<0NcIo|}^t$(DcTR6U!ZES^sqv>|XntTPl6tpzO8!Bo8EW;9n#zgR|0tQ50tBHq^
zE^+%=gueP#?8v|-?m@A^e)A-CbSKVxjrG>=BJ=TspC5=%sK$hojY5s&e6NH#eN1gx
zoY150BAu01C^yx5vAnKgUZqD~zcDcARKB%_sbi&y;|nuQh1Y6yQP*PLm%l0TMj7T8bh-rt5>1hHR0t%PmUs7`{+ywTV7iU1g
zE451mVA2e@U{$TZ07)kZYiGoEg{gOh%{B5dVz8Z;>^JkGBzRITw=GP1Eqo39tLaE~
zZ}+zpf#ZQ{S)n{bxj@R*FsvQ9GB56CWF)6A(MUR8N~vz7ST|TtS!kZOpBt+)Q1VkC
z8YLz0a+u71%5h_i==M>^1voi8?^I$dSwT0@Dp+g51V9SuMwDqvH0s9Lt{*
zhFWH{hh!%jdizw`Q#Kzmo6`R@6$U1v;T{d+BeBV)+RR~wC~Gg(&VbTpdx
z*2WfdidNXVinx@WP5{nydJk}-Mw5y!YYlu~kurOvdiIL=32h)O9)sBzoroD7ZRVnM
zvaSrAQ~G8ggG!p9Tzi(XI5f#=UK)JN>`%b#T&Vx%fIw8znm3U%c-Aq>6gJscIo}Sj
z>k@W4^cA^*$r6k*L#--TTp$UTQo8;$+y3Sh>Beh8X2p$h2VkSQOwxV9BT^7*DY>GN
zwp=f4oh(w%eIcp5yG3X~EN@C7MA@i5;kriqSlhx}+w;J7M?ibMuj+&{g%#@y0ZDT5
z$41xf!9J^KcgLEBf*LZi*72=hEW2wb4%2
zERshAj@09!5pBCB}sE3QRdcmZfW>a&4%;SGYqgzF5D)OR2y
z^f;x#c^P^6E@&25hCGzH3fOqV03;z2%!7_Shhcu~GJat?-gM&iVZA-EadIE@n3T25x8bcXB64HyOv~W8>9-c-
zciYK?agy^nNRGThIa^+)GAioq$>FS`1FUA
zkt?gWY1{A4+NRCaP|25Fnnqb5UY>y5KH1x8ugp`^^hpmk{-ncCfu&fvLa4Fn!j3K^
zsEaj}zpkgrTi;scF2`G?J(HSYF&3pdoE0AUh}TKJ_}9TXaXBmhGA)_WtB>_+45-z|
z88~(~8PvQ+Q82gzQ^VdmwpO0Y&5m$nt0&8WJFrZay);~dVq$qbR${@R(nUdU=(jSI
zUf=TZLx(UXul8R6Wa|TfQ9S$dPp|=q9bj#)TC3ChFBg;m_`*iElTjTn{e@VBFpA!I
z8|pU@C6fB>4r<{gBO}bi&r6E8Wd3%w6l7VJKSYIWs+02bh08p)izIfO-fll2&Ng^&
z1O5JCB!CA_@8T-mor}L6oX31rK9KeFz}qdo=6-A(ZC6{ncG_s=2(6m^X<3obWKL*J
zTeb9ESz+Fjdi5KTMRiuUFJ=t3_r0>2t9d)KPA=i*0LK;Ie0(hW3(cf$>9e_&!8aYh
zJFJ46ei|)(2M>6B{2ejuR7aTK;RM`nC?wrppS$<_KT@C5-;lq*BM@!~5Yc5{|4))g
z@FPG$_LN2)re~{5H^T~ftNJ6Oqig<&g6x5};X(gWs{G38>guV4s^1Z*zZ02oMApX8
zx-UQWG98mRy$2WUhgFNQ=kL`9k7d7^C=2Qr&;Nz-^dC&3a_LyQBXL^+1fC4fH?MMP
z?CI@&Z$3?_PZ-;9F@3zH{#Ln+Zi%*2!SR*pSGmamoC#%Kd
zw?KIC*LLNrI-$9sVIDR_Tt+l!O364V?RI-?%wOAP?6CdUXWPL%bluKlhZuY~l^q~8
z^JJrb-0$fH^pi%~f#Vk}h_xq=LDOCTWNXmJtgv-^y%XWt2k*ocC9Q6bPmN&Hy_F9jkTqBhh8BEZ*8U2#n(-|2?R5%;#-1qm2cDF4GGMh3g9Yh
zOI|ULUV*m
z=sXF0wg5evJV_Z3E3?OMW6mPi?=BNah1s=bf|w<&Kfww*g>ks%>o?eK|4Z@=>IbbGr(x9lI56G7=Ruf
zkXd=@A3r0y?1vZWBKqS2t!r2PARp4F4#WikY+xUP=dM6&7oj((`}fz^=Z9f*;A=?d
zP1e{F7h3>XsgM_{(7
zjy`|y2FT&+LBp5iZ4JFB#}{?3sz<
zUGh-+gNTHL`~!$yl(gC|avp&gNPDpe$O4z@LY65b;ERBTUv!0gl^OMg28#l<9r3jq
z7dZ>iNI&4fA|^R(>)fv{r#JsXWM9C`KpdjiOH?xDfuh&f`spdg#cFuqV!7fKdubQT
z$DmPYsE9;`w7KU++(p;`}cp1vM$lU{ud`4
zyA82((wGK7ifQ-+>|T}5IelEq^BG{oJ(6EP(oLJW!KV#c-~Pgqw4&GeayvM9xTD+<
z`SnO~d;llLPDu1U;cW{PZo5thCy7M7C0_ZL#McBzQa5a?VAKmni&tcKXHS3qu{15^t{VdAUIUE+PF
zLAN|z-@KI0Be9m_#u^~1UwSF8!4LN>JU43uw6inb)uS-V#j9~S5j_)r`;3C
zl|$nnFmXTQy!<@v!Gl_&rc_F_%goL1ep!1K8p$)Ec`i9so#bmwgN;q>>>PWr?sUWB
zWyD6HwbqngCG%2KKIQiqB1;T}`%&lKfE?V}u>}`_t8JwNQ$IECECZ@cec;2()
z^cggt$mx&D%2qaZ1rqm^I*rB-=Z^?u_@i_L})9pL>)l%|E19MI51s(42
zX82248h-mZdY7EkV$)lTpz={XgHE~97?;0--}u@KYkK>RKs4hqUBpxhR=r42S@?-Afmdsp00
zpeJ{>;3UxJo(zqR_%&aE4#);*wfe)2B@wdWM;Qd!@=%C4a(l4!giCT;JyZ$0loBilKYBnBT&?WeiK{zcYFz)8$4FlUy%R3PSqe%C-$YyF
z%ZMXPM}5*ImZGlp{%3*#3L9fHU`V|ljKfT9v2C(Z%bu!VAbg+f8=Xn#XwHt0-dLyO
zN*KT2B;@>q8PE1x@Bac8I`Eb574)0Qz`#~_d;;FLf_bwepiURNz;4LYPukLqEYcB^
zr~sV@pl;-iT)))J`dh9FC;A6$C1DT*oNwW&oJN{U)OPW)`3%8P4_wy;EK$V!@sLZq
zmZZvvc;)FB8xAouLQ_aB{aLMifz!0HLjs>4Ej&`g?#F9{f(UMh5>;I#j9=h#?;
zup%87WTD#mKVi_WOyA(9?W(OUND$!*(O^VLHng(()%1&f1Rg`(39bp9Pq#y($2PJL
zs7_g`4?i;2WDPIuo>GSjsuTei9JDs%;gx1+@HBinh{(!lE@dC^brZpx_A>-yv8pRc
zH_pS1X68jT*cPP|n-E`7@2U9yr;r>N8XDHeWba~JJ{4WQ#G#7rUK@<&a6Up(L1d_V
zCCAZ5v0kiy+ER)Y>Wf~j++DsfFBiOiH!7wzK_>blVFe58YnL;m3{P|F+uUm-&f84&xSha
z&DIPW6IPAUn6v+V)PD~U)k*&?3;N#qZ(lLu(tpc>ail;I_J1$j4lS&BPWs+lfAP|)
QW$@?xS;aGPr>@=oACeSgd;kCd
literal 0
HcmV?d00001
diff --git a/Solutions/Torq/Playbooks/Torq-Sentinel-Incident-Trigger/readme.md b/Solutions/Torq/Playbooks/Torq-Sentinel-Incident-Trigger/readme.md
new file mode 100644
index 00000000000..955b4b98091
--- /dev/null
+++ b/Solutions/Torq/Playbooks/Torq-Sentinel-Incident-Trigger/readme.md
@@ -0,0 +1,43 @@
+# Torq-Sentinel-Incident-Trigger
+
+## Summary
+
+When a new Sentinel Incident is created or updated, this playbook gets triggered and sends a notification (HTTPS POST Request) to a Microsoft Sentinel Webhook in Torq
+
+
+
+### Prerequisites
+
+1. Prior to the deployment of this playbook, create a new Microsoft Sentinel Trigger integration in Torq.
+2. Take note of the endpoint URL, the authentication header name, and the authentication header secret configured in the Microsoft Sentinel Trigger integration.
+
+
+### Deployment instructions
+
+1. To deploy the Playbook, click the Deploy to Azure button. This will launch the ARM Template deployment wizard.
+2. Fill in the required paramteres:
+ * Playbook Name: Enter the playbook name here
+ * Torq_Webhook_Enpoint_URL: Enter the endpoint URL for the Microsoft Sentinel Trigger integration previously created in Torq.
+ * Torq_Webhook_Auth_Header_Name: Enter the authentication header name for the Microsoft Sentinel Trigger integration previously created in Torq.
+ * Torq_Webhook_Auth_Header_Secret: Enter the authentication header secret for the Microsoft Sentinel Trigger integration previously created in Torq.
+
+[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://portal.azure.com/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FTorq%2FPlaybooks%2FPlaybooks%2FTorq-Sentinel-Incident-Trigger%2Fazuredeploy.json) [![Deploy to Azure](https://aka.ms/deploytoazuregovbutton)](https://portal.azure.us/#create/Microsoft.Template/uri/https%3A%2F%2Fraw.githubusercontent.com%2FAzure%2FAzure-Sentinel%2Fmaster%2FSolutions%2FTorq%2FPlaybooks%2FPlaybooks%2FTorq-Sentinel-Incident-Trigger%2Fazuredeploy.json)
+
+### Post-Deployment instructions
+
+1. Browse to your Microsoft Sentinel workspace > Configuration > Automation
+2. Click "+ Create" and select "Automation rule" to create a new automation rule meant to send a notification to Torq when a new Sentinel Incident is **created**.
+3. Give the automation rule a meaningful name, like "Notify Torq when new Sentinel Incident is created".
+4. From the "Trigger" drop-down menu, select **"When incident is created"**.
+5. Leve "Conditions" to its default values.
+6. From the "Actions" drop-down menu, select "Run playbook".
+7. From the playbook selection drop-down, select the playbook "Sentinel_Incident_Sync_to_Torq"
+8. Click the "Apply" button.
+9. Click "+ Create" again and select "Automation rule" to create a new automation rule meant to send a notification to Torq when an existing Sentinel Incident is **updated**.
+10. Give the automation rule a meaningful name, like "Notify Torq when a Sentinel Incident is updated".
+11. From the "Trigger" drop-down menu, select **"When incident is updated"**
+12. Leve "Conditions" to its default values.
+13. From the "Actions" drop-down menu, select "Run playbook".
+14. From the playbook selection drop-down, select the playbook "Sentinel_Incident_Sync_to_Torq"
+15. Click the "Apply" button.
+
diff --git a/Solutions/Torq/Playbooks/logo.png b/Solutions/Torq/Playbooks/logo.png
new file mode 100644
index 0000000000000000000000000000000000000000..cc5d3be7328bb4453610b79ee2aafc62e53e59ee
GIT binary patch
literal 3449
zcmZ{ncQhQ%7RQ$;OC(x^MB7!f5)!?)Rf6a&(M4Y+646;*bXG}p!f%yW-69B^qC{tf
z6L4}}cd{?^VcbYIk{RH;fk21;
z$uN4+bMfJwJcZ*Fd35&rdLY_0Fc3U3IG5h06^3Y002td0hs)MbQqF2|6ltbt)xK$0HFYYe`=cWOl_oK`n0g?r95I8
z+up&RxrN1V0qlgI_LLt?+Z>GZj)fzO(I7F8%WV(xl9hV;uPGi2tvt1>VQ^XN#t@mc
zNxjUf$>QWm3G{-(M3v1PtD+4i)HARH`MK(z7=^TRtIkBnd^`ceJsMo0BBs3IzChw8
z8-60cCpYus^OjWaq;3+ngDS;Oz15DpoU?#lvPo73QOT{jR>Nzx!ZfS5ln|(b$M6PHWf(}l=q
zfld{23sTqOVL|!n@yx#hx(^GT9m>WMx4bW+Ou%4X6e8socq@|)JzPeHhVxzxNNWir
zFl0GLPr}=@5Zd}w5O9+4Ar)Ma1P+V4_K5jwWQ4oC9?Pl__2KCFtdhD06+GhU+++}H
zw&^-Ec&qf4!uHzx53fB%X?te&th>pFw`NbJJa+8e%~QjiLVM}Khz@$@SB)w=X!B&1
zi`+Ezt;V5ug!X}Ht*7SMDb>dD8l8#A?V*t4MrZNH+HYOiF91UApVregWkVk_%`X`Q
zrBoQHMkBXP4#dX4!C8jfxLLca9{lhvsns9%j?5TBlO!N(8nd^UP6~P8WmW
z44x_+F*0mqTQjF=9ef`rITsLD1aLIjecqw9JpxyP5>;lm`c`~t53@-@DCq}ok!jjT
zJp+n9wboggoFj8&K)5egtL;n5F7Fp#ZQT!5+S^JBxr@^j!jKH3q-H#HMmzBg2E>7Z
z-S0$K?}2628z7V_MqM~**L_>B^rEk{U00O^nxo^Sr&{=Mo|4G$01$pt
zJ96y#@9*W5i@74`$U9+{&nC8;-(-jm1~g?xQ}>s81r83%=b`#(;{c4pa9`)7
zkH{EMv99{0E|%H6WbfASgOSV)M^SE?O+H1)acW*dA$>+IS5{)N&B5P83oX9;1@t)M
zWsf&Go>wLJ7x9ir%BNT|f06psez`8S_4rJEar)Lr>6v-hYBiIzap){hi1dK-{>O;O
z?j+tuGSK(PoE;%f|m|OG>up~g5ES}SS4PCQbTk6Y;*Xm
z6Cu{cdhB`CGOa5`)N69PGbR4x1W@F1I1*~x8nYixj`VW8gH1qPK<2uPQIKUb
zzB$>FO4k1ZA9vpS?g+f&7n19CnqZ-%mXn+{Zfe?QY)^NZy#@tdBIrowUCdFk*sG
zuxE9rGS6ThD8{m9sh^3XrF&24I}vP*hA1bOs@bfq&QkfNdjkqO{hO7zlRK{@Q$xz&
zyVz?d3K8#8K9k~a8KcykkL#vd(fZq&(sms+{(Ux_`3c~i5rkG5gkVoa3}KP_^!k_N
zk8Px)r(1o?I~rK=MzV(5VaI7@$SWV!LUIa0)L3l7Z`3o3_LK}@r}k4V9uteBT2hNa
zm6`mN51?r8`*z~yG8MQ*p3r{%VbN|sO9}`JE~eeySOL#u{MR&W%>YHV(q3{r=89lj
z^mBEMlW^OS%4kzubY`QpVui}oZeCP!1z9y8jU5e{D|6*rO}skURM(~z*pGbs11YHj
z-|D8GxHNWZW;qgVqTvl;-wWReLmsMBn&^3i!_87%GP>^;H!u!fUv}HR0yTGfV{PKn
z>=WC-=;Z)WZ|?QED{?|C9JFg7KtZVbg(6|6h}AfoK~^sy1PCwsdOM4Z
z_kubMS>X?aZ0iS6sucsES{fu8H~v#5>Wu(h!j7bLxTm}C9sJl{>+{?50f28m+@S0^
z+BF448Qb<*YBbJaS6b5obfSf*fpFSN!MVzvjnLP2zdDPZ>PFQ_z+2%gD_s+T1G9Jg
zJKx{z{`xBd={wxmm3x2?Bqk^EwuNhUNdbhKWkkbFEFM87Wfp-@DTA7@XbrnsYfhn$dJTevXrkTH_Gb+AW1&4`%@-5u(iZ#CAF#h{TkT)
zdFl#WR`xkgMB6pjtlXY*r`#$C0ImYrrU;a4*~9*-tEe`NgH>^w+M<^hKooSiJ9%oA
zT0PNIF2%Rm^RT*C^)5=4EtsRkZeOZaYB3Y-28+QNS`A}z6Hb+XLDR8LRry{_bhzIl
zXNC=DOLRK{-+Y#d*Pb?&{4M6tB@RymH4lEtDeBJ|<7It6OYLR|S59F*Us2^sNy5Sn
zZih~tVQzls`IKka=_P?>>|HO0Z+w!&m|o;rOZJQ{AgMHjLrVkvz>ye46Zys&B8{^X0inBBKc>N&Sdg6~v6Cp({!%1xXl
ze#6nNVVL*{T3n=Ma1X}p&YD^%Sdt1y|B|EG7>Q%%wFwq#TQqDW=-zF+oKeS@{h(=V
zY|EG0ML)s#4pTZ!bDenH&1Dk_jXvI4yB6Iq5&6(h?A3gb6JU=4r+1}Ug}d0ZC6cEE
zl(XzGND~$>)_l+A$5+9a;75CuG@2TY%{B#yd)Y;dx)F!=^Oj9aieWTSn2*j?9Y0N&
z#x=tf9bURn^;3xg0)T6jgyT$|{(%?mvueM@Pt{7^YGn=pP|UbTuO>|=I+YjunO6=;!f?1I3DWegn4p{(<>hyjn>l5Hb9}Cg1L`qDOYw-ALO7Pfr5{tKB
z|3YJQTcygyN=@m4YF9yH)>IrV4+HL{pU6~DWIE5%)xixxUBSL-oB2IcP(E@BaZ(#b
z(?ac5v9CzBT6{KcF2qc(^AXxgl{Mw7=o}z>!T1s{6T~TZUnsRWzjXQYO
zK}AAH&ax4E?Z6ZBjRzLPfG$37%>JA+y_@R~vtYmwI($ZgpEaXAeRUZpokL`+p;q%0
z?%OLMl~A_dM;dKE@k@PY-W;Qfgwz!`#bXXQY?GPm=2#SotAT;-ZO8SPC=6>i)A2@e
zdrH=Yu-*ex@lGbF`Qrm|$G`Hs1zwQwqR0-wBvob_Fmm%}35S8*?Uc!
zqt?TB7%#J&=^nXO=_V{k`=`2t#XbhsoU^J7Of2?q&<^_kcH+0~m6bfb+1hXGx96Mo
zehZxr#0DUGO!2Zj=7>F^E5frvw$^GnnJhP2Hgb>z#!5bqH^1ANCU%oa+vaW;PKT+o
zjFi>re%c-$m+Y82UM(9LTw#mhLV-}LwWMv==MK~qxN=+9`BAZbkNECH@G`yuRG$dE
z{NkxiL<%A#{1X8Fsp*LH^EV{?(SNhWKlLA;_}l(}nB&h9e}_RTUNYMP2+Ge}1KG7N
QiQxg7YPzb`P}_)q0mm|KLjV8(
literal 0
HcmV?d00001
diff --git a/Solutions/Torq/ReleaseNotes.md b/Solutions/Torq/ReleaseNotes.md
new file mode 100644
index 00000000000..3ca4764b9eb
--- /dev/null
+++ b/Solutions/Torq/ReleaseNotes.md
@@ -0,0 +1,4 @@
+| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
+|-------------|--------------------------------|--------------------------------------------------------------------|
+| 1.0.0 | 06-11-2023 | New **Playbook** Torq_Sentinel_Incident_Trigger |
+
diff --git a/Solutions/Torq/SolutionMetadata.json b/Solutions/Torq/SolutionMetadata.json
new file mode 100644
index 00000000000..a1e4c6151f0
--- /dev/null
+++ b/Solutions/Torq/SolutionMetadata.json
@@ -0,0 +1,15 @@
+{
+ "publisherId": "azuresentinel",
+ "offerId": "azure-sentinel-solution-torq",
+ "firstPublishDate": "2024-11-06",
+ "providers": ["Torq"],
+ "categories": {
+ "domains" : ["Application"]
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+}
\ No newline at end of file
From 0fd2bff4db238a011a0b932900fae2b4a9120140 Mon Sep 17 00:00:00 2001
From: Ido Shabi
Date: Thu, 7 Nov 2024 13:26:32 +0200
Subject: [PATCH 02/75] publishing solution for gcp firewall logs connector
---
.../GCPFirewallLogSetup.tf | 103 ++++
.../GCPFirewallLogs_ccp/GCPFirewall_DCR.json | 29 +
.../GCPFirewall_PollingConfig.json | 29 +
.../connectorDefinition.json | 105 ++++
.../GCPFirewallLogs_ccp/solutionMetadata.json | 24 +
.../Data/Solution_GoogleFirewallLogs.json | 14 +
.../Package/3.0.0.zip | Bin 0 -> 6429 bytes
.../Package/createUiDefinition.json | 85 +++
.../Package/mainTemplate.json | 576 ++++++++++++++++++
.../Package/testParameters.json | 38 ++
.../solutionMetadata.json | 20 +
11 files changed, 1023 insertions(+)
create mode 100644 DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPFirewallLogsSetup/GCPFirewallLogSetup.tf
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_DCR.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_PollingConfig.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/solutionMetadata.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Package/3.0.0.zip
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Package/createUiDefinition.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/Package/testParameters.json
create mode 100644 Solutions/Google Cloud Platform Firewall Logs/solutionMetadata.json
diff --git a/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPFirewallLogsSetup/GCPFirewallLogSetup.tf b/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPFirewallLogsSetup/GCPFirewallLogSetup.tf
new file mode 100644
index 00000000000..f66efc8b3f2
--- /dev/null
+++ b/DataConnectors/GCP/Terraform/sentinel_resources_creation/GCPFirewallLogsSetup/GCPFirewallLogSetup.tf
@@ -0,0 +1,103 @@
+terraform {
+ required_providers {
+ google = {
+ source = "hashicorp/google"
+ version = "3.73.0"
+ }
+ }
+
+ required_version = ">= 0.15.0"
+}
+
+data "google_project" "project" {
+ project_id = "Enter Project Id"
+}
+
+variable "topic-name" {
+ type = string
+ default = "sentinel-topic"
+ description = "Name of existing topic"
+}
+
+variable "organization-id" {
+ type = string
+ default = ""
+ description = "Organization id"
+}
+
+resource "google_project_service" "enable-logging-api" {
+ service = "logging.googleapis.com"
+ project = data.google_project.project.project_id
+}
+
+resource "google_pubsub_topic" "sentinel-topic" {
+ count = "${var.topic-name != "sentinel-topic" ? 0 : 1}"
+ name = var.topic-name
+ project = data.google_project.project.project_id
+}
+
+resource "google_pubsub_subscription" "sentinel-subscription" {
+ project = data.google_project.project.project_id
+ name = "sentinel-subscription-firewalllogs"
+ topic = var.topic-name
+ depends_on = [google_pubsub_topic.sentinel-topic]
+}
+
+resource "google_logging_project_sink" "sentinel-sink" {
+ project = data.google_project.project.project_id
+ count = var.organization-id == "" ? 1 : 0
+ name = "firewall-logs-sentinel-sink"
+ destination = "pubsub.googleapis.com/projects/${data.google_project.project.project_id}/topics/${var.topic-name}"
+ depends_on = [google_pubsub_topic.sentinel-topic]
+
+ filter = "resource.type=gce_subnetwork AND logName:firewall"
+ unique_writer_identity = true
+}
+
+resource "google_logging_organization_sink" "sentinel-organization-sink" {
+ count = var.organization-id == "" ? 0 : 1
+ name = "firewall-logs-organization-sentinel-sink"
+ org_id = var.organization-id
+ destination = "pubsub.googleapis.com/projects/${data.google_project.project.project_id}/topics/${var.topic-name}"
+
+ filter = "resource.type=gce_subnetwork AND logName:firewall"
+ include_children = true
+}
+
+resource "google_project_iam_binding" "log-writer" {
+ count = var.organization-id == "" ? 1 : 0
+ project = data.google_project.project.project_id
+ role = "roles/pubsub.publisher"
+
+ members = [
+ google_logging_project_sink.sentinel-sink[0].writer_identity
+ ]
+}
+
+resource "google_project_iam_binding" "log-writer-organization" {
+ count = var.organization-id == "" ? 0 : 1
+ project = data.google_project.project.project_id
+ role = "roles/pubsub.publisher"
+
+ members = [
+ google_logging_organization_sink.sentinel-organization-sink[0].writer_identity
+ ]
+}
+
+output "An_output_message"{
+ value = "Please copy the following values to Sentinel"
+}
+
+output "GCP_project_id" {
+ value = data.google_project.project.project_id
+}
+
+output "GCP_project_number" {
+ value = data.google_project.project.number
+}
+
+output "GCP_subscription_name" {
+ value = google_pubsub_subscription.sentinel-subscription.name
+}
+
+#danielle ask her about this
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_DCR.json b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_DCR.json
new file mode 100644
index 00000000000..373274ec623
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_DCR.json
@@ -0,0 +1,29 @@
+[
+ {
+ "name": "gcpFirewallLogsDCR",
+ "apiVersion": "2021-09-01-preview",
+ "type": "Microsoft.Insights/dataCollectionRules",
+ "location": "{{location}}",
+ "properties": {
+ "destinations": {
+ "logAnalytics": [
+ {
+ "workspaceResourceId": "{{workspaceResourceId}}",
+ "name": "clv2ws1"
+ }
+ ]
+ },
+ "dataFlows": [
+ {
+ "streams": [
+ "Microsoft-GCPFirewallLogs"
+ ],
+ "destinations": [
+ "clv2ws1"
+ ]
+ }
+ ],
+ "dataCollectionEndpointId": "[concat('/subscriptions/',variables('subscriptionID'),'/resourceGroups/',resourceGroup().name,'/providers/Microsoft.Insights/dataCollectionEndpoints/',{{dataCollectionEndpointId}}"
+ }
+ }
+]
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_PollingConfig.json b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_PollingConfig.json
new file mode 100644
index 00000000000..b3bd05ee9f2
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/GCPFirewall_PollingConfig.json
@@ -0,0 +1,29 @@
+[
+ {
+ "name": "GCPFirewallLogsTemplateConnections",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.SecurityInsights/dataConnectors",
+ "location": "{{location}}",
+ "kind": "GCP",
+ "properties": {
+ "connectorDefinitionName": "GCPFirewallLogsCCPDefinition",
+ "dcrConfig": {
+ "streamName": "SENTINEL_GCP_FIREWALL_LOGS",
+ "dataCollectionEndpoint": "{{dataCollectionEndpoint}}",
+ "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}"
+ },
+ "dataType": "GCPFirewallLogs",
+ "auth": {
+ "serviceAccountEmail": "{{'GCPServiceAccountEmail'}}",
+ "projectNumber": "{{'GCPProjectNumber'}}",
+ "workloadIdentityProviderId": "{{'GCPWorkloadIdentityProviderId'}}"
+ },
+ "request": {
+ "projectId": "{{'GCPProjectId'}}",
+ "subscriptionNames": [
+ "{{'GCPSubscriptionName'}}"
+ ]
+ }
+ }
+ }
+]
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json
new file mode 100644
index 00000000000..e05dc516cb1
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json
@@ -0,0 +1,105 @@
+{
+ "name": "GCPFirewallLogsCCPDefinition",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
+ "location": "{{location}}",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "GCPFirewallLogsCCPDefinition",
+ "title": "GCP Pub/Sub Firewall Logs",
+ "publisher": "Microsoft",
+ "descriptionMarkdown": "The Google Cloud Platform (GCP) firewall logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.",
+ "graphQueriesTableName": "GCPFirewallLogs",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "GCP Pub/Sub Firewall Logs",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get Sample of GCP Firewall Logs",
+ "query": "{{graphQueriesTableName}}\n | take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors"
+ }
+ ],
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true,
+ "action": false
+ }
+ }
+
+ ]
+ },
+ "instructionSteps": [
+ {
+ "instructions": [
+ {
+ "type": "MarkdownControlEnvBased",
+ "parameters": {
+ "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
+ "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
+ }
+ },
+ {
+ "type": "CopyableLabel",
+ "parameters": {
+ "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+ "fillWith": [
+ "TenantId"
+ ],
+ "name": "PoolId",
+ "disabled": true
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 2. Enable Firewall logs \nIn your GCP account, navigate to the Firewall section. Here, you can either create a new rule or edit an existing one that you want to monitor. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/firewall/docs/using-firewall-rules-logging?_gl=1*1no0nhk*_ga*NDMxNDIxODI3LjE3MjUyNjUzMzc.*_ga_WH2QY8WWF5*MTcyNTUyNzc4MS4xMS4xLjE3MjU1MjgxNTIuNDYuMC4w)"
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 3. Connect new collectors \n To enable GCP Firewall Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+ }
+ },
+ {
+ "type": "GCPGrid",
+ "parameters": {}
+ },
+ {
+ "type": "GCPContextPane",
+ "parameters": {}
+ }
+ ]
+ }
+ ]
+ }
+ }
+}
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/solutionMetadata.json b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/solutionMetadata.json
new file mode 100644
index 00000000000..a96ce2e2d79
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/solutionMetadata.json
@@ -0,0 +1,24 @@
+{
+ "publisherId": "azuresentinel",
+ "offerId": "azure-sentinel-solution-gcpfirewalllogs-api",
+ "firstPublishDate": "2024-09-08",
+ "providers": ["Google"],
+ "categories": {
+ "domains" : ["DevOps"],
+ "verticals": []
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ },
+ "SolutionName":"GCP Pub/Sub Firewall Logs",
+ "SolutionAuthor": "User",
+ "SolutionVersion":"1.0.0",
+ "packageIcon": "google_logo",
+ "SolutionTier": "Microsoft",
+ "PackageId":"gcpfirewalllogs-api",
+ "ConnectorDefinitionTemplateVersion": "1.0.0",
+ "DataConnectorsTemplateVersion": "1.0.0"
+}
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json b/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json
new file mode 100644
index 00000000000..48e8dc74d39
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json
@@ -0,0 +1,14 @@
+{
+ "Name": "Google CLoud Platform Firewall Logs",
+ "Author": "Microsoft - support@microsoft.com",
+ "Logo": "",
+ "Description": "The Google Cloud Platform (GCP) firewall logs, ingested from Sentinel's connector, enable you to capture and track all network activity that occurs in your GCP intances. These firewall logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.",
+ "Data Connectors": [
+ "Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json"
+ ],
+ "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Google Cloud Platform Firewall Logs",
+ "Version": "3.0.3",
+ "Metadata": "solutionMetadata.json",
+ "TemplateSpec": true,
+ "Is1PConnector": false
+}
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Package/3.0.0.zip b/Solutions/Google Cloud Platform Firewall Logs/Package/3.0.0.zip
new file mode 100644
index 0000000000000000000000000000000000000000..3980bf3c345a15f690ea091af442bddc50a2c134
GIT binary patch
literal 6429
zcmZ`;MN}M$mTcS!4i63P1Wj;v_r@I(Xq?6&I0To*2@u@f3EDWpH8=zscXxhfHZ$|*
z{CgL5ZY^qC=T@mJAs`X}0030LzOA)>B@6GpJ2C(;hzkG^|79&*tp#<*N@VQT49If4dV;{;1qY2j
z_%<}ekz-b;k{4aP+%aI?+@*uBUO1Gh=(J8LMk;DC1gfu>mu*I+Mgm1w=Qs#f;CfzKan#z{9;OBJ4c(OCS
zPMKYzsiz>zQAk}f!cNZ)&O9U}m@$GPD6q7s7BY8lxfu%iOIIG9iM{1x`8`v{Ffd2rSLioOvp8&^bo6UUMV9Xbja4M}q1+kUv7
zA;+2`nXsJd8cR!fG&C_Te@2gF>sR_Qg+dDrd#8r@
zL^yYB>S8$8pSUlvNY2t}I4w$5xZ;{6@6T07S5sfH4-4c84do<$((9w0{RYxP@R(dw
zI}AbO8HS->6gD|$7#KR=dt-Rn6Y2*IXYWy+!*hgF_fO1_yZZ=75gYXNqnZL5VLtRYFCX>{9N4`!bZ#^t~eKq3Q}Rq+3M8ofQ%j@j2SPcnR;x?n(quW&@kO%!
z!}TKB_fVolu3$<+NV~6*=EXXV5F(|7*mS(pVR`%Zv`&HxN#vb7w&3d
ziQOSntJO66b|wPIB_BARQX&Ti*gIu@%X!DNkE2PkV25Wrdf6lRe?aFe0~RwzJViV~
zUYr=8P^9=fSbz3P=^Ke~2QdmFl!Q;la^zUr+!ktar7=gJRfp3IWEH96(qeSpKEPFN
zSU#!}_SceJDVs7=YJB(1F3C>X*A9J&r#I&k;lesO9Zb9+8xvQ@XXL~mC}kPen5Qf-
z?}iKCPLM0cEKMbwg_H>Qd6(4EmQ4Pbp8GufOhVi6wWZ;85Ql`Bk*5ZQtTv^fJt~~a
zhH$r`ciNt_A03V>fc3|gJPxoG11BjqvmVqGAJj+g{ACff{d4(z?K*oOs~%O^Ht)uV6g10!pGBPKEen36qIwp<
zyS1^2*ge%fvg8pCI{Fmx<{7>;Tpi-r>2wm@1i_4ss9aY*BfT}KmGu-msw4WtT6UA&
z{pZDc*DheX#WTNdZiuP>
zAEz35)x9eJ>r(!%0Ki`WIGEcyYFj%v+yC{e|MsX8;}^}l3`ExY)iMZHeEDML|4mA;c8RxbDB`FB
zv~dH>y#+3YV`B+>gq*}3@SazG!(MmW4VXQMM6=(Ob3P*`bxnKVpIkO0e51Q7;jJfU
zl|&c)gVbs@FdZ898$8)0HMk@r{TMnV(F5H#)pEx|OA7gBTPzPhWFj{fO`9GgjV7@Z
z9JWJfX&Ik1ZcHS!1K{WzVD>%;zaG65uKzXI5fb8`1V+;R0_Py!ESoW8k0Cd~(L1ou
z@PnT{UUHF&H7bE`aii#!KeK18>9}6%L*?)2uXP=I*Fsp#pIyGp0;!`zieN#RFlDL=
zx?(Ff#|X!Sskx=kxRCYP%-OZ9iHd7~SfeHAEM!9lxuFl$cDooy<15hPOy^klX+#87%ks!5izapiiJdw3b
zLhV^H&m0pPLlQW?ijGhf{s@Y^Oc>uWB-nxe5k!K8qNTM*fZ49YaLdL+SqU{keF{|C
z3HiD|M5zO!^jeQK$N~;;xvTUK%b(U@u!e_@J-zC!u}X(nJyDG-Tq;yTG6ddS`}*4H^f2Q%?2@}80%OW5f|E^ifQ-{d3&B@VJ&jw44?~GSYHOW%Wvs3E%E<$+bGd8Xo
z*K7qxHGxLQHumll^IeK_1+)E3X@a1x9fe&5=aeL5A?$U0lW0cx1kuWxu3Mei*WcJ2
zNe3OHOFL$QhD#LLEnr3}hRiguc2w&&n>)`|CmNF;9!dYDhu>)&BQ903FT~SVx`pmw
zsyz;@F7z?uEab#|Yj;;-dcdY~$51h%W4jR8ydQS-Q+_N{4>FF>1Yimv5df)+w7EXF
zmKSTJRPmk9AKg;?+&CHNdNNdoIU3AZbphVJr!$7x2}$~jrrB0GSia5%ouxQ&Ddm_h
ztt$!7G@l`k4NwYLv`eiypPR3{9NZ;9%_nGx4b#TD_VGgPcP06IBFeZ(3!_X_EL}G3
zs;InE14ba(NSZANnx2SHGOt>;_DML`@2ynrLzut{(hKzCBZeERolZcPp!QCVyY@dQ
zG>ZrF)mq%)bwBsZ^ECv-9Sk+yKP@e^jw+BRrXTV0!hKbxpS1371cF>Naorqx@m!dT
zRNX0QuX^Sy#~u$K@x4*^QK+-qt`$L1*e!{#Aaqyh6Mk?(R&rN|JW;&>XJeg{4I73k
zFj`EgB!!@ay1dvH%8oMUc~2&0h~e^*Y!breQar}Wc0ieT@Hpp%sQyHX%K~dTR^p%7
z;%6Y7%b#nA;hDmC&*pklD!wX@%<*$5Ou30cnxFs!F3BAti;{)1^PUnb{*Q*c@(=vW
zf+Gyg=IbRlENaq=l;xd_2TYVLnzm(8L5KVj0g04}lHAKrZiz-)CSgnJx!B~q#1ao%#S&(
z-=py}8h-qOT&S_xjDP`>qcbb*sD?>Y(-!I?eoCY=Q8H?OLq;wh$|F?%8bzHV`M{-F
zogw9)K??rh!q=#*C{Cv-q}78?8n6
zf{b#1U#E$eD_Z2p@}{8L_@K5s;)?Hr!N%JemW;l44kVaZworz0pw_P^!!~y7pB5Oq
z@nf_`mJcav-=7o=g4^Dad67zg%73_|KwZp~80;f$OMpo%
zU=8$7_bhgM(sZT+P6#D3<(HC)@ULLSb(o;F&ec56)=7X6iiXHH6$@LnSk;yxs
zFBDN23IEX$GqsnCNVt0$HlnBct;2hTF7C7_sZ)r
z%6SRjy1{id3pj&J3L7TRFZ%tQ>^`9h&MG7Cn7}NM5Pd`LC4-EcDqa#%`K$)VONF|S
z9v{R|Ay1s}Yz|D2#2s%S#h@Ff7Gk}NXQu&vnBWm@C->F~IYwxK`@@;hyLH2!j
zi`8$1(~cD5ow5iSr?=VS{obZdAGnDP-~G*~ZJMsdmKs2g;EN`+2}(MQSN#QO6D~IY
z63PD|BM=fBlAS!39V>Fb5%n!Lk!H0&TAxi`)zg^D&P|z2E^cx%buI{u**`$*^19js
zDSd9KNqX*MDg>kceWk|C*Dc;jO!R?w@)SdIOAxbo=1&$
zHBx@>V+rAyD+`|P%BK5ATz~CmpxyeYfGwpGxd17ML3bK&VgpEAy_YS1=3|<`n>r_T
zTh(Rley@W&O%>P_I=#ymfk{yvb@^(lEHVS`p|F!p%1{znc?`7wHP@>ok_RC3ADaAb
z{71k?-6E&WQW~WPSr$n_$VGpTBw^9{a6eKw6l+=9yi8)UkR9NEaX^S>DJ&5lD#-Cj
zE?HxYEd*9hS1XdWIAfh#VdLR?@8suf?u9}lR+i0=!>_C^D{dqINnkJ;aZ{2;U31t4
zm9WIh8tGjrD{GV@xu-QOw!3}?g01;r?`!dpAWqqFv+?*LsGqryHaT8Moawb;%uiqp
zS?oX#Zy+g?ootpmq;5DCb-U=2S8Bf}f(u3V>Ck{mU^9V}EPm@!Y;tJ*4#Wx)HN0U=
zW8Jd^SqFg5d;&mwkK+pykhQxNwcGVKzlOKhy?4G;$8aC{#k@OTXKUX01-u_lM%U~7
z8v-!z#D1&Y#pRf6Zxl{0uRmSfyk4kwbl-qFS{|-P!I;k>Og9iXh1DQ+e#6wQ9zN8!
z0qy$AWGIemB_`WG?uy%qQXVx~9E6Hzx|x!0$Bf|Mc*k4{NN%l;RJ53&(;&Vm(?KsA
zj*Ql8Iz<-5ZxWWkW^84Cn)N+MjNG&=ix*jMZhwbuMKb=i}Et<(6eP}UbP8gS=jqpo>s&iSBIC;{C%w&H9dxg
zcvx?HBrj2UU}H4##veGZkuRcboI*kX$cOp>mwGW@pXyTcy_*UYr8E1>sK>D)70jH*
z%iul}O1{%a{Vt`?UR*tecI#Y_l!3yfSN)BBk7Q@>%W!8XpZdl}Qk+%A7J06X5#-jj
zR8>xGcUo2zT^p`k>@z?1F5Dk6KK{<2tJ*x!BUx*)EXPRTreMGNizvpQM>|D;p8HeV
zDK`ah?UGa=}H@EV
z@n~Jo_j-}`dhYgm#Msu@aAq@{e;3jp^eL2VAoL4e5r#S_J7?ACD!e(LX9y*N*@bOH
zp9|+h-L^hp?XsH)g3?3Yj3Vcr!YbGRT5X12Q35v)J)2B-mpCs*_ai6er^u}etmz6E
zUJ4YIbU?C-@Wio@c;1NE9R{8rX`-MAHbjgJ6cl|D{|_lJEjuOQ^2~*U2WXJ
zCi#hfkCY#h63xvJu*NU8#-wZ+&+~GWuusO3>FxH0WBGhgU=bC<<8T{0s
z0bQaEeOsSU?ihDnWj5=^UK9F&<0pOmNoih~=C&Kt;tk|o8U@C{VImB%^{o};FBKfC
z49Eett+AR=?6_3iHK#}pg_%z4QYqNhI`H*Q-@aZ+%l|
z_Cn>#l*+vrDBLoP82u6Dt1J-o+w~{>GXIjaRHZr$zVhl1EY+W~5Ti
zZpkJdA*A6Dp)&a33Z}vcy_{=@b7Vzr=AhOY)-r-v#F{>;zoLMd@2S%z{b(;)Cj!6x
zM!iguv|`c;L}T{Yyf-9zY-Br(F-?02EL;?6aEkmB)bzp>ilyw#
zd-GlTRvr;PCml;eQ0|NPV-6{5Bb({wc%Y^kn_N76br9T*1y@;CIxd`%d`_LX1Y8`8
zGUE{(HRdf641ciS*RBu@tFZjxg&~L3iW)`W#WBILQ8NhPK}7W=4@q_|L)8ED$KPIi
zv+>*og-G!Jz4+yG$R-u8sQJZ&nGR#mbby`LrT
zVL#OjGgw$COl;ebfM;n{s+vlxnW&S+RR3aqM9q8UIb%PpJxgHL7LLu$P;szdT~I
z7ga31Od1H6$z{$puv;V~MI}2>9SV(TW=NfCCzTHgE6>2RYBuJx`Nf)175m$T*1Ewg
zx3w-VWl+wA}KpfSA8LNNs022=h8n
zCQ}-!_5=b%`y_3|uoQAcu`ls0UkjGDAeeJegs@iWF+`ZBH2x7^S;}wtbUr0tXHe|w
zBB0C4g?@*QUdmw|Jwks(;Vc7a)8!Oyz4{yMz`+v${&NZOH{JPP^B*dSe;4`peCU4^
c%K!Eo|1T|4S3>$r0|4-UH}o%tko?#6FMU`ujQ{`u
literal 0
HcmV?d00001
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Package/createUiDefinition.json b/Solutions/Google Cloud Platform Firewall Logs/Package/createUiDefinition.json
new file mode 100644
index 00000000000..645d9e645b2
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Package/createUiDefinition.json
@@ -0,0 +1,85 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#",
+ "handler": "Microsoft.Azure.CreateUIDef",
+ "version": "0.1.2-preview",
+ "parameters": {
+ "config": {
+ "isWizard": false,
+ "basics": {
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Google%20CLoud%20Platform%20Firewall%20Logs/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Google Cloud Platform (GCP) firewall logs, ingested from Sentinel's connector, enable you to capture and track all network activity that occurs in your GCP intances. These firewall logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "subscription": {
+ "resourceProviders": [
+ "Microsoft.OperationsManagement/solutions",
+ "Microsoft.OperationalInsights/workspaces/providers/alertRules",
+ "Microsoft.Insights/workbooks",
+ "Microsoft.Logic/workflows"
+ ]
+ },
+ "location": {
+ "metadata": {
+ "hidden": "Hiding location, we get it from the log analytics workspace"
+ },
+ "visible": false
+ },
+ "resourceGroup": {
+ "allowExisting": true
+ }
+ }
+ },
+ "basics": [
+ {
+ "name": "getLAWorkspace",
+ "type": "Microsoft.Solutions.ArmApiControl",
+ "toolTip": "This filters by workspaces that exist in the Resource Group selected",
+ "condition": "[greater(length(resourceGroup().name),0)]",
+ "request": {
+ "method": "GET",
+ "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]"
+ }
+ },
+ {
+ "name": "workspace",
+ "type": "Microsoft.Common.DropDown",
+ "label": "Workspace",
+ "placeholder": "Select a workspace",
+ "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected",
+ "constraints": {
+ "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]",
+ "required": true
+ },
+ "visible": true
+ }
+ ],
+ "steps": [
+ {
+ "name": "dataconnectors",
+ "label": "Data Connectors",
+ "bladeTitle": "Data Connectors",
+ "elements": [
+ {
+ "name": "dataconnectors1-text",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "text": "This Solution installs the data connector for Google CLoud Platform Firewall Logs. You can get Google CLoud Platform Firewall Logs data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view."
+ }
+ },
+ {
+ "name": "dataconnectors-link2",
+ "type": "Microsoft.Common.TextBlock",
+ "options": {
+ "link": {
+ "label": "Learn more about connecting data sources",
+ "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources"
+ }
+ }
+ }
+ ]
+ }
+ ],
+ "outputs": {
+ "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]",
+ "location": "[location()]",
+ "workspace": "[basics('workspace')]"
+ }
+ }
+}
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json b/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json
new file mode 100644
index 00000000000..fd566500d2d
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json
@@ -0,0 +1,576 @@
+{
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "1.0.0.0",
+ "metadata": {
+ "author": "Microsoft - support@microsoft.com",
+ "comments": "Solution template for Google CLoud Platform Firewall Logs"
+ },
+ "parameters": {
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().name]",
+ "metadata": {
+ "description": "resource group name where Microsoft Sentinel is setup"
+ }
+ },
+ "subscription": {
+ "type": "string",
+ "defaultValue": "[last(split(subscription().id, '/'))]",
+ "metadata": {
+ "description": "subscription id where Microsoft Sentinel is setup"
+ }
+ }
+ },
+ "variables": {
+ "email": "support@microsoft.com",
+ "_email": "[variables('email')]",
+ "_solutionName": "Google CLoud Platform Firewall Logs",
+ "_solutionVersion": "3.0.0",
+ "solutionId": "azure-sentinel-solution-gcpfirewalllogs-api",
+ "_solutionId": "[variables('solutionId')]",
+ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
+ "dataConnectorCCPVersion": "2.0.4",
+ "_dataConnectorContentIdConnectorDefinition1": "GCPFirewallLogsCCPDefinition",
+ "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
+ "_dataConnectorContentIdConnections1": "GCPFirewallLogsCCPDefinitionConnections",
+ "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]",
+ "dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
+ "blanks": "[replace('b', 'b', '')]",
+ "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
+ },
+ "resources": [
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
+ "displayName": "GCP Pub/Sub Firewall Logs",
+ "contentKind": "DataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorCCPVersion')]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "GCPFirewallLogsCCPDefinition",
+ "title": "GCP Pub/Sub Firewall Logs",
+ "publisher": "Microsoft",
+ "descriptionMarkdown": "The Google Cloud Platform (GCP) firewall logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.",
+ "graphQueriesTableName": "GCPFirewallLogs",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "GCP Pub/Sub Firewall Logs",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get Sample of GCP Firewall Logs",
+ "query": "{{graphQueriesTableName}}\n | take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors"
+ }
+ ],
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true,
+ "action": false
+ }
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "instructions": [
+ {
+ "type": "MarkdownControlEnvBased",
+ "parameters": {
+ "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
+ "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
+ }
+ },
+ {
+ "type": "CopyableLabel",
+ "parameters": {
+ "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+ "fillWith": [
+ "TenantId"
+ ],
+ "name": "PoolId",
+ "disabled": true
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 2. Enable Firewall logs \nIn your GCP account, navigate to the Firewall section. Here, you can either create a new rule or edit an existing one that you want to monitor. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/firewall/docs/using-firewall-rules-logging?_gl=1*1no0nhk*_ga*NDMxNDIxODI3LjE3MjUyNjUzMzc.*_ga_WH2QY8WWF5*MTcyNTUyNzc4MS4xMS4xLjE3MjU1MjgxNTIuNDYuMC4w)"
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 3. Connect new collectors \n To enable GCP Firewall Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+ }
+ },
+ {
+ "type": "GCPGrid",
+ "parameters": {}
+ },
+ {
+ "type": "GCPContextPane",
+ "parameters": {}
+ }
+ ]
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "gcpFirewallLogsDCR",
+ "apiVersion": "2022-06-01",
+ "type": "Microsoft.Insights/dataCollectionRules",
+ "location": "[parameters('workspace-location')]",
+ "kind": "[variables('blanks')]",
+ "properties": {
+ "destinations": {
+ "logAnalytics": [
+ {
+ "workspaceResourceId": "[variables('workspaceResourceId')]",
+ "name": "clv2ws1"
+ }
+ ]
+ },
+ "dataFlows": [
+ {
+ "streams": [
+ "Microsoft-GCPFirewallLogs"
+ ],
+ "destinations": [
+ "clv2ws1"
+ ]
+ }
+ ],
+ "dataCollectionEndpointId": "[variables('dataCollectionEndpointId1')]"
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "apiVersion": "2022-09-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions",
+ "location": "[parameters('workspace-location')]",
+ "kind": "Customizable",
+ "properties": {
+ "connectorUiConfig": {
+ "id": "GCPFirewallLogsCCPDefinition",
+ "title": "GCP Pub/Sub Firewall Logs",
+ "publisher": "Microsoft",
+ "descriptionMarkdown": "The Google Cloud Platform (GCP) firewall logs, enable you to capture network inbound and outbound activity to monitor access and detect potential threats across Google Cloud Platform (GCP) resources.",
+ "graphQueriesTableName": "GCPFirewallLogs",
+ "graphQueries": [
+ {
+ "metricName": "Total events received",
+ "legend": "GCP Pub/Sub Firewall Logs",
+ "baseQuery": "{{graphQueriesTableName}}"
+ }
+ ],
+ "sampleQueries": [
+ {
+ "description": "Get Sample of GCP Firewall Logs",
+ "query": "{{graphQueriesTableName}}\n | take 10"
+ }
+ ],
+ "dataTypes": [
+ {
+ "name": "{{graphQueriesTableName}}",
+ "lastDataReceivedQuery": "{{graphQueriesTableName}}\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)"
+ }
+ ],
+ "availability": {
+ "status": 1,
+ "isPreview": false
+ },
+ "connectivityCriteria": [
+ {
+ "type": "HasDataConnectors"
+ }
+ ],
+ "permissions": {
+ "resourceProvider": [
+ {
+ "provider": "Microsoft.OperationalInsights/workspaces",
+ "permissionsDisplayText": "Read and Write permissions are required.",
+ "providerDisplayName": "Workspace",
+ "scope": "Workspace",
+ "requiredPermissions": {
+ "read": true,
+ "write": true,
+ "delete": true,
+ "action": false
+ }
+ }
+ ]
+ },
+ "instructionSteps": [
+ {
+ "instructions": [
+ {
+ "type": "MarkdownControlEnvBased",
+ "parameters": {
+ "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
+ "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
+ }
+ },
+ {
+ "type": "CopyableLabel",
+ "parameters": {
+ "label": "Tenant ID: A unique identifier that is used as an input in the Terraform configuration within a GCP environment.",
+ "fillWith": [
+ "TenantId"
+ ],
+ "name": "PoolId",
+ "disabled": true
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 2. Enable Firewall logs \nIn your GCP account, navigate to the Firewall section. Here, you can either create a new rule or edit an existing one that you want to monitor. Once you open the rule, switch the toggle button under the **Logs** section to **On**, and save the changes.\n\nFor more information: [Link to documentation](https://cloud.google.com/firewall/docs/using-firewall-rules-logging?_gl=1*1no0nhk*_ga*NDMxNDIxODI3LjE3MjUyNjUzMzc.*_ga_WH2QY8WWF5*MTcyNTUyNzc4MS4xMS4xLjE3MjU1MjgxNTIuNDYuMC4w)"
+ }
+ },
+ {
+ "type": "Markdown",
+ "parameters": {
+ "content": "#### 3. Connect new collectors \n To enable GCP Firewall Logs for Microsoft Sentinel, click the Add new collector button, fill the required information in the context pane and click on Connect."
+ }
+ },
+ {
+ "type": "GCPGrid",
+ "parameters": {}
+ },
+ {
+ "type": "GCPContextPane",
+ "parameters": {}
+ }
+ ]
+ }
+ ]
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]",
+ "kind": "DataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ },
+ "dependencies": {
+ "criteria": [
+ {
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "kind": "ResourcesDataConnector"
+ }
+ ]
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "displayName": "GCP Pub/Sub Firewall Logs",
+ "contentKind": "ResourcesDataConnector",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('dataConnectorCCPVersion')]",
+ "parameters": {
+ "connectorDefinitionName": {
+ "defaultValue": "GCP Pub/Sub Firewall Logs",
+ "type": "string",
+ "minLength": 1
+ },
+ "workspace": {
+ "defaultValue": "[parameters('workspace')]",
+ "type": "string"
+ },
+ "dcrConfig": {
+ "defaultValue": {
+ "dataCollectionEndpoint": "data collection Endpoint",
+ "dataCollectionRuleImmutableId": "data collection rule immutableId"
+ },
+ "type": "object"
+ },
+ "GCPServiceAccountEmail": {
+ "type": "String",
+ "minLength": 1
+ },
+ "GCPWorkloadIdentityProviderId": {
+ "type": "string"
+ },
+ "GCPProjectNumber": {
+ "type": "String",
+ "minLength": 1
+ },
+ "GCPProjectId": {
+ "type": "string",
+ "minLength": 4
+ },
+ "GCPSubscriptionName": {
+ "type": "String",
+ "minLength": 1
+ }
+ },
+ "variables": {
+ "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]"
+ },
+ "resources": [
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]",
+ "apiVersion": "2022-01-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "properties": {
+ "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "kind": "ResourcesDataConnector",
+ "version": "[variables('dataConnectorCCPVersion')]",
+ "source": {
+ "sourceId": "[variables('_solutionId')]",
+ "name": "[variables('_solutionName')]",
+ "kind": "Solution"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ },
+ {
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', 'GCPFirewallLogsTemplateConnections')]",
+ "apiVersion": "2023-02-01-preview",
+ "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors",
+ "location": "[parameters('workspace-location')]",
+ "kind": "GCP",
+ "properties": {
+ "connectorDefinitionName": "GCPFirewallLogsCCPDefinition",
+ "dcrConfig": {
+ "streamName": "SENTINEL_GCP_FIREWALL_LOGS",
+ "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]",
+ "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]"
+ },
+ "dataType": "GCPFirewallLogs",
+ "auth": {
+ "serviceAccountEmail": "[[parameters('GCPServiceAccountEmail')]",
+ "projectNumber": "[[parameters('GCPProjectNumber')]",
+ "workloadIdentityProviderId": "[[parameters('GCPWorkloadIdentityProviderId')]"
+ },
+ "request": {
+ "projectId": "[[parameters('GCPProjectId')]",
+ "subscriptionNames": [
+ "[[parameters('GCPSubscriptionName')]"
+ ]
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
+ "apiVersion": "2023-04-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "version": "3.0.0",
+ "kind": "Solution",
+ "contentSchemaVersion": "3.0.0",
+ "displayName": "Google CLoud Platform Firewall Logs",
+ "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
+ "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Google Cloud Platform (GCP) firewall logs, ingested from Sentinel's connector, enable you to capture and track all network activity that occurs in your GCP intances. These firewall logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.
\nData Connectors: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n",
+ "contentKind": "Solution",
+ "contentProductId": "[variables('_solutioncontentProductId')]",
+ "id": "[variables('_solutioncontentProductId')]",
+ "icon": "",
+ "contentId": "[variables('_solutionId')]",
+ "parentId": "[variables('_solutionId')]",
+ "source": {
+ "kind": "Solution",
+ "name": "Google CLoud Platform Firewall Logs",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ },
+ "dependencies": {
+ "operator": "AND",
+ "criteria": [
+ {
+ "kind": "DataConnector",
+ "contentId": "[variables('_dataConnectorContentIdConnections1')]",
+ "version": "[variables('dataConnectorCCPVersion')]"
+ }
+ ]
+ },
+ "firstPublishDate": "2024-11-03",
+ "providers": [
+ "Google"
+ ],
+ "categories": {
+ "domains": [
+ "DevOps",
+ "Security"
+ ]
+ }
+ },
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]"
+ }
+ ],
+ "outputs": {}
+}
\ No newline at end of file
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Package/testParameters.json b/Solutions/Google Cloud Platform Firewall Logs/Package/testParameters.json
new file mode 100644
index 00000000000..554801e41b7
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/Package/testParameters.json
@@ -0,0 +1,38 @@
+{
+ "location": {
+ "type": "string",
+ "minLength": 1,
+ "defaultValue": "[resourceGroup().location]",
+ "metadata": {
+ "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace"
+ }
+ },
+ "workspace-location": {
+ "type": "string",
+ "defaultValue": "",
+ "metadata": {
+ "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]"
+ }
+ },
+ "workspace": {
+ "defaultValue": "",
+ "type": "string",
+ "metadata": {
+ "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup"
+ }
+ },
+ "resourceGroupName": {
+ "type": "string",
+ "defaultValue": "[resourceGroup().name]",
+ "metadata": {
+ "description": "resource group name where Microsoft Sentinel is setup"
+ }
+ },
+ "subscription": {
+ "type": "string",
+ "defaultValue": "[last(split(subscription().id, '/'))]",
+ "metadata": {
+ "description": "subscription id where Microsoft Sentinel is setup"
+ }
+ }
+}
diff --git a/Solutions/Google Cloud Platform Firewall Logs/solutionMetadata.json b/Solutions/Google Cloud Platform Firewall Logs/solutionMetadata.json
new file mode 100644
index 00000000000..1166f605794
--- /dev/null
+++ b/Solutions/Google Cloud Platform Firewall Logs/solutionMetadata.json
@@ -0,0 +1,20 @@
+{
+ "publisherId": "azuresentinel",
+ "offerId": "azure-sentinel-solution-gcpfirewalllogs",
+ "firstPublishDate": "2024-11-03",
+ "providers": [
+ "Google"
+ ],
+ "categories": {
+ "domains": [
+ "DevOps",
+ "Security"
+ ]
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+}
\ No newline at end of file
From a637b2f667379f0c22ebcd0b2e05eded97c8f2c9 Mon Sep 17 00:00:00 2001
From: Ido Shabi
Date: Thu, 7 Nov 2024 13:32:09 +0200
Subject: [PATCH 03/75] fixing Cloud typeo
---
.../Data/Solution_GoogleFirewallLogs.json | 2 +-
.../Package/mainTemplate.json | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json b/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json
index 48e8dc74d39..c80c265aa9a 100644
--- a/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data/Solution_GoogleFirewallLogs.json
@@ -1,5 +1,5 @@
{
- "Name": "Google CLoud Platform Firewall Logs",
+ "Name": "Google Cloud Platform Firewall Logs",
"Author": "Microsoft - support@microsoft.com",
"Logo": "",
"Description": "The Google Cloud Platform (GCP) firewall logs, ingested from Sentinel's connector, enable you to capture and track all network activity that occurs in your GCP intances. These firewall logs provide valuable insights for monitoring user activity, troubleshooting issues, and ensuring compliance with security regulations. They serve as a record of events that practitioners can utilize to monitor access and identify potential threats across GCP resources.",
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json b/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json
index fd566500d2d..68059a28d46 100644
--- a/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json
+++ b/Solutions/Google Cloud Platform Firewall Logs/Package/mainTemplate.json
@@ -46,7 +46,7 @@
"variables": {
"email": "support@microsoft.com",
"_email": "[variables('email')]",
- "_solutionName": "Google CLoud Platform Firewall Logs",
+ "_solutionName": "Google Cloud Platform Firewall Logs",
"_solutionVersion": "3.0.0",
"solutionId": "azure-sentinel-solution-gcpfirewalllogs-api",
"_solutionId": "[variables('solutionId')]",
From cbe45518b6b788198885f949c5aaa458e75b5ca7 Mon Sep 17 00:00:00 2001
From: Ido Shabi
Date: Tue, 12 Nov 2024 11:01:27 +0200
Subject: [PATCH 04/75] fixing syntax issues and parameters
---
.../connectorDefinition.json | 6 +++---
.../Package/3.0.0.zip | Bin 6429 -> 6543 bytes
.../Package/mainTemplate.json | 12 ++++++------
3 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json
index e05dc516cb1..56f4aab4ce7 100644
--- a/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json
+++ b/Solutions/Google Cloud Platform Firewall Logs/Data Connectors/GCPFirewallLogs_ccp/connectorDefinition.json
@@ -62,8 +62,8 @@
{
"type": "MarkdownControlEnvBased",
"parameters": {
- "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation).",
- "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)."
+ "prodScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation)\n Connector tutorial: [Link to tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup) .",
+ "govScript": "#### 1. Set up your GCP environment \n You must have the following GCP resources defined and configured: topic, subscription for the topic, workload identity pool, workload identity provider and service account with permissions to get and consume from subscription. \n Terraform provides API for the IAM that creates the resources. [Link to Gov Terraform scripts](https://github.com/Azure/Azure-Sentinel/tree/master/DataConnectors/GCP/Terraform/sentinel_resources_creation_gov)\n Connector tutorial: [Link to tutorial](https://learn.microsoft.com/en-us/azure/sentinel/connect-google-cloud-platform?tabs=terraform%2Cauditlogs#gcp-authentication-setup)."
}
},
{
@@ -73,7 +73,7 @@
"fillWith": [
"TenantId"
],
- "name": "PoolId",
+ "name": "TenantId",
"disabled": true
}
},
diff --git a/Solutions/Google Cloud Platform Firewall Logs/Package/3.0.0.zip b/Solutions/Google Cloud Platform Firewall Logs/Package/3.0.0.zip
index 3980bf3c345a15f690ea091af442bddc50a2c134..96b57d723530c96206ac8dfd299fb470dc0d9b42 100644
GIT binary patch
literal 6543
zcmZ{JWl$VIlr-+{7F>eM;w+212Pe3@E$$8puF2vaAYpNWyN3mW!{QoTf=lw{uCA`G
z>b{#-HC;0`uX_G4waWE2tv1OyC(BPToKZybUT#%Kr#BZLSDTfWd*noSX9OKbAj!
z0X7jnYdg{obJR{vy7G#X7Ze@j(qZ;M)@SpL|LpX;^^id7W$k{J$(mdVByUh<7huVH
zxWF3az0X`Fi5d(Px!rsQPtF~yVp7|LwfACzM{0KSopQXf8I%JIF9i%%-hDeJ|C7yE
zH-uhE++`}@6tJAn^_kEM+!+M%Bz8%MPh69xL&ttS9CukMHEA>x`I&KH4GM9Y@a?r<
z6=wa_D%!0WYs-)1ipZBVZ1hxxoff|19G}kL>}1hT-@4EpKYe#Zk}C31-smN?%D|p=
zK~;ZNmsg^@TBdl+K&P4Yi}#|w<$`YnD8=*;IC85OI
z%eQR1W0Bm*g)|a&D(m(+KWoK_M)a4&{Jk&J00sRiiG#AFIk`MbL!N2jJuQnWq9s~_
z^RpzQ4WHmRntDLY0Zm=NaOsh=Z?6lU%SGW6{ioNPVosTL_g55Bosm5q0IhxUKK;wB
z0xO-~3IN>h0;d?z`9p{vX!bGHUVebZk8ms<_k5cdF-!Yi4WyFn{)P--_<#)+GIw=>n}^>V<0#
zr09Dp(z|I@`h_<>qgaE@v^VISy%E0}_EsjKqmo3UnPY*XnD?w6QJ{qjEWu+ll}3XP
zbHNu=VfS$srl+g#V?xVE+urB%F=u$rSI2E~7oTvE&pF$51chC^Z1`Nv`dqAGMEEO+
z0C_&kO5cHFQ3^$2RpbFJszWon8dR%wJ<4;`PQg
zejN*m46bWhjTlJAD4G>8TxX`$_;>#HK#FXr2i^wNBT|E)jgB{7=H4KDp6O^EWzEU;
zsH>kqjKfH!#^;;g7&Y)ocQEyPX@OJ1WK(zsRf&0NcXcPaALQi|Y|wY14N}wDRQ;w~
zt|ZnLbCcZQ+Cs(q=+FRN2Y-P#tsu|j&&DEFxEbAZTF(a^Ptms0ke?#eixObr+?cxe
zcHIV4ML+QjIte?>zOC@n-T6&+-U=VK9weB59k@_bUfgWoIunHNcvd+5;3=h6v%Q`M
zG0AfDPS;4btXjSryq57Mx*hJ?>L(1H#pB7f`!>_jor9UNo=!v0Q)i@7FG*(br~h7H
zNHD!dTlL`k^Qj#?$_9H9|IVG0wa_ue|)HL`nV#2>$@V
z&C1DL&(6)$^`9pFrw*N&y}nx$CivS62t|jr6d)gfBFZfwg50PXe5kUKIY$I>$F5$7
zTTP}vK=kZ@&>WCSQF&*^ernT&=G{8WYlJ4|@~pFe%c@yznD|EM3n4?YR;-Yv+-iU<
zRW#qtaHhMVluPNuuYrN^wW6s@6Np(*}J^BvB*6P+MjP}E)nu*MGg8;d$CmV
z62|TW3Bp9?r_&e|L8zW$^?wjAuTXM|W(p(~w0W2D+gKDoaIU-E^@5;PbA4WgJ
zT#3AQbQv&k8m*Y5Rpsm$
zWW})V?f#a_>fzN~n8i4(uK{g{aL7Iq5XDf31j>Tle^;I@DS7NMlv+D!S5q;VyJ%zN
z{CYx@M2u$YMB4-c%4)E?u*&A86;jKrT1Mg2GTN$wU|c{yNUW65`|5>ng165H$H&92
zE9tt#fYT^o?E}Ln>`1XG|pz>=Y1u20(3*Ie>*yUIo0%=7@mR{
zU1Kn*%*u)^H(eDZnYa>3+5{&`ppDmY
z!u0IwLdcYhq}L_2L|AR(bxUHZKLg6Uvh(%F}+)I-Qdn5@6!)o$oO00
z30TDJ>f9oJ^;5+{uI8~JVR{P56+
zL!G{}F(iFkA;MXgoH>6#ukRoWbYn}u+yS=#6nshN6OE=3=5(;kaXc01MvA#
zA;Wz^hx}#(AjhuhxM`9ix~`;VsdYM}-pFjVN`aLmGI}xyatl-9xb=8Oq!v46og*3i
zmj3F1vlnBmvlZiy86KFutRI4x#&g3h{$sw`+qm1dD{I#;Cp7_
z3imG}C2`F`X<^3CQ`1=q2=-D6v8xZ&z8cRNn(dee-gAk10`=IITt2g=^kF3!C;PUi
zjoz7AZ*{)@B;>317yZ(p%c`VP7ff_J0*GW}k`gVnwPTYAf->yU7YgTf@m*Lwf9+BI
z-hasIm#eF1Wf)WxUX4k%NxH81l)W%!ZRlloGNvXuj_KCA)Jy9xd$shkq22i2md7Cq
z9F!W<=j%EEPsezi2~6bpA)MF1tV=xi@@Eg>#8A`XJ7=@cX`I!F2vmp72e#yx^H_B#
zZryjSUvM=tEIEaU3v~-)$_~c5jk$guz^ZRjg$mMrUigmjTRVL(MX9asdllUPM_jIQ
z!fzzsWZG0uTqnR`2YY{gzSCq%Lh#fNKn?kmb6y
z(E@u)J``~=UfO7oPtRKkRc`Sjt*_I+BDbyABkR7GH#kHG$}H0_*Cf^~*!mpSZyC?+
zL=>hV?PHT3p2vRflKP^_r^P~jf=%$|&FWEsg_dg)x-O)Ekv&I}Pn2%dKrpye=ejM;
z>lkMR`=Delu4V@y`y66t1Fpxyl^3Lu4GH{8mF_W?wgKH+twSog;Ve1ANVTyN?aG81
zk{6qbM~S1KiSaz7%pZ}#c+0JrGps!!He^a1xiV#($5;l7JjtgD_jD5VZV5xh1||-T
zzVjg}3Ov?)>$pg0LW<3@LlP
z;S9h$P=(rhr63afl^bc=GWxg3mOmRT9?Sx-E{Gj|#exYbDX{`FZc2Xb4$@oKR^xhT
zWB!|E-WE^`S2Vh&Sx}7JiS7?8#0sH(Vd$%}-D9>5<95g`Nx!Lcg+qL6beYv_kk8M9
z$}Xxulhh_se}K$Eappkjk@)B@C_Q6}=*~Ypm-lRiDN
zupo=Sb5Js*!Gelt%cjHTGD)fDG%FWVSpZ8IT*R(X&nXLx?NlP=ddh0OgRv*xM!_k#
zgVx6f;PV{Gr9`z9Mk79NuDJ0xsS)ecY&5py+^i9yWX>t{i&cOk8s0Zq*IB5D!$4kI
zgrODjRkh_cxOhaklQP#N$uk
zdlb>^poQsY_Vd1Nvpdb_)ldlScW(7mcvwDdIQ4Ad1M566thHT(369Ah`xgc4)(wcQ
zD0^j90UR{qZu@C1KBd0%A^Vcmd(eJ&Ow-qo~MBNqq7Y}?Ix@vRI
z7#*F6vR_H)w`Q3eETJ`KV9K9b`#510*~p=!9D-ERRu-qxMi+Z&MrACpKc111n^}pc
z@#`U@;0y&yvm_b4;gwZzSJA%N1P0jVE|cA_&cUA_~y#cU75;E%N*~2-&9)45TeCC{UA2Okzht{
zlr-wDOwjMRMMc4-8Rh2whOkuakTz48J$SRv)UF2f=6a$@?+l~S*{LXl;K7ei$%P>J
z2GoWszZzp%sV!wa5eu!|J_vWy0Au2AuW)*})mDVG!cb*OxcMDS+Wv?QgsdyVNKK>5}U%sPz)Zz)Z0fXBgcX=%e3MBuA
zoNdi_NC0E+J!(hM*-|~O{)i1eQ!0NDlU$s65T}a
zq@AuF_nwxVF>#-P5}c@=Ox9pJ+L1%nXa^6>ZD?u1coKHZaOZA{D>JLvyAh57FsGIr
z4QB-s2}oH2k$k%_@}1#Xc7W#E8()-T6AFumi2yh|oVrB=UV(r86rdFkqk#GryJ<3W`zFD4k=-K*O?(s4MO{H7
zt#AvoPK}v+I3c^X(|VMI{F6^XaU97O&IWu4zcS+3pIA&l>=WnkgPC($5j%iCZ6==@
z!vOK7c>geiRQqG>pnB7;GP!p>moz;sQ*X3jwz-VrX9qhPWiNJ^PLIVH(q|79&JYvT
zz>h30-#<$^SNY7=PcCCnKc23fOx-nDIX)rDX6h*CMx;o@>4jEXMxVNJc)n?_BR+SH
zgR_fSH>gbbSujnyEKDZ8g+~#vXq3wX@P)Yjn**7I4_d^8w6A7v#qf?{QZ
z)uYJOxGkduNc1Y%6S0N;5Okssl{NWgAus8ebi|imhm8y8H9PXEe}GX}^djB*922U~)AK+sSv+mQWs_M=4l
za(81VGI(eT^IlT?eGZ*hL0@EVFtnvvM7YnUE{DD7}g*H-8XaNh;4DT^vdATW;!)uXa;ZV-ka1
z;9H1T49>2u-55oZ88M>)!3+tOJqltpNG&>q8}nEnd&dsrtOn^Q7jr)scUvIB9TwvX
zTdlH4g1fW4B~v!13_=aX(acOLHc*UL#hNsw_8>C73q<_!X3EhpBLtmr@pXO0f
zvaCWT8zhBN?DQ@ea~w2rv~W+S*d@DeHBfL&9>SlQli4R1}-y3qvd5`%S9S|G?a
z(X$j*&Qu1m9S5dy!ka|n*7gVe6Z5Hv;I_%|GY9mNMLH1R7u^#?MpR7g@msMi!z-_p
zpmMkB=-W6)J@+2FD*!jFMd~qHAhT}g%f2S+X+;1ZKzN$%TYTb*>(tg@D^e^Q-}Y_+
z|2Zbr50N2N^Yp!S*9Vd)^!vC$j0va9Xfs(2eWLtk4MGVaW1+5lv?_JOyqK;z@z;OQPXc5CYu;SY=!4BS%F
zM?6;L?W^n;U@O4^qY-nv;s)pllv&YcY6NcovSsT_4tOoa*_VhKr-e^ft|)l#et58z
z6(PPyR;bbaj?Wh}u85i1{rU50MQ8y`i`dzOg2V>%>BdE3*qGuZ1sP%vetOtWfh9=@
z_tSiG&9HSVgbPz-{Bij1dVrDNUgNMn>$|=s-fl0R`>o%a=RKHl#JQR^oSyTj(A<$d
z0`kKW89+RH+8z68TRSfG%b%t%1Y_+>;eHsRPi$J9R~~(D%8;&54HI;?ZN>&@k*5}l
zphzRzA42Lh$j2V0&4Z<1>ZJZKk9u=}amRF3(WIa9mXgJ1BqZ5Ozmhzy9CYZhzkJQc
zl5%btNUd5v=g(v;$u9*oTZj}6YbAu-G^-WuKY+5yapG?9%DJsRo6GT=FtRKOJMeIX8qNE%SvBocu>8W7(fxbHSG!tC
zuX11%)}T_NG=M_puTHPHX^UjgX)?q#qLw!rH9wKFtqBw|f9Av3{8DH$_gDOFKHG-T4Pc>~9
zC3){pR5`&+Mqq9Ntly^93JFzFMN8V*T1H*$h)L-WY4?0z@xt*bj(S6*YcgBu;P_E}
ziE)HA<6KDKhc}ax#81Zkh6G_XzWz}86pm(!vwpW`qM7vO$;}Ux<3qEEf(D8psl0iRaP2$
zXI!rtu-3s1Z|%kJ8<@d-F#qd|>iBQ?pG5!LiTa;JDgV-v|K&^lPl}DQBYi5t{~rbFzg7eUq<=N}
L4{Is@