T#RAemo0FRM^5|omHIW6`djX9 zJ;bdkVHf@yfZsNhF2amU?U#pBZad5v#HjkC{93sBHbIZ zo?6uwO|Q}7K@Gz00^jUDy+qZ5GT*vIBp#C(;L(!HV!69V~VcnNb*2 zW|o@!83>Qlmqm8=O*a2TBqSA!CxCEuK#axcS9h^t&vYOJsOKn~@QI8T#_X+CipN$W z$kL8N2X!JUTW;Y7%bIBXP6?}Uf0=jKEi2&=qSUKSXiOu zhg*gyr!QU>RZTb_^Eokz+t{uoPS)4vO>}c)KDV?Wz0fboG^DJl?qQduc_n&z;R8`Re6-@Z2eEwowrkVe%Zy6~w)RH$kvk z+jd8dae?@-wUFW*Q~bPID%@DGe~Bn`fDP5R`p%Occ=>+u{^(cPm~22nUHxXKm;ZEo zEozu&zxsH#9f`ZA2DN?E>80OUe4Vi)&<+_lks-L3vngBzdT5*oSPE9!;4A!BlF;eL zO?>(?M`{d*PtHZD6q%l4$`!l{FirF-bjkcxr5RF z^>%<>y`@-#FOCQ}o7SKwR-@#mfcP_A(MZ)VcOj;$J5=8sQqAp?x5L~6F5qot4Cv`R=N8-(@w7vcq4Vu z>^kCMM-+3gP#OkUc-iGR0Y`V5U621?*ZKc3H2}K61ayHbSFaIhRSRf!)WgmIXtfe( zb>7Qv4QN#hX!WD_7^KsQ=_SaR|Cf($0ej$!&AZ#J0blI@>#F~|sUXlHhJ)r?U`(oj z4k=wU-vYxR2z00%=+LZ}T|3YrrJd$mU>I(J;j98$oprZs2U=~164R5B%!-}SM47BC zzF+m+6KKpGa6Xyubv`)~Z2ZCt9KBlgyuDoY^qj2Jns7d`6lnY+2%NO;e3Ej#>WL2= z{Xb0k=e+E~fGdf|9DLVCnLJazXeLU%UPb20T`>Y|+Zs(Yytqb9=yUIV!(_!5S^N8| zS{xKU%0RzP88RH)K%imwoI6zcFlxHcz?sxx@TxKqz9IWz_r9M+i~Nh>R?FG`X2kS^ zeG4ANJ**LfZsPEyeuqSys~n**&6fpDIvK%a2*Ufmu zML!srRTDgzvK%B7CKw#>o8`c%3--VK;DC{WnK+plxtM8KN|=4Kw6k=vw6|lna<;c~ zbw>mPhx$18KQ9{UATZb}gjjPA#8~rbeIN5PgA=C}p47Kajb~)qvwl_C)T*O%8Cy?T z>tc-gB_g-ezB;pFRaAJHbY-Y8u(O4mUsic$B(?y65AKdd#~%xyxRa|+Un7Is#e2Zt z)g88C|Nf#BeDkKkhxn(k9jCBSnLeK7`}eV=>BJ|OiPSMIil;_eQwk}@9XBU)w|eg7 z4P>$Jy?@UpREA27FK7mB27G=uT}l-v6hDOR9kQrCyw4CE*J97P31S=T6tBXEU~+Kb zpR_si_C)}@HIh-t>(es&5>3T3X9P;bZ*zM?p%86NJ_vY$#Wl6<`u!|GL@}RBvPtjA z_#cg(RZtv2mxY1gFt`L8d~hcrxCeK)puycONW#F7paa1@IAL%NE`z%a4k1{u;0{?* zTebCX)jn+XLwCQN?z%7C{q?PTw1;TYHE{9GK-mcx?A*7KH=gP?du?s%4aC#SQ&|=A zg0W0E`Ep=NnN@qG(az=FlZ5-xW#sqL%zo;9ri$m!nQE>~Zaau}ljCxBTi|)uYqj#kyRu6;F;hqaE-YG%;b!P%)X#v3pR}Kc{*7DNA)xH6q5{oP9sw z26bKKr#$Nf&c}eq^}i210VSkH{z|Ylz9b54;w^;peqj3P>^To zn(ohnPQy?+bxG(T1>by|nUsnmnOHg8jOG_HozO@b-l9WO>2%1KXt1GuMV~j_B)pO_ znGG44f+--HgnW$r*e41*(DN@txzTA)Xiz0qz-JA!Fs5N@B6nf8qGs8iL2FPQv)(ug zT5DQbk83wW#A=t&-8Fp+>CfFVg4|QDR8EFbXZ0t_nuJd|#KO&gJfrqSL}nG_dCCT8 zxEYi{b|#*RYn`Iqe{EN+aoEXmLwx&*ik{U2j|ul%>63^Y;mHF0lVWfYnj&neWC>cR z-30e9+a;pP#cs4JDYK&na`s#HM3mlEIVcQ ziqP@`%^y5y`GG>FXJrFWn5FC-@uvmi`qzthrie)(^5!kNMle z$-!$G32zrxp+Wy=<23mpgmNW{{-L6dVLbe&C$;;D5-E1o%~ygoGzGRm@`X1atE|bD ziz`&EiDt2m&}7r|<|cKAk!b+p>fRqFoLC(6(0^oj%E&y=D9$%>ODq?XOqS3H_xJLe5}MTvr+ z!x^!gvA1u!9Hm*CzxRryS+n5Fhhwg5vCaHd@SknEMA?X7I;KMGdXd`N*Fko zorgoTYeQlRD%WAL<5fXCupkrJk3$y*vb8>|RPV06)ymgH7C(NMg#9F`8I#>fS%$R1 zYe8(etmsPvg_mLW9L-IqUHY$ZRLiI8=L5)z)Wr8|abVsq$EsMx10fZ&GnGPnbFY?{ z^$!j7_T66J4WJc1Y3yN3q)HHm|9+)nhGiS|o+(TtW0>hMiE^r6Qys&cly3v_kP7j} z1dD6xCG5#*OP55@K*x!wZP7L=An*9`sS;0drGBva(h>>ONAp6$>EdrmG_6op8XRSH za$+%e2>saRvGy%cVmKrE`MOFCbZ1i^s`}T?4q{r?tN9R>AYy>bpqlK}=II#??a_z! zH@lixhsX#?MH*PAP_sUw9Q(B$P%o_Iz3|1-mO1I%yQ;t<;f^V$yE@TPtJ+w#^LOx* z(F81OAf(dFzfFR!j2e(WsU9?Lw$JeRWr#v>i{FzhVwlNgMHetcafwP1q}ey2>Ja*= zHuyR@;5Z>meS9JkbsyBVJb6!&DXSZ{frS#E>8=9{!g{)`eX>959&nRh3dvSnUWe4X zc=A1++nhysyav=<&Lk?wG-TcQ<;7BtB|J`X7g&YXV^qTK!viS+HCmp#)bCc8vnF-iGjY=yWKhgA<>-3gkanIut|t>k5I$M-eIk2hAxQP06ruNlQXFj5nd zV>|_0pONaa-m_;&Z&PBonmQHeck(+-9zpz?W$($!4P5phsE++6d$ft~b%aq?r+znO ziyp3uCTs z4KzJ9#{KXixU_u*XmKiFX~%ZFA0$pxsrHebMvFXex%ndoL-OGj0e2D0vSWD^40u~m zj=Mhr4upEKKMHA#M{cn|hVz&(MEmOwM#SWpV}vO+7j&fz$eo1BGnH|e zvOCfq0X3JyP*0O{l>GxK!RJh*)C&QD7K8o?T}Fc5!~qNk{A1*q+rRrjchlQDlc28Q z9^m4Oe~}ZnFs|di2t|E^Uo?mN({@zBtweWK(OKx}Nn%PPEGjCeVYx^pM zt7%Mbhn9!ut;#O3pLtIA0;zTpG=%?v;@nB-;14?SC1MGno=1u^SOYvJ(*5)kEumsg zw{i&c4B4!FE;b2{68IJ)>K-YT&NvIY^mT?vaRAkN1l5Y6c#L;4%N!h`IVH($6lCQKi{;yQs^>zFP~aDN;IWGOJvXW44T6>qU=b zvx(I*aUZZ*ra04Ys;xoeLrV>?yz$#4QME^j3(%A5tn0z9S-lVE;UnDj`HBTYb~3MJ ziwR=pzGvp!x&L)O>k#srX&-tuk! zFg{>Gk}x#JYpUVXMpRsQ9-Rwf^f3xF+78V@6WPQ!tE(fcb3$KRu3YaC*&3!W^m4Sm zxk3ldYKR{Bj!vR^AdXzTXL4G&+~W>*8ik=N2b4qp1DdriI*3tr{q(ydXE@Cl*eWpJ z(B-J0%}k&f4d}kQp{CB_9s9CP=(XGO6PbOF&;2rB?7HL^VeR^SMq%@?X( zYL8x-te)5be^#)nkbV|0b|Pxa6id~LtTqcQL$RE;jc=H+rlj@G(T-e|3^J%@F}-T{ zXt7U8Y(&uH}?k1Qy;uUt_sj%t{9f{n>bym`Y4BsW5lLO|LaTYlJu;$*$+e)=s3VgBJ4x4%QjF3{I*O>m*0r<&-<=Y-xT|H{JcmFK&xtC~J{Ac_ycZiy&Cu+C1l=f1RAZ zkMDB1#p&Ul^h#XXLXW3(!mgfd@M8#zJ{Ah>z15IHC4hRZSu^GbsM4t~eULQ9NfL_OE zLPav+Dr2}dSUjI^zi2s4KZ(&L$7hxzOhyl;p3zm|)NK>!S`g*;X)Mrsp+gYcH3}Hz9 zkmJ9s8n4D!Xgl2)k$_)vD%_!GE1tj0VG zEGDP@>UC^<28Bf*#&OITVUVKG;%~d9U;aY53?F-zMP-=uY-f0Dr2djwPNNcgO=68V zX?1yTj8foaxe*lDJ(xA;28^w$e*Yh#=?oM+elFuRh6So!r zDo2$4ciOOQx&kURHR*gn?{>AVaw~4?<~sq7G-2oT09RxI`O3!0aq4+hJOiWwYEDZG zzU;inO!*isJ1WhZEa%r~7{A4|H&<7t;O>Rv+h5%cJ#mVdKRfITjbVT0&HFT;`@7$Jg&|?SM~9KRvzId>ODk|MLl&nHGX6F(bROk(f}V7a zY`C31S>& zzgJ}FfJks2|F|YTMxFZiiM>sA+uBl#c%FJnYs8mB&M)XSr)|V6l46upzl(a0HovL! zw?@RvTv*V)%zneZIn_0oJdek)zm=r|kveWrQuN+zTTqZ?C~5HJwY=ZJY!jL-;&@4V zUi9w1_|(E~vA0o-uU9Q2;3`0BqlxOJ?hi!)1Jl3?;XN{L zRx>&O?M><-@A20w+IR3m`c7RY_BFCVgW;$(3ghoa*W7rq2MU|mYeAOwFK=&9k!r4r zIwGln4id~Azde5)TF0IKug_kHCH}o-{h`OM}7_ zCg;{SzAkCg8DOmq0{|J#-ioKyc7-$_P{0AppJh`(&Rriskr$&vNF4rDyd=gUx{mX{COe_0Z*$R}iP`Fu;aozCBr- zpXF-iQh~A1MRG-VSjSxo$3z1`&D&WsUqIz+#ppN$80nETvYUD@Ca?M$K;~-K7e(ZEo4;+#$ZZcZ*npAg20nVDQ8rREjR2{+iYx*z0|B7&ocVN~o9}a#CtXj4tEL^*>=>S;_(t?^ zRQvMI|NZb&$THpg1SH+=IOOnPaHW579@4kkoxn69W9xn;LZUTE8#8%|{)ztH3AIbP zqbsVn@MihD&CQE`&;FEF%?HcmLEe{JzD8HrQ0C4H9Hr@CpN!Ab5^(fs5pd|npT95u zfw-3yL6%I!NJyJCNY5Y+8HMDRFaHP3HHQBix>!26>b`ezcYelm z|2L9DLqhg@#&Q2C`;YMb=aS_AOI96@^#A64&*J}hpQZ{L`oG now()\n| where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n| where ExpirationDateTime > now()\n| join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType" - }, - { - "description": "Summarize by 1 hour bins", - "query": "ThreatIntelligenceIndicator\n| where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n| where TimeGenerated >= ago(1d) | summarize count()" - } - ], "connectivityCriterias": [ { "type": "SentinelKinds", @@ -1118,49 +1105,6 @@ "name": "ThreatIntelligenceIndicator", "lastDataReceivedQuery": "ThreatIntelligenceIndicator \n | where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } - ], - "availability": { - "status": 2, - "isPreview": false, - "featureFlag": { - "feature": "premiummdticonnector", - "featureStates": { - "1": 1, - "2": 1, - "3": 1, - "4": 1 - } - } - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - } - ] - }, - "instructionSteps": [ - { - "title": "Use this data connector to import Indicators of Compromise (IOCs) from Premium Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel." - }, - { - "instructions": [ - { - "type": "PremiumMicrosoftDefenderForThreatIntelligence", - "parameters": { - "connectorKind": "PremiumMicrosoftDefenderForThreatIntelligence" - } - } - ] - } ] } } @@ -1241,7 +1185,7 @@ "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "StaticUI", "properties": { "connectorUiConfig": { "title": "Premium Microsoft Defender Threat Intelligence", @@ -1268,59 +1212,6 @@ ] } ], - "sampleQueries": [ - { - "description": "Summarize by threat type", - "query": "ThreatIntelligenceIndicator\n| where ExpirationDateTime > now()\n| where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n| where ExpirationDateTime > now()\n| join ( SigninLogs ) on $left.NetworkIP == $right.IPAddress | summarize count() by ThreatType" - }, - { - "description": "Summarize by 1 hour bins", - "query": "ThreatIntelligenceIndicator\n| where SourceSystem == \"Premium Microsoft Defender Threat Intelligence\"\n| where TimeGenerated >= ago(1d) | summarize count()​​" - } - ], - "availability": { - "status": 2, - "isPreview": false, - "featureFlag": { - "feature": "premiummdticonnector", - "featureStates": { - "1": 1, - "2": 1, - "3": 1, - "4": 1 - } - } - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - } - ] - }, - "instructionSteps": [ - { - "title": "Use this data connector to import Indicators of Compromise (IOCs) from Premium Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel." - }, - { - "instructions": [ - { - "type": "PremiumMicrosoftDefenderForThreatIntelligence", - "parameters": { - "connectorKind": "PremiumMicrosoftDefenderForThreatIntelligence" - } - } - ] - } - ], "id": "[variables('_uiConfigId4')]" } } @@ -1334,7 +1225,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.9", + "description": "Threat Intelligence data connector with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion5')]", @@ -1493,7 +1384,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ThreatIntelligence Workbook with template version 3.0.9", + "description": "ThreatIntelligence Workbook with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1597,7 +1488,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.9", + "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1678,7 +1569,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.9", + "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1759,7 +1650,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.9", + "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1840,7 +1731,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.9", + "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1921,7 +1812,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.9", + "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -2002,7 +1893,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -2058,8 +1949,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "HostName" } ], "entityType": "Host" @@ -2067,8 +1958,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -2076,8 +1967,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "PA_Url" + "columnName": "PA_Url", + "identifier": "Url" } ], "entityType": "URL" @@ -2136,7 +2027,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -2198,12 +2089,12 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -2211,8 +2102,8 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" } ], "entityType": "Host" @@ -2220,8 +2111,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -2229,8 +2120,8 @@ { "fieldMappings": [ { - "identifier": "CommandLine", - "columnName": "InitiatingProcessCommandLine" + "columnName": "InitiatingProcessCommandLine", + "identifier": "CommandLine" } ], "entityType": "Process" @@ -2289,7 +2180,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -2351,16 +2242,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -2368,8 +2259,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "ClientIP" + "columnName": "ClientIP", + "identifier": "Address" } ], "entityType": "IP" @@ -2377,8 +2268,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -2437,7 +2328,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -2499,16 +2390,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "RecipientEmailAddress" + "columnName": "RecipientEmailAddress", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -2567,7 +2458,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -2629,16 +2520,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "RecipientEmailAddress" + "columnName": "RecipientEmailAddress", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -2646,8 +2537,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -2706,7 +2597,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -2774,8 +2665,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIpAddr" + "columnName": "SrcIpAddr", + "identifier": "Address" } ], "entityType": "IP" @@ -2783,25 +2674,25 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" } ], "customDetails": { - "IoCExpirationTime": "ExpirationDateTime", "EventTime": "Event_TimeGenerated", - "IndicatorId": "IndicatorId", - "IoCConfidenceScore": "ConfidenceScore", + "IoCExpirationTime": "ExpirationDateTime", "ActivityGroupNames": "ActivityGroupNames", - "IoCDescription": "Description", - "ThreatType": "ThreatType" + "IoCConfidenceScore": "ConfidenceScore", + "ThreatType": "ThreatType", + "IndicatorId": "IndicatorId", + "IoCDescription": "Description" }, "alertDetailsOverride": { - "alertDescriptionFormat": "A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator.", - "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC" + "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC", + "alertDescriptionFormat": "A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator." } } }, @@ -2856,7 +2747,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -2918,8 +2809,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "HostName" } ], "entityType": "Host" @@ -2927,8 +2818,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -2936,8 +2827,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "PA_Url" + "columnName": "PA_Url", + "identifier": "Url" } ], "entityType": "URL" @@ -2996,7 +2887,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -3064,8 +2955,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" } ], "entityType": "Host" @@ -3073,8 +2964,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IP_addr" + "columnName": "IP_addr", + "identifier": "Address" } ], "entityType": "IP" @@ -3082,8 +2973,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -3142,7 +3033,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -3204,16 +3095,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -3221,8 +3112,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "HostIP" + "columnName": "HostIP", + "identifier": "Address" } ], "entityType": "IP" @@ -3230,8 +3121,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -3290,7 +3181,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -3352,16 +3243,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Caller" + "columnName": "Caller", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -3369,8 +3260,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "CallerIpAddress" + "columnName": "CallerIpAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -3378,8 +3269,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -3438,7 +3329,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -3500,16 +3391,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "RecipientEmailAddress" + "columnName": "RecipientEmailAddress", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -3568,7 +3459,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -3630,16 +3521,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserId" + "columnName": "UserId", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -3647,8 +3538,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "ClientIP" + "columnName": "ClientIP", + "identifier": "Address" } ], "entityType": "IP" @@ -3656,8 +3547,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -3716,7 +3607,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -3778,8 +3669,8 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "DestinationUserID" + "columnName": "DestinationUserID", + "identifier": "Name" } ], "entityType": "Account" @@ -3787,8 +3678,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -3796,8 +3687,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -3856,7 +3747,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -3918,16 +3809,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "EntityEmail" + "columnName": "EntityEmail", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -3935,8 +3826,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -3995,7 +3886,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -4069,8 +3960,8 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "TargetUserName" + "columnName": "TargetUserName", + "identifier": "Name" } ], "entityType": "Account" @@ -4078,12 +3969,12 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -4091,8 +3982,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IpAddress" + "columnName": "IpAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -4100,8 +3991,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -4160,7 +4051,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", @@ -4228,16 +4119,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserPrincipalName" + "columnName": "UserPrincipalName", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -4245,8 +4136,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPAddress" + "columnName": "IPAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -4254,8 +4145,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -4314,7 +4205,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", @@ -4376,16 +4267,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "SourceUserName" + "columnName": "SourceUserName", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -4393,16 +4284,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -4410,8 +4301,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -4419,8 +4310,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -4428,12 +4319,12 @@ { "fieldMappings": [ { - "identifier": "Value", - "columnName": "FileHashValue" + "columnName": "FileHashValue", + "identifier": "Value" }, { - "identifier": "Algorithm", - "columnName": "FileHashType" + "columnName": "FileHashType", + "identifier": "Algorithm" } ], "entityType": "FileHash" @@ -4492,7 +4383,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_DeviceFileEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "FileHashEntity_DeviceFileEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", @@ -4554,16 +4445,16 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "RequestAccountName" + "columnName": "RequestAccountName", + "identifier": "Name" }, { - "identifier": "Sid", - "columnName": "RequestAccountSid" + "columnName": "RequestAccountSid", + "identifier": "Sid" }, { - "identifier": "NTDomain", - "columnName": "RequestAccountDomain" + "columnName": "RequestAccountDomain", + "identifier": "NTDomain" } ], "entityType": "Account" @@ -4571,12 +4462,12 @@ { "fieldMappings": [ { - "identifier": "Value", - "columnName": "FileHashValue" + "columnName": "FileHashValue", + "identifier": "Value" }, { - "identifier": "Algorithm", - "columnName": "FileHashType" + "columnName": "FileHashType", + "identifier": "Algorithm" } ], "entityType": "FileHash" @@ -4584,8 +4475,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "HostName" } ], "entityType": "Host" @@ -4644,7 +4535,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", @@ -4718,16 +4609,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Account" + "columnName": "Account", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "NTDomain", - "columnName": "NTDomain" + "columnName": "NTDomain", + "identifier": "NTDomain" } ], "entityType": "Account" @@ -4735,16 +4626,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -4752,8 +4643,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -4761,12 +4652,12 @@ { "fieldMappings": [ { - "identifier": "Value", - "columnName": "FileHashValue" + "columnName": "FileHashValue", + "identifier": "Value" }, { - "identifier": "Algorithm", - "columnName": "FileHashType" + "columnName": "FileHashType", + "identifier": "Algorithm" } ], "entityType": "FileHash" @@ -4825,7 +4716,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", @@ -4881,12 +4772,12 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -4894,8 +4785,8 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "CsUsername" + "columnName": "CsUsername", + "identifier": "Name" } ], "entityType": "Account" @@ -4903,8 +4794,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "CIp" + "columnName": "CIp", + "identifier": "Address" } ], "entityType": "IP" @@ -4912,8 +4803,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -4921,8 +4812,8 @@ { "fieldMappings": [ { - "identifier": "ResourceId", - "columnName": "_ResourceId" + "columnName": "_ResourceId", + "identifier": "ResourceId" } ], "entityType": "AzureResource" @@ -4984,7 +4875,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", @@ -5046,8 +4937,8 @@ { "fieldMappings": [ { - "identifier": "ObjectGuid", - "columnName": "UserIdentityUserName" + "columnName": "UserIdentityUserName", + "identifier": "ObjectGuid" } ], "entityType": "Account" @@ -5055,8 +4946,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIpAddress" + "columnName": "SourceIpAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -5064,8 +4955,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -5124,7 +5015,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", @@ -5186,16 +5077,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Caller" + "columnName": "Caller", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -5203,8 +5094,8 @@ { "fieldMappings": [ { - "identifier": "AadUserId", - "columnName": "AadUserId" + "columnName": "AadUserId", + "identifier": "AadUserId" } ], "entityType": "Account" @@ -5212,8 +5103,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "CallerIpAddress" + "columnName": "CallerIpAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -5221,8 +5112,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -5230,8 +5121,8 @@ { "fieldMappings": [ { - "identifier": "ResourceId", - "columnName": "ResourceId" + "columnName": "ResourceId", + "identifier": "ResourceId" } ], "entityType": "AzureResource" @@ -5290,7 +5181,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", @@ -5352,8 +5243,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "TI_ipEntity" + "columnName": "TI_ipEntity", + "identifier": "Address" } ], "entityType": "IP" @@ -5361,8 +5252,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -5421,7 +5312,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", @@ -5483,8 +5374,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "ClientIP" + "columnName": "ClientIP", + "identifier": "Address" } ], "entityType": "IP" @@ -5492,8 +5383,8 @@ { "fieldMappings": [ { - "identifier": "ResourceId", - "columnName": "ResourceId" + "columnName": "ResourceId", + "identifier": "ResourceId" } ], "entityType": "AzureResource" @@ -5552,7 +5443,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", @@ -5608,16 +5499,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -5625,8 +5516,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "TI_ipEntity" + "columnName": "TI_ipEntity", + "identifier": "Address" } ], "entityType": "IP" @@ -5634,8 +5525,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -5694,7 +5585,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", @@ -5756,8 +5647,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "ClientIP" + "columnName": "ClientIP", + "identifier": "Address" } ], "entityType": "IP" @@ -5816,7 +5707,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", @@ -5878,8 +5769,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "CS_ipEntity" + "columnName": "CS_ipEntity", + "identifier": "Address" } ], "entityType": "IP" @@ -5938,7 +5829,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", @@ -6000,12 +5891,12 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -6013,8 +5904,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "TI_ipEntity" + "columnName": "TI_ipEntity", + "identifier": "Address" } ], "entityType": "IP" @@ -6022,8 +5913,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "RemoteUrl" + "columnName": "RemoteUrl", + "identifier": "Url" } ], "entityType": "URL" @@ -6031,8 +5922,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "HostName" } ], "entityType": "Host" @@ -6091,7 +5982,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", @@ -6153,16 +6044,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -6170,8 +6061,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "ClientIP" + "columnName": "ClientIP", + "identifier": "Address" } ], "entityType": "IP" @@ -6179,8 +6070,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -6239,7 +6130,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", @@ -6307,25 +6198,25 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "DstIpAddr" + "columnName": "DstIpAddr", + "identifier": "Address" } ], "entityType": "IP" } ], "customDetails": { - "IoCExpirationTime": "ExpirationDateTime", "EventTime": "imNWS_TimeGenerated", - "IndicatorId": "IndicatorId", - "IoCConfidenceScore": "ConfidenceScore", + "IoCExpirationTime": "ExpirationDateTime", "ActivityGroupNames": "ActivityGroupNames", - "IoCDescription": "Description", - "ThreatType": "ThreatType" + "IoCConfidenceScore": "ConfidenceScore", + "ThreatType": "ThreatType", + "IndicatorId": "IndicatorId", + "IoCDescription": "Description" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The source address {{SrcIpAddr}} of the web request for the URL {{Url}} matches a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence feed for more information about the indicator.", - "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC" + "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC", + "alertDescriptionFormat": "The source address {{SrcIpAddr}} of the web request for the URL {{Url}} matches a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence feed for more information about the indicator." } } }, @@ -6380,7 +6271,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", @@ -6442,16 +6333,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserId" + "columnName": "UserId", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -6459,8 +6350,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "TI_ipEntity" + "columnName": "TI_ipEntity", + "identifier": "Address" } ], "entityType": "IP" @@ -6468,8 +6359,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -6528,7 +6419,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", @@ -6596,16 +6487,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "UserPrincipalName" + "columnName": "UserPrincipalName", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -6613,8 +6504,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPAddress" + "columnName": "IPAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -6622,8 +6513,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -6682,7 +6573,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", @@ -6744,12 +6635,12 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "DnsDomain" + "columnName": "DnsDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -6757,8 +6648,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "RemoteIp" + "columnName": "RemoteIp", + "identifier": "Address" } ], "entityType": "IP" @@ -6766,8 +6657,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -6826,7 +6717,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", @@ -6888,8 +6779,8 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "csUserName" + "columnName": "csUserName", + "identifier": "Name" } ], "entityType": "Account" @@ -6897,8 +6788,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "HostName" } ], "entityType": "Host" @@ -6906,8 +6797,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "cIP" + "columnName": "cIP", + "identifier": "Address" } ], "entityType": "IP" @@ -6915,8 +6806,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -6975,7 +6866,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", @@ -7037,16 +6928,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "userPrincipalName" + "columnName": "userPrincipalName", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "AccountName" + "columnName": "AccountName", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "AccountUPNSuffix" + "columnName": "AccountUPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -7054,16 +6945,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "TargetResourceDisplayName" + "columnName": "TargetResourceDisplayName", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "HostNameDomain" + "columnName": "HostNameDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -7071,8 +6962,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7131,7 +7022,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", @@ -7193,12 +7084,12 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -7206,8 +7097,8 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "FullName" } ], "entityType": "Host" @@ -7215,8 +7106,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7224,8 +7115,8 @@ { "fieldMappings": [ { - "identifier": "CommandLine", - "columnName": "InitiatingProcessCommandLine" + "columnName": "InitiatingProcessCommandLine", + "identifier": "CommandLine" } ], "entityType": "Process" @@ -7284,7 +7175,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", @@ -7346,16 +7237,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "RecipientEmailAddress" + "columnName": "RecipientEmailAddress", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -7363,8 +7254,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7423,7 +7314,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", @@ -7485,16 +7376,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "User" + "columnName": "User", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -7502,8 +7393,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7562,7 +7453,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", @@ -7624,8 +7515,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "HostName" } ], "entityType": "Host" @@ -7633,8 +7524,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -7642,8 +7533,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "PA_Url" + "columnName": "PA_Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7702,7 +7593,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", @@ -7770,8 +7661,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "Compromised_Host" + "columnName": "Compromised_Host", + "identifier": "HostName" } ], "entityType": "Host" @@ -7779,8 +7670,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7839,7 +7730,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject41').analyticRuleVersion41]", @@ -7901,8 +7792,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "Computer" + "columnName": "Computer", + "identifier": "HostName" } ], "entityType": "Host" @@ -7910,8 +7801,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "HostIP" + "columnName": "HostIP", + "identifier": "Address" } ], "entityType": "IP" @@ -7919,8 +7810,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -7979,7 +7870,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_UrlClickEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_UrlClickEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject42').analyticRuleVersion42]", @@ -8041,16 +7932,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "AccountUpn" + "columnName": "AccountUpn", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -8058,8 +7949,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -8118,7 +8009,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject43').analyticRuleVersion43]", @@ -8180,16 +8071,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "user_name_s" + "columnName": "user_name_s", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -8197,8 +8088,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "access_device_ip_s" + "columnName": "access_device_ip_s", + "identifier": "Address" } ], "entityType": "IP" @@ -8257,7 +8148,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "imDns_DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "imDns_DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject44').analyticRuleVersion44]", @@ -8361,16 +8252,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Dvc" + "columnName": "Dvc", + "identifier": "FullName" }, { - "identifier": "HostName", - "columnName": "HostName" + "columnName": "HostName", + "identifier": "HostName" }, { - "identifier": "DnsDomain", - "columnName": "HostNameDomain" + "columnName": "HostNameDomain", + "identifier": "DnsDomain" } ], "entityType": "Host" @@ -8378,8 +8269,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIpAddr" + "columnName": "SrcIpAddr", + "identifier": "Address" } ], "entityType": "IP" @@ -8387,8 +8278,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -8396,25 +8287,25 @@ { "fieldMappings": [ { - "identifier": "DomainName", - "columnName": "Domain" + "columnName": "Domain", + "identifier": "DomainName" } ], "entityType": "DNS" } ], "customDetails": { - "ExpirationDateTime": "ExpirationDateTime", - "LatestIndicatorTime": "LatestIndicatorTime", - "DnsQuery": "DnsQuery", "DNSRequestTime": "DNS_TimeGenerated", - "QueryType": "DnsQueryType", - "IndicatorId": "IndicatorId", + "DnsQuery": "DnsQuery", "ActivityGroupNames": "ActivityGroupNames", + "LatestIndicatorTime": "LatestIndicatorTime", + "ConfidenceScore": "ConfidenceScore", + "Description": "Description", + "QueryType": "DnsQueryType", "SourceIPAddress": "SrcIpAddr", + "ExpirationDateTime": "ExpirationDateTime", "ThreatType": "ThreatType", - "ConfidenceScore": "ConfidenceScore", - "Description": "Description" + "IndicatorId": "IndicatorId" } } }, @@ -8469,7 +8360,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "imDns_IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "imDns_IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject45').analyticRuleVersion45]", @@ -8573,8 +8464,8 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "Dvc" + "columnName": "Dvc", + "identifier": "FullName" } ], "entityType": "Host" @@ -8582,8 +8473,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IoC" + "columnName": "IoC", + "identifier": "Address" } ], "entityType": "IP" @@ -8591,28 +8482,28 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIpAddr" + "columnName": "SrcIpAddr", + "identifier": "Address" } ], "entityType": "IP" } ], "customDetails": { - "ExpirationDateTime": "ExpirationDateTime", - "LatestIndicatorTime": "LatestIndicatorTime", - "DnsQuery": "DnsQuery", "DNSRequestTime": "imDns_mintime", - "IndicatorId": "IndicatorId", + "DnsQuery": "DnsQuery", "ActivityGroupNames": "ActivityGroupNames", + "LatestIndicatorTime": "LatestIndicatorTime", + "ConfidenceScore": "ConfidenceScore", + "Description": "Description", "SourceIPAddress": "SrcIpAddr", + "ExpirationDateTime": "ExpirationDateTime", "ThreatType": "ThreatType", - "ConfidenceScore": "ConfidenceScore", - "Description": "Description" + "IndicatorId": "IndicatorId" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The response address {{IoC}} to a DNS query matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator.", - "alertDisplayNameFormat": "The response {{IoC}} to DNS query matched an IoC" + "alertDisplayNameFormat": "The response {{IoC}} to DNS query matched an IoC", + "alertDescriptionFormat": "The response address {{IoC}} to a DNS query matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator." } } }, @@ -8667,7 +8558,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imNetworkSession_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_imNetworkSession_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject46').analyticRuleVersion46]", @@ -8814,27 +8705,27 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IoCIP" + "columnName": "IoCIP", + "identifier": "Address" } ], "entityType": "IP" } ], "customDetails": { - "EventEndTime": "imNWS_maxtime", - "IoCExpirationTime": "ExpirationDateTime", + "ActivityGroupNames": "ActivityGroupNames", "EventStartTime": "imNWS_mintime", - "IndicatorId": "IndicatorId", + "IoCExpirationTime": "ExpirationDateTime", "IoCConfidenceScore": "ConfidenceScore", - "ActivityGroupNames": "ActivityGroupNames", - "IoCDescription": "Description", + "IoCIPDirection": "IoCDirection", + "EventEndTime": "imNWS_maxtime", "ThreatType": "ThreatType", - "IoCIPDirection": "IoCDirection" + "IndicatorId": "IndicatorId", + "IoCDescription": "Description" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The {{IoCDirection}} address {{IoCIP}} of a network session matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blead for more information on the indicator.", - "alertDisplayNameFormat": "A network session {{IoCDirection}} address {{IoCIP}} matched an IoC." + "alertDisplayNameFormat": "A network session {{IoCDirection}} address {{IoCIP}} matched an IoC.", + "alertDescriptionFormat": "The {{IoCDirection}} address {{IoCIP}} of a network session matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blead for more information on the indicator." } } }, @@ -8889,7 +8780,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intel Matches to GitHub Audit Logs_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "Threat Intel Matches to GitHub Audit Logs_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject47').analyticRuleVersion47]", @@ -8906,7 +8797,7 @@ "description": "Identifies a match in GitHub_CL table from any IP IOC from TI", "displayName": "TI map IP entity to GitHub_CL", "enabled": false, - "query": "let dt_lookBack = 1h; // Look back 1 hour for VMConnection events\nlet ioc_lookBack = 14d; // Look back 14 days for threat intelligence indicators\nThreatIntelligenceIndicator\n// Picking up only IOC's that contain the entities we want\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\n| where Action == true\n| where TimeGenerated >= ago(ioc_lookBack)\n// Taking the first non-empty value based on potential IOC match availability\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now()\n| join (\n GitHubAudit\n | where TimeGenerated >= ago(dt_lookBack)\n | extend GitHubAudit_TimeGenerated = TimeGenerated\n)\non $left.TI_ipEntity == $right.IPaddress\n| project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, GitHubAudit_TimeGenerated, TI_ipEntity, IPaddress, Actor, Action, Country, OperationType, NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress\n| extend timestamp = GitHubAudit_TimeGenerated, IPCustomEntity = IPaddress, AccountCustomEntity = Actor\n", + "query": "let dt_lookBack = 1h; // Look back 1 hour for VMConnection events\nlet ioc_lookBack = 14d; // Look back 14 days for threat intelligence indicators\nThreatIntelligenceIndicator\n// Picking up only IOC's that contain the entities we want\n| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP)\n| where Action == true\n| where TimeGenerated >= ago(ioc_lookBack)\n// Taking the first non-empty value based on potential IOC match availability\n| extend TI_ipEntity = iff(isnotempty(NetworkIP), NetworkIP, NetworkDestinationIP)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(NetworkSourceIP), NetworkSourceIP, TI_ipEntity)\n| extend TI_ipEntity = iff(isempty(TI_ipEntity) and isnotempty(EmailSourceIpAddress), EmailSourceIpAddress, TI_ipEntity)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now()\n| join (\n GitHubAudit\n | where TimeGenerated >= ago(dt_lookBack)\n | extend GitHubAudit_TimeGenerated = TimeGenerated\n)\non $left.TI_ipEntity == $right.IPaddress\n| project LatestIndicatorTime, Description, ActivityGroupNames, IndicatorId, ThreatType, Url, ExpirationDateTime, ConfidenceScore, GitHubAudit_TimeGenerated, TI_ipEntity, IPaddress, Actor, Action, Country, OperationType, NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress\n", "queryFrequency": "PT1H", "queryPeriod": "P14D", "severity": "Medium", @@ -8945,8 +8836,8 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "AccountCustomEntity" + "columnName": "Actor", + "identifier": "FullName" } ], "entityType": "Account" @@ -8954,8 +8845,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPCustomEntity" + "columnName": "IPaddress", + "identifier": "Address" } ], "entityType": "IP" @@ -9014,7 +8905,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "DomainEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject48').analyticRuleVersion48]", @@ -9064,8 +8955,8 @@ { "fieldMappings": [ { - "identifier": "DomainName", - "columnName": "DomainName" + "columnName": "DomainName", + "identifier": "DomainName" } ], "entityType": "DNS" @@ -9073,8 +8964,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPAddress" + "columnName": "IPAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -9133,7 +9024,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "EmailEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject49').analyticRuleVersion49]", @@ -9183,16 +9074,16 @@ { "fieldMappings": [ { - "identifier": "DisplayName", - "columnName": "Name" + "columnName": "Name", + "identifier": "DisplayName" }, { - "identifier": "FullName", - "columnName": "User_Id" + "columnName": "User_Id", + "identifier": "FullName" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -9251,7 +9142,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "FileHashEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject50').analyticRuleVersion50]", @@ -9307,8 +9198,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "DestinationIP" + "columnName": "DestinationIP", + "identifier": "Address" } ], "entityType": "IP" @@ -9316,8 +9207,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "SourceIP" + "columnName": "SourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -9325,8 +9216,8 @@ { "fieldMappings": [ { - "identifier": "HostName", - "columnName": "DeviceName" + "columnName": "DeviceName", + "identifier": "HostName" } ], "entityType": "Host" @@ -9334,12 +9225,12 @@ { "fieldMappings": [ { - "identifier": "Value", - "columnName": "FileHashValue" + "columnName": "FileHashValue", + "identifier": "Value" }, { - "identifier": "Algorithm", - "columnName": "FileHashType" + "columnName": "FileHashType", + "identifier": "Algorithm" } ], "entityType": "FileHash" @@ -9398,7 +9289,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject51').analyticRuleVersion51]", @@ -9448,8 +9339,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "TI_ipEntity" + "columnName": "TI_ipEntity", + "identifier": "Address" } ], "entityType": "IP" @@ -9457,8 +9348,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "NetworkDestinationIP" + "columnName": "NetworkDestinationIP", + "identifier": "Address" } ], "entityType": "IP" @@ -9466,8 +9357,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "NetworkSourceIP" + "columnName": "NetworkSourceIP", + "identifier": "Address" } ], "entityType": "IP" @@ -9475,8 +9366,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "EmailSourceIPAddress" + "columnName": "EmailSourceIPAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -9535,7 +9426,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "URLEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject52').analyticRuleVersion52]", @@ -9585,16 +9476,16 @@ { "fieldMappings": [ { - "identifier": "ObjectGuid", - "columnName": "AccountObjectId" + "columnName": "AccountObjectId", + "identifier": "ObjectGuid" }, { - "identifier": "FullName", - "columnName": "userPrincipalName" + "columnName": "userPrincipalName", + "identifier": "FullName" }, { - "identifier": "DisplayName", - "columnName": "AccountDisplayName" + "columnName": "AccountDisplayName", + "identifier": "DisplayName" } ], "entityType": "Account" @@ -9602,8 +9493,8 @@ { "fieldMappings": [ { - "identifier": "Url", - "columnName": "Url" + "columnName": "Url", + "identifier": "Url" } ], "entityType": "URL" @@ -9611,8 +9502,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPAddress" + "columnName": "IPAddress", + "identifier": "Address" } ], "entityType": "IP" @@ -9620,12 +9511,12 @@ { "fieldMappings": [ { - "identifier": "Name", - "columnName": "Application" + "columnName": "Application", + "identifier": "Name" }, { - "identifier": "AppId", - "columnName": "ApplicationID" + "columnName": "ApplicationID", + "identifier": "AppId" } ], "entityType": "CloudApplication" @@ -9684,7 +9575,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_Workday_AnalyticalRules Analytics Rule with template version 3.0.9", + "description": "IPEntity_Workday_AnalyticalRules Analytics Rule with template version 3.1.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject53').analyticRuleVersion53]", @@ -9746,16 +9637,16 @@ { "fieldMappings": [ { - "identifier": "FullName", - "columnName": "ActorUsername" + "columnName": "ActorUsername", + "identifier": "FullName" }, { - "identifier": "Name", - "columnName": "Name" + "columnName": "Name", + "identifier": "Name" }, { - "identifier": "UPNSuffix", - "columnName": "UPNSuffix" + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" } ], "entityType": "Account" @@ -9763,8 +9654,8 @@ { "fieldMappings": [ { - "identifier": "Address", - "columnName": "DvcIpAddr" + "columnName": "DvcIpAddr", + "identifier": "Address" } ], "entityType": "IP" @@ -9819,7 +9710,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.9", + "version": "3.1.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Threat Intelligence", From 982c5aea978d7cccd3f40bdfa579919aa8403082 Mon Sep 17 00:00:00 2001 From: v-prasadboke Date: Mon, 20 Jan 2025 15:16:59 +0530 Subject: [PATCH 5/5] TI Gov packaged --- .../Package/3.0.4.zip | Bin 0 -> 41712 bytes .../Package/mainTemplate.json | 688 +++++++++--------- 2 files changed, 344 insertions(+), 344 deletions(-) create mode 100644 Solutions/Threat Intelligence Solution for Azure Government/Package/3.0.4.zip diff --git a/Solutions/Threat Intelligence Solution for Azure Government/Package/3.0.4.zip b/Solutions/Threat Intelligence Solution for Azure Government/Package/3.0.4.zip new file mode 100644 index 0000000000000000000000000000000000000000..11d653c72ae60d45df48d2f7aabbdf1019255af5 GIT binary patch literal 41712 zcmZ^~V{|25*EJm5wr$%sI_V@G+qP}1V|HviCuYaCZChWi`@WucJl`1aTW3`LIOD9j z*P3hYReRMwr6daqh6V)n{n__m(**io2PO~^kddQ_fwRd^3o#Q@3tJ0k3p-l|OD8*9 z7k5}7V6cCF`=85CRd^ssa@<%mukUk4+sEue$HQ)~75%GQs2g;LpboOx>EfLE_`Fa4 zkSXKbm~s<3(wIq~Y}J%BN;5HXxC4HAYBp|BarQ|nJ0(kwBBgS|R(YHUMZ9b82|?h; zJfq(`C~=h_t=V7G#)s&}Vok`?mB(hlY_4*y!gBOWyP_Wg`5CVv#)iro@5jccE@S+8 zM#IZvfU#-=VOW^;xKDN4_1kcM$xFwtFFl!OKTDSh4VBXlf+Vg*X178m!^$_%Ik)1l z(i`?97@oeNw%$K$z`vb`*w_Lwy0^(&kD>g=DNn##2Ntlu(q%9iV#`W2INO}0(cM&= znYEqM9mx=#*>1O8nYIkB&DKGDLCUUcPT)V^Wc<5) zz}8&F!t)CRop`0#h3h3%Al4_2L9ob=)VtE&f@#rBM~l>fw416(ZVexkEo^YzqIaype~XND-SgMF@BRmM-rneAsaKJQ5A!PD-4%qAMEx%G$%$smO~MM4W1W^ zHh`LgeA2m8a>{*Uax^3*OL0y0m-mF7z$X!nTk$nj1RE>Vn~Pe zaG@SR7r0Ec2+x)uQ6x^n6T@qW$KK2r`0Fmge`$|Q!@{@nL+5sHjr4sg&C6P5A-UI1 zeLTLG0l21zUqnZprO2P9IJ;}`l6clR{yLWF^N(x}A9qwKi@NL0Un0{>dX})%C;71@ zc^_{93aBr z^9Gi@;gVa$+lfsH&-8$Ub|%e^B4#e$%d`}uYq|2@HqQbddla-Rid>DV+S~ioeeN$1 zL#UVS*D?c*+Bc)=}bM16h_phLkk{;iD_{p5mb)z8~bUNI!=R({20Tr=!L^D zKIGz9XvZbT*?QjlFvM_fO>hnPgMtNw4#O7CGI=#L$B#!8N*7u zxeKFaXyR=Lr`Ght8+jHc>%*f=I=-5z(v0>CHtT5VqhGW7$VTFVMYV~ zaXKbhH`GDL-WXirH$FG_$7uH1;;5x~Gi5T&|TD{!E=q*h`o{piN=Nl29GB#b%A(dtd+WT`xwFG1#@ z(yl2Q_mbDfITKgTUFSUzy)Fm&8Qr{{GHd4q6UE*y*9+sXjv8WiZKUdA|6shN5lBJY z;7y~H1VBP>BZbpaU{(oHW&2$!J+F*^n7U}wlw5ZqQ|DLuViv+MP*D_D@o40yu`mj) zQKF7G*8U#-X#)>jR1V*u$pDm7heF@AUD=&h+6#-o~eXY`q>tvlgS~Fbg z0>u!cQUhu1^t>XYU8;L*9`W{a43KNgA zH-kN61>I|G&P-fAJF&5N>KrHhemNx8j z6VRx?HXbqgoqj9bS~1SAd-f@RUC83~E+1!!nzRdkWLpZ1K(i5e8AP6#cezstA_~!x0wOM^{5h)2#)VAKNn;{$3O7P>W))0bpWu5s^V89I-T z=f`k4;woVYD9QI_@{fG39`=*gDJ5pyt0~A!cC~bEls9B4;{2m@>4=d!`*gE|4e3Rj z0+Ti16w`71%-k?w1^_MSI5$$c;l?sJY(p9_G5vKsYEsW`KjIYsRmd`#bXg6N^~5{!8z*A)G2?MSKxM>27p4Rx&7UR@oLg9&!cFAkt>#}^JQYM zf=f4QvFIuY{A(n<;l1lb_BD%FO9+b)J8!`r}I3${lMW((q!AA2AYM^Jq42SzeEDi%bK4)i zkI_Myy2UK>^Qty?4I$+RD|xR>TB60c%s{TQp|K3Bc<@fu)y>qicCt*Wh(1Cw8zKNhvK z=)t;RQZ=49)YCVFOtVMoY=c#G)_mOX@MBdT_k);kwP-F($$xRmENZXN=j~g6>2vW_ z8UJZ&E4TeXk{;0D6j;>05%=Eq`jOs_poUu>!J1idX9|=!8i!0V@*ZUG`1XB+7|$@M z?>^*lK&FuGD4N)@J_@6Yha($Zf3lLC`aFag_;pW}$P$6e-xfPnOE!9w^w$>cVTD~= z$NsPltXLzzM6y$960+i`S$YCSGlkp>EG!GlA%Z^RHa`|-0iK}$i=p%A4)6s zZEc(AQAz`W>pjRiGnDXu7;%inQ&0U)NI}{pUhe8`tvt3=8g7%>uZ}DGhKVk@SY$&F z?d^KTXOj+zWLk~=k+UBfZ{O)|uR$AAz}_?zXCjv?x1lPdfiTevKTY30{=OW0>M4!X z&4QIgmC%%H6}zoGq4#K?*AvK`d-1`Vr8&((mSr|;rOF6$8O4HJmiP=9?JYTOJ8%x% z5!~QnkRidC_Aa@X7NWGen@_n(@E9hgplx{#hzk&!4$YrgAn2?*t=Aq}nvMQ~1Y%Xg zU^3Pm7{By;Vf(`_X?Zgn?z_*&Pkb96GqI9HKE;qNyrG+Dc@rU)nCo)|HuatgrnR$X zob8E{N0&#NW=6kaDqaJBkY--^Go?%L{`s8w>9wMKmFkXhO+X>DQXi(nI>~kRXSO(p zA%Rxo2;5rS5&?bE&$XR$Wr84JH6<(!mY#DGrx4TSa2(-YxTtYKO(V9q{kV(Kw+px7 zo766zpP6O~195XwOP#zm15#71#-Go$k*bJh!vz zFXO2Xh6Ij!3swhQQD5dq8HHPd103W9gSk#@EFpf|Utf?)vXD@-l9Z_V2tYvGUO+%f z|ECKE_5A;L!N}iTu#JI*t*VKQz4do5{QvBK^}c&w?|=K>b006aHLk>~ucxdxe6AdR zD=&#;alr3ruT`6p4j)QHyL0EOO|B)`g!l<~a!WDlSjwcA^A;FH6tdn_vb99{Dd!e> zkPr|hDztK6I`6lwFWEWQ&xsb>k>z!d{EPMRBbBegUSO{ugqf&!8PTK0x}0BiX$kEI zF)zGdc`Hm1o&{B$(V&@fI#&o|I`KF2>_>&4f?b?1dkQfe`W{K#oo_MY-ou&tyb^$b zuf3~bW82k3JnrXE#O;K(v@Lg5y4RsP)10fA!;I>esFV532|v6jvk@dxkxXn-Sb;^J zr}aTRoVmj+Vw?Sm#;8ne=A%{W+P(Hk_H+#~SQ*0r((|InsHc!|3Mnf{X+JY@U-HSk0@w z=;uvC(*!-!O~dvUJTQckDWvlq?@z2j4b6 zJ``Vk;+(k)%uZ(2O2@jR9vh*VWYl}Dt~7Zw(k?gF>%7xsL99r$Lyu}1vY;ItJbhU7 zV7J4aLk38C{aTu2w&w!{4O zfh#?~m<{WA%k4818Q-i2R&f!OG$NOhwrl~HX~9oM0#~r{mPGHII!Ys_K(=Nj=}%mHq}9 zP=D=al~HLKh?!?)nIU$Nr4g0R+6^lu)+)mCqhyvx5k1W__%@WnN-p@uUVt2f0Z3GB zlp0WRL164`+mfQL)k5#n(wxTSr-xJ={TK<~ z)|UcVV!ue`j4l3dW3}4mVpflBF~DgNSb?;Or^=J$uCEmBl*@|I##8*r2o$Y)tk`qL z$6tQ2QIWD4G%E;?AUnGp!<*Hom-7zuoyEpX>95}B2_H1dTI+je`k0`XdHoPs*L!AW z`+FvMieJO|t(|S}tsRE;=M6B7x&^G42M4K<88ZUKWpMNem;#Jo5FD9Wi41(>?1B)j z9(-k=D8!(*OZ;ReQC-Yw-tRJm`mpbicTe-0%1-ls3gI{YEe~46C=F5*c0nS{vu|o9 zB_ODSh@uW~ZAURbq7AsEH=7>Sdp*JX$D{kTblHDBx?js|zh47S@$ERDwX^G;wZqhY zy#YqC#dwLIkBE+;N^q0=(&4h+MIV%w0l1UULPQOd@vppBM}A3imv168kg1M(82glm zJsK%o6=avJ2h-3n&+f^wKX@Ut7j3)an;op}%*u+5Xga!-LeSMQ?TQd)re=bBu2g>+ z37fiIg?@pK4TnF=96UK3iO4#J>W+d}jo`J!gxa{aH*a!u&;x8ZGhb`hTJC$z&C{wR ztfbnT#iS{|*8skEPpySl7$<#~zQ@15as)ajI(KX^2z50ZS1g;>hV1jS7W2wls(O{K zo+OGlt>E9XCr9en`h9zMeBwoG4Bexg^S7^?Z$n#tdb|Ic`7AX{^3`gQE-7e%{7A9Y zq<9}YMy&Gf;I&SY_>V>K|5)6Gw&?t0p*v^I9+PhiOz7D$cica(rIXFp0os51@G4QD zZtqSwpritC7r=mqx2dps?HY;5NWXf4I4;})*|2E~WLL;L{dPD#J%M1+9An$fY6%a6 zV0V-d+9HLS+;4SDwfhz#tE!dxF3{f8bSCfNeh@fQHPMV~+A@Q8JU~L4^_sIusA1z{ z+{A-FcghCeA5S$JTu(nZu#Dek%rWd~s5u?JLOv*+%qg8KSaI0#t2r znxF@P`P_|u?)ag@v>b|49dn1|0uyrwvQ8h3M7t7`T+AIi?ma`iRVkMY*%lpbM=b{m zl0uX7AE^8pJ9f#9(9I@I{Xb7VJe;_ul6EWEwwdwOz!F~NP%Ucz2MY!Lf3O&D|APgB z3=u#})px;%Y>UZBX0B|=9`l%Iax%fNd}1?K|Ij;adAcFIM3CWHvtsM2BHjvUhr+bz zZiNyIC$C1@F$7Q%_l>!WF46Ucyfy|C&y1q(C^(1)Vq84E28C{%ozc(wU;GiL^U?21 z_k{{8K+a-{F)c};>C0xvLIGc8WavY5Tvf(K3Gq}G3FeJs{1;^cb;s5LxmcXH^%onx zC?Whr^(H|^u>c;z4yXRSbrN!?LQ6_+C(o(~nuhug%NY!QVH}U>$$#(eudcBx_jR8Y@1$G+c4QBh3vFjkiH#IA~0Yx?Ca^dJ&%rM$CM0T!7T3I%Ie?BA?( z|I5k~p>%N6!=GTNCqlho*ar(}WP<&OYoT!aF3CU){2029xih$%JZK58Zi`dXrOPwd zehLYzqWUP3YT_@fJ40?~pqy4t`cl$4ggeMUnkI*Lh&q;tldjGJLGhUF$^Xb;vg zUqL#s5@DMbj9XA@xWKszWHs%#O>AZC1}9FfvPQ}#0hT_%t=$H&#j!e(BaK7W&u&mj zte_qofD-tw5zub9K}9-(i&RECUnUf3t1^|fyAKQMV#b48>xUE872U6f0wo7~sS|M7_t1XR8rTVp+$oX`1JCK6O*s?p&53v~-2b_e5P8R6fUfIG?h zx?8I*L^@X=vy(S-*-OK!Nxv+jslW1M^NwdSe~ulq6YeancLd20dsW1CLx;vA@HUoywN;I zX14P;x7s!T*Axcm~K2dR!p%z~Q*^w68R3Wh2xs_Pih+DZejjAXN+rS_>@m{W5ec5Xh?bZT)8KIquA!0x1ACXXE`w91sSUqbi)o{?{DRefuV z_Sw`fo_3_ty21*f61W#l5`&H>aLX%B4)xrlV1eDUKVbo{_^40wzaWVQ{A&Mk!?=I- zztRZQW~(u!<*Z*~iR{>NUy*3BYdp{26yGb^IOTL{FoJUdZMAmO5@o4pNo=qB7WID% zY69TjslW2i)L*yz$CHX*>y7#*l2xHAm%W~6t`eevje+?lfU=ey8-z_iOGdT=sVHg9 z{~f|aF6x~ulb(14yxzK=Et9@r<`h}wDz@DRz>m|{JCDb~>>_M5Z>u$t@Y{FUs)}^V z6!@Q-TtL1`H~*hfmH-gRP6TT^E>ZXoDN@{e-=*wV#|p??$;uqB=xkpckp2@^56-!p z#7DDm=tV+$PE$uy=!ourYrFX4zoq#foq`A}$YSHNVO;H^;NNc)@lx4ZnS!y5S(dkW zN8Iol)!MytoNkji9#2Uw9_@duirc~SrcHJ-#=_g+U+=)EMRkG|BbbHx;?4D3Q5h7l z-Je8zJB(DRCT~4w`+li|K;!G!%nn}h68@GIL99_prCl|ap=kcHML~e|`FzH#gyv?e znmS~U*s7(F6(t(ac%(kZmP2OZaNBrVdj)Mwz3l_aM`LET()O|8!?S zM;%$z!`BU9l+c7Ak655GQNQ@Fwma}#308u=L>=i?0VC;C*YGB_TK@A3#)pb7T7?Z7 zx!rLJmK2@7s9j?+ELUlLAVtI`RcRjJoCFcd+m%8!J9jES{$WQ|napNkR#AwjK}v_?*+gX?ul1^g)bZE)J<9hW6aPFTi38nKhvEZ64B z6{V~=8?{p_v^6>C4BOJJd6^nkvte_3JOciUJxyl&Pt^o}j9l&5>T)I*lWOhT0vjqk z?IW)0?$e?aY-p+}=HEj&OhQ!Mgy;oUUW*_L81&^I*A|LYJytaY zn{i>9cFt!!NmGz>LEXE4_;0l<*3B^zM_YDB4|Oi!h~5gx4EOpYdEj4>v|Y4TySl%+ zPP8U{`NdiEt4lcDi{cA@sP0NqKQszdj-`vXSkMe@t~;j(kB5tAF%GD;$ey)>nQkHs z>TRY5$}X{;=mpWfwKrT6o|Cs=HyRfby za0lpgNDP|Vu(yyvIFQDwzTN%e*r(0iQZ!)ouA~~3A7;pww-_^sK&<97Ic=O>#ox+u zbtZ@J^_OYH*dG<^+37$*`3&{4O;QNjUF{@tFjv8%4dvRV)t;efK7Qyiui1HOTFlAGJcq9?zkS+pjVG#?{~tIo}6c zTCL**{cAeJ2F|}N_m0K9|AQu98Iv2Rp`DpjY2kzKg7%Br!p>t^$Vf@De~V>bDOsAE zk1|^+SG8%2#+zUGr+4}fMs=wJ9&PC?6~TZ3JJ~LNZHBf+9%Qi3loEMYYsmR7k0*}y z;Ja8iUYRgsn%oG)i@kH2*rEfdS^6<{ z*Z58SOpiOjVc0?GLR7!LjilRn$gJLT)B(u0TEe!O(=J&bWW-2|HOq3GDE#UJ@2EU; zxznzmxl^#VDC$6&Beg#m+Vg0KYk&ac3G!~xrtNi4-fCe!s{7Gw=DttsrcZdkO=C{L z_$cQy5|jcl!3;B*&Pk>mLdHAJEyhkNGyzyS;NK9V2CpSZ z*;3_;A@z&op-dppkBBwz^w-PBT}&NSjC2=jST*X*QLVf%OU&|cK0;gy(z~d}zzd4A z)2mDH+oqSbSV~Y4)!u?TiK}(yHnVba7ucqy36|#?uFVat4xLYV4q=-wBEs_CbddCT0DqneM5uI!;Yx1a(|2@T@-MoUUyd7r z0mWIXi_=zb3)V+|)tnxyOn7~>JPOztaR5@DnCb7amFG@=(|_&v(8k@gK(^BB|Ew~| zYJn?Aa4d&L6jtr7bh*Dn)Xjv#=Xq$uK-z1!y^p86+ra{aa{FB9L{a}lz*Gea3V8iZ z#*lwJ;_Ty?>rZwEd(L|}?O>2RM~5`eUt2+Ef1gPm)V%k+9_=rZZ1t1-r#mh^91AY5 z08TjdA__fu^d_tAsmX+5IUCcQ-2B#Pt$X?faV7y|3svZeA?n2_G;E@74>Xe29~br$ zfN7s$W;hWwKo>H zx5R|e2zmYs5#0R<7Z9(u>isd5#qbd(4Bn>4KXma3CC)OQxzuXU;wGlN;S%^^d6Me9 z`;4ajJYX$zoos)AfNAQ=wHe8o;k`ndWAfk=gx~AcnPpr zy*^S6`#NpB5!6j;vsG}`)CntzW_?U-PcLKQ<;pW-2-p*vzRI#?ro>oi#c3keH5a-v zn@f)wuQ5<3)0^+>e(chyZmA8}dkr2(JmtVnhjoi(-*P{$f00Z6S%qt62=TK@TBBja zlIe7nQEVljbTJ?HeA;I;DeXfz#nkoY&KRf8HSLsSW1iVRu(92=z3^EGWK{w_86>PyW0N^6!3#<*Gx* zp@I%u&qsVzIN_O5t!!?N_m5?wc0sqUQ)~Bk%;>>x5QA)9ImFBu)9RNNf_1^lUyPIwDYJ|RSAK8X$B2fy2M z-e%go1*DKX8s|UI(R5W; z;Jmf(+C+C$K)_^$7H8KtpFl$tZK?wM)RmrLV7fn)o}WSV&|&mw=9@_v1bV%GX?q6> z{hFXES8IJ{dHej)`fM5!rMJ4Qp+j4Vj+vXMyR%EH{oc;5eqvJp(CQ9OWtQFZoJf@6 zQm{`uJw69EQ3;Nr2Zg7CfObcupGGg%W(Rt_tLt$7q92*4^au&6m@G7WL{yzv(7+J9 zfI(DIKSYnKnutI#3Xw3tG@YK8Afk_46zB4>9sdw0k^&Nh1{RPE?6)5z;MhyxK@`V_ zxm*HwG6HG0U%d%ad84l%69!>{2BlL)7@e?X4&LtmBQFZQ7o+H)2;`?~UL=gFGK^{+ zTbkiXoMoosSHY^YC>*;X-rHiewXR{45`}>JC!m#jdr)(4-+bLH;Sv^|QYR){jYrX40e8gv65pHsxje z_04F78$=h?R-6=E3FMDaKB;u_!_1Xav`SNXGoKH3d6IJOZlFR%qapBK6ZdqBL=XWN(lc7Q z)BLKIq&F(UJ%rFOi=LNA*Jw_z(9UWZzg-29uICqNpxnWMYlybj5P{H%l1rsDXMHI=+4gU8{kE>8zT@-9aLzfk2!lXO7SYW?01KUI7z`|hor{nNnN6*Xkx)Mb+F0=V~4olG~TRsN_# zSUzK51!Y9^U&^|s?MzYU+*cPjnKnN^Y>1TraalTlcyeZOb2Kz>(yg}@5E_}Xwkt8o zC+nqN3_4BvTjaAxy(+P?Z}p;;&BtfQFg>8%a*9A0bnx+4SO^B8L(&Ies~140FyRuj zN!~>{B+j>LRyf{lEya2R5W0%OjnKnDZ2*$L85C8%>^Ut@9?E)6I(HXwu6D(L2i$wMMc^lx49DO@U`S-ad7JlsY375s=;#V#zek&9&wJZJS zu_NVqxVyMwEM!CNjwaC+eSr;UMn7`+YtQsrRYF;2!K6@22SB36j3VBaexyO-H7m zqMCI`6vRiZ;0qC)h_4&&YWEH!^Cyq2ec#OytFw1L8sP~0J1E7SGR@m@bQrilIw>QQ zWH;@sD{sM!?mheOVY^?6pZMoet7a)2p53)s>D6OmbY-e?Yp!YYQRP<}Tk~K)oToDe zl1`G1`;n!s*)#DCIqz-f%#SZ1M)qqX{9L6wxIw^emp91Cm`7NtqYREd2bj*eFx!8k zCvl2afEwd;6sC8P>js1P5kwN=z*p~0Jx#N);1D&W4e{S}&MadZ59y68QRA>{#6QAq zmC&cRK}JCoS|iHH!je34H4}h*x@X7|uF=rmZtWM{eT;?!X0SQv3+#>oi+PYVYb^J| z1qP=R0?eNHN%s?%=FoMLisN3Wa`wN@*QgB{pTVln!IMTgx%5A5I|2l^7EEEYe>MtP zsHqxw7Ab{yGkZ?>{;jYrn9$onOHVt0ao?E&IGER;kLUZ{2S2!c-i_lz79d~ok?%}h zX>-u247+^T58l358!I|IiVS|J;ynAKcF_RRr`)thlOr@*=~U=cKcc=4G)14r6gQVd z*8^}gMOh)Pzuyy3fPZ`s6|mzt1|4Jf$rZrz$v(3eV>O7hm0Rm5sxixvJzk@}m)AxS z-HPV3+SwbZ`%Cq3|FTrad!q-0dC&a{u8W7azPY(*r{!Yj3SaUiu?M6p8`5p4PgB&& zj0J~a4y*|rH}VSK6l@NjCG&oT=-2kS!>EE9D@K}z|9ToXWIs(JsyR`txQVsl*|nWg|(>Xppa)w){1jj84+ZGrEvZ1LiMhm@!>IDSxQC}NL&dyuH8zy^4h ztj&C{FKV!>JmWqj%03s%ajOtiFR`8xtF-MnU5L23E*CPD8m-uxY&VV@&o)dUan82= zK1=~c*blaMy$q;9Np9U-|(4o~|LU&a^f!KWny(3)hAPR{aA+oC)2E zxsAA(0OlS7Ly~LfMzsJaAT$!hnE<1?rR_rVla zqGZY0fQF~XtQ+405&x>`EL&}OAt8c+MGn_|S1>scffZ8wNe4^W*k_tRjN4!NeA}KB znoDI7k{RRP)5)K1cIn-wvKe7P@9CHg{xtH@#dw=t72@P#DW*B$JXpa?*sF}PT{=v7 z*x^}HPCVKtIxqe5xB`JzqXkF87zRNfes}hBXNywQ@AZ~3Z;b+HAyZD$zb{bqe%awl z*Ziv3_)m5w>Q|9O?iR{?1Y@IZLvQZ0{_oD|=*Rmr*+)(k&wP0PC0}Tcu_jiJeB785 zb@|t$gZaCY#Sf7J0@Nc|5ALU8#(RuTr&04y5lPQvs|2H5f>nFkyeBBRcdh#=^IE{K z++My6A7Zz6XIP&ggpX^7xwk=-xq?BBC9WxhKuS zj&7Jlk?Mzj- zhO;;RW{}z!Dfe2}Z|-0)wrWWt9Xu4ni}BJKUY`@Q}}$8_!+9!m*)+ zdJt|3j0BqJNY1k?jRfOa1VXVijIr%zV&Gr|gNMpQAV7BRiQ)P?jFH0mZ@l06A6_Tm z=1l6#6MKVfq|3(;8jfWd`>r%ks^1FJrBiBb&ikub*K(i9SW3m{<5ql9(_SD$$HzZq z`tiF}0(EXsa+%C`LR(dOLEzGixHtO{CArdgwlh5qNB5&x@0Qievv8xEXM*6<{vxO)ayrJs==ZoA+S+fTcF@mXf!d0RC?P-Jz*P}#QD^;*)kjz=jVBYf5kLdNGl4w1y+3aCSc$600mYME(i z|K3NR^IDu?NnzA)W-Ajle9ZjSzz9OwJ>EIU zh7@4+PRmt|g5=CMTLiAA$sO=J+&Sd3lI|X{sS*LXH?&NXof{+=uwHj~}4*XEIQZhRDuZR)6bEm88Sh}6+KS02|>s^ec zYw}K6GdW-?9w8&Lp*7su1a(!egci~!&*)~9RDV(1KeBR)lBIomGo`$I&X*fmB|WC^E}b(!c)kw&F6w zk}aZ5OzJZOry7)I{w1_gWttJoM>~LP=!a$w6J?*@zAh~G;Y)QAF!o#5S(3kD_ms=h zOF`c#H@svKUc+13?xLA< zpmjz(9MsitvQ4l)?=>{)loyoa(VV8Yp*A?%X)B|;gb;eLTi5Y^oKMyWsZamTFV4nv*mFp&Wz zAi(QM+%`dae3l+6o*%e_nUbMOx<2~;y5vml>=%kNI$~nov~v|K0Ghdq;FBf{R4e9R zu84a$VwUsNfrwoC%$aHVx|!z?_Vyj+@ON1`Qv%f1vb ziWyOq{zEJUrwuAo4HfeEFL~10%f#k-!&MK5Gu;k*a51~1irz79UXrv@%l=2MmJ(d@Z{}!bmtTqhrJ9OMCrqtG(hVX zkJ9+53#mA-kIpk{m$#=qz=uul$ab<&lk3pcZd{hJDIiN8%YbRg}h{?={hTGYUT!Q|PqE(qsQ{DsQZ~U&ZK^U%E0LW%KCkNnHS3 z*Fd2W>WekJ-j_tepp>+}L^pevA8VINJh=!I32ll{vLsy-+1aFxeP?Opn6C^?I0iUNvXaa1WVUjS<{~1Y-U~ResqM zZhwHlDYiuSRs;R)CEd-2wYiemo!9j}vw=1Q8~umOU|dNVlo@F?H$#%%@}nofmh^qd zwO_z;0@b#fUHGAPhCAu7d>ImGa5X=gV{c z+&Pt^<+L;>2S38DN{yn94mhL3ceMR#6wCSU7NqyIh6oNgSX!XS6m@R4j5&81H!m2+ z-o$dfsm*#z4J+j?ebCtHC*4#C3~DPKJvxK~yJkJ9+sO+; zpwHM3E*_rzb2^=^KS$;06*cpq61)A*^)w+3MVwU4T8uip&#KG5>;ZF!8#u0Shyogj zlvX5-fA6z`xk1!58P#PO6LT@Ey`Bi|?;Ru%>e}9X7i`Jp68{*c)!l6)aNKuwb!5k{ z!1PI-F?O>CEt~~$clCMhS|*ANq+*&%n6PsrSX8nsS)pJ*K2ZMnmEA|NNnXTygg8pLF`cPeDSkGa__Eb$w4k33hLk1h+#4mFtW&d-g%j#4U9F z6Yrtd1Ek|uIvmMD=2$ysVXdym$QXpawW(&(sdZG>&LGJ7V%7>wAcd9MbR=kF!%-rQ zw1}1m!c}~wzag7$^VA6D{|0G#DE&XaJcaO3y4fS&DB%Qy6j06dC_=!6+Ke?N$>WCY z0w);2{9MnP=r#(aJRx3Q*5I0gozaXoN?r zgc|q4nt@}Tn{zU#=tx>njb`%&EcuCa#cCvjPD!hPN3q@WBvHXU4LLqzJ~udipuK zF;~j3HZ<%6KZaMLR8^%c6Lh{pem45g2n;|4BL|i<(e*;yz0b(=%G%wa`M&o?O&x$E z(Og0IH_DrJ?9=btq0K=uITR-DF`(|v-(7d)78s24RyhD!t%384wLy0&(>yeL*6PtH zeXTE>&G>nvMU~F$J(6OgA`^N}{I6j8a`hm@#eqMtT`I82 z>4vQqZzoxWouj)n90|Z$%Jis?l%b)l>cMs9Vs!Hhy`1SCi3_c=HSo|6+**Wwi7}&0 zc!Z6<=ByPgJauo{u0cx)3gUvu6_5Gn&aAs){`mt>&WBB+S7e=an3G8ds z*--Zze}@SVma6mr(n_yp-XOxN#QuCrj{Ir!36|nw%_*;m6JfXYq&gf#R07Hg+|>P^ z2R+AV-vss;fBGCRA_+hrwzqNUP?|R#e4KF&PY!Pux1mGt4@uG<(emoSd1Q8n%!t`w zdHnx~`ljH_x;DxfZ*1GPZFX$i>e#kz+qSKala6h>V@$q(s%ENAopZDA&V%(}txaM3 zyc<_~lk_U&U^@R7X}i^#Z1mr`ij7#|lbzrR#Y(f3Hvn1^WGQI+?t!Qakj{t5K3OLi zgLPYzSxS8yx;kSt70LQnOs@$>-a50umtl+Eym4tw3-pUX>$5kwvVkE}N#b^BgXa&OZvn@mb|M=@spiNA z(Qt0EX-iq&^|F_>n<9nEE0cuCRUca)S>Qu(2fhJUE&Nb0UmkS$zTqq>9)F8#&K+v| z#7^8$#{A9(Dd1@Tc4~7o+M5W1JV8igd+L{mP`rSDt6GsUSdA{V?p>$|kO! z{C9%59}ooDWkvlcI<}a~X6*O!S#hRIw;6B0^ZzogWEBD;A@T6yC7o|V*9?jk*SG4f zLY=e_nLik?pvIya#9vP|H0$b8DFLb>y6$ijwDOvHe);hnB-b%<7`9Hwn2{Re}SIN{T zqU`Vz?!(^1-5b$^FaES)%)aJyle1+NUpT}0#b)TvIonR#++B1Dn7wuTrhB*!Izv@tt%yi;BITmHXcv3JrwzKG+u+d*h$` zBcZySEF~8bENRheSW&IVyrL$$)QKJ$D-x$bbY3-dY8ZG-YK;)9YggDZ($%Pe zA;X;DclGLsi72_An>c?QJL#aSP+9a5HV5j7dFPH}@K343`Z%%Bn&>=mYhB?(pF5D&!Vlr(dQeW5K@GNRN`X!Wc} zBuShQ_PP1BvrY|F zzOUjr5|1#DSNV!wUex*&?Yse~SM5<>^2v|VZN;FTu)esf^1>%=!{@3>C5fs|y=yay zl|3g{IRsbaKDy>S6|%Gj5z(za({v&p*B4DFTO!}70YE6f;$xPwK$geT;G_|w9^*h+ zlkgVuaZ>rn(XVjz`bIS_FGv26rhWtu*<3#DA08dASE#vM1qBBTFNV(I)cMqI=*-el zS>gNxRf7XQoMo`9PTVVIa*|9}K@@R9!4Xc+&vxKet{XpuUgMltJqL{679F=|7b;CL zxAM(O^H#J-OFVSzb-dhqVG{YL@@iA_gVV=m^a&mWN~b3WHWxb5Kw_2t(EOMM?$4~H zX<)`>Kb=HQ9J}_?Rn!p)k)o8|P70bsY1pnv{@mCJq(^+C%dU_~u7=}jM!oJB= zQ&C?xGblCSCVt+ZY3dfx;PWKCZBaLz>kJM_cFh2fAT4ZGds?nrVZqR)GQ>3N1REgb z60`JO%qukk9)M%-C>vb{+xh7}k~Z z*@iI0@AAs`-8I&pvC_@+>-zn9>oX130kTqB^W*QZ9J(v-#bn6z9>pA?!jQ!VLsMOn zREPgvn8z?ILK+;@2d2%frXHpSg6%VT|k0s8G086yuE~Omo87tfhnj6TMD4JSOW(SB+&`@YV_^(TmRrSe;L{Hpe5i{V2wKDgHUi znDZVUBx8d%Q3cSROM*tmTWjbk!h7J?fOVvw+%`#n#)b&1iOT(Lgr{1liLcDK2}68= zXO7HRuZ|Qp4#aJOxa6S57^`1%1*g9khzqD_X?|M!f?zk)2~|@F84pp423&v(&coX4aIjYpvZ&M5vGSENY2l!%!%Dx_kMcD2oZBjjk zW;+w}XxOVGV%O~zB#wo0IN?)4G&)#i|7RCc()^e>BqIxl)2dQ$cG`NRcFI?2rfeWI z>l9+vD~hczmj`LXyoFcgdtxUDRaNxMs!njK``6y6t9tdo5H%2d#l7| zb+zK8x0Y9{$_L1Ugja&jnu=rP^fWhiAT_;8TaI5A_p~Y=AK^@@%)d)Rqwd9n(kM$j zj@jzqUD_Ad9WuH_99AX_*hqpf#04jAly?v+1@2t zr|2=$ICUGf+&iV*yW>{R(I9yp>b#ey*I`fzEC(MMvw|D+(O7;D5ctRN(q%Q*d}Zb` ziqoWxu1!m~cOQWN4F~omOpGqxKrJ|NV}8=lM1 z5-?P1BH-ga3Tp2Y9PO;>0%8B!`*xWN%`{6{^0*`;3qjy#mf#MA@Oeb)JRfD_AjmN_ zIkdIm{Uyw<^zkp_)5B{3dCGvF=-eMB{6=pu?sgf{_cK`-f`+tl4Gdi5%k6@whOp*W z{K#pfo^#(=ZP&BmT_PWNfX`b;x!q+`Uuq_Tm7VSCZf;n;k&_HPrd_PyT~BH=ZlAT#1Mn+K1pki9=-}xUGIS}Z^*fu1 z(QyrMM4>5t9hrZ+$xD%k`|2$U{cUw-v<~MqdgdMv2l-wupAt?-Mc^Nl}^i-*z#Nt_G!kv#+R+@Ouf#1xz)zqIR}{b>alk&JfnVI zLoAL3-w#+_V+Vy}G_5qx?o`k2+CpA5n+NyY<=KZRN#0)Bhe#7Xi25ETv+WXb9^yQ& zz7MkGA&jLM)CVH7h4&V@k0|D&oXAvea%IU`yRF(U4}4fdCS!Wp0|N=JF4vm5S^HkI z=l9Bw{ZR>#sf@+QM)7&YY5W~LYQ1lh>fgBD|E`uqJiUs%{{e>H1HAufk~BBg@dv$# zyq?44!g8%ms_Va=)98Pyy`M*&Xa9RUZ^A>|IBJ;19H@C(W!S2txM;XJbid?D8S~x3 zf8W_Nh~u#2HMjTCxpW_qJE~zgs=2YLYSXI@m{jfyF8jhNaYHyf6#Cc~a!kk46Szv^ z^J6*;fV>l}m8r9ZY@JZIPgdG>giH$8x!(PI?I<&VU$1rkB8r`f+WETuq!JojrmLH8 zv7OPpp0%s%2e&>aHpTsnly@g_Dq)U+9;LpQgj(mR#gSJp@kzT?Gz0l0#l2L7qj4l# zmwh%nkg+YrC*a0DnNeFGMKGR`%O*_2v&a%Ikj&DvI}npplYN%L(&Jca-@?*UKBHO3 z!nY+*uN(UqJ-=Zk@wV{kNgV5pvfc}7{rovdX1MP2YU%QQ{>izp){xw_uqVj&L>`#7 zviWZN*_)P|2TpI- z>0PAB&;2y)S4=kR-OSLfSC6hKDidHC141QV(K>a#d~xkt_Ig&3kn7g&g>ZKX1zY~k zrJbk7Asd;t+pkM3zR@QD5YSWZFI+q}C;Q5-Lzv%eS+4UdPxN|uFYh+d#~h~?1?CAz zZ^NJ`2-3H(kGU7C&XHI&_ooE=xJZb`E3c3R_}9addm?Zi;7L#un$7;lQM4YlZdW20 z-sjO}-7obc`B04d#q2B;>5iZk!MR-Sha@t%Q#av#br$)?`l#l5hZbi97V*N^?;2+) z8jR=#q3aFSZ(nB-t}hI>ZcI*YLA~DT1{}Bfv9Lk&^36oQd$dupv2_>~Q4GRlF;J>E z=4^pWZ^2V6f+S!q@51~n(|ANQRPtOb?i?vB?*Fd5PBm);*`Tjo_D~Qie|`KUKelNs zOBDOsfy`&i*588{oK9*_+Fmqx06+<8z9!+=euv+#=IPP zzwI$Mak_DjI^qZ%Ud-r&o~@r1pB^sAjLmz2!tUKvD4zWzcw=8~7rfG2FyfqF88=Fp!M4uLnLM!{NZ8jO?>P(bbnB*(j zjZ|;pqaDx#2QS{|r0saI;b$ULx2eYw9FFTqn6A0Vl=(eS5@t5nJBZ{EFv8Ww0Z zCI!N|Q2H8>0k+yGUgtQ>eRuIvlX^C;%EF~w2Pw$J#b$f6EH;JkX=E;TM&2kAK1?vtpG(Ij_jUKvx(baeD<-2er%P4c z4=`+U<`^8Mo|NursIcFoP6^&36XToN47Vx`PLCtbIwoRL2#|j>kZ`u_ap%vcr6G0Z z$;Fu@Yb0e%%iT@g6`nAMB{c(8kC9}R^hAoC9=KiplS!bMYwDM95EjoTO6SDL5D@Fu zh`};wI7{BX%0~~Rd$2GH8lN@Kt+M#_D_w)bIZmd`$B@-iT+#EA_H#5_ZeWSF=e&R2 z@v3_g3yc!UH6BUg(?LQK=5kRw_Etn8hfI*1N~s{5<3kD!gPj&*vncp*h4As2QOjtS zmPrkl!AV{OyxQhakcp&hn9=a;9gCPVPhBHfwSh7q4^Ov_iBXy=kFBTlg(-owAv^%2 z7cVR^`AT03cf7LKZo&mGql8&7zQh@|Cn6R z9P4e^WDIG)!YCHQC@|3Q*q~%$Iw8?2dr?TA?zHX(f<_7$;X(_Q5k#Q;^`Kou-C=Q| zAOc_kK=8WaN}r)KYyWiGN3{yp*(=b9N6Us?MibpY_PO% z#y(`IF1P~I@@&8q9SQ-}+H6+<{153~$P1^KtbA2 z23e75j-A+aOPcvF~R0xPXfiyg|_(y)}hL{=I0`P%P_XoZym2Zw`0Bn z-Tc!9Ai{)0bqIOV&$&A+eMg^+Nb z7Qv57#tH6RRbj*RMTQ3QYoT(N;UcV$^I&JpIvoA@89&i4%1R`|peM z>3Kgu_3$6mB{^~S`=B7Ues;O-9xiSlFPGn*=@FGe!+}GEGf`Ag-+8?}+y6$qWsk|@ z1QrcToIuZ)vZqos|B&2fGVf--_YJW^YCJHr+n^o_u}tm^82zs9={Om>Hkx?~Bu;?3 z)z%P(LaWDW7R83TW8?gje4C;3N_wvsHR7bXCt}XJZY=5-e^glt9m?+ukh-yEWf1IN zUnY-PX|7tlQ*CbutJp(0IE~9}P47_WC`CB`zGh^1(gK3l1i=|BYH=l2!YxG@*d!ug zsJM7?JW=-iLe$Q{3FMTD{gi=$ z5Et5vPrID;k!#jM|DnIR8O|-&t=n)8(5hGEtI7xOz8w{U3508i{2~vx@q1Lq`a$+i z_TIv~QzxY_MER&}3v=m%5y<3D zGc#H;OdevNcXZ0Yo1HsBjF-4wG?v^wuC7xEqQ9py(q~lW%%|C#wPFS2Q+LMq*5QS} zoN8~i3vq<`GJBFSbAw7y8xrC& zLu)OY>a<4j@$X3mFy)W2SxY-JDL7iy_vj|~>GpkZl)G9K-J_Nx-C@MO)kd|GAJTRZ zwhIlq1CwfQ(b2XG2eob3whPM_GN`Ciq7gz*+^~=6Rw>#VcLl@ z+=I;mb`vOVX5g43@`?CJ&~qbBb11xM=_Y(Vi4%pJ9UWsX@4(34$?QX^psEG2KN4ei zyL<#PR`>6j>;+f-VF3FP5P@>0J3|VbcVkKs7?I@P(sNP%v5S7dEH7!r5#GA;<>xBXETL&k%A~bPfd5ZFSJn!@=$O;CHk<) z$HLXWa`)+IUE5N%1Bw3M5YqwDLw|AxbXC$A zY97ETCP*dPMFh^gpsyw2MCihm)OrxCh}0Zdl{?%0G(lM-rs!Rf7$A-~_$K_`_U)I8 zKvtybyckpls>)s%5Vi;YZCjNX2zWO9jjP8z{RZsVrF8I_aFll*QM;|Ay4my^&EB#7 zLKF?6W%7#7G=ArO$DJ>YT3a$Mz~*8>z6|C##t^PCt@k=u!JD5(Vxb5CF$(4UBZy|) z-hR}t$q?TPt<6?9PnpfqUwc0)go=n0ixGe{$-;i;0h|JkYS~DC$|)dAO2NoBpj@0* z!az8*UPAAY=%IC8NWtG5lF0Tu0=AKD9#4F7Hra~^$@tmOE){uMb52Z5k0N!B3elsU zzyB2Ku03$?Jg{;Trt$@I2puZQOxSL1&ZcD`&3YT!&N!D~S;4J9x z?t!KQk_5CmhLLKxl9tt0yzE{#lG+;z(7WpDRL!|&$n;?d2Yi<1)}`wI9x}?~0#0fZ zT}=~R-e3=_HV%O1ikgMxiK_Ro?#NBSX~4pJEBblUWf;QLlsF7lu*tn`w1#H$%yq~zi<9-b`6$vjsb(K zmtGjLdf40FT!^kbf4|Kyeb3K9rlq}=3FzxBKYw?J$@71{<~{QHy`RlGpbqak#m9{H zJF^lieMBCl-u9QvqM{y(y_T_m6(-dwvlwV?!Qk(wo<}rOc2}T`jw6jaYFeyNR2KoW zbh9~eyWA}O6RmbLBms?~ zOtYa7-@Z(l``?aYYB|bcoL`v=-z{ggQ==u6g7H8!8;>A;5hDC0KO6>BO(cCl!Ye%1 z^^dj+zW?Cy4#We z)tZ`}F4h|mmP55q=?B+}-I7ELL`Y7#;o?e){)S7hBx95R#dB~%R?*Le5ctPgpJcln z{q#O_uJJ>Srhr}95Mr{v&&Z@w;aeI0pE}Y#8qdFar2F!aJ}v#grrm}My33+76~vv% zZH2UMLU-8r-6Tn1wLSD7q%uUe`KLvJW+a0HqotoN3D6u**!a2Dc3)_WW>i3HM0Cx? z-@=0vqH$UsuA%T~Z#pc@75DH-hz{`l;93JTC=j7j4-cx5phr^Yw2+`H9q`KZqc3nH z#h)gJ(IuC3K%mi-+w#~HWPxg*s?~>h`P0pHq2zMt5z)JM8$EOFqIFh8@@{`FiG2s( z0xpRY-odHo*smcA`tNVzk;onL^=XYU9n9ovrI@i0`dCAbS*g=k%P{x6q;HBoV0k`| zNx9PG<;2rIY-lv+Vni!b{*h~Ga!*S~=(TUmauN7`FnK1*_Cz zda;-BL~OQ`cFfC;=9P65e?U7Ns;GBno|j!lQ}VsMxCI&@EwNvNVN~%#&OVnmTqTnn?{lC=^zv_#*RCN8NGmMPaW*IP@j+;r;nmYm9_O^UnGgwc6q-&ERZ2ED2n@ zT>5tr70cWb$|ynF8CVc=zPMP0@Di`7D4f7XHTv@`VWTckC;+_q2bXQ%05skW~|}SGjjqQB;+MBNdj+99C`YI4Wrp`NdW<-f_{cg06I@uu2Monq0K^w#B8*K zL;vDf*%A3_cQF_(BEBwkMiG4wk%fFQ7caZ6g6iEaw-@zMZ#dckhFHDQ<&3+&aU*u5 zZM2y)&!3155gDOXekwDiPVmtn)=#V&RLQRR3FCNQqMl^tYy5l6Lxb@`hgl-$R6-(L zWpw5;gl&{R8Qks@3rE2z`B{bSCc>W1+(*hpx%8)cszYA$<8`He4>+SyLjqWSHiTB# zv)lb&$&z@WD=XWVvFh+PTqX$uCbLl%x;_%kj%}^%r&#K~nP>l@~9g9f0wVfY)$!cw&nbj2TYyWK;i;c{a z!)?xwrIo>R)aEDNK67p3AeMX1{}mOM79Fy~BQQX&NA7^NBz07M7#JDKAQX?p*q6by zoi3#|GK?ZxneL8;GV3ItyWSHM8S$(Z9YOQf<|x~pt^MF@v=6>D`7<{_sWaMFmG!PN z-WN-msbsnvoDU`=KCtwGl6;($82z)L6BLTJ)XK-aJsT1ITs8i(PI7Rw>u#o6@Vn&W zF7opP5&NdB^1=OCdF5*nIz|Fx#AkH0h|bp50r#xFw)+hvCrY2sfA5cl{1HQN3F0|q z-jv+chbYjU{eqaGngB~QwkW&{XQLr3&8Vg;r;EUXrsB!an)aom30Sc=>I<#i22X zqgp0nT(yz3ir{#uAh=1A20nT}@t0UVutz=66~6+o4WT~{#zz0mKTzeA9+MG&7<;p( zoi)i%`1h)d426HRt1eDKpM@=j17DJ_QwDy^kE-)uWw=*ySfXTnuMO@rB+KWnxq_GN zfPeO?vp=baJoIf1UM1wM>9s=mQxl9bL8Ck`OItNsK&UwKPMztCSKy*zYo{F3&u;{? zuh5TX?B&m^`3=RW{+z(fgc{Qq^{D>HOB?s7zRFoO&uAV#nkMmh-g1P$XrFg{AMG?- zxrUJKM$ku4HsNMwY4Gr5U#cxm;#D;)z)_P2b0;`AGc;Dz>J@5)oA1*OSuIiy8xkzmvKPp z2YF5sA!MRw8!0T`d*eMxa8Lva0}cyn^CkD?2|D0mq(K^WTgYqnCr4NM)zYa%2+Z}M zQUH?6OigIXlj8h6R@gL1iQ+Yg0>!ER;{PAeL|7H|7BrI3(bn)SaX1o(>g?tnYuWbK8~ueD52$1KuJxheDty zob#$jtB(SLP!*UrC*9pd_i%KmWdjHDe2cr5#`_;Sb{^qOd&ph|ocZF)2RJH=&(-wZ zyvHw|JTHyljHc5Y3f5S`0~=$T@vNQvcsc^xIOifjy*lvIFPM4>FjnkGy5uv#$bY?D zVPX#Dnx*njlw5Bq*D(=0)lEkOBCE9cGrfBwP;U7KuU>Z55g=WctRArln5 zTJ?+qtVV~3yfB8JfE#O#i7xL@F>m43ITy5&kdg;2uZhM6#8W^7^vE^ zx2S?8S$YF_7w!2TgXMUJNSIIxx%?f2IltwT`%z(tOjUdQPgu%hV8b{;OI6Yl5IV5u zO~=;E@HHoUL!!{C$#NgceZqjnA%Kx9C^+X<)FF}%)Ee!;ysLpC3+P=h?RQ_( zWSJgDZkG#A54aeTkwTEdm01+_vjL<>120e#?Ngw_1^Gnnd2gg8^(D62irQ3nP#dQyS~UCFM-O!`vqw!pl>-vTtlr z7_p_T>p1a+*G5v1kW714o`WJNafNn+X;ef*BFhz!v|}PEYu%S)q9oz2Xn{i{ufzmN zwljzg!tYg93N68VY9K{1J^Z1HKtwlj2m^f|{!IZR{RT#jnsP_?ha%B!8iV}L!uSM- zX`blrKgpoNSyhD4smBM&h0vdN)#q+w1++d62;9O}72PqB*0LkUrI8$fgXE51O3-3N z4={WFnXLx+K`BBH-LO*1&cmxXj;o*I6F_y+Q4u#*H=?pdu~Uv@qGek=`a(@gAX*=6 zzA)a_=jH>arL#J(TQ~-GG~wPTaPgU_M{=_lEm%L?m`wVl6JKd)&Dfxb zOzhg|i4f(;`7iv6A;h+H6gU6ke?F%m-~bd8K(NJsEynmfsbljKiI7rf4=RsRsoZ`3 zS61A8o=Tat^om;W>G;NgOrzg`a#TiZSCd_MxONc3q%l}G4JLz>jg97 z8AIR7TUJ`nHwSJn2l-`s?BRqWz;SofW~*e zHa-WD=u%o@R~8SwAL}l`k74-Z8yR3td6N?8jozBYQT~he+cmnle}#vMZznB8-93 zhYzAj!GX&rq=}%2*J7j9HIy+>NaOf;kgd$*FHG1U%wFvDMXOBD=Nn6Z$|aItmShWp z(M8G+eU38*so;} zm4@&Stm?95(QBAlc@rrxrfAAta2hvQ(FWzg3WV^G!oT=1ne1Qbl^v{todLVWoUG}{)-?8ym*Wj5hTqXR#h7sOu=v%%hDi*2Z2#~)B$f`ppaD9FW`?^* zCI9K*c;-WveBeGZr&3AceMVh~=|700N;!ZU-|jm$mSHXt4r0UvNMoiP5;8|CkhhRB zP3lIkeuYx3Omrerc4$ZoWiS_~^qr7oY!W*$r&(lXw~?|V0iz1>B80Hi6?hX0^H=@Q zOOsUwk%{>dh@d-$@k!mJFq_T$at0<6*y$i&N(9!t)Ka%J7`{i0?kMVGG)2EY!}Yo# zrhCTRI|aUPzg&VVbvW)3CkTF()ef=KcMncC@v6_*CISaiCRd3byB^t)F&SaKN-s?f zhc!|X3u`is?P+_rBA>t#tHVK+Lgb_n z*O;9rjS&2 zC70hW^@bakdjK1ifEeofdDkCULzAmIAZ{8||EE88fg1%RSWBiqR$5s% zY7p(Q72kDfCJ3*EW_8}DKejTfX~9&Xy6LIOAGc-E#oHT5$)$fW05_sQP7K@fA`n|l z+tVR*|P`w zQ^l$rEUMuo9V#w=Hx)McF1Ffq4s|NAE8^nPGLb)w~3p%mEzL!}IGj;E5S67%3 zKj;m9?XWabE$D5g@PDi9mxU%qOSde^sP31ILokbkjA7Ji)HEnhJsHmoMKz%S&r0KE;I%26@r&%0=U?sqv8?p3o z9|}pf%v?q|E#D{|z_>Q}*`L<@GyP@boezB(pR*GL$?(ZGAVfPuEt+4pd6+2^J)Q!% znb2%PBflzu&CLdbxG}>(q#+OV_fuwE2JsDYar1Ri=k`g7n61G{X11mOiOK&Ol$gVO zHIh44QpR?fc%h}VbY;#LC@{Oi3DeqIP7`Xx&*BaBZ%GC%{&oAy5{_jn3pNt3wy~jyG^g{=dfH@0 z<0s4^5a5Q&oa#9?`%|Yfy7)0vcPo|2ywc09_}tn;k;>MR17&0*w1ZPfmD`m(_?IPP z(SY;tG1H)9^CZzUMr&I3i*Hk@?)3-Y9R;L={I@CEw-oYeOTv%P94hhej)(QGBLk+> z!>YQ}uKI}3u3#K1WOz|gF6UDHb@f<3wj3_~x%fNI!yx!)%EoZ-dVWLudJs0?tc~$k z>B2~2X$J0)urS%*%KHf(-$4Q#=1zIos%bnV3--6#BR{GD?g`q%7EkByE9s>*DBoDF zt`VC~<|Yu@;FmeDPF%sN!sB4-?ZsIM@kWbc-4q-7H_UgrX-VVc1EzaH@=66|{Rt84 zjA#J>!0#BsB}8Aq!7v0X2~Bn>cGQBK4*65V!J_2{$kfgRVkU^8!Pk1#?F;BwO3>D4 z+^2j4Hj(*SymYqzGgys$B$EZj&jtYS8at$#!ufi|~FqyP7h z2qAy~9pd;mL-y7k3mSi+3@g~lNSecFeUwYKnrOrWETrms;Q+fh5H|d+GgI7UKL||b z_PEIACIvK9_dlkn>0ojV8p1I)cBC=>P_DENarvHk@k}F3TeAYoSwX8~6a5B6(sla%u8H1=Ld3^11%y%-d z$tq{L==kCjqBJzN73AE{FW?6^{m!{U@=Asz&9_`_^>IaWj%!lwuyREp^C=MXBSWc} z^&7N^y5_2gIh9dWL8sEa6Ee(CUPp08#aT(^ec&b&b1fKp_n#v*o=Uf)i zynf=b`Zvnp+{A^^)h$=XiwMaHF`g66;pUIJ7wa7FsYQ60 zjL8&AeN}i$2gD)TnBGxgol(@2P`n0~k1kqt%A61lXcIF9dB0gnn$lp?Qjs2VWy;^< zpyDf$yGX&-Q%LViY1ua#B@@4e4Kdr+=lgJCc3J^`&>lN3WsR~1j6J@ryERkVYM67f zg09p6u@ZTSkm$;I#e4aXXirfSl}C#XEq(uGl=K9^{0NLaZlO#IOsYR6W8Yr}n3HWn zKvpzdBO2nI)}Q(Rpw4n}S{U1zszwr<@h=B2 z)a`ZiShfh6JPpGh^8mK9l8eU|pyJvu+u=-|P0n8No~`zS7Z4@l5aON$h(svou~_-$ zo<+B@uilq+Zs?NLF3u1!{_aI@qnT=)XsH4`X_AoPGEQ`l>Ax@_YTNZ&x2o+plPdVw z^~7zuz-rX}(%>2uKs0CuVg(p!kkvMOx@okW_;|sIKxn7`U`h5=mdL6j5V~iX#z8A@hG zlT6qJf14zDzGU+#id(NA1@l!}4q(A#9lJ3AQfDkRas_xpTWfpP@V=F2@|yIDL$N~> z_;c^C;%RSUe>U+nzMF9tS6uyqN%VLz5H9$8ku%%{39iSV1$;TZym~PM@ELy1OBT4B ztkXVXl)QwIN-vCTOSy`dlt1e|+x z6)=#h55a`=zkX%mIx(Z1!F+PS9+*q+p8p8#9iS(fu+j9iWDGyQEcuY~t31%B2KGHN zY=d#GS+l-wyRx1^6+=DDCnb7m3+1xPqB$9*)<7TavMSKWmgBOjeqR&(NtJi52lkSt z28KwmstxS2iuG?xxu%f)g`xf@@2YxVpwAZQ<%PMqxZU2|^OT|f?=uvd>Tg;D{ZHo{ zd; zmGQc0ja9;~s^jz}R^H2N;YOguxeN*M;i}>JJ`N1qU7Ha$p$%6Ut~-D5L<>X#QatQ* zglwQ{;IN!m^U*p#KdeM(_R*kgXl&9<{A94K(gi=yoSvya=#8>ed(# z?&?WPSUztD*GHzGbt(`&6EKvBS}Tu8H1$!t#jj}1nD-;9$kqW>2pYh_y3Z}o2iMyY zpc{ zGGe8xiEO>mp%9QzBp|W49z5*5;feslAh;4`c-yHjUp$9C)UI4ch~i)}(Im|9&9qa7ARddw)40o9y36xc2Lgvo2R=Wlhdh^e zwsUuvnTQ_e?(&Hh8D%?w-&E}Kp>>;g?eT@6&3ZO*mw@x81w8*(5A8pu`9J@^Akl3e z4|#*7a+~Yr|NIfN`DsSK`N|UZJp5nW9cc1@hFx&+{J(KG=-Hy4k+qXq!{Ue^h_`{A z8h3Wxfp-IXxB`f^3e9h5dwPsI9OpFyP`&)e;~5^9hbhq3`0 zm6{_<9%+Rly6}4OTk8ip^=R-N*=lD$QgP`6eI&bdTBw}^*aG4izkew%G$45xFjXcc zg!%171dus%KiN2%I`QNBB21(lWzM_+f>59Sy3l>$TI=6|j;QYb>I^g+P8~VQZ2%d#jgp=TaP9vIAmIJ2Z>cQf&o$WTN=TGk>;No z!O^SJ%<;j^xxu>u1IY2g3qO4=Tksy+Fj7_=uJ~ZHqCnD3P||?0v_Q7E?gD6NszWxC z!Lfh$i$Uab+f}OGMnFm}{U|}?q|0M>*0wiSuMF$6*WdOxT4^|A4G-TcM|kbhW^}fH z8l~2JHhQ_9WMhxoX5(zcsz zrb6NF?m9Yz-wXw~CE?o#=W}wfXNsUCYm{0AurW%AT?Z`^R;3=ZTi6Bt?-jg}&y2AO z6udl@W7rB}2+u2<8&pg**@UT**mOVyW%Sm=pDx}QvodCgImZD6bK@;ycjnu;%YQ5! zjIrPk)V@T{fK%ufCWPLYMG=BLpvr(-t;lDq0>R85`YY9|2znMelK)X?OXwh6e9S;K zv6OPK&p)-y$HbsWODZ~y*H{wjIX**3diu0(d~#g-knfJAo2rsiCk?#ED=>K=0Ndc} zcIy|v&~MJ$AtTZ$Rt?_}hF}Eyy!w0uLoItGSeicFsL}DkdCT~N6Ug)!V3Eti&kCl| z-^{B$RdVI+!TG>@R;NDNcUkp=%j;(b2f}tk+!?Q=uwn5e8u{DU>ro*-8^e8J{8p$E zL$CsIO_YvS9T5QQ;#}KOlUU!c|2gHxj)X(I4}qSjI5h=t+I?}@h){JNVcej%+#6-2TUyK8tV@iq00j8hp| zK+P*;obsgP?6l9g$G>X3yMD+PPJczoUY(uN8b(w8EGSr^yI=Qr58|Lr|?l@k7br&#Tql>BqUMhkuQ3 z84~)tT@oNpoXF$iGiLF`kINDo7wx+6u_W^FzQ25n=f%_saf;Nf3`@ZS1dn4;id9V$ zQ*^Wn2kXe(l9U8b+UFxr_sp*$$lVxW_HFSLXZBr9|4+QSBK%O4S^9EcT3J4}`lCc$~V?=^{iaZ*|A@n{fik>C$PjoH@%G7UyM5O?g z1gcs)BvZ$j&^OW42`=}HiK(RSH%XRP=^g@c6asVdb9C2lSdQQ8dj|S2D3;*&a=B)I zf9}8C`uTq@Cjq*WPH#JJ^qEt{Z2u_pfM`ubf(9-2hjbAM_O<`iS7vm@h1a2s_pTVCr7439|OF@29;=-x)DNe z3{3CvXs6xEQ*Ru)A3^OW&+nGI)*bgnyulhZ&1}K%29&hl+(9Yn{K@$biTL|n12_(j zw;Rkp4{?sz71Qub|6p7lAaG{^r5Q=1vH5Zq@Y}^dV`N; zEdF~j_6Dyj@p3AO3jal}hT;a@E)W9PrwXz;NWKJ;w>;Y#_f6+gu;AyFrUThAi#IWH zJ+OcyTW%%|>%d;@SV?p?dl)7r?oX#r&y0`Igim(ESP7+~muP~Q;nwP=YQ%3HPF0%} zCoe)H)9FVm_7Cl59MM2DGk%=r#UDoT2s6MpHMAMzoxb}4K#34u3DKoOZfI4`lmU57 z%vhiS3Sg|^bwVGf5Nm;&-h=)P z-qti?_R5ajWBLxjEwdTEcyM%782s;m@k>_B-U&NziqT8O>M(VAk8})_ew&)$6^u;H z@De}fQg2qsx*MC7KAn{x^TU~9%$4}X0ZH8S|EcUNgX##Hc7fpTuEE{i^#B2aySuv+ z+}&M*ySqCCf)hLh4+qzS+jsI-eYf8Grm(59Hk z8{~Ru*D8XhOE%k)uJWubL4EWsK!N15iXFB=$q}LSDxEK}G|*urbYw;{R1b=^0@#&_ z*LZ5(`wDmB#FjSo#A+OOytWhJ)etypPeg0+Y_a+z5LsGbZIg|@nSa*oLa^g5__`f( z4+$9Vu}>L%mt!OH(C5D5u2IJ9Nf?)DgZFGcv0%3=mqczv#hF0Up2|s|Ss&%3rz5eO zGmUC3jY@&rkmIs--RT8+ka+W$P)~l_LF-BV9JZi;2ML}?#zQW3d6xwxzRj*y_<2G5 zMcDLw!B2}{IH}ABqOXYEGp92Ezo-9uiEbMtv^rlR*$L^>a21#c6*U| z$|<=@yI@-tJw+R9fSQ#_3dSxV_OQb`V9N4V&y}b^{)t&t-3iAqw)z?4Q&|sGLs{dJ zyaH2d$8~Q;D3jq-@L`+!l$}e(06$)Z`KilP74!Ab51O?hO=UgQr9+`Dh@X=KO-mUt z$d^}&zj){K*p5ocd*gELyrjsP7ek3_hQ*#7_HU$xC}(F!Wnq8SubS*} zBv3e3P%%67NZGfG)|ee8E{fv&V#zUxXcJ5ha#M6aTc4he+`U2XqLG&g@1Kr1UXB1b zs}gdJ2tF*bC7Z7q-+EK}g!kdS7%WGnoSzR?vV4&?-#JI(3bo^y0B1BoHjutZXLDCp zQR@Vm7sF^9z)&4m_3+z?{Sabs`JAfwd6pzSj6{b90p`V0MLFvl67o%lB|30E1%>l;si z735ARJ}824w<%7O+z%JtV7x`jP)2$lGvHMqhv|oN8X>a{22yoA4UOF(e%sg;U1dAr zo5jl->#h)yl0FwEdtof$Z$qx@j_a6y04^q-)qZkE9*o47c9ds(+d$8Veo7IXV80wp zS!Jm`#x48S_-kg}yG@nbv%DAwaRZz9`9box2Gfm7dLEn`JLLkTNV9c_@UW7#AWylJ znMPg`nfIK9QAx_eJ`&31R+KIyUao7@>n7QDTE#Z)~?i69s zE2*gLzYo9o3JPU}l03Pb%dU)*?tQRoR}%9N4(L#QnlW3ao8h7jqp2sMrP9Z;L;DT1 z-^D=X@!KoxsERg~gf1JtyxWlxi^epP4qhPtA#fw5eP8NSJdqFbcDAD#(7+{i^MS7d zyvi5w-jsco3>Br1iFsw)q}~Kr{81V;pm{eld`0JZu%7c5n_YxDE;|!X;oF#bLbznc zIKQ%7CJPL!-+s7^6Gr_FSgVn25Ij3ekDp^EN5Sr1unj+nqFzv>Yv<0;Vc@?#z#j={XL>#HP#Q(f(YxRWe5^*I3yF~4xDh~5m-s5h1eSf50e z2iWu6QFiRoOTJYiN9%@@6fd&vxe(V5qS7<9VKPo1I0y+Iu*H(NR<2VlH%p4>8!k4s zUn#Z!eNB42GE+NqW_+ZGw9O@Rg7^#C)()7+j}XD2{qu7aMMZ&nDehHVd31Oc4-E!- zJPunXX(7w`Jo=^Q7xs6=#sFxK=3fHqE;4&2NX5<%>Z991!MgyL_sDzm#cwT~_<4Pf zB7p(X0Rc^?L_=kTXjMk)a?uN}SQSQ~`HGZjVjv ziox!CuZ0@2;-(IK*As|5T}n=MiI=KzSHr-Ad$D*?mEjaoss8yw7sA4CbIG__kGrqw z&A!cU#+*VA-_k-cH6PL0+fdOwV}*lCN{3*;PxY|sl(Q3k`9dVFe&^E-sq1E}_9*KLI7W-5 zP#MZ$Dw*WSVQN`7&)$rvP;HJQeA5d@Em@@aTu)pt7WuE*2~L5l9m$~!F3Dk2`G~qy zB*m?*_le=m=DOac?QbW@7&Kv?K2j$boWrJ#;vYm}{CC_qG-x<9InInmpRl8~(O_sO zVG-y>l(4mD2Z=l1|K2=oI~hS;Ay-;+R@+gK$|I58JCc&*_W}-4+pa=(W*hC`KKqSH zBMyoV&9cpp;?o>3F8Mhf!aD0)CcY_=|4N z^2(7OfN{S-IEm+RXlSocik|EsUZGY4G4@$}VQ(`p4xVH;T)3LJx{@fwg8zOT>P)f! zoG&)KBgkrEI;p{%lCr$*hgl|H*7RDV5E%)Pk5CFzCLMum{={vDY>TW7B+smdT&cLY zd0idT0VzDT$s2rVapDGo#1DlDW=_B@zgKJP%$;tn*(lEdmPB|r#R@AJEAjU@ssFI`7NRas}2ja&5sH z@AnB8+TD7A=SttMnh@^I89S-IF5Ukpd}!#R^68{{P1DO(97gKePh$ACaEesfoPkg9 zdvqaao?ca&V|U)ZN~+ZP4cQq@bty%xc2ZA6KAr9yojNI(uIC6vP|te|RX<&7*bkql z$X~xu#3N5<+Bk%~Dmf|~V~DqFi8l$JD=lP`BMSrTr`=>fqm%v7vV00akLV(XCh1dtCAk_B^>u(WPfO+HO{G9J>uE z@{Fgb-hAdsnV#mUlI70>h}mEkS2s|5%NT?WVWPap;QK| zE&n=WMFanqa-Yr>kWH-fC!YwCB&4}<+_e+oJs7CX)BPTo`N=B#4AZBk^+X0$*B`DRH+ zS8IupA!yA&;l$q5!d=3RolZs>*Qb^zP=#5aM3pC)JN_Pt@aU_g{Q6TB0RCVr60kR~ zjj%kZSWhHi?EYz3pG;V)0se)DRg?^)_Bc0D@}W_O*XA%cvL;pO+B!5&`;(MkTP7&K za{H9(-b^_C**Cld)p@o3olbt7Fl#wI)?@<|RL}T;(^5_&PQVQtVECz>!+|Qz`A1%I zqrM{kLRj)SRh)IdETIvV4LK>X4wZTnv>KI(qm27KLZX=&=3ad!X0>(!vCpHDWxQh-f5TFNfz56=pzD~KSfL}1M7<&|bWmI}Hc3*iYC-y%&&FlJU z|2!f~40eQGcvNw9fE0mGHx$PIiNB@NtaQLfPLwJF28>TnTC{5`aZhkR8ZA3$4dmO7 zqmX80YeougiI=vWY2+V^$bwSD1^?W{6dqjlZN{Ikb2y&858bNVpi(>$w5tV0QJK; zKncN)pd_2q%vI0UG>X3USYXe&*r8@kY7)l2H@wGweeh0f483!E;MOi|5gq!2vw+Z_ zy+{OALRbV*^L_$Z-=J#Z`FF(LXs>-H=TG!3m>~e?nlFS+vg-%Z-XctO%Cw!zv`aLe ztFk)96ET^`n+qBOL_X1|ylYp|0+p+so*Br-%iO#wtW%M~rxufH^maj-VabrC>zZ&M zx4Z8}xAI9ZTWdv+fx{`S%PW-X;W{uOx)UW5ve0ORPOvD1Bq4{2U0u@5gF;R&ZOU-v zvMT2DM`0QiR#qyX1WR$P4V=2KCVLdH#LZNxPB38mARI|pU%s-&8??kntcEW^Aq_u$ zOGJhbE>fu7Hx;rLkvah3Knu3-AEGOstkKPYq*=LK&gn3s|F%QO_|f9^Id92Wl*XS_ zmo@myVFiUpotJ~GPIxX(2$sa6)*v|wk>`4!O= z*3PuxV9WvR%!L-Fv1WwU?GOJs^9-MqPtJPbzQxsnQkXvNP}FL%&{=bb72Oldkq*N#gm7dK%Eb|9>#VC1y3J9zY;BK>@FY--Lew)X#r#>#BU+;+1AaG3;IrIQ*-;YmdPzJW{ z&m|VNESTxUrdo;pImxF>0gZ5@RFsg26VmQYI{!)8P&vXxChTMF-tQ&_i9FQv;?yqq z#c$bx0!kKMULz`WLH+QJjZl>h>Wpa^t1M`hMqrY&JQGZEDsN9i-6^7+Xd$0GoJV_c zA@njw-u~lsSlk$QzNtCv@1qpvJ>{YTx2d7$XuxCZHQ}~l*u6+KKO>nL5g0en(GB)} ze`sJWF7OTgWFP0tY3X#tj7qVxoNEwF?j)nPVDUXND1vLtD5{X7x4h#FgzFl zqQXr&fL>3>X#Uy4o+HQlVS-GkqD$z%WyKqE#qTT|ydQo3(uXzC(W0;5DcdzLJD)bL z2l2=Ph1Yfy9;!>Gi_F`Pf{R;i@s+%BbPYdz^<=?LV6-_whDz+y(ghSj^;}OSn`%{` za5dGDH0O|h1PQ4z=1kv{>+nT1{O|5SE-Eqpb$O!h%vr5fwAaJJYYbx{Q3&HcNVvW2 z5^)ae)`N8f8bwRYC(JGi;+LI&=}@7|EdD1G^7s;V6ZZ8~vTU=1P&h26O&d3>d9e!w zoJ>`=H*&*r$QtmkvNqnaB~Rb>z?>BE-$BWf6iv_@g8C#HuJ`Zg!KzWxcyM2ZP4E+LXVCRJnYJny1W5WZaD z#HszKV5i{U!hQ#CHFXsXqVZ~>3Txb>3LV{GAo{?5>g*qB1<{=jQ>aHM)_^Z&r7`Gz zma+Xa2|v(2K}Qd=M9;S6Uvv4o%H|t@Z;<6njn*97d;y~z30J8~md{8$XbS3`rF)oZs5=3)nqe4az3*2yFcV=2|p z%!5g>UbRo-v;{;>ew^h-p7{-KbQywluap)lm16Suy`iiCv0t*+(|CGOLvuVFK9m62 zbsqDl;-4niY!opAB^2eCZ9q6^otu2H zuZ1q8Jwl(xrTeEiuawI&ttMn@URhA?{t|e3_{qq_(KoEXd(^=#A12hVu<@iUQ6`8^ z-Vvry6zuz=9FM{`tjda{FTzN))R-d6!f1R&hCdbm5GpJD7MC1!Zn(K;T|FpSjtJi` zqd|UtJ*t@bp3+lxwKp<;QQ?-sw_4e$jH_CvxiyJWBW@JEaLVIc)o>;yM4%S#1Ixig_MC~jP__Ru(M^Om6;z44_MPOO znFRO3o=Yd;TF1pGqy+bqtu+J4F{XdK(Z2*f#wRJ9 zqc^Ixz}K1XW}|?>k}C%}Yk46kNHb)uIXIq(Nqwc$9WP)Wc8GK2)3x=1zH09ruk(!H z0j^sL)&>@k-EzwwPZWUk!~7T@uRU==8TDD}O}t1YR}A+8dOMnA&-J^nq?Z!h?=R|& z&IT?^l;@ShyWdUqtR|?Sx@ei>PRl_`+Dh1&nRABSLdTW1M9mGU)Z2odN*K1tvP8Z4 z{JO)kh}Q0>yVrUt#pvqH;qK=cgRvv*2}aSnW=FqTt*u#-P;&N$5Ynk$0wOL6SV%{l zPai_UG#-p!hqcbkc^MNtsa2_hF?#y(it8oK1(cgi-0h1_N9fiks~w4XKTG6MwQy@k??5hR9WM#x1l~|B8#3AhKkd~KF zZ*j4RU=_x0al_DMiu@nuNB^^DO0@Oh6k9fSuYh5_&6AKC;wj!{ya87IcP~I5;!0=#_#Jos zzU?i&;ln7C8Bc@paUjZu&G2##KrLSz?9UqT-7WE2Utg|yFx(Le zYyyZ9yhWS6Bs7U#ZXjjJ;KSVP(5S9?4mh(whPYY<7*qDq$&VrmB4FaFK*yFGl}R|<7+ z)x&xB@J-jGy!ylE@XxgVHlX3768?3PoU90%&lA3q+EF6W7^n8e!K~mc%%=HV(1cqB z2W349>36;~K6R192nsG4nzR=p5{>a9xHdp7Um)YK5_wK{<0C1YqVE9A6I}SSHiI8_ zuYv85oR7n|A|32ZE`87@TKM#l-u((N^^eKIp_+-Pn)lCw0YvcnS7=hD{p|}v;(>|6 zg;9h3qI?(;id*0%lk<$Rxv_~rjgWRyf{mMxqSi!A3r?-=uV$RS)0(trcegg(d2!#X z5(dyoy3`|8%GAve)il=zB|?wt%vddRlTVTe3nXo4j%?RZlGmQOg0lN)5F#`+; z7j3W0bf@WbA2mtJS$oSB6EzA&T3NMTReKFQ+hZ1F@X?hcRC;76iIPJJTR)V0U|sQ? ziLZt7ICv7E6}~j1m5`pBi2&KZSpMwNMkLct5+~v2eA>wE+ihp@s9ikK_E4?R)6I9x zU*e~$n-wSU$f{70#X3}|<1^E~XP`m4a}5|e8-NnfcYB)1W$cfN{ScUD?8#Iv%hhN3 zVE)yODxfEyU$**iu(F5Qawc^T)sxiFPrY+7L$cxs5FCO-92(GgN3(go{Q{Q~) z3idM6K~w4pI>JJnYUerGf4_06?dE0QUCk=A`B`S%&MAb4TCR*paxSyv=*$8*ag=g& z&{${Gdu%NEMQ7CcY%PU_xYf?9!9Z@c-C8hkMWL++3|v(R9{~f+z`$IcSt~FwR|l;D z40N#M9{>X#!9dd=k98gsSRkEe!IyO4zyezacfcKS(d-3u4-RC0YA2# zn_&QU=^)O{R7V0WtAu%L@_?4~LcBGk1-WJSo3*ZBakW|N>+P7a;nwog$1!8rt>ym@ zXwU{+VFq@2;1uX}kQV4^op*Um`8XPc16S%Iftn!sd0VG~p08uEhDI7TjXz)1d#zi0 z7y8m4;#{Xp; o77YTz!NkT<-NM1y9$du#)2z{d%)-F_D+~&}w}K^2@xQzO0qaDzQUCw| literal 0 HcmV?d00001 diff --git a/Solutions/Threat Intelligence Solution for Azure Government/Package/mainTemplate.json b/Solutions/Threat Intelligence Solution for Azure Government/Package/mainTemplate.json index 19c04d7e94d..cbbbdf973f2 100644 --- a/Solutions/Threat Intelligence Solution for Azure Government/Package/mainTemplate.json +++ b/Solutions/Threat Intelligence Solution for Azure Government/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Threat Intelligence Solution for Azure Government", - "_solutionVersion": "3.0.3", + "_solutionVersion": "3.0.4", "solutionId": "azuresentinel.azure-sentinel-solution-threatintelligenceazuregov", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "ThreatIntelligenceTaxii", @@ -362,7 +362,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.3", + "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -521,7 +521,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.3", + "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -568,7 +568,7 @@ } ], "availability": { - "status": 1, + "status": 2, "isPreview": false }, "permissions": { @@ -716,7 +716,7 @@ } ], "availability": { - "status": 1, + "status": 2, "isPreview": false }, "permissions": { @@ -764,7 +764,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.3", + "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion3')]", @@ -923,7 +923,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.3", + "description": "Threat Intelligence Solution for Azure Government data connector with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion4')]", @@ -1082,7 +1082,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ThreatIntelligence Workbook with template version 3.0.3", + "description": "ThreatIntelligence Workbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1186,7 +1186,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.3", + "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1267,7 +1267,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.3", + "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1348,7 +1348,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.3", + "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1429,7 +1429,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.3", + "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1510,7 +1510,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.3", + "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1591,7 +1591,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -1619,22 +1619,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -1725,7 +1725,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -1753,28 +1753,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ] + ], + "connectorId": "DNS" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -1873,7 +1873,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -1901,34 +1901,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "SquidProxy", "dataTypes": [ "SquidProxy_CL" - ] + ], + "connectorId": "SquidProxy" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -1958,17 +1958,17 @@ } ], "customDetails": { + "EventTime": "Event_TimeGenerated", "IoCExpirationTime": "ExpirationDateTime", "ActivityGroupNames": "ActivityGroupNames", - "IndicatorId": "IndicatorId", "IoCConfidenceScore": "ConfidenceScore", - "IoCDescription": "Description", "ThreatType": "ThreatType", - "EventTime": "Event_TimeGenerated" + "IndicatorId": "IndicatorId", + "IoCDescription": "Description" }, "alertDetailsOverride": { - "alertDescriptionFormat": "A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator.", - "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC" + "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC", + "alertDescriptionFormat": "A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator." } } }, @@ -2023,7 +2023,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -2051,28 +2051,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -2163,7 +2163,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -2191,34 +2191,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftCloudAppSecurity", "dataTypes": [ "SecurityAlert" - ] + ], + "connectorId": "MicrosoftCloudAppSecurity" }, { - "connectorId": "AzureSecurityCenter", "dataTypes": [ "SecurityAlert" - ] + ], + "connectorId": "AzureSecurityCenter" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -2309,7 +2309,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -2337,28 +2337,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -2457,7 +2457,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -2485,28 +2485,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AzureActivity", "dataTypes": [ "AzureActivity" - ] + ], + "connectorId": "AzureActivity" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -2605,7 +2605,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -2633,28 +2633,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Office365", "dataTypes": [ "OfficeActivity" - ] + ], + "connectorId": "Office365" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -2753,7 +2753,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -2781,28 +2781,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -2893,7 +2893,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -2921,28 +2921,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AzureSecurityCenter", "dataTypes": [ "SecurityAlert" - ] + ], + "connectorId": "AzureSecurityCenter" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -3032,7 +3032,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -3060,40 +3060,40 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "WindowsSecurityEvents", "dataTypes": [ "SecurityEvents" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -3197,7 +3197,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -3225,34 +3225,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AzureActiveDirectory", "dataTypes": [ "SigninLogs" - ] + ], + "connectorId": "AzureActiveDirectory" }, { - "connectorId": "AzureActiveDirectory", "dataTypes": [ "AADNonInteractiveUserSignInLogs" - ] + ], + "connectorId": "AzureActiveDirectory" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -3351,7 +3351,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -3379,28 +3379,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -3529,7 +3529,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -3557,40 +3557,40 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "WindowsSecurityEvents", "dataTypes": [ "SecurityEvents" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -3710,7 +3710,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -3738,22 +3738,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -3869,7 +3869,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", @@ -3897,28 +3897,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AWS", "dataTypes": [ "AWSCloudTrail" - ] + ], + "connectorId": "AWS" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4009,7 +4009,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", @@ -4037,28 +4037,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AzureActivity", "dataTypes": [ "AzureActivity" - ] + ], + "connectorId": "AzureActivity" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4175,7 +4175,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", @@ -4203,28 +4203,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4306,7 +4306,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", @@ -4334,28 +4334,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AzureKeyVault", "dataTypes": [ "KeyVaultData" - ] + ], + "connectorId": "AzureKeyVault" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4437,7 +4437,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", @@ -4465,22 +4465,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4579,7 +4579,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", @@ -4607,28 +4607,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AzureSql", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureSql" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4701,7 +4701,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", @@ -4729,28 +4729,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "CEF", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CEF" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4823,7 +4823,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", @@ -4851,28 +4851,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "DNS", "dataTypes": [ "DnsEvents" - ] + ], + "connectorId": "DNS" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -4971,7 +4971,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", @@ -4999,34 +4999,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "SquidProxy", "dataTypes": [ "SquidProxy_CL" - ] + ], + "connectorId": "SquidProxy" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -5047,17 +5047,17 @@ } ], "customDetails": { + "EventTime": "imNWS_TimeGenerated", "IoCExpirationTime": "ExpirationDateTime", "ActivityGroupNames": "ActivityGroupNames", - "IndicatorId": "IndicatorId", "IoCConfidenceScore": "ConfidenceScore", - "IoCDescription": "Description", "ThreatType": "ThreatType", - "EventTime": "imNWS_TimeGenerated" + "IndicatorId": "IndicatorId", + "IoCDescription": "Description" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The source address {{SrcIpAddr}} of the web request for the URL {{Url}} matches a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence feed for more information about the indicator.", - "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC" + "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC", + "alertDescriptionFormat": "The source address {{SrcIpAddr}} of the web request for the URL {{Url}} matches a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence feed for more information about the indicator." } } }, @@ -5112,7 +5112,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", @@ -5140,28 +5140,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" }, { - "connectorId": "Office365", "dataTypes": [ "OfficeActivity" - ] + ], + "connectorId": "Office365" } ], "tactics": [ @@ -5260,7 +5260,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPentity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPentity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", @@ -5288,34 +5288,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "AzureActiveDirectory", "dataTypes": [ "SigninLogs" - ] + ], + "connectorId": "AzureActiveDirectory" }, { - "connectorId": "AzureActiveDirectory", "dataTypes": [ "AADNonInteractiveUserSignInLogs" - ] + ], + "connectorId": "AzureActiveDirectory" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -5414,7 +5414,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", @@ -5442,28 +5442,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" } ], "tactics": [ @@ -5558,7 +5558,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", @@ -5586,28 +5586,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" }, { - "connectorId": "AzureMonitor(IIS)", "dataTypes": [ "W3CIISLog" - ] + ], + "connectorId": "AzureMonitor(IIS)" } ], "tactics": [ @@ -5707,7 +5707,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", @@ -5735,28 +5735,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AzureActiveDirectory", "dataTypes": [ "AuditLogs" - ] + ], + "connectorId": "AzureActiveDirectory" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -5863,7 +5863,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", @@ -5891,28 +5891,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Office365", "dataTypes": [ "OfficeActivity" - ] + ], + "connectorId": "Office365" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" } ], "tactics": [ @@ -6002,7 +6002,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", @@ -6030,28 +6030,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -6142,7 +6142,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", @@ -6170,34 +6170,34 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MicrosoftCloudAppSecurity", "dataTypes": [ "SecurityAlert" - ] + ], + "connectorId": "MicrosoftCloudAppSecurity" }, { - "connectorId": "AzureSecurityCenter", "dataTypes": [ "SecurityAlert" - ] + ], + "connectorId": "AzureSecurityCenter" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -6279,7 +6279,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", @@ -6307,28 +6307,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "Syslog", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "Syslog" }, { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -6419,7 +6419,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", @@ -6447,28 +6447,28 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "CiscoDuoSecurity", "dataTypes": [ "CiscoDuo" - ] + ], + "connectorId": "CiscoDuoSecurity" }, { - "connectorId": "MicrosoftDefenderThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "MicrosoftDefenderThreatIntelligence" } ], "tactics": [ @@ -6554,7 +6554,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Threat Intelligence Solution for Azure Government",