From f73d8e8f27dc2c78a10bced48fb26a27efe49fd2 Mon Sep 17 00:00:00 2001 From: thbanasi <54327442+thbanasi@users.noreply.github.com> Date: Sun, 27 Feb 2022 14:42:43 -0500 Subject: [PATCH 1/2] ZeroTrust_Solution Update Version 2 --- .../ZeroTrustDNSFamilyControlsMonitoring.yaml | 48 - ...ataProtectionFamilyControlsMonitoring.yaml | 48 - ...eroTrustEmailFamilyControlsMonitoring.yaml | 48 - ...ustEnterpriseFamilyControlsMonitoring.yaml | 48 - ...eroTrustFilesFamilyControlsMonitoring.yaml | 48 - ...sionDetectionFamilyControlsMonitoring.yaml | 48 - ...ustNetworkingFamilyControlsMonitoring.yaml | 48 - ...ustResiliencyFamilyControlsMonitoring.yaml | 48 - .../ZeroTrustUCCFamilyControlsMonitoring.yaml | 48 - ...yCapabilitiesFamilyControlsMonitoring.yaml | 48 - .../ZeroTrustWebFamilyControlsMonitoring.yaml | 48 - ...TIC3.0_ControlAssessmentPostureChange.yaml | 47 + .../Open_DevOpsTaskRecommendation.json | 170 + .../Open_JIRATicketRecommendation.json | 158 + .../Preview/ZeroTrust(TIC3.0)Black1.PNG | Bin 122414 -> 0 bytes .../Preview/ZeroTrust(TIC3.0)White1.PNG | Bin 122883 -> 0 bytes .../Images/ZeroTrust(TIC3.0)Black1.PNG | Bin 0 -> 395379 bytes .../Images/ZeroTrust(TIC3.0)White1.PNG | Bin 0 -> 393087 bytes .../Workbooks/ZeroTrust(TIC3.0).json | 34552 +++++++++++----- Solutions/ZeroTrust(TIC3.0)/readme.md | 59 +- 20 files changed, 25279 insertions(+), 10235 deletions(-) delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDNSFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDataProtectionFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEmailFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEnterpriseFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustFilesFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustIntrusionDetectionFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustNetworkingFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustResiliencyFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUCCFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUniversalSecurityCapabilitiesFamilyControlsMonitoring.yaml delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustWebFamilyControlsMonitoring.yaml create mode 100644 Solutions/ZeroTrust(TIC3.0)/Analytic Rules/Zero_Trust_TIC3.0_ControlAssessmentPostureChange.yaml create mode 100644 Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_DevOpsTaskRecommendation.json create mode 100644 Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_JIRATicketRecommendation.json delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)Black1.PNG delete mode 100644 Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)White1.PNG create mode 100644 Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/ZeroTrust(TIC3.0)Black1.PNG create mode 100644 Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/ZeroTrust(TIC3.0)White1.PNG diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDNSFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDNSFamilyControlsMonitoring.yaml deleted file mode 100644 index d45fca231a8..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDNSFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: 6d737820-2ae6-4328-b62b-9a43e8f6692e -name: (Preview) ZeroTrust(TIC3.0) DNS Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'DNS' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDataProtectionFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDataProtectionFamilyControlsMonitoring.yaml deleted file mode 100644 index 708e8233423..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustDataProtectionFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: 6289c9d2-b9c4-4a4c-927e-36a717113b58 -name: (Preview) ZeroTrust(TIC3.0) Data Protection Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Data Protection' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEmailFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEmailFamilyControlsMonitoring.yaml deleted file mode 100644 index a526c9eaa5e..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEmailFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: b237d2b9-b8e6-48e0-b3dc-1430b429e8c5 -name: (Preview) ZeroTrust(TIC3.0) Email Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Email' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEnterpriseFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEnterpriseFamilyControlsMonitoring.yaml deleted file mode 100644 index 0b8ad5d93a1..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustEnterpriseFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: dc618145-bec3-437b-8a70-8b4d4d4e28e3 -name: (Preview) ZeroTrust(TIC3.0) Enterprise Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Enterprise' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustFilesFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustFilesFamilyControlsMonitoring.yaml deleted file mode 100644 index 9f3297db60e..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustFilesFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: 618ab10b-fe9a-454f-9a80-1b0a6a9f8cb1 -name: (Preview) ZeroTrust(TIC3.0) Files Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Files' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustIntrusionDetectionFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustIntrusionDetectionFamilyControlsMonitoring.yaml deleted file mode 100644 index 3a751d88bf9..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustIntrusionDetectionFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: 555c9a75-71f0-406b-943c-42e007211916 -name: (Preview) ZeroTrust(TIC3.0) Intrusion Detection Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Intrusion Detection' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustNetworkingFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustNetworkingFamilyControlsMonitoring.yaml deleted file mode 100644 index 4b26082b2b6..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustNetworkingFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: f0f614c5-a660-4994-8f80-f6a5b6e85021 -name: (Preview) ZeroTrust(TIC3.0) Networking Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Networking' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustResiliencyFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustResiliencyFamilyControlsMonitoring.yaml deleted file mode 100644 index 4fdd86ec3b3..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustResiliencyFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: c67c454d-043d-4eaa-ac50-712973d767a1 -name: (Preview) ZeroTrust(TIC3.0) Resiliency Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Resiliency' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUCCFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUCCFamilyControlsMonitoring.yaml deleted file mode 100644 index 3c8ff1a2033..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUCCFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: e3d75cd2-37e5-457f-a7d2-781de9bfa3cf -name: (Preview) ZeroTrust(TIC3.0) UCC Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Unified Communications & Collaboration' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUniversalSecurityCapabilitiesFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUniversalSecurityCapabilitiesFamilyControlsMonitoring.yaml deleted file mode 100644 index db320f4713b..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustUniversalSecurityCapabilitiesFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: 377553c4-8a99-4171-ac6a-be12c4d0d1b8 -name: (Preview) ZeroTrust(TIC3.0) Universal Security Capabilities Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Universal Security Capabilities' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustWebFamilyControlsMonitoring.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustWebFamilyControlsMonitoring.yaml deleted file mode 100644 index ff3de09d581..00000000000 --- a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/ZeroTrustWebFamilyControlsMonitoring.yaml +++ /dev/null @@ -1,48 +0,0 @@ -id: fd759ce2-e108-48ef-83c4-a1bb9886a6de -name: (Preview) ZeroTrust(TIC3.0) Web Control Family Monitoring -description: | - 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' -severity: Medium -requiredDataConnectors: [] -queryFrequency: 7d -queryPeriod: 7d -triggerOperator: gt -triggerThreshold: 0 -tactics: - - Discovery -relevantTechniques: - - T1082 -query: | - let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv"] with (format="csv", ignoreFirstRecord=True); - SecurityRecommendation - | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName - | where Family == 'Web' - | summarize - Assessments = count(), - Success = countif(RecommendationState == 'Healthy' or RecommendationState == 'NotApplicable' or RecommendationState == 'Removed'), - Failed = countif(RecommendationState == 'Unhealthy') - by Capability, Family, RecommendationDisplayName - | extend SuccessRatePercentage = (Success * 100 / Assessments) - | extend FailedRatePercentage = (Failed * 100 / Assessments) - | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/22') - | project - Capability, - Family, - RecommendationDisplayName, - Assessments, - SuccessRatePercentage, - FailedRatePercentage, - RemediationLink - | where RecommendationDisplayName <> '' - // | where RecommendationName <> '' //Filter Out or Suppress Recommendations - | where FailedRatePercentage > 30 //Adjust Either FailedRatePercentage or PasedRatePercentage Thresholds within Organizational Needs - | sort by FailedRatePercentage desc - | limit 250 - | extend URLCustomEntity = RemediationLink -entityMappings: - - entityType: URL - fieldMappings: - - identifier: Url - columnName: URLCustomEntity -version: 1.0.0 -kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/Zero_Trust_TIC3.0_ControlAssessmentPostureChange.yaml b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/Zero_Trust_TIC3.0_ControlAssessmentPostureChange.yaml new file mode 100644 index 00000000000..50746bb0b34 --- /dev/null +++ b/Solutions/ZeroTrust(TIC3.0)/Analytic Rules/Zero_Trust_TIC3.0_ControlAssessmentPostureChange.yaml @@ -0,0 +1,47 @@ +id: 4942992d-a4d3-44b0-9cf4-b5a23811d82d +name: ZeroTrust(TIC3.0) Control Assessment Posture Change +description: | + 'Zero Trust(TIC3.0) Control Assessments have Deviated from Configured Threshold Baselines' +severity: Medium +requiredDataConnectors: [] +queryFrequency: 7d +queryPeriod: 7d +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Discovery +relevantTechniques: + - T1082 +query: | + SecurityRecommendation + | where RecommendationDisplayName <> "" + | extend ControlFamily=iff(RecommendationDisplayName has_any("email"), "Email", + iff(RecommendationDisplayName has_any("apps", "teams", "meeting", "call"), "Unified Communications & Collaboration", + iff(RecommendationDisplayName has_any("dns", "domain"), "DNS", + iff(RecommendationDisplayName has_any("endpoint protection", "malware", "file", "files", "IaaSAntimalware"), "Files", + iff(RecommendationDisplayName has_any("Security Center", "defender", "adaptive", "HoneyTokens", "honey", "deception", "intrusion", "incident", "incidents"), "Intrusion Detection", + iff(RecommendationDisplayName has_any("firewall", "watcher", "proxy", "certificate", "url", "web"), "Web", + iff(RecommendationDisplayName has_any("network", "segment", "network security groups", "subnet", "application gateway", "security groups", "IP forwarding", "port", "ports", "networks"), "Networking", + iff(RecommendationDisplayName has_any("backup", "denial", "DDoS", "load", "scale", "front", "traffic manager", "pool", "disaster", "region", "redundant", "geo"), "Resiliency", + iff(RecommendationDisplayName has_any("encrypt", "rest", "transit", "data", "http", "https", "TLS", "transfer", "transit", "Secure Socket", "SSH", "just", "FTP", "server-side", "storage", "database", "databases", "SQL", "disk", "disks"), "Data Protection", + iff(RecommendationDisplayName has_any("private", "vpn", "automation", "playbook", "logic", "notification", "authorized", "safe", "network gateway", "express", "VPC"), "Enterprise", + iff(RecommendationDisplayName has_any("recover", "log", "configured", "configuration", "identity", "privilege", "admin", "authentication", "JIT", "just", "password", "time", "sync", "vulnerability", "Vulnerabilities", "updates", "update", "upgrade", "audit", "account", "guest", "shared", "access", "machines", "rights", "VM", "key", "keys", "IAM", "EC2", "GuardDuty", "logs", "CloudTrail", "MFA", "External accounts", "accounts", "config", "credentials", "privileged", "owner", "owners", "login", "logon", "virtual machine", "container", "containers", "Kubernetes"), "Universal Security Capabilities", "Other"))))))))))) + | summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName + | summarize + Failed=countif(RecommendationState == "Unhealthy"), + Passed=countif(RecommendationState == "Healthy"), + Total=countif(RecommendationState == "Unhealthy" or RecommendationState == "Healthy") + by ControlFamily + | extend PassedControlsPercentage = (Passed / todouble(Total)) * 100 + | extend RemediationLink = strcat('https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5') + | extend URLCustomEntity = RemediationLink + | project ControlFamily, Total, PassedControlsPercentage, Passed, Failed, RemediationLink, URLCustomEntity + | where PassedControlsPercentage < 70 //Adjust PassedRatePercentage Thresholds within Organizational Needs + | sort by PassedControlsPercentage asc +entityMappings: + - entityType: URL + fieldMappings: + - identifier: Url + columnName: URLCustomEntity +version: 1.0.0 +kind: Scheduled \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_DevOpsTaskRecommendation.json b/Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_DevOpsTaskRecommendation.json new file mode 100644 index 00000000000..89d0153a3dc --- /dev/null +++ b/Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_DevOpsTaskRecommendation.json @@ -0,0 +1,170 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Create-AzureDevOpsTask", + "description": "This playbook will create the Azure DevOps task filled with the Azure Sentinel incident details.", + "prerequisites": "", + "lastUpdateTime": "2021-07-14T00:00:00.000Z", + "entities": [], + "tags": ["Sync"], + "support": { + "tier": "Community" + }, + "author": { + "name": "Nicholas DiCola" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "Create-AzureDevOpsTask", + "type": "string" + } + }, + "variables": { + "AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]", + "AzureDevOpsConnectionName": "[concat('azuredevops-', parameters('PlaybookName'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('AzureSentinelConnectionName')]", + "location": "[resourceGroup().location]", + "kind": "V1", + "properties": { + "displayName": "[variables('AzureSentinelConnectionName')]", + "customParameterValues": {}, + "parameterValueType": "Alternative", + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('AzureDevOpsConnectionName')]", + "location": "[resourceGroup().location]", + "properties": { + "displayName": "[variables('AzureDevOpsConnectionName')]", + "customParameterValues": { + }, + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/visualstudioteamservices')]" + } + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[parameters('PlaybookName')]", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "Create-AzureDevOpsTask", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "dependsOn": [ + "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "[resourceId('Microsoft.Web/connections', variables('AzureDevOpsConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "actions": { + "Add_comment_to_incident_(V3)": { + "inputs": { + "body": { + "incidentArmId": "@triggerBody()?['object']?['id']", + "message": "

Azure DevOps Task created: @{body('Create_a_work_item')?['url']}

" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "method": "post", + "path": "/Incidents/Comment" + }, + "runAfter": { + "Create_a_work_item": [ + "Succeeded" + ] + }, + "type": "ApiConnection" + }, + "Create_a_work_item": { + "inputs": { + "body": { + "description": "Incident Description: @{triggerBody()?['object']?['properties']?['description']}\nIncident Severity: @{triggerBody()?['object']?['properties']?['severity']}\nIncident URL: @{triggerBody()?['object']?['properties']?['incidentUrl']}\n", + "title": "New Azure Sentinel Incident: @{triggerBody()?['object']?['properties']?['title']}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['visualstudioteamservices']['connectionId']" + } + }, + "method": "patch", + "path": "/@{encodeURIComponent('test')}/_apis/wit/workitems/$@{encodeURIComponent('Task')}", + "queries": { + "account": "test" + } + }, + "runAfter": {}, + "type": "ApiConnection" + } + }, + "contentVersion": "1.0.0.0", + "outputs": {}, + "parameters": { + "$connections": { + "defaultValue": {}, + "type": "Object" + } + }, + "triggers": { + "When_Azure_Sentinel_incident_creation_rule_was_triggered": { + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + }, + "type": "ApiConnectionWebhook" + } + } + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "connectionName": "[variables('AzureSentinelConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "visualstudioteamservices": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureDevOpsConnectionName'))]", + "connectionName": "[variables('AzureDevOpsConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/visualstudioteamservices')]" + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_JIRATicketRecommendation.json b/Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_JIRATicketRecommendation.json new file mode 100644 index 00000000000..8eb05e8cae2 --- /dev/null +++ b/Solutions/ZeroTrust(TIC3.0)/Playbooks/Open_JIRATicketRecommendation.json @@ -0,0 +1,158 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "metadata": { + "title": "Create Jira Issue", + "description": "This playbook will open a Jira Issue when a new incident is opened in Azure Sentinel.", + "prerequisites": ["1. Jira instance (ex. xyz.atlassian.net)", + "2. Jira API", + "3. Username."], + "lastUpdateTime": "2021-07-14T00:00:00.000Z", + "entities": [], + "tags": [ "Sync" ], + "support": { + "tier": "community" + }, + "author": { + "name": "Yaniv Shasha and Benjamin Kovacevic" + } + }, + "parameters": { + "PlaybookName": { + "defaultValue": "CreateJiraIssue", + "type": "string", + "metadata": { + "description": "Incident trigger" + } + } + }, + "variables": { + "AzureSentinelConnectionName": "[concat('azuresentinel-', parameters('PlaybookName'))]", + "JiraConnectionName": "[concat('jira-', parameters('PlaybookName'))]" + }, + "resources": [ + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('AzureSentinelConnectionName')]", + "location": "[resourceGroup().location]", + "properties": { + "displayName": "[variables('AzureSentinelConnectionName')]", + "customParameterValues": {}, + "parameterValueType": "Alternative", + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]" + } + } + }, + { + "type": "Microsoft.Web/connections", + "apiVersion": "2016-06-01", + "name": "[variables('jiraConnectionName')]", + "location": "[resourceGroup().location]", + "properties": { + "displayName": "[variables('jiraConnectionName')]", + "customParameterValues": { + }, + "api": { + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/jira')]" + } + } + }, + { + "type": "Microsoft.Logic/workflows", + "apiVersion": "2017-07-01", + "name": "[parameters('PlaybookName')]", + "location": "[resourceGroup().location]", + "tags": { + "hidden-SentinelTemplateName": "CreateJiraIssue-Incident", + "hidden-SentinelTemplateVersion": "1.0" + }, + "identity": { + "type": "SystemAssigned" + }, + "dependsOn": [ + "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "[resourceId('Microsoft.Web/connections', variables('JiraConnectionName'))]" + ], + "properties": { + "state": "Enabled", + "definition": { + "$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "$connections": { + "defaultValue": {}, + "type": "Object" + } + }, + "triggers": { + "When_Azure_Sentinel_incident_creation_rule_was_triggered": { + "type": "ApiConnectionWebhook", + "inputs": { + "body": { + "callback_url": "@{listCallbackUrl()}" + }, + "host": { + "connection": { + "name": "@parameters('$connections')['azuresentinel']['connectionId']" + } + }, + "path": "/incident-creation" + } + } + }, + "actions": { + "Create_a_new_issue": { + "runAfter": {}, + "type": "ApiConnection", + "inputs": { + "body": { + "fields": { + "description": "Incident description: @{triggerBody()?['object']?['properties']?['description']};\nSeverity: @{triggerBody()?['object']?['properties']?['severity']};\nIncident URL: @{triggerBody()?['object']?['properties']?['incidentUrl']}", + "issuetype": { + "id": "10007" + }, + "summary": "@triggerBody()?['object']?['properties']?['title']" + } + }, + "host": { + "connection": { + "name": "@parameters('$connections')['Jira']['connectionId']" + } + }, + "method": "post", + "path": "/issue", + "queries": { + "projectKey": "SOC" + } + } + } + }, + "outputs": {} + }, + "parameters": { + "$connections": { + "value": { + "azuresentinel": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('AzureSentinelConnectionName'))]", + "connectionName": "[variables('AzureSentinelConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/azuresentinel')]", + "connectionProperties": { + "authentication": { + "type": "ManagedServiceIdentity" + } + } + }, + "Jira": { + "connectionId": "[resourceId('Microsoft.Web/connections', variables('jiraConnectionName'))]", + "connectionName": "[variables('jiraConnectionName')]", + "id": "[concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Web/locations/', resourceGroup().location, '/managedApis/jira')]" + } + } + } + } + } + } + ] +} \ No newline at end of file diff --git a/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)Black1.PNG b/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)Black1.PNG deleted file mode 100644 index e47ebfd0128ebe37e6b9ad0b163ce11a4784d9c6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 122414 zcmeFYcT`i`w>BI=K}5tODk9Bu6c7moHocfdmXdAYQ^Qe&Eg)>-!Jj4^PlFqrX9Ay^{05haH}V=7u29$0Q-< z&7Ht!!8@1jfILy`0RLK@7>OuVxgVJ?{*$at9rWc@4sXBJuUBsHa5hPJDPJbP{f9- ziaiY41Z72FuwmD+84GG*1sS>XNKRduOi#8|!IkSd3;rSFRw3KblqiA_4n)wyh$6piR;i0=n%cTTLN4xIq`GZki)v&+|7~c#DNmoiMZ-R)NRYap z9d0Hcz0W-BYGx00G>JXLoa^`IF@V(+I4s+khCP5|sTd}Xxdg{cC20oCJEE4Z$)mDg z!R*CfIq069hj;kvw3T8d|B#|}Zw8(!^*N7nVm&{q_ODo=NPO*%P1TvMwxZK{`Y6o| z<&9)~=tCXU;w~tz^jM3y2s6}I%1gUz_?(Ju7%%d_9(F=QFnCyRD{zEli?Y~O-sT`; zn6xQpvf5D4lTu({*DP<4eQZBLe!f5MzRAAI5gtp}Lyzdt0u;u{RuN)vpnCA~kO!(g z{tLU=*PTkMYpja=znj_QKKaz)vp$|}Lu+(|sU&DFN6Dw{@B)?wz!gaBMMz%~Trp|7FjBDV<$r zuh?>4GC!|FblS?n;TqAzueP7Hv^a9i$Z28k?OgSDtfCbxY)>19iGFxzO}Zf~Myr`) zF-761v2?s%?_CIr+L}iJc23|hVDhN*?DJc=D%M-q?_ur!{00s7y>r_r{7oEt2n!bB zP~0TGbY~<5*2B5mtGy0micKM6wrDpI&pB#L>hn#`8Y2eAaN44y*hcG&-034j)Tep2 zd`Rf&YeM!O+xurRpM&q|aT6*asR)D}BD`4N_M+yQp+e!U%MLJ8wNECTW{d z>rv8SYTkUl1C@Mep-_f>GNXg?S)@Gt7!!ZP=`H2i_@3C%>TKKwnKqs?HLNINVVY%H zM=%Ax?_xVd8V~q9k6@|L;jj@>PC1$qGeMVYq-DVb!3;1*n$_I##`GW2Dlj5rbt-z| zo^~hiS@{J)8rPhz)w}@RuF)N@vp=m$h{;GB+30>50J2sr(fN7q8|s@5HA%1uYZvDs zH4kew_RI%ICyig(r2?J8PKCkLAqAgTl62Zo%+9*+tK*nYC!*(J;ihG527KxmW9g5W zaw-Z&H~gE%B8xy+s?3x09P>@o(oVi1N)CbfAfr>9?eF?2)I#TcFaZqtqnQCKpiqtJ zGOVXFw3V4vB1`O&7d#Je2;Zi$&4<~u2=|ljfsAtSLmkeK&O0{Vmx@cAP@z@bFkp)}pPYZ=b9Qwx>2|}hv2~2pM#f4%A$@?e_Hp1% z&~c;$K|XNY^v@8+Qx38DoV->*ol}?v6D*w=_pvCo;Kv5MDr&F3Qd81#yl+RFQPz5h z+On4ET0OY|Hgecm%e(vp?B_Q0kv34f3;gLi)PNuQ0nDV8)c}sg$jTJqK8?8@Hs#4- zax^;JInthCzR}H~V?xSAz+Scbq!Jss`cj|K>$r zu@(zZyaZBjCip?mtqI3^N6JdwMEPU#<+-0x0kk_Z`w!_1_^T4|xoW-Ozd7)jgU3Cur0jeD= z7i7v}HdX9VK(s5Le}D>PzjAI+T0~kwLv!}@8vPO0^CEVYjBRf1*=CNnKSfhWC{~ge zse|uDlzDCU%0o`Yv1sO+?36jU(vOOvK->}=D6Jei*=MT%Wt97=0!O17SU98Rj&a4f zGgAfz-`qM2?GHkt54I^Z6!&-V1^4(+?fUn-YO;F0M=$BvxXAQ`xHs z&OSCXKW|DFyxlXyLBKX{e@Cox!%)i8w|KD!o)gT(kZzr+dmV`Vo1-i4XWgd*(5NgT z$$~?Z>7j&ih~P|wJ7Q#d>#BFIQ%KAAf(KD#{OY6hRZyX1vidU3H;~^T%DxOK%iR*t z-2$hz;4M1G3?0eD5FW@l!U8`L5TzDb&ri&cooWO7HlJLgB6AY9Fq9rj3S@$(4;87d zEiH1X9rKb92JtAT@Mf+_ZCP+osND$3rm)~dOfPb2*JK^l>4gdu9U{SzRWi^%{;{R^ z2n$|1MT{cnp0rro>RKPoUJcyl=@Z{zq)*NW9@BvtC6!TfdFrQFRmgYQ@@hAnq(t;_ z`C%K_+q7$&rsKy?*H0(DeN$DY$EJ2OsC#3#H^84TF;nGkX^Y?{QS_^jZQYxUSg_Rw zv`A?BAh5K;TOEifzY+Ei@FP#uI;@8yB0lhnS-UDfl>ufvy@LnGh;2r!C9iaFre)9+ zpPFb_XxenVa=j6{T&LY>>uPwrJLHm~B^Y#)F_Zpo71Mbibb_lgf#i^#9%Q@ zqV0Ou(uG>%7d`xg+HtPU(SRfUpo9R;IrH`Ig=_;5g+9!Q@Xi<;T)G^VD7sUnT1g{b z6>46WTc2m+`UKvQKp`;hZ+LjQ)OM=Y`?tTdC<)TN%phsSczcAH99>;;YuM(&`7)yv zOxgM@+nnxY2$%!9Z6qD9vJjm(-7fzlYZwa1WKez9qj%`$bPz|!_wp-_jC%dKC2E^U zvZlRAH)jAQ;vaE_IROLV zzNK~~=KE56fd1)9#T*)p!8uNo!!$4$Ic4H#P?NWpeT*37bmtB`s&K4!h-cXz8P*uo z0*g~XfNrm651=Aj`C**pjXQz9HF99z7{%m>=5BrgXL4jt7b`3U(eTEU;B6RM!{SlAN10$4 zAq=Kbe(MFOV26%TFHC!PY@#kFTfj731b zdLuQ4;cG&3(jb5ed+bv{V-Woyi>)rINLGyh=n$BFCgW|bZot?YjiV6ZPXZM+)SN;| zpz?J#5u8uQqL=gYX6ZQ?Up9W_Dd}OxbOvwEYM?WlU7idkc=JNnB(IKE@EdTJ$!@r( zZ4J355MFGan&|=?D`PIPZQ8XBLj=Ny2$%_p(>P2jz>h&dY1>gV^c?Wx_N^;V+%`Ks?-_0pMM{YKsB4iwWH_qNtfjj~?ZQltxWd%}q?%k=v#Q9X_Oc4TD zR|`Ddo)q@7Yp9eqB@wi_X)T2D(DHNPXl_{MqVtmhl?VkU8eEVok~wBJUUvI&q6K5B zT)T_aAT@<)?$PJ7Ub_3^^U8M%cF}YrczI9l*xh&MLYX+Rfif{Dt>I3`F|{{A03wd{ z4q8d+Zo4VMb~?NCnj1Jd++mO|1GaVdjCI83x)sD4DcKf zsF#K{H17&q8u?>+Yvuc$Z2;!8Vw7R6%ck2~ zQ==XPX)EbHT6vo>^sXT<`cJtdZQy*!{aZ_wSX!HYb-ZBQ&vdyscZar9Y*0T-CKDlh zV!Nds{<&lmr#FVe$W8@8nth?oGhfZ8-m1~GI%LMSUeeFy%5Y~xdIl?i7UB>Isfha; zRA&Y6ed|R8X4qk9gQ1>{nO;mz+qSMaJLHqvSS0$7g}dCZ7`P`07(nW`@2Cw>-@a+a%h3AWY^yP9O*69dKi<-UL0JqZ0OXNIK7mv!l512rdy zP1DJ6)8Z@sC_&u3QA=`aZ>e{?(r z*Rf>59X96#FfI+`8i$br3&aY>Q@4m;SA%2Qjh;fVMiCD}LPETAKkuCXaj$QAhd~V6 ztkajrlANxi%&0OzKrSI*XaM(uKO9zxhnev{fxsHi71z@BY;2|=Iuri(cFdzbjrz;m zT03&^?UIbp^X;Ke1W_e)3rITcJ5vrS zR878`*xel7{Fl|8K~#Qdu4|H)gHdE1yA}hMV9#bHhQ1_lw3W6BAr3;Z^{#7C*@W4@ zlt7s`AC{_EIhh|#A>QFG?Z9_C&zzrZn1MVytfP?+`Io~!b;4x94oR&T)?HkWfnW7)ZS z+wzknL2SR#*{>QpjX*#Sc8K%pr!meo183}Sp}0fZ)PWuCOtetX z*Z8|~ci>~p79^hifk>|sf5QH_vPj5BM?Ndd*!}Hm`7~lt;C$sygJ}{S+j9VfK5**5 z>d{$B6V(qYo|c)4Zm2l~3c->`wAXrpe>zyDt{%P}`PGjIiCm?|_Wol03|0?Hf(}Bt zx|QeN2YvYWeux6-q~pGne{MUS|8<(5lmqnLpN5ukh@Yc_g?~Ba6V3iRe{qHe*gt*( zkJumo#1(^tUm@lHzws;Z{eP_w-1)MtImr1+^4Jk)6js{%$W;HoG_3a#?j{+8{PpX} zU*Ts!^)Q6uXAu}jUNpPAk-VqYIq1UK$$pVGLcwMOh}bT-GGd`~B`g%V%ClIiqs#4-=H-u*$A3L-B;;Q+Tl@$rM3ujAzpZigs7AN1N$DP_ zWiUWe>*R=9BxB63mP%=RG4TBa^S%*MZ@YnpNu;YYXKT(1K`+@KDx>*^{Wb`2I)H7STR#R&Q~{UeZkEmFcCv!L*_#?$<$I z|LYug0AXt1$A(sQCC*u;mUN7oL3KuQVki`#AEgY@OFWjSac%U>siVO5Oj`3Iy*7q5 ziCmBiGPwKSRDV1A;Z0o-eJ}uqIJ9eBkG>HwQ1<-~-NCh5o{LJ8aD}-!Qz6N&*`4f) zodzu3YVqO>&)CozB8h_2=mK9)tXey`4}`W>HkLP?^d|pw!E;Xkt}yZx=m>!j(Jh&> zv}^2ZjWx)!|2EG>uw`Zqao0-TPChl?NL&I*QK%B1MDA{n_vvyC0bIOfe?@huF58sSJH)Og0ZQOn(?1(rrNV<}zFClCsb}qYMa2;5~j^EZ$EjX(ez?UmZ`M}dR zTSBHNY8KD)faV1MNj6UW0gR3{RqEOLC&nTE_JDP<@15@`Ch>qQeSe$OyFYBHP7@T_>NC&Nw=*D}#kz#H z#_)lVBfszdyBgLZ(K)l8aCJS9Hc6opRWo&KLl*>k^87aqn#WNg)jWNh4g-8hD@rY+ zKo6NK05bUa>sW%27k(OiyL8lp)@{gx){Bq_)f&(0WFmU>jH>k>^Q)hN7_NLMTkV+j8{pG(wCR_p!X}{ws%%3Y6pcuMJ=5$PllFk1z z8`2-a=erWbD*udIUDVzQzIdzst(^HAmYjwNu#|+~mLkkAjdh93(&&a2@dE>YNNHZy zCVBmD1GjTO_VXKH@JL|X8~RBJkQ4oNrU2k02Yq<@3ZPWN%`Gzj#tmEHPwQ2_n71FlW!92>~Y7v?dC0eU?hwj_kibxpwTG z&MOh2R8giMd1l2#nMIr)OTp2IinayBDX#ey^0!tA_}vM@@p-Qd6xjg!xHCrUWvlRNu71F2PPOa;OCT)_(VS!u!Cb;wfjOk}m zbMz=Py7Ot)XCu$$fJE@8)nn931e_aSEQRBUGU+WIw?2n>PYwv$_^QwI@71$I3xHy8 zbxMI)%MEu(VUa5>d!j`_=*#@gtjNnzAqAyek;HlW_UmZd3nO}q}qk?p1!l(BWz+@OL!f+Nvc;FLKdjp zSgAM0!v@VXQ~*nnEeFkYWWfd$jvkNS<{V?njqMj&$jJL^d=@RaA#iUzHp0kWLh{2s z-T>1amH35F1-phigNNXe<+wc#xvautrM9!tWt9GWCl$Mgo~|M5dGOKMX;40@!8jk8RX~%%_69b=U5Uw?cl{^?2+DUka&1B`tE%$d z#^P-4^9h6w?l0$dvx@4x%MGxi$S;(pB`V%P6O0IFe9~t4{edc*h7iEmCg&MXY$!Ws z(~B&}7+9FCPW92j!rhY@Q>1B>=5$Oi#?;M6!Zs;f|!uHAI75d=Ds*2s%QIEI82Ox~9` zmBwi>bQ2$8p|wJfjtR5tU7?^>;n0SAKGZ1hm5CgZh&QB$uJygzeG)HxoDom{jto30 z187~Iu-L#87N(~)NABJD+Pwfbg2H{aH&*Z`@pY>e-5=2s4~u}^JE&62T#oaQyYZqJ z0ZZ&|d&%UcgZA2W9kcZlEI4B|ht^QynNKBp;%B9Z-8L}nEY$KVY`COTF{B40?~K{H zTdM*O=d6@d)~I+)0A_1rtSOlIgx~XHG27GVSx*IcD8)%1I{Y&%Xz(aL>$k{MafBifkdtPzCO>8t;QAb9`cN@V{|7 zT}U;E*q&^Lp`*)Xz_a~6A?pII#4wc8Ojun$L(WRo5KN zh_}InN79`dwZC>B-~f=!`jFP*0B01oTo5Ha zH`I^^rVZ$c3}U)}V!PnhCBz7FHia<=_^jIvo%v2%4>QGpSoA6kG$^z3T;xdDkyx5$ zSdYv)S~LB<@MFB;av~Z%wcFJ>;SI4 z9NwV9jtL?K<5YL(YNsj=T~QA3qEc>gl2nqiYVvxMY9ng4JNR~gu6A!!x!`az0A3DO z>SP$#O`H(^kr$;qSn14gut*`48;K|b7!9AGrPdIN@YbAj|)LajcNjK z9h>DqM}+1wqE&a$18I*EeQ*TwEY7Gwes%MJGR6#>T<@mnnP2l5ekR$M5TsyV!! z1_M`b-X&$Aqm(*`R9x>MM77!>pH(KkTGPD|)u=b7U*uC(v%2^vGc*Y&?^lUM4}-@s z><|`1QU!?qg?lRYlr+}x`$7{H}V6*XvV zp&>?nLoB08V-aOdHSO12-U3G(JRHZQsHY zO$jCPX`QVRv~h2X4vndbn)_7*uXC<$J3cfQ1x7^ufa?uxyi;Cn?C-_& z9U5Jj4c=geOZddtMwPmEsSQL~GzM%(Y?Is;ROmHX$@A>lZM_L;sLrf+*4EuleADtw zI-*>~ffEe&A$b(*fIuS~+_cxaqE$f3)ibz^^|wg)NynDp6~m6=2wsroo}D`l%t38e z91{3Hv+mu5A+f^C-W?Uf>Ky_PrsKO+UB;8u4E&^Y*6xOclD3yL20X9PnTB_!;PUvo z7-fbvle@++U`7vc zu6e0dzkLkp$R@FJl?dSxKm3*lx{gMeva0KMqtL2N{>;TJP4qQSl=3wj*u#&y-D|{C zelLrjHAmz6RmuTg^NQcnhH&Zf=q7_aNztOoCt+)bLlcMn*Mg!^2%|=)K$bFbjjHNS zUG}M|Nx)uR>s_y#99TF-yhCrNyu?U#5Bmcg!ZsI&TUS7j<&S{oe$)=R6y$Rea5hhe zg(Yhj}l|m@!$RN;!qZzVAR1hob=^GuQdp*9Je^lhm~u>Hv=j| z2It=k49oF%g4DQ)=WeVe1jR3WpWP`^QGLBEXdo$MP;o*N+N7NrCS3>*X3xUA@AB}} z8Xp}BkRR}O7AM+6Km3WOuWE{AEKmrx@Zo^&tq{kUfn^78NI_MRYPwHU$ZAFfwDPNt zN|W9IqwauCQ@|E&u3eI)s+?O}5@bLADr5zJY(k(48)r%i$N;>>a~%uCAp5#dfceLX zydY(i`>tjXn|)cWIMkR;ToDpVz$C#13I(4Q= zalUq3RYx@VnAkZlAn2?U4h=k@*x>!AftE4iO->M{y7C;n@rblKX|r*U{ia$_@6Ag8 zpDHf_YD#u|$Pdg`UuywDk1u>i1{P{OIw~uVe)RKx2B0ocnJp^?K*#+(F}Pk(PBdH_ zZ>H!T&a(_xy&tcv(e%A zsDx)*4iZDi2RYe!-y`;882}=V}RacHBoP1FS;9 zF;IPAWhOuI_blw?=7^$wdri&ievNM#=BG(TbB-D?&T`u%brgu-|$V&s#!&%Q#aD z2?}B(u`O}fA&{rCA>MqG`2cK16$q8x6yXV_RLSIVv!uH(UmNElg#F}N2WAW( zTYpTWRhwsf=W$4~6q2F?P$02gqjl(_B$9MM*z8^UtXCH7` z=vJuFt$Ls&!8)|DZ7_t7NjiOl>a~7k5$v6xyI1zi$|wFH$o_8dRI1P!RqEAzR;t_2z?m67+2RP|(%?nDF@B&C*a8*zB>Kp8`&X1T{h5 zdKM9RiieP|U6*|P&;_&AFVdrHSuyNx@5uGCX3sKJ+IilAoQYbTe+A8Z6~9pTpW6J9 z%gIO&_bf2v%HonA5dX!gXqr>$zXvcPz0o zA|VB|Qh?f7Qk@Dc-_*OHCqw+5G`te$jyfH`osi~}YRLJKJQ*jbY8GXwBw|?_Cl0QP zfo->aUwjQjSq~YtH>SQcJ?&i1Xs|mj$|krxt=ThCqi9SE`7=}64X_RQ&ftbHZIPz8o9lU-`aLjNGJ9)(GSp?DC*~5G??2Q5I9{KR zt>0uRg?wy1*^k~Ob<30SNmkw0P57?p>MQ}L`|MWBv7zY^jSY#~Z|kG%V{*kELGu91 zDxupjS^cd1(LJN*R+x*JWcLI#D`V58fFbJjX)xce!RdcKYdbfvS-h`2gY!y%l5l=3 zNJIeeJ4&_+gXAVidU|+)@SU@Ynh#qC1$ve~+%rP_F-)#Yic~Jn8l$;U&Vp`7KUa=9T9w@ybTnH1+Fegg*3ME=?r zwi_h~k*p}l%+J=_$l_=cweYnPgX$+rxy=zc=R*$xTB|T$;XZ=E?PCDAbbt!~$i=ZK zPjRz~ewH4?t_vvZKE|hlQ~VlGB522WzW>zE^Ssb`592LVG;x zY@N}o8h{e@c0SRR&C^$P)a6&thTXtcYi}ZJJA!zsX`-{V1vJNP!hj*PHJT3|vlJ)+ zn)b!2;LjP{UUy^xH%6xjWuQIy*#%>7_ioZszPxK7huHd_qQCFLZEw_^y4Bfm^UeH| z#K0P78GbeBVSW6GD97zA$KT`BWDT~ma}S*2v^Y9=V7=TI zz2Zf*<@Q`tyZT($qgC#RidO3nmkFVpA7-thCZ0T>0vyYr4{~ioFDSJRli&t3H#23m z8r)OUcniYQ%ZphiJDw6Wy|$Awi)QcTikdZHCuH0setf#nU9IU?0lppadL78uptSL@ zSHu8&i zcKjsn2NZ)!;#qnMXGx(Fmv2b5)zNx+l=O2~$3;tO9wyXe4XJv##=Ty9W?6Lp z8fq$e(C2mF5V^X19+8hQYgBvh*Lb|15WiRNs-97D`fM(T{sITT0C3Zr+E&ZgsRo$4 zYSHdqKIDlnb;OSXGN-N4<@<-o4qFwy#FHFxBq0W?fFudLtODK6ce#n%(>*BHstDuA z)ac3($z=sOVj|8&ljK8NfmveD*5L*lwE@nb%BT?)?z`N)0b}#&=hr&(cdN0Ps@hIEE=F|Ri!hV;#DSMvHU3q!JRwjKTq4-zxRs&(jUeHj*67-0$@S^& zw@M@ekxu9c;~$NNLKt>?;<8fCj5LrD0*iDmH0+RE>{8ny8 zeZoT@l@L#*-80I;opB8!i`jWjA3O8r5z%#JMm3^>74-M?nO!!AC=8z_bgUSeFE*XDgJ<@L^7AGa1g;dhMjgZ?GH{MD6i6(wXk zj)cWjKNwEK>D^^iQLC6vNNXPfRPJgN@!gO@D!j(xOEEqOPj> zxy;642MyU1`%i_p@r&Zt?>65OoYnVRY`En*oDuGH(5y~t&oKEzYYJUuBiukt&ou3U zCd<9EA!j)R?JZF#dHTJb9u`ZRq5A4aH1@_tY-UucR^I3q`U+29=Np(!m`^ICT@Y0w z#5fy0`x9>XNK%Hs61HDXjvysxUoPUah<(6nS5l?4@g*Ym?bThgR+Ff%g}*7qN5MpU zL~Q(Rl5F1qZ8p%O?_Dpw6JDADY7d8Q9PqlQsd6H9zHy5kZh-MU$Low^`x2KzL4!hX z1mTF9P7UXUayY)T*3S(RtkR@9Q)$tyNQi+VKTtgwS9Ir2kiJq(^BM3Ww$#0jku+^B zE9h#4TNeahUhQtg5(I1pC<1efZAi&)phod82x=8@mK=^B_Ud}6zBM^LSP=@}aco@U z_@{TNZx8o88yu`&Np*bc&YX-#dNut7)rC4m#tc%(^0RlvNP8+^RplYCvW= z#Ufj%eJ2%SL;ZWTb5FPz^}?d?g5FhG!ug&UldiCuun&_PbJ>nF8Sml~50}nb`CdhW zjdh&4CX~-wPNSRcj9L?n-ENfyr_Z?U)^yiaAxy#@IqoW@GAj$uLAP~Zr1ew@{66z!VQo$&1V}&vP3*MynDFI%!NyYt%)o@3ICILO=p|vr;R{rhb z&y`$R>|>92H*#XTrS?)$N!RkRGTci1!2`vHrDK(<9L>mKsiZ3THt_ z5Z}c_wB3bbw+-dNIXjYnm`-lD=2y9-9&udQl}-QADsL;s!P&lq2!0D-P+~J?*Qcz>zlN3!O)*Jl=w9n@^i;9GH>Dxj}9UlNMgyEZ4_2Bc@)LgCj2{u*ORQ7wYyZQ=2R1M*lRw6!w*o=*2y-7Am)0!?R;1fTQThH3N zxNCPc;XQ%y4oKz9GNG=dBKoe%rJ|YS4k|b&^DDTPo|v0AoABdqcP#c)q*asH=nks$ zY0_}+M@KaNCDG4Z<_6>94Se+TOk2lWQ(2qY@7VHJtf@*5ahncr79V?Oe0078yiJxq zvoi#+gf4yXotc3B@B4XgU&*KTr0qUSZ!M`(!miHD!apJd!&{XRhXzHjM&;v_0jfwV z%(*?#bC*ehpEJD*6JKD^r{+iT%ieEwYB*s z`acDVi031W)ggYA(a%eUXYBfi*GnQWCG^LC=W^zcd+2&&I$a~2f-T6SwHY;K8FbeT zXE#x^I?P0Ymq>AhPz2>A(U;6>v_Q*?YAHIeOGM>n!ov1wuYWng$xM~W}}~RJUuX}iKYfEB)xu|hIL{Yt0s->5EFj9 zlubl8`FHCMXo;%%I03vU+Iu395?5E0K_a2v%)T^L57H|NSPNrmI~|MZpNUznym_b9 z0*zrAVQdC$GPD25@cY!b-rmHoZ|WF%66nqyyhpnx=%MG|C0mK83Jkk=;Qm}GF~D^{ z+V-MhwQqOcoAv#rS|iOBE5aMj?L()+(eL1sO=*x9nRals^dnZ43$8)VXE^&n^KUYy zD%8naAvw#2`o}LT0c^?Erz`aC{!en8)GYH4jyhl&O-p)er)k=IrAwC4lUJwBpc+24 z^4+0chqHY=2{b*|2bsF%H`t_g~ZP zaC3fB3rB72^p~5&k*5IgQRIHnOIUxhu&{ha;)9u4V_R+|GrpHDOQ}3()51M(RL%4t z**k|YwXX)rQMYe6pq%w=yjezO)ih5a7uNgsD5|$y*K`mQ)z|k?GvIq@a-{#C0G$y! zV|zdE<@j2?|2%|_Vmjla^ZtjVrIh*ZC710+F>T=*c;=~tKKvvxj-yi4pW8Ws_c|4^ zRLQ9LQ}JFnCewDP;!TxXXwH0?&>GCS0C~F7ybs~@jkU5-LaOIe zk5^|&o2LOjF)d2@vex;#(sA&6}1V-3{KgxH)E2dS3baTJ2)x1%Z@)zrY3pv-InY<;P!BCQfP0M87)L;kaska;kxhr)VjaSfyJ0B~=3)vl=c z{>=w>?s?bISeMK`(#u8<0ZEkYKp1?zAaiI_L?Mo@QjC#7zatb0Ek$%TXQUNGZI+6C zD|P#g)Vfw;x0Wcr(o3^@lxJDFcHZieVDascZ+VnX(x@SeON*);v}^9)`R9yyg8gWe zJweTORMqXT%APb<|0!%%`o@hL_`qtx+{=A7xv51&JF^gmByyP|xPLulCs&O+~p5yA#C0 z74G(H{so~b)*oi{lHqo1XR9RxPp|IP@cVcf-zD=X-KUg&oC^a>3(EZ|tYk`&Oh%Af zyQeNV8T-V1q3%C-(Bp$nr_2r&tpww+(Lm)Gu%Cxh^UNr8mZ?B1qQhSe8h6RvJ6yV? zr*x-Pl#WV~HRkP27%Bo?(Ff9IxqLZ1Kzoh^4EEfqW$m>szkZ_f{@nVbAy>WEoW}_@ z`cI){6D85#%#4ydPBq*w?7^v{RKm}jBa#5lLNjRy5qvVJ?#1Y6^>g@W;1dl*W~^sH z{kv@k&P%ny=t!%-G#VN&c@)+V#){rQ*gdO1a258F>12u(oe?=O7Q)D_wl6JrO`E)u zpA3dxrJ4}m<~Vr$#`xvUcofLm_+1zH+--c|gm2xYQd7B#FD2rAa9L#uWgDt;-UaIQ zn*gzBbt$8$c<6P(w^z0Kel~tryFI?WYDHu31LEHl&{$aq0d>&`@MX0VIc2no%_T0QG4I*_*A`4-)-ZsN#7%>ZKD*W zAbhsw^>oCmA52>_o!c9a+37b|@!rl&vXRP*^-?$AG%aG->lZ^rJF$<_^5u6{NCsCADjnU94g=O*naPwp_)P;C0WRV>eqS4@m`@kZskUdYkL>S!_0mze-&Xt=ndkR+<**xMB}5Zf^$`a?dhsg3Q>D4Rs(py2+LH4Gg0_#Ms~b zj)`hz@17I{=ZW?{XaBee0QL07*q0`??;JS(t&nJ^JR_Z6uN3Z7YV;9E5W}OILLiwf z&u#LRy*{0IZ?~S0)+r)9R#@232syuZcRXDM7lic{5-r6((g0fNU|`PmjqF>+b{ik- zY~IY9H2FsaRth;mRo`AQwS7FPiwBUK=~>YTO&{E|wjcy1>S6T`V{`-nmZ{6e0K2Nw zm2LE)#?m9d?36&M7!{}M5aNn4M%@XzB zT~D!Ji7reY9+SzULB_V5_`xEn_?)6N+BN57kVx|1Xm<~wca6$U< zPq%UTkKza#B)<=I)0is`#c8eb7~#~(@^|o-*Ft^A-zDWQNBB`w7wWzqRU?{3Jl*&H zKv~ZvEdca=t7v>>8?gS|@%RflOi~rOT50-P@#rVn(kPz@*Q<+47TM{+wf1GpuSWZD z>}z+*<-gOazIupzScM7ND9%e|oI5$cjZioD>oEDP)AmH3%K~3$Y_y4&=c$8#ouoc_ zeskRU{9xoce>y(%L3v3;YSw*+Otm6HCv`~s;CaB+U+i`pu9+xI%RB7mD=lVUs|<~5Csk_i zKbl&_?VH3`{MSo?KRZB8jMENk@J&0Vw_Z1CtpJc@_cO~<=ftRX_tSZe0P-=u)1Gop z0by6>^qrC-w50KhT$uVg{T(8Q9;R zw7Z*D3mZbR80NEuaWo0`q!41(WUB-V0LofoL&j+{LtS>ew4PQ0QEF)M;L{%Hvo5_2 zp6XLWJ-TmcpUE}sh@QJ*DK!y3w2MjW5qST)sPKa=6$+rDk%;q0NO%+RO~fRmCKw1nxPaT{C?y z<0+vx0`bORe*KZoP*FqNsOF8_^k8@-xolS&%(787Wc*pD8^eo8F`kV;sOfCGod()f z#f4IDTWkt-27Jx`0F=B2eZt^bJDqz1ZU3^nX3yJ8ZxrJnkWnS4o@HoOn=1szCh+eKhPAT>ubx)Ti-yWFj$E)Lv%@gPs$TBfLdGc)XP_D_w023_3eEc{68W zz^V1P*tKDG{6%RV`gnR;B>xhQe9#Kdz}DwuX7^>IJMNCy zh5o(JxtTtMsW|)J$IUFfKUAy3`HjliYj?7oOE27732+$Ggw(+-?sb#f_CALNP^;#J ze@t)^Z6MfD7Wyc~|Gh(MfJ(W_C>O!}Yt4Af*yre!`jxt}2ks5sVH*gnp+ev(cT8x_=jsgB z-_a)SX;SzP3b{*(x6S#c=Xku08b8Blj-Rnb-e7x^m zD8Ti{5bV%;B&!&ZB%KA{@%Q8(T?KcgP7==vQr@t-Yt@N&-suJrB?MXFD&z7LtF)4# zxz|ceB07_vEN(xHk#m=-PbtB`avi4qc*Jz8?%KX9UecR8#|vl~6USkG4Rilh!{6@V zf5iyrQYS`d{N7CfLUY%Wp(S8E9n(vgSu@9m%eR#e3`0eRhtYNecBiZ5J?5fbwDw3m zA(Nm2bR48Va7{jD0W_?eau(;=e2zt_65+m(@;!J-iKsqQcy92Y@=$V0$i(|e@FwLh zP%k)=7kWM_C}&n=-r7#hq&V!TE3jGyIG!G3#+2{apl8?$9WbaqTjyS|gD6OeZF=lp;mtveJ&AuV%&@S) zN&V4|KxFK7(L+E&eCt_Ban3W%7@s9ILWl+~z21JcKIUpjq z(7e6%V;Ap$P>k2)i+uo8-)5myQSaAyzX-^}giB~C<0Cbb~Sl5bjfuGHOA{$zq6 zc+Gu>S-DhGcn*sB4!C|8)3&niuCu&mbW&+szamDFW0nQMyRMQhAFCRK)aH9+Ly~3_ua?!-v}8V<>Jook7p8Y!da$wEpf^X_#Gc|=p~zCEn^3F*jPJuYuG~IPy*J=$a?%uX zMv7cE6-Mg{kdLa9g}h5IaC5o$fL55M%GK5L5Av^{6Kgk!yOJNYbMh3PpLnPys()(} zqq*)}BIvK49i2%zpE@~o_EcQMpmOTR9-grfq$#sLfP6)(zs9Lx+GZBmH7?MpG1H}{ zbi8E7YK?!kfu8xQqVzxgkbi?gg^_MJ;OR&b!?C3<1@o#-Df8`iPcE~2H|`yN6oaeO zzF|+j@y}~w=L5Ag5auw%1Rw2K0nRf=`G0`c~%^Q}K zh(9Rdy?P60(8P0cH0ft8t*)3;Z222lIc&^6`1IpHgymmA+z$!T0=As6rG}(bQV4&{ zm3$gc_0?iNKZCFNlsPZ8Vr|iZd1P#Qbbt-u{YzuUUd3zCnZ`U~!HqhBbXy&=ve1XZ z7c;sA!_pGm3BDJjtV8rqjHQE`jpjQbVac{A{QW_l%V3BF+r4j3;r%4g9IMgjgB}AJ zRf_OaqwnuNSzi8BU2rkml8uX{%+;(y|5>I(J+Yq;2H1s|`w6F9Vn)Tde));awtu-2 za>vGF&wBlp-O-kWEol=gb|Y%LLj(goiYuA64;YnD-1B_glA4?dBt}H-KDZ5d34*k` z?=a=Xy|ofHztbS@Kkz1>ia3(q_(5j#*Qa!2uF%D;)pU4^J* zZVJcT9!9Pm%ZF$ds zdxvPdtB+OTCK&)yv?QKf9K@ggSarW^;zISFzQItNv)_U%DyXFuK1jlz8C_p|W@J&8 zr$#W-y39=1J<44JZuiHt0?{NSKMGwjR>>&%&!KI8o~Gqqn=FD5{GM~6`0lXuE^{}6 zjbn44{FzcQ?yivu?!=nQ$RW~NT%h$!P;*20jA*x1ceXzY7W_v_W6AMM+B zh}TzF)nnYh`O}alB?<6BqTdY}{0i`v68na+wbc5i$HmYR!T+&M?P;4H{(yx5g_qdQ z?eMRR&b*RG+%b^*BRbS0~=}amiUa&@e9%TEGDI)ia z|5EfC2%L`sKkC8id@wc@bJ(vpO4JzJP_xk@9y3DNy5=gm>OhbQY_U_>E^Kr$qWt!& z{f{3aSS?=7JpmxoG%Hd;46k{evVXeSj~&QXn9EZ)?|d*Tkhvvh48KL& zHhmY~02RCFR61={IjW-V3t$v#>dT&Is{YlG>@4+({nOeW8%E@1;Zn|jZKZ!sJXx!t zAD-cdqPlb#+j4r=12*-5?<<7)rZpCb-|*OH3%|1mS;99ERb`&$a{^>U%NU68EeVb~{NKE~f(EvQo zXE5R=w2!i!Y+H9ApVR6Ytn ztZFbH={@>_H~RIDf3NvAnSvJcmr1_c-O zSk)|mhc)V^ce7c0-G%72K)v_>df|!Mc6|r_Fom`pJcM!bhr2fDl#^og=sAWLf4vg& zYs%3uE1Na9-w;6hEzW#Y*W?f99y;ySJi=I&Tr5GyPc-sRM*{ob9E&0kjxU**-k->_ zux`|%2ry3Xsi|q)g{1mk7T$2c{*O!MpKH}RV~h!oe6@IFkE$>f`3B6r*id^R6VA!Noe*>-Azl>oh6Z zg{3Hb3o3z{xo`}kn^smY1B)c2oMDold^1~|c z_LZ$L2*hj$*@&hA)kVufF$g&u6S>+x0Wp z?QpRzll8ebyd~{oAukU^SwA!8$XUVVA6Krm8&}Z>sF+Qc%CECq!pSwsW6=yvoH3{F z7J9_8)*C~R=i(YN{C&I2cISP%L2PYNCH3?034uMz#KSCg(1Lqc5p`ie`FKn|im*8f zpE{tbAbaCy4v7ZMUH(*~d%!w-;sG)XH_ogn^hU>BzVQNsjHSOUa+#ou{lnHkS7nRx^L0K4>)pE}NZ~%y;kq!y+4JN)v+jOq#j3t7tV^2s_4R8LuPEm?cfh5U!4vJ_4D1z|@H z>bez22S}EXnC4c(C072QzCbXq2DL6w#8q`;%!-siL-bnfbTitYem5}wf?*yGgD z{2)CpP4DAt&BGf}LOr$U?VScCHtxgc(uxvXcnYzo%lXS5eU81IVuzr_F9zI9z$vV! z!H;?;YD~ z2VC}R5If%X9`frNOneAWe5>#?OqGSIRG@clWzo*Xptd4oDpCs1P0`E#UHHS_iXT{y`bfMoauQExBR*o6bGK=xK8$ojp zk1!?Y)@pOY6Pq}v#}h-IGL<66B3a>5)O1*&CQ-?1JL#?iJY{ohiH1o45(7J<#maB@ z-k#YuX7A!^I7rhvyAK3w70W;M7Wm$J*Ms5oZpm}{7T_~VW^9vyoRt)<2qPW5ujcFx zPxn{~CtuOwO+9sMD-N5!GEa<@;3+knl)T-0t$CmCFkEDqrg}D-|12?386B6UkvKbJ zbAN{y)&yvh6pfzyT)W$%uPisHDNE_ljIIg~zgQWgB-rl4E^|IyA^+S~uUsxqHYbGQ zslG%L$nS=!chGneIIWN$ygZ}#8#d=>7I_LOGqJo)=#hX~IyKd~-wahh3h{ zhy~Azms6fEWx&qwYN()i3OU_Ol|eLon%ikzZSAy+C4UA4qfoiI<@q= zL;}lL8EB&(H$%>D@RGfbPNtFO0+K)okqASI&24{ zMeEF{WiXvlPN=t&eJ`w#Ht&mBl@NC~l-M3g_txWbBfNn=x%y+LNGXI2wW~#5{84Wj z|L|!iGvjV+5_2#_&fq-flw*2k;#GQ?{rk>&(Z~afjz^3T(2T|>f`?bwia`EbxR|X= z4qSixE9_7Yd}O|C%KodW(fEb1V<3oO!&jS^b>^rQ^Rdy+*XZ_|KTF^e?7`0Gn8>R? z=2qs%I*{VS-5YRU-M?FK&)+;~j)LmDG78$|3f~{=GhO&uN5+VfB`UF*^*QA-@$=q| z6WA>RIefnR;*!#A&BPUqTG#az`T(T6J@C0PB^faP`Yi&-*V{vCy-_hmPt(ml;|aU> z>naHNH+xr4E!NR8UF@0>(pD0;L z2svzjC7#3S4ftMAgl*SSv0E85ad$y_6s5_c+sya*x^8no(v9}vdoTYYUPKJ9k){?$ zT)L%9=1L)}#Pe40LH9Y=es#U3<+dQBm2L7_(#^Tqx$>s8$*^E$db_cImP`}UZWG}_ z6yW+E=0!eb0sPkblw+YC%aB9oZ?UnOHvuWGYwYx4?5)V9HFwp-XYXdlJELO*cssKz zU(5;Tu**m6NU^Cf@h$}QlVFD#wLw31A4CU2uES%;a0h{BWJe#i=mC(68SCBlkDcef z0(#CAz53$qLjTdK8f=nu9^Z8H9X9dTNOZGoh>kcHo!5^O_tUs0ZrPZ-@gx6qmZYLp zeEkT|8x{U3BaJZ_{GFEnt1;1weJN&AsGJf%_viS8XhwEmKMa5IW^Rc>Rjq}tu}*SW zUs|GE{ANx`EG+uX*#2fHXA(=Sd8L-Pvxe!x?%g0KwWdTxgTeZ8Mo zg1j0Ab5)gKl&T7AdO>+k>rR&m^s)6v!BR?0fd^KjYK&>j^5$6d8?td~=Q)Y|$`_a; zqY4dQT&o@6{X}pU{!xL{blC0~ylzSM>R#RY(p~0^*4kx$V}+hBanu3k;P{z|Wy`Y1 zd{xF3AJuqkSIGFTF#XUTGVyXTjr=O~8!xfpb7`H^8|gK@WL)E^(JGpx(8;k^o6d87 zm8r62u8EPkIgukd|16(bmz3jXZ7TTq@-{#Z`|kq&QV&On>?yZjuh+bJ&Ijai^miPv zP)IZcP=~G7P28Qk4r33h18do3ZjY&zhLEKU-Nvchnwb68Wmlfl#ZkMDGuzEl>l@+Mdbm{MyGmM~HIrXY{4f%Q zWrvSSyk&T^_N)If4@--4)8jg1wkUADJ<)rret88;mPAL6ZC>^dsjy~y9G~wSx{m$O zy6DGR_ec=P_w=z-I5{Cu!~W-+^Yy9;Us=T$H92Lit4apy<(;8CBPw3``Z>L%Vv?RX zGxNOe5m;q;X6Ih3P2~s49R@~<0IQjxAatdXWP zl_7O2_!`L+7D4Du(N(l^{bee#i_2Q^KiAxe)~SY`lWupS+pFH)d&+S1%d&Co^%GS< z2B(9%ckm5l!Rq}6=;Ze6skHNmX&dVZQ!0QuoiW}AmkAGyn@hdb)Vsz886}T7Z3s`; z!K00DP!)$;%iB$KK>Ul9D>Vz4obL1)$ZzZS3Vq#EEndq(QI6NTrZ!Z?@^}%`jxW{5 zkBVjMeVr5FX@G{ikw}&-_v3F>`St<9PN6@th)T%rx%(AZ)}*Hy}^jaI*FqQKN*DN$iv8NaQ_GqxLdg zI@7{s7muEjT|l!j>%g$*+zkh4^V`jUW^oZe7@kS|=)~4)m|t!7kCB-R^rmcw zJ38pC;g?AlIm8hX5k8ioVB`9yQkn1K8Z~@0JE3vw5Uh$$t-%Z|*r3#s?h-lo*sFXi zH$_yMASz?r1_iaw7()5ijgn@(Undnpb#;hNhf8g-Ofg#-cx3zc+qj943RACH3Bex@wAVw~NP4FZ`i-6I>oL2R<+GV<2h zNz{ARIm_#LuBgBL+wX%x&WnO8jYcAXwYuEMw&`*R>E;Gku_}$1`d>Bg#0Xqp8kZH94Po(?a$ta{;~S zxg&xdWqX$I+ipexoDq@#?**NIoURpx6Y~?VGuLr>3Mjc6u}ghxn`UO`*#_C+bKE{I z6l2KE%qsK{^V+>;_nj|a>_+e7j`yxU zWtE-%jTdAmCD$yzI(K51xpnrgPY(0?nZO{Jg%YGos16)dQ;M|`JGmyAg-#&m^+Q?# zEuc>6`*77~Qc^68^aTIFP)I)Z(`bWJbw-?zP&w((riiCRP$h(>p8kf2mRgNcDn^Hy zkgJEkhfHf%O!Ik7Wlp2W@{!IoI|@KJc0kzwgG7{ef@bMD{_jwLYd*-r^baDS*(GMZ zJrZTy5AU`1Gfg&d(#WD|yGnoqt5VWLtQ?xI_9jIDJ?9xzaa3L`mf#7RjJc-0r8d3! zb;e|M0C^8s3r2|-lyn1hk5Di5ExJj^6EZz>i~HWw$3`a2CBT{X|N2F~OmIKGj_XVrX7qi)$=P5nmT*LLh`rCc`fA7=)Tk%c*u=_v z)U$`l_-+L4ZQp4}>3TEas(L4dq7*-@<&H75oM?{!7gkhy`MjL!nV?=Zm5$L1Zj6!< zy@?M}^hU#P@Xywc&0hkG`2Uy|lz)eJEC;sCX~%#EBZ=87QYf9b!|l>WKMaU~0DLq3 zXk{R9{cH?;H8MfL{AG{CoP3nh0b+nU3(#uR%)r_S;$F`y#14|%OAJmO8uf8sKv?>58B*AS6xiTyR9Ocw(NXd z^wnBf=&Y@Qz(M0$c&f_oyr{^nx@|ESd+sLvR)pBt%*YY}j6Fb$N56`0JeE-0pg7tX z;`xC#eRpUQ_g8=T4Wuwk=rMftS#X%%+NCi}4m@lK}YonwqLf1Pw}?UTXMG{g6>fT49UJff$6;>;J+Z*9zzK z?&OOZ9~qFanEaV43LlD`9)*DUSQChL6Ic<>ZK$7vaR6P4Lc3F zGA^&!iTdx{BNngZj-2aMU%zF#>+4QyuW-zB_dX3`u>*IWRHF6RSd&7yTmE4X-g@&a z2^oD!--Ul=)~xBs*;MB9$dgTnf5z1>FerC$0@I>bYc3P@u6p#%Xzu{kYvR8Ph*U42 zOoiAM9e6wh90FqUA%ZHFc-~z03xGI_p5Hv-xFxw*O7FggQ1$FHJ0A3NWKOl~@|{#@ zno~YKx>o$S`kA+j-p_}$EnFV#hxxGYq-t*;`aXp9nD$WRp@HX%9K6Kdz=x#iO_Txk zHHiSWDceq?EQ8A{+PwI#{wNtKXMT3q{lsvXC~UP?T`E^1Hgwm;hLO!)x>ZcRf<1!7 zs9~)Wl4`W9T8{{E8Tbd}jShKG35*Q6GFKkEbia7&^2vvAXOWDE>~1p8p*z{adsez- zS@kD7rGe#$M)UHmcsUxjgQ_I3lO;P+5Kl;&E1=32!Y)L>*VXFnB%~M1wAusr+ld>j zJ_)P~bJ82C>+hOM)o~i1$@3M>rBw#Ads(fP{$dg6BcZQm~M$$*rHgH zD`x9gWpbIqqp9sDQ`C)YYlm&^3i6l5biaO-6!JTLR7ZBLc0TSh zK3%i$;?nnJ3s%jFrzN0hNdgePH`C8o1ovWBBirQeuSlyfD5|;m>I^p0%g+C%e5_UP z{tl^(jr%k`p+)n5*ST2Y#1box2Y%k=4ELbmhgk1VfxTRq1N{y9$p_pUHYX`xD`}O~ zz7Xztn26t@lR6n7LpQ2kc{5Z(D^k4K)M+z13BCV*+W_`*wBGqY&4dEcUWfE*$@q3> zM;L>2lhJVUJ{hHG_A(r;T$_t*^Xyvfv=usm)nvgzs(lr9<0h69lUMuHR!YG+7D-N! z;!3W^xE_oM(EaIOT>A*_`g3!YqsgLNU|U6P%&OEnHyUr%Zi;kdx)eQHq0ZEmxJryH z_IoiE6|IiLo5{mlTd|9UIcMnU+rG?pv2^5Q)P{e0iNui&nDAl|EVBlu;H})0RvSZ2 zzuax+1(kN(rWE@1k1j=ItRFVFm#<6hACb4>bp(uY&(`!xiNO_7C^K4Ztd0Pg_<;o~nlD zGtj}qle^4Sg5(EoCppG0X)Edm(Y6D4vXis*TKwXVyjQrP-@+f=z3nRM#XIf1biseM z>ka>=(aE0!qJanM&TcF1x+Johc5%5T0Nxmo;QGXgcE$;&WE+S0ut!E7ZxbYXizJ7nzpbQfw&ZbW*KKNxW$nF+({tss6B z_0H7Fdz{Y><{yBEjDpoGeflqm{LHXFV)Tv{7bdux59S^3p0#7$ZK3uv2V=W!4qr4Z z_5X0Q!V%{#<^A)o2ETVTx#3NgB|x2BG4ok#u*&m{5qCG1^Tf<{HG!%Z9sYfBiZyp( zE$8x+m*<%!kS|hn-QC67->S1cb@Oox&?J}sa8Fh4`TBoM6>8fa;PR{%7r4I>KY`_W zJjqQU>SIJ>)8b|$^Uev2v4fA*asF8k3|}lbQA`9TF#@ zt}JLq51A#SxHvWjJWW-N&G;ZCvXdkr!v$P{IQ_F%Df}^!hM;4>QfAA$ah=`tFD%=Ox)E5sCd|&w#324`+n}Tp{uN> zI|an%E_?f4fP~;(zUuR2)m{!zj}#ZknmRq}%w=6kr}yQ4JBc|E?s@#(Fb}o2WmBE} z&@q{SgHQ=SOqK3WbIQSif77{xOR;XQb?MEOJba(6lZv@eZ1bEcUc z_t@C~ZLOK2LyWtRR)lt+>p|wk!Q<_}IgXj z4Rd$YCM9zDCnugIe%xsnngRk#b?#yn@SxvWnNGT?fOG_|B-L#oC^*YD^_jRBu<>d7 zL%8^}=M<$l*}>SCP$lOL+(tcf?|?*=H}LDv?46p>ZK&O{>Fb&k$@_TVM3EZ&>*$`i z(P@6o>|N`F0V7rXr45&Z(u=?q=zI0@;ku}Jf;Zu&GiiZ(Y#wiItA2lhcb^mPqeOXx zM~5vhNtaQt*wpY?q*0wD@zD&Zw2cBiv9DalA zFW&}Z;2@7a-xg5mw;VIE`$XgcAguYVDpPtPo(QVGeHQ?9MP*-$ys&wen18#_v0 zHJ;_Lk2lXakiK+J5n9a_S0dU+=^Q!{O8D@66z(aR>Cde*JgfAN@06byRqtWkeGbj-cJ!Zl)0#Y*p4x{RHxAjWy18v(;7IhHE8!%^A; zmAQsUhNdY)i;%dFmPn*O9IcL&2yOPHMi4m{*-6mPsUwtvq3%M$LLB+}O7(U-Pr!5D zSg@S7|5?sf(9=F{trvq#7^Phv;AsoyBhJq!yY&|Bh!4S?sJ>!sY&G*VqBKmi5_T^V zGRc~I|6-2th>xlLH3Vtm;>k26&`c^5S_j$mmFde5uu1K}!i`9a*#1-K6JU1zw+vLf z#|4Byg0Q`jFDb&~Y-$+lONQ$lHybIWMh;tR*xlWo+l00M|{l zi~hj?$;5i7fCc*&R<;4?9x9wBuI(>fONl%rZDn3m^gYjpancSe8%6@z;wf7HDZ)=) zSU#xo%LbS-!p!AeSLV$-i+}`aF0AY69&aGRkm_dJw9UX3y|Vt?$}6!9w^uk#rkp=$iC>I$p-HoMU9Wy zs=6A`7<&$}BfD@ki#bWt1(~iO6F8HA(XMugp=l`_S@(Cwpwk3iJ=ebCuwh;Zbpc}? zqvNun8Q$T}W}Rx(_eEHdd#T4S%6sfQg!S&7he!|P3jKPj-L9t`i?CLoI;nNP&d2vy zhkX6Dz)VT8_z|}eAYfd zN%y4f-&vV@n5f>Zr_mL`%1as5e)h>6+GE+@r&67sL{OWxg$o|k#<(a**DKvr zxSV?vr&r3{t$(f5-XGbk0FTUXVu-0zbq6HYxUe7azAWbJ;r6aLmO8u26-E0U^Sq<2 z5q#7Qte~w)mU|7lI)O=l#LWPghLbqBqisRQ9?*<+KUV(z7=-}J0HAf*Z+Y1$>T!`8 zc&vv^`J48(b`37rS1Van2)0vE^d%$)d3@^{yYt6do5tL-Q~pex;&#g(W^M4{?9Ee; z8q?Qw{7dX%!%pzw0w31CA8BpR<=NN9yCrW>ZYJfG+XjT1y<535fKz7QYT)IPO=jJF zH{}}xVuXs(Pz#_?W$1*{gnh*Ibsy|^QQ;JCFLnCp$?WBwOl1IAg1#V*~O z?vAC+8VyZ0B*E@Z6E8P@34GG3QRjKq2y-28?^LaDBFHH@%T-Nzvf9dATIO4LK^88D zUwh*~7+g{L41N&!V5A~T`2Rj4duuHu*^?&HJ>;AA+>IfGSx8>Aq+USXj^l$pD{=r6 zV_C2C-(dTCZVU#85dCs3bCNKMt=+bUx?TzHyRHdJ-wbQi!142)xLnk1X_mM2Jt zctDD6g+rYOF@_}WVy9{Hl}-W!NYsbG97hndlZ*nS;Xe->h0lZyE)G80dDxXeHJO6u z#Q%xWDI!5CveVh-9%+PP-B^w2f(zzVWSMnz{VO4W$G zU&tgq%eNk?ELR0gXhR|0z4wLirm3vg?*h=Le6o!5Goz}JgQO4peNf}Rt4`}G^ejsL zU93K5B%>@Fb$yrlyV^? z(h5Ej`lQF)K45GuFb$ow&j(hvC*Zh4y{O8e2e8wb@;?lJZ2c{DtM;0I1XpSq(9E<; zk3jGO+8f4f@po%bRe_Tdsv+WFwLw^TEiyIU?aK|+i!I&%p-{8<;I!+j*Mvj)_hQsY z>diy=nlAv7Z54Sb@d4zCl}}TXJ+unc^cKIYHBKpY6JWO!6(WJ)d*Zc^IOQ)0?t0jt zs|W$=;}gZGmsEKF#hAVa^6 z*d(aHEs&PV`$~YN{*>)BykTF$e_XRI#SEg!X8)T*@Edvy-m5RUew(MlGMp}A0VwAA ziSCEg!PZP;!DKB+nt_|a{@qFcc;%py8!2Mo~5!$?=urfizLEM<5*;my+z)R z#USIudHU)D!l#`ALZ@9?#Z?lzQ{ILDO2`6+tVTz)9opGYIa&GET3S=H2qMNo9Ts+Y zy%DV05(BR{guGUSlKY6c^o*#0p!aDC3;qz>`H#p#LLejg$Ne8O z#moaE*NmPZw@ZoRT(aqox=ywoUtPBIfwjgs>yCD}XoDgv;t@+ebL$-uZ)mdhN6Xsk zRPzN6=YOcl@`FH}PrQIO@!-Y3Q?q-w*@+p&sIeo1G_2X6II+c8QSgItxoNMw<0d9b zDy`cQ5^U&Zo{*{k1GFgGC-~%t0J|If~)1zD+)>{NY?opTg zT9hm2E@Nv|C+?uE@-4i&S8oJeOHF^a=Ou{IAyz4DpS;WU{>?ocUo?&sWcguX{mjP- zq3hY?8|w1b12ZO&Xf@Zn5Fda(itt!13J48I@cB+_i}0+feV5ElhSpu*T_botb>x^Q z*#|$cQWmu0XIX8H&JN3+Yv|XL^Wd8cKI!jG4D7SYB_7lF2!m28f$Y7ACJhwS;Lq6Lo^G=O-JdlBuaI3Ih-M0mH8H}^t&doAy+~7X^%tUR`Mk1RlB|JcyPHm*zXjaC% z40er?jG>lsrhI7z8U@PI)HJmi8+(Tu5Mpnvm9bhhp6)WUyWBVH4#d!>{VH}Zox<`4 zfwUJrlrK+i(0#C9D80$XEvqH>+OxTSSrz5F!J6MtPN?eCgFM3X7bd?Yz+{r3PLM+a zy1$OmVfpcVD5LD&$XkJ~Tu0md9O*9{!lASD54 z=qHfkcl!=>g*^G*Gv&Y3ejfYoAJm;Vr`2&X-l2jJalj1^y>8Mh_e<|isej^LJu6N>TXhyHymGqNFA#xDD%!-|x9taPnI|l1fP(DJ!{;=G!fy zs;H1iL>bZE11NuW^}?Hb2);l1{BkP9fhnX6+qd?lztVMI)!QnW=Nar82N$w$g=gl* znC6_95LXlA^XqA*KMnXB+RzsG%lFPojrqHjed8D=c{=$pkEBJR{Hk)N?5iEJcNaT- zD{o{em7(E(>gYjNoWae2GuAWQYOtqz7G9iK=L3IL^LfgE-t~XeEqAoZpq2sSXT0jT z9e~(b-E~Sx@tn=$_=8Q?AXAxY8Od7usflh7SuSY+xu81J_Z$@*SI+&%w)jT6GYJRA zarDrAk5XIB+SiIanrkSjlCg*aBxvw2YcY1INqAE^66bu-8wFBz|A#? zvz1+8L0ovN#nmZmiT`!~d+(%`SyTDH<;BZ$WP$kkLg|1;!|qIHZ=xg%PLLW)%~*@i zSJk>)TK-33zW_H#$2p`75f8PtM<$Yh^)j_(}Z zc8-PYJ5zK(g$@7SpO1KgIHmHjSI3ya2Cn!rX0)AfQ(Fpy+x$lolDVK-*|hbD9WTxL zbOzjgW(xweDYChPt6b_YatKYWV^QM2YPW&ic@RkQ0qf3?KRB14SidU<9{4a#PrE~a z{yP{@GnO)}NRi5jHOm0hc$&?^WO@6?R$c)ss`UYIU@B+*ki1N2e1JrF9nD2Q_urg& zm{v1U^vW~N$6L%kc-UF}0$sN@;fopwU^ov__?i~FdZi*OQcXfaj2cP^W~O3kN4c8( z*1s;zYj-~?_sMG#$Y9<- zOLNLQv_Q^YZkJ9;V&@n+ebA9Dg6I5KRRgpyp76GK^Bo(B>k=NTL(6e~bUBt?JW!>H# z?~2JiF@9-<{Ui5of@<@26>aSuI%!VDru9QRoLK-_W!!PfA0GFc@O(Q zHV7Fj-``nE>(Akc@V?3xZL+d`1YhuHQelpyL!}zCe^mYb9josVJtt}tod0xM z%Ib|6QK~<&8S2zx+f^=xpMLxJ+K+S^1B(>MiOu2TsWc-FYqrg675vyu*LDqJR6t}L zWa4|=Q)4QJuyXF^mq6t!!j-V_g@rDrbWH!fQHat-nj9ODS(jN5@r}m?*5no<5)pSH zeQ46{1^=Cr8um^usj$KX&g6N#%UU>UtEjQB);?;-rgb8@{hZg#?ni%2`=95O%`q-G@Xz$G$n4GR{naI>Vpn_di}J+h>fSJ) zquWmY>A{`|)vT;Hw|io*R(PKB$wt@sSItcZ@apAW&4z|so_aipegV0Li=2Myy{omz zOsjQ%`?674bbxd(;VM2o$&J}kfVZY1&~fdm4}n-cyr$t+wE~z$W8Dlp7?KUi+-OvT zMLOu@J~zE|dURZK_^n1I?0pt*v?3x7(f_s3n_%X^ldlIX6<}H$yCr52 zO)3)~+G=7AFYi8pYP3WMfkc|aMj+9V=-XR1e>qk?=&TRWz=rjeNnOGZr zWqVopF}_wU<371<`n43-FWx<9@p~y67|>C^3)u8gO*91*_0AUV1+!zbs?)ehBe?RPj_(a7ZYkhjCz9 zTTCiT3$iyfRl7aZh<(W_UGDm?up@OZG>LCV24N20mC|^lpJ?A09^Lk6zKN?7FU2K< zA9-q@ID*NDO()uN$+`wDR8NN~s^BIUcLA5WTKklWjh67ahp}lH_>>ZX&^h12uMwM% zFxs7XXmbuMt9;j24wLN4`Pb?8J*+e0+Ri-) z^V=SdM=!9YeX>B-T(cM2>f=blm$P^oWoFD!`(7o9oQzDzomW;xse0Z+^JlnIdmH3D43z?Q+eVI|e5w(=2>+ppMcn)V!&p z(`8X_X0Vc{C`~&_$b*FbN_~Wg0_`L`@=dMK{VqF|)pkbMc(6$k^FFbydp_m|z>PxU z{@O!RCvAl;ROfCu$b6V+*7o_RRD_iBF)hu@8mzMT{f zii0Y7e2D`}4o_N9#!2$s$;Ty^^=EzxJ$|f3G*$B!5NkH>Rm%SSSt}Wxs3bqj+lhlf zTDpS2g3!(GjZC-3o{i*PPU@0li1W06xVm$uE zLJB^tUs7>I#3$Gegs1nsx=3(XEg^~@Df@9}wdZt+qks31&lq&)y56^kcfhFb@Dj5P z%}4gp8rZWAv(@{HpR27YcsM8-=DcdHiZ@)EP#*Uyi5+Qi^UUD(EMG~ZF&?fz~*eFgmZMA|$* z2m{#KH=5$P?yl+|(HWxLTbni|e6sTFQ$9kNwm|5*h7Tv#ZDBylxi?>Zs4=>mqab7) z6d1Bvyp$wF=W@%5QJhwCz?-j@@3Dm4i+b#t+t!4PX3W0Wjf6h?xevrMFG~2UU+yI`sI49KbQ5BU(kgI$na>1KlvsPR{G3!NBqaDS7y_8>DGCt@y*e^#6(?U`Yn7W zl!T(fQ8_UHxb+#Q%%`;NMa@fGd}&QZvA)SLMvCw?YNb*6%(F)~dm3RIFCE|FaHXl6 z7SEy~v!00Y^;6vc&22W+{r`!(0$4bHVn$#Y26L~z=4PU;Qgx&#qo9!O3 zVSo(VSs$*Hzrn}mYH8M3Fp$nPp3-3tVnI0wt$sZv-%0E=1ZIT0IMuxB!9}je)Q<(VY9c0 z=TUY>JH&${NqZ=TGcsUiPDNqYKEL^aPMYb6a*kriJd?hu!>x2K-ZPDk0ty~gdL_{C z?L5>IcEn$s&=wk@Z&&^4Ta5h!MZk7VDru&tfq;d(?C{6!ch|jtS4ZZj!NB0Q?jfZ` z5$w$3+0;9%k{vx9J$=N!>?umlGX4;0aBb{JPgK{GYuAKpVscD9FjISiR2z#i$`**E zR%RQCd_Hy&X0i?`gD%V@PbS!L!>~@On;lDKn66mG>HQV_sD+4xPR^zoS(JXJC#o!4 zmN`;1bov%{q%i>)Dv^vW%U&>qkH}2O)Uze+(We&!S7zfl0F6#G@eYEt#u4eV8(uS9 z&aZE+qh{^6O}$LmJ+mfIGYv8frx0nPP=NeBZTg=bM|&QlsCY|liCt92Vw|;~8$M9n z3zd>JyF*v24*c5sX)vU|KnfE}8f?RU3ybL6ET76d>Y}}3eL5S=xYzDc^)xS%=M$;pN`TcHh)FQ@aq1vqM(Vkts zzTU+6-0{1mHXscI)d$jtY<8Y!C)Eti+=(1*;{9;s>=fC8sG)E7!Nv&0u4OYa2eN_9 zun2(3=H0)FB>%+~^q+>Ra>-WjqCAI_2hxgJjJGGl{NdLj?>e?rBe#=LWiz2RK=VoC zY9}i7gyGa-FZs?H=vR{0_ZLu^Zy&d@eiYG)9uqE_9pIHhqYGuy+`4p1HUiAXNnaQ< zZ;8XALu*ZM3YWD9rdLMsW!F!X@NBGvxyqhgkM)fQQ2Jm>>2?FZbV*njgtL6*6Rk5m zd9__l-hB1O;?0ZB$9X`Y5xQt6@SGf2Y67zUOrS#k>Sg}B^P)e@oZ5gNQ=jPZ7xjL2<5|MdL-& zB&&Yp_Q-`Z7Km-{u7TLvXcs$vZJ(T`@fCrdFw5Q+XcH&`tp z2Bu%1hds)|+;R%iQl?%|bq>5#42xPf0M$nXpNr3B++R?{zCXlOVNaubgF~*Zp0#p` zdR$_QbW+Q?_dsJClNPQDUqiTU$xW*QtFbAxxkT-$jiU*4zY9c6|4WGh=M)hf*jE>K zfhmkN+X)}^U8N5HdiME+#0Wku&38aIq~526&mV)7+OAl{yY*dtuqnlP_R@#-5Q+Ft zj#K{-S8)u+@!h#4!uqn-m?^BD4NpK+ZxAaNw@>nUJu96^3q z3ZXYvmipuRU6fS!2Rr**pRO)K9>S4BlUOVcM&;w(IpLzzBCUgH*W-Je+%Z2Z3KG@g z%8g95PsiSEgg!33HG0umr}>z>R7KCY;YHU%aeTUV!{E@h&B(t(BEPOve2ACS*-slTAodZB~mdl=1*NfhQGozJhX6v*6=KvntcOUr74sfk^=hAB?8inWc zKE0I)Rm7JnOn(PsT*_v`ubp50GuiVzOEKgnuhe(@%!tJI-S6w~Phl8VpYHJshss*L z>GRXpb65$xyV|j2NXbms(+$heP+Z9VN(|{WHcn}dS z5;aIjB8VQn1Va*X3xeofh~As;qL&s#2mXtl$;FKy}@4K%ghC5zbr{^ zyev3;{M(qiw!9?~!M)FKyyf>7(tZ%W1?`*7A3I8S5C-Ntv{8VCNWm5;tMN)W^)f(W zq495k!bPbKW(R1JWRiF)0osf+<%}2nTORqE5#y{*@{X;aFaDI_LhRv6o7p)rd2JUKqh)$*kiy)3a{ustR?$j=gUbwxK>?Pxa+AHobhiAMUk)7(q znyoH==<%t6do>11H`L_LCE$kNL2CTy7e^MJ{}L#)PGC*oq1Fk+=Ho6kYy|{bm4>0wdj{fj`lx4Hkfbc>sc}~s=&`pl@z6dR} zh4s(A~N(jms{7*HEm7z9|~;bSvur+O1wSyfUs#-eV7#7M9Z-P19`KN)&__$h{b+!D_|M&02C~e|ZUY z4F{z=0j@^{tt*bZ?cFIaZF&ge9}*vgOY0{!i(`>zm42B^=KtNZ z196UIfC^42H!ZgCyU?bcAFJkSA{%I`7wM-6qs;r_j~}2`hX;j50gcHi#TbS(wTtd? zA>k0Zl;Hx>DPjD&Xq4CMB`4e|Q*UkkE5nPr@0fx*)s8;# zn#P3b*k1g%eP_peIZ3U>XMsjvtkd{DA-GJN@1@ww*1io%ZQ<_y;*K-(Ucmk<8+QbI z#ZA(+dhW}sYEInr0cb^>rXD46Cfb71jvDj$t`6cj?5OJewDaW;dzf6q_px_z0iy?F zxjWprs-Qmw!t;FNfp5`+5E)?nJqVYf5LgZjq58!vnaBTU)0Kkk-c&4dh~9c~rCV{) zNuPe2-k@h07rLdq673m<``HTj%fbK3{uSsmn zqm+7~MgaSLDnmofjv{CpxUwc~Y!5n}UDz1Rpl>Ef0)e7Q;w;;%q}S2-lxG1>%fGiq z1_s-)*e98c^{t;OI!P3G%=dmG`#|ZXzd!9RK;GhT$WwC#9_^otb-VYN?j6`m*tO&a zm|Pv`>xadk_zTZG9dioH5z5p5oJvxQBpv| z9}=|Yv+sX+oooKdW8ry1`SNuuJ_4nvR<8e1Z~HkzGz5tBgc1RBQTeOp{35D- zRPv8{2eeE1A5!!%O5M*cEH$?+m+lt)T2llmB2SX_nkIM9?2W~S24-J7^f#}K78gBz zCsBB&disN6EBF6X^%y(p+W^ z_gp`u8p*c+Xhui3acVa1BmYcEE|LoXIs$_BY*cmQ?~AK)4f`h=1%bx85&4|G(BOdq z(bjT;jyk31%c~iaOO_`k4QQ+e7m%pLoY-ZbGm4u>lWz;v!R)&LAC9$;XVBy3anX^o z|28)dmff7k#_baBJ?*%+`0M4bHRvQ3bI@=`+9b60zg>!#HoQTeT{K$?9aD9M1g8FA zD^}n_1X3vJ^sC_|Pk_Loi{p6#|G1QJs)pGgP$2hS7Ja(cx9~DdBi-BoxQFLg$7vUv zV0r#DsCi?iHH*K^(F>$G+kbnr{wkDuGaTCe$cakB8l`)mM>FBbg!XByyS&2v)B?$IBCjh4s9`VNt`*{9cbt@cD1M>$t_dwT!`jC1R3&HqqU` zqGLx{uWT?+^*xs5?Oq+>=t--aqV-eNLJ6u&jmqT zKn=N?qI)%QK62y)dmSJ&)Pp--nZI^X^WT}ow{ZDnFulBtM-UG8^At>F-gvV6{=c+^ zTIkJcCbqd0PG*yZ(qKXmw|Eu4ZuZ$@El)EOACjzyTGmaAHUKO*i{doGcw;;qr0+71 zJ_%*rk}M|BKLlLckj01Bm8Vb zY{~rn{UJCUw;AS&vzqbVVEs-t+6oUQVFK70!OVoRC ze%_9Wwl^q9;*L*k(3m><&T~|>qnPNh+y2X`8PL7mpw5zM0EQH0mOs7+D4949U}kC* zuHbXc16BzWb(T!EXu=yVf4BAFI{oo8S(gcZw$E7&rlU?S?EYWP=~(&l>=v>1-cq>jp&%Xs=V_18N9T34;ISY4B+@ zcZy-(Gz2W|^D)1EQR|@NbE46fL2KqpWISD&Z^)=k#ydHz>~3g z*i5<(+&z{5X5FBfRXocsn`gM&2zYd09;bG+yKC&B{Hg#M2AE&aI@-O;KleD&w){fA~fz5MShHC-vTkHifKOoE*aP)kVTC6;j`2pdYVYs}#Kgh9pdTk@ zIuY;4-Es2%?HXe;z=n_bgg-9<_*HMOw6l*wJYc$L;<>k({n8u5%h&_+ns=3Jh+}d>9T)}>vRQDXYWiZyB_ycqum_ZS-I8kyJ&K6 ziNDZN+mFzRay7@gXJ4ERZc*>|&{jBpnZOUGM_Zx)*~3Oc3U zmPb$Dsex4&+Up#T+H)s3MOX**E|#E=7dbXf36}|ay6M^&Ega6Vmk3s1jvnxORFFdo=IylRz8P&Z%OInTjI}_YI@^Ai&6MBrJ(NjQvjMrJS&$fBHJMHv zw!W3q#RuRzRtp#SoV^>uyKb>X`k7oU z(XeP5P`iyYDR{Y~tkvLicg|_AP`@MpkAE0Xf-@FC+{8L} zM_n&wOgJF1yC=Z@D!2SqmbZ;kMu;5G4 z;rE8q;_SPb8NM%7jp1Ox;ybe%urxsVUjuU438&W1Wgf*R4ZscZO0ucs`@5tZegaWe)j3=5;=_}CYU+W;-l}2xn|T=5&SiZV<-oqpl*zpN>-y3y9gi3e z=fmog1+FJt?Y3J+6(+lyVv+;er&%7amOi`(vUaYm(`XLlri}pVjW0p%bYMzOE55U)e4=?@_y5!Dhm9k9ggW`MG>jCUvnj}jL z^rZHj=ZwqWttWF`y7_HeE_+z3Mk42#cW7$f9l%ir4>>7!PJM4%f0)WKD%Q-&3qXy1 zoWaHT912R_Q^lil$-CuwR}GWkXY_m^7Qi-&%JYz2nnNJSFigUrrt_}ol~BJ?+0D?z zw5=Vid|Hyc3n1@4<=HRk)wnv2chjm^E*%#|$B+VOCU$H~`~^}n8Q_Mm`Wwot?w=x% zHyu1}Q&8?4{TYpTT=K2K<*dE_UmDZS?{~uUbuQE<{d?{wr3o0{NRi|1?|Q}RNO&k} z=&nDlY39K_x^cdruFU$GiPmI%pC>m;;|`091Dkyxx1w9=O*deERe2|NKb(E~^iA%Q z!*53#xtX9M{Xa>qnK;jbaJL8mkcTUXOS>Qf_`_u>O)l>J3F7jW2Jss6gl4UXk-$xe zv$UiURY@`+KLZ%|^9h-ZS_;Zw3Vqm{%YQpa!RwkOAUj}+d?uufd?Ll4jQSp(ToiiK z{6Z1Xy8M3s@AMY_c)3X?u|F0bm$!09Nwa5he9`_mkQqRH>&>CVPP264g%*Cres;-redN_bx z*lme-0>LIjV!!Uvjo_yVD+-w#>o$fkw3KA&O_u5e-*p-x04guuQBSnk4Vl+y4hk$9 zr&Bn51;<#JUq;Q>UTTbt5RKWmp!tCz{7Z?1Ad+KP6oE{kCdyovg+(egb3@n*{${u!{k%J*c*@93q4uFhhdPX~g210iL8sJM?E6_tvo z-DtVdTK5-nnBI)4Lq*bt4>TGI%(z53-||9{YUE`!c~3tR9oof_=YLF_c6#z||BKh~ zo?`#zh+{Yk@fs&K=#6hYD{BU?IGUiR)-N(8&NhLp!vpy;W1TFkaVu!MdG&DT zpm|qR{GO&WTe|F+KL!jtn@vUqT{c-I6KCBcYCXu(o34WQs;6;c$uu}ow%YBFlE-1f ze{H-^+U1x$M@Aaj5|$6oL|Y}mrz`kSH=8KZijgu7<9**s;;fAQB=ufVOxV2qrBlA2 z!z^S^0+oNZ&aci{kDd1^+(@zoNA{)i+{)wu6{(=+T~bbxXUY#rz@{%xy=Kz}CsbNp z8%|X6YOnvh!Fz*i@W}(F3p9SrRkO}9xhNnEl-2+)>SUq6OOo9g0Y;MxI4HJFE_G1b zPI8Lsi)n22_)L@F5h~!n3ATdguWLw-UB(O3-0;tsQ4$+B4aX-0aDI-e(9y6#;X`jj zAvY$~#_VJh@x`9q>T%(`c{$7o{Y6FYQc5e0-Vp5oDi;GYb1B_9m>vOWg!h`c@vOp1 z0bl!+k{hKuv4D`dasmX?&d5cPI6_ItA{h zWnWj&?jP(6PHvrb7HkKQWeCvM&Gj&ydPgvtGOy0Y;lOn@Qz^RpU%F1a*=$1}0?h?C z!^nx{hQFoolT{8tIzn1fc6U5kBnnzR=!9OMh+kQzbsE_`UCy_jp1@CK+*g4CTtu(5kJ_0i%TGjVV3Q?h0$zd3oY(#vqSmD9qzd*{1%QeQ z_v(930LNfp@&Vutz{QPJ4^2)AC+kEjsVQ^HMvYyQ!^09?s?eI?%>F<&g zi(gcwmm^|oYhbiMk#ev3rL}IWJQd(c)Iyed>0nTYm0v$i1SUT!o)|dH?+~X1c;QPW zz5=$RzZ+28M?uzKIp=4tl;>Bq_yuq9sS>=4v?F@39WGb%Lm+zn1G7h~@;O%vDvqQ> z+MZeU20d>=1zdVm{^5Lo&K$94=+0c{D*2A;HU0%ijP3V9e~I%O8hw-{nZmid4PZ3- zDt}Bnp67mY=~)W#r#(mDchX0=+lf34y^xd>W#9-1Y!ETc$GHXIaDAhgtI*T@Ttyzt z1yB-ihStDl6srxtDwEjlVLx9yK0HI6zTP&Vz-@)a546;Fc|6@0CAkc`J)YU3Q`*!u zkR7*C2H2EMwg!Ic)z4J=Tc*2(DPe!RzA3vv{TK8%6+j6m#=dk-4MTMV_cyI1qeO+b zhz{i(+ak8!R@kHk%*U;Cr+ct9Ho@!MiCzp_Y=G|P%Jd7>bpSa73 z^)hBaivqf3-6{s@c~cR$1C8cZnke#4PL~p!9hDs!Z?c~#lpKl&+65&L_1?JYZ8=`{ zh$P2fsWmgm)3|}Z2lM48Twj}}G5{k8HMUj* z7_(Xc54QIi9+fgzC&}^!)YIP0TfNwyH#cI*GTM|6tReWvViQkcS9`aeNOLNmG)`nN zQ#B)*(Mel^X}K@4jE`u@3DW3+{@_2IckR|a@O#GjN8ggh%_@;Xjp`Wc;~rspX) z$-)1uxo$TamamOTFP*D91D6VO9aa12ang>Q`2M-Ds)bOaRYa4L&KE(CAz`!3$>sudU`VU>%ikg*(5~q zxGCE8zzO<#y+QX1WAQgXNSc{rFp*m5NYO3|5y^HUZLt0)EcOAAfHGB3CxFT zYywjPrVsrAC-#<9X^kSR{X3hyYv8$t{SvFK<_f-b{L|6pl=`8;teu!2y{LQ6K@XIF z$_u5JIxlsQbd_tOi67sDupyv9v0w-E2xx4vq>HeMTRHEFwTB&D*k0u`9W+i2f4;G( z;RZM8+fHh&>`lP8?r0n#DJQ(H{dBOiAvrk5v>&I9ZwF>EjbVdr=n+z)69B=U+ z`WhDIcafeidZFkI4$$^QMq5Vq5YCyU#(ohpmJGFabAijjc3^bS0gans4s`ECXH0V& zgLHnE$7`e!R*<9P|8D03f8s1jc)C@~Z0m@GnH+`=uy0CfuTCvI%G)v@5kn@dbc&9U z#3j?PJK%$W4z!V9-A@;wO*(ec4XACuEq}Vfz3P8t!VbCqBdFQ5os)b0l*kiVoj;SZ z4x~G;ps>D|0P94e;C{6tQ(n?{lR6GHwU(FaFx4j;!f7wx%*Ug&=V>U#?fx2^UNr1K zKTIV|JDwH2H=Ze6s5ntt-}Co(Jxkrqs1;R*_EQkK{!GGO?0vKmmkVC}XW&@t02BB9 zeFm_%86DpgQ}tk*E+IQX6020fc({pTzi9@$2~uLFg1(yeDRIQfNb4AHQ5|jDeiu8Rn_Z`=sVo!M7bwr8iwZ26n3_w}pW zdxXmrseJ2lAg}w`VsGYc#liViOUe(SS@ohGfjxZc6>^ek@cGIb5b;Q}*p$!QWsGP~ z@pNtB!BTSZnn=o!l#tA&kt_4g%*%WCw!nEUOElIX`mg-O0y`x8vKCuXn(FedPdokd zdf2CqVTTvC97IDRaV-ePlcb%JK|8|uL)7a5#K2A&-Hqib*i|q`3K#>v1t*Ea7JC4P zgaYh(&oNNGdcj{jK!bIzV#p*&+d)}l7MNkM>7RD@_Ke}DvA@2UCs!~&uMgbB_MzTo z7v}J2-E!dl8iO|7Rs&Xeb|9Uk_J|kr^GcoRq^WidU8~|a;X@;WU+WeXS~-T_x(Rih z=rCP>Mb{90xq@KN7=f(0*HP`Ej8If$-ftNNgEt3o6Ul(b66L(+SCX*~Iop$*Rjmwp z$1`BeD9icfvqnSq?bjyxd5u#r~;vJllKH;Af_u z9k&lj3f)l;n0M8($b_ydSfp9;LT^Ju7 zSuL;2WZo7IO!SLEOZEyFUjSvZ!)duj95_2xEZJwlumlA9OsXzAVB4!|>wRIi7$lJ- z`(Lny)J zxv9jvl>pAvFr@txEJcw3SOx3Ow5rIt}M>4b42nNa@D_-f5|3AsDBL;y$U_e zt8W8(^$2(`FNfNdr_pQGcA0m45L1`GKLWyQnIl1GpBC_V?T+%eiE)7X;N-++-G?Q! zyY$~Pw$Ti1BQJGem8v=1P-_IPl2qI~?{CY8$A#U+6U4z~^@0q+Gqc`CQuhg%RZQ`# zUO7tmj=k#W)yp{6&4BFC4C~_iZb4D^G%pr-0GEjoGZ79Qd_Tpt(1iPcD-TsWgx&e$?h}eq{K}|BG^Fzcl)m>GQ*#VR)BN5i;cYJ( zWiL{=uBP zFSY4?x++(JKgeCjDoKRi1oyUtm(7-}W_*ojVN8)A)LSP^+xUEu?z+o#1cxhQ8>UW- zz<`5bd*4NtYgocqUL>rA;B^V*qC&Q;cZmGFhb!dy;H-@=u6p%hX+ z!dcPQyF(e!&^;!Y@5hwk$NhfnZ(2xsQb=V0FCXYOps|R+RX!BY*~%3?B(i=0 zQ;k!e9Uo!K9Dc8OaH`JHTAmpn&7aJNb z30=&MR;TLrserC>9bA9+=TWtv>grQ~+CpQWz*N9noDR^=qo3s;YRMPU28)WU`K%MO zf-(T9OIP_!2WPP@H;piGi`(p`Aqv;Jv*#7E#B@u{l^PTv?%w6GK(czIcL~T z?B5?cx3fW!azneJ7>7&o6lqkNndo9*8bka2nX1no(Pug<-+HSPi)GDpIa1*^_5*?V zx5)?bO-G*6dB9(=CKB?tD6`jzVUjqDo}+|cD69lLUrq{7(?&jks_j*4+#YihGfK(h zW)WNOn{H2E~=ZwsJ zH(wcE#*0wS(ZcEEu;HD-QZq(!sy>pNIaDb7kz)ZyZ?BwglWoqsd-8>(n*Y}u*%jT; z0-4V2lj1|!`YDS72l~GhYDaCo4VO9+-`sk4w}Kd2VlC#X+#Fy~<{aZ}_wa<*f^q4M9%fQQ^IZgpM9AXHI7=t5#@G^-?Rq1#aW{BsNRi<$}tNI6|H6$wY4z) z&AR8(tnlC)MrtvOxpw0r$M%zCID)f&t+?dg>T!L7a|hiK&)4KnNX6jsgtNQ>oj&U6C=v27x?ii}*9ZHn% zymYg#;^Aa+c=!?glAF8awE$zFZNF`Tz2C1?#=JXs&yVF^+rMnai#Yq9w!$wqY3R{; zHE3zzU+g7nd2QFC+=5(&%%$0NNhR?{R(>HZQj>=mx6_?Mn>3Y8f8+vL;p&EApO}9L zw1)FkYv>^HR*n#U3jZyzR!h=aT0FJrolBImlfTWF2cm#+uYfQ>f)dxg8=coU{KF0E zhp5En+VxYIF}8`5>@G(6vOjikD(lmY)s@R72~DmL~B4r z{}Z=B_^LCslMY!6tXH$+rViQM3Bo%u7Mr9FIN};3ks`097+AN!H-%+w+eV|h}zb&1ZI(Jj*zPtj*f-$4`^kTfgYr5MM{~0tT3C71?fHxD-^Ma^)Z3xqTDI0Ez-qiV z4h?ZKG%9%&+WbTJZ65_f#trSCb(h?M= z=sey(s<`5$xdFI9ZU&ozs=cF_wW5gt*AIef-xKSF_Up|BJ+))qnT#6RaUIZjx;+B{ z#_Mlaa&uu0qZ#+={Deha@f3J|u8Z*z;)4Hd6(DSMuU#8b5@4-h$BAYhB2VM#_U#0w zU5zDn*{M&4*;#L9)!PVF?tql9`HuDM9S1r>jmE7k3+*iaEQ?DXUEbYTxqzh`qT~k_ zKPA7_C`o4Zv2@cH^E6|mEO~lDD(XZP1$)*13T%0aMGAP5=MU>VqPzaJf-=*P?`U|L z^QryzYBl`iul1>0toSL|@sv$dTk}(?)mFY#G4IwlUnIpuN80>j4qm0ozW&j*!$@F>iwIgYvs6}lF(LC0CmzpJ|`6ArXzCykfL)u%%YUx zO^NpJKvMEuNKD2p=G!-+`n~;Qk*7g1MWr#WO8fCgX$01l+vtNZMRm1uv~-*s$NHGw zKtZL`<;zj18ZEVI&(9j}7Mt$8E_F|e;$a>7r4y2(I z21xyIsk6&NvH~Ue!JmdWl2ah^J2|?zb%j(?Kw>cJqDIeu90GiJY%FzT&uS-!sX#*LA64E zhw9~KzG^X;X*ajOBC!ne_`{hpSHg4XIFclASQKfjHCino&{R%}NJlbp>(2zTze{qn zxAk?|Z&VM;b87XdzZF#rfoo|@W7ZAv8Od7Lgq|-Foc7nxU$@r4|9_`H5fS~Vqa{I% z5RNDx2>Kym+~u|zzbX&I5bq2g*2+yJ)%nM6S1`|pNjf8AR!-_KxouTNJycZ8=N-() zJLo@I!RjY?n$JF1+Dv|i)y}Gzd|+aWVahm;d}u806PZ&e(?xSPPu9$|Jus8gR((&@ zYR@}g_%Agb*4e@>O2c1WOQ=S3Rcq>z*M_1f7xL#HTbNE}>v)?<{g{MnwB3l2G#I!x zy^UWnD>YFu6*mtit{S4WNThgV*8@-qUa8RzrLovgVRiGI zu4v52voT$@f6)4dK~^)MF)4{sZQb-|i=ur9 z-l#7JcLU3SYz33rMlAGk zubDCjVW3MQl>LC;?7ns`w}Ff6F!xP`Ovm@@=Rx-t;Wp z%vV$T0>LGfvg#t=KVnpQ$RF)D?FVj%d}KTA54{|iheSj=ACf>kD2u&<2%!g!G*u8g z+hW`AZ%xGYO$9bZ);~8|Ug*~->HbP)=#=+tb(K;uBn$e`eEf~QA6?JRCA*EF4f!YC zO|TdP$jr31*G7I2(t%HA^MFaxQlW8HK^kLszP0-*`hK1*I(R3NmZCae=1_oPy$x`? z$cNNNj{W#S_$Wl`_qpuKW@oT;tM^Z9hG6e$$3nc@4{_p?87aU$N+I7COqH< z6kaDH#J8PWbkIi}7_~d*koR~*eQhjR?$^8R#(xwmRsJ6*&Fz1PAGfvqX!>MbKc4vZ zQsZV)g%S&&@u)tFijG)Kv$!B@xCoFyz9nJveD${1;vXHBQhD!BpVGuRQ9Lbqi+3h$ zL8X)aU4mH*na8Pbu&&t`3rqIHnMYHVi`w%dAvz4;ZxPTXYCUg>yvUe0FpI-U+^4{| zOLlvh%L*~3(&^_M>jsqk7dC3m-FADaZ=mL!0|xDVVoyX8N0?m1PX-UFu2UvCx8@!3 znQG1-w0vkknxMYUhb>+oMAypAOGxSpao>4dV(+y5oC&>YZ7p}!4&*x)(47bD74?eu zSXRPw*Q}LU?f1uSgSwK1`g0w4zs|EvoJ*wXyCUF^TAv<^Ors>dcUDe;^pM}gJ}ST2 zkBDfIcRs(K|MZKV_@otEW~Hhz;-4V(D-e4c;X;1V1{H@cQr^eU3Xu+&xwzC0F5gYL|9@CaYUzsj4H+cAfNBsPD_~>sp327_wayD$Ciq@}aF*gu)9( zcxfh&=q%qaTa``pmlQ%ar*hF%0v8Mlt_>@UVe9G29^&tRQA=t@vxxiW*&tK<4#f1? z>o9(N8?I-%854G8Hi4%z^SoFE*W(qTph7k6oM9;sw7TT5Yaotw1*mg8yl&YMKMsCR z{`{6`mF!W4$d|hJRwG+x+h51aRg4(}%iueI5ocbnKSVQFbs?*u)#`Ue`go%EL0{|l zeK*=U#D8eprp8Ld>uuGyeJo$zZnpDfZgvbHU12BG2SsZ=zO0H{@@{uR?g>rFC*L~u z4LYD^R;`YVnfj#$lZu8!6^&4eSx(pHEykNyyJJhhg9ypaN*fH-YZ6Qm7+!lboHlWsKbZib7!m0`kuaIX>|Gz!@vUj(%1KoS=^{ zo=+Yo$~;UM`H(Z^-l%QaJv>?;;Y7atvuqBK_1o@ePo7MYDg9@ml$Y63)ZfZbU-z7Z zlwU5=otR&vxJVUJFkisuTm@0s65lqA=Y1<}!Oz!F+^}SwQqlj!I#S=rQal>hL4Df(d-?LD zQz-DqzhTlwDN)~T;xp%EbZyM8%#v6OM5>~J>HczO@<`1KV;sqvM%+PZw(XNNQo>0o zB;;DNUBS~s6{DgbDe=(FP<3lj9Y4vVRzV&(?q$y5bN}pPI|mO?nHV|tH!Yu`;QlzC zzTVXCK}F3sohxlKH_g6!c<7@Wt&+E_X$>2;?$X67%j&gwuPWF@`xOEnT@qoCc0nE) zyCVyJ8ShV9xI5^wQjs#rtU=}oyw1BGtHzi z{SG;k@RbLPmC*0^!=!tSD;F+VZf2XQo8>Pu3Jv*M$>Y4Yiz!y8@DTh2n==DB{`Ygk z^DTlz-kKx7sph-c@(zJ78w`r?GmPLbCb73qD=#V)JB4t?dohcQsOmuGjitj72+7_b z@^FGeB7S*w71MObqeyJFJ^53YNK?rDhepG-Ze&JwCgqQdBUO;bkC$}0{MU?qQ*iiC zH~RWN6BHRx#w_Ih?MeD)%O6J@X8!4~WVZ1O5#04ox!Bbcl)3$>#mIA z3tI{{y-XpRYK`;cGN-S)ndk)AHzX{6xQ#xb+qn;idEfsx`an7(mk@+7g_z}Czcz&Q zdTe)OB`E8;sJ^n7H4Ci)8THEUPIr%r`H`G!xeXd`U!eVp(!A3z3Z?QtM8U*UJJISK zF>i)Q%60f|kFrn1Q<#?vM~jx2@9ufb-=B-D2MZG&w4|;#yf-(ckQsRu;L-zwgLvQD zYTl5e-y@&HX-=J<#kPPos~=P+V*NAb%OtibQkA}HoP`*@K8s~@*(bC9UKQ-gUee}m zy_oOj+Ag=+XyZ2a>RM;>AIipOGaMJCvgUdNSl`QhV>8};Kntm$02-0ExT^;empkU2 z_(yJ`@U$NR08W<>k6uAv??`1PzKXl|JGf=tU~xjt*dinQy(3NBotOLb&SY#=x9vz3_04i+4SKe-kNa2#E#-H#oh^GZd>hL>?~Ll* z>r^K>Pvx^bb4+5_NW~rmk(5f~bIiP_9OG!yCAyhWhFhD zO%>kpU-t+zm^}G*p1zag&~FhQcIOT3hGrKB28k>Ib#Nndr&wRV zX~$E_UzNJ>L9Q0#O7~MpYOH(|ZIh>NlIit+QY*tnp2{Wri?~v?pMuh-97@gjDiH+u zj;mH6&38Ex%%rcq1%xeB8M5iOT-4~y_zZab`^t!U# zv|;-?*}CIOO=6p_$KVf{rnWX=W0@hl-?H8rp%;zJy;!ifTS2ZyJe#Q+GHB6x-O5YQ z{&gW%pu&2Z83*Evw4hP(bDZLjV64W(ik{-srX5(55Rr7Dgj`qI2a%#B>~aa!VXQ>->|<`O*EEOk^jC_QMEN@Y zUR?vDg>@h;B8n;IyOo)l_1LwX6-HTW|Jyg-?Zqz@-!Qs8p>DWqb2F|oHK>mx*v|vW zF>v|w0P<9?W+A060@rsn*;9?phss)CDBpq5$HTl4HkY$=iS z3QGSzKwtUWi&*Sn-%oy2PZ4%&e;^(+3mZ6%NRe;iW@ayjQm&2_Icf7POYous47DM? z9Kju-w>ubRM|H3y%>0};a&BNWlcR-rk1>jq+|l{5Y_z|qSkaU;Jftjq%8zWc-CsXI z^2@v`j!Es0j-+QhNr*_sF(ynlpGyHH1prow36_6Xeq>#Ja1!=Yv*)9<*n`%Os|o4w z9Z3h$kELg&*l4jxyMH#{CGUs)G%U8aUwes{`fIysb*=KX)5{w<2G1lp9)`Hv3b+~h z>DjC-pzOVS$+@bYAv(;`dmKIcsQOGQledO>!eDh4p~79)rB;$BR|HbUAvYP=jwgBe zDOP#-H$$U0sxUrb_l(pDcHzS+Uhw22uIDfTfd8De^|D(mXU zUgn}T-@8F-Vczs7uY4LSSdlkur8b&+xcLi?tYyE?js6al^4psU%DQbw#)45~M!K;s zO)w|dL;e-GUB`C}g2&iQG<%IttiYa?Yq5E@p3Zoj@v>V28nN%3S;h;9I^^fF^O5*^ zmD>H?U8j&-*EWQrI-qLwq3u_QOu+S=)aHTdy+Y-=H3^~Qs#X?*@kOQao7Sc`rK>Ta z{PJA|-vy^rp?%25;eXlA>#Yp!g0@Hv*>;Klc~h;27YR{UXU{M3qv0{H`0jKUyYRlb zXr$zyi?;(aP0k**h{YTEvJVR$2bLw^;YZxJzm8ja+(A*E7E3tJDj9My^FRM01(6rj zr>yk-y7ehquxqxWc7>9`OhaQJtu<4QQmn@ud2I-{6eE2;zOMq(jey-Xf1zpU+d+d9 zAf=K1RLJkoF!lZIav!q{gisZ=m-~=ZQ}4CP-M81bMDwHfkM$oNFbo^~{)(Jx%$>E~ zuW>~viV;_O>mTI&L#+amJKGX&dPygLJhO22#FnF#j3|NiP>JJdpZolMl(LO$^yCwK zi`1VxW5t%g#QRR2imJ6PGrc)i1hsW3vh)_YyNz$dv&+(|{vhu@0*nzpPkg_FVU;z- z=}qvjV$jNlMXwZA+y45S6g5qu3X-tUP~Mi-$59{(*~DHYklbWjI``3-7p;PAP*rd? zChgA+tRkpW9AlFD^uC0g$sm)`ld${lk#M3kd?oVImjUG?FhNcVl{17N=s ziZiQ`?mDFfPM>65ld&x&g|f30SwQIykC^i2xSW0t(`{t3gOCS}ijB0hDp&{KZZ}iA z(Nx`lbFU$IOjMmbPk2Mlj}eg#}UfncGyq|2{mb*JR+MRHf{#Pzpv@?~TeEw`ra^Pj{38`|JVrmsh%Z zLUd`(3HuTmZm%f&sh(3Mc3Sv4XCoK$1&*emnxrGape}T{q`AqdB+qfDZTd;G?C%y# zn81;-=j?(ta=qjXWF?ofVxCL3bLpwKg+<|8 zv!g1CaR%x#aTAYv{QpPQS^q`#ec_%?=?+0b0jZ&LC?!-{7`k!jMuede>Hg3)l++-N zjzv)6h*&-O8t^p^uL_-L%-;xsU<0pyMdrQ_-F zb@$f*%>y*%jmOI*w^}Ck=`(_3zwo?fWbHjne1Lq;E96ZWisS^PmtuSSLUej~Nuy>q zn`Q6E(RYxV30&L~U3@Yn8jWsf%=LxQ@a;^7y1?V_G2vM;PFUgM zDGk2R5>eOTeisyn>#zE_R@@X@Pe{n$k;{r+^w3fEBwP?(nwv8JYG==VZ<&qnH_+`n z#q|NPRW@vm=I&_C0{@h8RyIK}uy{+OB{e}d6o}UZ@{F(so@m3->>B^$x@efwzwd_E zn`Q2d=JwZ6ex0HM;*b}A&E~$}G<6fl*@+5+Jp)DmOq9mg#bnMz;l@goM;26%GAxrl^sGU8e2p z7EWgr^Zv#!aplE6gd5#-HV`7yD+2nRC?lWHP)NLNZWVMKas|0Y@r)sXtrYT>yp`+> z=b+A`5t+Q^5IQ{PiQB&6jF`Z%=l2ChRd`;hbR@qN0t*d>Cs*7p?E-5}2~W8|=}X)qKA*r}e9_dx@CWmt+pse3MJ1-!yWfi)|c%(VyM^^BhRP z;C9q>6T<_M^P)#|*uanO0YnaM)%}sldZezHd!VQI08n&-(FZ4>Xc)?bs$qm(4Jm2+Nr+>WiBGeU zqp$++{jxYWTjJQqh~-7cG5O<9gk{()r>&F7dldZ1vf`nBJ`CH)d960mU z7_P*~S{7RH8klc40A~=qawHYA+$S_N&={?Ig(qo<2E^icPFWp(eeolMRq=vqZBnSFd}4;s2m z9{pLd1s#jQ0rQX?t?%~VIWS~moxV9qU=Kj8_YeH}%x@3Tc2&2qco`gDb<4$PfC#_>X1Ft-)pUnNAiq|_No>KKGw zXg8@@n-0^5UP;~a@y$S@N-AYLf$!hwoR$S$DS{ah!M;5@x@WI(4G^DBe&tfzZ0Km4 zg(j!(eHx~+=m5p~`S5ppQhk9+&`K0ReZN8om75@Okc!v5BLp$Feu%1>J@U`f4AWx` zqWBr8D%g_{9K}zye2OdAk>D6&TIa&dWY5{UT6B+ewr-%pyQ3l&Tfk)nQa%j$*=g`q zod9X6j^-#wITCR&u8^r48##twQb3dl4DhmkL=ABRwLh z78Sd|`?&^qSJ9qqT}_}xOs-yMPc%T7a0Ohv({qB=g$IQWT1N;ru7U=U!JF>~WFT_j zX}`!V*++s(JA;U*&*W-8Es8aYBJj5ZqK;i@eu3rMoE`hNL`jVrF9|*d2@E6K!)h1m zcEEV%of3*h{=~ssjm54CkV!o2o!^D+jSpqhWo@bf+@VdewL`lNh(c%i zvVKziy2stzQvG8Us9U^ALToOAyGPQ0|3o#VqFWblW}W%+u?1h&YANsDmU<%7<{I7G zg;UD6Q^-j!Mdpv>KVu-2D8&5AWMN^l`WO=)r#^2zWA2T|FnRTi=?U|)QfO-i>)22~ z`*EAo3(Udv^l=yqFvo5%Z5&y4VueR)+|mdC*n1P@?xsg;p&Vj!*OotrxopDZfrSDVxmFp$DXT^_0_h&@3>K%e$ zG$E~y#;$#u@thPX2|DK0OfF~C<6WUF1enRe+0CAmfXJ2$%oh%N3U694EREj=A>N%N_RLeI9lGPv?@?+0Tp)&i|>)YggsupR>K2o)pmTLKc&#i z^uIkk8lr%J_Ibh}agXCDoDt3?AbMAdkXSxF1*!|m-FgG^nl`UTVJtQh>+B<@9!5e| zM#19&C(MJ$8upLz?dmC;lv{>~?$8Adc#eki^K)Fefz^S&+mso^TOEXLTSXIxfEHms zMP=5k5{b`M9E)^v_av(Ja5vtxBuP_tgOW4RaB5HltI=*FaCQJaKCX2mr}9}C)EhNy z*JplMP`YZ)Vqlcc>_??*o&8pFnl%8?2T=hn#i;Zn`qj0e)dX5{J|nL;UdtJWybP)p zcPxl-%ej{37jiY{?SKu7YcWtJcct<5{~9IF_Y{YgfNxFHpX*`PdS7>G&OBsG_6^t# z*DX428-iq~FyT)Go-IfxtpC2wHej+a++DHFl^MK`YW7|{*wWM~|5Dq_yoiKvhW z|E%A4nWp{Y&}LfJ?5%cgHE&Im^uc3~{-Gt--?cky-5IH#?WQyp%oGOk&@X>)K1;sG zjwK?%5g7J43;bgFT7Y)29~%Q3EAVIi(U<2T?2m)^g$l}IHiMACa0@8wL;5Lo4=k2) z;cBId#Y!S@Y`C*ad&*R;XSn8h`WuaiO&-F0s}@~n&ZZv(YxN0Ez`8*l{-y;|7-H4F zEoN603fRrQ#|(Qgf()K@(TH&`gv-?xL7V^1V=dHurhfdK~#PCMd;NGKK>f zh-bxcElAO;^0ZH)uGV-&hhKawDjY0XWx(R?9x$X6&QS7r^VMUlp6#!AP)W8c!Z4F% zV0t$^m#W)i!E{;AlTtGx3^Zb^FP#}~~3kcOKgmmV=C>OW>uieRK()Di%rgZ8h6%DznYx61|*q8Zp028Y>pczwE z#lZ9scCDV1yxH;ws=9d!lw;8w(aAwh#INPNOj|US(M4?t4Ml>n{9RHeDHCE&#mRbx zo!X|48zf+#6H$(uo^>;_cNsI`RxMYO-sgXC@aizK7TVJTUX_NmEft4!d*qUPx%oTz z!*p`wZ7)2x9w0{&YqyPQ31g5|$K4126m0j6|^x4|b(?dp=d2|9mv^>7z0gL>)QL(OnejTzIw)Zd2BI@35x2K(u>*!$83B~zZP?U!!Bso;K1asCT>NFl=`Y6>pi8g8H_Wb z2y!BTZY`Yr_4VU=9?Z$>vC)YY^I zRKN8~RV*-;=v&WjLSy1223I-^YL&V9SrM`j#R{ydhD5uOX}Pw0l9LvebMw(GnTemk zd)>VQDz=^+`+gWz`2M6jr*9mR71ZlEGQDe#*izC3r%WcIL|Bxa=$%AQZ{8d?xWzUVAqVt=&Wf4!r^1ZfDD~$Rc`q+jMUS_1VeOL-W*D5O2rsHBqP^2jFZ|rn|45} z_qQNOpCm|Gjrf^Ni{{4FT7Vi2`ZuKC5_CtqOTtY&qbU*K(xYb*u7xz5_4m zNc|?Z;{Dnw6^`o)N{jy}ja<(NP8*Cmt}OrxvzB{X%%Rd7ExKONah{W$mk~6`k7@B=j573=T!Y7KDB0Mj9 z_>U}xRAvWRg#^=cd89sP@+BeHK`&<<1rgRNo04PAr3cM&Lv1uYQ@bFXHW&b}z1@Tw ziyo-$IzclmhGM)j#BFva$?9IJx<6UV?zk9pM$biMs-q3+sCkTz&M?R!TSe(L)qW$50ynn$Jf1E3KEqb896*`=N@rCO^3}s_aJOn(*K~9_^svgY0N&_u zRlj{E0BGdXM|M%p!)m7DCdOr59{8nBWvJv1HAf3H=V-Lk6SdL8*MA=ScPPP5#nsTN z+{Plq69f7%Og$R>eq5Kt5K9FS%4cvpa_wU2+cP?Tzxm8#T~-yNg|gLuMeZS&NnEi9 z5ot%z<*jEkr9#TiptA8vk)0IbXPt74Cx~wEOK^wA&Ukw)M+R*3R{tV?+L@V5%#6Sk^$|p62&rQIC%B=`=OAh=gBBKh%%&gh(+sjvhv7-tV zT8hp`MCWzR?Av@9H=C7eAHNs*|;%N z4zGtUF*g0aqzOGC5}HKeh53R~<-%n(#}y#-o+QwUO81N6)5x*~%SucPK5gZ@lH7I1R>-+S#5H z2^ylkU}t$TVo)w}6pC)s8`4J>b6d-Ub!yz$`ON&}AsQby*uCq)b!;qc5&ObvM_27B zcN_OkQOymd>ItyzaiC&7G$4b)4+2CymO32Dp{;)um-8S9{;KYgPD9T~hxRoy7St*g^| zDKG&7&{bmzb`=#+o+?dywPIIRC;;-P!)sSFW!&)?{JcJ`Set7onfbqrz)AJrQ@CM-v z#`0z>Yg*$B>~xi?pW0TDj>Wu-KwNc1+N*UQ229!oAI>Dd6(LxW5GJB$eJ};TppB#C zX2*&*mGsQwCqCB2BYMUtwDAa9y_TG~dOoe7EMj61Mzi~pNmkeLD0k}J6@PjRgAVT# z2{t=GEzk-mtf>+dS@uMT3!9ARGHwR{VD08VPM(VHp9AI33GgtO-1rlXTW8L`b2e7UV-og6PB&T?{2N5biDsz{78Hx3^rUy z=p>+b6_`z4x7uYePA`05hqlCU+n)ntu%A;Rf5U!N*&ThMN>kgk4p2<~^U1tt$;r?- z@X0zQK&gDq^BLm!h(g_5JKj?>5~A1eta0iu;5V@!2W;#%G;+XUcK5V8JRrpjkGwlM zyQwb13m@lKh7CXm-Rhp}`xU^q`=K@B;T75SxbzLJDpkdf7VU67`Xf^Y9nNlRZjG3X z99-toIa^@atu7=td|&)_LYOcA^2^Q6^-vtgMS_LNirn2()(F9n#}yRoEJ2T~vXKDR zkta8MtzAC(DHRFh+X*IXoRh6v?x=oz@AJesR^U_Nj0)|nVz8g|QZ5Dd_Q?&B70T*J zHjhF&Uu(E7w(-$D5;zaJ>+5&MNna%37bv)R`@5;_scO2nk4_H%>@P1cz)BBI*lFg( zr0%32zHC^JRMv5k*c!ysXQqm4>C6pDWpaj?P(Vpz;de8qu3OFL7`O++g9@zOZ%2Cu z@d8_(Hg}nU=u$$Ok}~+?qwxGR(TA@|A~b(NH$GlxCSHYNKK}l%Qq@P$^dlTdg-+dj zldD-NWFH4DzwZ>hS4C`HyOZ)1RgUZh6?|ug_NShra!*BN{i{B^-10Q=xz-osmt~Z! zuP>xAU$gYdMhh8@Rzz0QYK0~6eP0OjFe&v>W;lsGTD#+4=JfHaIKYNkGgrKH3*icG zT~WZmJz-`aXFc)f7%RBT0lH$kS0(ox0k7fD!UOC(1xx8bx~E||)#9F#i6|3>4bJE= z?pl)VV}C)LKFME`@WIvNjdcvKkeSN{Ethy0;ttv~Nr~hvc~w%>nt;(V9t@hjhPcC@ zAu^gk2AWu9%w%TGh4gy~x5O&{Th>=gR7Vum*1!84%#u+;vT_omJpFgnN51aVn+q-TKp;rEZ8{=sM91IhZ+uAG z)tHCNm0!A~R4A3L4aElS1kO29 z>D0b(;S(>+8+=NF_rdJ6pVzFMqC*I1S*!9w4~{;8ah^IO_ie--Vc(_Gf){6YB>l4A zyj5=b5ZjnzbohL$Ai7xFTU`8dJtZX3m|^XDN4Z1=*y%6v-JWTy*0;V;1KLU1aUXZ} zmiRW-OnohHYgyOli0X6ox3ZIBTb3UtgzUpq&^Zk*##xJ;KNU zx_Oae)r4oj*hH?~IiR0BMJ#qBDk=9TzTp1$PTTT*vfmbNC+zOE=x+3)@8?|?~Xs1jvt&`2; z?L2YH;iIGkhv_UH`a`f*`ZFBh^kC3_$` zVICg<_`^`xZ?X2%$=6a?0s+0%8O23}`RtMQRwZ&5vysV@=|U~A$lb3oo#%1~6e5$h zYFRz}rpRU^ne0^pK4o&zhZ&hbry)U(;PBBUwTSFZf#XS6wB8}`6^+Wfcv*%uxc*M( zN9PfN;H16_;@ajP#z{v1t-A4{5#U+YJ|@Z%i~-BSZpR!ahl!vKlEP?kQ+=&8aOsbo z$*T$sDIt5t+f{Rq0~I3sqnuw7TG}{rw=Yg*`6M5Ow!Etb0)LMWxY^!kre z%hHW%&h%Iw7K#s?-{f>SqODMB9Y5V0?t)u@OW#NQH-S`jw;r7`5Pkc%YgaPE?M(DJRS4ZZdXCL? zn;F6N5ankG1o<*vZj2hfLzBO$==-5?k=`}8w-uh#0+^oy4&E94k{x~g|Lt#Cbvk;O z)Em^S)^ZOhHS;nNQeEoVbzwt9y?9PTI{4QYzP*eNxcuZBD+Avn0h-+f!EM-$|!m@DzQcr`CK^ggn6&!w&lpt631npV`hF%k%QeWul=U#?=<2H|j5DW5=tzH$J)JhqWhA^CE#qV@DWozNEb1xS zVED}~5|zbxHBT%ObYPUG_v`zVhF730Z&Ld<2~_xjZruLg+B^Jf&52Chi_b z5q%~Dj!$#V<-?u`ft}2OebtB1uVb#Sdahr`3r6_Np>)>OKJDtK3{;C=or-rl0Nh>S z1yA%-Uw9u54U2c2VV_>g_XBTgHs3q2O1(xqxF18ovuMD1Rd@#ZJ{785gial7-7cwc z0ocYV>)cO_(`PwSEF`#_>*Y?Gw4pK0 zkYeZ-HbM5xqzSF9SNw#B{=@bf0tqWP8jG zkZNy1&?hp}G4M6xik)s-_ONdZ90n ztas}mKOnATwoeoNPTUb)3_f{(hmY%Aw$IdLQmUqjw)gVyF+S{4eOmOIwx>Y*XmO}- z7~XhRhTI-`i9e=&IcQFg3j)!PPQ8QR{w%1~Dci`|#*GG7=!Rnj3EoZImL2^p9r;V1 zm8CNJ`l;21r{%*b*5++c6&gR)F=b+e)ZF!d)zO+h_)MXDNC+eRwDd%ykR^IOYq&tu zjmXa)`;|5)cLW_u-t z+a1{WJWdVbd3%UTZE;rulIrs-ABRdV$3A+$8%!~dm~ zaqlO8aare|Q8e?|(aL1}kBUa|B%IxMxjGkrG3_9OzZQ>^ct0%~Q=!LJCh2+`G$wXv z7~%<7Ir1x)J1p7^S=2u&&-aT_Q`+!G6Vc9a|5-qQsrI-OlwkI*C38D<{~xKXF)nO8 z?NpWM_)Vx~E>BSRuV1xjGbfw58QHO)(lUStn?G>rCxl{(x#mqw{xtn2jXb8f)&{Cl zn~~^FY3}daG%{ddBH;9)fiRz(%@0o+E>Bne3RJR6g2r5VNg$7!ZI`yC{M5g@o9WIN z?8e(dlbY!Dipt-&GOgFT8&KZ!e4uaYH|P7K&*v$g2lgZe1{BW2OLBs+qG(81!LLzY zxA^`xk>E{!wc(rbuKC+1Mbp|*8ZCIvQj|JBUN1&{8BEJSpE`Vi?Gu8#Dskiy6L|g- z+{&o#g}DUvS6gRX83*=pA}+39itq*)`>a^gK1R)|j^6fu9cnljA=@)}#xLV5DiqkM z<(KDCr9}4G=i>B+ENZA`d>fKIR%6Z6m{UCA#R}@@BWtER^_N6L4UUozZ_NDD!qA9C zJ7n}lY$>wmQoA>Drj9UwMB=LNG2@l`-IdjXb$<(yK;n(@GkBeh9%M}a%a$8e*}4v` zb(!2QiVxlafoP{cLbyVu*EhBR-oM^(F6lx~KjwUmJiAhytm!-MuL+a-P5Kz}k5b=+ zK&wDT3rBV|9o!-AhnevOY0FAJ(vkc4{^jXyXUNcw*qXmcsX!5O&rtr-@BOwxMEOf= z_6rr{=y`cHTiF|@+5ql%Pm+^R{H`lsQh}G*14s_W+UsQw#qu$1cQesGo?UpxU)1w< z7{>iWi<@g=2eRxS2JsuIa{~^GW0E7xr#b%4-jwYxrxynbk{ur$oNn`PKX!}`x`L!b zy7jhT{{0xu15uuVQ~;E7z~T8}J6+kFx(hZiZ;IyT?ZbgcE+iSwVr%TnJa|?y1l(AWN>It38ECzE2lDJ8WH_-2m%` z#yVD(8ES{1C%0y*7V1BqqpLxQa*H;;%nD@rA&U7+evg^0sTFJP2^j{cYS{xglf|+F zP#)lBxA-TZv*Q6yIRPx@A3pu0Pkv~7d{zmP=C5g}*E=Xm8k)3ww;i!3t=E_-CYY`K zyJh;-*taChJ^u^Z(^h*S$n*APtIXu9?KTW<2K;?IegH{;0FmBTLDJ2mQVb*7qz|~l z1~**fDzk}-BJuWzj%X+RY_k!BoPu}wQqHbfxpo}iD$=no_;5OGpTTN^i z#d;wzj~>%|f*;56OjZ7ZdU~{6*#`Xn-nL%@-olDFkM)(u#?7xL33fFLDEifc=yNMV zF<_KvN+mkKq->QJF@k1c-}g#QEo>5sHRVdGo43J1OK?3hR3!|Q{Dla)i;r{6eZLQ9_Q*a=U0ev!+w{iy6Z zYc;M)3s^K2Ke!p!X#@2NOEOE zbDljV{RK@u%wCIE&|f!!Tw?t=e9TO=ug+VXZ_v@#x!Y*)&HSPqk%fvCka1oW1r6*z zS2iawOK`6GP_5$Q*+}s2+p>}o0kr5fSDCFjk?%bTk?%GQ5u+1u;K;MzAV63`JJSVx z#AarZh>Sf{4q9YNddnB*+f`&t)6_Z%_>}VoM|6vEZ?iNj0xJximC=8JG<~pZ=7o-mZZ8;R0O)j~VXu zIsM)pHOCFzjWY5}3$MY9LPLvwbw?GoXZthnsHx@R180t??j821#aK}Xkc8YkS@$d< zM8BNHqkn^^#<9C!&}J2%_uRIz8(;Zj5++IvZ&F zYItO*g?E$&U(Wi{W+N=!cIKf74T_=CoTauuSEU|9{OoL#)gFoR<;6Z_ zE?*D0=Rm4wWEZq-XwsOpPCX~T25DkoEK$BwRM6F&8|ymQb)u%4lupk>eY~>96PuTu z;2MbiZrdcd-t46I@mx55UQP@VGly3tv1H(%hdAz?mzv~kn&oz%Pvku69L zZ1T!g6TG!-=tqAobs}`z*@RRo7$$XtVCEj4qGK)3ddwNcM)7U~lAi_!9z*k74 z`|n1aEv9&e!uJiR@0wt~uQjWsMYG?B=bzoJ=cv9MzZdi93Lcz9EwK?yTK&YcdA2^V zQ8ySaL_c^XSNDjiZjqR9f zHLQRsG^-zrIB;A8q0>rJRWJ#wK)nIXxr@HfFTeBZEis>DV8BON(3~T*vF*WsCycqx z-GD}ajOqHMxo-N^uT60G<9J7=^&!&|ht)0YSGqfApa+~nVK&G5xdTQ;%hGwy_A8E3 z&gGzu7IBAINpU`1bRu|5KSjCI8gOuO35~>hB&?tE$=QI&WW`;2avc0+AC81>k#gJ= z?`hu(vKDE;(oMCNgpHeK<`wzrDni{JUoZM(R2pl{CLH@Sv!W2>hfmRoO~80EO(gXy zbKWFMWBx%{4ww@;6_B)?kb^i)*l*5Zb=4n`8Ijave)KR#v^#IyA~NuaInO(|O)EZw z`n2VC=~)Y)Co@R{L~_-whbLmmx9GO%t_jrkO0;`YJC1?5iE;fv9t~L)n&@>`fF7~E zy>K4_`!Uww4q-cioXbo+yGxE<32>u>cD?)OjhR<_xI3REx6Yo9J9$XKP@>Fqhb<@V z3q;4)7@NK`YqE}0j|Xn(N9Eu^ahBC-j`epX#aI9AB>zC}>eN%fWqPCb@1^ z`{~Q5po$%Jlt6YXF1r;iqMf@mK@M|J!W5|~7njf<7F0{kFpYwF7^f&*DP~pq()}yD z87`ve_ioJi%IF(4f1eW;jp@%{MHF~FjHxl`S3qqe?6Ehu=k~q%EGdwzAL37Kho2%nQ^!fY%FgI#ay3UvFU}&wuMX#W$X_Qc-}L+Uqe`yvV~4%1?JxjPp4Hek3-Y? z=rQ>F-&qK2b#p}}#8^@q&~sYWoV-}cR}&ayfjHZ% z3QBoxv5Clw@y{>!g1%CO@tEPwVhnb~*hjB48+fHo=W6o3UZ83vZySb=#z1hkE zjJWfXSRN#y%mmdX<%G!w;0cHPfRV^cf&x-26Yp~id-`+oK7r$n(8QJj1DHp3OAaG^-$hTrnVUI^p9U6|_0JLK{n{sFL zJOZuqhQQXB$^{yGZG7Kz@Ksd^98;@crr=)Llw17f-}sWmD5YMH!AR$DkD)cm6YV(t z3c;csWAA_=irbW8OOpzdXEv+_xrPR-J*SlG!`6xGhqg~fhSp?MaECXxmkbOq&064V zGA9nrm&2Qh6!VPdo+wQ2@YKV~JBa%CQsx1o7R@9)y2zG9?&(}sy3-Gr)^^=Y-aLkmRiWC3!U$6bAo;_ zPB9?)m&p|Lsh=nbEQQB?_JP3qi=*|;gx6<(wTKcyCuw-TBJ5*jw#v~X>)J+Rz<|fE zoQqtpvg!%%uB7-HW|IhIH+DXh_fwGrzk+?9#5Np= z&0QL{@R=HNE?hwHxv zSpZQ@uXxZqJb-;H+rH^ew&>!=P`%sg@M~-g(qHOfNhJFc(qzGE2?&zetSOSETj z#g@I&?kYJh>|m^%oFp7}R9K)XVg*Yi3D9HXTd{}0@^;`eW{4C+(h8x(=>B)l8WUpe za?ZA_m#dL+7~IkC7HaU`P>S0O;qj(qGnF27*!d(=ka!oas>+V7$E>CKm?+YAZk%9F zXq8G;3t>f{cY8|))!qqtm{9PawK%Hy)17+K(RxwEHCeHi?L=F{+cz4iZWUxX*~9z1 zK|X>2?|oeIJSIM+o?@7*j}gohO?{#uev9l4RC4&epXrdi>E=$xwWHUNOkq#lVNk>o%XvsmygU2kL+QmAn$JkkDSV>vJ7Jo{uL0q*klYt&KR+hH;sO=#R?vN- z=&F@MxOQ=JmSNz+EzY};C4-es|Z@y~0zvG2s~9ey8yA`RIfh|lE|s~=~LINLW`zvkisQ)Xw20Xp6; zZw8J)ixKaE;7cr$=yxT>#jLeQ^x_^yS#`pW?^ztDzdWVOz0v(Be}!Wd*m?Hb6mhLv zjL6Z>bUPf6?UPQ~e?}$Rmm%$JHt}x=V(=8;M41FcLkg;h+t?N&&2PWTul*Rh532v<32$DGM<#Zo$voS8~ zhO11t*@1tr*GL)B`z|u*FHULF=vQ?#fz#&Ss70JNF{>Fj0HejKcr>TOdc2xIViP5T~ z)e-Qm*a7gY30E^Yk8YqYBLT!(vmTuwp#jP`9ud?2K_>0WQ%X-ZxUR}uAKQWMuX+lp zz+HzfUv{GOy)P+aUj;4sxyvQ?9Q$odxgB~w9oA?1Wzd+|?J zt~~Ucy2?Zd#i^_!{W5R2Xw#WNbGIDX-MXYdQ_Syq0wp7tfKNh z&HWQFZ7mL`FwW~wAEHEra@%H~M7;a0CGg(2ux+A|Tz_w=gn17@RIoD|zx7ZQ8lKJe zAALVYH!%+5@7r>LY=Yh}I*m_Xwy*K42Nn8do-Bu*lE)hpEWH3@E;Uut+vgu>hGnac zFWG-1*8Z#6zpTO*>sb&Lcr5F6e52U@{i|qX82M5&xos~owX0Sn^k~m(2SAX_9{S3z zlf39LE-Zmr7vu?KjTn*kXmQeGTM>QLee5O>Nz_Xm*T3s5e5Bz$jcvn4-o{dGaQ|k z<%j6t4sH~OIic&Hw-B_;?ADiwyOwV|Qz|G~CmV#bn!GhQ_45j|JEFyyZ@M8{~$3se?iJOdx>eRjcLh)wQyL|EK?4Q_Z5tA%1YH0K+GK$4VtdpKFu%Jq4e`okAq-W17w{0_L^S`F? zb%;WSKD3F?Hh%MmpbI%Gn`GL=rhNiB^(J6@UjIa|wz*o}v>zxZ=hKR2%MTx9kVC`` zlV3A+Jq|dxKt?pyy~Z`@ss1(!Ft41SSLPST<+u%HEwqp==wKEySs&48m6TH|Cw)l(7sgV{S=G2YH!CyWls z$D|MbzEcLn1~ir480MmswakZkBb4R>Y2=;5-_gIQmD5iamf64cN*$1R#h9cUE)y^P zhB`4$TOcFKPwd3H@R$P9qN*XerONH#~xOMnSLsD`uM-h45 zLd;V#lyKY(Yb2j1el(s^K<_y%0MKfmN1G$S0z?a1KB_@$8$W~G0fVd3z6{EFQ#2nR z=&lA~yktY0=+K}p26*L?7`?qrQR@OKu1X zDf3(xr{0X@v0AV4DY8BrFTP_5euUhgQV*nTe%N4N=F#29()DbmpPrQYe>=_(_CuYP zYVgMAL?twcIkJOov| zBUf=3yr5#03BJ3J#r%GN>wj>*wNw^O_LKGj{y){icWG8}dUCG=N0lQ^KmEjq-4=kB zeL^$R7lQPzF+r?DJ}v?fQ^_ji@`;ezeT3dFW$ zbWjGvl~%l59I}K}Kj00@RV{zJR@h#73rp%L^*i%8ITdRgS0SWB%B(&>i~f>4?eK93 zN9-GJlG0IQwulSEkH2)Qykn8_k#B(5KIX9A=cHq3o;(_(7eD}X=1UV*GJLio|GSGN z8VHRRRF-@W{2|_rWC;bdt0}mi=jUq|jJe0w<(ursA|eJD6{qyXwCk%T@Dtv8S**X| z?EuibJ1TS3y@Vu*DNYW=iPW9}-~ri;*NBflIbI|!JrPs7g5r&t<*oj4eu?e+Q_#`| z$Q}st2`#)k;_m&>tKp34PK$MJya+!{JfowhTlC9hD>h&W3YM}o{}oN?)}>mlrPX#} z({}#X5y6E)W{4)l8vG{V95;;9e)~ zZn3JIB`KLM6zexUBa0179pFmK=&S31YoMLPAN>?ybKj!40#Bw$o-`9k@dk2N*2mR< zPkG|U(juH*XFb`}Vcj34TA;eiKPk>YxBcz-35~msDmMvH37{xJ5-uO-Co=rS2R%B$ zUHH(9rWwA4AxBS!s9CNu_y96p8Ex2LUir=qzd65KEBvjOOL?bT)tA=@@)Z4P^JgE%WO&o$ReRa-70A~uMb9KKkw|-;P`6L6!b&gaYDML$X`Q- ztN%mRTX(hjeQ}#uaV_peibJsCPLURu;vQU!2Y0vP?nMd|FB)8n2Pj@B?ivUVlke}D zHEU+gA9)2?_de(B{n^*`k>P!RG^)~aFl$C!kZu{q3~pmFUZl_o>G0gw#YCxzX=A@q;!PX*W_BUz&oMj^T@nXLAs2{CfLRu&a8F=te#0hXBacvsut-xz^s@a=rZ9fL6&MF+E_9r%rHNn%Isvsj_JeaX9pxWchDH{W< zY)w*%BeMdAgbsjFetUd-55M4yS@nCnZs`3XBkdzw0&{M>;<`}ZK|cz!#VJDdG^;s;0qL~ic> z>VVh9xckvtol74TlE^P>H;yq{tM8oFncP;l^b__Yc*SS?G^}|FMAu@A44%N&Uzvlq zRBSu%SP^7H*x*}Vvn_H0+qm&`<|>rjvT~NydnZddgr*uB^{(Zv{i8vUlGJPc$G2<` zTHKQzptOd)7sZb2R^^A19nns6q;cK;-f({KC6WqWqJ_B)F*R`a!8q;b6uzJ%((lpH z!wJK!I8W0#+5AV5IA(f$WyjOq5BThxWvJ2$>E*;uE7|?imH3#k(I2j8oP854>J+|! zh%ai7MSItBHNFVANWTF4C#{s|h@{`WJp}F`5@1*jrPNmO`y+0pR!I~{`F#ohr%NIq zm5sDBE^)0Z7tHhSR@X;rquIwefAJS)t&7B2d^@pU>6On{v%!x{{59g2IJr>>8K^^U zWlI3n4>qnBSE%8%XDa*s?S;1Mp*W6`yHbD0@y7dQ+P0K}LZ6&m3^9Rv>$w|+7jI*F zbXdqJM3=iycHkrzjq7Rv>-aI&()QcaB>v6&Hv?UQ<6JuY0kR{S^E+?S+TCbZfw`@s zXyeWnYMMb@UBXYvopvkX9Daso=U=}pYhU9PDt_YAh0O2zWo4d(=4aZ%VbmvnNMl5W zFB#U~Cpm6kVk(2=Fm3g!ydX#7*4fi9QgGBu+6|hXd0*f;cLATp)_x8ExRm$-{X^lj z1uyC9DqX|4A+A~{-!R{78#ajmk2kYlfzPe!a++zWXhQoBax0UK5UyvR##B<<)C;1= zyU}Q6&4psNQDwzniw*GgDt?K&EY5UsryIl;4{pg3{gxLND2ejPyj-@4Rd7J01_=kJ zHC=t`47nz(3DQNIvgC(}NOtcwyF<6Dj0`&eto!j~EekOqOFb>-11##7+G+ljZO z0W&=eG@Yi|w86Uk{r%f{6&lP&ZRL(;UvN1#0eeFYJyh9ga46=I{Bwd$8$2&N@$UF; z6jj)aqB%Ut(u^n}SjSvWmKu+p;%cWcZ+zOF_lXC&`mTYTCtG8xUww=Kis(i@>?kJq0oFRwemuQm>^Yis{aX{IP>f2gi!=sV+m|LLe8_)NdGl}~3TsLD3g&Zmmx zj8B-!x;@PF$46f%Ey>k#Ab(8nH%|1OsQ}7WXI{ma-YAZxSPlF}HiwVnf#3smce@{Q zLtIC7qX?#a=VMR>4({}79#g}O+t!iS6Q&tcUp=60=mG_~-U)x{j2#WY*x`-cRmff= zHy;Wl*k+*hMygy}C{f@^dbBlEpx%WyAn?R!+n*|{ZJ#{hh>S}3+L4&#uJCvkf8L(p z|HfC0B})>f&g0&1<#*b33vzebes)XUzt#C%pyiIBQ~VJWon zS-nafw+i(3|5iv9$O}AZMzjOe8$garDm5vKVinBc*3ZvDLbT1Nt zh3h{O!vqGrqqC;BP91kd%~7B0pV&oA`9iK1oSU(V+Woxw@FD>NNi%m~aqISkt6QvG zsR%f>{?KgtS6+=znxNmCNkjF1FzVp*yw3R}9#+(| z@D3@W(~3XlAer^_mFrSvtcQD(XZ#8%?Gj0-DgxSI zQi#kF*}tSnV`#=Y#x_7c^O%@Gh^f>5F4wvi$mm8%7-O zc$k|sf4E=;o4AW~x1I$Vu&gm;pX&${0xx-!aDa7s1Am{Yg8e40bY!Y`M;NId1O;yRq)w(l^--0rWc zhlZaS&L+La8vT$nd?Ex{XZyQYc!Ax#(^3fIuKk^GL4vz#i3Q{mV7D+2b_0Z9CR5&; zEY#Wr6&BgA60?uzh7|z zy`J0SOE6T9KVyaBI@HghKDSjzXv&-Km#NMNMrN+aJC~bA!4oRD1oLgUZRk1e762vh z{A4cLFmdQa*Q^6$ImDYXs01L3Hz&RAZ8@sK2{(hlP!oy)1Gu6-A(6^i11QIEZnL^= z>BCruHVOXeze}6*)e;~-Bim$ImpqeN1;#yPrP-=z^UInV>;eHGI5EX#2K{2yMHG6B zri4*S{r9GccqvM=26-6Aq-K;xG-CLMR+)e^hXwj()bA;{nBQqldyh3?H*~0(TVfBe zEHlSs-LxD2{EMhlRLAkdV?9_Y4=*-n&?NewXJ4Ew8G~COC>wd-RWjU0c*|nrtH3bM z%Lm@bP*k$%?UwVljGafmUI9X(4LUz!W7}>i)4In{{iAPU83`bxl-ji)q8PZb4Iefy=?oNeugYraVN?cPr)f425NM14kx(0zN` z0%qU|lQ4Y!X?#7N)iq9pYEBi+mb-`pi_xY=TQeI8X_a}6#*i;4hq&x+@m<@k(y!=w zQxQrqpBSh$M8qw<9*e3}#Cd;*2+D0}sW%>OBDj1xdvnCe@V03=FsmjJpVP3prB{^Yt_o8$r?IZZ`$Nq)e3T@)Y=?Bk|K3 zd&g=s>&w-j?Vk0U@alKCYV+%d7m#Q&ULw#3-^h}q+gyZt>|5<|UIcF|(Qgk$gvjSs zA0gILi3f2F#EG)9#+^(vN|8v@tzF}Ma$QmIJgZfL@&DI}l_YspBz4YLTwe5Uj4L!7 z!#O?NI-fg;N})Y$6#%GntR}X66p7P0)mW$~>7ywJ#o!>(k0Gi#alH9y4cXe@T@LG)Eo^M(CEjv(y^Y&Q9#GmQqIi zW0o6{02lC3GQTie#FnVn^(q!Z8{pmZuVEu~opUvEuu${Y!mMFC@)yiwh?4^0!a>?IN$nH_F-lHu^;ACbWQhWEG2FCV7 zQ5A|h=(JKSP%g{WZ72V~O^l7ZG67Zl+CU^@gg5Xk@MK|~$R%O)`qz+9L1>k{J7-ZL z4?l%&8+z%S{5hXbS}5YjmSkL+s8dl$aTRB|+n zddX6TZeqR9Ra~&2TP9`lVkhiBFyjIy7Yg`sw8`VVvo7O>ZY%cS6yYYpVXc>9%^cSk zd{3qLBHZLs7U&(N=UMDfXJ2`yTDD{W(E@Bo%}D?9*H1bJde<)alfVW`9f? z$y^@{?1bEYF~x6^upCR*2GV^cz#KC51WP2>lQmL6*A=E{hG5yC z-1UqtQiz}E^>=bRhr{EW4K2Gq{f;_WfR#|fYkTbWqkXcv105#zlNp~ zd0NqSk4>mxV?9xReF0*cmtvVL?95m=5fs0%A~_38;$%lB(DI~FTJ6up-6Fs~+G>B| z++X&uVRO+%J|UP`iT;%eF}Wzn$iy6xsMiZzrQwR9U;}&C1c$6zB_02>+%p~?^EqQ? zdiovdPcTQ=!mbiSJ^hj1q$hr8HGhscc!UjRIGobGbW7&<4w$3|dy9M4)Mg{o%=@wx zQ82dNL}tMs9wAJrruAD`3xu>}N>E?}w?1jLM4*Fz-^~tRI1WGSr0dG{MW~y21$WWi z)70sekSYBGuu7Z|p*~)zjsnarxW%v=n(bp$P80&_b?vjkXby`O^z73%D@V`HnIF%r zuS1@fSs7D0P%BpV3B}GYUa`uZy$o{;mWWF2gpxqrEp*1_zt+ypy_4Zmw6B|?hTpB;4 z2a`dqEj?JM<95-CcE+FJ-uvbaIXur6GF`Cx-f-<`>5HfW5F14iTE|21`8Sl%26JiL z&G}*lz{$_JBBtE^9(H;Qdshy$8kUS=^ux+EiB35`Qw>lt0q_fvvgRVX^l@` zi=eH#Bc><}Hb|JZY}ob6{6EoEGlhCOO;N!e9L_E+xDEnltCv+kj8wGI5Q*0Op_97l zcXp<3Ukuoc;K66*yS>H3DiF}6KiPMs&0UTc|G8p z;A+KSW!9VtdPgPh68U####{64B=~E%Kscb-J5V?yQ16lY*|Xn+|g^so>2A%yR&BO+;Ud_%szeC#WYvTr1XKajdH-TXX{x753#%PfKnx7{Wd#K`H z%kB&*s4{-UYY{(fr3;+h&i*VHn{TH*Eeu*%KO-%F$L`rwf(n5H6}ipx*Wy1FZdw*EaD&s@c`02xn>&ee-*hD?8h@I(tede`Zqhp~uuq$&A?{-U~6+hpkhX+rYsz z&izGJ1Pf;0$6dQO(nx-{mmWfYu?u*{%z~0fN#n1?t=HzhMdmrn@d*ip&5}4Z#hG;@ z^}+3Z)w8wO@50BbmA{&Yhh^5`50A+bvwxiUd!iTU`6m%exgM&+F%TGsm2qz7N>^_2 z!{&HXt6|KFRHK}84cF^`A%8SFJ2ZhPnc>ANTLDtdSdY_|9at?bxCoWLn2RI! zQ9|$9!1OuJ&3Gp0_^S#iiv%WFpQs5w^Eesug&6)JK~QRCz&&HQXx80*j^ueQ3CbaZ zxA7>pw%t*)1PgihBqu_$251HL?Ej3X(Gl*qoj8Eu>*(`>Z0WW8i&~aqR?|ykwUlDx zK{NJmo^5t;AH^TsAdB-K#y~BZCN+HU4ulaE!`R!i#@(S-R@ zf;}))YJ;x@f1ph#-Up}0TL;SOM3au0itew%@xO-rJoh1Ll!4Z$zvTlQ#|`b_mbeVP zh<&6Ui5|9xNL*&eQoiYlVkIEnauVtEx>}I)>ZfdZD}+sVk9p+>vm2WlF4Q@dzGWlCsWp71C{fPxTTEpa-(ag- zoxPK?9P>-q{a7N8V1IBDsd5KqXdZUB0>|TnE*NaiH#2tlPiQu@4NaC;4EM`;GG2Vv z=*LeSa-tGF;haCQ8r+9h1}0W*Eob=!rh6RM_zJjZEymG5`@D>0y*8*B_|XM`$jlF= zL6AP^=U+yEy~A?(WwUv&&+em&nD);djgy>x5+}Io0Txk#i)a>@}g)N^8$L?xSefzZtEOGd% z8{T$XuU!%)d8A+6&Ms&uQ8&ys^Y3*h^&Ac?kgMpiQd*Uvint}qU^X^*pfe059`BTC z)-BT_7Rng@a4Q^vAH#!-C&WQn9m_x{VaIjsuzo%+kpDf+Bw+cfL+|qk&yU>DZ$ky! zOBJo^OLL@BPZ)3$O1aa>fnmJ#!p5*(clF3SrZKbiJMgWSK!szQGt1*6tv-@x_*@b`Bp}`lG#*T&d09 z6N1v@RrD3%`*yBA-(TLWN8$6rSLkO(_ZENXXmTR^6>* zdshYg1Ox|0M30JUEt_3w}9V zVdp5|oy0`y-y5wYcP!*I(IMW*c#`tNQq_70-<@~W!+eG&)Q(*v#XO3_%8{|A8m^jz zxg1Hm0%VaKZf7Zqn^{Nw?LytJm$N+ruQV!r>&7MJRe*e~Ec{cym+YBWt{tmLGZbIB z_xSZe9E6I<^5&FF=h$|VW;pKRlvm$TF!nItxBcx&9}}o*@zf!{?kX zH^o@&5|+@xUHHF?tN)Y)Ni%Lv)Y;%k2_Ti5`NHQ-xvd9+U=Jo(?RV$iW?wpz%3coh z<#YJPDz`Oo8lJsAmYkoO6g@>C;0{0c8z*KW);F^bnsTAa5Df+PT2S`J5h68aCAOLk zeX~huKd|PqjQJ-QYF_$ZY*Dfkb?9#R17@Af%NFWb z^ltx9fVQw6k}%wCwuhK#S4_}5Mh!Hl!h zS&NV;JzV28WQudUF!mb!ywG=}H7}L``%_@s zqtLVJh+%B9tM|*?a@Gj?V*Z`S1)kAZWt-gfR@^t|;V*$=QoQW3!9m{!2!Cw(cTtrp z7b-OdZ0gUyvx&nQPX80^a{wq4d?Vpkd^9VI!mtsPl$Uf}vvWv0C!i{$pTY zr^iY9y$9HuGjm^@onEK3lLpGZh4fym& znrC9wLw-eMCB-kzCm-p1x=0}F4ORYUH81Lt_;X@TQ;ULXue#}>!kGv(>!sD8KVixI z+jkNRb zi2O(9%f*%;qm?-W^I=|c8^O=Hoe-6sYZQdkUt(2S843KQJ!u=pAEL6os?#lz@(;g;bV*{mBFB!3FLJ2PmpF4vR zAn1rGN5Bq8MNxkOrY*N|i=k@MFElJQu--@WV-=8QLj9p&i*O$jTEltL9R?#J!(hUo;=4A1AG?9;O8g*zMeGn-O)Ov1G#$qX@Yb3 z+2-wIEtRQ`)LO(PEr5J^R-u#rd;yU$a;qB)&#FD3CfJ7JqbrDC(q0U?7kGb$KG#Wp zQyn9a@cFx8LQfEHup$T^LkPvuiSL#8Ve7|HxXkpiYp|R7-F%P5pn?I200Hm@K`i$l z*;I@Y{s24f79MORT!AX%JZi+F!xbBeHG`3wMl$_WoON#-7yYcp)b*$5+0-z{@Lr~! z%iQXRE!*ub*EFEmaTdUmy2LYSxaodS4ux1uT9RYNIfSygpphu0c4YAK-;Ht$V zg%EDJ)CHEmTWe@qMrDZiF}%(}gQrv7FUG=04tnDKH#uWTExrl%OzrGDv=F&Gh_#F` zuQ-y!;L(UBSu&a{eBDdlB(0vUp~R2@mP${<1<4-YUz~nkUC^7UlV#G|>nPFN3g!;n z@_paNlt(XIF3wO%pL2?unsb|XQj8N0pdxx z!_MWc(CN8W0auNo%%P3OvMM@9X~r;?cv1pwbMX)#tWctih5#$GW=&;6yJg7~pQ@|7 z^MsY(*yWWY-4uOkl$j1e`k|@DM#|ec@kOB&;s=WASzYU(!yWbg_a0(D(r>?I44CzV;o+<5Pu9t^t!61mh8tSAK`9drj$-=tFoG#moW9Mh(Y2LF> zN9?6C%G*!lbsD*St`l=aCQ}yr+>$^E+@yS!B#+C@UAQ6~ywKGOQAo^;KKaPZlZ@~8 zL#7g>^p^F4dW$iGAY$omT2br7EEI(l`$BN+x=q$VPX*CrbjgN5hCvKzGZ{?-r39NW zAfX<17ZUoD2A`L%vY(w)h8;y0-N_4JX*!lrFHbcnN1@lP|NdyK==t4MLzx6b=j`fq zA+8HOnCHrKUBPi0RiRtCepkZb=Zcs`*CG@3zr` zb9#psO^J=)OI=cn0XDZtLm3!bLT_UxjV3ZA_GC!G%nJK8B`e9S*2cRJ_n0V+1jAib zxjcKOH(+fMlqQ-|rrG%BUnlJ`l4yOoB-5B#0}kNpDsmbN7I4o%i4ip6llAjWFwYbv z8PK{noC;1*#xfKk9}friOopVo9a;gW{8z}(^a?0|lZOWN38V--v|HjRFU*cWg2lHj zVNyoke*2w6ij+#u+CQ})XJs90OM*G(Iwi$t0`L=*^es31HYjH*qDZ?{mVY=@9*@yuYv!r(P<{d#O|N(`!|^86xtK_W7SrP zo4CCXwQ{(Y&zZa{S)!te|23(V zeOi~8Ws%e)qDA4!(5JgGJK(5iP+}i5ZU0&2|3$xW^3_$x&F5B9{Lft&c}Y5Y40;m} ziR~!QLJ-;H!d!XIVpoX&?PqFy({B0&5Aix=QKGyYLV1uB>z+PoEZuZ)86&Aa9wRwB zpz>0Ly{*Q^*5g+o@p&?GLZ<+l-uc>GV8T7ND0V~Gu}}A!=tLeLVIvaBHl0qqKAa9I zgu`Xv^_LCJ^o{yU*h?zpQ8`RXo$UP|e-%4y!ryg}FwRmKOy&3Wz2%&!^iFDeA*6fW zSbLTyO5mA2G4byXhsVji68&l1-(DE&$2(eqr;i$`85-)g&40}xEWnV%=lfO09QPxH zn*w|VmvHQg0%Ydddff3-)TqrB6(a-X*5dtKwnG* z(Dgs3S8fK{6D7=nxQm6yGSAGz&XV(kznzWx!iysSo8h7Flhu{7gNjE&BH=4&NkxH& zzxhv35Oe%2CG*=Dve)nBFax?~j8@!dg-U7I22vWo!s4?Ohm3VX-adst(?S<1a+-)2Sq>z!d$MtShhKg=J$FTWEN$@Pm&{ODA!b%?g? zed)iR_SSwyP+4EV<=(HewbJ?4d}0(2Ff=%bq|@@N2{t>??8(nTpL?4AU?_=EyX4*= z*Mn}o_VhL3UZ;l`oNq#df65I)MaQQFZtc&O3zsuD5Es@ySmi=8yEH~bW(J@{ugiqcZ3Q2{p;`CN#K)k0X-_*+b?RB=8k1%lxcRym2yzdvEs7@na$g*py@V+p49LAUWFF?;NUERh zynXO)4cWVD;;w;bF>L*RauV{pijTU_`{`F4Jk6+h@EkJ+=$>#~$zsdrSwGLaUzwVo z_k-6iXB8gJKk@fw-L4K>LN-RoZkv*eiHJ5YusuWLxUC3u$B@QC9&4)tw54o^-7=9A zydw3Gr}9M|@(k_24Hfz6_0eVNNUKJaVykF7gobbtINh;`RP zgAGP}luM>@F;=VUcc6Eo6}$O_5O9K>;CLCTHkf5GCel$j$!;jRTkncZK%}%tf3^Sy zUVm!v`Pt)r>j66{_bqR-0M2kfluYC1=zm?(k#`4}dwXOzq!r|d8H!I`U`Lky5bfRt z^K-(Ll>Y^&X#%ppQu5no0Ws!PjaAenhi(uq`f<+W=pao?N^mC*h7bs1?g|q)lCYrRx)6y{cn>4YSQ&R%0XzG~ zbpM%jB-}|jCRCc<%8`52n-t{b`8{h|SUokB=^%jiMUgdZ{>k`w+NE>QS|9pylrk(7#t>Ya898Ph;`4d7)z^%c>F8bQQEWAE5)Ty}X{m*d8tu+D|}uP&C!@-{$`$s`{!OPAJ{8h}%k%*7ncx zeXpxDC;l5&^sg4}5DA@7Di^ed=U~813KUBELL~L~S4bU*EmIOjU2U7t3Z1CW_!y z{{k_WO>>oF5VRA`@rE`AZDf)^Z93h5x{!GAfJAvP+GCymluSrm-?@PvtSQQfCaZdXC)wTVO(w?aBll0}b?Q0d@L8-iw9dJ;SiQa>pMlNiFHvz{? zb1g7OCccG{8U*P4>W+bG*L1FlnOt zX#euOl^zGqfpD(8hn@<9NZogduBJ*|8B7)7j#LuobvYa7Pen>W6Gi6>S)pf!48zq4 zpOCm)q&-q@Kl(G@Qc)juq^Yj`TZtTTi7D#>Ocyf%y?uz}Uz&E1Mba9>V9mcv!&-9- z?D7bERLTdsbZ5#!u~c2xO`%dCvSscz8x=Ry4l_|gA;0)`4JgvI{u#(-g?h&X6{3N7^WPkkGFd; zI*SH0uU%{I`M1C@3H=T6Vy)!0zDN-Np8Ffc%isj5dG=U_Aq9^{jZ2i265h^EC0E5CdC-moig}psFN`6ybkuKoB#<#hp4#)~!*ESL zMU9+(cfa31oB+Ff*q@P$NbECGX9uKVOqcP&<_hc{ZFTpYSF&63xxDmk)NH&HAZdK| zRb8jdryDYVQ>fP8QI@%z41godE|)8;~8r`57Ay( z^cJQrbo&<5@(2`|t!>?#t7V?Ed;M7p4QGD$ME&5&LA>E`VZr8PpDic4vO7Dq9%p-7 z`9YhaGa0x1tQa_#NOt-)LseN){*ka{=B!)E)@JUo`SCoa<~iMt61uS7k=-1mOpre= zdhF%6Ig}X(1D zL_;UKh=iGQ_8>$0Hu+<5!sEH{m8w=ejPa6Lr2V@>uKTPhT()9pPwv08#rqr#kEh*x z59|KG4$ZqVEh=>WESrY44{&s%e#oQo=OavCp20Re9C8(D2JG-%H*$QmumP1248J4K z^W6?p`id}DDwCQeT>_bR8CMYqNG@X0i5Gccx+eRr%6PmdU#e^~*$_<{^)v}@4rc$< zAP+J|+Ycmog;XXqdLQf_%IU_V+_7lxU1xH@f-MJ!G+nDYx|3(o% zQNWlU&^3leR3>x}@(q>sST$M+V|kqy*C3;@v~7q`{AvG|66!sB(7G^t;OxNCWs8@q z)p9##13Y?;vR=KlM>CD2H3u4hIPYL6vv%;^&jcQJ_PfB_&=Ld`R+!fEs~dmH@H&Hl z09$Zdv$HiTbbb1>@nlBju#zT-CfH_A>u=<2&-%%5hV=7I_32WRVrqBsywf}i=7+Pw zrB+fv!sULe`#2SV^J{I*bIR0CUdil?#mZj`l2gI6Y)~zm6Mri1hzoF9(T$2DJ<)2e z!K1TFk~@++aAq+q;gai|cI?QGs>v9yhlb>{r)2}U?yS+wDldB6q z&$<|m87@XBW|dlD+NdOlffKix?(&oYC zUhD7QE;M?jp4?iwj2`mz70~K9==~8%5W$OUJijHM?TXf^1AjE7Whr_+Q>q{ycY~jV z?Zi?lmvj2y+$K+@^k`2j0x3GZ|Iq#2-@-fL(q*eY9IG}*e_ae4>qm;h|1q?n@(Ae> z0?{r7;e3gCg+1RMOT{XW^mMA=>tJGkj7k3IfECFTq~VQ!Jw-Z5*14X#CC%@W{)=8@ z#F#QvY2cLPdwm6EfGfv0x7bU9Y)Su|mFf|qP z@kK7?S->HR!21V`l$JBdzG0a z`j_xUL0CUopV92FVfvKU2#b7%H*QyC6~raObagx|F99402Kimf#hb zj*c}sNg)!l$(K(R6NqOn&t;H{+hUZRugi~TItv_8DxFJaZClPeGP&~(P+>-tnr@)H!d44pljPoGFH)$&*L8~G)T45fO5|EA%>S zWaA|Wm~F5qqUS2c5_;v}Q86kis__td13PwmfP^($4Cot3a7JjN_Q)IpMP{c`RMNEE z@~jK^ZW9fY+Y?pYlAq5HJ-7qePk*l~p;=RxY_~IKA)rsofUx>=->&J_>_F`M*%`XOXX`~5rLzc-j}tj`f1w@ zC;62kZHQo$i&~NR>DA%ro$+MZF2aEKBE&l3>_~Rn$1f} zz98fW*k@?z<4P1r8=?Vc^V@Z;Xejw$Y1uj7 z`QHzGFz#aDR$H0!(*b2(9|{4e(n3-vn*PEfisb{qosf81V6W-kW?8dTuiStui5T=_ zcPGVrd3J-n{Jcc}P|op_GMGEGOY?FTGXp(J5w&5$_#T-Y%pcxZGQrZxflw0QqX+)x z2`dK~G&)lf3M+K~iquTl&*#jYf}lNO*^R)U{Nkr531^KNZ{gFMiPof<1v;!Hp)LA@ zq#?=Kp;czcHKmAfg0~B6yE99`f+towhhJ2OB}bWLe7xH@t%97^-x*h;ytL_I>Wo6- zV^aN;5I!Ke=$7Cs;ki@AM^V_Tb-vMF;n^ubm6X5*T9-inTEHLa(Qm zPpI%6u&A`LWcn{qcFLY`SsUx}MyI@&_lOL6DVG{Zt<-LD?-w5wj|YAVc0dB|#nD6G zpc_rwYJni7%1g}T+i2AQGjhF}c*J7z@z=!Iygr@nUWp|=Y80A2J*JmZnGv@QVtC|z z)i%xZtC-HRZubRjBVmKkcwwfjA?jf64eiV#RI*qp zXv*v{K$Ys>()k>zZz4wd)}GyPR!mv5gx1Mpz%bt5&wj1>6@^Mowzm($^Iq3NzEuw2 z=Uh0akt!)QV*T`TXl;t;@AKL%EAt9iRI@khW)?Ur^gz*^_{Q(3#_Y(MS=T`LgQg9R zB})VUL$}cf|L#xvA`WVEVu`xE|G#a&gL?WbAE~=nTI5)*i@`Q6&JC?GMqD~kfESx_ z_#5ww=>NgCnVmX|GGL}`x%z_)YH<5Ua(xXkEE^H_wN-OjIQB>86pUUr?Jgc%##c{R zIvKg*eEi!vH-5bSd|0V67Pim_QHoSp`G>oW0u`M32Gd8vvqsvV#44a?5BT>x`vuMU zAI7;NJUbK#6p<^O?%nY$SZ0(PGY0Oh1 z&QsP&xccaHKm7n|y; z(d8|buN~`5V2wavoTyG_p~XfD^LQgZf#ABK=HRs!KnuIMl|}-NJ_7Na%$>+=mh?SH z!a{5Z`jjgSyZW(`RH3hQfX5?#p%0`4ZFLg1^ zrH@7i;(p?j628H_-scs~zx-_1z^7@v?(D#=SYr;FV0_=2i~$7yy=1%V2B*4wJX0g( z_m|_WBEv>UoNdP6U zwx#t)5-&$g&Cm?-yI-*y{5k@%W%-4?Rd8x8q=eWdXpH=A=~4h5Z0l6(-J4gwbR1AJ zDO`%NP#Vl$7*g+1ga=Hy{7-Sb3}fi9F;Ai7;@o{@D8WQ=W1$SJ|%v zU_pO)xLmQ6@>|mBt3a$iqS|z+>*|5}wozttl30rBdt?&G)n#ra=-{o$b>+W9+wB=B z-=U(%pO|8NfT}f3Ir6iP`k`#9QMf&VhTVXtY&Ka_n>;O(n+!^xuPho9Iukrt6LMMe`Q>k}`?$Q0 zJ~9PC%4gWB-io^)_Gy=R#xowC6zK8C*4KC1lU?1E?*++Z>@KtUyF5DQggi!?#YOF| zQasZ{>#^y!PJ#^ z%Mh`TU^5vPCb&+`zhd&DC7rAc9-95Pq)SZC@PI0_HdU0|Ts+L3vtUyKIV-Qs^R&Rb z$xr(Z-<0-&tS7+wmoAw9xrAa-i0mv>nR#8*m|2nTZfz~;e!ZWFgffocxv z<@s;trrjMcvci6>^S3AwseB%_pm%=QS>|_=V&nWls<3(%T{O2S+|wM=zy%P+@_IH! z`3d64aqCbmil3*-;q}I_`o24J*9T;6_@fx>`;XH~Tq;Y$8~s>AUUGQeKYJ^|f#Gm? zA+g6R)!xc}M`Kd@#_CpNlE!t)E)S0i10y;j+pNumo{Hc?<538AUSd zGr1;uq%!00DUlfW+$WB+Hh89i-TO3k=TiYuiQdN2`+=Jv>4OOXp`F5_m_f5$g;wD{ zEk_wn!}vjO=@g(hIP4emT;krG-3a_?4BcQoc@TYKhjye5gv#RQ8Sc)!)Za`zo{kyp z@6LSq6NP80H;9t?rTu-HSOEJF_KI@u0#%s{?oN}HfUx9Qp&YXpbj_Q<{>Ih##cW!g0YT{p6n-mzNy)D3l&H~Uy3C`vEc=q9;Ic>_a z@H-ZiD`(m>_NjL$BGcAomShDu;Z#v(v)DAu_jtyvY3CmHN&8Mygfr0n?XFj@qSixv zSwmO~tCe~RA)jA-#fQ2wNC7hwBxY4BZ+467bxw$4!cfZ)_hu@?%Yqww@QNJKC$qQHuI36vif!DC1*@7D z-&nWWh@}#ezLAnToR~*EeRPcs@+OFP^ocpVa0l0%9rexD$Ho35^x zmU=hw9WgzTmWR$`hcBID(VqVUE=Cd0{Zc`=A{?pKGYxLei_lS^jrH8Qzi8X@R?zzc zA{w}Q*zR2OI_X?On~g)EAAA4RiJm1~&EIHH&5SO13@INo?GsVtM-4>@=CEtJUVs1SI&-udXy5cb3sQES6ZG?#0? z7~s46?O5Z-)5qcG(<=|^i6g7(j#>>pyIxn#trbhUZm*+03^g3zW22EOjkwyAcDo54 zkzU6wc-3_O(CFNZc>C0h0;T>>7xo4f=^*8k9DlVfU{e2Am>VhS|3%$!U#g zq>CU(jf(WHNQa;ZsPqm}A|L`%0#ZT`2#83tQKSXwy+|)1N{fp0PAJklAwUucB`5yg zcki>`{lCundam;Yp5$qnHLKjSX69Z)pJtlb?l_SbSbcuni7Ji#ou*%M=eg1MVY51S zocWVFf2lrjL+WbZyyk&9FsEBgr^KsUf4c3t*p3}CBGDbJqut1HI}szCABVOW{&mXx z={+*_HsRB>>V3@{hml3}>!ZM);iy-a!;K zEVb!my`luiR(bK3d1kqIUW9a(Pz|&O<$~C!{*R+ zekWGbwSJVm^B;7y<)m`5(EdX$xs9&r*bt8KUN#rhs%KtBrylcg?F4FQ7g^A>@{PBD z&LD=5yqKT1OoZ^svFh9Q8I4Hr#JykBf#KwOXuUsXn&E}KiVu&K3C53RUMlT{2xi^c z*WfDh)cK-X;XKrGct0Hh1v>4>FM3QlC(++#C`4bZZDXY=z7;6I%GCXphh%n>w_PGu z|GXn`!v><@V{(C)baGMYaQT_i(K4H|(D{oX?lJ{GN1mOtxR$I3`17%`rf4-u&bBw~ zeX|+@(E@eXB{E|}4+Jlo43*+cpT_qt{t@s!l9{Nf#xQ%=Z6#5|-WJ)y^rau>&qBFQ z1!Db4cc&g0C4T*i5+=Duy968+UK1ti$o2)wzBT63HqsRv=&Fw^Dkm?zcXXPbi!`-t zi@VJq+;jUp`yD9du!?cu#tUTQt`00Zmexs%r0Y;hg$Ij3`6h z11~3QQCH4;H4+{13OCr$z6{-W`7~=7wGFr9G(;-TFR#{owzYAWvKW4Cc4!`O%a7-( zR+iRllQk9=_s?yTosN@NrplHE)_WXM3DoMt~BIB8|p-+P%?>_`5 z71d~rxQ1A=>pe`<{3zI8aJWtN>3w5-p}3U>XS0rosw!NtM>o$~V??;XO{E+8Y;8ie^0X%6T!7pmM4lZN{=lIb#09Qc7gwC zzjs}pk7UJXt7X~wK!<6(gsdV=L{B$U^U;~0;kK9-sQyyX!nk!#NNS0AlB3GfIwlK|mZ+Ag)$M3uy!%<>Q$sMn=I?<5$(k>} zi|6F|qaEltjK?4O(2g|6=#}-C0hp*2tpaDzdEcLApy-%U?&C#RSaRtHs51%}4)nXr>OVjgx z+99d*!S4-%&FA@CppwkiMc(u_IKIfe2=SiVWukhlu6FC@^zjSHogm2!{7gn^CcTsY z*=&x!(vG|ANB?%2B!9e>R&Y;wUMM!hmDHu`d+X#9tNowPiTl7`!UeYECSyv~+{t5$w{3rr&YM=6ooC(bSJ zDq+5&D(T{rG)jV9U;#48{#M`Y>XZXB%2170ofDj2v1%Q4_SAO0N9yH_AdRbJZ~Ank zS>xN}K8|w_XdQ4so)74pPSFe)od&*m?Jcp`9l3}tbAg?SD+Nb7x>0-W!IxaX72c-A zAGbvB5?_D`(e6nrXOA)xY8sOg2bB8F)f8UXn4By%4$V=Nxq?3``u+j3X4;ASprYq> zbLjn^k91q4j3`Go3}Od8d;=cP^77QB;1BQiXf{UI<*nVEo`$h_@U%pYC)wTKx}Q32 zskPOSGSai|SJx?Qve7lGWyLhK@wsSyafaUa#=v^yhS0{|a%3H}!*e>N>GR{^Tg83AEJ1U z^7bvp@=VVMUrpBX_@WW3Oy<8|2g}UFqI-r@o{zZt!;jhIToj`j?erHkQjOPtXtF82 zP@_u9*5TJ)8yu9Gl6~r{gyU08X-RyTJLI@(+*NJHHq#mMoW`ElV(62;j*AgGWZLDo zkhNV}Pa^gp^Ub|(HV&hQEVRd?cg0^%CvkS}qHSwtFgf0%Wnd-Tj>qyus2t;VicVzf z)ybuPcyOZRuC>n3sXLib25>4vrUz_zmWy0g;t}^!>2KwF-R$V%j8pjfgR=aAbQs^t z%PZ|sDo!$w*@C(-|3w5_qZ=Og{N*FG6OW~ojr^=Ydz^SgR7Vhb)CPG;FEe!*PBbOh#8zWF1GKBu&;``{%w zc5OLiS?+Qb<@G`V)YXv{@9u_A$T%`KkO!V*=XhQ;OqTwMSiH{j^Crt?f4ADH6rJvE z2V$;^0B{YfN%5HN$Af1JhV1p>mRilHb6ww|R;O2brT9@-7dD#Qv}JhCp&aIwpnj~H z;h34bc1>u+B=f%FRrAnpmV=iQcHeBtMIO62won7jz1r@Sij^}M2g?v`bcfhyRQ;yO zKUwk0tD6&5u(6>!N0R85P^7)=v*k-~nV1V?935Pr23%m|gX`K;cDigkhPn*Tw;BgD zKHZ#?Nq6YH;u^Flot`y`aw`<19{CZ0m2CR2_#H8CfS!JQ{+^M@ zXp!3mKMZg8@Pq6*>GSh!Hnji6g!tH^8>}WSh9OrN6LfR;ekeRnVz%EnXuG|nZAjj# z!Zj_Q(gJ-`h}Tj?H`0C4_vkF%;0CgK~M*^l{eesHz);?eZy)DZDI5gDlvmu4S&&4SQy zc@Uz)nDxo{`D@*Wg$r7U}9YRFc51%Obg{r;{@_$ochgdAZe7m?QFFM4NNBdKD zvbaq2tn{MO=A77LDy%bv|h4vj`Vf4_sOgW&j-FU1tq;H zXt&48ULS8-HR17l>i9El>xgjA@nbQ}<|d9lsYs3A(RO%)Y_&v9!NG6&Z(V7YLEqAR zWH2wO1x0!$A2{xAvpOK<13SB5P)9gvdronEowp!ZRCifS_^r!XK6Fg)0eI-jQe0(TzM>d0@VKkzhW}S+G1j z=J%G!r=V*Cpa8qKysVmzc^WP@zYQaA$V&QO)O$ml_v4)cnPw&pro}ZNl;+8m`d^(y@=Q?=^aZ$^858g_zmBrk-BsX+(%E`9J4b{SWJjCWX@sjZuAloKJ_f9) z0~T_bS;N_Ymu_WuNkgcFjmquqXD_+rD&#%ZQIVnp?QVX#Qe)b|p>3vBBN4#)j6z2s zJ=Tx){gz zn#9ucdtBxn`SI7xPr-hC$1P#Mzn1Q^pp?!zPNEB(#2Q=A~s=e3DG_OqSX z@sCjdN{{@3bC&O~P@B@x9TfmNmIrJq*Aw^7sPu+<7L0@)Ui)NrLboYI=~Z>(y&n%) zUA)rGbuHfPKCmNG&1YJ2-!htYgd-YgfO|)E)8Ky2W3LarJzMdPxc9*E%=P{2OyIPUfccX#_?pDp_jYv0-#kRiZ3i_KiJE?g zd21X64Oa8LMWs~xf!f`Z$F_22YHxbCgi~m%@zpDNZ{xx`b*P;6VGEytTL$tM8pOj3 z!=z^={qF;ubmn%;de2c{$VJ0TQ?6S@$5nud1Zi-vD>_U2f-CB=*qQsdyA z&~}>Q#{jly@#Ja&Ac0Mr{oAuIdKY)D$N9cIo~`GpGm>g(+EGk$)hHDtgu+} zfR~Bm^Ro1Rk(@pJsJixGNY^iW#p6AYW9o?J*oxNAq4ljpapr4F_U1W<(5{yYtwlj` z#|KHGJX@3tot;g+1E*DW<9Jzi;X)7Jlu0 z?=Adew8rr@8ix0@ zO)=VjtGGI|NGnf7IYe>hYn$O-9QgE=XB)QX_Ls-xdY@@~D_+OOy`|Fs{my@B7TMUn z3#Ws_U;H1x>0jp=wf}2X#{Y4_YU#cIkI$X<{ChKY@>-j{?{_;<2?;0hOQh71=A1u) zb$*Y7iyR~R%Urp4a8r%28_}~^WhVs#zt##rYLBl4j$>*OZzqcixNA3XXdCpOzx%m| z<;APrfh=VW_thfQ)Y^EN=WMhco-A7K6-bm_3DmVtaE4R{M=fmZRlCIe6gc_4#J(gs zD2;v=r!!wmO#Z^Oc#UGW$0jFyD}a>iRpi(v)q7{{i^TE~lsX|dL^GI%?%b1p%=3+d<`8C1t2PU`#

vp`OHT(0Ft#pD@V##A^ygbA=o8A!Lr^WqAGekQ2 zMtx577Rv^4Dcg+Ys8zyrBDOW~?mI)=)k+SYgXetjY3Z`v4dUpn9a^8x{I1Ztd3{rQ zzG;G($81Ix7yCZi;@V_gl(_%mhTWc=V>dfZT!N z4$U9Xvyqd;gzLife{;N@S>ZxSlzj4aT=C3i^WOYYU+_BydChG++E#|U- znYbVRQF<30w{OSoFx%~IY^wq_BvF0T$RZ~3YMgn5iZ`&pHN4&9ytBR}nC?XSe{RbO zx$wd%;`n}hiZ_D~B}M~vx^VfHSKqfkkh{!3;>}SbNIouXR*NYWCmqiPkfY zW8J!s zSEf>?J#1Y2GH!Y2CdeY7MXQ|Ht~9Idm6fCSAYyp4xnnlq-5OoC+&S~1Vr1TbGMLDQ zX*lV!C&cZ^E>N>x^K^3jFxylm{n(7dG474aJI$==v+1d{E-IN(J=y;6OFB-Us`Rz2 z5?yj)Wc0VSM~j}?r}a+0V}#z^SNOA3rWDT{sL~dQ@PWOox#rQcHBd=Qe}nSJM5cQ+ zgX#8!k|VuSqnk;k8|4q`7jtvwjv|BV8R~58TM;r8_8NY(2kqJ_P#tsg7`I6N35zj7 zp3J450Gm6zo5DRDRV-twVur#x)_cvSYErpxf$NS@eKZ|B-!Z(UFXIT043_TmXoPpK z_!x&L(sLdw{Rwru3w=^g3z0uoEKs`MAAK73vx>^jqK;;lD!Y=!`}7UUY(npPM{jJ< zn^#R^KGCgi4>HA$W$O50uivAEFAx21^ZK4(IP(j#uLEe7y%6BwJe3 zn@*&1d>PXq^~>4vY3ha2NDBR^xS&(zO~G-n0E0E>^@vIH+=a$}gd@$LKglka*DCz0 znBiS`l0cw}Wi+#_A#{kcPGy1`4(amBHR5nJrD6HhNDCzGxG!0^@h$t`w|+AbL3hl> z@GQV85Om;nZyQ>q*!4V$aO>GG>@g{O(M-U}l^(j7ys5Nsk$5W7emUahzTD;B1X7^2 z*TR4;>1zY)10Eag(`HJKm0hPe^$R{(p$ymdn)P>00(r1YJYj7uGa3r!1fym?eBfB* zH?jUkGF5X6z3K7^Z6I*v~=){|u*DjRFZ$x`&W&gMJNxgY}#b`a^`$a8<^`y!u+i<<&;IV;U_rqnjrYx^&SE>qJvWIPS)QVS`LRM79*icMmL;xudm zewFl7-E0dhpV0yz1Yu92C$)~?VD8=cqi~c3?Zt@A9gCC(FQMHgH~z6Uo`-wQ9|tHx z3~cN?y)&0!yT{MXoXtX4wtkGH(OsMjVBfv5sPf`2v~;t(C&|~gIOPH3gJtJObB+6F zuNq?}wNw({%oOq{!qp$}O)RE01XX&;_pdZuL4PaFy1@9Kb=UJmPtj%!o0E(f(AB^$E+|#iWwq^sH4(=a}VjFV3exj)F zynslb%x5i(z2Gs8!G7UlUaY?vREupejJ;FY^FsTYLC>r@h2Lc=!?52IZjrVe4L&@- zdHYe6CVxJ#prh)eJyhOIsKMRHP|8o!QjDTb$%f;mXaoo8fGnY^lLX?4X!tJ_nTAzV z$J&xM$9#eo1YBQwkg040vop8zTw9Bg*j}Nii!dX-C0zd&eIHBw8bm8Z_Tk(RU|I9X zNLrO7;c||sSdY@hy}kKTxR}bAK_-Me8RGNs`VE4_rYPNf=^7n$>7J)p2$Yb?_r`^c zT>hu8{x|Sg75&nJIQ;`rq0O4$%8tU6UHxBT{I7d#1jtXI&$;;zt;7EbU&xoGzer^N z3$Fef()`!0WTez*7Ww~^a~j|1a_;%)UsfaK{cHDP=YIgb#U7Rz8^h=kmyi|1vKGnW z4%bRPxwbPfhv|Z>1@KM*n`o_qR_S)Zb>HE@Ki$;Hsu10E8_~J`Q zw{Kj5|J?!8KYR6)MxpLTP-UCKKH@%_|Ga|XKYEIe+#{moKX$<`6o=EA^f?ytW;ep; zi0i$h&0A%rYtYSutKB=uz{F{MXrx{FatP&Tw?}}AQtzUn3od3$9|59q@2`r4o7d5- zOXSH9b6ibp{~ujc$^@nw4ATT&LtaJ}4Sx!rB%s4iE+u3_KeQjkp2-%F&O%aFPj5!a zg<(NTCVSPYa}_(oE(g(=-|9VUON{n-A0GS({+IvT_9eMgAM+W`<@D4yjjm4$B8g5w zVih*y=!%3#u#mEO%F7nYz>hVx}2HHd#JBj ziKy+P9tD?ai%fS(P^f{0zGQ(+!ueBXu|%EVpheVr)$quDu6djM4=!u_ryIocI(#Q) zeZ7tCi5E}GW%Qb9qKN|J*aThRdmd9OTa}>bSxH5vcW$ounRcldvxBS!LfZeRxV;SH zRa5a*%OZBkkgHA9N}Utc1$n>u?f2gf+L61{UZl7R4V@UK0r3?4{<6Whb`#RXelo$E zyZ6&5T4Nrj@9g?rs!ws^{CHcqZ}W(Qy{B|O!m*v_o`;Y}F0}pj$PqA9SKtfjYs^84 z`e!LhUh-%ac1V9I-S5>op))M~Fc`BNxsUifKXHt*M<`Pvh-!@7j_|RWPw-Si8kC zKxum38EvICOhu|>&u@kT>SM0yeRpmo% ziliLcpIN}Frl3a@4(9@X0sQTCGI{-f#0d*v`=uNh@+NTaA0?`OK2u*;tP73#R@)+t|#GroTzSk zYI3h$poLQn!a;?M8s|R~Kj(gTYI!-;#x&)3Z+@iU?xWGlFB;p_y27C({-sj^(Yge0 zs1E~qcggLLHv4=FAM(m=x3jIpuXH)HO;RC6)z(-_hoFz$0@ECd; zRH&zsI}AcKh@=uoEd#%4Ut#VvkVU+>(_S2(_*(;0Yn-mw^yO?4 z1LV~2HON5bEC?9a5k6rv4sP-`Aby^AD(igyHs-%c(Qu zK%??dklM@1!?2@;E6Hr`h0LFYx(L2<7{->RlvJ1FXwtMMy7Ze6#o=R-9aRFjrEXi# zpP^?2n6!Imx^sa-wB68?3q;lo%JVNgsfoV4attzzk{wLKq%+#JOcUvI6yi#^O3D*EaUQyyA>R~&xo2r}Al?s4 z9K82@O?GwCFV6KN3kMvif7NgcY;hLCxlT?tmJ+E{*cwvin%!qe@jv%tbhw4_6sS|z zIaI%~C-%mPDyzLYx>9Ej7URz64}`?pFKL9yxk&UKmpZeI)$`dZM~!n%D7J!NKJU%9 zJ8Iu7@eP1LnYJ1?v@F9&cS}20i8~!HE?8_Ky2u&byV|7VmWAisFpoqEn;2l5n+oYs zD2tn0+#M9?8CTEv?@0a7)55+CQ(W7{b0k7JB6V4Gy&I%;J?-hW8xc?6g#V$u*l{zC z`*OA#P>sSUj~PgOpcw^#8LI1D*M0S)P@E#FEBaQ{_6=GcHra?ZeqOHggtA>6#Oz3#N2llnyWx4Iz z()Iz=S$R9gCUEBSLW^uhfb(0VO68q-bZMx}u5xNSv5J@?AwiIZyOwyM+u(Xv!p%Vq zN2`f@H5|y&7kOKx-B`1<)0L(qO>YE#=5nQIohIQRRA-V0MAKj=w`UtR6SBCMHy4Ck zB1q5DB)Wvry!@@31+3z)TCGGqb46`rs=uadAg2io+ArXE zouP!YC^+C<(yQ8>hsmkzzUxp)O@uyb-x*PSP~TUEpX8Ga7!o_dmxN5OQnHPiuS}5ZJ5%Nju-R2@37#M(}yTX0A?K=my+Re|br&w9`VW;v9&I<)C)F z+_G`ipxCn;SKl9d+=EnZ-2Ci=h4Aw2p6s!979pFJ-Oo=`%X~%xWd6))XYsa=DwZT2 zh}!NwqF5JM3loWgA(~o#>@7hMl`Y?Vw0O*mg(Q61v#}27B2Nt7T!%wi$ItFc>J9v@ zpt+?|rNw3+71XXB<+?73q#9Opek<{#WZEeDwr!iRZ8`ej^T!SY-)US2Y%3n=Xfl=< z$lXO+Q@u%O_<3P)u3_5S^(c=_hmnccK`*?9O4t_b?xYo3xu;s3Ef1dEMh^0j^!>W# zo(tJbxfX4Yhq%HK=gYtYyf;@3>TVRjPn%&UJKV`hI; zy_4NFF@k-GZ9p|jMOCcvvGRdWwqwzE+nLLDPAaxKA7zEEe&z`E!}!W{62Pawi4zB;5~Z-Y{qOTuJPlj>7I*~52&ol~FF4b6{ekLwYD{wZ}1CzXb);)2^z)U;&+CM z87MnXIQiwMgd&!%y&QM+vjgb}(yGVs<}JB-TcZXDP5LmaN%q-yl_L+b9KR2c*I{!P zp`;$*Fghhdgl~lI{$S9oUGONh^eF2(K3Dg|R?TxPufCB_W>44Nr8F<>_hV?`I(ls$ z_Sk#=XOf1QL1+J#jBWy|bgy8JS^kBpN|~$RsjiL(diBix13-4ZvGlS6{g*P#VJp-e zq%T~rDc`zX4lG=<{ZIvg0(ZrY*Cx~ZIs9$$ z3*BdDR7u+~paENW52w^Q;^_58O4FU>LX5I7f&J@~KbAp$=G-O9`It_X6gKzOrToB^ zgMrB57NSy@J&w3kJ^V7?K5vr-0LZaTr_Py;JFovh^$`2)v>DT;G~<6VT$Mj^?6Avc z5N73fGOQ|}$ukGGl_eH*Pi%5fFGUxLNw$|OO_YcA%^r+Z?b>YLO^K;EegvD>OzcOF zX%3)MH;?d*mCU4JPV-VB34^fRjK@46iM47a$JYEf>5W`tceta}I`VS*Dl6*eT1Mjv z3LNlcjHw{b&o#YiZsQaL>1z2B>cgo?J6G%|m>Ft{tR)(}Gv zzKkw14?1z0WA{$)cH_(XsvJD`)YOACx8pxjeeG9ffL;+J)P~D$5}h>M{+TfSvr(^I zFQt+ON9qX6*5eA#4kd7yf59bqrZQ=y%wCfwTw!LDQw1t-11z}OF zI1Dv>%9u(0;H;oYsw+DiVfRW#ow!5~Dc_8RV>guVvvro(a)WMHC#{_HwS}eVl0!xB zj71A-y?d~bLom5PbF-ic8wK2AiZgLWANdriwL$ET2?a1U*dd`?7&d@HI$9TDOhvlN z8v}Xd&o1pQ4ZuzolNOA#3LMR$)8|f8=kJ-X60+(HPy?w=DmA^}^ydQ-)*UJCQy;oR zp|1w&MjJfl2FOa|-D=^HoP15R2c3ojiiMnxPqH33jWrdViIYOA?5aXj4F*2)%E9BZ zy7Imf%gY;#F7*%s@jLo zS(82&1g@T_f2xACGoz48E%}a?GewJA$91eUIU9Ohy$yF3tJqrwNF8>NZ`~gtpI)d# z@0DFGJGXh#{GvcffGR0&>6w@XmlROWP-_$zBhi;Mt~`uIu2la z+XIje^vN6cA4pD2#rm&eQyS2qy~bJkc~bRgnRNTw!O}~=io58_jeo1ZAV3ej0tR^* z`Lzyj83b)Ex&@+9$PsMwv^fIEQm|t_A2wFA#JpJ3PHMe(mIkI%*O_M>J|YBm(JruN zVdWuP)FlOcIVBw6GfVg;d}823A;o&J;~`7cb{hfj&ghH}3o)H$4}3Urrh=L85!g5x z7LqzIion7eOQ9Qz<+Ep=r_j>LRaanwy*m#d629HEvbu?7*r*i{<*nUq-1VS52?>Si z9&GH6pgW@tnxKspYCgsRk1@f{uE4~?V_ml^;gw`sely6tyDbx<7h?u0oId}~VYc

6~mJLfac->bNtVkYV1PlUQ4o$S6Bo-as6@p3IX)%*Roz z*IDOxl{8=zgeNfCRVymK&MFa~xgx1}UXSiqO; zrna#=uooQI;qI7$xlx4hlhRrx@NSl)Hu5k#prpd2-OI#Jxonfuk=~kJ3ZOM6E1zkj z+FCr9f;`qpVnB7#KdBM7;Z{RWF(q6W#JTNo=FIM72l@Aav1=Tj>{S+BUxRPBH!sgF z$TM$NI(j494p&&IaD&Yc|Gc6E4$K`ez!P>S{T zjZfh11oSe2gl8SA4K$fLsE1WaUeCrI6*$xP00n2Tv)mmVp4U`*^1b)h3X&5w`IC4N zOGY999K)c1*wt|M#^5!}G&=)SFHQN@wmc#!$sa z=E9)GS-Nw0;*czWx50L?mb1(`v}fQOWcG?0UMLbO{|5bn1lkE@3Uf3e-BGXIvEWtS zJu8mDP{UFY&Pz=Nd&P%#^Lx4Utpkklz4)<&g-JW+LE;^Bn*0o$3xelUa|di+_Izvjq0u6`T;j1bdIz#jC?FELQElRx2gjqD5>Z(*j{!!&1`;6>a6y>H820T>r6HbvLS9b88AKndSGVy z7*>_FiO~A!sy32-F~@C%GiU7JxR&e%sXot7Uu`$3@NYaT4gDjp1#3qUo}IOxP9ASJ z$!3n0@b9`|&FA4K+Y=n9xW?aS{?2w-Z-yAPozdNj*UG&!XS;M>?)_!&MbBe^Tq(^~gSWHvj7Gl!JgeoU6{PSbt*Q_1`7?h*f zB8Z;TjGnhQr4KQY%B}=Mu(_vf@?Clye6VRf?#{c3L)jmzJWikj0KQER$^xAH_t%_~ z?ciEL?B)ztbgD3ndX$3=#h@~Gfi6D&;~m1P?FhgZ630N@}XCQeiLC3M(6GDFQJjqMo_{Niy`cNTLS2qBcU!yi*{A0m{P`#Aryb<0Upj1T$ z7_8xP@=0)klOVv86@^Aw%y@A0SrA}rYeJJ_#3xr6Ud?A(xI1n}9T5C8HjQDHj9fnWG~_t1NdZRAU{z2n%QNnmJOFK*)Y4gi-4FIGCfz)~%3H9p*bLvOte`{<&EE zK*p1Be4f_{3PXg&gD+(y1{->x7CtwFpe2L=p@$=hj6$T5yOF2~%i)?(s&nUiC4qOorFCXHH|{4xqa31f*}oJ#onW`uqBy8ZD#nPT0^|41Xrark1reN{I%~i68EIP% z$t3G|XEt}oBZ3_w?uy$`>BSuINzC49B#I`sHhawof(TlSI}i3$a_fu9`AAmdDrNg$ zJJrfFL0D|JQbu}r&H6XcXTfbNvQ~gk8e=MB;6|=(Ev{s5n6`R^bVjce>}MeQtqUYv zkEdPF7}|e?I%fnSq~yeTPrW(yxp*(VsIwX7iL@R-$rdyJvmMhtFkNM^#~)*VGB$Tk z))HCra4%J_Wwyl$y4Gs_(NT9selBcfBFN;fSl)#}&%NV~J=}M&vG`U~br?0H#} z1i6L;4K&7W{`5|F;Ar2=>^#XM=BgrVf7|v3c$u6lK*VFJ;l|3THpEBuktEx?~Z6fsyLxGKeioES8L1RIc4k-Cjo8>+`~s( zapKfMzITIn63oQro1DC@=T-7K_MU{n47kI0Nx!}?Ei48HN2#Kv7-9ZDd?T<`+1T#6 z%uT02RJ_$#D|`7vKuhqAnGcCE@*JKqt(NKaYd^?yGNMTs!l4~FbK+gND+DHA;GPa3 zZ*)y{Z)Kbx=mCC2Q7w&0Kt|4a*2Yd$%4l-p8rRN7C$vL~HrObH$^Njs{LzI$zoNS* z5~S+5aYDd3=yesL$4a!dQ-TACh6aDzOi3#MTVtAJ+v@IN+E?CiC`-09`^&6Y!|5PR z6Pvd0EX&Bk964IhZj-UGMP8jsmEt*ZuUc`rJz%dIg%88=xTTmu4x$)HxO1Hq@2CK zv8Z`s4I<`7U?)D1fAC6JitJUXc+8x4XaEU|G@mixJJ5kJ0FN8LTRYETXJ00fI)V6I zui0-25u`g}S9;-ZjIy-qWmbpAL}#5v43IlT$j%z+@n;Vm(;asyl7qpY ztf@zT7LUYM7OIdfcT&&4;(n8Cc~Xa-bA~h7eM�S{FR9A&h@t>r80Dt*}JT8O=AZ zCUkpGymF-+6dYI*tv5UM?m!nFd3Tg2YSNtV_jbTlfZRt1-6zPli^Y6+-+Me&3H(SpW-b9ceewAL`xe3nf zc2ID8cCD*?(^iMh4W^d2f6)R*?=cr_c zk;nl6Z14+34B$wLVM9s1-kxugYulP4NF;(D%K#9eH?~iodj$St>D6CTSi>dV5x3g5 z0+YBEYNTxI+UHvu8S$CN6LH#VtQC_>4!Tw0E5i6W>y&WT83eDOBKtaQlh<^!w)|#y;ExCcVADD;ngA5s zHkx?tXoMX{x}93qW&(Ua41BOU%F{s(Wh@y_y&PwuTwrDc^*AghoNLS(k-iKa4lLTx&+8Ec$c`Qp zFdyg$Q%_c@AIv*QVLn^^7EpkBK31_=bP1GqKG5K4uo7VLE&@%UQ>Op`o;s0pSG(s) z)*VQjeL`sCHMf^T#GF({yGxR`zQx?@elku;Rf5z~r5k6>JhgP{H1O~8CvgLMt5z*< z(98ZwThu|kNla$b?!y3I<4AN*BInDI(k^c z%7+5-@W|nV@QiIY4_Obullj70x^Nm#qxNc%%=QbYII^c2|9u;fkWPIM8za5uUXjom z4^*#+#uT3XZT+K9i9ZV*hnYb;o6UPYk7>Tp$b7I^APrNWv-Xd{Z_pCA@bp7&rH zSrS9Z@LYlOJrxCgz_!VF{u|R z^3^R^nr`~BK?*vHlcN zam4=t&Y4EY-vN<3Dc6b|@a9$s)JPcPF?R6AKn0RU8U2j25$1BGu#rvnxqB5=4kgE{qSha5y*MFKfcMPG-u6JUd>o*zV&FX9{5HV0tZ^j6 z3Bc9)CTIZedf}@aPaJiUd}}8ThS*2dBU~$}bGp}P!*+lj2h5UDQZ#Czd#`YfYFFoo zO~H)u)**8C4akf{)1+MwpIqCNz!n9VvTX8ryHF9Mr@_ z;gSNi0*1i0Y@Vet@ZNwh8}4#bK+7V09=F4SKAvbnKvP-&Y0(RFiuD@?O7?r>SdB2# z%dm@gE?>i`iT#7nA;dp-7gkB@NZZa`$Sy-;$fCx-{4Oz9j@)XFzS{tav&n){G%1Xk z_f$WnVTT1tDBO!EYv=J_MZHEtEgF4E%Q5rQ&|tLSKfXoUF<1=1+vZ_a6i-{V*j@P% zWYVfIC?XabJh-F8+*RbY_;AiKO3H7!n|9cDO>CH4qx4jGQ zlisd1G*8fd-Z+39Ud=!j0I&l*8$;@eixR-sG zCtlzm>>&SZ?vlFW`tcU*Xn!x&*;ekFv42B<1yI#~yVeqe-4cp6VAfU6^=-h;gD~FR zE#q&=Mz!ekeoNprjWS8qed_4^%Z)MVnp6+iS!?I`9au0H=NkEoY?Ub$&j3M^u0vljEh|Aeo!8pPG`6iJ&gDbaCW z884PxYx8|hhXQ&lXb9o8*RLg-V4(EpWCr!P0hd{C*MJQMjSkmU#Q=L1GWO}`nr?;c z-4CuRA6gsezX?dd3>mlTqqTyU$VSa;DoQVJclq46gOA^1Y#dP6hM@lk#5>Mh_vFqfLd`e$T3wcT;^Eau)vwy0h-==~$c){x=j7HjS{;Wf9~~nuS0Yafu?uSs zoCwnL|E)3!c7`y26EpS>a`M!)kx6%{n@>q9h#=H4v875Gg z869xm+bS*|WywtHj@P{1*P3Jk7QAn`a}Dbh$65j7dZ=<*q3(3fZHE?dBb8=ua({!S zd-D-)L2=3-xK`X4+Gdng+kGXNO7C)I!w?x?CzS_x{*ma)_(a`E&$r%JUoGMuU_+A2 z6fDj(L%7ZAQVvE-EObJSW@|7>4v@aKnReyv(_bmo$MhMUt5po}CA<#_0!Db8dbU)h zYXXRGEd22q9atsm@q$p#KZ>ia9IPPN8av%=fGmLMQO74NBwYWvmirNhAJ?@!{h z(mHGaZugm;-|Nc1w^F{DMRSKy-6R&I)kID`GRK@=vo}>O$nMk#cAdz^&h?OOrIf7M zON5$v5_;?H$?sxi9|jT=xs=!Ufh{3KTL}HCAgGY-Uomc{4P_wQitiONCdWM~-NL@Z{z^+CCocUKn_R z`2Bb~r2KF82;LVwZ6+__`FD(>xXr`)T$~~FwY5z6aZmk%ZS)*@USuPx!#jtkSRl|c zV_yFbBz3H%ZCz<-M5Klu0)&>k0iE;S^Sd9;hjYt&pHB%qZLhudD*yFg zJ2V*m+5Eeziu8Gj9+xlZF_!4-vFC7gFmav34Uexs1U5%m8boT;8K^E#@ArnqS_P3mAWy*5Df_gHFD34VbjLIcT8+XwA^aoVPeCyBxCAt_kG{67e!Ao5Rk5D$aW~iFl!U_YWQAc9iKEh#b0WE?!to zwe)K1tZUO%z5U_BWnW9~^9lBX=+!Dt+di6-8F@L_L*MQKdvJHD0o%manU6nW>aw%; z<@9GHK0R`&$Dy36=`a2W#V!3uB)uyE!T_0^b1RGHvoZc1viU_FcK`TVrE*QZ!p3E{ zXvEBnoj$jpm2cyzr=-7@2V58Xs1J~8J>RPx3P~-+o9{NSn=3bS>LxRiNc}h|af##n={B9wE{+WAnF+rRMLS z(Dx&Tii$G5<0Vc(L{ckKrt=}hc{Oo>dXvx#ugyc%RxKY5F|-I-NPypCzi9oEI0{Sf zXbRIo31b=pY$0nUIDUcX$XP*ynIqu0r4{`PQ}?v{*qSR%0zlMysD$@&d-r~gB#&WQ zbl;KRpzL1KkImH<-p-Fvk^6f|4&r^mqha}~7ORi9D6u+rCsA2u(3Aa#ujG_Q?AHh( zDO~ww|5=-p;{xoFPz%OrX2TcT;5Ko})~EU5DnI{YKBEuro}siU7n;Bgp&IL{u+Q!u zC=*?X;LywMwCru)uMWTwuGqQgDCKl3^44(`Gv23snjuj9vOz%MDCbdC35rx2=zgo= zI!boc{8pVCjm>dr24l>uS(RXKpO_CKDO(uRB81dm>Q#7q$AzfUs$^IFS}k5~LoKZ_ zroSY9%7<*MRbgz0eCizV@;+9}o3L}MR31=y5cVzsmYxw}koB^I`0yBWQYC3*X8ljUASXnVhPoV z>bGOCmzn}RSC#uC;nHLo@vwbUiE(o(_2T+MCy+|I57+0IwQ#2t7}tf1%R0(~r;FBr zxi;4Yn1*~krZfmz_3hU>gw`UAH>KnIrb>&4(;0|l+ynrUG$w@$b^3*YBiG97DuTgG z%5LhVB#5~whQI@DE@_k^bOltP~gI_oErA7 zfQ%D9Lk!xNXFhv?qV6+osIFy#C{pCran~oeG(?vOwQV&%@4n6XmCXf>Hl|p$-GYfZm+>jtCSZ3f zz@w@iR=t|!)Dx8^>>o8mi>Yd8vrUx2KJDMml}zYbdXQUP_ zRh?G!h6h3VtmRT)F9vs|iAN*G;-Do0j0qUy;})CnmzLKgEt`?r`{i{Y=s({E4M@bV zfOJZc7eo&;XC*K8Ok>z4mQ*!@EN@7Q;>_CD&qsSg1l6P3z9_AhOF)o8^1md04rW~C zlUtqj>XWvVapf8id(a~TrlQdU#Ong&0y$r*!>7$267s9pz=FHiKzKns`Vv-}CR{l_ zDUg`*(gFnQr{gqBubZ>C`^Y+feOS+_x?bSpHUgJEP<6j;a!Qx4egutb?zg2%;dSqo zgS+~|F>0Q+ZUYg8gmK^I6vj&HDmB&DwRH4pQsh zAj_HG(ZuD86>0F8@C!~CA*5|a78ffAC)7J`$$2i#cb}s~?ZeKE&3U+xG@SFJG4q{| z91XIhc9kd4Z~?o#L0zB5N3rZy7ZtpN2ElFvtqp~hxY#zU&9?IyD}aIEXD!lO2=vu$ z9XhawF#pD=;uu2`wh{MW;eM4*>-V<1!gnKwblyloL^c+*R*F0>dWZ9K_Y;CbaJ2bv zWuK34Cq*2>U(P=Z+5tQB$0ESmOAcjoB=TeXd02VI<^Z^2oYM0S>96q2%VVL{A8(^Z z-^z5pzx{BLL&EYs)tqmR0t7ViHE%Ml%JEAVHP&IWG!NsV=sW#aB^k1mePWG@%My7E zGV4gG8z}V^7H@+k&r9KuW!#v1E!{uYRC@7#c*NlFw)0Z-?-;Ywq3mgg<7Q!UWQY}U zulvkZ**aLOpEst=y6dln8l=ETz!F#38FiQnRAXfC2C;YY-q1epXvoqN*4Fncl;6lO zwMEp>Y|f;C>1pcB5&4)`;2^DwR1VI-ke<(bIupCR;#D%G#_*XPL@$|YJ|y&JtFxjSAHoi z3hY^*ukrosCG6wBEQvw|_V(3{)DX3mFY|3UI^VDY=cP-;z0~top1Ng-#H)StTu`^@ zs03fTGD*wVTlJCiTgECj*2DoVII&qXxQvP=OgUZ3BX$G&n8!(%Tf)*tp9e zMOZtZ-sd67pS1=Bnc>o_9;*WI(%0xKD2bRx2wpR>RJ~c z1{^NC@Zb=acw)l`MV-=hiLk%A*SD4jha>f34_R$CsmsozJ?1azaZ9gdg*;`*PyW?4 zX4gXH*63x`2M-s=w{({<)V`^362<#gZeob%2E^56(&fn6b~4q{A+Dfik=E)}<#ZWRu^{^?y8+k>DmIvqQrIyvz&WUd;hXCZmv?t<@o4{#F)MpDVD>btGYKO$Fe zd{*CNreKrTZs1lr#TmZuO zfv3xySv4C*fOZkJCmFt2r z=Ez<9KR*^9raxPwLJ8iepfcB{$n64?^6a8!m`#sP8A#i7y`{ zVXCEhR51#cx8dCbhofFo&nQ?rpS(AAv~-vuKd=RYpy?c7Ack;D?`2gY(dqhC`9#ck zl{APrNi!$ zL5=2@iBhE#LOgZfsj;T8VvxATVzvp}Nk87%4XtI-a=_RWUgH%eZ3YG0x}6a=DpET& zD_l#Pdu!?^Dia3^1f4FYr#TQXN5{5h?OKpf`4FY4k(I{0X|O`nbOrH?~@ zrnrBUH|>TLU;pAZ^U(_Pi0^kh0e{&-{tAf^W`e%>tMoh?ng5~GsqOMkiA=^VF)Z)+ z`+yW(fl}0!v$AdJM7^-nLxYEMvExM{o)LhjmX0E49etP!d?q4eNU->mS3+HZ<8Kh8 znGyvzBIN(p#K98S+->xsVyJ7G+2P-wJY7Eda6SkG;h$9fH0Z*=_R4MDsvCU)-ZiLea44f-ebUOqKXgAuFhf6=dEdC1IQk84-Jgky(j;(FEn zdE5GX>gGtR?dsoGfdB{1c<(!I12$qaY!yIf#L6e&gYhM<>&+#ZJZuw&sv1`#0vq08 zR90%{Q{JlfH`?3KPP)4v!lL#j>R|BX&FE?e&M*m#*W23{FDdB6G0c0!5-br`|9bXUgnu=d)vx@gbz@a-Errey|2C)qGy|R<{G`>_jD8=fE z;y@+vp@J*vL$#5ibFejw;*xA0Hpk8xa!13v(=O|)&)RUz%QlpTj;s~96m$J;+pm^c zi(k)+hbm}ww!IK*gM`L!RKbtvR&Jahq(J#xf=vg<7D3UIepTg^$Ez}E-C7pKyp6f; z7Y&h9rF%`RA1~=VwRLf0Fc5D3w^c&9>E4JR<|nCaGhAt_*p=z25P|X)Ca`dT+g;hb z^65yp|E<;cw+FEj(%tLpM_~61S0vP+uPubw+fR!$H*|12G2L;h zAYe-5*}*q%WP2R=6|4#5Z;i8MQbIBKbDSHklDCIQ+V9uO+8eTn^jAj^ro1$c_|sJ%o_RCLycN}?W_KA{aFsvpQ(WOzxM z4tR6X;|y>2)?6-|DuJFQAAo37zG^+bGYT^SywL-lzV4^L-H|n%im)`UA}d-QDdK+j z!ZZLUTWpaoiQ%>&#IgFwHagAj5VIU}6g=2Idf60lwtOhAfQhL~^glUv9E{$?{O5>r zxHa^KDlWvj_l%MA3plL`4?jvlTfYdBk&Ru?%aWH2h$0PRReS0mXCnq|jvGz6322-3 zlyNhd%WdZ)W{K-oO?#60lV|$9x;vaqCk%5O&XlwxUd-p2ZS^nJzPjABg8X8dqlvpl z>`JXIy<}y~$!#YDa+^H&QfF|Bl@LFn#VIjF(k!uYy(@h)w-{E( z&{-eUz<6#|A+!mq2B;x$w$hau?}9C&2%X7uWW2zh;u}Iy#Yy7kPBPDpl3rx_T9zYZ z0n+lBU}-SfZ43{0Yx))Po~r+2${Z~r(U&97sEGe!ILTOLo#7WagdZEe$@$^iyg~j^ zmQ=<=!et0=nvUx4^wEiZ7YCnx_r}rco59K4D_iys7H{hMcxtl32z(yc%NnS<8`mLutmyo&|-Mc0EctYe9RBwbwrwtO|5fe#>ze{~m(trGiT$RzfNaVtOeT8VR@V5jGevmZ)d< zrZRlLQ>+V?tYD?Bj1}#|vZ}5gHVD4^_KyjB?F*^k-&fc1+xrQjs#{ZR#-g#$IQg|N zwddngGBUTU=FdwEG)38TEp~Uqg#_?njtu}tJ}MK+S#3aaNFd2tbQjEIx@SUW9#%5i zq@g{5CHmfjr2&$rbIs{w7epNGfoZnFmSvv0E{vtyRDslHA+28CtMnKflxu$mhGA(z zE>lZdu3W2#2pnI(jIByPTf)r8ij~-HB|Ws+$KLXJn32Be+NTtb!5Pt?xW`)yK_D{9 zKWxh*BL*bra-_t-r`q^cvkC@MDnLAhO-K5%_})v14FvluKi^E5)PsMHUb?B;E^y4M zn>~50452zQPr34ochbYO7iW@%3U8Djb*^_%sHc3bw@Qpr#`U7k#}Jx;n)T%Pa1B@q zeW&S5+R3Zvylgug5RHI8>FkM;RFHCRx`0fo@WTeqcr%s0*Mf#lhStcl{-DLlMVs2x z;976bQoBj)ZN8}Uc?7itKg%RPOtKBY6+8x<^s#Cna)|G^_y;h0#h0?;+03A(i_g#O zJAqB%duaIJ+HJ3ZvkFL4VJpsu@9GleA`aO!+O8IxtYJu_O|Q^L#@KXJ@6ht{%zNK2 zdT4Rur{3Nc<-Yx3z}D0()dned<96F?w-^N%Z=`Z5 z9i`KeD*KyyC1LS|zoLyfHAe0y+lS3{QyG|-B7>hM?KWf$ z@E(F$%(D8^kpuvX7Ol$FoagrF0m@SZ{wN@1xGuHJoJ$VzPv~mG zC5**QwM5kPl|6G?+hR%u5FMPitWX~ff|~^3XLH=|z0@&BciP)HA~xj0k;X2Z%9y+h zJRU&cf#N?LZE+sQ1aOt6r2KPGjUj^lxNW}4-UJf9@TgKM+6p&s5Z)|@J+^OoPkm;* z)uwNmKw4G73hO9-Y$TQW3eY(xzxf$JqQhVI!dOy_sq7x7agmUwXv2{}muqJ56&s{s zKsISjn+}}%Yr}svk<+#rLB5{iWq!3=gE-bZzMk8-l_~IRetX&#vD5l!hLhE;y>Iyj za@2jEb*AFw<|f~S)Mj^?pV{hS{-vh5#+jFmEQlB}XEVwo3U(W%(zLoFm<*;VbP@2^W z2qYCwv>sQ=b7pTHW3!{&As{r)*Q$WgSVztFg?0c0C=GN3mHfS}fF_84%*!$)bl57^ z#m43>=lZuCXKlhG9W6FE_sx-_KZkI0JT`XYtQ7R(&HHyC{Q~jf=CD(I4dL|A2h(m~ z9LPA|2IeRsIh56g!AI6Ko#_+t;u>(i*iiu$Qir9f34^&;qk4Q}Dlc5&mC)B)!>n6CU*Zu?W8??43Wj+m=n0_*C@cwo&oakSsX zd8Z-{KIR+k1he21zI;3C+d0MpcWPGP^J}4VBk<`U=is3 zP}GfyLwBxZj^;I%7CjxA)@iU7qdj(Rbcg`t-#?skpOH~ zy%@wO7U_8@2fcfh(a}Pv7MLRytl`w=9+=baB5%Wk$jq*OQeUp-)Kh!Whxd0M+n)x; zHIq$dHT3do<^b_6UG6jG)VR7AT{mBN%XU>>;&rx`bi0uJ=KDonEwg%1Pxl=ZPnOsh zL^|9c&}}u68p?qF5?inoSuPqY6?qvWxeRG-{AjHdX{B1*Z@7P(tN|)rS}~^~I+u(% za}COPYfBCKOkt56UQ8cZjrG;kBWn+fHyAdmr|8y_fo>`7vQa%J^OO_B0s@(!!S6ak zRXcER)NS$H+RJ?&1CQ2%81*!BmQ{M6N52ZBr8lL^2w`GIAbU=9_bOx)B(yJ0b=?18 zPj(&=03k2a$vBi$eeDrI{xNdTy*`8{ut_$TpqbK`Q~sjH8zc#MzE{ z{igD1h#Z%Cl1gHBlw7z?6ZKAiid$sOr_<1I4sGuN1K?~TZJHvNke!#sX8;3!`;f^A z-qTL5>O6nRNtNd+p!O%qOF>%TF!{m!g(&nNUfQv&a^Hhddp$8Hfc>_CAAB8<$grQ0 z9{laT$;ZAs{WeXNN1sJ%Ta1YT010j16#3orsJ4yZ?#*BKd;r9macj=~F~21G`b38F zX%??Zy3)TENP9HZ)cTof5e#yMewWYDR+}>@Qwo8|9cYRoP+brLbfp(IY>qDxL6UQ2 zr6Hi{!L85WU}dqe8xh2jZfxSa_s>oa25Us)EEiGhk~zXeRYT|GzK2N<8*Dmnr!4t3 z5}#p6w-)VV9WNGY$QyG)lh7u8L-CvTh7t^w~XK>DcC7-pm zEt?YW&+hI10NqUdDyrkgu-gIp zp0WoAQB|8yJ4>o-{q3)=CN#hW4@eRtRTi0;np^Pu_ZTci|25oTcrHfIXWD%E@d^K7 zYWI*^1^5B5f)Ey17-n*rB6m+NZ#)|wcaZY)cY`Z0{<<=^FF62_CY$ByT-a7{&VO2s zCG0=-p)H8xsFgXAxv)F^eVF=viL$RMST?kf2Zo1hKf6^Ma-WIch@5*2ZU3SyR;wN_d&YNm+-COQgj3jg zJuCHtsUKXYp6na$Ovl@qYua4|{)IgFfZTUNHG(D)mO`z8dBG^svG$X^) zb%a(1-I@kGSnAXZflN(!^yod~fpyw9AhGG|cF z>I}&xJ{d_7eJB3vNi_oe?m_nWE%6VHkAl`{3ngf5$^w1C;5P#(Y;m%KrQH-8Zk%}v z77t2e6{l2buj;7qk^YmqFpNs-@JJ0wt}3W^OsJcZQ;hBKVbSWMjG9)v2-pi7hA30| z!s6%|#+e&r)_PS{8E*6&(lyI`ls7fJ=>@@kV_jUD_*ObU1Q~Uiq)$=Ofy1M&uY5|S ziKdL|vBqlYzNyTfm8jFX+Gatkth9~#lieGgN>ECeCqiIq-6d8H)z+~#TKi6MF5zS3 z*?{m2>gvjg!gdAt5U~a9+kmCNPO6~%rkenR8<0{&iy5O~xZc_^L)?ZkD($osCR3d! zs|wmNFUMM2Cy+PkzT6nSZh}4{hJ8nLn?MISL_BVG({hhqIf+tU&KSnCA2_WGlO9v} z_1mI`3^ZdApQL7Kh$C4UtFdgFUIeL#f4pX+lg)C#FuG~2X-zD!v5OzJV<-hon@~Zk zid--*ZE}j99;AiX*qE#EyErv6hP-fZ{lmgkwXT)1S+0tS@K~!i*}XfatT_DSg23Ap zM3P^*LHhC&Ru3$9w8?0wXJO87Er{%chzY&7UeV?CG8YU?c^SN-XBv2)`a ziw;3{dEMwda938qTd_3(ujwwi4LO+ z-bT>3#Hx0zrQk;LiK<%^{oa+5TjU!|wO3P(l!fXlx9ecRQ}b8m(vgQ~SygH8{9vDg z{zFpw#0!Y&QB%(3Z<5-*Fpu7P(xR>P-)PlQz76`<-vimj`#!OUEuk&Bc^4B;LQgDK z(DF|DChEf@HyCKgzxAS6Rpe&oTC$t=TN4D4II}pK*OpWaHpCT)Or#Kj5 zc-AqmeJV%$YKw{!{wg@Nm>*xSPsT2K>e2H!t}*OkC3$tr*GIwxr5kC;ido~0`eCeF83{cKbX6&K3uG@q1Cr-z1vvLDPFCV6Ps1!R)&2Z z!8le5J}&2iSRY$N$K+xF#ei}?$9%1_7)y7X@(k+_L&W+G`1Knalc7D7Q^9mST3qDG zp(@d>hay;3s(tRXt7h zw4ax`_3~NtZkXPlrw{U)gG*aMInbeswTs97mVJ-=EehPec_H(vm7Ih`W)Pe2&6_Zk zVc*d@*WdP?2q&|wuifN4GF3}Yd?)A6>Db|C(EegqKyD_)QNZ}onmXQ)4oOi9H$jm& zEY$o3BR?>*Ib`(BN{J%hSV71Ho0;2!RiaOMj-UdBP+7t&1rw3soBFHdxplJ3K{&s9 zRKEhUNKvAMmUIsZhc6R1X)|w7gpTEwi2gfW6%EWW8}k=I=#JS5K!h67+JHLuQ29dW zaFyET(|nh~if=xivisA6j`;E)WF^EGz0r%R7vjTTaTC2N>P^#dm65pdkv&%>{mDr0 zqqO2_M*fKeDHaa##;)whqxghb23ot;9jH_~^)6H8Te0k)O$~W^3EW)BMJ2jdNG*_+ z!TN!ixw76DK4%9Kumj-%bADTWje${WCk7a~-jZSFd{Gyc_h-+c+{m(q*&O$oh2t}D zoTP37p&=bx*d_Kk-xH?bkFB~k^}uGpnC_X~hU)Ul4rwxk_ZZ^PL&?}&QIjhvGUs(! z#jO}Q+_HmTTWVF3;*cL@6lvLyqW97|ds6H(=Qt3gK;+N{7-TNNX`@nFq75LGD3(|Q zv13a{LU`Yfl=kTe1ghLl#7n@#lNs>8~=MxMsXOk zxV+COW%Sx{?buw=8g7ajW8qy{toY*_1l}Ay1ubq3sQSkI{6aX6*x&2FmWHcvgGBed zRZA#~Ww>UOr+wGQZA_O|`Kav*V4aC&P|+eOp0H!ib@Jg&8!t(|qaA+qnZvYj&_|m& zr_NaDlw;DaTLg7f)G5)ir;s#5IQ(E=jIm(ka$B(($-mc}h9beYYDfoi(v(GQE1V;Y$?vAYWT7&8#y z?UL#Sn@XYz8eEZIqKj=_p^|uTN-B?AXciIyH@#gepHZu(X5xA;$W-;8yI|QMHnXd{ z@4p*?#JlMi&>NF@v}qMmtT<$XW;2nsZftszj{rp7D5Q-8j+CKu1#o#I9qyQS?J18_ z_Fmp17yT?%qQtzEs1ctaE)MoAF+ zq8He6!8TzR@kxAhj7Nhm>H?bZ>n4L9tEVs{r*vyOe0=%ejCJ!(h3=2hVvJuh%LMzl z+!IMk88w}fEmH(oMT&11?FP-*EJ}<%!8LT{ml*8ZvDXkeWUUP)y~`@8KfhQ{l82US z{t|25r<9GEYv7}tYEg$TcgQ!dq{&s0ON9$~Xf#D<*zQ`gW*SLAa-hP-&mGhm{Rd?~dWew_CT1{4&d6P4kyXlVE=^{GM!xm;9g3h)uk&0t z<((R~)3Z6v@=R^iZq9_i3kVd^my?OTR-)fe>Sz`b<5g}pjt(0Lo`R>YEskkDxZP>( zWMWcYtnxCzO}`UT{7D6Laq3e88TL`la~vU8o>s~ytWtHt?n@oUDJIA*NtxP(t;gyCEnvo}h?m@_$gpE>re zN#2LvE0S&LzJG$*1@jb>YrLpL3q&SlE?ur8Cl(kjdLn?xu$iLx$o`8FwnB`E6nt4R zj+EL?O&a5CN=KT&8*C^Un^IfcCoz+qh^!Y4N zxjOJTlmX{xbf7n5xFESVFu*Zs>=4-RXC&W^p5Du+ZRKzsi!~4c8$sVwyv~t*8s+f+%25M6SIEc@7c-6A1~l&1zo)-ZXFYfQf=M`1Gj^n=C5kNP?DP3= zo2t!auI&uZO=(wvcv6NwqyiugLY}4?7Z7U9kQ9W2(!Nm>Ox)s4{!lY5>MK zPkmz>?dVFye5bFc1&@s7Mb)qGVk^&%s7@PuNrbI*Ma7y4pL#m7`R&QPY%8kE@5&CL z6g=tubST&cVV(mgLtOIqFXZX@^WSw}&zEm34e@xFH(5UIJO#W}U+sMp#f!S!(%PN%N_5d=5GvV<=rKdJ1DCb1 zm&Z#IT2po2I!;-dCE%#^rR!}9k#oi#<%7=mb|f8 zyEyTQ?C==rmp=jhRPg4ZvmR;6w@E76!{arl!hfYfE1VeF?H$F}UqXtz==WcB)!y%O zSJt-qmd;H6S|s{nto9Z}FsK_9A=E2-Ad4ebU$nl5@;grFr!+dZK{l&Ib&nO;{shv* z-s67XGAxZ%-g2tj&9%Fc)RRnCAfXTJRG&9Ls*}sU4sBm$dC&&@1V9G>Ra;IgPd!m) z2uzAgXpA=f$PbtN-a~M2qCWSfIb7e`d`=e7ONRu$no|jf;^|r8g6q?5cPv0b)~Xd4 zVApdz+SQKKBSpo+*G2E8u8CUmgG#`4G=8l5uAp>6shriM=dKP~m({a59z_LU809#A zvipcoEe^YO%x18{vu;5PK*O@uev9VhPQHirG7E2|MY$z#OAgYLT)*1+L|?A+vtqKe ztM5nwn_b47@uWlKB%Ly|th}?&!iQG9GtcIFZ*8>4{)e31AZt&JiN8Bji5Fvi$KIS3 z#i!cH3f~|Eh%EcH9o0x(SQL$5_}00~g(_qQAw=<43gU@W6^IUQyy+%Xj?Pq@G)-F? zp#LQh*9l_pSRU8|Mdr~{Qp_a>^NkQV{@Y7Rt?`}g7Zb%lW&T< z!pr9ct7|(NC8bL|24$~Fj3l(9!|CUKFBR;BxNe0l*{DqiZy%%WEo3fo-09?&+=)o1 zvhrr%t20f?aumF*7N4UA6luEJPKMI8`&3ZX z$Tu_1fE42{u4{9GZXxG0X9e(Hf+vJ=A63`uGo**^?MwU_k;>$OT7dFNt`*?cYth2> zZqkG0Cu6Y_)giU-jvCgx7H^qdhv%De!A6L7AETt5u(67p)(|Cf1ENr|r8SO3P1)>} zT2`|3vz*_*`yNH@DiF!X-k?7s=nd$qKIW`@o?5u4y;Y7&dA(QFjN6e5shI8UEc$$G z#?6H+8ux0#mZJ?$#bg!srjOLto?H{Jo9Wee(gDrV#xYot)R7`H~zbFYFs!wB5!MU#5u?xP^DQ-D(QKa|`e z&18e+EGIE>cJJMnza(l8TNlkEfBPl$q5?5G|x-5+4h;xOfNc{YR^RF z+1(o_FH8Iq!(2@D)SbC_4l?tq+GbFu4E2SR(a>=R@R+ub_t`gu0Y&ah>3Ln0FkbA@ zr3q`jCQ}BaW%RA31cDhQgs&g9%&sijLRi{vg5QPAly0)k06Rr3^OqnO*P?ndC_N|G z+nrTuoe_KH9Q*u!gr=w%MM!AvqG)gi*oNw*L04{;pl1@P!;S4YSZg!6nkUA*+T&qaA+mL>~4n|`-q?ohg-tZmKjc&~%Am#`5;?1Xe zU>IqCvJqT#fFbF0I~A(Ifi4f*fBM#X>hjsa{?aa^6nkl&Cdw(vq4d#@1b31o*sfRz z<<_s8fzsX`dS6T`r$!PvKj#)ecQv)dzsLRo3Ej7+!3=D}TjpkK33{RGZG2C^?!S9y z-sDUG#3Nrq(g7ROrJXd&e+VB2=l%JjSx!?BxyIUjeYT1A`GOVnU^1Jd0q1yNz>AEo z@d5)j$BcM`d6T*73Pv*z`%Dz!M;=62lD4zLZTa<>bS!6tD~_6vy&w)FUf-D`^<|1{nI9uxskRndg1$_WGV#4ve!Fe6QQs9!G^qpT4!I%FH#9{E< z|A+W2W_$1Lt1ci5ae^T*~lUu@?qVFE(CY-&2x=B>i4W^bHm zsf2{Y7WVEq12E8bBz)w|4^mk6Cjb^>DX-&W3JBxJ%=5T+2)5aL_v;}`sk*Ah&Vzzd zWt2&qk=x@EWTQ-A2l0hJXhGG@?CocW)6_Drg`T33XIvU~&wWQg_N-gPnCdlV4dpMC z-lK{`REM)$Y-l|>-T8o;ERc(ysoj?f@<8jdf4L3W0WDvKM9N7)a#)s!HQUG?Z@i;t zdDf-(rf;W8_)k9xfISw_b{{9oHtpMsf%d*KnD5?e`&^*m6ABrFeily{UaT9(iT%&l zn5}TPlSPx_4nJyD`7`t+R6Pj|5p2lgh%2DxB#;Xgi3l0c3#?)MgX5Fvxno6UjQ=5> z{~y;KK$=F^kIe-Tw+V^ERv>eqp5C+s{PUpR!MS;`9a>;0fpI0w-guj`Ztf@9y{#?F zI$&}%&i}(7TZZK9X_WY$&9V$ghO6YEqAU3EsrVvJ&7y^HO7Tex&*l1jnbZS7lNx`L zz?{JDE4U$EGJh-XefW}26xj5s;1ptm^{5B6-`JUSj=1%eXSgr`d4dM6O8m+0m!Si1 zAYHlg7U|dY#f@!ZTj5-s58|aFv(p^1ot&h(TQm*81<^khwpj%-gGqI$HE#{$(xBm@ zl3k0`T;MW-A(XE`)c-90{4q4X-n`F>Ob@Fw@4qs5(|u>WG@-~bKFz*WmLk%hLJ?EF z4vZ?l;ZJVnAlQ8r{me^?TZw+~LZr&ZGmx;jt*th<)8#EhdGD#J-BOH(0zp|9{|7H~ zo6FFj_YV&h7_0x5UWNa%+O%gvmVP!fL^kH`Fj7fgKmizm0j^h9Z53H;>gQyzi#w!K z^ho`Sa5xUx+non{4f0$3=by7T!==H;%d6Su=|DYtq;Z?ODoQ2TJHYvs&XhenJ|1d1 zQEoGWyset2UM7_9qRc8_?*s#HxA@6zYuT5Wbh#M~=?A}iIHP06*tRAA>69_Hi5+h2 zm&(EEviK;5`PVT*ZVT#x@@#1d15zxSZKQg+^4RU+duo#4)+0Yx?KUT~dUX4O#B)(- zybZyN3-I-tKOgwgHxaVZ1He}L)&H991*cD;jOchE+a#X_wId2RF?fta`umI zv`;zU#}*y%Js1~|Z?*Dkr||h3F&qeeEond<63c&1Zq^Rc(i8aO`+pOi*k}kEz=HiE XW*wzIX{ZNYA9DRK-9K|LTR;3CmXZop diff --git a/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)White1.PNG b/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)White1.PNG deleted file mode 100644 index 2ecd546f611a04691dd3e7f16dc9ead25bba902a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 122883 zcmeFZXH-*Ly9TOT#a>bA;ufSxZ$V0kg(5X{qy(f(38?fEup=NMolq6&RXT(cl}>;N z3B8Hbgc5;-KtkXq;Qr3u`#a~){dvcoV`L;*%r)2B=3AcmhEQD{wbLiqPaHUK;I#TZ zW&HyOjsg!H_+#Q26a9+#k^YKAGpY52NOU}S z*Q69UH19coj4%12*0~Ryx8>%a^2U1T2*kv6=vl{k^q3Zm$GyaZCh^6?_%!_Sx^e|f z0hvmo)O+XDA@ohqD_F-yqjWmOe;*P|80No!KVWk@oBtmdn%T9$|G4l*MgjmN=gCDv zii&HtB}wgFkR6GC%(yw;{?K2P>rpD;aua10>1D#b<#giPN^SnmB}<4X&ggs6Kc?S0 zm{*1qyivGn>ca!nPG|ngknVrRd-#$zIwZRQIAwdBwE2s9S77FaLB28xx%T9rggq6` zi^k<$Ci^6(4Mdk;GvR%B^@()Ue01&ULr&w_R`!NDrkw+EZpgU7YX)is6La-?4@@lz zR{Hqr(kyr4ymA$dLm}L~Mxem^+LMnvK^%pnM?Y3{C{~AI09fMx}-Wh)*F)eP+>I?R*_|lT}!6vE9z@)T;Tcme46r2Lh zvgbdM@JIUIJToQqYBXUuHItJ5EFX+(#dgP;ltqdI5B}{zAHKY)-TH#iC*?(+;q?^X zT2Br?o6mBFlWfp0EaT`eZ|KyTl@z@pk=i541ZlNz)JEUpbr1-{D8);2a*<9ZzHcQ~ zzJu56M@)6v;_wdKQhv3gXaBbT0bPadvYDq8Y(PN&uKI!jVR<#!xG~5&_*Ht@T&@hJ zyzkd3b}vz<^&Z)i7!hic7)HuM)$nkZ02~k@k+gH)e%wNmbh_GLx}E#C5nVl`W}G(+ zxnd~0ldvmCq=0gJN;rw&fotim2I$I0h)ha-E9gC_3cQ=_HX7NL@C4T7*gBKopR0yff*a z>ucCQ%xQr^VZE19A13>Vc7&7)+%4nNLO(4{{8C)5iQqDl1{#2Vy}F2({cSH#^F8n} zM$Xvu5<`=nd7AUkb02JgJF;LR5u-**vZAJ^>u`zbf%)-kZ3npp*SY4Q=t|?r?G@Y? z$36?WEI>ZaXXl=b+sHi#%u9{rT^oGu*;dzm2&O!rBt5(PdG+Bqnb4qQXmLs`4$b|azH3Wh30zXc(?-(TT29>Bgj}a?Q-%HSA+xm(M ztCDs|gF!~>g*`ss$j)(5AGw(S(4XlVuxJ+A^uYg*J^9QW-1RV=AB@~O8g_E)RO%XB z+Qj&+esFzep1<2*a=zNn^^fDm>+n)UwxiJ^?uL~Tp_3(Lez{}Sd_pBiY|q+sOq41g zMIdmgMH7UR#*2gLW}j6_rsd#<@@nZ{2)?`{7^!FW1Msu*QN6Ke%CT9UXU&I2SdwFK za6WWq>4Nyxa;3|qfyIzWS8cEfLGU?w1WeY z=JR&9?;etI$RjOJgE#WdzLwP%&7oLTYwNnq*6h~y>}+2WXQH9q&qgGd@F}iI!M0yK zJ(x%_U7sbXh%(+?nUV&Q z8%k6G2tA0{tmW>}{)cwzl55xs>(-N8{m?;3@s*^?8(C@cB{6E)zS20_TKS}xehHU` zjD$fas8O%m=}{`8wPZTfCm=r^93<`;(&3pJ@~{{tl{JUN<%!N9LBzty559fygox_f)(-Wo*WVyaOIfso%0GWsQ9M=xLMs1fD zmq%zs1>SoCe>UYg4jM__)^$+2KkMM{&pT=(D3+b`fJ?S)F{%LvzZz@ugLBV9zBu(% zu>cP(cDlG5i>NjhZQRest~Ss2C5s}>fRfhmk$?xu{snDTSffE{12ln!*)`q2@v9fU zGZ=XnSor`xg7A3ZAF!ZBkTQ$Uo{!w2SG*AL1?%<7PSKLKr$&pnv@ z!FWkAvx@d9#4ULJ)dXqI;}>^8L)Mus+Dv{L65_dJI_H>V+;eXaymrrq+7!7kmtQ+h>|ui zEq9drwQ&_AbRYOoyt>xM~>YJY>SNm`clmv*37Y8TU zX4oHHt8+%FjlRn}WFN+>WsRK>`w{qJL@A4?!KwPEd3d!D%dK_`+7Y`vbbo@h5jrFT&_t@x zMxQW{RpZj$>Hq>KO>%v{3v$vP(XlzON>1c*oD+e}EdjeAZBFU%YtpT7&QSECVP z8z}S9khcCD)yBNy^oDy4mD3+6*j(BE@Ajjl#kQSN)m_nfg8$=J>34T(+`f-AJEj_` zPh$YU*+hoG{&I7-0*6Uq_*JCI!u1DdCJ4m7lJ@@O^DxvvQ4DkWJK}(<4i^Ks0Nhjc2yTa-%xviRqv}4@gHHu@Hz<}!+zS0{K|9LOovsOM z`Q{r+%O(Urf4l>&q9BCLVQNVEu9?QviT<(3{T61xm49<;{ynI9X!~}F5uX1A(3Z|r z%Tla|H}6B%zY>=>GTg+ivs@A6kK8yvr|??maN$vB&2JRmXu{f?EPLkpV)a14^0xo1 zTx!Wyp_x5K>MPv^MP7i`cqSnTWx6vN5$;!ZDks-1FJ_e_9Gxf#^2AwTo4wLAV+B=< zl_h&d{RM_B$A55YftxyboJp}vQMA}N9FAa4S^UWD)I`qjanDjUQhl(JHIpXVXOJ+< zktmPHI8qD!owUJuyYJI2R*DU5PFVyDb7Q}sJ#0{A&rG*^<@@ZH$W>^slmi&GEGMa*Ujh-m8Sg}XaJ|S?R=cpE@_D5p}U&Nzs-CTBix`a0ez z_-t=*;pC^$>M7DHK99wRYO=SJu)r!VxjdyY%QS3M7#MqW^oCW*h(V&*!LVLGoq{a0 zwE)1yG2-EUcha6Dg3dEOJBb%*^53$@Cs|G8nY|4(UseyAs=fnF8HJ3mFLE!gn^@3; zVGY^EKhLB)D$98!#)mp+mE#r|h_D104{g|-^+E^xwGlKd)?Eo>Jiz`96T>$1U0_sO zKc4b2uC1D$yA^}66Y)7%ZyDN3K{RTJX*Iqj4koFoq%N|)iIB^uHXy%8`TW}V1l-GO4v zOa4|7uAZMJ2nHh?^OU>Ty7*fEz!qgvO)dG0QYGNLm*Y z(OZueB{-AT>yiu9Q7@o}7-GrQJmpV*im>~_8oXbCJjssT*{@Rzn=iMs&`j>_6UwL}}#a|Tuo>Kb%rilEDkaHZJDAf5o$NqeI z?#{7~7p;FMwzph|${o)#F6$OK&349_6?@P>hiU$G+uozk0NloM>7lvh?B9#lr-$fV zKi&L~S{YM+9H5sdSC#(3+s!X@#@?LmmjtRsuxIT>c)DvJl*`)4O&FQ@=!RT2_EIZ2 z;+zm{5%(6;rd-6b^y}R+Os^6-uHcRO+%mzadf#v{C|dp4nVplEnoe0m=7V7r*SEh* z=3Hv*TY8BXkWTmz%)&#Q9pLGYZZ0)&ewFkH^@v6d>xK4zgXAcFs?c_!DbQDIKD$S{ z?sW`?HO*0REt`V$(Loig)_Q*N!be+jZM#a5dqg&k0-r7Kxggg{bzKgo#TE2079GAF%j|3MlGB4G%O4y zhC$#%&d>dzm*-P0<3^;S4w!R~tx3TZZa$^=0~dyq(h%HNl8QGrOZF4{55DIOq(0k; zFeH8}m7)2oN;7u;h*Ri%)^tI=_`3OgQ_;I+#mQ-*8^DcwXZx!yf!FTr-y4>4=@TJe zT1>Omua*Dr3)n&Zv!xUx%4C#Uh;JpY&W`a&F>{}0A%j()hY?H1J&b6#3}=*N=JinG zvFj#=mOS$Q z(`suMkdC4noVa{)dlVs<`oSvuag zPL%xu8%7EO*His)&YtP@BJtrvG4z*3&*jtUnh(g26K|!T3|(BF^^{U`MMT)jgb`vd>u$S)rI|1bYm z!vE)FGH{MM4=^;b2!bPie#ALP26w$uCr<}27Avhq?pxs(+`+vt@|cm5oa63GOrv5` z+KM;c)*XY8nnL=CTsg5LK$CvtH-&-eCh+#6$YpY5Z8Kf?xfOws3nffIUA-PI-eElp~<;bo1t@vbhc6^wRS12>U3u5+6C+V3jF}~ z%3dDT!T|ek1?Ea%Fq!C!_H3_emGZP+XEym(oJQW8?l-$I_)at;Lq0nP)g_(ZCFZaG zBXiY>M5aU7S(zU2#;RzTb>;ZwR(d8tAGenGGOoWEXO{v-d`*zWU^+)%)dj(|!F4Hi zJ7=W6v%WI|0E?9J3pMR&eQXi9HH`!$^~#a~T5-K}2Rsw(kGW)UU||*_e0CkAEEU? zAsAD_x7+D|pM(td*g<;> z9r|mXThAEj`cp(_!bmKyHh6ecYCpgDuSKFnLf-M82KREex&A``PN@G=3+P^DtolJz z^3%)*fCAdBQhB$&X8y*m*7kleu%~1ONk=rfhspV@T;tRa@S;bW3Ll@ z2euQ|v@`6xpPMr%+Z!hiGnmH87%z(s^3AiDiRgiqs_#O2eJX>-7fItmVgJ_+twA+b z$tf&eR(aa!-79kI;~{-2XW!8(E@cy@SY$FR*;Z>WD*&%?5N+zR@uq3M!)Raoh$>8MHEH{;iz*ONFaMg@DRhzsG2!gP8S~f>WN4c)KHS>3>Yve;1r@b^ zSt{M3)5>-`y1%L2!A!r56+Wf7t?o?Hp?^<8M`75B&5%&JPks&X@I-}|98VW z;qIoGAJI)`^YAIK9_p0>u@((5U&?v+f6((04f1xeUGJMH(ANU@4vQo#th*RIrgR$Ng9$=WFD6xMqDe^=D6Z%I5O-?yDZF62xJBD$@1HW0U6 zXazqRq5IaJc=ja!*KS%M_K89tTK2kEVt!o&0vro;JS^)j?B@G2Ht{)b=We0}J?MI= zmqc!x_}P#x`hWE81^Vqnz1VwO@O#*jol6OM1wjk_tBg9iq}~GZc*{P&EhK$2G+*uZ zh*8@xsM>mhVmP^uD&zQ+BTG*i)D~;0f~%Y|^)+=*#?P;7%`W4C zbEcd;Rby1-$D_iMQc)fJd(!;#1+Es{?YHFY)p8fpe`WVggaqdmcr6MPeYRfGWu!Ux zbhAJyHJjpKHjYcS$@V7;`bOHg`}QY=8p&X!6i!g-sYTkv%UwpjbF1q-&wA*Q&Yi`e z8>>!R41nPRje0_6Dt?MWzVvA{|5e=#sw4ob2{l`sgzTI4j{>fEC#m(Xrpc)eIlX>R zO;3amAdX^k8MIGcId1DA(1@T{ZGAOn{6gg$98Q(5ZrS@@uu(|~UT5;6RASoY#I$}U z%sO!o`1#;gO0Jb~#^zSZ`>($KX6pu(>=jkfffgFuott=tt{s6Fr$g>t+1NZc z{MvMLqNcM~gE%ZIcbPq5ih7avrgtVZxTkHsRqLUDu4nzr!-Y`frj|usK=eS+W zz#clD#E`r3!Frolj!gkZovy8uN*6z2?8Sl0tLGLxMs+LFAcBM!y0oRnYJ&R*w;;c@ z3BLKv^y|obzFXrgjZNXYR&@YD zjc#GO7KN-ZlPo_|$sY5n%M3TEoe;$t>PS06<7VT8`8>qjcVMuLG|p5rc) z1m@6l2%CF}$8ENp_}PCj=HYCi(*v{w>gvOW&cV3lw}=UsfJe_k2wFB8%F{AYXSAk~ zR=$3`62oJtbNOYP+UGzqP~Glx8k;bB43+zsjW@A6GZiSLfWZK)wb|3)624QAt|;Fp7^1ppviV+1{G84JaHUt)jx~+d?b6gSiu> zP*h-sSjOU|YuZ+?7wbGXglTnHlovs0)NFVo*Z**Oj=+VjOuwpfb}=VPx02hu^$0Vo zY^Wn92x`S~#baa36UMWk)U!c&j^&ZITv9p)I;uxFOIOJ`Q1f?bs&A)$)yUA;9vGV= zE0R7=-%&11g^$@&t9E`6Xj{}~bj`lYr0c_e4RBN9ilSTcA;5-Qz)#skljmQQ{V3|z z@IW2*TT>mY-(NOD9I9q>QZ&yEs|NfuHy9Rs9_v)i^B#jT0`8ZUZDiTGCCH;hitO=WdMtK%hH1P z)YnkEA^b6bF(0^P2(_sP1e?4`>2cQFOo?5jD9oI9HK@_a^P=Z(Pw!i2C=^XD!xX!B z(!!ZR`yWIZIoQ>eF>%*afaI>U_Y2HIh1YIHxBRjS(3tWc_vC_+67S$h5;y}!XjZ(9 zl5+$Tvr}(*Ydv2KT^15bfN802+>hy=>Tv&BY+f}RGRjl)&Z$}W^N6z@*n4#O*i6ja zNc$Qmj5+ZZcp{;b>QJmMDAYM~tY2st%tug82VJJHSyBePU^Qq=C8%FHcM0|DzIfT9 zV9B8O)_d>G94Hd!8kHV_xyaY< zi4z{#)oNl>un)8?m^&ja?blD%$v3Ps?0n`Wvk4INP&zJpMH~L zu}9?g>2IkyKhNsJx=*6j8xmtNZnQ831?$zImF^;0Wdo;g4AM*l2dYnF_3R<$DQz zaZRx!Rm(*i5P~^wBnS%BxtCh85h|W{YNNUO!65&5WwE^PVXErq#dy~?(a|@a$tQH0 zv7fci7QEwgAFkHvthO43h9Q))vP^DkS*%Up*zlST-&Wp%B=uSaz^x{U?x;(=intA4xhuz*7{-*@nf}%%&SY@ z6Y0P>PhhTM8sRQgqStQ*9)_Y|D;w{E^hY8VyDIDUVNTl^C?9^hd%e ze1Vp00CZ}~$vKxOhBU_qRY{CmD`hY7yp>{FS8b7;=m;?XNr!Re>t-*&x|4vjL88CQ z`1TGWHoN6g!Vx~?a>tJ!GsUtW7v&S&p2*o>yQ%oGerTkrTb?Ct`*H?8zG_=JZ6nAv zyE|?Grax$b-z)v3}o`b7oz1ZY>+VKZ{Z~UCeF^y-vxtQ&bbcIO|hEOe- z`-2u6*`LGMg!zXp7aNT>Zi_?9&gfT-Up|?)sM6rbTXK?|1ME=|v~5DD)k(fZiBHwX zK&wXhpr5HcicA*h=jUXYzR_1|wU{p~H!9&)8oNuX)cWPRe(4oY`=Ly>v)<;I36{mQ zn$ELt=`vs1CYGOT1Z0RkC-abiGU`c<7ndkWk2#AIR4K#$#a*y>cSLPA8V4DZBXdLccaS9MII+5>-oEGT!xMNEo*G2 z>>=LwlYEf@e#_@8sSC$GLztbI8pX0uMo8I+Ic_KX$)*KRCpX9c;n&|$ji8`=nd=FIeJ@Pyz{3qDrV=V!;8k9v!Uq>{;<+Q61`zbD2lJ%a=J^Y@-FA47sp5# zx()1e{u?)XoVm*pK%Chn2NZfHCBZ%ERV;-Pjwm5|2wRE+KW3j_-^B{<9=Ui)?S@h> z!6+l0avs07bA%z7{dNA5;NzNYX0P$9?rXa&O#^b;-CEA24+8q`33xMBi8}VJ8W2w@ z`H*=3^V;X2bc$JsJ-)ajnMhzETg;}vvN`-O3?aqWt>2o|e+Cu(dbYtpmcE{=r?-%M zUb{>{Sb!5)3!JOoyc9eC!RROa>CaEAfrOLngQqM$O;&dWq$@wY^Z0)n0ro(vt7n!# z-umN89pO(d(AJqX`+)|499DSk!nYojm*u)K=Z2=B4xLaw9KC?1aas)cR0bao3uT}- z;DpV_d2cULy8A843->hzZA>vhhMkuq7&`Y&Gcn4(jPrC4&!x*5^*5wIFbcP;*u#UbZ z!GI1ZjVY7GyjzW=`BDyIY5Hl%e9m*5L;sSsgyhnA13txAlQgrFlPs)12x>3}t`@T3 zV#US*z2>6ik!LR3`r&lWa|I`cXO`!kJTbnlrV@Wr3p-)8`IGn=s_`ekQDP~&+9E^S zML_A_^fL!&g7eeQSSCwbH;#N%1}eH}ektrqxRPG3lCU~kbv+2za-43k7soA08|#Y5 zhU&nIz}^F4bkKqDO7`9Q#=5km)iKkuPhH^SEqn0Z-*&EzO=t8We@UwhgHntwXIfq|$*xfgAHq*@xid*9 z)lZOJqrrkspFp=Bx`h7-H}5wY6*EY8LfnVteLac)2`I^RIO&sns4YzP+NGZ@RP%b8 zB53eQXwYRl5ZDi9n%*CDLV%acatt>f*%(LlV;=`~2c&O1B+Ldm3-JAyW*k6hbN<8R z&jo^T;Chnq(8}P4&sr9qw_sJnHY9Fvkx_8^)Uy3Z;M!6A&Ur#UH`%J75u2?HL{i?Q zvwy%7eWBG?sGx;PjmUC`lhp-i>5ce+2^jHZ`iT=Qr|&jA>;b(SKIe8u*d#Lag=yOSMt$qiW{Xs1*} zdQNZUi-85{mJ3;D;{I(;myK6M2V*v^9?mXH+~;tveH0?P{+2HstA4!X#yNC}QlaQl z*_dhDXPlrsx#L2mt0O#ECdJJ#MKP;!6#7a&ZPWCU(ulWKWI#FnF)zyN#SXst(?9=F zWRnxP+QbJ(eWdR0jX0xn0+l6k?p56u55o7%U zowOvZ(z4}H-j40}kyymIwA&|y)A!N*i6Qc#wvvT%vk2eF>-WGW{>YW(HaRHn;O;#) z;#vu^#xXz7AuU7}z)3Q=3tcx4#!c;3#$P$3c}?+pw`q66rpfKnf1e-RXZ|h!$g33|JH2wmSfU&2Wb?(;J|37R3;mCY1F^;O5%B5Cj%Y4>#4h@b2ym${3sx_tO5AF5+jSOTl1xggTJ`Ba z%WaJD$rR;-=9He+@leDgY+Bu71ROCQWDBF+u+By3Y*Wgi$iU>Z*4%leJuYrR_jJIE(plVg_V!G<)=HhcWYZ5L07^1NcHA+2WD+3Rj( z@I&>(6V-L1gL*-Z(v~S&j=W3@8%?zw56*GFGYpKD7DhYIu}#;qTf(&}FYlD)WkA$e z!Ij!b+4?tRZel0rswiqwVZs?1BN_6x>^P@t!ImXrch_5}hOK{? zICkx>mlm4l!GT{~3ed{jPdBi94DX>Uyq%0pS)^fP75Fz@^sR6|L|AU8U@)Cxe zV)&o~ul7#K!d^)w`@Oa*KQfxiye*Tbzz6NK*YuqIS{4%&;T-ajuwvvW!-83}h5C11 z`PBO3RC3xR4sj=^h};!_i^kD4PVYjl)~dcOZQpSax|`+VKU@8 zJ4bl>4XI$(X}B|z%d|Gc^*)ldN++lGG3WW0l@XycarOleGGC!oasVOO{EYFYTyr{5 z&4moSIZ5v;v$QC&%nx;BQxnBVbzZHAxWOY)xHNsXn{pFgEr|Al41MlQ$u8?rA7;v| ztj{Z2;a=8h(79-DiO>SqEq(WbUvq|#-i7IUrm{ra-y1fjMU&f{>tN`m`Yg-2#xN~5 zZ(7sri47S+r#rAXfY|6wo!n8i@IzkfkH)57rp%RJhc&D>8kGc3*VOMH&SKB(Y5!Dv zS)t_PV2ALQo>1Dz`@{(S5WbUD)XIF*GqI`IUJL!~1^Ss*f5bE(7cFa*!N@rvV=h^g zRfB^5VDDfEq<_lD%aVG*YlZnbej+b9h2-A&DCFIN{w*2HOfwJ?BX%7B$CJp}2@S)t z+IbdgZ*L@e7@yPGC07JASe|^PT*OLg^GAua8m<17hw9WJ#F zeHpYM(bc&b{v7Ob3}CC|r}{v44y)n@f!%gVQ5quhm^DQQBNZ_r)XxbYe+FkjaOf^A4Wz^@1L>i?DeO9VBKtc{mK95j?l8u>C}+{8U_&X z`fhoPv)XAw#MWHvC;w1=K|;AU%VNWp7BH!MvN(uBG$YLdG@0iw=dE)zd=T~jY46qa zd7)j=9K=>{JTDa8uydjkEI4ykq8&sKvksh}(ZGx<3k2tB(@!XYC~yDlq#652wgfFh z97m`lvvWw!<#Ap(Ym_`+_flpGX2Dwro$`v2_kJ zosqn05NX67=q)di=YT$ul(w_loNI;8F4C zxzi6vW^<%SXH-wE{O*P@n&iFL&Hu2*AE&>5GVx9JsRCF><0E3$dfH~2#bE84>|Aa+ zccJ%dg3{X_aaK=T7DEA6Wi@bNA!Z5X^U__Epcy}zQk zZMao=(iFov%9Zg#5pNXq);qW#*7m62(6+LsuPbQduLnW+g)<<#dd7D{3oT#AuyB={>n{CQ+ORJ@k64bxvfLZ6j#U3{yS*FKQd z)ID;E+A29)C~xP{6=zb_=IS9{n0Y?YM*75*cOCW5d|C(KrJ)~G8TlH2Ar84%Qy`{I zmDsOUz8qoHgBK4;;zXIrHcSY<4Hr$DTN*&+0&*<15+!DHD@n4s>q&o;u@U_UmhQL< z(AB?ANrc{@Jsg!lGM(dZ_LU^Bt_bF7a-b|ro~)p!0h=buJWjkt!Udc?{DtPN?pPB_pgoFI59}gN~mV*ITm}4ej02S#Wj3ygO&EkWx3vG2pTF?tKx4~5~Jx$ zVFCl_TnY>`MgQ6PAPgaD-lW;N`$dC8yw>?E@l>*-&WqkZB|5WLEH3D|r*l$T?K|!F z+3$lRu0fx?rgZZ7S}oNt2elh!`*hhqa&YuFt`7dq_tm`?X5CYX$M^%_gLiO!jT1_t zvhPM021SwWYZ1}AJ_u2tcy42Qi;Nykj-Jeq1gLh-CyD8m$8!-~4nF=kRS%`?Kv*R# zuav&^H)WFLvT|D#$x9JL+_&S4DhmR%3tt?9t(miX1_nCw`a5u6HlqFyo$)K$j-5s z9>z7_Iw3}H0n*y=61}T#=oD}I@)SQN{;4%iyfR}^&kJK<+b=ujj?88isNqm`wl@y~i64fZlt}@Z z?>j_^NaUtu!~gs#FJdcc`r1fmp1Eu>(E#ZB0@dm?W3-WjQ>ZKa96hLlRp@+kraeC$ z6^oinEC7`OFN>ePtC9V9Bd#e{Yp~~~R!|2;!Hy$k%9G-60?F@1&YAs&3Lfn>=(K!E z*gjU#Hg6|;-U@?gm9=(fMf8+d2fcsDCzUtpy5sFQY;811l%_lmF44AvBDI!5#&rRt z+x@9q$$(p>{?=O$mBm<20*!Ke2_bw&g!U%w0^HKW4EE|&~+4v(Y%Ooh3oE45G? z{MGtr=-1c**NdEkNBU~JZjV0I_#w%*Ty-3dKQE5Dv&H|I-S2C?5VZw*N)_T5o3}iL zs9P}yv{}%imL=|fKnGsO+@#*Pb^#-KwdGz#!fuhU)KI#^uIbizkI+~Sh4O}K+`rSZ z-~aQ}bMH9)V-#$`F4{ap2*SMbN;hU}6l>aD54%`yDk*9H1TtbAD~4I`aP-M7*+f0q zaaOL7`=jOA5{)vPZ5ccNqCDf1qDuE=SFkF7$tYnWe1k7Ivd4;lr9tRy!WHNKj$vWM@5lEx(wZXJe|GaebbG1HYR%MyBnS(bRufXk!St|X4a?(A5#ItEK zhX!-GdGY+nNMEtW-WE3P-;mjXTsB5I_2GM9{c>X3%#KZRR!_&q9b67L0QKFHju}~D z@V0MXxF%FxnxzBY3#D@Aq`r9l5KqmIcc!+er_hh;a|67i;1|9M;*v$irsmJh)O)8* z(Y|+eQT;~bb1GT562a@-&l8V5lBhM8Te%I8ugfA|kLVB3*LFAEFzyKzyunnvNO8^V z?r2S06-4#UH607KZPH7fgojqis$;u_y(YG1AAB)M`FEey!)!6&2mV@*(4fN8mG?hG zV8yQ-d9^gLrHCcPXlh?o2K|Tj*G%&b@sEtxuRFICOCr5>wOkc-qd0|zlVYp2e_fM9 zj#$IfHLn+VCoFoTgWoz1R^mMELGH+V!yJH~B{_fn%D}3dqvBK3G(@CWVQavL;cAl& zrb<70)0&bfBG{kuX3CZ57%T|UQ;G-1i^biubTGBr5-hQIpRM^9T=(I-C+XAsVtlo{ z{qu(Jlq_V|*Xkp=ypgjHF8x((9RPra$%Z*FYaP-wVjsf>_91P{BSlwKqtt zSnlWijKoZ81Eq%5ws^4*XFRFZkm(cH*7=LPfxGUX#U-V2hN2c8a&$X)VlmxvvHs}r z0y4ypU}WRU{?0fsLv&$DBst*j&-z6~{=$ZOGS)HK_x!ZJqhQVrEz2d?)a;URoWnLj zH9&KGBAV6b@sWQaY9F^oJ>9=q@hvZhl5BeAz`hP0-+cO6tC?g^@=Ac zLytb(p>;)aN>i%SS{x@VXVjb~WaP;7;INWhr9S^>fDQY~y|;(tj8l*G35?4^%PD~# zXgg#f+PSitm}%v_!FqSVa)nwIYMDCQ*mCJ#Xyz-`YwzhB@-16{e#3oUzAP-EU^yYL zjM-?kxkngE#qot3VmQgzg5wwiyNu&1VlS^9a)}vN11|uNUT4>fmk;t9*Q>NsgHO!= z@|@}ENW<|&#T8TIbWWdB?p~0OCETl)k8oISrT9@lx}Hikc)FE)q`P z9n5Q+bM1c}%34`Qw%7K^t#{V+F+L*UuU*HT+R*QZmQ<%`6mydr9d(OG355A!Nrr;D zB+;_(gm$j0f#?{H+LffBSjXb87A0a?J9GC-e=VM$cv8$r6SF2g`Ujc)?pdxK`J)_L zsvLmmo73#8ZZ!lc=*>Nk3!%lUc-&moN?qjmeqorc2mB5d;AZik-BO-FmLheG0g?1B4JSOO`R8W7dmk(d7FryB?^I;D zxqtRO0HT6?gOpRsVThu8UwUhxfx_Cw>o;Eax~mOXBDKu%%a1pgorTq$wWK8~j)eBa z4wk*l7lHvU95P;e50eOwvuy+EMa;Vok}igtit;(uh}ir>ZIyDbkV}L)gE^;FqSA*w zOD#nK7K0Y{@v;B}-|9$QF&}RfJbP?IY=vmPkiGSdOMd)F>bPo22mfBP>RyJi-v}ze z%XeaV$=E3JPJswqAm6{dno@~AW7=p`9FqmL7t=PGz!_q)bCh+`hP%Q~#Js_d*r|5h zh7>P};q#O4#UF}SLi*tOyryeTkKAgc!@pdRjp6KxCu!EHgT=}s6G2^KS>I+eWel?C8n(!fNGjNieQpxeWh+xu8{bv~Zx0N1oN_&#A3`wP@jgu=wEf96^gP2wg7?rpZH&aCLbT3A{Pzb_TtHOG%00!|Rf%cG< zfVeO{+iM;Xc9C6|>YN*`GPyJBk#9>TcB(G)3vMx*j-S+y9(6QA-;Y@p+R_rqpozb_ zj5bzf>P+DOhRQ+^ecc5Sv8v1YtZ&DT_1PA|RJj1TkLyjW2x4?xF)mD|*T$jMLM8wwVU1zHLGtzbh#OCv13W0th+CgeGh5gJ}* z)#|xh8iNlDngA-*wOk;P+03!k+d#*xVCN(cvw+u7Sn%1-eEen5PxK6blt-~=Egd|x zL}IT--L$CO?n%}tZx!8<{kBX`*7b}}0divve z{Vg(zvLYBbSwsB*b?tVC4gt=RHCn#$$1XhJvG$6UnE=zjq1b5E_4;<+&`l5RAeLmi zynb{gG2SvI_7$8DC8c53P_g`NjGjsK$KwQFN3mYipR5wgoQx6UR=kM`Pbm^?8cj^d zSSeZA(2P*sIC!baq%Yj`p%(nLNA-0=ZDN$nE9GW&Hhtq75u>QQ@?3fPNkB(*U9<`G zZG_evKktw3Z&Syeon|ESaP)t4V|myWDgqIfR#&v0OEZ*BlGV6CT9UUs2A@~Q(wn9` zXbvqOyt8B}L0|%6m767KvOoXdsP6miiAmYjNZSDgeq^{Fl4DtWEPb+AIqnL0yu636 zwgM`nl`|pe;1_wCgv`1sTfV72Y9&?mfy|kSc$(1UOFuTA{Y>|NGeSPYKQZ z3E3jwjF_^h&^0FkW_aT%^SL>&p{;F+2TR^pi=k6TkRhtTU5@1ALRbO?*J$s9`dRQQpcF z!_2PZtw(rK%LqI?oSt(4+hDtT<(eBBv7hp)1D(DZB_M=Dm4F3sN5k;rcnw<=Yu1`@ z>-m4j>>1bK<2`{ZxceN@3(B@Oh2!Qc)qHPEM>go7PQl#C@h!VgBlM#TWW|O?VQ70R zffC@hW9_-DTt7|+spSi5We1uK6%AKZ78^#qgaM6y@#Rqpdc-jSm*&FT}pz|6G{X^LJ~s09nYM5&)n}1z}|V@ z{gm~rwcZxh7V=UP8uf+w42`&Hc1C0{%}VYC@e11QFTN@1(yYuV z`us~Zqhva|zvhaLYG5p5#RmD2?xzE;I3_{{DWpXB&o``PzZK4EFv$5DVAerOFY>(FQ4VpN*Z*&3zSq|9?moynf3BlbW6NRPQyF0w0O{Aja?xul zJM}m5*HIC}aW8?x??(R~Xr~C^HLYR~1D8S%bWxM19xlk$OG-e4;U!T`sWroCtN=U7 z@pYn1Qju&(8t?~%y{M^c+Bn~qFxX2j1aJ5zd5ya z7QXjl?o;Kvts5_gOztDh4@3n5E$Uy+jEC;4v);!r-QjvlZc7nLFL$1;=gH7H_`7>} zmuMil66>{=SjjB&o510K`Q3aoNw9=WtDd4At)C6($*2_BxMDFZsh1>oZbOFGU~Q`t z8b!fRYRc_E)qd(L{<{@8%h_5>I&%`vWbbyx{a?|pO!vTx-e zop`d{%&ZTT8DMedcXa=askMP+0-@zd zf8~Kh?5&^p1m{QnTL5v-Ugc3da;(GIa{ts@EVFvThrZK%DgyFJB|9w1tLD6KXerL1 z>rq6EOP_H)W?u1Cjg^#M-{9Uw`hhO2=7KwFf1!LWpE}ULGo5x{_E(#efqi8kXFti& zb80#WeRi*?B@N>$;eeq_q_4ba3b;_2U9lx9G#GK!q{vM8m*@u>?heyp&^m(kk&`T^ zFMRow4wrY@Am;MK&*jh0=>L0le7p-h13ldDTpueoQl;ssjmXi&CYqvy3;DXzYhg!Y zyC`Q_u<=Shg72vG3S9Y3+T@CwQuI-KG8I!`tRsmX2C9qRTSUztRWIIoj-B*(5FbKxQ zw{*Yt^DQYjzr`NZ`im72Z59xQ?NN?M&Kik_}w#+-Ib~B*}7oZ{+WQd16X24o< zJ9asO3wngwTDEV~xuN}74Q~+fA~y3u+HYiX-a9*BmHM zNJ~4v1=(8aM75tOR?|_^{*Q6Q%a>bOe?Qrs&Q#MUSe{p?W8`L%ESy5h0){Re*r3ZT zBE~oCtrGv%74BBWYGcf7h1_E~k6KdGbQWaRHJ#$+VUr%z4TAI$+ZJ)>rRU(!h z5Q?^;!Edxpb-PMi%e*bwTAuBM3~+Z88N!qYZmh3cA`w9y6 z@87Pqc3ny0)#RGe8nrfjR|QNSm4tQqX!rK!^yM0_WW`^4uY1tFcTZAp{XvZWJDk$) zH{l$N<&Rrmb{g;zx9rlfK|nkKHLPQauRy-up{fUFpc-I!VhhySz)Iio{UXKfUq>s5 zzwj(z6CfSo!^eKXU-ymjT^K(!u~##M1lV#Gh5lc;EYtnd&P%5#B~rny^^fTaepxH^c3onmEnw+z zXW8q>vhSt<(joZ4ibaOm)BCVK=F7Mgzf?@ z?3!=0;eaL25GB~yY2Mhb2hlbsvXsTo{0@f=(s*D?{q}~c0pl)3JU!2xceTs~_7oh)C0r9F z-CK<@^`&9xeXuc4gPc!$_$Na|s(UG6y@nw$h53@^{;p!U%?I7F(&$KPx)h4;n3oTY z9Q;FVNcjwp4oOdtFUWB-F&8jZ`QOu%*9ZurKnnKBs+tmo^&3C>?+mr$LhpUfNG&-hXs|};9me^#Vs~lF$fe^bhm4ea#qdut%Jjuv+K5Q ztnKn$a0cavoL`??wC7;D*J0G~QSRu)vnqjQ=kU?QV^0|)q!u9(SZuy&^4y2gsB;m@%=PqOMBiwnbV6y_ zFxklO9(dPoLmSK&Y`#_!;f-n8D%YDH-Dz2N)c4Lc{f?tsv}v8r|6!LT*kt;H>Y4iP zd%wu#B9$D43Fi_@Ses4b2a5i`6XWI7dUK<72`^xy@(tLijq#hEufQ8ssc)UUC+%n- zs1I^M)GR2k=wCZ7GgP`llvE0H^}Yr$Bt+yRvu7rOF5h>` zwjYeb_{>YX9~|X}ePr`|1i0P@tI>cW@9+QlB4EO!hrnmeobj`6nzO0E5VY;(8>w5W zZmaWObdlY1!9Y;d3gC$m>y9H{X@P};zrQ5%i{N!VQiNwX1ja<_ z6M*pvDq}g)(uUe%tN|FubkZ*ULG5w3sRayZZhioG_uAke-P3l0Cahszu7CXSSvQKy z?kOvHyhyNLRAjqk6epu>W@%6t0e@PG619YYczCw-iK67u{7IhOCoLSDVfaaz=S#S<)1Q??V zPd&)i5wipp*ZRL-R*@A_Ogq@00ob_QECCz4as+Y`)v0II6y}QO#&?`( zm7^uzaQJp2-IkoaYIyT;M7PQAiud>eGjK3Pkh}P87*i?Fuw(3de^KV{8uwZ-o}AM- z^-#l6dF%XF??@o!T# zx*YEIojm-k-F(Q0Hm*G4LUqpTaG!H#(5bw`T_%c{CHyGpnqzT~V*f3W&RSpa>2oDR zuz6>lA?9E(Mo~{`9C}*8n-8<{?bU$@5e=DK5p$mzslZ*V#j|T`XtWarL5x~B;Q-c{?%k%w9A_Ko%atwmGW*~pte@q_NQ-sBqb*|9jd0sv1 zecQ%*(%M!uBd<3OPa>077t`ua6#Rc9q4o7;&u-7K#_nF`GeG zmS@zO{Ye+bMx}`EU){ADXRo_67G66Lj$UlS(a^<35ug2s(o?z9jO@>)tQf zx=^CJ5VZ5&D37L>pA3%?a91no-O8zTZ@dA^-pn!pawDno-=AbGM^MiDhg0M!^fQ*fWJ6xn71fdXp4InqnRj$9G1-5K*6RrW4TR8c|4ay|`4Et(p}VARtIrzPAr`W0c#F z9SYYgxO6h>pIOe7md)~w>gjb{4{T{DXp8Sr#d$jtsL&o9QRQ{;Z(L)R9J~E(akq|*svsE)7ibw4ui6$iy!clnkb^OYIJByo z{?ql7L?Laqv`HSmU(idCYf*jTxUsh>NDD3FQT;-yX=5_o*42n`=YVFGl{$bmRnL*m zdm7Pd4|ZG*vspGOggZ!LDoS;}YIvM{xs&LbqvRh~p!QKws}hwpAZ0wWqa3Pld0&^j z8>w%WJ1uVu_K^X+5e3U0!rO~P^B0@fg#R4b^=Oo|`ry6gdh)6k+dJ-XA2w^qGqf&| z$JuQS0ASBnC|%jk@A_F?t6=WI-?&Q~ILwfD(gvIjyM)P>P2O>jCsn)_1rkvmDy}bk4Ad7?zxWZm!R7ex z2O)i%&SFgD6x|3PC2br57SKYpl0})K!wQqkM`0&(>H;>cED~^au*5^O4;TfhQ5Efu z{eaKA(Cfpxtz`XDc42o$ZeYAoANiv%uM87Mg19qY6m}bo`2!WKEb;F+>cwppy1-SG z)$VRW@$IgUwAz|SK|+vM?Q2=T&aKzkH*IVIn^`Yg^R43QQ^(#dRUKFk)baU*o&1?m zuGpffaow>$`;d`^G?TzNJ$!6P2fX*;O0fTzjG6RR^~kronZN-C+C@cA_D6mos#>s; zsB0618GBM<;k*<;IJw|U)kh)UoHDyQGucmetD8Yy&scDCnlU|pL^6}NZt#yqap*kl z27W*K2@9Iei_a+wp7i)NxL$k-O_HlM(-{!2$D8l8)+g?-S*4cOn?|_fC!^;Y3cgKV z$;IG7zi2QFQEI%4&!BG#K!;fQ#svo^8p};{w(by%1u^?;6&d`A$z?>o)((r{CZ-uf z;?X5d#s}%#e3;Mu_Rl?^X3 z)18bxaRR(d)oWQFl%DJ({f3I>q1epzj39;2 zmmNe(QWm|+%rZcao@*7t8M*SWkDa-Cym}{#p-LiXoU6>2j%>%89_>wfz1B?0%KUwe z>&T426Zd(6@YCziFwvlqJI(3qUe7x8QUC#LLd|@) z_U)pPh0k$7N|sLTFj`!>m>3Oxgw&dO6MtWn9E7X((w^ElXDnp7SzlAGl>Wvm@;XyG zNPFA%8G3GfPE{g=1a_l zM00~UMgE+H3Ge$UQ0;28`NOgqkLmS@bgSt_Sx;@lT@RNC+1ejEv6=~IZmm+d7XjCg zKla{6g0ql&TJ?0NmCi?107?i@JzT#Lrq1U7`RCPhfC~stjW&Im8(9jQJV{A6NOe8~ z8n|$gORx}wE=s!oJqN6(IM(u1LQI0T!TI+63 zD@^tZ$D_2l1Bl540-?F?SAF|(|Itxo@hQ{OM!jnM!fF*&OQ3J0C0Vo7yV=nz<$chK zG7VqQ(;42ikh6~Wb(8Lnjb>sBpPn6q>Y#s{;Zsr)8t3z1N}n)>77r4)m4d(2ijmyQ zCIey$>_LX=!-uvq@5r*45rw|b6ffvs@y{RCsYh)s zl3IH^&S-R3BzZ;Z?20;q3w`b?+J^&( zqxT*WuLeT`-WOwGdN=`{=`13e*cZ{XU>-0r`2m) z64s`mUx!59DNdOEe1hc~Yrz>2Y7casV}*BC8f`1{pV699Nt2K#LVgSEN;qLITex;( zVx#}nsUtEJwK~%lSi zfL_6(3!2@E+;5O%eI{-kTm7MtQ9S#UHQ?1JJF5;AwaZwdLB@UyE!FKWUVIUn9l5Ug zT570>G4A^7Z<3QWoOsopd~MG<+pCvzus!+$o7(2XYeaHoDD+FeJ2yUgWrJ(UU3QkQ zPg5M8!E`x!w)ONj^h5Ir{O!O24~kpG;sxVTOo)R|mRAWvB6+CT7&<4$kR}Oe5E`Hv z6dFFGxMB47ZVW>Ao}vDnfo^>ZGWG%_LOWYAa`6(>`$-9Zq6hh=q{e2FtR5KhwI>KR zFvksDmxMQEJQykg1fOF9vkEsaSjO``Y3EznuHjbWirO&(;rfk=*UBcwJ zYt*${;Og+9$0TNW({zi=-`%TGdVc1XbmPDKSP@_3H+hJcB3)oY$Ev-3e#oQYzR`GR z60SE8{Daxb=WL>b$xh6q;;3o3UF4xwHtT<)2&|~e#CBM7ijuD zzu0AA+IWtzC?1N>8@Bd04o35`ny!VvBGWgbAWv>e=fQOc1ig0Mdfd}q7tW4aNjAnO z^Y*VrStwB#D|LSHPUzEr>vil?d9-cc=i&`jSIdBkk56IVR(B<12e+Qme-ScP0}cKb z(u@>^-f|EzN!6%WX<&pc{?;UICi3!}!Zq(#E!)QC2~3Y)UuD7K5!#jH^*-iX<8SMu z_h8Bj66@F@?AQ#-N}ZQtvCunC2r`UzK;b7t4yaqb{(R$n(RE#KlbsPc6t{r3DLUJ0 z^4LfJCl1cE3Wt!=j>ddJi#mjU0a}tdBLjBXjPEn)&%NGY_ZQioCR3NFk76!};QGhR z#*|1|@oh(2V*+U%Aye=Ynl2ulAjlxki|T+D_156L2XIXwajqk z6u3a(tS|V#%HJ)A5`ZL1x-n(Uw#I+k50QwNCqE})VXjkzi+Ei4@FR@H&Hb~0Xl)1nd>muh5LNB1XiAgM&WX1eQlA7ZMZYmYT&%yDn1hL%TTLvUFIzRmIa!7&YovrfJ0s&8 z9i18*&UfOaX?5!4PeescycaNEy2lqz8q|q+Zd%w+I=)8DSW`Cu)PieeQSIe_&LtAQ zL4-uadG3-9=zlJ8u~jE>_VE2}UalfSTBy4~Qg3eHa|{-1w$l;t;ivsP7*e;sdDn z$OHp9#I*MT)n(@N#Jf9$(O+ywtTyq7R2r|76$1eF>jA@?*U!VZ2+$m8jdmG?g0@6$ z5Mz2wOg(28RokN87Nl{@gYr$zubO3tvp%>Z1OG3)NABkjm9ZB#qr{P_B&YNjx@rN} zQ*3pcUY)xt*Xnu`L-21g*ZWbU13$g>jR!%Ww(B-B`qlC4l-EqB0h3jANg;Ek-ge+r z{`C1$_x;^G6oHw(Iy+&K=P_Sw=)=y=~3tUbQBd=+e{r+L07M3Hw}Wg{W_+)yl}A55%P+M3)QX_%@)vm zJ@3Bo?6|`UPTdUig3KYH5`B?p@>%US0Kg8k%1j^R8I+bb#qF(Sh_%t=hdG+!(&!Y^ zG1iKm+*baNf&GtjIa>fj{`!u-^xfsDXdra|gU6lcvD;?v#z!I`wx3KG-Dm-N?w6WPBSv2#Bc@d2(@;$>pawVQR9ctJ`DO zL0eBZaYFckqz2$MD-H7g1n^mT&SPz9IHne@zA6Y78`(O^_8ZtrnQG^P=sb!yXHWKR z5pZY6J6!Vp__efn*j!z|{9jmX?03_}eEnQ)_11ve4>)>?%L#BdQ^)yJ4>MS+V_axVLt7Vmb@e55Z2j*dMFB2Jjdyd>< z>G0K~1?~3`f0Z@lyTppe2fh7-=pS{qkqg`7r&0`Bi2ET}%2(U>tW3RZjt2gpNL{B; z^o6A8tI^LRA4NPRPF4YA=oMc95whz&k<9M~M;+Ld=^IRCqGEIiHkiXH&Xd{xqxbew zez{7voF#iKEXnhFXimLOBZ`03;H27};+J7xSmSsGl2tw@u%cry{E4F9Rlc(?u_O_r zC8(RSrzKBxRXYrZA2sN^u#7{+^tj*n{~jsJw{~+R5Fdixeog1%s9K5=@$eQs;O;>)cd z6ngNQL`jSq3LGCV5F=MOW(3{$yFRpJW~5#LUVzQ{~C!6tp{7X_3v{ED_{Bt$c8sW9#64*dFFz{H>Oo zb5f|l(u&3jkk#%doWF2G_;isPI1~tzwA;^G?C&~l=~rQDfnK^dnEd26VQLM+uSiWp zj_tC&&q>A9uCExh#$2%D8J+|IL;u=_@4AfM^Xt?zR)Z8_Y(U)Aw(zC&4v_4<0Y_E5i@_ISFI44LoB za`-Q)PD9p#aw|Kqt9A?bHm87_y)N0VRHHus1noV|IN0gsgtn%Z`+4KDv5(q(?=ec0 z2jTgXr|lOYLW*vw7lGF^EL#`7^cjuF=G&0TPV23Dpiwq%>Cl70^}=hf@zMdTFU<5g zax;@@4W_D8n>~&wbV{|om<<_ia!ryZ0P&EA@V%?iv@A{#*auV%XPf_umu0mw|xx z!6$2M=OJu%Y#bHkVS+xkdv@WY3|Ml(tVI&xbCS^$=e^K_sv4TSW+-XCQJOdf+gKOF z%rZ+&?-E|W?@ms8os^eRPX;`-b@ypQeNZ(Cf5@O(2t<4><<8EdrekSKIq%%Y`%uv7 z4wFUK?pHdS6qYgNr3Uz1p!ih<-Vq;v?IR%s>edg9R?wh^huxS?Al2d4vxBQJK26^; zoOMV`NPf()Uw4tT#=&jpD^^pMxN=pCg`x3KYVhMe*eYQ+{zC@uCz|AxI$P%>rASx{ zK2z8YJQLo?{N;8NBnNsvtb;ch`bJry`W-Sg4O9nW(N6a%;=@#zTu3HKi|iZoEt{Hs zCSH&gfzadtYWSgX_@FDUjkdN;Po#W){Dj( zyko$oN zneqFn`zeWiqhsGiUbi3Hd8+aFB{n58p2%^Sgw}53HS;qBWnnLq_?{q{a2tFG{T<4MeB@ z#*=uymRwDv62(O|q0$03�$eclZk^LO`(}L$7v9wll2~UX>S| zXjxC6*$pndy|jg|-wpb(zCt6GuCIX4{rn{5_7bKd#YM-)GSJHekY+ljMdK z7gk<9UgPB3u{L5$hjNUh_G4t>50{4BhoGx=!|I}09~z6I^|MU>r7|q92cbzV#D9OX z;tXzl%n7vwDd&}WnasBj4_;=Wx{f~XP)1)O-1@gQAW+? zqRjSB(pEVsv{AK$`io#gl;-aY>D2tK{N}AIH9i{@lA_T-pQ4%G&QM2m&U!!2Ifv<%< ziILoLr^lL!9-v6~+>@t4Hd>OkgD>h$4a+ibX9X3HNGC;Vwrz!sP)wD6lWUR04DNC; zh0>s$a)L47p8x%QvN)6^qRaL z+Ay4X^%*4^Eg&|mE_cYMVfw;U=z*89?81OYrHv81qm;ZJ@f%}|%-k)|?JE_w@DS~B z0ETg623}p_^W=rws^MnYTdM*_DE~JWrEzas%9bw7d}sP$t;@>&#e4D=hQa6nZ)4qL z^X)h8rUdt;;AtkX3{Pq~z+Z9HZ*B_(_fS$LLPeO*n2xKBQkw|%joZK%IIqBI?a%N5 zH&EqDwJj-CIVI#x0sB1ac(4)cVr)KOBDoo(I&;44QTy#aW{Ofy3;S?$xcsOH^uHMnu6}fq1`K+ z+$pXwmD)>B*+GgMibmCeoNhoZbFJp6KOp2s=%2f0aE@3Zm0RPg?HVwp_AW2?Di^;5 zf7%^CQ_z(vW)zpC6w39vmS^&`+D%2?8RadVD;Csc5B&J;=(b`)NZz3hf78w!Ri~pa zt!*_9sC@-yN_NK`feUcV*WeJdZ(7XBA*rotb-qGI@3Ly<-|MvxbCYb7l|2O(|oH|Y~j1bWfeJ;jLdix)Lr(An~BAOLM6FSoIXSA z>@W&Y$jyM|2V?A}{t)}hB5I9pt5?ls!Bs;@pNl1P0b1{~hGY6%6~p zq-UT?I`FrZ& z{fiA(K3|ZM%>VGB!Qs^vE&ugl6IrRfB2sp)YSX|omyTmoyp+<@#OX_}{LUYXuesiV z7Mp75`Fl3q&<(*z&MfChKSRHYI|JR;txSwN_SepUjm=c!mF4x;qb;VOnLm{1;%n#8 zN4m$3Hp$vI)|2g>KlP8=d&%Z7Wn)P0@~yKkJ~`h^U;$`L+Jd%dI}GxfHai~rU31Fk z?dS~6604{;+J4p`e(py8H0=w{E`vUC*2igz{?c{MsOAeyrDvng9_GH{0pQ6oedpCW zl9wb$%t+xr-a?+m6M{ zhd8zppOuLR9*(Jfz~pKHkf-PxeAmD<+R1)9DYR5{el`^;ptdQo(jwgu8Pb}N`X*9h zd+YwQ)=%%Z0Ke<&YdP^9U%O-f1&6_|#)M9f93puMr4s{1voaAb6X%8Uf@}i)D&_zr z!Umdvq|^fUUVXI3g&hz_<$P@aF1l$7oT59_d9F`U*xC=_8N?t3MziN!PHxD{A7G{o z+#^KqyD#O)o2yj4I;-w0I{027`GR$pXh^K}%S|oLlvv=z_p^;V)C8I?mIBCA^`66j z7}oKXFRD;Kvw#jD_CkHWN8N+Gq;kJ8ICAH3ytPOWaaB9R9B?~Go}H`5pU`6Qc!?+p za_E`ChPQaeNtIse%EMJW!&f+(WZxed?dM<}OFX-;hi_W#Cb>732iig1D&$1uuyeNt zx60lT2nY-p{zz&bFuS}X#dXeI32$`eA_etkn2YDN(a_sBrBgb_CYT}$rxCSEI^31N zXGwqVl|~C#qF1}K)1xC}t1KS$c5ssGnV6_cdM;iO3Uk(_3GYr8Pb1cgkxw}j1;-_9 zjKgPv+OmRvJlw6~UfZqnsf(NTg<%3-}c$3VZ@TOY+6{ZQ4!Hzc{pQ)#y z`jA%+YEW2ffKnnkBZ01*^Bni?n7QYpjL1>28_B~5L`V3W`L72)2hj;R6UI&p~3E>yY#ODgw-3!U=#F%sRdkj9wt)$BDV}v!k7A$I@d39zwPHlUust z#=xZT-9J`Y+FaW3D$R#voM-o2{-K>L7g6!94}7;V>TeW5y-;HsIJC+HT064Dj(o72 zp{-Nj!sp{6o|3>d(5q0`J9b;#P;N1QXP@@2$BlQ%`seW+2Wy7ms53ctS!FtD0GzO@ z$}!d)I8@**UIpvDp8dW&47_$>w}a-Y@DF(4wtDFbNoR?1C=#$Mq8ph*UbWSOX&?}=0;O#Yq&;9|e^>$Ov@`7|fupbW` z1`eJHtHmxDV$Tj*?p3w@G#DxC05Hqei&P~Ff%XvVrw+_k86FA7l!foxVRF~Bs}}!4 z?I^ykwJOn2Nb(l_;X;1|76BW$`F-S=^8s#k1D1bSKpk}F5D!KuXLqx$8~PS|0Dh8T zL24TI!l`;UP|HKWYEL~yVva4;;J89e)_;7^%of;P>1=H$m7?x`z7N|Q0zuHGYd?K-Ox zh5Y{@R=ojkZ~A;&_k&>GW)f&_bx}T^@nv8(eWA?*@bciFt3IpJ=elpaSUQEV6hB-g zTMKXn3**I&cS;&1NG$m-kJYtkRS(D2r&~hMwc&CZY>ye*8=i)DjCm(>hS@(pZ zv*g0{GMf{-Ug?{{n{t}$AC2jjZt!`VX6Kz-II@~Qldb*DG^Yk7v}$G#wstZ{0EQ7l zc}&Rd2@>oNS1xO?ZI?py>VYGzU)m>0Ul1p)u{tNw`+L1yv)s*fl3%KACbIm&ZhZlP zuXPco5(D>JAND}?ekRPWQquMzmlsx>#Jt=z4oITi7~z#@wi1xV|K@fr0Z2E|6t~Ni zp}Yf_d&ZpF<9?kjDlQ6-W}zh^2bJ}KIHu=aXvi=JZbk%A#j-j;0tZkk`i zvAiJ-5-P=#{c@U(S&xDH2RdTE(~96;lz>6y5X@+Bi@LD{X&&hDD8iYj{dtrTFYGe( zPuRpY^5ECBE&hz9lGtB}CdAgY!!^c4=YLnbe*L+=xj1PT4NGG&SxEEt4QWAq{@$E^ zcT(i#>I+Hiv|{+Sfzdy+qvohpdSWscnPUS8vcZy1E&J{OKUd_cqFu0WPNkr~lMNCO zPm@;wczaBCEn)SJnQiy|1dgF)191_pUY(Bf1#On>g5vpz?Pp_u@kq24zJF4=qO79+ z{a}J6hog_MmU!K-H*6AREMTiU?i;8OQ9(W<#7)$cV$7#F=JUlSDKZQ4hC5XzI;DNL zs#^(#lM&QONq1X}`ZPsuZSo-oUIhiYN8H!pxCpSE_Rx#XXZtQ>-1*)BEgFRWIHRJ^ zFf9zUXT>U?809@zgGpcM?AX!*N-WG?fwIR*=n9h33$e)<04Yzr!p<4 z?i7lO>kV6v&#v4Z_^sZ(w0r|-%^pq)*V&T+*0bAk6T0~nNQ@uE#yv!WC1YQ3Zt#?N%hb+LY^T-dfgS1KiA!?|Px z-hr9EtjX9^Mu_;>J|v_axiv)s^hE(XMlvy8(R3r^7V=R23zdJcK0mrf+%5hq@+n`R zZmL`1&Gg_jXAvJ0hh$37jY8=X7NWd6x#}?Cj zjnJ4Ep;9HC3|IHlHwK_hGni1?Aze>LUCw!HX1PZtnq}kHN$fL_K_ie`I03(dTp)E2e_f{IYx$1H6hcpSJ9b6A-9X7=+)b~^rCF08yv?Edy z4hK8LZY%NwUkEuK!EbU#pCD4~r#lxAUH|uMR^!xn3&}1ZU%mkIMfCXsdvVBW%Db}! zfr2-gn83REmT#iFM}lfNOx{`9+A}BCB7tP*qgQAx+AKHsvpoE zUI=V7G{0k$CiEIq?#CF;2IM>TMt*2giZOW4WG=Tlq@6&bzX;-JRJn7;`F)lcl%|0PxTrO_Ri^ahv25fq zp|!nCT`Aai^!f2PfuWgFVAm$ED9_z`uWxNFkp!m$_v^UN6|8d_b=wtfZXuWyg0`6J zbM*3k>nz1f=8%XFB9C9X_i90d^9Ir{iT*Qff2E}AOfE(-L(!!Qik?*ZzIoF*IBE2C zS}QhqMnY3@RRWyf5?hV;8lKEF|#a*-~7^Jn1GlH&#P&b^t-!xP9o{IIwOycH__jYxOrQ+ ztM6>{IRL_hdST+2d$$uFSrqRJQqne9DvDU!vCGz5ZxbHRbxFhlzGRzzoX$H`xI3~L zM2ptpj|<=fzG636NqbXUyDS3*NZWL!?8KW<2GV@2@_ZV`NvTFttm?&`Jh)bXLml#; z3)>kAM+18BMFH)X4Mp5kslc!we5awb9xNMh{plhylI>yx_$~}JRW?t$6i7f{XWuzF z4D_@+b~eEr1I-=AiaxM71*}W*vhf}1jp#wgv^cmNnV|aU*YsVOr3m{k6Qh-e$KyHe zYAuk|3$wMTD#EshVzovgT%}Gq=Ds*K@<4Q$joMc6n0Rvqt>c;}_}g^W*sO8o`-2+I zL90eTb z)1RlC0xT{_TjChL6K<`)+FEpt@&2Q&dju#-_j+Gb{en+zE_s-wFQlsCP%`^EXRL0L zM0u?0e%eSo3|X_lT1*KAH+0%9LH~tlZ6O(nWEdve-Zh>h`*0_28DV+ z=u^&rEE(Ab$xmUmI!ubD#=_SSN$X^l#yzp>w{7(m_a}`yuDVbDpSL!}IT* zj`W*X);2;)YcnJ~99+lJ9m(Sm!AK)PLS+K(;*#nwi46y><|~d_+k1Fl}Y3KD-F@Q5s~JbCe&9F z%;ZgsvPXVz!H_7~#%F=`fB>F?%r=IeT?X2 zUj8O0pUdrF3iLx>6Y0~wu+9EXX5rey7XeB8@=041=CI&Cx6Om;j&C(?KZ?F&i2k$J z?WU-jq&a3jrcVg=gr}UU({?XtsRor?0jv|VYjEc}qAhyMyCd&Xg_5bcqY)lMCWmsA zEtMr6Xe%x=f!w!1EoQq_6=nzI~VUm#`0Uobb^ z#yYCBqiDurdR@U?%O_2pUS+Q3wtix$?cN|(jwVeO;-FO^9P#z~FY>HQ&}lT|n5z^p z$PF-B*h`0PmBdXKfMrk1PqhY+$AifC{dWHV)M8sk4<08)+=00W9&1HWR>3q&V1R1nr!p_ z19dbY+6s27mmsMCd;wh3gTkI^`o>+#flJ+43WjQ5p|H_@7lDOH2D^?-rh$SR9(}t| z+g<=OagbS?G%RENWp%{ev3yyAISU68E!)kAnEpE(%OOMJo?k^0za{eyQO+RE-g5t(@e(~rL`mOl)tbyg&JXTcQ&qQvV znxnn8-Iaf}j^}l5>q`lgh45J9_tQGa#riu1Sr!5JCYPQMRpjRb+|-{sYC!X?@+Xn5 zp~tf_)HfxMkFcPnX|gi8X!MpbT{jJa*AbM(9BE!&Oat)WV0*)pV2Tom=ykvhFn1S_ zWNLa^O-rR*Bfe?BB7tvet$Dg^ZTE2OU7mZGI>yd=fS;_+x>cF^Z6mOyehW6Fy>O`l zv)ZZRoab|L?Q05BNjvaskUP9QB#0g4cSSckO#4B|2m+AQ13dc58Mx!jCxw>|d_Rlw zGHmlmyA2(LkO1MYN?TyL4u8K>Y`u5$mxxxgH(55OA=)NBJHxzZZFAlV3szrYCa%{E3lf83H zmO!DylhvO1uUS%+I$4S_6gaGjt)C~{%V$xHpCe|&YoGj_s52$140`L~j=aGEOSWoYJjb$Ai;tL&F$*B!~P`dVAnew;QB%q;vk%@E%05F>Uam1s<5r>p^ zR#s=2+;2uQ&!MZm!0l#CkPxCg_~H*>PK75l<*dNQ{24NUj*TrN9o=A8>-PV?PU z?C5UJL4hXaD`afg$j`Dz>U4+zjCg+nQ=|UN9C>y)3!$`D(s4TokBw*wXdIM?ey+p# z8qYviuDix;OVyX*L(w%q@+(K9Hftjw7h38d`2A0Jd;me&xz+*pvBv{I*L~F5pswL% zTt(=$3`S8km2>ybe-0W5o2>9Rh5z?)`{!}eo-72xyX^R}?d z)>-67ux75Cb;M;bNLXC{2E4h~~k0B>|V{aspJEq}A5Z9ZVEW#Ult z)q1(CUj%Yoeo))t>QN_vOdZ9Vyf70eNs@#&|z}?6=9uV zl@nSAD#6ZTZCp2mhv@?sHOFnul`22Cok97r=4h+9`qNbhwIo*!^Ix9_d$Or3rNE(5j1?)|L?v|Bg z!`z=>GpT?OFE98%7dih+`i!-jjsyv$yG{$Mq0-7zN_a}VwYEp}#S)lLF!?fi7p1i- zc690i$D=R6xaA`neQc7^veCEgW$E1A_Sb0uevT+|7a0%vZsVRENd(MqR;kGG$Y|0o zx=FQU)h~e+<7vWcDF4G$Z>lG-`%YO)MvaVN#4?d2C7_9wF^m^vRik#^O>k+C(pliovW6j3_YUQ z$4vn_ER{#3x;c9EnQ`W;v0ML9^D`XVOY#!$kAO!0F4f*Rk+t9}5oN4|O=bQC__7!) zIEDtDsxRVArczgZE@*?NMSkBlpK7mjMddn?8bjLWzBqtcg>XP#JFk@~$Y21d42GBa z7a^|`)9SP~y}VmIAzdHfp7w&Oj2_;ZLzU?0xNJwdOl$n4&4kH5yMG;5Vjo0wVgfZ? zhZKPsLYhA}fX>!y9EVDK>+lNhYUUHHPTu@;@drSssk?x;)5YV!zY0}gUv!ztq3GnH z)1VEN`fefhEJY7}u_l#q^blItQT_C@&mFrB&EQG8??wu@{^R6Qf>=A;7Qq4&zPQE# zbZLO;myxLZPdGmhd(eunFPxIQiU(*qu(L=)+vn5<5ISid?R>7+8QR}%I5D|(5`the z8}S2b=ES8W8fRpz7)q7eUOa3w_ETN#K^-ai1~#GH25)+@8eQRQ>{e6H(|@+ob=I_@ zsZ5itIM3v6GReJ&5K@Z93<*bRXJ#mr;UFP@9)Tdju76%a+noQD91aQVZLYSvWbXO; zpWdB}MO$|5xvazG741)(E}z~&0-FoaQv074$(peN5dT#903+)6&C9XtaL3+o1qM0gdu ziyxy$P$nX6J4w8fXF1xWTY6mgzUkEqv9GLiXaEQB!Ux6@(wI$$zGyM1j1>J_=ay2=c<{)gTpbb0!4!|F`E)! z!)GWXOlHxwwq&?&L=PCIXf+U`bX8Qp=Wd)LQ&zi$BH-oe_AeM1eaSI1;HPl4!R~KB zLcy(?bUq*OXTinQB7DM6DJ`~}r~zaxc0kj>v0pF(qUn6%*lL3PbHk$!Y$%Ut5KoNt54J>M zZKwgKZzi{YpAqncCRq;E0Ts}Y9AEzh|Irm?=0JB7d(92;x)hpBEqlX3a$+wzgtdZx9Dl z0c(cY$UH{ruXX*%T8i+K5p)nlwO%?6lu)4oGHea-S2+$mQ%E&Qw6ErPi@X00k+13m zMh;qzLJJi}5I^QXL5DrsUOz~L>+6x@s67MRpEMZ=ueS9MK_S5iNSTF z-AV?k16rjf^%>OBRR{UgO7Ndz9}2n9oR2 z;My@=gVzEd-tXt)yzgkVZIfVKmSCM_!|?RSm=qv8&c+{jI-gBADE?8pKnP}Nh+Ob# z|2Fd*^w4)!LL?;b;(uMN0E0&T?BQ=4i(8uLie13=N1-;SIG!(ub7d)W`Y;#p*U6qM zejxZlR~DCEW_K_0dw2pP^iXk*h1*}VIN+){l19c~&03Hg7)}UW>nsymH^rfFZtTH6 z$E)v$j@>Nk=gp>et^NO`SG@@~iN;lGJeZ4j$G1LPI6EP@_S2j>bt!BUx63VLt9{70 zQhqhbMr&%UXS%!2u1^mn12D!6jt&N;b%iFa9LF8`A3os$&nc+M`Z6xla~`eoz+74{ z?(SI|MfWIG)#_`}m@wzg{PWs4dHEkIW_=4`*aZ4XGL_Ft5Yh#aq@_HA;^S{A=Kw8q z+~$+TBi!vATgyYL%f=h6bcMz3j8ZIe|;7>XP6Mo5m0cA zav7!h_1ulzO4<#bnUj0=YQ@3pyY~K6??q-0nIZ!Dg$3Gy@yW?KkCcaQui~cl?oaZ% zl(bG1YHFNVu1g`6%DoOt0U{uPi}T^?{9TZFGbxq;KR zF>E$ou3n8r<~WxW7=dnNuUqj#Or=xy2a99yai z!(^Jy{x!-2iH)&$^Osny&(d8b%$aMj~jKkPHh611RvgO^ynyq8y-KIY^ zgR%<*KnY-Meph!7bQXL9sJNX^du$tg>M;%c-1)Gc2G19)-{Gv4#|8|btCky`zTUSQ zAB;T#q@qI%_6D4yPIwXB2XSp2W$Z7W?dC|@!NoNkm~~Ur*+=?^#9M)~d$u_~xJK2B zv8yRxTcob4i_I0dch40?#f!fvz7e>b9#cDSPNmD9cyrW%a5-<oV;*OI2Jr~Ph{)Xcu^=uOMLLh<( zJ-R7JFEeOWY+Sd0EkFpvG16%F-2hRmzSIce?p}3|PaCNutykvY5K32J9X8VBQV9dn zHRM&xHPsr5|1KwptnYb>TvPx`>+2wEEtarWx~35}Lq-791IhQ%-|_vnAp!|N79!?n zJce35PM}A0{sEf!nxXUAsgMay>z0wJ@BfnJ2Apkfj)}<$uGMMi{&g+btun`c@X@f| zi&!;QEi3<947B1C>Nn}jZy%~#JFOvCj%X$>sDtOmb=bH|OFIl*FeuLJcZ-=&>Z;q3 zliWqd;umaHv>z0uz7uog^PoDED?=|_LvwAJ+(kRgF}Xm@CRBQZQ~i5Uz4V1IU^a%4 zpZx2PpN<;sWvm)@^JcUBD=Ye@5jte~U@J#%mt|#|Ec;}r+}3S- z?V-r=x?ovk+bb@hqm$B5I+JP4t|{CyQiRDlQB#xQK?v+PD%@YLl2QssP4I__1c6|8Hk=vWpi39pj;?6^1auHjcae zSLAZ3IzahTO7#tGaU2T1ck)%jHlo!4N;}SnJ^)J3-RSCzx%VDUDzU)Rq*RixJ0trp z1{&XGg9HydCc=%oLD3_cEzK3ZseKm$HGmmtH*ZLcDs(D*rHYGc?0C+ERj{kJe2r3N zBoz8udL94jP^ZCjX#cK;5B{??@W%n;ZOymsn`_ssnxiEkdp_fNMPr`dILAOLgGy(v zr|*SNO@E!1F^&!bb6TC`rjm&THOe*NS~|T*vPl0J;Ut2CWIE>R*TRDvV`V69efc{r z2`8*R@E17lRHue&RlN0R^LEoz%qgP$F>J_nxvh8;Pz8s68JlMPEenhK>)mdtCImvo z#{mLPR1+?_s0L;X@3$T?YPPL{PAbrbgE-=9dOUjDaQYPId!Ro8g|FT%j7 zLJ}K2G+(DwZvE7)J)u)bNSSL!*pk|A=Vy^^JOoHO`R_JA0YaF%jGy0Y1H`;t+kZwq zYDB>H8j#AUd+j>KEdUFF+J_*VFk#^eH0)E4!TrK1!tu7MQFqIoqF*?A$g#aJG|>JIX7+x;+Uogl+`VWK0*7ngW#7k)!3b5~UTD8zZoY(^(xD;H~+?qG<`3vNOVn zS~x5|cZ0jb%Jy29V|Xp^!fle2z)S}L^k|Kd1ee37+DM>XLj|0`#_92PTzIA*A*V=w@oI zTj>;kPbjJwQG%KA4_>ovVqV7H>#eSFY%@nJU{s}X8D7aGuwrUUTkpw~XlJ3*VMEN4D){&2BlXEsQ+wZ%#NQcBt;-vYH@)Fu{%LF!y;&TK-b>jO zyOjc9C?!BDiQ7QB6RjtPdUrRR2eL#x(yVVxEV7XYjkS6o&O*z=NatTC>x%o1^J|>8 zPf-)KP}^ea7A?#H{K|#aNtFWRLVt4chj>sTJ+mI8%~T-_<@CBiP+AcX=&U&;*t(5% z0b;F!hvdVSJur;n5G`(2b~-CAQW>J&{?&;R_@8yXEhKi145oXt297~>8n)cesD-(d zPohQqZAw;-;(q>!hHkVfNvl(bie4y0%%shr5}B9T_6TDA@b=kROErOO_?pQpl)$u7JAC;?=)iM5L0h1&m_~r#apC zuya$X2YC6N;-wmFs;y(3wBLiT}|5(PDCK)^p|7rT`k2oNgQ`%uYofohK1OT&E!L-uR!td%ZZ~GSwR> zUK=~UJ=sHo7uoL6$%>h$vZ=)OZ-0p5fit8=m-UOW4ys)%VvNCKz)3{th?!2An13UW zM@X^fTn5*J_5J1}7K`if-Pqtf{LQ-dr2=VPi*ERFCJ=)P*qTTS{ z6l_pSzO`VZUrF4k43OA8noQZaZYEx0-~%>UEVVl}=#@_pWN17RD?5Wx0Q3gsQ-q)) zKOTdyb)~y`R{qda&~9C<--1ad(evK=rgp#y#_c39H^@FZZkp56ryh_xJzcaD(i42! z#v2BU1Zqof>LW`apK?oBqAcN2Az;2A|KoW#b~n|gh$%hYQuHyNkI_3@VBup#5fTAY zz5B1U{ZTToR{1p+V90XWY^JNj7LYc~iaFNEd*Qwd^p64V%b`3H`=RidWsj>#O^wf| zKdbMCrVjNkkaS6Xx5MfXmXls}Lkn=FHV$2(_Rm=hi5H||Vt=_zJ@K!l@HcCpR@VDg zoZ9!LCUAsquW_&>p@KIJwo#A%Y-d8x+nQTI591mC63+LIkW(b911FhizNDM7&sA9IIj%D?uSLq?Es4EnW0P z@n{F-Z^C@&a^?G06M}Nr+Dc%}$XBel@6@ldxM@9t2Dv6Pqe(YLSJYml`?0ImKepf( zLvOMQB#!39%L}mX27U~~Lek;Yuvjh6m=kYQPE7=#5F{4mSD=;xFPDG-O4;Jr_Do=4 zTH1P_L^$@D9zBsIiEZx}-|=wSfBAc+I5TJ|nW=ILR1Da2Y0UsOoVeo~@>>k={CjH? z3bnMUll|vZOS^%5kaA?5lS;GpXP{=tWqH-X&|M&5=@oE74DQ;Kn+VGBJh)9|jfWbt zzCgEf;bByw%7FTQ-MzkwkSnDhrD(^hQb_AZk+-&7pPMSIE-8PrnSvxs8+Vb)?Ve4s z_|(xFX`iO*!bk_Tq~b{fq2u>r@7D9-8T;)ds!dJH9`%e7plJSHOg`%INR6qME{Z9@ z>Z(UD`~?Ssnw$#pzr-6*1agF2@jUuxS)OJ;vME|YpDZyjXEb&72jYa}z`$G`+RG#% zI^#~{4%pZiZQ2URdO~Bas`I*3T-scb0umDJqT<5z*l@Sk2r4k6K^zQN=*bxniA2?t ztZGny-olZ&*;|ucpuFznMfTbl48$}d-Cxu5w*ZhQ5&NNtYH2>)oUX$QdE2~;KuYfn zn6^a}TBp=Q<=QG8&5Dl@Wtz`VyM7IGj%Ye8HZ_tWEC1??2y;?f-_#i4hhv9K-K1w+ z2RQ7Ri=EW)U4^InMaBJUnk5ygtzF%FeyS{VQ+qQC z4S6P^CDv22(Rpj!Y2srJ?}Yvdsm5E0UnUBpJw| zc-nTJ$eiDO$vGs|WGcvUe@(_{1(w?db;WGU`|DgZm&=`QK&*AFf78cvkbjOZR$xP; zB7pu|z3l94I*sDt$a0?Cm~Bn5>%zs+4z@Xc*n^Y2;C3h%bYrzZ0x_F?U#gOyb943N za|QmJs+V#31qFOaz5B`hTHGk;J_K*IJ4K`?s+82VIfx-ezGJZc->65 z!uQhMNY4k>hp_C`4JRywLDAoe>U{E!0zn}yL{3O3jUte6{u2j>NzI{;mc!olwme{g zo$Kt0WpZ@xZp@nKUKzP!y4g9Px4egiI zVLiJ4&%Qh|aY&dV#w;Ov;H$TLU(~0kh>_u8@9YR!uUEg7`g{+nnN` zj8Hi#f|a1xC`_~6=@%8j6VdwX&d?R zDVo5bqR=5+@|C`K)3!SUVO}13a+*$`b6g{74@nfco9)hw$s3B@0F_>C8_n(fUa%@|fDNyZZzst(^GxEfhiTce|^THxEVsbHBO%+0R z6Wj#JTRhzwDs1%sTE**!qH==?)qqTdK1r+GvQIn_@SQTZ;kr=F7v=V;&}HeM$s@JM zvIg}A6y5`mvJ2_MYf9JZz+v9wPS8zY?qu7yAAS)O++TCz(&5C=1<(n9fyDRUdq@4*Lrf1`22rA% z4hOAP)Fg`cOm}oq@vHzY=xe8?=rl5l4d%<|jlZo#l=x>|p9(Bu_F4h|T_SQGuAhb! z*jV4BveWLJYTY;2LB3_mqVm1G70}-dushd2EeAppuNp+)CaS49*;_T*ZIKPnmt5op zr4QC#qP-gd`d~KtG>1Iq<&;g%8YqcE+?z&c)~Y)nyqoZww!ux#;c!lYr5~GUvnE&! z6NPPDeI_Hx!?m*-UmW`dIP3{5z0AMD&$Y)2BV6 zV7c6%263Q8H6CSJt^h&~fo#I2{jpq5G1@66CPoxPnb~pZb-W%XeDEhKDpvRYhE|-O zM~S;pfP&N9bHfLodKzFtGJy3ciBwls&U>@)0jLAyX zA}vtd_K36AgB0IHCBXvCWq5@}1R&5g}^Wf%wq~BmUeYC;-O1jMAa)(UG z>eZ<`^v8l>$EUMDRy;jrju*#PEP^4-{Ud+kIIyZ6hckelvGl~p_GaFlqnFo}p`pdV zNW+hFA}?_Im+C@2Td=ys%`LgCl?8xodWYU>6zaI!rb0>eEqqoY;PN~w_z2(9#;Rq# zzZWgO&sX+X+WyYuMB!k+aMgfN>f~L=;3-Gdbl>{S*ZQ zjo?C&UqBp=l0gP$PQOD+P#f*_7!JZdrs>m>>R7L%)0B(B(O~kBP{oGdn_#o@P$uu)lt9vhmz9PU!w{xpF-ONTZ*a8C#ijW$mm3Z_Y^obvFG1OHyW^Dsdd0 z#Fy%UEvOy_dSxXdCxy)xvMn93;$3ILu?{fc&_?R>3be?};GfwVc+MVQQ2qBI1BHwO zZ@O`=6GTEOw;k6Jsvfu|3U+rT|CK%5w(MKle@;b z6)wBCfMwL0KIde8b~>##nNPwh-8hpCUs>r_RLt9E{O-+t<9gELNd^5P&{-3yWGDaS zSAX==1rnvM{Bx{7#ky;uu_7s}G(?w0nsr7^JfgFKDQ83sIu@+}@= zMvq1QLJ_K6DI3 z8m5)jrRBC^B&JvOfMx0B@^u0~?k6*U9cl0TxuEg*3{%I?)g^3U23QC;#mIXFYXe z#{IeRw?tWVWfwLH;O!lYvulGsO=OK4i$497k>ovzYs3@>NI@~EXkG4n`L51I_0D3P zq+*FH4}O7v@FW;bc>}ED9_|*r7wlBi)w{%Y>UP%bVmY=ybX>`Th4<#a@lqa=T<(Nq zYWjy(2bLfQ+{eIM=5?rV9DEqfe-IZ3s9VgVb3AwRJ^FMqR&b@b$YNn-%?t55}4CU1Jr>$?D@Q&VwK zTaFgYmX#(w2;wztPL`;EX@CJ$^>h+j?U&1+Q1vA$PBkTHvw)DcBeep&EV)jmzh&E>% zfXECL>_w9O=S&8eih&kvUfdv~EEcRS1PljtDepRp5#+}{tNruIwfQk5sb|JnRaC5f zFdc2n3Ic1al*h=JVMM(bCTeBqYNWo%_{3oI(on|ZN;M(UqMu0cnbVKYbppO!Ln$F7 zO~M@L6p2`AmmGc{weLNV&0%B$C4o?= z8Q&bUk`@#KSvdm6WzDahO$s1}XtO5eSe<)f3gD9+myQIejZo;*-5`JnB3;RE3{X!S zR{?KzO60&^|$>R8+%_YTY5OT+^^LBf2>S4F_ zzgU`|Y(~=IR?B6jS(0!`(^EPL1-jRmnziO;4h*s7_0s?%ZH55)El&*~G4;ARtf{7l zkO2l*XjB0(`Oou2A2ekH^s|R{0aYrKWEytM18t6rc1WM9@STvvgafT&4MrB8iDZRYsX}UhFa&wt-IemiwdF}; z!qb0kXLZhzgf#y|zjw_0p9m+M=J!ZNy$4eOiP{<&{MLM= z70XL%Gr9^i4c^`45g2?Rszc@H#*ecvd1-(9UuWRgnB>Qp8UUVOe+u>Do?M{4xK6Wu z*Y^ikfn0=k&@9+W+ZCL-+`REozs-P?zV%2OAi8YQ2SI#3%1?wu!avLbT=Y3t30iq< zB?gL$pwE5+(BQL8fDY;Do|W+M;3gGO4L$Ul17t%MfAr|!Q5zoUMfi6@jG6%Vp=`9A zfw)Y6uL{tw+rb9PjFFDqj?|2%4g#R=o3z&r$%o1KP22R#&WAGocH?PDp}MZ?-hx(& zKm+Q}0P+`rPFW`0ePY>tOHr&cPNp6MQ|*iJ*FBU8`(FTA?-4MewnDy+VP1@@13%ej zX%Bg70S!^kbQ;3BYIwkB5jW%mYNU@=V}<~uQwA`!w8yJ1(>Ss= zVXHW7VjahRMNQY~n)3?ZRhD;%&!t#04z2>@&)_iDt_8(SAec76Db(|c7krV}B4wxB zV71hjurX4;JwWButF!vTvDADDSVl0BqjU^}>TSND7 zwxe$sAx11lv(D%+M=l~U$8%#d($WY(6w5iiLsXn^ga15gLse&4jI{gzzAyC5@z6rb zWL(Za{oCW@I+&qN4FGFC4efdiyszWFCv6{=N;{mS&}_hezgo6U7FHO8_oG1n%P&s= zJh1FQkjv$u}bB^dQu(ovX zi$BBxKj2|cHEmeNJf6AMiiet%UvE=vd&$IB)-~W7{-6r>`r9Hu-7KD=6U&RS**7T)&iJMPO z;o?4i5S+OOY$pOU35+^SrHemECc0M;OefY~wZUqUp6}_3xP%jgnvuh8Z+1}IrNcwD zm+}UH4M;r7^;H!M-BVlvr`C%?)D$3hfx?(#^9zGwCwvEl^dC8}BL2%GQi0wX5I2OPn94W(tFceQWJ zMP@+=QDd)APE0d1>0K1nGb#ZB@oIhp@18Svq<-VABeHvu`bP*#KOP=tWk;dH9B`Kt zlyuL&dHU$)rN96A#d9ft73_^ULsV_eJ{gT}h2QTRq9>vGXy7{2oqbL4JACC4@e(f- ze;qpRz@>8%3R2SPJo~8Les9)fSmV|BuJ1VB$a1Uqkm1jc;(0qWEwY~F>xC}JIljtt z<>*tkjl#OUssF|U7x<8AB>Z2W^RKTmys0!yU_NtoGA`&E<74s}uSHl?!#8{*S9SvD=2sc%u-9^b;4aKc z;T=K}idE42bh+dGy`k_di3av6g2Km3Da$KY6rv3~NOsnCSc%xJH_dTe-&4exo>bFD zb}GnvEh^PCU06|`v^2c62!Y7o|MP2_R(ZI^qzygfk+aAB4t^XVs$dc%B$Q3;Adc3J zgjV-kneE~=zu~Hori@q{W|s1Wawnf*vNt=3zBMcDTEuww(`Op;os1NvV1b>uXVEX; z*zdW1)$*9x-MnC}qZMDoayt^(pw&OV1bHyOakyn||A zn_vdEY#LCoFIn&5czWo%4y>)ZhLg6?ecUt-K!uT4bi z*JE!*D&@Cy>Q#iqM#&s=t%Vrga(BOO(y}$6P>y_mU4n{-J@K5j`LzQvf&TTJK;;|k zVD!P)Wy%PDKJnu{nEO*c;ClyG1ztJtBIkA2CPw$2O-Rug9JPXWQm& zcsajEl}?U`c24KyR1)n07Us}}>0ff6(CyD@#LVuqRv~tN|A2nNDW*-1+_t&-6%szH zS%vh&eXV;!Jfsrzn3p7aYzo&7p^q&pDb2oI*H)8t^11%&2wb{*9&n#zTr8v<&|h~E zxEa$qGmWv9EP-ZzoQF`QHXbh4J@UtkF2;VR9TCmS3~cQgYPr9Tg?pHsfWG*ZD&y4& z{+%BdV3>8#fW#z(jaDxHI*$EYs*L3wyU0$Tm-~p2G#SnZFQDSzqPX908w?Aqfjj#K zajy^&^Oq%LfA?ozz0uPqha!_;d7A5>jbCAJn7s1vV4fo^Kj3kk)?!=N*gf! z@p_l3I)JvkcliR0?bE9Izi*36e=D9pqm0fz-~B6&grs1!6|h$G#Lr@UC%9Lyq&uGO zw@=L1=n*}fQ((UzHdcux7dF`vZz?b2TT3*#b}e0*WG<3CMN)7dCdMlr*7ld_HG!oY zIPt2konVJ##xf@5MZ$YL8DGpdJa5rnxfQuIsQm_EJJ?gt|H5|Ui`ED0go~>7SAS>D z1}{if-S#n|%k*u(Zu%%Yk>_KKosk!M8-r+AiI}sF$cQ)j6&M#`9ljJn70_N0cm@Bl zZxd%JfX}fQaB~}__lY1g?0M;tog*)zuMmRWTlca?p7>HNwl@)nuGoV=Ut_f}(9f@^P60RIWFI?(Ku%1H zU=@CIQ$fz(ffGWF!ZwpPO}YaW)bM0RH)v3Uth+r{H zEnZpN<d2*G1C7`RPB(Z*t1icT%k1DcL!4ZjsU5J9sSZnEcd#$O)qvDx1G4SmFz3}z+9DbaiD=qSN z+1gf7yxG4(sB72ibO7^o;=P!r1hm7HY;U2-!(QRscRWh>3AMY+`+g}mNQ<`!e(#Gh z5>>Sm2G9M$?b$Wi48r%thTi#C35MzZG%FzlT_Fqj#E0T_S*uzbCG4&mqAc!;bn7?N9#_J|T2ZYW}ai)rPwn;{D+nB#tVA&_)KIu3Z;F#kx$K-nghuF0(WA`#YVX zt+gC=H1AdL0U;B@6ZZth-xo2qR-WeUlHDJ6k+9G0mQty+p=7N#^zKBcS9+K>lAP;_ z{3jku+U|X-Rgt!iKL)RVdGxcf@7d!wimZS5OxjIK4bi#h?uC9MJ z1fTf4GOJ-HY4)%~;`Z4(y#R$5xKB&03p%oWzxcy4vabY^Ou3`e4fi zp@qXrM^8tz`So=S{QrMW?=`N1<@g8o7H0YBO1;wnO$y+QYjlanXJgKC;Ck{%`w zYTx~KNFHmGi!Zp+o&-0bD`E_asAC}6rV!QNSC#x#Vcr(vEvRfZD>oR`YqqVg^hM`a zh>2NTC;@&gCrJBkAawaV@W5;v4_uJU%;;xjc{udS<~OS`fBvJ$g`0;tVf!my0zX4; z{h{<*OKt@*sLf>j23{9;nDXRdCqg^=@gr+5oe-CuzUG&b@%mrCH};LB&`WF@cKom= zrsso2Y-}2$p@Cql644kDrrycYx=oewV2s?tm8OG_(8Ly!(LryZH2D~K`igva&Z~vU zCpG#dPrM!Vj^Ao;i^YnhZ7H<)`X9zHmTh4~z(cm#x$m$62hiDW+WEHD zY7*P9$PAMY1T6N4k|l;W=qS4Wu*pK=g4O(oS7g&E={`xQM1xN>hE3@FZxQ~Bl&Xk* zM&;_JCu+oC*_;Hn>>QrA9<&PYCn4=AOuW3BKBM%86{=)S@@Lja2$$U~<#wy0d7v)A z(nmbxVO4l!_G8yjhWv22YW`~EVotmQS?hgVN7&2haRYXp*&nS*B`OtP`Oi2k7_zHu ze)XN*8JGRC_FB3qsrEoNNX)xl{KqFRWmTcdr)K8)D`_<*?So;(+*jZe-&3kV?wkTg zrS{!wA(vN-H@wO`>f#-zUBf(bY-cS9dRQhGX~+z!^g|)JfyCa}RO3Fax9u#RRV_!2 zNAGKa&}J!r{hwujlDo=Hp10;nc_w+{wIlAKD|1c#0eFLV+2wVPkYPDrjEHp{5wu3L zw3TvSX(RrDm?zU@VLy$swy4wJ%9c+qYs}_wJ9KAAXuZMjuVHR^F;+58UI(8!{Fz^M zKj2_Zz-4=I3n5sN_uC8?>VHgRa3+Wbq_)9lf9yJ2N-(rfty%Xt>x$SOs_<)hm0zT_ zop0njsQqGxGi3O{VqF=m>*Ra$qgl1odcdEhp1QJf3GpsXazQ>=>?IvCrv<0x(g-5h z9td|nu+~;{U|~Eo_v3fJ96~pLE~nh;#>BXQ-nxSf=k7&R`UpOz)B8J+#yl=RSLJid z=InySg=5eh=i0ryk%Bq%O$Q@sd{hQ=oT?DuDv>@OSwHOs!R%9Zyh zqU0+<&DNoNedYl(26xWu-jVLA>S%v_Heaj{cMk{Bib=7XleN!;Ta(MfHIN@= zv-K`nZih5ejn@u*lWz$LJ|hnu@>Sj_e=*;EuBFg1MS?yWJyN0DU*DuhIOC7jU+m0F zH#!OizkU4IAKAScw4c+p)Ip<$tFRs8wkV447riO^yV^{`ca(e5*m5+de{-ualCK^^ zy4Vj$yRX)z-@yZ4A%6!?nIG_pf4W5lMel?mLoxF}hU@eibze58@KwYT|CgKnI(tW5 zZtuzdeLspLTdF4yAG`POitP3^>jhAVJxe3U-n#p^$p^KmBa*&>DAvI^Q)vpf)?H-$ zlE2OR-?}mr7AkuQciLcbo5V;#sXy5KG}7Q;1w?tvSFEfOeG#*6X> zzZH}%K7-dvM(53wXfzEnpwD?TR>wXveOax#7kEIsCUy7O9&5L}BNGKkfT(afc_I_M z;wn7rUT}7$dXH|$*+*3eA8Yvn!SY5>V^n=WUadR(mDqbP=+H8$8C-)GPpjbpwxl`{ zP?%_C^-a=_gP`)3h*!=Rzx*Rh|A{?qM|!!dSFYT<{BHX037Hg8q@CG3DCN6s>icMB z>tHF><`?k?>hJH&*I`uhT%m6+??7*F)w1HFn-9NDPd~sy@Nzh=vv0g*@<$@!YIk^{ zqu!p*zmwq$td$jpq^Hx~hO=Cw47v_?N|rd!<8~Q9v*^Sq(f!6zeA04Vy<^PEev%Tp zp*m>E_Sb~L<@dkk#2!r5s@d9^?1Z0f1RI977e^AQo1Z{!S7^A2`0-~qW!yejLwWT_ z7be*Fj&A#HmbXLW_HxquTNND-jl|m%+V8H*BCf!#;Mni2qFq(SbQi)=mx#C$h^{u1 zb$wffV{=Y`m9Y;AIYUX)3jvfx~90|Vtx!?>nnAwGY@=?sqfLDw+gkAovpL6c1HAYektM zi!3=L5BbM~E!9E*c(c79PAnVBg5B70%CFuywou<&qz>M1Klt&(v_AVB%#)b3ZD#z< zfc>f%uChJtAPQ~xc*>BSA7hm7-G^J&`h{|V#@~vZ7)>()YBRI!?E_-%6Bj0?Jf&?V zaksPqxEY_m%(sNb!o7U1kJ%~fLa(dp|H;YFUx zVp3Ct*f*!a8ClMeWBWMBpQ~`2n^`mls!oa>=B|^CRNIw+(l5>-;xgf^34Huq!DF^P z6Y3ozdDi|G2YT_F7KOs|t8)=@Y-)CNPOU zitfH2Nt~;bUCaC*uyqBT4`0_kaJMUtXG>lf!yBQQcePaBzxQ7{wxtRjU{V;jU4Ix$ z-ZuDJ0UGIxx!L|GPRP$1ULWBev6Wfq!Nc2j4lTTMtKU>cLDyVYcgNC)rG;W@To9iA z`$33~Iahq56XUq-i++ung*q>iXxbCebHMyT_%)RFc9%GMgZXG@*=HtV?<*bW+xe_T z#MdvBRh!>IaU0 z?TpjnZCeE-8j92_bFBWf=6!x1Cy_W(_92gKB75{X7S?<^LCCSOWYND zMT_HEfav2suX%ESO)d5~S5BhPZLP7A3OyrDedQK%TtPnh4GaFZuzniW4ox|)R{OgJ zm0sKNDUORVWoiMGhBH@Ro>U3eg^b*2EdVResa;Dd;@ACC!!7SNss}ISdw((a$IJ)d z`mx+@1x@nmc`Q?SI6^2i6;FdFhCXc%QENgMq%4P4ulC;v1)V5ui-rp9gb8TUe5Dyj z7k(#k{GJeJ!q$cQUEmD1UcHtw(US3tvcNrp=btu@Uj;|)oHWIKyG=SDVt-=EbG$94 zwM(V7tOowMKoC}n@5&YtbuFd70GYJC7Ee~cAb}Tp%e2w#x3#$A7Iv7@eblLh9w+sz zd~XPTv(%x#Ymco{-y5Bm`1JsG{tAkmL#!bO*>^|u9T5U?T<2!8<~${iX(*Sgkl2Wp zlevg(8adK&#Nm%*dzA1u12YTnm?ryQM+lA(9=A7Ms)CZ+9&6pT*EXcu6ITfQynO_c zvWuRz+vU9D--y*nYXj=;mtwd`K1*vY8SImP@z(ukKf??}Yk#qA(Z5@vf=p6Ux@DRW zLIrQKPh=e*O8PYD_&uxlNI&b_?a)#5HRQm##_Wr1qUm2q(28Qi4e@7ah6iKX;ZsoYUjzifCG-}IF;6lNZd!k(Q()Hu`2{Tl{{b=}$zil5_5?*%(_{P(a zD1MyxAsIPzTQ4`i%Bge(NZMt_K46iZ@@0an2$+Mxh&?+IOt(&>VZJHOoC5=9mq+6K^O}KaE-t!x({6k^3Xon}Z z&CAfpZ6~R%XMM76Nm7^3UlZNvTjpoql8CgWdNb?E+OXgMpzGxR2EfWSF~)xv#8S+V z%;7pob#218a6NKt`daaIy$r9=&e!r{C)Ru%?$PRjnR5f-wKJP*-fR*VOm!)JoU>Zs|>)dd#5-yFCr;3IIpAK$NQG4VQ-=Tz<2i)Aqn@)@!Th zXKY?W6JL(Sx94EU=#l#Ot0ME5^&PN0heZaKL2hlHdm*Ovo)~*&0+ohR^O8JnFcSQW zEj)jT_&m?rI6QjwFxtgBF3SFpogUirchLBdGt4Dp*QpuLxv!5D?zl7UJmw_jTa&*lvJ|v;n4S-X5me9 zl;D{hfpwx%z3%SoMg5O%3wPc=3Y+LRlVgm8Uz#LUe1PYlNx@W9ng2ho-ZHG|_YeD5 zM7p~XK|nw{BnC=~v~-OYkZv|gx=W=5HVHwxyBirW>FyX^qeuMr{oN1#$9+HDj$_Am z?Q>o4IA7=c3X6?!fILP`$QX7Mz2o$P>^MtiuMJV#P>aXA%2Dv+L9(3jp<8Y%Kk&+j z--BnfgN9y$o895uh;v7)!Ik+$N+-wdfbI&8@$8E-srZ}UAd&H!AugRhQryPv^QaZW*lG0wyK^?rYtjt0E$_mlS7 zmkH1EB^_}61p3Jx5}$6p2FHYO6r#Ed!Nka$L1CX|*&o}qhL^3T1)%Yi3uSR7atAlH zPq!n>^C8GD3YSHI^xHo?`+{q!U6fM zwo-{Y%v0%OH9II8q%TDrdU?kaHPjske}jY0&sjH^-fL%58#JcB9|Wh^}>1 zh2yhOu=;@#g`9wtbFLuP=eDHZ_}mU`5o(8v9zx`LT9w^xB2}d}4~03$tBlP7^vQ6U zw5O<-=YC>LiF{wTzSrcqnby3UZMI^H%P_M363Z=5EO##4>;Df~*?JXsSLZ86P9FbK z7-)8`sld|g6&YXJ0Vba9m$yIvn9W~9^ZAX$-ao%7?JUtp9OO$yi}COG!4_cw1zUDb zN0N3eN^5S9a%=K;P7q7djS9#<>mFXkI88> z;oaqLhGxmm{@|S5e^=SC*VAgPdJUPn;aJ%{Q8sw7F|hWY$8#GN{n}N+i5#E2#SckJ zRZZ3Ny`2vF1R8$3TORzOJ~0~~CGr45uq)09Xppoul$Yt7-M(-CkpzZaepBER(0Zcy za3C3fNPq2aDY!p@Zu`EU)ViPT$o@~lDrI)w=J;5VCX}n0ue%Rn`W*{v_Ds9p&<*%e-UGWnZ;qV;~ox}YTAj-fLi4R)%a{NcI! z%KH9W7T8PwJxur@<@g<-``L{n(T2@hV38z#g37)%+f{d4GQ&&w0#hvBnva=C+~L}y z=}F>~x;uBLLh=MH$kwT0=elmEJe-nP)kEX_2QDP*2nWhurFWZa1!ObNib|b#BikdJ@Nvxrb-8 z!nDrsR_7^4JaB`93h(FiU1ojQ!A68P;GSETNjdW(0=m9W*sRsG9%X*&3K*L>y31=BSPYx+0|vs^7c)yIf3M41QQFy! z+PT=Zj5Bi%Hdl*&nDE0v@BQqVzii<4t1JnP_9+z(Fx5jPb@wC0S`wbIQ?$6@D--R3 zji*XKbmtz$<+#^7!EI&;V;R%Nel>F4DDys!V_)~<>d(&dUrK)P`Hg-okh~L}+gEJZ^wXl_{YbCz(V^kzqm|(}mh0(`;hmRcS9;wZ73DvRU{-e|x@>YR zAK8l=Kdy)%%Sm0o35BfS3sI-M)9ih2|DdRz?Snb* z1Dn|jX9?4KB7)bslRdYQA)79Rs9XSs2wF06f=}_CtHR$-Q6;#(mC!L=5Ij+z7??bR!(Imeu&!-g}`j);q^fEUXcv+fICC zA552f{Rof6Td#ag#cv)=6muhm+daPqMC{UwYA!_c;Sb*SX>USwrP!=Kj$xk|wcdWh zMqJpLH8yd~{GbA4o}~No;xSWy7kqKi*;3GSqIZ&lDI#A0ARZX{IM#X0i~geE1Fl9$ zP1ma&ZEH|0BujO+4iC=^8}z>ap&@?;t}TDOBpBL8`p!R6s|KB9lt-d9BMCKY%@qC4e=KuSh-QCoP)P-A*w z9ktx=^(>B(nh#94m>Df7O8e!lK8^0F_8w{-Yp)GYrR!eJZN66p_7=&>GtS8*gICF0 z^6$~HSKJ=m9YMxUdfXT60tG!&qPRUUOZtPwaGE~+f_pnLVmbA%0uLh{`!ZGBE8jRoc$|#SpfyFO zhrFDG7z2!8P%$*2&3pAKmY7<|N?EBwIEoSwnvWHf@gj%r@hS+Fr;N#8kNFChr;lHid z!G9-^Jz6JI@g3D2I22Mr_Z=(eEDVfMkYenDrD@udebaE z&j8y$)D@9!Hzt@BvG$4r=eXSPw-tCRyF*FYC11^CfPCMTiqfIu^~8iu{pYPbZbU!I zp4~cBL=I1oBNQm4BmL{YMngD#-C1-b;mJF@-EC1M2#muA9|?`2J_R?R`Hk|ncs_fS z(SGAbsZr#h71SQ_qRu`1ydU(b^zlS!WtJ3haj|u=dC>_s@$3Q7!BR$&Tie%LcZQLq z$hDj3d%I!g=z+dwSMzLNQGO=EQfgGtUlKO`$u*$1S!`=_B?0GB1I0zc+Ur~`I773Wyfaeg@ItLUFI`% zM|?<1iMsSHQP;i>@n|*4LOfGWZo_Lbx$n}F{%M~^qur524E&a9<*IB)&=_=%Krtpq zt{~;cqU2^oIaNL4$COzLwBWlF6+~!|0cUU{6b0eSLUH=JZKk+|VPsa<6`9 zflv_48m~s&5BQx4$!4V@J<}S3jzqix z!Cj2&Z+lyPeIL>CYwZJ#V=J%mA9nF2;FX1wjrE#u8RRba*k;ZtA3aiNjr77YXz_@{ zb4!@|mA|&7k|?yZAM7=q&2gEX4@|iI7*>Sl{l;lfdX6;$ZFwG5>UNz}3vAnYDz=W_ zbD({JLKPZ#VbY@AKwskrS)6V*-E@uoC^pr+2x>C6=VL6;s& zt$Dv|(4*;DMm5WOK%WF7*IIM3xt}CPJITRS4u!U@4!KR4Y0eNAb&`cYUz9$L@ZNp# zBlOUV9h~aSC~zK(!xA63xKr_4psmegN@7ml@WF6ci6Qe=R2*ogx}kufkEx-qAEuE- zt$I~Md5I9Y2$JSl^icS1s4i^bJAIuuCBpI`ih-=9$t zi)L&Px|f6Z44$Ga`Z2Z|oGT4?UK8`4iT}ma?J(A1a=*PJ+op}}rUKgf^}4n<&U~rC zO1O&Jbe!T%16^3!=^8erq&yw+8c6D;Nu^al5G{#0tbNTUeZCw)C^#4R)AZIcI8e^J zy0W_3y%-~n6AAo~@6i45Pr%QR*?e#>=)i46s9w0WiS_%4R@?(x3<5WDbt;c~4Vj7? zz11dA=FB9A#VYsdRe)DspEZ-Jwf@d6OqmgSS$i76vM%=H&JYYx=~QWkvDN z+AE24Kx!Gkv2gWb)4Y+XX_2CzHhN7i(UvMzLX|J3pn{Ff{$`CSt{N%THJN+0ist4F z#A#A5WE5kHWt-6f;me(8cPb}%_ANuP$ph`lpbL z9*XCJtyKAVu5XDg+pEu{6!g32hdA+|%%zE6VaX14^&UV|kx<-Vv6Ova4vI~sS7Wi~ zt-}g^DX}ZF?i~@z^yjjICH?6#-v!+c%R2C|@j>QBR+=1u^8AUNX>{|J8t{0Q*73E^ zGPs4EGM#|;GAg$-FHw4L5mpqtS!Oe)S@I+v>p)2g!bd~=R#oPJGD?vq?`e-tMAvmm zN+f@3k>reH)G8Ksjhwn=w8QqstsTENy2^1vs(uTM;^4uLx_U zep_x6frrevks;8iyao!(N{;bW=lQInK>S?i;ozV%KRf;S-rfdhnX%1YSKQb|iwZ)@ zuU6_4c6U!tnfTz^Wk4RoL^f<~^`TyjWA02~(GRZ@xZcK@y6gHtD%0Y|Czw7uBd5=S zCD(SCFE(nk?mztEGCK!2y6r)luuTs1u`)&96LX$0D#Ap*?<7&ssb`CLq#w>^_Ea5V+2eD$ z{Wo^pJ*;UE$6~o#Y9{;U)0HJYTuDrW9wDI}z}TP*1qPP8F(#KiGvKhlrklsfdgH#rw}TrMJq@VQZX z0aclY*V;#|!LH+(H$xM@iw;^LRQ&`zJBGbi7FGnrVZ<|$UB+Ydv+WlC#AW+UV@5`c zE5r+NYq|=_p=fUdsM9`O7)2r_W+~>m1A+HCw>~IV1H>H)rt&D!_u%$cU)PPmshzgK->pD-a&Fmk`CKvXEB=0x+)VG3 zrMzR=YPHq@*N$p;6pW@Nxp`d@3&=GX>U*7xhA2QLG(9A3jT$`L zi58_Q5mgI73m*Q1l#Ne?*cp_+3w4P4hvZR-n=sD~3K=NwNZ?76v(rYrMfdod=%kD0uCZ`u=`Lb9)NI5hVWh`pDgHZg- zkU#l8tL9pu5Si$k*aUi{KL!EVyo9%Mpc6Ez_m+?aF9gk*rzkYGQU*G^w`B(uDe&m&cm+1Oga+jSNwqD=8KMYvz12 zIxbt^PNMl})_-oEJeMOKy5kxZfdu|nWkfXTcxS=6`^90N<(eFNKKpc=e;C(6bOc_4 z-C9k};yMP#ASliLD>M9Io55{|`z(jdnmQ!g%%B0a>5cll+8+iI1$Yvu{$5h6Q-JQ0 zx=iXXy6w#o(Lot>u2121+$$8F0C?%_s5V7wnx(afk0WQp=rY&@wpFlObsm}@wwLcB-d8>7f?GyHh+@X zA43M99i!)U53g5*C@*lfm5)YQyg5~1g}~8j6$k`bKQdv*J3ZsSb1G+$MN3k`#+lb<{`gBiI)gRI9^1zu)(hmiKl4Ess^N`Oy8#h2Z&jwhs2XRGGICsn)g zrGN7qUw4C`R!Kp!RdGS9Mjk>sibhhbc-&lzC-52C_iQ&ny9dqh>~Zojhm8 zwT#4uJiW`}atj+HIYJ_vr*NUaXD76Uv*tyPUS`p%AJUk5^}9r$(jmR{&ufj9B1z6t zrb2r%f|(}pF8XfmK;j?wKW8X5a``uN`xd(%whN5f(=jZr6o52>rJ3g#&dGo9Xb2ys z{5?`p`v12Nt0yuP!!fj!x7i!lgCWx1nH)7bA}$-Y)#=M zf7>9)WLjutgQ)8&Lj+36xpLI(&LfVWcyHUjhv9Weg|j;4uj#(lgw@4@DGkB2z1so2 zDgx7cipH9RL3rIoUa2FgC0GeDRQ^nZTe4t(MzEZZp&SS5j1SQ}5${`T{cOvW`kNGC zJ+Ww!u43b%Vh?GUbEEE6IF%x-_EP$4KT0{x52QMJ<#Iv4q+@%^17iy?`eNkarr8h++MM!rffP5d5^ zUzVzlJ&eABJ~Lk3hDcq*%N-k=0NLR|Ey>Vd5r1K5wfN;&Cv4&rtr+^<{D<`qM%NHk z-C(qB$-F7;JPC0=n>X?bQacBy(e49Ap#HX%XHu^W?nn)C{!2b<@`T6MCn|N5Tz9N? zFH%UKdmTANq28?rW>*Uig`(B5YJePQNy}4%r#-jC>}Xkkt%l$D!+#J!H3HKVION+G zzAve1Br}jNJtH6iA1Z>|Wt{Afq?rQwK4~nEeX9x%S zOHOe$vl_77FWY(5JYK(EnohkQ53li(ClG@nWzZO5Ezxfq419-@n7X5|y0$XTDCmK> ziMKlC#$}R!{r1dZDoh^EzVXZg@eIbo!!hMGM!xpp+SBwzC$P4VVe(#6>DiM~MA*FW5f45F*$oAQkKhKFiksLRLyKt{hK>C%+MX8Z>u< zb1Fp{Axe`Yq&EnsT(A-JHn4D%tXF2A|DriGby#Ij{4r>Ek2T-QhHFM`UNo8%YyVfa zL!)T3!|DrkYRCmWq(zdViS+Q#wRl-Lmu+V^|KJ?89t>bG*Slw2%R;$pI<{dp{aTX! zE|C%1H7txQbYBi>{o?ygtQh0_zeIXbxNYGF1cZ5h$*6A|_e`qQw*4hWb6(YsR^pCQ zUx%WVLz}J|f-AzS1O(JgLqqAR;gm*JrtmLc%9zPkk&$eK8MJcsu2S$sE^J68e|$8Rx-QOo|5}KvNPD-BC=68F&CDuJJZM7pY%eB2O?Mh`gwg*?4&Y8e7~ia%@l zqU2wW4UPiDYCw5P1Hz4NI?@d~qPb6h(xU*R?UST6SMB{nUH1rUFP0%gT6qn&gp`ut zz2ziMU|!*RL3SF0J6ZxhY3rcFpzIsS^y4mI6mw1dRMNnH=Kql>A5Be%mu{_CaGLp( zeoTdsKNkypKfff>o}TrN&%|FI3h(=Wb@_@`GU-4FIXK2r~7ys_rje>zT;o`|gyaWj+hHz7XKMTZ1S5 zCFlXOMwLm8MdgT1E{MG|pYw;ZwXyUBN~&TJW4eS+l9X-st%UfPH+K4iP@tx)R;kYi z^??nw*MOyk3!;6S-w#G^vo74BQ@`@IHsnqCFC`1Qj?r<;(1;pVYiqKR6yC5UKiH10 znk1pRkL9RCY zO%25rPlxC3tRx12l4wNm7)1U<;)_@RZH(8{uk9*ply^WAo|E7F+>pin)q_O~1j3bN z!p$A$K#^CP;JvM@%15qdgP^N`zAj5wFY1XLx>>(-HsSCMf=xf2^I^E`UU;c6HX+ZE z%MogkATY|@f1{cucOx*-`uknhzAC~1wuub!Ew@=Hj7ZZSMur!eP;a~EyN!wjr`S4l zsG9fOIXaEOlhqLlgjj2z!p5m6u0@?1IufD|w;YJzDrPd=4CjeB8zOS^C6Y3{3Dl|; ze8z$0LSqx@L~Tx97?s%5)I=F4yXBFEjqEQjuBz@qBX85}kyZQ^t9Pu@J{jA%k`BT4 zE?Q#H27%kJZ3tgB7i`!9Czxy11L~>XBN5|K|Eb_DoGvjISzamyq&nt%$S!hpSUK^C zzqc5EX3?r>39)Q@%TS-G`TA=v$AkI6{SHQt6Us-z5>;N@PgimI z@z3+DYW_ZBCtG-6EtCW8jEr}fHVtb=lc z&pkE?w=cg)mo+^`E9StnY?H2iIImUFm)DR@iPXCG)Ho@9$xru{n_=|WFvNDv5#Y%NmdNKud*e>9 zBRTz3Mf06(6m9&M72Pzsn#pjs2q*vuK1mjlJ3ePOP5mJ39G0vot| z-NEw<9*gGtfe;~LWmND7HZq&6j)S+ElCBA0p_Uk$CKc~5EbkIOyQI;bsK_mD5MOC6 zLd`HagzEW8pTar;yZIL{J{o4oYm8>zM7zFmj8>6ZQT(Kx{x-OtvJ9ZExfK6=(8{s^yd zeWW-Kywa6xMB8NYMxJK+0KZoFwoqDjSUtkdR`1ZbKYK*A6ZX1ZSN!!9FaEgAtC-t$ zU}e_I4Lnqz?3)EF0og3Bj^4d|U8lpc*XUXpe`5q>rQKR9WjVFEAigjwk?039#v}gv zijC3RFjdyz^T%BU4NPij7qKq#V3&UVcCnnPhPGWoC-_rBBdR*a$b2bu_C*;y8BHP~N zQlu$oAe0}*gA#JtdpgS zEf5C^c_{`ZH)u!o732L7#WX7R zsVCotWb1Cre9KJ8s!g<7q#gLE##8GwA@H;knM|pA!t;G6`rR6`o=ghlTl8^jPX5ma zRj4#079riHXlO`CsW^$V&o5F5DXGQVUD05XFcwf6dDa^A@vhL5$TPgf`>^_di1X8# z^o5Tn`3NVBt}wKE&#ecwkhyeN%zR>Y)L6F+d7P~w{|BRJ`_uXiF8g8g)t`F&?*IJH6iwbeuk2=DgpRPra#$-PGKL2C(LXVV>5Ab8Zl)kR zm02)cuFUU9ISPeqIs1_!(%D+Ed&CJstQ6StT^>H9cD~+oFRL|cWd)dqhR3y638)jk z@q5Ai;8E+2FOEN81G28TEa^g?dwd<|L%YC#BlKuf4?^gTwbvB8zl^W~6{WlZ^VH?G zN?k$THr%_#{rG$-@!E>kUHwx-09J85!?%B2B#c*%O?A-pN7sn$`_E!tGH}7z|I6S- z@-Y#;5QDq{^_9$b9s`R;F7T-u55uNxKj*PM!RzO6uwTLL9~9`)SFrKKF^B zO-N&}or5e|o;B?T`WcDiuHj30dcZZ0(NU4rOK=TpF-wifdg(&}`D*4rnUt#k>~r@8 zO^}yM@0(~>4#|l{|tCVz=tT|V_c7o$DX17057t8K%F@M z0hzrlDSYL@XCQhUZU^%;5R(b}e|+zBHl%=nkWtx-FU12}h2ahT3rIw0OU}_oagN1Y zu@JxHjY4{=I|Sr6efFyXam}(92-)~du|F>*ameGBM=#EG74VI0~Q|#d&zo)EWy)gzqP+-+{BhCMYp`X+_1DfjERx67YY%;36ft0A8c$`-OFF+{o={xs748eA4ERZYBjL?Z$!M> zW0E+OaI)MoJ|hmbL9%QI@BVEAG(G(%cAZt;W(F?aypz6@l7Lh`j3i&P z_NOF~R`GUVVQ@=S&s)tfI%o1n+khkky|&oukF$lL?k{7W&8E#3zA-|`BB#X ziyuIW|2Qjqigx;>aa2E6W*_ji|8sv8)N<~xaXO#8#9yg_Md9M=6aW+#$($;C*m-l% z@D4^QU5UVTQ9D6DW}2UeGlZ~t#^O8O%fI{ipAb0^p%><*fZwHK<>WC@BH)q+7m9x6 zQ}BOFCA=zeXBU5KUbGw&AJol^Z9@sTmm7_i4n{qBvVu^Sf3NfY!f%RShvwVI&kQFN zK{D0!bkkaWgU`7Wgu0Sr6Z6K=rbWQo;omD{sWGeC%ye`SV)E>gG29m3QT$-$n{;{2 zrUwRd0K@)Wr{xbsZNX1=(q?1n-d6lFxN`q#d&$JBu`V6P`Q-sU&TF0MQJGxo3PD|U zoW4pcjQvpKlP4SiI*oOb{AKaRi_zD6R=q6IEeNsvtp5E-q$869=kl+plLk}W2^4Z~ z4ZzcCwLTPIX`#S%5XIxSqh&dTSdM!0a|a&1@^{p$|9*dxTJVch20`j#z=<`S=MwZc z%(%s=i#b~kRfLjz$&CW0Zv90-wXeF4?iam9E3Uxa^r%I&jmp2R=1%r^RmJ7MLuQLee-w7$( zbg!?O@5tBh9x>BOp|B7!Z~vXD_HV(s5GSP?2mgV}3tg3Koo%O;1PHWd?&nm|S?O~I z|2G$#5=K<3%^~|>P}v*B9~vN;u4GCWz`YE%Z#Y1UX3(u{ybZxm0z3J_5E=K(jJ#=n zn|kZsLH$V~)4-Nak>nHyr^xH3))|=bQ(j-a%qHd|!%I9|Xb}Go-E(>Oyxx3^Er+C$ zbA5$SDkl$vreW9w7uX0dhJ~RGP=+2gF_Cw^4B2fzyO(;CIdul*lCB<7ayyQ&k6GJJlqH+Qd#tf{-j^JKX7ql8Bn7=KwGeR(gl(Fg5P@7M1DUQKuIE02sG8`D(B;28d|84t4l}o(Xcv0rol*h`)N0=&GfZp}iPz zO3*VeT3!P7F}kZS-j|;T{yF`6yZ+9GfEz67uC(*{@TdE-Gi0xv1aJ*PJ(G3P(vk4g zpBYIg(_V{w2Dy6IUzeT+o2yoiSvq}8V=TtzYB%pW%4l6mvdh5TPmOG11wUXa>0N3P ze!*B0*vWZcE)|yxp?aRicsF`m6nFiiP4&KS?eAq1(FNGyLU(?=CVoTWt>6dX^-RgX z|9k;fqXgeL8T!h>P}-Werb3_ZvHUhu2SN*`*I(#Go~D?TbhI`+TLZm_lQ`Jhfy+-@)J-RvX-f4vCv zaKS~>l5Zl_OIBROG2i2ED(h#wWj`!EM=d1NEQ12ip6`4Ik@4Ip{SYwBPf#I`{Z-*k z1mS}r^gPV_?d_8M;to^j(_NLpqldkfJ1YO0L+Nr`fER4O91Z?$8?fQrH?C8D)$E>v zTu_&7jv+XoQf^@o^r%>jBBHjh{l|rX?R7+&d3UMYzuF8nHd&&*Od=&KZl9>N=$`6d z4w1qJqT=-3RGR`=Z&cA%QEB@5I@PBY%Hrd-y$j!imfN2-`{;!G`!9phMlq*SACS?- zwBy1{%D^|?rW8K~WiR$hm${Wpnb*(eR#1qd1*%%dpBNpCx%>@Ve}j$|o)dm42Da3s zF@#%KO#yy!@1xH|<)g#fVKh_SWw!)(9s+UG@whs_wpk@2r zz41Q;*Yt$bRpGpqU}L@f1EKe#!B#@>ncmZV_Gws^1qJH;ieh0%#nb*XDJ)_-AmBA` z?$ZhKi0xuD7>4FG(!$}#BaqZIVru=QcZl|#Xpc;ExAU5&S1coGQ&2PCopXD4MyIqV zW(&6EfJGg{RkTyIFSb>KZVAjPI<~;ZDC4$31Q1F9;HEV6CIj>RZ{|Mf?`V4v`Z4}$ zmO!yEB#4trbWD#u12^nQfeA%;wF{Tatw8S=U$G=k1L5UvtwHAjTuq8YHEX_F{=$Km zFDlg~;dhSr`O^xe%+h?b`>=5n88j`Z+>KzyhL8Y~X=3o=pV0jLC`{xVV=Ol*wni`Z z*LusX0+tX!E%$i4p&M#yL0TH!kq`1qMb83jhZbrisR?U`=Rf1$>~@eC6I#vYHlOoR zePbqW`zD;E%oY5~^j|;rgK4gRYPSAVG%!=>)2LkhA{o`^j5__z;EjK~lM3lKdy=cD zdcg{2aVyD!I9+IO4Dyx%>OH+3%=M`WXj-k_$@ANEr|FG~@l=y{sM>XJ6V}!C_Yt|2 z@R^AokuIds3A!!+FfxuD`Yx7u6zmo{6@a}zqZ}!+zewMLY)z0uITtsO*ftQ^JDMh^ z=qH;oN`Oz$3KYM{CDVreM{_OJKGy4R=B3~n`za{@OR{{uvM z8(!`HUufaJbh6Ix)(KcQ@^A4!AhMlpyNoZv#oGKjcAkcLOy*g6+91*`?b;G|d+t}D zgmGpSkG}<$T%mqNLCl!xeBs`-{ez|TJ?+A*he~D_x4A9heINvFAtqJaph7tYw3rDG z3h+_xXWlQq{d{cVEF8cb-#;y^D3_jYw%EeF6CYrwQv)W8ig+vhr%sjE63eYdDfkN~ z0`#TdhJ`QRfVi}0y{GRBy|toLv>SEK#T+WKt~DMp=K$p?D{|!U+J;uiRGI*(IR zuiHlUEK2q{`YO<%^rsWI&n5$ZKubFJoK9o@iCJd$dK&0U!R-d+ zlQWqSPRSP~SS<17QhqDko$ZX?+bVk0en9#Hft;^bbM>&Gu`_Q^Ko9SuoDh!61l>@- zJIKhigA3jL%szQsvuz(MCp;#v3bMJOU;A*f>8X6(D?X5r6kI7e!_7Y`rkXFXRcIEZ z>QUk43^o?@xsTe9%5h$o8bmHX9wruusAsyAt;{(^*4^cjnR)YYO)ThPhksi8tI3y@ zSf!@8h8KLHrkQXmEiesh476Cd7XOdMU16zY2!xy(ML9$|$5XUZBQ2dO10z*uD^mOH z_pP3KPb;)DxkX(}wu`0O9_qJ8u=EL@qJH-s+Xq;gT=fagf+F_$U^BoD_b7X7xWorj z6rt6CuwLmvAK1e#;B%w2O00~C3_SfzAdxm~N#N*7x*|h^0bh${N%lT`^;a2=hK$vV zUeFZN=6-gdQ>(5+MVrW(x1rymDX}RO*GXQH38i{P3!PKF!Lg4!+*qNXarYyE5?2BR zyk`t=E_^VRLO3|k2^fLz$8!P$KL{=NKav;Kf${Qo3xeUGonJ3v{I;&uVZlPt<$m+O zy6BOecLl=$%LQX03n8KLHggcxkumK+`+j;ruIe)6cq`)yDgQJgr2&P5*^Ww9KbJ4} zMagZYb5#Q%J~}gekoD@`1?@&8Th9hCVtHrR!0yDIN9xH^jru!Xs{E=WkMCw-ff_z(JKx)9m00=F0j&?(_otEEE+MHjxkZT?mYH8rQxDjx~|kvKt_ z2JneWmHSdX{d|7yY2fd&P(k&cvjrX=K01Bl`Vkus!U*nrM~7F-9@W-jCZ+&vQRXzl_#aiQu)<xUPe5323Vd)dalr;-WZ+Q{9O1JfETO5W0@@Y=EFR&oIf5{v(K@;l z;hyv}!}FKp1Oa;HHxe7Ub_7%eu=LRkQexz~*LuH9=Bc`wZI#LE1DY%0yj(P7Ipj7k z&GH5#5s5S{66(M*AfglPb9cI-D<=*;%gz?~%1_Idte3||_mY&|iftV7o-E#7U7p^V zW^y^df$l*kG<7Zgsa>h;`@P(Y3cKMAETKDYN@x*?zmRX!X-CTq=I6N|2!Yx4Hqvkl<+B zZSCbk*O}%tPxce`Qh;EThX4kwAAVPX1swIM2M_J_O{`Y+^y!Uh?;0}Siy%g zb4}Lv3k!Uk!36OxM-V}g(D6ZX=wnQ9Pq;%Y5bz&MMIP#v<*!{NM)}u&>h@Zp0__9DS ze;q=Erz%6a)Ew~9C(_9RsAAW71^M}GBhp%s)O-A&YWjsN6%Qn71XC0Jcc05!rZ0>~ zxK*h3wi%(WDi6Enn+@?wvwn`qvsl^vmBD+gvgMGPQDKCN9I1pQlRK_CDy*v*-aY>H zAgVz+a3MAxqN@Fq7h5VvCz|#axmw@#w*pe&*8vFJz2)%63La;H7qD3L*c5+PF=2;a z?O9^Zx9^uk6fCcuA1nz*af4Rcw12`6-|;@I!#D-`G?G>B)ZeS^Luz(Td0}wM2VZkB zVf$ZrkI$42Q&Yox(>VPuwf7@?{hmHfmt_|$OU_BYSQ5nV)>rUVKc6J<$70PDh#w`{ z*)jQ^qbANy$3PfiI5ul5Od=t{9%{$-1I@5rc}A$v67&OFx=S%2X*HLB6JqbT)U(wP zALDYtq4`}=U%uKUc|M!NNQTw^G8W_ES)ccOb9px@t zplD7`&L^<8#LhMtFojOXMn1SU=<#8iVYBn*DMDhYb=|IsOz~w6B3-pfXp{LRg}tv9{_K>{d1` z+hKI3$;bMlQXAq3n7ma9w$C!C_8KVM#$=WjC*N3#Ed5!(_fzRPC{#5$4gsa=0$ zXck~kWliPl*3mbH(sbSCl|J>s3LYsD*Y}Ci0`a+Q(ZOU1Zvy? zuh5@2`}M+gGL4X46jOzdZ>f1d%7^dmbE??qK>t$(2cobATnGgqp1?GS^iFoPM$^$F zjlmYHX-qrj*CYQ_QiOkj(ob!xAoyr;@>4=ND*>K@sSjdZXFUE+b5B-`*E?Z?WM4*z zYzJHu-;FJh6LMAi+e}^}vx@0*sMyUkVGCZfZ2xG)Pq!L=_-Rnix>m?q1vP%8I59#n zi23ov=p>-E0lbazQ2{rdRE@B1@z;nPKdKdk*0;p7`^s~n%7U1q!l>o!wtp?(k1d)S zFh95EQa?eoUh<+K4Yc9CLpvAIUb637h+;yk9V+6wzC^;`9oO*n@QBH)`}tqqaf==g zg;-K?>FfPBn+AQ?P+6Q!U_d>!+<^Ej;SNIV4@x}Q>i zO|76?+Oq^2GU!1OD){=pfA(CjbfbU_hkw!bt%loLjqU`+_5SF>OrtfQx zHuKm;HU|yUJ=uRe?$0{Sil=09w7CPnOQj(%!6~DRc`FW+w3$9J!Ft)bIiT+p^&KMB zffsB$V*-R!==o2ray_Omz!>e>+Tv1NGIQ10(OI*K=fz}zk|Zx?4QtDjRFNB1oF7|m zEu_y?c%v-dF7&l?{NA{-H(5vl;hQClxBGc>t3>YFY@|olm0hHxqtCa84EFElIW{zY zsd#m94In>f34(a~5{%ag^j5&$@d<}-;Kzn9X@xBXFXdkH$;vr=m>E6% zhHN6e>{Cic8$a!GY{kk))3$fx{AG;&wa90l8j8QP<>9nQ#^NWezWIgWoha2ROc%og zQwy<0ORXax!m)(jZ*FX2@qB0bx7a*{R=WeKLZ!-4!Rfn+S)-lGqY|%bIKJ@U;=n) zcP4XQwa|YKJs$ zHSE@-Lz{pSW-O|?ae?;&BW=wha)Lg%9#wB6|88ry3@n+{%-%GMM)A*R9pD48m$G=y zqpN`BWkP2nCOm1stMCk4okyoBChERjgyTqFY~8rNAD@LAnbD!TjLeeP>qHaC%Lug1 zX4^e}R5Y25{JY4=Z%dE#HD$b@-hOq+7nZ~4xZi;1#ZqN74>A`&Le(f{aFC%*ERsFzbNf)$@j!D8KOAn+9p5 zyF;WwasX)*Bt*J%=mudZiJ?PO8io=O>F%LHy1TnOX6Q5D-+R61oa_7#&vWm6@3q!v zIku6`nZ8N#qMmc{4~}y6>(WMW3s80aG$^hvB?>4-+$uPQdIoTb0gqo+42q9OzMk$Z zlsy3cH4H}t)vsW^>?afO8t8P6V@8Cqn!elI2#hGWxZQs6y(EmLF!@P|J_cnXwTY#< z&T}8jsnTG?*6Z_Lvb23vQPtp&`uUL1`R%Hr1D>)LW=?JrVIQF$Y8@ei#K~o0;_kCJ@xn8l4P|0Z8ibKYBeE&Myw=|EIwZk&=%X3;26U-ACRn-(4py#{G*u{J68H&4NIt<6VZrnO*V zjlDmU34^Hy_p_Lj-bqQR6$MxdAL@**^W^24+2`Lpgq3~z=$B3xMAW*L9I@gB-v14WlO9aZ&c&H%p4MukMn}iUGAv_7SfF#L5WmS1PFLBjOiIj%pAd1nd4fa_hy0 zkK7_-O9-%vOa_^~nBJ-f^VjYiO+O05+Cea=ZYp*BON}`vKwp9q0#Y^pc_?Bu7Wv{A z-MG48QcSV2{uI{`*lMJ_^7ll0q4`PCn|HlV?=Xl8qrFmzUC~2og*EOKE!^>&<+e+U zbH#Y}lANR8Sp8A$fU~F}?kAp6Zun=6z=YhI3?Z$(pTTWY`jJKu7{P;+xzm|x-l-CN ze$sY#!?$k};hX%*#VGDF)+wWubKmwCW~&fOq}#;pDR`BN048Dd_~!mG^_9CsaJ!P) z{sjjdw)9G4$l3d>R;@KcSLK-DR& zZ{z#M8z>eH3SRQ5Jx%SOoHZ;DuRj@I!>OMUJloR;O-zx>rIU{022-&pzMsHy6!`OM zPX(`5M^uQ;fRSqX_a4rTFy)uH$|*&CYM-{Oy0KL^XSiq4XrBkaOF}e6$C8DL(XG9V zF`Ik*c8xPe<}*GbuzZ%ivT=KKtw&(%1p1dpvFB-`=q7ja%^?>#GXHLcwL zd8Kh4`95MSEi-T_U%ywRM)CQOjo7#G{eKswS~*iFX=(#)E~a^=${kgQnbS+ek29;A zA4!%bZ;i62dTamBTzax?DZF=Z3dyC9mCeRl5bdlLP*<-SiNAaYE1_(5c+(<e%9n>;wRcscgUPo+FVQqEqGyIJ8sI3pQeY{V+ zY86*`5DzX}g*RFayKngX>vt?&Bx^mKjDq!&5AMbEf>`JNVWotrzXrSzy0U@7drT+0 zTJl6v*}+UguHL=|@1z(~)JKKE)zr7K_sI`e#M=3EB}&I^sg9ILK{fKBbKjcy>R)`| zCSvU40%Ym2hGmfa=>=mKb)o%@CVy#lw!h{k5(J%`GO8KU+%&BU7%EV$0+s>e@qOlrSFRuk~ZHKd@T<`YYUlWvE52OEgr`HjtuL84EvZ=t#Luv%c^tF-Q^vG;4kTFt_h=PmmqY`YtrN!5Sf z%wa2d4O4?B_ek>gut7I!pCk!9epRP%c%ADUhIaY+EUS!9t*?j;shLs^v`WEBWQD7l zTBWL<_a!5lYCfd$NFj%s_>ZuvE2~%UrKKdjEBrM#&KQFPqvYnDAUi0E-Lk7_MMWKJ z$2L|o4PhiVd0WSR?8!>IO3c;cJn`!G2hx(u^|)Q*);Z;EHPUK^S3*`OTmP8c5HYW8 z#82`x!kB~eUNjP$rb^BqJJu)UBw@Y$!F{WJpR~t_S*RK&hBQgIj5b^%y#HfE-R5EL zP9bz$9Ax;+=wDXc+&|zAn<_jC1C8Ui%ulZY!5UT_hLZ)#!MBYT zv*Br`|1wdyAQMvcETV3)`m@XmaMZTEjN|3G>OYet)6+a(naa=4q4rHH4`lDSK?8JTlPL|aD&C%+ za2yfio|KJLb>UDO!LRY8Fze_vdq=+e3d`8;;vCXURjS0N+YCuj+>i5}*R>)^e^Ci@ z2Z)gNLx=*}v1!@d2y`Z$$tq;8Q>(AMb23t>O(J*mEtv|3| z;+P3k?WRKxBtcQ{eUq~ew|Ar;B`pRP`$w~%wuO{wHqRI*i1EG}JDMO3Q_O2GKd2B) z5bmEFMJ1{Wg>Ag#nd3`4Jp6iN7q>Af`n%5%)e}QR?jcsu5}*szc-Iw=tZ5@e`p~EO z;M2YkU*a`+xS^O8_mnG=emGV9Jr)@mAs!7jWC(3BQ?cm(X=(sfyIh8g4NI$LDuo9bWvoQWyw9b1Gzet7jgoBUx4gLb;pmcBuxDvo#Uz*fdRP{If7BfEw( z+#Pd+1@V~gam0{WJ&Zu%cz%6ob>KVM*5tmU(D9ie{h&7;S6*|Uf-ej##LA-~ec~HH zH+sDTin$GTQBURhHQj-w#mtFq{;~sYTg{XS;=Nm#QFU?{V{t`LZXiaWMHKCMq5^i$*CrVRidek!mSu?9T zWV32OU zSXf#KVzm0^-!&iLiNJ1Psq>Z#K}I+J68`C69^>cPh{-E!d0z2lOk$Y9uh|jp(=X+T zllZtFqBjXaNzsnJnlKR%Gy5;O|@Arbz#SoJms-@p7M~nc^(~PjRXr^)yz29`2I@{$f<{E6&6#Az@^$M-36(tf9CA zl1MoK5*-J-X~Ug-UfFOh?z13Kgk#Jm#aCM1F~~RCh9dlS0b;+6vrG^$ zX!MYq$^Qc-NPqWKuE=a+Q}h-kyct5$+4w~po+3nsys||dJ!?=NdgOOzW<`}u>CHt7iVUHC6FQWDR`q%lS?Q72p-U5=htx0 zXY8_l>>leAu*Q&eCfVAH4wv93$XYKz8rtoTy&*s9H9JAIq~rXO&pf80LlznuSgQ*; zFxv6+3)jV9q@CR$CGqHet~TN2Ha+6kZ;$3PRY4CIkG|;_7ZYfWo>Ne*Fj0BPE2^qc z7&C`>?=6hgZuKFI3AUuRC*OCikBEyStq5OKkMcJ}-!2(Is!WbO zbPYvyxW>MGecKcGF51R|uJ5_7p)m4hv*THCr_&s0EEKZWS)63YIrcpNGmbdlY;cOQ zKef&OYirE6=7qdIQo5L>IeIaRCT5bYeBhaoHvO$$h=l) zlC)HwRbE+kbZL{*OIWF{n;WHy@?FMv;O&ABTMdWGyy-^lqKxHbea~Kc_+8_4T0s=| zI!8Fb1Df}o|1;J?BquzyyA-&8m9jdp-aV z;Yz==^I?04&BfE-*X8mH;8CpuU~Tm{bCgq;rlnG94Zjl#86^ z6AHP_GA7S4W&a#MT5xJ^`{xSjZljl^BqLE^B++@T>uePgBABSdf-SWl*C#2F7)NDO zEtzTE#SqTZ@48Uv_xGG($&@som}06?<+^nzSNjM6!6Mf(UL#*r#@&cE$>-v==1yU5{}spRHd7?vm_P~i^~I+*&LXq)lf3ggjsr~P}mc^ zo>kP1>Jlz*OJ$Gt6C_(a!}&@{;)a}jmmR(klh8ST&^r#yxt}CqSNuVEMh}#CY5tLl za!V7k+BA>pv(_kBZ_F5OzB5L5V_#GwIc|L-$J4*}nvOPSA8pv*hSHBLO|pkP-C`T_ zsI3D$1`YlC=T0i=Un}(Dh3#r4rHjkXFs+gjfl-x~%EX?N;Nb|V4W}Ubp*doT%uFLB~Bo4c~ojf~fcka-q2jZbsqGn2zy>0#k zTU>OmU9iXWdEh~%y$+8f-okMe-%c5E*wphyb=+3%U zGl4fm!FR7p!hEaCnCS@B%I zM?v-j!g3uK5}tpfP-r^kuwCEK)xNF`Ai7HUHQ3U(CL=2A{Ci8j0*!>n7d{O+0d{#0 zS%@xkL`G%Zgu_Bdr}`>ieo}LXsB>-bEearU6&o(x?I#VkNgD4Ab_m+);K~i`Bc~VA}}u08RLYY+WKpa&ALDvx|Uk6vP>@>=simrrMZPhZ>c; z%WYVS*fZ(DVl{IPV=T(r@LF)2LKT~Tx5{{F0k@U2Rsn9{)fsrq6Udn;dc3e zSMukDz`N-W79I-+VUz94>#-cA7CwltG~2`4%M)x_L>qR0Gi*|tDVn_rZMf>QsdDWD z_&eG~t*%ZfTFaEqDT@BwU&Y~$k32%zO_@7?I=uXnY6WO!tJ zKSqHT^2!L_8PS*7crkum5OUH)^Dp=gTH3;@*&sKZHGIWdaFm=;^X_G7K$H zQPHEMebp%Ey0IV6_#q3|W7dtu_8m7n-|!{)bA>Pr_)> zd%EjxNiW~joso!C_7qWa1hJa>)bC$6wR_%oVe?r=tQha79pdbq8m?I96$4@QH;Map zYsF5SSN{z8S*d^MI9qMvM&~0`Vc9K^JO3Zw5*jiALa@q$8?IrDi3bNoE|D={wth-c zn11N6h3)zE(v|L&>yimtnYs}l7&-fXaH;tTkN$$ z5kXs@&%DL8S>KJ0fsR;WOm^$3^72vQ*+TS21b=J57!N2I3${R;3lPaciiLzx2q(di z>oH+cZQeZrL|EuE)j#}csT1^k_JuuIZmE` zAVOdnH*5cZg7Z?pYZy)^cJrkFMk?fw*p0B zj=;^RQ)`J31zsEBaudwoZuG4wSeE+j8VH{O*L)@UNH-M`K@9mH`}*h_i4e#rAw4}o zCluGaO*PE*ICIIM0)0d}v~zau-0b$c*-3+A7G zlrYIsCYdB-F*UPDKNe*N{mAR2iQD*;Ze7zh(^xf6q{(5s#!dg9?*m7N2I#xtKXw%B zr@&+68{&&?vFZg8px!FcRk31xbppOJDyiMjw?6HwtZQ{~%{Bx2krD)6XdA-K9D+v4 zO)4)wA4W2QA2Yq-kaYl1N{7liuqV#HR*U zVzwF>?;zv~^YK5D>E}B^ZYR zSUYwv^nH*D3n9RVdhZNq|NTnff3J|K_LNvbb@H7vzWu-R_GT!R*0og7t^&7KA^X~` zfOVnT1FI`3mpK7a?2xMhrzD~?N)rEG*V)rbt%MOrn!$VQZ1euNW0~+gqwHZVF3&fh zt16(zu^dS}&aVd*-%+Q(%MXH|zg*BNJVBnYz05ljmo430ddTWu3Q8r*3BiV^*83c- zb?lLTa$7ho6onwfL#kC$>Jrl=K;&~$AEDbLB($u z>%96>-tQF2v{UQiA#^v@)w-MxbDlf*>#5y$ROtPh2f#EDz^L!on;x;&1la|gUopRK z`Ww~Vve>m47%owknG<8S_-I$J;-{g~|bbunMS;+NFw1Jt7w8`lXB18k~+FP0893meCnFUKw6 z)vi^xUmglP7$04~zJ3VWqQw!)@31_&60&^Xa=bM>ACD1j(4>@R9z}1t>>GIkynEcJ z8IST~X26L~W$d=CeUCp_3G&4#>ckylfFIFLoSU`iXgDa->t$r+3G!WMz9ZtIP4DiX zne8MSLfN0OX-?NE#suLET#EcSu{QYgdm)fe2l|Mw>MRbf^XQedTsKtV@(%(sZR6nu z!yrQz0d9+%W3eH&Vb=?P!pm7+zm2AlB9$b8KZ$Le1{2O$@Mi{!V##J#QeN43nqnaX zO@8jWy^XZkd!0=}0sDuglU+rCAF3bFW`ae0$}5! zCf%ihQGnrQNB$MV4f|D*50KnBz!$N8EP~>$bSlPGu+tvD4`+L)oiZ!!5MHi$4qM=oQTsCmtiFkj08rxCL~#k z2<8ZGQQ}z+-;^uss6gxtT(F=j({|5+%0kJ>vep}a*IXg)$ zpw2q|dN*;T3b4qpN$v8jSG&d)`!V4g}@PYXoO9+%rsw4@#uCl&)B28O8H;VKhnCcCYiid z`ciIbxFZtD@y!AajYbO~+f~c@5qdZ4rO=eE=$YPq3jXjFKdgbfb5T5C;Wb9gDQ#~& zBYQ(82JP3R`8)xRQpvZtx69mXV;;sfJUwh2dj>&3qW`Pu`29Jd)SK9E#A{Ck&zRC3 zP3L^K?YJDEP3q~#2>&9Yz+OMqe zTpaDLyzRlKWqn-r+-?pw81CzoItAJRmVB0z?EBtv|DOCiwldM3|k14p!l5YjA}K6LP&?_{Q-;OPXr z4Y4wKO&rDfsXOaFTVO5A73K6s;f%M#g<^*!kUT;>%$~RF_)69UQfZBmM&jH5&GMAd zeWbpB^CV^7Y5s{rE^klcp*%wmevM$|tH27o+bH-Kk#=);BEB3>++4F}?QzbMC%jYT z3fm=~d#`eaX4@7>TpPcLCOKOu3;S+myPu7l9O-DryJsc^Ryb~+$B9#|RVR^FQh(## zm{KU1S5(-hF(Hu05evzCW*n8{ZK#q;Schl19y6)>e2f#X8WjL5WcjoMsXX^ZkfhFj z4eXL=!ZR0uZ)&^ThWn`nTnHqD#{@{8i+{J*U&emeC-L=qcDtn!RUG)~=XaTcBHO~)w+{CkavDjoh8LC6VY2}U)`j0?I`lvv`}L<7&_=L!h45;IO%<(ddRIc zzSCVln(RmBx*g50dHfAQKbtz9SR#Z zI6IB}?;7vMfOBa$T73jv#93+f#-KNr#BipqX zw>a~BUB}hAR;ZB;q0dS+2HRRO725rcF-o$NPH1<0=&&fi#o8;qeNtX5WE(YSVN%Fa zqv<;x{i6v<6;h6g^-(B}a=2JBuqP*a}0gBVedFh zQE~Y#^1Az1-nroOMIvAR5{h0mC#?=GZx#}X>&7QNI%6yk#qx0UnmNHlMeo%U+4i=g z-)p-1&}X_OQ*Y}&6FsV5=r}fImP{jIRQYuec72x2j3qy%{hw?@Y#JXfHoi2@GroGh zQ^tOX-C8)S`e2YQCif&MZd35(5Zc2_+9zp4EI|(7CyTbn=n#Ric2Iw^$jJ#{2&*?h z^01Gc7$p*G8}d(G4L}~ItqI=&KUMzS4rv9veIm%hJeyt_F7Z6wXF%Yt@vnFkEKG0; z!QGdU{^v`+vgxa=P!F*0ANR9SeHea(?rE)WoY5f#D(tHh&dB|BcqsAf^*J7}qw`LG z#WMM;2`}=lF#ErlDSa&%9XUkLHq{z^ z96ajI?@;@2VWFKdc^e0nG`4Bgw5LP5yUR|!!}-SPMQ@i4QQqDDdVkjX#OLh9Gn_`! z)#?T02v`C36U`8EgAClAIW?J)^(4nUzsv?>ex(aGp}sV~{-@2=z99ExwmNU7$0zvX zBr$p}aA6U^7QRJszVPMvmj{Vj!U}c_nS6I?@T%iV=kvr(L&t?WfB+|{sh%KOaZ@T6 z+X3?|Lh7n&gxySM(6>eYOngKoLF>RpXi?pF#|g{l0&g~XA=KYYe_rvHvR`W{Hp?t( z1%A#eLlWX*hq-mS$4+wEwk z@)ipFg?Z`QNIF}Nu>3uDgiCf@@QB6ppVTP8sw!ZnbQ1syeK#mJ7}i-nD2N&@L_uls zWs!0gM$zo)HmP6-_XqZ9j9ev&=dUMhN<*=}^#F+<@e|A=Edr%L?YZlr8=4bWcyd=T zpF)j0XM)%a&Ec-N`*N}V+aDxDZt^4xcV4uJ6B5xI}r=V4Z9w-+RG?)eSRE55A9y(Bcu6zE9(`E71c)h5jIXS3C3i-%vnWlzO1 zd>aKK=GVO<`t%0T@fmYrU7^R2?xPS$E*u311m0BP(-SsPx&CpZKAn;vyN}?H&qK22 zf&U36-*;OR&aF{#SBAU%V|c?Hc`fqZ!Hx<1cZ_e3sa$upZ;xXfn%ABM*Bg$|;LhC0 zrq+PXE1c5{!209czsj7mruxA7WYX5B3|RNSh=`hp4p{ued7L|MfNwu25<>F(DPEbT z9$N~k)s}q@U-V8StzY;}F;aGDSdlD@XfrJ9yKOCJv0--0H=liP=}yaP^H;RR1* z-mBSMM0{sF+W#nwf@rQyGjOiR`Z|7x6MHF!48ZWf+Q#JXPxqC5?Bv;gU*mlnAi$l8 zS3hpTIy@%9HL%TDH-W^ly-&0jgHO|7ssom2Wy{Q+=B#(#f1E~Fj`OEv5)`%zj|jXf z>V#v+rLv=fgaFMxq1>kA^9*dJWmj3K8_W(qYiV&x{98=PXFmziw;tO%CY!{T7jnf~ zFEy|PWy@Q&NV5yyp2#zXQO_*13WisF{K`cpl8%P6D<7=BLG)n#W-VXFcH_}DbKgo8+|EV9!eM*kt`A2s>F=5De`lwWp$QJX-O%LD%G@M!u40i_ zeXF_H(E{313FcV4mALGP&CC;2EqqL@M-`|(l9|&^3 z79Ao#ul%&DY=q&SpuZaR9=nd%Tqr)TKyKOS$Na)bb@x?8$kBxa$sv6#lrmvK_Q);X z-v{kFjR<4rXG2%$LQAfPEgLQsHI}9QqWsw;;SxaSpoU1!-)wz5^nxe&g`>ghOKh~N8>2nDS_or@AnyUz>eydRQ<*kFRW7u zpV#*`C&8}-XFK7CyvkRcyqi?De>PaK?Awv@mbgMw6=Tc}pX$Brh9yJihtTs?Mne^f zi^@+=T_1>i5J`h|*lt9nfG;_9zQ3uW8riO1T0;M-1cg1C^*8Ho9UqV;_H|Y(GDtN( z3|Iv2S}!&qcd`@Ld)*-Ck!_Va=`Id`b7hbq$Qx|kz(C{5c_ob<%0ajB>?89Eq`vh2 zNUD^Ai3GiGR;*uJlSl!JWHAvQ^lZMXAK{ye6t&vd=)x2oGxf_~Gqvk`&%Q!mm6^-zko5wXZ&XigUUuSzDfeQ2g z71xsX|H_SXCffU+M?8KsJXCp&P?(S6l}QF#XLq_=t7MLwqNFi%=eVTauG7%j-qb@b z4kiAkz??Vqe`!%li`M&DWmz#66qSl&gqqF|bun3Dxh_k4|#RoS3_Fv^?gvU$2pKi34cWy4=5HvnsCVplKNVtlBo zze(#J3s)v-@kzlM_C>myvjF9896`ACQA0;HGjEq5&=h$H*?Kt2L2Xuz!nfgm_@`sq zKx@HTBRfeK>a1Nmy$~A4M;h4tT*;|}N5n^eT9G&v!`Qze^Zn|r>za+qyCSm1tw71HUzBZvQnvmDn;;KHf1y` zCt$Mdp!o958M|n;MU&F~b&xCiWQ(_rm#WX+i+(#dy_r7ciKMjR&=JHU5BQn5vUPQ4 zm>?-?x6I_yl0X}8;tD~uc}u`y+95JKMjG|fDb46T^WfU>@<8}(eitt%-}E2T#`@wv zrVZtPz#GltwYKM!+;O#eQFY}0uKzj~rF}746I^<4SP+H0h&E@3_456Jpq~CUv7b+k zFBi{Njk{hS?U9J@mO3N{?=H^ktWn|G)I~epVmBK^gp+Qsjt}bac^WnKj>c|!?b!VjRQ(!=tSqbmRVOI=c6(Z*HOAx3)+HDF|fNsav z2Y#D*C6^xXl}Kgt$Z;LTE|d^UMYo`)Ol_`n{9xdB*LZ!uiMfS zYpMy+`xRog%s_j-lg%D#zP6%Vf24{07stTgpWiavg5SBWr{SH?DWQ#xVt!ulH}^9? z_-$6{>0CyMi0{|a6Ra(lMCWHOQz8%1X?3?Uk`LiAwV6oI)g}>w8>y|B`Kext)w8u{U;;*WmAi=V$ zA)J(ecdphmYJBERbpy5#Mmjan_@|GCQOY8!N19;q-{wwhPgi__fYvE)N_(%f(p%p- zopFa*`F&wa8olPa$#S{=K-Bg9JT5pal?h&4*sR32_Z54sm=fL4pfn_>(8Ijh>rBg! z=IfjXU;C*Kmi;^W$)$&`V4Ymo*5t|2dq!7{yC8=MGv%XooTDXfur~J|M}PpOjnqx6 z9gkaz799J$evGcw+DJe&e-kiRFdyJv}eSp zlxTr*z{=L|ZX?OEsw%u}AIn|ZacAod(Mk-*(9d>j5VYGbdgEq!Dn_&R7-6?27dLH;!E4&DzdFArU>fB4TK{zub2{*@2~bduEKj|#3|lqQ>=sOq)BQvR>E zSHj-l#`eRFDK1=2-cYc-HdOHR=}^-G%Z8*fN$SYw@U>rZ#|7Vr0G3ouX=uYKo;4Bg z>ESGXEBT4}m~=@pS+`tUbCoY^RblfSJ9hR~sUe~25g%swTNvr{OQAKMpZ8D6sfDev zPa?8~*6|1p5{BX3qhsQ?kz41t!&EdWj4L7e7$SAd<=)dfm%G-an=^EvqFNfT9qHb# z-<^TqbWR0t^;oD4bl+4FZY1N@PwRmMXG#*gZVutqV3vkiC*BR05MIfeS0Y^W>&P_f zqVcg#?*$Tx&RAty-xB1J|8+Mt3yQRazQL}INP>1g&}Lg&+cnTzL4I1AeqPe18V!1q z^g#r8_|6|oRB;vDUZ1J&j*OiN^3yajZw_H@rp|j|fk?B1@1SoM>Fyy6Qho?U?X?Z( zSgvF}eK2T4?D$~eVzI?Z;x6+$|{6}YbYx$4rLq{S>3k%M0{mhGC zE5!G+m&maaExbY;HHdWrzb^oA_Y4up*%#Y+Hvj&059K!WxnF5&{fae$!7>nIn5F?6 zgbTr_d%*uD(Oete54s7NMeXYt*No`|endOI;QZDeyVTu-bNx5AOqh5V0Km3L=MJ9w z#I){0u&9^vzib9k zxeuXIIQG(GT{}_@wruhR&Y@xduD(+~68%OGLW<%qGPnK$0Kip&wu^rS{oVROjTWy$ zqmuXZ=!WvJe`ByD+M3Db4m9@X>YhYZ)>TRSdsM74Bs|^+`-o06k#reyd2)sigWQEm z9oi`HYw?45A>(^DI|2OP*Ln!ZW~OmwiT@^qgK;d)W{9-6Wf_yA3_eKc>wUo8i85ys zn^^jn#-0~TA?w~Z6=S}!%%KO(MS8qlkR27XSkIv6;{}lL^;7jE*%2gsi?oR`d-(Z$ zewU?L340Y3=?JB;0sJMe>su8Gi)!T%%Fq3xqvkv5((h)Inl)ib6w4p}PFwWqLX&XO z0@=#*HiCAgd)+F5!l%Jc+{i8iJ6rf;_}F2|qemRe3Fz6!6#LO(Uy8#3iU-+WF(jT# zzoted5T?fV5>JRw0!fZQ{VL@gM2#eV709_nJocw_&P#kjZDNn2qj*cL3a+`)POxJE zQ9dpDMHs8+|ChS>&oxvL;N3BH<6i42uu0=lAcI2VM2qixg33_-ggrkQ_%73#wDW%N z43@UXK>6aP3n1=@uZ#Sa>0M&xbfi%Ed&5d^+6SA{bsOod9Ha_oyL=ih{{Cdk?+uC^AQ-(*Bol*m_| zmGl#DwDH)vB1)fWPW~?Q($046#>;%4ogf$X)Wc_VA`fwiS*ZLyK%%pI?`=|9+-)y9 zA&w&T`QBK#pZUe@DvC_k2N63w?D|I8wT03SWTaYjGY=)ygfSm%5k**G-VcUUCE}ynC&cq zx=3Jz-xk3e(Ydls_aLwd60x(Vz*U>aF1w}EmDG;w!V0gJm#K!cEHPIgrthZ*diT8j z;0@-MY-kUfBJNa4G#z{DcqE-F9zESrs@i(U?Yy7vUCYgzrBFY~NqnCT@r!snEO_XF6%Aa8fbT#<)QMjs5Oz8eM!dVgBH^oqVf-SlzfD0{!^z23v$90(n z;1oFSP!6PGbmv$qd*Tj_R-l8vY{6wFD$?DJKRpC9X=Z-u>(Gi&m+7Zf$_YC3rl9+d z9|{cX?)bpS=crE;8~ZObG0o3xz1(tKg);O+&Ey+MY0R*H^Mf~U?!4sXCNcDD*@ zjoC%D{Oz%D(56AEpujg{On*okpE#l7J&R0xBZ_VN0TQ6<;Sb1^q79hz>?fQ{Smy0w0B$lHs^U*{Ep&iVz2lSpct|KoTcfGATWZ@n`jlH~1fYA?d!T-yI~{w@aqpr!|IGoa@^5Ug%NI?rbP|hKIUPK`p>lv`5$kE!zH<#Xq(k~N zIur+wnX!1rJ=N3?Ab5T!ob}4rNvG2g&tiQ^B6hF8>p|W5TgB;I(96Bn5#!$hi&X#Y zWxZ`q_7xEdn>iZPp>);IoY|{1<=0DHIIpR>t%FbvN5M^X{b{YLLtSg4-Hgx}B9y-`z? zc$t@tn!1O}PKacVKCG%zH4XFjcX`Ao>e=@R5Y(JI!Jk3|8#q}MTXC78aFbP2C0RNrOQyNWxYWo zg9GHX$`7CWgL>{zL3^%p6?eX6d0+q?g?A$qErbvK+~dd}UN(jgKS|5t%wENp78%yQ z=haUiA{Yt}3ets%xz`)YX4?tKWD~ z1oSU?{pIb3I^WU&7MgwoBMs(o{8u-^Ex>wNS~uTqd-!j z%RpCHrk)@Cf$7iq=blCM;=A-irgIveOtRZ|7k#87E-kY}YZBE;sJ!5FluRsKdKR^p zOK5Y<#}@khb0@Vxc>Z$F(P5s_Ru&YE~JwC-Dl)D~gqRByH zo~nGBD|x%h$fr3#(B=ueH5u%QL!V+!UEd&0ACf0L%S3eyLRcTh4QauD7UcZR6=7h$ zg1awdiX?Ix)JK*HaHb)7YpKr4Rl#h13=fFuNSE=Z3e*2$?meTL`nJANv4L~}DN-V$ z6zRQ#iV9K$M0yjDCS7_UiAWQqsC0!yx=QaokuF6dy%Xt#&=W#QNN)U}^Stl5<9Y5K z@3^1t2S&!u4r{M9*X(QV`D;89fq#9oh%n~ViWoFL6P4Y6$X_Zt!G-Z=JFA48G##@{ zn5Q%RE_YURQ++{Oa1l;TSF{~fxt2TZ%vS~Q!EvtL z#=SUV7t2uVX7~Qi9f)_+l>;$st|38swY8s0LPA83#>{mJ#$VB zkCO@VqM-PN0}G+KBhFr?N0vXBD>$hxbUV{;w{!`aCN@i}ybb-4w=Nm;8bJ6XWdiDd zcPuk6S6I#}SQc&EZ=uL%Kl9+EY{W~%(`$)(cg~AoYh(rYx)L!L#(ww51y+YOkiheL zXBwOOQfET2cc$koVwAT$F)^~t05q)!^;^!bJ5!BhhrJOjyWH{f5mV=v9nf>jF)A9# zkb$NRw9eZlXzIqeE6#;2nLo?Iy&oy4Q-xIxZEqJ4*$QW~Fmk(B^*fUz-bYjSfl}L# z{IxdnEZ|pO#=WhoSw>9g!`tvJi)Td*WsJ0i=Sy?#reeBd-xZ!`pHRG~Tyz-sIO^$4 zWp%6>U%kPEA&pop%=JL58{7cIY(CIg43n0exQq$bF`w}=WRs2ec2t+=pEBY@0!9yZ zL-<hOKDu=*RTHk7X^T%3?a@|S_-&Y4V+TV zXdtJF+Pk@TDa4^E!HJ=egjJhIcQx}%6gev{YE9w$62GKj%fx*<9VZl{D)x5CyJr>w zMv`h|`OeJtQ}rLK55)W!8S@_H zlb9=uc@0GG+_fOD1aOWuYO2jOT^QR@q?uvLx_qJMxZ`bHZo<6w;AFy?0JjD;$4*sr zG7ufXY;jO|+5?VrzCBo`%91WV)ssLMN448g6M6H?quyaDpq*5y!Oz&e0&%GU*9)~= zQmmf>pbQc3o>coA-^iJ}H=mEgsOIOog)(j(_Q#xIM;uUN&y=JzuHciBV&{>)9YY_6 zDcKAi@dB@YC;vZH8iraM@g|=dxiCkU6Ru~S6K@uOy>K@9(X|`MO)||Tj6DIi%-euDIVpg^gL7sB%0@h{{P@8_m-2Te^ z=fjcHxElW&=-`*o9q(~&)0OqhyZpCk5$)qbTDwIGyP7Mq2B-HIoZbcAUu+2O>1>aQ z_+#R8y@XH@7AqyNLjS+Y#z6H>(+2_sX0W;s^Z*FZf08TnW*+|LCoUv%>Lf0 zmfs#zA{pPE;-#3((@$zaEjkr?JiRV6g{LoOp zRY4ej_Dq!<{Icq*V+=v$(DZ1kr6QP`QXlRnliAOi3O#p$edu)yaHh-f#qxq-XV(W4 zelSot+q#|$Y!}KyQg5aKZyWu1pvU$S^78#a*C0e4a;{uLjcW3~gzl_MMoDT_&G9V{ z#h9sX4X5+pMj*oP9ZACM`L3L-NxOP3c>=(El7gEgQR9$?Sc?<3u`oVoDXg1l*A+D@ zB2e6U>abum;>8>ORFjbungLe(W1$$6`Ved;OEnZ=$J7@|bm;k-CFQo~mPw+}OY=4} zUP31#7o4aSVcS*3w-n@J{5GL#E)$QKc{H#fnJ?D8C3rS;L*rtxP`fT*IfUmD5 zRoCF-s8y5u{0?@s*%nRQ;62su9o0G1r^)@!FaZbK?WW2vLm`cxXj-;38)w0pEhST*(vZ(9v4zf-;G(8((MB~Cg9qQx57_*yAB=QP|KK}#`jG>IKMtnlYi-`RC=hwG~cWrMU@DB!7ryAD+gw?Qru-^?J3au zQ=Px}U{|BkhAUr*&**s2w1HXCl&Y=F%{cKluBuHLk5X%xuRYvX2`?MW(uP@FYQYfN z*V5tdr+-m@q&~j4MMqWX&~u%FcV*Gr#b0s*Q74%y>@I6|dgIAVe$z|<+4D7m}3qJL{+wfNgdiPl#7s9$!Rm$k&5NlH<>3H2cV@{tk z1>WAYp=U|HwoLA~kIgIo_()8T)r}LkioVE&aZS;AA+85YKA&5jG}C^t;mG`hKCkGi z%m*e-EaG~IGU^KG<~I(*$Zb^{&ui)oXHkJ4uQ(h}PZ{#40X}oO?oiLyy&Ca0At-eP z#Ha;;oQ07Kb?b*~Cz&%2l$NJeai8%Ob$@%FHW))d%td(4-lTJ4hCCIg`0t_UF4O(% z@m{s*`Guw$?-r)3_l2Pz+&;7klNKkXEth*Ts4wbt&RRtqvZ-DbY-e@X#>vIMdd1ng z8gT!;lcCBW;34we1R^ga%JEvf)p15K$3sI2tGHF~UUJz|rZMyA6^}R6u*_l_ZFlC7 zIpL)^*x~zkP#S9$?K3wqWP8&D-h(bcp3C{*JKgMecCr|m$OtSV++ul4k@=( zyLRI(w1|QmT(vm!cJe$~k@jajMjXQwO1Ron<;Zj4pTscpcLgI{_MD$!Ew>a`v!>#O zQ+nuy&R+4@EB*q{PY<4D!fzV%Kc>6sfP0}yX_zkOE}w-srvlSXs3 zQCz>RPv%-?IX9;L&INeQUTdyH=T!%~h7>tlb4ouKQBxh^*u-(uZ=A#}t-m{(ifWZ* zw+|r?)%_+%U(^4QEgvc?=SDamfZn60-UdwZOPW_}0fT&~x20 z2VX-1`zL8)-@@6KAXvN6QC9A6T+?tuAb}}D8w$R@S+{%HACvH=jY-Uvzd9=%%4zk@#^W_a7n%)Y z;cePKK0Wl$`q41qL8UgjdufA!liMrTe0b+I*h-d4qb%bhOqkf{eKWjZPdDdcW9eR` z)jsX*K;a9hirj=m)x*HMd0&t34FohwDN)C-d%7&<=Ttr4f8;jh^H#y^C64QyEfmZr z(_xm?^+aIZfQRW93`)avc$aCbNUCl@D&%P2?fDx%T94qCU8=bALPcl$-zWev-h$cN zSLv2x^dn!|&bS3WSQxDl2mq+ktw|b0cIzp0e2lh!zM1fVQ%&LA3`0&&PiYAJ1E+V( zj%?(YWq;P^U3<}$ufmx&qr%&nDlp2O5#!i$PM4f*XM%Y*Na6`)N9dc9$#9hR+`mp!Wk*6|f5w58HpWHep5 zDa%&m<-)(0_q3sUZwk)|t>uc5usJ_YooWB-kLR?{Iej2l;{h^0hF1^EA9hdW)?i%h z9{TDZ&D%8T2}coJ`5c{@A8MZeejoSS^*5c=i>U{hryb!I8tv2_#W8n#vN@;Pgjt_d z2uB?enSL~QJkh^1IMBpSwEH z({CLddw+{n*1;{Gs`+Gyi~DfrQe;e0Z1=L+-K{N#N)t5QzRI;4Of8pgDkeam->!I+ zmNgChN#W&H9G?=^r#nZ3%l$-=0sECm^_F{|;R4UKuxWdt@}GUS(Z$%}HZ z3wqp!R513M8xihKo`}j z5b=I)f_kFC`ZB*4djw=adFx?jw;9v!YcuSP(qAlZy<1qG&Ys=_m)w{d6=O?MjDKzJ zp{=)mpVgzgBl^_X_v>RNPY*8oX|MA)a?2DS+zF)jj?7J8uM|GN5wSDxSoD;9!aNZq z(p7JLh0BX*dB!B{4E1hgTqqOhLwwxJneo%*70CTMZ6)kkcUdM4p6s)G;p%oq`*nJe z`In3# zRFAb@acJs<%uqWLj_>LN?BAldsfXLb`SWIVY1|PP&FZq5M7fb~3ImIOyeaN!@7P>! zFWHgXbC;nuYp|l>=S^>K-hngEyUO2Uq>0Amet1s^7h7R`8&xXdaiiGuoaeV)>Xs71 zy}r(pKTB=*_DHsk_HAGZ|BPL8y2yDZ!u_Y>k`}XW(icULFI55iX5|$c_H3ebo8>WI zsr;CC{8?^>8~(6@vC!Lk7((V70vG&3E5C-xXlq zt>%x2HFgBKa`SsT^xg{y*4TNP^ zZi6MSsdw*Q$|Us7Nzz!Wuk?0-!d^lqWIzV^UF_it9d18_;0Wx;!Jmf#pI zrM!EtOK|1K>070@@%>T1GXwVGE$AMXIQ^+BjNV(14&x6Fyu-HEM)TonA2atK29XFm z3294*v6m2?I24ujGQO%+!>*QY!MgRrf=%-^JIWC^-N3=(*g>Liz(Yp1iorMP3uvQ1 zpU>}$%zg=(CA|L}dVV6d_{Zrv`*c_-&x@taRc1I){=vhwyLM}je-5e@tYi)J2Sfve z182}Fj3tqs&;2Z>(uVRul>yCiv2#eWpTfCIG!W8j`;ag?L zV*qE9(&mk0kx4IuXLrPC={~L{;ux<)oO2G3DUExrvpU1S4r~1meo%rtrqJa+ zAGK6a*!F|8TUW}GuL=JIU6qkdy6f2QZ2^EWc{o08_W{w1F-Th5r%_iuv9ydW*!Ihy zZfK*kR)9u~;Xuq+VHe=W+y%~N?5En@mB5~2Z}Ud2<(PtB%vG`(qJzSt|=VxcT>T~SUgP(TSnL-CxZcK{uDFAQ( z7`iP|Ij_iDe_Gf+QTW)XQtoOsr5i(1cb_MT8PoK_i}}H&^4R;RXG%4mte+bw-GR&) z_;3ReD+RX9Wpj$dAFAHJhcmnihNWqk@Ta`O-%pS+@3~kJq2sKc96w8ciS(_%<_Xk0 zJ2mDw{6>kB`*HeYP)KOE0;pC2ofg>GI_%w6sECHlwTajVcRk&Nmt%g{>5`-Fr5>nVyVi1bLTE+ng$?_Q zvd2!CY69{Wr59C3>Ut{OfCA<%lFvs3`4nJU6^8BXR;|MX4Fz*&(@!yKpKoYyAHU@L zeB34aB%z!1d9gb!dJq4!ck=2<(MMF(A6s9k?OJyYF@|@vsEA)p>-@LB(d6YT+_TuY zOv6a?g5JJ{(J}8}3cF|KZ1ZzObs7Ffak}R5?-@A@jx>7Z77CuXR)Jog5OqA?r{9rz z$rMRoeR$RNd}c{rirv-+8ml*Mg0wQ#tpRTmh4D&mvCkSm#@SvU3}hp`nQRxfdK@j2 z>veO`tL8A5rphM$a+^SC3!6^Ghg^wfkJZZgpaU(pZ6iVtrEN6yeyAhpp`%8%hli;3 z1V=|OV|ksJy+D9hstsVU6VCZ9Hl$o4=h{-RMS0cGr=#x$JbtCi@#dj%Z2B z4xh~3P4vm4@Y?DLhJ4nuA!2A~@Tb|4F8|KcYaegDNj+!$jP=s(&tIJFby$(Z_ih5O zM_Wfp+n366G};&lr2DW;22@JEZ<f5|6+B;`h4gNs) z%+U%h&qBCg%F*$-C2)J}#)JW9>9U>Xfz7Ys4J^rer~Q<9-3d8RSC0*^zdO4;dTp51!7%%k zaDlt87Vg>W&=^}%ELzoAhc#Nty@_RbG;30j8abLK_lSSUPV?LQjN+1#e>XGNB3y0u zaAw|20KKeWSPI2I-?egQ-rR0Pu+gmdA5<4Mj5e5M_KT!!e7k$Xi1i;c|5wmVV|vZa zjsNQxcxA-teI^RMzDjyhE^^ffdEXCZ6X__|xGyBi&5oGaGD)6yP(T6ZVbZP_;gU@5 zqd7g}s8@VDvR`>kG?t;1b8YHNoI6#5tl)t2iM)PH$j6jcnNhqaq0PigRlSy~`g!kJ z_YDPQxG*lWPEV=uX%B>#50~8cYwC-O3t(H@=x?#V6)nm`5);k@C+HRn=1+reju9U$ z(j%)r$L6YSX=mMauQ+S2I%XO>9;X`Jv#ps)P9o*Lj~>KVk%ZrOx|y;?c0|>a4-1A8~m?bgl$5NxUX0 z@FDKOho6nwf^X<-z8l@znHRnQE@?Qk5i%)=x|D;5#h`OsIe+)!|72sbLxA5q zt{tV0#Rbx^eQ*BS8vsqESJ+xz_ctmz5sQxqUW zNo&~8F4_FpY~fUC&ZL^^?bP0Ac{@olBveTVUn2baI`;Q?_iu08ur8pql6QjzTuxJT z@461s&xmg%OUauJ5US#rAk8^5SW(vozUCm-Yl)iSj-}BrIdU0qP~4ek;sHvkvPe7} zPHD(UzTz3FL@Dfw3v``)8Z6GH$oO1MywQwwq=nn* z5G~t#oWqM>OJ9TwvZ54oZTMnLul>a30nTGTj5A?ZP?{UA>~zlV%y~3@&&%FPGhJIF zr9jue0JhUyRm?}gRZQIh7P00J{H{8**;&CSoQmKXcg-0)jI{STp_uB8IOff0FVJ?W zWx!f*ceVbiaNtOE;dr890Ue7Rp=0|CZkW`1qZ>84sQCg*6*hQLu%_{^WY= zVOj2lhpW+Fm;33(2+)}O`{LDmEr!67Xk)>D3ito_vuQ5AVKdci760$E`sWDjSS#}X z4s!j^xBswdgi+x=%B22tsJ~^J{~G`6$c^EY|GN11cmMVA%>Dhp>r?*M&;RQd^LM$w zko5oYkpCFN^!hCz%YVDISl_;y0ROFlw#5h~{Zrohes73^@f!p%A8A|s@fYs*)oZ2^ zhw1j+QULSIXZquB9EnToR!DFo=E1PiB1htDrXRca4D>tNw}d zylRMa6>Bm;?IR@)Ti4-FEh~7lGImR6cP6V)HtfsaRkoY_j}&ZRF!~eDU4B=E={5m$ z~ z1@+%SLfHT3RdVFF~O@@1V3s7TbBiv>5{}3fn}< z{QsRn|6%f|JO3lm|KaZYX_w=m{~^!+OBg6zkgNOub$MS~|5kSYF7y}Lm=@$)r~^Oz zk8$6KHqMektXCQ&!S)&p58k-$joDriWSNU}#!#_dfp*fRyXxP1CI)Zl%F;Pr{xMSZ zEsnBfH$;zFS+86y&ReHQoPPKN3Dx7AL+fkgNYVETbu~B(%l3iog?2i|aDpbL;XfCo zL>&i(h`ryi1m760*`oY~8(+;^hk%>h&vx0DHxYl<$d=@au4An@C^?vwbXY-qohglt z!eHLl?i6lVK3qf3a(Tx=A5m4SJw(1b!V&-CdA}DD`QQ3uF3Hy%M?4$5zA@o1?f`MC%0#tah6EjYZyBW#4T{UnLg_wE?i=(K(dUM^w)-AqY)% z+eSVHQM$W$9qm*jH zaOEzNMqd0N2jWLJ;nNjGOjdsrdDlcZ1TGqo48G=Vfi*$aNt5RIt@%KgI}U!CmwqeZ zvtd^+JDUhS6sbI9{{cbiL=~rjfA{<`^l4`&Uzt(IZao^mBY-av1T?;am{K(g0P}d0 zrl(4Sq;OH_Gw+6Hki4wGW#!w1WgIbkm~YKum%I%up;_h2hS4CAb6(l z<a*eRTP>Ddf#49K=uTwl9N;O3tyXLsS_eY*ji3=k2W#dujQU0LACp-M&uv8#%YMVX7dzZ#oka~=zlHP=+;9TABYI>QAT6x08C3j2i{kZW~Kkn&k{eGkSR52E* zU-}3+!LS-6=tzS=PhjlRP(;>D_664F-Q< zveuq^c`~C7o3p5=30pdpio=qK%_g%5pGDCxA){kMHUuOj<(GoXu)uGn$N@gSEE&H5bi zDWU!PY}4XF^y1j%HYTG6T==9t@uAY8s$>A4N5%rcs=B}$2tA#NJEB!UAq2Bqk)(OW zOvku}$>Jee*R3YGxiL^=eL!}Kv*-MQg+<_C%S>`|u2tcBIfQQkn`F|_ypC0DP>AK$ zAmvuBXyrK7pnLYv6IE)29(#Pko3AS60w73Y#N!O;$ssqMR6s8Zf0 z3_ZHl#NEl|)8=+e7`$Ldt-ViV8lv%OE|}hRnG{hMg#fas#x+}nL=6kA z)wzMRzWOKGY7$;*?90}FG(_(WU;ef=P(S% zc0f-6sdeB<73buM-3*hnHn%P;)K0do&=o^?c^2P+tllD&9v=E58U^O&l);9!VY35$3-i0G^K8HA41oF#Gs^hVEm5~yp57J5xlTjsj#x>FNWtrd>V(7gII zhuI8hcKCc~{o!M(bLXDF+)RZ|bJG@=(S2UxzT(p&MCTo^AK>oQt4)=prK9MEof?lR5YnV07;>!WkijIz1VP~197r12jt;C(|3YKPD#>)Q zla3?ip%27g3BRitgF4Gqx92(8k6A|2!&DrPJZ+;Dxg4v;PRWyyZMfzBtB}2elun1T zRpRt)5`+Eh-tPQiMn+1!&r{+F%6pIm03|o>?zdA7B+Tw1hTykKZEDSx@Y#kjh&i9h z%Jo@B25QJ*lIKh$qXj3UDsjqldRA+G#J^kKo@v)U!1OI-l232fhbQo5Bk?=pyO?^u zMS3mjHBh-!(}%pb%3$3QqsM-$+Z{b4EG_^ylrE=G#Sd0tM~H|UwlXYb=nY?~_FXN; z4<;Fe3rM!?0G|OS`*$m(zTj2OB5bQF9*0ohbJT2~#xO$0w1&m%1dbBWsnWtJr zGAawq?R6nsPy?`&gVjYR>LI2Uq~`7L;=`##N)-XnActdN1ZYc~QIs4U`c+ZWv2?+q z8wJZqY@NsadDk(I@De9{%4{Ug3uSyRrG?89Y8!M#ro;T0pJ5gc~*6{qWA zLPc>HCEz_g+?nU0|6yd=BxypX1}47_Z#cvjAJ(|2vO7@(U8x$)9SgfY(Z-y7)>1PW zVR1u3{pQY5$JY9K$9a(Ag3yS^#gwQ{H&6vWL)U5G=LAO;nnoGnO{r#+m?YW20P+v>$=F??ilYovP2the;RvSdA%r|Rk9x;s)l`qi z1R#GdPsoKKe7x|gFV&E}_GgE_?U?lFLxc|mu|=Hz+@V#X`95bC5kAV@VGIc~KR#L^ zEdHuE!|a_5$@|}*E1y8t1LpRb7AqF2T&KKtwK_9)-F>uATJ4E#;}}%^+>s-S{ zYyv43V6vGh{45s_5Z}tN@05&H%|J>LjUCt^_@U_@&E!V_^t1}iH2GN_DTgD$w9xg` zLU|jYzwI-2eE1-1ieRCZyN_{jc7evB1=CHRgmDwpP|AI06S>D1&z<80P#7x2x(-kN z;=`zzO@i)lr%i9KKM6O%yR<7VabL?J!^GI%?wh6PQO?s_`FX<7UW?P3QJ!7>t%juo zq#XA%1a2;8>9f6c=S0RttiK&X$>s=W*b%QN!JtX>!c-}-?7hwJNW-K%LwIxAjE_cg z7W0C))5}CjWIx0R*52Fx>cZai=NX?&wbna4RU6;;+}0~f2L`gFs$kRHK#1SVmIqvw zgRr`Khn?AsXh1NDR!!2SS`lDxf0l7D`;?+2rfre6q}fpav$(oN5THdv?LA;UexxRh zQDL6>$u8USA}MWgKGeYmt}x>4>75gaP?8A?;TacK-#tC-0x)&$Mkm{nYj&#QCJn#? z^>5(4bw>mb9)l*Fr)_@mR+ZcwzAJEX<){Hg5l|H%LLdXv4h{YlOei);tn$ij&rRH&cQA6wB*fimYF>nImZ za}`aGe}wB)9f0DIWP7vkIz=TEBcCIq0!d7)=sP)jOjN2@dLx@8b%(rlC%hsRTx4zl zJ0q&K9$K-{l?tC|41yPK7rJV^Y$Ra$L+6txO~W*owgD+9QLFEE)L7LgI2*-6jK_Wh zWZu?(Tul#xd*MKl=V3jh1|s=|9b+(f=Y8ez45b67mKkuT-a~1BvsW~^TUk^0Q6m0? zixp|2W;QLq7l3g!$AqnYvY(fh-rQ~CU9b|$EW<4zCL){BS)`*C^vXnY{M9e3Uf z2o@ztYBjmOTJd;aCNKdw{6 zku*pHgyxD~%Wvj~1mLO4@JI3%bPy9jBu75u$pW_z0hlHc$Bvl8<-N+y4+hg1oz`U? zvF+t1`W)1~2dbb8-n;g+D>n1@iV{s>2wbWgpFwyq3Z$Hb3>1H#OLf z@j1^l4<&sHHpU!Q+6K4~px3^1YYqZe7wZ;RE|ob=PtDE-G2SNy61wZomRJx&;NQ<) z0#?GI!hBx>vZl$kX^%dvjRp)1zW5Ywi#{EFRa@H1WQ;t>kKg_Y;I0inckbLLXNpsU zNl#qNQ)DCiHV{J%KLc!7pFqj`z90qKLK|RE7h=aAtTRO(;I1K4tFKS&v>2%SOmr)1 zO%S(c7YmNF?)%-+63PJY7p!0h1$Aq246$2eW9xx_J>;?Z z{W*Vrc}_)xVldg4_c;Sm$c-0E{?GM#m6dzK;9f)x0a4Qi9MOHL@QeHmC~x5;M$tt; zWY+RH%ZE)vQxanP)4qk`C=sjD8%viFhn>Fr-aa(cLFpX+J%?qzAJH;>$mp+?M9SSp z1~dkvHN8=N>~acP{FsyOk`K-+v)&neL^YoxCTqWde_D)7@L4KGk>`;?a|bUPcT&%0 zeD*TzoR&lT5Qag9j~=8!f=t^oK9ltkL5F=>U~qkElDidft=k!#$OaAy(4`=~!=CcU4zhNy5JaO2&THzZ4l`Yi==Xs^0VqD(YtIiNuS$AA2^T?J07 zcd_yQDH4+3n*|Ym`x@#Pu~vl#(UY+Y9-2_{79s~V@O{ER*!}aUNAZpF5`UWmnEdwk zOTcW==WsL^#5`2X;0rSU|PfoXwrUhUgiJVRB48 zyY}=UdOD{#75AmfxeL+NCjlki5aO^?d%IudJw26Gq-v;*4Cr%G=c*+ND^IVcPSTw_ zch^6WvJEixQ4s4&gJQI7@SSwpD$X`s4qc~dvYK@WYwp&`Zq5RHb!?UHUB1{7*&}FT z7!nc#h%IJV+GJ!G#nwv|*-E}5{g(U5J! z6IU5_S~MA%5q-wgc87q$f(OJ}hlg3n2=awVHq>5|f44>s#49XCM19%5KoYf^=zs{W zL%rYGaXNkUgg93`E6K16!HiUrP*8f0guh^%F`(A+RnOXccB_dH_Rbl%19=z+j3wym&Q!uG46BA%$Rus|Ndfbir?g{aAa3Rdxx-R_gB60C}CVD@s8 z%GTHX4*1EDHc>d~0wYaqEnJgtW{w0&JGM$mX7{25s@1@XtgSHTn{L?+AYCk155Ph>-K-=s|j z2ycKVN7CV$ib3+=7{lGqaoiI2nV_JxY}@td20l>GF*rPOrBJ)G0SWTKAMf}OLyp^- zB)^A8E>nb)X?M0lU51}zN-`wxy=a7El?`J_hZ&vGy-2SLOd-SK$ipyaSf~G*GfXrA z7hZ%74Ztq1Z?8c37l5U&l&4PtbRNlK@RLb!&0fyp0O}>g#cW(=nJj5Y)CAE~c-nBW zZ?||%p|L31k|kF+akU#f;bVn4t_^K{sZe8$H?o^M%d&kxQ$Q4>bF$*R*t=gb2C(N& z%5EqHSy#+ar0~L$8+2&>YhW^l(GD1-NnPg1wzbCK(NU}d^Sh==hq2|b`+d|{-cq_m z@Sr!aM^BHOl58ORkEdOGx}7*Rg*>$tU!pC~fM<8{Coiz7`2`0bUY#7O?9Uv%qL{S& z>dEnUbTG8?zJ@b+XK5XggG*9$fl)WO4RbA?LcEfHi?vqS`hj7m3+QS5FHLXfV_l5v z=t=Nd>)z=MiKl(&)kkFfXUGFr`;X3RfBiCJinTonSY2kO%g%Xn{6OhzVCk}S!uoAe zLhCYAuLh>NkFPbi33$4D^mrWEIp?p4C+SxZPflzav7$l^2!vGy*}j=zz8Eul<@;khaXF>u|1NoGxOsc8IipMKyV)nJ4b?pd={9^_*jvh z@I_F@nXMUL_i8uHL6m8x1RJYb<{y5>wOHl@^tY%z)?4(4P1pFKElFp)G4`6nVTpC{ z7gAoA=X` zw~;~%RTMqi@hs5>Sgn=y0zLhawCW_fI#P4T9c>9k6kG0y+zxv;LCHAO$e>j|zLACO zWKm&$9xc;;bwHD`DU!YVb>`c)yQ_>>p!D5sdRhUeOymH0FJTp}ziWS@BpxgC|J%g*3fGei(0%oJxPpF*G^lAq z&M(JQAqo+%P;NX#EBmKHO^R{Zmb%C_W8ltID%4X{*YJA+2<;yA_gBukNZxlN{%gYO z#ZS=6HL1{F`M9|%5%p=aROmA7EBtrg0fEmdtO~QW zY0$Fes>K7=8jOFkrY-xw7dyjR(72XT@hv%`L;0n=6G-3H|g2_Y_=Sskx!BWNXq1&e1A(xFEc^t(II zjG&rs*;-xkaRfjc$LqmLWrM?Xj znZP2%<7pRI3R+lQkxXo^#8tL66KqRxo*>lRNm@#$^${0XO~|y!`$CF@I^-Y{l*T)E{WqH+y)b|>9r&^wIxssw3YHYe+oyOl07gO35Fan#laNTmOH z#iO$(XZovxf8qL??`ZMDZ~rG0#*rx;@n>&Skj55012#{%h!_6lubLtKG$>QKjm1gK z&)*|hif#O4f-lQ%P@$wg^>(h?glm96$5UYcJ8Rpp`6DZy2@PpNJaXF@*z@YNnp$^V zoqcwI>0373J_rWUJ@$@7_C3=@{?a7(`YtXh9&TZOuCDlFI#FVug!N*b71E%eeGtN8 z-;Xc6bC||_O

=Bst~<+GOz7TCWnvrxmkb%}c7vDjGKJC45^>i=CVZ6E_7i$~zUV zQ_NrFIu6QO=vt%SjLUYeFc@s5WX8+uEDin&^^a0nfx`7sOh?}}pZXqp3H1`~qCv|_ zh|>0!UIz#KxM}ZOJ_k+%fob&}`Xw2dZd@BUaKXWO{Ifh=5PJlirTe0sWCxj3RlH@Y&7^@_#YKG9D>KHjDz zP1QG|7YjPX-QID1%jVgOdC~gNw>8HL-&S*6xg(BtF+rbD4mQG$+73TSZ+sf`|M6Ng zbK_{HYJK)#G6{PJIloh(d9xH45_NTZww*#kixB8DONj=b&vW2J4asmhKI{e56qup{ z#u8GY)=>IMP>3B`tu7zunNIN@YWC~mvJ|ua;aib^@offI;;Y*+RUo=GxR2!j7vdZLev8}Uc^;zmrzVFTPgXJKeUSb1TSY7Wc9q4JaD zGSXd#nGl=g)0UQwq7IMVfim9Fw7;e$h#{mbiFBmN3-3a<;A{N;7cfAe}k2Gq3M`4hNsePZvK zVQ38@ucSlrPW<4;HxEM*eeO}!8CmwqF!rJ>MIZO$MV}JAq<%%bp^ak6qdUJ|pe;>* zv|-;I=rsRY>_G-RiU^cBHtUd#P2}Lvj_&afvA&=k_M{Fs_cwbr01*@x6LIuyZ@>Y>rc&=WUfChykAx^H;uLWt?H;e*)lh85780O zZqhHuh5yawgZ;=>s2X$4f>X`!q8iy*Oy4Dz!@W!s_#oEZCrldhzn7Up4KZB!xe3+eH>1kV(qShheN#;GQW+~Z2H51+M)HH#HYEO zyk58Nw$|e%#KJ5>+tkNI)y-or7%B^uk`|D(4b){OK#e;5R7Y*iB9>Li1UOM8?@7#m!%&a^81MF!VJE78I$-k zVM%2)^gC@WHR7q5$+EaV0YPQ5AM;BrEHb1>7y02)XuTS_&GFl$PjmGvE>6wPL)V=3 zPkCnO>E5q@S^l}jNqOxHJ~bJjjc4*mjT(zHCS5hG=-YJ$s|jo@cZKbB@0U|vnI0L? z!VlA0+NVZ;&3EAk)V@M0S>tIR690_isr>q@c~uIFJ-m8z|9T(KC$iEe$)ABr72Nm9>Q((0}#9WPbPsxSDz1*$Sq5J9i=sFea1&eGnA?)hg}0H@xt|Vq0Yc!{kg*DJ5T_Vq8cKw>%%Wk zLy9*!P5evmziJ_f=il_EcpQa_*1;$bzvCx%j)@jPJbOxhTN4Wuk?RU)MOfaEvVvL# zzjR=8B47qWaAmnC`>BAU;U?54WpfC&k{C5EIFsbA8Ab=KIeK!p_+EJSFuq>lZ;;~IU}Bo= zC#l`gqS@rjO(mc}_R$+tzXSJ)+{n8f&MUYyh@SjVt@)*1Q~UBqJR@TShhv@yX4%$V z+b(15R5HEL0Fiq|c{|N~lz`ZIsvZAkSq_yV0AwgNqZA*WWRolY#|6z z$YFE&T}6Hw~}g}wwZcixB3Tu6^P_+ZQ0ZkI5zv{n{S!!xf^6~yhl|<(r+C39Vh(oKqZF)o#Y|?;71_1s%UAju1eO@-)geyUP);AlD z2j=j@hjEk~4{E2$)E4NY2B)KM=QjHt>??qu04w%5UcXBItPrj+ZmI{Pv;CU`*xOyT z<>yo^SfBf2V&G1};W+-u^XH=pIj^R<4j9(*26vbYpPUL09>529hF-4Fi%UYxGiGX* z(*wBph`k&WpqV;8)0BNmn>{}6?WM(ql!qN6ITMgAO7-ugWuy{sak(r)YM>4;zs)LM zrmK7;8e|^WisfSWwjqsmx^pUN+~5))Rw_z8ob#KDD!^&dWNY-Sr4%Hu8bFsk2Ow&Y zt|4(O>E<`g2F$O*1IdZwO%L9Fc!zW={hBj^55T5PK10|<4e`KsmsK3s)}sU#n-^HV zm_f=BhwU$~5V(tD&V6Q+lm01cGsVE+2HxBVEj_Kmj+8wAgsX2>nv+*k4F!?nVBwsb3WV?@yNYM_n) z2TAX#qa;@ykM66Z!2*!5^%D9=`waoyhhQPFSf6}7RuU&I-y35#=P z8$%4DMbg3Z76hw(FH>7)@~Xo>dZ~6XD|86G+`~AMECC5mCfC@Em?zdiXfs)=xNF^k znFw5EwV;SPry=O4@qHc`9; z)fCzlg?~KXy0o#{J5(=Y216fhLDFE+zFL!mUo4vw>tv>#T6J+{HWfpVlKbFr^2rNL z7LNSX`D>h?COyyZcF@l8vyU}Ba$x@gTH-OUFv4f7?;L(W* z$_ddg{Jzp)Jb4FCBaGMr10=fhihr{cNso{vT_(5oMn8Y-Q~(ptpf2Alz4K{@jO`*nnfRd) zBr8H%>*8?vP|mA}tHLKyKJXVM15&3;oqd2{{{ z@W4zIOnG^O&`s+M3R&mNr4Ij{iv^~Aa#|L2aT8tejNvob`uI@m4u;1qGNeJOIO4dLpxO3kSBNX+PPH@XZY92cYApzLiWuXj zX1HD-ge`c&IUDmB*iHD;2#O6hL>!U_lLRI)446cHBr~vb(EcYVu8h;ddvb4hw1V_Z znUZ0Nu$7M0O4g)s;?b}OZ{>Cc%G*4tm22_ge2DYZV_RQ`c-AEblxR;Ig$I?67nd`~ zefu7FUCCW{%X(ILg8#Y_FLh1P`>9hyr7rGg1P?K?+0s5KIME;&?d_(Eq(M(Stwu*L zP3<<;ZEc%$eLTUEdltsrKH1yuy8`K^H0*$AB!-&X6z57et3c7jyLOelop87TF;$5l?&*0A1@c^HF9IOhCL#bl^{(ki>atjtHK zo#6&Mw+e6Us8;Hxjk0Dl5Es<}_o_={;YxK7k#B(J>w4e{(N zLuo-Vz(7^1Q#HPyCV8}Rk6_XOLNj`QiX(u^+=5a!))far(o43iUpasCo&$#vP?5vW z4mq&z(ng#7;VPpzrq`Hzb7^)GzP{uzd;#xEIGXXhjRTl|$eU1&`~IeMQ!gw4*9^X7 zX*&*N5AL69@!QmFe-E$Y2Voi7f2jvjcrp0%fe?Lq;s}DI)VWBQjD4b&U@kxk@bQ^& z|I!NFD6M|*e5(Uh)A+Z-^(|x}Zd~YgLK`r(RBhg!d$*Di2x_r68yx zupbm`_8krGU1O8;zpM=zfZ*562+_NnIe8*^K8JZpCb-SjQq5ycQ(a_o78 zkoqgX@X=zVTd2x-OGK387(85e+%NstxJ(?Xj32{EH2n$jlexW?+O2Lg}i5zA}2N`T9Ip;cM(y;W|LV3 zG&)GRR+P^kKc?Z(Xaxem`ZW;$TcE(6UpSkN_}ktvR?{bDdWS)%T){)Y)&W3 zqEAMXV<<;anyX%+Eru$MY#K2J8M|O+Y1l5v=Rg|&Qy3`|A(OnGRQ4%yS7LH@3(Cus zGJLj%Jt3iYhQJxbE&zkfpZv!p()lu^$YNRsMY(I~vj$@P$=Z)4%<;vRQdB^tO_#yJtXg*qvznKVUbp{SDgWWv}bZ$uGh6U|BOKx zMi4?!=y1tP0Iq~OT%XnwVeNZd;w8s^CA23U_7WnkEp2NRnNVnd#$XJ!Zk-Rx z`~}3MSz;n2ORxJ5fgj{4)~Lud6bx8Unt0Xl0%809~y$E22bbsy8<(|-vv(x95) zmE*mal*>TKR5gz3(^IYb$+c!Cu_v|eJ zDMF$3w+GgAe(#A;Gv$}KuhY*5c(|$3M4{2EAYdF@QqsfQ`E@T7Ab?IZhl z+r&(`PXIXuSRK;si*;Vdziyg$c=^q4>||d!`hu*wx6x#9$;wEEkV?2&Gc^TI<4ba9 zIBOmux}c2oVOyhUeP`Rn5T)I+C7RyQK>+blrPp&+6CP}Jxj&I;rjeoYgH+}?viuY}eHhb@Yg2H?p<0V)+F0DjcXGrC z@qy8xtQw4G)-xL^1WZrR>QtubyeDPaL_Y5t<)rMV(n-v{gTJhYvwhlF0^M}gs*JvB z@<@;pHK-voXz(wXSSg_~)17wiJt#=--Cv?K#92o^gf@N7DC)~?W9c9#jpo_Oe!5m) zLZ)HCfaT=+yWE=QhJ{)e$W|uhwBUJ(dO%}aAUzKlBkB&kPQod;saCgz5rcyIEr-0oFyCX9VZ5b%EE|+4QF?XE8gQX$(=83b~27T|&Gac6^miaQ+=;6Be~f*XFmf zp`Gmss{Dk+DJp($EpJVl+6}I5!>`0~&|y6jqfGXj38p|`GVbA=tgI#^DQ0a=#}-q^ z@L52tGh3M9a)zz?^sm!ic9nB~lZ%}WK0O2#BU3Y2&Yyz05awMINTvUvpfjzDYq#t> z@_IT9TDr}ipBsDv#Wnog53Sh4)kj-R5LgD&d~L!aiQl}J>4$m zr;KEeD6hJOcQhTGL&@2AQcCq)=19{_GLagS0}y4AzW_&(vLLj# zusL!NHIczL!VRlVBD-x5ZdnN&7?Y{wu55)VpGbkRq|lX2CAqmH zRNTV_sS;XC!_fyKa;T|5dYChQS~bT>PB!2Z?O||yZ7lKWN9@qx2tN)-?cDJ5i>!MespJ1|P4;2@$3H;Qh%qlkB)JlyEZ<5BLST%DXg83ak)Iks}9IWg)=% z1YGgX?TH6Y<6-W@e#*U6D;Q~oP{Y`E3O>i1IVnm;vF=Obtb z(-BXSra_{%-SnJk1Ql!785PuAml4ppTU4RY*3yoCtv45vFty1Sy`1m6JJk}yu$n+c z6k8ubL8mm(dNbeEpv8gm`r+A zynk5|ywg)uGbu*%($_Tq=PDI7f`J!UB$^|o(C-43_-C#sAC1~GQ63-e;4ITmYyB>A zz%ZgJ+=g@s{wOu;DtyJ*Z1)SnuvI~)NlfaVWPiyGwu!9Y!PDlD9#fAoAEOUp+uhZ3 z4kO1T^U8inCWsf=F|Nu-@j18mcnd7F%!B&T_>F52S)h7om>CK+n0&oe$WMhn%~p>I zcrS64;dyb$W}@lFv(sK4S{ho&*IR_8R;l@$sf)F9^A;hwKN9acqM0jEj0QnXSp+6- zsoZ}mxEL!_Ek*`Q#Qv%=qC>$4ybHJjnd1tRvcR`*MeS}b+qOD&&$DH?EEof4Kx zw06LxxRqC_bZ&*ZvI)BONtszDIqkl)dNzXOOdk`C2Q_#5)8iXm;Ox47(y6oz4dg3H znJ0C>RLOg{>hB~Ob-tw@%`46uYAV4f$xY!S?`Rvc)DFc&dhV!YPWe$*19HSBz+DfafbUj=(EMzS?r-%ozq^{+gyx z#yp+kon`qpQ!{T5qquz7`#W$j!3}|0p_$sU@m$OOVb8?;oA3CJ7P$NZ{a611mo@DW z<`boE8_=~f*&ln&OjEOG+kY^&>yQP+mOb7;O;L30(5x8VU@PUUs$0F_zKJM2vXeqoPrwWaqTPj1S)kDwOw43-=Zc&lz~n&mK-93 z)?2((3NQ@3{H~fq2zva6_VGgy1>$U2BYSRH`Tlqq1E}l;Jpu;h7r`lYdq<>);*Oj>s zWHH{wpAwd1ubmOe#uYkyjQ~N1UFD{&B4%Yb?q&CDr^__kTKfZ_nlcHiiivDSUPdX=5I|yY;nu z;jwH~K~ic0Ka!ciz@!ves533iqb6)+&)YC&knXCl{ zLE4qY!nd{0(N&(~>nT@^_mR=Nz&$wgIz<>#f1_HF@)wK{MHb>PA5cy-DAVn*%_93m5wql~Yz?e$9hZbmPtzNy9{9KP=`a$i*^Y0>yHc%6u7m8g9iob_ud5j!=dhYU zD*}a1@X$@(+XlbsUE32Raa#}9@E)oee^t)V8UOgI)Fo(V#=N5TMl0!4!PYVW*zvWnPi8Z49 zmSI|P--67(qGj;67tfz%BEZUVhkh})0LC4?x!l}6cbxUyE3SZ7_bT>E@!-|N+W%S~ z92)@a7<+-4`BvzsX~V3THq{e}X~(kW^Sq-649<9QAfZv@Qu0DhK-bu^7tN0=HsDI7 z9Fu_%reKRh@!ex3s9;3S?*?gn`RwVP8PB@FLMOn~#Z~Z#;c~Jy2cJ{6gWO&X^B%#S z-Aj{$ue&_RKwP1A`FMUhD?8y$Tx7%;6*#Nn<;f+8x_XoQ$H^r>BHi>lrWh^08nlx2MMTe~Be2n}NLpUsSe}itIWqDNkzj*n z2@<2QaXH7R%6oVE!{B9qIzLYZlakZ^PSw%7x%$=T3Teop^iZ=HS3UD{ED7QIK;8Bz z#<~}%>0~cn8*-uNNQb}5t`K)5cpMa{e#vM`hYm^?c*|xX;bln{A+KSn*IfhkLR2D? zN~iYq?;-teIdcG8-d@qq(`Z>^#+%=fte+l853E(#Vm0>Q>n(p<p_ov$~fVV=3qU)8l*3b;;0k@7SrT_DTnMkSH>u)WXOM}$Svyi42lAJAFVZ1m|Pe~-HnB&v(ktLvan zkI4U0|Du%%E{`Uu&40Qr3|PHUw(+E4bjQMbV=lx1qxelQJtx!BqtDE&%8btkiB~X` z{_#*o;?4}#cmJiO`Uc9<;4qO!JW_>9OPo|v&O%)i$ zXbs9U1XGP0wS#f@=1vMA!aI9-C;}ZbOLwU?J#TqUi_r;|FSXV! zA(MKhUKYg9wv6YUBhroZ8NQW;@Q#V3zYeC48VA|(V5-U*_S&eybuSK{rnF_vU$Ith1-$m5lQBc}mmz|Y%wgZvKCzJM`p`jg=yYO%8}OuHyl{UF zdVun**vw4LzbM&7=^Z{1A*#+Y6pNM5l0IAwAN1@Zhfv5lzZ8q|%~kITaSWU1$9L*I zrR_Z_n_XQsSk5lY>g18VYyIFVoPiK42sBon`MX`+pUUzrANNkxmm=6Dg|QX|ocLuI z+MFcH0qzj`k!t9|87f}dZu9co$nu@gUi^#O1WIH}b!eTYq)yxk>16i~znH#kGIbb` z$tD68Rx*fVk0JJH8LtSg#Vo&c&m@o4`RU2u3A-xesl_zy{XNiacD9g+v#0forW)!}gS%)4;(PE5?G`+M}Y-B%^QK9Bh@nw5N4`Ixlg=4mP6Gx8n5 z4S4y*ZoHIWwkex{bHO6m3|g$dCi@muF;i?}rfD<4MXD-hf{_LVx$4{Cx;4X3w<}!tI^7c(A!?;h6Qp`J~lz!M0=Ag3t)d zms!0I>kRJCih%P2aeX3yCqTG%^yOv(66f1Q@} zv%yabbVjXHPn?Ffj?`k~+pp79<8WE)$VEk!S+q8rMdJ)2NhwvRh>lx+4y%#BaiX@? zh5AM)GICq_n7WAb{Y0O9O$fqlD@%j#6mf?vg}+*Br)(gt6a_J27H{PV*0cPTo|Z=~ z-(%Tci=JFVc8vF@)FBsqqV1%!8B{k1F^oiU$HD@YmYmUfVim(!%j%2{ABwI^ilUfM z15AU4_Ez}eNnKpq5?bxNorT%2RCb;r8e$7JWPwWD80_;2Im!`{d&YXa(8ME18WyWd zq`++OPGWL$tq1g*wppwFSOc0=`c100!Ma$SgN2uN%lqH3dhw|nK_O_ww6SceF3D76 zG-&4`u=4x7U9belaAGo63Nqm#akTF=kG z1vTONwk;f1eAn}jX|Qge!uT*F3qMVa1RuAKs!OKMiNuj|s^xaoWCjlwVCtGrtSGMy z5XPFGuhuj~$1KP~vTQy5a%#OI4E@#HuwMEW;+v_iO(>-4j2Q0BkdY2tb9D#H$sG&f6H0!%JPl4J+EFtgE^URpZ}|;7CviudIY@_OS1h`nAyb=Ei0B1XbarJVvr9g)`ZhqC|=WaovY@m zR3tls8gxQ6+0}1su^l-lDWaAc`ir17ALm+Ao#dNQ17$;oA6I5a z7Y%ZFX;K;!Qkl6JfoAAoO*NUPHmtu)j<7F|H;P9rwExsq?yxhfQAks{s5ulfox*8r zz)`)IRO~C+_{c>A8^0)%9%@q45(HB*6%o8%Sv0#{Oi0gC`Kq4T<3WJ8VRftjz_0WX z?4!dw#hOBvaD`4U=NrxI%|A!2E>`59Q&^QH zRR2|y_lFq&zkY=6-fDaC>1T5dMxf!9yJmmAMW6OiF;a}Q@BcE_hs_8?-}u9*aj+6o zM}nKDTebMtUU{QHx6-!t*|n7|KwnyPYYBYbhmwIDU!m*_8Fo&aK_XiYm-E2_&ckv9 zs%x_`9Gt{t=XMq+)$Ym7pd?t-(5vm{-8X^rSdzW+E_FI*$R;T2lo`h5JsMSAJ`rFf zzN$+S%&5*1CoiqS&jt!&`w2}bznjew-9<6@`Vh^4j;-@q{F>8OJH35(*JfQ$1hQUk zo~3T3!)~@P6KH=!kXC69nN&=9#D%xi!rIBw#aij=l8Ai5v~`RA1?qHRl;&~OGb=5- z7;ZHH0M4tx_V$p*CxQnLbxW-m3SFb@3@?{iBwh=TV04!Jeut-}qWO*N@n^hxEzL_?R+3JFN^`MOz!ZrDI)9&$7$qH2hu1PhSV7YL-jWs zniP|^r5s>>9kq9)vwZ0wAqY6p`JJKaaacpM3u$jC=o5M92s=ITjHi{JiewC8?U*vy zb$MY;jrH5xTcVva{UWY5w;$z1;&?T&@=>_pPM_y0sY4dB%4JO| zHo?Y8=^5C{)vG*69Vq+){4W_x&W;nNbCzZ>?KaEjjJ4Bpkwb>KKqF5z#?+NgZ+AHQ zx)YtPxr^bv+dU6XK3ty&XX5MY(W_xo!I?a@t4(K;qy5^l>{kHIyo`~TXSpc8HGwFu z8+dSm(L5L(ay#74qjgSy2x=QOUKL>lAsT+5fsGgWW(?Il(A7v#A(E*`T+m2{W~M{o zsjabzb#UcY1{F!G*xt$N>+hag*TZ>2U(Kq%TfYc7M8DQPyLu=N8Q>pTGFOm|j?@cJ ziuOb^w@@SNA70Gu=M6qRLyASlUy3XKj<;)yN(C_<-ZWSfk_0RL|tc>Zl+Z z|1*i?sn_6Ol+cS(5S$7v-?xX?!i8hs;_pi1CL+NQFN2sex_IOUv?36JcpWR19$$8) z968rNFj-^MJrox{k!I)V_m+Le9Dav%IkS25aVV#f>4#5Nkj z7W6a)wIm^hR%Z+lgb55)lZ=P^YMV#O%m@BqS3q;i`Lc~0i`-ws?Ay5xVZleeUg&#%aEm>g=w=CE2G2a_6}O#raB=l1qRDI<4Q2oNP5sp zR3iX>cFh&rc2dI(`ukaHn=^FlumqdQik3F6W+vnUR3bGuD z7VOZH{y8Za;mwwE|H{6$+*2S}go&1#gk?fsXM^~@Y^_%>-JTa|oO}HM;UQk$hm?AP zH;V)j1uV2(lKfZ8bZGMl87sW};H@i4E*BJaaZFn?zUQSH*hHP`tdt~2Xq1lwX^e=V ziqgC{6fd{Tm4j$H0`jrdU{l8Py&|`60P;N!1kjzWRR>tH!L%il4bv)=(JE@aRyw;)>QpjhmWw3_zh z$m)~(Y9s182B>S(X2=gUS0#$?erg0aqhOdDvFk`u8^zbxv>UD0ipZe*`?7KjO*9Vf zWLiyR8I4?dK+mZP@THH!;2p`yVMnEKMlJ6zOrHCiQ*z_uHM0v#{oXJMP5W>m#?e-8 zvKEZ9?%?#~`nzKv#Q#k2U>udqTg7aORLN1QQcy}}wF^a=RyTS2EnIWgN zr2A8;uSJX{Wzt&-mq-njP+Y`r>j7KPJgd^LswD@B$JDgz`%yH1yo^D^3n%53> zLFSG4OD(zjFqDjjl6&~Usv_>uAL&82sLlx4`U(pBIi2r$pP#rGIm;;7k*a7W3(;;q z_^NC{F1?GFNUWAh4&kiz9954+M$U&I`f1!`H^{dR4~*ZziA#h#4F?W(juTBp%`%KV zuAkv8))_HTgjt7XV38Z+e_t3hJM9O~*^ud*?xB^%*FTzb2hI0h=i8Is%r+l29V=9S zlF4r(sG|x_EhE)<{|3UD+n?Nk=Yql+_yRK3J1B2+D{20v|SiG&6hyM zJYD{~TbDB@&|f*A@9}ajv0ZdLa-Cctv9F0gG*zbP;?fLMB?JOK%UX?E8AxAuUg^7> z*EQ>UzT35PVvOB7HnJ=?*`DlmR&{@+e|Uebff>OZ*6#M)-AI>e^qj2BQ!x+1PkXG-;dgso4btONG~6+kf5IJx^(lT$KZuX*U)OJ>D6N0mDosdW^ZuQ~5; zPeuqbYS13{%~1QWUQC$Jlk@9W!YfQ4+)w>e6U|ajz2sX#VoH zGV93%W))vQbO(1MXSASduTg_*XlD6AEHUNn18bXkGMTZ3JCV1v>mK^C{K0_64LU!x z=ZRrkiD`t-5pJFUrqi-gd*jMk9)eFwc2#-JMBFb5Mgkq9h$i2;aX=yRntNLphaJ)# zc8Q)Qvg^ir?yD~S`8x>vVA96i{;I8cPB8TIqnZaF%jkd(xO(GqC)KkPH#Y#qM6`Cj z>%+G?UCcF9a=+wJ%k+AV)yc{O!JWtXev$jF6Cn|tzPrs-Z}^rP*6bfk2RPB+Dp=V+ zHd1ksk!h;9!T}7uGOTrN3SVSTj)Y0Cyfh z^+#j8kV|&}a69}aleG}Rc>;i6yEW`PVSQLX; zpiRQBdQG*^x`KodS&$~efsi0U&v0(t%#}LIEvglYGX9A-rAw3DMq<)v%pn_b)-(M8 zK#j)r9JK`xI9>JYPcI&=a&@kg$sm185<9;(r(4PH0(ZQXl}j)SD<)YP*k3l!sDc;Q zGxPVWa;3KLttL0R$Lnu+zg`ENFab6G3Vamng4KqtCCcTtc+#N)aWUtM)=^cuF9)R0 zBvl4soaD$Os|tR*{&W@mJG`wMf+%a1n)tVc9F%;kLbQfKx!1nJJfvUo2OY7W^gEap z<|Rx4)BD9*1wN8Uw|uw0*#070F;+<{vqF%XoB4{q(kxF-Ha~)qZwZ3sciy!u*|N=* zoi#XL0!37-AMaxiAUbIz-mPz{MC$!23^BAkzuRaMOm+PNPMCY?JMVH=1^kL0PqSl; z4gA9cYrSAV>KRS>JQNP&brrM z^|YPtlhV#4AWx?6pc>aVkXzY8G-jxIMh=}dvo#Ju`~;vcM)b&M7t;p-dBXRd**%+5 zJ5babWrvW}{OLJTS%qf8l5P)PyGhE-I<=BCdjLL$q34@9Y_tn@31DcHh+zv;S}6HC zt=Lyul|+P$JkiAkYC;)iS>rN0BjDI4?jZfT0}j2o0MB;&fS0#W47*}c&eS`Cx;|H) zK0qRO`d?R$Gp6Ur3Qr^j-yQuFF0h%*9G^hCseU(t4~w%+=~m5y9%2BLhs!NWTq4v} z+ol6w4kZ~kBAU0Abyrdgbg|I>)L70*7Ii&}*>UFxwKsKLt@R^^vD)q@Tq4&w&n3+TV~xJtMi zrsZ++6Xe>H{@ys#3prQ@G@P58`Tm_J{rcxix^wQy}xeiVk?DBI` za55qTk&)!F@j6oc0EqkzHGzCJZomlkB6c#zAd z0Z1~Zm?`iRILD#>asBBc_5HQ|WS@?3ezAfqIr+`KdTIX?7JY{e|Cww4puiKo-bRTz z;}BuA&v>}B6@3ec>z@0s%~3`X0Li^q0Gjg8CL%Bc|6eJ@|Mx78{}6Ne|KMj8s+jGO zJsOTfRc(QcKg>?Vo)NM-Wsonw@+sfB`e?HG04Z%K!i}<;$0FtlohUzpn~Un;vZ9lT zvd2)x3@!x@5N+Rs*#?}sfY&r(&#u&lPtuVW;)e@x9gWI{x1(C_TQ&Rd%+@r^FBA`k zJaq*Gq@7I+F<&S%a``*`?9Slc6%t(O{GGeYbI%gqClsmT9C!ucD=RfK8^N{wP#iDD zj^A8PO=*05bDh|UMsL|tukNq+>#N|~fJNmHrg7EJb8ON3eyr;qIzJZ66MW7%tZ7DN zX*RY#ngfV)bwM;F%^6jBm?op96h5ECEA|Yqus^7E?hC>^1}+4;VY3i)x4X-PTMYo4DbBhD(cZ_o-zmd#mxsg(?%eGcnFKI*;aYm!L3=$_V%9kGyqT%zZ z-Ag}hqNz#kDs$4awUCyh{f)w8thslyiCcQOKo@sCb05(jkM&v?1UMX8F|uVm0c*Ee zP;H^1;m~ct}E_)o6ckA4o-XIsfb6d)ut+6 zky>H6rys)D383@b6$+i%Xb_GGP~KAdNc0`sG7z1c(Rs8+UYXh+Wc1}_vPr=7k}I>tXTM_bDh7u zgh5-f2;-;}WO{ql?V(15zNPKC(NUROX_)<=aq$KBv&YQ*PqF?L_<--d5LIn1Ic*F- zE-}>=M@BmpE>4HH2YWO(s>4$C^Og={Lr9JOo2vmrwrjq)?S1jDa@j-gFM%GKYL&?i zpWzm+G1=>?u;HMcd!EPqDe$fpfBYa%aIUy&bj!@mQGY>rtz8)cs8HC<{tBfG@9luA zO-R~{sXE)R-fD|^yrAMa8ks$A6aGJah=JtVB+wy&O1+@kRTmgeVm39<7rbN1sZF+k zSoOi{i<_-^$z6Tgeq(9Mj$0N M2Dhqi+u7f8xOoe2G(9lXl@1E)31kW*T#MSN5(C)Wh{ax#{ z&M`tmyUdgj7E*H2*_yqX^k|vz+urK+7j^aZgzFD(-g~3OeC_dLmeLX-r3bjvO&_jd z1bm{Vn0+=o`-%Pf@GY$~q^t9a)vguN3bFHU9@%QgR$h*~+px=9&b!NIt=5gxzIb)m z|8?uiXen&^U$23uFSCTv?*02^R*vg>|9&+r*Dso0o^OueeqG6yD@7+i8AXE`2SieG z2v;ZKE}eH($G^YxE@SQ5)kyuXTRg!v<}Qa8yC+ff!Mia}ks%Q|(}LAm*ZFBeZMau*@(;f(p&MGay6-(N$ssU=0jz^By=(uvq? z=ZILm&?T3GGUB9U*NC>M?f&a9Xb;eQ?mdag&k;A`g#3Fvo>BathvOj{`oE6+PC6Lv zuYbLYW@MpHA@wM<`lAmcy}M4g?SMEYlSW@cgu;Pu>{3flYGEmwpPz)0-;;>tPdngR z-}^3it;RiJ#37;D%f5(?BSI{nrM8mq{Jg)3j^|%8BSIksEsDrI3I^8{AYL`o&*jk6 zpBzzhc_iN3k!z=a_*bBy>mW+!w(l|%ojRd&Y**ekIiEF4_)q$NuKwhx3D3>tvj}Sn zr|GAiChae>-JfqHctvEcL*Z(YrPHgh_;CJ0mP=pbKAP|`9&w{!2t|Vn7UqEbOLEr4 z!y+>Lfz+7eHC!CzfMjjSigV!PVYYZL_vY-vU094_8T-bH%j~jvCr&@#hT8n(9+P-) z9VT4sU!(FZCKp|gl&&f&XZnIlU)^3!G2#>NVQ~^_#VJtmsM;4VmsVa|Fe0EOy1e;Udu|fyLZ|baE98@@+h_Y3gwJB!YIzprxpsf61#7J~t)-j9KlVQrBm4HOg&dN(2TkEaM_xCh>|(>jflBAb~)229@W zeOcP#7Xr&hf^Cib{f_40Ci!Y>B$4^>RKj0zB}q3a#6ovv5?srP-0s;qoNBZLDV1g! zp>^8!IrT|Vo|Dp5AJQC)_!)OwxtVpNChm1Bl&5oW*nGbUlN#Mlt;h1ReO&Kc*tVl- z8eEH~lM}J1JVzjvjDhBQ$4j0?(-imYUkk5ml<@>DE@0S^!aX*WoSrt6qn$Tgc}fx< zgRO2DXmF`PyO$lRW=P{FvK$k@idD!m&|;4lSu%Rv&LEA#WJC$lCSt@HxbZ@~Ona8g z_+3aWyBUT1cqm1h9US?NKR>Q>Q$o!Jy1Z7IyQdBW znnnh)V4v!i`Malj!sS|83Ua-MzhqU(NxID8zp20UtaY*nCWyERd#RLMWl?Mo< zLg3bWa^i5&*+R?0C*| z9+exWw2`2u3G83HpXLtIZhNSGN%F-j)(_5nRPPO4tZXLuR|;Acca7p-cLuu)})!ly|d%^w5A)g4KskojjI)o?Xq zrL?8;k*~&jF|ATInOtntP)$t-9Pvb`g!xht@O`&_CadO>VU#=8z3X_|dxv;9#q$Fr zUyu=WgC>wV*=ay9#W&X6=tD$9CiFqOWr|5~ZMKl8`Eu(|oJwK4rRt7|z|crFF@aHH z(|=`@u3p9sw745nVV9}Vc1NAJmPb2PVe13Mv3Kdb9tCon_AR_$7a=pYeqQR$5Oa)s ztFSbx!W3`&dwb+nMN4y$fzW3jmtS`KVMP|OWM8caO_&(b-2np`iH_1xycjR4Y(dN9 z2WM&Ca-K8r(qh4QnAq{P$Gw&auXgjW7-V`>O&E*FC%QxyG!$K!I(qPA3C!vP7UrYaub-tKf>*644bK}>vrY%(s-%ivLBu<^WvY;*ws3_#!T>6+14#? z-XDyClRQ#CLeCj&{i`Go+Ai#lvc)Ja&hR0k$d-!ONXyznmh2kbQ<(>!#U83tlt~*x z$TNR_cuY=jEdj=20zHv@XFeGorx-JpOwsVh6+%z3%|hvRG95B2180-zJ^dg(IGZSxOGe8V1PKd4M?Mu&HCjzkbW zC~gv1ygrxYOrs;bcSl6Uj4}MNriP){@b(1XY$*}Z^3rB>Ut`kAm&~NZLlB1I1WJ#t za#B{6OaeAtRjH`L9hkCOOOQ%6h+KPm!JQ_4_}}IFTf6b`&xd8M2$Rs_v3yln8z$~j zV+v9|waZ10Z_n3ZdrH{?p7Wf)4#~V28!=T0f%V3-;f6GK1QRZgsp?kFK^q)*X4F** z)WX9!eK2Zgc5nQelZEIY0W?adT>@?{hboz$*J@>ySfMJTZHBp#4Zu@F-7aGo`A2=&^LLbP}PvhjZLLyjcc zzI>jmnQ;d!IO@{r6%9igkr>E^>Hq~uP<%&6INm1#NxH|;(+<^s#(j+6QGBr)(v~S>u3W|_N?4_KieT^c%uQ}C*Du1C2PJGS)BdM!a~Yr?gw0rHN;p~O;A9e@J}S7F>=Vu z%PZvC8M_|Unl5Ljib`clf@01p8}gK!oRqZX-li^5QxrR7PWsMcTBG1VUw?n8WFE)$ z_22dH9xkoIWMn&9IYL;G-CViV{bd5=I1*V(d|BSyic`4f&# z#wU&yQhI4p7)QCN!Y5wamj=!k=E2;4%S>-Syxm-z=ZLkV+h_V3(x zH4NuQwm;974--g9xOWE%+75zriSE{tEV$sW;1Z}o%Dt~?NYkFmOR@UIV~6FqJxhpY zYDCsT;qD6wm>t(icIw#>sGw_;ItX2_e|33=zg zi+ACN)5a*xWSMck>)Yu%bP;))hpZBW=s{F3y6yyjc@9t?QL9kWH7}A8y`V zf-yB!{K3>T+B5v$l6aTzor#N_b+?k@DPViph`GNAoMoB6x^5TS@lA1;9RnPd3B*YH zkE5cP8pBI9L)nMz5T2OWP68?(5N1k5Qtt0{lE88msrpU{Zj5{p zLa#lVg7mqF#&cPxR6xdMEk<*mk83+8<2NZ)Sj}qCsyfY4@e>j;bcPVIwN93s#$sS8 z&Z$DJ1In(TrA|NLZ;+n$h~Ix@u!Xmrc}gN53x|g`IQZdei7Ok~yp3%nW|0StwHx!08eXKkEhYR;d~wi%L6i{2o&q zVl}JkPa-7avfq(Ooq4+#K4&ru%&qTlzi|E8JelA;%M7_En<$9jKxZ?my zhZkxYPrcI3v4z#)_$ph%Vi*c*lf2IMI(=QUWD;Z2vZIr@?Grr9SBFrMBjg*iABiH+?w);PDKd=>nSyx zX`kea`zIRP6T97!R8mN**#holkL3B4?NXIi|4?QG-+mWa1Vs=cr6_B4+PW#Zq*2HR zBYyq8T`bpu+9pdi;{8!xdgtnU9c;B!9Qy`G@9k~d*jtvnO_xF~9#XN49G!j9Oek4Y zeV^obr9t~0Ho2?BpG(@8z#*fCoT;_XG#|-=^U7{dRmT=LUQFFkTQ74ISY^?oBohl^ z->qM?(%fx8$d=zfKPxkaWf*pDE<>Nc?yc#swiu%gMTu8S3Faf-&eX{3cpfTm68(xC zUz}^q<^flDhyNy%uu*guYjEL1F@q-s&-7iTGz=xKQaH=>s)pe^YXhg=$YU~ZO~Y zSwfHIJ=nBTJa^P{m1@h3`Vz*Z$G^mD)!IoU!rvNAlzg@8Byx^hA2IC>^YOo*sIP66 zJmuJHV+ST9s=*Zzr?0&`Q;X=e(QrtdcU>iNT@2=uejs_2L%m7F(n|1UZ#_G;2Um_y zU*<6gis-hs7bF=fUtW6UD(A=GS5;b!N#4PuF$fNP#H90zfWyKlm^+$Ilks`7)9yv* zjoZg*>g6U8yv|l^1wu>&XK66Ca+AXNtUTrX6wjsv?Y1Aq#RtT#frAYGTkShXXX)lHfpu3Z z5q=1@x*WNf7h94RK$p~j{?-vn^L$h|7_;SBRvgE4g4 z#a4-hDuoGF?xVI0i$%@CzvAIG!*#u39CsZ9&Vj+MTaZ@@-*5Ivs9g-7sNo0FkM|}d zd|oU!!4EO6#r2+hjm;KgZ!Z`VS**N&>bTLzgHvw!zOq6}%Hsetkav5FXEw5=Ux1%U2eWb66HMasVbY|FxN>ZpXNK`fsiqAnJinzd3#gM?3*yutzQo_ z5u(kZ6d`HKNCiP&L%~r+^ z=Uf(pOOsqGgQ^t3f2!37hlYHof4UNA7-{9 z=j@B6FBY-cLa%}<^iWmT(|AR_(!%)FGk=U0=~MxJeb1(IPPjBS<#wnJK~ES!F?qwDDR^!me#t^u{fghPB z6Z0OiNyXCz?Dw7YdWo`Jb72pFqmpO1uFbEM_~M3P8ss#P1a zxAf0wYj{u&`P!C>0?H6AP_Trf^60+T21%%WmxPaIR3Jm*-j)MY^5bIK6ss2RyMC=r zKxphSZa+yMe;~EO*j}nL^czq*=_43oIaWGQBRJk3#T*fh6}P@lcoNqoI&bM3#dqMu z@W(+S-H+jMEw%9UpkgQ#xb6@b%!z|(({&udgJ9()OCarRwrCZIAE2s5r z0y9*4eHb$sQCW?Jwf2U9{Yx_;!87?5OQvTo-jaYGaq{gwtHmfa zL^5qXgw^Y37~*R{Kd~c0ynZ4C-x-VY7tDUS_7H8+ug2S1V(Tjd;J*6ban!&1t$V(9 z|87GC=pN8|VgW1NdXJUmd|!?o5EjA(ovoDUDQMsoS^X**q6*ZM$NKsanNu8A?sBE; zwx4;wd$h>cjm!n8gdWDJUg-c`3WwzM)d)<@?)DwEg$bwCzCWlJ^hTQdiFl2AnG7S? z*Hj7qQs~+^6ec_>)~#l2=d;+=F)b#@(|iA6I7dGHkr0t_PmILyh%ofzP}-WxV!CRZ z^4&K=xnA5 zaK&nDCM+i5-BaZT7tC^|JjrNUN@gLXDI!b8B%#`&DPJYu+@vxRmIp zbv_F!xxP%E=J2{2`q`|c#jj8Ca9jzrwQNt}K}oh34_0MC{lHPrPv>wl59DtcBd}wl zmy^eYr3?_*GdT@dgz_Kc0I8515}9&xw}zt~8eqUdo~DHh)SbA(a%rzFY8KuViL>yg z!qSWuL{wOSq^hKv$|`PEL_naE<*78}w@QSDwlJIqtv8dS1QJL@s`ts{4IeWb;dHv9 zFytJeft#OgW;2=-6ARD$+v<7BL@sODy^X2L{CKhT!mKXwRiDw7-V_EZxfJ$R0$}lkNd0r$&n&KibonhLNLrH__cBX1gn`%5hHdb|4J2E0%Vkc0OnQ*yh!G@ zRp6%{Mh*)&b1R3%sKaNm?m%2BBUIUP*7)5_p?hO_Dp&M_(y|zX#_Y{IrV4+oZS&XW zJWd-EEbW|4sFelZ3izBd0f(g-95V7Q-n!{r_JV(F%l37wVyS_M>qd9B(SB4etHZ<~ z`8CnTev-A)Mm00$&W~6CrDWNItHvF!eNWa`NrhYKjud2lJEg?-)T~hoySsX?xQSoT zMZx`?+w07igEB(U+Y3TXg9QheNgE#L4vS@qWHarL)9-stAe=E(^)~TASi0jo_-`gJ zE_mac3ysriDvtAycN{TFF8!}?)ZwUfCp&_IFR3yzGv4kLM>fNZK z-l;B4Kb%iMdxYhZqfz;Z57Em8f7;CAeq;%>i(>r#7>2~r^6QKQxmn^u@09_3LN`T!6^sl3mZ zJ(#~@V4FV(uS?r|oTW;U>G&>&?$;$}kX+Ymc!ZoM4xFxsU)4-gFHAb6Ap$8$pU3QG z&y`D8ms`q6q?w3Pe2rlg+*YTl!rIgGr2?y=gEYb>kzGA+DS(y|fe5F;k*^ADGu?mv z)cdGu)Lkj?b3{)6t~h)JN>1;sj>)7TQl^b4GlGnCCNw`6&|xfi%CNVZEVp1w2bv9# z(~2bzhXf;Y571|%-__CyoQl}4yB1N7ywO>fufbN2S8mnNMl@p(Y@Bo#;vIQxpIuNY ztUqb@pU#k)0t+u5k3cK-~>vyMO zVPV;ywl-Wwt)|Ky9(F8nNq-3(M*Gk%^(1~E4{$Qc?WxL4opU!F{CJTci;Kp9K4ewn zSg+Y>``}b?VLMMRoVYDVUz8bj8*Ji|62gnQuHBdPAps&Zm0!>!mTOD|$7%55c|Etv zLH1m&%rd211rfWYF8#TYh3D4Qs^)TkEyH4~JA{vR1)phFSvsChl^Xi5JHD>Pz^xfR zL~c*3PF2(@=(ullOg6X%Nr+`$yM>&wmwRQ+(KC%g=ZE9rV$}dB^#vcUqgYh)`s8UbEg({Tr#q;N>35mG?^;FOHPmxyp!M)XWp?Cl@LD_*F=oyAC}g z?UR#9VCN7rxq*A_KLclU55z*I(38Y$NslCi*cN$9xj0CT*sVqE;zB-;8y=Rw4Qbnv zO!p7zvW&>==8xEn7m3(JMT6PTjYyxi=|+uubRTZ9cApRPbbF1*;;5HqichrLnl0Xc z8+lyb33NO55;D!xRSMPA_z1*zL2}4Q3eJ=0t4rI|0tw z+6J8_33vy8FOLGQvsqA*=FeJ=m{K5kMNfFnT`m*}iQ;iem;Gb$Vv~slM*)=uJ8y(o zuFh$lHky{(U05Az68!XXz%^8oupE#2&9{T&uqi2@yIO?xOga^6VAKTJ3R0W)d+2bl zv&*LN(b#*e;lGM?|GDrSBAxN(YYVGk$Gz%l{U%D8lh^m3+F6a+FPXREwPfz zhZo8)F%$eud(R~4?lP33qZCdmB0U&#w2%hX@ZPY?v3H10h(}qYVIe~SGqlUHu;!T0SV8K_dtp0GkUvUQx z&q&3VB^S$WzanmFS%A-^T~~3iGdq0`l78Yy2&cLs#r}3m`UJUa{V{SA6xn+u0xc|Z zijYr{7&w;GD-8pg*D&5rRfO}oCSlu7*E!~6cKr0i$ew^^C>3gm%soBJ!qk(HMVD(l zKhj(u&5h(}H$U2%wEMPk{uyJ@VRuD->_qW`X&ldr?dUAbLVU3o3F2i3tZWNq9ZXC6vSJneZ=x9G?cA#cpT+p zTcB;8@PuJyOP+#FqvlzuDh}3@T-EFlOrGJFIkon&;CjZAt680bU#;zVIA#Z9(3XA~JJsafgt>y*mcWs33|r|lnTXn>D`w~4%-No< zN3!99)_Ym5nX(0N_eDlG; zf5fztBsQYI_oLlpf{=(uiwvOZs*W~GBtT!F(XUdh75|{^%ld4I5IUPyxrq!u>ymaP zJYl7-_~hiGes`&A+KTNo&4F;dSa%n3MmuQedC>K+)7DWSNmg+Fw0VwI|I8(x$1$%{ zFX8hQB$|XyyOPMeuhFP9)Zhz%lzawiiphjB^S<_%icWIP!;P_mIg<|9L}^pJUIvrD zCk;%sK>YTXJcZ0W59Dk$t8vdGw$zLBpRL%LagXCNU?X}&;~u-kH}5`)TX>E|3O-ks zE5>*8cZz;?0H#^K7ap&369QPSoPiTVMMnc(y=P+*zE^e|(WJ3V?ZK7Ez8ZUJ_JQO2 zWAFX2q;p`!u}mQNxnE&Q!2iTenw8Mnr}T&H)3AwT8t<;ZscX$sGixeCFQUi?E?@a8 zW?Wa3DUV;fTe~3oxQyp7&R6)~E)-ou?@Q#0>`&%}MXOdtr-=k5th1DsVqSYt6hp5= zdr8b~@R8$Kgow{UE$eg$;d?a2VzclJ)G(=6uP=cTo0y{I;67DpZS8h2h<0PUPZ<4e zgl40M$g5qFsW-Yv_r(q@lbI~&h#9(9A|nK74DdK-jS9=~K`DO>w8En_s?Rs?;`MxQ z^)F<>^2ntq)U4)g)dvZwkfYC0_s~&fv4e6#nCOMgo5qukP2YDIx~tegAg=;)juoVL z5?ywgRyhL%8Rlj${lRguc74ZF)jo8B2N|tEowp@?fb-b{FUK$Bpc1|N;IAlJ<(>mk z#S*=1Y%=^q*`d9OTwGtpsAQ0!;TMlOD4s>Y03Mev=?DD1&*cmIU#mca`k19<--{~ObztozEw3v% z;sWj19>9OBb}hub4%4##OG~9jbHdY&4maA+f-T1KdJIDaO+H>VDV%3r{Xc{L2DiuY zn}~0>u!tw?ty4eavx&M19)F?NZJcqV3dc|>P=|I9*bmz#?_i&60SP0Xn5kkl0kMkf zjvD{&eR-}*DVIVYDsYk`op9iPD4V97uhIilib9s~#m-QwgAWFYg5Hf!1su8v?2lqf zEhkwa^lu3)-()+z#m)J`jwX)&emJceZ;CLOLASAC7&OEvaHSLpX=UxA$v2h&^D3 zxWtVnMM=5uN&uuZ67~7`MWCR&)|D5a=6rLx<%k=n-Z-W$wdsYo&0UzbQW0c>L6=dgDQC&TSSH3YoYgKXKs4VDAq(4PR zxD%dAXmm}h<{=(r^)z1Hh_icWQ8SQwu?ugfO&B(*dm`QoSBL*iV1YW$1d1k;^Ng+k z`b{zPw>oa?6ju`X;ct)TFzz+xZz8k}X3F4)+%aMC6NlAw+vh92)y@)U=BCxBzpnc~ z|98g&>}k*@E(`D5;QaY_nQm;fTcu~t*(f(Q>eWZShfk~$Z*bI%+JWt>( z;5GlSRb`0yXy186O$|ad{0xPVQd5h=^ir=dD{VNM%Ku}F?4rK$4Gk|o;0FhVX8A30 zdcI-cb&#&mQsdJiKWgCk8@8aKg~i0h-37h?(~pLRhQ_;d(Ea5Sre)9^k3_$9KjF%P z3~pU7e)~- z^G^3VHGfy6e|)ya;Q<=DR@)Cb;)pff)Cl_#3@Hz-&m52c@sa;Ld?zJ!<&0iuz24V9I{()QprNt;e_iut&tmrR7_aa+v13xXj;h_di8?b-$#5Wh5yeOU?dDY$otXeNtX z)msqJWh=jwb~LmMuIqY#{|K7a5qpgYx^@~*6N5S^h&4WmOEWW}z|Q_1FniVi_y!Hw zU;bGnVHYiuG1SD?SpUt)FS9t0gN0UhrI?Ux-agOM)Ev9L2BH_&6tj!wi?qbP_R)|)^lR&Mm0IM zmpovn;pOQh5%!An%+PN}(6Z3KNB0>&NLznj&_Y>sVIMB#ZORj*=`2PgxwF@vP2ePJ z>t3xumg*l|_44G|KL^}c0$sO^9XfuaqK$aMNJeHF7$f7G)DveQ7k>urRp>vbJ2vxY z8b|MZ+*ngW)7-FLJQy{K1~o^>)y9^q+q3_XDs0q0QO~!XK}%fgP@6$_6SF0RxmQ=e zCxSj)PY_e1o(|6+f;RWh(?Vl?BkWScZZYwa*z@=~KJ&t3{IiZ{2m9IoF{t5-IT zE7xDbA3F`B+&}Y04WCFVyEmA4R&UR*sez}~0Khh#-MrJ)iY-WAJ!2OXMXxMbX5421 zT~rfu@m=bU6r)wjp;p(<`aPE4mIMChB~LUxNo)!qn@VhI?D}ymJ<}`$kMjm?C(7!1 zxBMt-d95q$rRg(18R!=(>$ugXxVW-}KSNi?iHGKa}uM1_4UK`Ia2UI1?bSA-ug}RcQnTYKKFC4JF;VK3>#ss;`R>J}U zZliXOz3mRxSRk~2PBOV9g5p!BX6x_g;4Ul|%gZnfbvg_?@157{LJbN7U${*F07|XD z?|dR5K|#25Bcc$&ixb`ym4t5_yDmie060^^KxW)<3b)f=^;c$k8 zp*g%F_iEUIQ*r5FeWc9okRYDTxd`7Wb2pYoTSKGLiozHc6@Jy|GoKpi?N6>Z0@et- zGOJmh^^wkcs#ks*1McoU!mXTdY*BhjA5a7;tu@zMt+Iw|>OhUyjw)Pz=Z4(?n-f zmgj;Re$cHD!`r?|xr%E~u9{~2B0(#|r_HxAZN9#O&&Y!Qaa0QbZZyGI zzLZf6y@{8nap32$4M5^Nk%v)$dTZEcXI!HNOED7DOa6O!I1Vwf$wx;h@?h<`^Zcx~ zWGv&`EYQX2xq)1Q#mZTX7CZ+QB#sg7bygCuoN845dnN*D+{ce8fFmw41vy7oYqwms z@|!%^)ZSG``#g7Jl+bKP#|_uM`NK_C%L(QyAbyB><8|LuW$#Gxf!NZ?;ijhI`_GDb z4(7QRP+MOaao<9yIe4Cj8Y(t2I`QlKD@mn7ZmN zKMup?1H5GNlWcz?#a5i_`k-D}>Bv`mGpgq~Gb55uN*v#O&>bx`>@=G3#iab1ZZ>4F ze{2}qBg5s$+5A3tXx?$B=A4rT7&t6vO62D}Hi=vfeqt7vn>8F`scYedZnDOD@*O1CsG^bxTR)3 zS(bUoc)e7A){Wcthp(%`DCl1lvKnk4S4UVbjE=zd-XP&+XtLnIlnDnJEpkv%C$#Pk>EAl?XtZ)nFc0WpzK3!Tn z$P!vT5gweaca{nzc9sGQq7S#K@)oU2XhZZ~QR9gPK8Hn=bOL*zXgJzuSgF+!@`PFG zg`f!|9%4^z`?w!;K;%b`ol*P7a3w9qgSg8|NNih2M-RME)8|OrkB7GAxDYRvbbKLp zZ9bK4gwZmEFD|=c_ATmKQ1bLwz?I*F1ouzOSLV%n_!7ay!1weYV>~ zS(3T;ShWi=z@KRGO!}&UBRyHRKd$TDy_V|DDMZCdl){I?MpP@be^Thp6pICIwuFT! z=;@J!herd4@)Ag;WiH(~Y%;rxCIcz6ZdCHX7Qb{5KVsr}GF_Dq0G?EIPjqjsNAE-_ z<(GCxls`5Jrw{`H{UR+N-z%r{N-0X|IBGzQ*+vfRgPt(N$PjWRE+l`7?n(T^UmonE z{dI0zrcr4jp@W=rFaAu-uK`*>dMml==^wB3(yJWEcK;HKghh*h%gU0#=NzPExYDzV zjnSe->S<*en?zm^S{Y!DL0woju_wbQ@yqL%q?0=#do(SXjAd;`Oe5b=W7Hkdp6~+- ztGr-PDTtHc@@&ZzaNW1d4u1ZLcRx&{)XooRuT%G0otFwfs{$1?GTVN+$5`f?O>OuwF1&7nY5W%t%zuXEa(G5^SMn_3fI@W+z;ZJFV<+q~;nF!$Q2e%UH|YJ&IE={Hf!#jjH=5U4Q|(s!3_Gly8n^(ArO`phXdum$ijE2R zY117+Vg56~OLn)969QM-X+YdxKVR_K-;pSiF?eg@I;K3GW)6^Jp0#Uz@`5OBo+^(H|-vETW~vLcDck#=m{ z@9t`$T)-nnCGiu!iyXf5(MY@3*|G}tDhxE*bs4U^z-dMq&>nf0g(YM;8QAPUIW~B& zd|v(Cc0haf2A=@U@YHtHjN9ht7h#~?15-<3uEgv(LLmNy{s&OKbvUi(=m|M3!$6(u z8Ij|En_^M80WYKiwrAE|Y|zS)wqLDXO=W|r*E!@mY>aj%Y%KM;c?t6%9)rUO>tNCD52xPcISwhqf6Mn$AEfD3lO>#LC}E+GiC?p9;a z05Z`%$TUBOPg{5Qan1j5g1#SIdoj>PaJ{ zacJ3$V0u}uS{va8H1a~Z45L_ecg=0qeDf7^=!FIF>v*)a;YR^nlMkCa_uHeNEJBy*-CCKg_Ivy*NC0oTFf_|CgSDacCgPJzj>m5o^LEW zGSZKnqD!tuOnB7l{9JXJI!)W1hAx^nj@o*x^PX9frYWKpK?{Pt_j(I-NPqWzcq;Mx!DJc?FyNkad&jl$oL8C zBM1J3?21O)S?j`8_Vb3m)RbXuqEaolSEUTP+n# z-@Ln&FdpsMUsbGq@R!;7UMq4w`-M~U3#K*JN~A_fbtKN;1= zx0j(hFR;qb-Y@=8D(3{vNF5s3kU}8J2lyd<$r0LCtT0!>xMj*hdr>FM`ezAYt2z8ekpdZUqE}yd$1*6-nHRWiKbS^d2aic%{mRv7zOS-wzXPxvv^Ej~IMha$*{oU@Usz?)Cc#>c1C6U)Rjz<2(+ z_Up2F{0UiUQMnkBID*SsATT5(raVM7%23@+(Y!0{xdg#0S1F_zAsg5sFuRq_sOS@# zr<7}9MeMXb+@8P|UL-a?-r&ks4y|K2xseSxr1&Z!uN0DaHd)Z(R-jeu9jhs=#M zWUm_?UCwaRsO5w?tWPNm0RO2k23t2OLU4<(a5`hlF1;9#HQo-Uxb-=+sfxgZ-Fe+B z7F0JlZfsFIw1_&I-mPI6ux>mwc@;mln7+yHebE4fhn5WW<(?hn5J}y|Maa4JWSZYn zfAX|tdXb!aF|Afj08O@A1K*zM<-y7!Xgx_!`5Rn*NJj27U3$5u4d4Q6va({QMf_N7 zvUiI21uAS@eQu?@x1?~cN80hoFqEGWd*Ec4mAO4k9+sW7l9 z(7zkNf5`s4E7(K5+|k}HAt9zyteqXgVQM2R>I;K0AtM1^jCUAy801@^t#oDQM+bTJ z$i+fuj4vMsM@12f5mk@yt2Gp+X2~Q|-ohqk5B|6@ZmpL^k=raT1&1(@V8LtvRWa-TNeRr|uq< zczn~2zjz&2cDrJTCs#7MXQjMxg~1z9-=CfeT>*Q{v|x3zBYatoTUXm12)h2H8lABa6&XWM-4X2( z-B6#MCfSi#;`GW*cmhv(+~QOwu*|R6b83raO7<_Re|h=-(P13tvth%cX=r!2pe1n1 zSAIURt#E)Is@V6Lj-S>gYhY`;8fyYSo>|`V%gqZhVo%{aj~OkG6pJ@W$;#DsvocN# z9HrVnJzfT=Wu<||?Z6D7lM`wVhWJ9O+IJ&Cb!6{!w~ z8MH^k{?=+k7@1g9!)5bnh}+sH-}7+{3pbe~KnN09&-!_HB>}hZs|?ZZIGoz3T}_cX z)Y$tZ8oUHt^bSiwk|vW0mmGrYRRXBC$gCo1Mzz(tudkb;z@`>i(x>J*(*@H-DAb($ zj?6>mtn0bAUfa%LtJLltCFzf#(9gBIq6NqOo!sW^k^B)b`7G@b#79D_ux1}cjE`%3 zLk$`wdP4TWn{}bxf{QQ|3rDj!o$h`J)rF2+2F0WK^qIX?mx)8CLXFBkQ?1Rna^tS} zwpJCz=rho*eXx;K2(>e9-B+?-&3I?bl_soC9_3b;X)NO7eOOJzf6HvPaC0R4NVQ0- zonERqa5zGKl|+se;ri;P!kptg=wKS#TMKVKCmM*L$Un5wYeLqgcfJ~d3CLcoJd6%U z8lRzvKftEjpPU(toOyQC&B0OyQ&IV=+4iRCGRg8C@)!-72tW$0edyK@|q%cKVumgeC0heMs-qU zHq%KLZr~&*NVKEE}0`fAc^eS~qH05B2*{Zstr>>kv zir0zx`b23uDqJl!$$eaVHUsSDGl}1x(q#}x#csLce{Q@DkSN15rd_^_<1re1&;={Ji6AB;~n& z3?aQ69{{mdDQ?by8O0qQtl3r<%$GDbj5lh#*Pf=-|ED=R_!>JN$ss2j$K1S>3b=^) zIHN>r*JQdF_BtGzh-$F1-fyr!IiSgvPtU@%6Yn2C`)ZyEtFl(JXvHQPR|RI-z7y!f z$B&n(y@`xLowgg1;mVvC0BTs=wq0iD#>r+8*K~u&Bx~p1*3OJv=iV@~BD`uPQ;!EI z1R;DJ!+h$4i~|Y88XcAL!qarqSrf9$0~hOktFl}(dRBL+<^}s=6R56FHoaNmPi{1Z zJsC0UW^_)FJ!z9+fK3JLgPlC(D@U?9`$i@cD%Qv4y>H-?b^V|Si_bTDW~LbOI>gs) zHT&EO;v5{y4n7%vptHGfi^OAas}qz4TdVv^Eq=!Thqd>NYdY)Nwyh{SjN@RXs;G!G z>C#aYLcVPYynYeCJwTiDywcifuvPUwMW7CUBUSnp zW4Cj3KJ8X_CDFUyGMxqor9X{x=SLpED%jNfq{CEmqnbw4hWgg?r>23MPkGe0={CkE z4CIr#>d=cBx+ctA3S#ZA+ubq5FcilQ^d4f|5`2itdg>E4r57p4;P@LJ8iJC zq%eb9-x#D!lvw75-kj(g_QFE40&bpv0<8^{ao_bk|7`q#%s>zO|}})(it; zP9pFYVPTj^LQ6g_J0oUHlxJ@V4n*ZqU9q_TEVr}@o!#xIvx?QnG_)d!S6Zq!M z7A-|kb$!s0u@z;{dQ_!tE)OH45w#}{%O+|Fy#-2)OLUQfwexadJgyhCpWgB^GD2_a zmWhnJRJ@}gtf+LXF*tReL_nefwT(m5?uY(X97?)#SN_9d6AQ1IL3FAg>*J^g%8@z8 zcH13@_}(B{>^Cv5`Qb?9_)`b2f2e2vG>D;$;PRXD-9{5O$8s6OZr`w)m~_W{xcE@k zrHv=V!C}`|iFa}n6wz(M;ib}~-{%%BGgdJ=a~S(@{l2v;2MhI4G7QGphgy(Q=OLLn*%KidQ2ZuqBb4iusW~7iiGxFy9kHUs(=klC#JV*Wh1FQQpRDnF)vxJ)B;u)V0cAy@?CB7T^o{ZvD> zR^k29=t94Y$GtbQC8ludTf`%qki6kamx;6f3x$id?)`h<|41hW=k8*+B?J3Xs-&?a zU8wn2alFz8{VirC-OgE5Rc50Is>3(=*Y)|{8ZPPzXtZ4e5@Tw<0Hr9C8Ie79k1Se? zA;bGJUv{a6Q{qG%#}W|3*w#y6BAZ|=8QQP2yBnuLCbVRzU#6gk2(XD|98vG14~TU! zzrR#W>HWfI1^BC6L;gsVvAPWm44H2a~m8nTPdUT56ZoVcn8N?op>7wR(*QZR-5o zriCgO!>{?t4e+~Iay%y@kSSm^RC`I(VMgc+aMiU}g3g~c95C9e!y?qV90zARKMb1T z=OO9ZEh`mqKqJbWjVqU!2I;ME!QnT&93c{$?ttx;y;*z*C!4-SOGPT716w1Hy9dWj zr)&C8r*Nu4R@`K#$rN;RuRtTZ9x<$Lb(?**mbB5|8V)8}YQuR^-rmGaYsbJU&D%qt z3RVmcoRM(_ITF>jO%P0_#J__{rQsck7ZbHFxQHg;7HfScx|h9NpPs*UW9-YR z8RIWDI-f~G-j05YwMP_;$ZVXlXeF!AERavv%q+O6KFNaCn`8wf_ntDU*{ z;)sl#Yq%(U`D0aBz!WUQp!DeFgv_1a;2XJ7>x4dY5ZD89v`OZR5{^+05XwCW9{TlT zB!7R9xu4>P0uyt3e06)Ydclv@9W1gM++Ee-0m`WoKg6l@|fh?B#y zi3a$i4(JZq!n`;y3ZX8r@%3u|aQ`lN@W#OxYow!UZ>=@ZrlNOe!iYW}BI)F*r_;`_ zK*Au^H=N|y>o!zB2)uep_nImmuoBDMQ=N{c6hp$Ea2B&)Yh5AN?Sk{ z;L(d9aSgL*Zjw0~x0xJ&Du!OM2#Vh)#1l50;!Rw3TbG_X@fRUaU;?kN3#0U!r(JBH z^iAz)_5)#Ahlcx0hg$5fv-%!x@TPXRpQK$XPG7LXo%gkD%(OD%;Mx~49S z7f2do-HrzJo66f)myHQFNc{2qR1`92m zGVY9Yq7Jbun>W{rxbl$B;u=nc#-oJWEgjk|P0>~@n-YiRumD>qf@}3`u73u zN{P&Z8=KpfekUQ&x}~9MUv2}Vs)6RVG1|(}k~>80!5XXnIbbExwyal67F%CPyk8|s}+f0|ON3RV~y8|5dpAD-aXC=#uQ|&m# zV+-r$?(-sp&07y91N)ao#iyTCw9o1^>do|*=hXfBuR|-`4ZH0a3LJv+SN9!F1gMFQ z5lw%f9n*yit1MpzQA>obvIU;$xk2*j-4fK)?^<~1J*%SIrRKFMi@lf|u8L5kK#VvK z{vMJ#33wbnW8~D(g~URAyRD^XJPB1W#XN>n37y6a3nFDt5$Q+TiCPAQTzdrPmh*XPeN*EaLx%TpKNUN?w~ z;0#yN|5`uxiE3~PaW5D8mIs7p6Cc$GQpYV>t76kkqvELF`lH3QZ;Yr8gkB8zjJ8q^ zUjEBTj2+>UqMQd20p96xEViEpN$rAoHfF~*xMVTa!goDZK+!AmWIA3%4-5U~PwPss zFbAPI#+Tk3XAKN97gE;!ujeC2tGh+^mw>Tj3gUCbc01$K(~FyQU#xnl-KS;6WVE9E z+7(;Kp3ocVrO+_bMV*wvYPCx0U^TD|BsUKwx1>h=5Glxs`h)#^2J{Zs?%zNbqAG#g8fl!B({*=`~IHJwtIXMpvO*w@aNMzzpn0 z$>+qYk5%(TPogCn@) z+7?~an&!~?Fmb8Q-zr06j@_p`htD9d(BzXBm$lyt$PenqcskYSOM(IoDb-FSxj-np%7HH=o0*#L6ys+$qUw@f|J_}ml7}UrbTbz4QHH+r-qQyi zag@@9`*Fq&^a>KMDYDdU=S3Dm<2k^=iF7&;etijIE>w|5iCSl;@cCPOTM^pzvjLjj zXDl}Ttb(>OA`_SY$tkI#kQ&?^BdX}pYm|B?PC9c&YJVlJ)MCbktq0pnuYt6OTT@QP0ApMD4C+Z{*jl@93Hr)DttM&q z!ba9F_s{qSON7rU$v9^>sA>EoxUNc*cfFet`UP<q{aSnwwYD9U=Ur`X^m*iTM;VVAH(D05-P3}K@ER#W3nMPL zx=N7lY7YMmUd9TVEa{L?at>#U_6}SnlEHI9^zj%+%QsubgsOKJjz%hNN|7r=lMN zA(Q!+#5re1tU;-*Rb>cwpOrb`QrN~?k5SN?b>^d@OAT?-Q1$V{RlawC5Z1*DWb`Ys z7y&$9l6q`sx-=9!ZW=$DY}wn=E~~p~TpsH-gYowagrfpFqM)I0}H-mvz zh^ICz#|>09c#ftd-WjL_60aW*T`zWjEgG30BaLYy8+m1TevP83$-4&a?7cHj9&6-{ z;IaiK>C=R;Ao-k!l*ic@7xxs6torrrr7T{4$c)b*n)4dIDd?(6>T)KnnEa{d`_-ii z&%RT(Afn&KLZ0B4EnV6z4bhb_J;7FR;#@Bot7biegXzq4Yd;{DxRPpprTl;8F11<8 z>`+}Ve0dq|w2$D!=72HHpNR>Cj)B)wZN(@5)8&0xmtVxBmxTs*G#q^a_t1{HZeLrLRJFWM%RQ;TOnKOv|XT8kjSs6!&PE)fk5-QJj|NEPKU&II|67xW#*m6xa|Q;l>0KqrGR1F7i`J4X?S!;ssA8y^-h z*poNUX9}s$|LPb6!SqS4R2_WPJSXaqvA(e~E~s%ejvS#wKfG-s>PxZ>{8KQdLACU3 zZ!=yIB87MtqC`$TjZx9p^)!?WCDK8ADG!)4HLBiUKKI+(R=BGTXKO?~f-pq7V~&5M zHsotCt1RhXHTHByX^eS_AP*^8zHi7Ex;7`En$q%-P_nuAR{F*l*O+!N$Q$3E3`Hp;IMR_0>{~ zACtEohdiES+ekz6Crf8$*d;9RELs#!B>-Mgd-jKCS2GuaKOXK0xB>2%1mKD!Z|iVW z6f6`B2;O+z$H}9;Y?BP{QhiTl&_LID9Y`5d;73cy{t$6}lxPxsim5hQRepC7coO3} za>S>ZvC*NyUpM!3)e5ZF!u#i*6#0rUOV2xadE-Z1VPDz86 z)1P)WN|ez$E@s!dJ63t+!2Gp*r z4+TD@#9*l-?SJ||>oA+%xRW3n-g6vV{cv3&evI(&$8=`6LXJ@spR17wX2vEUcV;I3 zmiK$dVt$HD$)iy5qc0XMkIU%xL>1OeL~8?YAm06cSE;Mn@s+{^VoP%@_B1m z-LYQ%&Al|vtrJtaCF8l^a!#XYg(lc8bZ$E;D->{?H@wJP2sWIY3fq{ecB+?E6Nrx>ZNJ)QPSBAC`fGOlj?)GrZf^!!8 zIUf7#S^$S{TmnDiDWE14^%vV(iKu$s5m5;CI`n!>0f!K}QpWHOU8C!+jJS$CM2t0D z9Rn~Z|4mB%G(4Rj8HbyX=O*;3I7g7h#tx4!CS}rAXa)LWEs7~@dTAG(To!DEm_peqxcJV$EF=SJ(PSd~>}E4$q+ zErpxoIm$OMX`;G)tci5gm|MoF<^Z}MmmLQ!L5;BT74}V`Wf~c+gs_SJP@yaCI$Nu< z$EKfKB&}FDXg@m@b2oyg{Le=iAYT%{$(wToQ*;;Wq0Gs4DQWYxSA&)Ac8h0`h8t-%j{X$;(G(COci6^gFEa^6Alo@*LMOSM zw#KK?XuS*JLH1U{^lJDALlj{SZK_QeZi%)5zuzzK%NIw*-bL*G5^K z%ayDs0f)Sm&E1B)<$1_XSZD{ld2?f`vRBWPxvRbZkrHVbTqI5V+|oyvJF0071Xo@V zoieWg2I|Oet1?8B`i=@lkq(-9y?ZF5H(>#o?mI-TpGV;xPU?p7@04U9qKxP?*4}K7 z#YH!Ke_@1Mc>==gxceg2p+0yJh32Ln-{sf%_2tw3X^r1N@|NUauL`D5w$VXz_jvvG zP!c>iuG5>7hnuo?4m$%r@v4nhGirnkX=KBa0Q^_!aI&MQTJy?6FyG&&lBvEqa3>R3 zQ^;5;M2b@LaH4|a`Ou6Rsg+Swvo{!kOeVm!99%_m^J*-dD}6?4Tly{S&Js@kQU2!Y z)Q@i;D(-x{%-S4MgF{XjyR@l=08?k)s~jh)P7WEd=U1@{Xfx5p+r<_w*jXpKvRjwh z*6SSOb)WeBs7<3NF}EFofd6$0*`#@K;KZ@RbFLT}N7j&AxmSW$Atkjs@~uZ>9u?u% ziSt8va0-ezRgO@PemyrD#$tETNN(WI3XN_;&RRMg1qsFR*k2}MQjPlU^v`!2XJ1_L zpb+*^0v)ozXMVOmMw=e$6EL0Pk>T5~m@xIV#ZdW=zkWPfPf61cw8W$(k&1l!CvrKl z%R_}N@P!#}Hb`IsKF?7ySK4NWCUh4MC2W5VpZ++(c%=Q)|9T3Tud+)*II!-uCtV^G zVH8K8f+5^N*d9CfssC#-9ADRpofU7SR|Bh^e`S@^#u}*@=I>87&-|L);NpIQ;p?&V z24I;J#wP2g5)~wn%lzRbs8gO0PQv{7gHd(sYS5_=0oM((tqYXaz~UDVJ^$+wNZV-r zmeL2H9;!nBFf|u-uksn}7}<6JJPG#YAy4^Sn-_;=KRs@gAmGmCaq)md?0z3O`UEvR z8+CoEKfXNLxirxueZsmrLt_4VTdF$jNPNH&1zQFG+3p==0<3TXO>dVypg)lF4o(60 zx;QL+q`1^E*hBNWxu^u)S1-qPCCfE>*iRZsT+WOfiej7d%B^6QU)i^U7}I zd1@+s$n!*FU1wZMp#9^M@qt0Wnc6ij6|Hp^EhXjX{&-CYAgDd1?jj8G+Hxj1=_K#T zqF=>yJU0{1-+Dj4ULxjZ8G|m^#ly5%@7{N)EJ8U$uPz9?3um~Sgao4ewsbbm;|NQkDonGO270?jX*imV94{RC?&?qRSW{@ zmr~cXzRv3H*0imG){t*y(eXSU580d|EeDq%N%N$qWsq)n!&VZ*j)IYGbsfIX|6x5N z(qcbQRKjkHn%3uxm#{+K~-QD zaVvS#qz<)G4Gym8=K~Q~q9-O*rApG7AwrHyM(BuDJ3-{31R<<2$yyVYlo*Crirrz8b(4@@1@W05~Mu zeGd@A&B`L-J5M-LKt=kh+%-H7$Wpde!h=w_oa5Vgv{shhL!X|xK}!Ae9ga{x%ub*d z)X`eqfdn-L%(~b8D(#Xs+S?>kTW=55!bpFa$oOm){P?lAu8L8@1k61lgpg;lfSrw%Zh=xTFYzobXH4HQwqtG~ zfwTQ4)QVSj8C~APBHj=CvkUo@R<1p$!%qtZ5u*9)8FJ$%92ol%I%^e$zj1Kcp6DeyVbco!- zw}L_h(>4OUgrW<8p*|MA{qQHwBSp3ryZ7mSaq5wB62Vr5?{O9512lR8Kh38SE9{Xy;MylP>|Bks`?gQA0D36%(%i=t8LhFsn-6neIw4oTU`OA&~3M_Vb&; zHL%kK+?&%i3}mYMm4OMHqT3LwYJ!UkGvbA78296Ay*-eeInc_DI6ST+g{;n1_NHpx z<1LF{k_i^srGoCb%g{CvKCZJ`a=J}1zKwl@NZSY2HQ1Wf{01bLJZ}BFj{%z|5KOxC zqmBCK@`svN1Y~3G$6Btq{d*$3n>snU{Q{WfC4gf_x&bViILWsaz9)Bp(8wu}@5ydh zegBdo9V?=I_fK%642*p3m)_fxtVEVGbOv*T*G;|b1ZB68ah-}xN`ZzO2j-5kG7e7h zm43ykRk{D;j&0dH?k<Tt<1af{?C~)A@a20xLi*Zmr^CiNk zhouM1F8T~z^9FsIVB0)U(UKVWdWCkYck`lK7%S_TPB38YZU9j~)Z~VHMaPouXbhVT zB7>c$jO`dgU6Z^lp|1gwMb@P*-Qr@)!uA}aP4IRjDS0ry;U6CTmE2J3c6-H2vD)|1aXstSLZ`fNWY~amz%4!!n(0T#Xpc$o2KUu&W~cxXWxj45#!g z@hNYydE7hSr<8&!v8xH1e72izcjN}Rs}c5(olg|37|DQ| zn#|@TWNfi@3Wn_(F=|%E3_s3&&x}RjwvCnU9u|VJ3rp}*m#Lw^Zcc)aV-lcWhdctW9QEK7aVH0iuNKb_@Qg6E-~dwE@& zHe^2l3Zsm`rb{9}Efy9!)<-u0{Zf#7)!7c^)K^;$LLfK7L^k3ErKfrWgHNnCx>p7N zMsCeVt<(;OxYJ2_xJz$~gc#IRVkH0%(_}{4gZGzZVjOGl9rQN`2j#QV`Sc%vjGnxB zmzZ|cIYepczSidKPBFs6jKuDfhGYI|Io0-=zjW>IZ9XA<*8DrR%hNsoYEkc@#LrTp93%ypY;te%ntA7t8nAjW{8va$I}-l3uh1PeW>+c{ zn^rF`+fkYLX4_e3U1`vKLMfW~x*PtWaJUh7J7q5gedX%0w!N@Y^pVG(C&i~p6 zw>hkl8uuIv^-5MxbZB;Y+@LY3%X(5?+O*z*(KyrikWw=2$j1Zokw#r{tsGj4z{xAd znQ9ub0>6q)E(^RE`()d2_qA=lUb!#le6L2~PS9Es7x=Qp$wi^ppoL12emGmf&Vv^B zr#@RdG!(YMv(LOHvo@lMUZ|U%0+gKRdSuHQV`KeeUDdCD+&fnj);$>*Z;fg9*EjaM~MKo`!(hJe!5d zvCWiQ`6Lz70erq*p{FdF6F796o)7jwz##C=)X;*)R)G(Cx+`j~vagROLtfJgSuG1; zFBw;Oqe&4#^h+z>9`Y8GPA(oWi49vLMaY3X@9P8ltDi^u4;+Ccl{T;0{VJ|?msx-} zB`*Z*6@3FA3!ll}1CiRUi(k89q}#LP>#L01)IooLE_Xhj(@;l?Sd{rR1${>Rycy zdTKCh0p$b!oWeH(2Wx%fWb}u&bve<%x&;JjND?E_Kao9s)n7-fvx*_BdmC^D3A6xp zJNod-aWKV+Zr=*B)tRcruWmkDoC4}!IqjEpp!?jPU@7V)wa4Wrw;C^_X>)_01=j8x zuK0pAC^VfSPCv=bv;=iSL>EKQS-pcy(MIAmgNEK2ks&eJ>R8hHK=al%_`=uK_m&!p z>ny01HC&Ur{&xDB{R!&+rqA%F;Ok-puZ52;D2A8Xa=y$|C54UzhLya8W?mP0Py^WG#)B7KBC0fwb@$=}^s64e zA;D3Iz4Yir8F_oVR@GWc)7j47kIMkt&6ju+`BXcj$0njmUQ)(+mo7+#u9w>)3u5Sb z0o|z$WBu^U{&QlC&#u5A*bFjr&mUeoZrQtbxzwL6!(9u0A(3>>c=XNGHHHXu_#cU= zDL%D-71Q&XvuBN877+FN7xxXFa44OhXE@aBGy#+&O*=svmM&=p`qq6{F8u5e^0+@A ze6bip?n)iV21oxS(iL-WkS(aw3x^LUjCSS!Pi;WnqUUFrSLoH7(UGZOiXNN%dfccJRW|ud%LKr=PTep8W>rx zvmq{1rFX1=nnktg*o8X}>Ru04BkU^`F~a7eH((#OpU?$&^n2A~BW1oh0d-SHRH8xz zYfCG)Kj{G({cEY}*4PLOT};3My9vYG=ztXos&SG;G(GQ9@H<$1WJ~Q3N2$Y0e6OgBko) zw@mAn;HTc1q=`$R195v@dWI@MQ(R${DaJC_l z7tP2qJAqUBIoX3e;y=d8}3nQy7%oe9{_y(KNrfU zU-mw@gk`t4TzzrqHE*%r8HA4SWUN*LVuEdbPzgH}S3237=?r{NCqFzpkObnp_L(~_ z%Yu^gMvhUS@ZL&bwThDlZb=#7tc#5nFHQRN>DpiuA~ggU!Tr|QFoxB;ycjLfPc{JJ zpyp=UIR=`%(*O@6 zkn9;rNa!&M35Cui`M6#^Uf0@xkYollgKfW%2!NZ*^<~FYz^MwFsD(7JTWgeEo2}8Z zxv}D$qDntNA7EVK&K8vd>PNOl*!q2P=Tq9HJhU>{p5*uK{q8vHX0heGk+3%LiU9fz zmfpR(tR4a7+h%5wSKQmZI>rE`c`8Q#Y$y2E4KBF<`Fa5mRV*B!+iKGy#nf&bk#jf) zh=7^sw9(}*8?VI}z zYX72E!0)Hn0jgP^5yuOxVmJ?^+kKac{{6pG{x^u_-PIiMs`K$bv1d$={0H*#)$h00 z(x?UN5|@Ae6!_&+KOceu78AvR=Z;VP=OYmQ1G>2Qz<9VK zKM1VYyiUSm>-amCKjfQr#*I;zl_z7O% zn&9t)qH(|n%5L$L1=w<=LEQ~HkVL*A7b}u%A@>hI?(Y}l-qmftJUAqxM!ejSpr{B? zbNq!}^71g8S^mQgeCbkw3`*75rGlS02K2O}u^m-q`Ykyh+6m6RZl!Ja zmdIa|_#_Ce@h`SOnwJL)vuFSn;nMxkV8B1E2&~UJ0XFi{hV+kt)a}3T1pn7}V9~O{ z-bQebDZ`h&kAurXZR&ej2v?a4o*1C>B><0Z$M=sfOHkXkwa;^>CCMt607;e0TO7q1 z$KI*4>6OY3a-HtELGV1N={NbO4sWiKROVs`>wEJwQdFY{yYm6Cx+3F11X$X&H4^NV z4I9$7Xv74HQ{N~l`%PXebZ%}!bHekQ)%NVD8uG?N4*2=%zIMvY9d9%~P-t6;1JRLA?7nS3CflVm<3WxMNOvQ0V2?-=*i?Iz zfj-^O4=lR4xKxDlf>LzQ6>5hcXa{;xUxVQt)=5+0$YI&rs>8u^UzAdG;fZR8TU5dF z9k8n^s=vq@s>hpCfqUKgf4p?y+o~RBTHIVooQBZ=BeFMD7)TaTu88{#-2v9%q0@MdjL*zoCGIU*3Z^_{3X) z&Fl&>(g*sV9sg$uSfq4gWnY)F#{bU3Uw$8i_)>Ps9nd$S`W(V!R|**`YYC3~$(M?H z8p8|3b)aXPfLQ|=Aq6y#VR-VD<3xvaYpRMrMGpP-;hy5Ubt*nIm^;fTE5`bP9Y~hE^GW(z?~qX;vP8|7ChV#Ae^5PCK3RW!-nWV# z&|L!%j@K^gtUXCg4LkX-mLR&Wi)XVj0SoTdme`&%@2;3Lo${P zVPoWpyNk^lZi;G~lMwq0%hK|A#%EPY<;hU1g}G3wjz@k~VjPIZUAynhY6T%JGi==i zgL~#P<}(#T#c@}Fqr}W_;d5wz=zts1Cr*1a{&>BFZ%vOwoxi<5*O*c53`DX1N}_{f z6UFkez^}hxu(IJD&Gj6wItmk!?_$>m8RTKt9kMwQ`62W|vo-%QCP(MZaBgRS?g3AU z`@nHntVzPrzcDnGxlN6$-(S*>(WlwOe9IgoO4{?OOXD?3C5%3X28x5%US1mL9io%K zELsI$IvJQwGwsgAbj48*V;u8`;~k8sB`tc^1(CHuzbtdLKUd6SyumwwnW+e<2a#NU zDjKa>LNuo;1hI097@0?dKnq|9rhlc_O!s zmSFAl8i-Nm;9Na-RKejD|0D+9l+z$#?Ds)P1B}NPL~A?^k0G{^K(x7yS9e-VYbZqh zpV;)kTk9I|ce;gvw8bxBYbp78H>Ns%7Z!G<4a~~|DSTw>-3E||4P(8jVAOFEC=m&= zrQUE{rlx;u1DML>g4f_iwYM$Y{54RGIzL(JcRM{&*^QDqD^h5`(Zql_>8aGRPGV5DE+<6eQ8Umcd+rUyb5xbn}S zr*b8A4glMcB7e3I;6UdArHlXYj`MZ5XjB%c;V&iz59KD{Dl1rdP5c1@uI@$T-X!o; zsJcl3vy^)VDB@*q)|RzRyyb!WRbRkDIMpGHOshG3-Poz{@x!LnHYtJu9(JH1JyK_6_uVB9JAma z9LfO$fX6Nc%_@o$-y!c5xYf zlxadp70f@69ZEZ1>4aLBS0VO*{VF}G7ncLmVRW9E^UrBR(EQNZ@fp8B?(Y4EV-+0h zwU~XXpHIa4MGrKdM0WT}6&bZxw4a=pxa<5`Bozh&}`f9%)k)R^Dlta6X|sWNa^6tdNIW zgpXOhj_w_tjswc0o!;t?omLV7se!z}K@j}jz_qnI>RmG@U)G<-Dqt4M$!D~*me$`g z#5fb4bg+StmOMOljaA|UCf;<8#(YbfqFF4PHsX8%4aY=SzsvpD|fRQL|?q`HX;SlirVZ&12xc#m&t$ zF;J(3`ukQm3A*Py`VrWSrm(GGR*8mi&sI~&%05DI@Ei2WFVq(x(esM&wtqEvft)pv zX%u75)$QuAw~JQo{Q?$iX0mWJ@z7TfX|^RU^HYpzz=(Nu_rH&nLH>~f@G{CUlBC}- zqQ-GD0qbascTA(B{^n{9?9f22iB(n}EoznUnhcJNT>F{@_f0V6NzNDA z0x@qu6to0~$*|b)jW_pwHSc}RLNkkdJdm9~4u0TA?)*bRQIn2)mvp+{@5XFEdolh3hNNzO%Et=_BdR`vE4#MRE39#rgD zZ?v{NFUt{wm2~#I9RQ2x<{smoy4fo} z^q>yxk^s{pW`37vdKMjbDP@6Dm?^t(Q6FvR;e`Q2zfmGeg`Q7ez&;Dq&4*^jf(@er z^4*UuH`TVlt2d@PGdH}F@}w8ONnxdUk!s6ftFzZTi)fl)Q`dO?!ffKbuE0^dh^h=Y zfJQd3Nv4$ihKWve=P>Kje9fp&Yn3knR~Xt=S(^+;?)HoB_sfFj@V(MfTY5e{ zXTW|9C0KzFEi-sQQ^u({x$ZV&w7$j`-xP2kl&mxx_-0>7nn(%n!Z0cPgdB&|oG$h%K!-p<1;}_zb#yJZc7MH(TmffxPzlw3vj$p2rtjiBq z0}7=Hn5>y0B{09JmM+hsOVPblq7U$tFu`~#C1m)G+kTbq1l-kIZA?x>uCC4(w7M?i zW{GUTU=Z>oQ3!naN?ZdrI>r(Et~L#WLW@6qv>=ZuAaUX1N z4yFh5SsT2m=gn@qYT327*?}n!ovia(GyOAtVgyLAS2tcPy4)Tk>A+ZlVc|WgLp!4- zoFV$%;X%Y%rX*^v^UcSe2fEJF|Eh8PQsz_Sdxx<$+j+<_L;Z$zQ%`Bs)46<=t@X}cWkAQO z)V;nnD~t)W53I*~1t+B7g|Z1pcT@$Q1vmc`sdu_h3200bG!I*5G9e?JK%zGWgj{R99RtB$z3jR-@OB^%6t7^PAsP4&IcIeV+YyV;B(7I%VJXN)PNJArz$Yx&sp#?rOz$T9 zj3pu0_K$|^p5=!?c|}oQ9bs#zzZ09hC$6Pz8+nJ?cdBE+QF!OG=zEOeiZP1>^fDia zuMZW3^v0Fj%g8|Z0R3?#1hcho(0i{KdP2TAL@83Cby28ITEIo$ZvMD3n+{C17b;s|^b zDYTIv4i&jQr0QJkyyz{57h;X{g>d+iHBgRH%Ovd-B7}G()lXz2zo=4AZ=CGtmh5n~ zS|)!50_-LY+e385bb)2LFo=nB(?U%6cenSs&(CiAfP?;UA_hD!RIDoh4sKJ3Q(4U= z*5=Rnr3*hy;Tbr^;C`gRbqm%DQQ8jVOQ2=;$k?$3oN#Als9Mbe8=e#J(dJ1|gaoC3 zg{806fd;wG(Zh@FaF5kplg#N(R{D@z50{{Dx>B@za}fZda3i-~A0`pWTnu@^vyBT2 z+KB{1Z|AMeXja>8GS3jKs3eS;*f}N1*?RRT;-_^TYZ6`LJGEleE0+81fpPn`8)jZ#KYiX|`A#)H=u4qvkc@zhIYrH29M?F97}Y-xHV{}M!G zWRf17Op_NXuIy|qW%2ySiY*(7?S@z*tr!Ng%Ddsm`hLL{*Z=BQjz5*#)+&tnk}dQa zcp~$dMOudQ9;)MzG3%03{cxMVGVDhHs`X^Cu8?4ec>|^GniQ2;G6H` z{DHP83wGit3kBjJnTfeBkr2^M1V3D8>P&1jO_GO{J8JppyJ&m#IG8*#x{(9DNpYif zB$&Q9BJTx(=nrXsUR|0fDZe60DM=ERj!qTG9P%VnfB}$f;L{eJt~}T20yeFJtt-N9 zRo`xdgzKn!gjtEseFl)&uK^(qvQvB7>b-ExbNwlEnAAOlSPh2r_Oy@#g7_=Kpr}z| z7f7!JcR3^OPvc+L)Em+G+bU_g!k;ZKF44*0N`Cb|S~)LpEY~EixX=W4=TlQCueh8& z#n@am%p^A584H2Sy>?ujA%B~$M~Bzv`1GwAgKIbtd0(r!mYFAE_A(z+<2!NIJ#_^v zOO6!L>;QpGAUTRpm&SA6HoLVt7}2HDGe_NOx)~9UnE&7QLZn;z;uvBG74#lMkQ61eejK zFhfs7NJ*oer{do1Sc>M2UX>vmb#7I%dKsd>EW6Njq_LE3XUY)lZl038PqoldTh>xL zP~uQ`$|UA4UKI&;tG9dG1N>-lVT*5hn(U*{`2y0!`aB#w6bzJg64#zu0u}+9k^TB~ z2G{uLP}1$4;{@NPjz6{3=aj3JVvjS|KGk%ffrK|T$jDzdQ z7_A?Ro?CRX%Lf(2#Ot)?@x}%jM#huxc70Sg0YAsXd!f@!?(*2wuV;0`Lw|hRL%G=- zk}^KdqUmqVDY@O;ImpHsBuzY5WbuK%|9;&yIw|y^&nOM5%Z(3Vb>B<55Z1t74+SbO z1SS%s>dqENT_7kuQ=h%|vXljPl|-;}qO6S~kDUY)VX#k=Qj!WgmnVd;I{ByiA*`l< zBJ2dvVs9N^n%`Tg2xQ!vL~K9kp3I~!gueIz5Toas*O@OzF!uK{&*KR$oBYWINENFJ z;n{+p`OX2gdxoM`8yuycuA5M086lhY7SzZYfORy!W9A;fY3 z9kFWoba!g6oRz3QhQAXou5=^Y?Peyv7`kfzpHC{NLO1(b<;xTZjqSk<@e`mF4UHt47K`dft7 z-v>F-ddHoDyRR?g<}CCXb!Dvjg_U#d4iK4nWAg5h;f-E>iO&4xn*hXf96U|>ZbpL) zvl8uuXX=~a-E8rx$w!Vi(L&}F=0hN?I|<>TNB~6x+m%&kELiu!w~=S@ z?Y%oTeHoTuU4ODX5g|V@#$0Jgz=96w!!BLe+9-(IDg$kk&X3@=aX*av=Psny`xQ^A zqB3-FCrd#Dl^NqCOXtdP(LK(~TI3GHj$bkTI@9<~rnS3{_3DjhgUWAzwxsjdgLz+? zbf*GKngd4(g=Dh_&z6h(KuXIUOB%~&*S|=N0t?Seqe%7UoQUS(_~UqA(%ax2C3{pG zR~AjVj%`(PTO3pe19ezDv`2&)y)kMkxlk6!xDEHZ4hvmj<`?I;QrEgfn-oA_c^?ZtaXEe`l<3W@zL?QoSBc1lZ-9r<;|A50NA58Gks_{;RtCeOpe{H9q2l zk4k0(47VzB%*5WAuveNQNT$L%ANdgxB?@``JK`O44PM$gH|TGsc>E#BNQM{< z`ZBwPCY}!r2sJm0Z7eJ9cAp2s2;4!NGMH9wP=mtRp+7xA-a&b_yM@m}z1}UNmV5vC z?=)Q@wn<5OsCxn>E?RATNT_{8(|2U>!)twl?=;}y-VwRdgH@9qkQU(qnO6OKe`{LH zGEh$bch>A0aOve*ob>phiZ~{^5AzGba{S{0-((NW)q@phrc8sSNE0)%LO)0bilFZZ zTQWYuS>P{`Iyug@a=%%Y8RqjcDoTyvUn9P3N);ELaL!qtd}O(4RYa~@D#>3VpD)Gh z3c0C@BONd%U8Av^Mq??wH?ZTFMK|1ZgnXBd43>|3lnYhef$= zZ-WSmf^1trz%2p_3eq_sqI4-L(kR^x!jPh%DBWEGqJ(tUR_PwPr8@_P8u-@hj^jS( z_y0GSm(1P*GxNsttaYzD0J~_DrMjFf%F&SG5IaxqR&;|t+p0VreOH6xTkSVhv6{rG zhn_ypp{Mmw6~xvW&=t%Gw}7jS#j2gF7BD1{E;zE9sX`p_9p1?t|4aJDIM>h;pQsS2arT;P-VWpOx90!$gtmH^*4MZYDg6JoY81d`N@8m3s%8PK%= z_u1OY*;!o?r_eN1;a9E&*+#aZ0>DJ?%ngUoe*O=1pO6v(L8@#zI~eC&-&9axM@;&ejVk*)u5XzRVSaX+=jsH|if9?AVK0k4^Pl{oqT_2tlRv<;J!ImlJjXFBe zxHl^{vIk(HU=o?8;QuTHV`VCRs6mFpiA$x@5HG;Og>+5p)b0>6IO|Jp=V%c@fV; zE)OPE46)|rHBP+g05?m=Gwt$CS7{ZR4?m}x(7^nl3Kl*n-Wo7T0TgeV^gF_`M)(pNz|>vrmX}r;bh{ zQuFxGTH272Mq+%&601^b1~+#K2+?+9w#)##_nSIZw`IRzAMU)jR3uf1>Lb(`*nUF9 zy*}My@{)6?L+5Gv3oDamhsawNUO`ne7u|N$R^kL#7VT~n>^@j{oT(MOfm1*K^RlWx zori*1L*P8O@lz!+rl(U{)SPI6s*eyBsAe}|1rdmOk@{&6Xp$gm6$iU$ZJ-~&+|CHT z&D_Me7PAn98*xz(u$wn*^zK0oyupFLWB&B&&32m)Oi0%<_rXX5YG)H;!~TUXA;p}# z#3rB6DNP~ln++g6dU!NA#bB7~6QC$s2#R91k!Fgf4=9yy8WcfqMbNJ0ca)R#gt0zu zRHtWXQ=ZdEbNV`JChc!>*^T%!t)zm7GfsLXH*Vyvo$o|jN!w<5YK3GfL%i#E5HuV8-AxbhF|Hztpg01flM;tC=zhmlhL0l z8k8!dIyfg)XxiUAW5>Vj#An!F8VbCYQL2+ez;u_Jr~&w2rfh3z*u0466V%B;+|w1n zSZajS68-ogZjK%=PZ%BN*S-|%P4SK3qPVt_au+8DzCvQjlUpmJ7Eb#O!Mxd!4%;0S z_3FQ~ue%%o(0m7$ znRB|AodaAw7h*&9Z#b03mN^{icu{j38#>iUf~rlrvs8~oiP1R_g+8@`tM5qGFH@i6 zpzgBJ_9d>{-K3WF6u%V>8$ks(ce zIXRu|=Jper5w_R}Yl+|SbR0nxOLB4T_%6Jh?|=0X9}`%4Gx6ZOo}pgSNmgXiD-YUN zEuZr;rqv&P)oEup-NAZ1nzUMR;LhT(!>HV)qB$qyUTYp&Ol@u<@95>5C?~9Br?ymY z2ZY52(+)_=VkCZMHY4+WL5HkCruR$^)PM}a^%U-2-vH0yXdHE^2gI=z#PLh!*wx1TW5ac6~ z?+~G#8^5TPt1A_($urC}Tm&mago~U!wV2U>fxk}>fKD2!g{DRo6Q-~1+lFx;2Cnxl zr{5=X8shH3hLgmZj#gqqQkGGrO)xVGzBW2%UkQ4iyea@JgCJnK!-?s3DaCM^9cP`v zT<6sK98 zTdzA+Zx@V+7Za8U;i2`|GYP&a!5c-*M{`@d427d7o)%6&FnbfZum0J*V(AHD z=RaM3fvo2Gp=x|MtHywprYmQ|)_g8_ZJNquj{@a*#7a|nmcPF;tDVaxvuKmg8C+6R z4QR;&BDk!ANUg~Wx?1Tg=;m($mY~31;n;K`h)v5Cb4iuRu5)~azmxi>D5A7LIr(B7 znpJA#k&~<>Fj`FxQ7V;j+T)+x80Ec41#f zZV0g}n|H*IPnIc*hiqcceS#Ia&1Is_mvc0m%L29b?d)`Eb2ljG8GuG5x$UeBsz)oCb<-=6j=R_~e%2UW?N6;%M zm8CvcwB|6A8JYF!m}uRqq=`9sL^?eXz;Xcyxc+Peu*#ie!ky0X1HJOs}kEm`o+dX4aRg5MR)nUiXliQnUCs z9jfLXX^b|+W2OFH#`CDlIdLzwZW(e0cV8B@kW=S`@}`Nw7YZ& zwSTfR0bzwlLtaBac~Zd|VxEKKP3sHVp|u>R&evI?81{yQjQaI)UC4-^5~wvQX*^d? zgrq_;6a~AU)P@mgW*8;~hYJyI+vEeYn_CS`bkX?ZUckF_gV&1GeS1V9ELY`KZsW{WfLB01BdxjIM;sV*DL2xbbx85^%Z zb~2OSQ!M^E9z34wHCa}SJUKPIm&*>iCkh=_gjI^{GdD?Bh@*Jf#F66nhed@Tu%(b- z1i1s-%n59sleuwEMr5;HSM0#k0UEbP*@Okz7NB&py}LYf19kD5NU!mgw77SFYIBOU zL)`F-K2uF8K-(f6{5+Rvm&~fvl*(h@V{60xVs-4*!U;1)5zwc;a_OFE2XzwWl0B%C z5c9f-ox8URHYDdBrlg>8=2C@9O<{LhIdAQBX)MttFk@OLVR3EKfl#%-ThojLeT#RV52E zTeK|gA$Q-&i>#)Nd8xs%JiE#pa;-5Xy4{VBrwLC~wyHsp4rHc;kd_;RS3fD&uSi(E zp(us>g8@k~>LeNgTS1j>&ARnyG2OjFGksxluXbfy ztP19ZZh6z$SQkJ8c4Or+m_>n{Tn7<{Q(kaKmt(q2L`Lxr&we?*DgY9M^R@vsHnBrIN*?nmg0YbjKt)2pAO7;?9D9L@C9ms@4cax^y$o1Rqo+ zlJ~gMaMogl{`?;yT>NSIjUBBgJ^WSdN93e9$`*xRj@s1ngxYqYO z#DZU{S?`|ve&t$7fcQg!kk*C4?Y52O#o>|R5vyv#W6mN~qs17`6+zA-&c(gvWV=(7&Ai=3>?{agK4%lRp3bz0)oLmPylsP5AF9=@7~(YY z#yBwbRw*nWHvklazpSp#-8DTC7 zYxB5|r*L~ymNd(w8ZOi&;FR6{DKv6Mb=AU;MBX`0LGh0tnw%23E&H<$Bbh}*SH--^ zTkKKBY2;$yoNsgx=Uw@BU-EqI=3(zp$@;)Tb|guf)3A}tEO+AQv0Z%1s2KlLd3L)K zS=eL$GJWaxl^_oVp=WGX*eM(evaZHW_tIzHHtn*uYqO)K!5bkyaz)#3QZV-lcBreF zxHNWb*K==o1!k@*IUfGUIJVATz%OG~?%-L;D*WGBmg&v3(&$I;(tL7Dwh^FpQ}gd} z_?}bg@JM1}Pq6EU`XI5@2e*Y(g=llUuROO~UO1~-7$r6iv$h@mX{Ohk&e^b1aMM+- zC}lKUs%P}PUGbhR*NWANuYvnCe6)U({R=PD7wS4YitG4;Rw~_1|;%Q?n-qJ8VEf1 zVY)L|Ze+JKV0W~Np!&u~SI^z)rBNdzqiHiFV|xee&b=OGsW)IP21~o0ue$%&FF8hd zyG|4UiIzd5i#H=I{0RwSm_fuqKNI8PS3GPE69}zHVV6=AfQ?tmKWCSyf}qjxrO*Xd zRYQMb+~Z$AblQa@+J2sdM9bj_*Basg%#q)A6O4wLMqPO25n2duNI!Ew?R4BPZvHUmx{^uwD zZIU@GVAaiDgn)qWF4$V0jvr-$_`$H^;-_!l`h|h+!HVy4uG^t2=&s^~0Bb@5&iZ8% zzC22Qcps>;%#anD+VO?w3W??T#6WHO6?XOqNttLbAn`{jEOA|DM4>d0M7>dnh!KL& z$Xr*v6Z)+Z(Z3J)@u`pM=}Du@e@9{dax#1_r{PI|`R~7;o|8h3(|&H->HGg@ z)b#bv|C7@k_c_F0w#|CdJ&l~?Al*WYqvgwUo>{F7SHN_mgd*Q zQ^_WTbg3x^3;kg z6A?tAa(`WB&PFLdIMp$l&KDW^G9h2xgTeUF%>{ehc+`!>&|_xuOU%0s+7 zT&C9>i$_t#N>ihrevf9WF5Xhfy$1?PTJ#A^?7u!BzpZd`-o5+x`^Bz8{y->1T@H#d z`L)IhHbE5c_24wwK+r^w(yF~kN={CJxepRV<~aMqdon!UjmP6Qfn^e@8QFGUvVUVA zy9bE}0Jg!@Sygf39z2zFa8TuChgL2$H&|D_OI9FC209r7oeS4pec5w4XPmh~?YGmZ-2+Za+_dl#^6Ee0r%^LFJ>1}WQ;m-! zhvA)OuF-N1|FD#d%+=GYCL+>Z2 zlC(zL1Q96o5?$G! z2fU!^Oy7a_XY={#kruXWN~!PjSK3Fg^i8lF>Q%e%>Ggei78LQK`u#gdRoZAPtL|bV zIHw2PmMu|gB9bZ7b1!ns=Sr_^yTawq$8J@nb{lRKrc=M(0oC>m4B?Uxgd}$e^KQLA z6wc~`Er&iIGqdzS(Sr8whP6$6wBA108G@c(4>Dv@F$YNNo*@{budp+ld>XJ+t<=D` zt$T1jn%+}#g3gaFXQmO+G*a$2b8@)sazUP+(eyqDaYEGgMvU9e-v%WWX9a9lTbJ1J zH7=cVua}@RD%>*j+Qz$bszZ*^Tu)}%+%fm0c_{r@6m_Z-w3Dl6;?eS_E+0RNk3F&N z+N=gEu`U#ckqejDpMO9xl+mJ`>OtGnEVP^cmAP0UN^}|^4)!U8z=+(v`sHDeTqRY~ zcxGO49*%pAYVqi;h_4l+-Dr^toWN6r!;$Cv*FD`*Jciej7m!bz6B5W~J$p_-ZiRkR z*m8T-p@k1+e~5ECG-z{lUO8Z$Zd%g zRAwz(v_?x`Ab-@kIV&_^)Gua419qiFxz(=A?E)Qk!iMSUBRu}^^`n}m;EIM;igH>H4M)F_RmRdAVnv|(&#vHgXR_r`*92s&PU(=1S z0vS;t+?LS?in~PR2eSv&o)nU?rFL>8Ay<~NpJYZo%BD4xOk4)%^Pj9@xT((2#a}t) zQt|2gl6^GqyPoXcYO-T#d|#ayxO98gGK{}t4Ijaq>7UXRrbpu5^XW0C8vXYK*xjD$`S9Wq zeKy$JL>wrFvM7foig`zo7!9;PG>Wv{cfpM?wN+AZs&eNPZ*$@W^X0L$!eP=%6;Wn|9!ONRVADeYfs~0UthbiHdacVdb5k2Yfz`f-%1<<@+5S z*C;hj=hq7LGa1QH>C+h~ef+t3=3Vz;MiAHzL>-(39oAnf7JSj}s7-BA9|yKAF1sqgjN%bu4HUjjO0s=fc;F~ z^4luB{?_B7!9+0$@YPal<_Knz3$vQ2)vL^WWK`vckx!!|2M%3>vseaZE(EHSNLPaD zx9?W!Joj80Lz-8r&M-(z=3VyP%$J2%;vMycJexL=gMbeouAz#~p zeR^Ie-;um8G9MlolJH`d#=R+x1&P7v(6NPz%#n#K)q>8&aAvK_7WFw zH;jG>k@j8B#@_5v?VdEQgqfswY&;%!RE2M)g(){>PW3K@vTCTBgUefR4SSkczrygc z|AZTt$`u@-__dBgw2?pyQIRim+?bADqvEo`4dak~t>w$e;IZE9y<*@}aB9Mt*U~y3 z5YCfU5D2QdK`|Aqb2rClB-Y?cqN0;)Z@O9=c7}{f;NP_jxW);{@b4X)i!HNnSX8l* zt>RI9n)AG5u9xl)IMAUBWHx67l&Ur-g3$_mb5=PEJN!RPta< zx<0ZpEYfAbpq3@O@}RVwcOSJefoo!`GHpRWD=ZS$M4U0@AkgEJ+a!qc!ohB`DPu3I zY$Xgt>OO5VoFZW`0#?xK`4CP@bCsx(yM+HcHV)j6(#$}5@hEF!$ATdWp>2^JT-9N- zz$fMGpDbv6;we25ZbgIkV9!bDUs{`AW_WO%ywKd{oON7ZaejDDHC-{Wd~Oux$|Xe< zSz5R?*owkKS@PoOv5`#b?ta27voFX;dZ(~YP40xnxm6vkf8K|K0hr6FPPiP>icDBw zmEgfAii-WaYOU@Bz5d2Tm1@cJ*E^zu*RjX8;iO5!1uy3oa3Gl_Qu!I|)FSD=h|N)~ z?}`<5I&QWEe1a>cvqG&%-Iu&4TgyV&&N&*y?rv`m*V5Kd*Z%Mknr#KkX1U%oU zLuj?9b0QJ3pd)|rcs6>MkbsG?lI|oUwxwy;OV8}h#jZ*h^x5(xY-UfQ-6i9Zaz{YA z=?29JcfDrkFlh#rE~?a(Mmq}mXed2kABVfurW0L2NJLvt=Jd4ExkPBg_Q`J!&!Sg1 zj-Gvgx;%~52lob()^=NTRdko^OZ%sZv5Kk@CK#5qVijOGe30k)*mmD2EmnW`v7zD) z)M|R`lXtdi+X+&+O?n#9D^&)&p4b=WLti?uCIJX-Th2}1J2##S+ zyW3Nz$f*Q6el5SpLeeZkGSrH)e(nW;!$urj!4nE^Z`t8bL;AX3s)!*ho;_HaR4upP z+!k}{bZfD59MC90WX5Vw%N4V4U{lV43Fw}(Zn%F@L$}ri+i{$~$V3^Php5a*5!1TbS}DpsiNlFR>lA6wgqcyiH7%gNg_P^gA{SyR9UTV? z?|c<=`I=j4q%tSWWzo~jrHT=V5#UBA7bU!ZPo`4o{2CP!o5kC=D&LznCDO5c8tyfp zB>IZcmN~fTo0=<=L~j61XZOKLzIItoCkm=hABXAZQOh7fT}-^0ej`1Sa3ql{LT4_w zn$v^ChRe9CKJF^gTm=8Phu>(MZ`KZiS+gF=Z5YqA9}S(kX|uPb;=yvhQ8|Av_wu~! zg?kWd%!%W@aYN-mbGK-&&1f@<8|i*Abm!0C0{I39o*(=~Ms=M@CF0Al&WcpmKGfWm z_OvwaK5=ya6$yFl?61X)Wg~{}Rl&0?9}uvC0#t7=aUV$8VQ@c0&JDO1=)Jp;`am=Q zikW6kg{D%wg=UHgpbuY}?axa?QqN(LNNKJm9$5X6Q%9Q<7HRCNtz6o2ie{jRI=hNB zx$Zr?1>NIBSon@p@tR$Q@|PFC>(w>(&kZ48wQ+$><#}VeFS%Ngv0kl~bpyl0bn7v> z?uA~90N4~G4=i8yTb~%eSB4ZN*M0o3uDo5yBxNSvp^|jEXOSgY+$EawgB8~-K5xXp zn;Gr{Z)=dB#&g_9qK4XZZ-w|ZM=TWC-oAaVF%q)b|Mt1KQ-W#M!TD% z^;^rsCc8GB31Qlf8%Z^*YDH7{pvW6fVu{;`Q3r@<0v{`2AA~sfAEd|}3V)iJ$hk-G z9}@w0r6`_qGfZj0&gqH-Ae_=K3Fa4hA7PY>x(3Iya>xbj@E{wzC0Z<$=Vis%%afCD zMHM2RrC1OyjUMupEao=pg27X+O`Tt}SB)<?*41Ls?P!r%QsPIO`~P23fLXC9bc9M)qblh znI45g^}dsk_d?$zpYAJnd^d*(-SW-52XyDtpC1baZ}F;rj?q^nUO-|LH02j76LvAr zoe?gDiBb?{-->-%3#TYwqUck{4uh*L;=%Don6${TE2wyo9htYTT)3t7bkOhi#7s-P zMVsUJub@cvja%53#a+);1QYi^{873zSQNdJFDkZYPb2Flf7WeJ&b+e3U){21XZn`k zE`32IK5uw#iF362Qa-H2lzf&6wgMAmJ21m-*?J6X*#{u5=T42fF?>Jp5EKv)Xe)Yu zff&R(P;8`XQKJp%$B-)V83A9UhJF7OBCtn))IMbpspGp+Cx-Y|fR{<=92nrYn@hg3G+~ zp1j}^*V$`HZNC9t)^=eV$)e!Q{`9cm6X{*H6W9Y0q!lk_G?@9dYf<+jP*LZk(unQD_AcH(1kY7D3<9EaBxtc0N zFT-xJ{b-cU^p?6u4YFQeP3=Kb1^%b zfhG5YW*{uarj=j6_)7liJBpxhw}F6Z!@w@RohXL3@(cTy@7qswB;7S)wt7$q zgg0g*eXf9fH9|z-6h=Wf5G=(a9W6@N7##tTO?jA79W7x;ZPJ^?jTbrK(?nuqb_<@Z zBH$OI08-iVVaW=B9Rd7H-N0;6Aq)V5h@F>bC@$Cc+?gl18R3pBca8+KX!0fGgug=}8Y%fv?KE}4=Q z114Ak735;heTq?kZ;P!A{#=`0R?O&^XY^-}CzDT1!|G5wbsv`oqU;`5vQXX(JSE>M z>CV_!iYYKe3f$hVrcNv}-BGTj#>LJlOFaDh)Zfv>mAUL~hHjL`8yv{p^9<#Fkq9W> zv?fn}8I<%Ko)zIYcLX;y^I?yH*o@JLG1xO-h#^I9o-4U3pZd=m(eIeQ1aP%KScfvF zYUL#x_Iy_a~^tA3eoGvC7YVaq>W?0;>XrQ33(hF*kZ^VTKegK z>ROsb?d$jxzpSeDqd~4bUcA#yY>A}*_kiEUn%54n7=;wToApaIO<*t}kmRO-A^805 z+r2yyShqMmcm*;h6c~TSk@@uOP&oA)T3H!$y2d+ndXlcr->&TdmmM+?)H`@X17YcD1!gQn%XHe)E+F9g z04vC}_b!w6yr5|cIe$&NezJd;zL1Z*HccKcW-T6e@8KIrnzxH z5q0(IT>-nr>lf86D?{>{oUdagHju1qx@pf?o-T58CEUuOMP+ET`F!w9v^?S1y&P~r zDOvNPo-E7JSz>oYG%p@h#9llk2n@ z;sP4wblD+@$Fj`i}+pznjVroqGP8*kilW?F+@#g4Yzq?yjyE? zLCi7+?6_M71;HiXu=dzo;i$`uM*s8BTic$_PEMu$+4Sd!3VFWa;ihXIls$&xznB5v^UPg8dH^TqE3m3UPvXkLHJu_GugXv%kF~B;u)%ORx zY2WRgXZsY4?)Mj-2v)d_R+to_yz3Dc7?-^*&PZb@_@a0A6XW3yvny>?zVy;VOj^Wl zTXzEHJkQ78|I2a7vM>MlF(xpy7^pODjp4U$<)5i{81?1$osbWyb?39*C0T)`QYz>9 zcUhfc*f*fUU|rZo*j{A3K*p&o2kH3MIi!>G-qT1hTJUt4)Ehy(kTS(TSl9p#E;oVLmRmRW0zH=!4yDTz zABJm^dDAU&TNkr8)z`mn(@h3?19~n{@*4rsf8H8A^ELtuxHHc{0ev0DA&=LQaS7-d zwjx&lY=$h0L9KKH%9%Xx57i#qOdS6`(c`;E>tDykg)s-g{yLa&$Q&NHP*Ck3L0(1T zDm^`FLq&JSk7j+1i7vjYhRp|N&;Rqd-dX=&ZwvVr_p81H|2p%3{@gjE|2mgH|M&m* z>EX|J;eNH{LCM4WRl^il=;+1Yhd}YrFGh$saY2#LCswBk5@cQIxF5p8j+U*43IqX` zwtoBbll}5HQ({?Cv6^Caezp9x6>_^Q`K)X5F7Im)fmg$5!(`Z4pM z*gxO(&lA4KG`$3uLPJ8XoxFJKoPV8;KdEKe@WY#l5hwtN{_Ekc6pAn+T+6By$!Ue2 zBDpXW#HNFVatJ~l38oJy#-AMtNG_u?*hGcn6%atsaXQjqkzIxP(RH?74Y!JzUcAr^ z2t2tbE*`a(o}P|q_8Tm!4j8|VQk%atSyxJvrzt_C0kE2ahWP$lKc6$+U!SGU!Nh&! zmdK%ysHW2z11IYvb@do*X<>Mb!^qCVWG8MDKH=V6khUv{`(3^PmkiH@O=Gs-!-o%3 z6yl?sE6=lBIDWKqy*XM$VZ?QTMkU`ck+K(>Pt%P#;SXtPO~4ul+JbN>!av)&>wAg4 zGpZ^UbuMAA56PYfLrBDr88KE;5{J2kYovhPCo*cDM=&_lubqlfD2jd_itcVazg|mi z(FoJFW@kqPH7Y6WE$CU7<5*~2*lYwg*5nF!%}u^J{jAsOi$EEE>!9<~V-r|_`6gXD zZ4wRISW@&eqt2YAF{@=@Vgje^caz}vAEIVn!rkU{Qlc$8+PqW>0IHh+>~e@|xK@o0 zw4FoDXq`pOW1P9h>CwxpSoNySo=WQ;7@s;Ws8eL=^tQ%=C0A8bHjD?d0s)C0lsP(U zMF-6+>d|d)>y`_zXeT~rl|O_@%QXh+klPT_(@9nPpgd8Go z)F>zq%8#s|K~IA4JFEwc(jrY5w{c?N(u1popjF%rrAerJxh7x}{`aF!EAY5GCC}pd zlChT?ONj*JXD;ooH?8;2#1HBm$^Wq%3$96ejbR0Klc|J97J9S80pQSt%|hS5Wf|80 zP?oG>_3??bi|jvMpR{bZ-dq_~0NSH5)%c8r=QE@n3blHgAmTkta_?1eSQz6(B{h?0++|&VQobPpjQcwn zeR&Nt-CAi+WRppgH<&C@P@Nep#2Xy(yE}EBzy@?K4R*bot+@Tp4coQx`|H~iL@iF% z2;Goh0p6_=7XDSy;XL}DQN8v!+m#5$ z0e?O$nXLxm>wI}sEikDCs1Q9U`#50cyO`*%W>L|7RD1H`eiGNy1gM^n%y5}9`+g!+ z{^|YIA1jR@Cv#{Y3%5k(j%Py@3ycdqNvb~1&Kj0XN0}ffRG-dz+Qz7LQ;Q>s^>y;A z9U1(%QIRWcV;55vO2K2?rdyPcO4bI{gwvG!NiaD#dC9yErN;Mn7sE}mm-LSC-Zc^r z3D=@!Hi!vyNRSF3xvt)^al#S01*q*=Bx8-lFQMG5Nxm35a(haKvl>j7DX6xAWka6# zI_}$9g@`*zp0Qd^05KZIPG+!FuyQF%woR0`a?*?@-9HKA%J-=0Z4BOZ?fdWGrMl-y ztCONv z#ZSY$3U7~=y}~C-^iZ8O9L4CC7i)AuEb=j<;>5Z`sV7m@GHXGRoFJA!*^V>FJ;86LXY-scCk_R#d;kFcY~?XM&F+ z)npRJ6ZErcKKc-2oMe4|2GMY+#Vqq~S1Xmb-|U z`RluRVx1QuM}E2_(c@W5^h_&HvM3iDg-icpa1S0_T*4NF1mm2vdexw+Hlfh#D8-Pm zm5vS=xwY<+>E;=k#}bA2>D*&2*$#qVU$Y?RpOYoi);ratJSot_-<_@@sN8dv+|_Y2 zRQW@iUGs7UPSfVV$o^_(Z~MaE_PGC?WXpXT3_*lve}PFjsk7tc4~a!~!l;Tw*mhF` zodW=Bn{e9}{kiC$#)vp93!$&yA$p>kZ}@B%jDk%OiRc_fC&}i7+hsN=j+6@R5F!?= zb`MHm9cuo9K$|gwdEX({hXEKMX^?+VM`rTHM}K`AtlFD}yK`NoD-G&QfJLY{=1GhahIS{guvl zTQXIF0z1Ryc5uXTK0Qr#^*byna@B3X-Cas2bjlbPdwEg7b~b{A;2EGO>&t>G17d_C zcx*5!_IT$e*GFYGwc3!F{MO2X`30!c*uR!4fEzRKjFNofLPtVy45cVn!1M8MZ~Kq< zW1p6d+`(4f0Z1G$=8G-5KHibYm%Pc2RlqAPmL_Y^>06fB#W?!h)Wo{50rKz zu6t%XV|a?@FFh6drlbyWG;FbLv!+KX?i$_h#q?~hf>z8E*$BFfX}$%7*JH=s3=v9{iNe<^A>8BB{)s~`lopCjO-rRb#}hK!Nw zl-C|UlqCtXRN+fK5Pl5Q2r~*|!zUr0dhVpkS)nXXqB2+#xfFGNyuAODKq-4=RcEho zsQW;)CuBziY=xE&UOTwT%?Sv7xVzL4SNInjM^#gY4raJ-x_nh_Bqt z-{Q4B4DB&$)s8>rCVSt4g0&OW?xaDA2-M-eDDo36E zkO9rZltO5f=%FX78vpqTUWY;tqPwDYGL*C9zSY%5A6%&*agEl0*{f6mLqvE zI#BNo&>!iz$qAKk=nUwMMs5D5k+5_=A4w2_87K_>u~Nxmmf04=Wh1St`vG-M5x6}& ztI7VlFca%9h1Gn(MmJsiR<;LIVhx38Q+Rg$`B$g?^!=>LhPM>&JRc`iDKd{mg$#oe zyzK4!@}VrpUS3`w-`M%Su+cB(h`AC7+=c-$6>E|w=R(>B^o#Gr#c*8__awb*gg4Tb z)#Un;aLY{yiab|5cNrGa1hBVl`Uzkdv^8{J zsxTiGupV40>KBuUZ_@ZueImX$+(au@-n;k|`|Y}gCR(iLS#NzpW@D~0d2mBV+3p+O zjvkE{?3+>~>cyUEVhfhhJdqoVw2$4r>hyGO>p6=91uSiMBA~7dK0OUpbHV>MtbRok z;9J2({}tjp!(ny-g*Dg7ul)wGx0KbbUZccyL8%=S82AkCYoe`-ac(t7J1=KY3-4z9Q%W6#l8N3s@tXGgH@VeBpT;BLA1OQWFK&(I3u1BSWkZW zsOw2|xwX9~3F>#4TIGf_3#k?14RCrlV2)_J*j@wYd`1#Z&{E*vfF)*QRyJm_n}?*6$k+l3thOt_l|^6C?EY)mw~#IS+Y@}=0Cr_4hrTzbV_|8?rmes`7x8n4v{o~U^F!bfHHGM; z5q2mLSeJ5Oh57P79iw0T1l*D%&J%J#wn#yRq=?evdbPg&c_xO1-f+_( z1Tb;5>;>|el7f{?g!hRlMj6(=rwodT5tO+fAH7!(T&o*^_7&8TP<2-w3@og}CK&N- z*c)oJ$OFZ+*q&PEuhb6#eBe|EitNwm7?22a_nY1Y#JlFGK#b3HbL1^x_QA3VIt>JP zinO~Z?f<%G0a_(J{~ONlF5YSlHM{R0Nh>&MzKe~wKWpb0fM zTr8HTd0yOa3q5v-OF(P|`d{AT>T8^V)s_(He2~Zn1X%I1>xX7C()~BUK5A*mS<{rD zIAaM{x0Z_2upFIfi4A9ofOge7m9=dt>il(k2(OFEHH^G#Y zsH!~qO^mh4PH0cvl?5lv(&P+u@F57yVFt6}$8c-HnR(%&`A8 zi))PfZCT^?67{bysv918U>nyE%rtc(;W})WLhJSPjC-&2Z7%UHqa(KmE!JVOSMNz7 zbRAinF1$*rVFFDYMoN-=nVERefhqe~onTh5NHexhf?8`x@Cg|(cKv=EC zm%3;y<3`h@!LNnWlj$YbUQ=I=jy17*3^T-7E5nXe0mrgVoQSG&Z&^?Y#QLt=2k77& z18D41HFb3IdUc-dLM^Wc!WY<*QTEWO#zO1Wc3BA(ej!v|7+w% zZ;U$77d3Acg=zJsYzEqB{Fp6yQswG$HipNb^|B3_ZM^WV;Vao#f$m*F%=b9XJ4B98 zUh(t(b5{O-QdegMia{_JPubt>9a8tWf#i%)FOsoECEm~bGD*hTPO`PO24Qe6K<1Ox z*@guiZER2Fybkwbn*zK53_u{tF_LkF7GpPHHor8Yo%^ng^Y2O!T@ z#7(MuA1G1S?e0uv1?iCMfh_3O4v3MJU?i%qnRP63uvotNJAVZ%1srZ8E|V&<*oDQeV@GV?@3ZH$KFox85ln@z)Nb`R-~#=CPe-H;s5>$m8ay<>W{FvJw-fX zVS`D=@?@&XjJmqCe9=$3B&aXzL8Qoqex+}HyZ|U1;F3>>&}A}>XwjxM73=dX@F%+w z`~nu)cQ896FE+^kge%jsNY66XBQCFyM^S(N${D}b;J`q03K|+1xd($?K5BF#eUBZ? zse-L0wYiQ@x>4X2KxwQww$U`PIUS|k#@TWKegeNw4&@?qawVQe`AO1*)WXK^pZCE< zkENZx$7Clho)K;oVePCIMFAn(*`{gdhIi&VFh}4p+vP$x2X<`U(kzz*aK&$(&Fg?K@W1nwy#bs<@|Lp+>=wF3ODR|7tgpK!lHdYuLN73l-97CM5#_9y!Hya zG}wDo2~^WcotV5M*Yej&^}qHNTO}jBV{6DNXoQ2PtI(1}zF+~^*^mQRZvhY_tMA|5 z%t7`33$R1ZUQ4D#SyQoFzXBHZ)K49+9dtzoJX^eb0a46QigRLGoLAhmQ$=-wt!)j_ zfKBbs#6X-7Ivqi>AV0U(RjLJp*K)qe`z50S;u6vNTS&S+l84o5&pPY)#c@MFFS}^O z`dvZ1K33F-Bm`Ooy*Mq^xORez8g9>@C-FN#+kSG+qD9bQSsiVB0o4ocC)a@)(_rs6 zw^IO<-4ZZ(mvy{B(P>?}rPnY8(@mmuJ~dY_SqjNq~#v{O>UFhftg z8AW>H?|&VWyw)qAY_GAFzL?<>m@yE0v%@@GeJG*)o=SWN>t{?`bE}c>N!tfKT>X9rsGI8f?X>?KAU-Zvhy2C) zgWPL&u8-8M^saTz1)$`fYzA42 zZ8Tb|EikXoW;!&gwC&%>$}Q2F{aYt^oliOE)vLq2J;H?g_GVUu(w}e9D_ZWFjTHNF zXDrQovyc@|>T}qw?>{X2bclMgH0UiVcfycNc-nu4cZ#={gC6VF@wdGVvAFrbJnf!9 zX6w|sDtYW)it*Z|^qAim27@~pzAl9KNfve8qG2*)4iCsP2@M)Zd7kN*l=31(Z9LQH zldN;bBVoL?3Th9%ma@z{@%I7tu0_UJ8x{owiXnys&A`a`fCxwUKoH2m!693PnF^Zy z_)*=1Z62HzIBaJXku0M{_P>9efcPw>nk?%jAvs~SN@Zu^_zA04!QaJ<1ka*9sRN&~7 z6*67-4uT5{d8Vcx@;|A|`bZeyHBVzl54d*FCP^<`T-Tmzc#Y1N3pae(#bmbG#w&DU zG4ohV&JTqf+&iS`xvyiEZ$3-Qyj|>5hzV7D!aHbA(xq|P*VvNH7j>*V|8 zbNaTXE2qal*?8$TQ{70fBIB7@Pa^Nuu{apOGP&6nY~xIC;~lM@4*Hkaeta{^)Sxx= z-2c`!?*~sV(>i=LKV$R#^LU$Na7dfQg_UXIt&pLsZRHY4r9d{p-Ef&Arg72p(4GyMvw(u;JHdS9r+rGz#>9*1Q)-ligwsMvqJv;W$?S(AIw42VK zE2Fz5%(@dKrQy;&O)nt{6ul2HC`80TM(qir`n`a|{hZc0HQfR!^}~ zEWM@FFMiT+X>O2F(@RtFZk$kBM2rfjeCx*tSJhUVvObWhRIz-=D&M@o(8B!f*b#ko z4^#FiZt=V-!!)=s4R8jJP#WdzDJ{9)jSq68zKvj0zHRMD4{f%cH*k*3aR2Rm=#|#S zmTT+zBja!0=Sa}f3|tY)9lmwO0e9}Kda#+u3DF14CZc?28l|w`*(94c>E6+&7NfSl z{TR-_J%1ENaVT@BXUwAHO=sf&;ssRcqwa4U*5$ zTj~k(Ds-o|j*0yjFWL-}g-S^Hs_wf)y_V2Gr;RYA4Lx~u>Dk0wa`ou@USux;am8mE=#Kd)@@5= zWrE9>!)xCzWov?Kw8`?i#*Sa@dkbHAyQHo1(nr0b?RzaFFA`<9dB9t*!EgGqcy_B1 zS4u6Ie}84lk33GG(;(YgHpcdnJD@+wEai)C;j69)a8LUeR1;{4M-PlWkivUl9i|LK zhMu*3IPCpdt7&P4yX_~*$yO=P&wz|Dho{}s(=%;(x5#ar^+lP109H=`JE}1{qXSwM zIOy{0v@;Kwqit9ImQ>2J8lhGGzE3$|phOLE$1%uGPvaB&f3(?g@U$9}?RVL42?jTQ zs?cK0y6SjKa#(H;6CU_jE2(3pZxNv&PFtjQd}2Kx_kavfhxhRd!!h<_?=@bYjST z^7n__M$Bo6f_E!2>~(GR__J+DRB{dz3gU|IkBt^}a+mzh;h&Cu>NjN+f?IC+DO0$t z9ivT9)Xrf1kUFM$ng#7P$Fq)5GPo^t?1Soe*e}v3y5A1g9^jgh478eQoe|(S0FHo< zK;#?%H&F(lr=@x{dke!=CxA`gYA=~%4;U5Ff9dG%ukxt>jGn?I$X)|p?j73bLba>Z z%k$$wu;BuHrdvlp-T=R}5_Vz+D?s`}ljbMi5qUqA2Lo#!OrGJ~`1!ig(T7}VeWPem zw<@a9wYNkqXL{)@j%RP$QcL(hKcRk{LS$g{2uE?agz4JjkN$0#j(p zEZRR+K<}t0cvhM%b{s{!s7Xs{vD)5yeU-hwg`!>WTn-Cs=}F%ylz`mB zxVP?0Wn8XD++#Puk(O(Vpg0a22?ZMfPMBFRyv(e9fiA$o5irdFD|hq&1w197^~LT? zzSenGj}yADprG)>Qd7eOC9OXI;{uTXosWyGnl-)TbCC&5>Lv~y-?1c_s+-^~7U^Y_ zky)VA5u&k&$EW5Qf|^Dea{Yn^BV%6TcGO(HWFA?!$&OP1qvo>&4ZerAg+;4#Pe$eb z!*8F?S66dd_9*0Uj@GQcPxS1sK63W_OS*V7Jy*3<+!8vsW*T>S40~g9P^=I;CXurz z%iS;E?)2{%DY`n;x|^11p`rTd$(3hnKJ)u<04zm)?YWVfM=c! zrHNj1gJf_*B>ptw9Ud&I(WO9)(Xt2H7TPTDW96401+2nAmzh)+g z=R?lbHw1*hJ|lK0lwO`ZAw^kwWR&3yrI6q{a%S09V1>cP?m z%@R(O$Zb;0Fz7E7^WMSgms!F2C6zzjMg^Z`U7BZmQ7nI%?6eBpbur;>%W~{NY~R~u z+j(dUmslzr8Oi3V&s^)tb&}1S)U}!ZvA~4WTQKT}uFCo7M|fx))poG*wU;Svt4I3_ zxONS~YPZw4773j&Gxw0M#X|QzDoO(MYekNJ+?c=ai@Rjr&gN(w768&zQofaNDP6G8 z?8u?x_u`I|4btNd?s5C}QisxxKyMSr_PD!a7;RM6h-L27)~HmxdsW3vH>GsUx14N? z_@SIqRW6Kc7bR=H`q>2^kW`;H6$!+V*V)*PX0v62HbJGXHz#d5)cA2mxW z=F>`7d8*)Is6{K`{Qx%TTwVY6?gNSG%xG);8$W$trOT=JQs;>@ZcqE8vF^?-T>UZa@#Tu1>-1v`L|+Z6Mjo;OBX} z?X!toRGzq{6^(eQTgn~k%xSw~gTC<62pM@b6t>1IkbKx9*Th02p zr`bOAq>e}Q!@kF@!9PYGjx~_hg<42YPPWxqN}IH3#iD_mXltLbI(&ssXB=-;!E7(D zWdG|ygTZ)yvn((8k6rW!D3p0gE)5!b`DApPUfVAaC3)sh9rL$l7XsxwXjVVUr;Em8 z_?b}ikow@%eWyj&6yc4sn_!&hT4LAkmmoh!is!pNh_eeW>0XdvopL)aJ3$Wp=GL8` z*(PzE|Akvmh`IOt`{H7TyEvCfb!y2gt-j&;uNhv(YLUl_EKBp%Kj<8F!N?kiPAhc+GA zq*+_|hcH((nW#TWGmVd1dN|}6q8Kes?mw@XeJ&fo^NOb5FFDDpVuLzV_&mn8M?vTM zwsqFs`^AgqwC5H}(8J~v@3Jbkx4+!gCQ@7tdROEic1M#BAK(ALCnV?NUuNOo#+#6J zma*PZ@)KNnhb|owBQ_YKJk;r^cuYK2t z9sS>Q^G$v(J|Z2MwItSh2@7DZ?kZnxJTdssaM+-0aKYi=j5Ot~J8!15l2O#t5VCNSeM6(+wx&_16TK0AZpY9i@4$ zD88DH-7qa!H%v3BJ9n$Q*}sXvH*$NoOib;4)XQoGp;iOql?_$wLk`S%pazm2lw2@nQ47%U!DIALgC@K81R=c=S>Q;4o16}9d~WU^BxC!sGP29ItEd1iSvNj zW1%)A{mlcV-2rrsAvlG6YU@}(cGuhI5;*LZU3N+21hMk>-G@IMDg3bK)p~VcReFKg zszT>Iq|Q(zU-DF&sYI!beMG}ow62!@ciFZd_$2N3%ztifRq(E8vW+UWkyJUYZl~ez zUGdz93wl3ccwXQRiQ4dNmiF;xZT^V9yecn>jqrNxucs*}M^`bE)eSAPFb|}QvpauC zmEMs*K@jedGF!i6<}sH)>^G7wFlPEqf;?kYEkEK(s=(o6>3{EXn7$ z6vp_6RhZ};x^1;!@Y#g;c=8nDb!_bu1_Sx{6q^U54BR_Kr>n+Fj(sJzX+k@G&(s>)qZ(P}Hd{Pc^JMN7P)7MU3q1(vDqfx2<)-9Y_mHhGUey}h zu9)uR1c<|HuCMKWqfVm!fr$&v6Ej+vruvFs$$V#U$5~zQI6R;w7}&Dhfzh(pY;r)}?3-5<}I2r|uvCQAbE4Heyx$Jji8(352Bu#{ur`@m+G> zWRRPB49cqc$K`=T_s0+fWDEn;y_<%yuIDH+Hf$#_vZd3x4dgUH-#0^_8ZIvAthJTc z3ON{60xc5aHdiW1Y-$-IPD<|Zt(Q_kN`V+T71Tb=`p6-Pz+8ItYWqRiX?M1;WE`c$> zUs$?QVnQOF|5X@#4b)fE_1cVH(m-s=;8!cKM#z2a))%`)vZA|w-h^5VJ}(C_&_3?U zl?;KPrV_LA%8Ne-6lQ^=6V1F7Wf{MAh*0~F-foN)BD%kS2fK|@_Y@P@lqDq=>_Hcf zrQ&RQJRjay#JYNiLIBB68Bl`2;iT?q+#oUH+zM)ORs-+4I0AypY9`7rHr!<^pj4by z9JT(ctE~O-w6Ai=pZAa31cs+Uvs`OF{-@UqlK1{WG^#=1DvWWY=JcfI_ZWn(3rBl913l6m_ zckVs#M_Jt<8e4mT#G&F=GCf!!BEW^I%ms}LVl?5ubD>`0@F(Smb`d&A!BQ`n&MX|pM4|NVJ(GFntF^_s}~s|=P2j+O6i6mmdfPg z&vW6j8a61Gc-0F_wV}OH7?JQf`L@(Qg*Vxoh_j

!ep z&_mLmQkBm9vN{TGJF@yyZ2}0POAM(4mVGrriHV&wi=54&49}FN(xDH23SLjWUY+Cj z9bVd2>L>2WM5PMs2cL@s>@;Irrln#%) zgCl6;OuBp(y{6i7$TO9K@j|-rwfO0r9bMz6mwql@!;x$xuOChiG<5dFc?1cDByBBV^$_y)|jg{U5i zgm)R(nbdswDM_GisO)gjIl zS&XhcXC6yO=&KvM%+pP!JpJl-FYu?@l`bO@+YWhF+CNGD__`D=g)>NoxxlSaDSP-t z!Pdz?whM*vZl);z;^p-uyAe+-6@Vym28i`VwyZQbSR1uDJO^|zWMd)VMp1lU6=gZ% zZDhNU@jV4s@mz*FWkc`0_=^!)MXpgasDOve%gbm&^ZSXVup{F)Tp3|Qvr`wSe zAk|7ErtBst#2p_t@>G`C9QgTYZvW_Qkw-gZsjChr#=2Byw_BwbiMy=KBscNG#-iBKlDFP7ox_gpcz<}lM zTR9*GlGHp$^_~=ZI^fuIwodR$-CvbL<(GEnW;-^qBQ$V_zuCEP&X@ZIwdSF6mJ6wt zpx8rgZkhO&cNmsK_}e$UT4>P*?IXv%SWfpt+CL8obZu_oZ~;r>`{y4jJ3C18QyowM zRY1BjiwO1KvoK)gu6ih4BPNV&HRB|l-wF2CRq~+$;6U|JUQp5%cL`gT7=gPg`N2o+ zf$+mJ)h*#PkCSrMXkq-cDiMxdCQXF;PER*o*;qA-*BwGaRIpQ1N=MOmWEOe{KW1sH zjMWXAeeVuPV$lz4>B6Lnr>ByYIo2wM-YUE5iWgx5K=@CYzU5zELL+!sPAGxNIC)@Y z*TYdF45_nepou{kJo5nr}82>EE%WV9-jlN(;66jNZhazlzZC;ZfBf_(rMFkIkYJG8~DAB%?nSRXXXmfS0z05@sgYK>E*nIaN%5>Jt_XW z$~_|K&$Me($+cq|x4sNV%$OZCb4SOW|H7+VBD8X}%4rr))QJ?UulX5Qinp;k5&QiZ8&`Bg%93fx(d$u zIy~h?U_{ig5RypOZ(gXkSLq|+El%yI>{~@k>2#yLba*Z9Z-MOJHwUlQNhD&`3mi(J-E8YxW z!)_F0tfi8dT}orTV{8`D3-$T37_y|~*NQf(y1^4Ie(I zTzg(5bF9C-l1CbWQ05ju&$#Kt|#Nr3jNAS*;RL zz^!NGiY|XRV?s;_ycv6$!j6I?0VYB5rLP&0**@*giv~T5jDAeY=W4Yf{0zX%X~*d% zsU30)%{_a5RcQ5LvAT2_Eq+oy+l8$N{APFscz8!*f{3Jy~1$-eH{iOh_wtO~bS+SA!Ein5-zA zR>#ey_^p?~iOTHpINcPLLtZpvDP67})bRU?bi=MnWyARADqOLW0owB!;x*3ZWsH+n zb?H~Gh|_En-lC=SHwqm~9dDP3O+KKQqWTCaaHXCo?tNgJ)VQil^5fCXn?yXi< zZt!C7D0WX!@#Ax7wu@hKeKlW*d(ChoExQ>5&l8Xh2Tcv)MWQ%wd5$ z<@=6rLMZ-_O*YNmdQz;zatcBvU2HD;J}*bhsGO=2bfn31Ko&RkG7u?g>aCp2Qz8|0 z0Jw^bS9(*U#O2Q9Rw^7RJX6}XQL8NxBPdn1Vi%7LA&8LazHJ{i%oXexldSoYDlnBo zQUAo~fX<0!f?rIH%31Zhi>8j373c&HE(M$1mMGWkgn3GRkawFLct~I+N&wNU0B$f~ zfQb!&WKElgkX8CNamIhdRK2!A9H1nmG3A;jduRDTMRU=YoM^%^Qr0BOTbm+4?R8+y zwd6;C8LHkzV$T@t-gS;yQluOJJd+m2K@z{8%>Dl!L_1*0hDN{h0$&fWysFtQ4;Pl> z+54+btnxD`!Pn&xr4IHK5pr8HIEkLN%W8yy2SVM=4^1bH0{fKa6k7+C|`1&1!0@%~?^ zq+gK(d@UHOq=i4WO!g}O9LJ&^=cT98)z#JtQIn=I->#!q` zO$92uTDeFG8l>|RLvexzp93~mZ9nW&w3sYINm@K)YUJ(}=u+b8zn9<=4!4t(BhIN> za`pBGulfWyFCbh~I{*8v{`0K6_6-S$W*~f|65qiLY|zo_r446gFOb!xip5h)fBZVC zQ%lwXmpNN`i+%Zzoi!`Mw4kU#l~KA2=wsW9n9zAbDHZ4SO$Vtl^v!=_G@OpPTuNfu z3?a`$c4ryRzMsXIX#%bwBZP82c-;iu^t>$^-k04D}Z4y7z^>ph=V~k!^jhYs3ZYeqXNc0Q38gxLQF8H|< zeVj$dkVu~-`6A_BRXbT2mE8q*f}cu@qr=vVhVw;<#93Xn7DVF+ZXk@Qc}vxn^eW)| zYKsPp=z@L9o%_>Z+#O+73oF`>YL&djUSTXH)hrG-3INo@y)^Yyn;tV}knMdRy<=$5 z`&W@XY2c5eley09w^VsRso1|z5ZpMNCaJZCICh>T;{SgioyLEHGgPLM^iM4YflOey zSKyRq41_wQn3$9=X@FY5aq4xJ)9EXh^8Ar)O}0{&%s6%nXr$P*^fyrt=i!rg@5<>D1j_<6?WM*hkin&gQ;_xJ3V?+ zkJ>YRGBfAc@vj6^qJx3%l_?!4d4{6y8i1nObV?e<%4mC7C7a0x2e0LA@##?dw7S%L zz<@@o^OXT`HxgkrRU+XW?GE94Nz#buyVvwS6oxQ$Wcf-iQUlx~#}xp3uAcng91NnR z$-l&xg)TqPWS1P*0Fl_JbZLtcQ;#Psl<`Y%e6%^D`ox}*Tt&fu^_M6bRL(f)io)}b z6f7ddDI2>Rt3FS=x~*+p5qVCG@k30=D!4YEyFS5D+dSBE5CH4mn1$-PUAzN*A7fop zByy;jbB0seF&tPq>-uwYUvynhhv6(-cydEOi zPPIVaY9~1&QFIg=SgC6oSW5USR|9z+C5!uo;a|!v+qJg8JXdM2`zK@;9`bx*fY7Dy|-7i*S6bL zCZTE$c3Ue6Na!KseI<8o!?#QnT^f^~4`8>uk^NL=_Yq{CBN`dw9ZIm{2S;D!4m? zHvAzJiNd0g@)`I)6EXs6zVL=14s!FRzbT73NRVZyfN+p^^i!I<1YaI{Ue&=68xy1ShMW<`lt~rgW6-aG`@Ut>&fD zzbsIAcJ4RKe){OO3Oh!hJRkIIRd2}D?A}%r-TBqXb=26o<3oM$k&wcUw&)wLs%`~OM|Le1Gk8?CT+L>Ejj~+LF?iB?w$SqQVVkvjY|FhBVw3$n&M*rbCnzJB0d$%%3zKWx{$fW?q&C!PkR6Dvn z71KQn&7}6P!hxs^FlH^~XmsqB@ruH|bJWaVgG`rIGsi}!>V$SU*C0(>WW+(;QLTU? zOEuVneS)Ihs3`m6A8}09v%ikG09!O?q%y!X3Y_-;iO5KVWV27s{T-1J@mEB~>o^f& zb51R-+#;PC4V$_-AM#fCbmlq+KbSb4d&V={LDATpVS7#$3ik{|EY<>5X+YGJsP zR+E(UXM0VbuZ4|5SH(+@;vD9%^cbnvxXml1v35uS|3;bWLNDt)tqya6L!Y=HGrYe! z!LB7(T~^83UQ`D_-acS5LA{;xi&ENpO^=ZgW=s>wG$PX1 zw;c)tziQ$g^hjUd(JFK;nsT?xm&Vj}%`#YjlXe>{kKU8`sWB{i_$RmiKWBq*=zRc1 z(KlI^wP!aD^`ceXb{pmg*9pmKO_`EeN#w6(+9(h5x!&fk{lEDdci!M`zPcRBx{r43 zW5*N7HBgiHpO^h}qy6159CjQ7_COosMc@`^a?E<~*H5-WVkP;vZ!kCI$1G~2M-Ri* zjt^#jc>q!?z8=PR;Q)#W-T%^W|9uCSACKCCgVWnK0?717eCM!H`kFaa;da8PhZcUmT? zk_2$GgkLEjI5=^qkYNVAMirz+K`Qwp>g?b50zcdT8L|}->#^@!1hmZ_xCnUiIg&4C zlV5`~Q1o8g-(o`@vby^cgbU)_Z7^HXanE2xp*;o-nn<8xQu<+){Ay4>yzGAT60hV@ zq2cy@2*zT1*Q?A(XLUoAS7pM>7PRV8Tiogg)KFXPr#BDb93mW_G^P-NHo@{B>YDAF z9~scPKk9yee88u0D(k@g`cL8#4l9K=a$tZ_72ju_EjEQ8bs0A?``JtSi#?t!JiJfH zp<5A2wy%Av_IvWSRVP!{Bd^dvl*z)dZ9MNIIPPQ~UNlO`2foh}i%2Q#arZd`L)Qt> z72dg={|1=+@y=jVbc>H5>RfIsL z8C3%(Dt2y_^U0OjoPcxC!!f_O@#HCj!+r9>Wt;b>8zGp2zabo4xQj;^U@$s9pPpC@ z26D_EzGXxE$~YTjz{hPyZe8iwPOzc6RP#& zvB^}7MtAy?V-z?=^-xu$y{1M+1VXhOgB27YyWiBV>aB63Hg0ay3EOy^``=gib4yV@ zydEx5V4f*IRlLQB-}(|m_1yvz8#R>bZ1(kGV#CD;KC5z`q=mHJn+H}<{OU&pjNGz5Lj9TcE?P_o= zcYA(s+au&IR(%A4Zjw2CrOF1NbkZ>Fk$j(2@K=ycifNR3ML6f#rfGkPL^`UT$_9*? zr*)!VNaG3Fe6oj8h4EDW1Z*hYuR8+&6(LUqDU+`PNWq~E04lsG(NAk6PUY3?J_1-v zi*kQ_{(m=NB(=aiDqeEbNd=afC9$0Bw2tS5Q%#lkp#^`kyy8H~jbxsK_B$b(>s653$-J~7*v1&WT#-&cLpGRvH8k+xU( zA-kHka@=02^GuYGuT92t(6f1*ROshWQpS7Hv*#}vBS$KXqEC+;{)sQ^r}Hy%5uB`g zE5gG5d|q^K-kHX6t5m(WqXBpCD_vc}t`7I#S9@W#Ju?}k&oxp25 z?_6~<(2Au!>-+pUzzDr!LQ&t64c_Ulac2Fb3%sE_SpFmh92az}-1(pwG!)r~W z^;!ZO%ggR76ttF38ht+Y!ZzQ88){SrMQW=pwguhE8iqZS{z8TUclkFlO$Qf(mmSPN z_DOR+jlFt7f&cq4nh%e%{Zq_3Y!sv(5Cs=|b_!HE`%8E<$;Vf&*mt`B{W|`$Ww%K@ z1(%qG*d`k1`V`Gnmiy2krvBwlL;C9V{>%IH&&sBrX=@z!A%OHpBtnmZpQX8u>$uNd zMJZ3Qjw2ztp*X8=^r%O07rMkCxUQ81@b9IT;L`Lg?l0o!0Bf-m7?Ts=DFqshQ7vbM zImCG@%hVU9EhEfjt&TglM=lb^=Xj>GFLNd>is>NcaYTY|*k(q5TxlpHxe^ysG=wBe ztlt9trzYjv2lgm47Y8T7ww|*UGl4`P$xt&y)}}nVX=|28BC&q6pimwYeq%7U;}W^l zGLo$McM>M;7nkJCtF>$6p<+`-gCXwTWAe1EVG=o@GmF)H8akLHtrfP;Msl??``#Ga zpPvZsO*-1y!G|YBX*ciVNHjyO`)PLyhwQBxc#VX{_j-DA91~+9Z7Jx`w*PC66fPFb z2$xq63LL?_*s?}{@m3-nexj4Xsy9Bd({4U#j4ocZHonWb%hvtzSjlV}V-=I+<2O~ zz2-^IlqymbrpzE^@NKRl&MVW#%jfb$+^TvPJ_HMmu{VnXlGCsqOGI@ubO#qwv2$Gb z(gta%x|qTJ_|eDy>Cyx1hmmqsCsHa0WF{~Fb6WhdLF5oj3741i*MI48kiF>|K%3C8 zm^M54*VGY7dZfuuseXC}AO~cgTvEaB_PNpQatNy&d0U!HU#U$9NCg;VbujZ=XWC-V zR~!3t<`RAM!XkR-m>YGkV}9oVdQy_0MYHUSi+Ksv&b6!lWOP8axKY=`L*0}DR6S)w z-bI|x{`+ylRWawKI;7=j5~n|*nI^0KaR*-Oy1)Oux#B(|yg`OZK z|6y*ZTSoOZW6wWhBdFaCRWB`H(oc}V6qrG~6%{bdK@;z9Dz;?tSR^Wl{Kz`&+geQ# z3?lQKN;zpz2G}?5F>vQu+I8)Lc9JWnlOoNy{UeiEZ23gidRy5B0s>aASG7<|(~Sp{ zf+2g{`(zGIt-^bzPkQNuUkcqv_vr80noXiv%EvHP2{v3WhD5==QG-cz({A5kH)5>^BxJg2LSXWyXkHo=Es zg~v86K^qo2{0tJcE0No1e|8^7i(;Fs@VC%d((Kc^?`mwD<`Dlnvz<#vLdn--R zpMJ!k%N_y5YN9}oQ-;grHVx{j%6&Z;IST;#FAU(2Jqz{J4Z$rGvwdx_%dNi@tRVF7 zEUCnr1)8J~o!zO3!g!kw^k2jC30bxC1vlMR2TR=s^Lhcn8i*0w#Xbf_JM8m#wcK|A>;fF}Odzvj!>mb!CMD|JO^Q8DEX>)93e z?9|(CGC>O~bVfgux0X)woqvvZGiG{*e=i@;{r&fij=JnRz~1RO)!r{K`@9iq%Nd%) z1}PP>?E6??)>yk9Vk%QwvX5LeZ!|@ z8d+s2R@2n5(+x0%CHy}hXZOMyI6HAXGmDbGSrQh=|8aYo^cn9@u6?eR_t#r-MRQz5`GLHxoSo2k> zM--ApKXcWeSM2>))Wu%$%Ts*r4u@=C@313x)y$cWN1;*d&bu>fgN!8s-Ul0ot+YP~ ze-M4OdhNaI?&{n?0Zn}W|50_8VNtzb+g4E#DMdn%?(S}+yFnUp=pMR7Qo0)k=|-BN z5s4wCrE37mLAnOs&F}fw>leSlaWJ#*z3#QHb)NUpaRII8DM3>!r|+h{?8s;N5v^0x zv9UB2OesEhtwv>sm}evQvItFI5+LhkgFQF1SafU8d+zwj5P5$Y+|nph(&*)7+zQ_l z&u#?>OPeB0yZ=3RS65(~om2t~5J}rQd)%rIu~DZ)AkBNK2)R2e7E3yTMrQKunJf4* zcP95rcW2#ytLo2rLIs4T4>>N97$x?;oM@1pG5Ln~(&)qvPlV7}OISNSi7@mNtH&06 zw3>HG;vW;BIVA2MdIt%2kYZ=DGeC;j$xVNd(C`Fl3Pv3_V#`!d#%okvJp{n$D$VSH z8BHzrVqkjEi)Kl8W}up*2a1T=0AFU#YB9xgNNkVamZk;jq}eY6OiBY8Hvq9xcyukG zQwk_uqBU3v9S=?P@qn9Qa!eJks-Qq?bY7A=St8KU;qf5d{!5@aIB+5FIBy`>HRyj` zD_1=oqY>IE>y6x~6o{1h@|+bJY*;KxPO?w6j8d!8cUGWn%eWD`!kqdjCj8sWFSVT- zeUkL#C%v_NyWe&XoOeuFrmoPDXFSe2*p)g4JH*-H^+CfeyTXouHZBAhuLC_a%AmSX ze$9d9f>;2%7L*7GXh0^wa=vaq=vgOj{sHZe{w(m-Hb7242op+@txNTsy87DaXh2=T zYFKyI+*2PuQ$vKYVqB-xAbn_<&ACg}0MzX5VI$^G=E{s_DSUcJw|vd*;6={P>886v zO!8jpK_-J5o;_p}SOD(`Htrs-tsmF^_bUjn-~a+gO#tfw)L*|B36sFx@8HlQ9%vZ5 z0G%(J+CiF7*+SN{IsrVZJ@?`k(GfAG#UkPDc0;G^GW)-0{n=}p)tQvtt~C+f_FEeE zz2loW3a#e`*5$rz90;Z|WSP&iCIbiA#hkp0z3`7EUgv3h4f7PJLj!kza}QahZHmpA z+Z=eM&mA?lsj^Qq9;lSghuL1Ua}H3;uW88Grzi7{)_2d3&NZrU2QhxXxE{Ho2Fg7_ zO_?ZFPqyvaB&H5>064a3IMgnajm}bt166^>8X_IkTjMVwwC2tbg&E^FUzhJ)P(Wsg z`$c~(Au}5LJ?DKaF!n!rH_c?Y8k6=-;ozXA)M1@RqR$@}U^P17Q=XIBoyq|8ty3|N zC5G`~zg>Cky<;wA&8}wNfgvxXw=@@dxMaA;LDTjS&r6A_u9BJqOF<{^7SQ z@~0jeRe?kQ#NN^-dmg(i%=it??TICU&-mo;`|u<70)BtcCi5t9PBkdC zJP{CtSdOI4vPPUB{&UUdzn0!-tv%~Vm$_Y$65KmIDScl@3NKNMG;Aq)p4rwiZK_%> zBU2Zcw6y0w?|f%jUycZZmoN3||4&JkG(&;@nPG1=mEL%}Lxn&OfffDG_$e#YNr~C` zBIJtI5(|L4H9aSv4EpbY2EDI62Z@%nF^%BXHvp*tob4LvnqvNt-kL1Xfd&#PC1Q(3 z8^H=@ji(FvvB97&-bD>uhSp%_#`u@V=VZheK}p z&Bf;CvUFJzPnMk`KnK)5nZP4p6W1WM*38N;iSA+7pdS3CvyGIj{*#A%n69!tU%eft zxyXX#uFP|uQPtS(Pfq9U^1EDv%io0rZk8BH%7X&@tyuEU6ZbBlIS+xmCoB;?<2$|+ zHVyISb$zFR^>yO_2H-vhe%o8Hz8Lm29`t+TkSq6#PLCgGvBuTz6I|nC9E~5q_c^nG z4ps6e!6VZ*gZ}2<1shkWf%J|hHO8`9|DF|xoZx;Kpwd#Q@5RR|F)x-2Gi-Ne+wsgM zL+zAvnrKY6Sqb1nSN!Gv$(jLgfM*p8h6C=halBL}MZi`os?OwAm!U?(I@fUI*WQUfl4^u@b@h z%rGsQDdBO_K9gn4*Vfr1XvSSzJ)uDvp(lQE(naa}1zQ~GMSwOR^ZDJ_8C4)hq19du zz`mxTiuYJ&Njh^vpX>b1EV3C`*UUekBQNS^B#l@yOwIC(LUG!!RDq4WeA7Go&Qgw| zC(f3sapXwg>*aZA%OA^;>@?&2Lc>U)lw6hJ!x zFB8!QV4F3K*hi#p=2n6vdSSpXk??LPN;=tM*Mrnsy4|ncyh5cG5XwnisEWAx-^X>6 zdsnqJG$ubgTD3U2)n&kbb|(sd8dhk$)IxO0jc-q8)0Y%bft+%L8Sv1RpKWCB#-6Z+2GpXzX4%(I%kD0vwge zLIq14u~~i&)W??bfY613-J^}C7&gAEHK8TqY=Ms0=2JXU#f`n86QixZP4chQcX9bL zuiEcSAiuq~I)NCt7(r@4)PajH>|)2Qj8*pojr6B#k1W?Co+;;J!MtXy_e1`1N*FXB zPqcu>MU$5=YNKAEuWu{xEH;($?HS~XLhD+MtLumZ0QP~7HRli3Jil5Dt)8FXwC<)A z51#K=s&WiP%9SrG&07HXrI(JklZ-shmK$AJ&NHnOdcRItBkD;EOy9=Ojbu=%`goAc zPkOrsdR^2LDPt0&3GSx`9z~RbZtIjd+xYeIDkOn`$c_@}Tus?e35hJc!SRCBr!1bG zZAOQ0#)rkD7EmAyw}DS!^MZ-I(*+(AZeXDcm1Y&rMY*l#ZiooR(FPdFgwaD@)2QL= z-!1>XWwI&Gz;w3w`_x$wDF8`-^BjkSfgc^ytJ02&L%|gxoThPyxw<$1yC%W+jUxxw z#}E9TlvYL%VlC+^S3*nRPB`-Dxtr0AXb10|anH8Rj3RE<%{OhF>iUb)AM>`>fN8IP z-G>y?|KPD1l~i{=Qkp*qpuK&!2K3{2bcHjQBsyTRYQQ!J^oH5(3fW^p9&vpUW-Nw) zCDj062Tfo5-a{tH8-!(<$WOy2v{K$}$XTu6EP}ww<*pi$(k0uz{1?ocpJyL-kLcAxDoc@cdaT>;3a1m^y(J5~Z$;f)oG;_1t+X(({m-S8 zn2FMz?|_IqqgJ&o@^p$3K4r)4a^P?rhFO-mR&>rYF|yB=QS{uOr+?DOeOFB+$a{9I zKyiMys9b3FTPy25_L<+M?nF6n&CLIFN@<*dbe3Hpv2BH~Rrj$`fI2^5wvZrN>kLr% z4NU=_C=#ZEHyj>XJm^$_%U)aX^X^$pBqFVHtFDQZIUg|VWRT>ee>0z=22u<>b+Jz- z`v=ZnCK5Q+C?53SmUA0>PWtX(*aFGI+9lj)9x7x0Zcc$JUC?d<-e};eIf$MV{(7$N zYgGHYa4iv==?n!zv5{l;$&EVDcXL_tCMux*%TRY?T(x&akXm%CtOJ_Pv+gCd?ahyl z&Azoij?M@SIpwR~jTXI5oqL~+E!(7iOk{ZE^(~$G<%X4*)V!h?|R8Dw;?a*llyzA%fT~KHuTOJD$do@=sL_0iyt2&8 zQNSkYXxWS1{4d{U1eLHz=aE?CW{0VZF1hl7CNAm^`IPcrlcDyqM{ajthG^*wElUxa zA@#Ep^vVXY=KK1(>s><$oLa4D)mJ0lsr|n@mA_yMyc&7XZwYIHe zEsQ0Dd0+R_JM{x-Oa{6_jkC;e@}%7E@U-nw+V9nokT;2U(Qsb8EoLj5&a=>GL2uDN z0Y<(xma?U-o;eGEgD~~gz4S(1yBzo5$9BxK^I^gIy(A9Y(&>0Z_t7mgEaF>E$GR&& z-?0|FQuk1U+73`N3BdRg%${i@G8%_sVOnXVx0LS?(`$;14Bt-V$(Rcwm)Sr||NfDW z9;tDLQ9lYr(c%oKchfpx8d@N4)&G$c(SvppWJtxA;zSz|1WeuCp;OT zAt(Vh75Q>4T|p{YAi$DfTnU{UckPYUu?Fi;_kjRQ1(mICd~L7QV(E0c0a%pQ_w8$LiRinYtwvRkMGe8RZ`s6XvTz}z*T23|o165#@GX#l4!9Dwwf z_DrnDjP^BBXS+02Q-2yVgGre>5+*jtO;-Zs!3Ze~v~Y!~uPX!d@_KBiTzf(*aX^^C zmNi5u&ZQqT&3pFT2!1Ow_wHQHzQ8PyJTswjiN2>5^26Yb3gyZi^7#<<_k z0@OSY94BfPUGA8Yysx%_K8wk`j9$wQ1Z@havYS5+wCFOZzmOr3{b^xmwlGj@-($9i)hZ3G_|cMlV7d&a5&M9+gl_ zFfiA8Z~=6yX_fNQMr(_4hS3J=ajJQaQ9li z+nENpV-&4G< z@v-y-i6BI#)FBZI^#cTvL_DxHE4- zU$G5&7pLE+c=Lr9oGl=@hH&`r7uw0`;R{_@k*&un!QQ5FQRFq#Dk%iNDfMCbY#1l-P_^060!>-{Lg}srHWe9Ss*>~Wec~Lu z+^i)~WN_s(oNy`nwnGnK8z9=%aJ%@YkdKkA@-Us5oSIbL!B5O9A#s9>W~?tL;J24%>G%GeT7I-YyBQQ|<-Z5E!@fcZ)h`(?^v_aoUi3az zFT`7JQ)@^cndmmEUKnSFpHJs?x^5*uN|z#Oh@5jDN-mRKp}VKJ#|EtN5NZ7bcbpfA z;1g!BD~bA6AiFvq54N(S?;AI#*?4C5aV2)dVY)J&8&74tz=7Jjcj_a8Rw2HPNRZSY zPQxd`2^N#|F>2yQ+ddV1(wbHVO;RYi322CA`as+o1y_5pB~mJTmWBAkD}lJ&{QK8^ zDe9WFQ%5zpFIX9N+D}Xe*B!+<l5)rZ+-P z#drLu0;~pTIZ3_Q9qm9%RZrD}=DvP>LO{QII#igT^9|%%A;zY~ZRvzmLw<^eg`;}{ zNN<%K^{~xIzYPm5P0elHitEE*o&;~!V~Vyr4~C&?YWpT(=Ug?@^UNfqD*-?|<^gQi z6f6xmP}C*Ks!37}y7oT@ZS(+K@?k&lJaokLOMGS@$qaeg>a8lZ?GsDicptR}3y|Y4 zqj{$XikD$w?k*?g?1#DaVax|u_)T_?WMlZZDu*6MmhOffr}RJx*gr5#mwXMrvRX7a zJvNY)lMe-$TrvRh7ARPgFPFVunP2hc%3)2+*ku%1$crN7T2-Z!>nq8kDR+tS-0!3R zwD9O~dKaZ%(PTVhh(K8%NH=R&98NJdny$;_&({w|vH#DPAc7%FCtJ|t5A6oeq#=A2 zRpalgL^N8!zSrc9N8kJU-sl6n-LH8g zLicd!Ou{2IT%ZH4AmiyDk{!cw@CR}i`(3#^sb>aVFVwdw0 zSnDhX8NF~c!Y7b31*NMx&c1VvpIv94YKh7&A4pNp23qp+rcY7jq};10J}q$CR{bE< z6WaW`-}tgYu6+I{qcW?5l-?{?Xzu{@p zZ%5Y+@Lh3ezoG@!9OSBvPTgJE(Sl5(E|rMFxL$t+mI8ScCl2o?ALg%A|enZi&ak54G zkW0aG@nBgc876=0tCd)uGX#c#4PH4n*;47KqsyMM8324aZen|#*`i{fzPnsDZ^4bO zaY_{DHp_hL*lyfjsQ*9@^9F%f-hHkBvJ!)Fs&pf>x-Kn67j;Bv zx)#^cEs|+wbf3I(K3TFOmqO1hi}S;fjg1I2NV#%S1y#`4hDGl^Zzf1(8{>MhMi_aQ zJW*;8DzvS+y9r6mKY4b%q^|``?g^k99?n9QCkXtuyCn3LdWAtXv=}^vP%^0$e}slY z>nBkFtgc`9Rp4fke4G5Ng>3U?3FIl#)=}Sz9}g7k0722ky>-e?@q#&iMI+YrVa2`G zM5c81F8BPZy3JNRx_F5_`C%1)1Z}goXbv|1ml(QTu+;FYB49dH!!hgQU1;g3x_^vH z&+(}C>*qQDPW-*}7(g-oU>#(NrFevHnZv*RYzIC_!huYLgrifx0Px2ol4sACXclCg zrJl^;>L0WG)kKg0#;g2I*u=O{Ge{%QGz8SF$%ne>gz5$4t>MpesNc-h#YX{uV)`HB zJHl7%%}T+yaL84{)a!uP2LShs85@3Hk9Pb6tw^VYUXUAXiqsd}b!Uq;*D(X0`Sx6)Ql@ zm>gJUz*ZmX#)8Z*UaysTYL-YHQfRd!{{~4eRm^L%UbSy$4}ZG}HH zF@=brbuh6!F|ZI(AiM%t2G`+0hju6^_i~LLYPeG{?I1h4!Iltql0Tutk@L^#Y zAkwT~vsC+*M~-g-f$oWR2C(|jdS=9S@BU3! z_0Eaf7`vJcZ2B&wsq(u5Hrv%<$B1bi%iNMzr#0C({&4!u48#D>5$nTR)`}Lm)EP^o zj&J`Xp14;HfRC(ltkijTCQD@}`inJ=rBl86dPRkyryuVUQ;C$lXp6~p6*bV=-6tUB zHq?WekjnytMXxqZ^xl_}$Ld!X<1=?aQvVBpiIwhJqOq8CWEH7o%KT%WIs0>ZzJM60 zIogXi1qjvL0L(T+#D^D?L~x1`>EQzyzv0A68Cu^F{~SAAs0H}T*q!QBs? zhaqdRFuBP*xa)hcoycu(F=W(?tODPb7kC$i8?VkDI=z%tBgS_j6j-UF@BpN!!I z*FG)2&~8GZ)1r3R@6Kc(Y+ql5FTpSVSep;$!#Du(8TD8B;+}W;VgF!s!0#B{qYD#A zwhKlG&O;bfy$8wEx=eC_WRA+bI#2phkrx2w(5vi{7|od-AP{A)Uv=R;cSx{9$#J=t z)lZhuAnncW%x=GvtXk&#Kw~4;ena23jzGjkNaIFx zmwt3ugigHkzKutl+u#3JdOvj2Qym%em!tR4K-tk*?=sCJq4h0Cba^ ztIE;|)E(_?=PU)8_vz%1Sy6jVj@l6WS0ju9+?Opct2yeJ{x*zkCoX7MKO+c`2U5v2 zT|F+#L(fJ#b=sj`0rY*b+~20_=&j5v{$>GO{mk>|&Y7t@pHZ*))AV#9o+q=l;NfplM%rKKAo6Jzq#dzBd8J z6^V=gB#a=u8Bu-)6@`O2DSD|uyx`l^!dA&_YdEnv;8&T72UqlV>-{>YRHb1V56X>s z5??_AvNNFFIDfvh(Qy*fyD}t0_TeYC`_yrOBU$eX*@-ud_8Ic@tgE8yoO>|dC^ONehaG14 z{o3n@r+x`Jf(M;-<_m4ur5?BPIdwTSEFx@?j|1j#E|DT`O*61@x2J_mq5x69e{s7N ze-LwV+3Yiq2M6%Fy}XjHV+HICmKTbfL(2Y$o2`z;efH8>e^mfd&(+jlZF5tV=s*kZ z6O+#tvPRWaN=CwWe3{41HCXQ#Z}Y5Y6lWHtH-If{jjG!OAhT&&HB?4*=sRYja#bu$ zLt>DhN9cZuCZ6NcS8}zjwyP|b*#7M*#J)x;1CwZZ0G3t=LF}rfz@Z z*l&t)GCZu5RdL2jnRjQXzgY>TaLmye>=#%{7l+ZxuqGU}?X~U40974lG}qH30_cv% z->aJW0>PETkDq{Kz1mUJER4Q~PU-=%#358{fWV5`Mw$ie1gS%$+ltgk~WhzajH@e&1U6k#o8p-s6A>9k|`>A3YwMZ0yetyO!o3Pu#{!t09?p_l; zbZUG+QCZsxfV*{;1+?7y_BP1mB_rw5yY)Eu-_BfIjcoaqfh857>yei?NiDSers-or zh`rXr=;S6&q{qMeG>?d1Kbf8%z%Gt1m-;hR^jx6fOJ^y!?&PQqUIC9#dp#4A9P0?J zBsuQ42B9{brp+JP`4qn)9cKhv00v#=d4mOPH`|KxNeIGOj`{G?I`ZIoI zm}vD9fy!sNFC@aQ0DR_9PbCoV9PoiXPt28kb3gf5% z$f`?M{qx<9Lxt48d8?=>^9$LfqZTP|7r>&ITxv-kL7@URRb!!T#HDAz z!i1W}c^_RuCD@N}*0zy@>yew)WC`{Wk#{)JNQ0@RF7tiu*ZYt^>{<7XTRJ?=5Dx!`CH@n;2<{A)V*BljVox{?b0Je9r_ng{Ig zOC=JPlP!(y?)#lH_y$|Uw6_3yFmt}>um3=c(@d;T@dGHfBOxHR?eJKExKBBIx~M}0 zJHR69jxR|idMRC|j7%a2b3E$!T+Jcdn|B?K7&+Pth~8&4*uEoD>T+MTW0UO!cpy3Aj$RpsR=G>lXXYH5f6z+C3JF%mv^Yq zGqdgBLvIJ~l_>84;h@*vmrLIKl#N`p4uWHmctkXf`UfEvy!*#)q^Sw_{d5d_>4(Sp zMt8$(Ko<@eyn%1u#VM`E{@se@s#$O;)Q}@F0mM)Q*Bi5I&8m3P@(b7F;jw4;bFJ8y z^bu@Ws|at#_KRg9xoS#jDQOAZ*LctH?jv3Tgk6ck@Mr3;wO%FX(MPxz$i**r|FZo< zvk5*ELmU``J)qR7uh<6>dzK?h=jltB>8)NT{Ax_AL?t)9i3#MLbo*krsv_JwT$fMf zv=8Y|^54d}qqU0<1u z1OHF`a=8svn4-!b7pD^3N?lEgN*Y3ZOWDK#aitGf@WxMrl3*JYf=+_z#13q|zm=xy z4gDF3%nKK640eVVP9|0T&?ojtPSn4?O(YJh>uN@~$!7RrR+~_{!469rhOp8335h?C zxi0ox!n)cQv^I0RI+PKW9b@sTsF)?X2y8gkW5O0RXPy*??1j~}XxUJ)WuwjvT)Y$Z zjIR;5PT!6VvbsFcyvu?4Q9HUiY%8$|dnWT;2}2u4X=fW(KpjvOzIBW{uV}~5iikN$ zoTF!6iFE!1UL^9zMuFXLE%=DfnDz8Us8<@A8}G8pQN-^Igs-j!YM9297D$GSlO|^()nZty3Qc+$`HWD>LLrAoYsfT5 zS>2CLzCU1l7Y2gxy@$NZ_(pEIac68y=jT<7L6nxhc#FZ#H^|7ZmJb%HZM=bilHymN zSId48GW1DN8#MEKR6*W>Ac5v+;I~Pp6kWtOOg|z_3j3R@gw;^#GW*19%y%L9NA~&w z08K~9zB)2h*t!-On7@4t^Hs6P%*x#U!GSjDRB_7;@6v0_E_5byQ$bF-n}3bMC)5fT z+B_1M=6sagnKcy%Q&30JCYJhYf*msC&*#Q=(YgD4X&7qnJvh6P{k9T8t$*>{I+JK_ zR8@z%Kz9`fsEL(JrZB9W+cUp1)``KN7ayd;=wMovK_HxjW0$3>>nuZI@-&l_H~79r z!?S0}%u;=~g&=`c7}U9_to3g?mY{{TFP-$_>2oMn#Wy(MAgPg))?Rj;;`wfI-F~o1 zEVg=edH$Glc0X@-6U}Y^B^Xn{C*CmjnPXuqX`{+me8c7=7L;LKKQ8Pq>a#+%vtbE5 zp{Oy68NA}zAFfv{v-CuFI~aCDy!*Zk4$n?c6jU!-_TADvIjl)4+!(-X(lX%^PDiqG z;4;gqdqnGASh&H&A>8)4Q=g7_`_g{kjw3NS@hcfmgp2P|l$Z~D-oe`oW$0>+#gwXO zHvIT?{3S*kOpI!7=+mHwBe>%mBF7~z3fD47RwtoT8bYpQduGCOSb9YxR5#hSxH8C4NP^k}M^cvx9bY37x_G&~{!V-#_g4yeKUS>W|KMsGp*U1rj0%*i^VIhI7|? zCM`WOxGb@>OEqYEHoc|`yp8Qg=v77Wyl@ERaKqxQkLUCmIw!Ecp@moOs{|$xuF-0X@lEPEezo6e1Qj zbEUUqc&IE`?Y>U?X?zgZxt|}c;OK9G;l%lv9=x5Dr-vbX!kkpKsvZCj>(T6X@8CKQ z3E?FDAlWp}PI|f%>}Y=?7U2!owNED#MU*n`6{tdS z6J>2*R;IB{q~PpqJLgELQtbPk2Nx)>8e5Boe_bhkcB*AlS^aH8-GzxeHTBT1{K*#+ z&(p;}Vg5;G7w3CX;Hu-z7n#3pbRExMk~id6iCQi?6!oNdhYCem$6Jx3Q6_*yh<>T0M$q3Os=9M zi)gt(mX3|IUP_uN0`GVhJAx;hd$1E1e*B|!+ZXR*Zye0 zrR|ueGW9&$B^2+G3vc{M8%W%K%tsDf5Z8-KsUX9k+f`6mti#=sa0X51N}YM~cCo)n z@lj8}oOx<;5Qc+)qBmo>*xixXbpFZqP?zc z%-A-?cF#h)5hNkt5;DI+;itUGx%au#WfNhHd8Jrxo_q==a)B1%$gK;s$$!x|ywNGU znWGAnNcbqzpMC7rnf18e&na3|*IvK2(Y1DUpNipRrRZmTwB``x)J^P|HjCCJ`yI@% zJhDTYTyq)=RQ5Y7p;$yI72d*~2!V-VjX#lAn58nNrJ6|2th+yQYjPtl(y8AyD6w_+6cNCWjn8FtDb&G5 zUgFd?dU2mEqi>1U8!w@U(RlV$jPks7v@D%49^AV(;xQ=?Hzt#Ng>R{|=A+(r)6275CL@Ml2rmpt;e<8P{rDJG;QUx1Y)YPyo2rUN)L?; z`YGUxr&KgC4h%z3<80f`lmmg>uK)vM6I_*#y@FV@1|A$o__DKowq%T(=2>C-Mr|fj zqt>RVVoYcK$w+vq9TimcE96XVyEMn=41+G97}?IB{vysl4ofU4ADE@!C8 z>CbPS-zb$7FyPNqkK$7n&Gn70kKvnhFbc~)aNB0Gbl3nvYy2bp8h)!o&d zcZ}QnZ+utSM>Tr(#IFD3gK9p&^^bVgyuR&zj^%OR{{UU_?FX*NL5nBdv%f97x*mg- zzaVzT^QRF2=w8R7gWyu|_+)E=Zk7%bh7drLb%(_6PwBctD1a_oz>}tKs2C@7KOs70 zfgy`Sv$keN&0cGI2CI*dIX|qb=(p}VXSP}Bt$g1XbMtqj^gm9T{oY0Z5AB$vJm0Iw zmJM+GtK#}fEg{zP!ff1|;~du@!88TF+>%y0js3`lh7+|tY0NYUi)mU6?Ubxl!AO6Q z$}SXq^a`Rme3IGlsqB;N`IQpq=WC}{Ztt#&DKID))iIo;BPb7In4<5YR3+PEjEnpu z%m6r2x1h?nUN>(`TTMHz;a^SOMQY{AO~;%}qdUHHUhvU?h~CXk^Eti1{!L-7@y4Xb zv<(v?IsCoBdb@B}Vm_+Oh~VW4O6d*P!obXxSA^Hcayv5T1$u!dwTnP8Eb%ozr}SGf z)d37kBi`ATc(dnhMd4L!&yqxhJcULL-*I`OrSC0K&TiSjG#|4^p%^QukWp*?e9dCc zVz}U0|L%&s`Geb8eF1V}6Sa4KT|%BlY3l{};L=F+(eTh^mi+-FF5XADzcIn~!q*SY zkmcFRig<{LZUFIZb1D#5+Z_BU!ShVkKG!UkmG)DfrWnq@X0s3f-M)KEEPor|)qY_} z+s)Eacq5Dh$BEkZI)(JJdBG0Xp*ti{Q_9Ra>M(BpIxK(${xtM=-u$~8nuBfg@7$eY zXXrOkMQPoU18+5@R@Qf6(X|h_HyQZE8U>t$iZj!x!TpBqbx%7z*>ZB>2vqspK(VnM zKhXW1`f--n`=W$~0gcY$j$jnkjFOj}3EN#n0@!3|px**)sI+2o`kPL4$r13EWJ2zD=9b6IxR0r<5pAO z2*H=(J{-x6WGj+jd)CxB+7*Ngd+avc0d4uX6N3Efv6rRZ3tbDFYDuwl>Xtho9M*lG zz3s1%eqZEWZT@!M+pQvpT0#Xkoy|yw1d?Sed+7QzI~IOH?Ez|WjJP(^`!E;}vr`go z>}%vnq17%Nz+D9y0`6|7idD(HcQ#Z1l+r=+=pf!2g54+J97-z667wPa(|Ox!^KvTx z$s*;Q8$?HbAU0+Jr}^MO+s~g;wZ#Q$9llp34ofXy((VjCM;VVLx73QBVcIw8Bl>g| zfJ1VkX|f~V*ke&bIuf5MbqMeK*!h9bFQD9yJ3uzrFQgRt3q^Y`&Ii53XO?5I@mr2b zX4Pgig7V9m?oK&QLR!nPvG}bQn`@pP2?H{u+9;@@ih_cImL?8#X?}&WP1KQYp{!+V z^EP8l$kPi9{?kc^Ma(ZQIcWwtIwBnT=o zL~ZKNKhR7Lg5=vwKjDI24OI*~cAoIIU+t)v_9(?7-bPtxaraAupT%M=`O!>S3Dkiv?o^DSZiZA@cDVn<_65=@Oy_g z>uNMyY37cu;`d(S5+T9kT-G3FzyBybd-ioiv)S7ycYpeb|giJPwrO zGHcAW!cH#%l}~@E50|vqWzf7Ox*i{{LnQcI+htA$Y{amc;H%QrEg6sOP!S=x-^-XE zJu$!6PVDzL&g?(Ej`2F>6F`*&F+1ab6kwaK+C2HXd!PNZ38b~1z|pwDUdxM6eXdxb zKSqDnpKgFTL(e(erf$OZ3VYbJYFhh{>wjUa54p@f?m zFEVz%!bo`mzDJ@K4hJZT{In)p+@eW&F2b<2(@B3lcXk{ZBbHWoe{8mk>g?nuee0EV ztor-CbdFv;(;L)jCwIdCIo~fYI6SjJZJtTO#(5HAkZ-t_eG=?Ks{B@)kNE_aNO%5h z_po{8C?5RW{2OP0y!Cgvj`>xNjdo>g5iayXH*!nWDCT{GDo9 z6Gvl3kG-~L)HK=Ra4DS8&{4frsqDbTN?7|$bog|AzH;#G6U&QLm&ARp@sKm9wQzq^ z;q#TJiAt=*12{(E7`;z~a9m_?H8*)D2!BEkEVT#fw`X0{lVzvzAl1PaGA+VluSgtCc65+GzXqhY>fD zg2!nQ+NoF)cg>R+9yx2rU??G~m(%k%Sax7$!g9AG=o5_H^sj%eYokhrFT9S2i?y;Z z%~@ZryV2Ta=Y6?;R3IAkk`4QAbSb|o@TpVj9s^0(`+*&|)0X;}PxG!i2LlZGw=$>1 z`DaEiUdp`;k!4MJ9jxsq#5bm(+hLlu^fjp93pBReGES(L1~U6)v5Fmw+-f|p5Y+N# zz9I6d^XZ-koBcwEQHop3w>L{ZEA6hQf7HE!pajSZ@cjM(v{Ugaf3?fB@{C1%c6^42 zJwgN4LI_F~rpqSM{Rfj6c7L;gAeisCb5o7IzXJNI>gw!1D{h4uOyl$48?llYtML+b zs=33^cY+fIu*5%?&IfvC#I8pZiapac<;7wbp_taIU4gg+1auNOemCdJm~oe9vnwUa znT-kZ8>c&yoUwJjNAALyo<|aTqtyZ>G@e%^yTn|z4>Fz<2Cb4f!LY9Q;=So=y6t`S zfL5ouy{XcCw(+Sl?MzBa%0IupN!Ej4IO((1CStojswU7w-(^7Tli;%IP0Z&&OhZdM z;7zvZ@yv*X$sVxxH!T>Z@CO-}#C&tO%$0dL~P zlVPqgH5d*Jb=RM@FtU`5qo36m2Me+x=maT(tJmfp=N+2o8&3RI>p#D0nB3+dB(cah zD(DGeCBuBKyHX_c9%}bW@8EhT({zX%XSeDq{dPtkQ${WUKhYnR)%(JdzyWao)}d}z z_dtR)Dqt*ODyn{>Nc+Ipfy_y4%XG0(o_Ixh=);a!v`y8#^Ze@5s?OB-PaD|R_|P7$ zT2{iy**NADG{>o2#cJ*G=h$k)Jc621#g+v|19QU2I^+2OqM~_y1`t#QDWXg3s*^y> zVF2?+vR^S%tcg?w6(wkMU$x4@g+05Tm6~MRBEZ&~&RwrjNuO=FC)T*4%%udy1-HmF zva-oH8eGIH>u+g{f|=ZwwFbvfFr5qpv=)ZnCPVD9b7*FZ(gWQ%9fRu+qG)X5pu1!=eIj6$;t`mw0&m6f{ZC!gvT&(z*ScfILr2w+f;iUMi34BSRH#lI=#%L z%#Sl@vFm>HZumciMoNGUgjQvNBHzdgHNC+A4VC; z;KA_ESfL@2^#&8U5xAN4qU`+SN9V!;Q^K#G^b;0h=ER-nbI&M`$mF*FjL(u51`F5TO%;wUNIV^B{}=`TZx$N(q;!M+ z{-A&@)^10I(N@t3dT}`Yl#12OmYIF51XC zRHt?!~`{%ir@YBmES)DW5Q2(m77^&m3%_x+R_iGi@i|Mr1N_+L< zX}`^I-L^ezjXh#JQUu%c4eHg+ph5Vk$UoFCN(>Xbu%uqD$S%qcBszr()4A`ua1qR$ z?Dyv$VjJA_PuB{8z7N2yvCXgi1W+42M}yx6$L*Pj1QC;OU^QSH9}Ww@QBvb2*2 z+D(YlsU+6u5@~spvt-LjU^)@eY+t|Fn$DrSJsjjXL z%+yv9O`(`X3adY=j9O`ag`nvAUS{Z&>q~$6x{#gZGuyjXO>PG&LCc@lK#f3kEEWpd)o|0sg% z&*Dse*zooZgo`p;EI`!Mj~5xXbGlzQwu^XTuCt}jGrjV3H^XW56=L$O;dB=mljW~H!2l*{x0)KLc4`MSq*`6F&tt<47^_*d=fm($M=O*MDHM?gG;x&D z4J$uJ@CjKz{k2Kp{#^Ir+VX93H;%ptbM--I2XWeK9VC1>UYH#vKqg+DT}EZ#(c9wl zIAlM?V?U^o4}PM{0pGEH?f9P{M<<`S1zln%P}Pk3))kkwO=&}>N`GOaCe4Cr zGbEu{j5H3KRINF9Vk9T&k{|d>6=?FOtKg}Ayr*Tz@ zlBmVUKV`WqezA|=$O!ui?Ef2 z;x@gMQq=7p#ftJ|Zhw_F!m?a?i>_L#2zE*z;Fvf8?UH5Mtqz~qk2~_x$M-ToMs1}m z2|X0!-zASbn_@>y@4o;_qGYdme1}aUo}Uq>{0@6rd+fT|?&i+w!;wK_VXw(99oa-& zz_K&0h8}8^jNHSVimvol#dchhAiqo)wIat%lz9xzt&OltKz9kI?TU0|hl&Tyte&vHruSr#kC zGhD>6hHmW-=X7b^7}btLzc8WU!MkvO1vu!X@#BW0+F;HiilZZxXxK0m+d; zuMx`K$Y$1JkX5?mYSvVA-K<|>W(u=)r9azcY*Uw-bBY}Lz+Jr8s!l?tE10@T5TM4qcB)ofv!b0LNHQR9I4evp^^9r982Uu9F|Aylai}AF zT!xX6{M+tbaS9i4sodlwercWTqp2W2+381(18!@QHcDoIDfl|8k=$&AGYQ)5~XLx?oxr&mpV0<7LpT zml86uD%n#-@#7b5-XZCBP&KGihTYbX zYhXHcw*imLFN0b(odOd_u$%K|j7JYFsp2F#Sn4%BUJCTes(lL_+|!hY8FZoN%gkRJ z)^RuPxzQMY65Ehd^9W#{5Z3C?gDPr#p=;}vefXc=qQQ1XbLJR33|NxJQ=CQ3b>knxX&(bQ;E%<_ZpOx-*DKiJ8C+kUevy2SreY=PvL~7XzL39UPlOllDNZ4foS4#?HTUx7Ej+zDPhqJu?g8X< zcMia0oT<>PlOO8UJDNreB&mZkw&#-0&GY4>ZJ}NVNKPtb=i0!fX$VN*up3~aY=An4 zyF6-`>{SFYJB@gw*;Ta*#^>nhq{B~NzTBnaw%jVxzr5h@@fTS9fDSfjy*Q>5SpK=c!V`2OlA>Q{Plmnu@zbXqpdI^Xpm}nF<6Y}v3`p{T zl_5VVR{NPX*M3im3jx763j6bi2%?eAQSc0(gJsrCy;B~5C2zR#nk;-KW>37#Hmcp^ zIWL7BttQ2O5g7!MFY(|#5 zdA2uRyMiqlszHYyOZNQ!>AQ2yrKgAVTN(*0OISrFyN6Gs{=J#Q7+mhypeP!zR zY34_q>?pZp;)RiCJx+=P(a6p-*yP5nK*p@gyW2n{@lZ-YiK&ZZP|~mV6v%f?0yKid z{tNd|@m{ni_0h5SXmCnIer9PR?!P4JB7`ajk;t&ecSwYQTANNdXi+JlAPscT5=G5Q;qZYb13h;xj_*Y15ab7ZP;M9?PXpob}k8 z1^B=B_Ze(LgZEmk*mTsg(tf!u6+upMx@+Ca$194Z+(2ur#Y4J<#rUpEqOIzn<26h? zbJrW*4<>0=Mf{GS1RIITMD(NlrNc~Ng{XWBSb%q^iI;Mh89`Zm+CL3^;XI*zYKaZ9 zI{D7u#KM_&?FkxZ&0L#AzpguvR0SZ{f9BVyJsII6oSXS0<;DL)qdNq%#GqFpU}7sg z&G4A*m8~&$m}dNRG{(>M_|?TnAo}#-)33az^9e?br$r$U2Y!P#k(-L9*(zUx8a#B6 zlqCbj_LmQR@g2_rTlgNj9|)yGp}1PSXAG<(o;U$dBLXEevQSmP_`MVYry_8h2N zLe$`y-J?^T)0;Wtno4f@crBY|#}8-|93<9URX>jNVm}*SRu!PnVE-1cIwc1wA6FV& zcvjEm@l9_{QGlJ|6VAC(iG}_+(kj|MNixM7Dw4{QPZxuP7==Am-q{6>79rP(mAnhv zAZ+-&^nt$d2&j>zK%B4!2PEUDn8@J3w0EWS-9-N$xU(mz%%&{oA?_Uh{B+6V!YFloD-KFT_Swow=XTrqrZtlMvs`h! zXMF8cD`e{xT~|}fCI1qps1qJifo<)6kUrRwcMgr6NpP{s*miB6b6=9WzzaxO za!|_<%7-dPbC>^#-??ZW_BRx|a*>NH%=C?@L;ax!_?1_C7j_k6arDYI?d`)E9dU7> zpaHoe`&OXev@d_$mVg8s`vqQku|bo%%R(*ah~5+Yo0 z=irv0(>X6`%ua}|)%@*Bw78shp;`i3JWxPZ7PKBrS0ofmi}}tbaF>pWjkkUXgs!#+ zmivpIW#9WAZ=kb=p{U$s9op|X>bqRB&`tdM;Xy7};0lku90q@_S`WC9*8?Xvw~$C< zDSva#S7?_l&>j_>2yFC455ZV*bEeeV(SGUO#Tj4FSY^v!%m*~fz)pCrQ&tK5;7?5qL&IM)iRko!);u z!Nk~Vi**$bqy2v(@w+GOyqpU_Dh?=))d{$cs3EsGTwR|8rvefX*hYaker8^6IER8p zWcPah$+I!9?6&-ZFW&s*XK~MuIxjWF=?NoK-_!+^R#3bgI}^ zM*jXCpta2mohjQQkGS40+JK9tb~3!|B{VeUJmGu`8Bc(JqSeO!KIVy5%W0Q45BbO@ zk*V!cEGb0p+zFblaGHGt*lAE}kincE7O}QH(*`q{yR5#&0 zGEV{Rh)M&GYg1qHqSqgp89Y#e&q&LbX0PIBv8+7slS{nl@{IU(uxRjpI%oYU-u*;c zRY&eE8&ofFa}lNmbe=IYHpZn=uD+C-JWTKe0&t>0$1nMtiUG~|zfVu(SO6>`yXb8kz~zZxteD6PXaPaq)?`r(M?F5zodCPiBgPZf|&k=KZl1m<+2h zM7hqeeb=U}0c=4=*5=+PGG^_9NQmH)3Yc8QHQyz;FGo6@j$8S=Q7t`Mj#5Gi0Z~^6 zm;F{EyB3oCth28#fmIm>gVnqaFdrrt_B+85z4>D?-r%x=Q^@Bqt>i54x#uGIFq|9h z0aj-XYWUq73yY2RccDCfp1(4XR{hD60N#|-1E753wSZrsmIjKyKwbpJXYTkEi;0JJ9AztUL{)&iAJ+@W6Aek{K4nS5Xi04^P<(ALN5fR2EYE+R_93ET$;*i~!M@Vxk3c-4Yjd zU-T!quDj%+5Xy3qzc@)a(B69Vpjd66)K&wO_)&?DE5g8U;B?Sk!?_i{$l38&m&)$4gJ=p_jZ>|P@JQ0ug9BxvNMnwSb6Tf> zq<&rD-X<}Th_{f6=w6*BF+i&wdsxAI5!Z+8`}R7LnT=vQRFEHN2DDE>P}83ASS7zk z^DH1z7HI#Tk)>em3t#B#t+mK(lbMi?Z-cNH3jbguFVbwKC1Z<4EX5jAz(C^lo58}j zcK2AhZ0CHbfdMS=RyxG8fl#gkglHwIIB7KomjFY!XS#yEp-1ahFXGNu!{v(XvtGf+ zmndseCaI^DL?dqY5*iQTp|!_(B~ceeoingXUoG31sA78yY>|D2EJnE6&iUXIEM|vP z`VReq1664(X3N8~dy&Ku>nFD68gWe=i2#5+d82qds(|N#a+^C(9(T#b8r13`r@i;W zpY4~p>N8^v1O=tdl*8c5uUorA0p6lMgXA&DpIY_dCeRp)k2;MMrEM{Ia^!4xIn=2_ ze9Ar(6meBue}?7-#a2PlCD4!wlTg;(HxWoIjU<`KPPIh&gAY+;nyoM?juYdrsapMA zY&{}jJ(!u}u{DYnSZ3Osh$+sM{L*_-a=O~OKHWNL(3H+O)P)#NFGuQwdk4;qQUVM8 zj9G)TW>ta-uCV8JOnaQIZmC8nCT@{Nj?}*(O9HDlQ1nOm?kprF(tipS0Ag_k$NJAVKruQ* ztg6bnhXC{Hv`2=6l${IoLdDu;JzZw> z#ga63BrNQ)103g91uNr43dgF_NR`LwEMi#@cOmY;h4O%>aZd47|6~8-0W!lcB{*bU zzlb!oHL5Q8@ApKyag+1`P>+elZ4PftiVA)FD^a>CO2zHCqe|i)4Jtw*FHa9t^G~ewp7S11Q z5o(HuuAe#MF;i%ns^A75{k25b2oOl$p1Q9UM$#*`#e9%H#YwT0hj}AYIpi=txHE+d z&|4@1L_5;)cJ%>sb9DX%F46Juc1=|gGf*ZcAnnTQD`4~2|IOiAjMs1o^;=+B)>IKp zX3)|2tZw@w(kL2^jAEI8uYEDfQ~n(qV=(|HxN4sgf0Jp*cua>ZD0e!_JN&jHD>vIr z65sJQcU?X(R_M^dy7`9LaMytMlS%WD1PL}rqiH!7I0+EKG~kyppt`-W(YOG1AE=$I z#p+I=!hS?i{tR%BZ#ubTDnTXLz)ej_@XnS-!hGCyu%8^PG&;*n6n}juKsidHgo!cFu*?h7Cv#M6qh#dO$-z9g@ZpL%saZHT%mgUCreK~!zPYD>+%I=Fz1*J6!*Mf&G$9bW46y(f zs=b0STz-xHH?qt(2xg-nuMW50b`Y~0$&~8dGFLcEs>rS4z3Vf~mbiDF5r!&kXb|uj zcqipQDA+B@Dt>*I2N~x|QPDz*C26niuk?(Kh{^ zTod-q89HXeC*zUZuN%YJR8a{-)KXmVR#~yEC3DK5;%)qhuB`gKN}S4Wy6U3Fx~4kE z@WgupSp5mc+K5(gyy4s}AmFHJPg3-PA&I9t4DDzgedGuG8XZ~a1Bauwp>0z0KdUdE z>*L)wzYE|0dbmGcX!(S#nm+jJ84H=f?eRFLN?!Mf?uZUQM!b+nlDAw0*aTFs8Nlfh}k`K`XPTQq4ry2 zQ#C`uY})g*%ifzqH_#?av;vF*S0Mfq@=6n%chi((CO zpzt4&Ax6pWMxTrep!<;I2hxuNy^XgFTp)SV#qy<$9MRk#Oqxl4`&f_f_xdf7(yMLD z4pO*%iez9WTnV68-Bo7(EDz%%^%9Fy5!v*g^-JtMhD9KkU0krx2t4`%;VcS@w9uegpgAzbiqalHAYb#r9`<|f$- z_^}?~x@-3BL5F)_R2kf~Rpr%GV|4QA6}3{zbvoN=6Zy1gsnd#JlWb=7w@+RQue9VM zyX_R5lleEwJXNWr#fLIg_xBl@`S=nuy_d0{zk2oRau`UatHv{^7OV|$_YytpjNBNb z-@-&4?)Oj@UhX!lgL5|~N=ZbokE-L2={OuYRRItgECo1nIB7xyukQ=3CoyTJKj*il zn_?BPdt^Og&TTcQF@uWF4)wd3la>z0!TnPX)Xa|7(rAm^H%7JOZdcy-C0P~#*qlzj z(lei(u{sB1BLJ%gxH`qnK}u_1K{85CNn+ehc>ML%F&um`TGNgvb_ytX6tmH>y3bb3 zlk=66euMCC&VVu`eRj_RMJp;B1-*^BIfdSCxZU5sq4Yt-2HP{5WYI48gqJt(3Sm`=LZP=S6?yF=m11gp53650OKCLuF^6IT?9* z&1=kK04xf;_P{f3aDMlQghORW^e}Q({3eypL5VWpEN47=s4H4Tr7IlzbvL!velFq> z5fjrpszUXwM4zR^lr86XYk9S_>6#vtsduR&?fP z#@_Bwbqp7jAzM~}voLQiT!2{~ty*bAk-VDCkMxe`C6rI5HWnX{G`7k(Mu(eRJ*e$b4kMf?+UrEZ z7RT>nqb)Ab=k_^Q@j$cEOBv$>%ua;H44xksd`w%Q@tSp2N}UF0J>EmLOES>PM|~}$ z$_ly>1QN$;;5b09DL7gj^ed8#$N$VZ!0|aAV9%c`2<&lFFHWK0Eag#`Ea6GFVOi&4 zDFCFm>5ZW#FmK=XY{oDpRb`0yF}03>#otwqM}ZvD#-y=RJ^)!6PWoLR!)*XS=s?Io z?-CKzga1-Q0U$sb*o_OYj+omH1j+HRwajO27Hn&^q&n#@*1Mu@4)o(K#a5`kl7RhV ze~;?v(0Aj{bjOA6ICjmyZpPA1((MzU~TB41NFxx4q0cgJ)EjB|9zb@9!TC3ZsT+8{I4etxi=xJbFg= zSqTWiwflN{ZZEbfHu9py;yeV}i-7clt7_wRTh-ZuI;&p!w|n?vOk0<`Ubhzq-?ub_ zxH$}d1ZVmmC>rw5f-cKRlA`R5SviOsfJP4531IQNG!{#bh+L4~>~<{pflD~#INkD?#mOfz(^1v_M$EZz zthjxd#EqGKG;9%tFt@%TNXe)gDCbX*_g9k(DqOa*y5cFhr=mS^`M&Z|?ZcQ)6cuA+ z<7#!;k&D;g6uoTG-QH7|py*(9FZ@jgUCBHabU;LGNxLQi0y7FSD0MnCx{W?z%UAJe zo2bZMGfE{sE$pK|0-@V(X5%E7AfS*J8z2^ck5lG1J=wS5K4voh3H7!p6S!Dd$SU*Z zJJhO2?+R<1XEPvbrVp6lH;;J+uhd(S=Gpl9j1UgBUFp3| z4ECR)_1^Ji#>}jS{?Zn znm?zpzb?CLM)a|hnb-7lz8hm2uhR9a=dS)Q+TGVw1fVjEd-g5wZwW z?So&rnD^#I-$V!AUVFi6IwWz(y*2x-Boe(tsY`0-HHhkKJ;ow1{n2Q2?bny zg>*Ea+Wf{mcEQb_>={BHTK6A&2MlI+Qk(`#BlaGvXFM&?}F6EzZ`w4rNb>QIXCAXAeFr8 z>pJ&p9-drjafj|<3seBLqu*_(+f(tcsUEK2&;TMI{D!&~3Y6W(C_Rt&9$|3@r{PlY zQ@r)P2T^;00%&wx)H^L=XN%~*+m$_Z!jG|_G9_E>JqQqmaG*)~?H&nu7|t+Vwv3awr!Dw*fFIM?_7w1k+CnJ{Sr}ixDUO!VD*IzXODv*^o9RgR4(s` z6cctUJWyqK402Y}m2$3ZXdvAVDFSnS-K(Fj@+>tz-zSK@SCY#huT~|CnjwNk#w=8E zGJd;~JBzO8U_WkS%>2{WG6rC&VD?$lMi}fD*O{p`YSEE?;Qr$JOY=DThv&;pQu04b zvpn$xjK|o*XR8q_*+~xKggzz&BFod&3gDQR)(xr`M+~}NS+<5+0UnNDXofbfAYx#d6a&zO7iv8i8mR)}47?B(UERjZ)R#H52a%a`JZCAT7GTJZoc z7cnc6@TNW>x}7BW7VWM^m>Krv^61ARrfOgVV2dlAQyL}Jy z3cezg5rQ>|Wm}Az+q18A?0>6%by}grfZiRC7zW}RbznZs{TE4kc-(mF0DqGLTst%> zyY!7;CVAYkeQJXP)#V$DBw=Wze|;$MESQZn9Y*A{hyNS8iOzCi5yZlm|KeGys7Aq? zg?XtD#3J%sX;A8!PhTL;`Rm4a=alf&Ez)?G%4^3^0WUL@#=;|yf!|vG_Xmn38u7>F zIQty@L{Xo1@B+pMNjdJtad6Lv|KsEM@6VUOq-nxoR6e|fHTr_4kY9$8VLhWo{IauG z#EmP7+N0w)7bgFHYj9bL(qutzGeZn@!7KWqz(f<{z{w<&=6_};{{42~#~wbn%vxcu zSXOMMGri9Mxm{cC*K?<*K2I-Rj|cq+GWpjrXzk)ZxAvbH(!ieR#p|9C2q8HV%fKmO-$|A;B1M*Gjp{I?em{x^+6fwTVOI{ody-m(An_eS&i zXIIp}9Z01v{g0gP-(E!6{DX)1+iSrhxPZpsfARSL+?VA3%Aq@23jNPNeD7F^Zbc6C zuS*|nhy8#5s{XHg!~Xy0&-nk&y+W1N!oVu{SeM$mLkUs&YyB@f5wt}mu76$0u)bF| zqY&GX+{PO7xnY1eyueuYnlH7xHAz+d>~Z@OA9dr|v*>K1ORR_Sd1n z)NE>2{RL+yGxyT$I@YoIoZ~n6`!mCXB$_l>5ku%zq(;180jW=kN5N0Nq2c0YtI-s^ zir7|n?Eucd&f?ryZUBthZ_FA$&{777ukXYYTIUDPj=cVQ4;oqwoKCmt-Qdwxn3{fD z%1OFv?!)R&j>Vek_M6u46;-deJx1@p_O2?n)T!h(T|eT>usg2#dxMzvRiNB+W$lid z&k(!VlLi#W4+3t^kr%V96@Yr~XtT6p6o|ZSmO>s-SCeOm_{62F72c?=csAQCw6)$@ z!u<8QgT1XOuWrry&Tetn31+Tl-0N+89z9Z60Ucch-)e^Q-_U7~uw2aFtvCOAP%#3N-mNd#fB%8Qd`rrF&}~3d zjy5BU);EPFdsh9<#g0%LAX$IZg)csA>NO|(j8%{B^F#?JE|1HyOzQQR`q!^t=}_@I zo<=Qip91?Hqj~iIJ~i-DV&0s?AZ&0}Ah9L?dE7w%lu6B}P%s~PE7evFhjFkH@^efX z=Q$0VPN6s3oK7n#uDwZ^kS?pQiAH;T;4s zGc!l6D#+CNd9UZzC4%?EOAXw=&I=0v=i-uo(>_!r({W#iVN#A5&v%3oOiY>vli7+g z`9@cm_DIgCNbQq>;n2c4gz>wu@4EsgQOT_D!cq(NLUP=m>EE(EGrxs~<+@icU008LhWmt1N`$Jc80^PwU%@Rai~1kSyO)#E9=Gu8T8 z>}rn|7%3mhkYg=AZqEf>>7H?#nPlaqa9LpDQi`Qx;*d*t&H0cdFlmPLTX8qeIX1a( z#BC$T)Ws7HA14|LN-=BZ3e1gFPCQDclK6y+Fjc}Kb}5g(Rp?Ja_N$bnOSkS!ccrL zcSBqy>Aa&8=$Je|AOAa%J>q`{TLv$o5g%8-{hIJRVNm{@w*P|ICJL;Q+3Nux3ztQN4-sXzv-OBmqL^+OJ zizEN~%=MQ^HMi^uxw4t{BYO3K;8}UTP36(*I!cu~&rq0~l{md>TUrZt;Sv42vuW9r z>$u*xG?)0%adu9NUZ+dT!4H7IxT`6s>$SrT+LVwu)p3D3JPwaX@)A7*Yq_;;W2-IRsj}Vs*z1SiV`ph6u;{*R55C9ad$b;WYygqLn5b9?mizKt_D*cw-xmRc zeB*?s%K*vSd_b73pb^ZsAoJi6QH*&aXInB;50spI{FTK8&hx!RG{Gp&AMa#~4$BQH zX>k4DW@E6_ILzpQ;{-WQflnG8el2|`D=fZ5fcCgDeGiy@tr5Zm!CZj3#B-3lLc4EU zQ|tL!+6HiQ#y8=9*g6WQY%7F={W3Nuzo$JH=sYu!jUdWNbKI08WDMkhzcK;bEOLMp zKr-OVC~SyOmo(9jU+U$H0JahiG?U{>>%s|huK zNw>%}OZDH5?svC$aFB2`yLi6NmK-Bt`azpkhr;tebYXHHtP&OO{qj4ka@uK+9soW^ zgLFb00D$RZ3d;JjnecJszLknm9qHint|_qhaz7_%qawpHEmpYdhkcqUkknz?ys;qy zC@YXY^j##E?6?ZFBEX>%!e$y>20x|`<<-jav2+f1wmZZER95r^CWOu}8>u)Gc*(;6 zITK*sL^OqB1<9_WAzN1>03@OIIPmo*FIGx2Yu%`I zd%_z>=VpEbFS$g1Y{aAc1!!*E94LE)`~5JS!}SfJ*8n-*ql zgs7Ln!ohTVfc_n3Uu|`*08A{y$ongSih!w#@x&0{bgdl;yHQJWDvwPr=e5`JyAO?Q zSKOTIK|w)A&7R+JmS?N2)dO~eUf}cf!-Fr${wu<`N?V1Yk>c?+qS`J&JHg=ZM!K*! z`@_=sitRFT0!1sk&6n>d3>>Gb5+E-752W9Bc02^^!4k70(-(s?0Dws&HdppoFlS%T z*}2oMqLm{>q-qq3E_?v6x5#-ZQXGK{#xHM9pKOM%uh&Qv_wNaLY>wxX zn0fD)JP39EF%V7}s4&+wr@)uCfR#kH=!S5Ri}dE+HZLyQeKv1hZKZmbUcMmzkIA$S z5wQb%TQwZ}*|S9Jr($TT;CgYQ=6GdpiergY4!^Kru^(rP{C64!(_(KNXCt*R)RlgcsGXyv-aqHSkj^L{?YBw?VDN8lNfSV!)k33ef1&% z5solmwKrLRg<{pNW1A>5jPJL4oWKc=+JskBaNc`Kev+SLmTNmv65q3u16WWTG|iEn z95yDlirW(H%rEDSAjDV8+I9AVwsS07Pt^gtJC4f% zrDCo8^>Q(eiazuXDh!pt1SE80vSa2rOpQd3SVCE;yrx6EH?(^(UlTd^(T>UO*lv#7AivnFC922M7(2K%qrU6(*@_r zN53@0{O%m11u#5EUSumJDCiDl#Xi}Toz$Lwx@H+4$tQ&d!(7TfV`?mt9&HcuRU8(*2;nJxk^Jr{B> z!kBySMtQMv30WV0{o1k=8)>$*I*`gIYw>qif^zJrHy()3W4~ov#=n<@m;I_iefBRY zwXC0T9c>$fxifSq^5sb~g!d_5s?#e!QK>Xwdo$zZaaPeWk;CS7dx4k7Oo&j<9HvHXI2%{{XOBRd}d zW$0jx(}-VA-7^Zf7tF>c{r3ItvSVD#GASMQMwkAKhDbZ*0`jp}e%>t{(FzI09-;0f zH4ed%E$zL5Kz-gf8p$6+AG+?Qt7mdw_9j()&KmK5b%ch$JzN{OAXuMoZ9Ym70+7dJK;qBqIGgOaKCTE# z_yJU#QiwSXr7BtuB3ht&E?_!56PISwBjoRdQF%t;I;S}~z@p?EP~02?2#e#!)c-P4 zSqM~y-dxxjgc5_v`$sj)f^t2!?9Wx|B7qKI=Xcd z0ZhAfP77kNGtE3XTwgClGf>r~4^X7Sd!Nkbkjitm+j3a$4$w$sa^8^l&d#)H+H<@9O!(Q6Z^^L-;0${D)RIWvfZ1UK$ zN|_5q=M?xDI+Rif4!Txd`_OrLnh+b5DHdP^jw{f}2?4~V6xS3Za{;IVOx*kEh7D#6 zfn2e^^MS&+WCuiZ<$>jf)pB?IUnF4FnhotUxGS@*Z?dGU zp@dM+kgY=3)rj$x$+Do115XpE$xw^2f)G`j@lI% zW7gMuQclq8x|nORa@kq&qW@Dr-mZYR<(9J~#om>;?@QSuffY;~5oAU9)n5 z`E1jT_s$2+?kOQ*-Vp2sM}5D(lG%44XA?}$WeA&H^aOc}9`H9&(q&7Mw5rL(jEg}@D2rVW@?n6!0M{LSwZ(_lETM)i)_5)F;6%gUrhjn6IH`I`Ksi@ zKF+x7?r?C0alKhk;SvsWM+akvHv&t|4TkI=3#W|A%ab1~6!a9z&=Lcaog<|tn3ijb zZ&Vn#pK0_Q+f3yqU=W~htg#bckSY3}wrPhbOqQFL4k>n7o*fP)Y=mS+Bn^uhw8Tw&t;cX2KE*1C z1j^%^zxZ9z;rnCi`0;kT(OXTjrHL2Kk^7z^1RqhM1oNk(;)x${1f($kUZ!Xu_Rf9O zHx$QZ7!)v_+Y;N4DJ_wW1NCfdAtK3=N!sQBrQx_cS-cRPr-`#A;?+#Kl51+!!%*GU zlyE3@kX}=8mB+%%OnR!l;R|6|(4qLL7G+7P9NZ~>r^92mu?=#iR9)aYbzL#1lAkKcBrR2O-13kPKpbwe?Ym|U?p)uh#vk?* zFV8R>WWpdnAazKD8R5(yU zqwfR^OLLB6D#=bwx)FY@oq`GZArpt(zIT9Wi2}@c)nn_UbCQvK`3YHDdJ~T+g}JqY z26p2w4opcn0NKoIvdN5SK-dF2TNb;6OiyF&Zj}xgG8h5O6vC#d4Q6d!yrdECspr{b zpOHJx_+}b!WI9osmFA0kZuV(?Kd^Uesqf?sla5+QCn*1f!ly@mx^g#@2_-$UJLI8t zTHrb@5hLb*1MI9dj~3}ScDdS;T;p@h1$FVEzq!0`)AtqAz?r$><%yrbX}|eKC&#u@ z!G|K0fiKVJ_o0BvsTu5&iQ*V1W{PF#13Y#TOv7CO`ZA6RwZ3udFfjCUd68fo_?#Hd5>l(eBZ}LqP6xDN*8?l60n^6A8zc* zyFozO?}`uzCF6<>JPu5RWCvBNzo}Z4j|kSb-UpiW(DZiJI0$1CNc7lE0p6M0s`6Y8%KG6An&V-ovA*H z4{lf5PGns)^Q7neq@*l0sC)y+mH3LozTAE!y}DQ*u>f8I^ga3Fw>TnJvkO6mkIxn{ zJ#spyIqjoHIRSZa%gK^mrQ@8?wP~s{Hugq{4WL)dg+BVS^}4%i^+FgI9PSNO5fJ-u z?DiWsJ);271M|H3`4Bt(0&uQe4SX)*?c8KenRfhJepk2D=tD>~^y=Cx9U}0E81Te7 z&f<8bJfW_)A;WJ!OEq%|NRX|Y{HU5w1^%{8Xotqa$tB4LwHmYO=e#&`WQ?UxS@}y+ zTFw{t72TIZGN$#%NzRJ(eyRj)$@h6lwcrB{veYI4{>1z<^-u~rLhOf8*5$(27nZAo zTd`hIg}u$<%D6a763?9u9&FV7+h;gM;y-+b2PFv*9`TiLEh8E%$PED;siLUd;y1m+ z?a62I%4{oviOcF~kxUc3096l1092%+UrzMuH7I)?JCpN0K28F#$L^h83nDu1t(XRh z`_F6QUrE$CR>V|l80r%5B=;LMWg0@ z%bji0S;nZKxakj^XuwVEa(=Yc>6s6O&BD9G^~MqWYlXEY{=TlSMmIFi=wC4|PkQAK zN-uBaCd#|}#6|*AT}9-_@its8S=~8NDb4FPSc3&YmiEr>!Dwwj)Yl0&S9~B?Oz<1j zLh%_U7WWCX=_gD~zJ3U#iloEt=a1JmFrDH=Guam}gyv%QD|yYCHWT*>{gPUpZ~+X5 z!|`SbHc4XKW`?vlEMP{qX^$>KB-T+xx`YRXDk_Br+_Qs*ETzZhm|KSwr4!WZee)w z10I2S2OU%XX-}MFx7!I7eZW*2N9&k|FuzCSPxU6HSHVCAXCoa&>Ho&YJqcpCv~uXv zd%oxC1TRET-V~mADS)*b`-PlQm)iHWaQ=73$C!50r$1+zvre}>=!y?2Mvx_{%9Dv| z#1J0s-&gg_E|8V+1IB>4XdsCSGeOFM;G4NlPkVK0(NkFX3V~hP7=0th0K)npTDnFe zcJ#RSZaeQu1>^YX5w!pQt7g$(#>Wg6ZT-+B=-;i6XWW*OO}vbIUfXuppi1Y$;qeyx zq}U}OeOp;TlR#~kCa;ZZHQ$xqnrL-42;uMFGzs1JOk~-~Zz)%;9>+9Vc+{qsuK7On z$80!%Z)?%q=_dI^Yu9NEaunO})YWBJ{^w4fZoqilrQrF@J?c;}5UBQ!A~>pUZ!rI_ z7$Cz8TAEt$0HxkYILd36hsXoP?}}=u8>H@OD!v%)cbOV^W?bT$Mc)ISKDT;bJ-2tP zcvTiIq<%bGYAtX+6ONeTdsZPC8^9RbD5YIB6etHEjr(ZnL09`&4s%Vqn1ri0&qNy5 z0Y=FNIhaucNPV7*`Fq=n$KITt76Ky(=DI6g^`8dFmv(zXZfpG`NQ~tGJRjSKKx>?s zI{PV_t&6Dh5qU~QO8j5%?rp&!?g8=3Fy=z_X?D2n_AIIPGygohO zC|r@wWL(*qCp(YA$=+gp;WTtf`N}*PusMhv%(&dzL;F7K)SXp<18ncqb`Co{24?no zR<|lF1)=3y`ASWzWE0fzkvmc_1IX^mWTk}-xlNW)TKW`q7z(?uOR(yftF+$SoTUR~ zty&ttQ{qmeKWidq(#7hD8DGBLA_`Vs zXgi-hdwvB_hpvNS9jCZyJT_Hjx9fS)N>HXYVt-X{vm&8Ii!T(ydb|7!m3;Pps80R& zcu&Y)IR~4>FZ%f&y*+LgBTPw1K|N@Tx@tK;fgQt;OMYsdv2#dT;p2q4{}TFUwL3Vw z@lHg!PQhy3GHbK}c;9A<)~<-J#MTb$(DKJul`knOT+%mm7Lx2w?^*jGd}hUPy6cBD z$Sl#T;$3HyYFFs|kbQomxSQrIa}rgd1y-55cQ(g4mZvzH|8P0BB{uTd26!1oObtrM zBv)b$upp>2l>aB*g5-!ghw^t}26$-o<^||o$+dHs_8_RwgM>|>uc%UiK0;?l0NlD) z_q4v1@pxk;$TR>wd@q?kv=4FXBV~odz@1_@r@$3TqAdeYy8kSqxA){)|YhU3NX>L>BU{2xvman8{E^Xp>pA8Vd&95b0;$ut+l`s$8fCv@t# zQc7#$(V`GjLosfb6$FUIE{ef;YZ1BKytLX#R(2_`CWLtrf-*~Q%V88*G@uo<8%WG;4cFyC8Eqap0u662em2W zLKUAOX)$v($j*NP^ngM`@-lwlS^|>^*1MRAu$0AUM(6IJJ%lbdmmW;b(^b^RPkyN^ zn&O#PSWC0YxOt$i^EN%C!SjKH@R4zs2*Gy7(iE3LYC)v@v@KHs7H>~*rpXhA@*BbS zlaI(PDHG35Xy<|p)z41JqRj1Ky)T1S_tKCLTokwC=2>noCdr*s7D5>NFoko*ss((} zCC&QZHsh=doPhfU_o%z&M~yPg&UG0agm~oHkkQBFc<5W zO9BiQ8vT+%%^#MTLw9I>-Gq2}!YUsb^~r_N80Iv4=-SG`Vb}byzG>HjV zn(RQqm!XZ7MmC0`VTKjy=W>5~I^c|mu{B-d2p%ES4iRcfvUD!`eQKaRR&6oqqwl^| zZQMG!p8{k($z(GW^?b7ut)i&~tWAbStn*dEb=;NPeC{(yliT@{pRnR7ZsnqzeFS2_OKF$l+y5l2crCoc zXqj*6uEDQrOR4P6kT|~n2W-W94Ph3Q7H1rwI9*O^Al4k`G23XJCciF3uUSSC%a-0O zmLuFCs8y__QG4lp#{hkHRFlmU!?>5T`biykZP+=0MHoBlM@o3H~u z1Njtb&~%L5XoU_!(u+tgNi>S_6W~7$J{Wmkq}HyDY8u3@MBgMG>7fhhFLlSh5~9mQ zAkH4tHdp*1e7#hwW3gn`744CBcWLUiw>ndqBEL23*05pdAJyta8KAtmk*SW=SbT-@ z!iJe#Da}6MsMHRi=G85k`Y_ppuBcVU! zoQ9?!`s^*VUV#LY*Oohd>u(se&lK?C_n0i{pu3n>ExgW`wB=`a9tJPVc2r14aGn}`Pj|k~>)o0r1#8j3i^}LMQkY$KR*x$n< z3)(z!T!)<+jE^{_v0aoW2^=3x3FM7C0}v9Nmw?jnbLE2`*FqD{;E2(Jg7SYJ zAHNU^D01iv$O@3nW~BEk2XQX$Xgj6Z40Iz|0dmW}U^I3M!j-ieH@;KM>geF&=NkX3 za=y*Xdymgdm7_UE8pZJl)mYc%C~8lANT%I2BluarL>GiR)J(h(<9k2=7K9bwLCfCd zx3i3t@7omE_hcJc(yloC5?rk9M=JRZ4xTnv*U#G(cSsTzW~-I?_@%#m?z49*zkKo9 zBri-yUf&pDxABob!Ul!xL)idj_2NBa--QzPH1tlj4Syt>I%a|O{6cwXVrOrxww#vW z9)I<@Dvz{3l35*Ypm{B$;e(VJ-+qOPe(|ScD|ve)b8$o-xbhq@8wxpxXB>Fwo6^06 zD)OUe~)TC=X8%{Imm(U>7(DZ0tMyZuUO%4I<%3k+vc390-Q42aks4-F?zmCjs z_3rzni`;GpF`qzGq1W%|iUfCJ+BlVVmZhyToZ-1X)gcEo0$cRuSapwS$s8q&gYhV#ZHJA6;CR+u*g37w!1Q!yItQoe7+P}uPke= zbw3TMU$?f$n0nxNp|Xo}C^GxJcS!R*m`Bu_yHo@0A{XqwomCFH`Nh9Yp9!Mrj~ zGJ?~1iRBnZIQiAE0l5c{QC&J!Y`$yw2-w){j|*D#>NY_Wcre}s+;ew!PNngv zee!2fUljPu=;lk+^S#~bdGl`vr)dehYsgyRzV2zR%Y=+tS)Y&z1TS~n?MTv2kH8Uw zUiLRtRNa=%zFFsPPZBItg%lo@_29V!XxCjx$`cwY!q_tayebd_>ZNp3UjcKFodFdt z+aA>@*33nbH=@n&m#RC8P5onLOx|vJd|o7I5=JqeMpH;=nyXMe)if={J}#eL81w7p z=fwt7LZ+*Hm7f~?io_|cM<*P17MG%6jgufdMq{`~6!o2BA(Y5rt(tLa{%#OV(l}`K zFr*5dH#y&H473T`)peNsn8yoSR=Pj+$wpCqVA3ilr%k7!ZtQd%P_GE0^*RYmLB+14 zI4ZW^(qpw`#Nzqgn*Da#iX+a7;+Nf{DCP04u_YR~(}qxmOpk82mQ`+Fvh0~_#$79> z0JCJm?EUD{;Y!5R3(hZ!%b^i9sb9r0IW(K}$BtUcwvn`78(du09vN~`HJJ6E+YHEw z$FIOdU-fYrsC;WsKzKlAYBvCpbFgS@ncBS4owN76UCZGo7oSS^x0BVOV=qTb+S9ZW9yM-C zCno=#L;T6m9|Lx#6V7{teAeA3o7+84x`2$ZS$(Q;#Qh0x; zXVFRsHwRK$lZ*Yx($?}_k|YJ=N0j}N#j_u8EDv3<^cU`6-elnGcYaS4$B-nH(U^Fj zi;LnsG_N87trJ5He`prSAUhb&^1zi%T#!dEtSvjtO$<4!ju&0BU?XdHwP3bG%}y`m z?4DF3x2BaGsHnm1kJ(|^rc`I=(fdX2pkoX;v3ThzWa)cdMYA0P{juYb()!gYwi(Lw zDY2jUhp9tNQ}G|*>V#x%lPHaCY!8mB<~utCzm#Qm9{8O>o{D@o)*NTTTYBLlkRQzz zrw^b=6ronj-`vu!2u7~nncviDI|V>&Wzvq7;}Vs4zI?Y|&baQw9&d3&;T8EoYDV5T zo#;v%2ZBWUCZc%Cd}r4R8T5!$f`J-?sXwp!3<=NnmkG?7)3B^B(MYyn#Uy;n;Jh{N zElEhbDC-(eR98<6rv`L?ul&WfSR3^5{}t@`qT^54F;cimMU~h`X}2s*mf$U%-9=A8MF+VPqUPRpz4*vf?F@W( zXji7J5!I0FLDaeVV~W~xp7}1_((K*?+6nqS&_8vM4xG)i6q6!r`T z`7z(KspaTv*A$xj=`IObq7>Bb>3fX(ZirV`f+D;OVQ;mVu{Jz##CiB)6g?WUjDTKX z4^e2z#(TYDU=ogYEcr?HfV4}sK!EoqNj6Ma7`slBr@+rwC*;0dbfLpk29;1DQpTwf z9FEW0QZE(tLys+;(?#Q#VAch36#RS1wlfyr!+?>S##;J4Unj&ApH!LXh_A46N9v-{ zKp@jyFbrRdHK=6!uc_MDiTNPWc`&Fzd45Ct(@Ina^A=XGV`5sd&0)`z*}R031l^tD z)NIVIh9qvNjl~@SJEnneInnHfhFQ{ss3SWwTmM>`~_99{VZh zItF%x>Uu=#g!aGf$_(!~VhNa8?Z;dXef_ChZQ0eQQ#ex1K3*rf{!INii6oM*>$JIB z0dSI~$6MY5PV!J@I$)M*Rz#gHQhbWu)BY$9fy7+)$_Bq?$yIuYUB&ldlK^Tp#=}W` z68}I5=vhsM-pt%cQdv%XNo&5?<_Ef*z7HTGLvc;G!<$?vU(wXtJf%9vuv5OQd??FR zj_|GX&MfqBa%KHQ_JJ-PNmuKNPM*A$*-*~sW<>YAn}EaWmzb8Soj% z8X6re)wXB@YWhdshPT{M?BrHaSdd>cx7nN3TJ%ra4ymln?_)pMUvMJDrpS_}9k3XY zF@qWi+~(-!&(-!-9~tus_eH#CCZaSf(Z**~W34Uct&_Ot=fm*`PVqGMR{YnmOmWZc2Q03P*$E}kxEDz367x-_yq@G_9Q0((e#i#N5M=xT zPEYtqQ^PUEO*ANj(`PfEnh)hXZ@N0x!I>cs8MaV7TPBwAb40I!*d!- z@t^yCl!YJQ1RTkjBh~(q`a5RXwId_hVG`J$gB5Lcr*aN#GLi(`d**C=+*TL;G{cEY zxYenCqI@uS!F?K7;hS@|?i);?4$MRBkYVw{PRfVIyPGQZP4W_-FS9WalGPzKiI#Pb zwzV-qem3IPfecl?+6VhZ_6O%sDJD|1JnXzrCrK*Zzfa)Vv&pifnO*L*(XbE3(9#$2 zYN%;)bY1R@iW@GfWrfJq2|=&X2uFU0&9S5^oi-|bFOCL91m2ok^@slh|M|ySxWd~d z#)A(8X~K5mwiI7^$QwGmTdQlE6!oY(i2SO4-gck!J&-$mIZ#O8;Pb4Lzh5nnmKM{C z6z_4WozqLmnrKwF{qu?Ts@#Y@f|#bp<>yGqOA_RcY*_uvpHX4LYXwH@UQ-*)pDqM0 zcAJtYsTOD>mg?QR#@2Wp3wFaCtCtXb`%UY-H4-xx_#DQMB7U6S#z2O!mNj`3Qtb0> z18VAo?Uf!;pX7p#$;q&{uW2H~<>b~vxYN%o?jSr?<|{R)o!QcUOze}yc?{e(Al{ez zdbTf<7u|F*ge||mv#PRnqIi9IU-crYH~FLi*~n%NSm-;4fDTX$3)20+xy~HK^e=^k z^!w;uzNFQg3uk(__yZHfUq^h?EJML0l8)%k^bJ@oulACmCCB=M{aWrRxOQRp`_wi` z*ek7xnQ*$;%Y%lte)8%2D~TWz z$F*|H96b_KxLnlL?JdJ2buQN~q)DN+-yK__? zdb|Z4ny4*T$Hd@`2D8Ga^S)Ikd+&*k55Gh}%Px&TE+%WrmVbCVvexyZeU+6HL)Y<6# z(5-J%Z7T>JC{IxOsLey8?nERQkL43zilTh1gN9%{dZ)bf>^g+<>23xA2;n+!pfF3s zK*5Pw8?AOGbnPdJ@g{OpI5dw1o?N{0j0?RdF>^*7& z>XXj{mKbw)C?`vC4WRBY1()Yg<*;yW8Div5J6wjDcIVSC($J-78jR`7Qtfj+6#z)! zxq%F{j86d?fxfc_jVk2kwz(4x;ErIGEY@TTu5l!QEX`oUOh1_xwPPlgyA2bs*C9HN zdYcNWiUh*bJfd z%P$)eJ`ehtBZRr*!B6gC5COY10SHNB@sKUx=E}t+=FUSeT0oia0VbI#_X6P zUEA&f7sT)ggW8evU&pdXtpDLuYvb zW~TMk6Lg}2_s^(~G|I`XK8#kj7Ff~{NGg~K<2=e%it}aaim`b$r#1$PpJu7k*$<bQh_x1KBA&abAp6_Vvfiaeeqe{goT0n#ANduW?euMo?&h#1U`)DyK}QAOqj} z8^fB#vs8=jmy{q&*zUTl&Zv;8nnUTE>6$d8OH-A!Axntc9nyf&-EpxrsLnv+EkHNS z5%R{&IX+TSP^uP0Iv=eKnQOdK{G2{Zee_oO=slR&&+#cMhV2*zvdH>(U7k0Hr0{ks ze+d~;@=x`D72)1Ju9E+8O20F^!!68;vd_e@Xvjb0eovIj4EA*952#COa~$naJ%UZ* zN7f|qs4#zu7aLV)mdbk048+ojZITZI{)M$1II6<57FrWS{wR78rV8Y9?wDL#BbLsqeQ9bGPv!mzv$fGSJ-q#;SOUY+6AljVA|-LT`2@d;kk+js*al0)(o zQyK5lPNRnQ0Hc#Uuqb}AFlvLZ0l<99A8BEl(QLt}wT6~@`qJcYo_nAsGMOP^*)#ktQ@IPeTBz8qr{J>3DSKp zBFxhFTZugrU;K>KXppI1;60Ejz{rkjdQrzL8co+>%%B;gcJ=eASq2&@Dw8Xl(e&#~ zhz4y-ztSZv+#=?#EXG+-^j8n3wzmFphY+AO>> z{RkPCB8O6kO3nrdV?pKzAM@O60U>tkc@|oPn9ta>n%uacT&^56)Hye~Z>zPJ0ACJ< z@%;H$)x2UOpx2E_Njd6bx&;*B(hYe98s^rJBV=ZO%by+Vvb!f+J_=C0Nd_n+F6`qVtT&$Ayh9n~~CI zZS>qsQY7@SFnN7dWaUp}tff_ptvR0-;ixx9Dy1r6vU2rL#jxwemqU?Lj(b`wMl3T{ zyq$VpEAu)^IpltKMBxw2BFYrRbm>?>va^lNC6`2n`f0do65!}f-Q**`Aprh+wbW#z zPZRSQ_~Zs(LSSxm8Z|^_snq+s(&?T&HvUK^Ja<}$Ru$I>BK3X%?T-4ZjVe-+t)8g@ zZbC}*h!u5Rvj{BIlwD{?ime>y7T#~-(fA(I!a*9unbFDVb%-BRS0I3bZcK~&`xwF9 z_ryi~N&8~nGr!jJiYG%gBX}PqGvls!-?M-7|2anX)f-Am&YfVj9Gk~z=gK$gsE5Q_ zz*c|Mc;&P{*CPBgo!j6Zj%*yWs1k;!Pnzp7A(-u{sA!A4mjt1SR3Hv8uY6ueT=U+E z2C!&E97+I-Kn*g5dZDVud8dsH#;Z)8UuDpv9+kB%j)^YJHI20Uj^ar*O6-!R9q;LL@e6>78k%I<@;o{Ipx=!aC)Cq*z?sn^PWh< zf6&;|N`aNl4$2$N!s}45K)kA(0zF>qrlSuNqU`Yp9-pWh`T+u_bre$OnvJpg2n!(V z8$h(Gmk!Y^2t1wea#y(WCFJ{ZVrE0CErphy6wq6@o*dP@{nTzCv=|Osl7i!{_gH;H za!)XKjCE~fj){@Teihg0WygFaVsOFuwZN&$z$w|m;;Z;`zuYaww9Tt4HZ851pDJGE zglfXYyO?&5Q)uYuFz)xLL3Y9!mf^V&ki}Q+chcPy$HY*+{c65ZL}RSwDX2rVg_|RjWdBhYq%0(X&2s%VC-IYL|i0!_1mOg zlzD>;ucMKbF_3tUkAd&=Rm2o7(0zr*Z#4z2h2^aGk-A+uk}7wt%$z@n+n?<`66x*^1rZCKBjXbI?ER zY6740DWZ)zCAJn4HNl4lOK7djbjpS6d#S;q0w?E$0 znrbu(W;QnNPl@zo{QC8*;6v#nQOG-b?Hn6_N3~o#BQUd0*Db%g7^^ylK){B|FG#Bp6o%pW7N6_+fb?t+DTL(abMhHPn*nYV4_;M#ph?PQyKFooA1 zQ9n|qmwbMx(&FVX$->EY^ZS5pH80sJ>oYE0H!pw(Mq0tMdSPc^oGJcSOvYjhK*&+m zB5er^k#gu1SlgA|q!D95%7$5X577L6A%Vq_+Lk>r?`!#pl5nl(PcQ)@&De}<6-gKJ zv=+K#k2Z?+;z!)T%CcS>E3NL9QNm6U`l> z`W^ppNcFo%T(lBl-5VJ1C8!Pm!zyBk&QP)Qw1`Z$a0Nm{6JjX_7sf(6^`NQ+1sUvo zGZJ8rG#jyudJ!9f^b7|F$K>k#=!L@syW3f8ypgA(t*_xJ=xzh#vg!6T%mHYTK33&L zQF8KX5hVikCFj+S*G-Q~O(K)gRF&z-MwmVaPTTd>MQ+-quf*oMVEpIGQX9S7EN>8R zwgG|)qt)}I!boJE@ z;@a}lImG;67tMnoa-XrdS!TRGhv^-z>g4f8BWQ{le7c_o=FsLIs10-6UyURBzPepc zQ|OTs9dclQdX>oJr|RkMN5Ui=KMq9m44}4-cX0XPmJ^b!f1R8~ZXkWjUr1<)X0g>Hz~}^&+pTJ6{P;EB&I(foTKUT?w`5t zL05GmmpdY+U(cL0HBwPKtlXes_m_%S&^j%P(L<<`+N^k;G;4HZC)lwofYnj@$Xmi{ zvhsdXjYhOJ)YlG{SAKwB7B`RDcm4RFm#>hHm)jAVO`b|e%Es|~wkZKa5?4ZaKX@e3 zn*Z0465Ot{NCq*Li&`&j1K+X}JgxsU4DW!x<#J{FA$KPb_Tec2l5&Ta6nS!ga=fGf zlEjhfIVlxri+scOdc936cKFNQ>}=VO5#;@TR7FB8kV1P-3BgOw?~PS*+g{g%Kx(Wl zazC8)a-(OBFK+j0d8+ag#^bXQs7Ca3XHAj4^hVcq|J4b342LzcYpRpRcAs5%S5sDB z?oreNe{)s@yp07M!$ri59dsS!e5u+_>whQ*B0*D1$``0$Myt zFxoe4XcITeTZD!w(nDfc)%>km^scP1zFpj+iGo5xa)$Gj?jz4S)Gweg>X*=ePZy9t z$N!K<$}*895o|KLF1%FzGYMWW{mh0J9gqIDVSd$dS8b{HHI z#diWr;Rpvorah!ysSA0Q_8JYDbJ3m#>v z*vY&pE;gCBKK2I|Xy^SH#$-m4WO!8KD2j4h$<$0niY{SRH2t}10Iwg_>sY^Gf53V@ z-B!KDP59`WYBsKxnN#fXb7KLtzWMd3+E>J1vRvd|_<{Hz|WcI2_^Nkzp}i2mMDD5qzlO=t zdaJ=Bz?Vt4YTBL|7IpxbnrIX2nPEj2>=M7 z|A2P1^-EI{wM)8gX?G#e2`j~9rk)EhfY=;~g~+6KowuhGfovtwK})dix{mBByd8Jk z`HM~e=Z%PsAuqu)^RfeF530x0E{mb6N*;a9TP`sVScgBNlIH-5&3LUe?l!coLMLA! zstvQ~?wfqY)Q`Zs3=5<6;1e}qI^+VEB7@)=B6_Ixp<}rbP}5$W(F%p%N@(~dOAUXV z{1U?!q&`|Rp!J-|l0Yw9?A?ZMPBZcH3jcMGyvgzd(Y>h7Wgv0^tCpVyJw)!pG#;+t zbaZ_ci-tHx4huXzgcr3~ot&0X}A^4XBx>?qB}W-!&nQh4DEuXN|*hZN?ZNlcXRImH>qugFk#W;68tgW=s z+C7pP%6_e(4t{C^2C5&wxu|)1lO0|Ipk-#daeve(g6GDO>zWZ^wHZ<;cat09P!_bqNe73>E_0ixo&vPxf8_v^OO_YEm*Nd&%0)rOM zyQGJ5G4zUn<`A{{B!$bb(gb8S8y9Sy$PBazUTtS)iut2hbY2P1de|e!vg&DfuX?4} zoK^Iym+2-JsTWd~L#Jvi<%03qK(pti%*@%MJR9BOB28D8=#^VVIxzUl86@FPw5{}A zCGZS*`@X-lW$y*4iAIE|ULKcwoj3!FJ7KfV17KP}hji`#?ZOKYDRr+R)dm{ou|itE zUB5y7(PSY@qR^XL*Na7`nlc*BEGj^V`KSk~3+U-h4p;7{m+NDL6~QUOUizLNzQ?c8 z^6>?&a~G8ND;#W;+pmITH1#^0cW&E>#)#{^PH4m}uda|hJ%HRb!5`a;VTQ|mvi`{v zdS&H%qAnkG{{Y=eg%CV5I_X?dD|w?**mJN_!FsSHK+arz-u*`r-A1FZrJp83r1}>O zvm1ml*j!BDmQRh>5LApbD5Uog>Rdz=n(^DEPdrOEgiO$m+#2{qh;FeCmd{0|HhfTR zO+51Pr88@s{+T3+HK{wVkil^8@ zk2{)-zj_?EZH)x#FXoWk?R}}?<*X)t^7uStdZ9KET@Psz{OI(pUMH?cKU8cwgFYu~!Z0(J;#;6-Df833h#S15m-m4T&tb-Q`h zz*!AjM8kU>4q{9*jwrYYJ2-Hyfg}1 z<^A_hop+DQ7ybaLyLO4bSm{lqN(T~|nx_?^po`!|~l0ptRrQV6`rW@o3T z0D{21SS4U5qa=N?P6gKVBU?FMPaT-vgliOI~I&Jx-BxS^mK|~uQ53%M8 zuQvYLOl>%J>`Q~og3TN$u*S-PUncU{Ic&TlZ-4%2Uu&DP2P7iM6uWSXrzby_(hW*M zs02xDCdH0u^@Z@%Udn?^Yiit}s{ko@F7{CCH?!m<5LIf=tX1TUcz|JfCo%?Ei&{%( z)DCM_Daj%KCA$pG$26> z+&s#JP{oRbhjMlatw=!MQ5b$T0|{iDguAbDbfZKc)}=(*s$C&Ax*WF*>EEPfk)7)6 z2M9F(Hm`O6?W{7S2}MHDdal`!M!BQBMNxT9EGL|{v5QjSRZb&4e^Bd4@M`Qe(g>P% zAgc8qt^GhfcWE>4>C(w~uEll5fvb0UnUT%?@&KT5qC&FJEe5R7zj6<5wNg~Roig|1 zn+>9^zoVu{XkBtyT&0I=r8S3!Mw!n!;&@QBa@T%=^Jjasa|-$axMLpY)7c_xb`MPceNr{lxTn^4j5= zTGahTp!HA~hj{^x$N5wGtX!Eqz`Z2FDU^kjO^x6YM= z2UwnH1W&zR5-I=2r~wA%+mv!pS|EN% zk~|shPkFvwEZm9c_*8Xp%WPTw+DR6@$xL#IQ&@&X9^K=xd1?#0Za44{HApt;8Dqga zIhn(`^X=lGw5N04?!w35O&u_vv&YSg(^3_ODU)7$7*c72Z?k3y+ zO7%(L?drf6OS6{(e(XviZhMfdP2J;no0X|yq8PV)RZW5V{cY$N2h=}-zUYxFCasoI zMQ5K!6iH8~T%M9IjcP@b3u{^qkk*5su>2`E-X+<{w|IRox(TI5g}+U?78u&R4X_`U zmrWU=+nkSQ3iH*kxspfN%IpT3_ftYe-BK1_t_>%v&p?ZeWR6B*TtNWxAQz{8QIdaH zZI5a!`<2bjpvUTcFpU^Qi1MZ+ZT*rr*kmXk+6C5a+U(J3YjKrLHgOt#HAEzrQFthEXFK)yJ%7XwE_~G! zjw!K3i8Sxri4j<|MQet=e)c!)vIt5^zO$kYTDVf-C_t;Nn0&9FaD9^*BNs(#pct!^R9&G^DSL;ibnlix!Ym$3IQ zy~Jv8iQ)6IgSEH)nva`B%9;1LZbPfewJQCwNO&m9Z+iaac)ug!!dz`d4G>9)&vRlR zljRUL&Whan*FW%`JCNwMEs7r4702z~i)=5jMgkG3M0xXhk+CcidA#KU~gWVd@{r<{{@we{SZ#pM4YnO7#DJ>CfN(kAsl^zeCUd^AB+6e;y~l z>vg=1)c4u!0_ikSrhmKQ5KPcjk;TQoyc6s2nIOJSpZHR{Qpv=K-Joj$|{qdgo7VD7vj5xQhEBaacV>k0_{O$+hfrbV=moz^D?dUO7sEIVnvmtY* zOt~d#;@hS6y=Z^#UWU5GlcAw&%fDS{ATMxHZEe0VJi1(xt|)Oii->`>D0Vq-)V%_p zxqO1{wCGvxKN$#K5sE7>3-)~DP1v3in z7s8T~rHYW1R{W!aO{W1PQuFAZyy2=Nchk`_`5|i55Z8uS&Q_jHJ}&ta<)R)*$Ke@- z`oXBQ<6t+byUFswQx(WKQ6m1I#}b77_u&uUJ-5Cp`vgf`BRMjfv(e_`e@`0j00B zr&>zK|NX+hes;3t*WOD#>I$!#PM57e|MhN|CKz3q-y!w*?3?=cjht?MR1GCt)udrb zI<6A&P)66ntY22F)ZxC~>{qEzGJ4qu`?^UP>JY?3S&z+`|J*j-lfTC=(9=!tKXzQ3 z@Dgc+u}6k&@a>2%XIl=B zy+=q9To zr^OelD@&e#Z@-HkMy82hc#ZE@**S_JatR+HoXe+TXmm^B%JUe~Wk9TYJm=-Zq-j#s ztFF{t4z&50MaWOjb0YTe`Z$lbgoI%mhOl8$5FB#gpX5)G>SK+MdR>ZU+K0!xLWo+U zVzQ08{@gpuo7vnfI{QG`F8%7$(Rk)rOH=r(1L3dN|NESOgmf#QB#@B`yg2V8I^0{W zuR`?X?O*n=f*}xwg|AaXC{L6;QU3B-@{=6-l;j;H_vC z^9oAzTK<9OWb~6POm~m{`q%fLR+lH5q4ZAlT0BqT@~>>!1xuc;b~nBfe;k4izTZ5h`JHSCdIB`}2^@@>Igzp)RckeSafv|)Zr6)ek)NzRwEQTXN- zE;ycRS3+_(L-VJ70qY zx1XZ4$C6DYcWvq>__5*^b;@U6Lrui#ld1#g6C~We*CY6jSog8K!mDCB4%}WKqSqcm zPqAew6kbHg3__DjdBd>{e}rV-uC+kEoD3%M%PRkS{3|K;tI5{Qua_!gUYF_0sO2kU zgXj!x!*B&qu8+4|SlOR1Vk*x9;<16v$;ve!bk;Ba*Oh|D6NVMow2CPvn19?#cwUko z-AQocBE{L<-&=KaSZH-vA8eCb(_kF>e5E}|Xk44goo*&E*EIHV>c!`Vz&~#ywow-?-f;+Uzvo`$rgWp;? zsaDikt|U06rHQio0jVVQtXhV@ec#&Mdv~f;tMWRyvLyFOYN?8nENoe=VsuA#FeBWj zvQuSj!ZT)1dN@UD8NG>t-LeWo!=rmBd(`DPbroZ`LUQE67MZ=dvlJI^$%3VGv<$Jf zr(JU;Y9nXj2@d{h@7Gwvy(yCdr6X)IGaMSN;rO{m)1+_gni`&D5SP7chu)22pEF71 zK-VN`&v9(^FS_x%gKJ0IlWlZ;3c;qDM9Y<#g_tvwo@v9k4$cqdJztR`>6G%$+bq0| z8)(EHb+us}1{?cgW)4ZS7eZOQIFIep{1 z8m<*#gBiD@0#I**)bbaI`ks$uilLfg=z8pZKLkr>RglNs#g5V4-JNAZoz>0gg;Kvb zv$~R&4V=Z&k2GXu_xRpe4VSUprbIEmE|CUG#tQ#9uiVKG;Ka}qVOc1_OgVA|8~p|1 zTk<`{`AVO6vh^|cF12ZK-R<_xCc4uu$}-n9CE}z1{*X~Yx_r{Vs%mO~e%zA(Wk$H< zxY(mV)`z!e`Hx2o?CnvF-C~u@D1GW=FGW5XmsE#o=8x1lKJg8w3lpUefx7jy;ct0l zH=NI?ALO|uMe~ixWUJ?gS`f*!1}9OkXssAmGh;D57~7`pVF6a&-ISA(7ai<1ESV+o zsLF5m7a<5Z!6U&sUms2bs=0u1wGro5BJG-K6L!D zHKLVYXjG_}j3&$MN^sQFlSg^^ zF+eu8q}=?HAlA=YiFBGLbkbQbynP*cPH8Hxoi$QmZ7wOI)I1lK`%2%w zF&2`0l*A*v%3DZz-0CZinn{hU4|PgkLae>Yro!DBPCI$3#SXlVFV!q38?}h`0@|NV z)!E_#D}5Ic5(rq&s;YVcy8pPCjRnD z$YtV`@6NZz4QP}Lc;Z;JWPw;U=j!5Q7;q3vGV_3NVE8s40H~U?$OL;sjF&`BYtL*L z%9rkgZ=&ikEnVd6T<^x3Q8T8wUkj(-TP9V@E-I#t!v$was_!H`EaYpt-kI7b$%ZjT z#A(l*GsWw}9%~fLM^F&-5!g2_1oDdakqU+NiRF6mzIuFT-X$Y$*h?5 z3YFUPHT9nxIS0RZ*0$Q#4oAPp9;RPEDfm#NFdIp()+8+av%_el$~R;VUaLCp5m$$3j0G-s zme$V70$Wvfn{R(U7>nPCgB#|swV?+I#QXTiB2)%}PYtY9$#rGIj#qRHgCxrbeN?4>MxMFyHVV)a zHfiI^HeG4Tx|?wEDm8y6N=jJ<0nl9OWW$|RO)}Q9P0qG`Fop%&8xC2*JyI~8c%~qA zzGxVA9))PyN199rv<+>f=wYUjtQZ~7IMY-*eRE8Ou=wx8u53^_(g#W6xf>cpvO5-G z`1#suvBI71eDF6PX@%(ib3I`Rx9doxnSXbj)r?5Pbf_@beg(+0SOM8pABCq^wnutD?MN=a{cMrwVf#~+jb(gIJsU$r{in2u5gKWxnzW< z%#-9nJ|i-TTb9)|c8O^(SKM0@i^P?b#(d(hx}!%uu5;$8x=z{>eX&VL%}$kgs+e)= z8C==P#ev=5gWYVkWs;b{Lj5v)rD89Kw<%}bM5fUBXY@M{gMgi#j>V<@E0X5&_7ms# z8*z3$7{unzIho9n1e)S2N*`RN{)(rZvL)T=cHe_B? zk=M;;-9+DaLFdrbb&+$lW;W-QUWpAWtLrCDb@1w_Xflc2kW+q>IZ`3`v>DPI@2Esi zSn1gpTTwf@V}{AKch2vwr^G;&zfx?d8{ZxEy0DosKxUt;(W99Sf@Lkj;M^OB+EO#R zVWDUo%hj^{?zx9R_f<|Ew5@Y%p+xGe!0_XyA}?!}Xgb#yo0|I6QCMa;BnGYTW`HP( zsd;v{z8ltMX4rbsA&6*!IsVvI-GBz15rvsDFfc%BlO4Hn!n!ySol6ey%k?3ZlQiyf z6(X5lNsG40VD=J*(qu+ep#ux1B<-=izFYFte-YGe9 z$a>=X#<%snU%+gUTR-eNHiB$UQaoJ{E8aiE$nG-&6ZNQ*^K!Wu(mduX+#wmt`|sha zqsfsgzsI|vZ3KU=5?dE=s~bMI|1X}-IxNaH-1-Uvo0d?zyOC~Gx*McbTDlt)qF#nQh8mEDfnjLAckl0J|`15$Uv%GppXB~v1~ozmtA^LpZ%EDWxeX}G=?w-f!82zyfBC0MR~XU@xT*) z?OmnwAg%4SvNeqkqgLB1Df(uIZknwlcLv{x9s`$tMzb=Z&>bruh%7{Z`*e{QBBF3$ zk|ZX{Ie4eA*wS&krk)2}>1sYZHuK;q=WbGm-AIKX|M0+%k!NExR^(teR7AH%l@*Cw zf?@90_bNR}$8+}0`WFIC@{A3wcSbS2N@uk%dG)|toxMG|GM z;t0~j(u5PM1lnRHWX!c!R{AC`FE>3!5u$mG^I<#Sd(%1g1-@}HLXfXS|2ngAV>jW; zq2Z!5Go2v?87T-!z^a%Ac-}~vu%tr4x1wWA62<*0{cJ41_#R(r5lsO(Ueefcc0lGf z-T79ibM?+MS4{aa#j{y-WOkPmvtv6DM#h(x19nb4e>NQIJ}sF}F68i*jEqdc;?@Ir zL#&*)O#;tcg;1FX>m8_RfFym>4oCC}g!Op&+6e8JG+HZmsy&XKU^N}n_JR1^QP%@& zlb#fN5~E{Q8!H!6@K2S6vY>Jnq6ysuheQ0rJSvH$ss`B8mDHF|vE5umFx+BE_gQ=K zaIVW&2T!p?@F!t=+s)5*&7+ZLDAfg;U-XEG?X5dRvXHrQ*(NSyo7~*nbc8%3t)qIrleMe|cE;opl=ylGyxncKH zV-hj$P01VJpg^_!0L(rAp=7EX6;cvDoA}w`2 zFnjZPw4v{G`jGCh|3VV-Eg=6s-)NoLUb!U2>ZKtv`$e(szUM;Q(2`~{I7qmC*U`a@ z^&QuyXHVs=gW|`;-3i>kTk|-lLGmBku?u z0e4}@O5VGxr7}Zz#sX3+U**$rXn8 zh!B=1ZMcD2>RopWGnffA_>(f?QP5avBkAdG81CqOWL8%7#47mdL^5n-*OxfwD&&P8 zgaTOz%<9RF(`urgJUrbbz?sO2lt2Drda-pwsiu*3jLUQXe)1!_{aN=`EIsA-R}cyF zgF?g8MX}0`e$SDS-*oe7uQ3AKFr@3oikcT}pcu={xIwdBuSRDPpW#nutX5JMsU$QS z#;+CE5ak_*2f^ZDuY;5fr}J62+f8KL*Hdpw+y_ujnp3T%hg<^pCON((vHD8EBalipcy zV7j0Jh?rG>tb>VA$3Cy{2HpEqYV|vO zAF`UfINyHohNhn1cK~g4H$x=4;U@CX;3u%^#TZB32O0Nszo7HMbiT)a{0kd;pu~sf z0ie2y-bqu}T>yW#a?EQk(2eh%^<)kkY#gRXO8qp!Kdsn)5m4XY`w+K`y^3*udnFmw zWyS*l!^EI17x!H}7UR2~+kw1xbBu<28C{6*I0|92(w_a&?2%2Ek?xJazJ5^Z^Pc65 zHvms^aNYj#{ziN6;$%C+zOGaMN@-mTco7av%p?0+G7nKs6{OZbkMF>D5Rp_Ya$2j~ zMItc0RSRHkyJ5QluuXOkymfzTY`#i{c`IAaoACQv0!CxKhovcwv|epK!Pjs_@Pn|O z_=Lzf1O7HNVss!ale5U-y_fc*V@c4k($!Ri{@&q2uYOsPCC22aL{;g9*?x-se11S~PM%@XSmZ>>M?5D)l64*lLNOrN;Pi#^;kA{YO4& zCG3xJ{<{i>vZT9945AjWh>z6rSN{b!AR_)C+Ta|YQbhPHS^q71`ro``SqMf=52t)2 zy+5IUr|sg-hyvDg#(vyJhR!8LcK7bTCMo!63S|YmVf{S@qi8Oyl6cmeKVEmYO+j97 zNgsWtq(WDz(^`$uvHb>Q`SZg=$?u`78k;@VMN??j&kV}pS7=04<$XA4` zpEK*H5^2-Bd`P_mho)Ef3wQ7@X6{=keNFvk{S3h zJ9~`wYIgIS>dtdDg_nOK3)b1VQ<&IDtORx~srP>Z-W_qFE1#)cZs5TKCElapZjp5^ zCp~Rv@2scS=-az_wEZIQ|Hfjf_k7>d;aX;iK^}!nUse6@S!I*e$D`Yr!Y@>9?(D`7 z+)JA7PcAcG1<;M0(Gz7`IQdY~*@YRoPN=Cc4ij5Jt3A<2CRTV00&Z8-bmN$h_w;DN z!75AA%!Msn*DKjy#3)2>*6l&z6glk!Pm_VfkM@2iLar~zx13o;j(rXDYG7ZBzj4Ov zm#J)gulIC)Z{us?H5)3fRHeC{2su}|cr0!a=RMTJn#@gf?nH&IvmgT<5E>)t1k%@g z{$GOExbJc)u-etzbG4oBxa??gpu$*nIfeSVEEK}4V>;oh&tG|053Nv`+qB`0NFGs* zmpHkZP875x93~!R&oy+81giM_MP!^BAvO1k+}G_^Q0V>cDngjr&aD&uON6(18>E> zOu5a!Zftf3*Bcum-NB}9tY~FDw6Ir1X8fV=FQh;Z6LGB}?(1bUg>}{S5gLa}HH^PY ztS7T}kaujvSXzF5Vy14ROqUxnz{0b2UA}eQt4bhb@BIF(ZOvmVN^&1S+Oz4)-2dA- zG)xmHyKEXvwOC_p5N>5Qe)hgnzeX&qfAhOlUVxjl-*()x)uRtft_Pvo^@fbt>FPx}z~Ls=oWBUDRzLo8 z(-ITXXoR-Qq;ZAqpPq+K>g&iST!6W(9 zccHzDw&@BiI#PXuGH+r87Y6R)k#wgjX3l0p(hil>3w7rC$DKPIYn%KkTJPhnZbJo+ezA-*GkFi~CM4lU|d*X_3YkH#aKP*;rI7IDTk`z>fn8GLyXB}`5d_qODYewFvPhTBI!jdvFXnHWHBdd`tW6y3c_ zaXXwKv~oMw2-JU&4~|x>iP*c}8}*+@TH5~x|2pPWQDAz;OvWWH+rmX=S#AD9o!XwY z!=7RG&nwI7oZQ3*v>zr~ECv>beeb0=wv;r)xiH2qlMp>s$!L5iDXBAsJUb|5CdH>- zVS)>cnV-~2OV!~7Soc>$(w#N}i07{jEzHhlj-2!q55&UhUoD!$~0CM%}&f9od^Z2<<^+uj;W*(mvd#t4*x zkkF6%NB_*#QP2}dlg`cXgqy>E{xnkj&C6PtCvBF}Lw9+aja&Iwy^O&0P&*;ZY!1~| z4CA|Y44SCy($rYH4Jcip<->KRz{{ETP&R`sLFV*&_Ywhtkr@6~S$^*dVK*51Au*b8 zq^-Cjx%BtffrcN8yzwR?tM8T6>au&8Ut6?7?26ZacKSgN;2pFjT&V2^^?{lHiWqE% zQz8^NHeqk@9H!YQ@KQD$H_fCSfgUhkYv)ztmc`%geVjaDfS>b6IK{W`1{IE~A&vfL z9ZFZ3jJco5R?>H0KzEojO+*rzO8D#+i6{s!0*#E5rQCS9nl34tliG*tTs0jN*g4G1 zr_}Q~&zMV#Pp1p-gmirN84v4ZlP0l8eh;d+OI=l> zg%zipBhh#iElRtdD~-C?#LtEPWOwc!&h@^7Zyl*qGNu|>c8a05(`7sNknMP7xITL~ zoyVeF8UvKps)dMz4cjR6O$S z2#mODm04QEaWuA%1=_fUc7Tfc`BF83z*`S8p@3@_axVxkGC?v z8uj5>Z4$oX`gLX{V@N(jp;MlzGdQsEo?izav~dkY5-?cixjOf7J*VyB@yS2qttA48 z9UZE}y^=tyG09@3p$`1WxxL(`0oEb@CEO) z!J)U3w%$5Eh|3%=FL<{8!wC$EaixF5p9*)*t~Qt!;MX4loW=z~!l{3AQkN4uyuUp+3pw=D2xhAM5rDuK9MB|ol3;2q99RzeVsh(uF zjkLE6&0JiThAAC_JCe;G^5QmskRa`laC}0nhjTnDsd>F6h0?$VRJ2mbx}eUm5y%4^ zrSZ|_wWiL!!e((xFd~|uW}(qh3Jq2@6f9L z_~`^7-6>N=-Qw?9y19C^%LZwXD2dSKT3Lc!=+SI?xTy48hA2+;XjFbKZt6Ore7rP; z5LaZ&&+3+$RP#2pYRRrB+{WKa-Z`wf{^i+=z%B~{QA?hfXI)w{6F9U!(pMBxnsS3a zQ4*x_08&B`8=}_Nnn(G|pA-UUw$_KG!TzlcSi5?sxwhrt9JA{eW_1F+8NQ2Bk1cG| zhV?IIc|4COEcyQcwvDos73e9P^$lXcFsp$C->JSs}hTx7Kn|9J&8|kvEx;YrzAuw$!XONL`!T@ z4b{d0NpCLq{0~fMnEkW)87KW>8}CvHU-W}*!_qZc!n3Xeqy6tGzjTr&Y}>(0Z8oOYX_MJ4JXPZroy>BwUo55ox) zJB^-oK<%a3g`E>v^EAnC_>|B$+X1>OsliNisKw^R9XTq_vkd;=*SWA_J=&d+p8SVL zf7#+t=1X)=dYFFI zt4jY=;%lv5x0o@$hE@GmWM=QD< zO|DSu*48yKFLS@_W~Hym&pTt?I71Ep!6UJS@=OIiBb@D~Zjmw_8=IGpw z0sK>8_xI!6NH^zT?Guy#j=(e4P{+lpEMz33y9yodc+p*}w!jVxSF@Pi`aP06_IMm- z6euOZNtt+9h$dL85q@gr7EX|7PF_nw-!P67zllyC08VwaAe*AJsDdb;JclFxT;F{< zA1lP^t127oaBF$l4gDqJ6NW0V6>8*@#cM-2>#?t-*EUy7fG#|@VJ2tM_6`GyRav56 zloI@q(ZqfBz!Zevo$y-C&77&vkQa1J66UWEXMGHMC^S$!I$vMkVcfSJ|J|8MpFNQm zuswQJ*b#MTfH-^Cy*hhC75>(&b7P_!WS+b4Jz<&^r@L%Ocl@#A4t)N-P9oq={ z9mtaUD^Qi|VAZ z^gL}2^)iWj9sRJ$^OYyBZv<+Y=B{108O8q*hVRAl0_D9}lUY{l={q?1r#;f&ypC3t zygEb4g-4;(jAVEzn_tPM2+sk+!n{R-WLh#;NZ=L3#$!>>K>4GJM8dEP1R~XOF{O1m zpAZ$-GX=D(kGg=8lHNT5(+W^(OwDrvvB@t5PGQZ-EI~$WdDVXTI9;lx|2PDmm0|`T z+9>ma4($AHVCgkArIUE}vnJ?uYsZ;@|$T0NCU4*gE?FoK<(Eq=5H{ ziM?X4vU>oroNGKCu<$8jD(go__(zGqicFefSei&&jxS}|vp4_n(q?&lWOma8v-qEK zsI%PUYeQYXxLx85_;<_t9cc8MIqKSFT=*a9{epqmp9h)z3U0$V0de#Y=T^{`J>zOc z=+pQLOju9V2O)qp>8oL;B1B&0DE36X12v#@u>@=;fa~BY3EpXk%*ugQfR0-b`v=}z ze(*rQMvoDK{yR3_W6^!t{NVYO&&w=Z`*@?JY|nY>A9}3{gKQ!U)KeWdT80PdU~9+9 zh(6{_QD4Y;uE1G0=2So!N>4Z4yhx`xSI^|d9Eb3anS3JF>y;TX1+_#96Y z@8-EIyc^yRB2>5jq9DE)70M$Uu0Q=_rf)Sy{*BS#Eg@vbHW+W&!ET`{2%KaFCi4xC zP5q~`P@iab@MBYcqe~SzV}J!7=_8?E+mm8Dbi{M1M1@q7 zyY(Kyk)xgmrl8$b)$yiu5jmnB7H1VsEwp;H(8Bcv%k+GVqqDga5~5Nlx>KJiNhJ)8rKdYP zd(hiW6|Vim-@;ADV38g$8+*#7=F*ZLE?J!Cril$Lj=JSvcpRnS?3ZlWw_DulYprKO zqL}lwOX_EW^+s({Og8pD`Hzg~q`xTBro82A7kxI6Nk9C?#%K$UEO&nyoWv6aDo(bP zSOr94x2qdzPcy9*DkNEdZ@Q3Pghezz7sr%n)d#khD&v1JYQK4_P$fVyPOyh}Uu=)1 z>z&N12VVVcHc|;x8mg5V7CDxNl5SI2z8RGC9@utcQ}$CCvSNU}u5zxt{|p|_}cJ|;ej;r#mKM|pD64S$$qo>f4kvfspT|LP&3n@U6JO33JteP(el$j z^BLw>bAQP&{z44ZvpUyggtFz;s{AXoD|1mc|G8P{rxDumr2Q-vLJ;~s{3fHVPlKUb z>McoNSAO2TX!6oAavnpaWwtY>WiABT-MS8T!NlFRZ%#WL7%n_3Z3h|BK^VM}yE$70 zyL;vMlEB%p$JwMI+@=~u@ zt-~C)Js{;!6i87!$5nH)ZHIVY-})YuOT*C|UCPu}(Z8N1z!7^PDSschvcy<+1SFLE zHjcSby79Qb@$%pcAj8(=rlc4q?kqS7C-#~2TL#7A+uo2sPsjc7X)&PVnk$;ba-wp_F1R&8&I&3%q-~-lI(30?E!T9+L>(uAvOb zuY*-+qS&@PMY(YqhM|Uij*$-Wg}1kuB;F8q5OV^ROf%&w|zc#QE++W zS@>dt6Nu@WkzRxdUd{j{ZQ-lw&Ui}NndX?vrw;Xtz3Cz#k2wN3rW-Rk&AZ>{@(Ezx zM?#v%aZI+WnI7&)8iG^vB-K-nxb2r~i-aG`rZ|*bGF@m<>zsjMzTAF!Kz)CVJbfET z=Ud$wx9aEDq$R71DTRn!9RWz=r)yJ`44=;SE&!#iTV-a7BAUi6*qDq%=|jF)XRd+5 z6?9`&iZgBxi+)A;Yyk3J1Y5%_=Xg7Yr|0LR^5sQrKGQ#;p`M^g@w29H|FN`zUt{01*DOGTAf)8)$k%d1aA3(s=MEqkxUi$c@}6{@Sh!?_B^HW)qbciv}9+m>}&A_ zJfhl5l!?G$c-*JR-9Wc*^}X{{e_Tu`mlDRvS|kMGntN@YkakQXLAl?F|{r{HsrSSg`{rR)f+bNZL; zsJ++i2Q^#Y~>k=a56Rx3n=w(DnDECRb7!> zurjdMY;^b2Yq0{b$zOdhVgi?{L{_P^&FDf4<5w4R;Kt03>q(?9-DNAr$TAQevWff6 zD@kA-CtY#j!lqVH9X}_`$IDns&hzW{#Z{+0#Vl#n^<|8uW?9Gr)&7c5A5pnp-0y39 z32CTVI##Y@)j5F5uf@ex@(rLIMKHa*6RA@zhjuwox6Pfx++C=ALpOT-(*;v+{;){2%?XH$=cChEzM(-dL z2u7PHtpi-DoAIl#b!}?2wBt|Z#<9{8sP025fg3+a9$&h9^(d?7n4E6$45bgA>yVFX zrzx3ov+1dK0bPz=wcT%ZOl)6CXC0tv0y7Y?0b}< zLo;Nud-5)UMZk}TBS3xE-DSz%CUcJ;kvAJ?J+0YAb3-{UnR$M7Av92D>~n)GPV!93 zX)Vdvhclj4?k!dZctX-ehiRmHW)!GcXsURy$iCeg9(Kr^e$j3>U{yBu z`*(|OAazaA-)}WvP<0l&HSXOk>!51KJ}h!ikB5oo#TJtKR$z&@fdnQTu$?D|;^xUU zHj(X~rIdEcCD$Q@LQC>tgs0SAq}?!PI#ZA+7na@?lM>4);D1mYqLG5a7W5D~=avds zs(v53KMoSx{MpKDj7~3Lwi8G^67$J+Jf>_r59=D+ z(PxuH6l$UDb~2(hahYZ!q%D6CNSbb5z1pT~fw*=F!oaH0m#%F2muqdgyAVo#}Y!ZvG1nnh=?qFD0P0+Sz?B&)eyJ zZol`EQ}%~HL(C@}ct3SVQ8SJHLqr!umC7-Dh`h0#o@kv2d-ZK~JCfWjIj0VjItDOm zGeZ@G83SdPo}AS5yjI3?RbR<#)G_6zxT4Z}&{rb>4F0mRRPA?TU@Otp>-8wfY+zW0NZXp+RDn}5;-A`owaS7M!L0W(hkn`~Y zx8w(shuxT|@q(Q}(`Q2)=QQTm0LIQbX*wAE$!XY86g;qGo0>cu9{ROScp0V6vC8#8 z`T{{mjPQxy>>y9fbK!?QYPpJ|OM;XeXxeMZS6+{U$xbF3|65kN$fuwE8Nhi7qY_?) zb~|<=47jJ{32?FycKt)E6U68DkA+CDNkfTB{R(=+xB4|kR=8Z`crO6dx-W33#m}+p zCaSX7FT<_~b0?N+c70hS!G+b>*%CJxm}46gB>yHpG^8I=xGA$FQ01GySVzQ|aGyg& z;D6fP%c?bujMxEvZkXKfn)3s%`4t_8_CQM&&@Vz*++erOeCs}y4;qa?H4`}tYd)PZ z3t{kbfU4`1s-}HH94w~(h+kOH^@ESH*aE(i8)|^;1^SB9xyC)eJNTUU+)#DP)jDTF z)icjUr2Na`>J*2C`hh!$(;d=KatUxgKFFw=-yq~Zof!LWiMB^%mGhb?|^`10fXSxJhLBJ`7=bm8KbEqcy$J$5&(j;fq1 zHATazO06+8z*BQfpo8NH@v`4LkzO41G!*GctG&t>mFk@mOhi3FlR`w)EH=N}QEE`@ zj5}#X`I|jAhlR-O9Gp^D^9f(+`%9w3osbn>x0SJmUyeUzg1eoWv7+PwZ*UPKHXFB7 zBSp@eaQf`M@t{4~*Ob*dY4JwSCRWUkG)7Q}YBuNty|)si9rMi>b(^E{8j(SHkJ5EU z6)E_rC%qDo=SgnEN8gDh0?xV5#$$@LQgYVnQqY@B*m7B*h3q{t+*dANRi#${fwU&v z=Rb06ex@=YeL^N^U)Pbj(Gs)Oq}_UieA)2kxc6ssg?3dC+jK2HBo(CiOk zIN6@u9fZB}OC9oH=8)0v`~ZQQltb0&lythowK!)*X9J9FhCFQeA5J#=hrRjDoUT z1WBtG4UtHTDn{_L4scxERWx{dP%+~sB&XH<$=9C7W?kvmYW>_d&N8l)OflMd8=Ghr zCql|Fz&7yNvoq%d~7SbX|8IG6K2zT+ujT)>B1Znp`k69Q;eU|MXR5^>*R+_IDj%J99k} zzEQv;619Ip%xwX+c>?|7ce*?|GQ7th>N~qhcAiu8>&%VvOhD$pu&j6>yWfWdtneUC z?iAeOpF`3@+y=e(w z+bLB6lB@{B!tU#Go`!(xG0~r{P8x40qpFwri=6u@f;2wlH}pX~QHV~{Z;AR5-^W3R z@7@uNhq2j-Db=pjKckHgR~MPCw1_Rr5#^12Wn<(eGHqBgC@FK(-Nny>mCJO5iWoGn zvszzBRyMRo^g`mFW*r$+^kU*SzOyY^)5s4R9 z6T@~&6m0V81nDh6EmF9*(a zqrE||WAt@*7Id%mQJFifgn`;-pzXM2#TEjG{YTS(^4*aJ6hfSitBxIHS7Rf#Gf{)< z_E65R0)}t=AeXP$7+p<{EBfKhb{5v5n;RMX^JVk#x#CP4VW{RGs?uthBCQbS_Hclx zZ|H7KN^Le1I!;SD1?{ab=*DUl^5cvPR&^n`Y#YM}WZE88^n$D68egjZd1Ew#_9J^@krQv14g{l}o) zOdAk-ALW;9-y31*Jx>F#mx@;Nh1O8y>@~ zbC^^EvI5GZP%D$zP0N&0i3g29CO2D-P;+w>k7(5x|}@%knmcOT-qo%yV+k zA#!;P6^LFtZIey1GCuZ}wXmJsDs_#dq0POE(l0>Y$8~E|P@YM1Dw~;$iaMrIi4V#w!{(P6I zjt#7Ib1rqdoUh+*@qy%9l%y1W%)g6D>XJpuF~BiCt*Z)LF@s0V>XKvkz9!8@9vN{> zqnXkQE(AqYtISnR_2v>)4HhD4K}Qd6V?r5fn`rs3>m2aC*R;p6AJ1$3u9Cr% zhT1G5;$L5w8jc-Zv!Su&GqQ~<%LUqEbc6E)@>i?V@_mx&ZL+a_&2N6_(tJ1aquO7L z1Wb8jjerkBmWhO!WpMS6A(}k5%F9sM2y*L=`z>HH2??27aUFVDflaZe?eaLhG!v4_ zXiAMylz2Yje!99_Tb2b|AQ;CUM6Nq+ki39|+F2BmI-LE;nT`SMyaGIe- zk2nZ9*E}2!`=P56;ugM~0saM&+P~i%D``#LPFUkXrO7)DTfcCJGX3G`BLjdqrm%hS zQ{wginBlSRcTZZ17;$?i3Rcr#apUZYo(*P90t;4?fcx#yt-T8W&455VXB}uy@ z$*{0fPdAMQEj@3s9F3e*MzVJNWw@^1OFAs7Ei*!Mf858LZp(^DptGxbjJE4hxV^O2 zpjxA)#fHe+FGaYViTO3Bh4Y)Yj>anO3AQd8`L6$4bTE5E-;Qo>;+K16S!E~mNBu_{ z>_|fQq;WhDt11aFCIUiJTTzYWa+Sqr@Gaa+%qTC-<01O)@%)kSL?9a;qq8s z^ET9h!Tqq?pUM{iyJ16)3riKHs#}}u*KuIS#K^C5xa7$AtiW#Gnvl4^_l?8o)}Zz- z<#pdS&}gh6m7lOXt%8$f0f;vR*-r?b1AsXBEkP_00bDTE`BV~;k%=F3z%n^X37DpjK{Pjaz@X<%t}qq&qR8iOj>Hc zWmsB-mc@EFKG$QIs&$^MEMMNa8^P=d?Uq@5#ghwYW0$M$)8j3}9AiT6FL7)F_sdGD z9#(CQI=#3=bJY+0waxvuqK0EAU+83Q7qR}2aZjnf<*i(APt~=zGvEE)%IyC8eV<=X zYYYdd{Jz05Pw!&*GBvh9$Uq)M*l)aUOG_X#8Tz8<_m|e9Gf-5D=&mI^ z5FUKcijcSOYj9sc`S`n``P%?(20JyT-zUm{`h$}vyMDXQmQP;pr>y4n<6}IvBAHJ2 z<#J!ZUv>W}0PIu6NIHdOm662+fBdKH5NS!BjWDe4Gt!$C9A?FEiW%*hvLH+YW;d48 z8>Vm_)nu`m65(7hnn7$%`5V3SlCmEX*S~nZcFkE%^m2;^eWZ{-hA$KZDisdEF~!TY z-Ool0Nup!%yT@=xXOG?BCL(EF2EnQoMZ1Z6b5E~s>9kibb#gw1QZUd|#)`c9V7MXw zv*3niTxn?C)#YSV)v>N9^v2uv##_#ba~w8CvIfMFG+ELOM*RDQQ~dVwzXVHIt0hqa zug7H$$+Aj3pDw5b$v$-lOL4rC5{0~CG=xwuby#i2J_C{|qxPd+=ff*-vC`^)uj-t@ zRoz8HHPhm5T$KG{e+t+m*51DKOg@|lW|^dawPNiwk_)e+NlxoTW@*5}QOy_POR})J zuVuNLR=%|Sn+T)*H!C z7321%opB$29gZ73yP-;Y@(rmq_N4X(DTnDycs7ZC^1!xaOuqfVVmEv7qM6hHbX`nhG>g-LS!y zGIzv|gD`2w%1Gy_qullFh}-aeGHwY{y>ms%BT=nIXk&|DfNnaX-(%lRgU08bQ-#jrVp^-^>6YW**6a{)*Ec^`vDA8`;`}3x|Q{@r!Yr6cCay3;Y+RcuQBki3V z{^4ktlMjh~*iz}sKr&EkEb??`$fMd_;;@Q@BaS%@0>?KB$b)HG?kQtE+;j_;UVhFLxLjbL`z2L3Q#j4m5ZL~L%VitI z_;_H-{}RYD1kQ2{#O?P3*V#>2a?P7c$_~6_`zOqm!j;k4!X6V0p|(B!?&azfJu+E$ z6n*W*rsHJv=79mRE08>C>cN;~hhkpr1EmPjj=zz7Bqh}p6VeWU1pLh>fMzUk{Vxit z+(@qc3HA`uj4orr%<7s+<@6QvI!;y7LX0;}Z86j;BxO^+`9Fox5X zeC`fLS$lWF|CCFbQhbFCy>Q75sPe1O(Oi7Eo`ST=RHYntYo6YOtd7HwpYI*)7m_7N zx*6}1>(VcR5=c6ixRARmxh!`)cBu5tYrRlt(@FMa^4+(t3DO`Q|2y{)-_MZCIhvfi z?n;cxsdLHZ=ibSUhgM4&4CNVjNr!^@Hf<9YceLS+GsE#Kz%JOD_XA--a43+I=}h8k z&wQYpji(Z4Jo^?ZW7NziPS08Mo3DK{D0yfXyb!WbWo}LtLw*eDjM$x;q`7`$Get@6 zJFeJqdteXXzV#aN%5WvrP=rZsHa`NH_6d@SmvvspfA~(np<*x@k0$*LxN*bev|F!c z^E~>U#BNZ_`Cm=NYoL1X-D&r6GZC zl~KvB2D?ASm;kNf-PQ7~XFIY@G_nZTA`wS@-)}V!PW_P}a|3YL7lS&Yoq8U;FeQ}K z)Jop%+rL^YTLPz9NElfo(Kv@Iw8gy4%{=Q%^0 zTsfc$C#~87*lGREk#TT0q^6N`E&ngbqqu!~n^Tb#jB(r3#czIheyw1;K78N*4LH_S zyQB)vPM;$)6Uw1`+*nh7rhgu&qHB!cr-V5bdX0bHk&rxHr5+Ll=LpC>m8A`{n7 ztQQyVj52FXWlV~6TN%yesIE{Ig*Z`oCGWv$_1ANf^!9|p(Pnh2Dis79!A6)3-@>1= zxE-f&jFLTa=B{NMlVcD)EYl#J7pv>D?hqek@Qp%4D<$o+X9JX68S*5aKu__gN#XtX z7s+Gb(O-e@fNoCY8xF1*D`*i@mnxok6F7o|9b+yFkNwfY{rZXWh5K-$zMpft*hf@r z-q_N-BI<~)piS_afPa#2eXYcst7_p!^WUa!eA~+s)o&~LY$?Hd&o17wT8C4_ztqLh z`1F~K5)@T=6W6EhSA|H;gD-y5`OBc&^w3Y@q3x7Y&VEPimVcfoK)V-HqRN+2j-SM5 z@STsHgHmajz%%DKtg)Ndcx}q9AxTmEM63Is>%L6y9RbYuu85xGqZ)Kj9K}x61DzrB z*oP=+f=*OeLydHFMeLzIN^_4zCRUrP`?q&uB@#i(C5b6kgM+ZYPn%j7@9QVuO(j1v z4I638E2bW<-@_=8KaRi$CRS+7l{}w;sGZCv3_6<5?%&zSW;KA^0iSS;qNJ#D($>)a zE3BgUXJS_cW`d`08AS1R+0wR($G3k(vuPwgU99Z*>;-N}-C<&$x##k+LveFtw)`f* z(rj}SDU)nT^?rUe0q?lvhw%6(bH&y8EO@)$^qaSd-VtD+P+}`*tAqH1EPF&V=qa8O zv;C&14YUp%`A7Ztjos#X&0I@gMO@@~GFJG#GL$rJi3kn;+?!?Md^v_-6k&GWrP7*k zA0}`m?Lj?%)8Cr{XEF`!P1yWMiWklHGv|Nr;TsvPeqj<*CIyCQyRn*bxi{`A1>0z->YsahooV3OLIj`pOZ!EI6DZ$1% zuXRM;emkWu-Kev+wmkVcA^BHpznEoD>_8@1Yiv?Fsp?d5Zr;QlNo(mBVnQIF}MZeEq`)mf~WT;mqUrkE386j;~NOU{o5nXP% z`BU^1v$B)N2UXYrqCQAY-sR(yn-sTse8Qbyhf}%2W1gBZMS~SP;K##NN3DdE&ON1% zINlwvBTvigW5>RpTFEUva4&;yjQkpYq-ErMBon04n8wuudHx|WgL9!h`J{_ne`^db zUKcbNQ(96xhNfgQtMtc&$m**xsI_X1#X*%b2Y1~84nr*dqm(+I4>l$@8RuOnQbmhA zQ&wmqjT1hXq+2y#UC>Uy+E^(jOuYYav7x?m{TT24d!_x(^q2(iI%#5Cg*of_d)HW0 zV_jddk=ZMUM$~=`1LcQ3n^V|n=JQvpooB@na6!(|_NC)m+T68QUXIzP*)N!-4sVi>#I+F-o^wkSA6;UugKc~9bohot>kyXnQC_Sv} zGz*6fe#2es^iE%{GN_vx{iSU}`AeG;dqK#`+FHB$V6ozKlqGo_2Kteafrh;cG$Hb| z0(N*%rsaI;B?Si0}*|yXgb%^C!F= zXlNK_U0&tmh00fSj4wMsI~Pu~FqnAhn*Q2j-txqHJgfP;$|et*YNm3W0#&Cl5gaOJ zuaN$!i7y}L?>>16a9}+C>2++PtWi&g4zCjUuH)2hdNwMGRoniaKce0FXM0K&zNJ19 z2hJ|RbJhN*8!ssqye8@v7#lo7ze+#i27MS^HY{wBZ*;L zfvHfT=66=xa{d^=bhZBYxkt1%Cux1|W{aYXVJp12X7O8DcxuX}?TO1c8o}{PTru~v z(bJdUQv1}yad)KFl%^1-fu zbCIH;^dhCZL1fWgN{2K^w{&-%i96nRe`kN^_j&&Kh_cp`bB;O2J?;z6)KjbeF7W(} zHzPwCt^Zl3kS|`BJSnJjXWy*+AmD&QNWYX98HNKvJ*D9-o+Va=+40-uOD9TWp{eBi z!xFOo_B*hUOyTqUZV=r$^fvvk)ii8a4@dIm)0*4Tt2>~j!z=mMk3gfPP-od3DZQYz z{p-rIfzai~y_I(;Ep{vx#Ejp$S%*`nJ#?@s+wsW!+MYZ=%Xje|TfqttRL3 z*aJyL^%k8aKp;a#T-$GAz?mD*IZHnY15 z6+SoQbEXtsr=uh)B}?ZtLbRC5tv%H7#wC>>?cE(|e05{BSg<1?`cVs)8bj{MIV5ll zQFNiqqVfJ%D2cL9z*f|RH!9Ob(EXU)7HU;NkVMKsG0^UjDDPHV}o zvSU%elX?hvshfqq_)~X1+gm`zJhB8G_f%E4XCof}PSEEm z>yJ#ub+mkJIX>3Q4EOOF{FVBHZ6+(rEnlnyYwV{kIM%E?`7&tS`JGa?6M2DCqElsa zG!)DtbN+qWZVB_K`2qIolqt>0jyQ0(i+mLU=BJ)-88+;33wMfX7ARVYA}CsCF`n-7 zA92O4o*4wvmn;&Cfj~(z`of#p4{^hl{}y=#Oau#H1b@NrdNpqbG|y_+E?XX-%Xx#h z-Y}29M7xqV`)rkz>3w({2sN{k4W-lqJ~}|EQpm)eYA4HnX~STqN|T z;g~P{F#w9#PRv-9;02EJpLI-ah<`|$VWt?*ccqeRGv3{D#HsPnV;R@D-&7yX@-0_N zEqU>}fZ#3Mm6U$+T@ABCGUI16O2(CxvS?S>{7udGdGS=U<-iqqRV+t*RN-GE6Wxue7&!7h|gv1&I6pU8q+QESc)TGO2zQT z38J{~$;WrDe!oz`TML7`R5v~Nv3L6Pd@xIB)9QF+U$Z9NsCxl|5uV-5_OEcCw$Y%S zwBTx~!AR#;R$(!%C@%1&+y_c(V!dEM~e!E-Qw{in%lBPyObhf)Ww|)Gt$XKSN z$(Sb<6#KL#!*AfRq?gN<7dtnzS(iOIOTsl@yD;ZEPNMo(9loXu%?1Etow%(R?(EB^ ziq$eX`-(zNVhC7_T^?Tp15TW{d&oXGcXLn-BzpMWHcDF(q6smDoYq(4 zG=8u?S9I+5{F-a!BZ7$`qm8^@T~^XdGu2Z+{Z{+!d-nF#qD0*umJgF{zdwGSVy{h{ z)|4LGBlm9FJ8@VgT(^R)srSqSKZm9L+wlgG@BvD*%wsbj8-#Z;&pI8iGVFRTk*bcf0Ot_9;bMfvF5vc(Tjj3&0R zYCX?Z;9icaz3D#JoBC|tpy74I#pjiGQ|iW8AN2&-uYOcs-vqX4;PZx!JdxDlfhtxZk#l8O2Lb_dZysJtk?Ln0xNb4uZ zGqDZ$2RhPVhBWmAj^*vXtrdeSIgH7tP=mGave4n2g`RhWLbohE&nD-(mG4wh9r7$g zJcHpT%w2lPqGn6w%G@S|85~MvSJnxx4eIR^R`fvL?O5L-ji%9 z02J@L<~$MMI_ zPo-n;E3otrCX1)n^==Wst`nC<%yP+kba&J;>Y^ug3}MX`6))n>=qr^<~htyY9@8AUqv zaJjgSOMmvmz4MalHJ-3XtBHgHCB=PO8^Jnl_x-isb!4Y#gc4gLcQuCXXp2cmph9Iz z3*oDfhOh`WX_|OM6z30XiQJPMrU?T0lJ#fYtHZ8h$;E4l7R~ry_I*6r+%>27gYo7z<*6DdjshNFA6x89y<)U zC*MzJMQVNAg3uWQS_k)-Zo#c}f~RUW)^K zN}64&&kgU4)9~#e@Tq+s&&6Z;5QS&LDY?>SMuyDmNO@>Jr1d*X6uY0@Dk>zW%_bKF zZ_;=n3}34S^p()Km**-rZBbR`*LnSASf52pTmcddQK*k;J!kgkwY8PKgT*yRzGOJl z)lEHVy%5#@hGogn>D=veEq0!tAIXGL&q@6K@or`-WbcCkBbB;skts=7zg;|2S-bRI z4dRdQOKdC6_?70v)Ln#8_ydlh@BOFafUu-ar4`KBK7P-?%(qClCaArhmHNe{v;gy^ za;C%}+_=Zc$6=BcGKOvlNh7kUe)+ZmcuPsgHh3IcB=8K@yT)Ol81yFdv%H-<@T@N) zV9y!ugjMA^T+Sxc+7XBBZxoiSA{y^GaL8vC^-dpO0LCxFJ<_D)A7l?BB)3t#6=!p- zr>c5xeCBU1i}F9?v1rLz0-hgR!`{KW;REQN%N%H0ABz^BGhr5+4HrsP+_=XQRh2w< zo9sH5P9zyZ>tG-)9ggjicR;`MM*^8Ok$4hwBH7+pJk(f1TTMcaGHm(OLdtX+_(^uL zJ*%>hluMN+T`rbW?xP;IhjQGmRjJsm77igx|I&am!0h*I54^k+5x+&FxpM7w$w!(; zvxgO6zjYKGf!gu+{cIhevz(@q_LmDoGtWH6eC$eZ@S(TT4{82nawSD@@6RuCFOnhZKOUAl-oqDXT zd3)$hbymV~Wc*L{zOdIFY!(Tc@GmTV(a3cvZgpfLc_HX=lEwekMvBuMrzYbbni=yi zk>hoLY3T2slAJF%B*@b|)6gG?U5%{`OO%`0G%P#!X4tPt%#F4#FKp0QG*D7nLs|85 zXF=&Pbf{3V2qik{G;daS)KLun1Cd$?*Z}=_IwN?71n1tNy2rVH$Og(lc~Q$Tz@c9# zJ@-Wz@iHx&kR30lt-+#yjUUxUAR@|o^}tyb;cj{}wxZJBz-h02kjCfCxn7Az;Nc%# zzJ?pdb)>uBDB#FK6G;j^<+Ci(4ye1&tME)A!6phJP3)gm{!%gqxA;}E$f)g@btDZo z&&Q>?A5RiLsd?6kdZ)V)JbIe1i9~`;{Ozubdt|tog++@}E=dQs{T{@caOVughk(%^M#i^g=Ly}EMhnBu_CTc@8sOVP#K%16qnzSoavEPEjm+H@3Tdrw}AB<{!ix#PQ)CiUZ%OmaCUpCcKX) zwV%xj&o1o3Ah``k&pQN5_pu*B*8qgv!lE_KaWYN}65X5|Dc2+8*dMfwqrm;;`eyXt zL1rG>MUp}G3<|Gvny9=wvd)NWV!-m{ympXPH<_+_q@$#ASWj!eDeoM?$fX^1_JpZw z@4^ihE)M@(lr~nJFp40an!;bR!qcK(L2#WEu@(t0>8d)ZagO8XY<0n1+Z@ydHw4Nm z;k4o-ZDnTnvze}+-GRgq0&AJ|zYNWiAtLZVlAVU6kG|t5DrsvIHe7Z09JO!SzA?P1 z3G1*%2H)VDVV~@P!h0DK!3b|0uu=FGaO9?J!`5s^c>%XBHruEiHq#h0F7K^=&qk6v ze2%YcBX57UFP>W-I8N!6HO-?;=;)AXiiP)c*i!XQbjEVol8{KtvHRfj{bd9K&8DfW zdnWZ}or*x;717`h8hX&nC&!z(T}cFp4qtd)4|+o!njQ1dzM%1 ze`P`OB7rYa_5w|=23kMoFcLmW?&kwVHlk>U+QR5W@3fJ+wZxt^(_`->@8BeeWmqdH zM#wBM1%L7v6~J$btt*1!!^*~;O*~90n2hOo*7T%T#1rJlIAiHU=BA+A_>nE-9Gg!q zH{dvvwO`1mdS@l76+UqH!p6m0XsB)M20|kn#=Xq9Rn;}s+#MCKTjn~nRAWOU8}-e* zLGP%BboA=kf*~hJ89cG>?y%X|Zb~rDSyimr*9kJYVbbCc!?U3!m3_RkYL1Y<@q7(%gl6`2HR zvpKrSlPOKf9bAY-@BF5B7~FedzIa&VsO|mIKjJm$`gk{$=pKdRVXe-8vcsA!9krrL z)w-IDk(2Hx$^PLyK2fJdz5v+0r!wc`;ZN#Yu})pno(U<6kM&3IdIi$|+iU!6&0z;3 z^3+sNepIN|S0(2<(2Aik=aK$qnDGbYa9_AKz>FOM zfy$|yE>{WkOqfqqT5}j5ENlwY2=J0t5#0SFR_Ij2FCDDt%1=PMjyv(^xxa6KjNRzV z=dyK2XUM2^-i(~FiQ|YqTUE3=2tz3n#4EH_%E{SU%zA_C5Ndk)mn zI{Tk4C)#m}bKwa}Wp%dRL-X`tKc^99#{5F1{;b4@Qm#eIHp2Fb%IN!Xp1z4%!^1w( z+)CakQFLMXJet7P&2{J+8>-yG^Cw>^l473s3f^yUko=UR@)crF}fli z3#am{k46WEL}O|o2y3! zr*Fhs$VjR9zKtemKUI7=ydpkw1d9=-8ly_l7&TR(`F*=H_k$1r``-T3ijB$i_u3($ zj&vSBF)~65tY4lio6ymP%}=A^E<1ktHSSMtGEexE*IAfgi}9 z+em0Jhh*AVv~ex2f}&-g6H2$vyBPtV>5QLnX$zf^S~Eg%9>I4a$7P6XVMCEi$D914 z_SG`UO~k9v{fm5-y_bQP{7Q0WA1^%BQrC!a@gQ8KuRC7eJ$-lE6}#CBGIy>Ux%H;o zxB@Ttr|Lepas^k%&IfrnExc;y9Z*{5LFn?YQs44-M*e?B>(@Z+kp-NidNze`&iuKo zXs0UKRtEoJ5{;n55jJKTp^<&(&#h{-L^k$wDef+Eb9j8;Y48WWDp>PV?fqEVR|0N` zK%7V5dcN1QeE#MKCR>B1-1A};AaZk1{R~oE#KG_Ko7;MtC;*t~57n##OXvFQa?O!E zD&9c@doM=Pzid~)1hOQv)o5yV;&!0u-Aky=0eBQ$UMDz1lNu)<3X9VJai$0efhL8c z0bpQO(6)Gb;N`{r5#Pr!l-D~Z5rY-P@i~BmqXIk|^FiAco7L&g%w6A7rzHYU`$SUK zxCIjna3$>o9LMI;_Q4y^E~W3>)Q_+JItDw>#k4qJ>x9RD_VMGY5BVYa*}wF$L86hi zy4NqWXU}QeOD-eJ%QtY74uw9(d0NWbdopm}W6ezU3Yhh|_0q0)dkMU16DqAHMeni~ zpXbPBQ0LzOkBD$9=U=J-?E`ae(h>s=dtoFV71SGtTSn)M=u9_5glPXd$G`rxb9;^H z-?{LjPvz(Ew=#%L|31#YcA_8Lu~Gk*ZH4fE;Kcs+|Ng%N49XX()@h7*c&Q!# zo=<=AfI+E&5X)lbyL`|1#rmrpkyLr!SE}AU@SMLM?!TQ4*!5lNQ^xkq*BlnflpIYX zC8-~KRH5<}Eh}3sa(uAJtK8|Fx%P09q}WBEzCaKu+-=L-|C zx~3!!J!NFN8-H{Ukh5o+%riz4Pdf`48 zc?(+=R*4lR9aUmfy{7kb%qsxM$eMjsCV?y3w^VZ_Xqi&Fnx<_HPBntV70IETM?HW9 zokOt}ac8g6uK8iKaDokuWbTV6zL6fgqCq z;QgN5(nRIYm~4^A!1;W4l&oiStBNH96s->~?C95_GI+7+EU;n|OG_#5_WqbZOsos6 zH)1jag1_y7R{9e;(OSfA+a@hxC%m1Oi-uRBI+}QU;I4T*JiZp|Z`a|Lu}`PG9P-!m z*Sx=+m*s3W{5^){?4!8XWs#;kBD*7?M-O0;ZmO?;07APK7HyfQaLz3gOr|dlqpyYp zo_0-?`GNk*u5V`T3ZO&(5ukMu+`C6LZ{oaN+>ej*jP09Ze3}Pv~ex&q81T*7&eu^HesyKtsU? z7%1BA%+JIIBT_-oqyV#)Eq)m|p1$$gO29OC-^T&x<9I*3{co4|@4LhhNva2OY}ziL ztaR8q-!%D#2>#u!6)dfCfWo6VNe(=;l^aY_CBHfeVX2VJr{?NJsw1f)3!^|@gFE_!vIE$+$^|X{6#d8jgE*qa1W`xQhbVaRBp!GD&z6ahjed z0^V9&?F%L(Z$f$PkJ@lg!HNP-$&9mJCh+F#ltpz-UZcTBZ3;Ie6EMOru$0`6ohk-W zlzJ3;k=2GUSg#-_SZlDdHD?pn=$xKPiIK~*+;BQpD7q<%!wI2Cm;!!8tcrL50RcZ9 z$0jCPNuqcPgK+d)@jis5-){G62HaI<>s}KWsOgn*ugmr~-b#8LuV(R%+8b{_per-a z#OY?#U`E;w|G8yvv|F^{H*AS14f0-);_?mwp;#YDFbHTHI@o*Joe+q?LLF%@8yIld zneuCQNrX}W_YkO){BaXZcPRSwM7Dc^)!Z>&0D|P8mT>Pxmm+O zCFfzsoiaE}Ch#~vsSfU%X!?;*`>BKKf86eW{xupMJYl_C;zHe>L2rDtS|#4?p_iFk ze36H@eNSwdFm0f3Fk58~vid?%!dw0NJ<`E^8nR8&KdK{EK5iZEOTmQxxwN7 zWWsUGInP5sQEzk4-I`@}hvPcEoF#i0r*MzeNq`_F?emlrji{qv+aO`DLB#%zG7M7s zRePWSw{JokmJEW)Y*X9m;QDdz7cDHr5h8vVL%R9Ew@S!8pefN-Fo{N20<_V|o@nI4 zayH=&0%URN4TGNxJO#7FM;ixbEn~%b4Epn88HNi27v^lSRJTY_qV7mOV|lq(Ov6UI z6n)7O04M|l^eA2tn(P)4#+`H)>G=>uxihRzs5uwPqGyFtJO|70JB^W|AkZl`LY(qmp zZJaX}JRa`vf2RkcjGsWNh3dOOV$U+a6HmYn5 z_PDnThTUTmjQq?j4evHaYo9lT&R?Q__-R>52`y7C%9n-@@IWEOCL_iP69Vy9 zSE6KHTaP(0x>{k!8}V$+c%I9t2U)zu9%sT$@&To0ostVb=9K=>DAi~j69DA}xUDEE zR|s2i>c|qr2Iasu%Tc;!7uCQLR!XZRiFx$fq+7IZPiyg>my9l(`G#r9}}i82jT{RYKY0;`q)T}F`iVc@3jsw# z#fCd)zvUu6yE7m~j=eV{vcSpS>+Am}2M=;8Je$5JQ$bpryk*_b8pu$&(f3KEAQI-~ z+gg~jW>eA{Z~oq=ktSX|h@yU3=fKMy+UO8&r7y9tBHU>SC1D?ymY&>jhHVMAryMU| z9<6?O9s*#4_lHwd+s0&9NpzMVW6zEo0nA(xDkr9B>t|A^e$>B6zi;78I}vMW>Mh-PZH?{&fw zWTp4o!^7I)q<)N0)uX*-+sI1ib;7W$N5l8#$Iz(R*I(6w7_a-U>Pj#8!vNEVx3QJT zq!4qU@9XmIDk)mOw=CPwWu++`$Wb=p;+}n)V{(uGxQL@$uU9+`k&1NKUqHvdzqANE z7kB0pEpqh5VnmYxDXmx*2`{9Bg?wnq~Y=8lA zH35L$tV%!jjtQNk9<8P}D!65ZfTj5;NR{<$M%tD0>A^GXexjmmEI;l0CD#5`{Yh5( zxS2Vox^s3P0lb7qD$w8HV8J)&scM#Y3;hn@s3w90e$Dg@Xc^=mNsv{P&RY-H@R{~JO5@0VY44zy~& z?HNOU;%`vkM)~`r{d0_4d9E_pt#~HaFo=n|H``wH`k^&m5AmcBb#+W^I8!kd^ATKD z%B+TD3=LVzQlnvgk!r9c1^8F$xi)|gL`?%8`NtA2@!{-W?O0!VM)($+FjUlQ;{sxm zAf8m4H!$$_d`sM!ma9%-cWwW5WZAys$p3iPoCp1cgi3%qd0B8 zqy;X+U$i*3m8$@sIu=$fx2uzZr!*n4%**(DI3S#X%o$1BdW&(maxYe@VLLsX?C3 z)S%>kNL@+tBq^HPj84JnR-;0}dq|})YE?c(K8KQ=XjSUl9p7vH>1HRZcV&Jp;q@g8 znr#9Nfpz&2pG87D8)ONgtQ(WA))q&+a)m__>s2Y|rYx{BrWwe-%>m4aExJ*q=$L4k(9KSe6zPQH{*&O}+R3aW((ay<;ByQ}_PJ)MsIf)z(K@%J3Ba1XTq<{7{R&0SYu2C58&Q z$aRkKaF0zvD9vHnx`=9?WhT^jTAGU$S0qS;0#>F5ontd?@F|JlEKD`KML5LVVarANTdJGp95G zsmTHYlDFsk5NlbgH$7t+O`PQTDABmU6iYmzO)Q~clQ8D3FAAC12G4@;OX$)pTjy*B znfL=O+{t$)MxTo=<*$>aLFk&jMd=&JURjhvzhs!C7YHjm4Yf!T@iS-1yKrJNzRD#q z78v~uhx`_6AA4W616*&z|F?m>wp$zl2;UcXBRH$wl4qB$ z%AIel({pH)5J>stbe?2Krf2X_iiuN7d8`Cv<&KsI;K{qqFa{C6MSb$KFzs^;Q4feexpT&jd-VkHyT_WZjyC$F z9CN_}5EF~`v$5=g7ggSLB3Mm}#HH9st$OU+B1w2%FG?E+|c$zp(phhzHTb5RO&=xVS( z(UD`DcYozuTmDXv!v@7L+`coN_lTg?klG8j@#wQ5uVju5POg)y#|7i(EeY&v!#M@JE*ONpS(q9s>%)*@zwHHeZ3qibCLA%_ zdG|Lj{pNWM2^+2hKWrjNjos^r$Tm9!N2z?J6)M$@hl|Zff4b94Q8)#;iNVxmGb}l3Px!(u=h>={5Tev_|wIQ z#C^3X`DrjLCbJx*6qv3h2sfvIAz_2IBk-Mr9A|Qh3=*JJshSPq1J8t06A%MQ+<)a@ zMhK!X>Vc0eFi3t1=g;qcJcCWQ0rY(G7&X zjnMt*_oz-p=Aly8{Nr$c8Q?D`Z70FuSj9Pl+oS!?c0%vI#NvAJO{v;9p6& z1=G=@F@#YIauxsfya)A=g^baBJqAUK(99)Z^6+~(>auGSu&N@)H>u)!#JLhfnaRB4 zF@&G+)CHUdVM~>ay}rQ$KDC~yVbSAVW+_gb*N8*(qcpcP+|rLkvFd`S@k3rn2H#kS z>M=3C8hn)#viKZ{bRZrA@6dbQ-q^<`&_20j0lG3ISJ7E+0k3i<=@F%Y?NB0M(!S_h zkFjE%Tw=)v=>W^E^dDn7AcOhuyyQqV03$<>I}Z3Rw}WYGZ8Ph`I{cWy)cD+RO{Ux1 z^o!9+rxs11&dur;Z~e^`gpp%c3?Luf6u2Il*m|S6GZPm=sz2W+z+Ev&={xMY-G4a5 zFh&KqNm3=#uVRgv*$ZOhaw?s%fr*V+KV+Py=s|EX5emczh^GTeTPtNtW|KhI`-@$= zBIhnGpIPj}To}k@_U+?g{RA2u%@Zn=+SgtLY`SAFaY4yqAmY%d>;_jY)}0rsEB5tX z=70VkKZf$6Zo| z(g_!mxazl`j<#l&Cn_V7`0*m3Jyt{4s|^f){UR;V3iX5D`4)VojxdsZ(9*3|Wuph5 z+K!Hi5eG)RRXIFtV3ekXk9EI!d;(r)&DG7whbUPu8h6WJMpxHy^wxU!ae0OxqFCDP ziH=pvMsmTiOK#=i26pq3ZpqrI)${mxlQlsZ1pIyDiEH=_XDfD}uNo4_8GJI#PP|bi zBCJ;slC5R4F|OvW`CovF-ED%xO@5|&%`TNgcK$j2qkR{KB-D=6e&Z(yfU62bCPY$S z9_Y;0C4pGqs1|OJ=RDxO%?N;AeT=fEGCLQ$5Jf*a#YoW1T9ogIbnBT4pCeHK>(voa z3{J(BX=hKzZ@*ldv{mu+>`ru|&xh8Z__i89_j?`kfb+yUYkt>Oc`W$)0I7-fYg6Ot z*XOs~r=48(E;y4|t_9j-8faHX7{<4|^`0#(;!l(KMT+Nmf{@Fo(9vxRS5+^W6^y2y zuwhwo>pRYbpnJcqCoMf)bLMal^7^Wjcae`J-KCLJ{zbY4JMdo1~K? z=!YxkS}obXQaHXt^xOmn%(Z9lEJh0|5F6bDNM#fiX>y0@mcopXpZ#_7@AhJ6&eXbv z7CeSj3Wh#fTc{j%LwqN~y8xEXl&I&&yj@AWl4%+$XX8FpAgmbXY|D2rcrjwBlJ$->u0ow5~;F2qimW}oSd9=0?aw>Mo->`^Cs@1{Qvx3tdhJLdFZ9E zgha7|(Kx5OnhXDLc$mp*ocZSIP=Q{2mh`g__qtIfMXWjn%wfUk4Y=}*6F2XuC#Q;D zxkCqO!ugdr?qr2T&R_Xy-^IHc?(yb$E)MiKCzeS^TkMm@S6yi!Kg}fJcX@Nyb@aCl ziwv4wTb_CP;I(=pY&a)MkNttc*DPZzI}rqWm8iEZ%>6!JRL9JTy~2fS*x}ay62n9VDk2;qS*vvKL6pZ}l@N zTbA~)p+`CxvAFcFPgGJ{VMe&q0{pejoAE5fhUdw4kRA<2ZkG$PKPNEYK?r!D+l%ll zdDJkMk4Vvu|-(kSS`@LUMA5lY&CEtV^XU#y?M*XQXpz9uE>ds7#e^L0|p z^3+K6xz(3RLnCjMf!AEeRVBwrxCJAf2{>WM|4|xT6$-acJwX6VUx}3P=*;~TgqI04 zGXkVLdU8O`Se!129ftDHbEU=jAC=x_``uUJFsH5`6nWmYfn(c;gW;AgvdF;SY5{|F zv|eFDH}`&a-S!x9O(hw|&mod{+?N@+8sSQ6f|N_a@#j=#&v55WkLOLTmu%JCfBBD1 zQ>B^TDenP+h^9e7a!8fF@U6yNpdSX%(&o;;SEMW7bIg!ZLWTy0Qs@i|f%JUJRTNp& zTckny|4~t^eV*XqGvGe(SRAwaW}eW}tn0^E1uKk`oetWnKBoV}@ZWRVVGIg)t?N-W zTxvy41Imx_*IN=i-;^&6D5+Ey-*c#lZB2HE*5lyDcLY&OzW@dMKU)}wk?&s*3;2=mQo@2v?yE!g_1)fxtC{M^z^|JLG6Tt4Fwz}; zKLwj;Q7=Lbxrg49QBN~4p`Hh|8c6sRCGi%>y%W7wFOxU}%9{54*_%4sJV*-0lgU%) z*=+6YDV%p>$RbY*!aG5Nc1X3*q0rW{Xi_NJ!WzPn+d=5&W@qSV8g5Cuvbt{4 zEOX@%Z3x@$=>)~Yj2nMk?c*rUqi2S$0BTXgG3}~%_Rhvmnz#A5b@Wz2roovSkWNFv z>ha0AqN@}hDKxRHlXISQX!>cXXx)iKPN<@k_(@pTLakH-Kzr1z-|si}@ux_VXU~ zaqAZzXvr{We$4`1paAQvS6teW1A0<>D)$`S?M7oX2Lbch>||@wsRarD&7Il=3?OfO z5&m-o=lOb0m@HS@C!&LOk#9cwDD*dJ)|A4L%B_S8Utx_uDcO9M2$LhbmDR7!%;P$* za&87WpY6`bUKURJ>OAW{wFADb<)6-7gg9h~Q8*9V25Lj$+DXPt#lNjWJyg0mQzMJL zHG`17aFYbX;O!@wprE=cz^4CO-p@RfYN=%*L$g2l0h*jvNfLtT=rI-;}J2cuM%~C41_wc=`|hZZ{BOE^qP4LCCD{ zBrEt0qW!bnd1#wye-`h@jupI?prk(+4LHSEJwy0Q6$E0uNt^(a&YjF* z?cj98RwtKp_3THyM~wiFAbp~25Ik?7c1i9{~zjDIbL*}B&A^Xy zWTeT*=VIO;+iWOHdL&a4+maT%O~fo)@(Sd|G7sFX3r97)ahmsoeXw(MPpNqMl1wrE z4iN6K-o14H-t2VI$E_4=zYZE+4^#1EKR+JEAgtO1;~rWk4R&+m0*#&JolJX@}@Xq7Ck2 zG0s~dOUiOQxzk%kUymtulM2fb2DB+Zzg)m~&!3zrNFkotLIBAMSi__=E~ZiB?q;3C z7-pKlJcjU~0hf7#LIUJ_4qJjm7-T$ZwfHqKV9qlxf=j&8sy-gm0q7_f4!6DY^0#fs zmcRFl_3B*I3N@JA1#NExw9C!X>%+#2b+`+PbL@GD$0C-7eN`2+2}cVD`;zZoSqJZWai!zLJcD@ua{l(x5E0vK!i@Vg)Fi^LNhdcf}TcNbDA& zWYlgZ5iOWjaVHa+-tG*hWsg1|Z-&wtFFVOVfrjTUuuzroR0J1Mmg2-Mfd-(hlce%b znW;fRX6$Fi-P}Dek53D{b5<_}$`e#<66C@Z#H5DNLGpQYQ*PE$D7*YJF8(mzbb!h> zZ)LP9hc-RB`v5nT5O+nYNB|h6MV<~-Im~Is1fTvI=$t)T_FQ?=Hns5E8!3C5O{_9} zO_qc+P&YS(yy0DPmT_*4O6Tad3^^!vtq4c+or#Z$#L&fA_w(hkt-;s4BJiwYv2^1iLD1w|U-CywmCra9)dPGgFTP)V z1se1dbjPOH7Z7Z)I9?X47P6zJCrB~nulCLj`C_!gAVfW4Ns6~*#{1k=A6N*IG)0wl zaDF6ZXVlj#UtOu~Tv1}2m9bdkrP~me8cZ7?e8U4uwiZ68un@MEb24o)Mp{z*%jKMt4asxUA8A9%~LO+2^ef~1@j(ft%)18EmbKTYXF*hSJ zRyB9?V&C!vjrmTEoxKL40i&(SSAV9a=IZon*9o2FEqBcIbxyjCo(P0=Gaf0AW0U2Y zc_asyhTeo)r|R+X=*=cdU|E&@r1KJyE!!^yL{^<%JM2T9f_@2ML=DiAq*s--$yxg$ zHQx8&-2Cw>U$1=2WsZwJ2L}?(^Jphimr(dz%i(rLjEgpu05!zwCD$gyHYik*8G+>T z8^fUR2Sgz263Mm#552(ZO^pRJQC#n|UR`I< z3Qo4Tvf+=*4Z6j)AGLA&W^*^RrAVMmo$OoI`OtoxfT+vX(yaac{B}t(A&}O9S2l=lWGPp%mr&=3M98Ti)x>J|kcqoMeYW0~# zUM-BWcTQA{5yC$7DSSoOSGzQhzM|VK*eJ~G(^>|tOj`^C5v9vpUjA}KJqg+4tUX;2 zDX+0n`xu97?u|EOd0}(Dh zTO>jj{#91C(TaY+_NtBxQ=s%qgUf#ma0s}{YBoa><}-~-u=@rlCQpYb>Jn1pB1kYI z+F}LjB(8(F9QioYNtw0r?n9Fm4u~fk<=)?W4l9K+0kLiG(=N|icH<`gq>T8wuGtd|coo+Jm3KS_ zZNROzA`%&pVpCc5#~5-|M|^yNsj-eKJ}gIi>>+s6WYa{z zvyKgGa2IAjTgfDfL~b&h4O;%~@$%fqEt)O0bmL^g+hUF>!hm!jt)px7)&-5}DiWR| ztlYjvoQQ^UY4=Eqt?P`x?$+<4k_vGmX_|0A*8!w=tjC32AKQ$-TRCC{0WP9vDUnE zp0oGaXYckDuw>(h4j^ie3UObdx*vaBt&VGnBC^dLN+b1K9BG*}nq${|y+~aSCYAaJypC%IjMKw#>9oXfF4*nB zC$0~N#X05|TYc;{$3ps^hqRW9)ww`eGuGAKSOPLYcCC3?jA!z(KLHURK!#Q&J6V}# z9g@)PK|ZI`9!tIR;dGEm=k0Qt^g_agx1!L~yMJkwW)OE@z2}C7QYUY6#0uC-i<3o9 z5Xx+un^CovHA#OAg(8<_YSd(NxreZCJN&ebJzJm0W|?#SK43U@AY9&_q#WIW|Vw-xXIV|d*U*K4{WMp=0$+Ig!`|zychbcz92L%$sqaHvvvclDte4tt+c7`Lr_&sfCN!;8|ASW7 zJgd&Qe54pl1nr9M8nx^jcf=f~k+V&UUSl~T`hUIGd`O*6To#6fhqQ}<^=ZWaDB5|o znsE`H(f=&D^)h^rHG35&?=&`=$TVm7BuFMzt>G#+G^;U4eRI1m)x;0pcpEPm$szLr zSKG9~Y_CHGVG8o%Bb~$cBx~LmNBFm?@pt5ywZD9nQlSh1HDp!JAM(6s9zirf_?^ zPs%=GrOE#npvx@zX%=?@RV$DrdN`XOm@-|aQh*C<$m1Bd6|)nb3-9!*c-dg#xRW3F z|CP6m9CaP0u&@q~oLdqaX z?1JYkBJduUCe#>iM-|$&So+SBaQO>83B>60=hQKOXUJydP%cG^zvy7*SJ`6EBnZUxrRT*;glEG?Kha7k3{e8 zz}&xzE)BL@ipUBvGGU1R6_J^XLZhvYxO;_cKm**%M5?^3VGI5aJ{XVp^{>s%@hpd* zQRO^zZgV2{K~A^4>=>u-FIC=mw5qyYP6AqL_?XYTXDiR~S}0%pJqfCUmtHc+itoL? zJxLD9J!v;go|wcTIdPVL2etzr1f0B3_QQI3TXpF7qX+x>qyznM#6R&qA#$zKAKBe- zTf%?t`TPl{K`#$*T1x@3bY_Zz!Ay``^-@L8cx!H*&i=}|ou&X^BOt(7Nh)hS)!5y! zaOkMF!sSQ}=UBPURQ?k7^bR%nqmWP*bIT5n=XoyjVWYNPzP4SPY5?)YXJ0>34F2-f zw;Chbd+*Lrm)ipe{579DG9T||+tt?1x(RR>ErEUjU|c{2(aT2`g zLN$P6Lb+ChRtPO`f}3`m>q+?Exw1ohE|5OW`MXNrr-#E7gB@Ou%Cx)N!#yL zPn=1jTtDgOB0Suj#qg}TQ`7xUNSQHQfD-7rQyPIlE;)tr3Gwlh9olZ~+*@2WR{?|V zreoOn9}jvz0+dodIN-LHs}J^_pEg}Qc)}F!^0`|p9_XfclX}E? zE2bwIMa)&7OhZMLhbt}|vpllER(58q`Fp0_&#ySghO_}9`E+cAM(o#Saym1y1GT;6 zY4`TUaNmSFaU#H)G-BvqDzjb1tJnW6P_y6?b{ph0dGt}s46l|ftDa-nt;==WW#MNe z5DHa$QfW@Vrtm8tlDv zYKxq3t`$NN>$hkw{Kbt)JhSWME;m3~-Le(6d%W!Xd@^DXA^oFH`udD*ClB+IEIiZf zxuM@|U(}ak8^VgFslQS{AmZTCj2|WjXH=slxJy)zoPe_+^t=Aie;~%O&G}8B`svV# zAsv_aN8Gm&mV7I#1KK}&ox;be>D|dX@^Y_mDZ{W_q_ zM&wkyv1tQqv{VJt)aJ7H2-AFE5Q`|$LKsBb`T2$K_VY*~R6uiL4d-)O^K^5CF1mAh z{0lEv+YnQFk1u6)0nYf8XISUWz5D$3t?z{%JaWN&VSTgozF00@5r0zpHDc5qBT8;mbh1m?Ll_kyk z9-rv|Ec~XSHz>B0VfvyMyvYLc!#}KV_b&6D`}S2SxDqvkM}w;A94oqPsAZ4)@d`P> zLZG6gr9OY?lxrD90)YW~FLWM^>?>M8ebq?I|53dF{p1Se`=67<*bo)gI0kI5qNrI{ zUi^X?`O&nd_eD?dPu?cpYzKPU63`rsu?sNoE@74+(9Hb^8pRCO7exqhrE)hYb48jS z7gBm1xe#o(tv|0pv!4Fx4e`+=cj>z&3&8^p0k<@s?FPg4fsrKl?T4sI49O{a3dlL`egE8DoRdt@RqY7#G%~A4FeAdcjUf7g`Dn3KHE2m9u5)+2b?5 zRQ0wQ7k1&R?qj4@IPVW;OX}2GdGA()iMI#^?}-`pYee^N_=^cDTW*Q1A&uyO$x7My z*>oYAFA(63j?HQQ4f6?h(=_kuj)UQTzbQHS%TNscT_l;ny!)v_>o|9X_IAwxc`v{# zR}?xeow!!CQeK@lUny|ft`Gu#E&~9C%$Z1)WLTyQu0P>kQcFq?;F~k!-TF*9iGf4j$ zsQC)*V#+YUUVQI0jqfv*!1-iZo+0LV3Dh|tV}k3ExnkSCiIm0Ci(@$?;P;~@3Q@Dg zG5DtmU`l0XEw+ea-P{NUMCv}jMk8aHaMy9LKBZMh<{sIU9%zK%yZQCNABWcUt{trL0=<7i~FRSY~ zK=E41V+H~-h3`K@Wczmo6JMmM;8XppVp5`Sm309D%=)qg-<;d4{`KQ-A(HF5kUDAO zK6PwX;RWMJVSNTQiItyjoX^QT&uTSGn=msZ!3c0Ixe`06s`i1IQAuptvmB^EXs)ZB z)jwAQ&oD*}yG;FI9$u2OKx0qSo!`F0k=Eg9Lab2BA3!YMS9xtaVuhf11wspQ zF=n@aibuc6vc8b4aP8+yh3BE%(#soEO?Ex5S&W^{&x*#Lkw;Ec6WQI&JAEz14WVyo zUe+tjnM3PKsUX-IB%C73=A-y4&RVb~-xJHiW$nV4RsBM)ghpV^qc(jlWYI{rJ6UCj zc*KN7ouE*rh4VEv9_U#F#V5|K0Ou6Iqr{a|_j#TL=!#Yc1P8GUn<^@p^1RUp7R1OD`2b5t{ z@zHM_xn#AK#c9?qyk>o*nm4T$x8kY!Yat_Z(+ULBQ~Lam1T@VoeZ=7k(ZQs+t9L01 zA#Q7QKNv7-_C<&qPH2v)b8~uCIm5u#K}5p#{Vy@{=U} z*C1^9Th5~Wiv8Jq?z?g41!>53iY0xm&O1+X)8qN`$PN`_Jgkz%c(%WcWgum*0wKt| zGz!eG=ilg!`1N9%W%Xwk4mWuf6NcGUBb|&YYC0dgliO(`sVP&u1=HRPd$}(&`#iS? zWHV;z$Nsu-=VQsQo%d-zmy?dSm$tN|*8_r>(E~yYWm7it*+BLDq0W~n;jD1jI-J$1 z2>Q%8$J8JF^tMF6t>@4=SMSM_|4EAGBeg$KNhI6tOpW{Pl9`Jx<@P|#KrH2gMK!IC zx3?fWN1Z+Vsh1UcH#n}JqURZ=#w#r=+j~?6uH1~UuN_y{^FTqyB>$R3pVS~D_s=7n zQdNQ5b|v)F_acq&xhLn-5iFY(O>4D9p93j@?R!RhNTCh6$Bq&@s`Ol%EKA31y3;Y> zK1Be8@Q90wBBb-!naTq^`Km-9Ibhm7^(*4Fy68?Sx8>sJUN&IxH=5>pSeSBHn?R@7 z543+7PQsy6`I4XqihgiMKa^_DBv17zZu=T)rf+a>)$6n@arzJT%00T|3FoMg#1GSZ z3_Sqjs$ade`njyJu|H%AWlVGGz;L~yeY4P@=xpyxX>^*Tpf7<)xj;Wh{5JlI$$1=& zD0x5bMWV`N%XPf0b89AC8T+uy{}uK~L>2gf7^r5yxFmp9gHCijn5A}RQ~NH2YwmG$ zTbD;SL>Jxj9sM^Jqh<7fvbjFug2Cq-q9<>a_~RrJO0VfFElQ5|>2hm*2l^iJiafQd zMEZ=&C3ytNaS0(8Endlv@jbIzp(97(S2=^>HHcHUjr4GtIYmvkd&IZ(2!C_nGo@Wx zT+O{VQ-O@Tmc0US4)xIFB+F7wULf)qQ=WqiGv;wdyMcPkZKHcis5R>?K}|3G~G%jDrb#m5Ih zaef;{%a{^dQR|jrCz;#knP*{lV_$l@Fvn`m;I|-)b_y8_4r#Z&`d(03q|?%Uh_X!e zlZZDM=!XB_$@7a@thlPTlr@TcwPt|OsSy|Hw)ep5*e~49|MXrjjVKUNU~AKUaq^ck z!te*axRWdDk>(bkmt^C&89Xr}FYLP7o=0+Fs}aW z^OLX7emW1xe)}5JcEQkVuINEvA1>LMh^W;-xm=+kG9AJT!gd=Pks{`n^eaokAdP+i z1UM3`SD(KQ1m@$P|HYGWDwEv-Q#w&tcMGZp73BN9B!foC@W)FPzdqD>8G^>PditZo zTi42#9OrXrZ4`FX=+hhGeaq(aar$69DM$&Kfb~$)b$E`)(3}&;+Gz&v$GBh8{$wz5 zSFP(4^ftsu69v9$<~2F1o%8UA^tzU<4QpS2S5(vj#vnh?_1`bzIB$uoLPUQ)T~-sF z6(h!Rf4sJWEF!hk+RQIfE<;C`s~?X@$I~iSn!ZIYi+>Klb5C*t#?P?1S`)O22Pej$aXLQ5yevD> zMsa%dp_Xq=*+h?kacN4ULmInDz4E^sI7=rJePY@`^t}u1BjmZUD7~IOUxlG$W*;>VQRDw>(F!Jfdv;WMVi&;h@X}P zHnP(wXk9DrnwnN0BUcU4cL?65qcl8s$V#e2ed6YeTS%w)d7P9%%IyuRT0^)scIvEC zpxZ7FTT{}Wr#!;xl&?b*jEmudDzlyD5nzklgF2>_l%$}aJhl^9xH=FM&zLQ6u&JDLeyu|AwDuaI>o+~p#ZqMCz#$jKhGg^N88R!!zZ`^ zZ9*jor0A`bjd#?a5C6_b`V}wMg;?B+i?Y7CzoD>xjnLn+f_3pEX#wT@X%PC~=isZf zh6qac59Be1H1)i9e%7}}$Kmfgb#c2AZ(#Nx1@6Mr8%Fx_rRQjPv$!)Mi_ygsQGHka zC-HmC439=?ffqwD2Vcy^2}O)~-y9-!IQZe;K12OmYDLd&Qfa{wM=?9mGEl#daCq0% zzV;xoo9t|c-?p_?NnXT}hloxEvluH#q}I;^hp1P8>f}&D>l5wOY6O;`{kzR{!5x`A zpfPNum;DMhi4+#m-%tLv>bto9B_KM$k1l4IH%4$qvIlJQ>A0|ra<4pBX@TWssB^wh zo{iZ-GIYoQT{WnVjN8~mFhA~>EH^cwl@(k$xU?;zW#0Ercx8n<6hcxYs2-Y zuaHiAa0%WG7r}LF+!HK9tK`qrFNUp$C_xLqh-5U+W!w=fI?}V4FZ>`}ZIOh)Y zf~)E2IeMIcS!%^WeAD!7i5&mw*gW0LFg@Cm_c*Pw^h_QN=2Hkmg)$a}2{$B;RXAj0jW&BQx5H@@XYD_B;HT2uwDyqt zswGDMDdRh<-5o}0>H)p{K+35AAjD1HUR=G)uFZk z=9@ufQz-tPGA4__x|yWiBW;p-eeK+=!>sb#pwXn+R=4etU%gx-nuxWuU$<6cNZSnY{p9 zHeY@(Qs}FOg&cZ_|LY9Y6evss?QV=u^vM-E(I!!of)Cdj2@ZMTC?^9ax{q9sM^tdY zR>{AEmfiGuYc_s9{9)H(BO2R^=;5G96%3*?h1eSgGqahxMq23*n%!dhEvp z+YPyc{$NT*%}X+p;>g>>O|QJlm?Ey5WxJ74juH!Sq~hP{);-inDU8Bt^;oUIT!|rc zy816Dv$XoO#UuxEYA1OuW+HjghwW9kNBAW3)#258&hfLgbo*eVs92Z5R^zPNQ`|nK z670;e@dXy|a2aI>$6Ye0X!EaYed&a+1vJ#JfC+9!D1gNlN9ODIvX^^C()M-G4;z^I zEQF*7`szu3_c~w3iePMw`@F3o5H@?<#;>y5N~1vky6iOO7_&Qr9(Uo1*-R&F^Z2Ts zocpQeXnn-=k$P{v^)(S(Kz&_*l;Xp3Z`%Pw)|sV82~yjCSA)<{h1VGq=nJi%%)bfW zxedC&*f+0`H*b(*H!lqPe?CdckDR=YBRuNjve9jBZ9sDwS^n0PN%ksgQ=9*fhN?m2 zfF)snGttr1=SUYPn`{(G&(ek>>Z_`p;I8hIYT86`xx2RO0Z_p6`I-5OtN=o@pZkk! zDCp*{L1(I$SiJBku`G#rLfxPt>0<$?Q%_Zu|0~Vj*$^N+ zX4`A?q|nu;AGTE;I#~#QkmwHwY=Nw|mQ2^e#4TDS&O1X4)poev@W0 z)}_r}rQ(jYoY|e!{-hd-%g_<@nWUghr%B$FV>~B@?}_zYr+%?qn{k;}^v^v63X8C) z&Uw@~(L+{B4Cp4s)YV56R+gJXN44*9o@UXPpg%6+IZEtix zl09HZlGl0N*;+A*lr(RRJ8FZbf=iu)62jSlkuj!PxlV~c63S=6r`efQZX15v_D`N> z)uW@m>KM!I9!?7O2kx=qG&uHgU9!L=%|)xu)Rc=5Wk4>28y&zVmK)*$EP2w~MZ`v$ zu!&Z0LvjnNlDE_|XsyyD_ug?fpAh=jzaTDE8wMh2%aoY7prmrK@AV95DeLFf%!-a?|g z`X~&DGpNty0gRxWav2^EXcM!9{T=@{hrP+7)xKKH>}2vP%Go6ft#XUXC8h&`VDKL= zv+g-xRs^r_u{Y4ML1Mq+hOd-_RWBvSX5v_lNpb9;L+&;W)5D(+?XuC<*F`kYk|J?& zen>O_3Xruw!`S|AknK49lI78BL7Teh!;S178oqoN*-Fu2S-`NeG$LM0Pl$InH4AD9 zz$_T%)sP^|C+PI^o2;tvKJ@QK2D;7B*zkCj(A#IL)v6oZ^Tfr*!v=uFE3?+;z$0tl zPKUK59U^vqnSK&?xhmvMeo(9)?amE`eSeuEBP!Wkw!YuF>O`CpVRooESoAkQ%mDzGyzW_#=g+dxlO z)u9=UKfKwl8iTR1?Ed;`q;vb;b9QW<50>|#CU#EhoR;pI>WJ;M0VmQyR_nQ?!FhAg z4mG=l!lKy5EWZxR?R5KXH{tbg?lgv8)070T^3YPi?o-cTg|BK4$47UUDt2EuR6jWT z5*+s(uh3eaH$&e*K5C~NLUe2NEU~2xNA`xx&8%yI#@prnAo%_^BUn-pbg#qG{;PEL z8m7o^g_MWZMltxqaqHa*V4bq|9Z=>1!0=e!V4-~Yb4Ox$>^22iYced#-jC+bx^{a= zhoB^w4{T&F2XQhrZHWU#ak+$z*z< zs$2;4eA%@KvQ5 zWA|jQvq2t6vF8J=G`;Jez5z|plP z@k%hlV0Jc6D4m0kS`C&|3=C)y_{@{g&D#@5guq$zD;r27)A@XZ6%V@GyI{epAo~J@ zZ)@-6V(P|49Ua-ZZI&Y`d_Oi{t=wO1PZcXttavQw-XB#h5p!BjR#TFD9#Fn*u?=mQ zol3ac1|k8%ThBImPibHP1CJF)hx zR6xT+9Xu*1Cp=;o&esm+&I^}EiXT35V}A4Qjdb2Hc&glS z>-WMZ%h1omp^)KOR$>uxu;3Jnprv@ra-_pKDc2Z|+%p+NUUG8Y(Dv5Q_2)3jd#*RKZ3$&g8aSn!g?TIr*nfLA-3^+T*;>iwq3otrRY=SjS%*Wem5! z)rrmKKSk^%B}}$jvRfuaizV%7a8{%Sg+t7!OeeIghI+1;?-4rt)(@)7PVl7KPY9k2 z`L}qupxEs?WPh%k(Js_GGH^rh7cNaL&CpvW)#PB^*jd-Kk2r2?xIb1+!y<#Y>|zzP=Fy&mE_h_WcDDdo?Ww-Z@kQ3|^ z8XE$yixH)=9a20na`w`h6-4F@^K&h>r}zpMU*~u-0cDZXwdFf;T1vu+#Lb6{Vx4r{pXSK%N#4J5?ktjL2#4#J-_z7znOCA0(+yE{?WY< zLGQkAV&dx6Q(7ERSs3O}?id2QgmEQB7thYBpbJa!7Dy-b&(G%LY8AiM{=0zYr5}-J zTA|fnV%xjs<5gqu<$2>@(1$&c#l87(WY-1YU}pi?^=W=LdR($;r^tNC_x)qJ5~lXx14>H%Iv@CCZ-d+_r-q&8C1k=TwnA$^Db?BbQaO zni^mH5EyPtT1@#bXoSl>J~1(b45DM;fGpE)3 zTXkKN_9mcAOgSXYgz#+y!rEYQw<>`McFP3yKO*Kw%%YmFastNi&?ZLRuCFfQc&mh z982RxYKx=Sy(^ynt@HRb!d=C#WIsJ0Fr@)OdB&M<`|il*w5fe3C8b)g+;~au*o9xQ zi0>h%P+xV(Zme^vgPr(spvNbcGZbNNauSbScTujtP1_YZfeKPN_;9MnbZ=jt$@!8H zb}DyoMMItXF3{k?_BDG`uN?%_%kr6JqOlNPC%W;s_opjIy<^ASto9w6xU%0;zs0Mv zLDdV^S@5wD_k5s}&-kU2RP_FmHqrYc?RpZYj&q)x;aWB|lm)X_N;-FO4KBW=I}`i3 zNPorF@3Uot%e9ODOq<|6MSry$l*pOa;RvD;s{U3?`*df=dz53rq{#}!5xkg3L1eBf z46B6Brh;czk_Q&3E=~{oo~fAj#edrwk!(PC(Yi-pJs^FsGoA{%y^?BL)WbZytfi*->ff0sZ5!8yyw=OIciFx#3WYPAL!!}Jot2=5`XnO#$wwX5RB2*w0X z>ulc=lILAeSk3$=_19r)KjqdkaVnobPq5kGZnsM}JG2)a=lSq`f>3zf3V8}THLmlH zdkPc5vem~)7Hq&f!XYlggPxbZhb++xHL*_#PjbzhN8bCE)^`F?{b6!i$%{1{**rzt zSc_XS-Cz^!e;U`hR@V|2cAQ=ufuRn6a$VEh>&x_rPplHV#iJND z|Kh7E39O;P3g{|mBL-8Vj`g#Dn9Y0fTeGN>IQZlYJw@x=#=ryr2+&bC!gQ-sDousX z*JXXxZ<%09A-X43U$z3#;yA6D<0-Vt!507KYGj{e0_>I)&qtqLSMzQBwP%Va*Z2jV z7`z%{lWKqBIbp@><_)PWZV%{c1mEzOL3L@N-Qs)P#CI3!U}P}cgw=_d!{FH>0FYdG z_pTWndl0hI?0VZwQLQU^uiQR>NL;jcTPXCRgO0$%cV4m1a`y1Y=A{x*1jZ(KcmZsG z-`Y-Y;3$^KKO+!Yb`m6IPjxk8g|*l=^@v`%jdj&@I>~3b5`UT&mP+n+WVh@e2#GS` z(Tw44q!f5{nnONSD(M(K;yQdWYs1q>3*9v7_kcSOAv_Ruw}kg<8M)%vLAng>=6*jVlhX!zJ>|A4 zM69@oP}EI)K!Tk=7}y{TT%3LbuEmt*nZ3@BHp}%Wek|Ii?LJ5j4~I4myGiO=PT^J6 zN9`K{S5x&CxD|u7#ur9bmd>&%%-ypkGaEOaTpGBj&Wt+MSi(63z?x_87|&|?%w;^Q zBp`Tkc0XBe;KS1hmqB0@uUT9y2AB|)aut+Suj|j&*5yBqMDbbl3j7H)?NXR^>)EAc zhLb~25?CV{sgsPyg<;1=s*ELi`AE!d$Lv;&Ddk51GlE4y5hLW~D*4*ZGs_8sUcEFl ztIc)$ZYZImB$&fw_}yssRSL#HKj~iSiqfEO@+Vx)8@cgfm!nZI6U|2&h>i}<4)nS0 ztUfQg7f@=@0fXUfhS?Clj|BX&^synE+5&y|F#>*Y)5CR-QxLHna819=M%**I4!C!# znDS~Xvu4#8DUUDVsJ9}EJ7G~?+YrEe9$s_Z8G;QEhL@gXpUW4Pbkbe{ifN7 zLoe~N?|1TtQjj+m=DkZ6>zenDJVdi8qQL-L3N{=uxuMPWML#m$Gtsg460y2$w~(Ku zD)TAQ5zR+wS5X&bLjUa0UfN;)C{NvB7+TXs^eRKuQC+VcWg&8|j9gk-QB-jHw(;Kh zNtwrRFvasxHoP6XHT``;$XXs8FL=#!JmmcH8byZ8t@;oH+4CM_q_#)zj&P7keVV{ z>GZpjz$YQ)BAx|gG{1HPPe_?^@qJfNJ@rxc%bk8YWP86f3#{yi##O`wPeo7LUiR6K z61AMMcmSDfjKrFf$1O30kfVURD$MJUxBoSU`loBKxpX2hxGG)Jdg|N0+gJ0yNV~J` zfNpa4>t`il_`Saj4?SbD2f-+L8i|_hGu+O4%L$mP`@pBcAj^~bAvv!m_Ma+yOS)B_lKAPApj61stO0UZiiTtE* zg}x|ta-QACSk*2yQ>QOGG*Sg~9>=$|IfyiK^fIb?BOeu#poa$T&)(Xv1VW`pSNrvI z{9$Eq!U3ksyYswDX3~`JEwljd{2)-CiFR6LD>;APhP8MT^Nd6TW*c@I@z~V8L}%~U zNjj6sb-bC3#AFV!+pW?<6iaUEO9}AXr#JTH!~(tx+Oqg^2qI~40Zh$p+qoO@$K+37 z!{U=5yS|D3hf0Ye2j-Ep-pw7J?a?NdP-~7QSCrA?rQZYHPZdM~yh`5vzS5JD6Numi zLCj3HbLNDnR-Ep@fj#=-wZ84Ri`!u0!T3%zPw$ zd(_UysoD-lQvH5U4Qi{gE^8k9S4&S;=4vJJqJ+GB?FProp}oYeP=4W3w<)9W}Xd!0)5Bva?5uy{0i-c*_+WEk@fTp zlH*t#yQSJfB!8NBxC%Y2GsTJv9yrhLM-@$+leo5ByRXi7Q?}1@;Dqo_amphwu>3|{ znkD7cdA$|EyB*2F`I*yWI5Bf0s$PGeS$D&pm+KGpX1;j=>I6eodqAfTwSedFZG*Y3 z+5w;a#*Z}$>EF}xMn(u)4dXK@qvux>xb}dt0iXjS#}qpMku9>h++-KSv+gbiq1#E; zw(HIZqW#WNU4-k1|^;`o{CK@00SUucd0u{6OmD z)E?S)Z_^D@5heZ++hyT*gApoYA3y!^FUjLu4k;Z)cA?7TBSM?lS*-|>0qNTu?+NfQnvXgzE z==&+7*S$`L@H)3fq#xN~TcgF#mvjH#GB|QX!u(rz+m=}~m?+)JmQ-P!o5apNjY2P1 zMCBuNpjd)L=-E+jhhnt6M(kRi^D6@RMGE=?&(Lw0Vy{)^!b9d|3}_?*+iNYM-~EMV z&iZS3a_|G;r??Yqhg@=XXf5wPy4v#>b5CJ}w)q1mlosWL`a0_n?>OcvMClhlrEV}k zi8HBBUfAi|TCX?o+4zpe1YaOa>%bSdQ0Q%NYT!sqjfC42&BsJ`sS~i2Fr; zoKbr%TS;2$|F4^8o7UWI^K(3>r>Bda1cnkwH+q|?>Ofbljp_)K;phwqF z*krhj#KTQ--A(cO(f@__mpac#CKtY8#b*}lHMuL4(B~ZbgF9oY2er5z;m}@va!3tPiSuXK=yuWb2o{|Jas5Ir%CEq1SvxShwe(IRXBWC;DYNBIE9Z=bs z|5G#n2aFrMU$Jfa$$X4~yk!Kcv07jjyx#~+XM0BsTW zY^ARDfLKf&iJz>LIJQT2hu7U!!-8Hf&$@U1NKnvno8#^;x_`tCMC+jfBFkxd8p_R>6r05Tlnpsv zl!A8KOk^O`dj4kc%FN76jQ%)iS^O57<+c{~=10(YplX>~zU3S}F}EX03>slf%C|_B z={T3MOlYw~=IO{1Gm0P}ijsTv$?}aeb zTX)@OTmWgR1CzO8E}Fp0!7nW8lUk@)dR_DOj6gRQKt&dFt6ly!%itxwPK>Qe!U~@c zh3R2BzlDhpC(>{F#`eT}dLLT;3LZH)ZaOt@Z9KswfpCfi;cO2Pw~&Vg&wX#8CqaBI zlv%SJ@=r#vE!M6J%N$1B3AQdCO+kBQ9Nj{-F3yG;&uSl8Bd>cUWM|k({jplaIrPFU z;da|@S{oKS987`w*NdLObiudS#4;7P;8(!AkXW=45(w3uBWYoUn5d7b`0PH<&h^4- z3%~xl=^+7$NY_2-PUMJ(@OrYiy`M)$%a58T<;3?zBT@ZGt)pmu#?t0OsgN}sU+9g+ zYLk8L{uo4`KmD8bQ7}osOJhY(Y=Dy2a#9qcD?o_6KZm@+Ry7DHG%{RIfaS_8-jdk8 zW(MI_oJTOiuMbxFb&MhjBJ6r|JlPi+c>I}4^0>tKQ<@eS0Mt=6!^6OrTNqUT`djAB zczrT^BgY5q+w?s=bngt)BmS%Sf!CPUU*?;{ocJTqJaRoMHbPb6zF5~{pm}tbU%2(Q zJr;*5oH?4%p=1n_;*3rj0C?JhzaWRQ^)#;4)PaD}^E6m6}+;kGlOLwU;q2^O%@lPr+ZBE*6zC46gc4?=PhxHh<{IUt>05 zTY=+r(y;I~NdFJOk5+r#F{4)xUMhbPM<7QdVE!|idk6d~NKg;JEogq3uf>e@cc3N$ zmp}DUt*#;YYz|vhS{@QT1db!a?C}2BVU{-6v-uZ;^%hV8duGjgseS2tqq))~>`ekn z8_$E-CBOHyw6yy7;)5WXS+>W9&Ba!ivP#+IueLZiaT{ZU*woZLESm)*NDZy^J4_9nb03Qj_t}} z`xNM6Ll2@O!%l;~9FL-3zdAqi(Hc|vq~6&D`azVf{%%6mo{D@vh&^TKl7*yFA_rd6 zF8nQ2vX%N6@@woEjfFrX1+CWWnY4o7(?p4>mpMUgXA3ew6J?CxrBu1&87dNPpGlux zQuzN+?4|B(_+Cx~%?b^#QU25?w5wWIWo^w~Aj90l@RJzAf+xcv(ms6L#%%bZ%&7W$ zAlZmSd5FvIzVP?XB6L38FGm*auvGbd38m}>b^2UPUrMjld%h`eB}h{-W$L?pLqhE$ zg4@-!^95FgcV+aW)#}O@HwE!591Iq}gRBNDOPK}zKZG%v&0PHx*qlG!bSfkSX?la> zmg9sIFNZzaFZL2|mTpYbK(g*z^xi_7|I|#+mrbM5`@!YzIGuW*4w+0w#ZbSSa8)V82WZ|0q|xm%8;JTwK^*;Osna#&ba8>rW%J z05fE2VPvuOn8CnAeODwDt>W^>ww(xQqU6f7zOrTuY?j_}EfKnOetA}k0Pleo%eW`h z`F_98wMpjL^{$p^vfnC^SN<&@N# zJpc9G1xWd!;qSR9>?HcH6<1HI1waiC5i0&{e%+jKhJb!J!WY7(_mBNdzK3Q~de5|h zEZ0@alV?M~Fqu}q^zdJpx0HfHzc$rHQK;NA8!m;Bm<4M!;Be%Eh<)-Ec$gXz6=#sZ{YYvOhFkdRNX_ zACe3TsN^QIko;t9`x3euO#s^VXN9v%MfrPD)eH;qsEux$H^-~L0MmYrr7roh~wPHJ%i$giJ6(xU2pd_c?ds}m{}>aJr6g4MBG=~!+2US-GhC^#y2Y!U z(UJ`uW)=Uh<5303_!6tx_ahRi5USl~(*6sM@s49?4q%b|X)cNPTJg`V$Ja8youoRj zFXp2Fh94Im+_tXcxK_TOPe&P55WnAP&`Oz}2Fg8AQ-pu4LE2_8|I&seBk_A($|%ID z%UwUtsqOP6wRQ`?eFIqH)n^=AX<}|nfEgwb`fP&IIy2^M_mak*+QuTqxqM1(GkWhy zPH!Sw%Z#ws?2@W%M6@e`}7nAdb_(3uZF%i$n5J&Gf?FfuQwQ>mTZR z+v^l0E52>~o=3QyR=o<=La-=#bE=1|t-}r=rN5k#C%4OCYhaLgTxkVq90$HbN_%91 zp;JAm?KL^+O`ExDxWS%(K$$ZsnikHH$l&t{BDxH~0M5Rb>k;DE{A*u<^cr={G_cG= z-zO3naf0A`duZf;^lvI_;10{~5ACGB2UTMs;zz)*r=E8MC4_%RucaOB3u2>s+{$7Qwv)_?qkWKa#9;@xaQo6w& zl|M6$_%Xgr1A7~re=!ZJ43Ii{5TAs*obD;C0ba%GTV4U#g~q+$j~csRwSWQU)JBK~ zGlbVJA=0TX7f|l1G{k-We()j57K4Fd%zWSgfXUBcO$wj4$P%#J*0zZgod~Psv3cvi zzhXp08TQp45Fz$qx$>&0i3dfH_{te5MhL;mwP z1@X$F{j^{@*UGuhwc=J>@*mjXvEi=FLN!UK2J*(utLzsAK%EJJ0xjZRJLqGzNu29^ z3dZg&``l(ZMDrCPRFtXv{l8Z47odY(#2K*=e^tR>lWRO8FmTgOQK^UDD1iC{UcI+nc8Zl;@nOjqYd~7eaOEYBPv=|7qZgS z8&%Es5DTzNmrFY`QJ9q{JJr&v2bgseoL2}tsC&hJlbGibi+i>V>0R?4@dfsvu4tFJgKX1s-Xhh`luHs;0bN=wbn0_K%z-88K3o40 zC0g{))j0bT4RpcaI_cfiUKIjt<~vPk^`_e6)#u0-3w^ljn~>=kpM4L%zx1y$ zPha2+_h^=p9dl_D5L#XoGkygMwRRs8z{aYz@&^E$jny9h4S%No4|8uFROhyK`6jr8 zKp?mU4-nivxI-YgTX1(LIKd^jCAho0LvRW1f#B{=Pxg1t*=O(5U)Qbb?tAb0hXqBg z_3C`*9M2fPr!u|(L3B+Er{CuB=o$BEFL7i`ZxXe6&!g<%>V%^z6L#XEHo|4rW*EFD zdvY4A==szXYT%~nl(Mg&w}lr8__SA(^c_~%R@$F+dU&OaICdOr2vQ}r27xr+-fG9f z&9ppa-KR^Y^z2u^3W-Y>nL4B}3DK*30%HE>qG28Tk7Lnnv?GL8+x4rQ#ks2E{iuVS z-xOK)e($uUX>=#4F}GKxf{}p3plMQ48?z=$B52<|lVfB~yEt0m{D_EL^f$R{ILxI* zFx*_8zWckB>S1622170v`~aA!w`0L!_5Q{K3%AORuiUD&O|asVnMHJ#K3)@e`such zauX<{x)AI&2~h0)lT|$@c0ZY^HJ}|!BUBE@5cU>>&Q?>;$UFbdm?d=f77zx;w|YYtW&h|-x^R}N`c7|YCX=q~h|XplN=K<=ga*=*Yb!v( z>lLDs%lU%}qT!yu*F5UXo(y}E=C|iQJ_0n~sgN($gAEf%XtCQDcTvPZzh8D&e$h}R zcJFBmC8<7Oar7+@t1c>s=pygj;B=1-&m^9-j`NIYOAG5sT>nhNI+i3y@4_!(EbKfj z&1a4vJ+-@BEfVpi&?Y@-_)b2N6clUkeOPXLA9s$a#dMYp-*DkyT*+H2m|02>eWFuG z3vWm*Dkna1TbXATh1DFQ1G;Umuhl)_(LIxN;p^@cm*kp4ICFKwl)y$^I!*N94G#x3 z8|Vqg_S!8;{F-i+@2_WJKCeF{(x+SFudgi?1Q>|VXJ|5SLqH%KEOz13mbJ%QZvA2?p2cWv+YiqF z#K849FYnaUJp9C+BjslHMPIg{S4j!{)^QlshR0>(r;z!>Zb`+WFk`0DcR zC5g2$#hu&K?s4$GBiA1Kj;dX#1DUeGUN_yYhs_UGn3v`(7lpLHV4Gf*d+LTz`zMq< z@|#~a7EzM5u}?QuF0m~Ayy%pxrqsYMnfT!?$i@7bNbet3o)j)rN9&*5i!;M)Ean+8 zdZ?>A&YHu{K~PC4VZ&3az{2ZF*Cg4>Fy~HYo?Y+;%*{`rRSh23O0Loable{YKU@8_ zno804de=1IN#99PVF5By9!N%|?l`}0xRcPZI5B!r3XRM3zn<`a{Pu3vq|bem8024{ZI{*r8V$qF zrKf?eb&~~YujRfG7^V6X@C?c z%H`$eZ*vATr;y{e_H+1MCI73$%%_+-|8Ke;bA@SbZo{Y%}zW8gOm zG@!Q$My+F_htYhseCU8AwRKZD5$18aQ4?kJ;(7;C&fwdwhfzJ<2`Kq8BZS`7nHZA z+2CjX)+p=LsgLQHE#`J^FB)ii-185jIW`cWF06iVY+Uq*og*=AF-3?Q&$bOuKBYy3 z$cT|bHO@?X}b7Esg-MyWlkg&Ep@7gf?!VlPN>7&)_vUtVUF#eL-=2QW;DqpA<)NbP9Ybo z*FJG2KV*s^v8T!y7#QdP#LyIKZ<>M++`)}#Alc7fvZ{HVV^FMg?~g`h@Lv)v1hg$7 zacV?^DrNp^TwBXfnd+xdh}muH#|yj)idJ)Oo9DA+t-a0*Bu7?BnVB_Rwq@dhj__lz zWBlCi9`AGmtPMQA{0^(^{Z14(7y(1TaiZ#;2;~ z*rVb^^QvxMp39-c=fywQwb>vK=&S^9j$~e~#&^IO8ny8pU^s6?3@sj9$sZkRe1bV) z9jT0amteFpZ|%i3=$x9JR7wUvg4HYKV>lkLx*8u%-22|wnb+xuay-#rPVzr~$?z(U z$$=O|SJwIh7*M81WW2ltAWSSGB^5f%rG*YcRS)|J>f(Q_p8sPA+A^>mSNOa={#&Zb zZ2F~iGOIA~4?E1I@wn0J_q@O-|DSy!_*=%um`nxRlbER^_-egw+dV$(XP&KuAPwC8 zT`;iBep_DZW?vbI{OXcG0~jmoj`uDcdWL^NOMqO5yhHz|KJahv#(oScHLFd2V{wh3Bkr&BMo}2#SGx^ibk?VGBp5j-sSqRRK5I|!x3@^q>7_XS zq{0tO%3hOeluD_NyOT%G*6)bf?5OoBWO-7j{_zU#kfY+b7B@@y=O6y~x%Cx2<^uvI z_c@nRLyQhvkLJrpC7UR>_{H#hRo<_%LHzYlm{epvZ#a6qEgkwZEN7v3BI*FrG0qHWq=HZv@us-`&z(_F`TJ2bU|&11F`jQA>7kkT#^0V*d*1Vj36kEB z42$bmisPAy0s%a2;CY@HY(YsZ6@?tu@!&je2|uL=@o@wB54@1s#yW0Q7*d!Tt4OkWY4%q)NM?ADv9xNT-A_`w~7U? zfnCTKB!>QLCHzcX&xLg90XI5bCGg6O7aEUYD&?ax@QTk7fGeUp2PIYIZ;yd7%At?> z^$*r+tpX^UY%kvQ5HK70aSSCmnS7*U-TTq8WKXBJ&)V$b&TqbunoX1-@q@uwlLuRz z;U&BIXj@3R*l@GvL6`%!?~#I8>F(1xnKWOl5cWj`cH3mOT%GOl>?yn*kWq||iHVAi z_G$Mm<)5#yu#qX%Qp*>5@;W4NTHvHP|ANQoQv^VLHD7AaR%EZCq-_5087k%G953-X z{UBjq>HrAol)}f6G@j$@&Ga<@6Bhx^hl-yDd;0?GsY4j`>p9N7yt#!smI+->77lf- z(5~bb-@-|p_D)O$CaYKfyql)n>PaRe6#md(Oq#S21SqP!6MYD-MK%7%xw%_`| zY_$Xtujxn$&WM3DPxVvw8~7h4SN%gU^tQ*zIPpq6ZZGl-->uo!7g6TsXlpPI(E~0$e(SGZ$w%HrT8K37+jwRkS zwAesgQ)k*%cs=n8b*8XdhwNL-i@!ah>?IIMzfRv4h>Jd4SADeLN?}zO`XCbE(eh?$ ze^4lC9yYf#z-+GP*Rag7vBsD;PWFCXkqI7eT~_F^$|-|&PiMNy7!C(x^5Pe;cqcjL zi+RdAkn)wk{1H*~9>fhgg>WEW$X>+g5))T+MP5w~e z1d?C_u0ozQGeTYV_1Ir7@4l?}PVcNm2Mh_Cr;FNq1d_~e?^s(L=!dEQ+HY;2J=4%P zd;krDOJ3`7E@ut&)oio&>mQ_*>_(mYi{-|wi^k!eK74NeI?KKRzC07>4c%*hMbY!-YY*!)`be)P#r+ zqLq=|%s(|(c)FyG+VwNU*^L|W-RchDW#{tk;%TkfQ`DNt z)IK~tBl6gR4%8vH%?vf}*x9(Q4h6{zVlk||6iLgtpfc$Fw@EVRC+Jk0NOsBl3R);% zelyc{RQ;+)cV0*R4DP%1)I>3!Es=fJsBgSk?Xe28%a5wIr{!3JXY(lC zjdw7^#U3$}eH%D)N+4)H;uba(wsgK?JkORh^ehvf&%0Pb(N6nbOCMKO@U9Jc6%>^r z*=-<2+LaoDhml^2vg>I%6o|1k*^E!vMRxt5tJ2>yVyE0`u(*4r7B@E?w4|$kj1Lw*(_@##- z5`n^|nSeQ`J_{30}qdQ zmWhO~3a`Kg^-^6xRUa3IsLZaK7Tnc{YN=fy3AMn->(`csv~ePToOMaE(PSYR#d5(3 zRXMaDQ$Pwo?FFwc>jYZ&xXsps3(zyOeU8YH8L&*j(!Jd}RGf4JIwxzq_l zjy7vyY#9JGRyM!SZoh@{#IOv-Vt~NL#>TQ;M0tV34X0S3;N7|UK5jm&I|O45*pEh( zv)2F%SNQSazT9$=^K5^9Iw?uAzpA>tvV@)+j5KNa%GU#2q%KN@OI<$y3B5x)*VbroFDHmi^-&+EgGxF zl32__H?hMKnT*sVlf7Tg!n$ZMBW?@{#uyGEq-cM@1(8tE^g_V;P2hB(0-h>IvvBdL z%k5nKFjljSScQ^?9V)Z%?V`%z@ikHl%3d$Pv7ExQONK?l@e>KdA!21!y0kh><4NH4 z;9PRwmCni$dGKH|925nlP!hwDG~dUEOa2A7LyxVc=Ef3rvH5ozRVa^cW@oRc8=6js z=X>@{oeG&hf(%RUWYG~FIFUV$b#_VrDhVN%Ez`pjCT zY}&Yec1YN^_?%7$p}_m^Q8G9v^-i_o^^-}pi{WMcaSra-VTEU&Rf3w(@-|V;A=8Gitoh5jRxgyL*4E0n zuOXkSL_i>MHP7tMgXFpYXH1a$UP*k&DIexL*&kT-tKm4jMB-THk1fugr&`ACO1p$g zL2}#jms=SKup36X!+pqG=tzW4y%46D7E;UR;4whHEr^R8mQ3XteOwLgs)l^zbl8^OVU z6k~r|W<>I2MuH7!%3_iLnNo1!yvYd54y$Ov4+a&6o0MTgOcgsR;l)ksnk&YhHNt?y zbdwt_vIyY!bghV`T@%Jyi1YR#LUo^uC9%2WBDEY2?eRps7ce_m)=bijq=1@76{rTG7__dzZ zoMbBjK+U#Kf+Ag*oy9RV1`s++Q7teex5X-JC88AoMmdh{tG^M-k;?o^D@7wJj}96S zx7IoVJRK?B;{lqs{t6YT)c|*3U`^=Ubn;|B-j5hWB2Vw;Evo{dWaertLV(#E&1u=A zb{GvT1``vpang=%hgyXVTwGFkr;N=K={hSGT{ewA2|v0CKnQ^R`qU~663+TO;O;hp zn2#x^#?TBVJhy+Lc591eB@{C-s2fT{2Q0ElMdahb!h3A7;_S<}2tc3hE)!Zc9S87g zGs^^OZfZNP`s1WTdBm|wOGpS@S}q>X1x;5CArha0VYwtC@p$uvS%G+XDxM%mT*YFA zWxcpgzEZJTo@QfBwSm2*Q`~Ht$h-u-aJWA=@6X}cG;=fYQ+FH&Tc}~4OAQZN4w#Cf zy_l3!RJ`5k()8*oY*yDtUu5g$=F4rHBUp$H&anH)X}L_1vB$+f;+vwpOcGaQWlm^! z>KHrB@L&6k#DD?nRXUxZIsckf?Vv}`=8xuUs}ml6`fu%M_0PoLw#gA^aqf|oZb1{Q z`@B9$jgtDvvEgjR73=y-r;iA zJimNymsB>#wSA#&kDKLFp(;H)L)!@GW4e9pT^A2l-WDb3Zf-9p`UhB*o61u(=Vhsg z2ApI8P()QyB>J#>-3^mtg!Gw0!cj=%2l**Xwrydhb-j0gQp_VkW%YA8{&9RufZsgD zj?)A+%n2KJs~Cjl{O1MmUZUPiJGk@CxBsYwDM|T%i@!H ztJ66t{!7Jdj%c3?j+C0?p4Osru@;t(DBM*asS{^1@Ce}_uHqie!-P+)RExYR;g^M= zbdpkyVC3TNvxpMhLt~a3P33={?tzuY)=+TXC@Shqtt#~{Tw?lVJ){UORG3BV{!}EW}%YAo5Vmw;*9R{H%9N&!F zi9*vTd8+srz`%7o1MVghvxtWhjneY}i5pj;4joKn5*4I;yg&4kD>hZ!TW%#Red&c> z9Om%kCXW+CS&dV-41@F0;MMueE3>ieFs;dce>QP$vzao1rq7Gx3x+Qh$t0q{UIMqD z&Ic1GR&L3xb=x_~RcaxAq%be>63`;At~a$u0dA*ww8ChFAeB|O1IpvSReO~UxvB&j}=9-F9O=EK&@mNb$RmHNlM$`N}mG6iOXzVoT^>r{`6*#&MC4)Jv?5)?Rq2GsthEp%Gi?TEgPi?nKn9+S&T`01;W2b#n}By ztz91bO}cQ}28sO5G?og7zTtPA`kBi*c_(1+y$4j%YNRZWZuEHV@4Hc^%!KYo-Zk+c zDf0Gt1$vL!)9Oy<&9zL{?6dUQU`6cbQ=<58iR@ zeH0hmrB}Rbl@(CfPv#FJn+FLxQD80c_Y5Bfn2jvH2`u2B?E?}pFyMma)9B|wx4T6# zw{81H@_HvPzQL=aRHSL_o@F~0;zw3)s$s0I6doz+!K_wdi&28@p3_fZjf%B`w2a^P z&5ny7(QIEKz~gN@k-GpY9y4!D?NslELUmN6SbFaYNF)RQ1%J=uFiYC*i^8G#-3Q4@ z?feYlW#r$VWZ#AXL`FyLdU79Y6aw?fqE2j&H7mDzJQ81t=dK&=Wfo@9=FYQAw))uH zDq^ej$9`B;=S|Phv-tV#i>(S^+PnBU{j3#}0l#D{m~IS!VA#Ud=?r8&p-o0uCe|o1 zW5)hPI9FLx(RN!dixjvH@J)3;^V`U?Hg zSD7*9HrYDVimF^jUFRMzf5;XMI7!|d%HKcdvMPHcRPbG>buMe{ZToxgh!|?6enoNp zTW+7L!ezm6&5x0Hqk6z%R~^?!hOV*hV&I0)qLzqe!P*?0tD!s5>c9Y;RAw{60(AW| zqDHCVbL1@!6GJ92ZqSuTn)sz54Xw6ztUTKB<-JLhP#w^V+i-g~y*LB1RO!amNnIxm z&8xu`Bdd3fQ?EyRDtH1>24{*b%;{oV8GSTnnG$pzi-siy_;KVJ#p=ZRVr8>qg1OTJ zauD92JCPPePs`O>IR=acBo~*{S3I_ud&oSNR8Mu$GcG6deSJMg@K{6E(@!GEvg!j{ zgT3q68K(gMheI>tW3r#5{Kt>SCj)e5C_?Wv8=wfournw5vtn8m{H~WD9|FN5Z^u2~ zlEHD$NNlklO(qxdd}n%MTa=g|8-7siQ)qd5cz5LpZ{aQiHlHVVz>9hrUz*ilYim)7 ziT<~TgaJQVMI9d+&c-FHI>gn~aJ0Pc9gwvBVjNmd`X$+&kKPn0%k`M72@J(kuZ`)m!0-xf*;qA162V=-Pn6GT2O!~UcHyb@cAI*K zOU+_pV((8k>Ys~_ z7NFK|mF+3NeL+h4O+G&w8};G#@RO@&fY{d74~q1k@8!j@n2k|Pr;761-*7AoY&J#e zx)8v>7l%%jq^lRo9k`}Lk9vv6j#A!qbyHY+40^As=|3so#C@AOqQx~hbw|awpu3DG z?YY`ANgd8v5Kd7LdCuY+U^6V@58l&G|KhqDnyFj5AXa!L!7_7%P+H*ulFVbeKrs?k z;$=B#mTa9y)bDe84eiemEZA~LDS@t+pRl{kEerW4a{Q)QL}!E(N?ti}BD|u%NTEOK z(2w~Dm6Kqc+>S56>iqR0Y(1QqoUvPN>oAse8NI~@QQ~W`RI_tHD_XE#?b)m-v=jS0* z`j`Z*%$hshV7G=}&7;)_31Da((IkKCeFOAr6sKA&x3 z#B8rU!JNU9X>Kq8dU%xe#HF>L009{pR+-OhH)O96ROh#h$wbz4L#*xw5@^2= zMxB++_9%TaqM+kRwN8T02S{4fpHZVBz^wKiU6vG!F=;-b0X4OoQeVRV7cE)HGOKxx)1S~d$)4Xzx~HSgh2iu}gLl#wZ{#X39n zp*Q|5M31LPrY@yy4vW%@Zu4al#*1!4Jl_n2!%(y^uVoA*$yah&!XcO@k#81Geh*X& zwyLyxHY<_AQxN%Sat(bJa(DLu;r(3NR2KS5^I67FERK#OR|EM(i*_IA>l!%$-2J(l z$qzjl!iWr(3+!exr1^#ww!f*68pV!C3@$C1*xxEjx?T(}bI@tzhNo6H4BVXK9v!$H zs(mC8PZo0)tf>_VOZuZCxj7T*C?!6dal2e)^3jZH6g1LBve{d#MYh`*o_ZFu=ai@S z1xkfVsUV9#{P)1n4k-xn@)xVIu#_?C_oQ>ului~ZnLHDtDi=dfYs%6au3h#p3lqKp zod9s;qswHfdM^$p)P1Goe|!S{rKc2P_KfC;PVbw6z@v7)sREZOYnvv-wd`jeqJR@^ z_uZ0*>8ct;kuBC3KlK}DKUG9I>$f&fx=!G-O8mU$m%%3}O~;y&#p1Th&A(V92!9G$ zq_~6}WAor1Xr~2fNuR%kz5tf$j|Oiv*iEavi}idVHW5KPpN(!#s;TJ^yRTn~6^Y^w z9kYUq%l}||3ri)PPx3FHXiHQDm(p>gyw(fd^=EvcCRYn*5k0XKD8HI|DgNM~4!r$8 z_hS$!FM{Q$E^toW&B)dD>q&nSuVNq}{LX(*YO#^GJZXGd2B3qaz5G7!6Rj?O2D8}m zM}h|vjV&3bORBMA#$zgSsg1j4?zzzTeyeew$XpHSf8IrY=P@WRoJX6YUC1PkdkyJ& zO5lFYvpknlZAA{Ouq(||ZPegSQjqqUFzKuh+jqWMP~o;(pfx$D=%51x*Yvv}0zW0c zW5EF5$b%aIsM0-5CrqHGCcS@kz1tZ1AOUM2>w*4Ue?hL8;}@(4lo4njEH6s8HSqTs zgFE2a5^oHuKhGSh$PItrv&$2CVK11~JOhJG(m-5B<2v~YG!?;lU9M~i0g4neW>o<+ z_0ia&QLIbN812otEN2<3n3<`OA25J>7DZ~=qL@ti35I>i@Lw=&`_&(l64^MCqnoTU z5T|#P2fUa88tsY&Lt?%Dzo5S2eHx-Zhpjk;5;A9PMlj|#cWf*dYd?)pyv0ynGUaxe zl~kTwBVWZyZqfT9_7@;_CDmlkQ2iu(NByFI>s+sn--Nfz^i!(V{QZp`9U>-|Mx0Am*8U|$r;F%Ww7+kV%h>vbp= zsqi0WYj#k#u2%zLV=--gom8PzYca`n@10hYSj2ZfQGwgZ1_v{w{48^s_B)r;>gWh4 zEz&DuHPAIkH{vHg7rn{26=$*G5Dw0cn1n%}?19 zo+8#}d}3nNw*JF+pV_$828aEeU5#=*4#U9&U1=6^H`zo+#SveTFquw}xc5Wm!}GOs zJ+Fv+i~apn9D*LSp$wUWu?_FDi5->8L-M@-jcGnpCf93Kw+bVb$cf&0K$x?M4xAFH zD)QZ(lM4tMMQKI+U##U7g$m0#*H%nFDLGL`f>6{Z-}hxXXG|}o$A-RERS5~5LzvSH zT$dRMWhUxhN|vEd;k4o|DnKmD$W&urh zs??nCsQI5!ZL1UwAyorcWWye?N$kIeX4Hu1HT%NW;LL+b5E|;>f)R{PsNIlONgU{y zv9iJn1%e;?Q6L;`dds^iG05pcdn)aE?fz4+9ziQKV^ z{HAlQGZg7IDk*Lro|s|E+ib4E+QAHSC$9RtB?lJ_PG_xsPUNIs14IprZ?8^ z#vC_V_?d#4v@i)@zZ*dLl=g3_b18ZmM{L`k%4t_KZT%Q`knHuk_P$k#*>|XE5b{Nv zZRNAtn^50SloM1Q_&Vy(b2BpAey?6N9zs*kh!-pCTe+0@-mw8j-`>+P;F`ouKozN# zy|8+Gy9H_EE)rm->)W0%)0nYU&6yg~00J#4T?r|wbLrZww>`FJ7v$$^P;U$j^gEM6 z*)$N159K)t-euL&Nq}%yO60jg*zq<2UHyq$|YU@f$ zvn2vjWK}JletICc`d^4rb%O}Dw3iwW|-(=?(j{YHDKj#O8+&Q()~m?rS6xpKvn4-jf8`)=+G z4Z>O{)G|;)r#~wc$Y3$P{8D>o&{U&l^6A?d+lc?+Az_jKfA|RP`>D?_RTN~HOUIkf zBXMsRd7XU?(J|pG4P5W9%uYQAB{}lGW5x3X5jdPWWwhprzcXM#b^ih1+~*qVRt%-T z5FO`bNu%k0vQ}gCpi+D$N36Vm_Gfm7uqA?0-|bUl_AjXworeO5a4P9@j4*qIBdY`p zm=8GTKMAMFP)OPnP_+BGi&uzJ--56hWa90snU;klv*`Ds3X(QIx1mHQ4X1trYn~J9 zZXw^%=BHBoB*(e;ZHOR-lYkbXmo5n6FCyAKGXV(`bb&N2FF>k5xJo#v*&V-G&zO05 z0~6?Eb%fzkYpPJU9*- z${`&y8;^bvWIzpnHSqADKCj_J$JnY=oYdFf-;v>uXzy7E3_QPvxend~9SpI_0W`7e z#1|$Sp(eu1fA*CPZep#dGBPD46u7_F0tpcgxY<1KoX@r=V4ap6FduHrYGA@}n9YL% z30&a>OK|mQ9M0D7uC6j8G7j9Xq#-zn^7FZDmOUzR{ z`pwwu(M&P!H(KZjlVcsu<=CMYsUMkcQIn!=aHmoY>n}PlL~+5~&dCd^=Ae+2e^QQ=FnF5Hx6MV;e_bF`>s<@vWN%vRAcO&PrctE z)r*nEn>Sw<-#%l-@9Uy7yLj{aeLMb|+fV8+rroc?r~Tr_nk?AW620FgY~Lj*NeOiC zGrg)bDy}wIt(!w)hJ@1PM@(LXp9bCnPSN)zbK5^EHeRP&{is!o5-JGoLUx7(_MajS za&-;LF8h0A;C=w`)Lw24E+s?z@IUe&`VM zaYT_dxZ!FRVdpIGK?w=zhu>*wYH-`dr>Cw58jo@~SzlH{{r|}`CW_E`R)T>^T(f!a z$}M1UyLQ_Q0}L|7LTl<=!nuU|yoGfJUFW#@&y!JH4nV4tZ8)Yd)ORbuXgDFLrcc+2 z=-`fmq?53RO$>G;&(AvO0F_C2AAi^+A=h9L)5b7cE&S;2XB(P3Wi?#GU zPM=roW2WUYDml7O)9wTF91r}lh&mT;TJ|j=@h!&kqcnR#Ex^*5I&Vf)Z=j4FM<*o} zfSwnD%qHVANv`$+yI*xA?_HxFO8_`RiDu2BJpeQm(rfp*YmWdAjMb9H!;bUm<yP^=7788!D0aGW7nTeNyt9n>WPsYAi>FE~ikWw?t z?mA*t#9naG;X&AyXMWZ_H6;C$s?GrN-k|rdM5zM3*?@EBneM#3O{Jr-SX;t^RyWJ$BQ$O#^cd2Yfq}X=RQ&G zUYM%Y&yt`Xr#?W(r|;;B!9yRXh7ds|Vz8QxDF{mx&ousvXyZ=ySc?d@#?Ly`5=%Ms z>b2%FS=Vv3iX)BORA0YjulM7El99~jB}=G;8hPzl^%ce!>+$EXmziX%m_W8M5fkh{ z`0_-%g~d!9p}a(X_kM5o@|k}V5kIj%?u?`Jit~J|p1Din*_6?;nE^y=cuLoiz z&)b05E??6NfCH{cBWZo#!+WLl5CBYt#M`ZsBsJO)B%no2*g0RpZC}{)^dtv+g_i|0wOb(J5)|KvoC(fqA0$J(Kq~-6Olr)!g70Ki~ zE~NxznOKXGX=w4w;fk91xbH|irR!j?Phf~93LiXISNM0pjorQeypFAl2Ve z=7YK={rLWSMxc!tut}uI0$SvREUS60EotL}RgOK&4W(bKr z0}AL_Va1oKK!_&ReyHG`y@A z7xmaKBeXrARMv0%{M?lcqMpi^^kBZ)ED-#|q?%87EZ0FD=Wv`=OJ#o+h($B5?Vp+ZBmbIge4bam(+qov04jlg*^-EN2rGoF267Ckfz8;iH}yZ(qpELD%S(_W79CB^QRH3c&~?HZsl+=VB=j-rFPs_|?XBITFz|GthTxjU+O16< zS-Wg!I@PReZB!0KBwqC!MLunZRDU&dAMtV%4rXXH|;&RfE)=WS)FCrqECVj(lNkuM&=6 z;mcq|iJ#MNAs+G@XJ4;fJ^h>aPxiuF0!2r15D0zhL`#eXmvFls$}qP=2{np z=HJk#;MWrQFaSVeYV$L1Ns3bGG4`g!6C9*gH?G>iQ*^$COgdb8DtCIv1@Aa1SW;l6 zjTI?In9CB-p6;$Xk!R}dFo6Z$=5o<#ttZ*CY9k>_do+Q8@VkC*_|#Vt+{g22H3z{d z08DlIHD^{@y^(Npc^Gkf==I?i2gFXbZe#qKjyg`~YDu~OMN8d}A^rb=mU^NY>HH@x z^{zJwReZ_|P*g<}xS}rHx4SWIda#X*KO3KXrQ~SGHEA8zY-n4xHVqQ(5FG-pm*MAv?LN3#!U=u|FwkcQc)0Wu@Kst#%7Hf$Pe19(J{VW@pF$iNYaOrjVc^Xjky@c%?w1(~ zQN$WUa)pgV^=x`74@eg0%U54gvEw)f@;Q(JCcFHRk!^_9RmWxkFcAY&mmFU_)%NMq z1p<@Ut3j{!*p5h#f40FeDS8Z8I7eLLSofhghFto&!$#qovO_+pX2R8fNzGe-B}zb1 z&~Ki15?Uz}=E~+MC+m%bNaiK^tw9=?4k#6SW+a3{_ zeDCqY-RWI`v9Y@A6LWNc*UfhBvG4J76|vahWXlF|K7)W5WD^&@^$$Plw>OfH(&ryD zmHFQGf$lP4$aWEG`ecVU7dpn=<`<{ijHbe(k;%m=bi_fgNo=1Y3hpKr|& z{*~?lsmxa8(Sr_eOXN=NTHF-JWSh!PUC0zxu28u(!-){ieh2(Qa<0*4nNY11tG}={ zPaqxMz^U)peoepAo@q+lKtn;71KxW8A;534;(RGx$S z3O~_LO3QVdtQbN5L%KIS8o6=qgU^khm`e7?-0%b*x0j%(Hk_0+-%FzAmF9VWvkLH> zlb^k<8y9gJ%DC`?Lc+R%qv!|}lk|pDI5<4;gq$D0H-%TpTsygg;=c1i{pM3ZS5w6A zVr1>ucp09^BU(>SFETAH01$c+2|ezjWH3<$T-KvRK~%>AADL&^@{Wec!*t!{;$Sgk zTFVV-+5I$(77etc0|qQiphz6x2J8lCAm&cQRwAp{n0J%KYv7H6eg!)$oHPrCoq=mU zrz6uAD)qMLFvtX1_ay=ygmm+7N9fuUt;gfn9oD$F#_KCfMAP`VxYTc#|L*`bMd_Yt z)LJg4+{bJ_uE)q80n@<_BPu-(qd^eC$Jxu#7Qb{^CZnN_Ft&wn1A)VrM;8b*xbzQ( zclVde3?S>G`9z-zM+RNLfj!*=)P#T`8q?h@_Ycqa8f}+jt0djGNR|zWnSp8k1@z3J z5MAfcR_&%JOhNdu5C(UfN+q$_6={Hwt^W08xRQVZGY@pNUTXCMYksF@YrosVc@o+! zxx7OdpbqS^p_WXzN!jl_BO6zmr-t(091?x(1C+=lq_S_^H=_-6wY#^ z#gGJAHXPh72nemUV^lTdjhb3NZBGxiOBxNimQwiYYLHaXpL_z7$kAEb7H}G(>x5_N zbqBLoN@AK7>Bu*eQT||mj$k6X^YZ=;nhYMyxH!fp&q!y6{Kq2n`>6Tm6lG9YlYm5 z77npbJIe%3b3O?HGF>tOr@dIh~{J_{0uG z_rf(4rgfb%f2uT*dZO=mKCFSXu&uBMRskI#8BzSz)UMl1F{bUiCLrPyI2*QD&?;-R zm?LG1Wh>`j;S}&vj}W!LJdC!AWY{PW2-FVefNy^H_zLcdnfsTzx;29@n%pNPs_eSl zCQ~K0FVX=tEw5Kt9}SgyE+ko&29ZmB9@F^->0=azV=sn>Mig;Z`X+rleS^Er)Gz96$*(+k_9ml{$ z?7~TH5YxLxjK9`?#r%K?*HH((%4T^i$tQSnLWk}C9ku-_#&2H`Wy(3i_tE1FU2edy64LznXoem#72ExygB?Pm05oYMxwX z0}G5tQ_-fFNI2dXV21c69z%}v28-F5zLT!^L$m8S3NEhdJsIc-x9oLm@$)DoPa!`V z=BvPJyuPpi%e1BwJ`S5@Xbor)osC&P=cnOKOg9@5Q;ZPm_kl{e1of5Yzmown)+h`| zsJ2r2^xaVBSf%A zatu!nw71G7cr{kb;h@!B1$fH-v8P$%VU;#kZJPm3+qJp&fYMR>EOhy>x5eYOh~Z;* zFuILlJnfW_kzJ_3E_V*_f`Q_w(GjEN(+dfbhpyo4bp;&(hU-l(%mWD-KEkDx{9i!I~Q>P zP<}!{=z)fT(VIx1;#>@69}v;hOy$IumXT?La?htS|Ck3OlLrMXknzTbU%P4FoQ|6V z^5ts^cuKv1f(#D=;hO{BaL1hqOy;H&Eb#dkEt4;I1LyAup)X-?qRXJGa7^8G>!+e% zT}4GkJ__u}I(8Ex1yZmw!(J>jQXwMHJ@fC_-drq4)Gmkf4`qLr`$c&DI>H^?93YaQ zMO7|oU~{a`Y2fjdXt8_}n>Ak=pWulb7#sbn{kqI@c|LFNB8sRf^e92g1)l&Acgkn6 z_M{aRySF&aSnjq<54THOwoV!!q6`X4>YrLnrG^7t4+Ra4WPw~~IuMA=&RexyQ@Ix&4_>~723z# zB3A169#m=W=>FBbb{^0SZc+nb!VrL7Zk|{NPR{{mwwjW>&72l6_1*YW$NoEkKH+#O zzPk7KZ?P|5eh%kDSV0)`tipc-UVr`b+W?LZ0f^&6b-i@qV-TK_K zdV70$$+5`WVkC!O9u95!_XBJTY&k2^FVemj1f3ocy`Yf~s!#WX7|conG_ad}P{0@b&nrdarbX;GZm)il zkE6Fe9Pzs~^Worh+TwlQ49z+&bj+B;6LhHzsQPBMF_eYJy@!fU469y@K07xkBY@ny_?@x46f{54W`{UQk!;)GJ4r7nr%E&Us5xpnhv|h1y0M^z^ zzv)XW^IxVnIy_{C=H^Dvdi-_0{D0qND=9k=u+7&Y|HEvyaCb53__5F949=KvvqzHs z87+@2Yo-aJlWmEm>C+ttDj$)v=Pg`aHH<&kZvQnkDe>S4)1O7b|c=hX}@dzHvB z>W%>5PrAy_{LfqBuP?qW*COez4Wxwt9+bL4{x@v;rG6%@BGyds(Ev(EMVA-YdirxW z&M?*9+O403@9XVM&HAa*PHW6%+H3~}1Hr=0{<_=+D2@D*p+w%$6s2rL%%kY%zrit9 z60r|V3g$f4Er2&FJ{%Id1c*v6&a;tu_lB;q$F}!vz-M(H6g@D>cnZR6%EQNhC~@n= zMF42VBy;_0J8%J}Vb#Ig^g(C0Aobv;eB>Wh8zBk|iS z`>(y72@C5Po}%L=vv!xPq#lXP=9Fz=v>9$6*83~~wuc!JB_gTqdbZOBwp;pfBH(~S zla<)0YQK(sQdtD&_RtqW=e+!U{jJy^)G$eZOplwqFroV;+u3K6j?N^e7^Vr0xwm4# zql?aheuZeZ(e#Bj@g3cRat}O)aUKjr{fRQYjrmeiz#x5-o0qp)K@O}JMpmB|g5lYcq12JQzp^(wQ3s+a%0asT?~`$MAhN1-1BR3S!ToJQXwBD%rF zyIJP{mG7`Ce3a7GHGhr1Uiql#4(0n%@0gB|BQ zkbrlB>7OCV+LIFwkgxF+pqa34InL1YId=>Y=_XoJGJEu?KT@}K6dX{XSer?HLhNz4 znsDszhlPb@y_RIWWv!{X;vxayV@{rz3h63OSO@V2F-O2uwsK3VwsD$~=KhXq1xn9r7Y&W6ijP9Wg2$muR%ox-k|U%E5Eiy?D<8X znfL%F?|cY=yXM5^QJH^T?>A*Y(iW+5qoZkcsnfwFXHl(Ppm_KOG@F<;GcKs$#x#cp|M{-x>$Vu-Q>`%tCVdE(bg3U- z>5u?fMP=9Beat~0z=;kYuz`!iFF8Kpo-$GEEyf#yPRC)~2eXdz25bFEs*O&p$y}!T zjC#=rvUB4di{{hS=$oJ(Oq7`_1bnRrm8)bZo;MJ@s@eW^Q~&e3@HrHeR{3-RwL%@g zLe+ALft?WqFxC+L@FAKL8}Oi?<1ne4gvEu@#TBj<>Vk9u5>PJbz*G;5bXw*JzJ1IR zL-^GV5}j#E$3tRcp`b_w1Ny1}8=0OrV(5_d{x(pIfp`|fjNJNQKN6a|E5bQE&Zl4q zS-tiI+)yI=`j*oH=2M#1oly_D>FdYfui_Q@ptd?MLbnSpT($z)fx|D9ymz4btn88v z|ETM{(So4|D^kN_Hwq2N0)-Un+hmUFfsPBe#q{iGSx(RUTgT?1h*w(m91mW;KzPf4 zaeFRP>j5+%ME~P8L6N=0PyRR&^iF!0N7%5$*FbRcHks><(y|dKUX^8KpMp!-2s{K( zBdCkl36Mlsj+cXuB8AzS@<{pXYla`sDHk6OQ8lHb5bi06%Kn_w?dkZ};WxOO94Jx} z)6ZH4t?nIn!(zeK*DqsrPNmSUyp!)euq5{KF6RpsJLYG^nC>E{QWgw#-0M> zIY_=pA!rFICJ6YesqAcv_%^R^J>Y#WJD3(lGuk7IM8A*pT<^C;0K^jCv;P84&9X)z zBwse}ckOQV^gD28yPH=w`gClT1w55HdvmsV5BFohX4ZZ@3!LaKW|I}v4^=3AN$m$; zW}qC0Md#lSTG(}`UdSxMW$ zc!0t5*>2aJBu2Y*;zp{i%Tl$56(s*JZNWc(Nlffn6x7y!5HjP|^C~VctsciGm#G$YLe3$iPfNz_@tjG|Y*c5_-qXg`AnoNIwewrreD+ORB>|F`? zz;waJgW+*ZSoc9|79O}CV=6kGfSQY=+2llBCdxPC@_iw(VpGpnkoUuA-eD?Ml z9lgyxLbrsso|ZWZX?$5y1{?7}NuKop%*Ca^RjAz!-3ros*D{vJ5fJ^eWbOZ)*+;J&Lt0QK7jkTtW`wSn;A z@H%(?*kAX^lJH-j-oL+k|30k%LF#$)7+jTA`8c!f2&h#QQnlb2EDlSNc7hT>P06dUw3*;Rk_$+! z)%l4J-W;<};hKO{!wJlPhMV18i7{&2ubckCG z(%p_^{y}in|IGyxTpq*+2OYwVw;OpdU}rDffP$5VJU5$1ZA!Xln@o}Y2e_k%fo`|5 zD?214WOP;Rp%(&G4asUT%g3+1+alT+HM0&H%?5E%QQq#?=d1kH-d@gk|Nb2Q?KO5c z3VQ3q=?aEc1)MmW|6J1*xlj6Y=V?sek*7k9I!p^V+u0R`eL=&pZ2@AiY8S5v0mOmM zL-fq7H=FPtdf^uLX62Gf_jrxaYDHjvIYKy`z?sfYI#Cy#n)QrgKRuHoZ4D6-pmvL551WEZK{vFQwn$$eB?nq@QPh?o;LgK^;RtTtG!ltzrAN!qfBS5Xq>& zr&#)E36)uQcgnM&I)TTdL4~+{pO;yrTVX!%s;Q@1@y`qKf8(18?IOz(n# z?tJ4o?-2sF%v`d5v^}U2nl83WC#PUi6n#Av7{WKm05mgxE67)Y{-KS=YAiaYvv)|6 z+^YEy*fk(X2^dSZ2oeAl1idxyWS0)joev0NH~U>qJq=i^MgrG6?0~rv{$HN>|9aE^ z{p$OMg43fl5Y6*j1!d*Gm#%|((?L6G?a}W-7Qn|dpKc~5iRex?a9Bu?B`H)XZR;lW z363msG2YR#u=VKxpiMM z3YpmpYW1DQOW4fn7QUJ=cwZPL-MS1q0$tz}V!|So&MvS)-T}JE?tV3h9ln|aumOY3 zL_df}W( z_A1S*hWz8V#~9j#cLaCWL!S0i!-@Qk&%pY}k1tjA1{cYj%3y&4zhuKXaG@=;Eo)}5 zeg4Lo@ZZnouYZ1b`mc%NYplPl=Ij`eoKXUee=}CKqvKtC@V@{ypXkfBH2?#+^N;lPML1hBCs}C~tBJ zbMsPSQXumJg9GU^wmj?BLG<_Y=g`?nNBw!{^;tn4_Q7kSF}%MSBK}*MF2#xXzniDN z4}1K-Te5yM_?yV{-;P=0{}+DbM_J53!nWUUF^m4-1@KSO{lg0JAIl+Iyi>Wrp*VN-9q%=#9{W8;P~tt(1jM1O>ht57>9vjqQ=FaV+j`=E z{km}&e}9J95bI0nMoJ)uoVtS37Rxd_w^`v(~{91nDVWRjyZjTD$CH1!Lkf$oX zBAJ6ia_Ik6jSY)_&CSmh(1rfpJhkwvaPFz=%SleYETeBooY4Z`_+R9 z=`rau-OlRS#JibG{h7&k&mXYX+wFu$;97OU z&{~YVzD{O8W*L@ead1j=Kr`1y2xbbb`s8t4;j7w2i@JSgXizHbr#m6i8bqesjED|b z(wULjp2}TR^)K4e_guq;zZ_W<*#_!7bpePiLF&EfCJQ0*(T}@Qsb0uOPkZm3(!YG_ z5k;0@-vD8?hmy#vHxZgS7`KtK*|`>2VjN>zC+x_t zG4>6_e?*WOzbo=aMM-Ez;+cU(dkO(wvr0jhG{GrC^uFeIi_Focz9<0~8UeU{zOCsF zwSArmC9^i=A3{Xv;We@mmLq!uIJc1|XEiI+>*TA=pN1W{byk~V`86;qVE=R?r}ISn ztJie4LGt2{N1n%{Wt5cP_X$;GTd}*TmnTQ*mhPH=Y>d7_X(CXTKqys82$@Y1Et)4r zPy7+LC3>CQt2`vfp%Dt-Abp0LM0FgZ0COwT=JtE>bEEq6s<{o8`KN3(P7wZ-tVEc0 zUl8LJ2_Q5%LY1X2{4osa2Nu#|!cv10v8yC%|U@daNoOrDNWkG0W#uGX2Rp z5uT|A=41orBD$w~o)oj`_AfI}iFSn2w&4xcn$&qI~&8b>-BA#pahZ z=nDxUM$mQ;wrUplk6k)^|KvYDV#bE|q!YwU=Ca3GrekC!n>ej+1+j)}qFxkmJ1!32 zS)y6uSHKXt_IkVOwI(NG@Y{8!*)X{%zDI3|PAB(D+wta1Y7-5IGMAGjri$P>SMf(q zF4>t`eO|Ecm^>t!pg;`WrPn*oZ=Jk(X|^bw0FCkUvrYHUF*1`Facn&wW0dx+L?0nF z|EbiqOuTS?q>RUZS5eJlLo}AsF}cPu5wnEEho6E=etfCj<8=5EuVGv*Pl~p;I>u@9 zx=h6sp3(sKCMH9)i+$E+O7J$zsOLse7~UxC4HaOXVPn1@-hved0!y4W0FR0KUIA#| zx5|&HcHs%|6l*e>YeYcn5HT{Mp;#=NRIU@PeRdBkH{a}@DD2t%iC_$j3BlAS z@B(P*hnrj-3m?wgaP00cU0UA;C+`@jv<|5?i33!r?KpJ*R&5ZEig8YNSk^2?HDhz| z%@$tIUY#;>s7F%E}8rfUz+c(D)0I^z!B z&42tO@365hjgx4dx6$$P^WqnFyz1QF$fX(n3rnTXC!0h`2dp{v^okD$4duQg<2!R! zc%p_jd1~a@eV@RhYn?t8B@Ipii=VxEQTl8|^)ci2TZTn)@3-4R4kPUx(dwnV%wl!Af-mP%M_BH#Hx{X11 z*jRP!ql5<-m@e$gXnt6F2r#BA^m}+Z_}wO5T6D<`v(G2YYDSwyrT$)h46{O|LyZ)E z#JMd@7tnH)b(lg{QDdVn-@Wn~n}$U0p|)+7EsijeXgZ2LQCGIjv_#+^Fx~Cc5T{F? zmaOq+f4rFc1(p&WlL>Ep90SETA+NkKhW^5w<3ZwTcu^7$2gQCGcrZc7DKY|uMB3bM z=@+aFx3p>hNVkk}I#gw}wI|8nNBy?TemU^Qnu~XsF6`)8qf||tN(wjjToyCg>fEYy zofWp`?qD_Sn+>q+{1q}M_Ip+?=agk!j);?FAm9BdX$U4F1)@3jm-Rmo4)b)XT3790 zaCMn!og`W%p%1n;aAtnbbnDiuE^WA8m2SQ~->6=Twc8yuN;$8Ag@3b%vF_!Wm4d>f!ij z`-y8@0E%&2TQ*-4|%^zBk8_mSR6NS%jQEyKA zl*;53D1fe#G73esNy08SOJXBz9XtI%6@Kw3+^EUhT4dWdQ_)u+JV)&G7^!u$or5c3 z-JN+X^q;)jG9ZSuI-V$zF^><6*_|}qqoyrg6FaKNeQkZ$n~@x0Z;vvH=ja7QYdMvJ zyqk6BGkC0)1Fm)&i56c{p|xRfTQ}3a)`qV97`{r!w_NgthAE zEYqE&vjrV_IfFFXXC57_2rb%7(Es76DW94$S8_cylIA&gu8nB;rQT3h zQMoP}(`*Y0pj9YY?kV&p-3`&aAsAXf8KQcXv)V_=)bBAr3o5 zLtWDjIsHOlA11AA*TRL=2$vM?orYyKgmZSAm<(=a$WVP$Ye6ZDZ z(R>(V@hxiP z*Evjs+fh;^!}h?EhQE+XcyfIsMbZGEF{+g&Q6+@e{R!GGC_u*l=adRhe{ZIaulMF5 ze0~yQynPizquBMeo48;*73oNrn9Ld3TkBJ~!Ygi^|CS z6Fo1?us@ZTef?&g+WrnWft7)g_^fug z6?iXG%_G{KQLBoAr?J%y=D21l`%DPU|g=r;KTCI^Qa*zPbqRwh2jG-yqiq~#!wnXe(-`=|@ zJU!c7Pj{VD_kFk1w}0L^dW?K$wh7O91-3(^%^(}qEDxg&4sg1U39B+@ zfGb7IkG9@)<=v&2b{X_gpJu1ocedx)&HK#e6-W}p+u8S$ep;HC3eHNQsoz1GL%8of z^ZAsr_9fdOpJ4JK*JVj(ebf1lah2uam8dqB7sYj?flr4;9M0gHb^GMiM=Bj*{5jF{ zHU6`a$X$WkeU@`}gn={TtvX)K|Jd>j8f0>JD(mArj5M{KZ1%-jqD%-fNqS9|ZzEc9 zqet4gb{$)n?KY&QeDYAefGq~H)GgChtB1*Hsq&A@q&saxtR^VhQOq=*`d$d8|lk3Bq`BN-$IV7@0rMxGADp;~6e)N95`?vuio zY7lc`a9XwM!8j$KG*@)bdo4s;9iM*M)OZYe%i$}pPYvx?dZ#u85ddXb`#Dq#`IfV@ z$i$K~VP8V`$X4A^s_*X5*C8mJ4Nw|JbQ8dK0W(l?JhW^v|EIM8JN>#3RLS{-R)7vZ z`&|^SLNgz}6j#tC)eCU8SZHcED$Dj1=329mmmX04|Mg5r!udP1ip59i}fkHH^{S$<|IHOXkN z8;BLqlA@H*xX!tLCC;#1%8TFZKFp?9<#<#jZ1S+xIS5PDm>ZO~V|b1X&@Es8gi;#S z73?!6*Nv~qvW!E_uKjBm0-$Ng#)V47oX3#5n3Jn-Cy;}muU$&y#1N%>?>3%7D|WUV z@S`nLwe#hfnq?F_?)zSNsYUofGQ^jvgxiP9G@`oI(*N@aNWt_Iv|tZKwuW*yEMnjg z!$aIO9y0=h6{YQ{_oqId4J#c%t0O***5=JUO`RS`Jrr z!Q6q(T;`LmxkkXj+8brlk9Kw=f&_L;CPPp<#$>WkJK#8}bodbfr^VyM#808P;GdsWSn zjCCtun}y{=lTAh1K;LTRafVVqs6foW1f({dQ&rnVRkoA64$yk?zB~6>dqC2ob~)b* z10+V%ci#*HerOfqJSb(1)7=q?q3)}*>tHy}`F!zbVaWh4GTTn$u^qn}6TS#wC>2eg zZja-F-mVi+_KP`lM4z3{xkg-0GCmz|Qli!T+KK%@(Lt2a1mip2$5?vD}U7&&p4)=1e7@`_C3N!cGu5#s|Ertt#EnI zz}rxl%T}+kgafRRFhXv9kfx)~<#u7M>DJrnGM6_8hj=p1C(YjsxT`(={X@G{EOhBO zYtE*BzGKea?59jg8EQDk_49mCM4=<#J<@?q`KQ_Ze(k~lG(T;A8MLZ-??=*Yh`=q* zF@26TTa(J%dvFBuYYYa{XIh7xO6t}KW{q~Ht;{l`Qc-znKhU@@osMgdpHkJXS5I4t z7bkOawr+r@G%^?^vj!9iA#|U9nh;7~e>)CLE4@a6f8qp~NR>@1O()_gWHJ2@9g!V; zucs1e2fibQ`fEr@08BnYyW{7`JGh9a(V@&|e8lz|C}JPhcXlAn4Hy+{)H@HFIk|Jhlv=ef!;I}m`zu+oPL_zB3T}{4d^{U{Lkq%3 zuQuu<9KAe`Y(;pG9c$!5`mYR1Rl5bOZWl8yI7UbAG z>y}Qvlmt=S%6Iy4@m}z*rT5~c#WJM97ia5+Hc{JV)B`J6N0bNCDLrn@NKYVh0gP4o zMvXE=m%)e{#IpYhR=VFyLT4(z)OgpdJ>efYibyoU!|d0zTIe3@l|JOdjfT43&<2Z!gr9 z_;%!_Ix9f=2Ibg{{2Yt^1adxrEO~FNT^0m)JtjWVw+0Na`XM|1-G zE9p!hfubn4Y0cc3minPs&qk5Ph|5OtBzRKYPKZvz71yIVb7!fYV2-sXkv! zv5KCF4`zw%4o*nI1m}nQV?ypIG6pNAR z-9a72Z&tsiI!_iE@W0&ol!LFXIV<(6xIlgYR@w{{?2D}y>JIuuwy&8RvFePbaT*g zaacfldQ3GPX{h{K`fR*dgQG_!oE``GU5exZmJ45t$*}%z1}m1`32^5%5&7U;yAmz; zu2fqP9WD9}XZu)eZPk|Qku2Lrsvy;s72D>0G^Qy)`YvI(8SYp34^a@?4?{Czl>S;* z>lHq6(~1%Ter57Ty=v_a8?ODr&(6FA=R@}jTn@zn z8hJ)&Y4AU{xX&OJUqfxeRKH0}_x;r;?0IoAYm=rB zQcw07zem>VuM~7L+VT((>u`o+Ioo9oO%Ia(BztzCAxOgN5rC6g34UTBuP$_6U%V zw@i@-ZY4qtD`kz_0*NUCu&tl3vmYt6nVb3EzhAXWEnh&xwBmr-EGjZHRUqpU92?A_V*(8_wU!B83o?(&Wvgm z5~LfrX0W2+A}VK@=k4LU!;gaf{3P53BVV|j4S6MXhTtxPN>C#Yi6&_h&@7d{hhtTK z)l6U_h-I~!({uxhUs&`FRZ1^l$Z$@)c_OUuuor4%7*#~=evRY7!(95J{(NYM3H*dk z!h81)I;i55gb#OaGqCXQ08OzmBQHlTF}LN7MnntvN6N3QM`UPCpLg$pyxQ%Ec}_2x zaQ^smi6^Q*Kb4kv6UoI(Kw{AFSe}CmdekegO_V;KdHfMs?=K29Cvd;;>bPC{ zpE9-R6x{t3mBlK0VKx024#|Wp#?U57z`5cR0d;p$I*$89h5NNb^6C1!pi|mS+QX}q z$a?8~@=eq*0x7r_hng|SS0HSeo!uy=&ehVMLJmP_`S}NBAG=AS6{jaG;HjtG*2Xd zu-EmROF*!iYzTbTF72x}LRQQ?hcXFFr;mR99dyj6E=lqV!W5a_8jgC^SxV^R_XsxfMd^KOM^7n_$42Vy zXHztt5;i+J|81|xFSS@<3}m~L=NR&7oYc&%uA8`EX{HT`Q@JC#2@3>?$F1g2i4m@o zEl=+CIOS_ZDZv^#INvRK^)DaXAK`^E%2lQjF&+u$60s&2dwLkm4EFH*<9M1`9Jc&u z3|AsyVZ93%dbIR?9KSl2fKMm=CMG>hqoz?wcMBCZ_^;VhT#Dzo?AZ2|jsx!3nvqsF`nJYzH>ZxN2Z;VbmI zNuHylOW8X|$qJ{B#UI{4yoxmIM(7yvQR*WZ7!iQm$g|f!ek5-iLZ@clXD?4S@?Kf% z19?jo(-L42jbx(rqJhf?&+Tl|n8!-hG9a-Lcn$q59bs~2Z+Te>mQ%5!tSlSwIW>qQ z;X7U*9JPJbMp?eRHBp{}_``gr4AXPqPKo_e8d%yj2b~d5nU!@{7i+NUwGXN*muhRF zZ%HdCbOC}|0DzueCR^66;y|A-+ws}Y`cOThv0967q+(Z)ltk2I!u_cnR{dF<7Sx>Q zb#|Lr@+tAcu4$F$xiT?Tqz~zT%X9dFHS;7P9=FT)uHTFFZ)Kk7g3fKG)`HAkVxSP7 zxN~YDkkq3U6wN2Ms|h;cGQey(Uc+kG;~^_Y3Wt4;y-;+9yMn-ZRjbfGMbixtPnAv=svx>6cR)2O0jCU z{(%;)75QFJaj>Cq^c_0vwc>vkV2mriW~Wpf#nHNPj|$HX$zO(( z;c-RcBkN5~HBH2)Uq6?K?)H{zsI`7Cg-h_MBJ2HUekQK<(yg`Xiq^zw^(0-NH4hH5 zu4GL@qt>W$=+vmU3>U7{sPot#THT>-U`lQ>tcc5MK1#{_BCJblm?i(iTZtcAHQM*PU(q7WjU%2Cj>F#qJ z*6se&z;B?!Q(v^kyFSPD$SmclfDWV$_kTK+?!wlo9(2LgVUUy3j%HoUPqAzt`P|2m zDf)zr#N~h-2=TCUN`mfLRF#zvC)2phCn8_)*zrh9Vxd?^c_lpXiq%rMhRs>9h}eM> zI3TlW!D&++ys7*$sqU+)d|OrjjwPb9$}k}6D4WLA_uVT`ji((qj_=-sT$RGd42NhW z0(bx)93KQ|>;*=&Y*!{&kE+w-+lQG_5ibrhaCLq?u=hatxVl*!#-`$=kj{+3Ab)4L z6kDgJ{TOz#X^(OI*bgnj946Ad{S23_*NE+am_sZIN)|(D;&#II4NndJl=Wx&OXeeT z5P#{l7rkB|q)j2cB+o>T=iLyV6dXmHeTq8CzSlsQTw_&BvV8i~DmkKOV5}?;=G7!> zc_xiMRl$#`d8Acmm=Nc!*jOMOlsnA6xWz}*wHMZNcOYvR(K4W(1K+>zg_a!+kO(TR z)8fn7t;{5EHf;jGq3qJ)xZg-{f2HqiBqr2vxc`yLo_1 zDH}cFKN0Adj8PqXx`Ao)Q&*_6@{it4Z{wjR0{9o27o1OQ=W1|%738EO?^I21RU_0* zrGlWiH``j9VD8c(J&)q*uWqfLQxxw9uP2R|l06aqb7Lc=ed2T25$Q8B!>XjhUHm|* z7@2Z`*JX9G@pbE&L_W)CR>^_jH#{LHa~zjj0Dy&i;-aoUY+y*2Nvh+;!uPQ*I>z*H zEc#oP4ZwYed`j*cE+bqD%XVQ26(l?*$J$gnB(b*nV`}BmosAKR+i6*{98?oN8NN5r zal&u7qZuaM80Zod{uRsoLpqf~Aa|QtQ%LETxSs?kdUroyXpF4jByOz($)!LBpx-|D zf&)1R7$iQhf32r?Yt+nEW##)xz0}_Ug(7F443)kKOK%pN|I^O^(8Xc0bRc6e zeHRMf9R%{+OjG0*LKsSQT1YA&5LT-_BCYiCbiszNvn}^wOj`9Xc~7_OqY)ir1KdjB z7o`z1eY{!R6@>6X5C<3?!!_U4Zv?J)MUX~#!yzrzZ>zfW@s6UD zR5v3Q*d*N#CB!|SI99-ld;zhTc9?NHHc90(A$y2VGoP)8?$8JGEQhimfRp&_PE(dP*@%c3wk+x3Z>m>#Zq8n)kRV27s`ab(Ct8<>*K%Ugl^U5nh=CIt0ybEo3Rk!x#$jKDPka zC-OJyaZyD|N}Abau>8JpqMr_dBB~@DFK)S*o^-k6_prj_dSo5%&5b8rw+J}ix8I=Q zv$8EVCLAG6by{QtR|)lxkld0i_0~KF|qsOxIG3VIcQgu z^_*wFJ%NT?w)x!0TGv}rfu_?QaMsD7~2B-bER&cnR-w^ziiz5`mt16xQjdEWxdXV`6MZrQAVA@ zSPX9+k=wWLc^2%&$;Y`h(*h_q=RpX;VTuv|AFdW!Qm|>54Lx}YqE2>U$*U26C+6n+ zTWJS}P1oqn&M`pmD3Wyal|&>d$H@|r+2Hi#wGzS^P5t3S9E{&AI5-Vw>OToDRC=tn zt^6yAv2Z!tp=yYX9QoQ0sfbffvO>P6C-^AS&E#@W*>u>>P#QmLc*VpfJ3MpK-0q2h zyX7Ck(X-#^U`Jy}H?KyB#l-f7*b!QofKh?J^Lg+^@P0W$})zqf;(SvIf2mCjbLPt^Tz+;jGctESss?+WWI ztQ30BOGK7F%}c;3VbO28bVdnnU7zill!Z@{u4)#{unMaWYTR=S-s=Mt3tmIk-VD_? zB{U70F&rl9Q)+XSQ>V3*x1V%tUoXU=l)kbU-AZbef==iMhGSF_=|9%rZzbBD))=KZ zkTp7cS2?)p;Rlc1Fh-r)4){-wp9&;CX^D7a@`mFeJje_5p9aHAoonMXJ_BhD3qGh! zW%03EGUv{~_bSVNTRA!EbKA|OvZ)&?E>r7DuhMh06W z;4`Mg9%DXp;n;j7!xCCVnPjNIyBf>(nc;_04buScI?=Wk)1*qv-7TS|C;qtu zpQ*hCblflVjQ)J(A(~oy*j-K!yNlXa)Gz+V%fun(&bo>qchZS!Iargwr;uUNurCI> zLyO?gJ>XxyZnZ1U_b!yt1Ey)*z|Lt_u35w45U>A^D5TuD$s=Bq_AA#83Gpi_w#Nwz ze0l;lT8xV$j*A@Eo)`Ph!>tMBxI_m8Qlja1j;*e1FVssHQZXVg#jGxxTS%jPYqeEB z{H+V1sE~I%u`^e_YcTRe@$0Bl(-j+5$xzU{=szFq?-!Zq5vEx3T)!xzh6X~{V#fp0 zTv?6}M~fY)*UhIiAa!`I+?0*ZS)bGe>K-$3r+kKg3rHZ=_M|_qpR>vSn6ZoCCNF2B z;0i3EjW8x53w?=AP&qI>R zRoDkrNNQ~Y^*GEBKk*djp)y=(ROED`poI&oEA5#>N4~kkVY|1ju+(_xbZTeV{0F1W zUx$22ZoG)ZrQZPwbj}OcYtP_m1PzL{p5@*)H}S7OCg>%hz_7y$@8yxPH5&<8y+R5o0g`pWQ3Vrc(!~ONGlR z!GjnYhP80mP1D3LF;TwD=rh3}n%qZz_C(4l^RSYjg_Rs1wjy;JG83dFLHy z)14?t+)pt7fOOjk*8TO^j|_eCF*I+%AW11Lf)`A4Sxk=%A3}DgnV5S|Dh#e2&?`13 zvYPhR0g10Nehtwt##=e207*-=_qbgKpsJQS?~QIgNWq07y8yFIw)e zg&&9@_dqn3#ylNdxgMh^;0@Y$ZMYyBh2+>5PL#XjImU`SL<;CjQ42XvRH%ahVGe8a zJr>@0eQGw&m7HY^P}eILvT}KD8JXaXp>p3($=hJE)d7Tz@AG7_XTDBbOnDw{O;yor zUk!Rzy6czJU(wCj4mSA@s71VR&DQUfC6EWW1=Bz1n9op+W~!b>6s7LaRPmee190eh zbQ{&vS4v!yHqZM6mdz7sUzAfDFN8|t?Uf|7j_y~xZJQuYXpgs#9?MERQFGDC(bZK9 zPIQ+YD1;)nO*-QdjcJ(Z#0sh5L|IEu3m%`c|9*LaMd_R0Q=j`FJN6%N{GF5U*+2R%~X5vy~VWzeIB3woBQ!NUVSb zqF;+6OL>*)kx_Af4?{Mej?eu4i(d~F=e|q;^OoHSX%0^1920qf0BL@3_4)vPc#%q! z28^O}jSw#PJ?}$+6T+~1^frLuM+2|AK@AQ<2fFE?)NORMsYApq_d=*(1W+dHEk)ui z0f$7jk*z!Qz^e`!&XF?n@;;GC*$1n?gUj_xI4*--tsKcPis|F{6sxwNs02WD zUM1?7_q1w{BsX5X0(}Iwie}a+P#5OKuRidbmrh0%M)^PyM${3gldUGLe`LvQA3K=P zn$$=|wu%5DJ=qx+Kc~#tKffl&chKLZ=)M7e%R1_#;8Wk#K9x++A`zIcu-CBn?^3^# zWZUd%2Am_y^nw)IE$YXLH8VCLh`BwNamSd7bJZbLAwj#Yz@^y<7!e$Rb^XQp>uo-u zu{#0x*J0o?mAV`==m~hlha+;#n|xTh9Kf;$Fco&n4SJ_DjQUf9-zVslY z@$YIMz&k|@6k)m7eZ`9Pirn|rhAzo7?nZH)p-|fT{;7dAyOjH(6N=gmLLNhwmyY@z zl-tSp_35vMJMlU2r%E-xbBr8KId;x!S#LY<mp01dmJV~GnxWK{` zE4nq(tn^m+2KY`Sn~MA3Q604F)ffPu$_rrQWXt9k`*F@)mgYGMEYiI`RRN5>l_0+~ z9VYWG{||F-9aZJJzkAc6grG==Fp-ijX+csDB&55$yGyzekXAxedeU7=H_{!_-8JFd zxYpilt$p_IjB&wE`2MXAFY7N&0O33WgilItBUi+j#h zv2g+a$#jpmp^sZteDedI#}}SoC0Z7e;@nRvR1U!PWwuI)-WWs2$9HLi(RB?qSd+zs zOJ>X6M@$2$8Se7whE0{doX(V|U5wwajJ@lOd9# z2sZ8fLQi$}rL~7oaR;G5!}_8w7W(sh&@ zZ7B=fp3QhARdAJ<9#9tCY%ya7#le1zB@DzY8{eVMez)<|_q};mAnQh5+`c%&3$cUW zq{jSPyW?J;>PmfnG@oOVHTfFMSEzFk8rPeW6V!aVc2iDH-=W=}Sa5uhg2G9AT(N`w z79*PuU-p}QX|t}H`-NdQSDFalaHUh1e&cB3*`q?!cowT6d!u=uEkUPT^R)*n-+jeP3OkA9Ql8zgpP5n(!#hs8n zWPM_p=a+G{hgQHKG&4rvh8MGuN0}87<1b?!cqETAQ%6hR}uv+NMdaq;ANqEF;P z2Il?`w$=~vLVTp{?US|xq~Y($ZG=zGg4PBY; z?h_A{O0dm7*T8}k5d{6boeXLd+J87;a7cX_KSTy%Hf6Q$F@Ky&qLPQfM&4X(F*ts^ zSxo+N-9sv=eNM&?oPduHH8k!%r@R@b<-`Lp6B@Y?x;aM#BCK(@I}cZuL2UlX*OIqp zaA5Ed$bGGsKvwsk(jTQ)m9}t24O@=C|HB~_JTur)(*xN?Br2I}^B9M7WQgWD%Jy5Lt$MWU11wOTAyQ(% zo?F7Rv`jI^axD;fVX72?wF1fbDxRb&FQL@Pe1HJo?BAS{|FoiAk}pdMFNI()e3>MQ z?G-@lbtMIBC<^_+0=y`zU}`vVe{E+i_Q&EPVQ&>0ArC%Z9=$Ad0e9v9`f)6$U!{%x zwH$t&47z}iQ!s+7)`3|%clU(;w~ryAEJ6h23h1PcuZQO5!x#zv((D;^s+ z2nF{;f!*I$w*UIoL~kwco-nb3it z?bX#4Qg=MPd+xMP{U(_h3*-1HQ78%PfL>Anfn8e+;t*Zo8>I}wG8Q(uaQoW@bft^T zGZsuqG$Apeoi|o!g&ASZndFpEmw-g_KFI!$Q7rpx_Z^3v;vkH9 zag#-KzQbQ9urD3SqvEM;rY#S@Rs>14>O0Ex&Rum`=>9 zziPDE6S)j{?T{xi-F&+oFr|GO=CnxY$h=^yVKFi!0&RpuULr)H%sxOjY!kY0GvxQt zZ*)jLa78tYYV?dfu^CsKuCKUSHhW70UHQvD`}eB{_K>6$?!yP1 zNCBc1%Hjh_+X$q#UUDVjHEd3abgUAUZ-@qG>PSg)zJ0raWy?Gmo3yVwqno$S9(=ea zp%h00FEZzZe-v3<0?nfTxSn)j=wOgg?1jA#a7IK(PH|a8evzbjxESfMKgn>^>-+T-db5S~#XG z-=+zC>;tw7WGGJWUjQ9F1z+E`Jk|t%@HxMHSF+cX*YK^`zO?H!+qvKsNN?aPc=unv z=G`CN5?eZ%kB6xq1^2F+B&s^pK=ONFRu2nYEo^TPj@5mM!Xy1K#f*nnu+2ttMg|46;R<)96+&k^OeXO<%-2j`!FmbHT$2^wDN7^fqtOV{mN7H)OzsH zf10R~1Cn;a0ak!!Z(fc~+}GWnex#+sHttA(aE7k3ZeIq6XZp-&C8sz>(`g*F3bF?69=eJ@Vyis3Fa6Q1@$F-zTTgPo`ML73?t~-4NRQS;RaW<2KN+yW zXc7A57I>RsQkcweuvBWxvGaDtu1oOY?MdjxMd-W!B$ovN(8&8O6xi+GUQ+T0kO$?D z!Z}c(dg{zZEo3nla`t8AblYaSVrp8+1~b-}H`ZQwdp`oz+E|Kw6ff!Gh8HPGWNj*G zD??xwUcsW<0zmZ6RY(3Hj44y76=q;=jb83%$`bVj;#RX((h_^6b^MM77a zZ9MZWR>MXY!UZ|-J`b8)yFoVTfnSBDtR{8mI&nJ}a!;?nTVGrI>d_*|D9j7S9W8XQ z@0!Xpm6Y>5=fBXO12e}iS+*|s){~s*i#$Pcm+7VNjpO#((776d*lpNYTq{tL#<*_O zfqRGF!u5f%PA&Vb3D3+vmKS_cA`D0KAl!ID`1ymT-B}6q)G*0aYX_f9DwdJw+jGzt`UHH+8!tCMA?ujh2JsIv z_uLCZDmxKAsaB-8^mT(+5rb|2(8Xa^3vZjYUxWHXw<%Jbx`#NaFO#HD9`BVT9mBhM zxe9nRfgo<%mdRZVh}I1qNu=zcQ_nlYe%3RKqt6sj3(SbZ@Iqwy{?$B+jc(?XG9xW3 zVxOR~*PH7CTVK}^k6BlFGvHk)?N&N$Ikr&<^kz|vJ?=KSW%6W2FYiSvn6FxprnNU}&aQJACY72;Me%f8e#`8ZIRwjxdDlix9yp(4 zT`x@bGcE!ro%_~AwIlBMoK6yGO)2r~id47ILrP()qRIfAPy#fj3#`&@uDbrNN@6PEiJ_4vSJ z{$Q>gF1Z*(qt2zk&}_5BlgkNINem7ZsdUq(^p z$}%`SQXbx*M^hbjF%8w;iAnabBp?R(X;yOY%1&O~&5ox?7dD?OA>ISGE%osPtKrOb zL$ZMvfj23Zg@n|?%yWJ&DVcf_`_V2j2S4rH3od#7(4ww}VzkcgDDH2|9!s*g`yhcq%B;3v>AXQ% z>cal#4id0|5|vX5GqbkOHR)Muf1Kn6yU#4qWbQOFS2-WaGFnhLywL5x8uLHYbD(Km zef0v299kwChv_5jfz#4tOZf6*1JiuPm^uQc@7-znOe4>aE{f70J&cM_1E3eu*{P#5 z&{dM|_c~7nZe!oP+t+DQw@B%&w9j;n6f`71KM?|R+(hG%Q1s$kL~u~O&s$pD_4HG_ zFm)#Ph+M6GZ8-n*NV9hoN?@=?gk;=g(!kDr0%;j>3f!e)x$-*q_J-(u4EEI4y=2%Q z@T9urnZ0?t>-RuG=Qgn8f%@_5#^v~ByOUZjqHC!6J!n%kI;iT$MDoFv6PO75xObxJ zuAO_-xVQJxcH@l4PxbI$ULlI`IHW^K;wgo1V)N(rWwfLiVD&EwJrj+l_NoI~IAM&* zWt$haT~)w;o}k`gmcibIOWC55@-~N}tdMfjWASQxo~8GQjB0K8Y`G2ib>3ci$#*bL zN?p&-7JAW(H}>3+lmC2y383*u4ykI=uVnqr<7`q>iw8QM?lpT9RLHDepv!njZS9&4 zQ_+0v8MO*DR!1*N30v@It|*`|Q=I2^N$z+qc9z|%vLWZ!HDGqdqkbAq{9Gxf><1jC zcWi;;WTvKpx6i7Ybk@pQ^I2ELko%Z9rb@6wA$3jIl^4&1pt|P&blvoW>*nh^^plHI zo-CWrn~t!kv|nyCbV85r)NH6tZCl>sACu}=K3NBP+H$Oa!!9EasT*Md#^Rjh$G{u) z{>s;tC+laBpMa z($D8;+W&k(w4$5;2GyB?g&OJ;ZtPR~wjdu~;72Gj6QS93mYR5&>DJ(qO%^u;BbS&Tdgm_J_1Jk)Ib7~^Uml^X&Bm8=@kgD1ieuCo@CeLF55oGuq8`bRUd zjz`acxw~Yn`z0GB*~;ys0UgkK(oEgpYRZ4Ae4Clf`()7GvPjk6bGXRgxxUK>wPkNP%3jJt)>~%R+(rGp`zmqI{B8mu*h#^a&wz;1q?o9$XmL|8>&=^& zmiCo`ug6P06izBQJm=@$9iygF0@rNkjXej@WG$HcJgtA3!G$fD(n8&?U5d3J>(5w2 z6n6uYo~eas-w;~PJ?cw&SXzl~b*_jQ3yHbwC1N->??2Z#9zngjAE$c{{acJBtGN0Q zA+kxXnrr{}0vP5|2JSi=sdh=3qLvlx}s)>)#b|3EpJc}) zu#e@|ecjkA((1MsiFL)0r_cQT z8=OT(>0=KC5{>Hh`5H-<{B!4UDqJl1A89XfdZ3R~q`Y;yCnUmmg#K1I{q5n85+H74 zAbMwyX60=h%9%8exPxo!Gi|CIIFN#m={goW( zIfIGO@tcrMfL-1n5$z%dHhBWj7nXRcmR!KGkL*&_(`%#%hIsB?lJykmQBr?Qy@U5g zEI8plQJBO(Tm++U!H*eWRQfiK&j7t=zI-Qd!uP(eA+V0yh&soEz$QkuW+}QOvg}n<8Lq}3dhtRrwNfY z?(GI4y_Sr5XGnx@^C7a}O#Bfk(x3CH7=!awStNYVq93KFVJ@1jfOUimS~=qe+KJUU zzcbU%>7bFbEA#ul`Bz+EKy*}b{bFt5g;y1AslyXOUC>%R zw+_mz)^9@8Vjiu+-CvBK4&2qbV;@yv zZeZx+ojrN;u$-SvrNdznD0KpVowsWhz&lX$;2Z5^Q*ZqJ#ikyu7aLMr`wJ+wp1Bob zT8jx!NO4CkqTnhe3a&l2iX z<-0DDi3BRaPsYY-(sufN>$a#b_nUkU%j^Pl4&!|9X}p^nt3xnMrjkvJ$7Ny5nv}fL zmu@XSxIXeC-~%n6z80oZECt-B7VJeh%dZu>#lw<4ucX=g3erLfxCer4S`Cba34o<1 zWv$S_vBnsM6$nf%J2ZV;FLiXtGzU z^6@}q-!IMqJ<=^LJ=|u>`Q*-`p-V5-zR`x6ga%BbjkK#lI(g7WRr#-zgYA2kGz|;IdXLZegZ&qP?X3 z`vmIWkL9IEhA>z}5Oms|V4Vh3rN~g0nc(|D!llmvTGZ8r~9qWyUou#zXuc+D7WwN@6M!(mGy2oDq&glq=w=a z>l zf)0yw0W@)?`>TmLrlF4)pGbJ)&|%zl5n44qHS<6*Zn{q( zT+N%7i+wHarhRJudV%y11H5T9sC~1ARjQ{lJ~{REOfI-$dJ7MtQW@kWf|H$Uzhin; zMwNZv^>Q}RhR;mVrPyL|!z~xZ={&FD{lja@R$}ASgtHd;D#RI@h~bk2H(5=s{_%wX zXvY1osfHb)qlJS9sV9zS)d+X)Jq;==2LJm_gKjQ+TfLW>85-nzV^aMl;0U|}2)%XH z_2bz~U27=_mWra=NFnbXzt8!CPF%1M-MYxineWJz8to;5!k;r$N1@W~#}{Kx)g0C0{!$3>nE^h=8NCk=32CB(>ejxP z#)xI?I1=a45M3XRyi5tDA`d18kf-KRHlo2CVH9CFGp0EVJFQUEf)wNnEa+#@z$REDru|7~|fSm-T z_0mvxEiA_RqB+F5uUSYOk)Yyxe}!rJ^Mf~VtRU&u8CM>|l(=!a0qm`RC{(BkXVIx? z%b7Kp7qQpx`zc`$)F5Y1^wcBiSC8+*9zh5^zuKOren!)dI$6Gl=|yyjiUmACBk?pn zDRp3kQL`MqKF{Mf$w->X+{|KYM)ODzAKGiW_@+O9JK@r4IRFSpcg2p?_=ozntm^qB z=&}5NZcG2X2(kj4zOy&K4>Al7#lKc~%0-;UcqszK2e#Y5Qie0XlO?c*%q1k;ew%8p z8)!@)8{FL2wfcIrfbHOET~$^Es_7eH@LdBTLXWAh9}RM4pb|J-MNY2{UtIf@bw28t zD7~jvoF3JDJpLe7hHf{6`aX&e+O;l1Piv?So&4}UJ$G-R2tQc(!pC$s&M(|+3nHX=alITmK5^wAnO zBu0_@Xa?1|@zZ3mec&~bCq)Z-dsI{JGS^i?8lMGh!G9o@=d^Vgxe2X|3>Ol|^BEuL zJk3rkI4{*$aZ4zT6f%2nk4L=;?t6ojp&}~yC%EgeBT+XPV7Bq-CREOhG>pniLJ;JJ zk6jCXm`CRUqiXLpHXVVAH~T$9A_)C6G}_cpUZeH8^Xc5}G^KYXzkVON zJs}OIM2WL>Aj4?oE37D_QP(6HAS4*NrTt^q32&LO*><*3fmWET$9S=J1Xim>yHpR- zII$Wt$xDB84*$`4|NaeaMjH`;3%|!l)cw!R_P^Q=C0ysNzoBRU`8n3Ve8>1dA%;=@ zi9Y+=PsaQ0Kdl2_-cw?6`zNGQs(xj~aDl#k^{?+hR5UoOPt!j^NRaK1OBMz5R^uD;2duZ)B_=!m7Ci{nReixOBhMzhuAKh%4AYbUr%aSy7s(tvQ9}Z$BP*D6PEgExC0@3$<_*>3f824smmpZGe(ZKjm{lDs ztmX)3u10~q)Yw)!2w#H(PW-bhr=qP0>=jxd#&x+n z{;47IqVtq|lRy3mJ>;XXSaC&CYh|v{LLDl~lX92%w|8WSKR@Qb0bTcP-`S z3+cP^GL>hP8fSQwA`}Q~q=1T`7&EIyM4U0bV$WJ_=Ja zD+tIc$(=UqRjFx6?DSyicST|J&Xi!Y-_8YJXpEG&N<2+WG4hBBiJ3*-ORND9vVVUl zDTrZn8N`LcfYK(-GfnT8b1wbpt*v?7&0y@=A*@S{Q#m44djOP_U2#c=z z$GiGV{kwRJkJ26Mun+28WPR6J@dCUxeRN$rFU~IUV%F`~-C0{o{QfuAaMq-OqsND0 z-!{+8*-K3%22N-t0jSjw;l%h|{-nvi!%*tYR%JQplw%jVLTdAF$==eot#f@n7|9_QWJWxjrFjB!F!$H3|9&)O>quuPd+2cR{K5vIzi3(gWbVP=E2SAK1~7 z50sZnghQPHYkX@>)l)28Q9ZqfSJO||f7ZD#hIa%9EM+3b{y@{Y-;No6$;+vL#NQf@ybzSM3=dU@yMZS5}o`7rn!>-Hq zv^=c3$%g)t;v2`Hn?zyd>QC{t9%+aL^RSWLc zV9c?T1+3NIiU#N}*>dp0hpKqz3X^gLGq`9FI_|Y{F9>>9R~UO6&F-2iOkJ6tev6EK zzC;DVa6{Sue5cE~<^TT_yX;T(7;c1RGKyHkm9m%i5WvUayOj9^><9lKn5(9C>Z z2@K(+0`#!(3F*2f?R`;52t2r&6V(x;f`*jV9ywJ{b{&oy%CtI_znx&KY7+i)^bHEqZLV@_nOE%eB0T zI6!07n0vCChIq@_$Ux2*&Bv6Sf`F+8J7Fjjjiz&*aby=UQv5?Ss$yqUHjOmv zok9!%I^fGd)cEdO>O~Fa^0Gp&Rnz z$U_AphgdM7hiF~JyUC>YA%>~m4-L6-`@eukOBg>`%${TiQK@(7z7O7lu&=l3Y*teh zV&>-b^vVSxAl69jx8!QbBqzQIMhJ9l;;p%Rco!H)r4XPwnIZ#|NmXi5i7~Kl3MCwx z$QEWgB#K7rkYwq-7RGY~tb(5#a2~n5U|T9?dx12uE!*JQOJ1UBnH_-NH5Uz3D6uE2 zlVB)B3?Q$V-Uk^6lCe|YaB1*yKOdcu`+`Ac;i-!vGQB zG;<#q96E+r2r~i7tX}a9++w6p>)CQZ$ayxQ5l5#nutF-!1^1=iQ(4nfCsQ2Txxwcl zCcz$<9B9?f6QK071d?TRgK={UI-DV)fzM61W6kdXEf0`0fr;?l7%maND+}<9l-Mnc zV~~5()jDqYd&90QKI7T}v!CAKd%Eh|o2wI8>9?1`QAE|aSi$?#y~#whN<`B5%);vG zM5jB`!52qs8oBa+aQ(bP_L^?VX6qaV4ew;0eV_WPrEfLTb_PU-@pM{8^+Mi?NCZ%k z!NrdU$sls~^|W@y58Iv|JJy%=+c3iOD%Z=QsR0D>Hxdr^m1L%jf1Rn|E4DpRDihdtCMMg^5DribQ)u${BRjF$ ze@?RhoYa6uU+kL8};e0uS{oGs&i+C%9E^@1(r+GoZoY( zvzAsyCv-I$2`MORrZAf1!%Nnf+>r)Rz=l)V?0vSZ1VsBdaZE~Rq`+Y5%YiyK`VEhg ze|V#BsZ-5lGgGztaoMZ;nMd`9q)j7;zb%;K`U3MAjaBLvVp4V8HA#XWJB*5`yk1_0 z94BP0ly{IGIaEqFUbq0)W5EvN&a+?WNf7}6e+Wzhl8shHi9hlkWSi<&gJ-xBYiC&S zG8CIQ{i^({F3h5(Vol-6RX+5y$;=pR z#>(qUWPT&Q`tlQ+vdw@zfygZb6ens^qaA1N^Y z6?yfOGg(mhaS09PC9B+>^K;K>+{r)xdg1VHczz_#;~DsdhAx^T#`U&UbC0Nvqzk_m zi??HWMV96&1vlt>QSf0d_Prxt!drYD{-A3LRYPGk?JC`9wy5Bh2lMOhnGS4;;oH}= zjsqj|Rq;iNDOaYSIN4(^6nv138)M@)f&gw-;5WiM+sCE#Q%R$O-mt8I`)Od?;?Hfy z1BBn+rS7E|!x`!c=YX3VA+GLIwrlkjWM(w}eRP2_XNG8BYNq=!t9)XE?}3~I>nqdGJo>6$A( zDdo}RwO1VemDvhXBebf@yNAVD?Mt~2QpguKT!^>vwoEUrt!NxH(9L7Q>nlSp$oJJe z%K1$oG(PUKsYHN-34OkzZ)-b=&AVs%Q;YegW7(WfmFl21Kd)`#%BB1b+q7fDqfjbA z-)uD-0j9#2gL%Rf==hEIfHmEz;id3aqx-jhV0Y)-(w1M7rqmzn8aaDhT^AkLm+%qR zvf7LJD84x-hoR}G1M|sv<*|wBe2gHtGUzZrc6E5}3BZIQuXJKhS*E3{*stQ!3?#yD zUg*CiD0QIvx=R&gTpGJT%NS4hsKnXS+wqkXkQ%lC_a=}gW{k9}C*7-9{7Xajee3K~ zq(fGAO7cnE4PmrE#bYqvmasu8Ofmc;@#4?p4<08EAGd!vC+>bMuHmeteMgg#VbT@L z>Z*^`Kx-vT@Hmv+TIJ}Qtme#-OQ3s&!++WZ|1t=lpQ+iBLnPkShQCF`^H>?4` zX2paDqaDwTZ4a#OUIosj1rfrLP{rf-5i{9#6+|B%#>6MhJPhm!mu$xpg`TSBB6q@? zdbND{;45DZy-0*wt31waNP60ldR{EI$OHI$4C5~$eC|y$odR+ILe8rLF1@=h#{Mon znTX5M7sQ^)q_h3_U1RgQ22(CG4GoEBjj#* z@Q&Y_IrkfRM+jAK@har*D&NC zDI9!%ahY73uG#slhgJ%8Y1@%30;UmjF|~0A3}?&Si2{X`yZjjYzBbS@ymTEwFl=N) zBa|bz8O>+#KN5V$Sc=P^7ZH_emHphvit35qeJ~qde|NM$f0T9N4s|HkmU9fWxyED} zu4|!wQp*cy;}XP~NP5J4YR+|H3_VN7H@@H({t|x? zfwboeSmnPIk{t7`4>zwi9|ILfb<}T6c_CwWW~oOy3L@~=E<}>oKa8G%v#s35zWtsD z%4FglY%tOqG6L%EV~KmtG}p#_#)6a7Q;Dl~Mh$!&JEV~9>Lf(`N_Cj69+ zosk_jvb_hhvX^m_<03uYftV;@eGrn7bTGbE3tX|Co;6L0Mvbm)t;AVtZ!Tq9OOiM- zKLFi3bdD_On1=V)PqE9FK(9@jE^STu2(SK8@jS7{S~#pa|a8BnPO<`8q>5S_7IxWZjjo zq&tlR^4oZPN5Tic(eb(_vs5xm7>=uZNw(3o(B>}edJ1axU9Afc+%n6pU@5r3rG&O$ z7krN;Z_}<|y|baO7hhw4nxg+XwoQYJL>aLBBRgOmT z*DusuhwNRO2-F=7mm-|4&oN00di+4 zFVnkqI9D1NuIvHdjl3FgyE&+W33&7&PhY3x^r#f5`d!?Ays%T%kp=3oTK?iYbLIHO zZrxr%+_hn5whd8a=tCO)p)9dl>uq)&_YG34r`l`BakjfV?2;ixFz>z z08SB&`B(w4XnGTjlAt`pDhmPF7)4a zfn^Jj(LH@1%JudkJk{@D0bzE4i0Xy*dP==Aegoz*Kl+PpzT9j?q$k|`rCBz)&$axx z+ph$bf?-XC0p`YYg(M%~FIF}yikA~4WH;&W<+*i}N*4mje$O5D76VahAA*Lt=29v~go zO;R$`Z5N4GSx2iXS*i{oW+<~0c8`8cn!_pVss-f`=lv>AA3Pc|`(nJCu$%~!6xZq6 zX0TFuQy^dz=T;Mx@ZXW_l3@VJ-o^7wvT|srqpVFgmmGpd`effS>yWBsCRJ2?xfE)p5y8aVv?vr93?O>EhkPPQv&LUDJfinZ@TCi#b*v-xXoNbeDV zDG|XCAO4{zRpw}J$JM@-DDShvs^-&)IchU09-_PqX2BKLT^e~;84pKw8;!kcJU|C; z5)MyvO*t8}axMKpNqd;wGgC7k{!Ns6;o_!kQ3XWB4kl=#RJO_J$Wi3k>m1X}nA%t5 zry)c9_hdb{Nd&dSCf+7v8`c)a#IF{ZnD%s%-56U=7Vb!mtyTP^pJ7<8X;?5xjS@$A z7Qhx+{4y`L7apj5Yo3sjxiKJWd!m%?!nvckysQczSJD$?RBln|b+b7@1y*ZjDJ zme&TK$A0-h8Tj%K7A43H*4@@VsaI^Gy%V`Ooy;5Pa$Sxbce<*V<=udI?k`FZ*pEF> z`lf{L?cg;j`}3<--JqS+oA2PRq*}de>>=4KmBggQ;ky<@Y&~d1`RE=c1H(uf^Z}N{ zEhFVtk8^F|Y#p-qKSv~s zmWWoH;^5&SY>?ZGT+8s0ovx>a7Q9ZatnDk`7%3R0<#Dmc`lb1*!Dyb1r`P*UleZU# z>6>%E&U(+rZBvgFD+b{qdnUsxRlY04n%mu&n`7XhWi=h7fIZ_ug%**-A79X9dg88S zq+V@@7aXl>*etFNac{Yy5sN!!uG)2;eQ`T7Md7*Y^6b0g?8YCn-tHtO&`ev*(aDKV z0EmY4N$(Ckj}{Qv5fyReAvz~%=f$v55A-_!yM}G>raTb_MJ(&Ti`YZRKrfBf1tw^A z*H4H9yo06L_duddBNM(mrp2FiadFRgssUJc#fSaP4IV3+@w)mp?P1+VZpx}CL9qs9 zU2EmPLuJf&kC3#u$xN0rBuP$?(@uD|+};Vz&X_<2+0$9BXVYp|1d4eEj5^q0De+I# zLJbN|WgAaX3j;tL4hY5>a-U3BCnw|=_tywBKMGOX-SD^%oP6S_Zma`&D^@DfQUVk%hF34BbR1 z7$nODX6sc^MwjuE0$W@d6S2FB3phBDoeI`F)iPY-4qpoM20O+9PSJf>rzBjU=y3vv zQT3nVT76FT59I1KhhMr&MoRUouVvOU=bNvaI*}zQ+*q6!B%GkTw z8`sO230sEnAx!wWQg0(e_t?wzun>*} zhoAwJLc6%W`ZqB^6`*Fw1wr>lFJ{@IOV;caGCz1UTHKb3FXppuq*V5F$h3!GBRa+H zsa5JER?|NXd-7aVXdY9>1UL&RHqLG2&v?;{FDl`Ti?FE(xQ<&o36c|_F*WfqdK8w8 z-p~?T+x9&l;xFrkz7|pW;k%p<_0IBuRK0z2+pyslz@k2%NgRen$=0Ht67?|o&=$Xfgz+TI& zYMOH^=-Jg72%k6VNnD?;;|4(LTw%I6!q3iy>JxP?%o%Q{gpM3%2`-rc2sZvAFu$ml zSBIjr9#-cRCG@^ zM~NVIAi{7BNz(HchP^(z1?l650_F%~eD70ex=c1xlV(y+JyOLZP45h~jx0c@Pzo@j zS1Ga_dve=3vcp$C&P%-7q_r{uz6}e;P;eW^tk-7dvYrW{Q_NDE3&JLk3TLiS9jN>1 z(d>Jpj%wBckRCY6$%M7(Na8<6TKSnHi8xzRZ@m<+LM$1I;|L`->4e3oByM^@+7qyj zi$#Mcfbqlr5mG+Kt0~1OgVApZ##h=|SBXc|gxYr_CqN|VP-kznD5?>!BD^}CCNhPr ziS&oQm&$a7Rg60cpzqe~R8GIiH-3%DQoH#r|JcDW?gC&{vOu8v6v}Yp(zV{&mN$YQ z+?@LsqZP9oGwcmQC#39d`c5i*m}Wu9w%hGc44R_HeHf`O?spkZeLndU+rTb?>34zJ zxT-(|`9Y13;&eotV*xQtJ)ko~JU;=UD7;r3RJW3#JW6#Vu0 z&Un~9GK`|dS!aFPp<*Eb@$;`NrY<*jKPFO62qJP-`m^Dhe)S+Ojw06YtaUPryfyVP z#ZiLrstKu0g`0|iw}w8ot1Ka@i!OnOKC^};JX{_7e*IdxuTxa2%!cB*t*n}cS10LIk@*| zj2s9(s9-}}?t;|vekc{95v>Dl8rz&2E!q`k8=28jqK*qmAh5#pPuRYlQ%%Xr_?d_| zDgV=>3o@Yn&?sho)t>r2Hq*3Z^poRv1l_w4EZDK6w>wIezj6>5WMVaOn=`xldO+2H z733+;Ar_lZ`RyanH?o{sGl71XxvOAlm&&XF#@ijM$--#E>pqzHZmjMa$adEA^RGhE zhLY~d{)wmWQhZD*Lu@t}a*?fXxGnx{tNYUYpE2*Fuf1P91 zdrlVy6jX12Sg^m2H1hsrwMx$Y9INl$m8!rBYKw9!Ex+FOe435pSAq-S_g{E5>^UK@ ztEB3V1mL49aZ@}-k$`ZSzfG6DB$_+VyAYx-mXL=yMExPb=X4Q`ac$+xZecy_DAH9j zv4d%!lB!>(-+(w%gEj&p~2Q5{aDo-on=n!QN@y)^A!*>Z>U3 zpS_l8`wSE818Xj+!yoU{X6na>m|s63R4QopA^}F?I{_4b0kEQf2k9ihM&|^1({;IY zd%@ap;Y9%;k*hP?^MN;5(wQKXM1ND636w@BX`}@I)$TLbld&#_X|Y& zqEt+VDWg?xT6#J_fX?f_;D^dV@s(fGzKi;cN^u4Xij+_IiQAK-Lmpf>YC^|;GF%vU z^07}>NV&~?qvuxmfFKN`YTo*WI1H#AqCOns zC7xLr8GGsGF3t|SY;3}A$(>)*-ec9Fo)o@oXf$o)TL_Gv45$$EskEH^S~p$Amo^U z)fw^aGggwlYPg;b9PkmHl_##~xg@VSn{zBsI}7H#zHvqUgcpBIkY=@HqD~i9=`xP9 z8iD9HxwqAr%fxDL4fa)jKC8sFQFYTzOQ=w#-^~@p{pPq6K*W?Sz4W2%Ant+OnPyHA2}3pMIQtIGU@zNbu7reh5uk1WO@Uu!vxRLJZX8~MdrSIH+|9IOce51QLEu>uEQ zZ*uJ`jpN|PSMh1jM0qwEL_4t1tlh7_-_0V!OMMNC?1fxEG z5LWx%Be7)?%*0j1yWYd^hUpj2A!LxLv>FG3*}BXO#x?aP#1D*@;^h1>!J>v7auPc; z#D^)Y?V25l3Wb9UCai~p?+jI9oqlOY(}D%JLbr$6VT|}Hu?c`Qpn|yq=>|K{DaX40 zP_g~V&@rSK3S!2NRtH92_}3>sQ_I3W4(GHOGgXeOhoI?ooUYG*2n=iuSZ;R^86YEK zDRVv0=NDRa%Rg?0uup?jzI&tc{#;R8!(st!pp*-b7P^^GkIOV_k(^`SqIQpbicyUv7`| z**XA!G)0em*I{BVO*EKb8^aFjP*}R`I@l5=;iM}zM>%5*y5dZo|b8PFH$=1eEIT=vRp4w+hJ%0#SJA@NOelq&0k30 zapBq)j>`slLZE9%P2Q$l<>**j=zXW6_}0laSFbR zbaBTo!!9~19&B8+_a_QEeX0i1MNxn{M(gwx|02UwIZH+M#-C9^vwCuc2@lcaXYd8e?V>)D zhL0OIoVSV4h>AU#}nTRXpn-oBXSDb(fRgU%qvQYcEncdB1d&9QLRfQkRb-djb*v2Wd@ zI3YM85ZoaIcN!Rnd(q?A0O&xZdwpqfn6L=;mF-I0Hu0>+ z184#P0(GtS{i=YhX>S|$GqH5bPpuR@M3UMeA0ipHjpr##Ih1@IRQ zEqZ0y*Y)-F+cs@7Oec*sw(LKYM%$$W_T242!5XN`m>f$-)0zoC*_?MZb6{Au3gX@0 z;GZ66uz$axL-7P%F4(Tuc%5T|N^$IP&3wq*uV4Z5>ha5X9d{6|d|HTxMYH(r%cuNA zoqffl-e6(UjQLWsw0__bZFTbcaqxro2B92aF%EPB7r!-c22;b5_tp+F2{?WSNz-cd zg7rAUkXn|^! z{}I(1Y5c#*S~z_)fl`bGdBZsG2Z; zeKZ6t<8lv1#Td2zIY)#%f72W=CJ`ql%gCO z{MklWul%oA4=!nG4r+NBghk3}Va6~6@WGX*`(ZnNYe3Z`_gwxLK*2dNDAiBZaZnZ4 z0>1|BRRv^$`O!mq2wh+SDG5Rk=WMRG`|d1f$Z`@;Ylmhr{y(yn_}(|X**zIMU5_#_ zxKm?pbUOo~wx8WN&4x+4g2JY;_}`GuUml=>o;sT%13J**$aH}FzCT>p6d zM*2C2i;R5X`AMWOb=pI1yG2cSxrc21f<6}L(Bffbwve+z29vQC)1HUH;RIF|yMCA4 zgLpt#^FM8B(mv!BMsA64p?bpSfL=(}O%%v+a(JXCmUV-dR+ zruqV!SwofEM$FK?9be0GowNtqex7{-@H306&xait*8;54x zu$%6VnR1*56PBzWqxAjMdN2~4%HJdYh?Lr5p21<*yKis=SQbRL+(2T$0zgqpQ!XY> zy@F*x8m?b5Ia}I$Jl&$AS<%s4Y|KX6&_I|o;BPaN}X!_NxlA^ zh2Pb?pTFWISE|JI8fm zx0;z*0iN;9N@t8r8^S+8DRgdmLXFF79v)yS>hu%M`Z&&I!Be$&Gp z-rHxV{N8cgRSdi(gh`eqssX0+mTh5(-_D}(^13`nj^uQv)zk{;m}$nICDRT9B#YI} zVmz-&A`W_jsDvfPRF;#Li!qW2Ua#kf0(P`>pYvUbM`2#E>3`;HS&F$O6L?a>$}Z8U zY?pd3H{d_;4nh+wNY2uZgTtvrUHR2tO`gpqLum(DZcN4Lb}1L%)(s$hnv@1prhf7! z_RVrv6P&$HIMy;Bo?x+42Wp`ssLNsgbZtt7p(@T+PZLbb44b<)+O5t-Gh@PZXV) zmv@wq-$^vELyM+EUY87Q;~$xcN01RcX+40j!*c1=b7(fCy#`fuH`pq5j6W95vH*^} zQ^&FbPeNw^&1;_G6PKARB7h zI{{H2R=^ZDh^V9$wsz4yxmvZPvvUoeVju9LO`sJbf5BHXKyJI;$`D&%noOM~8 z8@4phB-vqJqWSLHp7lyeOSj)#5S?61iwg_zxZgRV5%XeAYk3F)>bwr*Ac%K~HVpOKjX;g1#pM0~gW zUIM*Yd3_OVKq=-kZU5S-qBHl==|(EREGU~2lG9B4IbCvgmJQRZat_*Sg71#;H8fB^ zOT7@d6KQs*8Q$)WPP^|v)s?zFW(~)Eq@l}E0ERDe6YHB)F+SNAGFEA|$z!m*+RFrp zQc#71@ATl9!ogqNszLZkDA|C$7Pl~HuD753AI+*1!-%Lq3b{y#WjQu&g|N7&ruYc`kc&@$d?=}nQ69QakKEGl$ z`29GHadD%fXxfd#{t&wI#m}bfe^U8)bPPosA_`>z_mq0I525Y2W(E=Y)$V z-fLFD1qM(eem3+JrkzSEhD#pNI0dv|k$AEUyHPcVPwgN$4!ePgw|na7^Yj`5PWz!JPA6WDFkZKJtGp z2jut!BQzCeOd*HYFSt9?=p8r@3Q8q?KDo>fKrDH}GhRbC3bsDVr(4Hm984i#ajI`?IrPjGbO<}sFYBHgySR(W^isd)^kl zK%b!xIy0uie%Mz7#973``)5r>s!|7TI>Y!^54NA*&ur;anv9^+*NV+g0)8G-WAM?~ z$$(RrsUf~g&W(6p2Rou+lmAMe^cEQz3!tbVc9x2oWp1cI@4z$)X2g~I_!ek$Jj;96 zc+5hr#e-xk<*KY3}Zkr*CBn+c{W$a!E1iSwXJ`W$|UH6U=puodKcbKd% zbmnFqOvQ91_5j21=_Z7X7)OOXvU}%RrLy)d zs3A9pZyyPLI9A_m40vf2^#>LOrZxcNgmf~rPPrIeA7yFXq%GND7NJZ{fg)bBQb`xgM?VKa`pYYmR4vbZ8ZT5`p1Zw)B zH9p512V$EPz;Cf?N&LzC#JPG%_K%2(`XcIx?LwB;i4Z=FfOqpLPccKOO>f=)c^k)$ zHoDw1<~u?!&@W+B;-&HrI*05Lt|=QZ?8ePZ6pyW54CLhOptbVLqkWa*hw zBi(t^lrDD{hPU?y?i>RUdUL}m#UUlD_U#^GmoJG_n`dnMluG6qIm=Z0hhKVJoje~r ziE#{xdakF)a^)d|!`uVw1u5f4HdK_i&Hc~sSL28fKO6z3D(0BUH^De>SL{y22{MK%dD zd62#oo&QpIYdufnSY~LpsurWj=wLAfz%o@$PB)P17QRMfbJDm3g&6N0xw@aX7!m-H zoA+a0fQI27^<|)bRqp|2sTh=Q8rPYZLITM<8g_LLt)!uX2g4 z2+Zno_61o~#s`^s(W4Ag{+XKZAi~*LyCYAnX+rgS!CO zw!E_c_1a8&LL6Vq7hp4HxLhtAXd<)!|E?|n@4B`G+w|4#10p6sv@G!?6ip{sJWcrh z#S*JVdO3LF5atpk>-@&M0+5`xap#Pn{NUIY8wJQ@c|ecgMZUk$fInHTr;D^jiVX35 z{YT)Bzy?EHD%z<74Ym?c2`E5?%?G466ova*WW@9-KJwGHrLGI<;bf_P?C;24|}Zo z${@B-)4bKdPCTJJBRg)MhtrAD3?<@P*v!XPT|OgOt0n{;gF{n})827$V2x@I-FXeY zy3%pvC-&*7%Xk*X+>iaSoos`$ErBZZ;r~+pW(Bvr6+)eSc-Vdkvi{C z3_d>t>`zvA^U}e&xVLM;Eaw>yn8J5hwTp&E7_xu~4Km3Ds_>%#whyw-N(>yp-zi1H zkQx!+{lgF76u$)c!No|g0^h&R7R9#+M{XB^0m`_)LV1<~0siz_cC^Azz&|nrat|>3 z+JW7*U_Hm&GWE>C708|Ij$3Y@Y+3dMD4kp*rNn%2eGyu&?%g*wH`fv$g@RX0(Wh-F zL|@k~IWr{jSe6_|_ty`$(okmwelr4!WsU%`n@z9tSt=d9`ZC~V#!@R(+Ir-y$$I7L z*xZu&^$Ie)$$PyK&8pvnrRjS5tHA@HEKgT_3>SjF3gd@qia1o!-w}zm8 zMix=FC~3(lF84cL+q4pfITjShhKHMdE^_gq(v)z!5BtpOER^*}05Z1%ki9#nbv%kU z=S_K-K3BDkWV{;%JjXNFqYqnwe{tMOG_oT_VFelp%hHrV(2er!n!M8&v@4mYEECt! zhl15DQIOAD%OT4ikAfvFH>Roaz^)F)RIG%Lu!i<0UDTZTPy{l)I+UYNe=MVTc1{9k z26>K)!T;iDjtNWP>kp(~Qrs`ZWWoMX*{Nf#wn6F^^+-zy$U->;igrnrDRy@hB>j>` zuDK|L*&WWiGs4hr$5chBTy33FRIF59;tb1vl=BlLEP)H@t2t=&Gcv<7dJd6-C-$(BO|&!?*9nRI1r=VKceq{>IHj#9tY zOL0SFw-IU-Kb)$x*Cm!H?$=ww&foH*=0jPC1H5aI_;Yq?_UE)(Q`M{eP8={P*-urB z_Lhul^*vD--yE^&s-fJS7IH|4xo}*=Z<{Q=qe9859M`$}TT_FQat<&4rTAdE0~PNz zqHh+P?^o+Vn6F0e^dQDL-1f5Nvy;9UO-9c353~^3+ytp53H^t2&OKKbCLbN(2Ye$1 z_pYRF?eS!gXW2Lx9Yrsq4K;i|6o}|n0Q)7TKCBN)`TH?)h;AmJB$1=+aRBWciyGAJ1C2TpYre0o#l!fcgi!e2}{N+K^^f+MF9|0_u7b@~lR{4hbuA*Oh zq`znwh9MVlL`Td@K{1e)Sn}Qu=dizQnj(p^KN|L}b}u))Mt8Fd<#3pckfYB~3ZI*m zhXYv|e1v}s1uSu9J$8Szu1r>9J>DbpC-n9*GtO%3aR^I3K2B=wWhba*w!Z;DUd$C)JHX)T9Uz`Us&=;E=y-i*gL(Esy3 z=jNqylLsKn{*8uTaot%F$`K7XgpTCFW-w^jN-DOK-@*n&S>{a!sADxL!%lcEsm}U| zhKPSlY{gVqR!^x^i_61qxtXTao}j2Xr++WU09?`pJPbm#KXu`&YR||VG48q-{5uOk zuN~JlsefJ%#WcSF9IpN+c@#Us zdUzp-broh=C*wre$)|}N2FJf({+sGhW@`dN79abNGxpJ3v7M$EZL|N0!zG8P=PFqH zZ^_NSs(XLE?65?YF}B6Ssu{{tKj)^pTYMMj`iSMDL;TbU{a+3j&i|q&2HZoYAmRUT z|Nia!jKjPB>%~*fW&Kadq~HD%YFyG4N=Tb>s`X~>2T2X7eSJ%p85dZ_Av?dZ~%T7Mg z%}YB6fKekD8WyOSL|*9cjNP#=k;e-K=$v?YcM&C*W=b`_ISx z?{{-b9_8&BXXk8vR^I0i8q>N^P|@(99tqhHfo_mYTq2Tdj7x9 zHe<B+5vUo#6RM7eyB&;cTnvZ%Aqif`i|2k|D)Y%5P9` zPaH^|IUL4WIlUo6cnL&d^$xYnY*MT;JL?`)EjDpO>*kM``WWttwJIt#4z3^B(sH%9 z5~yp81&Rh4QpN-W@-{_#8cyIHlSn+pvauqAIwBs=S83+wUj&c~+$aGn7oY5ZM%zD5 zlnm~G`;*46dTtE#apwXcG!7bMo^8_JRn3})v2&Wqw?7?a`N1g3`_Qs~`p~Yfkms%I zp(}MJMP5uz_sbr3rePo7e28x>t(7r;6r;c>0a@0{ChRjeXLy`d0d#kiG%J=B`DG-B z2^}ZbM_J7W;#)4#>1n~BMr|Vfl)FH~+j7+*v4_fg><6gOr{o8_tumUL5()hU$ZOYa z97E54kFvkUGHdaJ(CD$SG?O^rma5IsMWR}P_37Q zBnC{F5#)thaZ=aI8h)AWaFz#xlbcj}V0)Az=evI)CLxIQNy#zk2-7kkD>X=LUblq- z?!F|T@H2d;+OTN*JU&Ha<5Z&5|Guy`dKX$}`J))Q#;c$1Fd7vl=-byyW@DdL7Ymz)VW%`>S>=BN;Zu^^#}j%{Xas z%?DqrG6PGKLVIS6ux{4_G8-0_PG2@TODK`xO)iS!cWCA1XiekDRqLX?{hG$8G0l}s z1xY{Ntt;x@JWXh5AX>`3-52VuD8F8&y1NjR@~zo(&5@2!T=|i_YBJI;gfUL57fefj zKG^*1oVQf(u&TS>YI~yglE;H8($W7CC#R z#g$BP{_rvvJ=7r=H`)!2)SXM9*tsKC{av`MP;iCEDw|@$@Ww}@A-!HO+07lESYFF< z44y1$t!qo){LxSq_CII9U+*%tOv0agVt3&Cu{nOQ9`WTZO2hwpqcVP~7%ypkR#$)BEXy0qY)l5p5`ChitSg5?p?jB2z-&a=!=Va<2GLbM;0$kenOaalQHymFU8q* zS`=BIS6Jb2E##UHML7M`J`5Wf_GXL6Czk>`WZ&`gA<`!bR&7~Ui1Kc|d@gI~>S-Io+zWlddTS&O z)MeOzekJAUj+i+*HPK4oi-f))K1oO`oN%%uKrxJT8oVAIcpEnH2Qb$1uy;Is@=4RD z6h|LkoyJzazuLNn@DI1Vm19WR^L{Skq~?jx8sj60}3_24S~$XeEIov z5|h8z^3g|be(yDwGEkJz(U!L=EV`pK7uXz4I6;(HwRNMa08fVx<#f_^wS*S)@X|p> z_N?j<*`WhkHpMt{&CsFMXrOcwtZ&=narA0KuuAxh^f0IixsmdGRi(^Ejo%jEcG?)t zvhm?rxGO^arM=kEVsS93#3kpU1u_Cc1$Oc+$r7ukF42(Xtn zvj{Ta-hCjzsf#R=yX`ANL^yPNxdfJ^n0Z7h<^Yk^4_!x2kI+pg-=lUotdKh<9h5>W zkFTh&#NpAyS{AE{sjzi~28E7$ZT0sw;P5pQxi0Rc1mm}cio!%5fhe9kbK^mZs4UZp z#~Asz1*|I{g|KC;>tjG6aAUn8Jh8ZxW?O=j!9)Z1QRW0FM((}HZFZ=dpIC3U7q(|z zk0KG9t9U#qyqJ-Ja2^!38;n8Ej!g0ns}}&9$|3Rg{q4PnU-5ENnKKiZ2lrg>D$oz) zG!&!Im>)>DDO+~v1o38T@3zC2EkuHAt$EyHJtIhfHg8h?z&%6T%*8+jXLKh_GTrHF z;%RuT^E+vggw|~*LR>W!aKZl`Z(<)Jd8i{L6sW2Y=x(gK0)ZwL?=CF$6cc0eYWuom z*B@#tChp{v%L~ChES7i%MzfKCiNgA^Pw6cI;p-1qTe^ccNL-nc&85_cUAUfOuaXvOU}4W7sHuo zEcrmrzkbKV)kb%>=o2XCI+>^k{gVC;OW+SLks=EY%n2{oa8Dn( zxt+C-m3&*w;ZVK-3Q-{P8p-3~%b6Dv`l~`FwNcDrzDZ1NGtH~~t)ysfYX-<7Rh0+f zsM<+BAL$^niMG>9Nj(onU#=;k!9}pA*G zwj)#YRkr=e70;dox>};UD4DI$L9*Q@hOLrGxHQ8>u6;kG?ih%O$K53vXXAH6(^T^sp9A>NeFn) z9I*5wNhDmJz8trkh*c>x_EhX_MQ>y8oV4JdKb0@1CfBieZ&d4S_U6Zx>%1pd3Jm+! zu{+fU?PSJ-ODlc8Qlp0GH_s^7>p$M*qIdnYN?ey=iYAXaAj&1*9`ZBr4^d7V5h0J~ zF`n~Pi=QWTNOe0`smRLK$U|Gg=-v}J65(=_H+X3w?pmGNo6U)$kCT79UNR{MpM;Yf z-(lmOGA8{^b1UQ}1K)IRu~bd6-EEQ^#Lkh>p?bePew9&uV6NXGJJhVdVRTW9W$xv0GLT_TGBaZP;>$Im29gK{YR)G5JYRc%hnqJD;nQY{c# z^j^bN1nZdY&yN8ds&W+uxJ|Cl*JSBT{Bb-=+W|{>V)kKo#3R1ql=|;9Yi#5dhi;1B z)J>rF$l=EF|SXocA2>^ zw(NjW)C5}IiN$1x_d0IoGxw*$zK<2fbTk8Jst*#|TEBXX6z8g~cnvKmR z@Dx5BV0is2kcBvJ+#yM}VA&vC?WLt|BjzR$Qe&eqc27fvQnxm*NC$B)VYdMQ+w)3!i#}l0NMUYm4MV6_;M$zegv4# zxcl!--Od!pqiLHMh^6U;uuS}v0(<3E`!XbyU(;>2mYh&(P0Vu9?f1m`_p?FKdL>&Mhtdb99L_}OKzU5VA ziyaaAwl-s44?}q%16=z>0d4L0v*VP0N$6svBbUIwYp{7bVQI;|BcTWE$QW3&B$^g1 zaQBuYH)S z3pZeIzLzMoH`MJP`E*WAmOb1J(#x|%HsY1%0~u3)dRFO~XN#eX^rsVh0vLzpbIkch zGfuC(#Yn^M%)lWYh?@U2rv8-O(nlsWa#XMN2YAcIEPJw!ucQIhPW2pCTj$NIqPFb!S+$tyb&7vG zbP*NAx3_QSZFoNW;^2Et3srWi7%loVWXIf=*SmW`i6(vZs)D|Z`yqdsqlI)kQ6fo* z2*?tGw)pdF@&o+JrkJc`2G7j4_X`^%LGdQg?&(wBI`%%Kmq#D}+YFU|ID<(T97Rwd zjSmKj2Ta({sA>{SN|`XSHjR=;FZP)dT0lo~v+_77Vsx!uV!W79DAd^K6nqz2Ow07A z&nSgki}quYcQ_QB-uirtqUH#4XnnEjP*L(RP~FIG!B%`9E$xm~v)yz^tYdS`9_i6K zz9sbGTt=xapg$cEz}Z$xWOj!Tlam||#75|Xc<8?8nnA1T-E zSG_$6+2(vk3%v~w9K4=N{JtaLJWxHkWm6H~z$6WD1P{KyiB# z8b^4bbU*|Ic=pf1Vb#__AY|d0SqqFt!WL#a{OP=^AUAmp&@OBp&aSXVxe1vGzxA|* zN!UfJvxTxW5#;h(7=ijl-%-U2^X39E4>#oUWr>|SAXMyWxMP4g$GOLS&#tNssnnhb z;hc}^S@!J7RvUa0>fR=|+CZm)Q{N!I0l;>VW7z?tY?xKD^if7u>C>F(K@`;X@$6ue zQv8>-YL#Ra;e;QfUlU2yRhs+$qlEkKH^vTDTow~nbXlMp%U@ZQDdnkD1Yb%l@H@3Q zP*bDyK+A#wriL?0XYZZ2t}WZOT1nofFMIDyT&B`vgp(2YXnWOeiUu-05cpYY{lHww zixT<%H~jcE(<+z)@foRGGE%%49fsu2e3U49iv>J3?-oYgUE+;y12Y}wk6Z5>a<@J9 zUh_`;uy^emKGlq=hsDYjz;JFVB2bL-63Dmrv|`3#yS<|B@E7o8=~lTq$|>V69kI!P z#RdS;(l_-f-9{|iHfA*`KQRM#eD3p`Zi&5Dc87Q0-658yd3EOI48`a@Xg`VpMGQMl zI1;RI3U+e@N-DCk3iDoKPPDWsw-krXN}vR~17Hu2wgt)`zJs7E`HDZMYtl(E^}e|1 zgaG1%aVg$kjN0bT^WuUJNz(NPM;i)9JDH`XQfK{}R7I>r_^Slr71bIRR$ca+PV-Rd6 z>k=yAMDB}wpCO!ii_4d>0^ys*S?uOoAG4Vm-ok&tXzi++M6F`_Cc6icc3;x`S9v7x zo^2_y->M#q_wMtRi;h0wcg1iDr35ot>hJR@2(7LVGBJH>hDmns_=f3Ko{(*A1sZ3S0O816BN{Op7FR- zh1rMDdVuESDfoE(0xS6%gp;8;_?!|x^NU!X2hgR#0D973cL`23fNlZ&R)QGiUt zx77tEBfP{K*y3$4fF!JT1G;gS#7%OuMQR)JXcShh56$_AV;B245IIL%o!WQJdW%|% zJk_V}TtbyaYQMGQ_GWyl@WapV6astL8-i{Kz|yBz3qRiVU8-#&H;3?}8t+;`rf0S} z`|X=s##`p@KVTWvs}H#Gho-;Aeq{#CoCX|}jXNi|1TZHd2WJK|+fMtREAP#)2p*d_ zzN+)jOZ+{xHp$;*6yR*MB=+PAyLggtG^tqkx-#{{ z-=8w4@RC6j+kpH4ZG$_utvk%L4NmH`P8u{%650=K zsFbqkpAVjm7Tr86NrH=i=`i)18%k{Z|MXm;$5|rhhBo4>c37Oq=mry*BD(SBnNcAK zScGUdVMC@j+jBs=2lK^IuwC2sS>hLH`p5#t9|WJZs+YKfVIZoOZFSwlBCd;X|D?bC z^+>_Q{}ZPqUP_WLyNQ_hlA5yt|f9jL8^IyjtcA6;&plN?_~%5SiT*RH?&J0hCeuuVLAi-%&WEuv6_di4B&yx`NQfK_dM(EE*4z({T+MhVuuAXiv6{Rcm zkLl2?`3Z^K;dMrpv8|u4@hlkI)ayj=<=RY9!PHD&gz>(+nH|_c0`)hFb9LEU>k}kxN020Hy<^!0UnxY_o z5Ns;l{j`n^LTtCR`g>#n~rc;G###cLgt4Jle%k-`rXmP5S3KDRQj&l-iTk zu@~?w|L1POm`MM$s2SBBeEw0gZm|4QGXCUcv8mz88hpj+OgWd8QL8C$kpbRK)eo;d z(NYC`qO+_|73~-aCZCu*?+Nw!MOnZ#uTa2Gz7bMe_#`Q(#^Y&$MiWy8K@ZGDcj$pE zsrnL`fy~4KVyk#Y-v=9)rF$B#zFsw?9K>K@#~%06rFRyobDWM!l4Xep<0;Swy-*au zPIrUm=clVD@K};cgp!8BWAL^m-dqBtGb=$nr^Od&ExN3 z)*`lv5mk5iqo)1b(`fniUD8OUw+xzu8R;_dvW(p(rTCv1^I^izxPbP<(=XRkSf8hZ z*3QzfHEpeEZ>rDN>bQj#rkBIl=YOTtdl?X+mOHvpaBp>=-0rz{79;Gbq5h%l^G*Mz z30#98o_b0{fS`;EI4)RVp3ReP7lrOv{tar1NeFG=;z1mQ2#zFDVZ)c{DJW%1rN?uP zmsS*;P|4 z6;;(Z< zRt(mCHCPrV1fjL4)%Dfe)Ei*)C|7QPWQNXv*;i82y*KDc`E9lXpO#7TB7a)iGUZ5_ z&g<)C^@;=C0Sf(Gk_kMYSh+FqC^p2gts3nDJ8?cWmAv=S-P^nxt+vLfxF>bg9Pz~G zkR2`5&>n0Ucug7VyyFb4u2Am&$2(O6t14l=}lalcd`8(#uA1%!8>jQgSxzOJG&98U2o)~MA3_>5P; zBTM<9(dvGG0-d*9?`LThE7fjJdD@xgG#oEMxFvIg_6y@>(FA;Zyoad?hv4BVV5_5+ zGEg%#i4;ljhMy_>&%Ag#G4B3Fcz|3x@8@!>GQARW##v~wx?;$TAV7-HM0zD?LBfdo zsiFld(h+VJ7SoxtFsvcb9c^c)yD;x#H=U2^n(%!=hG>msEtR_N8rNX}J@AoG2{j!z zE1dPa4@cfbmc}l**q4v^?_(8SLT8r3=Y-D_`u4!iNqB2&E6x&+=agpGi%W zs^ObWm2_NEN%G~q%UBQX+@J?EMo1yx_A~m!qSjfBf z;>(cch>HQc{84HS)qGEbg`QG#?i(eecGG7Vu6;{!vx)$i&^JI8wI9u{xG(e>Phi#E z<#B-gma5-ySx9kzL8~!mC|UtPcMj~6xznj{SB0W>|-N@Q^0W%j&!hBS~oYfsT`TWZ;j?ii(Pri@9a9(@&Z@`HcB_ zJ}#I3-RqMFOuPTm%6|hu#54jIb3gmE0(PpxBg*tnYWVx^z*VJ0*rRE`Q*KyN_WX+G zw`1#9ss)d3%rD-SF|zDOUeMGJ;-~$4cS*+?hk_pfbn&Dr?;;$ijs}Re8&Yekj1zBC z7HSeR*+!ln0JzD*WTM&pg8gR-AdwGd`GbEyf<3-RiLi=uGrftBqD~n*Gq@fXUO(dYtGGHgdtT-& z`z#>GX{c46gaygIm%TrkDarm*%OSE(=ff3jpd>&iAT2qFg5|JT?i=4DCy8%^a|rF? zOQXJI(3&Ko!k+tnb+)UJug;uD%0BG!!i&n%lfN;{jqJ4tl_mk`8IQvXmSx!DAlP7JN#?~hDrV|WV8Lj6y$gKv&`0gP}h$;nfs0khbYce(B)EaAuSKr zq1ykXYR6y-`|Y>(*Lk?P<^l#o$Dv?1@#hDJ36O07=^oBsmYd(IU+%J&a++$DFim#o z-6nSuTF@56Bvr08=;2fJP_1Q37rs7doA3hQl6muPfauTlB%f4eJW5<&U;m2VFhuz& zrmljxl7vr(;Q*C9N^}(Sh;`d`aKJ1dGa>eak zahjoUeGn#>Yhy__ZhZtzej%7zKJu{*a^BBO!r%c9l+6<(UuU9r?;>)rU!U-iG8q%@=?tW z;Xdu-&-!gSZi>1&bc6*C-eWk0UrybM@FkqiWTFt>tqI?mHan;$<%zl+4ltcxH1~K& z9Z_6}Exo(VTDh?OVy>R=h2rHt9bdm~TKou~fjv!r=~XfWb>2H0?JeCGq+f2w-xVwy z(-UTIXeAUD38j8ADDsl7B^2`b%hv*8zAn6h@%AoXoSxlC*rsu4yG zzjz}=hG{1{L;Q|1CJ&N(W-p{PO@Fv3gt^ruJc|#|4!C+Gj>;>HbZ>OV3e{NdPC76X zK(@60XawF~@W^Y)mM!go_9>ggk)~V{Cra%iIN5Lm%ZKGv2%w_Bd+r3;TCFu1KiMnn z7|D^H9o}ueTq=YBy&m|$)><)SR$7loB^lNkLcn3Sw85S3v_$|+skhsJia)(_?hg4n z&$25A5J?w7!U+Wlk%_H5hv*17e}uan*CVfY-3O{y8peLwh74oMH>SUhb2-UCW^=#0 z%KRF=X>gCPWf#ezR(=M(2U;LJBuSNK2Fy=7Qc zUHk4WQqqD*cS}n*B3+_L*Fx#;E&%~)SV*Tdf^;{iba!_zO1jyD`}sfnxu5&k@B3|k z*z<#H9TIag*PLUHab4&6I|F$kKDv3mt^haDtH4%*nG?}`cV&^f30V0Ka-rSc-Y3JI z0=KCyyDbF;n4&kf3JL7rwr=vEUUy6WSnOU`j=FjgHaE3)S}n?uS*lThN&4`^MUz#N zm#y*Qb=@X~>SA*c6({F2G(2Vohu!kVl-{*^qs286Pav7DAC%3R4JY8StR3(HAl%l? zwb9=F>#ODB33d0b|H2$+5 z8@26(5BoKeEk@jErVUxAE?#EOw_ib!wucsVNB3zA)J?1vp^H6Gz6^%s?}=>3nOJ+w z*Qez}R6LQIJ^iS(7d*XWBBR^BtMZbyk$aEQz7+t--r_ z6k&3~C{13?bkMS*li@oE&vcJA@`ooIzEY4AE?GBfU{Q>V_8Q72D(EKetM2jW5KLqi zo7}`O-B{bzHr_dEgNxj5&apr)pm`)YLD{J?e1Tjyv9WiEWr#%>zVxytp6`s5vR5{b zYg)XcwP7*X-P$?6MfFi1h;3ufg;eR{AY|bO7<@SPJ$P&rO7>>Ex*J)JxcYhgbH1Dx zI4GZ+Yf0HGL&Lz8~PN+)CPM?P`*DvUV9041fxJULLU z`1IWT7B}2|KQJfQp~b1>ueA2ja@ZCkjoauRSkO>X*)Jz73plQ?OBiPb|5L{SkA{0D zo#@AxKBV^sqdb1vBnJ4JL~F`PU%N@g-E?DUV z>JLz%!wM0;*1}@ZYu^!$W0Q&E4nr2p56T1{I!rg0EJ-;(M|WSj5;;5Og5XJOvE?9j zN&(pM3NvLOGkM}opoj`p8@buRa^kHLuJ!9Je;>0_NoA^($f3z|inD8tAIbLQB;EPG zLnbu|mmLWKDV!#H2Am?|h9|4_SZU6;qezREp+akvgr*XfcQW(oR2u|YoFY;{9F*5e z5?J716J(%or4iPSRm_Yj!(ljmxYemJ{qYB{k{o;FeMac+5`IN-`#CFHSqh0Xkb8W& zIVpetmU|8e-UOorIKX6i3a znKo^%I^BKLIIw63#m&~qg3R7Gi>Obvv7vQ*y(N)pxVe0O?QQu2W&71(sCHEoJ+1vD z)y?U=yJxXEhJxUm7EuWw7gB-BN&R>L*rvcmr6dAZ{OJxKtf<2FnzUv$sj#GNd{XC! z7(9n=V3__>z~q0r-+aBF`6)JJYd8ye!Q)(4$Fuvl=}2~P-1=tn!L2R9_;*!t0H1Oa zm4l5J(hmq7E2K)h3X{1uojK40gw4;{gT_$bywt#YCm1DOC>Yy51d&DnR<&5XlGE0= zpp_pri*4QXsbNXn7F3oS@#_++QsF%$@d%QQrxUYA=ksGh2q}&S3%c;G#q~RksdQjD zi;8;G|MrvX++EF=KDOTN^4wyh`mkQ__%uC@guBIO@^Q>d9Pwnq<#>9yT>0zWy4Au^!_Ii;M#O2$2nDi&uQt^&3Vf`3+mX5ewZEX z9@X-aYzrAh{QJj~1TbY8UDWW;JEc2)3L$>fkIt$-Mf`Oy9J*J@^Kb_ez zmhj2bH^QeXCf0&eTkGn2ZBCPVd7G5hnr8z2c3qqKio|z&!2fks*nQyavWK_fa*gxr zJ|)u#jFHLbL(HW)ImVJKoS&DaeRqeGAS1!pe| zWKuxA_S-OpTZQvlP4%e)RH!$_soUhRN>uI{=GGtij#(aQisKtzr~0VHn|GV%)s7le zljXly*$ADLpDTEQaSN-Mv;8}ITcUGUF+JI>;0Q#|osl4|t}Zct*d+W4jhkYfZBo zrt9`!)5|j&RwmT*iRYy_t?TJlulTgQpZ3j-V=HLjNOM_l`$x-iFdDtAfF>AGTI($) z>)k{djtu%}0xjzW7;_7S|-mW#3fHJ;5D6Wv~ZMwKHKT?_0|cNub-lO zN&c2`6Odj5Nj}BzD~IoK+lrTl8Et)oAvP;{zy^tFam;~HB#W;RHFZM&v7*^=Ar|-k zm{$XaXZrTF&;5;pf1`E56*eS5esfwR| zQ7~sV7prcqc+^g5z8s4(_$Wf$Ka9wk%bm1{KYoHKu%+McXxH~r+Tv*^m;wc9R+zvl@4(94Z8JUS!SYz%%R0K<IX^@0I9;~RiPC-B*2BIU>!CrDuse;mzKbUi7P9v&}Za!M^!FByLIS)Q$_ zNP?nkJ1;f2x7)G%Q8_Sw!R)2Urm=noV*UKCTA0GWM-c?l4f-t`tfsvVCNRKg`4W#+ zCtnQ59|?mIHR|H1w`3@9@LQ6bAsAt`=n@qT`3YI;4_~LUuHuX-yI+|ZllOvbCQFRC z0@cE}=^&_Y<+ana()l#Uy>qm|!B~MIT^%N=02KlH$LVq-0#4(wxKxk*Is(T53gLtD zMQPG;$hp|gAK=fH^7c++rT2ZeUCF(f0}=yVFLUCn!n?|k7!&ObMQQU*50`ud9O9jR zVM}k773tLBEP7q1zBiA#`nsx7s^46&=-@bS-%Rtf_X{?4shxqGaWxlf%ZZV|fkOf>oH=-oFX+(!ari zC8%6M9#v)YT2rMs3PnucLu>T}9}1(@ee+WE(0}IL>+&p5i+&xN3AS>d-fB^;Ugd|e z@ukp&d_}k%h4}6{Irb%sm)dyGjB&^4zf`#xhfzgk1=F_T={hBYGS`?~_h}YT5hmFj z*V{vKJK>c=W9kF!0)Mh3ZdE8@mv>jinN~~06#422Zyf@O?9w|kXh!>dZ6Pa@n2emC z1Y@)&Z+EIDsqY;x6_1rfw?H&{g}qg&n4s&q@as(=b(^I@aYrHZs<@#La~!cqDiw=_ zY{a5hWRWAUyu0v7Q@7q^0TRA`H(2Chmo%5GUy9PUskpxu4xUgyCc9OsWwoY@|Czh6 zrF3x~1In2m2g>CjS&kJA_Kfn^Zpm_Hb-oyR=AzW{HBmcus%Mb#H)1raiW^JkJ^d5f zs&`NzfD$nIN{}`u`s~3wMBitjT&|!Ob4=@R2o+;j?fJ{8;;qpWIwntxA=^x2cz3aq ze)?11qgrA?ph>?ZI>I{gy;k4kt>x`e=V>LP`J6^Zs?r-uNqC~`U646)W=O^taGX9OMip%@oX66Y-A zmyowv-dl&Dxt)$#h5wpa#Mb7KpYW{^p~q&C@Z5X6sjKOJuOv{=3#8t?XGDytgmErdO8y#0liPOnh0jfJqP*nQ zc{y-}i}VNVF5)Loy~|FF8JmodBATBUle}*+tA$NXTX{CI$~5Q^W?O$2)L%r45971P z8tR#SWO1s)GD}*75gI~vR=}}A^2^xg!%qLmf-LPTCfUay*FI2L{0_s>^oAPhZC9!7 z@B*(#l&~SLz4aAF+5|1UnHRJls&U@;kJ=KR#H3&PPZ1dzD|qTY>f;&<_EnlJIxN;Kh1CWF+jr+m_@ zr5_v7=u2@JG+uTj*8)a^ldddSD^en1HNS$_RyHy;%*e=idVhC*N^t4b9n^w^&Zo(l zvbM3Y0sDLP;cmsC z0PRp~l-K!u&74 zc!iImBMWtyFr@PbdJJ)NWZLeNGR@oUZ%vP-b z?>5p%cU-?w_4K+jUgK|h6+{FzH;Pwun3u4$H%jICWTqx{oqjv=d&wy7jV2$&@GY`r z+=4|G7|5|xZvrDMc#>X4L}**!1KT49%~IEFZhBnKQKf)J$tWmO;pt)(SQ^h$S*P>Y z80>wDU%QMFNIW6>cr3O3(p4~buu_@q#{n6B0yY*^%;K0+o^jPUdc|s*xNCc;KxE6N z=qPgen0dq&n+@gBs66dV2tt*NZ78r!168k`TX1=8GC=*q&RLr#}+bR(BZC04Ja#j_IT7+jc#p}HxQkH z-+fcgqSRk<6~+Y2^QZ8%_>(ufy$7UXz<8Ox9kcea?8IJ0uk!uj*6hj09AG63UtGM# zF~lJBPnq4E!RNI}4QG}uqY3Y%gm7^vvR2E5P|5~;_3Bkvn=5tu%U)P#yH*i>q@it<5(u$&-^;L5Jb39;w<_J&AsHNZOw#H~}xV z^U(WIfxI(LI@fFKt6G>&>(_c2jdyv5=TK3E5m;t`jzv%IK?x{l0+^mz5IkvAkR)(Z{ORpP!h zPCA|+CTSI4Fzdj(FqoL-DVbhn(eb?I07gH{OVwwRTSWC#`2L;%~IGo&#Eu^QK_lJ6PrPu;K{s_RvS^TJxi}^;2b?cYH{q_ur@p&C>CQ( zo^+W5R|+LfI(TJ!%PY0MKCDRbb6hBNF} zIUB)pty=Ljn^>8gA?nR3s-6fUko%qZ!v9Ovow6VrbFF0-;4nJr)T5v1CKqMY*SyaP z=Dew8-=9NHVs4kD_Pjy_vcK|VoR=C<0)3WBxmBIcA-Okqxk5v!w%NQEsx`Z^a zAfJk8z#AJ6qy*EadA7fp7wPUhgO#+zO-rN9@MUHWnmN3V(B1C0n$>AwV5N3KiQTvzaA-yxBNR^&rwbuDiFPdF}(<)Nmo9>W7_8K z5-CUa#@!ZlE`Ae7&co$984~CIV(_ygJb`c91VbOX`o@?!`cYi{>5dsiXOX6}Gc+qg zfT%x-d;C)@xerO6QBHrdpgQ~~nrESg%P$l;Hat(tE}NBBgUUofP!a+xTl*|OD{|x& zUH2M?`-y4Z7+q&#!?^d9eao$Y#YDO;<#bwhYPN;V>oZ9X3|Vc{>7Kju)|o1cstAj* z{BM6{DVPpsws2RN|I`we=1j;9>A#)0QCrLxqfgs#X5X*wI?%nRj5p7X9a4A6-P`(L z5}W*|QkJ)Nr<&EJ{tHWLzAxd-cA${Du4HA}h>k&UNm9X}RfFI7GN$2dz{X;`eYoUV zmV)!MNb-eamH7x~0cVlEpsej(O<_c*+Oy<=>JrO9r$LrQm z^Bi-|i*`q?6erWomM7vRi;lRdD-?^#+J+*b#`e6TaoU*9i!3<)%FG{2vnlr27d34= zkI+JA`V=5^LIqR0B}M3yVz=rHu(>xUC#%WJOD^R6%}0dunm8Xuys4^}j@RyJnB-Me zrnSc3y~_5B69a&=vIY=L6P>D7= zt1ql2u3KOb>PA^V+CGqQ+{J0?PhV$zMKUWrw? zH^6Cr04YPC`YFcrXumUU>en|)b%%NzuMaSfxCDnh?J9k%hCL~nlUKgZ&|rM^EYl#4 zH+?l4VVlS%A3as80J%rSp-p_UJ_Bja8L6;Hu3a-wtf0jYt`b=n8aFFwvOrXFugw>> zJRqsV8Nhg4K?aFDj&f_$c2>!CxLYUbiP!DW6vqZ##Z)#@o5F>zub-Gls|_J*nN2qz zj`nyT5pFi?eN7ULMSvOV-2{_GB9Ux+Z?uh?iW(*v3H4(+ZZONw!rW|T(z!2ny25eI z776*UG^5$fwqLTO?s;thnZUodtpm2>$b+a-sx6hleUK_q$`!(ELVq~yiI#OY_2tL% z3K@6uWY4SX!0AJGUB28@;(LC&PuKmn_Vnq`Za$j$2X`x;AON5-2}jze&-TmG z^~%)Mu>X8nz=C?vEU29cOW4f*JZ?bIthKeV;x(3;<3?vYaaovk5>>meS6N^-y2 z8A$B7fuFLjpOWX;!6Z23c&yUHqo)10us726Epanz9z}Eu3UGhFzB6cwx=!cm@-X$m zZFHr=NoE?B&k^Tbx$ujkpqRv5sEK_<2>=id`v&gm%r7|hHF29g%w{N?FHB5WlTY}x z*gc;frEU3tnG=k_-MOs*_!NcNU~Shi12dR_)0Z%>p2XQ@=9;o2R?Fg`$Wy5*RChex_oxnN3G8!_xP7kar%mUk26n5NZqH^_9^x*bLdC_p4Iu8KJg4`tcMZbz zKXDgRCB5E6yJha6R8w>2aCrhqwzsGa8-nt^6zQ;%kwAN%IvdSWQoy1C%f2gT@PX@6}Yz1XMd$7SDyB zS^wGyAG2UDpeg)f9Dj~{s@c@?!~wO{Ia_uE^c?)eoo&0ghsbvrfJ_y>o&oP<}C{iHGgOuIzel!uE@pGs&AL9r$qK7YeS$xd;ak0Bl_6< zZJ;fhh3|Trx#6#ieRasFQCFB+7ut=e^WQ$@Jx7JWY!_5aR~2}aj}9&33*at0@A8#| zea&aA+hW011s&CKBPi&_T2IVNu%&DY&-|>boq?~za+JL2739{SkQMm^tjcIESp%g! ztdeboc`!*S-T!S>PDfCu@h4n+T-Wz6qw-Vcih-MWWOL2CAp`8xV_MJ{CIOzLpsIbW zROyYXbK3rZg%Ea8J|j^Y3h5o<;n$y=o8?<%l-*sd) zyHEBCAm5?iBslf~pdrtP!MW=5WoA5^K7ZgCsI*Ekx{in&(>FcwIe&CSzN6=uhN>ru zAKZ9)=zJB#&m+iT>#@l|7`$WUg6jvoPG>Y$+>>SvM?_a^?iH2<&G5*HY%RA=cPjgR zJ3y2%>?sz(P?u6^z=Z1J?|is#0XcjFttRE$!E^8wlgMi{h_jo?ue2E*SY^t!I8@Nu z=;d4;qwh1R&bqC0ZLFziBsT&>9gTe(jG z#Ar`L>7RyccSZg>T+LL}NY%c1Dxucue_VfU>#R<$HR1Tph=ms^@sGU6RVp*Pu_i{~ zOMlHsq+fjgHruYQM?DK@b9mcJiUJZb*PQfLFaxIqpQD}uS`uuQLj!^s|XfhhI$@~Sr2&3oK7a6ep3R>fq32z z>(fo!vpO3->xXHw3bgZza#aof_^aljYkcAJ;&&K)E;-;$!*?9H?&q4)<&JIb%#yL6XCFIObS=6O0hk z*(i^0ARSpLJL0t7%XbxuVA1Xo8LD9^?*k2=6c;1ej@Y*!y4>RRIOL@ny9pfnxhM6{ zQuv96DBzyn*IkQ(;v+L_J>Tt5eMH3B0oE!IaFE&hZC;E6D)T86q0w>2&;$yb8XkB^ zBzedl+TpeUP-Bota_vmY^~I>|0Ie6{SVs4+L=u}QfiJ&%j7=;0TKsz|Ooyp3^kp|6 z6pzU~R*ns#H&J(D%H0HxgTm*gw@C1CB;ZtE9E>Whh7O8$w)(=S)_o7G%xizkuveCc z*}WRA@G@S{z08;hHL)C^qm}^@apW9OD%s&bfQS0s>uzQ;dn+p26BfxqIDCwn{s+sB zKuLq$qsz*g_ca>R-TtOGDX@? z)T^#+dD#ZY3dFRn*)l7d8SI2}%60fpv4!@n4RrdS$$C78S1bZE_n{|3yR2*=h8b)$!e=w1wex{a-HGvlzSHxN-gyHF3)}0$gv$@XM$8$UnLSK!j+EEM*jg{vG+rO*e#55_#t;Ox5EVdl zis3g+xDDEjSd4ZW*FeC$#{cNhEOj^J^L0B`md0OW3B}Zy*d}jPL0A)5SA|h!Z)MI% zP}-yF-_YJV<`{o}fhu9vNbZ*>;v2>Z89FX!GV3`WflQ6iVbM&3LFP zdv?<_gx3ij9{A)|?}bF64f`&{@3?OD3ReEWyN!;k7QB7-%h;=+lX)A~YkU1vn{NV> zO1AogruB%$mww_LIPryu`_f)Xx!H&$2ZmV%tE`a$adKTWc`D1%Lnl7G{oMIea@-tI zd=9d^eQ&SW(A|CaGZQM+y7Y$>@PBVt>B?3e$@%HehyJWvs4;q1kd!wlKfMV)MH49pPr%c#zSZdrN_kVz}$0_AKIUO1^%{G zwL!P(T&;Rm0{ZTfyi@DO?w;e8wGKP&Ok#+}B6VVVnWMs-C9DP)0;w6iH7;KpoYD52 zI7sU{H@;7+98lA7j+!2%L3JSlklDu9y~=J{Cld7wY@xMthfX5HdeScd?f@7#^?5$- zTt%Xok@G}(IHw_7R(07WP9Xi;$(LYOpTp8&aJZzFyLx)=^c!_ zX^~`$DLkh<2WTm}C=4Jj%lqL!QmL->b3Xt5%w-k4s6$@^6zO?v)>d1%z>g)facz%B zu^vukq8BsV0LNMh*UGjGNrPr&@j@r zu#98YCV?uL=}^$+`yYf_(2hv*$oES8i2le}9WIOBd13?@#5}F4;>GP4ybDWxs?406 zy@c{5AZjdWT_Q~pst?swe5?Z$)wzk90*+hxVnRQ(4+_Oz;*d}q4(ooQw zo$heg?$=xVi8P4l=q+gsQ!P|Wu7(Cbw6Y_G&uYm8L2+l#d*SSUD1w{uV{-R%Epk*y z&FD$}tF6L@`;kpWgI@2d7zP>X<8}0rVDH4u2p3K_5nX{5C1c*<0d@hBEF%tgwkV31AdG`$V%XOz<=FA&3-jS-e5LMRTpf4;rAyEl_c_+H(K z&^mTl$6lmfeT-RaVeHGPRwOyGKRs`#MH{@ulp5ULFi3gGvzI%%{^6!)NH3z#{pmw{ zQPwm{60y4xCtEoQ!B$3q`f|tyCU$#qAZohmXf*LD@7sK#Kave!L42cCA+uz4M6suU|p8#4pw>>LqMM!t4uUKu2 zuE&h?H5+>}n{*u<)%H9S72%#az*y8e_-9v6jRd>HLEOn>L}h5Z!ehrW5^3s|D?TPg z$ekG5^KU!J4kX@*CErL*ucHfh1mv)Wgc^Eq@39LUS5&5l0!Bq{6Dy~WetGEQHf5{A zyMHf0!RwY!5J+TkYj+W7c69iLR3}3hUy5nBIo=NKN4zkT(Z@5M6?p5|ra)?l?69E>0fhI9!h zveHxAPK~=m=#F55N!XJ7q;=i5vfw11iWooN{qTtSoisl`7!Cawr*#JXo`IlPa+b%`x>rfO=rYm1E|Njw(D&8)gprFQV%w^f!) zoon4OFW0_PUTli8{qjRRb`p&g*)heKds+H-EAzHR}ED{?%BSlNCXw-Elbk&u`cXzRR_!}Rx<+eRlMm-?Vd(-gXs&HnyR6H=7 zmri%V@Vc>CTbQq(qZC*dzNEyo$usB`!e<(+LyBygy$Qsi;J6F0Pyg|ziix8J&q(OU z_~ZSQBf-3>_Zo$p?OKqO`Cs!HO_%+PM8T(_08f02!@bL;l{ly3uzw2l9UKP za19`!JxB43ws-@4*U_gX(Om>5<$9~ZZ`_dGl+MHebP5kbJcoFe@F;=4!2}PnR^}|e z%s48Hy&&+sr=v7&{r*)EqkEghj)%M5#Ox`qLtJV;bCaz_%Oq}}adXd5#;3ldji0q* zqK$&>Gv%+d;N@e;()63(K68VeJhpKQ8DU5?I3BY(z@>Y7x9+srzKz{g?@j{PZ%Ngi z^mShtAY4bj;U$c3;?v%Errsj5CR+E%`!^SUmeP5T8wI`A=f#kVUP5u{r`r%e`;L^8 zP5q+jH96*s=y9pLQppa{psf?7{x%tkezV_JnI!fvd4#TBewGr>?DgnB3n}m0MQtN` zrA9ihMx~W6+08>)uu*Y$>NQ(#JXQ)cFbV&2f3Nko!>6U zzv-GdWDgVyirRmCDS4CrLvlwko0XnWgNDz@!)kWs?OEjOcVHwFcD?a3JLkUM*uIi1 zz6KMjIA*m4lfUa|?#>l_E^(N(D~LjQpFi-1Z=fVpBgAz`Z8TBj!3Mi4Iz@9@JW=}M zVvoI*p7vW9E`914AI_4+NSP`o8`z(F+RvG3>*Es7xfv14awqFgOyeq9-X^1#paR^+ zuiEJLPUQC+Xevsxp-b^Y@ij0cmb$@x zVkK0Yxr@8&)=7a&-H|)OG~3HBIWC<{tha>I5*$^GWez1L!rwa*YVsU6@^T#q3GKd3 zli>P1WpnToG~o8Nf!QYd_5c#)H80VB$aZci4q14&uXtK}^4V;_Xu>ERpM0}_bkBf` zN)$`nGL7`2Qd~&yq5)H4BI@Pu(~O^n7?|Y~eWM;>vPV(kTgTdaOIcd|(U*gu*TLBt zp;sGJu6k zHi&P{nVPfFU$=4GDAp>gTQt8u;W`LTf%SVQ?I8^k>?p82letIiOwu2_gKUEm(51P(b3V{8a?3? z;azrw$8Z=SvR8XG1w@Bbu)X<)8e=-m>fJ${Ymkh?5ebrUR=!X(#+GH<#nADAken2k z--f!ViCcH4GUGh~Pf`0$0d`Vub6oE<)4N+kgq!CctaP#w z6;k0)&CzUO79G?32Fb?(hUrZ5kKIHrFAVzgSO2(H4ghza>A4&djtq|Pk-%rA5Eg=* z7B`Sq_?SDy75)i{Ljw|BmqW*qhl94W(T1AEZv~Ay*i!Mr(}g#kf;k?n+hH_3FeWd( z#mVB9`EQ}3?*#{bmjZ$c7 zm;nmAXazPG=bl%90hY4Jk+J#!%&{w@O=?Aac5Lf3OVM#sm^*4nMwnz$XD3$JYK`I- z{q+@;NT$50D;O`0?iv=Knu`t%wH0Ja3H^NHT1k!C&oR5>CBvbUAl1Y&aV45k_R)U1 za%uhjQve4{dfhOoZwTSUd}wLrPSQtz>HO4HeJ)&Plrud^D%7ki!MYUGT!*}j!nPA{ zuoTtXZ!ztR3lWwM;=n=qi78Rpkn}lr@@Y;g>%65rys|U4l7F?Wi3+C`BNpfx zrz!_MA7^`3_eE#nlV7+ktuyFwXs01?Zqk2;6WkeE(fVt5G78h~bKkWz{Tiiptf%dL4n$m|j{Ea- zW0@+)c_{_gCB9AF^-720UHQ_fb@C|q8B3?fKoR_X0U5fkqt~*K#du@;1XZ+dpt&T5 z>SmSmiI;b%vojqj)Xci7Pu^DU8nZpf>G&2AMfUXReD3MquvG8YjQ~8YOL`-3zpzLu{ymhXDE;w5l7pX`kH zzL;*t61{j;VcjKA(s(47;&XR7fIAB+Lw^o@7V|Zg@K|r)4;qgnI1yc!e6Q{H>o((_ zoS6<~h}0jnv>3xh7rlT!m+<6U5wEzR!eHg!oO7_9ubPb2*pCv&Yy(t#yD;p z#jjM)TC+I}V2Wh(nvdldw5h-*OI#jI;-)o+7kjTB$7}mTihi7(#vOGXk542aUWHZJ zw7|W2!PQXY*uyqR79=fPK5v2Ez~N9x;_uAy;o@4)Y{KWmpR0iBK*vB}T;(+4n7LC8 zDNp9w$vn*;+>$q;%TZyhuzo(JR;@jK@PP68lKKJYZZT*#qU+Dk>mGv=&DQaWy;spm zRU_(4E4hI}c^r;i9|0jK#&o5mSxhYD%SXxwmux9-3tHo8+*q}X)7L~7JZeCCP8|`i zdF`tDvGWk{v-2Aa6|v$>DW}1$+W+Z3V&K6l3f^fxiGKU>B9k3SiP0M2-!va+A`QSN zb0r7pIEKIRT1@=t?MP~uYUUab3-|%ba1w{L9;dyMBN_qCwd0Aso^FX9xWJLR_d9Q? zO3Yo1S$2e0eh0SoYx#+ng-pI50dEa0&I zxL7k!hn+>bLzB&%jXyeFPwL_tId$YC^ip!f@VY*=xFGG>#!v0TeWOyfK8E5Ffgf-A zR?M5GbjW~-4qNCC+^-zHK&+8Z`I!lRxqWR=gKrvsJ52nzIB6ti+(RI3zcJLYQ+Ie(#sxEUr$x;HxB1@3cqURy z4}13dzmzBU#h+(``hynyTzkcrof`U<0y`01b*&R>jBU;GBJ6o9K13jUXi ze%Ov9SV5t%*8I|qVa^0Mxucmcd}LhfTk-GWWxzIjq;0X z#cx@RY;4pKI$kt+c~iBl#Y*#JeL~wt66o1Zz3lmGE^9s;;zsXTPL;xeHXxr=7{Rw= z8d_L`_wCjC#OCRwZX_B~I#$V~x+A*JT^$L1x+l(qvn`aZS>xPhq482HZfCfY?5ABP zS>ZLi$$(CZ$3A~j0L=?0w`u9=W`u!k=%=rF3W8f+hi&y_)82d}freAE6QLx>Xl#vd zsUFcxV}hKPpg;^_)6#cc%qEHJvLhth3#SC^X-!DkU6--P(QnM> zXX0ADAgp0{f7#6W5yyZxA!{Ul z06DstWt*vq+~rLWh8QR{>>Xy>P9@q-T7OGa0tYIn6&bgSPAmJE79gG_DiY}0oy?ah1 z_GeH@I32DkF;CoQrDTji@sX@eO) zVhg{S#&?T7W^hVXnKp@!S#!G%8|^!wuqie5C=<=2I$2mhLpQ#M4}zfi9EA2^US-Il zp{~1KO4xbHANKOz4;#o=Q4hYLhiR>l(!62>oZ1=w{sr?IlTR-OM?BGjB4@q>!c%#x zjHa7{$Mkw;Maz&W&A%{)wcf6@S(1)DvjZft2J1g2A0eurO4&}b5KcohA1H=}FDiPe z$sg5B7ias1l%(x_jiV9cTDCb52Q>VCA%}he7^Q9Ld{*FzAq}?n5#p|y>3P&!GNs!y zV}ENJ9@ZDA-qY`E`+^n&R?eP7xM%lSUgQt@R3lYiq+Q)M327BQGdG!eITvr&+QQ<8*QAQ1>2%Xfbm&V3Si z8yBRWyY}%LVLV47gyXlw5f9aIUf#RSSqs9O*K1M8YHMVTbD{AbM-mb_vie=m)o;j~ zFE@z$D=Ed$aa@<}8p=NYMs2*_Z;&K>&B*AK3Pq9d<2FncDZvL1xl!hqz&4;4yoCSK z?Z~i5yG9LO!_d1sg9?u9eXc?qxJn-~jk=D?$uuE5_BaGoom8{&w+y5=%J0O}$wNw7 z?xZ*eWex+-0|L%kUeX-*&N#ui9vSu}lw;YxNfuDelRf-BSLXo0T2Bf_e`xRZ>GsC4 zFaeg8AtB1ngGja1^U_{7ek>Rrhla|RS4rfLVenGCit;(m5QoQ^rEt13@9T-vUolEc zKvB~rjYI*!9uXE zz))D8=;YGjTrrd?Bw!D@QV;@yHZH81hQ|%jM zNLXw1{RG>D-{imqTWZLZS~BCuv+kNj*(W!vthew)skb?I?-Z&PFAb9H7Ay|A_RXaw zyuBTQof}wY1*8F}Ir`;=E(p_*a9yMRlAWuv7}z8AF4tQsD+VIHmF&?&64aolZJ5TX z;BP4BBNakr&D+J#Ck@}o_)(gQ2~6_-y>0oZXTR~ltrWzLj`LbRL*fENS>Lh)eZ2FT zc=mfulmtrOT0)N8mVgw^gO`Un(2#vX4*0(Nl(o9x{>$9HCJ-T&Nz=zTf1{UFYS zqwJY6i$h~d&^@ZZFq!kIHthd{$vmy*2b_1IZ^L@BtTpQJsyA;YVo_hh!XiA1O;Z8U zB#=p?Khd;Sr+#2bbbq8~I9(5nYtgSz>RPw{1<8E-CEFV3uln)7Aej-yt04A8)0M~x z6u2Ka8?GG=L5jLuK$8$Y6?C;GAF!B7*HIakhuAizD(>PW+%S_h46D)XWiQ) zV}QDkVrV!tY*5E6pe`uP+)FYtN^L%qHXBkhJc2pbQ999WR|>JX$4w~}GytwDm2E9T z_Al(j6Y~InNVPQUnfydNAYe!x(m15uCVm;XCi|vj%`nVE%aXKT_&lJbSJs_U^NcAL za2|4h2z`&ve{KYboHMP`0{aIZw1Ab7zxn-30kYEQZS=!5dq%~`^w)NnQvVmkML3f- zpRVV$)%1I803h-R68K(O85H(sCTP*#beP?bpC!tP(9iHF%>Erd%-G-J&1xRz^TcUU z__=1*J^bLD683y8?l(gz0?yB94j)*O(eJ;0=(@aeAM-foQ@OSx0HJhp(bt0u*6^p^ zwuUREIOn|Js!}Gk`-PpaT8O7stP_0Dd^_+Lbct%_y364Ypy|VvMctyG>v;Pwg#$Nm z0<8Woqt)q63z-JIHZiBPgnl3<@hjbrazcHOAtGxVnT;Y}T~nJVDgtx3h-`ehXYy;b z9*g6RR}Us?%wRxufobp=(Pei^-T}E|9K!2|!~3T|n;NnPil7U0$b6g%pB z-_2H^J}a4`B!55NfpL?TbK?eKz@TSf1A{!&lJZ&5HvI9h8Tms>9pUhzhy+NiqX3dc zP!+K?nizu{X3rcI6}!lbPvK`O{w09M0}J@j6qQi=5OfEe>v-*1XEbSiEflBab!Sr%Wo%D$6ao2Q^_3x zpD9hrHa5Y2OSYS~*e6~d>BbIrmmH2BLvvMdxOp1OQN9p{^qUu+gF+8-r z4Z@{r10!cdgs1tOynomFpVh5kV|aczL>sQI(>Lq%#JTwhQgnu-C#jEM$pb3jV=a$k z*7WnaStZ{Z`Ud}3oa7hNk`1#d>^pH*e>9ZO^jM29f5nv>!A-vB4MjCCT7gN?kMrJ-xi6L~7x4mPaCBqDBUZZ4stf)o*0Sdu~qOk9nS} z{R6W3x5K$*n`QwKRBl0Op{7~RUnVWrzV4DN_FO(0APR3KkNG>H@!z_Pf4yEoDzyIz zg#6oaI)9yYdtk=>AGaCm|KH>~^iO{uU;q9a{;!4Q{lB!!4fDDD5AB5Xe?KuG46w>< zc7TxjfB$D@6AI^l6Bz&YsSlHd|C4|DpU)124*nA;`qv=#*FTlg1|S9U|6|)5Cin+C z^*=u-;lcF}BIMtG2{;}&_P>4af4%*Ge3yF}pF1N>e@p;!Ct`2<-roWjhl^MKPakC_ z7e|tde@pKx<^dNmyUvMgQ~ae|8u5Pxc_F1p=5ZgJ;HGC(O(+DH#A0^DF8b|H zE8r7q+~GTbuzv-Hx6}Baqpn>2=ZRT6oUrs851K<7o5uI*Eignpg>0EE)16G zYv)CqG%ygu^)4ZP5Q9{@BPC5f5wLh+aXKO7X*c=uiFuuT{pSs7 zamiV@T-(snnevurZlh^%b%L4oXvd+UtbjdmCeeGW=j5AS967%?7N*s^XDk-RnNmX* zCD~tpEE7y@1V!V+PmJw^boC7`$^A+#_|G4s^6sBGqlP4|;|*I2Rrm|3b*P0$?MVRY z3;v*81$JwMCTo)UTpkWDGLr%*5582HtpOaK4fC&DTlC@DfG@HCi?#ENhx=>Sy+lGJ z5kW-ssEKINI}t?mh)$5`UGzFeNR(*N%jh+FCwfGpx6uY;h+anThT$y#XP>>#dG_a= zH|KaIFJ#R4t+noT-Pe76U;J)*#c`)4X*&~B#wFtXUvtZ9vhtm>|Mj9*-+9+~xIqYg zi3zK4-TsE&1<}EGqX}4gx24L=$9iwHzW&xbPx$50S?8-Ty&u=0wohLOnXl~`8qhA2 z?Ia$5p;3{oHdnOhZjNl+_3dgfr>+bN3v4`^(I@)PSE*h|ycYOhyAb&9$V=aguua#( zFv5I{x7<>lzQyQ=A@9%Ee?v|E3SeuU7vV*jUPEYhHQTZA=jJ5?($fl$%>yle-A&&8 zGjL8)!Txz^?C##W9){F9yalD(U<~A|fP7cF6@%Msw{3c@frar?mns)M@zlD~1n;Rg zmh@A$1AKRArS7rFA%tdDeeHtQmGpjO#{YzV%MaFFuH8!e*t*Xt`|D-ad*1n8U#XLz z{0}8b+e+pCg%jLzP~-Z~_XWNAZ%=tvb28cYh>tLn3IVRdZT+#npMUU87b;9_{toz# zebnh?Kd@5Emf7hIJbxN*`*d_SaP0a-nN%&!^M#74Kd;9hbzd+9nEJxoC?W+mLp)yD z8Mx)wLjcwCHZ;9A%5#!@hi`2eyq`Z8=VasKnjixs@MPEsa4KU!;3c37^#|wd5d1OMW?E*?(|lEOHYrK5wl+} zw8d*^M*Uyob!#o~iNM-}Z!Pr{h8MH7$PT35iE^Bw^6T7In)H^}GA@V&zA0g587RlU z9iebTj<;noGeW3*mFt~bHf`G~6Qpme`A6_vf{o#rm$qG@41e9$?uRg!dl+QmwT<@f zX4@=Ko1Tg9{K&Y*WgefUUDuTCDnAqXI-9m(CN(a25wM(Lw;)d06kL8q=IS1L8vPB& zZZiT{zI{cPEqB0o^>5U}^*|oE=WQi^CX@DAGXhoX-E85krV-<+fC}T z+a=(mEd0c_>v307IWgnYOHt#aKHZ51S2ob33!C*l>u0SwL?ehCTCoD4N2mBt7Za43 zSRl%=ODAP!M~uvL|0@W3A+`6ml4itzdjv!ILHtVHo#UgT(l*v5D=pNo zw*GgwJj8B!i0^n$i|9NoH-*qM?B1xvr9H6JqH*QLJ{p2YYO5ARsN#+NhGI0O18gJh z5&rrUyGUQ!+GG`UN_&G2h!w!&~( zT|O^ub=tudyqZo5d3AS`_J{;4|R?i;*E{tnBm8K!;4esdadR|Ha+wTkNc`9uO zYa=dVS53&FuD*r+)0F6D_5a^fh_2Uzkt;U^u$Nkv z&F!`W=hY9AhsFH+bGMg&BA0JjFl>gOr>X`vs#%y{pK5=O^KbjFwU)UZ#4fQJi_FL8 zcW*~K#odaH+SOtI^u^}(H>$5~Xvevxt!wW*-{4J+9cIY83aYH#|IPLU@w|7c_b2R= zhnB%g|3Hk=^QV2TGi1F0ks<8P`Pt!eBsDr3#78os8$!BTJn;Z#1B^RfC6@R06tU@C zQ84LOj_SMWO|JQOqCz*2EA(d#>2sy1Vco0;k#tGqO(p1C)Q+hSnd_bege9-3?-=<~!p0k}>DHmcbCpsIFXE=&Qeo`FZi#A+4A#q1uqS++UC zm%nt63f80Y@9Uga~DRIt!L%j>`vRn!!XSNt zpuH_pQYq$&T(x0%82uy#Jk`O$&z5syR9=QY?2m%MLMu!jN9M-uogt9@C09I1EG9)z!+G!Qlona{@0Y%|Mqa|5j4xger74dZ{PfB+c*0v za>LwHS6YhcZu%4D*f4l;U}xH3-)aPzNG^E2HJK~;l8hxAfJA*%C<@H~VDST8Ck>2? z4BKgLUCoXBAUHu?X{=B!1DOvFH9-KaE%GM=tTeVU~{KdoMd-te63{oe~Q_4#-!txMJ`D&Sc|IO8LaOT7$$O;0hX)WE!*tOdn4D zM9w{`lDJdxWnrUF96V0n4V%4yJ>K_cUlK33Y1jR`)I#@Xef9~>2h+mqomY&9bL4+) z)*|^BgC6;`y$_@0SI8fP2@#jil7dm z;5A=u>b8^E@8h+EXMGuX(smzobl_4QAPB`=DNRgwg^u5g@1D?KoK#gl%Qtk#GtNXE z;b+8E=Kaqq23FGPlHDY~upj@GCNe%h*_G{N>FvdEHLNmNlo~H>o`J^C*SZ<6J3-WM zdG>Yo9t9H7MPLp$gNAZS&4ejte6X${%n8h!a`HAeiNuOvK-<(cZ6(cn0Cc3!PC<4* z`oMk0vy+tr3=0IA{Q68FyCNC4u@4ga{6Nw>de6ycp)-606Nj04m~;UWPHmcdow^%5 z=l+oQh~pPvj>I1%B_)A~CaENogr%i-EC`M>mX*IC%Y780@(gAFyZl4D>jhiskLwcY zs)JurNLdxN@d1S{-RCV*-$`FRUu8_d2t)nEz-3p~OGTk>t&EV*ggS5e?BsWq$INm2tJtSZAc zq=EY~^tg9aI&U&Qf9(QaW1F4MA`OJKnUuKDR0eGejcPZK)-;+3bJPlk@ve($i z;MsCSO~+e}KTe`U;W_f89KC~sa!;vW0RqENy|V=>au~!`hJXT7eTCRC65p^4dtd7x z9)ak#@n5U_Ona19@E>F5anFelK?}fTKD4Axo zo2QdmirAs~&}|YTcu0Tk31A{1aMFrO8x-(o$OV3WkT zP&u2MPyR6P^7uCx(s}N_B}S9*Gims2Dqoe3&wl!KCsmS3lwZCE@Rmhx?T?q}^W!kB zVbG-r=VvQYl~ZdH$zBBp`S(<4gn(SV4Gq2Ss<7`hErR__s`BFT{UMWhk^X^!SF_S* z^Se)I5h7fXN`O5O!@0lkgD&+gEJai}$cfXe)eObsp(JWKUQCfJ$aVI@wD8UMp;A@# zI+6z*D=*_!$DM^p+?K16Bc!SlpG+czU)3?MyjYGii59pVk|vtFqIfLV280{>E|I-+ z-*ok&osTyw8=(&JiI}RML?p%hvzDC zGN2uo;~ZVAC=pPGRWsNBaCX9+?Equ^=6L}VG3eq?TTLl*nI5UsP6}(5Z&7ixVB7t& z@O9ljhzCD^&Tfn8&1nS z8wy|h)jg7%uuW_<+RYrwgWp=z#<4W!`70J5V?YE_UOt}k^!eB~2EgKY=k_dqAus3# zQkd({b!AhFf0Kv7oehX9WJ%wg4EzCL#?NIdr@(3dE|;es_~HF`j)|_DOY-1}Mf9QIz?7J`*$h#Nbmng=A%Xm$U>JDR{`JxqND_0bIF~@ZCvUzQXZq(NB1=8Atxr? zGAjn$|H{4d2Q=L#j?IkNoW%gf5JJV!s_(YaJgZC>XGEYE0fLy;aPdGIV>?lF_^V!q z)AEayJfa64`ees}YdwV}M6OJL+2*pGZ{BhpfV*e>+*kPgitKGN-jf1yVl}&b0xCaJ zg71Fnp>9Y+b#3X(^T^$!qlUDsv$wR9oq!JeAic<@gYo0|I=EQnwkh zTCWj27Fx{+;2-(J-AP>{MGX!#TJ!$2k`WBuB;86Xlvb-)=M(TQD&-$JOu%c3F2V}AZ1NPEQg?6HAGU8#X1Fh`oev;GWB|CzS0Ge>>1 zx@_1}sJ21e1DDc2ze7m*pUU#I^I1>a2cy8hz~%F6skuP``dzbEI3B}0uQfB~>ryI` zn|uZ;d5U=7u*b7T38H&lzK;Za9%+^6E%jO93s3u=*_k8ldbhmm?0=lhhgN)?dr27m z2%P+Ce!mlpe7{IQ?v3>^0!s*jr`wjHxBDaf3;DVWMM6gW@Q5n!nNFIpv$;*VQi)zo zpG542r&lZI*_wp@@+>DvSP+T3%d$C?$>`tq_zKMeCY>!OK~`m`)XLrAea}S66eR9jCVk6D_zM^8B_fe|(j3?nL^Onjd(y4?gQ(|E z9uF?kR^niXa+Q?c$U`~cqUdTa%T62ILAWEOI0){fnd7e>77kAnP5}r=jrsG4{>vHG z5cvdH5PI(fp*ZK{pI&B5D?9?moD@uDx}Ohh%0)R#d*iu%fMdS z_}_XBn`6`Z@m9<6H>ud0cy8)6)|f_y{6D8DG8y#^z;V8n6!D=I!7TM-Faz*MTwROa zradbwNb;>!S!z|wkfTE*qvDOvukjv2KAO(Blifb}h?tZ!QpfdCAo>^m*$-9K8q7gm zbd58bf@M-YAJ7dz6r;@fV1fCGGOjh#)fE5dMn?-?L-O%L;c|f~B9bSb|Dp#epQZt;oH5caUTZ* zb%ipJh$?SVYLOn=eQST(dGN!zhiFy2X`RP@e_gp(Kcz>rMDhACVqpm8R z+eThsnhLDb_iJq@{qYFbZQ>Ji9&+fvtW04yYdmaaOE;o$&6Y z`z)jv<`)j6WK~|nRe^iT zf$Isnw6XTPcrfU%8*dOvT6;%r@T^r{ba{H6mALOrEJTuxg*VLr#?uJ~R_5v*ZTFg| zD3%3{o~+7`=yhZc`1JY4_t7G4)lQ4P#DYy;dH;y51~ez(>%!YBDbDwj1?&nxNe$0L z+ZlHKu$8->!4xpy7o$4vWOW%$Yz3^S%**6-O_$f~n|5FQ(@VvYP1opIF6$8d2o zC`PBix_+$OPus~FSlB)tJov<3lgxRy`H6i2r=?0uVfa*F*Hm0E57<3ZdKm_rL0j&_*Done6GUC)>%LrGK1{ za0o3l_j~*e5@VmD{)Ob#olT}l+&muF?OSudXD}6O86QGJ z5`r;Xq5*gdLO;|6x*U&p&f?QlseV0xy zWeKySyJIj5Ms^j!tCq0dltwxtN>S!#RQ%Sa;bd#m^;HCp)Z%VR4>|STUsq~CO&KcS zvM;e|JeP{7u|bW=H@G$`fYA*5>ujx;7eN#&4hw;VEI2uFI@Px$B})={FFJR}zm*AB ztt5Vn4s`Wzu0?91l)lNc)%T?ck5HoXke=%~ja5ss!eZLO(V1ne;V4Oxb&W`)V16j-(T!q zyOlR;&Z^`f1|}fyupNWXwVW{(W2CfhzY(0b8)!O!sQ+rk9ZeJ zl`Nw-NAAx5sPTdrRd_3g1vAa6cWidHDNrm;dbOwPdvZo3jsSPqjqNnX>z^XKSp5sin&FGKz+>=T^rUYgJ0!d*63{9 z9i2OT`4Hp^KOpTHqMC08bi_SyJ?QPPGt~&*)oSq(-Y=^SbzdTf;uF#Gp-JiJo`AHC znvRDlWMHR&e4is8bmMoJnLaq2sBunU*KPW(u?PPdif1$`+t0~^ZM?TJ%LQJUf1yyj z%={&dqod;3=Y1SH!seSgoH$CHpXdb+HS4HIe)-B z3G4-Nv(QTvSfHEYCLK!7)T3q4%&-gNYM+bKrz3LglAaMyHW{5qlm&0v;flX!0K3+CRswx_gS|ab9-JMZp|}i3EPX#p~Js=Fu*9&^FHq z2ws%e*UJ53EY?n=Dd{T`yiU-=-=AbIXt!`sNNqcdX%vdwiY@0E>)#fp{jg-M=<(%_ z@^=}w43EVcr}7}i-JBenTNgC#>NPBNcJo#aD@NY$&{U6lc0Z;GFW>w5Bci69hrhUj zg8IqP*L{s0*x-bqlAE?fscXpRxbL>%t|fUz{neW(a@h&W&G!Nlc3Wbn5JGm{c-2K|UsV((=2w1uO07s zE+SDCRQn0Fg^cf+!)#~t*&=KEZ|L~LVVC1&Mzc-ZDZ*`{(bj)5K&hR46dn>0f3%5A zk}z&PKd(C2LLrmcpsTyFiLnn{kj->yn{WkgT)YFpxWMRl3x!$*496(%bP8W^-V^-7 z!TEU4v(O`$Ln*5aqy4^oe)5n+tuZx8u-Mv}fXx6UM)bZ){(vlix#<;^JhDb6+Tw2S zt^-4ToMx_Jdz$Taa$Si5YVv$(hY=_HRgs)cz4fVUY9wls*~7*%sVd8L6eT`cWN)r7 zRyuvmeC>)AOgH-20}G5x$>+H&We6#?t9*t!QAAd~ObMzBE|HNXC`wWjAO2kXi-E~? zlS_(idoiA)CF}RQv*-tOe5wq{8TyFqMyB1OGiJx>>~U)0zasd*it1vG-Jy(s@Xt3y z>XMUsUJz`%lAo;;j4PdH58*za(!FR%6TgEk-PLOVZ~2lD0Lu3WLLV@LR!0%w>TJWf zEZbh7Ks(8zE68XBlO zkdxPap4w@)TT06EfRti6w$~c}0##wrZVCTmxx*}ekk#vmwRzU|gVxcewQ`x$W0^CT z^Mht`Vk0Le)Yhk@V8%&cxVGPYwx-IKhM;xlwllc`&3L2da_p1eB!)$)pSA66!}}>Z z)8dv@lBPZ|XLY+Wz#Yv!X(L*XzAmh~!QU%+1e7xTQ3y4uL-QM^-m$G^(GAkp|htnEO)Oi2-BlQ z30L|!kKH;S>96na>Z8R3cDOyAx?;xPQG6w1vlqWps#jy3Hyb&!_8e-%Zb|uZvc@K% zpl|rQn#qVmHqgXb9%Rowsxd#b9$CIRL;0;W5`O=d(QUCUNZQ&2blbgE#>m%2S|vOX zm-W%f&!SG!v)a-^de^!nZ#nBGaFWo`af!NZ#1fG5Y>NrnPYczr7ZxqTKjE5PoZn=z z)Bqt1p6dnqi(AlXyMEWBgOd~EgVhY=7Ix@GL?=M&Eu~*lGikfGDo9{A)F)dn{m?qB zEC>Vl)Vp*S@sn;iIB!lEC=KljJr-qjLKH|GKY$N>&Q(;=G!)jqO)4K_$U`6N{HMjH zfaz{4lclD?;6h)5d*bu%`q&1HoFmJV9Bn~(VKZ@f1I$r`BXL^m9_NE7I7?Sd!Kz2p zk4lEp%L{V3t&6i+4Kv-dQ1qFS4#wdP<*(uA@zA)Grt-K_){43&F2_qjeFi?&hJ75I z%L92CDGhzpvxs*6{t8D-z?ShWkG|*^eP{Ew8Wmz!u9$fu74Er&ooC8_T9(P>Jyv++ z&$m9P6SK6EdEvaWvc>|&KxN=M}awT7E)hK_xbmdgHj1zi@tAQ!S&w7{nr9{+EC5V>+df<$%i%y+BiXnDNVV^xMAZwU(8qDQBdgA%gvSlBV=VLY-k-D7NxKYAO7x> z5<4rXofTnQyUgxkB}yJT5z}Wto;`)Kcu5u5&k|LFd2NamMM3=}?|8ZQSC>G8IamxC zV6(Q@S&qU-`c6_5kYei8XXC;Bhf|3&jD0kW5E+@q@w)Wi2OfVYquO>6w2rixktTsk zD^(0@?l)=@XS?YvwN>0AzTDnk+g;!lwk3dOQc^1$ov53VR*9iqUXh7hWb$7*A0Gm% zi7o>vmb#tblILUee=$!J`kz zY^MHCKp{Asz2Z7P+O#k6s)j+?a20d+Z1DLSd_nIj5}?o5YWhb-JvR>y&eM04Ot;FA z-9D|VnB9;J&G+Jwqh_;TwL(HHox%yMJ?^k+Dubd;-Zlyz&2!A?NZoVcp6(B{pH{0? zhlgIc-^x!E#wUiBgvzC;<#-BVpEa$Yepp)ny5A+>NIm_&f5}ZCF5u4B{ARmSEZy={ zVBhCIan9mBu;-!eHFou8m(KC0;T*;5vdcOn*1st`6p$^CJ>pWRZR&Wbw7x^>XA()~pnd5`=UrVF9h zDf##GoR?djNkAzUs&_aSA-YxG@t`e3NKYL)abYD-g4pa0d)BiLx>#4^3VVm}=LFEJL zBe53j_#qwd3*rpPc+c6?*U$+&c+(gD2h)ENs^gptKPf_*Iq{8sl^{p;D>>i_H=H4b ztF12}=uXtr9a;Pz#of!A`N*emP!uW{p=iV8^U+#HL5+rwp6W(5?mXCFoktC!iSk4l`GU3=*mK17i~ zP8Z(#bn%2xHNBn>Voyl4F??_q$T}|s=}Q*ferwRn?Y>z&`HBft*rjKGlB0R22p+Gk zSSTej7b_{Vx(&LMT#nwZDs@z4k2-;tL?zO4g>tm`AKvCFg_z9>sMXNDQRm;& zAw^L)CR|m2lT*t?J68CpILEt$xcq2l5@JTHynWfDRN`Sbc0MU8{aqds_|7vMcAUSq zV9S#RBpDO?pTPdcHe$4FyX2CDF!T=RvmPBfsL`!A{=zTt1Kgu}`jV=YX0KzR0H)SQy`g0pz}XGN|j^le&>6-9T{(5NCt_mL)xuZHGwtyw-&Vx-scwZs+8m~piF9Zv<5fejWysb= z3IR(_Y4T%M#ZDbkf3_}#=7?sDch?63HeFqY1H8xdDs1~x2o(}{*O*e0$@0d6j%+g3 zbGH37<)y#p@11F$TnxK$kakvpG&3H-#O@rZi_A!xF`MD|X9#tWGgO_rvw~*1`9QEN zSTEtVj0vJ;3|3{EXx$$rO6)44u#sw{@ELugifo>y@u3*g9zH6qUhYa-Emf6Q8ic|Q z6%0hQR9d|Yn6Masq5V1cj*XNUoUmaoc8Gnw?D}|#O*pI2l$2)7@yx-UmBb1YrE=2) z@@%u2^V2*fUQ9=j8c%!bh9q;Rn!Fay_UB=R{LO*!wxZzEuNy z%u(}L?CwE6I`2~gmHm%4pUei}*Z~J-r}E?&Xa;IrC8O{A>Qz2?u|+NEE4C`U;kkGy z_cWt?&Ekue)t*-NE5fzm+)(}p-!*&Vm+@621Mmqnum5X}2|<;hhkBFsA3haaL`TQR ztKIC_x)AIZ8)oX}7qd0=&k^?74nFA~W}0;8kw0pnopGa;VA(fp9jAOIW5pVM(0(c3 zLq`|PJ6ArzV4|G+ptD;#`lNjUY^BmR9aS;4?lnU9iUr-FqXX0tjK~sJ;e7Yk;`?(o zrLNea;vyL`L7E%Y`vII>o>S;(z6(bid!wVx{Xa=AZ>y8TAxOGw?uDa2Lstf3FrAPp zpHR2A@J7pZn-PIQ9=mv&&TedUt!t?#t?n^Th3rZT>2sXNL%#_~7yq_N=cV_VM2fQ< zAGQuA&x3o4Bn7{9b^WfrO8D7@w=<)z!E$z_gf-^2CmMuYiS7QruYPFS8(*>K|NqYqsM!bYzyux#@4Gfrfp zec`g?Nv%XSPdi{oF^S^dwMlt%k;k*p*&AL>D4*W`z0JDWE})6qhVSO~LjQik_bE)Z z^lkx>JBpxJs{}1w<2BDY?jAa_navFN93+=`KQb`VA5K+!u_AdHMJw(j>a~vHx0^2= z+6P;660~Zez(u{ugWGDnDT!a89lTlN3p^u`GU2)2{iJ_)p#&#GBiy=LLI*hLIBDV(Pd=G3+xf8yx-Y;@r5t2OM#Nz&QYU%GwiNa6_( zAJ>WM8n09EXjWw2{OKj1wwvxZ%Xm&^nrny(9MxRt-~X;i=gM(86Sl;L@V5Ment;vn zjyb%P@^X!N)~_TgqC$KBEN`~BfMOueX=idrBQ4~+tK*CJ@(58g_)6&$E0VDzw~&@S z`E<|f&1?~ICOFL&xkV3!`~|kz@4afoj|f&&nLv;MgWe3o92qBHXBKUY=bTa%%uNyt zclEs8;<38@k#%1pe#F7`Y4zXGPT@O0zfY0Bdkk7ob^ID1jZJV#_qw}TD;?Wk**yK` zTj2fsFxMT-^NlAuXCEs!8yNXsFG4Uer9?-Saw$@JbhE$7UH}4@ZOb_>&VZ_3{nE~d zS-PHsAf$jDQb)Sw0RLyhAx{t6dg`}<6bYL9OgI0v`21RnV%6nx`y5miPmX3s*jjUb zTquu2N8Yuw++Uzg+p~yvIh#*x5<|z{O-+5A0QHrT&~(F5dSoh}Cj5>hur5ZO3n3Uea@nk~fzA&G zmoH)Qa}s$EEQ2~n2dqUqVwRUfb|7raVp;WkFG5M0X<$LL|7=Y<{cI!xr<*s(thmU= zGvCn8c3jY`%_7O|!AI)prvwhQ0%h_B4|TeYaJlkl(d#p51k%M7_7Mw>O9!H<{Wj_k zeeJ{h4Tre~6PHpiss0XPM5j%MnBpx|s}tD~963A5*;S?0uiV zwP37^*^OGJi#tIx)@-#`I`>2StMTbi0(Mijg{fkf=lgk^hpr>}gRjeScpPTLJRKIj zm+Oat#sZ>5Z@8HcCYyy5=4_U<#e8TF%-z<9gwcq0RM*cOID%?nd|DTV*25>{2QxT5 zsqWKOwGO-UfA+c|eEJJ=b~w z=jbEU7T?U>pK(4G&*M1M88W+$DJ?X`y{)xAjI0!56sUL zWj5VNAd{C#839^V92b9?+?n-TgCY^OrT_ z8q-swSc+W;<(+H7FH{y(k&=UP0fYX+0(|8f`^F)3O+!saO6f$!1zWS9 z-Y!F|)8uNlxpq~{T>7gfnhi^9BU^mF3DHyV=t`F(MRDt-KIa8@pSDb%UR z3ZoSl!MaLfPhuwV(>@G>1!R>+`Sv*gq*(u~DA|miJijRgepBoPW@uf}>s~95%lA_$ zMT8pNl|Xg)?ASobg>E&Hy)8l^7{^oR|W3+8kc)EA7ju!RFg{BYz+g-vTFL^{t%tt`I=`D;@ zyA!WB`rz>50J8_MV6dYj+cF8U%@V|;K_Z*Blzvwhwy9T`g`8uj!%XJm~C1HaheGw&n15a`h&}RK_D|$J-qi8@JwryQI?1FlFp@z{3zATV~UAfXhSne9S zptCgXNzxZNXD9Lgt?5x`o8@BN<#!`iUgvAVi_qi3_b#G`$#cyEQ?yffQxdv%T>o(x zq*MvN%{|yiU^3s8i%zjlF!fF@z*#6gpFf*$6O(;a^7`9gd}=gD>57QT3PORKm7p_c z;+*)c{rcmI+_Z}LdpJ0id!SJ0k|q*o2TpA6IDu;G;EPlaF?J=eN3j9dclhajwD?w_9`lO*m6XG-M}0ne=XL{4wTq^*+(y-D*G25uzsHQO)~^Ap8l z8_8Agb%9M}>+Hs*Mfzz1e_hu)f00>lIyBkWxj}5O2}9d}0*Qf_7X1V`IJXsLP>Ra@ z+e|myP9@;On?I<*Z^B1#4 zFHbG_hC1lt0RsB10nvU)>$M*~8YkJcrdEeXn3O`QhcexiAr3+vz9u_crWpVH!a`kG zsI2;}!f@D!t#uaou5l;_{XEUd$CB0=m*u{dx&~a%0{K$cXAAb*izCKH`&B6yJ0kK1 z+yh=xGpj9CHe<#RU(9#ivi+nI>$o0WgkBHhrr+A^oB{6LE9C?@hHb)NZibt)t*wLP zk2Z0TrKt`U{WtGC>_NF-wo^LY5lEj2X=}_`0$v;r#5?C2{#dD2ja37Ri~V##rGk;B zVJ@8u=4V(0Jy$jFAs{xJZjEl+fk5s(z=Fzy!g~k|$eX=ihLDt!4l0%lXda{7(@(SV zjAF$P>~Bd2{@4yY=%8{)-0`miXuNGo?a2)y>^yncjI#7L9`QzKlUok-bSZPV1>!v- zEXvyrG(l3|dgm9p_ewS&rFZjX{?Bk?!FmqUDP+DpM??ZKcxsb@u$sq1ZuuRix#&HTb8< zWIBP$>`ig&(Wjo<&0&ox-}}a~p>U(b`_iEC7?2j~buZklWPh;roSo~3;cSC4EMwnF ze*h+FL`x+!w1U~lWDcS8U8QH$ZfW9Y`Nk<-rU}Y;FAUKaNKrg$HbYX1Vs&;%mR@w|u&ZIMOToFt z#E#!yw`cvpD&`bQ>y@{*l0~^UdcS_*2#I?=((4!oy>Nargnngy9w}$gN+5}4LX|f3 ztnj`l>-1vBTv}dDUtm%KFiBOzWA_ASzNyu!ojL>z-|qn4h&x_lo+AR|ZFWKHB zdCuOYi`&$)l5Sz^7nPyk$M$z70RqsD%`^0tRRmY2{= zL19yonVmuJm#qLo`Zt!%sKWuGg1DqsaTHI9UiSK3O3Ais)5?4TF2>*RG46vvaOpp% zxxikwaM3{zD)_JdKcPz*qYKrL^@EIp)fAyEwas8FW#P*Q);Ay7t$;s)2-f}@t=I9z zwPT|4z`b-W61XVc$;iDNy+6kDztfiv5k_}zRixMezyGZ%VM9@d6_)cXzMO2DJ*<`P z#C!KI4x`^4Up!d|rxG-s^sI%P-O~*;ij9|tEJn%U&Zr}OC(7rB3)J&%Me}W5EauG! zCaD|pBi8p1E)VD*v_+P)~T4>*l8UNPEfv7*yP8J8#zcurJ7I?(dn%2a;!Y*|%E34=+Z|e6CbV;;D3)l}HkBP3C|2&!c9U3k$|W z$!y3+H&~y0()g-O9TH>3a>t_{W7R5Eukf!)$jzR)5yTO zVmy0Ip#R9T$HHqT#c?uTvp!Y)ivsU|;#f^q<_@A=p;nf1MdFrZH=3zhgWO13uBvB0 zR<YW zuW9mvt;*)vJ&!Y>QzV%MtvYk$pYcBup8;>rZmLakC!>1mQ*D`w`(Vsd=aqimT&w1_ zGeOIVA^rez9$1B-t> z?uuAYjg)qns=(&K>?;F#^3jGRUWc~FNrpyz)3GR@h9bSZC>N%-a2z!){CY)@MG}h+V6I#jGo)4JMzTY{#Ue!5RoRk*?)|)AlV(=JoS?Y}X~q z{NW_)|9VbwZU=Jks~NiwL`C13iQAK$;UMdH$7sfKAQ*Yu=rES2Rh-$e=;8?+Un{sj z&9?bA_^J9_=zcTs^!Gb&LSv9rH?R6;&?iyhr4RKdljntg=mPntvLmf^K%T2RQUdeZ zZF|O!u-?->g7em;FVsz{t+1!DPw|Li^f%0vZvYV5H%{U<*{aoUcXm7Ju|bc z+t#!d;nIM^NPcgdbWjPs;HG8Km|;_mC7dUN_ZXN9OdHULlmE1AZ)e6)b2e_gJv~Io zvs5qiyLj2pOlw@IQ5wVV9nPe>@jv4JFnTY%_Ln=!=B0w%h7J7vId$Px&gj%f?Phb?S}LobmURl8R*Ft3r@!3o@2KMk9^nKW7BfULF4 zOAe(qVU&xwd&{n%C$8xAm3xxj{X~&%+C%i?-wZLpAz2oJ0Nrs30G6L42#Lfy4pR`$ z5Wx2=wfVAb;fJTg*EOHn*2H6`pbw<3rjbG(TFrOp73Fq*%1X65lrIeUs0YQ4mm$hS zK@teZ8JAR;pu=**y>|}b-FoHdFlb_Lx|ZY!c2W6w?EG|pY14hCwqr4pSuy^GcwW}aqaAp#|uU@8x(ar4z{-gc2^uQPqqp3+s5mB!hn=^0`a9i~( zTq$a$iQ72_k2pw`@NAuO*S*xZwf+( z=&{4e0rP&&y?Wl3fmW~nWZUh$44SAbF<>N9$12E!u)Qx`a`3Jy)$Hz_sNE0a+A@ZEFtI~f1F>eTg&BYd!*75@#SB64bvPx z+eLjV8BqhY8_M@=bNo@1J*xEf_vabCXMq0NSFxO#3cEb#HPNy9_(J;C`mmxXz6Sl! zg7d+5IEzvSdOb6azdGRPALW{rn({BjoCvwZ$zR-&hYgT)pYssmwA-M4#f$sw^D6f| zivArN|JZk3aP=7ZHvH>mCb1tJXArcK`+P?QMrubEKFt3PF~@*hV=nR1MimL{;z&kj z3@8y^xt-qRIhfKY(R=@VAe~l_vUYc)3`|GjSLY8u|NR}FZMrpGZ?1!|S{r6wuCMFr z3O*P()+3OHzTcB@uO1%clDxEyP$Po0xD+@n-7gs*X{vAhH69p_h7^hv=<)Lo6ub(j zl2=kH_AG7V+jcez@IFKvS*D>qb?TkW_NS%)2YYWF74_D>4}&6#ItGX+WzZm!Lx)HR zLrOPD!w}LP3WA{0-Q7cX3)0;U(%qf&+jGwG#B-jt-u15ad%yp@U;c20krGOZNYP+^CmqV9Tl{-W|ayG9X$_hcSNCZ#D#9>-{6ptK-@xBDa`4rSrY;k!fQ zX4eU?;upZz@g8($f$Bu7e_AZ#R>pY3QpS<>6bUu8G)!?R+Oz4STv4y?%F>4=Y};VvbMY_&0{s@I);(Jy)Si2M}xdGh!plb}Wub-?!>;3{X)kMS_~pzvCkI z>EG33z$y8q1GgLv^v{9s5pk!p7_OoDtusC*VXtzxVYCO$50mv~&?X)7BDeV~1zR%6 zd(rA%P~)ytV2%$jeZ*v8E(*cHr?x*w5{DfL`3666J#V$r8O~EC87`j@_mf1hZx6fu7BB(GX2zN`wCj(#tRk19_i{FaW;rA!W4R1tX{yx+vbJ(o6GP~#hTjaUH9%omL$X=& zlUzrkqfox9_wadk(&VHIf<_q&6Xmpkv9V4{AYLyLCAUk`s5OV!T9cW~Jp_^L(yxpc zc+16AeIfN_n*)H*!;o+CC4$$JWXxEjGVKBQ#Js{t&`a` zg!i=(FhWl+CAJ`k7Kka_f&rbH{H(SDImB=*oV`TWpxYIGuU?%by93jJ!o zB#%h#Ud0`?h`$3U`(7SFG4E!!<|9UxGO`px0Js`UM3uHcc2fVZPq9AN$l*8HpWY%sGkE( z^do7Pn3chAtP_;LmE5;Cz`cbC|A_zrfpm^4JDgHVe(eB|_*+0;7Ljm!tXzFMO(9o3 z^=9+&4sRQX?99Zi`<;IhVN2twzW)G#6E8HY$BQd}L^g-_=hOKN%a^d13t4ig5;`Yry?_@3m}92)gx zLZwAlQKfWUcxz!d5BwXh z_qWc9n{VWc8XOhv!VUG2up1S`_^;eriZc3jrg^4)mv!5M1N89JbbO;u51eQOS568v zFR#Ft*A1`RL%v>fT&{@e1gU@I=I8qs!!foIZP@mZis)PT{@Zt57liD>&zuJ7-Ca|@ zEiXTkK^Mz4ugK+QL6!>wbEXhcm#ZvV6`ia&NESN4=ShG-+6~IYSB^D@!=f=gZb}OX z%qyv#?ZWtsc+}9@CCZi@ubKl;}cV97Gp*BZ0_iaNO5%k4egk+Wx zTg-=dVH2_14mTEU1tAb)RO%UcJR4j6rGBc88&L4I^0gLj#%=T-nM|e@OD+pH;I@a+ z7JC+?;i{h=R1P}1I4+lG4GO19#889CYMOC7|HJNnKawMBTakXDU0?m$3%X2sgdR6d z}-Wf!#De&{HDlnFO#jPY5f#p zftx~2LJaD=+w4461VvZA+P->iC}j+sydkM&_;5~)WRDmPqw~RmLSLGshCS%CC>HV< zviIZ1aV%@X&z=N+^pFf@uGA%|Jnc#34#-z3=VBLrqmYa(@|-Xl%A~?mm7=J|sg)Q$ z+2^p@U%t;IvBIEMDQ}XYnEw$fB=#vB(2JD#@lCmYax^>fd&K&S>#YuCXmhu}-<{XU znWI^H=O5kkzAKj(IV&?Lv|?T4ibN-ul9md6p^m*Bp^~ev7Uv`Db@xeV`QD-u|LEFs zg^PTyI?DTnG2tINfbbKA6%t=ao^90Hd(cCvQc`r#p%C^`E!k?N&hYx3Q_nBwjg5_! zIZFuCVYCVSJAeUSW^l>D$il>X@?=Z7J9EgNj=QEh_mAq*pKH$*@0oejwuWmAX@8m| zE78YWALSz+b2}6jnT!wN*&VM2Sv@v9=5Pkx)%o}>jfB_Na4zjYjy%O~ zr>@SuZ^PMaUidMqX*86)A)3AROg5~ys{pmjXQ0IsnHIl>Nf>zPAq?J@nyR5H4dg?< zy_XxAA-X`8%{cZ6n_bWO8bYWOzrbja8V93gHKEy8e!G>f_I&pX*M1LwACNauDz`|1 zvbd)u9b8_Vk&%%#avf0u1d4!wAcmSG(#vLfc)L5`X-uX{vC(hnd1x@Znou6tNER=f zJ>+e-Hz$ax_sc-Srr7h!%H=j81#ya6b2?@~6=(0(cqPaUyiJH1t_Ee|mL>=RaL>A8 zI7JUuYd#c7<(Z7L44hGcs7{4Yn?K?)|c(9;q+L6ODWT16XL|Pjh^2r&40f zgmf6NR5P2MW6BgYOh?s*hy25P+Ac3XJgW!0NTiR#WznvW>j48oD^X7OW_{Jkp3X{v zE{~jVu;*K1yKQt33m7^Yu{B0vzOKsc2d2v;7jBUW4pj8v6QIpdc^F|f4mBHPlpKDJ zkbbycF|v_qijMvWf@?BaFo=IM$9R;nuUtkSPU(&*N^>R`)`z^aJ?#rJf!i}~?{m~y zQH{F5f2y-8qY}LTu_c^WdkCO`v>g;yVz#$25v`HFdqPgy2bQZF^<#YOUf;TM@DwJG*dNufZFYM7dp+A zFHBd+t$BP{0?KgYbqOG~@!;Mr$a&{r9UWgc3Z@v@yFA-c(cWDIqE;+t)xYiKxA8OC z&1dPr2@%;q)ECKV8%xL&`1adt!}J8C^MyEt1Mpnsg1<}N4&ACnPNmIVe6-&aKe%gF zp#eOH7a(sR*?kD7TmnV<6thxKjq@zF^jmb>LAhDga4ug`rZ;qdxPE&xgzk%;NR{~b!ZT6Qwm0cuTt2~_5 zIWizEzk?OqSn2!e_!xW0AM@qm35M|iNZ?-SVu0LRJrK_Yj*Ak9aKkj70V^tQny=N|m<pt5nJv zG=<$W^?61IM(m4YI{MHzu+VTERf&-tn9+^Vlo7g{wN*?P~d2^jWYFY z#l-~g=$@mp?fP2_KyQR8#B`sVSuyEZ5Wsy1FLi|}TUHqA?|fTh4PP32c?*Pd>B_Po z&GwkZxC|hMPgfbOFRUH6DvxU1d|P?Nk3~vMCrttAvTKBOYNTEERd2~aGmth&c0RM= z8Lu|%Cy#SZx2k0JNZP6d>v{#ClU`gU|D-#-sfNx+p*9R84Z5<^Oy|_Q*6(^I4l3vr?nrh;qoM3~CH>Q$2W#SuckWilHa3=LRV*JLtTA2ryr#D2 zP#UAY#D&hweb=g@)|~h2t#rbqjm#NF?rH9&;k|BNy1{emO#}Kj!y2V&@yh^g=z)d4 zk@2AdRfjUTLC^a_y+HBul!pFQ+MOq0$%mAiuP^tyQImmVD+GCYRGWISKQc7eP<#5; zw2UT>+w3sx9Ge(hT{)yA} z2UVLyFhn;by}x=kDym8kna-Fh6z%;W!>`1cj+Py>&ryuTfKuF$~oP6(BjH zX%P;Iwl>4mH02u);zld1HYY}94X6}yz**>y835EZ$hDh%i$Q79_r$Df$5S?Yxn`}( z%ciR{r|q+i#N|m?+(O1PNhR%x8~~{4XCHHoP}<=oMuB+2FPww{k&)DKPP^VffTkWl z2*q^it93=XRbJ@pp`Z}}krBQ=GIM9mVA)`~olbNOuym^=?+|lQ@_XLi$&gMs`!17D zMp0GDS?D|?>9@eB+ZO)*gO}^LPRR>IVA3Gt$5wzBBJ5p-0*qTx6Gq!QK7;Y``|`s` z_{Wk$dA+iOArRnBv~QT>h)Lw|Pch%y^{d|j^_w9U2JqHyzjj?DKl z&Jp{B1U$rMa!3-_l>HLX%2+YHM@p3bduRgC$S?{`d57hCx%9;rjTkVuu52`5&-yP^a|X%%Efez zXRk&=UnmP^SVxt$U@~1ZX+7!6L;9M;fe>sOFWQaXS9FaD)gtfXBPajBuK!x<{?o5> zu6*t5s&Qc5UtTtVe^tpFUMkwH?<}2oq4sj^IdE`7fexLpn3&jU%ye;oI_3>uV)o}C z%@Z6)E)l#^d!d)QAn;DsZ6|fhT056up|2|pmI4bQWnp2dzUe+1IFC0iXFO!Q?e>^2 zs+crreLnv7>J9v|krI=rbLJTeR4%dexI=ZcIBS1nTmkgqB;DEBSs8>di=_~?L0jUV zr2;exb^DzIhv>tK{4h{@87?L==NZol!I95Vd^YWLhQK1Q?>DIhm``!t+me-Q=a!2d z0i{#;FYz>-L`qC#dVr;K*sL#Gezh}*f`?NU8sUKwSaFd-FDOyA`(RP`EZAjZP}rF$%3$@!|+_$q3f&9q-od#AilhwA&aH zqgDd5s%OBBXC|tMv)jc&@mWTUS>ShUrBFHM0`2BI@Y`tT&W5^S-Z&I30Cg%{npFYv z5C-uF?Z^wsF_4N~QqBN1WHYQ=>rchFHr#j4`}dA%S^-W)Y(>V0zsWU4K;O}Y)ju8V==Kh{R$4} z(;}=&6pw!B(cj+_4b3g_8`^ELW8KXO-uVdq*!(86gq7vqq}@Z1i`<`fDQrSRt74Cl z7zOzGs{KAu59QzQk{e+pn|b2F?LXe^UK{vsZ(JT7xdW``n{}JY$DogL04>0|dl&SHQ5^Uz-gE$D^9GfJ%es=|UV=TUS( zz@psU4d zb<@h-vD^s#KmOM((dX}-GQfkz#26`slwN@AduNI)A_P7H-?!>c}f?2`v@wu+CNDuZgBgYcw|~OzyDPSXWsp6Pmw}5}sZxdLVM{ z5)Vgq7NzQRKYaLX=HO*e`j@T1ytZ$R4~g{0B%<#C<%ZANNDdJt4tYS`Qp|1P-g3sT zv+hXQP@!q9t)&2x1J{fAQ=7ALrXy-eO~$!IA`g7o{I-h7b?CA#v<_Dyv}Z@ERi#6} zLXjLqHgK)?C4Eq`iaq|EjdjwJGKD8Y{LJy{n%vbRKd&IN%odP)WZkE z3~5_$*SnA+9Z|x;WL#&P&~gLR!KO~)Urub!ks$N6v3yC!T=TS$Da%4c_OF}aeO7X!=O7z3PMWBW zx5rgl4_ANj4tFi;aM0#X*4PBb^8%dF#L@?qmS0CpeZjrwvJ4-M-M4lskBug_Pf313 zNY=&Fj8KRna*p%3uW($`e0|sl$j&iw7Yrf*OH*QRA`ZC|NniAV)a58I13Q^7Cfu|; za*meu<3^ZFE=wp=+|m8BQ<23-1Bc$#&P9fFuJ|?HHRtBT5}yGjztzG)Anfac;&|%d z+vp7MA(}4rSDaN-Vu2LZlwJLA$g*{Cy#e$hzfqxR@o>TQe6@sJ(xugTA~=)0cQVe> zL^K$BG}^xQU(Avg)E;rZGVORI=Ul$+a&kx_6}OX)Zp9);yJtB`W51eCtX>@95t2jg zn>0>p-N2mxNl;i|Pn~^LCwFa@%U;TOVGSlw-HynQ=!a3hHQBls)$p?GVhxdhO_cw7 ztECWZH@j49nLJyI1SByj2)#;SePwS@>p#oHQlY$2Mc{&_W3AY^IL1;MN>MeHg6%w5 zsP*OR{j<~+i^Xah(gnY}orlSm9F6A2UZj%Fa@ekfI^R0%)L}trA1ePq^l?fnC z?3GL9kgzGL-XKVY?RFy>Kiq`yeA4Kdigb9m-Wpiq7(wd7D<$D-6{EzfBFo@iWAPcK z$r-sAM$Dj}}`v;6GdS!5g{;G{dkLK*BA0m*TmW#b7})>yfN zLy?h?;gZxBmvPA*R!?eYLZXgMwRt$B_Wr=x|7FbYH$7C*$Yc7cGO}C(gC92t5@ukl zSEpc+&-(y1lun0;_nyud5At(QM55FD7RrLE`yY}URz6%}V-8ZsTKK7F9?b*v1PKk- z(kdD_7h)_j7PL!r3TG1c&c;OaoCJd4jF12W zXiPXw>^&8$=n>ZLz#ry*-b^P&&;!EWr=G-5?o^Jz&5-E;};H`{&LIyn22bC1Om7G3V>X^olMdj)G zc`4_tVOfl@=hY0dEY&tpz)3OUWW#@d`=D!DKY3=5Y1XK zkRw`(0Bn4H53D#3jN#MI+>Q7x>^Kg+d4B!RW`zrz7M~z`f+|+u>~U2Ak*zPeIFRJ#!=mWz`wR;|_v=!gav20p-pdUGjukyZY@!x}fP~(5M&Op~6 z$TxLbLgd1IciA7j&HXas6NcMd10@%DYDlG}!9FE>^4XxLQ>L>OzM)BM>s9{ zT{!aDtMfZya#RqMt@ ztZRRvGmGU6l#Fz>6rh1ZtGh7zfp(scHWDBH`g`kt*<;vPU-O_P5xyyn@?DkA{wgdc z0yiEq?rkJ15VA+cwt&URdNjLj;kVteq zKK1VP6Cf1y!~QfKn&7{DR=T;g+2gwF#%7b7N3J8`j(s0bohsk?lBVSNX5irxp@*j#wMNQUl@V+3VL9%blA)?q68s7>)~;)QA%Z z0fCDL%^6pRf;&dFV8Z(;elV*rK7d_K?m817Y_?UA*$dlL;KnQ-`zk-NBOGy-0G60V zOzZDzD(eZY*l&**hud&npy4g#++^8KM1`@2DoaY*g?e9dDH(?ESQlR)X2m4@li9Z- zdsIHOHT-*9W-Ijp1xX;{mcLZ>-0NoU&}*>IM&^C-ROe!j|2b0GhwgRF^>(?DV@J|XVQaGJtyj2as2YWeq?eNQjE}b zBVVuOo_ziXAj2p&t1+TQY~F1WJW}%{l3uW_{%zp?+*6qoQr71LHmnIx5c9Jav4)%v zefH-0WPaoL4JnF>Q3cE{bjUzp(Qy10Z)5AM2bEjbv2q7mFrG`hxbhm%Q|t!1CYQz; zHau%5TP^TjLy&(YYaonaSmlOjfX#RF^%;KLC^wqAL_;@vGSCB zkGTDcCbb-DX?iD-3;6e6X3)6OFNx7J3|B9Xd%7={kJaX`RZWn1Yi}{|WnT&U^6#zp zp0bY+8u?wI5=L8+t`%6~%=b#pcR-HUdnAZ4cX_sZg;`Fs1CDPK1l$w^mg!rQP3D)(?S1~6%Fh0JH^61%6H$$ z?QcD(p$e?9NtD$5VQx{IY!b7U!`NRHCTtfBU6{D_g@(fXs=f{eeXJ@u1GgtkF~ew< zEngD5)>W3!i$%p!U$TKGjd%4~#+nNRKa%Rfq0TUmlQ{O&3hCisj`Ivw{r;IE@Tr?* zk6R_D_?|+faS7<(J}1yvyHoq(Oc|y7XRpH6*KuOEm=qgW!f9u)Xgt64U(CrCm{XH{ zfe%)pL9>gB@?nT3b3C?sX%JR6(84Tk(i0x9gb_9$MfSi18nUwUl?u&bXbvZ7#2SN9 zj;J=%lxS8&xWCvt7!MiHLm&gn2Z8jn79tTx=BeMWHh=#XxUEOSeju$TVwdHfrIsoZ z4nNaAJ7>*6InT8@)y9M%`H`?%QxW?+Gz`Et45r$)1Upg^2joVsU`tqkK8Ow^8bEj}U~ ztIN&;ny}tg>1jVEw&OnDg)Pkfdk^;reSY5!D|f2xe2pt#fiTT4a!CoLM~RgwEbtYG zL7NL*yRmkk)h@szBv*U!Tef2aaK59KlwhLw&)RlotvJ9|{zL{{P>^{|cZ$Yj+(~3S z2#NdR-2Mv2;?CAXFo8D#*s}ucdO%JmwkwM5(i|xNkOBW3d-5P-;u@PVi??xKgREVz z&A{QlnYM|oiK~iOmB2vlghRqwb&!P5-u}D2i9(HALGsnTESA@mRz>Sw$68h-9Yt1m zw=9S|%sI$RnxBiDAMydYw5RVvqF}OVUfJH)NUHiiVLw!PP0G#($hbvKm`hmo(I>Mu z!!*Fc!Uygq1FjGg2@B*(vHkyTk{ zPtqm&Ke07vZkBZOSLsvhVH-AM+Un~BX;DvMp}(sy-&g5kq0QEEmLVgdSdU8ewnRF} zocxe|MWrtPoIp)`s8!aL3N}azyf!Y~bhgVel9>*y1I#yglR$jUc*oiF~E| zb^aNT3LI1HiGfcwGD{P=Bp5K)qbCx%lL}AjBQ0p`yoR^T@F6L7aYTX>rCC;@gj0|@ zXdIY^Z1xbZ&teJ7la@nJC6H`%vj-Nu4~7#ofHTgWJo{IYFp&R^g%;4{ZkA^?nqs z*z?Gvz?RdnD0;E6DLJiamhQ-`<(_TPw#44lOmPr+kX2b|!(l_u36Aao5v`KlHvPRydniUQi2$|M@a%E2|b7MqpuX2b+wm~REwCVHQHpnPr51s@(cjo$Yn7^Lf z6l%fLL>tQY5A#NHDA#eI@nI zc8w5V-ZT}zFM~^d8BvVgzvRB(Mh;{RMHEMsXT{D%*9i(TT7p8KABM~|uH=c@b(VnG zpvJMPpQ^QR%3Prn>r3$ROZVgvXI_}j)nT6P%=pCb5!hGSg~ zD;&-wFDt%B)4Yu#z8AH|c9;jU5b1{(YD<0EWByvxyN*I`FF4eFAmNnelDVOuIfy3b zx)@|c^p7lX)W1|XNjaobjMxK>hJXIBA*1`z#OBG6{>OMFI$W_x86RE_wM051%6H}q zKg_Kvqk+7>h!SIygP`X&4ALlHlQROGGugHAj)<8*w z8Q$~3C*Aea8d8fi(S}oIr%5d!IqY$mjix)BuQAh}E}4lJoKuq6inj2p0CQCv{+dxm za!}y@B>&2HauYm=_YdB}mlt-Q9Zi$4j0B3S8)VaWdg#BwCYd`a?pbt|4Lw^pIuffB zXrOz$vB_YPa%HSXQn3*e`)HmqZts-MO$M?Qr*J<~VzxL=&COCv1faqZXNGi0f992eS-urHV#-EjI;B^w5 zqAmXO>1;iX*r0zAf7B0iol2uPG+1(NEXez5PW6r!bP?+k#z!BoMvxla;`uE z{3&qu-aiW+9SXnq(+aj){wgU-lI)>QYn3O03DLb!wF<3!HQ{i82`8i}Z#xWlKPFt#7|+~fgTt7MJE zrrtPl7JgrSS_(oBI3gdv7I0EQ-H%#i{SK6y6?oBzLi{jXs%*5w};;%knq%Z9{jsy8jjHE|H-?HvI7(O()+UDyaKh%+d53;px|u(I(el z7yKkIMrAYn$b4OiOuwc^@^#`BvHLid7X;Y7%SN`>h-sq#&?)|FWxS%ig}6!YYN^cE zC|{-8A~!_|tEV1dlGBl96(>0lyk3$%i!EP+%5er3Im5H_|GM&zXC5q9=s!_b3DGEg z@%rN2ZVbO|K{NZ&cb01}49u1BH$Kx5m_iuX>~6gK*I;}epaw&g^soOwbMqJc?}dW@ zUXA$Q9Q|*1 zg#+0|2SxsWe6!zvSyE59t_iTva;D3pGLg*H!mto(DinU;!Trj~mm(tG7C-Cwlq!G* z3+UDb+8p4+sdrWQu4~3RZnBpHTprnrj?y0g%_TbIQA*WGQ`CQ!`oV{|b)1mn+>`=< z3S9u1VYK*h1LtFgY(}Ewu^~S^sNg?{>eLfIaqQa|%%q5O<$*ny$GJ;&I`1$cxG5~T6-IID>l-TP?@}_N~+;Rb^?dAW*kp9OE`2=18HIPU1 zh*HmXAg}Q>ARu69q&5vu3)_G!Bm6ZT{-NP?O-%3$C28Y#u3L4IdH~W+3*?N3q~ec{ z?F{=IjH{(lR<8zSujq+|y&X-%VzVk%0Rq@;C4Rb|XMR-hg+Uh>j;(XUStf3^lh~ zaS@l0DDhOi9t&6Adk93uo+9NkWknK`k`T}SF*@+etGDu+=;2YO6(TRUEbM!>+W}8` z0YHyJBw{#3K&STk57&vA{ni`~gMUN9T)o}~SgKA}a40!Yy@{yha*QG6MC=v6Y-u+4qKN0Td{3%!jI+ zwg4Iof`JmoVYRNAS!ZV;7zg0EZ9Ce{*$k#Akth`I=sy4|;G>?hp-#t`p*^Q0Iqq11 zjd4Tk04R@nASM?GNF_SoTBCqbw{6%?JPT8Eh>*>Y7Sz(#ZqzG`h!>Q$C?FiE)zIsR zex`kS#LEuk1rDe+0B1hbX5(eP=LBdKr!`cq-Rz4}k%EC6n4*}krB{wW1RzQg=SLTJ z#ljm%Ml2YU+U)>cKo>N12Kpnp!ob!MRHgvR9}M)YTLAsun0h&wRz<$PzJA`1_tGD* z#-}6O5%J?sb3uD3-Fk7*ovNhib2NZN15yz=P}>Owe1wRDeZ^WA_X+dnjR?<#U{6ES z4cn~!vO|sx_3Fq`im7pj*<73gy#wl#>2L;=_WYWhDeJTaXh;Z9b_kW>sxFxTN-C;W z+2qkO!=SG~Wj2CQ*XQw;q=qZ#h9exqVcj=AVp`e`uykaA77+@_E`3XO+cqp~h!B6% z>H~R{0kiuhCMI^+Ih&but5w>zuPYVKS07C=&C!+5W82StV+FcBK6)eC6J_SR>xJEI z+_uwmMrQ;mLYzXcTF%b<_!tkdbdo9=$I}OxZ*lSNHp+24+MZR& zsk5Q*s`6ZibO(xzN2MJODny>EHi(A3g!WfY zzHfk#2mb_J6twjsz#1(Y$X4oqp|WBDy)BicN4qkR5d`{*h@(V6Qm?5<=oK|oV`2ex zC@E+iS`KutTOwyuV@_%0)1OuY(T>@IM8560Iie< z^z+au8zbc9#qKonQo*OODN@txs0d&~QSu=`(|#0xZq0`#haUY?R;32*LVFm~*>_i! z;y^I~6`cp`q5w4UWI_NsBcsK9WnZbJMuuv6f&CK`$-5>v5SisQ<{M0wi(+t}sG~Kg z?CfMy1);ME0MyNc4blQ3WA)07EO!l&5P=u#s*cIKBh ziItkRmX_+cvIam}oB5J(3!TT9I4%sIJX)`6``R$$4+fJ~`UiCCueYcr7bF;H4uEM;zMA3gYL>V>JeSq&5v#5@a4ayz2e z_U`{R*x#SsbH3+@x(wIDi&8{Ez8nrQ@R0+>dZq3(ya7W*mD%6+E zkXgC{)E_i#&yUUb@SQheCo9#?>P^Kv5cI2<;YZsTFtF(p-NPO$)Gq~_JJBNabd09bCS=^Sa?;~1 zGxJOWU&3Oiv-@L?i$Y1>peTofKt6ZkF!dZ)JX&QPKUg$JGU$$gx&|YyGpu!R1xTpa{(_Cb&xS-qen7mH$PM+i2lZ6qI@003iuzJ zI8J>V00tfooll*K1zv;_|Kr5OB!vEBYWZyA`dd?0yps-Vh+V+Oi<$`!uNwx~+_3{< zpdC~S+=xheA5U_wvC_4Bc@X$eb^uWB9LL9&VHe;hbEvWdojGCJG>-z84t&2sZgdF< z3c(tLAV90Z8Hs9?Y+8F^0~cFFLAQaN5i73#J_E3r_>ges;N<4&rIBIRgGYVZ9V&Kq z9>LT~efVv0hizh%(SH9qZ*DzO2I%14)b1SK{Sz59{FB8#8hnn`1 z@r{Caa}MB78|Z=TWufN;^L}rEu4sl_Rw%S-&by0(OBoMAY_YPyO>1 zm;Jk@2GD@{x|7?NMdm;swZNYss&i4ocZ~U+4_$^TKgh7Zym50^d_cY@!HX-lw>;rg)a1W zpB*=AngJ!o&^jsEbQMg){~lN{D! zpCD%Vui5ODeCjIgtyZ}0JY5+Z+0*FRKQl3B@8y3goEZ!I_$#eMwBfGEf z%2ht#;{zd{3PpacdWx%?PoARMYN5P+z_5nk3xS9@&}zMh576cwy`LD{$k+v4;9LEl z@fSE(osMOpLhrQ@dkr%L#@^O2l9otyZT|<3WDC%%Qd_fbi;PSFfe8qZ2mmj2!PfC# ztII#)3Rc}YV2>04fj_{$maj4Zs&Bw(TvKefriMmdp#q0bPnLDn5io99=-Pgp7)P6zsfh9I}|g4QO}6xaf)uT8ee-!Vfw+a5Q}~*=f^7uxzjv5}#g_ z1{_sV4vwS(VfA57(D%ohSk<8Z*%v%Imc3e5i)2(MR#cD*k9t|GKBHHf*4A`Dkey&j z!aJ4~57;KdKp&EaM?Kbl@v&vjGS3s#cJwdM;k~w-FVKTj0qkev3*Q>sswMzcsE6P#>(d^n?Q6;QPMqwQXp56qMHRm z7ZpIb0sRuxK*vBblmIrC=*jgI=10ls&mcGL4dMl^3gf8_bX4Vls2v**4<-IoGVtCz zjj;>0#=i6>iASA$@$q3?OW4W{5wKFal(VT?u&%a_zz^&_Db|7kp8*xiqi+@KwzE7w zYG8vePqcI&wwVD<6Mqn&{X6p_6%6uKLe8fvX@IHrRH@X(Ip-sRL|VTr_Risef0_=U zit%xdpY;!ebciU}r&&8V9(W!J)lh&jL$}nVUS~jx+C&bF2D1}xJ05OAL-+~`Ef!!v zH~|og5|j$Rh$)h#aiKqf+*t7Rlyo8FRaXa!H1MzE%XC8R+cRdZ0S#UV2Bljz*^2_| z!z$Be2di?s^|$DbG4#7a>Wy+IPC=+mA(JNFX|4G$BF8<4n_Or~i(N4^tOu)PAQu&n z>SGDmdX(NGB0PNeH(@4W>Qv^3b`2 z_Wo58z})<8>jT}8dOH*p_p6^c@83U}ZKngO7yLX#Th^0SYI{kq#nOxTfSe`S%a>hX zl^;!)y>o{KLlG4Pjz^|IECQUD3$tJ7ST@*fr?>$9NVtw=bth>&XFSzp2M9GO$_O^O zK!;>2v23DOEUc=Cy?{FurXT0nRTNeWL?e_PrYBT>>(mHj%0bI$hm})qWc?mbvyu9+ zBam4Ctq*c2tqO_@wRGHD*RnI$tP4JK@xrt`#V=dAxG&OSGe+DImlX1~`l4&R0I-+b zdc-X(0!h9zyf4;|2|_OFBXJZ=9W9TMpXp-zzWV=;RP#TZ zQUAZd0{Y)C{M()W-@4l`ga4nd3jMDQ|335o-x1ROsJm4Of2LNF)55IgjR97#rE%_vu6j=fI_Z2NC03^JJ_{9X z^R6EHD&-Ul8hjAOb(YubGod{t-T6CG=UI|4hNjPOnE-5{7B>5G`8mVFs**N3T6uug zyrjqoi>QQYEOnYKZBbLK#xWN{@|_P_-1KR^J`CIKo?ol^5BC`p{@5Czk7t;LFDg&+HNYvV1hO*Fr7VH23|Q za9`RBx2aD|pPMVC#Ey_)xk?0hm@tu=cVjc%LG$O#9~={&xTYYiTD^&_R1o<%Ek?xe z<*C3O+VidH9Lqa#6liWz&H7Anoq$ff<#fh%{m)Nuv!qJCLa#eML4wN(3Ed74)H~ik z9JSEuWDU&It$2)yHt$zfp#W=5bxyI{XzzHh+=s<}+)U42F>lGFI!+p-{z~X{2?}ac=%073T!wm*{<`Bo+2kdk;?9UTQp3!E2*}bwEcRo9G0T{IhR^% zrq%tE`3XASzis$G?7ewB)b0L1J}q*~eWxs`gbE>{BFe7CnqBs#g{))W$DS4yN|s7U zWX;ZuZ49MFimby7M%fKB_Q6n7KH&H^7SyQKQ;!ArKGhaqq|fsy>dNWuKdqv}j|s9u>2F ztd*>2FLx=`Y@u*E<&;W1TOlTUI|RpkX;&T{A-D_GnVCoD^};+NpZL)}7hi&mJ*)0G zys#57>;E2Z9pbXB!PZ}gR^PkzL_=5AW{7Ct%C3d=p~dmhrm5nu-kjo4p~Y)M8PDpB zkN^Bx!{ubS_fcreqLHMd-l1F8V0Qw>w%B;?rKb-}>s`~*&1g@jU(A*S^5w56u9x1vw(K#TbgkyQ_-KLEtm%}M@IOb1>2kE+qZ)dVJoJO+ z+4=a~VwgONCIZchT+OR3 z)Y%Q{f;9$HliHqsf9J3rvGZs7^R}_qciX%XzxmXM{AIoY=cs&BoHMaFxY6hS8UG#G z7mc6ztIk-A*~+PH%TR5*sK}o zz2(2G6NZt3n&Hhai(hip=Ov?X{EF zE2HbLW2f~*kmb~!DV%fC@fhCqO>g-szbsiU#ACx;iV1H~O@H@fbJX%qMEI#c|2R0K z@{*1;>f5r<(KP@ zzoZkcnId{`w79z&yM=5d`c08CDT?rm2Jp^S#+ZUwy%QC}2*jn!#NQDrUy@(W{N?%0 zl8%0Xcv?)zOp@@{m7gCzOm|t}bU%SO^2X4*NY2`~c4{T-0&4r8zdm5z{)mZ!1O|3Pl{r~)Jz6XYmnx(f>BoRlJX32iIBE2h& z5BZW83G0Zcts#2+|5j+kV`xNfztVG~`=obT$1=5%*Drv4h4F@!`U6FBHon-Y^`<{R zphcR-jd;Aa;#+4sF1(AtAqY){{664x%s@{719);r z%5FqPH2NUI@GiJl5N5BxcZDXP4CG~9X>qdrj6}t{Ud@eBYGj; zXI*Zvc!A@hSA}q~5Bbnw=%vs+#plZIMS$ma5Gn#cSITRcJr&kN>!iqhSbH0hmzGz(AIYV zPZQ1MP1h?S9zqi*ZR&d0XjJZ8y@DWbfl{H%zm9gKaD&}f^WHP#qR5&vO-Rc|e&7bLp1kFGZOK5uqVA`54ayYox_y6DZw>I)U_#cLd!mcet2H4~$QPCFq}G%N zQtcw#&>1SiZmy9T?S7!p)V=}Vb$ZW9@D?(u(mz@Y;UQSj3?WX8Ep7>#e8lNKZ!kIK zTgc9~0;IX@dV0vMHYM8IL~&G}wMQecmCtXn&u|A5l{`m#2Uyx&WPH?QTfulA!YMEhjx zTTr+!WD7oOvXFcnAEni>hdtRAPxlSGpcT6;*bA-1x5!$*AINAMXUjpGb|KI3O&Qlo{f0Ak8dRW2NxSv;en}GN`BCX;V5Twz@LFcDDWnFAY`cx{ zP|_|$E`UeOG#E#DBB>j+N-x!UO&waw)f1-Z{%Xmx#mUw-Ke-|Z!MFxKwEn7#WLeh| zAQ9cc{4li*sl={L6}XLj1Wz-Rc2tsn|K|3H(AR1|KR*@55Q`FufL~)$t;L1Mn4}k3 zzuKDN9|pQauROKxCgchGkaCVgxOXYw8P#F(&O~&f?2>fqO~rm8*jnJ;XM|$H)|bF8 z@Oe!7sX=5h-_GyA6Dr`YI{tWtz5JK8@#GJVYxCA)n|!3&)(xHAOH%_wkt(r#^0)ZI z`rB-%eVyPuObKy8yKMxK=hny)`)*Bkd_Qm*p)nILc1`#+WKQtPgs$(DeQkW9Qw}Dl zn$}PJQs_YXR)^E{Q}x0%^WQIu+Y4J}|ms5$qMtZVQ07bH}%EV#8a3s<7Q9b)-; zPuz04DVjs#S{-Br1(J>!J7vW~N3U8i2JnI2kV1<-FoVRpzh`H-pmJ5|xnCcs^`~Xu zjs5e{_QhL|^EtjIqk1sq(?HHDff(38(u)~rNdoR|_wB`iJv5%4$Z}~;GL}DX+kkep z-}$d^ZPJUa1Ag2wN!^Efdg;b5D{;I~!1gQI3UB&J!_4R^oaRyW z!>)Ja`c-T;*aeyPDA8TbB9AvZT3h7w6p}PF*J}og=^Tcz#Ce_ul#=I^$Eyv17L$au z_qzmZ58DME0@g>Pp$qXXVztl`-3xcsYJO5Y!jDFHaTe>o@4@2Z2M{t4K}Fz!9au{VnYa$1yHg(MOWz#(J$XGHU|=zW*RX|0i=HNW|9dCVXl7T~cKl-N zYYG*|9OfJL^j)6ORv$#%IP`gsl$?3f5@2*w=2cjjWqD8{jBpQ=9?((RcI`PZlr3(H z?&3o&8o2A0LsM^1X>%n^#+`E564vw-^)QFlXKwKLKH58dn7CBmQCN^7v)LlqKRz)b z|1Hy3%@4d~iQ}2-#GfA?_A3;a7FJOAOO$MGteL~53*+VBf=8&|{Sq%^ z6H=HwMS)ex`K(LV?3i@z8_%1Tivt&E*eQ1dYpNuNH7dhi?a=`@?c|ew3%TMeeq+DG z>idvBb1hDJ`5E!LlD*s_<2|EY4f@78REP^f*>SIfV-mntTR`bFy9(8CoWu$)x_ zMJB*IwFg|IW#iPU+sm*hn&&5-PM`HpF+AL%>wp-Ju4!)4;i`Xzk<4PvAgNi=@%!i00*1ee;uM6Y{(%6BDu~Z_W12oX4+zFIy{UH}G9w zv?R0wNkQm~!p~y8PM=3_005wr+Yr)5ri`X&v3!bCArE+G{7Lm8$i_$}gSGJ~6nXvf z{@^R?UR8kUV_w?G;Tb!ftpD^XF+N`K*01~2JJ_dM$eU^B>hQ2;LZ(V3kVMRrzCMTh zLG@OB@8C7vYe0w9W@e)Fro??MRqnO8V4Y6#it?v{U?5(U!Xh;2Y+URH`&BuxGe3nC zuX1^GuMeVT-X!ZX7ku)=j$hcOXDx?wwQsR;cG{j^Ie7C^TENEJP+QMhHA% zVqO(_HF<~I)}ygAbng`()vu*o_-luidoN33O=llR-d|UV`@HS)?zLHbVRGaJ&cp21 zd!t{HmnT*x&#gs>S(toM`$Qa<%%tAj-5Y(fUKP2)ycoClw@d^^7Az%Uj2FhV4zoPp z`LyGyZBsFMqel6tkUEN;zs2SCv<-RR9mx3F#JC z*P;QRaquG-Vrl{_A0=I-o9F0SleJ|U#JFYzE@JdEE-W|fpb;%2lw3U6uaw`?fn(I5Kk_a`en~zk zZ$s3gA{XHLuPL2Y#A2CzjVH$_p=T5BEOpCP4g0Q+nwk~Mk{-?32%Q;V7E!6c_-T(x zzR%<=+WM2h_)LZjTlE6xYN%>RWIc7c64=kpAvwdj!^KamoV#+}fUi*oM~}`F`q!T| z8*@ls5etQ%+#T~y5>?#S>x%ifjlWU zUOB%qA?@T{p|U4EEL8X4Hf!D^Kb6_Hyi*s^n3SkGQob}v{KSNEB5}?>J$+M+`|BdX zrMNo$E@m)@c*3}bN84 zrkBJv^^S=#HHil6%tNc&bVF6zrSz1C*%dh#p9nbU(y)=5oF{XJ9`hB`7JIx1)oyx~ z&UiD(O0Ytt6-kK~A30NqF)hYeoqE)C{Mx4+mE@J3m6L}zsbTy~MR(*V@`bjaR8*sM z+>kfKEh~M-rA`Z7V!z_75xNgoL?drTB^;j744x)bc3N}qzR&_^XxZ-VotvI|TA_0v zlBZv&D9%igRpejGO#vk6#qw}>09WPBr72mDh4poBv%Rm_TNllXK^#%z^m?QPj;lm# zoP{njp0q!B5w}%M&V{i z8?nmM=+%I`J8%`fB(eDFt4B7m5%pbtp(O6)nK*aLFt`)7A)Py9l~zZd&eq>w+izXt z=gIclV>oHnhCWgYS)IX<`cEG?6Ht<3TCC0&*z_$2iP~Hp@4qPJN9p~sc3~>rk#9+K zsbRY{>k0oU^~>3)dWC99FP2?$einX1;SrP<23t#@mDsbG`k-$@W!2;itXg4O8{*dT zvZP?|x9W!ta91}Z!_1db>R+5{R22Mi0bm4l8CTg=+aSGcO4yVlX>sx^n7`qgU`ZD;riH z6s>=3A|)jV{=FVh+IHOfIE~g7eUsvDxC(jjj1t_dQFX1&W8>2rGk;y!$4k%34dPp{ zG#S{;m%JL!)Wi9#FRS_K``Z-l#&CATX zPh6cTC_Y}Z(dk7X@kaQHifE|X$PNTN)pmC7o>HP=(ScBExUFhMkemnCeU9{2yTz%+ zICf3kf&h}l6!n%>RWYrv2Ko=u(!@$xdgnd}=jsr18YGyCL}!HpY^S{I8m>QrL58JUy(&>u?{Bd%ctR4*Ue(C@0A1-J{X8>$vV5_+V|(_j#Ml&!Mvui6P|b1qd)dsb&NQQqRKr zIT%(NB*aums7T5|O^g98fc%#U6AjjA=-o3t0?44rwJ8FHo zTXEf#n(24!#iy3;bM?`@F%m{VWTu7obK71r!)?~{RY@A0xlNd>@tvxg)EaC~mYts5 zJhab1vp{K}b17iMH(6u&pXCd8aNMDM=n6T5O?e4*JFR$%RKQOv3X#Xxe@xJLtrT{9 zmuw9U{P{gI{qn8%<3dd0OJj$Z@Yd99ZD?Cr&wm76&W$!DV)Oo;YnPO;c*T3Iw;|z6 z(ZiO5$8%tFrD6#ZVLUSX^7RhZeLLg#wYLG=zc857Yp^v2oOADH3-|h^Br@x2&s%dO z@J0MdlYA>5Q{JfsMo%cGNZXgy3NK6^)1>sBO4i(8yPMv({QusKG1&)sHqlvv(S5(P z?30FAPBl-KUw=P6_7MZILSXxqN}lfh-SIS3R}+n1OyW)e57If0Cxg*rlowr`r7(WLL=JWOG9;jr3IAch^th zpD4Pf&Q!rneHa@NzfJn5fnoH^otZd?r!V4d_l6xht0wJb|$f@NS<&OtG z%lcFL8|L;Dr2o7z-pWfUE(#3mI>>b7#9o7$?(W25zs}&GApgk*^ko0H6y-K(r{9lO zQ%zBnKRLAd!lkH`ncsCLgrnT0E@%sQjAeSe()Z-=$==DiBz(5!!jE^C`*U}cUL_M; zto6}+UrvQ>2D>|7I;3-n_)^y0rdHv*y6L;DwOKEa&(#XP=u)HYl~abNwuI;WH$6co zVo_lT{KW75AF|NihSmdGdpA%?{Zr%}ie%5e{+1$J3)v%Qe8a|REL}a4w)G0@^+L}m zlF~KzzBC94X$2UyNk|a+)6t<&{!&7vOpC1ikgtAEE$D1!v$SH@w9`7*$FuScfIH%c z51GgLCk}`|qfo#`W(8*Ui3}QI@75=kxg*&(hL4yXnn(LV;*m5qCwU zhhETXeOdjE!*KUV8+9{Z;-S^2)kU8v0d?KDJ$s*T*}29jNkMCuTO@a1Ii+qv*FE;W zF|HuZlsFTYCe)p8>K##x<2`pxd%xsT_I8#2R6XRv(9w%Xau2d-pz}VTL#^aIztt=R z&(zXCKAR?DNR{HCuquCdXLq1cn=aXuUa(1S*tX*}GKX3{?uJjlN}@-;<*u56G?7?V z6H|}P@NFA~VYpDgjisEY4MwanZm*wou3utT>{rR`7M{mkZyMsTVg^}Q<6A+>NnagI1CLJ zMSX1x_jz_>W(b7^l{M6Q$EPi=m+)gyCf#Io$u&8I32^oOj_5a9sk&Nmt*xoG@3yc< zpRt!1D}Nf7i*3P~M@2Td{uP85(q7s5>?ZR7sp7d;6|VV%UX;_u&_y&bMr8}NM!)o| zMKJf%d-abrmb58VhVqBGiocM>Jm3-|2qjzHIC$n(1@z^rkG#ps3JJ=-$jq~`I!z(CFgT=Ni;1QTCY;0v#|T)AI9cQtxC}P zJJk{QA1>q}O^&sEHpsN9wWx43KvjjHs3}tNme?(5R=hL{Go119L3)qiL0vtt&L6yz zft|Z02_7{&LLNAG7nLeuNu|)A9jDL?d6b_pge1ProKQVijD4e4K9r1o_NX`%w0JO_6-g!%8@?8JN?J zYR8#h!cZHF;VuSwe;Qb}^XfsZ8ed^+w%<6)P7n$1% zN&HWnri>&kD$aS3412JP?pL5ES&5=z@gHLklE3Yfuepc6Un6&KW(V!^S!ZLme%VCN zOzIR#+(+`MapZsRbF9*4Lus-h=oKa>!3xNjuq64D%AroK3P%Z*HubQ!DN{G!+ism! z_UsTutw#&b+m;+pw+9afmnRPd7+plsAh2Q6NjlsDZ{t#2-!W6C z5qX}2iC65iP*E$o{|9b!e(;0M4W`4I!D(+(o)I~0=l*b(w|s^2I%fnu0iA#K1UQ{% zG<_C1CtdPwh9kc&QwCf};ua&>BnUw2DZ9+-Pmy)sY#amtt9Bz+zObV^u`np+g$!hG z$l3;PKqGhgs}yg4&5fY$0#ZY^4*jF$G2hP4K`Dpx3ywPjy~aIRd?QW>UPwJQ*^#p_ zcsWr5X#qW%7}{jTE&sFS(EKH(4g-))gh-6*08FD9%`HZjl&rI*59j^d@JmSV4=U*w zwgp<~X3|BfeOssd245ofDvw(d6(9vWMczG)%#VL-{+_bCtIff?k;y@~U&6TRv5QoN zu26YXBD=X;uBkF%xi9Q&^~~}t^V!d!nVU(nOfkC`o9a6EQ%FLk4szj^U2|gnYzs^V zt@2u4sor*-9}%UT;}$jSs!VV6Ied2NUiPO&=iZVGaohTS%VTe2wtObOJC6Sm>PsCQ zuspVTgTOdVLm#6O3>eJbr?^$9rvF|xP)n-{9TUg&-(WQH$@dHLIj!%x=1|60C|4HZ+|@4mb|K+-Sqo3W4|Q?xz5_~5i z^R_LW8d4D6>m%`f$O@byzU7-JZe;1&LS<-O*7{sT^xEgg84|D7Kq}>{ce$Ix!QHLv zbIJ}DQ8@EasO_0ywYbuK&fC;84j{PFU&*w8K6TolC< zErsE~VPf}4J$4JJ$I>keOxmfStvRU;|RVAlkfxXIVCf2b^d|;vD1@@u7>5M7Y1rgI0`bbd#tMF#A}Aw`O3# zcEFo9aC%T%RK&^$_huyW8RrSJ?}ZlyT5@rREbnb6o2IJ>_}ZY5I_}Q>BAVz8=+Jw& z;fB<3#`>tt6eFr)+M0~qE$0?iPLZK(-Zk=LGIfIQt;s7rE}qbImGMH@@dmq^xCfTC zgNZ>x@9Gwo<$J2;zPTweP1{0po7>LV-uafm=Vy{@aH0d78@OuRq4Oi}8Y+e6`aY4^ z4ttEAP>+4-*T8H6{rTG!U)<#gwozn7?+y+Acud~I3mD1At=T^7zw zCfPn+Lob7t+)6;36PVswv=ttK7AuL_eFV5}nX+7-8AqN#FF7#%nBkG=*2*vM^pv+o zbYjeNnGWB%fiMn^BygV0wD+;zFJ{u8a_DNaq0m6CMzfIDUuPAglj$nzxICI{Q)cPr zG_4laR}ol_rESs&F}uIBvgU7W(3Gv--6#RNQ14Y!o5_#|=03=;03y0GI*|5&6BiX& zjz4Ow9ls5lq2``lvC(RG^NlB+YZ(BD`>~qUF*TF=;Pc$CYJ$2?xaap}$M6i4Y2A1r zQDWQ}2w9E(+mfHGj;}OOarc-PRsoi?Pds5VuXOor$eQdjtYS4PGtPJ`j^1Uh2&DXV zv83YJF+})^JU{W4(DT@X@*kH_OZwqo5(Q!fe?oI8k*sIq)%;=k`)#%$BY}?lFJMhj z%(@0;JcCm}Q+h_&JRE_lW+b*dKyT2G)LomACVLi?CeLqbCrNlxrG##hmaQD6AE>4W z-vCfAQC2Ab#)pTsBTvFM&-0~e)cJk0z@w+m4T7DD8=)^(Z%FvH&A|zWybUGOxq;C0 zc(e^&`TF{bitT*3n0x!us`S8?f9y3L8CQ>JDItmKCW|{O6RI=(Ztna$*S<6DZc@lk zC~^YEiF@*dAWTpuR_>b7C91Tntn>7mi$l2s)rN-Acygh=)waN|(2*X^qRHZWnxz|R z`R_Fn#v}@f-*++oPX^HblM^9YRu04@{iJ8V@Y(EG(h%N0wr1h_+3TLD*JIWC@tP?z zY<(+|I9S~XHA6QH9&0S1sFlz?ZDji6uwqcxSX&CUo?}aMZH>)Sk?YK}v_aH#?`dwk zw+2_|$CXnbcc76xwZqHAo543mpZAE7@rC}4=H}bUZiGeM0`ttfw3t3?*q4&TEiTc! zZiLXZFhzc=_Q`=p?;I`X$G(w6;h@e|<0QB1rqWiw$w}K=1GTuZ?4!4;y>0D$r+Vg; zE_aD|Y;xT%x+cT)Ema4mv=D9i5_bs)ERjr`VpZy#UAa$g9y8K6oN;lfMkJ4LzTElr z#b0qiFPTG?1q&^b%!Cw4aP7#J=yP5e$`hx!Ao`oX%`0A`WA_Njw80R3p;RwuZ?C^sqIbdJXk6!XvS5wf+_4n7 zC6{E*7cU<1$oD9UTjPlwdJ5O!(ZJDko`FRX0YcoV+b?0<25y1EcfS5~iXsTw%Fn)g zsMgR?r_?PB{kJq$K?TpBw(e6-T9@MIM_bf$Ex82gpz5=Da;#lh)XI1(1mki2m79_i zlt65Yr{{@-A#~)&ug?b$Bld>D<~_~eB|%q!q&R9TaO)DD|FH7)NFGtOZL{A}NG^Jc zt9DUM+Xs@dYg)2m#<`DYSi4$oetfi4&yu;%T>8s>%8u@j>bhFbltS)8051UxLPPRf ze2TkTRb1D4p{4S*^f*3b%pn<{P9JxC`8fFp&>u(}bS0ea(HcyrVj5-X7>(mX47>CR z8{fn~_|~Jb3@ezSkGlqCuV$77VO;iCQ7tA1@vOm+4W9lR z3wuqQ8%LG!)_lvHgysiXSR@&JNbRz)AJyZ>D#(VF&R6NPx7nsMY5vTz|7=mAQ?-}%gxZ@8@d;JFO-I=i_eQ@YdVdn=ZHj){zvE28v$=`PxSE?> zS8xj-c@&W=vp)tCMlzY>y08>E9_7#rLvj-be`Ijhka*;La)GJGtYv0X>1@9u5(=kS zAx)jFTQ%~2K-EKINTHvKu*()yOK*GVJ4*nbYU}=>FZ&N3YvmICjCae6MtXOWFY+$n zZNn5xu-yY_p

Pui#K*@a3+gF+HJC;7p#x@4Cl2eZd98(v(g3&gcJ*_D}C-HEuQ( z852$ymS)PRL2R)LO_!?k`$nH~F)1#)OcJkvzHlp3hI3P5F)qzn;P!S~oMpvlICGLC zGcBau-5zp>I4q2Rt5oL;?FE6I3)n4qE{G0+I$zT*WcQICcd*qFzpz)UM5@qqaio29 z;r;e!3_BtE&~4g)LJ)TG=R=A18<4;5Hh3*?VZ?Wv())XC-V4sCMT}8StOVj>qsi{6 z_?9op7$_mDkl#5TaY;u$d!v)m`r<6|7Q@L$R_J8z8_?_ayi(o4-BlstVFPTQA0a&D z`mE=)ie}CmHRuN4CfxeA)+1Er6qNb>QCuX5yY|=dJF17R zj&dhI0#B^M9ZT!ev-EsmE`A>{%Ku}F^ohTgj=pAL)113I052jimEv5zwL$f{@S&E9 zrN$ri;rHv*ktK8$aPA~LP^bRje{r2W|CLV*63Ap*L(J_?6rLx+A(90j&r^~O9?T(~K4N= z(AHv9Z||zMJEHhm_0x$uch26s0A2L~E_eOBm!1EDu<+8GSbpU(v{7cH$d3=oA9rlu za1&}0+2;hjfPL)AfTo3zW?Y^g*YycOD(0$uy0YMMUZ@1lzsKH*JQ}V)z&#=F=1+W8 zmKi8rycP(kX9}wK(nvcW#{)G_gL$2~hK-pj&*6Tm?z7oMD1S40bBqsm;{qqoxd;;W z3EaJxn$mE-!*>;$vuX!Ui=Mvx---@}Z4fFhKhx`Oc@mj@IO&ZBm%H=Npv^nnZ!IyV z{b7q@h<9Pzb0UY9Dy)RE6c(;9qY6>}vI99=9w2_!UkR%dGgFB$3?2HSE$NR2S!u2B zgwvBXn{91I^_zrUzyHQ65#8F?BQ{_Y*nRg8em6Re>Ysi#P9$J-wAH$wu6Vqww>*6ePUjQEpt9^AdbB7UCmRLX$pC9RJR-B>ck%k+D@d*e4JoMxZs0Ht9m zcsNES72Bs+X$h=&cA+nelurCI^|SR6YZ3 z&1N33@Xcm=5x|Ruh2VdwBwDAORXQ(kJte?L0xs*v=!R+2C=7jBeW1X zQ1)R-xFT$G`GkjU$djRa(kp8r>!srBl-m2FrzS`|YH+#$dn!!z!dOjN)@Bx&hv~~R z3aUE}z{eC>|M~Wd2l#?=3yFL&6FFt#avur&OK(V_WMnO!f;uL6T059l>J2+FcoE3H z%M}xdAnSax#ua)=-5B}Jy|rY7MbYDuy(;d9ZRWkLwHBE6`|T5QqZU1JamcAIry^=` zeV&baoSF`rah_(kPPmq(R2sIi=|7dgz*&G#{vwO5@Hco`kCpz)cBY0jPaa1go?M*bbv5!+)zHeC8Qy@rsS9TjU%HvPQviE4>=Q zL+b0v$swJ{U3>jd!mE)dD9G1tH==WbUF)2IzFtYxAm91U^PTQ>0DLhJo~k29dG(ln zh~<6G36u`{_$}rT)3O+bRpob9KRH(hMOam*eWOV2UiCNy^;RWfyF`QRa7)M{^!gTG|8?b1 zLww4EuH$ESs;7#3?$U^kKOr(6e{akT+BUBAS^1gIk~vS)+1Y0_zo<62_IDLo6N8qg z;jlPbk#SL}(mx0{9J1rc+1E%lEmc&Sha>q3r-*~5*xAZoBq(o|Hjj&Jj8B)6&{bP+ zznSExF(gbDxo)N)olrWx!^=_cvBg=}uJ17umHwpAl+)hX@C!fV& zn07y1)F8IamU^}&$W#3PNryL2&)>I9?AS&LX-pxNe`PvRMboI>+@RUgWT7~qNQRG$ z+s17!1r`~b7PRi~{*mAElxIfM@wE;je4<@OKqy0zIea3O?U!k>Q!@!6Q0q|d%#7D7 z0Z7O!Sl_GR`+!qwyEEn3-JM^4)xTg58&`#J#yy#B zh}Vp#?;?CugH*l0zI0TL^c_~N^)^(x-2>A3&t6u9@4CFocC|SQ_UfT8s3Er#vaU65 z?^)ZVpJYf-I1w2tdRe^llMZOurrfpq?Xgu!s6&O@z4jo}oR!1cKhlp^d{2woL)eM9 zfAG&`#v5_JZ}k_sVy;%Q0BYH^j;1*_^f5YV^>uvGo1w&{%zmWb&(H3D!BpBHMne>0 z=Upu^$Z|LcS+*WNf6}_fXHXUqe>>6>?M8ItIIgRZ6aMlg*NfWlm(r6`)j92(XEv`> zQ@&qBvCBDf{5iD<9quF=HC8|g$<2fbo2B*-38iTDUmq;}rzZs(R`$53y9n>0 zRvvycWj?l^Y`I*9AvEJ?L}g}l04z)K7nZf%(HAi5Z4x3T@27EFuHzNs$Sr^V0McD0 zn2;*Y7yqG1FDAz4}By^7%r- za`p?l-f(8E31JRPo?eL%2c4zuOw$jnTg|3--zIDGz_#$FXOH!rT z*%pH_wHA|~HNR~$M1=Pm9cleBQ$F*Zjnw{C+pd58%D?|T8ng4ihBmWb`}gns>$|-j|9jzoj>Z3m;$M>j@xP(?-%$MD z2>jnS|8KKGT<6CHrmclR;ao=KLua-QRxhUzRD4k3xd6*`F8h)@K*A>2ptDq?XaA}O z)Bo?y{_h(PC5`!g*NUos?sg#+VQFBq@b|BC<$`+QU{QH{z>8c60S8U())#a@R{Zwn zy;zy+?@ZCxHiKO{vZ85!{QWOsA2EyzRFOM(Uk5aF&G(R-%=c&9@i;D&k!v7 z%91UTSS4ob|HD@gp<<|=wDXy?Q%BXlYapE+)nVa<##|-DKzv6E{Fk?~EfZ|eNIGdg zO{t}n8NShCXvqKm6`mU}zD-R+)ZiUNILw6nhn*<`@mkBMO22Wdj>eJ?J(!*fCnFd? zUfibhDl2En?+4EW7<~orPRC;Ga=y;<`AS)#uVCI;7_{U(m~#r;_0c_r{Ig1zuNH@f z)E1aaiP_fI0aDP?k)ub=PCw`Q4v-H?MiVTCPmyp7n$_8K2&}lp5F>%_0LrM<6>Q^r zsyuH}JDt`x#(=oKn@a)%BzkkOvYrOXFa?7zv~|CD@ApzB*8KtA>Q@1{sD;K@Az+$G z0_uBOo}JE2DVo`02=$U1<`~so2v|qD$^CsK5DlwGG}XiVO1*QCU`tQuJnqo?vIivS zEicX%$O=)4>gG@IC99d1J9Sr-B`73co`-XGpAf(hH1 z=856kcJx#6U?>bq97?>cAe>nx4yxle+SU2{fblYx&D>c}n;0AbLw85umHQB>!npfr zTb9$wwtmkCd^&ZYQ2F~;_`=2b;|=Sy^uAn!%xQ4PA51u9YUO#S(j7lY=akh72qYKU zNX!YIn-n^(btTX0%>(Q*!NnxsSk&El-H8{}T||JceS1i438GI2`WAIjpj*a@UT0LM z41!EQ?eFghm6eDl$F&hgiw-n-1fZhUiQYPR#;(ND4ciU3YD@=M;xFe%p6Xcu_W~Q#PA3G*P+oGv{BTim{Hva(+3m2G$%RACC=6=ErX$@H-l_kOvGkpH~U@l1Fu zpKNZ>iJ42BfFmwahMPElqV7B5Tou3FQUW1!%y;n(3UkfY!Tg zL8HikSEBoaY8r#;&U?qH+TQNCtCC zLc}ezAMu17_f9&wPc81rql0J6z;3!u@4EE-6^K81Yu}Ot<=x-EVD`a^@)_uy$khj2 zP*QIN8hr&HY*!tst21~<%x5>f^&0(RlBHn)Pb;{%{;ASW*JboSHfG=NhyMf!XJPPz zb)VPhYr*2THsyprRh351GNB)M@al1(U-*6CGVKK#(lijA2D?r{N3#4lMy3?zo<&=l z;z01xGwqd6YAesu0+*Ntbjkd&uti^TK&y zVcnOrN>rT=6&$+3w5f8l-fme?XobHG9 zenN)@*lOGX)Ylk?Ha>YEQota?ZUAn~AFz4`3`Hx-pOA4ei~v^-Phd{F3uC2+L6&m( zS_1Qb^KEgFb!{)GF0gOj#lBB*uX6&$ScOA+NDs8hxq5NAWV|P2eLVOtJMfVu?d6>Z zo}U?YNdba4Pqz>{p#q#lCE(RfZLOObt5S&E%vcJ~<%3t%1Pa$n>_{2@2{q+NMPI=(SlyC@dE&RSi^h4zIaWi1R46NW6kis8sCBtrCX19VcAXb z@?*eiW)e3#uE6$bH6P8c^Cy@HlIO}}mmdasM}ayFY;y-3#TsG0@3-fv(2Y4E<n4~6zcfo}S=^Hly1*s%dl0nm8@U9Iod@Qsi{{EF``x#al0I;lHYmDqOyD<+aig~&c zc0fbaGh?aPtn}DBjg$3Y5>YGotoJ*WMkTc^Q)1TW@I3hoe6$L3Iw)qH{fKeM5UOpu zq$vY_vK|X!n%QbGQ;cU?R`D5oXu`_B?EwGv{vP$e@^jCM%ef$>2zLf)= zs;9@jcW*({b8vAXGIl6nHP#q79FvEo_ZrXI2f4gku=c|?Tin;Cymh#Mgjaw~Cl1z? zihjVk07rC_nETJFc_{da1UQZq2T(b>z&pep+&SPl*jIYvc+Fn@|8ja&xqs|`y@r2G&HuGs{`H6={x=l= z8;bv2L;jy9Up4?GN)-w+y=}xnC(v-X-a3kyRgEW>iDm7feLgB6`5C!O*fUpmZQ`Jay2x9LlU} zZ-(zU5rQ8kb(r>Y1Atr#)*V&JgTHP)driUjkWs5J+=*B(*nrPJt45Ctc=bUD-x)^5 z$;e$A?9Z5N>|rBBvDo%Ok|GjZ*xl$${@qjEGWK6Mx39FeGcai&>NCpVDCR=)8yXbf zWw3Gwd1v#PS_i%vZ4G(CAP%1}E&8dW!xyTL3G2UYE5|G+$tboN?E&p0)glo>H49m5 z#*J&Bm@S8cRFHRi82Cc)kvrZzOceFb181l&v4_v!*h*D!VjN({?qmIfXnsrUHNGUv zoY>U5JWb(*sryyV;9IACVV)SA*akawAFE{jHK?JM#^hu}4U=uAY;$>|AA;uZo@B8v zQ|x7Mgac>fkkCsYq8Y}8#Ulq{+ z_%^gzYom427(3Tv>7I&5{(tSAc{tR4-}gmQ)Tu~{q=jsylqD2W+4m)~6WRBDnUST= zBxDyM`#x0Gv6r%xL6)(PvJA%9$2OMdGuM4T&vBjC{rvm<_xP(r$6=ZA{e3^n`~7-f z{XZvz@{epC*q&zbtUx#O9sC~8V6pY-&AHotxFkyL0)TfX$b2ZHrlkijN;viY--wNO z_sFB4A6G8qctKsO59QIQ_f878`!j*Z#YrqTOh#3e>AlAgi44Q%!M82OZDkK3fhW%2 zX>w|)iJpdrQ1%0Q+?2u^gZ|f9Y5t>MCmURs-jWd91h$KxDQt4b%$*zeD!~}QGbE4f z7Vq}ejKKo^quQP=L!ML+Od|9Z*n=G_qZWmc2Q!Hmv4i4(E-@Ih)&rItyW*qv`>q+5 z^xRVUX%Gb%qFegpEBWg0_e2S4ZH`kNX}&w}mbtQFB|Hf12jk0HX?J}~bbmY^$gyX2 z#)QU7o0=4vmZojaEkK3u^sjQ`QN=#l(+iTq$WT8xLZLa{HOEw zyM5m&T^J>f2_|hL@Z($I5LIo^(weg#8CD_L0@Z<;{j^U`0v8UtfZ^hy&%g$9`j4Jd z0YO>XA9|%OwVmxxy+-lo!Pvvd#SJVIW0aO$)NkE}HSSCygk#ynLq-%FSTxl0xLo*GB(d|}al3144o$|j{Lr17XbB@VugJFQRT3_Ljh^SyX4Wr^#3T|gr}+AJoW z+Bc*tcD@%NXSEM$jMd>+@e1R_#|ogTztDp`e7sb@<_oyciQ}z*$MD7JKo1@`*aPXF zVC6*ZDJfXjV!CwXL-|ufzE=r*wWH{7l~S^+AZd|^*JEyUTQkzzlt_$ws}W}zE9xjw zWSsZ7SU$E0Ou0Yd)PkeLcu&7{{Di1Q%PW~}#iyHN-s#H8=E6yFs(Z2jG7=h; zyQF&}Dde6a_X`1K755Hy*A`3X*I>2=Gpzb&U>T}R7O@+A9z;WY$?oLxBgc||=>@f; zIjC;x`2KMq-|lcJQU8n(6LC4zK!0H$l0k@|F|2^s$`6+e9^K6i2oSAqB34VKf&kll z%=2-EEUg%IQ?ax45Dnv9GbqN_8bqLOEj_^|%v-kSos%>%rQ!bd1nD}=={8`zH&Rqu zKhI?5VT6zvPnGa0hrkCv?YDg%e_a6K6aW>I8P0U2OE>mILMZu6hAe3={6?M4m6uU2 z?MiIo1%4HF<5hUNdn6p^{rRadcV(rz!aurBQ;ERx99p9Lt6I}){>bp*_fNu@xJMNp zvfZ-+7qqc#g7YsuW*X1ELt-%oAStaYz^gTSLXx0>$*zUH%TpR>yPv1GOg>t0OZu(n zE4#?fYu0)>61p?8raMzwpQ)sqgRHSO;=K4TvM4`EEbihO$fj$eU&jgee#WPu1n+lb ztx*&mwJn~h>Zy9ExCx|{B|j%W5C4trwdv0gtAuv@XJ-3R$FLZx*em{jvAzkIh0?sv z_p_MDbT==(Uk5t4y~;^4wK^m;>movv`sccHZtdn#RUDFBLctd%zQ+k^uX&qT&z#$r=@~sHvcIEv=DSY9yJB-`+7||i3(59{FvK4*y8H%X?~wmKzYZuNeevn! z#YP;6bpHM0B(T#C&GfZvQ-)JdBHxPx9S4ld-^VGJBfxM_3}yhH$$}YA`(u=mEya-w zf5rnT0)@b>8-zeqN5FSDox5HO6MV{b%)ft zh+i%}k66FWx9>%N+cYZLwFykPVS47bk3FYBrOoe|0vKg=rb=QXidSG1i?)rnMK?qR z?2=4+cjqVpE&{DPsldzq1hs>FEiw=R?Vab9lKchAu)|5bUW&YMn+#Tf#l0!TSc?Fq zdbt}0;LVt*3vh;`w3?fiB7LxXTdn!eaHXi@$RJc9H3ZSEJL>PZbjz){S6zGWO7QTT z8a&27nO2*=AsAzCSpH_96xVZ$fGzb7dsxD$P&Z*0&&lo7@~D1?1%F7{Uo5VRxj`M3H?IiAkuK0$u$c{SXQBfG0(Ft2~UhpRpeQr%SwAo z=>iAnQyl)+^Yq|?A1xm&G^s}`za50G_WDsHc>x;2fKX>FPn2${=2(irGwUK#j8|&W zUkQVK_lLdvgQ9;_AeF78BqS~*t2@4q^u%LQ9eXk#Ir-M>=+zGiAhXP7(HhhVkvIsy zo=`m@nFn_;etriAsNXpBaLplf#{MZnPrv(cV++zVcGTJn=k0}Si{5Rj>aY!E42xh7 zBbP$2GsN)(wtQ&2Y(v6}#}ii>miF z(FW7>wQFmp|EEc`C7F{U_0sgx__`MnCd2 zR>5XPM#$yCqs$qrR{VrHp_-Tfshzrq$?o39kI;0VywzK7eF|dyIxhrJE@5wbR(|*_ zi+B6=SM~ZvTtja(rAwpTuSOHn2iK){t=8-3>5e(k?d=`UwfZxRd^J$ikdOJ8(DTVI zy&}D*|M!ac5$o9V`1`F7Nudc?<)x6Q-p^h4*iD|1ehJNu)png*lK=OkPt{@yaO`VO z(1U+*NLW6(WnBs0f8M(;w?$9i8QC0bpvdoQK5)@;!c~J?JhlX$XK(fS$Is0y={Ev_ zursE;15oTq>fuNZX{VaCsgII0jR%mb7fSaswG*PRhXAE@US%JQQNgI(tAORA9L@zCu$}WSY)^r>fL&HRu0k5NvaRJdQPV`=T zvPcRUalPo&?Q%w|AMtB5Drfr(jVCc5!9tWHu;sK>Rp?IaX_o{f2H*#y)3QT2ZH)71V?1;i^KHP;s2E=R^+Ppzde zG3iJ7=b^^McF>~O8yl9Ricl5ReRP>mB`jJL>;av^!l%`u+Pg8ERJ3ah)3n7M#C$>C zsCOpezUPO)u~&h{1eTQ5dF^E4Rf;p*e7|sy5O1qiPBErTWCs z&tGY8@NgZx_m~}QR*DxSqUcf?IT(z27%P0+Kr+hlJAg}$T)N*2tb!8T&(9XwHo!8H z?_Pxa<(yW43Gedcz#>y-G`Drc`#rsHbywO*de*~;`S!A5PQ5trI0|)d7a!b&dF}`r z9@FT^~YiF{H_6@|H+i2gZ0cL`hOiuTGQ=Zkm}j>8K~oe1Z;?Uw{oyG9^Q&FpL#SZB$d7<0XQ zQkbp(=egSpK&bc#qQNJycd9SQtFZ08>LPWd`WEWxruxKLyOF*d{O4^(O7k_EQ*OW6 zDd?%7+usFjU!(mJ#>13pWdCp6Uv_)^fqxFtOwbn)NZ$x`a>isqXkdJva8Q?loM-rq z0KEGGrp-)$&OS^ykI(4ojG&&L<@<4=T5zxOmT5!4M$4pnwY|Jz7USr_bN|_p1}rJZ zE!%Bil9V=X@Q>#gSN222=aiiW5a7!h2DRS4rOtiH$nG`3MMry)FFMmKh`Q2s@~S-q zxWarud8x`7=R~2T-uG_~dIIv|Pe2c=z9_!u6>@}RT;>5a+9xnY;-Fb~nEqiplMsG_ zR^GM-#JlK;o3zUa5%XaGFWw%fRf;BzX=zNrEL`3kjC9%gZ=<7AGBpQF6X`2sO39<} z1gDgWQY9zo@@^PuMF`su{6yfTzddQp>GFd=ixJ}I_XJm7Jyc!lUDq$PN%rEjhT!`d zr^Uu!^9^H|?@Az2R|(P{o$rUVZ8F?HMolwd5?U;oTL2ujO>e`y8S3`9v+I<_I9(9w z2wjLAPXjssgCd7~s(O40RDNh8_7eqKK9JK?5t=C@3vQp0!1C5~pD#dexA&ayb5$>n zR69WK8K3L1IZ5B4dvfw^bI91n90@X1t3%IlSMr+GYnd5XqOU?^@)Xj4Z^!c((^QEk z|8xC7&oqD|{YEg~PVJ>&m8g^>@-v8fH3QnSo~m;aHeOic@zGP1!3moPdI;1WRum(W zVdb+A=hc#h+e^d%>?F7>R2k!E7+2SG$E7aL;d21^bqEGls#Z==Sy*46T=5(M_*=Bn z>4_RU62J5OJ0fFT#qY23)e`cpk46gZmEg*sMWeBg{OdgTY4|X&K&8Wq zHg!3{b&#{#59tMo`Pl@GEX!^D4{0xY2P~;5`-F6o3ASWj1`4A7SOc|EX!dGtKW0Sd z$7N@`p|a^U4Z&^9#(E7P&vR#gm^cs;2aWL7y%`VaYPV-njQz9L`s#ecm)-Ml$wCOU zKzct-;~G@WzRHiX4~G|_(7%o_o?GZBPtbj$YnV++vppSpTazht7}dl-`tesj(-YW3 zH0-V_+as6mIfaIqQJ@*v*O9&fd_Lsbr3QC$z>rm9ZM4bdUJ?AJwD9T!7a1Q}pWU!l z7Qh!oSgxooc~j%J_{GvusFJf4eC4JBkw%1*ctl&dpvxOlYK+Tb z?ST|l^d7~YHL_Uc&h{j4F13f}qrmSBw`qPSj}L7KA!0~}!P?B`_aqr+6|2c@e7d`1 z6NW?5$d^RWFy>TZLtoTL%)cHv`Vw#m(~EcPIT7;$;~tZ$iw1h+z!67PqxunOHDulm z&PNV423ZBeB%@RH#syn{&yq@eEGGT{ggI=LjwbJPC3DtLpC+}XKUftd^iAjw@|+kxra$Q+6x)Uo7qqAz1SYImK+ME%?mk4GHF(&zx>$c53y=&CRe~_ zabsl3rP%`ZkL92UsJ^HUF3Ug%_Zf`)eMi4SZwKm?hwU`rJS{E(J~Kj)X%J;ilTM18 zonEQj!Vjj_^h!XX^VgL^~hb#XdTvi725{{vUW%J7o;e!FT3i`K|g!L#Feli7z)a4Um-H0BdhvtEA_ zO&DD<{bX4nkkV|W(wJj5MOo?k#(A(B%f4#RcAFe=uIE6$uSh#Ya|GSwNh}IRPRfpm z`YfNMOs=T0YJRM*iVxEmvxm_tQ z6gxbMC4LB6aENeuxnby8`sSSERoS6_(})i%@HD9P`@KUzdG|7-_Y$F}zkWA}K$)I_ zs>Bx;s>!jkF;c%U(HydNz40LG0kB09Y=KtF+ zu)IVJH`-Q0fN8cT-b`-7pZoqcrUEq%JuN%w!CH97NcW`&qZKH7t=2z*2V~Q&n(m!A zhb(&~gmh}@Y<_yysgp4N%USje-?5NbGH`}&qr_xlN0PnbP@=KdyIO0X+hryErBaU0 z@Q#joE1_#vaw)t3Y>ZrbPs6M}*{NR~<<=(-)sO6vwx=%} z55K~j5+jB=h?DkXweo|aCF=P42Y*|S;wO+Y9>ky-J&RmS>5i@tw*r@ksRAZvkJl9S zengBr$~Lh4x>US12`};`hO1BL)irTUNaRoy+(RIs91jZ?73SWuOMo==_OL4kM`?M*iCw+CCchVV|A`Roh$QV z;lxGh^x%>53$zu+T9>a~>|)%}Gy4VM3uEPNqK>1p)bZ=Wb`dS74C$%r*Ff{8{j$nw z=uhr;*v+Tk0~UkZ19}_ZEmGfP3C-uRpzCF>Wnd9p2+o-C3F;qCZ2XJEZAn0<`tld_ zpDULlzrtlZ7P}K-i`Zw*@mzr09{vhPDiO8*tDiB>%i<3{G-f2MEHaf=Lgk%n_2nA+#a@2D}6I80wzBrx=$valFrQflrg2{=-pq4eQ2ZZ+2EA# z9irUvfCpLFI38F=#ElatTV;A=C$#$e=Ss}7I{idH(u3YrfcG{-enn}3z_ ze&2Dp!{6hNn{jIuZia_#sw19Ie1#@00+4eB;J)|Q7QWoZf?6oL#-DLDsq#syA~_Q+ zp$|jHI`5Cn>F!H}-n=M=Vm(vHrKlZMxT$0|{K={aHb&hrQMAz3D>bUP)lsuj>e{w`K(OE>j@5+#uFN!WIYtWf=%hjKpt}D z+c$M=vt4cfOG3cT70Cie4fd5yoV>&DV4w|`dCWmlIMenn!RVnH@)xgw5~fe#RVUuA#G9v777OglhXuFy2+E!j9U}iYp`r2l$8KhR$PmN%^wJ(9!{I!F z{%qTOw7HD_Q%BmBzZtUY)-aM^Y3f2uDFg%18p$8!<%gIH|5B=IvGLh+L^oJ5y4^RV ze;=-XF(z$lWGlh&GS?TKe3u-+*z@epwb3h3aMTQ#hSd)GQ^CLDPG+?vO+?dr7y;%X zfdRv>J)`CAu)e+vVDj3fNq#t`=nwb3mtqk#g#&c=w7w|eRUq+uJ&6rrMEWKkU~J^b)NfmZ%I*Qz$Y>l;j3C({B-Ck{|!XoDj1Vz^NE z?W=yl6gidU6}dMq_q);G>5iX0>8SNq{eFh@-f6`41|g)nugbUHlA%A#n%^4vOKW3c z$jI=m1|@-B%$hX|DSDXLmUWKHYVQvn*1WrYlMQ1&{-^?gAI1GtPQ%s?D1Nr8h0m~V+ z&xHAv_XB*##P=3!mqvH-78W0z`i`E0tRy031Cpr!fnd2&T-MXc6cecCQGXmLp2J>> z?b7pATcj5lRoP0)*~7kM(#2TfF=d+S!gg{~ry~CNQO;d%b{MpJ9_gHZvzN$T1J?-a z4m@JFRAn`oLMrE)f~4#C@^oQd&MlE2vBoU(kQ^g$b8lBkGvyi)k_yjwTz`gmcf ztW&TccTICd$YIcWQR0nS0AYTtHnUQ^8M~t{Eq~zOtoW!WtU#T&km2BXzzy0}`I3;! zYa`Dm4tKTPhzQ`ZE=utzrpc3bd2`^^ej=JLNG_~?c;Bp0K-USmH_ZzATTRctKrDKo zB&r5O+TQE?OrqJ1{Hkl4CDhpV2t6K};`0;}7xi0aH9>MP3mPfuQ} z!GxfqXLnYWDzy+r1j2tIHO~Yf{!vCN_=KfVO={naXELV<|IR^npPow z#%cd{{ps^(RGJ;=%Oadi4st#S(F(ODrXRfx8nsO_W%ms#{PhN4(%M8bWOt-WRQtZ zhG2G(;CiQs*e9f%(c{OliO82ibJ-Cw(S6kgA-5^Kaa;4^It({U@a*@9lp5%M5iJe& zHSbx?ku;r{r-s4l57W;=dc%2S8broTP@@6kG|qd4<9!6Ro`_Zpc=;_T`%B8a?=kdo zKi&#uG5i%})OwXxx=ie9p#ZZ)zRsbR{n>MDL$ZgaqiIS<${m^Wqi$6{WTh>V=iwu; za)cxWPkm#YSEb*N-PSd+@cXq74Xiy#`n^YtflcHO=6+)COR<`zhSY81xlQg$;mb`B zr!?yO>(vblBOP8-o{jmlJfnNy(#E~8Q{5lK1xD?%)CAL2nkMYG@`#j zUJ50}p~uZYr~S(hRvh4ou|1uuOygKMzoMEV=Buq9{{E(?=x{Fl$?6QmJO~(O?E5|{Gx6~5&anCE;nuJx|vIVJG+ zMpAIR6o*8gs&ub%P*yYYVDI_8m95Dh451NJF{u|1mF*BA;;Cj6rmrsQ6|DE7p;|+((_I{^!ae)>elC|*`&Urf?p{l*`mi_dx?7NKj#6SJ@QRuZq`QYx1U6z;?{J-= z4MOg&v@W*K0^_O*cG6I)hb>9*H{BCd|M8cul8a_$ct?CkVt!r0C?Azk&_w$q_58qF z8VRsVwwLr?C}Wh`Y69K$GfI6d8AYF_rSK4*?(d%lj$;JaU?!g+0`-kQASDRb# zm3_C`Oq(e!Pgxz)T??%mH!HE%2~5mtsVburMhES?^eX$)_}(i#4|7AKfUs!*$`c~0 zcF`>>*kKGk_8oCb)IdcRTtA=e#f1Na%OQJe`rA~Lq>?1XTnXPyk=x(m!)J%D9Q1== zcKNWG;_QZL)>%tT3|uhvcWc(FTb|4Gyb^M~i2Bp(to_9v7O=&?0Yvmc{Rqec{EfuX zl=K_#C8>`M30`zNF%nMDg)x}UU`@TNTaKpsb4%?wRsTMc=tEixixm`-b9{W|{s7E4`K5TOAwOy&&*by0OH#b|9jh zb!cdq)Rw8-5O&RbkzouMn-`O-J{9gv&fq#5vEw%8i5-%x$GL{h8|bADdqR#6HjAs7 z>${MGD*hjjP?=qBU+Ooov>A@v=QwlH`}d2QQ5;M|tDirj6%+U%T8Wf)X`(fK)|K|P z1L)AIssa1VAuRfy<{BqcW5m`yNLo2Rs?EwM9j#d{)IZgGfLt8%S#BN}fKeLj+2ren zqV@rV>*H0{iAJrLKJG%c=5KXJOo~`KnH`6?yN3Seja-Fa;35|f&6hYViOn4(5`eUtws^_y5FE$8sy zh4{FPrXFPg8^ZGW+qb8G-BsmhtH=Uc0}8dX@Y#Ih55tXN5ChjachV;DcMBJ6si$np z6JLcfv3nR_pdhc`N1ue{GLd@8dvVyx8;4Nenw5w)1s7McWGj6#3V>r(9=n9Zt>r-F zpfO5MASO}>*fH7;^T*iS{Z;#)ihRcugT5EWVl2Cx?r%(P5Eq9*5?zMa-<~~uZtokO zC&NzC4qM29bP{>3?s1=ZtXZ0eeuJWH5fgF3RP1e%)g|b-mE)FkB6Re9aPz2YAC{C!4XjtrgSZc@g_-AQ=Ooq!|0{ z8F%*0Z>$??OXESlQGb=J}8msUh1dTepabN zztZ6yWpG3iyMWyKebmz|zrVlP<9PqUt4PeZ7px|;kzMN2>3eLOBhPPH33>)TRdz(j ze2Al3h)T7j#*+_5DlTCUAY}De+~-)-PZDACBe|iyMAZRK z91JbYs_MFyyl2{?dj)GR&q!eLU8VNbz`Y*t%l8;{oB282LGC)HPnV`BTfr$IRrtfX zVf&dFfAoxYI{tAfM(NGdx5=1)=mwv=C-U~pLfT*jEGCD^r{mLHN~o?4;kjdYk3P=& z+6IaTTMFlMsq0ziaD|ibaoR>oXzWL%-PXJE!0LL$@;+JcrqI>>-dIM?{Sn%ro%OhF z1bNdiZM25?J%x=DL}Jvv4(^RQam)gYL@FMIH@Yv~w)#1{FPEFmF5TUgc((PD(21R? z*xN^{=i7<&s6OU=Z{pxw?l*5v)*A*3X>U=aG1t~qYhx#{26!!-4Knw8?qBXI?dnGr zECxp~ho`Bffhz($Is8}XC3G@%LH+?`-EbpuqcWEaG5J-E3158|a`e&mtC^FJ!Pv)o zE%h`E+TmSiENZvgnlX%*uN?5)A}>#0!e`8@{N$-@+;- zTr(#QSFYvCWru#TN7a0<*X#D5a%ba2t|mE*m(RUXe2qhFrV__$vGE1KO@EP&s~)(~ z42l8yGb1>=?u*5{e9T3@RvAuQy;LIqh5UCw$mM-6Dz=) zSj`p61SomfF~I}^Q@6b~x}v!^86~?4JLX{^!4bQp_g(hdmGn#<<*7$jp$ixW+nmK3 z{>IVrgL5TLV}xR}=3pldXto04PObOlY2lRc_p=V$mVdY%M%-2E*8P=$*#>1wUBNLP z9}jj@i*inMf{tLnpj|q*P~?53dyN0yV^T56!=|5iwgf@mSS;uOUyO~A?Y5 zkZiU%MCc27W9E3CsK2{4MEjOd%bMnoNfvdSM=;ABB5)#?gV@`f^8n=3`Q%V4eN&$| zlInfwka4Gx%Wqf{%&3ZgRylY3$ru6Ut{%P!l|?9zk$|r?IKsU8b@gh@dV!-Z=kpp( zoe#7@D+qrsm#83APs{*^SG=Pa&(Z{KpR*z8bHP_xPSi8HaAvenrowE$7lImdaf}I+ zL&MURjx#}STLDG1xB^tZcZU=LDR{4{2>R!`Uw+ilnr9`qz#6~18rB!AM!uaQx>?uq zR)Gv?O0iag15?^zXdY7v8 z;-}G|PZ~u76+zp*LowXSOdi57ww8a`{QmNS7%hKcCHEyql?h}WvGD6C#7&+_%^p9) ztwymTqnV2afAxs6acTn6yC?q`{?qFeDg-w{F> z*upLb>l#+t*#a~Bjm8Gc;O-8fscIlWE*%Vs9psr&Bf~WV)|QgW+1eM@Y8QGda_m(| zZQoc~t3ZNPJ-1R|YT=(MpNmVD^mf{Eh8o}h6t%zSh4{LH9$tv|;)D>7j&reoOkc`v zdl$$MteY7mSJd5b#5s0DHO!RxYJe4GS5CX;44V-Ic5CMQ@Ah0j3ZGn6n)QnO8^G2F zdW6N;J%C1sN6+-?8Db;Kzd)}vjkGw%^M#bX=iFNv0nsa4%NtS|BZ22wZInflUk8t* z`}{ekhdZntI1hv`Z$u2}7P$vSPNySNV%~tEkSXK6LWI4&0m_IKZFz(i*E#^(aU&}K z2$^l)nK|oGVGf4=DoWPbl{*Dp9~xew=#1r+5_%MFqxVrKjBYqLtUP-koBhXq@ljSx z{x}O@yQv~LZV#Nfrf&w%;VMJt8j-v2c>Ca#?uqvv|Qyt$qImDY44@^T-bQn7hT!B9eq57Z0@>DFL< zfzAI;V@TtiEkrYwd*;j|N=!)=I|xuJtA#$4PK^SIVRcJj&n|j%1s{03o3UGDqPNl( z8Gq;Px-duvf;5(J~DW=PXA zCk!B#hK~o5wT6BFaiZT=Q+$%9`s~>Gji$A4vVE+ z=HpuQ*}KDXk>}@v_txXKU^+Qc*k3f}1_rRabTn0^%DdYTwhh|!sO!KXrDYa)Vl~xv zN|0Cc2c@7yHx7)!lV+(C;WfMuj;@-AX%vbxcbyHH#CFr{Ir+rBi~tIsGFSpZfv+F( z8a@!V{Ym>+{;y)4<@n%_Gg2@7xVsIDsA`D+w8YU!ZS9T4QzxAfbZeP9y`XugTf+ZGLWwKAjIlYC3yk=b zx%L6Ex!I`Qsz%XQIxn`^9_We!E|W$q^VM({V77$<#tH-b(zV`Jqdtz;TN1<++zMKwwABrSB5%#GcN#9sa56_p)q3%}L42=$#hb7&OPWt1w=!sma zT|$c4y_p}HkXr7}NJsYwd+c9u7#og{)hH?oA<{b(b&Npv-g%P&9p|F1Y%UjWp@&%c z$VjH^I%2%zKC6ui3AQ_fOhM zGQ~(IC-1y~YskH^;31P~z(^EqK+tH&ZW8)U&TO2=LTLK+ZXT0qrY8uz+wr)=`Ci*G z%7T^bptDd_eexg8(;ua{!%37KY~Gkao5CSm`dlX3OB6G?;Go_W4-eu%zba!c50k(l z*=Cp4NY1KjU?rBR^swz6Mvc`PTgc)QuN-OTpQwQB_a{qI^^Q;!FK(W8C{9GW_vUtP zIN`jXa=gmpQITHPFk~Gp;5u6Jpxk6HVPJE^(0K#`RhS)5&cO(65DXFXv;HxjR<@{927sisPR|MX3;tn|5c7#~)3(fZjTBVM{qEj5m9 z9z&dG(*E(dWK_tg3R%w~6>z8S4X=<=^LvR62|9W+hBG)spBsdEI@IIl91W`+Tw6O$ z7Y9FPEe- zc_RXA7}4{>lPTOUn{)flw#ICH%F_)%_8eylQ=e{l6g~swXBjfQ%U?H5@#^hm$+@9_ zMFg)vfrm!;%(wH5<+CbzoW4GZwZ2{KsllgJEj1Wg4pVzyps~_!z27<+L}wsBA|Kg43$dxjwHu<| z<3?CDeyHGaO;Q3qa(iFk+Vgdn&;C@Z8LzWQ5X*OFzWSyLI4%A-IrVl0rOG-GL)G&M zX(I}6Z{SHjdyHmdv(mddCfjlh;*;~Mj@l_hHhZdg(%fjPFBuM@*NFt zmCubdq+p!$J->Aij#Ider-%=w4X%?fkCHRjG6{zGo!{~o!hXH{zIisFagp5Qx`&OJ zUnBl>t}igx>iExV^It?%-^+L{AzD4C)JHoKZ&-uJ+O=6%MppZ#FBWBN{B~CUfZTRu zopS;~1B{bA5={vaZin(w-_`0aP)Fbz_A1?5O9jmuzt!wR6CZI6=v>$|Erjwes56pj@`H^%fL^)LJQ>>gXpJ8P&%XNc3?gCCp zub+>B{tf1fa&WnCCj7?_e)tVl?9u;Cl7-jVpy=^+Vq5f;aWR=M`JlW9M8^+GzC!Rl zQ{NYNMX9LXR?GVS2NX?aK5>8?e)tzyZ(tvh>5pFTvo(#~4L+;~-amgp(u`?$dJ~7O zCR^2)8~!o6qLfM(Jue@+dI;D*EuaRmDSBK=kvF#iMaLQRbI)k#j<3&9VT?Di=n;?) zJM65Vb2^*^^mxhz>d=|o54i>Z`H`*0)x`B23N3?Nm2=nKb5$rtFm@5UIOWGwOut}Q zZ~YE(FhRFG1Y~(jiZP=nOWq&%KiCs*{c&1Hh|LmnW`D`PwXk6e%hjGq*%J))yr1lUcYZm;! E071eglmGw# literal 0 HcmV?d00001 diff --git a/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/ZeroTrust(TIC3.0)White1.PNG b/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/ZeroTrust(TIC3.0)White1.PNG new file mode 100644 index 0000000000000000000000000000000000000000..dc5d8906d97ed3254cd0c3ad7e3416819c6499cf GIT binary patch literal 393087 zcmeFYcUV)~yETfUSiypbbfh=wMOsi1LJPe}N9nzngsP~Z^bVm(m)<)Gq9PEQ5FpY~ zAd~=+gd+Ve&enbQ@9gvab-(-H&GYzRRNl2<=t{gr+54^wRrex?z zLPGKB^xv5-*Y{Q=Bqs&Rk00v#nXOHqPu10<`>>g^p_rdv5Vt{5Apbz&!6R;khv!K( zFI6j?C*|(^u%mPR%)>L6RyJJn{q23)p@TE6eFFo1>dql2v&23T5#Noe`@0#Q_&!;@ zq%sTrIpCuI;}tR(Z#4Knj-9>@c&thB@56JPFFgKzltk`EBI&;m|9bO|{@+JGXaF}- zh6%dTO3QyO$n$}XQ>z8!jlKTv;c$~349D>AGu&{N`Ty$=om*s{$!xvJk8a3FsgPrg zKhw@sU3m6iKQJYA5%nInU*9DO$-am>^Y6oliEJM`VC#)lrQZp25*Mt#G+Y@=OttYI6o`r_Y@9g{ zZuB~e>m_uqiV!A~i8V`Gdd)ZZ<5>)EatDEVpvzg2!{yIxdJ=?QZATe@T2YlyqYY{x z)Hz89=}~01+7xoC^2B4R1$Gxy*1t8X4VOKE^~7_e?eX!`Biu}bo&>8GmdUcxMVrJ$ zVCdiA-mMgORcVa!X$xu4D#Jgk?ewGutE-&MMnAznTh$ROjdV`vg;A&SVptclkEpFD zutdUcmf(2cD*SYW_I267`wP*5N-jG&fh&<78UrI7gP)Unqu0|~_A=TUm-A1@x?(y! zR;@Upr;dLwU%jJl%;aBVGN+&X?x7^^7{M3Cv7SWvRDzT%!~R|Wq1pL`fvuj!595x6 zWsR_f!OW*)MH}{2o$p}d3^CGd-h}1n)R<4K`GW!{sQjd&a&95}x!!9G_;@dFOQy%m zMNvx&&$%y@`3mWEXByea!p%37Ql{WHr@wn*th?9pgss;NDVuK4O*h&)*d(OTPTi%^ zhR%Y5qoc^;+JsJ;=G|Gw*6noJG6TjyF;huBfph5j_G8{`erapOm8s=q$pZ5zr!nbW z(Ic-`Ib$dXPe?cQ_%MgaUYG*Vz3` z8=EKk-s-b?*J7t3*z#PeU5NaFFirnO(X8c*LNhPeooG>_t|`0g&F#91jb|kHr}3EV zqZuZ973)hMvqoFXfVzMu2% zvQJRmLZY%<;0`A6eYyvomvnsVD#~m(7nz4W*o2U}Wo7JC$}IYwg9nNC>qN;-a?X}Z zJDx3gku!VpGdrPXBFr+k<7p2anjb zE-Yp=`I% z+5cqfvN|N7#}eo4V+Sqen3883GaC!fDS|!spKa6NOxJj@%Jbc<_T|1p_Q$C>d5{e3 zdrRN!x+K>UvK6h`QN~^7`=8+iykpkA>8q*!jeLCW(|fV3<#35o3WbxPcs3SDM8U3< z%A4qrJl5}iBDP)UC4)OXtsuZmvYVoods;1AQ`_$M`ae)l%P3wvx-DsKloEh7ob}Jm ztFfEYa(Yge#W&?IG&jf0z`j&OzI4{Cv3)IsgW(MKh^Sx@ek8d6;^XK0KGTMjT#KcV z#qla#9%*I1z|w{|?YSMiDXlpe(ZiW~_0W%3LN~W;tQh}w=huziNO5%)cARHG*~Bjf zUg?Ru+qv)|LSb>e&{w5!q^C@B3LQe}n-`wgpEluG74g@T-1HHf!f^?`swqrVR2VkK zvz*o*)?+D`vk#_*0uSFQs2fgJR>_!(q}TDqb;wl0YGT{Q7u1Q((sHgcoEHZ6<>F&S zAQ30tNL7k!{5HeBFie0Mx(loNQ~SM>oV&t|sUOQ2b1r-jjT+(K%iU2Rq82U?ls2Vv zV~iG5z?S=dE8NYDj878d$hh}Z8^wITER40LKI;v0_|iaR#FX!~>7NIvid$~E4&+r&R3;dY?1^-z*FQn}u(#t@Zl%4`3T@ zSX)+k5@e_SiS9@9n5mQm0qPW2>4hX|`pNk+rG~`ey7#*Q%lz;Ae0B)rl^svXBl1($ z>}4+;{XLp&HabPeJXE}iyT9x(J3)KPdDj+ye*ZKkadRg5p7Fv;(Lrw)Q!rc1?uzBi zta^oMD+enWN$Y*p0aL+_8!N8`9l1(-Vk5oQhuL|Y^~;T{1Ajw^IiKX^P>+d}0X9VG zm#g|(i=G9^8&tJV@KckXt0gq!Uy{f&tagNl2XYbAi*LhjD2*{Ruep2Cl2h25bL6r4 zPFR=@G~xze^os>{JBb{z@}yEzr&YV|-nyip%uqNW7Smy0SO!%224skB?eiQbDt@8Q78;p2rYTn6ojTs^6Tym6-+Zll0tseYmL9 z`=9_4HxhYYv;?Z&%&T)*`I+-uvga#G8dM%&ra&d4QV}7ot#I>&>{AzF9PYi*@3l61%8T9`UvU^BM;gwJA`j8y+Nnxt9^cI3O zNw=F)R_WvT@KMTCbYJcX=OFQBla{!xL-BHr3Au@(cQ^4OU%9G{=tKIM#1@hIOTXN0 zd#iapHfqAcnFJVHI1_I5Z%8UB>=s1Me}6+pW7>XWH@FIC_u#a+&U7Y9TY5lC6!l}y zNQy(|2Np$)@l(Xx=P1+fZr7?3pUr^h-Sq%GR2(N)zRl0U5T^{b@mK=j4}>{RTB=0% z4SiP3y+0%Ip*-Jdyk@x8K!E7CR?Vng4)az{6E4_WTOBPGw%M{vlkly8X2+@|a@}>F zY)BX>)=@1|&+I>#>?zUXwVp)=j+R7TG;%H(GAC0HL{`Zk zEiLpU5SFroQ6J8bT78L}EieA-(jV6E0<~vhAobB@>!?GK=>#WWg>wk7&iLiBcGU5& zNQOKDe;m5uZjy=glGmr-n#vnR_!gx|53@JUC`>>JC2P|2lJE0TruNSmhS*vy<-9-B z`>LC@-CZKR$o9q=QLMujmqC+@SAF!vdpX`@N6;azBu%dTR^JcV>~E`7Dz=Jon^w5Z zQjd>uS;xae(V}x*vvKwTJz=x~^D1ET;h_wfA?wwezstVMg~eWjSWqCNL=5NtPEw5A z@nhu4cQChcMaJIY{x*)#Zhp+UG?*=cr&O7!v$yV673ld9oZMYYN|w6Y7!g4&fXaOp z(T8JE*hn_2cTC4jHoB%TNc*H>8cU82c6+Z3%5lzr3FHCCFxD2b=pxgEJM-~vP|wAQ z`cwwX-wU;|=JB+HoOKPG8Ms3WNRJfyZy?hzR{C~jPe%%DH0w?%agq({gi)JfM|$!B zOgq+^F3x~(QcT)Bg_3MN?;vJOi(l5_DW7hHDh!x5-?io6V^WI0Td?~nTUK| zB53m=7`0glL)OLfBnLd>jb(p@36%2Rdwr>mU?A2dz8o(5ya~UtW!5f@iMv+WdUZEH z@BWIN`o?mNSK6PzB5AA**dr*X@SB$VvK;KLw=RO6l=~)GSoV0GeIP`;?j;r3`LudPFGTqb^FAXz(}bK5hOUiC(oZ~EF9?Lt~ zrJ+63m7wM0~@q#qfvN*4)0fyhSPbPsg*abr6DYNcyo<3|_*y~A>s0*i>iDPpF1eFKOTxx zic9u@L95R_!$z0P?Mr`6(e>$Ipfs!~N%~rQ$a%bt4zFGNpn%Iv9a0gecRwi#+KB8a zusN<9ll~w_Ma++*Wh4wn{p`L0cjEl$(j9*!K`f}v9oJDwYP0_b+-(#fS2V2kDbJAd zMzsy5$hBJyW=*#>*jsef+3P@ALmS@-?;Vu@G~|DrF3R zO!vlgYkBdrPzftqhOnDp2vw_c+}|L6CbQrHTc!QOuW*2T!mPR zZEu_jKnJ)iDY$wWZ>J7s2z?4TK_!*m+<4M8?K^uy_e(P^>)(jd*aVRvj)?@<6X zEwSR}e)28^O8(c(Hti2ySiIE-f3!*+eMpMVRPYx-CE;#hw_8|K7C#v7A{51V;?3S# zsoEpt1BT-)0}8qbeyK}25neCTM7e*oKUu!0x;woN9Vu*X{kSmF*}XpFarkx(M0KS2 z7DCJ^Vix)9IwT|^ldr_*%n`8qfTPhAY#?Ewr(pfanO*+%RV-o{TBvaXF{6_l7DWvv z-%HpODZ=RxLPbO!~l=Jx; z^xxX$93E3oewPok>e^W!Ywc#f!cg$JaOGWI`+Mn)CV7=)K5MfBl~CE+hewTR;bgDhuSZ+1)9YHIA7qY}vVymV0^ghEy@r;b?eVQRoW|DKqfsJ* zAj{z@_xUe2a9F--%KN(Ykz!9>vteg?89PngV>=nd9q zh>H_C%r;zTMW&3s%dXGR!UyIz zNeRCg2W@qU*8ic_UfTQBx;cTne%C7N@B!l+zdYR!G4ldcDK*X7#;UD|d`O%w!D@@q zs^;kB0ST4wfH`?eg1%dXbecBjDL^vB|1fX_GY;QKnHq-y!E>LcIXl>?ojIlafsie& z<_JaJIQbUfxk&!8yhBd|q&!HhR(*Wl4Fv%_XeIu-&bv9paINb9%wo_uYasj;r5 zmxYZ0Nhmg&49CTQcuXoC|H~~@k(7lalF3%_% z-O$Ir(hgSDWPY(qbdiRu;=C5EUp1Qj&co0IFW8%#>}t%RWW4mC08c9#24yg*q;9cx z0h`9g6t=!HBUDzD1WfAgM0=>+>_J5|BE6$86*clq8vkwf{1xg{4BYG!xXs~((ANEB zdGp}yZH(5zGX9X~t7Rsq2BXNJ>~3Nb@N;SQG{RP*#0gw)JbMHXR@9$9vIV}rO4wTv zu=+Z8cerS9Uf5&7F&YyJnbE|JRYYCZ914l$(PKdy?rOz^k+DdkA21x;PvNDOgvVVL zooy!gri(oRH_D?04Jy*1>b=RC4X~@;Y|Kl}x~45YN#;REdSqAW?Z)zO2i~i7@8=kS zNcz!D>f@HgJNex2{*uY~jd$FXlLwx-IR=KVNZ1 z{jVqsDLo0$j4ny#jJh?j8kCqGXj_3wwlrASDxj3Kp-RHH?uZ2v z3!}7H{g>af(J|mh5xdizz_ zb$kRz+(bR@@p-zHW4i~59jt27X+6O&p@G6$vf$`B!`@4=@6n~DD_C1`o zF_(0;tX~~1@NeAEdZ^t1lt|@WFjIs|=wfe5TFvqsvY%VQ`)Tj@GVR|%qG-kXaX@#~ zQdZ_d-^Gb>i#jHmZ*%9>ovvlix4*O$77jRm&UU!0GO}=vKJ9-BD zVx2uTMj{Gm=&dI=OKZmEuN$-it!z^W7N!R^rU46w+sWlq=U+iFP9+uh;^C@7udXqmMlnFl8jN!rMO z^FaCup!9B~M|T_X>X(II_R^91k&x`(uQBlVvXwr!c;8O&F+g(5 zk_Fja|6C%U(r3qBAsUjauzB?dHh7v#p|&XT5u@S{t=?-U@q4Y)F+m=sXswrRfLc*v z(nKp_nwiuWhdP~HfMFzT!$mljznm`ro)huTHRWEz-kUUPK}uXw4mweX8z=N*HI6V%mWt_Gr|=F4 z?R1RPgktC0q(0oY3g0o5zeJe{?(KA{-(%VWO9(!Y$(!m!5b&E+P^s^H)e z8Gj$V_(KT*%O$iDut^_Zv5@-utbKc`sQtz*Ab9=@xec7m@fMG6ciT=<^qpMRcrHj+ zQPvurWjdXh({(YAxadcyr;kD5t>G3cMO>zTWxw>@*-AN_kl@m{S2)72$}nq;@}R7l{ZHMb zHleW27!4X7_N0Ribyq~hhTk{xy^iXb4Neql)t-)p5!OSrh^_o2H3|GA)MkwlJUjFSZ?tCDL z0juho({#h=Ijb_$#xb>0-Qt>jNQydYO6Q9VexhELf(gV%&2JKZdF(66%gE>>LRj>j zXBQlQIRH(D$B)mKaHebwZx**Pv#~LtA=1J_%L;3cecB z;I!fEG9Vom?XTxswv+H)9r2ddzMk8gCEGeuYChXGCY<{mq5`(63GJ(+_}cROF@L^( zN3Xh5*HiHH#%{-TfG$f=IGBpD$~$w5R_S|GblY&A$88b#8%|m)o#2mVG>BjM8J;36 zF)coQaW_cNLUN z)3K)t(j@Q;T)vO%aVE-IxC4@9(sr9aGx)yUu-im3k$~UB*+8Xk4qk{By(evx(l@aI zszQx5!t_tM&~5(jb^K`$J#5unfIPHoTOanJ+@=$qu9g1xj2&O`%Fn2nZb`$?MhXTU z-k0n-?zwa(YKYE=@XCA~t;JGMJcxem$*Yh68+t!ad7_24|0*HN$a$ zbkY@!MkR1o-g3{6D(p$_H&&ZN9S0ut*)HZr>`L~luw7k+6-v#=bX8P z{2J#6a4}X0PyE^<9bs#W6;Rc0bN?LkIh8YIj&beU-#?jZFHAGUyDZ->-WqbDX=*97yZUF& z=X^%1p60!eteQ7pSFQA}9uTlajGIk^8M?`elNO1s1HW*oK&Xu{~E>iQiCFR39U*P^0 z&?gqX*ODz%&*bS%5fG`Y&j|(=Xx`cTUjn7{#a*T>%vz-FNNB8J3D$UzzEp$wlqt!JoCH8}Q+mS$Mvua{BMAVe19FS^-hW z=B%79fTGw`Zx1p|t-!n&n8|Nzl^T@C=YeD37+NlCfiAr-k!fu8V$UEo3q5Sb^G$ow z!CcYxwZx@C=+(>0R{`e#29;mE$Kqu$2=00|$IIx|WvV_eTcB2IqKDE=Fy__I*hTh} zhCK@Nm`xF|(YD4{l7!E;2^?w6B6_tp_j&-(4`l$F^kT*S?sxR$PW!k)IY2)JXc<{y z%74tIaDh5U|J%LWTXB7H9+^iMGc=(h1+hKX7UBZZ5Ha+g(nBN(j7hahHsA>|)leH` zfM5*G5SQ-OlfLC-bJS9_>=Pc4o|{vQz?o<8Ym+HGcEf+8ow@cxlV*?MHiaudC`lqy z4_{r<)!H{ib3poWfd@N1mN6h6fP_!5M;F3F62@y!V(-e6sS>gMxi1V%?5jd#jlP^5 z@77*=J)~ufN{XR>*u`}I@~zmNbtb{e!AxmR(yTy5*v|6Z*&t%ncovk1MNPUQ*!$t) zappmL3LmG>sV91`C6FPPK?7MLU23Ifh}W0iR@=LUl0CJvK)Ip|)9edWlf+q3zg7Vt zQe*f15iV1y-eHto;WB>re#9;An^aG7RuF)+0wB~{D501WV&n+NAy?-CWhEY9`xF=| zQAs?i0QNn~GC%KM1|&^ts&DzTOu~Lu0ffyi!hp1^|J9$$TvBjI`9yucBSVkf%v3Yh z8<X|5e}PJ(%bhAlYTj!+EY=bHHDu{RrH5BxW!>n1dRFO0K^OKQ8ftB^ zzV=X{QY+32`(#;2*(rehIxhgPSeZDG>wo*0!mmwmwabTv<-K^QU-pC_U8pX`>b}fH zeUu$!WK{3q3_>gJ(%K0Jd=rHJ*aQhLcT!uA^`+T7reFwUw;xWG$o5$1zPpH0Ae*C? z^6Hksyw?)p(d=T9%2n-B&&>D5gS0v>oRZeQvw>YsgMf^+aDZ0%6+9wC*A#Vb}v+RtYv*0Cs8%?=F;ah zQTyD0-StL~MU|}^#y8>EJe4G#^!XC#9H6sdy+dDkDWSKo*3X7uEvQ~_FPSymu zBWJd=Hf~v1jO|bF4L1NQUWwkvrgPhX0zt5?@H8`kOreo-YBFb)gXZ-X8?+;#&M{x} z@$&Tnf6d<1F)({tThY4O9bwF2W9%X*)3md6n~LqbU3urNQ1VdrV3Is+zEbkziKGE8 zIbWozM}EZNyr>ZR#Q8vfkOz>_#XC4URMJ_B+oreF4QJcKFXa*>?iZ;Ij1X|FdwoI| zx9)s7{b8kz$e9@Ye+hjq&t-nc4hhM11Aqi&Wsvp;@OZ%PbYqS4q&~0`9zge!46J_S zD|^faMnQhQf`G5vPq#!xW(#VOU4!dDuND|EqhYA6SjLGv{e=t7T-VXi~vt^CV>L??TCroI*NoP0SiRL zbQGP0)n@K1jw%Iv&3H1-PDRp3UL%Z?ugP%`W*tEFTg;)jrrd8-pX*$@QCZl|NJn1N zZM9wr2pcaXfk`xN^-g#iy*LxNI}J27Ra2gWvhm~n?n-vP)Z8q3JO;qiLCeuHm&9k! ztD;Xn#ejhR8~*tG^z!D=J7MWqrO+^12^T)OqeHos*%Nzit=z}D*W(6CC-2+zg$ZLn zUCVP0uJS?vfI*Daf}7lJ_#J2F?{f8vMfs%<<*Rd)8%jsyVE$fLGss zM+;0-Dx_`%YxSoud>yEjc*!ppNw5y)s{}b7U-H`@Cf{@aB)J!KWH|1(r80tauz<`& za`!FE184@A*5bgauKA}J>z!!9y+9n)Fz9Fenw%#DaLx6N?RZ?VRkc5xW|Z7*F*AGl zBxe=mb+8f}P`gtm#xBJmW;bBDSDU>f1Awe}@an2Xg>kCi%`n!9mA+oW$d8 zi5XGWo!_4$bH(IhmHNk_9hMKGSD)}xp81FQ@jA(RyVqz*5&*NDh{z|KKeQ`M42iUV zo%)lCb&=%F*Jj@D9w!C|)*BUqjw)WwA{;60uv@V|eDiAx|N9n5+9Z8<$^dGfvL{2b z_B011^Bb~YD$P@Xh1v@MaDD&)Vc@?D;7{^TPQWj>nLZ^9A|n9N5PrL#S)rz&ZsuKg0jvv&0K=&C)=GI{BI@FvH5v*HJa(7#IBpTMRnr*l=D~{% zD*rF;-Am!`=$X&hX{sYO{jG7Eykoa!Zvh(ZaX?wft?u}b|Gc%|4|DVEyZ~uqcpY~< z>cTybo3VeBQ-4PK0m}nT3b!jtSgvAM@n#)3b*}~FA7l3WYnK2cFms$LUu@H;mt5$(S*M8G1$dbM+qV5V`k$Ku8fD3whUU^YSvi+aNLMdL=pO_`@&+opSxpM@VG3|AD zLao#@`3Uk6Wa~1rN9KU7yv?gL)ez*G-L?O>-+%WG_upWa+4a#|P0obH5HTU_#HqJrDSh$Lk|#-#TV)?>IDUO zrq?IlQ;}JJvS$eAKbKb1J$u1{s4 z|K5vjHtyuZjvLT^&>7pTYQOgTt04f-{pTzalBRq8vkW#_lZky6Sw}gud;S^=yWg`< zohDZV+AJ9N{{*9p!9UM>K!5q#wG==r=zg!2mmhp`JX~w5LG(M^?6Uqj*FgZ#cP{|M z%9{VA`Nqrt492Ns;UZ<5tlcc6&FM9JvQN1-H!1B%viSf)4=3P4)o=FO%-w#|y^X^x z{@R?cai3RghHaOKQT@Jgx6*&^lK9|UY?kAN-NW=R_0`G+O$V5v7S){*S0c$K)Usp@ z8(e4keW%>RWVT0ignibYqzOKK0kwNKke~tL_MP@l+5T-GAo)=K@;~CPz@u3^eaJ;o z0Avr@>|fBcT>w}qKsr`*RI%{E&p4m;5C%%}(f)RV|3))7o>RjmkSCr+;W9VSVtK87 z(>j%^Am@MI@)Xa12EqP2YyNTnefZS_VyakYt4NA#w+K2$35f0jmMUAtcZgluWyBM28j;|{G zQa2`~vCDL=Cku_S3aUJ7lb>l(X4g2bru=VqsK#R<_B~_(^F&5c&%;B zB`FoSXz>(uDO0=BOt#jv2atWM`{*QGx&b$%^=OHnP4;k+hQO)jJ^AV4!{1NtVjY<{ z-wALw*4?ok!?{oqVv)zQcfl`qH>OpyU^SJeUK}{=U`TGY)o0}y5Xx^R0W(p)eZm)E z`{Bo)I_Gn8Bno--xdZ^^-4fEgJ*DEUZ{matE*Mb!m~;F}#Mwf~XN}Wi77^9AH$Qsg z6NEHOljxP1e5W$=`OC*?Kl|6+`mcPJKt;J0svnK!CxA{;*s#RGS68U}8f1Sx@E>n< z%@z}LZ_Y#+JmV#u2stQX3QlbCcIb_yX*br1yR&Id>S8b*Bx7~f!)t+#;a<_);1}?uY}VRTv(A?o zCfBnbiO~c~Mn)GiT>Y2NZz%f-5`Yh^(7GQ!dhQ#&q{m~RVgJ5!!exr>j$`d_)?XS8 z+xP?+MA(@Ex8g3X{f@~HW4#X#C1IA@uB*-dr=Bqx3AcBB8A9>{nX-<7q&e>-&;}Jx zo*pX|J*B=$inx&{TL%~`)ovdm9-QjCfoG?T{%h>Z>rR@sHBUZ{zoF!$$IOyi{djpP zUdr2nTd$>#O(Tw_q~kOt$9}Dwf2+r90MFV!)wUp=!JP#W)YdD*1%+pJfNmX<=fVa$ z#Dq*Hku3yN??-x-#~P09@bb0G#A~pyu<_jI1WcA#cc4L7Oo1%*2l$&eNwb}iJ+4zS_a3C^sI*A@U=7vcB- z-}~|s<-#j!GeOqzW!u@n-Aq1nK5z1x-IBu{DoX9Kob@E{p z1oYrZf93f~ro(uq6S z6*7PVzOBQ&*=)#JhPPJ^2Y?E25Ad9eqW!m5*#XY?ZNnkZLn`+s-^+6@8lKAq}FA@uKMGpB#cOLKr%J`7bd>X<8g`=s_U=pdk`&S@02 zRkpL)#nhuJPu6t@#BhvG$DB$@*W~uUUA=Ja^9AxcI*AP($>4#&!EitTj7zIMj_qQ^ z-R+5gwWCPo;_R+x+X>9w4eCjiOmg$SYzd7*NIKvGHLWfDwb5>L;$Q^H22F3(^eYL* ztyDV$40nqQVqYtYZcYxED)bDj{diTCc$H+e{fWc{&%is>_vJYF8ws0V$=WIrJ1vJl z=QRqe1&@vEHoXrnFvhl1^CjB!!;N)9!3iG3q*{!j}f)WGX8jRCL$?c^bj z%L;iMJ$6zoCa8@c2Y9efI4psIZ{8(P>PK1-7`#5j%xYes6!-C*Rm&K6OT|rgl~jxr zT>V+|@t?{Y+}Wcfxo=ysGa>4=ESM(f9^c#}6?`19w^plMxFmJDbaHYq7@xsH(bT{C z&2U*}&YW-0xqwKHx;!wXW!V))#|dDf$jg00LzZH0inGD{D@6e28N3t2ndSHBlsi18 z8zy10-A4eHsa`;#Spbqi{7@dampCXV;M#uF&=m(wBpX`2C|$87E!7fzysKOGM98tk z)obLQZ?Eo7uwl!QRPGGju(aGQ34x0WJro7%ws78OY4qL}V`;S8{Q7qpj~X)KX&xecyduyIn#p`{bxguSZh8t6X}ey5hY~qcyMo%U~?!^%c(B0+jf)JrKRfmoiV>*ge9J zD*~y`Lo0ycS+h`WZ^BtauLW6Q+L9WEY_N|p1Z3&t+x_W1fb*o!moxaddHl9%;RgO& zb#}L5%9dN|8&ouwRW<#|&CZGZv|5C2HZ3j?vXFwzEi$ zZeUU6?hsFn=6hcyuN{gz8%1XIXN*HD0XJx$ua{g_u*_wd*5G)!3Qqx;Y> zQt$5{&!>R`TVw!WF;e~2_FlG;x+&3`Ye%C!&mQk`a`r|F6!`D<1mG=wHUe$A*1~U4 zVQ&?IlS#YNpx4FJCW@8>}V+4X()u+^427ZbooJxKg^*lc!j!EfRqH`@`U53k%tfC9=f zj|@*3W&FOX`KBNT06#iiZKQGnhob70emNM$uxDJL%jn`tGs+a?gfCY+Ul+DkvMTJi zB6i#x(DIT?tQyumX%*<%ePRA(7~qw#SfyJ!8uN@V%&y!+>$KoN4%0S8rHrbwoU4bZ z*)}S*APk=0tnFKVqdMB77}^IywoC&yd+^8-d>3#yENnKu;@9Xs-3HUwwj*30E$g)$ zD`sGEwpi6(iPk?Q6V~x3JFZAH-sr`OYeHQ1{ zZ(L#h36vFT79iv>yCx&-zr*BG8DWA8nzor1FhwTIV`g(IMEikS_@PV{<9X`3NNAER zM9n(RXqq(I%?v@;@XPxz0P)8ryLR1?y7lxu;A_s+cq%=;|?L++6hIx<`cTZ(zM| zmmCP^aMAs8ZKXQvk--jlDFA-dUNL(JW(9O-W1Ml?Me5FqpNE*~Tw?&^Mf#pM4JC(K zEZ}leJ+-oY9puao_`!8x+0P{j9E-XAfinETD%Py>o$zWzTUlgP$}V8)hgk9;paykzTD5A^{D?~!q^Y!LLO)vAyQPA-2@13# zVj&&|$N=s9?rH4n+?j85fK#sSiy?COUHtJ;R=fZ*l`oC{pt5%)-HDP@EtWbfcqTuJ z*EFWW6~JnRjb$Gd-YQl9=(HZ(m?n%Q1VU(Eg&mB&8=-C?2g0*MRB+2T5Ju_t@z>^X z_53G7`^k}0p?wQZ*vrrru~+D|P6%)QJ{LVRGCJsO4s-@w=dVz`^_e;q!1`%urG1=I zK!LDcxf4F|u3rPvcu{iGthIxeWlyRf`K(W{2WI=3oSMz|+8#VVTbOZ`PFxq6Dl_g( zdi}_RPSkD&{r%AUfVkKz5GrrL^o*ovRY`9lr z+o<_<5$AI?aM3zJfPn3H94qqf%#e&*)Qw5ue7=@Fqly2~9Rc5QuMW-`@Sl)3$D1Ln zrkXS$u?5NFK(~b219r}V+LpP{?xwbTa8Alk4f{MoqvL?s7#AijW3~FIV5OvYw5@EZ zK!O3fcd8VMn6KIcl-9TgQKPUJ+^IX#23CTbGhc^d;b7BG7hGo`(Nn& zWo?&5ZD+8Tc3>Tt`C_OZv5eoCSUnt2j^ECK%IXG`XM0G304=)3zPm0caEqBeJvrwU zuosI_3^!8j2wT;Kzix?vQ5ZG3JsoM*qYJ_{mt?a-cAB>c_UO99^+tPw-L8wrS9c2J zq`Pc^edDl}hJBEai(gUHt;@H#>`=8k*GuqXQR`l+DLXa-nH^>VT)t3tPi&uds}Dnh zdP~%XNvjV8dm=mQWIpOJ+O`97xMJnM9$-}z<}m;+*6y77z*4cQ8oa!R49(l1Iq2c! zSofOTzK^?@u9|XB3@sW=7QX>+--4M`_5xIZG*A)B4UvWES(NoNI>*@Z2gFvF`TRGO zi;KV(9zxzqxqUfQ4fjNrjFKZV#lS46M+om-E2}~}o(&`P+(9flWFAg*8!%wF5dbTY zq=gYs!F^)|N2g+Pu6Nf*%VEmkU-p~-%F)xonT1`7MJrroMohT+iOwoPqHKC$d6sP= zmI0z_3)lCjUoim2tr^(oP*%(Wh<CT+_DY#&sRmfaAvc*UuaAvi?3qLlY*nMJ1H9+2u{CqZyxXKNk)G-r z&V7J<>MAr={=8{_JXhfgd+R)W0Lo@Mod4WR<1+_;5V)DLd$S7X ze6MyQ58;VeUy%~HI}o+w9nuS@BEW$D5zCYc?FyE-r5C2`-xMuJ6tkNuw}sz@}a$tMMk7 z$a}Wb6aVQqCbRhAW=}WhWA=r>vbME0ZZeGQ>qS|9TM1DZ1)pR?;*9=bt=N{RTjjWI9do^k$G1L8=2DHqO;@3z}7VE+FF{(4TS%;@N8{+-l1tsi`RSK6EwO$wC!M6O{^sbt@@OkwvMSaj(3$9jq=<8 zFqeFtu+R68ufk9FiAo=~iA$K<(ZJD` zdrqxqW6$?fK3_98!6Fd;yKq7g^lS6f%BG)v_x0K-WlByX9oBLCTgEh(ytCB!CTXdA zNAO?tGRv1%0bAs7hH9q0)Xv&wsv$N*(zC3%8ZGq=l#Mu^=(d|I=~BS`1a_f5(Qz>| zZpxBy_JOsOrqmw-<9?0K230cld|*3|V4Y=AL4CG=uzI~wBBvr4Fk?Hdwmv5%d;Id% zD?=UEVd%Cr{Iw6Fp!WdC6a79-jJBCerzV!(5zlr{Q(ME({j{BhSxv zWc27y@PYeFfpH!$n$5!RRenxZhs$lHwodx^zL++Xmfboy#^yD>7m#J3_61lrrcJ9^ zPPL$sfR#4#eSrJu%_TsXfgPe>bHc+I13swv%2sB&EsO$QP9r?aUVP(=9{m2n96%q6 zwA(vL`>qLMeD)D%20?T~JICUM$ZGWeL)&|XHJx^Czm5gQQDm^8G#wF95fEw8v4Mh- z4$@Ji1PGCC63QTo1qsqSh(PE;YG?r+RFD!%LPAF=2_ZrxAwa16iuXP9%=_$jf82i2 zs z>bE=d8mIi0W=;HHxg&1{wF=Zm8e9yo=SB*g8V_Z37l!mYKiHO|Q&9gw>3k4!t1^1VO*irO{&g^aX58k#~FxrD-|Ty6fdz%z5I?BxGuo6@^o7_yjoo=8t+@Pp<4tOcIy9Mxb4>-+m+P_*2+#4x{c_hti*- zE9Zmd{PHPMlH#-%z_50G19UZc0TdW-W|}Oh)YsJ^&!x6J%-jbd8}@pClj9i2f`uXn@xHjD07#F5G; z-cS3DIi%-yrDZt>sj;|G@&_*Qf-!Pw7RnkaO;xk#V-RO-NH zsbyJ%f9SMOmHqYw2QQ4wm{Iq70~5s3*ueP_eHrIr(UEu~Evaa6y2$xq+dS&t`J%ph zX*0Fh%=K7M81v5=kB?@K8|1?i8aDcaN% zr~0T{>yVhd#y}>kE-Ra#`^3?~( z4R=vWWSH-`rIwt{Gf!=Sd~oAj;LYYhANG35iA+SAK2a@&@wBd^=fe+N==u3U8f!+T z9SFm^)hMZC`+dT47bp6JexFAg($>GNGrMYf%r@8bH3;fPQAcIF3)O+vR5@3z{x`o1 zOs=p)!u?M#Z{*`b%RvVj)7;N!7(;C^?tvHB(RmYu>}!8YR(4Gr{UDlM$DTcFfU++Ky?72m^#e7i zTYpTPUX}|Ps@7iw!@$(>cN`R6jKXI#F$m3Rd%L+y@TN^08=a}~b`v{TcQ2Rgkl&Hm z6|7=!v^Xi%wJ7jZ7aQ=n-j#D5C4il-v+SFi8c7wj)DL+jWWTuvvXj3j4f^kP4H+NGe`9C^fVBaZJrGU zTq&Hh78ft@#9>W9M9$gP(){r?B6i!P)K+?PT?fXhgT(kWE(@kmMrz@Txq@~5!RBB# zfB;5dcWBAT06?KY{h9bP+iEeSgT*2J!9O17X3X6@r!uCqiIuZuSkfGpBFgxuCYw$a z`%d+!U1KB8ZVCTJw$|S)ZM#x#F`7>U_GIz4?{8AQ8NE3XB!9b3wUs37#DHI^!xSB% zmLOU7^nBUX#GtDo;ssYXHO`w?kCWFN7(!)-ya=4-&(Wf9H??2z!g89RHh0z8Piyhx zp%4gsyH}~Vil$?`8Dl?(Lpxi>K?Ok zVOhJgAWItD5S$DaKPpTir0M%FNgE-qcT%Gw_}bF+Go(I-91rW{d$+QrOm|eYeJl0{ z4P>Y+kRx=~`Aj|7-rB@CnA-5q)==_p#dj$`NB7$0T;0P?EuJnc;5g)j>eG1kan7yN zn=P&YnsF&;!Ort#%ET>XS;4j>gHtA}sX6+pSs57S+yihr9cps|_@v8$-&2CWUp6}7 zzi}W4LkuAGgHva1_TNbSwdET%GiCQ1)kR)j>b-U3tZ{Fei2aK=soT4hVEYTBt(IaY zd5TvkP}|1@<~qP{%C4@%*$r1BB25JL@3f9lU1lwv2?gi@%`HS3gQy1qsjZ@FiJe7} zopr~!85y8a#+wk`0^YFwISjUbrh35JG4t9Z?b(i%uHEO`j51#Hnxkel-$?iUb}^dQ z7yL%P>aLUnmWgZn)ejEYgx8fNRAAW0}r+kKE>2KEGsH&LX9o)k%C1j{Mdw-qNc5nSHXi2Y9 z<>YWx5WJdokF6T^}tj=44QoCZ^)C3f2F}>=wPEpYMQAO;}DBs-jP+S9FbEP;9C3TVOEl%g5TX z7kEPLOtF!`*>U!?3|r}0D;rL*6u8Qv7D z;hWz+zL*s_aQ{#j=dq#@;!08#n~JTsY&@J!fG8&FPU5L%ao^ z2-6WCua}4AE{LkaUUlFa?72Zd-SIL;bdCA6GJboyk^O+j6w3vr=1B}5@`gMT7Zf?$l92? zbzd7)?6s@~`tW5rZ05Y?+fLHjfVd;;xng(BVu<7CiOOHPm=?O)?n3yfh>uqznv^el zgPM~yS5lsKU>&*q{Tv?2iA#12wI-K4!U@76Pf`?V-68GMmzjYKa<{)JD2erWbG!Y= zF6ufw`UcKQ<`*DRk+Q+(a;ma|Z;-5QPm0z?4TGE{-!*#9wBjoF zSPX9fl>UJbZB_l@5pbnHm>*X5b=nS9gwR=*)2%e5M8H@A>8^{UB*rLki*=yx*f$2!DlGcyAXDQE$26(DYBK5)jLZh zBh!OR1ME*e?q;eVe7dFg(1ju-@-9~ZW(RHkeE8gbzN!S2&tDT|Goz0LSw?k8ad zWVgVcFh-nHxi!A;^Nry;<8n$h%`3kLz905&J&cd+Sr+om!~z{EvIrq@t#VnbE2ftik8X&1mRJO4C*rZIYEn zSqN|L(pss5-TZ#uoKw0G)yN!~c~67~YlLX_Db=-hs!6&LG$0N{Ul-LZ!2#_fvX)&i zkuwAAce%~|p5Zc9-YS>_wGywQewLm(v{%NU+`M1}BFQQ1{`RRkIjx$-O0>b7T>IIZ zr#IKMq~?dm<#{BfZXxv?gA!wErm;iY&{dAc`Glr{k>RtKq5Y@(=6(j3D&WzGSFKU} z6S$T_Czc zQi2SPl8vc*$y~p*l_YRdp~NIN52pa4_&KY-aoNEe6JNWf#BMdSa&-*vyI|_ zlJz~^0-!B$Cs{|4!op0HCdi&#>s9PAd>cyeaZQiV5O-rNA7R$-Vl|p_GD8l{Dp`Na zX~Ju*p*FrfJF&bP_O~i=6gw$<)(zNVsr61^!XPc>Hhe8%c_(c?R@U=@ys1G;Iev%U z_;+g<<{a!%zCcvh31aGfw8U2?@_w%B&M{?&3VJpnP(F9Teb-*Ns(j4{%iu2w3b}cP zG%lZgAvEGNEamXobxgW+THsJ+y&$zcLBY%%9`Yg_r#by%{ALBpXlbceFZ&jLy4*Hg zqHR^(63JdphhuIM&qPD6O@kJdS@YJKjGEuttNL>o0nKX=(R!#e?#U#4oTwhu{`CqE z0LJ=wC?=gxs%m?+HQ2J!{2VU&%)ySb>ay_XCF-b&aXjlIs6eYQkm(_}tfUHOomeTu zq?B=(jHUlXm50}4l~{?_P?dGLW)v*T*inAeqnaQCKncW??F&*4jCLNnZK~*s#sb#y zx69bY(fmZVr2X)!Eb4=u{8>2S2C>K>vDkGf8kp>C%swqOmkEehufSltzr{G=RDa)V z@95#+F;tltyv%(-{L>ToAwk(7NW6F#r57}BF*4y#@v|>?z`JxkJ8`Qym^%Xs<3unS zIXwo9H2LT?+1{@ibsfxG@lu?%_4kQnK93BzLuEF1gH~%DkYmF30y!Pz=@?R1Y zlOPjtpc3pG-!A)r)V7l1bAV^WQ=}RnzUT9@=tO)Tnu%z{-UK6v2RBbB zIvGiQtiL9O;T?t~RRSF=PTc!ZRNE`%cAAn2AV{1YV%D`P&ApO& zajp!M1j52Cxd%;yGeq%yPLEggqA!(ai(h>2=_VUay5WOxc*$%~sP#RPZo9Z~=sB+e zV>a%*Zln$_;%l2akM7sY?;0(xc8&uBvM^J+NyAFOA~_m`v(XZiz~Xm;we1()ZhK5 zo1%d%Gj9x>cVB-y!d@a8r8@YiRZWN;tvXr&j=-owW zH6Cqs)`O)8Kkj6dJQ&KguvUB1-w{+lmQV`+06A#P+<+;Ho3XtTtO(KZlYY&4AX8 z7Z8=lRL{dNCzS}8c=P0)$%}{1G<3HvPl5R9k2_W~?8Aw`9^?uL)x<`t+%{Jq9tCM{o?dhs)uuC3*g^)N!nkw4NWLaV@0>m|dUMGv6_js4XsAkL zSM%))Q3q|Y_Zc9I7R7*T%B*>FL8EO71qI%HfN;C9w!)Ow*<5ng4KTmo!5ns)=>y6X z9*f9?iI)c>pVt!@Nc=b+nflph?>RZFH3yf+H{lK+=9##OmSuKO5x$XMq(IH18Zcnf zrUr>&Hq>}RB=uplQwFFI%Eojz5a8Z+g7~&I?1G*x#D8qj@JOKNY?jEkC`pwt}t)Qo3^0!!=fr&E^9P_{ymJ30#?NZ3own)}`dQ0rE}Ey-JPY zn^#0-J|_F4Lwfn1g0|>N9R#-v|4WHhJ#>hi-kA0MCssks9MV`xZutt`B~HPP=qG+dCh|v9crcrql}f zjKH~3Yvj^*`sE(#EAs5;iO5@lAvNIUCqDdif?rS%O_($gowIK|8bW$y{2Pb!S6Qh) zy&psA0$*Ml(gVz;TuCngr0$dZY3J;8Rdwu_gHd3Vu>q`&dx`OjFK1-BYCav%$KzeQ zJ&J5`SVw{UNl%o$RPCB+gdgyP%51K!B+Iv~4SV&(=xolOjgOV|9^MHFf?Wh7LzCm` z{wcv1k=1*3c|Et8cgbrci~C(nmHB~Y2R!o9y~*qJzTATP$bluIp6{Y8w%mH3ddHt+ z6HpT>(NZ92xB26DQC}^Q83vbG&zH$%Gp+!T;ES6Yq!HrVg0V{FZh_OnW6k*WWoxss z5!xz`1B=$QKKV8Bv6>(Cl0ZO!e8egmfr&09A5uP$g-6LTzj@!H)0l9GS~7$H~FYd z(3SgG?oCnnGn@O65@Y+eJ)p+R30w+oh3b|2tEOb^Wzy17y%l11}OP4COM4m zuTJDCf<2d&ntmHu<$wxj`|mQP6bO6(wrO{yeqeq!kdn6{g~u8=j0fD8M=;4WO`l^4 zx%9i3+sD~R01Tdao1X5EjPNF8`(5=lyEw>!IwfOfn8bq4pM=UjX!E)=`2xGaX28Ql zH9ADgTLo_d6sZq}J$ve~Y{vSHDB-8yU5n%aLGqN8Vd5o$TmYy!#?XE;JmlxL%X{~% zAk5ghD;9VkN6u_-uwzCxNfOq|*-su*>)-9WcP2!!9vYmhnxZ`M#2}dIcot}@2X^oC z;1c=v6a3d}+FS$=8VVlR9E{yN>ekKTt^+n3Qt#+PyqS)S61vY+KBWONuPuMn$Ak`2W_K~vO zV9>>Ji9K~A@6K3*>$<;2=AQHgn>M;~&hquLUs!3iSk0NTCtb|u{)wwA%HCcgdmS34 zL(Cu79en9&S$0UvKFA{rPs^&rSh1B$tUAGCo!>O2nml&aw0z1i`Mj(~EnJmTPbdhu zySAjNe{uj3aM(&b_M2N9+!A(q4vo&Zh+6hyqiTH<&jYW?;lK>qI3g%vZ`V&`Ic_3U z@dLbK?|{Mpb4-rX)J#ez94yY_B&z&ctIv4oQV>i1P&w0KZFa~z``{E}A`^5xjQ(>F z(v2NXc!;>$Jm^ds%P_PDDu2?e!&A{ZZSRjdLTAc(=U`3a{Na|6ooW)}r$5&B4av3n ztWL+rf5WQ zusw&ulU4?wOb!oO6tbRcATcnf1Bj4~$$m>-1pM3*TzP`~P0Y?T(W?s%Jzy)r(g%9lF;4viRpycXra(c0`c4cCG({`PDva%7 zpx@xylhwU6To~|z-B4XH4vgFsPx<1l-vYM}KF;K?&gs8X;NT1ip$%^Jh;iJ4llH(7 zmnvYMg?r4NA>(B|r)PHpJ@s?)^P7y6pF)|s#b+wB9s>f~qa+PTGEBv{dq zzO09hMpZAORa`4NpOW!lmKax&9V}MRCI_;!=1P=^Lt|jHkwExlgoKX3^Ip$bYxGo( zz%XN={6tL|0Z`;z=ae#OKh{(Zg9sb^`lBc=+Po@)tFC9+vfN z+*$#if_6-_sB?m>Rtw`-(cv8gu8l@*Q{wO3G0{!&yntGE;M^i{?RtS50E`t2<+V`s zKm1Bf8(26OjGI!8^IRKV!dVRYxXyT}X;6H}hEw+4DmE~KDEDAdrU{3Nf%J8jEPvc$$hTaV)! zXY^vRiD^{7_&M88uW(D4by^N9IPXtV>YLa{;8ap;6o9n78ILME*Y_!Kf71&_^>5~d z*r}bH;zzpR*-mJEuY;4Lh1IPufU+WGJ0UxC?f9Xy-ykP}HYh83veBFLrt&kI1C{9A ze$8nZBJi)3(w@XhIz|gUV$Ol{{pgS*?S=6+{5~<@+1mEF@r;ns!T{+N ztZfowa75-NP!dc(rDewh+hGb{MmBIsS!gb0+-n)>-ENf$vbjvQF7}5aeuOXgW9K)ijl+e-C>-`JzEg`kZDxws6YyN9%T;aQ zMB3fAv8pl^xkn#kw;HfOeYb#l4~XX;ks7M)w0oN~l{`o{=g4KA-Qpr2zB^t$d$;iQD2f?^ zx!}J*>hmh_E>9W~Y8(1KyeOl&V{7SgqVCl7-r&w%itIRP{qYV^bAE~*P^V6s*1n-jp)Z9~)m)J*=P z#o1`=HCbMac!v_%0$rId<#4Pg5W12J_R>I;|8}bg>`ed|lM>zgYOXZ)Gcq0UC__L5 zg}hG0#D>`Cwl!LIi}W`J$;V@ICP$-iDn}VVdas>nnfujrnFhKit5ev1PGv8Od=$Q{lIyPqryR5U6n4EuS-o}Izq3x-a2kiqxOEc9vmhxDPxQ1&IJ-Ez! znH@_wc=V_%3(MC2oP;}gss&Z$|HZTo@dj!h+V_l{S>CdowpT8!&RM_8==^KOveRy4 zcQH*>910=+0Mg*DptZ~W!R3b67J*VV)mar-S`_{_g52tlkEg9h;uEQDze3~59}m}BlI*Y zqHfF!d$>nxAXb$LBN_ADaC>q67Br*hNU{|&ggu)Zllo@&`fw{DLgaZF!dxea5V5!B zpTIHUrw694KLdxdz|yurnHyl8pOj5gjT+YP_FNM+EdMn2V*VIV781`N%c(=}TM9D2 z*b?$s>t|kIvdaa}&Wbpn;&|@sSU9G7Ge`c^DWjvO^W4P$Eqy=BuhU zJQEQ0Mt&sD_hr2Z0C}H=4(qv*>h5b-M127*a-?>?t9G^-fSb)Ff@l9oz3dZrxPIN+ zlQ8R_5CM*SYUIPMU;RT2;M4=hE*hV?lXjZ7qG7a@RK33P;~r1m(X{=6pY=H%p6Wc= z!Ks5b_XUh_ou=Ct3jPi`cG^(0Z^m ztAH_y7_S?c$~bky_qg_?#c@_YSkY$S)-7&-l3NLkz^pHW71YQ|tl^5nx_D3uhv9zW zR$OFl!+uwgFQ{DXi#&JD0eS1UqZizfBvR!YNoeqDpFSpeVs%>9=u9mvdfx|9PSz}! zIS?y3^P)KfvP&0YhDwF2&ymD}#-ZKx6Iz0ET;rZ78+p1fCx??L0lJE!)_!_PQTiuP zw;jT!AjH8NlyXj$N|)$5ux{1eI^;>HJ2c1G<9HY#ZX*wfx+2qRdK8hN2JQ_p!Ku{z*J<6wFd}mTa!QeOv}@2`ihd+_8LKYGwHxOlP`BKA-tS5qI#yseN8{T!)%#16nbJYtW~%4JmG#+GiuTXOP+^ER=5>g0kP_T| zsQ(fsm(H_B=gj~KiWudY03?-ES>&RWP+heH_NeHWOYo+x2A+)T%tdKz41M0en_&l^ zQ?o7KJ70OX+#v+9^;Gz__B*NTS`0xvf!pr$%J4F)%pvGIs1m2|m3eByta#MHL+Iu9Q_UA8j8<^&{ow`E4eJ3S1W z70%qiNWu0zsFY(=7k#pxmuy4K?KUPvi!~?F-tenq$$#7DciemxcYV;Fb!yxljs#w; z*WP0doj~dXsu`RXYPsFaXgM*M%kH#=<6+*l_WSq6gE{Ce(}G)5k3v5wx$c-Gl8Rc= z#wFL6L;96mO{NXshhz$zTyU4~kKo6b^U2H4yN3hnivOh_Y~g6_(W3W&+>us=(!R zHjI$!j5Hu;k)iF!b#4Z2KMe6-|CX{-_eWjUjvtPgE92^yOo#pH;8A+7&;94a*>Oef z#|L0xpH6lRQz!>T@u_pBc^At;>s>Zk-Z2TaaL#jl*CMnHJ54$>3A+`R}Ln5PV7x8`Hr(x&aDEYS?Kv94xuxN?jHno?J7H8bby@^z};ea>aW%rpd0rEGUj;w z6ZHNYU@R{M>`Ir|zijUz4e9>XAA4>*Y+Gvx5L%BHU5&W$tZ6B(+H1%l?)0tu-A|1r z$9@?_e`lyGBfF0A09Ocslim-tez`um!Jc>%t_nu9s^y&RoG$B19%ciwSrD$amfioJ zmKCo8TSx}3^HlDiAE}wR@ryk@_>1kDf0IdG-&HU@aN7CvD~!-puxLsO7pNd94SyalcoR83{K1an{#qg2`#2}YT^#p0PEP|{SUS3q|d*hOuBF1hN~HF zTVDYB_%oOP=ES^q|G)3MJy*o}`+WcXn&9{M`u~2}e}3@)EBxszn7owmRui$lr6`aO zuR4RZK9DuK-~EF^LVxINuI7@;%xqn|R>#uP>VWE9ui+;}W6d(@F8dd6d0sT&AvmL` z-C);^7MWygcK^aQ7|*=MKtwvh{C5U){mJGZ^Fa)0=Q&zyS8xge?&VopKS8Mlxa^S` zJ0FeA7NJHbaDBvpbw75%q$>qn!AZb*+X0SGsgY1A_y_%N|=8rb^D($8gt z#c4$pN6~X&s6@#qF-Vk?1@YzekLSO79@v4q1Sm>8*Ay_yxokEBnAY7CItQv3XJnl+ z|6>mDGIkUv%JA0RR0htAczQgXyr25dcg6b_%K*6O-9#ypiU<69RyFGm??&kkt>HlR%771&w?@Cy^ zCV?t_cG@thD@~;7=R2+S9{S141KE%vSi=Gq$Bhm(29>`OT`9`Y31YmO3|N{K8ft`R zC&)Wq`R&O02ap?Qp+7cxXg!^c)%fY2?1?myjJmsL{{107Ecp*>>V?7GyD5k}X|D_| zz6SaO1$O=HS(?pf<-214{@XjeEvo(h;WYivPc{xeG$sH8`vb6UiZ%K^oQHAYJ?o}; z8w(J6_VOAh;FhrU`wXTXQaq#h(xdMRZ1GKRu&-+xZ<0F=d_814Rj$VNx7KGf!1n%X z82c~7yVR*uf2A=nC06Af--p6dU_lOBDSf#!z^x3{arw6ZZKT{TkS%wD#;XCU;v@3K+n(_e3jMBSGO--7Dz-D%35-(wb%wUt7uUm@1+cqwJ#;1k|+&jMl0 zm|^MxL9Mf9nBaMp?hJM~HV7Du`dh+u;vJg3$M7-6QWu)ccc>VM0-(y9uDvXpbqFVEHQxBu@1&^stZE;C;kuz z)~cj{A5KdRt;w9homyuC9R}8}LF@Zg*4}lNDTdX4u|CT#3)zIit0c11l#A1$X?$r% z8-P7qE1a|oOE2S06b4Nwb8oX>g<5suLPj~Nv02&ktb8sD2PKZmjR-GuC$yUz?ACF~ zIQ8>`l?xYo*DlBZitgAcOFs`WAy4>hQ*v>R6&@d33^y zL!UeA{oHbsP6&ZbdK4^Bop!~>_SasiCE!=+?GfcMxGjg|D+TfzIX_*bjy>lFdZ_UNksY{@lbZe$P3c+lU0RUDXu`v5P91-Qy zWzK3Uuno{JAvP^!W1eEd#*mymPyqPy_VWzJ4aX*ZQ}s>>HhUinS1N}#@HEF2O}^B| z-JKm0|hP*qOpSudUP_XjWJEo*R(gqj?Ps`(#J|;xG0(&l+!FEUBL9X;` zJK)!~wS{UnFEu}RK4v(BQu5*8FldfH@!VBPm9htKh@ zc~d}TqElMJ%+>i!7XU%5;K8hne0qpx$XfLmR6|w-|AEUL>)W@rN2}a$QyRDO!R?3k zH-v={8$rk45SaQOv_^8yl=<5Ny}1Xg?d^>ya2e#Ho$Vo}mzUdIX%RpJlG?+6;1T&Y zB{*nvSef{KA;!9@EA+6e4Jp`_xS6ems?}WYQaqDA+pu&Q&}sT(g=xHW;50y%R3Zn8 z-J#;?x-5)r%I0Ds9?jc;w4vtOA?lu$vDYqrR>|=^Q!R^K<~TY z4s|csJQTAM3jph>$Xebi&Xf_#k%lH9qz|Q-rS6|@nqeTW<5pHC!ji#?7{*|^fNz_) zT9*Q@Gh(5toJQ3p#A4S~f(MQLZd?4K-!M>Q*7n^9Bm!TOMY>8U*V8aOlHa-3Dse7i zWx*aS8B09IeV?d;ov6DP@kIZLetuMvR(DLAT%tGv!hYEw(9HcT%0sJn0{6_@j##Sg zSh5-#Y0Wqe$#&{luXUOu*Qr~b{#fH|m(da-J3?rq*5#H)2Xidilsnbp3&4t`BZ*mC zqyU@Hnyg>_rlDGA7Fgv;nczQb$z$+>@zBd+$*Gb%1G=yFp)22v6bIZ@(MJxoNg6F^ znid4YZn@;Qw2b6Uo|^E`=B~82n2eNC4j`L}!M24?fB4xy>^8{?E<^1s;?E%3viqM4 zwYmUlecYG{oL>JZ%Gn<1nF`Kn*nD2X6=JgGY;h<6x5LOmVl|%@m1GhxsE8!=GmE6V zxf9tF4j+;ND2&ItjHYtkLi4+pic@PuvR}H;7YuK`OS;n8Ove zu=#z*Nlk2^KGf(B3%72jw(X}YrZlDYSHKCKD{c<|3e7v7=wAP`d2@N>`3*2C1(d*n zG*Bc+NJuR9=tN1*4U`?~10xV2Fv1 zkA252OaX*XX;G|_xRO?}McKi{DM6j3R{yp{|7IWed-X$tV?zrvI0L#Cwl(C2c3uV?A1h?(QVM!c($+tf{3us_dx|l{PX9T8iCg}Hy-lG>+ox?mwwq!6aEf+ zNLXh^iySFyHv1>g1vD>CeZG;O<5y3fCsp@VQ+hbojO%V7joa+P9vUqpZeJ554&Z$WoRUB-_3<3!iZ&8t7Y6rskLN=F2f6aK zUf*1vqtYf)*@!_yie)0s$A8GcCE(cYIoF<@l0g3WB|a$)L%4If9|mxPzuAsFBxx<1CaI@ zid$MFSX8Y-%%H2#1Cl(4&`foUPf6vwhRz(Z;#v-kl&;U)=_Ses7+vK2>51%F-CQXQ zA2>XUtW2s7ZHD2tw%$cB`d`^x z?+?7KqcGSX_!{VC^h9A-QKg{9e@y>?0PO-yvh4_%mrN&bZ}u!5o7n8r?{2N9SCOSKhJt0?#B^USeM6 zft0BQ(&*cuf#wPR2pfIZw{*a+$XAM(TLHm=HswJc6as{VYH6Rb9#g;p;*9un)hAyq zFhcc_?mf*|xyYxtKwdTj);25RcZ^i8(8j?w@$zl!ruMveUojMSD#rSZ7U)t)&JW{a zYPZwKz$TLfGE-Z#$z*h1AEtY=zu1CNSlv5Sn7jX{S+?b;S$0HevoV0VaM@KYmy?BU zEAHN0Ngw|+Xnx!UjS6n`oq4GVdf9REj@q6E(}A1?Vw=}WpuV;ySPaE^k>U_n07>`I z7FGAZTfI@bv^pCEN=8YZ+OcJ811LZm{^fLC9f-my%0_|klgMkCHU!R}0U2ej_TJLb zB3awo_AYD1d>hW(C8zhg#6!&xT$KZU?LS`REwB*!)fdU*iY}GBbDopC``r95W8(8Q zHZf)u_f_@p_4)P{nMo6EYtR>JP(9v?_Vg`JEiga5f!N{-=Q(Vy_4Qk?FjC$4Z(4g! z=dDtiTf48W;2LvBq0I4GKp{$Lddrz0$H(s6#Glt+y<(I{P|mybI80l&ABPySD0otL_>Mcw7)Lw~~e0Lf{xn zdOds8uRdOO*q)4v=t2yr2{Mp8A2Yh|LYuZ{$kz+6l>~2aDY5Fl({ z?@VykzR1jH)unjQ$>Eu50ZSvTKnV_&AjYoy@2)X6xJ`Sx+7xK+gV?eRPk^~a9hFM} zBKiwp?HxKvBAgVU?yHxJVk*-r0d?wg;dZryLvwIy{b!)id!3r}dw_@6&M{0~7p|FQ zx$@+#MDG&0$v1my1&xQNQNWThw+_}B{Y^~nhSu<=>lntxLH`%96EwVtxP&W~2b)-D zHPl-gCmd{qJ)2jSMr2Yd7a(?aGHZ=pPS}$BhuZ7mAn9O%V2#+|#elGgq1->g3Zj!V zNC=rR0c@9sfb5$q>)5FW&dys_ybk-{)c%u7-nFH_3BkPLz|LMO=R*X4S5-eB2?ViA z0=L1NJ5i<(tFc9ZtG+6^TNHQrf83pz}rO}lm&25Y88+zej0u+>$ugQarmGao zS(erTi=Pc(Xt+U+Sl4*uL#qp}oDRHZ1nzE8Rp@<@c-Uy&2iO+JQX&{krO$J>8ku=d zoo&GcH^;s0^lQ-cxYwZag!Gw#{h(+-F#*ExFX^htU7b!mmuKN7P#Jr(uYf&2dGFGf z?j&pD56juLD|Ko4Oy(&oR|@4w$Os(mCQ}^`D(qL#k64-wY?gt}l2$tTpl2M9@u`&wBWjw@v{+YBshTqe<-#76B3Qri zE*p?hJ;01W%MrB>V@L&pyo#1engsSkT*Y1v!jOKcrquo9xA0vH?BKJr$fit5j%Kbv zuYLKa>R2x5eoYrotv0ONxezj}!JecuFoaLSC{5}N{m ztvnU!JvLlJCiT`?5RT+D2bwSXY%SxwG}z|Jdu%AsDP(3dz=9ux)&ZzTd@YADki7r+ zr4;C1lY-A@dSM3pDVHk-v~mjh0XA3EnHy+ri4|xO`s^C&n5z*gvg*hP&GFO#O zz%N4lJ!Rk}%fE|U*)!wbYC7NTh+=L7uf-0o zYP6{6_D9~VawPygX|ds_-)5XOc^!5UI8;&_wi_FrlcoZ56?qHExO_!|K05Th^Xa|? zQL6#qWLqL>fUQm}u-%C@Bkb7zCH{l5dyu~99@u!3b?E9h6c;oC>0^z_ngBvw1VW1=>i zP~F!DCd7~!Dz7@{mF-h?fpPkcL5f_-9I!UL3zjR>9RZv@%3M}QV)_;3^_6+mp5fQF zw8f9!w`;*xCY*rAKH>9X12TRmc>_0qL~efIGaV~u-w4FyqBrY_8zDb>uT;$szbC~5 z^Qc-!GYtgXM~~{9M`AhvR8#ii%_$z_JWGY z1R?UOfLyAMS6z^N!hc;7D~jff*$cW4&#hF42Y?C5C^g%|qU1Wd_M30kz63mBkoCH9 zmx6LneM!sC#A7{2wn+DCpPX+Q-)&l(NxuohN){LDGSnftU;}bW^;m5{Nh)S3%@g2C zsH)dN*QT^+(Xn9d)ISH}19?~4I8uDRqyB3~kgxR)WU*BKV3y6lWu;Z5>{zy3V1%x)@ozJ%rnuaAx9PO zPFv;)V4r~%rx1||X(P?Wx?lhWy|f;q)8z)_=)NPDFH}^C`l8-`xHMFW@E%N-MX4|n zx2yk1=DP-*8fIA`fq$Np$y&8tNKm;jz!#WP3uiijMP{H?9K4)b;PQRY2s|577#s(z zVYBvonxt}(6d8$AhqaeV#)ExVGM{sSGX9tOT)s@iz6*Xwy0}ume;_s5Z0$U9Gu5PG zU~hOwih?ug>~C2TB7Y{5Vw~xacQZP`#;MT%IhBuGx9_M~MWPi=DD_~Px7+`>7Z2H; z{WZgh5DV&-AWh9MEXOnUR8V8LDj~+aNRxk(+nKDHC$PK=_EB7Ta?&pLcM94kV9WAD z0_?~LlP`>+uH|4+Vxfo#{t_4VR;1>{V2dLtz@2vnj?Pr9V$DK?W>uu7mG5{37zLAd z<%|d61AowPWwL*CAcOaTW<zMfN(Ixfmt;VcYPf10c?e53jZJ4 z-ZCJ{b$cJiPQX@>5Rn#8hL9LgQ96{AR>=|RZq%(P0)vD!h?LaOor+4=3=CZoLys_Y z{?~Yp`?$~feR#jTvp;P1b{OG#?&rSOy4Dra`|zgCk!LNws(DTP_HHJxrkiHYmdg{M z58^WV`ub!LpYc%_rw;ZAA*;#^-2!dTogrR6%YNrn{cRI;JI3;_p=+3a?<NMz*;tsudvZhwopj`peZ~_|1nzs|q zod8s?rAa_BP*~`y&5&k?9&aoS8FiEq{NW1{PNx(o4onmM)qC zUJ?rV3-S=}c)K@SmGm{vtK~XnQK`g+S-$@8z>&oMmp;kC12K1i?Lx*Dn1g$%pWjI<|V*Tluu9PrSJ0Dwm&1++WkqI=fy}?s8=*-nu zc{mZnrI!|h>aKj+!-oh;(Jpt+(RCcFI!Jl3bRgjOa+@%Z*2#ftckz8}Y>V=d`}k2X z)3SLky!uU}wPew0=VnV3?Nil;`;32z?ht&R4$_lFcYf7$284gCv!7d*5%y4VMj$t- zaTL?zK+@gbpi~&;cDu6Q;#z`#k#3T5Sj&=HxkICdFcg*ooq0D2U_n}@TWtL~a+;Bz z<)eB!o^L$LDhY}vP#20sfN9P$%Dxw22aTf9m#=TI3DU}^%Sofk5|K+sz5Qwjq zz_G;kiq!^0D^(x>JJQE4y?%OWx@1p3WNq|YrVCQx4)!l7N*k*{dra!JCW7~O@-wse z+b?g6JpT?Y>-hHSU@!pLa+@pE&QI59;W#!%S@+$Sj@)%y%N7tw9<2?yE8w}@3EjI9 zkgKq%cBWJ9c`5xarY&ZD^O-pYm-1JiaHsSdR;EyJ>ZMGy-ef5(rwQAOtlH1n=Grx1 zFr>5nsS&@?ss4eG_7Fei&!Z`=3`5njDMfM2%d{=?edbnu>C9YHE+wGd4#KBhoXa07 zFfaPcMRpU=tsWvfPGq{8-f1j5nN`d}LH`f6SWgz1f9X@X$x7>F6J(U_X(H&2)zAd+ z0nbRaY1B_)*!`#AYn%H7b2Yd43>oYFx(ZltY?TG{SqA%6yQW-Za2ljF2t6Uw5^~+w zZ8_9)Lwcx87xaD|nZ9WA=$kLo7+x!X-dgb`=7LChnwE_WiMUv#P*=Tp5h2kAn;F3S z!I~S(L|y~W<$@mGZN|rCqfQB2|Fw|~Z&5Y0f7gW0ldq!8q$Rp1(iN9uD6J?dpy@Q; z$Oc1u$kfqj+^QnDQS#s0X^9h6W+*8$yRTJXo0OqbhL5DZU~wT4+0JDVJ>xH!U7BTM zh+8wj-Nmt;*r)(06!3u0)rWAHWcBnOmc?CGgWJmrZWLkQLRJrkY@>o61&_v}B?u3Q z?qS^K8ud1W7~8dt$AprZqq`b%?h|8$#1<+if!J6R9b~ZId^X6RgZe*)(al zf*@zKr^GO2O13Xla7z~w;+I!VI3lgaTZ?+-P*?FgDt9(()LERM}7 z_R~$OC?31d&)X(ME#Q2%exx;DXE1}$%1f3ia%zqBUUd7kIFWg!jU@kJZ>Ce@doEL{ z`|VcKI;!{Cm~SyVZlmb4?p?+P=GDC^bGcR0(Fs3Rz(yxDU8j+jr0}xa2Wd>k@}>Y}Ps0NGCz5LwlZCs_N>G?&s=uy~MPi)W=oX=;{u(hS31! zS59#2Tq5}_mTM)-oCLxMrbl_ez-lYv{GS!q&Vnd=ZHZG?kJr}8%!EDB0cbaQu z)ujKlKxpO=gL|9U%wakhs{60#Sv<{$99!H84d~`y9j8eIpt*Sl=p&Nnc(sjOs|rvx zQ9xU004|T>KJFxc{QIlxY||BrU67TiLJ|Q|+k{r;gPi`^B0FYIy;|tyo0evKa-|PQ znPoNoTgX&4_hvv{u68xowADmPxsAairby3i)@wD!sbVE%P#;N^4X zgXjB914c2M({dM4XSubTmJ-4Dcqr1FB1-V6+wS%%9m=L7@>DQ=_D7d$y?xl5Q*}bX z6cbuETl@LQWHXu+V@bFnEus{&kxtfPKIzCnd7Ppf@PPpj-tW}%ouNvVj0ZL|r&srK zIHdv4CHc|El?@~Sb7oVXFpF59Zsb+m{^-xX4UQ9nqzwQ5=!-q5h#j!aR0vdMM-9su zN(*DZTM)~)3juQxpT04b$52F8y0o8YJO6p2S?B%-LfFj%+Qf5Q8VWFNvUvVv(923K zUqq>~4Q8PVF~Q8zP4_kSaw9%x;DCaS&+H4&6`aTATyH6uPBhd5ri8_G!o9J`nMVhgZaW_3pS|q*v8IMvT2Ip~Qn;&c!u`5cZ29(z4j@qsE}tZQ zoN3fQ_qmK!Kiij!8vT9&C*Wn-oju6khQGh_`1GVO_B?pNzJJo09+i*tRw9(AE`>h{ z{00c4vEmVZGH8LyGsy+i!)0{2>tpAtT+t(_dyJ=oSSD_~zp91Zxbm+@0ruSl-*i$D zcVO<^+lMnE^up#n)m> z!!NL)F2J3xIC#2PwZzug#is2c$@S~c5iF>O#^1HXG_4je$$(A8M}c{g)6NDZtqht0 zsVEr&Ab$|6KM_HimaOVaGnUta;zhv8h&cqhX?buYBqIU|6P+HBTk8aDB1#q2pZG?g zs1C~_pA=yjd9bgWREQdoBPTrLYKS%TqLEAY53LZxzzZ5saCHUdjP69mFr`QVD<-hh z4%L)CF4WiwCg;e1DsOtj@8RU#7#MFnyxAeL{NRZ;N^)pNS;C@uPE_&5W?x|_6b(_Y z-Zs-u^?<@?q8ruA0EtYcPBWGu+X0vNAU9$~D?jUOe`-R{p@H+w`yeHYdEY^CQ`$=< zxffC9HCHTTdYj()IEXs9=@dL=DzP08Iv0@t^D9I9M4wgVJD}`Y;ZrH2o+qKYp>)Wz z=)I(~THE4OYC%co;s}69l18R>fZ>u~5BgrXuwAn3A%XE34zNWypQqGSd)`1nki_oQ z7=wM66zll32+!Oyg`wWA6ujUu9vTlwx#!Hq%D)9eOxhqAN?44stc|mqs3Wyjk=~cC=3wyYFU-wmFoWbZk5io@Nn`tu)*M_xD zza}kmWrgPlP!F~+yH<9rw)CM|tkCv?w=fm1tB!7#c4x^CpomHxh4dh92|{P$6toJ$ zvRWOUbn$gvsNB!KDVLQFzyvQ;Xu+_7MwufvMOrYtOB+fvZ2;6s=|!df^=q{B?}o1M zfOetBNd>(W7mQL&X|8z}PXxlPums;${zJ*VE46{)$kRT2W`Ki(;0*20S%mF`!kF2; zXHUte(qFf)E#JI-WT{B=cF6MD8O^R6pSQ$2$WLMZ=@Ur778m&}<(PdBwqhg#Ny!19 z5TJl+Hg)Ws%-aErNM9saV#kQAiDn(N17F-aT`PzOW0tCB`1AB~A9cDH0F+@rcM;3- zsgoLR4?DlpbEsSiBlCWx89kbo>ShB3=b!W!=O~aV#NdEx@|9w)eSLR!;E;RA(r)bn zwMF~^xyC_QykT|vKeo6m=|1dOzc|X7tJZ(?HT>gy`p~E2CvV+!>~Sl+C&-=fPOlMu}8Tf7va}lcZI!Axyxg{A)Pt#=CkK3{aWNrDq^WV#kS9)C~7;o z?<4(dhh0C9Z3hmG{`>7$ip+dHovGu#3qx>kue)=u+|Y(kTm2Q{)XzX9!-iyLhzX)4MnBW1TcIiPO*S)c^?s9G8)uFK2hIyjiT+$RkIjaRI4>m|@#)3oq3T)&H(l|9LCqKMOIU4Wr`WaqaJj^zrtCU`d zv$0*Yikrzv+MIsvusy!zlxa{E)hs-!&BB>ZGF={0-1fs(?G8*hfkB#Eb9qX}=m&7; zoggK~cC`%2YDH*DSWPN2ED6y1Rh>Dz_s=sFbJwLsXZF!p(5E^Xn(IH*7wY4NHrBP1 zImam|F!XSTBU0kt*VP@Sk$ChGvfWxd4+_VRd<9xISv76^qc&JUT7yDUqQ#>6(aP+Q zf&g8!rNQHC*KRN+z@R&CJ{!TR7q6#%C z6|uH()U*obLNxt#-4}}0y@_kPA zgIq=$sGYLP7aO>K0VoP3u|G?W{&`n5Maiq}e_mQ+k9PkLa(JNZU$+1AUJCE4mqUJw zT>kh|qm%LfWSsx{vrBIe|DS*1oj+oD|NfA=%eVgsu>bwPZ=O5Z@aJ<>?LelFV~eZ| zfWrC~NrtA19e=uJFZn$azuv?BU+>{btTepgbOPik)dhdG zmQh$wjSE}l`26QD94yOa!9sU@~vkJSg)`WbM2Oh^FW`Z}N2 zpcq2jc$$FC&_W!$jSqx!|PtjE}j` zSF#a05CTPE4pmh0qIk!06NKoApafm%?@E~&8LI8c^9lwNfj+|s97v;K-w;?>Sjb6% zUr5(wt=#QVSL5m}VK{~FNAMZL85Nue&mcT7DhYpNwR_LBG@RuM5_$LuhQkq5hcu%; zePY+DcoOQzARsrJx4f*Z zQsNtvlBbutM(?yTUPAu4{B<>9mt#)X$l|L3vQ7xFT_dXjExOuZlRf@KBTWrOb8VQ( zWov;gh=EwS8ru|Ab@Mwq?$TLKwQD3)QnZa#CCBH_pH1i}Fh=L6KTL+i1o#elZf1f_ zH5)F5Hp{-Nu?h{$2-yXz7;(!|4&e}7qAV`Ib#;afNTLM<@(Q;7=^{j06F*%2?e-s! zPql-jXk3O)k;cc%%!-7!Zu1qI)K{US>GEjuUQdag4^lJt>(@J=(W^M_HpNnsgQJusRV{4H z*sfVOr18Um^I9vK2H6{X*`&KfX~W$TCnrKJv6SuX;u5g{i#n;tgrXQrw)cyGYdbdk z>4s(hjfK_Kq7?njwbkn$M~)m>967{zh1(F0&RJ8HqY`#f3|_O>5$K%`n{nNgN=WAd z=hUW^*64Nre#aSZlTu6EOcq)(j~kPVg_H@SHZL7{PWqNCc@z4 zq?yY&6!826LRE)-q<9KxvV4PJQcNghqFVrf*KYU9VIM~|?e3Z&lw)PAjlZ9ni!Px5_ zrAt*aN+fqs-ZbS-w8rt~OO+Dx6`tg0G|Yz@kwq_RlJ63u&n6rew&4+zA6Y=!xSi$I zUvPkj=g*xIa}iX8A>=^B5x{`up6xx52)P0(U~Y!6SkE0lb@r_BD?L;S#oS?QBGRcb z%)p)L*|TRWh{vyXH_UJOw(P%!&#z^;cqKvFpU*4AY3I7wl`D64)=l5d_7*hyiB7py z?(VoHzgYb8(n}U5+YuPj?qXvrsF7A9SG$&rqo?udYyxwl_45No=zwYpjC1eQwLJPW zF}bA3boyQKWM!`J1y2S8oYY zBtRn~A8DFq&OInI$)v%6@f*KIZ^v=23eUE{#|=*f7O4w&)n>Z>yoPd8g3|u)=a`_ zV01?u<18W0Z3^z7-r{(p=_{M56Mr0?)_QF%$H?jq8hikSMQ@=%4Qx(47w@|Q%i!qD_ddHGKTgyc^|O` zEp|DNu*LHhQY40Ue4tbbPRE-9Rl9kekMo;4QYV*d_ zrc(4Z@zgv!BBY)|8yCFE=v?i`MUO{qv=Mj@&gHALKM_59mWJa|N-7*4nxZ=%<=LPr zW3d3cgudn&ydJ8y7zTThUKa}tO=|;$WI#1CYfAt4@nfUu5DwcLHy(gg_-vjy&@qz9 zK^|gRF{{Z+5z!rQl#Nr!#-4#HO5((o$#$H(zT$Q`-!dujrgFk}f8(FSY<9?y1g0S9 z@>mYoL}Ld}xG6&JC7sKS1StNUqxar^NZeo8;~?S8s!9t(%d zT_4<1E?R|v(kf~MwCDBR*9{fE(GG|YC=KWjSPpnv_yF^=j(W(;s+X-GBO}Fgbr}{| zJ+!V0*75+$s_9=8=9?=02zp18(t|GFy_Vv)Dy-vax>{FS#%DwdiNl}1C(dNf#I^6V zEgQhN1NmM7t%ScnMu^hcmF6En6fu# zJ4Uv(#?C3C1UMsVG$7DLq1J-z@80hm$`e_OlG?iB?4y{#|rYiv4s3! z2+kUZ41g~x2~w0U8xf|7AoredDS)Kh2mq&OJSRtd#=nKViZGtawJOia^J74096fW@ zY{xrGeZT!c8U(y#Y8ODXeOh=I$M4&1WkpO>V&lBRUov`)VtD#%75e-HfyfJSyVq+< zD_q&0Xkwg}@MT`2MLnT|w?r4*KPtrX-LLyd2ZNK!n1z{MNuXSd_{H20Z zJQMQ0=f;Axo#ZpGFdoFFb`8>XYpR(V{MgJUaMeKv!*o&3=A%-z0)LqY9tk`5XF=Ze z(!soob^B4JMVX_lQ;ixXX777m9o9#WIJl~v-3SQ!y&c%3-G+tH+NSJa$5RmFwzb}g z!>JzK5SbXrb%9w%uCU^v!!goR{Q0t9Qq zBp*Ni`1RZOUc<}!`Yv-!6xE%+UW|y^WvWiNmveNJ`KCmD@<~sFuYPBKv9xpsIyb1F z+?s9?zj|!a@0!lfXBJuxJTBaQvgrr6(mJW3o-okCe=mN|Nz)UOFDAHWpKz8m*KEwL z0@T5J>Bp9W2aBha`|z_vs{3y((SDE}{m#mt5TMm{xW%FEp#pf8HvfcE>k2!&@WUUp z_ErOF1xMz&y6&mRReA)cb=;WRdD>C@js`#62=z;o^%E_v)}}U>Wm*{&JLG0CUW$%WC#=#Q*YolP9-EH8QtBOHeiCV4xgdq0 zJ8|MtQNMd$`P!Fzi0BQfu#H+03~wV_3Pwgo7RQD^+wOX-HUMjg<#H$EpyA`kK_agv z8QZMpoq|FCc;#DyJmI3^A-yE}V@m>IZyj$^Q6eqS!o8Ff*2_PJYMXGPYM@p8etah8 z({ezEoaom~-I6c%i8w*fouo#@M!vF1OHoag7TqgC#9*B2@fIb$;>>VAbl=!+xCjYs zM{mv*1#k*z(~JW)Rcglc`aQR{%rtXQ_#}|tbw!=x2|lAFBKi3X>K@6Su$bj?mW|(}VEaQsiX9tTt!swNJ*6oV*9Tf5Q8=dj8#!BC768D9S|)xxlM0v>^vFlFF8d=_f+Ka zdG6`8eV!kdV|$;i%O%C6v3aee(%`Asiv}H|w7e*a@gDH_$~twmWXzUNsF1HFiL@$o z>oVYMtilj&gp#aCcb(D5Op@}aoe*})&(k$C`-FUt9jtI0FCMs`1zfxdo<2>SDYT2$ z4x=Q??{Q87TR&l{10dhlqwmD&p&|G84$_j7`i_B8={LXkhF;R6FBB)jBIsafj5HrX ze0)8JIY6Df9KaDcI(U&CYKRaXr3z+2R!Ul`T z@Ja-!YjFOP&W5=J@Q_qEL{Z@0V{6BzmgJP(rE~$4pKv!yFf$3DK@%}?CMJ~lc7!&l z{*#iH8RXI_CdGQ|Kgg;|OH)P5vKLX@xNWn>@gUWYzb7;3|24l3f8IEibRbzz6>K(n@ zJNPW>YdCoHSPvXMbFF6H%$h*Zl3*!_33j{#xemnUY>f}*gI{dAenuApOm)))P=V3b zGC3<1uuRZ2c~B!tE%x)FZ`*4w%H|NBxx>g4l~R2P>Kx{3S(eG7q1>8EWB}pSdETAczmj>ruNtJH?p0=2Rndr_X0WV0 zZI=|vN47?NwT##nGH8_{X&Gc$dG5GqU~Rf{@5WFnwk160E{APq695MKvGt> zXxykk7$ozZ@=VbR5R|hrKVUe~uJmnia4=c2QJ%NbY-bYVwAtmdth50}@WEHZC5D=G zD%}rom<)~Q8NWS;E%hHouk~IZ^->mNA~(ueom6xiJ}X0>+v?u~Xt+o4xq9p878R%Y z7s30p4iGLBeqmMEt|>pGO?1g?xif6B$25)=325_W=+m9bi|FfI7VA?ImE$TWT9PTO zGfAtfLRC5iI874~P7zV|C)W3Uvee+-dbkQbH9hntt19-<{5=d)42+2)P*d&8>p&wK zp90M~+g0%6NIdhZ9!Gi}QQCjg{b-S+LkK?qe*W0M}w}?K&XARwC z)xph|?Rw5v9vM#S`fzI>4mBO?HlG8_fzYfVeYcCs7v`YW zZ!5S>#&kJsBR>%_6qFb^5Me#_CvtDy+zaCK_0dXf%h~fAqeYIi_<({I z(f8Agt;+!^WGDir(aM}<{Vus+t_xAt=OeB?`sn92V?pw9PIB5TpGuAb1FYoaQ4BUt zWarB<-UcB=l|T)KQ>zio=Y3&x!`VE;f1K29h;IDUo`AD=ZkH&n+L%6EvRv2~Byt3X zYD%0MX=bnNzN`=KV{nzJ+}t^|zL=h+U`)X|Mp1ljl86H?sr)zJh)oZd_yAu`)kAl` zRiTAdtMn@p9XbW4`jh07_onwU*^`ICz+!0C@L51H51JPcC zoks)72%H!f;7CSmKf{dc+Tvv&UD{Sii&JFtSVXDZjg2loC(c}|@j(p+sR$-|r=`5Y z!7D%usS571EE{kybizKW*l`BPB*|@+VWp!#zIL;ZSZ=;|ccW)ueZ3-EzHE9^IsC?b z@<(eO5!05sx4f0?V9asdslt;GU~O_D^~4ADR2&qx_^$y#$VMHSNj8ig1?{d^D@I3J2=~oIvN(%3E$~dQITzxRDP`D(WzG6Rz_rKY4_PN|Y#zHsG-5_29 zQN7ZkZ!>=Lr1k`<24Hk10_$w?GsNovLNRBG`$(RD6w@xatoEJ+AgQW(r+K#V7>8zI z^wMmn{NhBjx$@^wa1>$Yv!6WCQ(%{pZ;6xoULhQCalbCppQjZ3&{~P~XTgq?74Uj) z`ZHNJ;4c^m=+4^|ADKO5(iMfvE_qs1ni za#U;f`H#<{PcrMDW@Kb^JIYf8`?QQ&hp@Rs?E5U!ra<5jzKM&AD~AFQ3tP1tkFMpP zog@4lm*`rejw9XEPgz(62T3&+aA07qwb zT!k1+^u|Lq^_B9-`1#8Jjx>jD>m1poCHJJh*gMZ4)}v1|BGEg1|c}Sd_RW;WF|v-WEc?H?{u07Jq*+JZ;x5 zDV)l!RsKM#Qt&o#ON^EOGo1YUZ5W;~v5*fbF@28xbNc-6x9K8n1wzPU z#C5B0az`FieHPQm&}CuPzsTX~>A6Bz4?-1YCMKqp3x9v?-(OfS7k>)1Ew88;ho0ws zErZvW*q~XMf!d1jcQE`P(_jq4d4Z4w$TeYBq!oG(!?IpgIymfDF7sjk@3)h=5hGWR z96lTfCtE=+o$Jap3$s)?tGKxM${8QBcf6`H)%yf#bg$|iKor@*Dm|5q?8XLN1sVWU zgIr`QJ^(Z2s2IhcCW91K3z)W6X+*LI%zjV4puoUO5TF|N5(t^xrUm;CG6b%zIg_G! zAdBt0t>*5IO1cI&qB&F$Fd(1ttOH*4Uc1|DFhdCK?tVauCKY&Wtb~Fd;B87uN<^%- zl*QP{2on(JLKr>QZsB!EQ-WQYI$hdvWl45~7P3SgQB|2T<1V5PoP?>)vZ8(mf}TqL zgX@U6^uI^CRQnE!T~S7E=aWZcFO0NQ$J@09M zHdEtFVrN9Y#g2aQJs4sdCWBp!^nCdY&lEnhY-_pexqV+VJ+hMQNt)-mQLjyOICbh2 zfOq;PF(QuTx1f{@4&m0p$Mzuyh@y_OfpMnILF0{K5yq31M92m1_h?1pbF_2@oktxa zB&=e$kNR+^N`#roAs?@a{i~qfE(2xB37|^Z7uk0E68mOT2*WZsAXz*#{LM@XHNmt z7+)F?XrWWotEx(S0|G(mZpZ}Ci?SNl`n>}(NOx;uN2%gP8lHdZBiY{;(y50?hZh{wW`m;nv0VYq-0B~>(E9HFqpbVORV;ja-reZdRUN} z-bmBX?%fG|*RjzzrxE?Na(xf$0^_m7iKyV`CK&r6AZF`JY1by1o3(~o5;BVhS+goP ze39RnmP==H1)p|5q~A;!gR~qIZCAddI=?q5??$erjw5a`UidC`&z>#L z+O;--7|0s_8*BX?r;Ox)BBdb3=<3z03WFYm82cI)ImsIvJLKmQii#v6(xR7u>aC6; zkK%l}rViM4z;yCa#SoF^plt{ER4Sfj&O9?JS6lF-vF=@#-nESQ_&0=D5B&bSJXa7F z$&C?wF19KH%xp*o&s~oIKj-Dn<6W|ST3kZL+snlBcJlSzng01+GUH2>`1FuR4(EJ z@cVddCKvb}YqxFP*I)w(ne31!sf*t+a`SwmY zc^Ar%gh-G?5DltyitvK_E>q)s9s%|IPk#Wy|6Y@Isk)gV3G_e6BXlxr0Ue7hO*t}V zcJop9&oI@$G&_8EcY?vusmG8C%Dzx#iOnYaN*G=GlyA_lQ%joVB;|tH2kEI+ z8e9tbd+)|}Nd<%$H|_=lmf2+3IW2(CWsADxgKJPv$L_ba_mD0ZRDt8ySii_o&)Z$V z<5fqx!BA`s6Fa-iL{scsA+5}lQp#iJcP!o)fh7y@gV4YB6=KD1rHishxuJ#Ev*!oq zOzGiNH6~VitUUNmCd_E<3>_s^R_!jBmc~<2Uhr7&wAVVHJ@_QJa}gS*-qtHPPNZ}I zU12TVvt+Bvb=JF=q`SPf{(7^xglG+KYXI^QQ$nquY!2lN9uu0`SJ-1XW!_Pov$fIp zG;h9CiI?)C$#Vt_zjMOOc;e=dA_FhQ({=40;-9s7EmZYl=iiFX7uR?SdeF+Plh6|I zdy@HVu!+U@I~$sojN^5h#c|6H*wOpx62fRo%9W;#DK^BcT%TDBu`0>|TNt;nEQAWk zYn0{EYK}nkF~}!d2zh-rFsWFMuSxAwZB@_2*aHK_&9_bhzaA?R2tR9VdMVmL%e7p5 z;p;ATcBUiWpL%x43N37Q$@I(DBa3Y{)Qyxv{g=?lm16hpW(6DuLqPufzW?W6J@3-v zqmND5kNPh*H%0s^zkOe5lsqUm%9$!AssYWRgt&7E2*i6=&Rnla-FFqz=)!<_7d1kL zp3^$h$wRY6uWf%Ja(yJ5lTq$Mid-%p-Q8*RGyfp{;&dvKG;4=9w>oEKWrdg@8F|DR zTfVi}XhN?Cp|7@NycIbSTR9Q$!}#ta^q)4FC+x_+4!%OE11_gZy>h3gqT=sk^$E_a9uwIAwKzJ&uKwqa{`)JVE|z2Cwxcb?#SGN5Y znyJ{Nq^CW$E8#C*NdwLwe0eth)=Tho?>4O0O-Cn6cNKu?<4U-susKpi^LV?1d4KU6 zN%h3`*3`ff6p-#R2RtH6J*ub`;5U)24^4Mp|KPIGBT&nUP= zPcJ0JGZfg>2Jl;SCdr?NQYZxI0!2Dq>$bS+MmW1>bBt(%>?q5GQEtF4X=jixgbWW7 z3D_O@^`P8be+{!IR`iI}Rw3l8{G<1!I&JygHFMP(R&Xae$i=v(fydpw_)NrSFdzS~ zmu(~YvV*4}A83V&M&1H(dwlK9Y3N%Gyto5b=6dBIs8>boAf_A zWYL0(0J~qZU)W7h_qK8z>{I+F?ti++x@Hc&w0z|IrU8-S#h**o7Z+s})BV>r z&llDPB~iHnSeI@q!=2KWjZUdD87_&uO&8dz0M)^FFDG z)+p1~kq`0F-N$bWPZen8{0Mj=Idw#o{yl4A(#T~>niAC<6&AO;3NT$s(HiVRn8=V! z6md@pU|u{YOvfK$H=z(NtR#6G`|8t^&Wv%#iv=ov8Um&LOXbK2&Mox@k)1}PY|HUR z&1|0_dQs0NweP++-0)A(A!lO&H@STG?U|ff6|9^Jjrwuhzr3*;O4y&c@)A4awhzy+ zK#L<2on=SZ|Ldw!P}pA9loSSuNYJiEMu>oUSG_2)(lkx8I1V@lfVLn$ixZgK^AKv5rsEK{Jd~sYGjxs43c5@3#B%E3pz*=y8TFIdLUgo(2V( z#u(t9yRpyk(?P2gK03N&+wMU}^KN?UXPqH3ca`hP7m=>$vzX}o=Rq1O4OB>FtBPd} z7vOu~GCw7R+KF$EojyGa{ZbV2AJlL1ui!mf!X9eNztjeXuP*cJ1e|@~?n+<8sS_t2 zqV?QU_uZUYSXz?F!@N22##a38qm#T@Kii;9YlGi)W2hlU~p&W5EU(PRP+d34(O_J6Kp z9p>$+hWpwj9|2dx0&waEyM6lFUUNwRq5h-SIfI{o2`dBh z_8m4!t}jce(716z;efgC84k`Q`4o4Ld-py>Bi--}^0MjE&{}50vfY0VT2Qyyjd%Ke zRjWIjmaCf6wID9Xsi`+m8aE^koQGrBMyFF6eR5!kh65bmkRh`zqQs!8^V_42WhxT1 zf=|t!GqcErWE;fHKD-x*48fLsVm~5&<|$fFT>D${?e#@?oPe(}_Ng;=s;9y{3>gBE zqYD-ZwsPp@BryhjPwF;_UYDS%;I^tFVPFsJ@D%I;%+t85 zCFcKV`?Z|fZwt%S&~9(8Dxbdn00QKiB9NjSS5-62?sI_N1U7Xl5^Zc-%jS94$<0q9 z4l|K)7;+QaQ)Ly0d|!F$+go{1am-!!(JOPThe_*fPRPpK5HHwB7uC|ijGAM-A?Y}e zE^nGfx(PK)A84k}aH`eKiQ9Rst#6v9yEeRB+gy*R4og>0*Jyyr<6Mprn-X2vuUc&W zY*E0w#nk5!sy%Us4!6hI`2Zk(CFzz$;L4oU>I+V;>{1fh+=1 zqXgE)p=dTGYaM#Y8ZjU0Lyh^UxRk?uzmmYfjC9gA)@1^9y7={*H#sRHA{)F~xnH%> z#AatG^^zQB1mQGHggxxr+ue76{k0!~+2cnxs{;I$dc&r3#5eArZ29RSg)d*QUN^cb0AfV#b@bxZWmg5_F`yMtwE^L(xo}dj1nVmRE>wt` zyS``Mm9At5TM|IFW>%D@x{mkX`MU!Um-n2H)se~^<;ND9-`|GSg? z`|5jVlugFdWgf?-SPdl}rBUj2(XTm58_@1jYCjdp+7TZg;VCq5g__bCf}p}L#d)lx zg7bcIzs;tF$p+RdOztCn#y#5C>s6ve{V7!4Mc=!HM>G4^f)MEjwFq z{dD6Yn=;A45d|wcFz^J8h|%l(r|tdan7bqszTwY@jDQrm0!iCXy53jf9j6O*(frxi zbWJN*Vf(IS`8%rvIfjYZ;Nqi|A+})F`rsFbCZRJhc6jV1cYW;2UtF z?)Qr0x59VKsv_S5Ps>CiN<8yiLTxT|M#yg?K8%$`gDGXO-$~?ol*W`+6!rHj&(C{> z&GuF_#^T~#muazJm;gr}SiB_y=~TA12d6Ay95C=!R`PxYoF6*4?nvjtYEr5 z4t3kL8YSAq_33op@mB%#K`q<^MWx)BrRZ`{cq=T^CaJ$Dbt1lFjZW-K@5}7VYQ(O{ zR9to9|B5ijD`Sh4tz2evZt=M+nzAklKr}p=6K&j4*EK6l&##*pn)&y=`uzoLzzhxd zd-v?bmJwx7zi+=;4Oo@oD+s~3+KSwDkF0*-xG@B@*r~Owv%)4Y&)t9UU~g-((cYUL z8x4|>E~;D~38-SjG2Y5>Ryunok=;h#s;iJiRhXjdC5A+fV|KQaz~yHp#EACk2DCLz zJGf~n_;?vr53?*QHsMgx!MKfkYdt3T{TvrTe~yx6m(OvZrUVy=C`4t;(!gifgYhnsVAUMMEClWjpL^u+nj%h!X~D=BS<XeNo~w}54b%4dSQ5@(BJE_OPH{P^cO1I14tFKF)Eb6 zlz0A`b5)4DN0^$cTann$(MRi#2T;N^G*(r=b!OH`klQ_`-dBBg3itpaFx7s77CwIA zXCU;8xc}4`H&^a_V`(V<7XO3W^AvsDB^>@xV^8@0cVZK}SKbirE>Wi+A++k$5R#NF z3|umd?@y^Wc3uBHXc#WFs|O+5O~*UZ(v7}ncY6%$r#mvusei8+3Zqt`i!CxS)GPIF zjY{?NZR`sRiy@u`@^6ZkakV(t$<{<4AA#nDpM|kH*`g{N%{Q*>^Avgd{5LS*JwpxL zSfEw*c=BH=oW)uq|j&h`x;Sbou-Lmk4ZV$z?>IQm->2tJ>i}7d-}tn z;eXvp9VRgQ%bh=E)hhO5ZsZYiDaEijuqce5XPiw)jq@@!KPMYnh>N##TfQzYueBjI z@P^yezdzS|=58#hcZQyV=X$0$37iYVeTASC4!-^JXiw{nJ9qBXp(VC1L6pNgm`u2( z)xbj)atrLZVq;@Lr1|?pnuJfqUfMRMGqvb3(qf?Rj=0Kai7GYDSwmiy%(lq~G`$>EAxav6_-Nx4d=GqYa#O` zz=zDF9AXy9!9NJP)AY>Go*lX(E7xJpcXTV-wLID{wi<$1?o- z3M;FezA|-vdOTg2wNluVZ;8*V(9z=O*?d~>$Y-89(Cj{S1pOuq(Qb36H1l zpS(f{Ti>~NtFB>%gx_-p-Nxd(r@gtrQFeW7-fjNfo6{1kfxj0dMJ@~b)t3FXYBUB` z(ifx|83LrmXYOB%OUcJf#<2z_e2&`3L@=tayr-2fbZ6z|9a#nUj|mL{E)@?X?uunD zyy3cSJhO0NGn9hQ@Qd$>dW3t_`kVCHh1brhq|f@Kwvk5v(SHHxx>PVwx7M1>iiOS; z(l*{2kEex_6CjQpk=?N+`=YB9JP{~~|9@1SWk8gB+wI*3if(i(BGS?V(%m8=4blxF z9YYT>l!2&pcSy$&(m5a^-7~;QgTw$s!!R`GKl{ArdCxPS{i5UC_jO%st>4mO1%80= zha9^70srqWaODY>Xh@3PwcnD4bYPuoAK1$Wdv7%W_9T48J`*+>Miq)J>r5 zprIG^$}hhc`{|K>lW34Yj zb9T@8^sSq`zcl}*Qq0&KGr5sk1S1yR@NAOG{G3aSv+rZ}Qcw-VM{-{wwo+=ZdF(N)nI8h2c@% z^^&=$gQMd_v*j6p8w1h%2i^a9mWjHt^U1W_z7nZakXC^3=9xMjlS)q@g~+*8N#aTo9n#1f@W`ZtrULE0Bea86Wlp6n~R03Dt%%YtsRkIVuBqZu&Bom;nfPT%|qBL2UR z*TmcZm8+Tk>H$)%Vu`k8#?I)b%`R6@1)|~EeVr8fj9eV<(h7LW0Mb#G*u^#{h-9OrdqXK)pRL8^(CXOr~-|gscmHuc%UXu`uP}0=P0TECG;3P}~Nxg)NCT&8Wm-I*Qrt7%_ zET9;zf{@6_NFbA#HSetmLW1LTOZ4eW4QqMY%J$dJbK)ZiE`i1xhXFp1Bm3xB2>8t< z=a~DJ9;MhE3Hcmg7*{$UqQy&FN;b2`FS%@_)+9cGHL(%*Oevl-nb@pf^j?|m#rg{QzW%MV#^OusvTVaxFO735N45EB4f zRd+BL|JFZ8W}c90KzUGq`T5NRl<$>Ok&%L@gqcZ(z0v4(U1KuNdA4(^RiKk(G%k=b_ zuAyGPbEn|^pR!ownmci&&{3K}1{YqbqTA4{G|D|N_9wFPMS#{o7X@D<@|oyAcI*|^ z<;FjPoCVIZT9wnznkARUVF7z@yZ#(LG=4_;-KWhS!*Hw>+*f^jw7ZOXU}w&kk(r%q zzm2$*PtaVhaP(P*`c_qhJT~(SHu&@B&%i#dq?GWCjmCNPDL`9QX14tayx=8MJ;85t zR|Qj}*8BkoWUmb2AV66A2`kcIW=Z;Uonq~1&{CuT zZifTk;oaQ|$6(O6Iy;JF5)(V`bxkx>t2=(%pgDC1+!1e!_zh|^=>%?mjk=blhY1&s z5>MEOj5BJLdKy}q`CM&hfcZaPDIuuPjo;~JEce`ai_dJ z89rf?^{r*s*Xpjq**G&kYg^AZ_B25~g#18Yp}+r8 z+3<0G330qXeFa~=sz#Ci(FxphG)q=KSvc^$#9nvKAG`CW+tDCkKT+eGNYRpo3J15s zNhKHMN8AY@ub=8uZu74hw<8c)3lT5UE{c&9+$Y39L03xjS332We{DQ8)gMs6_01z) z&Llds61uDe;l6UEQnocVsbL{(3D?hvC~@eN9fxirpZ|P}uA&qA+~+(sl#;r4MO5a$ zJo%fe2J&)Id@bY``?je{w147R)kAh7?sj!$CL+3WmK;5ry?s`qZ>IS4X+idsHy>nZ z&d$j?!Lf`eCpJgK_-;yf(o0kWBmZIWuU@bzsERBvt1+uU!}`{8TJn}rM!gESw|3%p zFxpNKxTm*SAd}(N$yQVx%p!4#qD8gYbbmdbk@L&Co-Ob13(2AFxz8IPc^`Xx5WD(O~D8X@? z4)+B;;psDuFb*y%o&CT=PNM6!J7t?%$R&f`c zvVuaCJBIqQ^B--cIUg+fG$FnS@F#f=bxuz0%IFlVYwBND>Zv1wy80@AC={9eG@^xQ zy!0y>!p|9IPNkzcz{%zRHyj#QF<6kwF$#@^ED6%ka_7F0ik5IXG4|Cb#Vz|r$oEw6 zk06Ue&VxczIuJ{O@d44L}9=&L@GCI0C{Dk${wzKYbFpV_2Kht79XUU!=L zGW-(G{G43wNY70y;-^M?eEemaXZhXrg4>REH=md!rsmTLK(uG)`kK}3Z2U<&>wBH3 zybY#)HyFzBmn__$@zgspByqDHekIOUQ>6c+S#SMHF!|>4PO`VwZhp11sn&$eJh%K(3*86Q z=CeGkfJ0~w=a%ifO>NDGK+}eXvP{txfp4z#qCS`Vp_=KHa-kGEF0ACh=I+&koHVM>SUD*6Nco`$HM(*8;IUCgsMqIlA=s!rw`62B!#KHDoIBNzQ~xdlJBw1(UATWu zDQ+5xo)*Eqa};?1d0`KeauVJ0ZqfgXyNdh3_}CFzh={9ptEAIHS?GLJaUI`fTR@%zfHN)ftmeA~nl>CSe);T1RXNv2X{A4$~RfR09jwB{yBdI(nUUt|DC@Dw0 z7EDQNzKl87*xN$>bKEoFDa?trI6NiH3OiA;!Eae+j5~ug^2;PS1?T20wvZbVhngsh zQn}-^O00Gmu})rod8$QetJ5|@^(^)(6YTGU%Rvp2f{me=LDCcFM>*0EbbSI_yjdLI zJbHBbLS?lhJ#9mtRdTk55p_+PMraILU76^lZf#qWO;;C`x|0#?#+QxF#-KeNXmHJF zcm2R}TM?VBvZ}p6{(H&aCw|JaPnCC@jEsx`#1yykoD^ai;7}h>K492x#b-?aUL&#_ ztNcWeB_@CnjPvbsRRL)~ZPP&i5}y{JrVz3_%OF$5BqRi3E`Im!3jYwu6l}1ut?}W3 zd)m4AqVb@qs64q&6|1`v zeeU+pB(Y$l%hz84<^q?d3?;KV>j6q2&L|*j*RWk-w45N2Qj1Yqahj6zvGNFjtqg-&(=20#LMf$Jm%lgltb zuS>qJdq)Kaj@zp@ad1~@y#FR6C zSLN278CJk&pj!2{!=(U%ie;?~rfGZD*Aif{?G7tY3+-)tZKvA>qWPeU&w6OV^wm@e zW*L*IE{I9xLQQ1AwnT?w`@7eVqvH>I*F~>i`LX;BJ>ROI*;?b~Je1P1B9`Y%V&+bh zCw%?8^j`ja$w3hrCqGQ!$hJH!%){8sK~N<o_N}AmbSLH;|awzT=UeHU`5XGLO%bisIIDH;cyf z)2E_o5%gc@3Tcpze_C>DwO~CZI-codT2N6#VqN%dW0UBoD#`RQeH?6WBr}q!CbY$~ zKRfmi|M70w>6lOZ=M2w0J^xiH6;-nw>^CyCng{T~g3WKjX0CcB`VG1YV{iIc;V<%z zey6YCEG|Xu#s_9x=apo68~>hRL2r}tW$*i2n(*uS*hDsXdd?h{3{wrQ3ffgg;`>@} zGH~lx9KyUHfjR%%xI5pNucP*ong)eWZ*l4BU_K>P-C+?-U-^Q!y@}s{kX}po?!I5A zRx_dmUp=b{&o%zy=_2xYJ z_+Tb$=X;5rR(?yTO?|0%kIOt7%%)A%40XGm#m;P*X;@3+V&2fanX!K;fL+K<4jCug zS4L>|=zMaUBr=qIh29-b7MbvP*0A__i*A!AdwZ_-?O*(=vQNN_5&N!v#H~MXKh#rX z#Qqty6vIL88YEhciuB|e`QE`QoG7ScVjLQ>+HBDnANSZnwpE{erIx=(#sSn>x4I!q zj4yH_$V_2vHe1fBFyd6ds)evAm+;yG&z3dK8NCqloyvj`;x&Qqv_>Tm=!~hC+unuD zxM%B3Rop?@a;kL`Fwqbt1x$JB-VMtCI|gJ^78v9E#c0K;oQrd`eQfHcTp~Ovn+hsg zMRhNxDWda9ybLfn@lY8TF-DbSc)UM`nqaoX2ZT_N*@7V72T` zLFLCzRZsQhi)5Ir)k-3pzaJDXq>he@Z5Ng?_n$x{C^;#g_}2RKqPCQ#bn49NRIiCr zUUg?}I@J(=VfXpzx#SxE+omF+yzQ#9U3R`khaQjiq#`>jn)CB4osu-XT9(9lZG6$e~$ zimA1b&7!-F+a7eF0jJ8h&Y-q-ZK7(twP;*Q+Fxw(yGh&C8w0i4<)*R#{s_2AXlykg z_$S$^!6d?c_f>tiCTy(mWhR=a0B({b0vgZMf7yzdM78X9-d}~FEM0c1{@jyboo5Ec z!PX6pW;lt-@8%yRZ44DtumY5AYUd*}7)g6qIC$i;*b^%cFRrH2|dwx;gFU92lX3Sozi z3SAKv6?43aMg$hm=XrrSFKZ{vNX8?ZU&r zU-DZnMBG~tdm3#33$qox zv-y0_aw?mReX1V$rW4^=_!Gxf2UQXqw_3R5Ioj`PX7m$ZOHoMo`hgyU$?g-_l+g@rE6UypK3aFK|VTuKcu@ zV)aSBU18{x>g#7gt-U zi4;CpvpYGh@Y;OAb{OxL@li?KP4t?m+T=({OAVbzV1_crsdZu|@>pV@30j7Ho$gs? zWS%ZP+2)8We!ZVTo}C_Fjf$(qr;}*XhHlv!jd@j-!OB*5jmHc#%f|dSi^zwPcU+Dw zkxV|TS)Z2+45a(QD9ri*t2ml9(@*JVDMsqTI~(LQ$kqTz0`&cCD-H!ZB3_BF1NK?T zL;AQd+ay_z?|#P}{p{RWWR`-V^K*HZyrLEl&=g8!@(Qx} zcsS$dd#O80z$!*?^F4SFv!}Lvv&27tOf5y&*?dI3kLkTs6PFJDqD&11=W+a-Y6QVPIk8Iemfu zs)n*?02;Qnl;kS_Xdq1%$E*AN`Fh!7j6E8`d-#~2U%7I5p!iZod*t)oxyv8dDlK~+ z0O-0W5+hg2v_F96?-vUMeh8Flqp{@OOCXw6JC61CW7J?%C0WJgHY&nxR3_3kzU!6b z=T-VnEys^`cj|Yx4>mIBk|E_KX|e!Z#C4)xt6MdS-JB}HGTSWA_R8%kVsGE*4`eKLEdp}!8t={l}x z_WBDBf3ccpnRCWkcDH(QP1jiwPDpzZaDRElHX~2>Ox&vY>ZRGWKw`g&{352}DbI~~ zL%uS3wh5{S79V)G$_4}k4t9nBW-X#)c?lk|UNgx8OD{!xQvPE|x>4x4+Gv(Ori#md zAXXNMZeqPTj_V}%3M6+d^Qm!j=ys^l(iR?HFK;{}U!hIB!3Cz~n*En0epS3GEm$*| zw`S!IhnT9(kmPUS0nRyd`>S}$A{r4IhZfWbmDZ{ke{vo=3-&RpV|@1w`=Vi2NYx+k z=c3xs3~a06YzIWNhBKaTTlp$+-qixst$JI>^uM+3Unr4drXKz0E`O!|#VGq4gnfGB zu40_sUkt22wJsJ!cz2u6$djJ#AD$@D({X>T>a-~Nd=aLqQXNcMnn~F$$_>-%2?9M( zrvnvxgO#=hflQ{JnIVbg!moN90zWJ7B-?7S6=)d97ks!g(qt?q{&6XIS2$iMaC&Gp zE1jZxG0+M2r!L2ieNTjLa#scn;aegLzr7}-C36P1CM(Rux3@*f9JZQM46EFvoVIz2 zQ3qUA6wo6td0B2l`d8v34mKxYwzhJ1%p@2SLuWX~=BkjPOux zIV6o^-y@(7CTOC}SQLhu{z)lAPS$<&xA0ndjQtH&`5b1?o6Ix1o88$o@&eOKxmjtX z(Yq^UMOL%Z%ZK`f#}~Bww2e}*fV_Ojyi@B_NzZEb$l$z)DX)1bLHY2|x7Uz5j_4|D z)SvoBPrSJr)2JB^-)Lz?p05}7$0smSuii@8xC5PYm7CKQXN35c!8AqW;is!Jwt^c= zx$nsksb!v&?w(IIC*RB04b^DHA`izSBq*!h%Gy6!uK0Pz+n%eX)iY?D9%JhTzDHbU zZkI+m@eC+#2bFZ$+7G(FmK86HFG)M_+1!bX-q@0t^wd2sFJ3dwOD|z~h2}k#9a<|` zp^i7-k2KpE{Aq|&8e*1o7Lf3uZ&aVw(LwRV&i;935JTp zDd)sToQA!%rA8e?LuRxAtL8m`-Q*(`iMvw>O2XV0!_$|6Y|io}hJtc-|<2Q3EJwSSk`NJI22MmJGT3Xn|CAWT8$gT`z+LWsE6VS;=Be&Gm0 z0Dt>0$n6K*dGw5D45EozKCiNkrr4U!3oW|7lq(Z$(&UwFPEx(b;1@H?!$<0|n>nEU zkJ)(xwxqe@D6WAk5ZC!2xvV(Z;Bq50j#xOJcTCEJ8{%<3YqDPGSTGi7!hu;=M^OAi zK|+(?h3F3SaGta@ayjFk#s7h+l(*F|lp(3CM4WGB$3L%eD-8bj$Y3faMR#!w%Q8c* z6CxrtWUKQALGhvLXVDf1>x}xPgVv}-!2(^WTS`g`UUuMi>ZaG$JxFW-^mfl1Y)vDH zVLB_vfgtI{9YL}{=oECKOgLiLKWEHXuq0=HwZ)aZ%z*YGo2>Z5#7l?y#6S8Y=LPSn zN_VQJROK8nss_ezVyjP1tu0-XtTe)ZjbIHBYeBlrBTwRqviM}{juqh~f@%99(B`2j zGJ2@=G>7bkg!Le&h~=3ofkOU2ALC`%=cO5{EKvMC}IT_oO;3aHF`pH(m#W+eH)+B%_E z={%>RKW)!mp5m0Z?96Z1EO~xHb7|7xIgVB%rqJ1~k6EKT&a~6(-^@vy5tSCMtBFcg z+bBDTsOY$3iD-YJwkFi*IqcF^V$>Fwz9IPI`#}Z!9+ISE*?8K=9fMYK-cB%Tk+S_s zzO|G~V*jwu<^`R&dS`b=lztWW%65nXX|)EW%P`Kwho@KjA2EvLCsPq!3VA<|r-|NF ze~g&DuLlp$#TV*}lzTUNaCsu}>XEvG-CMFyZK6t1zu z5~mIF0vFj2#W79qcQ)lt5F|vk~Lawu_csz|w>>wlJ z^m}lL!1qP2e$AhgpJ9I1udD}c^e6>RR$KoeouwQu`5w35ClVD)F`1BTG)1`Co2-eg z&U~_&F>2E|w;2GO!?h9r-KoQ>e41&Ug2x73t7Q5)?iB@3YYkgw{Pj&{FEm!1d4TNHe*t16+y^!-~>eY zI<(muk_bGKtK5y}MncXN;6yTLTb~U&7m!*0H?`i&$%+j2av6S-gU@K!9lqz!z5nPD zOJ5=<|9jHXFN+aG&jdW&p70De%iF`!w97O*XqAfqCBoX|+P&+&UrAXvih2ZoXP;I= z;p2*3@v(JvUYcadf^a>vYELMwdIc}9Q>3s?y^HyXlH%tNA4@kyobmyPcC=*fE?o5< zjhJP=)hlpP+|D7hzf1c!$THQkZZ?&4uN_BI7>Irbh!x`ln650H;U_*EE{4e9fKs=d zwT@Pq>QI66cVii~xk-+lT*{CWTk6V*l<>a-S$$DqLtkSs+F|k_Ll2fif_OCH2vH7$ zrl%PJg$Q#<*=4Y-#nJMrOLSJfJP$UuC%9iwb~OjB3L`16Rtn!28>4vMP#Qq*{xN#A zdL178?tq2v#N?HI<6X+@O8zEgi!jLo51J|@%i!VoyvpUPHN6*`1}OA&p=>LM=);7= z(;o-yw;hIGT@ya>|D^lfH4l<6Q!pw#+kF><|C=hK%$oglwPDx|+44-Uc|?eIrY3iT zQWID=w6s~u{*E`?-WD`x@)G{lFl)J^^B=z~7%tCg9S!yOU|&bMlh5Qg0zdv)N`+vS z6HUHW+L{#xburCNRA`QzX%>W)d;2U$XVgeqssP(O3O21NT~5>Osy*;kI@4H`RmS6} zc{TIfHSlwv%}>7k*bw}rn)EnOM&p6s%6fDA65=pjW=3*7QEBUGjL{Tqyo@I{Lo1p% z|7w`0Eqd@~Vuo!;hQ~JG=Hh<@Q=Mh z`abin*Gv%SS~GDLOv+A&?KMp&>wOdo+#WD~{M^53H*88AZK?p<&NLWwiLbgn^2xS- z4Y$RdXJNR43 zaD)`;A{vjA4c~vT6Hm;Oho^5$wGL@3gBrjHNkMmkTbcmu>-)?AuqB9vY@cTD-C%c% zG|{36G6&j-`M`<$Ga(+U>T|m2rRga3@r<- zwR!U8Tl*S?*0V?$yLDXhl6FR_IWa)rwk zRGsf;&6(9NHWw-CPW_sgHM}uq^155Gb!Y@XUd&55sZ^Q)rAeQ~3J&LNiraJ<5Qi(x zash*oq2ALsoKyZ&Ht}0%h?zfsHrME-A)<_0<7r@=kwC0{nXQ)PxLj>{jKeEx zwH?6{an6LskpKD2vuD##Y&p)ej)gLN#moZ3@GdcinTuY7!D7*B?E>Yt;kY+Le+TB< zdu?E^S2BEGDW1V6S4rbu1DZ0RL`SO0Fal@T^ftn?mxrF_bfhlAxsm3tX**M{*0qxF z+`lv+FA}{(SY?OxF+_H+6zzSTUXB@%xMG4gS{=+NkMsVA9kMc^3-bXl_Ndeb+~|bKB$jNhaI{9Jn@bfRo9}&UdK>v^PzrS8_ug$pO;n#N4 zg{~>@qBCm()5hG8zP9z9?W#OIj2|_13?;kK=<|SkpiKg7FP5_ar<{K{8dqJ31Oi-a z({@9bHfXJ|kMqDz$`OuIK`U;zUV`KBtF77@+`{JO>XRZ&*EgBSo}jOE06Q1|FFLg8 zbdLER$>S$*-7*iV!G>WWYybf)w%3tp25PNTt$O}+usroRh1B%|R7;gM=hG&PytO5U z`s$T=O*dWf5$x}&7STAC)o6VDCLbi7G3gsx2j;&VVQN7*zWO2PRkoZp^=X}Tei<8? z{Z09>_ls#k6I=;<^3>$%wwzIG|8TF+Oet3PJmclmn4Rj5s5?nH+1rCjAwd#!{S+;_ zEAJ?yE8aA^4lBD$WmkY6sp2aX2R{+WTTV%UGBAT;e*b9@Pa+* z>?JT%0zUDRLPwovUsOX^u4>0wrL~KoPm>LsZ^Rvx`*Zw^zw~uw9R9G|d1|nC_-=>Q zWvC!h+oXl|za0*~rOJwII>RFrydn~YYVuvm(?0SwR3yJanxs4A8>(_;o`Q6=2kUAo zrlWW&za0Q=mLtzGPs@E0!PRwQ$G)N;ndsbaC~u5lT1%mb|kGX=+%}r4rywoYU?cVSgqKAr>xIq^Wjw(-ldv z8YnP-G80*}eXGQrmIP<}RA#%@KK-^q?Hl!=>kUEbX&wfxkUPR{SwOmDz45u)B%os3 za(c-AGEA&kWILc_>bPsL$_dR4-`=*D8x{rs-VN8n;moHwDotxMu7Z!34%UiaqfFO` zzbZu`=qvI!9TF5Kl20N|0#-zhP?L}Rw^h5cXFTnZE?;zgMw;$B+^h^eZptf%o}Ia< z`|zI~q*<(}wN8lMbz^5e9ifqQCf|+}*i1LQK`kkLIYDk0EUw3qWd51+3zOj{H0w5l zK^~dR+fw;ggK4hXA9nW+9^Q*w;?e>&i;17 zmd~66olib3`8b7AkcZ_1jZ1tMo#-{GP6RFiM23MofqF)M@}jY2kS7#14wqpHyix>3;!AzpEj&7w)eI_5Bd^C&7dsnfJkj!?&3r@e zi)cPb`>@XWUm|cvGEVDgbx**M8Istq?oYwR;>4dWbN}jhtRiv;j|+fnK1}XEKKJt3 zY5ObxHj;z;UgD6{xd5syEiH{MIr?AqN7?RT>(+j<6#qe^lC$wbglS+aZd=jrb+3G< zCkLC4B=?+60Aja40yC|b50%QFF&*Cwf6kScT8i~RJo3_gKeDYEFzwf=g2GHE`#Dh5 zO)Z{09`4sz+tnO#3ELN^@Jb^yz)j9@gm!%jh|FrEI(I@In|#{uq$&bi?PuNX5h|NF zx;i7%l)(OH&cO6y1;kZVtJ!|zvQ@EC=?9!M`8Ski?&0;Z6!h)lWQp?&g3B|rc`D1) z|J5NvGu$h9yeB5cMf541zm2NYo794q_;BbY@!z2_4NYo2Z9L%APfmJ%67qx-E`AN4fqIJj)8aj+V|> zH=|<#erSQ2Vrsp{G)IR;kgssr|H<;k1&?og;38sG^B8dr>mEoQYhW~##M2AGoddu0 zpnjzWF8OFPT%awC@6#U3Co4BNNg91hj?H2zUK%T8yO=xXDe$A}qFdC!29c?2sc1r? zgm!jG&CW*+QH84a1d-9RTv=2SFA6jD(5!8kJ|7!f;CJ1dS8rqcz&?3*&Pj}sn_I;E z#eMY}wuI3~hVk;(*nq3IY2L&@kjb^&|MSGeRQpV@dF9DPSvBb(P#n#5} z8J$WSw)`yu5o@c*j^<94p2~?!+Wq5n^kH%3u`3dPf`6V1Z5H{dDmvCBwlceJ(0e9@ z=n|8` zFD~59j(8`Uyvij7ZPNNii@D#+$Q)|pKa^k=7Z>w1^Lh#1VsQfp!Dz6I_KXfmC(6^& z*uJ2Z9ysX<(vRa8sc^t^Vb9c{-|I!7>v2GJRsqp@SX;4JL!L}K5z9uUE9w=T^M&PU zErg{o2c-=zW_hq0dzP>qNDX)tHUfxpv6PzOR|PnsiDRlimIlCcmFge>Yo%&i2xD6R~oJ4k~j%C5rTv`X1) zoPrMHai9mHM}DzO`7i9_qutMR1WxE7wZWXVe~WR$9)XqA9ai325wW1O@_QOW6H3uD z0H$Ux55m-3v}Ef22AlnGK8Pl|4b1*q?ty^gCcd;Of< zXsE$Wm&znT?diIkOD$g4;hf)oduR2f*8N7utY%GK(ymwbhUxXXuFfEA_ETG89P3B& zWyWx52qKu(KTPGf%4@VxI>Q$r_ob%f1;MbsH+4=n;3bw!yts<12>vLhBK2f|WsARS zW=c}IFUwre$^#w4)-reHzw#1a$(;}4ztroCx`_2^_l&6R4az%a^M7+U1twa{p7&L5 zOcIb)W~TM#rTv3wrBD0H`)(J=NjJK$R;zQ3h_NXl?q=$v1QS+^ z+~cm(yo1!H+{2r`c_+TUxxas>?@g?~My*-wm0EQSiQ_Mrwn{`EJW79JB6Tkg?C-qk z531e2vL_9-J8E^Y->_VJ|Fr02kk*}5)1Yfw`1nK(gd+mEMq26C@kK~lNAyw z)vMnwi=mA@$!k`{0r4n&+Wr~|(?Q{y!&OSk9anPjYA5pckV-cb4_j?fF11+xu)IckrSgxI~NOGn&$$Ol#qzhT?}3cAH)I zPUCo6wYE=$eot@WHG6wqbE#>9Jk$W21;7BSXwqS@eZYl@YGQb3_1fbyS_ZxO*7AfJ+8zVlR)L$@S~ zlr>_?qQ}GFWE$W;a?NvIvHg5bNd(|P(som|>BOm)pNPIzGlYkPsYt)xjHq>8|Nezm zT{T6BzkPpYARZ7d_|s@8bL{}*sYv1>4NZD>v8q~a1Hf`3L4hz+@8oP!Qke9;m6hX# zG6XVqmSD!qTlrgf6&i1P&pKDR<^#)*@;QzASxZ@Xc#D%smEG%0GVG+W^UJ8{;5-@~ zH9e#KCb;$qe)g6Yf?wQTAMID8?43$w{j8D$YT9$)`?-lqwD`yB!1IeqQuDIN8a|bE zr8*k;Ljlx5@O>C6M0qo*#)uC$7R5`ySeTMBS;9!Sk0>Ct#1A0h zt$4E_CR=9+xfWWkFM7vT)KStnJuECi7-l`qyZA!Do%g%kebJq_B*`A`6ev4mc!Y@E ztrwR+q=6`!>}F(uV!O1DkA;jy^#Fr+Y%6V% z&k4!XpDL-;OAroRNjz5<78++yGEQb2?>4H!SanS5zOTMq(;PsTRF(Ozf9p3PIoEXT zn~i$RX8Hr=cp1W4oT9{221bPH;#l2ojkOz)IM3XXy9~W3L)<|z()P(>U}7mhGkBNlf@a}b)y77!c*QPh?~Gq zQ*OTk>3Xy8Bp#9;t<94SL2>v#ho4ShBaeq~IsXwUbN^U7vRE3@%@1UoIXM2@MgO8X zs4cC8TE5s)hC6wpwb^GDZGTVFI=#H1G$T`VD4?Z0d+l2y?PhN7dqIC^^c=AQ+;y=N zS!JV6VEPhTj2GG?zQ>^e0mcd-msP&dR}s(+puSzGj~c&1mEZdnPU!yy)t#1Oz3~Jh zFH72=YOnzCw>n&5CRlx)rr+d~bL&d5)n~^$6Y9T63m;3u;y|A`YX?@qkLS2*sQ&~j zR0}~52C(d>jd>rOYu%&(Ha9}f(+zVu6V38ayL(7|UAU0@W-0U(2YO)UUvXrJh_45z~x$Z@1ungd4n*U@h^EfB?LV}eO2aS0q z4er}sw)opcNRL&@-Lad=4}S*m&Maz=og?VR@r8onjJ%a+Y7Gf4NsT6GWEizFkg965?rE%`Hh2%3b=cec?^ETWv&nad`nE=< zXrPQGW81<;xi>A!+7GNBR+VDqSW6wneV~QYmYj=RT_%|$WKqsHtB)X64`0r~9HsEAzk48W$4Om3D;m^*%arhJLzYgoMP)(_Y`@T^{rM zkrF=rbiZ&zt5&ytdP(B<4HkVYcQ0&-#YnkN@c5u#FTYA}7gpxb++4X^*iBdP9zF^N z{Js9|E}-z`sn(>G=zkY~0SlmDimYR2&z#ll%(!h#BXE@6mZVB0-1{q%RS`fUHf&;4 z(|BZBPS%x^`Ec%bkzv78rcLF1Nc{sJ*RT?$QD~~~q^uL9%>uUwTw3wBZwbzNY zuma6|*3ECaW9`?rv>Grb(OOb5EX zgI*E{%;n8uFG3zcJ(4`!YVm+kgM>^Dna?oU?@B|(qp=G*pm+9Q*OxYf$a(NJpfLnzy89;Cmp$l+~yu!od3#t!Ahuk0du!L)=aM1zj-+c7eKi(VnsrAQR%Tg zD`|)D5YG(UGGNmm)|>Ug(CmVuB9xXpMBJw7DW=jFkixkU0?*iTV@6za+Q1mw)h9gX zmtO6Ea?u`qPqGLOq6`pB$`Nta#CGmu)Vm=|$G@T68Ia z1!AB%dBz%Zf!u^^))X7u!?@;WC6b%L6rCEDbxG?rMMW`4ap}=dlN@ji0DvWi5MgS1 zA=(>021g3acBZrbV_JGB^ylOd1Z7F`{EhWXpRJa0p3aJQX`OKCoVNY5Ezho;!`IUm+Hag{|McZGhQ(4JL6=C!mj=<6zpLA+3ikYNI{)JG*bl@q3GziAx5)#H4@E=2Kc+vK0Tcvf&?F5saA}G9nTO5`qPRv^a*QKv0gbBBPf9bzb1t@Z@y8BdB46*=BCZg zp;H`32ulOnr}YQrqBRGcD2cOx(=-#{?#8nlXcB~?V4w&^14hV!AOS9H04k*kkoO`N zLSGe%i?Vyze}By;R_nT(ar{$*7qdQiNz%a)fEmj1FqrF4W0Qm(C{&mNqMmTyHlasj z;b9(jq{%Du;i>1)){JJ3wJIDj7Xubr<{NHYFJ(b_`Q8`c07qCG&q?$0(s%F{=tSoa z9T{fO@%;)Kt7eaBDR9!tl=2_A*dBu?O4czh5g59u=Vg8FgT82!^8rusYohE`Q^v?i zv-8tA$l+QG!gqjAJzc^M;q2@%W1S=fC353pYQlVOeC=z6`}Zz=%>A@C$Sx&eKRSh( z4?nTjS$reUde^UVS-;w`l2!|yA=LMpmEn)7oT}G7k}%sFT6w~OK5!ehX?C05U}?!Qk9Rh2%m z>o6p#TFp@w#K(K-_*^#cZGU6u!wJbx(S&~CpYjAu4KZ!5H!Xd>1$tWnwYIukt$w(` zWfegR5_6i$|HIsOMm4pr-6|lc2#5%XNRuWVg7hvZ0!r^4NkBS;CS5^50qGq=@4fdb zJv6C-P!&RGq4#n-x5^ zXoKqz*U3mJsr}F_9L*tI2FKv~+g7rjTSDlHxxW_T$3XvHytnjg0X8UeYSH}|qgq(Z z)X9Dhzz*zpa3X)d_0oO*jBB?^J8VBE(|>+KjpnPv=Rz9bpBG2R3Z&_cJl+FZj8?4M zAMeCk%^lVa0uSv?w%AbY&y=8vAQvW!tM!NleWBGCI|=x2kA^nqLJj{5(B(C}FCxwg z9wO2Y_Zz&(`asO}-9>Y#oZ3xnSRs)06ms&T3%n&wiW0d@SLA$k2 zNyFE$5)Pnt&IDA6V}3>LJk9CA{!u_#V(Vx4#0? zpAD#H9gSPf{QE(5Wo=^)H%YQidL?SN1_PDd-Hdlb6EB9{g2n#vy#Gwr=U`e8zY6XZ zR0c4YQGO;4k)N)bJg0I)M5lA|mg%A#HU8B_=0AV^*RAb!PJ7a~DVb^VM{EFRCWdA^ zpVsf*vi`*XqAU*lYT|#cjlZ7p|F)^gU!U^dyCm5^t0;fJ|Nl=PmcPH!-!CM|P(pU) zfm{hcWQP({fAo`qB)$Zjm^zh(h+pMei;}Z{aR8(^lPxyY3~hJq7=|A=s@(Tjsm=Yn z?+I-!4i3%~0Q>#-r9aK-_QJgFSP$afroww+9T>D{(yD9rr1$;P-g<`x*+;RThEgIM zUnW)6|WEE$lw6 z4_=HS|CbIY2oj=m^lLO{cxH>Ps|@v-Ns<`uawsEl<4x8gxi;@HQ1=RhC>mRT6T?|_ z=P`Nx4G<|9y!Z#cIkITP(yY^eX|C{fX?BK5)tOnJO~Ju zDF8gw!^ZAPDX0Czn$ZsyWqH6v61xpQq}zS)L5=mzjaAKYUBAd{1*& z^#&4#F)vX{u0_NG+X&?46@Sshr+*XL*WvU?h%kCJXL+;O)i<}Kx+Wmj!;qZo33EGuXn~VVB?L{4`m(6oGEOWC~fJ3k@Bhz$I$)$Ru zVq(-;`z>j7*f*edWR4kpYgPPPFSe7vst&jd1iNEe8 zgybC2Q4^A(W7$RVQ3&3!S@qm-PpBis?k=4E->N3+b9J#6zsw{fCM)WYl@z#+&%Pv^ zXREa*s!mmY7CZbiE&9gCk(fkpjA&U$zK ziOlyPg{s^?x-S=hJ(zw>wRv|gi)6q77YgjPxV2oZKCQ{64?;eM%RL;wZ&IuPohZ(* z+Vkdc$9WI>vVR26>Nx=DnD1$2JJh0VIqChq@_heRP5aNVEFz;e(vy>Mp~;*OZszAq zDnnf`@?lZ8&VKqZF}`U)292V8=W8@&t-{`e1*TKOIZgu!qG*4Q=M2psm>QM3;Pk-p zsA|X1nlr(C4gpl9JVK+Bw^f#!#r_<^`S+iC6?00*p@v9WsrdFerl?GmCT>aRS-^!SRCK z#vW|9GS zkKWzQtFBIUg26WCFN0}y+_+f>8*;^Ss$p-qgjqBerXAZ6IXOKen;7%#{A$C7YgmuA znc+VuSO1#G#q~I#i^A;vWkG`=<4~96l*Wysds09FL$ZLh-&|s;jPoS9D!IzY@EV=f z$sBYe<^{ob>x;yW7~LqOr8qpk2T1U3c@_7M5&k)pK(dV?Qe!U+-3F}W$qpj<0*CrC znps4KHZE=ma5pf#Z3hNX!vfMlb3+o-Kn*9IhJoObJ`ql-;NU;0@(^N_q01%V10c8sk z&idN#ttZ+&gSC{yZ|f!q^HIYaAGKV=B3lg2Qf@fA0Bd8=-u6a0;^)KQqu27j)w)k} z*0qQo&s=r( zRU8O%+3(p+Mgce_xv<1g=UFKGzeInY5r#zpS!p@IN>{jk+-tB%dJN6?O^5B?=yd?3 zM#g^X!smejLNx|HSG;8vkB7GDOvzx;bGeb&x1$ir{ON%J!YanJR1m3ED`5?`Io(aU z|7Uy2VmP5u70*!})zrmlK`ZOWzF;kAD!jKa(x$XG6=-;=I3rV7;%y4p0o*viR)88 zzecnfVHp)AI3=%&Qz0^=HwnJ;{3e}SN&eH+e1W!kqe&%d?#<7#5%r-JtW`A8O>;&5 z+*M#tV54;A4E zmwR_~f$EK`dkknlY)T^E@w8Dv3FXeb?Q`@R{xu2SOQ3N-XG(l7Wp}c{ zg7G`^%wyj6`-spB;nEs8px!Z1XB%9SdbS=4Kz*TKvckV#HI-XRReI^#ye_nRQ4B4= zD$B(7N!9gNwQkfb{DlCtd-jdxP))BvVFt}8Tw+=W4atZ zVf)wK|Lb02P(NzbV1G4R+#8YDssv@eo{b*n4GUSshEvwjiF=pp#18~M6-#!?p5_b`jiyC18pYjeyyDc~Q~k+Nq3@+Hxcx_}~unHc9A z=4}AXpx`&kB7JvV@?-KvHS^D^{(Vev_Ug`7sH5Jf9stKK|Gc(S62n|2@2~kNU%zu? z%V$g23JZ%|TKlKasQ@%=MpjurPfQC`oU&v)??Zny<+vPr+DQK{_gZh`G=Vm>P-Oi) zf$*xbHn5T4aaPWRc20?q%}@Fc;h49_+VJl)>*VqzLCWsQAMY|Wqc5Ap-hF-}{ZOQM zi6K|ej%(X3N$u$X>+admV<|ST@l)f{X`g&I-D`P^wv|@^g(V>3<#;Z7s=U%7u8`V7 zrSn;8zMI=}`H+-P$dC&)pu= zo2?ug=jmoH=D~jK<*c>E?r|j@b0Y;Axnm}#1InvVXGv7*zH)qJc)1~?+Vy}L^UV7> zXx`};*ZxY$ORC;OmHkUGChl|-Kf&`uUB2J*-Tv?2rq7w)@8ea%{*?D8hr|?N(3@To6u3p4GPXknhxpthAMS(i{ z1|Y{hVxZ7KK(QPhK=L$BZbs9x=bkJi+T2@W#iey)3FAXGq5U#1TqC*G!eD5hpMHMQ zL3Nfeo^e^#ftEm7qw>h@jnkYa&g(us1;swVAB@Q%IhLDnJ&wo7E0trVs5Wb#^>e88 z_J2iH$%k`FRGUqn=KqF`I|ap6TU8AXb)i)0|C%07{L2z8yZJ1EWH_eP=&xBTA*i49 z@R1CzAZLuv>~G5Umh)hD{V1_c3Fx$LpT!AKA()FF#Izna5Q%@}BQF+KDg5f%5EkUW zACzmrDP1V!`75{T!qeyui(apS_xw{%4rWZ8JIz)M!0B$lESGNoE^(}la%m~m7F<$X zo6i0cAM%)O5h9E-15I9+4 zJt9{yP2H=gTd!1|;%$8=(F}h#c3dsw3~#gSyHkK=Y=CSf zwK)NEHH{Lt8_UF`n~-H|1kU<@ddckssDmJk;u;c%d37Od%B%Z<9ZQ{KNIk=pxSFU>zCf)VAwciSzY|3@TyMvW zHbr6}@6+1luyKv%RTM*8RTY?K)w|WpP5|j)poXq|Y{Et72sHYPJI=yqeST)aM>u-+J` zP1WSuwKetXwCNR}W7)(4G4iq8LTOaBKXaCDx#wPw-%TP=_|f$nv3s8RITs>%6)y*+ z-eQ0N`)i5QJrWD3MHD-GN31oiN4#e_;OID`?ZOul3wk4-CZ#4(%`U%W7NkWytrnkW zMjrnj`OcKATBB^3znY3jNwh}fKk<0MSX}ZbDcnEhlrwpQ%>E=fIjCXhNCb^oe=^On zVAQGGt!5Jp4@DO$EFk^CGrLa`0Ke*OL z(c6&i;ujsaSp}7qRh|htY!5fv+YukXn#CtorogIrOg!CKC5aFF)$H1Op1fRRkyvGs z1Olk8zYbQ09EX}MY==DN53u^3zt^amF;Xh22|uZ(ACE1Gx(ku>dBwG3uyo7#T<>h({!VsqXR! zTK>sJ2p^|WQ#U3e{`-P?BC~QGtgszJ)g=kjNRB%)XYwCB+%6f6#ZUx*~dbP&vP~&Ewj$eH1>6mKhmkG?G>zsT+G3iV@+8q1Vh8I=$dw9Pm*J8$V^LbS#qkZ@6ms`DX!Mo>WnpSKp&fgb&kSSbu zARKHP5j=*#Xr*BVK5|6z^9F^Yiy^Z6O%rr=TVEoi3T)?3nHA$8+IU3#!!K->R6m(vFp*3wvB3B_p2 zl`MHPlbAYT;okMjX;w8KStHjq@^#bR$feahv7ND<*`7h2v%nL0Uf!+x93#AXi1OFY zv+6jH71Fn!lM$yWU;m!&Z=qB+{1-k7z;uBnLv2501@wu-7j3hW(S!e^8S z)T#P;Y*rH4`R3H+z5U-AxoAV2M(CvRKmqZt2lM%Zexci|lA($lpWA$|e^}>&9B7yN z0yoypWAY|byeoy2woW+=UNyl`=_(lY9X~?YHgOxsRrbq88Hdpz(dxIb&!2m)1+#=> zYH^M*^J9LN$AcFq<*5>uGx|~B-q1&@YYerpM|mj={9GD$+*Z%Ar*g#-PeS(e@IEbZB=$91@Ff3kPyJHx=0f$I5O2!C`j0Q-;GA|3cKakd@cg99g$Dq zTBU`C|5(j*4!HF-_DO-wbw)}HE8Bp^0&}4|zyGB{-UOPh5cETB(+_PUE&Hdby6ePN zd~dX#Ze8eTDI|^wh-4u=#R6e*!(&n#C{7 zN(Vn_s=4@}fQwGr(|xu0l3eY&`w{J86oK^G`KE>zOh-QR>fahkD&jKhe^f zo64soq7Oo^M%xhvke*#<*NAyKaZrn1+3d>~uev*N`|^<+cjxcz@;~S%UE84BzBb62 zeE-+#l96F13Vixw*DWdj(x^cHxPx%X?uS+I=Vu{M=V<{vh?IUhdjqHZ(3)kvpY!Z* z5QPYv93iPD+*QjdI@tXzk8o}KI;mI~k;y9}d?tG$6zu2cw=NUvHnQeD{bOX5t<%24 zYd7VU&~as!`+lsZx&qYOzaimzI?J9kB)x;*%%(S@aV58qa5<+xn_OMq&?2U49~x=L z85YiCu)gg9asDA%#VrlVxCIWDT$D7?sYbTS4u8y5-7+WBf{#*WWE;gdCKCP9x!y7w zLlxt{LY4fM>drr$uCU921c6@RUDQ@N)8qT6Hb#9tdjis4-9Mg$uMH<(k}x$YG!^6TdR$s4RmxKb7dY6aw}RO)!LVq*TQ$Z z7pyBijUqzEkg{2=!R#aJI1)*|ATKvajy|$St7RO%GXT5E*M&Z8;L{`=!yEh6SAC*avuWDex!KoPf=g%VT5K_tf z!pSMTQW#H8R>HN9B|kj6Np)>j)E(%e@T9?8M4B|?agTvMr=$GO?4CaVT1eUU>h8PHdV*a$ev;A z(i*$@a+;m&TNNsvARc{p+(tP~hwROM&bTd%0c7omie+=LNsHaxinbOL%DYUbJAdpc zh?gt?J;?H_YKQa+cij-Ak&|`L?#4d7BzWzIGu3&-#Bu=LZQplXci;R%V{$Opxk#Q% zCk=2g7F73xf<=WjryT#)B>zKzA;k01ls==GVHQzy3l9fDTM1u~>#Cs3)}A*?D)wdG zc?&OAMwzWeXy^+(qQs(VNqClyMfw3tU!x}84_T2}b#{Ips|aGMasGl$?9ExRxANrl z<-*5y}KS02pAw6uX*JC^Dngd&DR^xCG@9NhBh~|vAmt` zX0*TDRD#nRp#1LruD&f)(@@abdf{!8l}v`pFQI$k10FuLkk0}Z+1siN+s8;T43q)8rxIJwppSbB@`m{0`9=iNq&Z?ec#0Q%Q83{l;ZomG_3X7 z60N(B8<1%#{l+9a2#)FZYRy%ML;UGFEvNdk z(@VH^Am0Rs`Wr{B2!`v?%^8NpN!e}3bi9tS{9LzN88t3ENHe8*(C=~M)AfeU>@l_$ zA?wKg`kulmROM;UeqlRa%)%y?;;hbjXakX*A!Q2LsUCPsc1Nx@ZQK-?iHQ@+|IP_9 zF;zb(xBz?zvp>=TOmaiPk7rY?IxW zX;)W#hlzTVd?5L0@l&({YtNQh`%X#sW>W(ptBvPi1zunOScb>&lmTcxaPC(fTZ-zv z)2OC1MU*z)U#_qtlwVfxSjO;8tLj?xF22qxEGmg`6Tx5307fD-1hh21Gz{>$mYW=h zBa|dAWeN%kLe%cfCZJGfF^-!!7HePS#@VmIZJ?K(lPcA@)DKKpxHkH!VO?;Q+ zQaS6^gNcN}Y?9qS%mCVe1%9>WLoXHSZpJo)9`y|ub<5WtnkptO#&kf)ugF-z<-<%g zJ&RItj|cF$1{8CfhWrss^4w2=xPbs z;yeO9;5s}*pq9d5QHgGip>0EQ8AsYinIrSqw=OE#ow?)|{gZFMl_mi@lT3-+Tw3!P zv$WYWG45P`LD}=~J~S5|P^VjrmV`KM)=ia_7milU_x3GBzh!fL%+1yR)gk+5Yy0_H zm`l{$ahLp0Yy*ak?_1EZ@LMsbDbA72rNF~ew zkX|EweX*9&uG1 z2wZ*JkUN*a`q}Jtt_Nlhh#J0A{KM9L`xeUU!%SAl^+u$&Fv7v0plhPsBrw<(X+?fq z6z-M47^$I6XB$emu41S|e@+ya*OqKdqqVlsF56@P>+F+Ke@G~Nx*6ysEkT3UG#2Aeh%zS95?h*p&w-~mrq4g^F$0$e?IwDV!a z6s^|Mc=sK5;XZ#cPw+(5lhgIRySq*f(Zd2Oa1pDDuU@5VGJjTAUvvZzL@h2FQwUjR zot(UUpf94salNk;GXmaQ?gOE7Q&GWOEzz>nZt8bd+kmd0;IlEMn+DJm+stfWLfr=N zcK|BU+Z&NtWmVJndIlH3AcH>jKBN%$taG<5$jf`%a=ss%z=tQdKjFG__^x zv2+6rKy~z$4&l`|uIS6@_dZvdB#0od*U;TKJaGL{R36`xXzBm@6u>Lys@8|mORKcQ zFjOvkX<@u^`+=-&DG3!#foKzL{N#NxlF?l(nGi#svv=JBp$Mqw#WQ7?uF z2@ic;cbY0H-aG;YWv5lCCc~aBCra5u(fQP)&CO9VCqi&Wu{qS(y(?rz03--rpn(qU zrseJS!{_b%9YF;>Z+cmn0E&dNW$hR4j{fcvoc5|KS@O2@&c3jd3UG2~G%W4_&XUoM zK^!-9s&%l`o%kDHn{oM6kgpXH)p%n_;q&Ypw`C~&V@8*L;2gF&hA@e&Vwx>a zpCHSn9g40-BA?@y;P6u3X-b}R*xX;7ex*hHE_K^@|0Eveejym{gG>7ptn zFO0k>#xWd@Y8;$?r>zT#%-Gdu9pc7UoTXj;GgcLp(If-%+$Zk@Y09Rfp2yXpO4XM*`$u3oUrj|pnuD|PnZv?D5M@<*Y;+PI1ld4j z<@{%3h2e_&2i`+t8uBfc@ZTyaKsF@M!E&GW_RnSSmQk*81HzB!6Qmzwx7PZUyXT9z z??zNb#avcb6E(lj4>+9(X*dgv#NF#R&?VkpQ}MdUO?L5kntp>TOgnPphhZ33ac|Ys zd|TDv?c%E-c8Tem^DbeAi@buxoW>cnzp;0%xw9(Lkf))no^OB_8ub95IYFCje-u#1|(XNAIH0gOz5iap!wbwKXYN$o?odD!C zdg0~z<-n6y%1{rM4?1zO+GZkd;d~UQ!-T(dU;XnJ7AK}{0bVI*mmaHli2;Pp4_x8B z%*%pGZ#Dj$Xn1zF;+e9lior~}Xl<1|lee?vonIH}HvKabDmL`9Jv#hZPkhbZSj@=T zGAQ4JnGRix%B2{2Yd@oU%@H{x7U(Sb}Rn~S9>K2WDX;@(JZBZX%sfJ_$ z5jjmpG6f*$M5bo!J$2g}?pU9yH6I_&@P*2_W#}&v#wp}VY87AB%cr{(N!SeAJ$&JJ zR{v+l4|F;M=JPRMx_IG;Lz_N(xX9;7s_{IGQ=EaTq*uLN=DS{S}Ji+KvG zovjtPVt~|%93E!&;{)H<$}U<*$0SCW3!D5S!y!;kaJu!?WQ`rNCCSlq^{tD44cBMm zhx*6trx4ke`|oZXG$g-q(!MKc@1pBbJ`^!LcZ-Pm)IqN$WpRrs@CtNq>>ZMZK*xsjp)u2L zHun)7*A_FaM}d!HBJLuvtMsaj^oc5h3YUHGdBI4o{DQ%Bub)5bUI{HNT^10;TfNsS z9J!)XhE~;Vbtd0;W}h!ntdMIARXo}I+)%QnU%dhIwsp5eu!2>BK(_cq8Bwpz%yQsQ zUK+PauFVz3Ijn!jfJMy!PcPF%?p6Bz?$)xvu;gMd#V$$wC!XNSU2(jT@5X^gr;m>( zq4Min=~bQNl#Y<0BhSO>gv9Q&XaDr|o(r2$fa=G4TaxdWGrnM+VepW{M($}#JGdp> zCo5+dUFhRZ<txmA1#OXpfgR-#Hb*SI<3X!M^C69+C3Oznb0aSXbDs z*OG;|2Q~r%z#kZQ(@R+OE{bz;Ch^&WMD&>iu98{ZvM2W7Zgi1X+5&t&|8es`ElFXb z)d%4Yw*9|GsHRm)R?*DUN-lAUyMI&((DW{eJbNopZKq9r9^{3)xujW1xPQ08ZLjDEy1Hvy zJ=0m?QRO9RKM45g>a@PL;E>$Jo{Qb#VxG~==A`wz*PBzu-*+5&I8A71uH)$Esv8tX z;nb zK)qdQCdlT`8ohJMCu{gNhefWzeTjPOp?CU!&vu>e=TB}O7QOz6KZW?=>JmEw6V)&t zZ?bwm0s2(sKRT)kbXAl^UFJ_s;XHT$uK)tdaZ$VBWQ$}~n#phHm-NxnC!zoUNG{o*1k$u8)IZ->=M+XQaBIYYp`9f-s>P*K$vxmto7I< zchn#wKm9F{g93ATu^pyB!|8Qr(NwYXO59RCHtFb*B)g{c6`cmBd?_ zO0o-4+jvY)+IM+8r>A$FQ#Nemc~!3u-NmUEh3~dsi>1NIQ4>#^T8>hE)ay-!nyqgH zg{leP+053d0Ky|I<}l~jlQRk|LT7Di=loL2^8n%a(@8zcROb~8El58V>{grc4u;-) zeLd@*9m0ouo%Ok?%rzgkPDhgWEVpisYp0ishMmL61@sjXjdE;sFT73G?Xs)s)01Rg zK5nw}80RR(nr3SgPc8hxatgT!(EIZ3c+SfKG%sn zqaqql7h?DGlI+$HJLiVq_RH4pZ?H_1B0Va5ykFb>^_mevZb!KvETfqlcNC zl_|2`)%ssHp{vr6?zVFEYX^$2SI7Sx5w+s|K!9k`6qX4e~4 zup#8Pl+WXljslD&&C#9nuZq0Ayhhz}?6@_GcSp(*1tO3sfv@)~2)sD@gq{2r_;yLxpf zHH#|a8ri_3Hva@5oCdBo=`RP^+W3=A@N zG-n;oZT1#?uKVVjJy1t8wlNxPS_O#A%*<-YAJkfIYUHr_u&t)Oq)vin$#x69mZ6(J zVEUCTbxY@)89^ZVNvoN&{b7iz%E*p;behd}xh&1dkvZ(FSzRxTnpRa^oncsfKV%kA z!)I-4>*>jz7bgB@zukPC7s8Me6da5?MW@8*Rhur9nKT1CJ`Z(E>fYMg+Il_V7knC@ z0~J57?Prv1jjr3VaR3vtqhsD zw6rwb((^NlSRVB9GJ|x$1C?O`o7rD!g!l3BHS8Z-FO(bHF-d^;4aQ_;F|17%Cw;}i zqs-0V=qyZ2tDR4zi;0P`q)`sNOZ`f69AV@IsczwsFl;^FYGe@Oc;DcJDS$g|Ocobx z8G5h1)>xTbtj<=5eXFh>ohsC$6q1-D?cu)bPrf`4boCZvF$HF%Ae>`1GtLfCg!L zEx&KZ)?M%Ysiz~@Qm6{Z4yi_UOWm?h?E#FZjsLJey~J!OE@;QqRlUbZ+b|o;Zs@#- z^PE$ByXs{Wn|Njo6FnzLl*rAs^gg(~jfBe6VEpp_gFPt9wXgd8gKp_r8dE%Z>k{#@ zj;oP8*S2jbbDme*S@`eA`zD_$z_xGrwa5LdK|K#8XfBd6L8SB^Y~o3O_IW@bmQqHZ zv)$I$mcYFuB|^C{*En)p=G`HIb6ku-Pu{uH@kJ~r%;<-mN_Uc8;2n6Fns7l{{)p~$ z>ZwBp+}LWn#yR8T87KGuu(cx&@WE**An}zq^2`pF$_QDVHts4pfS!t!%d-{~ydJ)P z>r;@$-T3^Xl2}#@`dII&3)TtRxca2=ysy}g9t_U%Y3ACc^i$kh#reQeciU)S3Ev%u z1?MRu@Bv%9;ZT7z4wmB6bC76dohn&3Y2Kj`@2}PxwK^6YT!X31UCGBzx9XZojr<-+ zP4QPKrY&_+bzm2p#Y?3PJ~rKnI9)AipbWst^Wq6q#9QqQ3#9^b?%BTpg0SNpl0ta; zSuaN|@*WOZ4>`PN1FFuS8Yo*^tNo_fSVTnn_#4J7nEspDQ1_F*}Zn zPGgDY^Of?{hb>o#x7dtorZM&edI^;#)e0+>dA1xS5+XROuq7#$8t%IPO056-WdA{qr@*X;pb?)|r(R4gtjEK(@1=bm}du zt*7ebQhcuNIJmlMeF51G#;1eglf^%L9k@Q!I$c8>trzcK>6=9o>QC z)0zR8fDr~8PHcnSPF88=RZwHz7by{&w@4LDg}fWvH9Vc_LkAOajRiDw;E{|zPtdk^ zZ%f_fr{MXJ_0`{>BKIl#$)&4Cpuqg6r~>D0Xoe6FC}+*}96{vm4KHyrzs zngW=aS}o@04I}}PT8Vs{o&*c_{*es8I|bH#ky5V1Sy+lFCZ77 zo^%TwdAi=uH7@RRcqmZNRAyM!ArZ?Slim@Kf687CSjU31z2ISuMS>$GE~O%m>C}Ey zMljR2Ow%!gYh8EmDP6-sAs`F-EtISYa-HVI^ph61_admMHO;4_3$3DX%xceNx_hWn zJ-lm|hfF4_oKfu#SswFY@l^DH=jg?nxgR zfZtr9Cl%MdNpKC?B=0oDf}yXes+km6wjvC!)q+F?D`3yOXT!@$A-)gB>cV_)r91Zp zc#!8D1`YS_taaKSick;#D8|?BF<)V8d9Qh!D8`Q2HF^*2UU1ggMt`@e-Q0A4c&Fh~2(|9Wi@VmIMqcyt@=Hp)ZH2xS z(MS5i5pUeA*8u5C=vp|08=Q z(^GESZp+#+m{MeU>g3m(esN~>OiK&VyYPLYg1cSMa~7r%xCz31NkvUeAondX%vexM z96x!@iSb@ny?#{8M0N#FwdxUA6CRfojOxoi1!}(qAk+bVt=Npbb$H=ZDiWCF0U_3B zuI1gXCJW{}k`KFpXfnH~K$pqeOLFK$P{otX3vA1!kMkz_QmNMR8 z@dXkdeiuR&REh{U3%ntUoKBkHev5ni-IT0V+4d75QW*O{+(g0anZWxo1i17Ch9_OO zzk6{Qa{lt>zte9ruI!{M)lH=!B~|QC`}N9%x_e=L#<}+w+4dEm0mQca;FDXn$@p25 zs~gJgAZEds1?j98i&PL2$?ZSH=Vmih2aNp+R?F|$j-h|@@ZcIT_lI9Rj? zgbF$K`dS3sPKF7M0GKG28Eh$K&J6xik^Sz_`VIXDQJbfy)r_bdX>*FPA%2Q5XEiE| zEisO_E%V8_6|36#ky9y#1t2`w^t8eq^(kyn`7OA%#8E6Y4XB^?;kpDy_ycnH9^y96 zWrFLn99N#Yln;HcDCzo0>OV z-Dj(<;@I`8lxI?<_Bu(FfYXq;TkApD(D}BHq@vKFx=x+(7wg%&k&_@7L%W%hipB@j zAnm4*FD##-tMko)NF}O@EZVYmWJ{)X&Kxut=>y)^sd38Rjj17d_Kf`!??L$2W{>Ji z1%5@oHixs*)4pniVWF?x!>^gr+|XhbUhL3Ak!!gK{IhQ% zA?mkz?oR1c*?;M>7V7K6Lq*6^t4wPgRJ0F^d!6-SUwbIq*a7XASQ~!`6>Seg`p5Tq zhlLd&Sfg~x47N(i?xDBHtCXl#02zf;_!gLGrusg_N{Zh1oUN_?~s3 zoxms4rY7NdUg3AgtX~a&S?b}xYRs&>ulUnTdY1B4HzkfL-9tE;;EG5UNXCB1RM*4k ziPj6Tg?HiSK1y0>GK!Z?BvSvwHaTGlqc7f;t6#thBZbHjp{=!py9!6 z_z)x8e9uY_jh3m%=Ta#(=HilQYcHn(BiD&L0%>Yu!U%ffo|ndVj0%?ecSr@g^0>CO zwzwj1ARWDN$Gyzgs60jNm0xmmvBr2-zli4%b7zSD)lFL@Py3^gKS3jJIof&nYN~3J zGC$S5Og8m+lkmXJytK2aLbl|DQ^(K<#t5VY3r(q}WCF;XqU$ygFG;IFOBdV}#?o)% zV%u8I`BYtgwbybw23H4`>KRO%7+p6uSHcA&b(Ql&>4C~wy_aF)dYK8K4I8|5&E`|Q zQ^`nz%U7O2+J`t+H=!*{H|BZUEf|=ab?XT}h1^q;0+`3($SkxH_xAHu9dhv(hTPXR#bod)A^6Dr@! zhX>}x^hCaI*o$WlzHGh{RI>SPO825Wx`FJIZmCt3meoVSB|Ey_F3lligPyA6k)>5n z1)vu)fq(ZFmz~|(Y<-lwxaIhZnBA_&SXe;g+Kd!(QXOhiC$tmK>mTm5mk5q}VWSsY$qbK2>h2vC|einDj&K_4CZ<6T^qs#fZ>$D3ick z0KtaF&dACBaGWCS0qO%G1UgiYF1Va)@k)ZLj>hWi>#Minhx*J++H~hEzMENvT>6!SR=$prsEI!vag z^NCMkDWF|sX+(0&3{RI11hR3oWp|w2;ALu-GciMhgT?&80}VdcHkHtc88tVZgsvmp ztE(&DcXD`9QPoSm%41mA*b`TnQTV}PyPstu2e9R>@hB__pS_JVXmpvJG;pjsx+r_? zI0RrlGBQ!A*j=ov*gCv}csNqD_~Nb4AL3&3yu9NlD7xE2$5+>bNAk0H9t~{t>30|y zrb>wEaJTwINPAd5NQy?D?ZHfkdC!U&)W#-ObrT!w%Ya1fA6Fcu+ehU>kc>Eit>*Vz z=3;uBpsNqGiBuF2D0l7eOUWkwpRaN#J;i&_PB>h2em_{EDX?Gzc+y`^bgF~PEK;57D9gch8Frd-=%r#h{7D1xU9hrSwK#~8)!aWQ6BsKhTzg6wB z`jTjV@3@aK7A%98O2Y zm_@fAi)^c%v#JT8GB>06jZB~cx*o%MC4teRDUMRe2O-F3Bfrm2op9Pf8{4bw4#%z$ z79CjXE8mj56=OWS6|5e{tL0;~P3H&`;h#qyJ6V=JegI}wn~?xJI*f*P>B{0-0a#Y~ zni_WDTXj$RpEI_;DmfF^sewfIdFA5uwcs_rJ#`dgJkH-@#lA0mU)#^SIMuFKqn+M0 z`6&a5?)3lR>#f70YS;E*X+%ntl9rMV$)N=SK}xz2X6Wut5s|K;Te`bTq&tQfN~K%6 z;kV}5``yp8-|s!X`G*@h@L0^Ob>G)@oz<0HC)z4d$_G5>7|8bTvrT%<;y{J(IY=ak z=f#!*xXi?izSvqSAO8pEMT%_LF0W5`xW(MNZ(P?~4L8+8kRDMlVP*3^~ng?`JO+-AJxrG5~F^!s%ob|P>Ew<3^z^FU{`nU zW?}+7?$bj(iF!HkaS^u_Haubb4(qwfF5@QMDfme@(ZAal^u>}(OVtd|$g%s43(Y^; z7E-l|Sm8-EZAb5!8)Z&@#7ZJK=aiH%1IU&2lNs(AxX?mT8NT~;kDRNCH=m>tP9V2^ z$NSmE_vK|HAHD`Wk5-2f`275`0Sz@+?vJ-(QkD(zQU@j$y;_5<3oJiIc8(i~{f}W{ z-Mgm&o{HOBMP)79dtd6s^%b_(bL*B|0cOoBG25ZIC{}E_$>-od?Kid530D{{N2inB z)il9(>rsmoSh+R z{Y2I3=&yk4-F7X(j+Uqw$!Dt%*y+rt*Ah#)rF%I0cneZ}kt=S*h1Hh|H;+jO8)8Iv z&$iYp9sR1Xk}SW902n$HxeuT#@}=11H;t2S4bX?Eg?w{r_AF5pZJr^g8V#Dt5r*h` z77fzXi52MGD>B#5#q=3k32g~~+7lPR(3M}Y)AM^#BBQs-9mayQSrfd+?GQ3l#vb*v zeF?t%3t&FLhIg&yYh84OGPIu5nm-mZG(0-CG+Ouz?inHdwKOQ2H7wgGHrCja1jr`{RHWLV~VYArZJiCOMYYaiog zO$Q^a#_;gcEx)*J71pk|PKFIE(P)s9h+I9_6( z>tMkyPG+_P75aqun)Lc$sHvj}QBC}B zN)40w0*4i@$raC^@1qNxf`%JGVCQOk?hUXOql3=Et?CX05 zZj&>lrh^-b-jy$r!l(*G>QWrpI+(B!`)X1_Le^etM8*N}S~ zL9>8^Z2gs`7_9IivQ#L#0NF*4+zRaczMG?sWA7J(7EYjpC5l5O<$l3nQmzQ4NG^oJ zf${8Io%A*SVkJY7RQ&0(MlBoA?vK$RYbR2IZT zaNB4+7M_UC&GH6BBJ+-Zhy0}eYFIU7pzW-z&YEGB>1f=227m407^Ck<)_u<_F zE-1P7M?VP%tO@xhCCQ{|&pNn1NKqnM({hd~9+sSrLqRL5n`xEU`NZk2dkMDHV1*ao z-+>XPe$#VELO82ILP~V=aJHdGNIm)73z~}S(qtY*Q;8|TmLFhZ9<*Y<-%w@!dL-c7 z@z8D?Ahdgjp1Q?sn>AF-4&?Lpg+z*Ko}Q@A@`3}eY1@?}W~_>6@uWcq%gYLU`OyCA zw$JZn%09}AfiZt~74nt_|Cl1imKA(a@clQB6y#!fa$OHcbTQFTCm@#jzUu3e)95!=0_f#0ga zHqc(*g8bUww_KSLZW)(<3*F=Q@bHLDEork8v|12E7NL3S{M!8wenOWiU_ARlMTO?! zu0auPhuR1u`e}h03l-|>&oi5a`l8tuOFXB7G{<7^(<8>?9%4fspVrGs`QN*nW_sWG z3TflT&NcB&Cu~-#B>8OMuX4u(B+)#yo{>DK!xR1^rdcdv4T#%)8!w} z9==qrCp}G?D$(TdcnHD+-&b@1fWD%-b~L5e>C>y9cNaFe!~g28GydwXCv!xCcQQV) z*;8$BupnJshM!Chc3avS54=IjwEWl-8rC25~5N-ywE&z=7RTYogbI_#GWn}l80FH^9{+kSxt{5s%6v;CL} ze71v0O3(5(Q;*=jM1!=s3-68rp#{u=hS>?1qAQF1#Gia=@2sc~Y=k@Mf#>a2k#>FG zE-eEFeXw_OzTKk>_4J5(G5=-HQ4G*xL#+DZ)WCmt^9`R<}k z@}jp5R~Ac=#H|c}!zU9*=*d=k`q&i2agOq8KXJI1x32#120 zsK1y3`_>K$DGOyf`!-cvl!0-*~xUq*Y^&?~*ac}g9IF5PIY&}WA_ zNUe(n6u=WR!7eFp7@~LmHr#dslHa7?^pmMoozM&A~ZeVRV52epCDu&~XSuS0c7jFP%i?8#6KT%r z$q{+uW@ErPGW|)M&Dt!l{;*+0UiIuFR=Ny6XRxF7<8a?F*RQTu>%GE+oDL8_G2SJO zyYGwZaEW`%6-4Ln5;!?T`e$i6yraf4s)>Fbor6`3RqU|e&i)_^+dw~^sls9(T|z7I zqHJZtTT(8x^c^$wr1`p#x)LhxB_Y(~;Orw}P)C8fHr&DRAtKzWIIpijNL{F}xz0&- z{+sWzfl(c;QkH9a<9@vO*=@Z?5p(D8>9s$ovz|&X>7z@nxhm#(v#-6rNY3K>T@^g( zlo}BwK;AmJFncNI!=$6zeBK9!naCm4!jaU+eu!yJx97 zNO5{;@8Iy%PfTn802MxcLS3DnnV1bNOjC!83g06yKC zI6h*`?2q7I{uU_gn|6|mWsD?Z{}Py$X>iQ2FuZ=PIyp6!r&^$>U<#{B6!p0&G)f%N z<+Fms&}fS>pfVAl`+6^PcW zsXJO5@v^^&9)EnY&Pvl`r>FqZt7{ipFoW)UdGGa3L4kL4;?|^hmjWc!uMbr0hTc~R zGoN$S78Y~sdV1$hfL>koFHkn-^B5NBVlc&q6Q#-DIAjHvh$|y+t;*# zp0>%U%uV#L}Jn9fP89> zGL1~qZXZ3m$*wxb%2oVsP7-FJ4vqp?AC`|&v!99y@px*D(l*)B8tuxA_x#{ z{PGKZQah9G>%-|%okicD+giNy5*3B_Hn113Kh&D=WR_`2+Y83pI~wtn0;0ldYdifH z6*J8)wkgaZ$?(T++=C^y21^Hr_oc%J?h!`~w0LJL`)BUzW*il@D++DT1}4~Z1CK3T zrU-M#MphCkCP%5{E5$JLCn^H+@izNhW&bTBDpYCW{GG^a3 zWN7W^^+L($5eQt}5_M+A^P*8?3pzw=HXpib5*n~t-2wIS5ucNhno0M%4;J6` zOl~K*^CB0tNAxGIuFdMBIqr-55n`HH@MwF-L`AXz12<@vnQO_Rm;HN*u>*~+Czv|! zn>m%9hL=&1M;`*vx1Re`V@Q&k519|q?vAEz@|Qj-eX`&`t7#?|#s6&DH${x{VKq7h z<1~vF^+g(hiSLa2dniXn-Nj@lxU~?uNs0GS$BTgOb4{?$4LO9!qh?iGz>9m|JW0QB zf>@A01!jhoq!UMtZ?3N0)y*^8Z}-x;q?ayu2oA^)hm<_RM-|N$Rp!t_7xSre{p324 za#*J(5h5>w;Gy`1^C5)Rdr4;_`zyxEtz& zKPqr7D-Nxd(ec=ZqdBR}u52Bp+OinpFJ@D*lfUI-|0x-no(9x$B@gLoQ@KKP8wn!J zuh1yE^G`40{A~BXA;%8aonAU)Zjn_Wugj@r8JLhZR8lpHW(7@rtH6`Xa=kYaaz`Z@ z>j`#1>un+nsrJ~}YxX3+9c}kK`*Ly>NT_XTfH_%WmVBMozBgv3>UG?u}6J zY;VXHHYAtxad@-&<0)*g61&K^L8Jwdrvie40~Q5Q_-1BiR~DmD%f?3=^NaIora^7oT?0&ZbV$3ER3_Co##4*uq&Akc~oM;r~CtgrcZ*O5X*l2ICLXP9i8v@fW&;FY++&1 zR?1f4!*b8^H{2A7Jio=WD{HKCX49eR8*ec+dP7s`ry258t;s(yl zO__q7Z90ZO{z;>GN?DBK)6nC1ZqX^ujrsk}%+JXCk%t>YU^hEaPX4N&R0Hg(dg*F> zaOhmDMsaK`AnYiqX5Me**Jy7R&Y2GiZ#_|hhNmacwbYGWR75;UxWjWzxRF6E5~sH; z9Ffl}@+a5VMc?>g1|71{S^bXlO{^{~I-{5T4>>KIRld;AVW&jj8{<<;NqnCV+ajva zr2R`HHP*#W;S#4IMeb@mzXDn(r?FUicxsjCF>c`SpWr7jH@ZRdp7xhbmqRGkdN&rM zeK3{L-3>NM_DIK%c!p>6(?`fE%d#j@96jte8(C8AwKB^FabvUo`Rh@VROu;)#NkVXyh66l^;Tw6mzuH#)ke#3aznlk4WX7JvK?T9MoYlJ@cgb zrXOJQI<9O>oIxc!yGvHztQRoF6q^WwR!m6WKN!7fytRkO5GGB%z%gd%&UC_Y4MZD6a5r14_3dV4u54MMNZIU}?&m<}b zT1#lx{b+F{xRS(jD}l(DTTx!QgeWG|H`L~DOMb%--&RIJDYY3^xPIMa*fGcys)%z9 zS^+)~FFlJj3IHMdj zpd(^@-wnU*w>>*}`>{A2U1s`0lq3kowy2r~n#H#KNW|JH_}Qh^UGWQ@$h5l47mLy~ z9Y=3axVunQ1CUlOP>cae)DGHx1e*N`4{($z;IhWB!CFBR<>%9aE|b`tY_;Z}eKBGS z=ZrYZTh|=yw0Cof=&VDY#kK-n3Jw9}=5>kvMQO60V|#5w!+B>-v!;*s{tCI*aCxhp zoIHF?fs;T^nBbF5mU0`$ulIL1Lrt3*EM$Dv(Po)G(jPuxcWE?thu{shdN`@$2bH1Y zlE2!FAS;-;`u$|Agq1PBx~6*VY}POim}k%?DrJ-gsyZY3wh_A*{s>V%U>yHpY5}dT z1V>L|BNfQ{F7p4nJ(UUl^y$)bi01NVH=d~SO_T|_FWjP6)4ITHwd;HYg%rW~n>WiJ zf+Q+h;y+(o-DPRJIfbIY+wYD~#+ZMilPWoTRz41NA!65gEt}bL5|7?R5acCx97OF4`i(Q>-6kM5~*n zK;z!KqRmqk%rIomL~?S2g0A0?8!~;q5*R2n*W7o* z&~C3#i#=vWTj|hL*OZ4u&%a9NXH3~&_aia#6}>pO61Mb{Pkw>e&(H5{QBQTZw6rvSKvRzfF=ci4 zoN+;(j;fFh!ToJFyd0YvN6W;-G+E*2=kY6;co)r!nsZ~xZ6)Tg{Z8YqoFnAyaHT;B zEi{}`M2FJr_VHuvQmVbe#EYEZCuLAGZ|_!w_MDkoQtb27f~e?J+jeb8WtSCDJ#gE= z*&I)5Eqe2?qeC|UmaE2%j2ya-K~;FOuy#R5`lCmT_&{&iDYCMNO%0gW|#iiG!0{oU@G==0;aDrSF;w zsgSGnzV9!A!7ucOf1Dk*VYbT0{xf1=3h3geYb=FH|#<_)gOQ;?;*74c;Q_Da2 zs3xg$G#6t?j9PK*yvovAWEr8)`kC+J8c#eiIQy z`Hfhu7)(eqy*8F=O{LeRW9X=RFu&!)v)}<5`kI=nZvT}@ib?p}{vnwk1dBW8r969} zCaVPcWT>Ilf{^)E!&2Am+twv=^<>KaGUYzs%|GJ2{sFkjZqk17g&DeVQPySE!kwqd z!6P>@<+G7C!v*gwAG!N@t=3%`P}yDHpxuaBNk%U6is=JmURWpbQ{T~@L+!R!mBSVD zv#0>}_uC6?5Us3Mv25E+Hm?1Ju&gqwy1Uj!%_*cg=RNb9mhWtj`;olNhJhwcHa+c2 z@y%6n~y{P*EBr{h${ zxw#*;^?N3D!yP@5PQwW9V4iLF8X6R+$}Uap3zc6b`8|c0+P6pnVmvDo_x@Hb_=b^TtA-Ae{DTshO^Bkd?#F1N)4lnnWO!*x>eBR^Pp^ON=k8cI0D`XCN}tn zthl(iV zU%is0^t}A&aj|sq0`-}ZM=8ecYkhVFq0bUQ=q39mV#6qo)`VnaEJ`AGwZIrflHl31 z^`8MKzgJEAe-HzMQG`~1G+n5qlio>-sDj2l7bx@3kR7S%1hfz^Xa*jo@HYu@T%+WZ zF)>4cBpavaI3Shq3%og+UaW^79ng#ziSDAUC0SA}8W?z-@e-y5T}#bBnmL2b8V(6= zrm5O>09k2;Gk!DLX4*K4NPB&a4y(H`o7)VL$vi8~vR1=bfbP}IM_s^#Y20-GnQU#4 zrJ!)7>TYMJ*wY4AJ4W>3w|vv#{f&C%i|UsjQw8#m00WdWKOlOEbdwLYNzd)>ta!Of z)Mt5!BeOJ87q1^lH%d^eq+%ehLfNGmkY$yGK?U`NH$&q;VjU4ze!J#mz$z`b6} zL){nO#=Wtn5>zjhoF1OU)aRH_j{3WF%RB1SDJps-Z@{s4nUvWi(juQ+gt~8KKvHx} zn?*IQgNI!|Q-phcD<-F+d@!D>j-L>GM{;736R$Si&%HlV6Lv1sIdC8god`{1>U%zT zn(kMqq-z_e=;Q^?j@ zV5y{%$kn&KrPM6$Lu!_%-)Ult9xd)8d%P2{xe*<(dQ;}Xz1QaR`}$JR!5tjp?7?P`jxWo>=j$3< z>u1}rgKvw)AH&Jv`#b+`Oz1doHudrE+d162j2f|br3x(&EdJd6w$T~!WZ|l{Xb`}m zS-|rURkR&vNB{E3`u!V?rbST>g^{TB){MnG+uB1|KCL=&KFwAa`Jgvcqdgx2n0j;b z!;C5F(2?z>57TLM<>GL<_)STjta19Qh{;zDTb`()vIjo-?voAy(06ixN1-12wzp|# zYN)!XPru{EU~?5;ez$Y0t*=26M_98|i{t_cU>NZA11vj&J(NSOV)twga72J*=%_}q zG101C3;KMWX&+~(GQ6L18v-UJgT2!q>U_!h^J%FuqBRsbWTyD6JQa~=B7jJ~8dSsU zE73N2^tLw5h~_-25^gK3<#EP~lLX)F1Ljz-vH_PLGgbtXXClo4k_k-bK3DD6E&+Fa z4nN&1!+l4-AN_7Do2a0D%5k7FlwJ0#IV6iUzM&oOE@B@~LUvh+bO$ymx(o3hEu~XG zyl(&L8MKQ#V^Ln@>bH68Tt~Ubh@8eMvGZMpYCrLjO{#2=?B7tJ%rambd3=>eL3cJ$ ze%u53<+x967>aEV{UG8Ld2a7e9P^Zm^0=Q=qWWjE?0{Eu%L|WqBta?0`Y^96x%HE_ zwS<#7($8P|mw&IWLiRhX)QOTSE8|SE*8ipa|59ji1%Vv{MleTiZm~nxm&cSp9Qw=M zLiY)yb8BRbMw8Rq)IjAO1YzsH-jaUE;)Tz=>F(IM0Vm(uR9nk3#n@AsC5RwTJJ;G~v;95su26l9Z>og_%NfJ1Tkx+URrq*gnebW)={BYunva`aH5%*AnUowBrka}TZUY1wUW zZRSiaD3JbSJQ&5@c^O`BHrm~zl2DN+Q`tbnrvJd{=3x&OI$JcrZ{^zF4Juwzw`d7= zl2957*~DX&O*}DW9AMs0`_UA72iQBR>|0FBgjS2>z8_i81MW0^Z_}o<^LtSj#fsTc zi*NDWzD*WGFZ=f^e!O&;T>f=>cQ&BIJ6XYSBc`-WsL?kz zy9(R(?_>%-hpz`PT79|Rq zJPkSlc0DD{J&q53H-JTfC8_G=-5E@K@BtIcxJI$C0Ce%VHDGz2WULfx#jo%GKJzWf8pXoBP7jqZ6VoqxQTo5d$iaEUqC5n zQGfavK|+g{X&Jm)@=@D7i<;FQ9Uf1r*D4SMlLJ-^U>KJ#AY_a^1H08xko(o2-|i04 zs%bv}Rx7NL6;!CTY;9_`_w?%fPoxRt{7O@G*nb7EBSi7=;2*jflY=v{cy&H9eP==; z7&Gi4`x~M#ec#4v6B~doos6*|UMoNT6sKPz-KUO82~A6ZJJffN;x~gx(9-l9S?P zHo!FR(@nFi5C@~Sw@-YEZ!jN~H;AjXUXSaAfk|{5h6IgOtQ>eY`?Ca3e|XS)w*Eg( zDoRwmWo$#Gf}Z9OOr|Tso!dIXL5e6sei?b#lQuOkfr1j6PDZYRHw=D>r8E3yax(9x z24D0ASNFLP+C1;#x59m1a^+%fh{q;3JL(}*M_w+Zg}WYmCgqmQ$0}ZHO09}TAYQaZQVzqwW6+q!it`b^@FW zN|4l{@H?iM4CXmgJJ%+x1Fn$kI|Z+fPEo!26(w)Ml$ZZ=T0foOLPN>=)$+Oh_GKDy z^YxeGM>`(+Tny~M{N8o=-i50wSu?J3{dLz)jc1-8iQ$F<-R+`_PL>?1cpp{E=_AEq zc8fRwGuHK^;1snYMa^SvqLD*PbHkZc+m)b6n&-8z1Q=;b^x79v3aZt;Ukko*xtyiJ z|G8Mcd^|u;ks?eJ-SqMN8!iFanq}Hc=G^bV98s;{wj=H(mt zi`M}+q&2`Y^DOci#jlAf@-9%)CQLoKZvNf))$Ndi2XoCR3TE4BT3V2?=QPYQr|NObKk;dCZ&u{mdS>0g}usQ^-~G z!HGt|VFT@>C6$BEcs6D9Is;dMo=~}ca$!Qn_HJRHSubkIE++R1H3>m<#70?1%@2i^ zIiGy}-QmO&za(EO1=IzT zpI3NLm2U;6yj8$$Px*d<4rFeYL>8Ya~lj~9U<>| zQ#eewfj{i;)Cb=!d;pM%56T*BEp_!XImX&wF5KND;eoq9zL+bmPG5V5G|D$dg$*)) z@+a16uaG?lLrb`;pLfpcVdB1NT1|26`y*bWoom08VvJqhC8}jy7Kv{iltspxm;=jW zLPe$dgVm*j3IF>j`+Jr1jO_Y3F;uezOa=`7kGm5n*3VT@7QPwsQ;@o14LU%_*mohf zBlo6;wwW%px!(aU1GulPs;*0LVNxD)Dic~9)W}w!PX=nIwF<2J97RoV!b-D&?qW}D zHuW4&I%#8nrw|mHs5b2aZ+Ht-M9-0v@h``Prk9L2ohYi+shw~@%Zy|})c9J_<#&&zryFm8{4T3XbA`+!b=T`FT-?Pd8thRoHXa!x(N)=mI9pO30$a`KD z3t)hJ=gTzjr)hrK5F`b;C<1x&wl_HxocHbl`IB=`sH4*&%)ANM$MI#8|&P?kJKv_zSS`N%Ke za=>U-dwHAk$n7|K%xR|BqCYw)#IvmCJSEtl!fQVI12bTWK(A?)E4jQhOKsnExUGM@ zX&@={a3xe`_VkSg5ugIVH%+6;AFN?>ZxQ^O>9v}efZNVKS=OeTi)YBcD`B{?ry|W} zlQxh3-n10z+linw+umRKg_3DZn@h&aaL@|(MNkNKxE1MG)ec@=|B8E`sjx#0$oArri9fxIE{JPw;M46Ll~bE% z*&7k2HnTiVwDh!94-H=y${j&*QYLb$Uzbmauz4K7xG+Ul|LaAWtk_C43!vFsi&PB) zzfq!EWs&I%Ar2V;tdq!ms4oYJ&Y5%b;dvr7)c7_Y2qHdv`3H#?{ii_|?jrC z+LDlGarX?*XV~dA}9fxg;cZCj7morw3r>QW`j-^Muq9?jcw*{MH;L zVm`Yq@@ECW8{hGqA;)Z%=p-C`>Js62r)?F25UlTM-Jpa1K7IeOnuwWV=ss!Si7{sSi-nPM@@XAXCko zGnc-kBaC*^KTZVPmYp{O1XWR#xY~`W{C*G@E8b%M6sHd19gW20Zf|L@Oq8#M;1a{o z1gXc@G7P7BU;`4%nfUBad#Rb^TlFaNoT5JpS>Zu>3Tbcer_Q|zJI4uVO=c+RkOuxI;4gEPXKP0Dif=(J{mf35?Hb><3{pjd#Aq7-w`WVD}?C}vr zdDQ^5xK2c5{6G8de=Q=#B6~AkXD2(!z0CUOQw$hPB)b8xGFGeUok)J& z8(>YG%54Q3xld_Re|9-lJ~5t8^;1+&zjE0cfB4mG?eXz#KB^~(v>-zudjFRn?Lug3 zT<&0Npb0OIv3Tn)vXk`)c6B$=6S9`d=27Q@)KBCHyBHt}vKo)^T^|*dQW$Wl8EZ&?znh8?SF_zxQbaa>u;TAG0bNCAJG#WjXd;)$8R6Ulv>i|?|@_Fd` zx=1{-H;rF&*vdgruZZz*$ODsf$XAf^OqL*|RZKzc+31*LYH3da^^ zU)u*3ptO?mr0xOSSx0c!0szy8JY6Avg#JOyjzjq-`0lmYAuy|oB%U20^)q`nJG-i$ zPD^ce&l@v2@;U3RZg#oy0j8seuSY(@9dp!773kKueda$VJeHpYJS@s7)+)+dG`$l` zcP4nUFi2Y~5A$cSL|BwsHC#8=F)*PLy=jkk?_KX7E0Cz*w0Zd0!jHX&59`fTt|Wd|X>BNu zKYK8bH%SjN%`0aq-J|Q?~Ay$K#*w;ZEcTM99(8%o6 zMn=N6(GrT|ZULxpy+om@n!QO1x{O~2irodeq5ldPaQQk|vW{>*4QzaaFgZ?}f<-4t zWZI6od@pmFS_4>25gpom<*5yS5jM1fX1M^aH({yXl#EM9z`I%$*5 z#!rQ+OD7rKUEp0&ea6}?mW`08qq?71)9nJd=`XB?<~^HP^8?`O0yyL16Xw|A-CXoQ zo)Sz4ioXi6X&}p-&(9xgsjhxyAbptnF>SK8Ah2&>ie@#UW8U7b zSbmnZp+PcJ;`vbmN8RzIbDM@zM}E=l%UVaL*`2}IcWplFO;uexf`cyt9(z`X87yPE z7S1qJ1!&Ak3n^`SZoW0ypL)(6^Zr&R_0TBvTHnwQNNfOQj!PeqQ@(o5!8z??0#p>9 z)OgjKdPNlc+&M`ZQvwH)@Vd_1MV$(Y%_OBbI!!CTYp(EF_^;hnN!YGJdYnKM<>dK# zLSip*9=gF-AF?pdvLewSN+Zg<0$bLua6eMX*a z6GIgHR*2k*p*488Q7Motfk5?Ohu1Dr98seI0q9{h=3AXod}^KyqAA4r94?Kioa*aZ`2)4F*qYvaA=g-V9l<(En)`eP zC;v}gL9D%tXg=|a^Cw-Lv^gTMt1keXZ7w(b{p*~pww$G$yO;itH+kSZ$P5`XgTHr> z?t2As&|Us0OHlOt<|L{(Rh#@0PAS}f5-9aYK)!`Y+oXcK25qzhaL_$Q45ChzH4#SG zsYCTm%IJ-svlcmacT37quIo_OeGj)Kj%V4p06^_g#YoDu#C@Zv98CA4wu_Ai_0+S$ zqBhMXQQF3xV5h+KW{JG-k`@UX{W%G>dX`bj&b?NjSUyjoN5L{~2%)z=OT z+#x`~Qrav`2BQ6+OaA8~XLaG}lR+dA&c3lFZ4uw5`jyAT(W)xyw15i~8yW=0-5i&Q z>dyJ9Ph&Su9&$g5jBtAYNFfrgx-j#9h61FQMhou8Jvjd8nUDaeqtDFt8UOKz{Jo@D zA-Ck|-2|gJm--qH&mSt%7)wG5Pl6LZ2_2b()BM-3i4SY806CxOBV-oz1b&Oll zBK`h=0upFwh`xp&)7;zE#vtD&226_>YdH3)4;T(9{zgjvv2yk{R#tpX^J??oyS{_t zb3(n}2ftqhLtwG7hS?hkF;E3ZRP8_NGFf8;u*gT-i799=TNKDgY>LG*` z3m4$v!~;+4mjaD^DXG4iyvJ{u=kSxK5K3eKHMly1%ZC0jsr-k?ZqK!pZ11nhF}(;SP6i3p`88K)J>Nw+vO@%|7~@uMdsN&XxG5HR(5#MG;Gl9{(H zs3HtFr*v(_c$LvVHBn7q1E!8Pkoo18fH8MYqoCm6x({Nzry)4lwf0WGsNfvcY2G64|oUbBC^jeUGFt4ja#3;&<5)ldHkeg6G-|FzDW4;2S!pysFpK0LoyavjcW4xv|`Zr>M z?J>nV4Gx-M58#Hkln4`YD|%6a)8zj7U;Mphtf8fhe|^@ne|+_s=j=A)Y0U9P@Y1x? z%bb}v;-jQDrgLm0eQ6!JA=W$Bm?#Lc?*H+UC65q`!kqFaPpZ21*Soj_BAKM5%3cd? zX7WAh4_MqG@BkFJh=2RPUe4S?#u9=XNP^AtyQ-u~CNB%V$@PvY#sci1zfvvKs!i=Q zny~++LlS+*Qpls27YF;ApPdi2=LsY7{sQskh7-> z{;tC;<%Lj$#VjsIZ)i8I5V&)=Emm6%;(d1MR#^Gr0Py6wEjZNZ;|CzGousI@r1180 zcUlRNKet)|X#pMk?8=9Xqfz_#vwd!Z$3Aa+H3z1F9ERfbUz=6_e*FLI14n#2G4a>O zWA}On+3~#s1vz`B{_@ae>K&pLgshOqqd5fkGP$IYzkTVg|IIF`1wk+w-QHnqx0T`X zP)2#6PwbxqY7D@_d%2lf?cfC^*n7Rd3D7)v|FNq-Y5={eNP47+KrRjhc$I;$vWN$BP$!K(3n?*81XD?DPpRDH@!OqeXOIceY``*lQ3$4|JM3 zH&EB7MYt~4@UO{ToZA9fP+KOyZ-t5064i%*n6V+i1Nq0;(z`c4X?4{Ou~g-Ib35FY zd$(sm@z>XlW2_R?qgzn~uoIKK^xqX(ZubLFFF&PcG8h=Z_N6iAz>u5Yxmr#@B7L>Qp5gp>p34=o=~>bqpo#M^e3sRv&F{iW`nF~?HK`8>+yMt zHB*_er#6FekRHT6K4j;)x5lOkODF1jLbN*j*qw(K0(*3k6@y=YZY~);D3J0j{8?d@B}bw`>Ev-Pe9|;E|uqGu);NhmS>;id_&5oI5X!Wuw6BEN8CCSMAOO z1ws8D`fc>%Q}5Wfe$h(6mAJK_%CCUo4H)o`-n%m-p7${0UN_)zp_{deAI5}_jFk-SMpcmnXR%KczlAgxuiltC{@@~wb}9uWY0@0t#?gzG zD;{q~OvL^XCq5H^1LUXF`s#e?PcJkhpM@1n>z+Hw!K9%7}9C{Y$e6So&#bHt{=2X z@Tu)r4!32>(wx(QcXKs89p)Q+RVyqn{y{Og^~w!82y)<|o|3pWS=vcxxEHu}zgXp# zAN_Z}1e4fT3ESq!?LO;?g{gTRUY{Jky4*)nS}p^0P_lwKD(-r~ac77))iJLcUVp3| ztNhBVW~c`ySD%1rPiu&ONo?G?4Pmcs|YZv}PTjmmbb5%W!!f zx1N4r!NUpYr~%$u?nZ>`V;;r24$*AeNr2+&3(u&iR^nZ^SIKL=P^x#vbxr{Kv^49u19_@p7=_cMi_pSOA>!qUxh-}LfS0a)EoeNFl zD(iO~2?*wVn`XB)hqE;TvjUVfgJ>e&h;0$@Mb0b#A7}}9s-3O7+ZGjo5eyK-;V1`0 z9{oGh3h`m=2q3!c{Tv`dEI%I?H*t*p5bzCvM8Ey{->vY%#agr+jFfgLje zVb#065zX~+xFB?rzF(b4pDK_0%*byR*w+6Y{^u|X(z<9(zdGJ9)UIZ0dk-=EH$egZr~#zDGv;;EfD4@PERA;Eklldj|c-2z2slm@iimX z9B9hS4wnNTolRJ_~PDT!^zM{jh zG8;`Z-{HbO#=5f{Uwc+9SNOQNhY>ism}NY%t6j&~z|V_&2zGy4-y#kZgl{}5yE9&4 zv{;AhIkLQlW+x*ieyv$^6>(;Fq za$AidK!{QVVlXNaTuc!KNN%FiCk)uHkNuthxWud!NEc^95rKc>z)D9X2g+af7aiipG#Qc4TbQX(MIv2+SZ zw{(MmDAL{C9ZQ!;ckBYYgfuL%bjN%1eV_01{Frf^afUw}xbMBL&*wPL!#(G=VsoRQ zy6i0!*4|JG818hmnF7e0>zraru+Il~;T~*hC`f9`dZj@_xOY8+BCtX#Iek%DH+$54 zRcNK95o0P>aTWg#SRepaTr(%3x_p5R4%S5t`juKiOVk?cplz6~eJVs>C`E8|2obFB z0%^hCG%aYycE>FFLHp=skeu>pBZZaAVb<0=>7uc6jhF z0hMD42PUPt|6j zIhy+VI=Gg%Pp;d*j$6lTuTlIwAJ;86ripziRdy$oh1^oHIm~^H@pdHs_KXgwA23_OK0y!mI26NeQsUp5U7r=7&DeqA5Q= z&4jl%bgfMQT$yvcwDf+nk9^FLsA6<&z$c(f)@M7KvjDod@(_&?wnG8I9I zV}1=H*nnFINB^I~4Xy zVbRZ8JmL88iLWaYFm-)}eZ&kf@j4R&CTS23bfE@Wjg_{y*n%4wzzrC<##XD8h{_Ui z^7v}_!xI3S4(8HetAMD(=zX_3-^xtGq-G_GLnEFhl2@0((k@$Wv#0>aI&sb+<}=j4 z4wnWp`{W}mQ_d)|M~4?Zlm}yQ4t+w{2wLoTHO64?v^D^&mL|Mm8sJfqujirZP4@_D z=$91s0vq}#@c;n5TjQ55N`;5&pL?Uz;#G*vK-TMEu`!MX!)j?eppKF&(4n; z(z4vX)Q6{2;I8%OvK2l zT^IfODb&+DVUZdB2TbgX-0kkd%| znB;>_%^cAMj{EUS#{dE<^9vc;|1D=e5&;3|e5%m}LU_<#_I)F_8jJe-YYYf)ULOuXmfN^Djl&fmu=;~`)bs(jb6 z#dZES&l7BL2kzPyC!uxNC=LF0T}qG%a4#pJ|Kfpf+rNnU?`iw%b(eQD(`{eu1%mRA z);m*U$E4g1jr+C5slAfue4X?cqq?D4bs9kVl(0{FTIgx>xD1a-^51Ua@NC=>!ycfv(jqRnj8=DBZo0MxkN1o zb4um2e5kZzY47=NMaJMkKsr11)w>z;1ujNJDwvkj=F=#s;x$~2znR1joNuEln4}9G ztz{6HH;Lon-t(ZfB|wPHNMpj*A^7B#zaQn-N`uTaopmzmV;7UH7K!zostiUMEpXis zG~D=me`6FdT@su&{?@o|$*dZ#Fq&vQ0P~~tG#wBZk}#Za7$xWfT4SDX6Q2ZHJ*h6p z3>z0I(;Ef6ABpL7aoRb)=0?FSSx|1lIA2GZhScY4TAsJGo5mxj@1Tt1dnuONewV&G z5qKnqh8Ai3i_}w)iv!zFBIT#+lhsbd8_x!C^!b@I^DTM{>Xlgo{jw43c}3f! ziW<(bPQ!3*)ueWEs{(n8y^EhT*(JUoGG;9h*Dh*z^V9fjF2(UITDY zF(9AHxT`&5^y&|DG4^0XZ*2v3sETRrGx8W^0V_&|lwTOPqhXV9l? z%Nwx{*Ov`;nt3-Gc|PhTXi-3hKJJY18+1XI;ot9nnH>|Nw};2{C81VJjG*NtAxq*k z>ZxUxv9s=%q?Tr09cNuBX>e-|XD0E6O#xQ%^z%O?h2g1V!dkmo9KvRt99_H<_XB(LcZdV+kC~ z0Nv7*3p4gRUtmj79J32tLD&2oay@r85>fzVDFRyx!y>}vM6f%%>$X|jJ;k-wZonY4 zI~$Z7wzUjKY*8y=;rMax9xqb%Esu+{xKd_V6xd;?-m{iAM`!av_yfeC-Y9&WUQtHK zQq_)#E@RecFOtz;OiP1#P_eoi0+hHWLl8!Ub(sP^?x6 z8sy~gX13}T)^#E3Osj-39`p1rlse8<)D7Pn?G>{nzu(x3$5_>@ZXBdjncSGiA_O{o zHaDnf1zPp3IPDZhr|IF{k;=Ubz*1Swh9b#cU8m2dRFge7ZWjf0M^BJ(6F0D*V7SV*BC1{IRSFhO41K zVttL69`)Bd%2(=WCK5s(eWjrwq@If_aCUl?SV5DmX{GGk`l$>OtxCag&l>tNxwy&?Xe1#|V8{tKJg{3*Jd5u^!*mQH~ z*(iP4aBC^xy?UBdFMxrd(KO!+e>iIw?I3L@OVgE3` znmU_p;2*aM19B^EF?d$I|9h)cV1Kc{HWWd;7A#N{t)YpWQ@#J4$dLIs*;&WLhP6mnrH9av;#?t}4{0V_Wf;~0qtaG8< zp{&hzU-;j!cDqoEu{Tl=ihM zbxY8hUme5mt#pK;L@$EjK$7{@fc{w3H2i>e1`8A#RmLc3#gad^^dhbKNp6r~S^Rsc z@S56PP2A)6&x7+G1zA$d0dkq#-Q@QLPCNDP^M75xMg|`Te2T;TqYmsEibwbg;)-`3 z*_Z;LK`E={xtKbolMKo1^Nnu0`r?Bf0k$BkE-?D_lzU(Y&etE)OXLTg?E)%F`V4#o zZ%nEzLIvQ?=)0I`Z0NtYxjw$ltAdo*7rnl@0W*2X+FPsEZDYa$2~ZyUQcfeo{AI%B zpIBA=&10^3tOErxc$c*6>2l-<)~O5(+#tvB*;qWG7Hm1>N(pkDGQP_hZNu9_QZGf) zo(jG{EP+0CVMB1@3URrqj#VzKn=a~sTUpiSm!*(XtW832%sIPZX z03sAg)=yW1GN0{;j?^E_vtj>UzS#~NIjPA`>bm;9sSuB#Atdd3WGsHd%zzJ5~Cy7-2|d?o=E7l7{G0{kN=!+CSH89p;hiN-E3j;(I;d~0F^EQrawqiIP1 zswN}>7yE@&lCqi^Ze4n`Xmbb(Zh1j5d<53GnKz{yEp?_*7sP6NXyu0KMtxGq6sn=h{ELK>MvGq z9vSsC;-$fX>0e1eP2`*3wPnCIDykI@8AkWjhPycT=@Nqs8*RP9{9l?At|#%52ZlY` zTn)bz-3`3qy5AvCTJ$hmJ1W8{fpof5Ywx!|gxwQgt|^6A)72gyF?qjggxV0tqT^J* zKgBbd5c@)@2gJr$fy#$+TDois6owr>(liC4fPtS%K6~ukqh@TQXQ!G^#?LAq;)?MA z=o=~7#(N9Ae8;2#ObwT&@>yY)gdYz4Rk>%rI94zDRIk6T#OwuG4MyGluQIF+o903G z&mbBsG0*ojMO%*iyco`z>_oN3_(0nqyN+j?Woau!$_n08B%)1WYhehY*_K;6rh2|e zM`Uj%b6?f(@&(s-dUG~HZt&>_0bE{nBgFzjCQF2~zWv4By_VwUh7zTbnSm}}2kK}- zvl+fdMfTt!|LR|zrM{Lsf+6z+HlF|cngiW^Vv+n(${O`;=u;dBdvWn^K?!gXm{eZo z`nhJPU(_HdH1NIf0U6~UOTsB`)MVX;@@+iI2*8dk2V?t|vT+-idfzVC{r9BtQZRIe z;T3j1!6Unv4$4xe_b9^^I~ziOObQh|(8^VC6JMWU;DaFB-Fb5FL>H;<&0FJUw-SXW z+2zMTn>P#?$)*2mTCWx+R`TR1V5~tVzVFpBQK+iTxTKp{luRYxvI$Ed`fxB$@}!vi zhC}G+eq!6Bu`QAB_sYgQ9%6jC&*_2#<2h?c4v0F{kpCGKB2^a?{o^0o>C=-#s-*oj zH1HlM2u!;MIXD%=% zABfK}8@hOBR(39AQQ^$h;zGYfeqRk2$AgvRpp?)@c@X3hPHWz;4U1aehe4Li^5(TC zHFc)9#I<0BVIR{^D(u(<_#8krQ(5{U-oK9PeZ_)X0bahy>3JtM&L3{*{W*E(fNG4g zAzWvm+_)rOzrfm}qHH`GV#_>twrO@<16JM8QBAEirLa zN_Hc-Z;7d?zaGH1WFu2>&-r%)y$?~HkbbXhGpS3VB281?03guGOo923gUD}O+k*)E zVJnb*t;pZ<7d3M^Rna0~wU9yB$Zj6}Dt&!LwZpt^i^?4dIxpo)IzK^km$Wj#k*i`l z`p@_>E(;_le|uPnwXQqUB@OV#B}4oTSXr$!N{>398GokG4@rJ(YO%4bhMU}{=FiF} zzyMw@@z>_m{u2KC zbBW@)pS)=rzgT@egpk*zq{JiaZ3+|6FIRBe3wV(+>^g(=K+HI6N5m-Z+@tt_pM&Y0KL2rl_we1R*~Qb>b|nb1obbU zB!MO_HmL@?jWt%SZZHt)iL~f@{vv9zYgQTarJduY?lFaqq{oVD#<)1OL$E-J>M*z z?+>e;r|VQk=wZCRb_C~MzhzLt^lk;1@VZByRWBk{^+eBC%(2#Kbe>m#$(pC(HwDbS z$Oa#v0}edOX6m7D`?1P^CV3$r24c0SJraSN07p7pv8vel+#)C9={Fer*3;!_o8Rr^ zeJtvBpz!-3$p=Vw3w(lL7k)QX-NkIb3GhuwZ8Wx47v8+G1@zKR(vd#(z!meIxo%Hs zZSk%f0rd*iQ_JmMbQ7cBSJJ>0Z#6+nWRZxnzA@CrgQi}$6+rhiv>Aj5<6wi&^D@wJ z-gYnY{{uN^(wLySP6Gd(!4@`hzMAoW*L8CkeoMuS9&Q0iHMHX+BO#_S5;?(E4;aeE zmFZ)SpZH-JC*KPe4jUA-+%EFw|DMC&XZ({pOcsK-C$rofaOI<@kv6YKy;vleyz=B= znJVcVDy~&qP`Qw)4h)%U8o523geF#~s9?T;NPgwnl|_G*%AleB+r) z(L5P;Lttl4z<7haE$0Ee?bCqh-Q}h{r;f8B>&RG$-tf{^E5o`S)epzTD*v77ZRQ>Q z>J~1tz40JDIH7mx;W*?iHc8#X-pqBgb9xd$0o45!EjrY&yeZhqe4)B& z?;$BFT2xpb1%%2DrMZRm^aFXXvbsrJ?xx@K9+vBmMoFcj|{kIbJE5pQNg z0>vuouz`Blh`LhdGK=QZNZXa~ANxG))k_lwc9d1L%BnMF28DM=)x>#mnzpF#J_q_y zrdb${+#{c=5n+#ny{FuR{OG-2f9L%wW4EYo8rb0;dLn3{ap?*(K|C8Xdu;MV;!6V1 z#;m=Y8Idvpun5H)D@_-L+nGGD5qS)L8bhm}u#tAe=Znh+=PwETG5S=X$}C;+m33*5 zKfn+V5R3;h)0nE*iIRNJwc4tyd2Mq-Wr&X?-C*~+Gzed{LKUs=x1DtN=$`mk?U@@C zlvcUwh{i7oW1!{Yh-p`iI@(Xcj=4@;<&5{!>*Z5MpO%ttqezzXA=nW80;1Y8U}#4Y z=A_Seh1tm4P4&NR`*;=FS)x4$N-1lJO0D1lVWUN5eT&G5LAv0ehE%Ux|95lW1E-2B z5vG#D_fKo^7GHn6Xp&h}vNNU$r!66PXm20!n9!t8nQ+Bvt{L+7V-y=O&m4e?(#wwW zt*imDUX!z>YL7+ym!8)^fx+4?kCu(k9d7+jRatpO?;!Twmy*TZElojn9RL&Te>_My zSZknCMxgYSb$ej}jP;G8O|;{T1NOI>9FG9!JUyq%^9=ay4?&B|Mi2khIcbl&Es=M( z%w(FHt)dzW=*XX3SY(Q66Db^+e~W_)Oc_W9t1%?Jl@Q`$BQshuTy`35Zu~+Y>rZW; z?yQxzArgVSyzYs&V<4)7bCYb{YUjxsD!UE4^Q_%1RSpoZFl?lGhI?IZF{yw}Gf?7+ z&ww82!`mxV|I8b+!AyVjRiOGy*1hoti(Q!fUK<>aDH?(K|4V{~9XCMrvMw$VKxA$M zFkHn13+V!r{6YUbVBxX66kl5MfX9mqc)Wf&pgZ&|Y9XZ#d+)tE2S*j5YJAdi_`935 zz}Wyi`@+5kGlwVX_wZ7XL(t(svD`}RrNXb{Slit>6N~pz*DbALmqAU_E`|_H+x0~s z%giR3qY+W9!@lJ(4^WB&E6W)vbV2Duf#FcZNXaP2s2bhpq=>nIl$pr{kUAMb=!>iceAv=8~5qJmS|st|%Cl6(SOCBCftQGeTPvqT#sM|HeZKt+ zTvp!U>U&TwQ@@O23D3?Zz|{iw*Uzv(h+&)8D#~hswGl2lp9tS;S5*`)Bry5yfcm~0 ziFg;lp7Z6$f6P>;MuT_hudmzO!)1k;Dfxy}Lqb9u)GM)c=o`>A?;EwhSV;5Fb_URR z?d?)cJCav^eh=qZc`JOa38zEWy&R@Q=k&^{cPd5>SlVROwcO-Jd4&5MfMIT(4F>5} zvXkx0l%YE*i0W(%m3}NO&{tYM{iSk_56-hjWurs8FmgCn=)#LFhy*6KW&Rvk4)_hG zw#CO8jT)vh5@|kPW!wV2t^4mE-wP_k;UHnJyc*b-1IZ)w_JV28h>1mxeJaz}UH#)t z3Oso{HaBj8PUfF{MWG6|DGAJjbx!X^)vy0l8I(csM|yiQ%k9oz=jjs>$M;@V>bKa< zyLvQxOuJzur7zCgrzL0GprdZ`m2Ri4w*MsP^I7=%(pVYj)NK5pWry{-PfAvx4^USB z2T~HL6B0Mr+9kYJ`ofHC5h|HZy~4cVTG1@(Nz?q{)GYp^i*nwd0#b`X*vIb`DaQmS z&lO3{B-AOHB)(7zb7B($f9{C>Oz1XbygSVK;B4?B>C{Z0h%tl;#Rvr6i@oo;oHk%u zx7QDe>w-J9w=(JowtntYi?J#Y&yxeO^uj4+1V|3o7qwg{aCSc)0g%C>PS;_p^O^r} z-m1ocLC?-F+E>iI|iH+YeeOr!&($?0jxM+50jU1s0_*>7gK@Ui7(=#yzt{FFFBsnWJE7m6%gw z%$cQd40ECg3p-Fd;yG=w`w;1I*LV{vW+S}U!=UH|g+dQe?RWQDBNONVSVd{uOaB)yJl{zT{3QB|VLD>(Rfvc;9R+aCakJjCyuO-OM zr^S5uKByjLLu4Jnn%DQmeMPZoXsEOSKq}eN^bc*6Oye9B1302lxS+JMVWB(YZ`aKs*!N2p4^VG5$E2i?$Xtu$EMG5x z->J<9lTYU*jH5rEfa2FkkD6<6e3Tmf@GUBO|I1HD^5awexX}E@W51-S09>AB@@iM$ z!fxaRar-J6ZM zx>l0WZcpImvb2?J61y#b@QscxrITDeoE2*(bB){61%))rL7N;7+6WNPunTv>x51re z^cw%pAy{d%6IkB3u`Zz3V!9rbg%r5m=eFVYhx6cr&h=71=utTQvM%p|7nQN5weKnJ z#Ac!PVhHbsmBnA3zdR@zq(jC9mFL~hqM@FCJTGqc%8n$UJQU*PuZXP)BTh$q?t>R# zVJ*S>2$*y6>oSY&({F~nc4c^Sh{Ua&#*Ipb2CVt4R#G}QJaJAlpVU_%1Fk7FpXHfe z^Np3(0&KE`O1!}wD(s;-9i5O@+@*wC52-=(`mLyx_kMd<#CX$1;H#f`F)r-M`UUn1 zKx3zeo0O-o7_1HQW%PgK*yhZ>>*uP=&$Uj?Ojh6=C4qac$>)XX?$;$qFn4zMMtzQkX2c-hgd!jzX9&CK(W3>I=i#S(9E_4BG3 zV7WEUN~4CQ3AqGer85S(ZBD&@={RkjXQmDDoBQ)!-K}10ol(1Cs)c2LJ#q0~n2Wg4 zSBouOz3iYVJ-1y@e^F|`o@~7Z9|4z7!0Fl|1hn`C1qUjPy6E}&HKoGIUyF#Gv{MTv zvE3ah#*LdCuJ&_n6lARZA^wHehGbMNlX%j+FE^DPrzhd7qTlLAF8vPSlw zP3VI}mmiz@o*oG7W6fe?eQgICdM(E+vSH>&LJ1J8b;^D`0l}}7QXPMQJ<`Vs2|aMg zR?h^c^m$|7zg@Gx5{`f4I_JE|nGXAJ+bo%2L`v5N{Z}=~4eNI!$hqp2=uM*Ln{>_l ztjyD;?d)n?AUso);-HuTDz#-rRt_T+9;qD}z@{~vKX;p>F0VH=uYkD71WT@uI*m>y z@dY{^yojQ-Pq$LIYd`BTn*0paDZ|7lINA~4R82*Tj`UcwTLgEe|5MkC z%ztIO@cF-Wy}e%|ioZ6xw7hVqo@K6Nr*slhWCBlH+3wP(J=~7S4+@{=NF`>S#^;Kq z9(Z&X$7cGqGKh*39XL8!#Dv4oRUYyg4whJ|HM;T)?wJ(x*wp6{eSdp3LBNc7%;iWq z1%KGa@4t{`TWqr&%s8NJM>kD?7YRg&)Wxl&f8W#VD#_N@yPFc~1iDNB7hM(?bt5H% z`@e`wq0^3%vZ+myu_ymsG6FW9Zzhk-9I=>mVq!9T02HQ@DtBckW( zS>S;fd{r7v5rWa@Tkjh053d_f&T&YqmXt+Y9^mx;Xb+Oxez40hgOIr|tFQ|rgd(B* zH6(8BQhvh-(%{e%7?zSc5Vk;4>It(+$5H*~1f6*2jY3UyAarpXZ zeIr*xnu|-F>I7pB>|He#`cWP!Aj=#|LEHWLzKP9Wtu`2e%X)vg1U}*wmhlH70vcHn ztPI@@-R!;T6ro5BTEGLxFt7;rz(Am`f?*woser~!bx|MSQ`Bk=OOV5YbL3yZkx_9GvyA^WN!)y?CPn)b+CR&DrPh zTcAql?+q^wp3755$~mJ%8q>i^f7MwH*pD_wRgcn#qNAfthLhV(&-W+k0dF=x)Wyii z=x`~7x*vgRVe$7rX}6NbDyV3?et+{WzVcJ$8q|yRvvS8&)rxx-6NPS zUu}=7*D3KEW<3E`6aYwKP5Go`&!irH>GR2F^rg+%xV8e4X<>&y;z-i={?QrvSqt}l z{LZnpm;p2y{5OR0b;sV_x&Vl7X5HZ%X4;_!N zxIQqsQ9nk%*<2LLP6g5hAJ_MW5|{v}#v#d+d2+nZT+w}rQo_YGtu2gUv#|X**qrA< z0zu$4tL&@TX?3&yc5GStirP=k=i;zC3kmeqf!o{X*hjw|@9PNgR~-BL{5vB#|I)S5 z?M{^YZ0yFzq6yN>@2eIA78Q+j5OFD%7aGG;)@9 zI^%MlQ*g~BSWeR%8MBv_M!9RJ_#RcT0#ioyieJL{b(nY`VU)l0WXGr~pm1y?20A7( z&@PE1Mnk(S&O3R)9%JU7A6A_;eXxrf?NqY*9Hy#+!56uhYzrjSYZcGPzPlVP5zQ$sg?=N~~2SReNJMi66AYqg7nLRa80Q)@QTxz zY^rmO*?gc83PjnYpPPLI07YQ*yAR4?AOXKTyGdtH@ODzFivmKs%gdXY57F-(D~$}fW4@R4HZV5 z$~x-b;NbwJgq8;E=huGBIY9opj`F&N&cHPH4RnG_jI$HqHl~hzfetZaz97>l{5*w$ z&A99QJQJ!mR?yo^I_wo8UEv%8!LmfGRhpU+05a_dC~Md{_YP^eZxAH>zRqt_mavEh zT~>+1&3kzoo1URU#k2+Z;80HTw!IVp--|`#;uvNM1Q2+pZ;B!+1l2LR^`<5@>KfgJ z9#2{QvKT(Ks`ahmUG1CApf7Sn71oi~CZW5pS*Dr!CeLIpD3kVO2A~qCfqOlsIt;%d zpQZs*oSfy9r0DN+*?n^O&kI-R|K(%#t$yyd;_Z?<1CMtCNIFD{Y`!p#bcD|2Pjx&# zwK#Wy*RLa)$UK|lzmgSiSU z;Nyqk8-&@!-2}Vb$47&NvI>uaNi7BNHn{-w9_q=jw)g~pdlKF0dM*vRl3;c9h9)Gr zR-{pF9mN`HZ(v6Dh3h4>3YV{3^nycrzBYraV>Ca-(S%wRT_MT}J($e5rrl=`w3_Z> zM(#`ZzYS>i3Ys8aPV;qJDsD=EWA#t+i{IKhR93IpIaHHGS%HWY*HFRmrp?N$62Kf+ zn1SQB?KWuOHH3e#?G{3C1 zOm(*-An`8VV8R3_DiQ$d>dLq;qRK5rtXDcD=GFWja{11^5iQdf!wVpee2tFi^)b|9 zO}H^}z1V;$JT;1TD5^8{L+KvOvvB3nXm&pv!0@N-n+q`fH4Y59X(nLDDzCZYu}v&D z9tGG%zBacHX+qf(*Bx0Oy7m|2ZOCoCvgo<_eP9PvA$ruh#sFHI{$%v-9tPyq7pHRO zcHcTj;q%I@oqb|5Fj31P&^eOSO54lt>fOg#ZLjEm{McDTT+&YrP-3~4l)ln@p5#Y9 znY>G#*5>-5o#pvs)bgyAs1;`z?&x@52=0fHYOTRF}-(n+yeoXU8^HBrc zF9I|`d!R06x|g^6w;f+4QN^ad`+-~Y2SoS9@t>q!hW>_%SJPwwl(n{aDI|;8syUJD zF_qPtLpRAInqP>zyT5;eBG@9!HbZPKnB54)1%7q5{k?`4?b3~Srgk-y)9_;_)v(`O zX5#YdI7-wyJi2ODM`LAcTdwOl%mWnjHoNRb>*UL;9*JHJ9eW_k%gf{CQ+NmH2t`?qdsFr7 z(tNM0W|n;(#_QDEroFSjyQ%99UW>Y5U|{Ix*8s_0g&#KABI^#j2p45#LYG<<3aGm* zx)i}$jt|J>D=Dd1G|JT~Rs^b76WeXe@RX(O+75z~&9)};fZcFqMuyL2sK*V$uI-IN znX0ZD{n?_coy|?kZxP>viw(#AZsMuKSH0MGXMW5Eu^PtvmvG-(<+bp&<7%y1^C+kw zXPv`})V*dW)fuL>ysdFZ`TMX?)_Z=2Z>n>senACr|Jw2SS&Jn4PW+Ko(~;84RNx#| zAv4q|Q7?z^}8rfcFY^f5UmggZL6q6ul<@fup7(2({6?HhnW5XagPiFQc=w` zJIw<9bpEsBqd(7wg+-H9^@oK+fDhJiEHA7(t*a}<;=IhrF0xFdAZ&NJOhnp9?7>P# z%ZVZ9H!3^&??CXC-1|5wiUw%4$*72O$DE7=O+NKb+s#1C8`9vL-2JIO4;@wSBS)UB zvO9Qt6##(~Um8p=tTw>=ey+G!7T@XhqT@lv6)Q+qHggDw=N8Xv%yD#x1ihm!fP~u6 z>AdF3Ln@^cw+m`|Qo;=I_SUl)2-4W2q1t8`hoaZzZLr7OvLm5I?2^6vt zn5f*sM`QSIW3_eIHBXaFLw=oMsrS*6f9WBhB&DQ&;l!H z#s;6(qIrAcSi9TVKx#c*>a}lYMF~s1Yo-X~XkTG%cf3hjP&CI|Ps#HB67J5R@9n}X ze7fGz!F?_#xS8f%?dTg-Oi{h}eQ{ipNMWzWtg!dnLT69WSFSFK?z`tEeVy;To_tO% z?Ck$Zp+xExm8-CWP<*7el^bC?V>TD5Q`$;v_=mwONlY5H^WAC{h$gP>WpV?#qEbC7 zoZ}1DWy{&QHRS_W!Bh0E|Lpee|0*P?PW}EuFdsE+(X_Js!yC%H-$R*C_S=N?%jE2%g0-B)vGPf;u2js~KjcIK=vAHk`WbRJx$O`oV@K{~% zw~U<6Ew#?UMTRjIylYx`<>KzyN5gls&4l}}ig|H63_Li9-WSUFjfpFHU~fr&sLa$P z+L;mJP5yC-F#n8Bf+i`BmKTZ>kWJGXLLVvSr=%iNahKXG)W7$IZ}!=xyZd@SY&J=# zhSv2g{py6^DBd!Cq(?_G=&QEnpuUZP{MmH!j~1UW$RdgWCtCbh>(5<2=5Csf+OK!+ z0?CF{^x|X2yE8;}zZ^E4z|OHAC=i5vq%*UsS^KKU$+SCb>a)#@^41DIse&SBqjqP0 zYUWC_G3Z zJXAteika{>y#g*wwCaLptU?#;T9#Alt6(vL_lB_8Gycys&#*o$o#kF_W2@D@ZW%F% zn2M3{E=J%PYri)IUEg*jqO~l33gA)LqA)q-|JKlRR+=Bq-J>dpq2K_A3nD5sOe3DJx9%^6*9#DiH*%%-4c2+s*)HML+>ZEp+k(^c#z=z)c<8>+# z#!Z<}oe#xdZY(dD;qd5{s#@R1>Gm})g5c)QhDJ{jb2CNGZlaN#FaN+`ijJ)XlbRiIDXkF;8A-k8pZ zD6gS+VRBfn5m!hf;wgCXN$+p<6yqNmiuLpZG3}`;P^IzdE;GJD`=2t3awR+|zb}2q zE))1ivG@)k%^&|bYiC@Hh9HYZebR4v6v(eRvUN%9sCJdW^6vu1)D+8h?XF*HgEPx^ zoVG2M4-}n4nQ`uvTiUl$G1{Fpi{(V<A5#?Lo= z<7azw#ydD9{43!p-__F$<`Alu7f`qXK6@qB;&@gQJ{B8|uCa}jlA5151FkHOcPdzk zNq}1sKem!|)4vj$?wh2)m`;>!j|8!OR{JM?L&)VxHwXB3|(qI9ZQXUu#`d?{v8H6k;0DOrqjS zEKw43!Ml2u+_RQ1K58sXV}C1ClI%}r^tWYJ^B30-86~-!9~bze>LNTV7QaATN>vi# z1RoX5{{1>%Dd{QQ>jt;bp_H>SR{g`6cem%n(b@BSPV0E?H+33$o)J{l))yQ>XQNZ; zf&Q1W@vOX$vtluf2-FNOEcbLR=5j-au3UVU1W9l91535*wBhx3c3xkjQd6z9THLDe z$lq$-&NawDP&2RXT2CMi&CMm5L$wj2>LhYaF58TQz88}5*T*%pf+2Wh*}tF6kWShU z#IxNMb7I1-wtvJO?p|Xe-Aksg86Q7qkF|srlTn8*o?uqncRsw>sZsoCbM-rDv7dUI zuWxhwtR!>L6V;~k0xq@|Q-lJB68Yd2ubVS6^AUr5^KWZsZqDZU zwCBIbw_cv)=?hDIMDHD#>L+GWbL*ZQl>JQziavKcN*ai;?8SpBz#%pTROkhYz5U-F z*%fAXA8&D+Y*nvWQjCT3^ASN3gdQSSN5%owR#Y5|Mqf^Z2qR0~5q3o&W&*15OnBswi|S^{O;Oj7d6o)fqlYnWxdP&9=temC535M>Fwe9 zd4Bs=lY?*Zog5`d_AX6-;Vh(e7aV^Ev~!H-1>99D4?n%xUDEcIshFeC?gk6OPSl7M zHPy4xj+dsx9w|fl_6BAxqm~MpyEL~w<28z58$O#GF%uHo)9K!=RmF#)$dbaHpSQ0W z{l)SW^{xb|iWP&1Vzs`RT)?^XoIGwEtE(#seOH|bPK9H#+ta!0h-sEVEE`d#5bM{x1-z$+f z--cvXu-t!WYGLR+&$;n82j|fFw>!5zyA=)=sgRlL%(VY=%>T|_-UFRi3rguaxZpBt z?n`=h#1VdU^mrAu>7_-o#Rd%YqjU5|C!Svqjf_sSZ&-;w>3dBi$DE|0M6-zMk3Zuz z9SDzUbUfEB_iAR*TR0b%{2ap#&P!FV!wbay6sX01(n%9%1efQTO1NTRdokqae;2nk zo>%Y#ygE*b=jAsrGaYD#*GqstD@(o;?tgRM_GVcZlI#vuNrCUFo4x3^Ni>DzqTRu0 zjssAS-+ZSE+>#9#!_ABi7LncFUvFbJ48#>Qy89V9J)Is!{2FG~UJ=H-iBJ-nuCuw} z;FXY%#wmOmIQHFQ3~SdPStvPfj`Mm{!i4@37VuI+PfLi zNpX3<(;hJ@jIv{!SHFZ&W~vu()E}}G;#KIPLdhf6gs@^AGoIn=Fg$(;URJ|Z-h0hSi_BD$vbdg$--W) z6bzPl@n{1d{`WJ+yUEFkDZ?9|n=4X+Lsw_#xF>W{AAw

0O)m^7b~9@g6lD6%`fI z2YZ)PDTUW2PosijZD+QI`TJ+WZ>~hk;^4?f#EhSg)`y`@U%}`P)n*rd~_6Zwb!f|WJmOSoK~*d>WrPF$HHB2@Hc{}{QHlv*aQPA z4!tH9p2yx8*w`gvcn^h2G|FnV*_e1w8^WkX^}!nB2rN+@i1q8y_Wf*+Rvs%@A(A(~ zvP~3LrkY^4Gp_@FI6?dBsSm%do>T|sMgc*D6|^|6cu$S&)MDeR+H`Ogg0R!rNbwm# zXOAFvt}lKO_=B7O3@wZDn^m%9{k9PasF>Qh^2xw!i;OB;NI=x)tTH4oo&4kSK{mQwIX3yCE&yG<~I_ z!6N+3%MTd`#+Wd~8I;rrBylW(E`)fcU!*sTls`Sdc)p{V%$$r8V=Sr5np^g%RNHFc z`H+3W;#BS5R>s%7rv{=_<}q3F-X^K1x;yB_N3odc+&3r;@B!&nxO0jErN42YWjW6F z-#7fcu-`ns-MRfo^Tqu(Y~I5oB$T2Uwn|GIm2p2{m$|I@&~F0|uOg<;Q4U@7G@GNJ zCmyM_h)3dzzw$K9pq_>kEv0JI9eIP@ir-$nQc2f&Qm~+7qIAea@_`i1M|_2JxC#3` zgT?!p-yGTul~RvM%f=@Ka!8l+1~ zx@3kG9NA)Y_`Jo{|-Ugx|Y-f!<(?|d0uvnIL!_kCTz zx*#6&XCjENU*{B)n|^G4Sf~z89#;Er6PnY{ttH%Se}rQP=a@7ErE8m(NG}+zy6|Gs zt3zAqgonFz(43(zI48jKifxYkBPp~Y;jQM(H<;UNMH4+1QEk!!{H8v1={KXF#Kx z^qg?wy%lrYJd_7Y9((q5r(yxF{f0}($a+Lr-T;(>VI#}H1 zxwB#fHmy%NIaq9hNR?=CdWKByS=rMkJS# zKuv^Nqpzo96c>$|3RIuYj+c%>ja>ENE#nuZS4at;#Za!%i2&*w)eUH!m<8-J2y#CUY59m#wM6GkbmaZ}%dymgVV!vz6UF={m2S48} zXh&>t-RD>Yy&!v0;$s81O@-mWd_`I>_UFJ?pN^uaKD0Dv>oR34+~5#p!CaS`o1n72 zfom%(IS8!N4^5sIB)0hYX`(+?>UXtd>dF?t$OK>P&iYsi+x;zg3}@MYi<8L6$ec{& zD}e0$zwu7KGVuG|JF@lZoFu_6v5{mGnWVRZze70BIHM!^w* zoAE<~gQXSU1}2#SII&@8Q`JQ+Vd50)_U;ZjJ|?2O%K~n%wV+mO0jc#yt>qT-x&2W; zNI|>LsfUVh5kVdr9e|4SlA@uia0}i+VdDN@4fEFU>oY%4T*4hKlIHJVNnZzjo#Tq& zJdINQ>-tG4amf^=;0e%VOF3q`xL|Hx{I`@h9-oCvOW{xPtg~3Fq~;QtN;7pdZLGH~ zYa_p_UrTgO4Ul#0X0vitRMvSkn&1cKT7A}NzKby6~8ZAh)CjI9KwI3*?XM3l8HJCeG`_2g}`&w zh=6Y;pFN1{RF&rTUGQv}*hP5e9ps|TGyATjkVCyulvHU)RkuC!Su8z2B%b(zMjB|E zAw<2iUwEfdUI>5trwZl2D5m<81=oO+0Xa-eG6t=@wP zg+cS#Y!(#FAHDE1UV75^c1m`c8R)Ds7NaO05iuVkt?jzKYG!53;iXe`i4YK)CbGnK}O2r-}M_i-xXn(qdffc3!)aU+5vcUK+DC*2V3VpOvu@R6Q^D zqJ^7m6oin!3-MH$>?dfnYuql`H>TE=PtIELJww-iRD1Bn;QlksQ`i(vi32lE3NkGh#o!tcLm@*Ou*NzWk>d@4xPK zMcJa3FA|zx5GcQu=I5Z&bvVVKp=Z?}t#UM3jg|-z(0?nCo0u9qKi4IBV6p%D9Lg)* z1dZU3ZMd~VRX3_7+yB}1jgKfUTa3TUL|WB074d0_x%QkmmfF{EJmA#Un=&>0g{j%* zAl#nGRbpD~8!6>g9gi}Mq$`W=6S0mbaTa<*7Px)QW3)KN3*`%uvLtBruiOmL>%y(p z3ryL(a~vUDPu2nyHZjZ`OT)NZHBN*LgFcVzk8E3@EKs9Q25_TA8|3R+b(g6oS1n7Y z%-**tcnyHcADw$sZLQI&4C~Ky0y76;Kb6op$wv>$*LPo2(H)l8Mi+sOI2wPJ8_S#L zgBrB8Kk8ZJnu;uv#o7?qu|qPZrpV>`)DXQ&fc6T}jAP;*IrvQ#;Se%d(BFuzdjBK$ zLNiv=1pA^FlkQOddf)6edV)dV{}S zf`a8!g~hwVJ#{!ZMongGB29j`KIO1qLE^K2J$d!Uk%C|uT@C^TM}K~@i!a0SC2MB_ zvPF0MJG-3?34!W!E4G;OU}~K*715JS zqe71-LuiA&HZZncQXu5v>3Aa3C_>?}Wtc2%l#hfO+%uXdw>}i@+H?0^s=wvo)`%-j zbyj%w$Gp>+ax#2k%Hi&urzhxq7oz;>*O9jI`Obt1lmHCi9YTGl6u@y)pLAwHztxSM z>D#FByJLL#Mn_j$4V%n#Gjuf0(rDr@0hhInA;f;#2Kcw zzrvpUeh0>PtXYrOGa>yNO3bdmO8!pqNFXX zLf@8WpjD)>(%mkXBTb>75wmBDjTe#g;3Lz?z#uwz2M!vHX*#|H#R=0&2S_=r8A*ac zfHJ$+ihHWhB7oGwv#^i1u>E9p@#Q&Le^$6+xm^uF>$bn+jY!}`pdJWN#t}nLvW9pv z#?7RB1&6SsXKq!LGfuN|Kn`T3ZE%;n=(iJ# zFwmbrch^8?SMOznSpEXlDq6aEQZEmJ%fJXm>YYr8p`j-Qwebq@g?u*}iDJOP!6D{! zDJjuAP4zljmKx2KQN1>~c5uJS4hH}3{P3P(!Zs#0mX?7*B`vLX>L(gC)$@AuIaoT> z!11i-d2erT^uzre)Sn-1?+Iwd*kV6`4f|lJ!L_`;B^su&GhG?$b>ErDVY^tzo%o22 zHv9N=nN6d1qwPoTPjoQVd&4jLfx+6jX61UIHAA_H&rjU%uL+I!4|k2*e}w=f9gY5A zdNH&o>$SXzXyML&k!tBd!}e&7q}(c}M7k<)%ts$KKj>)_^eTu418y4B^`e4|xXw`D zaUay=2eBHn%;y8}c&w%EiQQ6zxo9s$C=Y z-H>zoP+x*6Lf;*O8Bkoht+}LBAEXvdAi6kOpC5??|0#z>$zx8i#cVXEh7S&4Cn_BEg}Ynqk~Bvsd^fI8D!<<`I%39)Dr_S@O+OMCbR+-{QZAY(%zk zM`}8V1#(hY=}YpX5@MBT5NCi!LikMK{>K!%ugAb_-}58o3^nqrX5ZnAr157KH{H7z zi;|K<_g}SEuNntgjp^awYcds!8p6Arp-_~&#@hQd`6aS)1h#xOX_L|V>Z&E<3w2fc z7{|3{N~1x4(5K+QhFHK#Vg`P*5~BDt(Ap0G=yJ!)ceHj&O3-A&IEL67_TGJ)V3XI> zUwVnM95xYAZmx{cjcgdvosbSjw944mQhzTK@x!r(np4L>7aLtG6QKyAqc2OGpB(Rqwv@A_eV4E;52#D68l~8J zY_+X|Fh*uPFhhR)`0=$RGc!$?oIW}_x=Wk!y*@p(S)%(Fk!>x@`vwsn9(6G>vCfIw zEBVPny3uMgrR$Y`)^$Hr3NTe9CE-J%7*iH1eLGID<)Lk8Z0E0^j+-|A>K}f5??@k0M$NW z)VF$dyvjXCM@uUi7_>84L_JYVIM@?z(0gb(1-0H@YzoH6i9^A64Z?2HBw)H#M8P6q zYH&SFfH10)95RcHIliPSIC+x zsc8C457`ZG0eyjB@$sMT8UloJACe!h>5G4yuG2?#!eXzsQ16co3MZh@8-Jg$$?)jI z8lQl539>8Chv+JL1 zGnKgKC6uN5%6!JXYI)0@FZqMu*^5lQS7nL^FIEnztS#X(aQ=Ia8X4!G#U={okTE&o zro5ozXp;b9HT^9;1yh`2TAu?&i>UV2@{hmn&JkDGd|I@~^k-PP7BLb>L^721FZ7E* zRpn?z@>{C92Muld?Zc)rbIDS=u4&Ci1Kh%3iZ&;O^LLu?yP_i&ty3#uPkRsuaYsWf(5KX|8 zU`Y_dx+%{?yX9tsq9R=%ACokIM^&9jJnJKkpFlyQIkR0WMIb@D(s(wzb@l{@BDmYA z6)hq??;u;xA_3f3@JMPS&{2Na|6=`YG=hE>al+6_)D0;h_BX*NPQh|0ETVz16AE9V zB%>kUArZ4BI=$;yeCaG`r*rmHkhYDfnzUi8Yx`V`egjXlMV;zt z1Hv?0G@VWwlYZzCn0UHJsvV&OC#ShNp~1`B(z-SRhr6@b5or?x_Iy)wc=&s*kv1P< zK6}Nc{XVbH+aLKi=^owf8eDUSo#2F1G)%Ev_H$ykTF#ZFBcY)5ebe`irfaQ+FvPoS476d@rY zU2+%bWu#1lsa%POsMtM#7j50mssv+at6~YD9aRm}0Srvq7#vq)H8W}j$Hf&@Mm3BB z)Q<5)f>kB}6X38hV7^-WT7&T584gb3u2wC_Gej!PD)-Z+(Vvcl_}mQ7kV2HBQAS6t zP@$!wq}oA}cEY;8;-t>*0E!+1h+9|^QT^YRYU`JSa7;{1Qy{fPJ;K3(fijmALNvN_ zOC=>S4-_Q>m%+6cRh^UnK*>Ljbzp6&XNzdWEMhf+KT~F^Bq>(;S$wy(@a9H3*PpoA zNcx&ZGc~~m=3B@STGYxLU7}WnoDZFRDm=eVL8>o8=bR*Fbk-X>`q`0QiU~1bBkr+% zUIg_G>tjoZw`rI<{ZMDvjwY{VU)gCsXM!GUn56|8%06^0C>*9LX_MeYGjzs2j;p^n zd4N;KT4gyL`*CVkof_vuKkNY+NFdroRM2bJ6mN+Q8@UgVcx*vDy3@l#qf<^qZMI6O zmY?hnTUH5;B85R@-j&gUQ_Sy>;|qCV82{Gz>T>FBuhQ1ul7r*Z_8JAxRRirEutYc~ zV(61+&o3Vo;|0SexsN+x@_flL4D>af<1;n#?w0R*5jkZ8208=wp*U3WW7Y_gk)^@eLjC$H{ti!3{IK|D{3h@G+v*_bo4997nE23@f;IvDB)&Tj`b;`b+ zu~!24)ae7f<$B}>`Xa2T&jJzbEEY&sfnW0!Gq>%@bGuRQ1vLl>5(mYu2INABoUYCi z{^becEIK^E+9%)g^X<8`kU51hQLZt=^pfOUfwFt0Cs!}q0iJ=bK&I6zpvqxL8^o{f z{z#x{HT;KeF)%wX20StQa+z4e=Z{yVtZ?mJn#oL4n@dwOZ4J4YCcvJ)RJU$9o*ysq z+Ab!~RKS^1t?to6;m1|%kgsJ0)MjET(}aZw`%FCCM=_n>clsvn&mnC6DZ++}P=6IY zQPCpn&-<Y5H zg8n;tLsbUGH!{dJ z%EuA~!3wyOnzbJBSLTr|2lZ-Qo>&!`k0JnMPGPtcj7h(FfJqwR_)!;TIabG~;pPS%e+`ss&iNA<$nGa_OL76Kl^NM=lh_aUDRgI4#WR`rL z(vAqbfJxeDfYJi{R?sk8{3!MzqWi9qe@^IJXa%21K>8`8-My+s*{znT9E^*4gDrQN zsg5VJMaj6_BKw6$nE`SLkH^1w>TUB5h-QO-o5XR$Iy2MLan^#M*OP5Q416NxV>2(( z)t3v)vO9}qKE{Nmrd~svL3H3&pCqwXbi5CZb(Je^KB_ml7^D%o_|H_bTf%%AQe9e= zx38;9(M=;o=UC_COXz4tD>eX1=v!d;o}VMeGO??f6n^f^%k=yq$+XyYzhRW4WbL(6 ztbY8ik!8UyW7cjxQ=)DP>{-fR8)pALG-U*W`7}r+^yB(eK+#U9g_)F8n})j?suVtf zy_21?{?}E@vlL;)QR;C>!@;ZFNMl)fhq6EL%f?%;US>A%Ok1m8{P%$C^|vGV7B?Gi z?mLOR$u6o`5at4=NixOwr}~{e)a1~E zzEWa&%e}1d!-|~wSeLTsua^jKV(ArPc+VHDmig2!vIUD{YLUc6X) zR9gb<&-nT8-^#})7YQW;Od%1%P=5^Im4X0)kQ|^w7c}v@e`~FMdsm9uBdcu&i1ou7 zPZf!I4(yN5m`IQc5B2wFYde=TnrIo=RTR^BsY%v6)VmB%j>5E*0(G zoL1a_2ad`pX<*#|A|Sm)C%ohRRQ1F3rmT0~r^69Gi-H;i zz!lT^X>mkuzY3lmb#$2#XT2EYR1(R9tykKw8V@8@?i>=PZ=Y6%tL8T{Waw>B$zf7! zSAGn%klTCKPUO5Z{v37RmbOXP&if`T*%V*z?DWrw6lLr}gKICaLDcS-)7u=_yeMd* zXcyF&>R;85_PM*kw;{YZoiWQGU}d#+KWw`EH8rfXVAET(f9CSkdjSyzJ1$Yr<0o70 zhf(){KLcmxW5)Nlw$Cnc${$Xyjx82G{~qgSZF-}kq5|y;Yi7;g95XJxL&2dap(xKh z%-_!wA=sQ-V^Gc2t~=PNyf~=#X{_))-MB6bqLF&iI zugCQz)U=Z#=h{YYf5%$N&rEr5f_AYp+>wiw^aC;8Zu3xH4Nu`#m>aA$!GxhVJ;o#X z2I*(An#KP<27&1bG1;O(nb zT-@KMVLQt4dBbU+iZ-^HNGUKN%P&=>85(n~4}*Qv@xb|#>jq!cOF|TeqMtvjnG(pz zE}Ob=R>7msQi!BoFZA{Wklth;Rh1>ucvs~+{E{Z&t-A}L*Io~9*hx{itx}k)Yj*qy z#@D+$N3o2A8&oVG5?Va~xa!H;39rm>uX-%o__3p!@9@rk_-eDVz_4gbJ z726k>&p7NfVIvQ8X;myaT~-DB1tN~Q+H8eWyHqQiPkx%w^lpfkVj zU`l=(Ad}!^w4b%VL^Jc{GrT|7K-7}iO(OuB)|ii}H3`EyIHHWoD=OHM+3a)PTF-)W zzJFi8sx(?zH7W!X0EiGdzf%;@Ef)TXp%o;&q-q?gKR-A1BSVAg>5}l+l(5uU&y{Js zLOn{O5)bNGp_MbfI(iOm@AX4O1vk8k@-yOuj|~qX@Z}>EqxN||cfWs8;6Vrg?R)~6t@d8VG z>bjofa6~>rlKV69POUGR6=yaEO(!hC;)@ocgwpF{^3>?+SVYX$0gUA+^SG*a!sTLX z-`!jezy@94z-FN-m|_~;wMOQ^F*X-z1cMi$KxLmJsCh{KdB;i*2`7MDL1f zCe{|7ih^(@)UkcUL*U4j++pS*YDb51S>;Q+~fQnXN=~Y0M}cTZ{00`R*sjrTYn)b@ARg7d|))sc)cGW zRaXuVXzJ?DOkQnb{89?}kE?TYf9Fk|{w95O@I(ya@E4iBT)L{$UX-f4kee8`?2wXr z5edB(c4Zr@KeQPvw<(WP9}62#PEOV$0S;rG)bo;no}S+M+QJ3MV1E1&XUxV%-p-K4 zmI=FBsdOy3G3v@(nX~`f&l`=5Lnvkbe2s4EIMnX(gUSZJ>*E|2W=!S2qXirW9E%># z4Fs3TkK2bVVR{mE`JKyqGIFxDUKU8_Lb8cNnFKa6$*KwP)c^5T|75i4biFN8v2Su3 zlP@8T`WhMeWaLlEiCY15rB!|iKP3Kt9REyT|2{6(9FC7~9!vQD@m3f{ z^uG^J1yKk6ud5dLu>W6rOEQeNUHyNpSm2+zy#vfq0cKUdMnq|V&Kc^)OZ+Gy_~(to z;7zw;e*$xSZ!8^gIq`p2*p^Pr9dlbtz7NrwoMwG(0jQ5|pT{b8v{;?h-pN=L^v_oS z?sNJVGE_CI?98BhLa}tqX4N!w3{qq@zORvIMWVHuhep3=B%YNVGVpMnN55k=I~V-d zbL(B=1(++m;V$Nm9p|R~#pTVflarIXq;PcwfZo&uFb{#EjDAp1;n6Eb0eu{F_wR4# zghwK;M7K|Fzn!FJhW0M6MT)hhECs{&6bLx{gIN)1s#yg)Rww?V>PKN3#%J zal2}`<-dM`9Lwi&ZnzNtxVV>mo);y@DWV=)DH2kYTzY@G(}8a|c$?lkde-sA-FJ+S zFD;7YU`P?bTcduMi!7wqAd5UB6z4?^O?6pH=`iPTTC^v=TSdp;`}=Kh#QB^$rDYTo z&UYW8HZwgH0WFJR<9T~Oz_O$2_=u2 zIr$o+kQlV5snnvM+ImMiNk2=lX|GY@*Cx@F;=g{+DU2Y8t*W|@ofyPE{cPJ4#RV8^ zuaW|?1_E8qwp84&mVC<{(6%z?<95!q)%ff*dLZRS-!rEmBs@JOZu*d(H~H5b)G6%8kLyYUlKuGcW7rf+#+NTh zGZ#y~F{!DRjh)=6sHi_5L6Up_z$))b_-`Mx3a*3p#lbk*PmkeKpcKv*5E)RIFm=mIQe7 z+;72vFm3reg&Bx}S_+m9O!Bz|V%+9FuFvVxn*cCk)!83nP2aP|#^#H#r(&;B3+OZKtFoYMCdpI-=-tz*@O0qY~hxY3l&%vxqB*98X!$tJSsu5YB;Cfs0=d<_T)sMl4W zg=GQ_k!YLWM=R;KjV>y{>^ zB_zIBI5w&QW_Xk73d7MdZ_ipqIofnWw?Qn@$^ICiWtkdEr=^gx+^u}Pvi}?TAc!6x z2cMJ7!E9sG1zh@;JC&MB;Z!EcEJP!qt+PqlMd$UrrhLu z7n9gT1rj<+gokHclKcAlVjf^Nkj)E4YwdG@XE4&xNIE-Mkh;0pEtp*(@f)d62rEE>yZ1!@!qg;nA5vyO%_iA5%PJ_I zSDsS`5GbrIvwMel_KP)LuS|vX;l4yd^>l*9aR9s~u`MNApHT;8GIw+49;ST) z#?i$%<9w0ru;^?#obaxumU;i+CRRUn8n-_CbFV0u=>i31M82%VhF)^>4Mj5cqh}}BcVp0 z%7J~F_~Aru_N2-RfT%xqA2V2|Ur=<9W_f!qP0Q`?)}3w?Wno@CJF1V4eh#$`T5<@T zRoAw*&wf>Le!1k^PhPi_4?7077%l-RJK+N$$K(F8<Eljk=isu2B9rn-z zI^ZRyD7?%B>XGB1!%r4B^}WtqjaXC^^x_b5@RX=D(lgLnVW*q>`7)T#x!DUs&4zoM zLHRLnM(X*=i2gA^<)|4-BP-^v^(etrjk`A7di$CxmM#sV`1OiMP@jX|2JFUfJItzk z(wJ=Y&g~BOb%;(CwT)It2Y?-m!szq`}$JY_fs%ZE}j+!e` zcH3@JAg-~$K`dR`tjtI{8;9}YcheWT4ms* zJtDY&W@3P9fnt%pxssr;Vz_2KfdPUs8DbdcKZ=5!(A}6X4iV%6bbygFe{ZR7*iFtJ zP2u)tmsP9VvFi46No}>Xlj@Vd#oG&~KfZc5)s5#HskAP}&!dvK98G@;G@z+Bo{ff{ zz-Mc_v`fT!k^Dj~7d_P>f((P1q})9Ms!M8Z7?yVMu%pV zUyaC?Mb)Qr!_PieviV;iz|=$m<9^O`p*&Y1GvfIk$;F*rka)^V?-nN}D)ESn{-`fC zIw4=>RPi1By%usMv22f>>Lwei5Rf9XQ@DQllR_XYlba^d`TK`#L+SP&l~qPzr6PF%sC!GDWnPPj;|4% zV}5t{z*%Mlu@+h{rg5fiH_ihbS<#$kLp@z0Jbl-vn?Tt`SK_^Vy$J;OG~>Fux|%QM z1oAfgDCDMgOy#jnz}}xLGEmp-J|`3M04tD$IsZ9{&v^}hM2Id#rz!CD$-52{Q4`X@ zc&a+P%HG8LemmbKz`}_%aRC;LlVVi)xMWF!<{v`*$jD8nD)7bFYdt1F4ecbwYUMGy z4KBpxGdS5HK!?<06S@ieH1c85W7j(QW=LSPQk8zS6s1_LEUtyynnSM|>nVjc)w2Zv zvNUcdEl<4paaQy8+Ofl<`V}6(LvhVT^5q~8P}U$IAUy8$fM9l;<77wx5cq5%9wsFb zY5p(}EfOU`Do}1Jc$>=epsT^&H8=?IKKhJ2XHev_KO1-%95jh%wzc%?qOukIF|jn7kQX(#TNW$%?I4;;@w9ms_Tbw7plDqAlV2lHab3( zCb7I+7-f=*Nb8Tf8Yi=NbW)acvGF4lO3n7?oAB1jbGD{Dc5!||kE%jNwoer(a;%G| zC)Mz#xI=ZqV?QvfTPXA+?X6V;rsW1TY9rjXI;j2P~(v6K7Mesi!J2bKBUp7}> zln7q;GlVGgMvqwEt`}=tk{%Y3C5|=gS$a%fet-zv3nj2@j+XkGxgW_V0N#DMZUY== z@~4EB0dX%lPu5zdF>8fOE*&Zr=k&lmKQ}#m&Go0mA*Una?-Nt8q{hIs31!(CAg_QU zRG&m3^p0#jVWauc``e|xB_`Usfn1ti?3NVVuZ(OVmbtTYau{tMlVRj*hXBdXw^fXK zKcTa3v+p&2ANs=-2>g`|#wO48INuptS}2Z{Gz9U~>LTY^|bb>1He%a6i0c0*nFikG!)t4H|!H>+UloF5gwZlqObceG;dCaA7fosx#o@p zYglKAcRT7w?h`78i|96={B;eDOkg1XBOZ4UnCi=BBv+x|?1b%t3rvu*cXWB7PA^q! zaB{QdNF0-{{%X-iaa4F(2|-8~SdC>Iu0JxF$RUz+mlyFQi;6qW%FOh)I=y&v$zp$& zo5DB2k};_%H$6OcQ_mmdG@OC7T~Uf{WeB#=oHDWl6KawAuXR}YRLUgRLLQ)GAvK?!i$fQBIkkgz9>e9{mmPmt!OEg&;Vep6h&p*GiLn@FvjT^-6qnbNNFm>b z6YSHWvK0@t>idNNgIHy8PC_hj@zj3wUY{07dLTm=AuD6K+?wgP`k=Y+NbO&rnCw(e zafC^>uQjI&xH52;^-};=+_+(3xQ^*S8ZD$)?a}Xxp?KPoUf`pr2&x|@>|39G49W!v za2kR=c>+RuRN}&O;z-N8+3*oeBb|PNeVOPy)S+S-_phK8pb}9wHy$r+=!d4R8^B#v&^x-J@kLRwBtCg}D~ zF;m#O(RAT=Hczo8ZpEMmzsp|XZ2JrTcz`;#TNYl~T)3R41~_3(JQGu6X;Za?qR zitZ|%n&U87FIw+ke_7p7yA9Ca69=lfK`}wQfd~T?$^E$&eV2oIL*R0&7_cmFDw}i@4K+_F1(b4f4&52We+VB9r89nOHy6{xNkzVl>Bz_rk5h>!u z0o@JE)2R$gH$^SAW|Dcs$et@J%_>&OKvg}!C;&Cmk)^~bq5{~IxQfp!0fCIrD!{J4 z=$bYVC(tawB5E5L+HrNaa=YVWey@_-SiPKCTFW%^X#IU z=7;Z$-zl`|NYFd8`F7Z4ZX1@_1CF=%n79N`_MusryL14w?8H^Ro=l;JJg!=hweRG{ z61xDpDGYGi{B#dwa)~~(l~a+1cbBh?0j0EBWN>ID(@^tRa!gjOiA==-&_t{4lGP0y zX-)p3S(grYkSv6WIKe*2KQVw4?#m=Z%rA6+9bGPHRL+{(g6m#YjnqI@H53=WAOI2`zlMbsgW{G+Oa>Qfw<1RTE6{ZnM)Cia5q7Dg{ z1prNbR#em!;{%T87d~52$0=>+Q%hMFZ85=}+*xAsVq*TsDb9~k0lQJF4%D%BVc7V= z7E|1;l#wo_mX+iT3=Gi5H?NZXPU`ag{VjU1)S!gfW1A}<7mo!990%Nb`D?_br3;T! zo<@j|6)6qCQJl}(gmJ5JAT;3Id*+cFZEoBP-IFG?bPSwI?*~Nk#fV!ZbHCLUfA`Q~rZk%YLN&Tr_!xwQML?AVe$1Fp+F|o& zgX|OUoo~}7PM-vvKM!MvEOOgTUL1F!1fi2Zr)XU`^T@!( zuqj9J;r*hiC^C4`Tx9oa<8`;@zJ1Vs`@QY&N%o^%qU0+$F+N8HN;mRlq=ucmBF!fB z8xL2bF4!a!)t8^amGxUKp9aQU4G_x4449vbFKWv&L+9rQ)YBc&KE>s~F4xbxOKlKR z0k)LyvrT0#&41GP64FX1XUr6xDpw_PD*m~iAq1SvEj5qth`5LRnC?O-3 zRh1_#R%O=Z_0>f?bnN74m_B^?Rs9Wc0xLo=+ueZqFsY=rP4&9}_rfd*mxshY!JN2Z z@NRF+bNpIh6(N(T8!ssHbR@4ve^1E?6eweLqu0s@xb(|cWlUQl$Oes1&ZXStzw$AbaXxDp&aQgcd+;MF567j zHa`}v+_&0L!y@0jAS5(vG)_0^X-}}2KnNX7FkqH8!k~(br5_Y&<@4rOv}xI&1cLYA zU3yivneLxA=YLkmq+5HcQAyED6?Y3{rDUflnRJxAenv2mNELu8x76$n_H2O<2~^oF zBjAVe*{^&#jwZzMSDN%U!fJ01OZ+B&t<&GCxOY7LL7Z=L2%nXe)%uwG-{_)x7Xv%a zpngi3fl9`>*eJDj!pYgw%Am77CVO`Dk4YF8t{j4jo>_J25QBRm(o_=8eZX&S?(fyZ+HDdo^eOYFU(cEao1OrKC=JjA9zi_R~5t zrKyZ5PPeiFM&c@r95)K z)$zFT3r|XqNaSQ9zmH_V4dW~d0Od+E>zmDxCg!z+@_*Bz1vz1zgAKzo&YQrv=1MyG z#>8`o%Is*%q!9N4myyfMky*Ia+GQmai!c((SP(WBc(-&4PI`;w6btC&`!|fXyUdcb ze=y3_E)kUKMz&ae61bf|QZB?O&*~eUnk!Yu6vfYn1P{vCi$5BU)njo+V`mlDHwaA6*__US+s~a z!r|Q z$5oTR-B91rsl%NAD#!}vQgSU(7>~S)qvw5&Pt4&Kl`{VlFY{yjn4XZQbnwOgBX(f? zaDO*@NZ!F0B4f7X<@l|h(n$LKqJ6_{mDkS+cIu>e_>sx%-u1@>jv8iQS(xv&$@WxT zPw-Mt^VERr!gx8UUmgpp1MG(gG@ zprU7bmJtk4HV@#-)e`{7h3xrgTYu%g+3LWVF!Fi0b6qW!tVnm<@G3fZuvr!Z{x>={ zy7tp7lR@x4zhdyT`TBj(5{JAH<^I*mv*F?kNzZts%LhRD3|%-DY_bLh@ae8xy6%H(4t-szK|!xS}p$t4W@w<_x|Cq$+w*)ye|dK-XMCK%6F?2}rb z+zDI4KTv$CZqx66X~QVY+RD8>;c+|*`11=uc{{%|3cH|(!OTffzg$;D%{i%|75h(g zO~Er0jQJmh3XwuB8Yk%re$T0vcYV8GLzGh_fIZ6)a9_||-3&mgBK21M1 zj3?{g?Ok%7yxT;WeKV8~*CR-BL-8Kv=8Wvglp2#Q)$lBBs23Tj#Y3P*ivUZgslj$i z64Y(Vyz_Qhk(_>yeqgNFpFNe^wbN%x;#;}i%v2@UK?-Fd%%}aTFhdIan^(>`5sk-t z-qCti_-hoE#fCSg+@B}Gj}Qlz*Fr1!`@p4 z#ntZHz9Bfl5(0tXNr2Ee1a}A!+`4hsU?I3e@SwrnwP~brmk@%xTX1)GyOXu{-tW8C zK62|+-MU{6pGc9Siz&~X&-jn=8$e!CcmAec^>#-SGhhhy`ILrvBYp`iQ_C{84373T z<0-NT)k0WNHsCxzLCgy7k`OiTDrUGH6MEUVZHCoMc7HuFV-ow3nR&y@*JrH$0eI3u zFGoL+z`}yofZe zmSlDjsKVmM&Af?fMO)^@&wKHojojgP4 zf8&?VzwKhSQ&jMa`oxJ^6KgVqpXD;oDWL|)WN^%bKslpIn&;*>=JhQT;MFt3$~#Xd zp$JU#U2V%2MOqYuyxg0?-eIJZG6Xc&B2wb4YLK~tMb8#mzxM^y_!hms<$ z7>y#VwyKM>j?E8MjJq}18&3w1{eB4mJOLgj`zgT`(His4!Yt;lO(3YbdQu!@9x+})Z`16(?!Lh|{3ow=B3)SvU zj-L&Z9*DWB9-{t*&uHH)m+~EVwLQj>lsLK6e0+SsrOQV)Kf1jh?q~q-GwXhtgz-wc z7wkqywzlQ3!^d@1s$CT0CakNtTuz6b&~Il zt>(wQshV^nd;*qg19OyzMHJ9(0c)GO)uTh0qJ(%BGFUtrjb zAMOK0wDFUXI9O;U0p~=H%}U1$a8vz}O3Jh6pqGF>w-azs6jmebeLuu~s`zYuu*RkF z$obF1n6kXop91BPQpLC9d4R&K*ttLFln3LeLB6p=i3eXo(PX{_1LpZ%q&si_0~q5B_#*BbJ3d2Lr8&h~275&;l% z+tSiV*QEwp!lM?d<93EG`RP4u%Kyn2VCe_dgcDMR5O^?=k)@e8ag{ie@BOJ8z3f_+ znlVMv77uR}HSszQa+Tkl4Sq7%qIq9+El`%n2LwlF3yc0qO+m)z;p{Ym_B36uzUJgS zQM|)BT^p9DUd_294b&5)2A68d6mH3lU;B9Lhs)z51McA_6`M%Z>WRIui^;r_)Ooi7E`zevW=cyZ^#GPB@;g8+1mAUZ8U#e&2C z>>=Zf$tDf!%d(Z~no6zQ4%@?(0{_|c;Al&SBp?pN6fXB?lfqy@61Yj*1yy%|>!=W; zGS=gZHUsFsU?1`%RSry%Nk`0cD|mnCyWO`vgh0aeIl}#NxU<|~4K#hYA%5jCNB)m| z|64|E2?+_C>K8w0djpjgS9fy+ivDs)0So(0#*D-rjM1EMJv&=6(1; zbV{T9aN*M@jLRID-v;{!g^OOrlYF3v>_Usk|-%ud@020 zKPfVWq)*|;DD&tgE(bbjGYI^=Wm=SqVNEzT#MMr%14f1V6xuGjRsBq1byAZJE&>N3aV3 zG39#PoOejP0xS)2?IEvvGlYHD2E&q#Zo*TKfgwdmLqh{bkIc=bA*40OqUKBaZM?2g zx4d9-v0YaLr8yt^dHaWyM<)dJ6Wj{?;}+>xJUtPTKs3SZ~w^f>Aen0E-wyXPHe&#;JA zMFTP0g3c$@KU0~Pu<$Dr1Uv%hwX3zP5NDomp!_1R+Za%UoA%EvOu!DYXRtTW(n8X8 zz1ZYme;D!{WY7j#Ox~LSRjX)7l$ImKnob4k6?sQ0zOi&FP{Yfgh&V7qe}@%keUhPn z(1GQ5T6`UVtQ};~MS_>Z+uM6vZ82eyBc<12X9Du0jTf63;XN8^VyMh!pq_BmU}H_PbnDpqNK51ryMq3D zGr1ge2pyJ|q=I_4(yDND@f94aUv$RbO9$Dp6FfbU+{!$&c!aJ&u0EbYz~^EQFQbJr zM)FHMNO8vVMbLUqE09R9WuXDS8*d1axx~r8@Z`guE=-KbXX#qzfPxGbmUXP?m2Xfb zfkZ1thuTgu<%bU@-RO^LRPLLkOjm{(q&v&gJzU(G*B0+f^jx*hw(}CePbbS7r{V8Q z!-JUi0iEZ}MX`?kK8)IAJWTNpf5%II%}m{p^(weP)U@3AzU1B27bER%&x%BzG%%%>bn=jd*55A^ zej<)rnPL{x-pHBuIE=noD-kP$Dd8nHFsD~*1q`I|({*=Gm?*V70l>&UDP;^a z28NLQIq)2h!|%Cl=tEfQ`=%LfsoQTGvTkpmUh(qis))IU{Aj3H z{XAI#_-!jrPO5sZX5^7+1Z+>{Z-|SE!F1T?# zRw>@9HFqBaUYCxQ$PI^f=DAwje2YLrsaI2h0m|qkDv7G7amg~~l91@oJ5cMj)3~!b zrufW*jG8_d>bM6pF~cu89wZg!WJZ**EyUm_h|Z;6dA>Cd)aaH9ykS`^cn2Wlxt#7jike?* z`3tKQL?^*kyf04idgZ%&3+3Z^Dwtt9OHFC8Pu*nelfw=Rt6IdT5Fn) zDLL*=={HIkEzEns>ZNBLt=fADWe_Swqp4-b9k&&LJ}eZ?+3;$Y%Sef_^X#O-`UNk} zdAlVrAT(&`dNq9%7c-kR6`*7}$1_adZ#WRZZx%+A2xRUqnQH(O=C3&f1X-P#GZFUs zlnMQJ=rGT7E6ZIQB0k5mS?r)v{IValGvH6#YBvu0Une?*| zN$>Z`%y$JD1i#LgPzV&E2{Kt13+7+1!Ot)%8(?`&_ur+Ww>Zba;{vh`98=8?Rv*CC zqG!6JJ$08s-4toNBpFXZ&?IH`!}_T>ClsW_v(6z@2{EmoABnF0D4$W)H>*m3HpGlQv;61%3j4j=A7*s4>xu;Xr});mIU=|{WK$cRRU99=HXwWM zx`27LUm!SUL*;kD1p!gatz3bn`*XO8-6jx&Au4-tH+VzjDLf{>V{+dIP65#9>&hZlU!@&3r zxV&vK_|_Wk1dgZUw62^DeHvRR)$cFj3oUuqDCOj^U#QF}!<>1gRlcMdeU>))(p;Ys zYpPa$f=kUz-$K?GBN0#4OBxbow4GjH`;JzbV4t7%#4$bMiTo_$gKQ%9L}!Ly6wFy` z;E?J;S^H@bV^x^%37ws;M-iq0r$3Qlp-Y^{PZ2SFa#_^RYT4EOy|=tFNQ4{$TJk#E zin6S>7-M~KN`M2Szd)wE^vnV@f&zF1Ae$>g)AT{#2UR)^9GuO|GO#EXzwO;^sMW(L z>^T_Z&(jB@aJ^Iu5ePAdT0;S2mw^TPIWS40TVPo^vl7O~L$aXP#|_fSMMI3gr6!{% zcxT4B^ZhlZ-!}}Cx~g10INZ+G{yhn%v8)0*#85^bK)$ihrbFQ-I^xMK*P4o-p6TOx zaLnmqr!l#c>!0iU72!^m5tyKlg;Ng5yG@;Va`+$+u2tO|wm55=8Z zS=r!ohv$`IC1^VzLF)sy1vT*?#IrtzWv4$~#<3@0w=sbg)lB%hAs&E-N72&V|3A^i z9Y#R$-x~ zGP;o9X2D&>|LlyorxziIikMC7ibNoLsGZVWwBzHrsRfT;$HFZ|I`FRBZK1pBN=^ua0hq11tBbnU_=U}{5PsZKQQ2r(HTs7T#qd%J5 z>sGP6G8}J_ro`*fSXxipcj_Hp*!0NX2r2trgiV^C$d*?)QW7_`)ryG^$mF!N-QB=e zi!_FCTzYsLXqvKPx0CSnJmSRQ*$AnsZbLY9QuVop=wYCoIVbe>0k)2V$a8-Ly`>VP zLbl1cj)|RFX&lup$ag8MYtN^GfSxszQW~)_U-5XNzlKN3SQSRs9WFI>!b(!d_dnv{*fC_*eV6kgUIAUhFNX*6QZVr>h8us}yS%R9pP1EyGySlfg*gvk`d%gy}h~W?_e@ z6fwR>bpJb)vdn9(LKOyfM^w1+R(gLjWV1kip?P`B%u^?`2^E_pr(?kVYVDQn;G9z- zOzip|OmOG^t2Qf;%>Ac1vHk9lj_3Ur4ZeMM59{q03H(e-&bgfGhk3XCIABKAtzYa> z99G8)8F^&3vbxvu1g3dz(*hLAjYpi0%IsX+-&n8OEfM z-x3_q)kR@kYe6j=F6{Ff|GZU@HL#(q9J_Xd9-ED%I14AqE~c9g&Q0;ul*E>Kz4^4s8Zd$f5=Rut`_n(-}&cltHez_zEp z%Z0pXEQO4YK6k0MQ%TvL8GwzRjRC95h`>(YSgcZHN6BQ6?yvH!EZ%rK#=oecDWYagB%ik{Xu9es*fZ`0xI1MbAIU^guD+hj|M@86F==UWF^v zPJ`tGQwZ{kh4!={ZM{!s+iA z@qw+_s!4AS0ik=OM&8;XdA_bO;xz|gvjHQe_6Z}R!dAF|e8~8c1Ugt(S9j$t<`BB4 z-Y#L)9K7W`DYS6~`%KFX2}OlTMTsER`7yULQ(Y(ARBik<@7?9kweUzMf@jwmrw8Be z?=W}|_<@8JP-8^vs59@``Kds=q5A0c-&d#UXNW{!thea&5yX6R-r|i=al(ackB_Ms zcvU&bBx7oUSd@oL9d~z=mDXy>1fvo>*mtaO`+at0FOJh!c9q`YG>f7HUtuCpj-gh- zhqG#K+@DF+Rs3Um{!nMpD)gcQbI7nq@t(zHiPg?g=nK@lw@@2KepO@{_bNk|O#LTP z>`bQYXvPa$QK;qnllu}>SV-Eqjir9G;?>8>YzYFxb+Fe@j$8BW{445I#EJFjUDBCF zg|^|F_UyjW^V@{h0&$F{qqaa(8jL5OUX<Z^irYhT+V15k^Ebk#pL-+2H0w=_W?FxjTZIv*q;c}9YVNk6)fuZpKB9CCbk zat3%LtXJ4?7LN#D89W0O)S636o|;qVDR3LjoD#8q`Lhxg8Ob=B=Rxm_f*lcrM+5D4 zEIukllUIWQ$^;UU8vK(jB@zT)(sAcU&I2Y45TZcBof1ZaxttJy`~W~L35MW1baeEQ zddQ9e!rRcM;li~k4cro&$`>-WzrE-=^cq8JYR*=|(ZeQ-HS={Y0*Jpb&zob%#x~#D zhW~My)P}kC#@aw*=}+R6-?)wtk9T3H}<3Hxfa1?=3-8(7{Vim(Hd zF;&v;5xoF>q)N~zFxFqYXE6+&+;uwexael6`J=S!i~IN4aQPr{Q=xQ3ygsu55W9J2 zvMwd(ojHT`lw*tArJS2uv6@U;MVRze=hH29_@xt@XmUNeiZ8RAJ}&CcuqP~-d*)aQ zUXJy$3PlTNmI#B@{;c~CeQU4(dMKFiF4UMy}IaU@$9SG8hQ z@q>*?!1`A<*1@jf#zW%ys$3dH{Mh;wBoe(u-p|*Cp{SWiebulg{2oi$kFehfe)9He zlOuPuAg(c%scdF0KgX+XuIM9$;ydZr(5ykv(7W5SA(z5g)rm>YDxfIyyaOLAgQaTe zQ@uH7UwDXK#Fz6HbXb#Rko;gYV6z=R4}02=s=P4sOEndhuF|8`;vl@Yk_U>ugbQ|Q zwfs#e5qF6K0@7@w|1mTz*+FzBM72yB5S7Cjp7KP8!4YvO-ByuW=5lGSc5 z^HvQ)tp4;)*8)BQ`W}N1@-ecImW+zViq%U=P5C`s_PHx2FfcHbh*w1gekCh#dHB|B zB&XofqQZAOBnsLzpv{ii<^;6;sF;}dasx9vT7EWUggE2XR=n()d&6%f-qFxV+}~Ii zVr)~CB0|4M7gXW=;;QvJm~Yy?7oRaGFzl2&zIvtG)9A7=qm|cuBA3{yvP779SJvd3 zAXa1j;K@!_@V`S;>m4uk_$Z9eD(7p=IgRFug~WB3e&@-rx8HiR;PKE@O&^sUfE_Cu zh~1+s&rcfyP1Sno#jf#}ZxDbTmlwCu%kdnALeXz>xK-{01MZ z86e4ZJrERULN4}sHW9SqrV*L`rCa%bIgjBHG6#bc*X<4jeOAg=gg z6O<}HBE9EQKZQ~s(R!b=t_(~24dYT2mO@cyRU-#l#SrOK0`jHo4Z^3J^%^_tyFTFe zLAO?v2;&NhIEF+&dY}%j_4VrPunZ=8z zVh{|En)Kw&4j0sUc8JHeI)BrK?oi@@b)@8LEVGngk9{;0?v>|W#jl9vQ^o;BzX@CM z5tc{$6{c&ak@}XWaRP7vRi3otet|(-XSgp0zEParoHFj+YGtNszS30x@fL+|=>l^` zOAv(zsAOHJX-m5KL`Qt^9P@aVAURXSzM4$*4I?At^1%iT(4r{`h-F6;!NZe5Fs5M^ zmJZG0km3E#-}RJ~ndW^VRH40_(-rwZYA62qarza}`6I*&Oi3{0i?rTyA78A z)Y$?HcZ2ejg1{wih>0uM76@tt@5f^ z?}tFhNkPx`E#*G`);~))<^n31`m0+%)}vvK7b{D^RGE?@iCd!D`}eFdpxT?QrWIJS7q9D&WKYY&Hgs1UO`h0%;twd{uUffnp)6 ztKHGS^VcKY#tUf6TkXzIi*i{Qm>gKbb@)OyG0+|bUIzr*+@^o5BOJHIKXB2my}kGd z&8uLr<_z*|2g6m~;srhK=cxDdUPfDzl09AVw0AIR(w33JF9GQl^9N#r+zlzwREu`# zU_G%GyjXcgr!!csR6OqBFA(!(%IZOa{g&FKvPjj9%+|O#=QNs_HioO)!Dw|$&beH7 zpDKQ)#Z~R6Qqqk8Dlp9#t$x`Fu{>CC=jO&+3P))>-NJFdU2k-OuLBbv8>KR{B=F*1 ziN_eyW3R2iXcDwmh)vUfGX6O0_6ooHjYrBmk-o#{<=|^onm)1r(1b- z5}z&?$P{(BG17x;5?l1VG06q8)DnOo^@6zj6N5d%8X$s)T%zOZ(x{CeZSNWc89m!7 zCDlnYW~%Ym!!~KV+}g-J27nR;=O5;1wDw1;3e64qP{`lJ)Kp0SeeDv{*3CYzt67?_7Mp8zg?K!6O;_W-V9?C0wX`k1pM?m5G@5$oh z<`Q*;KA?gk`ZcP{10025JX=V+m#+D4B;DmTc!W$LUt-c9~0KR-shWEE0RX{HX&f%hs zGapLm;*|O}*>3FT=3%YxvptYRl(rx^K9oi=qxA)oP?Mg8A{m02Mzu#g<{7VCKpFO{aeXvg`L+s?r_atT-|X0_9L zKYIw4W9wDGPl$|CbrFVqtaq6EJNlp37d?}cw()T5;^K)T;Pu%dd{L{FW0`N~%B9lL zlFsz!2b6QZ64K5eD3jn8^^R7fihkqA_>#FXu5c<~?OKWrE_X@=w7%n6>z0Bc$%ga2uo{g( zme+UJ7pl=+CPqe|bkg*nkaeW#Y4!jA4fke7LH#$lx3B*3JaBJGnVZAvwa5rX18hD+ z`C<|i%~Zzo-rSH75Kzy#okrMOc~z84-Mf{tE|5>m^b%x^HO=ed^mS4+%zyu^~7q-BGDDY>-$3a#b1#Z5^M&^SaU9$Cy|Y z3}(NW$eidUL7JRSH02Y-f88GzDQa4=dMC`jx)~C-TK5G31pU|^+W=AEe>AL^^lDl+ zG3@WJw^V*=KG$&g?4H@Ykz=r;a-nPz>>Mej`NmZ3%ci+X|S zTA1Iucj95S5Z)3AToa=GS$ZK&H<_ZxEr8|axaDFYey!zJ<1)qTe(ue)SDrLXjh9hC zd3BlE8D1s%%+~<&j3bVxHiEmM;CNU_9A*i#E$ZRH# z7`Tuc3*g^oi~4j)o3ewi9#c+g}Ahh92!G^m<^mQ5G9{8VN` zt!glP{@A3#r<*@^m`bwC(^NeqlNZB5tqHIq4j~8)xC=p3nE0pAYfM}O8mmz&NUku& zN?AC>cwtoEwxL=cjX5K=RB&qDv>v5P_s3ZDy72l!^p4M+cBKbK?5hUVXv`G>go!Eu z7s*;}g@5+?+q5A|2z|BbSGw9=c#u&#>$Hm%4N5hPf~L-Px@Q8Kwoaw5GfbbM&{CELOmf_% z3bj{#nbSbQB&3+Fv5u!zrtS^G3n-1*2S_*Nz|VEg5>BD?Kb>jDr>-izgx zHD8?hc&~>miG4zDC4Xi6hr1dG|NMtcmT%33&FjkNo`Ys=S;w4-vzf1_=VFz9)Pui0{ypzRULpq z8%LSQP#OT*;tRvGvG?lq+guaRk0d~2A1tRze{qQ2SpB)o$8guf3@?_nc#Z|ph~F4-9#vdL?%>T5q9KdvDs zwfcv~q)#FbYUmG;H;vv>1+EM5qEehqJ48@9?eilx&44JeKk^sP~)lx(o=?R(ZAp#Nq^}PXJ zF7>;2U7FT%k$@Kfx|5lixxBW=pq{Ayg46?yjIRU8itOrUe=*IAWcQ!t7PA3WK;rW* z`Ju!Ywa%^tSWm|;-~bO~*}7;xDkkAQja*6uFsDC>=5Xht z_5cVe;7>WGgK5Xx7I5itSO7va&*+g%^$bAj5lM4)Pr)$SycsIC;B+|z+QX2E|2S=r z(E=nuiPg+Nat?vsC$XQ?T&`)W7=DBi(-?MyLcCfwWzv6GrLeBa9-Xq{s2dPY2jkO$ zH4SueJD|$>;as1+=(hHJc1BJ6J`^5irK3J#N_OX)q^rNo!K}RaZS0()x%SR**IVm# z$R2`EcP8Oq8%om$1x_lRU0izI4w`6y!m({f={&3anrE9kWXxYP02WZMKV@vx05Otj zo_sR($%dC^t(Ws%eCH3<9TdMb9nUSXpx|I7h{>r33x7Jb#U3X>raE)JbLX^Tx+~*a zpq5X31E4EZe^fc8pRM@c6{@y0&tTv2iEgg7$LmDtw|!Ccrh|654NUyAD&U{G4FS@I z;u;5kgU~;LVMVI^>}P;n04aObnlye9*cB8*GQJ?HfErDsroue#f7#IG!@CWYWWq&p zH5)g(I%E z>^V&izMh9R`fkJZ_RfS4YH$FBMDPz}(sDW8YNq)t6)zihxDDr2bNhqpi{;g#ceC+D zK87Z~Q_@wgIms_GJiX%DO~u-pI}^Kx~gI#o!T!%_Ne2ad5}Ho|L@}Dy4?d*+XaW*pZE01P&@{ z_cf|0VHe;aFUR`@QeJRT6}SfMzLAf+W?0WBaq)UgQr8NMl-fFVIIeNX77wq(c9960 znyG<-&mU()>nqy<5|{nDjSysP*Yj;E09K-!iNhywJ4A_&h87X8c#K&YQ%|-`~I6F9r0h9Whw!j|>_;T1J zTp2US-k2oG06xWppo;}xjbCB@X5j{u;=2-5jZkE9?}I$j;^kGbH&bR9sPU+FS_LRS znPvGrq*q}`Y;#%q!E)@A#etL2FTWsv@01aW-;d;!x}6fmZ5|y#LBYY@6j4Zy^|}Y$ zpuj~6MqwuCg$~}$2j@dvhg)Fm`q{mba`n+Rw_R)Kacy`|YnU@*%^!hyzHjHS=Nv}j zlFyT;7#V4vx-pP8uHzI@ZFK@p-UdD==Hd<^w@Oug;jt_7Rqq1J7D&cU)XK^1<>!Tk zxTbA4$!znIa!y8NM~mK94^%LRpNV5y5XI3MpPy);gs0SAE~Y{e?%Y{%uzSAYcLmX6RpMRnyaFt3D4SrB#6(joZ=5YydcmE(dihhzQ!ja3<()EK76hex{24Nm{H0=(a=+or^j5u)xJ`r4g9{j zEIOWvZrwzZZF(5qTuVUzxdO79X#4$tdePq06$GYomX-=VoB^-DhFUm)t=>78r2qyX8V zE?n0S5BLipAS9(Umvi;$$}J`{peX8SqHy*9o0s3e= zD%w^|DLC z*P>@76&8%h#;uxD$ofC!mfLd!y$+k2KEY4+7*khEunXbDk=Q&P!m$UJ` zup;}hxmH^c2mQ#2vn03Hug}t@IX`gh*nxFk7$(vbzVU1|pFh?2otGGCLk^s`}m5 ze!lXz!?pe24i_FZTo%9csp^&I0WEi|IW)#s0b7JKKp{LE*rQ54h$Ad-88j`+Dv5`G zq|WIb_QRCy>xl(oi`@fE5te(Va-Pk6^L4?G^?pagfBhx)>?<$-#xw_hU_Txr*`w%9 z0^Qm(L0i$Y`9NPXv%I$b4zO_qBirIOa=%WeB+hzaq;1sru{|HKayMu8gu6C>78FaV z+<6RZG>@uxn7)YQ2Ttv)z@wXS`Fh(Fx&GKZa&Z`PJQI7G#D9FcJ?(#MXF2O&;HBc8 zPJ6MtK`HTq&B$t%8$ye!PXg{iKedk~Hopl@Z>TsT5|hgXSe>=t?p~${Evs(YAp!_d zrvfDnub^)Ep|a*-h3;D>bw}&cqiN$n>#uK@D*ze|dO3&>lJ%mzYLd;pSaWt#jA!gD z;&BWrpsxdZiS&b!KbK5!FYooS(Z&;pWQPA!{&PS?68pmLrzoJ(G~#hSQRm2bV>Vbu z4Kx)$c9gQ(o~-?2kCoSOlvXbMeYrq)d6&m)@95Go;^q}Ydbljh}p%X{9>{~;6{X>6%1kiWSjcKI(m?eO?=7Nm#v z(*o@k%|hhuW{p!JQ9S|vb94!Iey6D=bVBGaZu1krF>2gjmRcgSp(b$ zYhzc(kg%UZhi;zVV}XHxmxNb)Z)SzMKP5g_WYk;1J^4tYo5x7b z6-_l96mSv74irR97S$*Fso1d0yP8ohvI5)RRkJ{}PRpa_m%x#yK}xRg6L?d@$W=0< zjkEfM5iqXBJ46Po2)`Pb`3~OVH-9E2ZP(-~o$~`PuGnRv_p&0=FiA zETDL7JM119;Fxza)~L2Dn0a;ENRq|eM&8pM#D?@WD?QRDXIv?wS(-$Pq`j42@y109W1x}7MS={sJM@Eq_rIJ*=rR3_ z1z`qxaulupxb5mN_Vlrgsr;7qpgIbtZDh@LeNP0n7-f4ZefQ>;X|SUe3K+pz-h9m8clSE8ha9cn^ke^89p6&;VZw)j7|zzAe~+kxr-k+Q+dgBP1g6QoCG7yK8@q=dXZ{&*+xUMuarSDUBh^r8?jeR%**6%WLJDbCTTmpw_D#&qGx(V~Y_RxUl z7KXRBLxxetF^m-2+-)4_1s1c)92Xe+0ZeEeW{`aUb504=Dq#26HC#aiN>HBbglJ5j zKetw;v9ZO)|20gebUFH5u*$*gm9c{}OatD8ds=I%Smc-9AEn>#zPeZe>M`p!J(L|QD6`ll+RsQU7as;vU;Z%%B&{MWC8@ryXdtmTc3nE(+sBpAbkh?uS4d=?`3xB$`BkN3$+A8fqbNQU-2+zG z+ai%C=^B35iVjXpYUUPx4Y7-Ds5()+VOmaF+T48qSOd2`UMPJ*HrL+S+3Ac^{IG%p z88%w&ihN9rKPJanJ#Xni8HjEd`>~REG(BnjZewQ__#o6r0tNX06)snemCZ^uykY9^ zq|hoLNeTOe0U+plhW+U5ma$+YK=Ecb!vb0K*^GQvaP8N0t@V7V`J>4(`BdLzIF~cA zKoRqr8h&azrYJKF&A`_ccBF0*YD}gSfbS2vdDAWV(VpRFyq<4Mcw~eVPVYVNOxE1% ze2D+AyMNQ%7vU;A9Q)YBS`a^>jB1KWmj{*idvbJiEjMpaVRW_zvx~=R9cK3c9j-Me zjT!kajdxm!t+btLBJUshxNz8;Xtx_FENhxG9%vk%C*y4G#0cf#;e3Z3>`k|z0rybPw~l#RQ#wJ18>fb7 zD!Pl~d+NxUQ6Lnx*4K~?h6&j-}i7xwbIp1)9?T#jAjDAHx>jb~E+(G=JI`*+uRznApJ zfcCq0?|wTM-kDDn(WZNx*YzcEOT$!(%^Sy`;HRv6@yg#drhx6!nPPgYnt)^7gP1N! zKb1%iG%>I$?63hNjw<48qK?`)hMDL$(l{xq(Z{%u-^kC_Ry!Zm==D|>Nk2D&Q+z|> zF%DPLuX>!N*8m+r6)~Enwl>Ef@ke*emdnb~wKppb1yKI@X$9xa*hv{#(T|>uk5b{4 zX=GFb@cnpr4GocX6{GTvyv?dpnd+&V>qUVKy8DU3(gF2oyVnTimLR8i>{Jaa5s@~+ zp~RgB(7xVzvNoO%%<|(S(rETfNfm!+H!`(57doiDBIEorO?!smW#nFM8Q!hX5;7qc zYen4=vZcX<3=0&$dO-Tm{m8Jt({^L#n@_R_BQ0cmFPGmBU}Kvsk!lU}GemTaZrKX3 zsivfotj=?MIsQn4WAwmR#U`~^b6N`o!BfN3LmW9rVAYbUcI)GDL2%141(bAZ{A}l#iT_DJw<;P zG4IyQ4HR$g(9&k};NZ7_cJP9c_~S0+LJLncy#LR-^4n*N+D z*aJV@^Vj0LBe0uCI7;h#6{Wru@YUXC*e4iD#;aGCgxW3Lh|StnHkPI*=GQ#f>o`&q zM`4T;ZCo-Uj8IOEeo9Wa$2y5ycyVkjA7Gc6;?V#dyt1MR`j~p#%&9BKx;uaryB3{BZ-Vqf1{l~pKIK5qHxwd8*z`ETw#V~bRv*!Uj&#gME8NdENM4eSw z8_>3`aV^qP+)InQyS4?2TX7BU?hZwY7k9Vf?p7eUJHdln&`|uQXYYH?OCESi_`bE~ znsbc#k9A%Pp?bQCT0Q5Oo0c~h>N5pQ14RTQojvuY;zEY$8*Iz%%@`o}kj4*6>$!CU zM0twmx+$tF=HEsccgevU5--n5$;q-3L3?~*lAjLLiTGMID*O{*q4NJ?J*6&ZXMh15 zQ=zz$!wE(K?&X!SQ;7yuzPqEwECWlP-MJ3JEtwFeP~2JNj4HmC4`-Msbfjz9J<8wJ zwFLh#)u)v6hsOtC9L9%mHjDP{q*;xq3~`r>kq39}E&}>*uWfAR$S41p)qmjCB(R(M zPWo_-8mhBIA!3T3Qm(%<0-+n$k4kL1PJZgRaP^qeeuYCZRW6-ePX4YZpnT<`mopcH zPlh;zFyw)y4DxyND>n9Kj<`kfl%#Akeaj#WK4MOE4MatlU9xLgi%{%m)*rZa1%)K; zy-@OJzN3cyD763iu<~bT!2Zaquj^^m3(!aMjDj|;g6%5@&O21EJ_%GP13jAkjiusJ za-93%ZWc%^xMLIa4|SA>R{fAkh=RMuJ;j3t6Mf2J05XaE-bL@B(V zhLzba9SJY*ocWGdb(f6A9O8bXBx-BX&WUYQ6ui0dL-p=BaX$+YZZdrO$#yr^%6BJI zkZptsFD^6Ihy%4Ic6)O<{|py=OC4QToNpFb_Y`yvY`36_XjyrF{C)YgsoX?)a2`{(S%JYE}KA=Qf;$9blm(Gz@(w^)7^R4 zoAe9!;1nOa!mhlD(+S2!fTAZ|_t&mMR`wi3J~sJ3`||QAj!HqTG{ZysLv&P@PDtHS zJ_2ph@v+3|;>&KQHXUxi`ftDL+Tt5oEtLs1)){6xx?3jAB!BhV7W}ik+`%Qt{~l&n zr;+|jY_)2f#5PK@L;w|dsS>HT3dsLC?pFve~3RehwFoWjNlj>L#hCi+8zQ; zHg5NN)5kB>_uf5jIFhmcs%mNrFsUZ557urNo~#yTzMABqQ-{XW^j$6M#hi&Ocq*k& zvnYR+ez193HB=Cmg@<+F13yHe*VNgb#T>qtol7Q?UO>il74TlV@KQ zUCN)~7d2=Z6MUTiK{IXjuvTNWO6+}*mLfQ|)IS+SbG`wmkE9LxO=btJ zf>8cQPaM3RpBo%n_RA&lGl&HtzqQFW5h$1g>uaEp;CmHH@zj6>^`l>=I8eh5w$0_5j)B*j z@Xwnw`oGRk^1-T>Tn<$g&U3A2<87#|h}dk9UmYbd+`p$f%Joe- z#<7DfarEIX-C2l;nVfUNPYqj%bR*xLR{8*Zn`p?pJU~unBBon(9}?b?gm2-b5cyN3 z4GWmyz(1qR?C&6Q_HG~#?6B?Yw#!1ki(Z``bCZ`k4m|a6Ha#tp?6pHE||(Gu~(HJbwX)w;oWc&&{w%vufr{b2zCc7-d9|hZU~T@ zO|9>{&FW7I(0&GeT4k*+MOCsa1{nOM*u$V>W4~+R#_!@UfStEsXe?1sl$esL2RXkF zwOBP=OTkpLX@w_FLDs6cj-#I)-)zJQ#S;5D6Yc?X>|{d2{+U|c$`w;Vr4Kg?OqX?j zeZCu+S1TEY^#>nCSQK*n_K5}jpZJM6eACt(`)}**K)m2?fK?()^Ng3K^!waH31g{d z`An`{o$+nTI5|zo%JJDQ=YcwJcA^$}7Wz2ACV;&|)h#$0YZpC9_n654nELd9zqU1LOU5h0-IlpX6NE7c}+D zAC2$#QVnl>d|`alJ8NG^z*pkVF*7`D`TpSbkog?^|5(ylf}xTit-_a$yKV99yN-+YBxzkS|{e7W8U{Pkas zUzX=i{EX;GB zB|Vp>eRz<*XW#wR1YeZ(e4VVSYJu?GX#>ydO-+TSZi}P5ofpvU9tv_ex(x$l>_ys4 zbt>xRcP~l%jaGCo;lj$R^T%GHznZ{nzAPWQJGA+`q{MdAW1sgX9940h3+&mV+m_m( z+1DRhG2|$Y{R4un0Kq@PB{T>6x`djYx_uIOtfh{xjk(+;kX}a>9&+zGa$5FYpWMPu zZlt6Y1_+&c3H~#(OybdEl*{IoU41XZ0@5Bj-*+y`$==Y9eGTrz@u@qEW7u2C#C3@! z0LEBEI<3}A!Hldw%t~`H_>e?R|F)iby;?{=6SnpvD$DX>g}`>dX~i59!F;~RGOATz zKSP#Q9r-AHVhul+Q>~lKkJ`NjvDxB18X>n=X@9{YE0=j}+aP+BA@Ll&n7aXYHX_J) zcJ691WU|?-1_uU7g%n8{Y_Rm4j#SLmL3Mh->ed(c^NLI=9@Ks{ z&POPqkbHqRVmH&X2sl#@YieW?Q{Oxto}uI!NBg1ZHS0N@j+2ii_+MW<_Wr%z-(NvGw%YI`n?6B&$|_*C0GFGzViPe`_t8M}7#sGuL?t4Dlls^Nlh>)Vj61LB-=`&i;{MTX*Ce49YCjv?4Re)z8`iS7kjbfh8y%b%zG@XNK&>L-Cv>? zeNF3uXj8hWHbQ_sh?1P&i$4$_JW4NcEH}k$nA<%-o}e+cf&) zxbQZlbrK%P0Xp*hGn83R_R~f=hbVx*PB*XdriO$oNT#%>&X(iKI@3^^d;bajYj6h8~NZcKzd>ud?S1#a>Snv{zAVdj!(Ndc9vl(hB3$zU+-9i=pCxZrm0#yN?K|b zbL=EGs)ZG7o0T)M!h~r}4Ga{=(>xMO=w6Cd2rZq@nzzy;@MP~}FGgG84nQU`# z$8jO+bQPaw$-pP3Qu{j7^=Cvpuia`{?GBK%I#ulTNo{9mXE*GmCQ+m3sbEw3%NOFu z(_h*R=A)>P9z!-KahOG-^J;X=8MeDWqG{+?egX@$gel|+^&9+4N@7*8c*BfaQkyKu z%i}rEY=h#fz9rev`-t7Wy%8E5F=kBzrym$^U~t#prLI+Qv@;rF?k z>#7^();wCSD?CS~`X-~OxHv_N%lZ$8%`>~vq|3L`=29wrKY-^vGDtWA+t;}j3XJ4~ z3BPQ94>t*0Mq^E3SN;B4zJ8szKEBvEE%J=EkA993;FG!jeks`Qd`T{!-I{VCHZ03j zgABRZ9`ySIvo0qm*C%Rf32#_Fmz_>abM+V9<>G?8HW$PA*;!Qu#L>4q)My3!eou9C z4?yVOmlR$5lwCyBBA+-4of24_*?crNr06V9x4QU3S-{=`Y8rZtw=&RJB#&CV-q zdT-5TDq+dMPooB%s|xqxsSb)0z7$DA;_TO|V{qFQ25Xn%X^_bTmp;BPbEy$%16uh7 z-#jBit~{lihx$EZLux5Ge4$ZQndf9+{aOw2xxw?kXFSOFv|+elj82>M#IN9WQm0WV z!;LD)R*4kbj-1%$FBX8oW+7{J^?=Y4YA0!oA0Tf0nPuJ6!)58|fFQN}Vt@DU9U~o5 z-{Ybe(1%o<67hkA?DDqR7XLoWPhQ4sWn1KOa&Y9hzJpP;r~dT%C)0e4$6DrPeG@^* zj~Lk>oTthB`1OrgSL#cuH+bVumw8#QRwiaTwkP;NEI824rq-Y5iVeWT)%m?`WeNOH zhz)16)YEy#3D?c~Tet1XagM>M6C1AGeFvN}QpSzjX%ED3-2wmAb{-hKz5gS^*=dqN z5UW5-Fd*7v->~|;(od|#Kb0BQ+AmNIWuANuJsO~iSfOx8dPa8`JVClrSZ|IcAla-q z`CxzlX(u6#X3vLL)=Q^So$MQKB#3%X=(TMBm(;Kr`r5^iJ9gQv^b!G5Vxh}>P+=lR zYTup$%4fyHk6$b}2I!l&q>s`U%69-yS8F2GdnzI!Wd7o{(xY#aCj`!aQB%6i;jKTQs`LED5YNhvyZH@!PM{O=g^Qkn89Q<; z`dt=a^AVS}m6kVh9q0ZcUs@8)x!@1qP&ACSA4Z()4Mr>D#q_9VD zl7Ym+F-F=Fl{i%@!!Uo*kqWPnprHHprs|JdugnIavV6-81?`g8w>}{4? zkkKb3h5XK`bHgqcK?JjfDG42?syq=7j@gj9#(i2QAzcH%J^Z%Q`mw!hw(cYxu_u}C zzgJ9cm%z-Apugv^SLZKO%2q>QEGb=7_kHu#V`_{aZrLmB@9KE@^C$ykjz(UPb&q1$ zI`!4IG^HkmOP@vV2rTp1?C-_)VpRn_149a1_g~2pd4Vtf+D$sVwrd~bM4+v(tmfa! z=I5AfWg#O@0N^m+razOR|E*gSKrvfTWAN>8R29G3*{Ybjd=S|G?%Cx25bV{yIcp|1 z+V}TnAI}5C@A^4ScIlrfa!VD2nt*qydd}t5E}sur^^06AqGS-=%*I}dKH}H> zMMaXinauu`^4+iGO5|&H-mw$iU!j$_K!KgO?In!; zcX&@$_Y}UzxFNBUA7f*#nT3ieYUp}72&1-syEmUH7(MvHKjQl|6P~djcQCPZ^~Y%j zJ3#BD@C_x0WQ$8^gRqqP?Mygj*#*iG*BIWA!R6eP^Qu*8REN*{-A$MQWp#?CUo|!C z!0*Zg<=VDt@Ay5+gZ)OL8=|bYS!jgrZOAga@UVJ?p6bVF7X0SiSDbYD+PquMoNp_l zd(7o6)PnACnH?XQeL8E@$B%T0UC_eQb@;yg=((MFru`j8+Bj{SYzxL@JtXIv`O z7V!U8zEHml@W63<_hsW31j67#+mx`}_yHft@68utd3eQ^xO-m5vNw%LaHo@mzR_@L zAFegw7MUVDZ+Eib$~Rc_?k``8w9@Z)m4Kb7Yf;&G4+H*|5|R0ej1G=9L#L+>g3@8m z%n?o76|Y(?(HAB)QGu4k_hPHkC)cpSq=sdPKk3bNo?(BE2=U-*X-Fi)G#{AJ6K4>K zT8#8eBHJmZ*+g(7Z?kuy769Y6q6=@?KhBn)nc95IC*$J#K4}fxDBs zS6$?gVMORE{%{wcbO1@^Y<9)cP*jr_A>W53Q&O0aJ*SzFuVSlLmKlOLSIruIe3Z>wHFK^BTAN1w*&TpiIE9zZC5ptq~ImsjX+~DE! zBMYy1$M_ugvBB`moK#%X^kTd4QCt-=rsyGB`);<)rC~26@I^J<-}7jfQI49#EWyP@$o`VjokTX#X|cCpZGYiH5y7WkNhK6-loiJ={5 zwWonop4~t+&sSQgB^Md*-uZT8`*5X{)kf85LrBE{ZZA9lP}c*MkUHNse@+`}@Iw&< z7y3E3*KIX4@ZyX+AK#y{`We&wUwilJ@7)Yl3C~PxboR0c8SXnhe%{>M!@tt?ZDWqa zN}@7UV&HhuH)Z~-t7l;E%gXm68Lvj2re0rJASt@8$E;MvniTUW_ldSi9TsO~Nb$g- z`>p|Ffx$xDNAA^L-$=5$B+J$6ys=rZ)esbHgo5@jlQS#L6`N%{MeH=X~4 zo<=cGt)bt>=>9`i33>ZA;?C76#xQB@GhB)k(K1!_=&{&>fBO`S5TJd8PjH zKzjB%hAAk3Uy^P_Yuc#dGj4-hK(0&2gy$Oaelg?L)lv5 z@US1a*1-K`D9{EG;N6t0wv&GyM#Texko%YATaN~y<#%U&E7?3xT4Hc4QU3l>Sf*9`PT{Xo$gJf0;W z_W(Vs7~(|7#L=vSAK-2NEG;cJ_MK&~evB=(xA#~gPRRW<{*zoP(Gl?n9MQk=u7}ez z4>8DO*Rew9NeP8tM}7@PnSp^Ziw>Wg?N?wvM5%DBWVi};*L4ItZlpR@HfRn0SFu; zh5@g|CRr~-H#K^wPG9tFD`A~Wm-DI9kOrO~%n4UUg%X@yEJq;ZIwmW>MhD9guW7GH zGYjc?e!NQ+g0$;Swb-t3y0z4y4n0~8V!$wTk#xWD;?YAt%y7&+5F-#aD&g7k8TG=s zd01mKlbrd@6nt@p#lPA3aDjw-4=`C-JpDjc2R1{$o zu{sq8$A+Wz4yC5%FdMiX9+0!+S3ot6X4w?aXIKwK#&FU7^Nz9eABPuD*dy24FW|x4 zCl-p_`sZ#&;A(lQ{K4R*_p(aQeZe(3cjsz%(CWMj%RK<>#X=Ho1|FYN z%ezVof?Dr!IAis0V#_dz1qsX@fFQ!ipNFBlUIzN&V@+pfyRhf%sxiCI~fN$Wec z=VIfSriK%bXB|c$=|*~@5Lv-4Ew-I02kKqfmiNnqKlYp(xKF#;0fk@Td}X8)6nh8L>#J#v<0-j9XKnX zyk6wWC(f~9CUX&IS6DN{A$9Tkw*^{8-cp=6DaA{C>+>M((-gBZH+{WLJ6!bzw7bhKajO%`@sV1E8m{2nnNU`O z#XQe^Z|m8Ip0gMmt4{+az}xVL<_We~)P#k9Dx#k|OhxpA8%5*#yb|p0AFg8FA9Hfk zFp(nI3ssJWd}B)SNiDWa7xF%|!cgACCD@U`GW&UBw1r1yI907UN9ohJq6hXj&g6|~ zW3R|YhgQ`rP*;n(JHymuROu_%ZjMG{gtNJcg@$syR>euJU17lb4_Y+cA5G zZ@L*fmX9JfnI90Rw6y0b+^mQtHao@Ea7Ws@rV2 zwwS;87E?wsD`xl7leMpIYBuU$0&_h*TV-1oUuHi{tNr{oR@AG7AvbpGqLOYVA*LqV zW_E8cov+tIFE^I=tHLHG5i`gy>H*{#gxsaH#x zTAf8e2>EY!nArV2j^d|BodSV@^{y;UJXZ1|tHInxWam+sg4$~Vi)NO@LWpibb*@Pv zG^x2^TUNWpm(or#bpTjlKne`(6+c>Sit>lqZ?Xitmk}hyVVuib7lRzIcK(@mmv!<_ ztVtn=ubZM1EZJEJA8w`et>mwT3eECb%ZKQOtafLrGrDZoUq4Y_UQXCfbP^(l(VjbA zrf$DdWNlLRhGCs(__~hHm(LbQ73-Z!q|0XrYtMDKoe;P&SSfaPcB)?lKRK*)4z_<+ z=SOrJJ1QTj}7FfUTe#XnWk| z*DZxJ%^#3_fV~)F-+ShMiKf(}Kif>DGVK#$-k@utT_V4WXl+D|@!;m4?ezD4B!S#1 z!0#MC2szG2^KNWkDxRGB1V-{+um*eDYl4aOjbYw^a0q|N7~Re#h8*)jf5-fY2%?*h z4v)|^b%(ZoV&y5}w zp`hHRJ6#7P1t++S_944mZYgWbQL`_*rx32?<-D>eptRg23k@|_Qn&a1c<3o+c=z_0 zkGJ;8fYp2*U`A+8q;Zbe|-Ke~om9juZA{(L&?Gte07tSMdnmCt2!p21y;O@>Ay zo#6xyRv<9%et4Oc$$mzbsBG~|W!^j=p8?Zkr=20gx__R^AC;?#Y;43s9=BcCX2H*S zVNxU$#HKKPn_A5Wxx5e&=~Jw@a!tjeF)e)|Q_m`!_K!UsAgmjd63FjVJR&YK+t6YU z!K&QM8y^_wjn(R4Gj#Y_J?;s%*geR{(;bnZ$&I|zsRYOG6BSlYm&Z)1S^ShoO6q8zuH$`b1$xg=g{1|qY=+(LcW2lO|J zh({pOg~aih9g8EydPOU=@eSV25s|G-NPGe*D=Q8kBm;SZ-Fd4#;&pCT5E2&Ka%ruz z^8tSYZ%INGw*ISxGwNsqgpD%t&bQ%yoZu}n9HTvM`NP{tfQT#O!@@Pm)Mv<%JZhV` zYFw@}I@~{}rQGiseq7LX-NPuWFsSnT*f)$f>Kg83?*fOo`Rrg-ANsf5<|P3Y)Tqx@ z@TJ(A%&Qz$j?5!{ZVseYyPXU0P@G*FqW?rs96hRS=O1QD|}u zvRSnEhF8bn)m%3=`(Hq_$~=dG@WpgAp{!3Wxw&g^*G;elb@CJkR+~rK{8Gkyvk*XG zC*0^1Ghb5q{jb%mDeB5Au{Y!g$`L^2~U$ z`AgiQ4a%%Urw@Sw57BQwzvxPKe>CUudwtm6LO2=Ei%s#j`;G7=gRw>coA$Z^`T6V+ zBrX29eY)SDR=47C5eeaO8?a4TXq~Jw$sN zC&q53dc1d;eb5AS*NYq$ULX7tzW+ou& zQV9>u&Oh2s;SJpWYqAF95^L-9soLach3yc%H6ozkP*d6$fp*|=Ob{NQ-D2)pfVF1! z9u?e0bnUp<5+mDY?U1g~>MfF)S7j0n4?y%_kuAS7Ee=l%o2OZ2M7XVmJbXMTAe%=% zMgse`cE2cy%Li@+_)y7Q+&1kN!`M6zOBAnx8GUAxfgstnbAC6uqxI4jw<;TPwAp66 z3D1Ipf)Dt-;_u&Tgwse5#S)+<4itS>z~qN6gXbkoFLxk&mBd`T{WzlWjg8#TlQ~`J zKDQ226e2N?E!UKUMaX-^l(}2Vt+Vsuo*{y3?RGY1-Kwgp>cbpHTW~BLFjvHHG*lC^ zS}_J$_rZbT_5T8%VWDL{=(Aa5EY3_!4Sc^3{0 z_V^%wzKzzYE1?B|L2C4cAukBs4XkYEOKMX0+m=h+t_uiwrahwcE9UDCvmcEF5 zVcntdPr2;*P3+1T>^C6NXKR%_cbRLrP^csU?Hgxmy2I+pLS z_jjCInjP`F0IgnCm+~U*a6eaR;{xe-K%djwX&jH>me=vJ1pl=nvDLKV=CxEDtf~}j z>FBf58fyt3A&w-F8SrH*t}E6-*)qf-XQexXTx9YtPsMPR+9nCIzk4hJycMAwg%&Dk zKY$O)Y*lhC4<<*O1y)l=4$%Sx9@C7@8vXt3+I?#|)bsMti`1u;2gxhzn+M)+u-f7?;j6 z|8d9u69r?jrFUXGIQ99&G1!Kzq5J`7S~&Qgnc|vpTH*G0#g&>T>iR7 z^_D##u%8te*JouHHRSpOI!*zc+PIBND5E?~jhk6Rdaa-1-8dRUa-q`sJvjDw{2Mdh z0M|eL#R4PKr*jYApz)|)%V`+x46}5XOTc{_gHs~s+Q?A#p*rCO``qjm;4IE8BP?bM zQGK>xAKX1zK?6E=UL-8+a z-pCp*2I#lf)7MmvyW;NsNSclf9w~GY>Fy+(Eigl&Oy-G=mu+<{dCm%-76wI~e9D1k zUy;Kh#4s`5P+`kNPHNJjp08nfo1ec|YZ@BzV|5cN{DY>1ZXoz=?HT4!+S0&zkj_w= zI%Xm->t=F=-KYUKU=ee*xNs}41OdF{kTqj4G!N0q`T(&XE^G4RrHd&aY8QXW3i_u4 zku7v8#?fY>vye#2IMyN|&9kK-f>4pvJ+A7J6&W{xs-z{Ekt~kb>5n^d&iz1qs3DGD1aMZxlGh1cq6WL>69+-&gIKSS2E8Nvdoki=^d z->PqRKdXl#a$qkLcd5!vm6ULpRVM7Z47+CEy72jk@jlQ z_w{84x3-E_cR!GLT^6T)`tU)OfK`wFAloNa&;6+QY6#LJ^!{Kz*A#?Xzv!C_#SNlj@tI?vBF5Gv$JX8q0w)RTn#Z;e59*L1`%Ma`(f-mz-uyIcn{(wZELU8-jN*Wk zmJ;0hSzRmYPw9C*{MEp#??6l|?H{dXx+KxM{*kSuxnrvu z6S#XD(60i&SOuE%f;OFP)7(ubVakcV&Q?}PCcPkCw$orOfj3PZDj^NRf|IfBsv&)w zq99n_HYCMK(L&<+urUk_f0}2^WRJ7qHpOAD2Ym$p34A6*!6fs;$ulLLo?OZol9CFH zN0+GUn3E&hrzDTRt;3c=z4~P-N8GnQJQIg{j8KqM(yMOwr(klU4mG>kv9|9HAjo$P zM9Adas+@DTlr{`M)=6TSPxEvvQ?mG7c%5#BDFL?%bN@BBfe2zfCN9{qz6F?={odHx zHZc~eT~J?A0yvuUEfHPRUao(7d$l{VfH)tNey}=;nb`{kh7h1gQrW|I>FQD-r9ejK z;BHsh&*0gJh>q2_V|><%r6g}R5bMPK5H9um(s`(}G^Po*BDR0x)=+;Bw`{432^W9k zDL$}YNwcZJ4i~nvKd!weKOR&G>o%DvciGE=1;Yb}Iu#RR1UKW=%McLNjArKLkBHS3 z(##N0KQ+?5p( z<>Q_Er76JKtr4`^8uz~clgS<+*Wqy3)t~a91-ngM#1Oanu=)u9k_TN(et(ZT?i}1Z zGQ&mwe>S`OyQ}HQs$zw};wdhU4rNXZx#FTfJMJN(f1ZAEYA421pFqvam50WCF={f1a=;t%TT3wm zBo3U7Ne+$B+@;N)DRiJAR3vvy7{l)QwGt2bNy0l>lMJDr>Cdg zE2irB;xYeti(DTAm{P&A>3S;;&yK8}l{1Qw1(V9g+kun)r~ zFTv*ZafhV9uHgIYDL2OXAS2Y?x24nclo3uB&nYarH;)uRld0i^!rh6MjTD$2WB7>k zAd>DQ|Hpy$aGShXE&l+)4>0ow9vs{n=bCpj-b2%VRClrb$J(Z@AAjBhG4OhZIh_gix%dCQ$PNDI zMZP@{jqHrvshN&v1`4@@(D@5|duu*~MmCO&}*a6+*UUoHH(S zVm+MZkWu^?a_uH(-TqF#g_XQXV}D!1fien3TvQwA2tUGRe*!+_Jm=Py@Ng*b0>v-U z-0+9MWms3HvXnS81?}V^Ki$`t7H;jhmirV~#_vyho?yp4H)N|npP%tIBU44EAe^)5 zOn0#k43T%x>5;*=hO!xINr=838if0ykL9?i;#na9QB9X^(jsj3`E(}-`zA+b3D_0` zE5>?xP%MO)(~_C()h!Agf0^nR@199UmxJXLMIohWVrxnxTTBGY8Thb3dubC)UB|a% z+^mdbQwdCQk>%A=aD3+K^{5h!`u)}==zMVFKjWSi-FK*VAGe^RlS{$gNQ>YdsRt*# zE(@!lFq>I{pl`Ilol=#U?QIjbR4H}v> zgJ!?|-FN~CJ7{nz&);~kDyFE3tyPTnSphd!59d~w@{0vli|-L(-|)?`i)e$bP|L+) zV1NZbBWT}Nmll^+pL=<>EkxYwiE3r`-!)q{VLu7uAb-Dl7P+NJzH@YF3JzDjJ-v@) zeAhTM&V@vAMp5IuT&M3%v_vgRmc4mD)2-#Zt-NTIT_!v&*~ ztr1SZb7f%`;QQobRZ`B-vd053SlHnbJ~M#V_yoHSrQvs31L^E*;(f&gOBQT?3uy z9oXbv9VN|!FdVi#L;N=j>N!s~og=5lQwL|tVeh<>x%!d6tklkW>X=7Mw8|*Wn7<-$ z4XsFbY5a7MNAaclkrGGeQyD}M%@&d5wwQs-u(3t&TiwfW0c=!@$IKoP<%2Y^STbsjbnpj9{7VE z{`rNFStdz@c%eligYA`5_K~)RWJB_+wEC?SYwYAgoiL~~&&KVGZ4L(4DzcZxPqU2Q zZ{*)j1ZAn7k-B|sg|G3@UDG32xLS6#pu(3|z(d9IUQN#{ z=jaE8W(QD-BzYwwY+ZM@%0?3(oL9LMeFd3oscC;m>y1QX73gpuJmkeP-t6{M9HSKy z()}WpE$E&EGtimuhSly4?TzuU0ES}md=4n2dz}vE)szywu3=OXHN}LU*B9LsW&_*j z=I!NXm53}71SFP!5zMeKqY+G(gP%P!D5AQx;!wz@!+ODs7w`_YX`hto(Dp_2=@3we zC2b9g=2$hcpw)ieCMHtXMkcfM!?lZT|I z(+b1*xQ0J@K}V59=^eBa{NLkGJG(lVJLx4KUG+S77w-TOAwZZs8`k;0^z3|O#LjF} zM8p&tx)}2_L6pSGKn45ajP{)Tyv`TOLGm@BSf!mffa!@DYpQDD)6Tw_jM!_UIMv}l z^LyZa-ZJ$>k4smqVz~6{@@X_+5^Mv)B6sYd@G7$%`4xu7Spr@@cDR(wEg$2Uyl=(kz>&WV8*$>05RF*Q{say zX2x}n8~@B>;iYcqlWzx2sjB!-i4ie8O!ZpCx+sy`E)O#7jB8@FO=Db=B^Hzn1*+-3 zyo?6te_GRj#|^Lk=c1y@&T>D^l)iSi?^4NZ==~g12vYp9i=R3&Dk4xX*1_nw{*k3e zvQxzO6X(2Am^)g+Ho4T^yg}98)61Eucn6%gUoq(66+P}Yg{Jdr5F0VusK$xoTjoL55~hIz z?=OsmY~wD`rSZ^XV=$(*Rh<;pAN1=(#X8l-(5zT+E{YJs(Ihfqhgdb*KR6LrjmoCunauMIs2x zo1?mZLxqj56Tb$5i~qCnET?XJsMpcoO@J8Xtcy3%8O0f8z+(??1z1G}GFIAD@%GdN z>IQh%@@b~632Fye+kGY`zab)G`bsLHD?u_d3G5+un75lllFtNKPvy=kLdp-umFCeA zaOiHWq~ZD*#yp74?2^2u$H^B~nSqK6Zi*V-33a6e{oTm6D@9=~H?U=&r3zdPY} zU1tA>jr4t8_o(-|v)8x486X%-VO^MlX`<>XpQVO}YojyUzkM!6I|7x~*lu>~FV<{Q z!Q@blGC;8J-O-%%pr9_VL&|b1|IuboK+}x`6+%At0DXmKO|^#SZZwb0;&5LG!(xC2 zY!|izmUt#$-WzBQbB;?aR^BUojT8MoNP7z}`GJ2nuv7RT*jhR-`fTunrBVnA&diit z3UkWZT1H|?J4PrsA}Y4(LH?gVf2^x{V@6zB?AJ|CTb+J6?6#DZK@a*$Iz`EnQ@OJK zdszeD^KEsFy8p73&RXUXM}9gitj#t>Omr8s?rfkgIrImwuSM&-0XghgSW9hU&d3%1 zJ_Bs4+dX)ZT$~-`)9U^l&)+MdJYyeV)wcFheZ@@t27V^Oy95m-#+{Mnov<4t(N^)V z^$zz^$cF{BDm3ORy-qIrqe&YT5J%L)_Lb#Irys;#0l%>L2>~W&3Xhlz#r(q{sq9~* z2xJM;UCp{1`nl!R-#`v0w3NAXbsLwCY0Kau4?NR@{10B{-*i`8JaF0o@~s%jG78vo z<*mpuZ!am0?oop?<)TsT#!W*fG49};aKy&0*2SVv3!JlwH$gIV!MX>p$;Brm7@;CZ z$Y!fVUB_sgJR?m`VNNLXw!I60)nLl_AB58Lwa|LQX(v6xwCv+iwnWpm%MhpUuedAT zHhc`eMRD!E|2BX(gbTY+7WjCIzb4Ormvl=u^b6d%cu+B3t&74oSTiEDpPE^5BGV2M zLTC`nZ*Y+Nmayip*LvFB(ecj<%xM9gtq=3AWw08*CsAuwSZOBt=3*!oj^}Cs05%do zOU|R57xP$Q2W(N3fgIH|!_Dki$5`X$(zM zrC2vwK?`wwYz_7-b!?Bi#XIjBm=t*oZ`Sz&toAnSF#n91oqhhh20B)?NnX~%j@mGh z&&qB?Flslk;oH>%>%AQ}z*Pu2xiR5ZZ`}VMVP73q)wb>}ji7*1g0yr>NOvRM9ZE^V zLO{Aix=UK5JET*(K|;D=kpj{U-&p(Hv(MT0?C+j`c;Hzqm}`zP-|@yT+LTc+Ge11L zt^I+c@db;anJddbdwxmPAazo~{JHyS%d7Y39Erqp1pq)KtJnxoPWZJvJvvSj&RQzJ@WD{(pX(J?cO zx6*ghRo^g8rjDqF-#dSLO`DSN*H1hgGV`^z#vp4nNF;N;1 ztC~YM1!QDES$aDjlAY5UxZyqIq(AYnJ0X`Ip^i7nvvnANT6{TBvEZKZxoo`lXAR$# z`n0WeI3t-(W+co*E+l;n<|hMXQ_cx3HjE;#&y4)?NyFYR3Do4^XdNTk7t3?G#4~)V z`Qi9rkR(*wB$`A{3;Md%_Oo&>)`*W?&E~|jxoxafx=`i_`|X>vFTcq8-L@y335|U` z9Ygy~zbXqAm2DTVRi61_1dYE`-4j^TEu=+rg)2c2aDvpbFmF-r+HQSqXOxoL!pp~y zG{wbrN`M>lb#q<*s4>PmE!*>Y(9PHJr-XlDcPAlw|JLjiruBr;6*t3XdyyCq?`Hu# zAnbl|^2rFbXW>E1lT+^lJ)iAsJ%#H~cFn9lf| z(>h9u#8oRMhVd<3EU>@p`znF1-nmTgkAj&Hncmq)^#}F(jNo$Zd0_V zPF_T2MG8z_h3|g0<>zi~jv^NlG9+>RP?PF88AkZ^%a>)N?Wxv`U$4f_PBje+mXRZ9 zsB-~VCk>!YrGqMNS$njM>x;=U^3t3e(AXD0+`hWpNRjyYk&T zb|h0Gg&nuqA1^d8kDsooJieWmVW6E$+X^I3l-qiM&UYGbmGGmZ>jNt_{AACmBIV#o&FXZQ$lmT0^QE5)!h$nc*FS%b=k(rFGP7 zvpY%XRO51BFjHyzEd;nYBj^pW_hZ@28lWPKjssb;YR2fuhIfOfa69y6|1;`bL3EJ9 z;(As_39&pN^CT?}_p)kjqC;vkcCv71X2rWX2*>dB zFO7CZs@2WqILnsnpZM!=2lEdiieEk}->Yfo`7P*p9ur51{g#yO$J7J-&!oo3>qR9z zgj1iiUb(;Q>jG@OQ+-_4k={V2AkU7EIEp}FseB2~Q6&IK2UrH>|85C8cP7nhUp~3% zZaA@=`|>N3>3cRM)}#^S=F?}*FY+S%YrET}qRBrGU1#w|sh`7NA^+IKb2mRn4t9|H z5y3h$u;@#S$b@#&(y&uSEW3IIztM`qby6erS{>*y(i0jd#8VutxH*T$NVD^-Qn|1jcuFJ({ zip|WYoh)c^x0soon%k^0mbdLoVDny9(PxWmQ^gk9a{|ZfPddba4|?u9rD(^}sz0aQ zMM`SjJ5gDHnby$+eYV#2u>X8W<4Fj6=3^2`zJLz}bA3QLXeQ>76tQ8R|I2%h-o!5{!S`lLOR=vF{w;BQ2K*R#DGx_x4K zdC-zhT6SwUqB48tlSO3q=DQD>!SCdb>WDvc?~gZ*sAmqbREZM(6N|p_7(89wOB6Ru z?05QR4g+niiTm_%v4YZxf!@Q>QW_im4-aztb)Q$7wAJ8Tnhe0Xu1+l+^%in#*O<5R z^HM1xY^T7VSW)z@M(#FlA$~Bsr=!*vYvq8ySV6WMu*$0)w^=?>#z(~w&Y;8dC`GR; zSf1vVQXP+Kf`5nk13%e$Nd;3zE;!MI*_=hhUrMa&zEoM-e(o!$_Sx3F5 z9zhQL*V!Fbwh7tQ{hfUX!LpmT$=lujlcZC&<4z4Xrpd(FeX3`%UX%HDsR*X;LK=1& z?g0yMmTETd#o%???W@@+XGA5gXV1T%Z=7lUCfMtoak2_^^(5OXMWxU-CRpOLbp#?QW1&`|=jd<-E7f^3r(aYkMG9U@*59DL{>Yj1hM{ zEYu2dziD1>M?dApGFqPA@B)D_J=Ol^gDViQSg%`)80V)bJMDVEc4>0wfxEOkZP$F6 z>y;Q2Lt!;l8edn(ed%xs(Km5Y2*BuHkeR9`&|p+aUPT_6Vt z*~QkK?M^A~*BvwCN(k_~*U0f&eARouf|MKq5G?Vr)Cy4}c#P$?`mwTMM*&L6r$I+; zUa>T3lrD=7fnMHodoIs5_j5AfQgx%!fj6UUYl~-zl@)vi`p)kUSz$vBU4F++z+9ef zCci@_w&?A+yB>eeHirj}E`;W#vnH!XdJxVzvBHfTmHwc&o*h$@#Mgq?Qj8_k~^U`wn z4hoCPG%~gHL3{myQ~W`*<+*xLXMb%s{$PjBT=)=%T z*)I)E`D@d$#)t8->X;mhOw6Q&g{-+)iQm(3=H9zeNalJsDJ~JPI=G3|8yN*D`1pK2 zB{)7SV8~C3z|*Lmr5X*KDyic9y%>1j){23%CB8oV2uta1M9w0sLf4)_R8S6Ihr1bh zaGqRsQ8B8sIM-=ZWKQ_GtG8J0d$0c0WVfDkbqcf2&ejiw5;vX;?FdhK8~dL;GxhdW z?lI`j!kD*MQJGW1vg6|&Q^d0#j;T9&8)z$9>UZJUglRk$)NNmJnC^c18!z=ky996qLU~0;Yo1a=MLye5VWpjX4au&;am!4Zl?fr7| zX_A|xEhADlCaTwmA9S|fa1_#Bhr_8lNF=97BELcV`Q6LwcAE&BHms;HUW?aQouR{u z`7iCbY@6&IzyIRi`u#qjSX7qai{sChHQdujyVbeb~1VM*dhtw}wloCC5~FAM3csJ?`~ zhiaXvpvT}f!}teb2&2Jwfd`m0Mz2S{ynaK%8!`k}AVd`8_S=rX_w8B!r{&kP))ude z#0JSwWM8inpSN8-pn5e+e|FnnH%Vsup1O*)Om?vH^t6Vk#43O1Ih!#2OLkq2Hy!SJnlT=Q&fVXj@XBv z^CQC47xJm2OKify+BiQJjb4PfCw@yJ`!bN zJp|e;Uw<_Gi75D$pfPbxV3tBuWD38_>*tr3h0=NL4`JOMH5x`nxeflqZ2tRp^d0F+ zZ{WmAfP=F>P>`2S4a8XGw-9oSeKDFavHcsrK!`M`wHo`9InXXxZ;B z)}Yz3)CJ$+=cEqi3n)I`FE~a5F^QsA^P1&C5&mm4`!3&mJEF+NPH&`9#>TNg*rR4Q zABtIQb}!m`v$WX!6vqU&y4vE!3&}903REJEUu`WH!{g(s$QVSFSUc13PcS;UjQ}Bd zl~l>GQu-IW(~jEZ>HrILkUg)cqwj2Qu3B$7!LI>~&$uYr*v1;9oOG&fsT2in!}MGh zPIWS9pZgel^4q1$C36($G;rF^=l2L5c4DhPT6>gj+#jb}_;auH^Rw;6tU%>O#oocB zZ$P*Y4l78{s|yzhV&HGJI@}!{Ra)9$yiLRuypgtTUBlR(um9FSv69+5PM0V5^GfJ) zJ+?$QR9r%$&ot4n^fY2EX)fJyxIX!S)wo-y_PxMJN%$4-`TTK}0uVSl{ag@;L9m(j zHhWKuNma9p`Ej$Lus&3M$tnmO`#gGNc&LX`{(Kj&BQ;6|bScapih2b(VA%x(XE;2v ze_5+W{EC>#on3aK4Tp^6ajZd;Ky!092e}|xMP0Lw>p-NYWTB(E@pnYj&tFI*ia!fK zs8E+i7>0Y&okdg4IgAZex&Q(|S)^}EpJ+xPRrn4I|JrBKbV;Zku8Px#*amMr_RC{c zzMD-vpXignwq^x5y(VuBl<*3Le&%RTN&VRddh*-+Z>@IQg|Yo)2IKD$ZE=?~ZL92a zB=k9uJEzkvoX!HiVNsux-80YATQ|Q*i7x3Da~WPd&o23en-M}m2VrN%3&x5pS2ell z#V*!;C4fpR7nTp`a!r1yS{{D!37#HsOX)- zcPf1Jk#nTNTC?;60oOQRchyAbpjtk8FHs@Se5wQEoM&68)z~_K5t;(V<4-e_c6rYu z_lLZWeAe*}a;m@lbo}kNR!3q^%)Tw(MDSj>K0G71&o!0wi`SImNqvKSopvPR$IJJf zcujkaI{b?rc0R|Gi^sBF`3pPnZ*zhVI(L0K+CwQgw1~*kNo`TM7N7#?vsQLN{?}PqkjKFrcJX?`?De;qyqhI33v!@k*ZLayu%a z`POUW&~gAp?Q>a~eA#3Ip<7FLoQ-NNlhlMdNqD^%*;l@`tmd5?M7T$0_G~C)QA?qC zlm&0`zd>gVYfC3oZN3*6`#BI-pPavU6A%{nvsn#y`*1yoK~IDTRFPuo4)%VIfRu}A z>X}8kdjG2L%AOGWD=pI3T0Wc+f%rlFgI+9p-$tI>tO1#itCxpY1bZhUPgYa!nPj3j z!w%dCF$<1|x5@nHuGRMg-HEL+m#*0L{b%2}ql^akP0fYXywlU{#cp|SH;-AtGJIa+ z;N960vHxV_w2ryr`${$PZzI>liu?H`Mhk!4sfuWI_6U)8hi%<*>cMMou=hx9p0%@C z2NLXAn|HMzF0)lro9E9DoA!vJn~~^%3fd+d1up45wt8n;^Pczp{yVi?S4V7^?dWa z21~l-Ov=r_1}VJWJjuy#_xBL{tfnJH5xRLR_LmALBd*ye_)a!Eg-LDHW@{c!~Fj<}?OaV#< zhl-FNHcY4W1iJF91f%{RL4e_ln!XzIX1_49N%fhyBPZC=lE!5<5J}{ zeN~GhY*~gu$Ym5?@I^9fgx?*5!wMSiwEfh!`hmZx#>ERh^(cSg!$d`^&B`LUc|;@g zfW6IPIrRYsBFqF$8`8*0A63Mxc06?E$EQedpCV$35nOIBX+J$QsS+2ksJLohTGr;9 z;C&2TMMLcs0CJaT>XOYhjYnGLn+@(VmBUXrEEn~mCxRlD9U5vH3mcC&_if{F%^CvJ zv{ex#*82n)O}%su3du}0eXv%5P@vQC)*G7_?-<^(W1#|JEDQBiFeozauPK<*5CcsE z1oDSo6Ic%-tZMg+N8_g)r}A86HeZJ7jzz<_?P3zyJ$c372!u5#jI7ms_-!U+WLyL0 zuk;~MPgGZ1<8?RhIpi}v~aE*V;f=kepLI~(va^BdIE9)Z=5wW~iPM){X+g|d4QXsWD#3&4v81=48b z*bF{*FU)y->1}ND2_pd>6=TQB36-xOT}U>LEbBJe=ApN{;ByAPFh^022fKY&Ky0xV zElY_R3re)~lR^XXar-xd2!>wc4kXn9ap%btSLz(e)!~;(p`*wn3+Ci@G@SNyuJEO) z$w-}9wtiCdQpGAORNYb{vm}Wxf^&Y|^WSzV%lK7IqPfavqxDxQ0ZYtM9P5jt zT1K@G4{cLNIgwkQX|VIqV|*DmJnTFtX#;{!V}Zw`srb`xx(6`LfCAk5EieLL$=b zP}IYOk8+_uHAO4}LgZn6R`Wp@q_~mi=2fbiPmZ<94|xmReQrF|&8sggEwO^`PvUBh zph!;$^)R^}F_9YI?&j5MZo&mgB@B);bM^q4Zvf1N_%oxoj+>x-Et320s z)W_d`sv*El+~ZsHXlKN^6=5cat*-eGu{dpK*SIS5!fiRY= zzqKxMIow-6s<9Ajh7w}ZNk4}_f5Y%lR!ny)?n;MPvgY^LQMHZiw6jhbS+!r&!ai4r z`Z5LEnB^<2#2?75K`9mLPqSw%9FOZG{yiNR`BK{mbg+UV5Ug8E zQcOnnsZwnB>7U!~P;9fi_r(lQK-;i&`hXq+eOlTd?~}fzV_=BQ&?x>fLX-O8Yj-^H z-oL`J@o73gKpvLeM%)s<)aK(ks#AZaCB(&$!f6u&voC$t15^V6Ir(y_Ty2{~Y=LG5o!MJm@e|KR(+(l+{sUrEjb)R|=a`gT#fpEKOkw;m=>LQ}B=s zPCXnoNRxh!v9QLAqSZ=%PmM8$qp-ifPv5dVo~M{|YXem2+ZSvg* zZjuQVT;L=PUO(5IW432`9uSN**Ovv6!(&U8<5!5~apIDaI#YLzzB+rq zF0W1W-}>HskcfNqZqw@aQGu_O3bYVg02( z6S~&>fpXi4V^CQjP+!BDXMXzaHC1c29{;>VDFF#JATqqTGYA}d9}3$XICjNDQJY@! z@p1EPee{g67R~AInWr?WL+|I|JIg?4(WwWwE+?53!7@w< zcwQus%O7}^`=3f-$ro)exXh!nuT5V?y+r9{l}F|9qpgKqhVAUl;kGFa7h4QEsBj7=OLP|9t7sH=cg{`roft z;xC*0Z$91xb}bsh?xtA|g?Fr)2{SgGLPAKpmc#KL_39H^+sxQ5rY-JWjsJape_q5t zUbs27@KRQgsf?o$AjiG**4BJRbNUdk)(7vZo`OY;eqJY3>e^kLY~sIsqIFV*;}9T( zox^yi5q+e$i}vLFcj+qL^z0Q2I&|ATn}S7?|Es~5m;dGF-K;s(-r2bIJLXs~A^b$- z*@-fy>4n>WlNNrDuZ74@)t3-|kHv=8zYelU7=mUdLB&L0HiB~CEu?F2(FOwgT$8Wx zR3NfBe<<%CuPjTaeybqj7;_z{?R(1Wo|mu|=6X%pnmvET^nZRLz04VL9;ije6xMVd zQca~-VQ`A3588)*%ocO~aqiax3;=f*tM=ahJO;<13lsHP?-J^@u$i7i*TBqKqBTj0 z)4MqMRQri0)yu2ASWUgsw-oD06nIA?9q()_Jv2+@?muKyxiaePqRD<2<1<+fbvQaY z*q)_MiRmnUnsj38*HlL>@4>&2ZO%Y?cxLaoeMRS9hq`XE>7R7?28<`=cK!n_ts?nJafI*!0166l;Uzb zqZdcksGyP82RLc#AU;8X)xuhU@4DIGm4fHx`2&@>>XvVpfM zJIMW#x%p9dDBf@{(avREYihy-*gRbRx>0z#yzqXup2k~7y=|t;UknQHJE3KHDW}gv zY4@(v>R}!dt{y5W-txMCeVltoyFeqjIO8u5Ta-8F&{~}8GhMML1bQ^K;*4Lk!zDQD zJ|Ru=lZxTSY9CwCAYWBO*UJzBCaZ^ieN0^3Dgfm$cCm!X?;{9EN4GiAF~3_$aOgOE zfYpQP${7(Ia}I8(Or|m(mv>6BUn)o{pa7SbeK9Ji!kSmc91wXj>I6D7+UM^GL&A=2 zrRjf+n4e>oQuo4L+zmNxSDM**#qyo}ucz>@KT16xT8&eUZk6d@v-@^8@ae0{;TE@W zr_gjm`xflajw3Do zQgb_pu#>kn|xn~Hm~m{gkOX%_+m*q zCFu^s@hfx%HxL$cK-;nWRzFlV8-_S@AGxlTSpqUTKv?os#>U|xu^!|>s?BdZM*9&~ zR?bABaJTw)Ztor**7&*Q>2Kj2!cAjp%X$MY(Eg9LYhBmAdu}A_r)^M_S3|=-p<{F2 zX75O%H5vU4Lt+n{H`FHWJb$0qV`HxM&n2i(q8z7YOc8L?%uezEjU3KM2`j-t-Vbk0 zEyLN^cV7TCG^aken$yEs((T#O!2{LfeppC~Uup$WDE)>?U1$kNSDn{xrkxU8-BM-H zSUfLBy6<+&cCZM8-aOdbJ!YDLd{rhjn-gme``}b-5a}FP;K0;PFh#ucw1?Ov8-Kf| zD}FcTZJ zSQj!-tbGCadq4K<2Vp`Mtw5v65)~gDCMM8*{@a`DMGsuEX~@f3xwGs<>5NIir$4{G z=9tjpq{i(p*IZo>EtwhP>{aDObT8O4+lWMg-Y8;QWv^YQ@r-R=YPp&@72+hSzw_cF zycW;H>xTJiB(cM>khbKX zxzv)~D9mj1?M4^vkP~Qd;z$yv=B}jyNZ;I~)R)>o;E_{$Loy|jUF}hh_$)-iCB_9?L`cvpd1a!2Pk|{$Zy3VPy=cDFZV)cc<)}e3Sd3@UeZO8@VmOSB>q z4V=$0YJ-(m$-|Wg=_HlMXSP@8AWlkh z=0fs`3%+`#Gt>CqPFvr2(Zp`Q%DS5Y%6fNeS)LQ&k^U+c0Cnynz|xs+Ko{XY*%}GV z?#!36Hs0X6^A-rZb%$wDfM8cuoTyJyu$0C{CVuW|?&f|A)3vlL+4aeANDox7ra}on zrdhP&G5D3XK(!IE|A$sOutI5BG<%Z4ffK}%uA5c}pZx7AQ2J&;;Dm@<6YxPyhqF1K zrf6iZ5(V+e{l2U@h%x<{?vXUfmp|*Zjd>b_IlPmfbn} z*?8)4aEss7wa7xxvC0@5xW67<%LaaY4HzlgKl`O>o=?5@kUX`b<*8NUq{OwHTSzm| z%ivdW^19wWX;%c71S1U%S-o`uNa(ip_T}{KeuGyO>+`Su|qSp8DW6 zXfk=uA?ifvFa4M3fI39o4?u@S$+`*><&kxHI;lo-^K57mWW9%#A#!1R3v-Jmm-8RL zQyGJ^Bt%D}OH&cSXA8kED0l%ON8KkaB@&x#+UMPaCZQ~UGz>CnxC?iW#0T}RAY2!K+sIqWlZ%tJtANbYW&QL+7rW39X)ZGgWjjhh1R_W!fCFnmrdun3< z+AK6u8HKuc$ta6YQH!1>0yC>`7I!$UZ6c<$B`d-BG7J+H+ynhxHpzOcKt z9qT{le-AKTVF|u}c$@%&852XwgCK5&U2Hx1X}I5ZsLH|+g@Rn-@4?vsV24IX7RNe1 zrFUX&K{wT$)D@$t*BB~ib7M5Yk{USt3qO06+}$r6B0M9;4KIa{jT)n*sflTq>GU>I zLinlH_74@qhEMJTBbpL@$-BG*714L`tEnU-`(qq)iDgNV=*XW6L!(~&SX{PVd!skg zO0{0}yRhKd5|wb|b?hjo>;O}6#}d%!8q2GWtkJJh4oVul5}mtzC1^M>qMf|=@V9ef zkdiE4AXeX#;hjqIDXPB-jDP01V_3p(geyhTEh44p^-($TWP7d;Z6=ZGL}2!y>VifXhISk&{uf+b1qFV(T zVz<*_qCrWM`tpN62CbSp6(JH)fuGQXiAKq%Wr;0_o~+wg5Y|}q)R%$AkAx|d4H!=W zFQ*UMc(Dvrrs3F}%fAl^sE$BG9}2@_)58>m-|{m5?{!cy zOxA?0L$G_GJ7b0?zeEUQ+l_7a5}HsbS?52gEnN7-egd%ih_JksgIaTnoXmSMm+|or zA#bA~-rR{qEJIA-bC)-nV-uyB69i8ID5};0=)19KCoG73+$7?JSS!L|2$TB*nhsru z`UsY|#vEMS=iyoHCQ$V>Q*h{CnkuHlx^EQeVbMUo;|HXe1xwSZtxpy|$!))+(Lrv-q2cm&7Y3wf{ik8Z)fgvAaB1xD;kz82wP$Sk z2Tn47?(DzocO-7$L!bQ#NEgSXGNrH&_LYrr_o)laFug1#@a;8*Wr8muHyx#Vea!Tl z%7Z%>{M$IIRK{71wt}Zn>$T5(w!74Pb}lVV?9I&=?%E-QZ+(Lo;28qY?a_Sa9)0A^ zwHnGM@!b&wItwlL;Hi{A>)_>eM&U^n?z9JoTXAbe5e%eWN-!!qb~Ld5Pt14XOB%XH zahPy`E?ER( z0qx_R3phAoFx(>RRtLuPl)w<~j#nukKIrOYjiXOPnQ)ywS)Ll_vu$4`6hGo0jq#Bo z_GH~{=Kul8v1fyjvUr=FDV#cD({(W{2rJFO0-;i|5Q8ZXE((cv!ovn^M9_ z(e$J-4c^+{8quE~riLZM*HQZZlyq%CL!`BL_Fbl(+|gPOYEGikk&=HnD`{n=f6$lD zTbqO#=U~H2hS~yCC!sYyxEa^7zZLF0gQffGD=gwVX0yK+zB{)Zx0LQx~TvtxXD|Kd`n6K1>2p^D1e5+QBkQcqM-9_*5`>@!M5EEaF z@1l=RfC+;h2}_TMjHfo&o@yW;<;M`MtZLL7_`EMHHDOsSm`UfFx#PFWCI6?lBk{3nj{Z>}&*{#u^fcRM_J{Gs|)`JQRL_A+fx1O0G=Lj5oL2!N* zDbUn(n&TB2qlx3KNY+ok<;@q?Lwpj-wCB&XFOF3+9b!tx2()aHJ!!5#A&D2y&F1G7YHJV`Ki;Cu& zeD9L*YlJQubnFX*O9zj?2W%~z61WLsuRop|Z;_koR6YC8MX5kCe)jpxFFW27?0=8W z4t}};zNe1gV4h|A!uIy%7uVOJk&%&A??y#|#6saNCW<{d4-9Ow3U|jpEbf5f@9MDCH8P>*Vv1}i4#q11amWnE%n@@kq7i<4fs-<{bK_Zrhuxq z%SAy~pTl-H^x?MYXouDUTWh=oaWw_jpNvcQJ({^pn}F+*!`4%y5N%fDN1TcUK}5xt zBa4QnHeNU4anS~E)go}_l%ax zEdF(5!Xjj$_htRY?(NU92ZL4mpu#fXYfdXgsD?7I7K!JMutz$2e;zL@t{ZRH}=D-~8wAJS$5bH4@G|Oebz7x>?D8IUvuD z_H4e7!*0~TH_p6WycvSKG|K9FoLB82SodRk17Qz3e#|Sw$A_OhJNq$shFL@^D~#+* z{cT+WWGD!)0b_b{JIT}Ebg`aTz1Y~V#(Q<{ke++z=|;((&{)2%E({3+Q!#*A8gKA}Y_JSls-3YO5c;3PW3aG9PiZ)YUnZoOt|25Qv9o$DtrpLY%Nv(96HAI84Ti~(Z zKQOzYQF(I{_;8coiJ}=+TB@)`u>YkI#AB_%LqbBrX1^>HE}_m2)^fQJyHUD}Mnz$>2GY_?nDuQyO2Zri6yQ(Fz%HguAUlM6p2h6Sm$ zcAqmdm=WGLWfmz%Mg)*o!;udFeW8I=8JmeNlpdt~wbAIiqkfA$O3)T~g~;<@?|cEA zK7j)-pp;odZPlok+)?`U05;X1x9JpTnke-XYrU>t?L{jVwTRwFU+VSh0K?Nc@pG^X z<@jXhK3YYTkfD4r2y{LfAFnD+C z{V`j5yUKq_;%@L^3;cJpXnjYFJk|dkmH7Y_(!N_EqB#G0Q;5b=&De`U!!uL-e*8I= zi5ET2Z<~)o(As(}lMY+iZgrV+pcMFz9wlfh+R=c)q>Z5XzlSFBdn}9;+RcO3d%V=b zx;ia1baW~}TB`i^4dz(`X@5wgRr_xw=6{?)Q5#fcb$Yp;<(gihELe&zT>9-E&Fk&H zd%#CJPhk70C#~kZTCy>L0u$HW2Uh^S56VEi`XJqdWq8PWW`(`=!u=cidgj+rSjr=lPx-H>82eg7#CT22$ap=6twa*IpO#>X2- zTe}5w>p-W+|8@x)R zaR19nNMQ!*|IKt&$}cc+GsHch)}sOHL)2T%4Hb?<7!8+*TVrlX-)Ae3s=ILKac=5k zq>Y|F@tBDAk*2(rpg zt?p_!SJbQA*Dy9Ss!*SzR^7os4F6b{Y}>zEltSOFmD|TjU?w1bzmOA39k}e?#8= zKJZ3ZXm2(JnmFPg-TH#{@6*~&vFdKh88j8VghcjrQuRt66IuMgfOS=Q1)jXXXO@lw z)gu7NkO9yJl9VEl8@*1**=l`gftK)ms#E5Gy7w#b%9kL`TTTH6%>cQ{Ma`Ai9C*Wm9 z7~=K&Tz8_zsi&o`svqNcvnU=yTr^#Xb>ArDaQ9q<-tR#C96BfCC#o$6c-dM1=5@gIem!Mxw`(9jLjGb2reDOY*wuRyc`jona*U|jLD#`) zS0gK?4-rNe!n_1x-!d1VOEcHq({Pr7uBQ`oP-ZX!YrfB5>x4Fr=5CbAz@~3nwStv6 z2^zhC3?5a~I$QSkd0p(U`o_RG0fTsF4~2%>Jb;%EG_%P&H3d`ezO;o#9iEhdh`C1M zcxE1{=UCJHPLStd-oO&fReF#n*-W)KCswmCDSt&Ub(N_54SM^SV6ub>CdLXDYhI9A z&-;b#GXgWB&0gMz#7uFCi379MR#2e%Sh!QWtoO4U@!a+;0+F^x9=QJUxwX zxxEU`OH524C>RFEkxA$8H}t;>eZq|droWj-7T+H$3Lp#qk?4OG?uDg@tIh|U^+yA@ zJ3%*wC=uPXnA|B(MG2Ar6Q&ZCmAtfi>||7BHGq~h)~wgGV1=xA!qLK)r5OB6fhnqL z{^_BE%Xm&*mFO7}z0ww`!W`WKQd9{zm)+(3y@Mx($7qqfjj;D2{F`v~b z@R_86uZIN0ErSgA;XDVgTo+FbtjGhTPPKCEt1z|fQ}Ln;_#eC z-lws#G3*(us7|dd&;|;R|MG=wmkThCyxh5OAyVs)1$1g10BCNqpx> zbc~EurBvW~>h%tIEQ3@@O>QXEk?E}1(50Sq!vz%i6o)U~mEBn1P-U~0pZ_b){ZC#2 zQ9EW3=h?SC+6pG8|LhA&h>l{OZ$Tey6Z)!k;U_^%uQcih4+>fr}<9)+S(a9@$}xrv~e&TnEyAv*ZFp* zUyeJ1BlA*Vb0%N`uaCrY2KRgY_k;5snFR#k;oxxjB%|2{Xe7Wev}m@=lN{y5#1g$i zf%_|qV{G5Wkm5=SEsYwvrgCKUbSmaw(#wGwt#~Oa*J$u_MWx9$Tm5PXLs!RzJ{1KO z71dK>?2?S0a3O=HW~+walAB9&7{k0_&pYYkM?~#!8(aheS6VrYX z(tH#0F(3dSRDAr$dq_R=y(?#oI0+$nfhl_Yol>@h zP#QqS0ePbf&$r03CP%mYiZauTrmv94`}P6TRc|jLRyAl2FqKF@&xl_y_t917`T_qo z)^_EUe?TN60g~y_4(T@A(a(jazkguB&?V<1-$WDCwkH6}{N_K#Tcuy}UEQn__68%KdmBM?v?3%rC9q>OWhqyDcDj7It z??YR2iV*r9zvv)j>J=e`Ij^ukrge-H*!fOUynCxx%zV)#)TmZ^1MxO(sesvd{~RFi zBIxBhii8O3LOKCC=cH+hiQh=yIFoKHxYD4Ur%1=W=Wbl6X2MF<@4epfsh0rCECNxZ zkEh^|7DdqW-bF(fG*0Vl@I;Dt+IGF?+`jfG_NZoRoU}rou9a{!tdfWm^X#Q(Ow?Oz znPdB|8W2#56{|yeeAgcXC+VKP$THnf6Jp9*AAcHFMWI-yG00nQrya8XY!lHw#?9PQ z5_+EBNGJKcl8FZU+8qawjH_J-Axmu)DXVuPcdl{q@iHPJzFxUXeLT3`nA3&ot34${Bgj40s?!L(fu;W zE4F9bW&QbgDZc9xg^0ODO|?ii@V*!R24S%yoaRN(9$W`pH4HF#XZOKW zV_e)i<}t8vPQYmA>at2uWc5J(Ra4|KOlbX6OOq~=tncE!n?W6+XA6~XcTD>G!JR}5474y4rS|0#m^XX>)Vzk4cJ*O&VO;~SA-djkQtQFEX3050JK>e#NdGSR8=E@w%dv;7bNaF>YRez1PTpBO!D0-qi5pKa*?dc%>iz4v zyUD)Yw%bw=M`_^vDjTks$c;(J>xY*t(aFh$5r97ZIKj*FTIV0|WR7%bMLm70P_;`G z5GbL|dU0ziFWPeRvlE*P3qm<#)|4T1c1)hOp3Ca-u8BQMv7?10jC%thr0I{iWG?S$ zvia{c=;nCT?-LH(h3O$))wUx4UT*zyu*ipYMSm4_HjfKp_?mjsq=Q@>e(Uh@W|iXb z$e!qg_{q+jnc-=y_9vPb#$~3HH_A`$o-Pl$;_mU}rj@~rjZB7rQH{F1PfV+IiA6X+ zRg=p2S_yF?k*VeF=ZO1|<(YbI@wFxqNUdb|^ti6xPl<6Zjmf*!9z~mL=Jh2vUrq`z z7Ke<)rnJgTp1nLsjre&scioy!-~IVoH`&Q*N_b8r>PNgGb-~3OodYtSBJZG6U34sn z2$|1X8E3y45UM+Ay0{)!SAM#)Sqg=x!NMjw4~`F13wjCI2^;9!onC#C4T*Yqbin5& zI%CxmO~^S9zvviyK6aL1)0$Sg1DK#fFAc{z6c1g_qo(I843!lxb=_I-7j^9+LrCx-+#ZCWWbHKWTW)XaE=)$x484LHB$gvk7@iB+M$ad%gDzj34>eV#%};amhEkLXA}&^>pG zhf7LIg1N@;`i;Ph53S1TC2PHb$HmWKeFFn#(3OgFKd6^dNaoI*W%a&zlhpAZ{udDV z;;lc9;G;kObW55ppc@ktQ>?4LLc2#>Ho)90E_iJ%lJh(wI4RIrDl#TVHesuwsH{Qd zyyIwqrFHB4;^yx9;OE7nHo@1hbnkthg^eCk@2b)g_-&8PwA#~a#f_0#fEN^E0V)Z% zHT_q$NEUa${V~@E*%hX4l_Ol1obnP_`inS!|39|gGN`Vo&DITW!9xh{5IjI|3+~Rw z-QC@tB)AjYWn;nJ-6goYyE|v`-M-zo>)iE|D)ygMbIvu#JH~ikh}z%EcOqX#s??jD zivMx_eaA9Zc|W;u0?A|wj=aa4UoQ$tyOl9))16_Cdlo4&$4kg+HD=j1{DzNz784Z! zykx1PGAsu+zGr#kuEi)+UGsUs6;L1id8WuPE-z2m{S<&B)*R@nR@D7xH3OJ}ULZ3f{+463=Qfj_#U1mGGA*uc=z2+L)(xU0J5T{y*cj}wI zdp1cgQ3r3gX&d)@BwsP+Evdo1F)YwB&KOj;&8R$eO?~w3i^l?Tgb+zU(psoL9|Hte`bi8!G zp$RRNEC4+QloE;nBe1b_aTM&aDGR*l4>1@)xPU-hf{?wg0-^r{0G?M-b(4NE{|c`n zpa%^N|4z3kxI>!VO1(BeAw!k3Duc`dq!JZa0pf}6-nA)bUSaq>)Q`n=L;;6uJk_n& zmP*Y}=!cNb2D@u7ZPrs)3)(blenn6L@X$zq)?4H%BxlCY#`lT)af}VQ=GM~?v z5uYZ+&oWZN$sz{Pf!HnC*G6nK3E@^q9^>+CBMZks*N^SwH_|T_yEN7CD#AI=4h~gr zdNNF1Irc^$pHLyR>`m?wyTUzca zYG%m`nTc~TLD2^k5_frQh2PE$!9L|=n0~RYuFPs}Z(|cW1*odMCYkAL5;+;2bYLx~2=>&sa)Q{E&z6R~bR-pb+=P3NpJ-)3!~W>_ofSIWC>sbtq1b zha^eME9Q8$RkIz+ZpjkB3S9&BiUEQ2b4)|1Px==(7qe# zR>?lAHTFUgTmz${Ap1}AP1Ys9|5^v=EVgN zJMb51&3TC!5@XW9fH)4T zM-70IohCR$b8e)i6pe~t9vvK<>~d6wfk{BmTe=q@Zh2d(e%bMIC*k3dfcFJj{=GS8B$-e9Gu^#1P#%BNP^79Q z2Al>}Ht!A;U>{uOpCkWNBxP@V^z=>3{KBT%%(JfB2L^SEbIi%LR(IXu*PSWP@HkV( zfhNp%FGwWMbvi^-CFxkdI|z8L-w}6key&X+9D8h^TU;AAFMqjaU4^>}eo*+$!minZ zDYWf)%S4i39O|0ay-{kZSwYg*jMq^Iz|ZY`hq?3;UB^ugS&=z(=DyjkpkRu$H1i3q zNhx5D4dE+2uk$|d+M*Wyqgf>j^jhB8CKQNGQ7yo%;(+Xb8*y_L;pWa)%^C*E*1nu= zwQH@YQ*AWdG#ec}UYEmiu4=K9O7pd6#r-bm!!!2n(!4mdSpwMWW}O1A8kmY-XpQYv z!D#(Gye%aS^(VA80w>Os<2sFspM6VgfJ@4Mi3k6$W-1d5TZ?uK= zAcDbO07(5OK0YDr0P({)`Vn#8S9-=I=B=}Uc1u`@=e7zhL2se$rfdRZD`B%*0k5fR zVm}B2Na%0mnt}YdkS5$OKBkd~Uc|5V!tHErQ+xwbfo>z~9?;isiP06CP|#u=kOI&B zuE>91hn>+rUj9Ec3hVEgb;3k6ilKzi7&o>@YUfaM6iOfch*8cRwK8C%evC|a50sGg zxn8Jdi+VGej@M#0>s6)`+=ps6ri1_`-sTyNR97Uu0Q5ic7P&=-;PtAsWQ5b}170w0!f zx43|IMQB|PQ*Gibcz>C%XVp)0rBt5srZ4z;Sa&ef&e&wUm`yV+aC*GU5fd3wY0}g@ z-5l-S4-i-LW>moxqiY$}Rnl49!}6Z<|sN=iO1;VT|pufXpFL6>+BH^FZN# z?*C*Al$TcRr`poC`!3AGb%ijtKj);t=d%&-`aunQp0&~PdIDx*{>O&PWF)>P=|nnp zn(k24dK+yK35iMoNr264JVbpt44$dd-=cIsuI%rfn^O&DcGPtfAdrs4V-an8xYc~P zEU73Va6FtYriuKaW7SJ-Iro}vfQWzBe1<(NMl}BKC6VDtV0Sc=kzTW|#>O07XC#wd zZq;q;2G=~3{|)ouU@yVpAU~;iVyBoYv-Fd7$BFS6rrdz0Z95szLZ~vg;`#>FM3jh5 zCU$Ul&ttt<%-Ytz9V_LWPR8YWKnm<@DyBHo3G`2KvC1u*L}8!Yo!~#N(rV zuiWMQmSfM_+J$YyAW&TBoJkel^xk?q3()9}CK9=w5A&9?Bie2kORC&1?i^N}=Y|b( zU)Fil&L48Z7!%*?zSzS)gZLP`-1oMk_@=-6^4PW|Vn>F#+;?9R8Q=dzZ~70LB=Y0^ zV2BcB8b4rP)jCkbpXt&Rb-7e6#Pp=Xod9&SM8J(cmQe>t%uRzc-I_%Wn>1UDl+0$5 z=aGRhvN^_4cL_j%)>sjBm=kw1ZAlIIXyaUVtLT5i6_(!@tAsl55N6SpbRBNW!ydsF!o)KKz%m-E;Hj!U1M7xyX6< zziNE1v`T!3fXT3Y9XO=_&o2LTJf40XAmkvsDe8^9t+Y z?*lg|i0HVvf4F*6NYW^fV)IF|)>N8Gh&#!Rl@6}~!p;_?Gv;j>X_s2mOLu;+toBzx zbg=^*VzEg$yKwL8FOsaJ=pFLQm+N*`>&*#>dVFtEg&DZWVIb&NfA64({cuZ*`oor@j3v$^R=nZVtcT<^^|4INt>lIa}jF((Fw?Nn4 zK$Y|SEzs`ww4Us`Y+o3T&ngL!0O;`8ZEAeTs+@;aoLzCatcsx3f~i03Oq8hF$`m4KDH1>1 zC%VLsvd-z09E7Hh{{}9LKL5OGY*sX2QEb&0f?bTsV+x6%nkzTXllQc6LyAV_K&9FqSW9QS`WB24>*DS z_$BL9R;E)Wx0O+&MtqFx$;#T+Bo*%7s}lwrY>Be$K5+{n%!&5thHW-=lMu6kC?e}W z0cp;h&Bx_dV_7dBuZBb(}{XViYcSmrMwmVgZg(c6QlBgJE zEepp|>MCT!b%oL#@sP$eiIU``@JZ}(;(O9Vg4hBWOjcU@|^lBYYT`+G}= z8f_Ewi)u*Av)la^;YXZwx{2#!5 zWyvkXx;74`M#lxLAPs!B7KD4-KE!VAR(&x z>TUble(CeSEY#ck`igfSoa+(JZ=+)oeIJZ8qgyKLly%e+7{*ISVheq55^vz1d%C-2 znrd&8KKo|?mIq3hK1DT+^31RyIw^Y`$UORCS8l|eCJ}Xqu>k2mS5oE2V|4KknzzHD zzElzozRs?2rfO+kbP(|Hl6K^j_w0TGuYhaLwZRGAo=(;d2KplpaA`MxF{{CUdL(QF zQfDnUrcIF-qytba-E3I!be+=WcI$R^KmKm&i?*nB`i%9!+`#k;M#Ba0I)n{x^O3c~ z9Sb8+0_i`Le`d`5ye>fGH+^z3W>`+>{QKq9eJ;LxUnGI53^W8JBviiT9K)mg za)bThy#Z1X`bx9w+_<}Yd2d#!POW6{$GvpdHm<@3fX-Wp=y&`No@5Xhr7Np__wG}l zNwc;RSd`;BAjevNewovqttCZ|L4S08$vleSnf~~t#<)A=hK7&J_)z&^s#lTWHcJ|a zVwN7PG&zSg-G8Uj(b1uC6L_t+S~bw7rAhPux|eJSJCMB9R}_dO%u!G+Wn)v`wBp2a z*zt+U*u-S0qC~Z19XgUD(vKJ+Cyw{x!UM%~LN_`gBF}A8tF94$zEgrmYDR zL|-% z{yAN$mz#Sx+-zq;8GIpm^y|)l>48M6%3}N=m|QmKEN2plz(x4HktOSL{&;W#vRa$w zaO|@#a3q`BDw?$-MM zoy8g*r3e)29ahTIJpv0H>taZ5Z&_nqf}9#le@Z1C=YZRu2fpzitT4#)@U9p+FuJ7}fyOwE1IDoeCY$d^1RM4K9zpGHHA9>EJ=!8X#3tXI;VU(C zaIqBS<}-D^eKB-1dk{FlJ*8jM#voCz_K-R-^riq3klTQ@(8%toNt;0nhBOqJ-5CUj zVme$kOlAqa{No(7!~x$YaRk+u{fN#Z#8-ZAcH*$aM zVvz1VtPRI4@ehQ}O2FcN**qzWHw?5MIVS5Y?EusL*|In8>Hc3uZFBemDWB8UBnT{4 z)sjwQb4OwzyR!3+F_70Ut1a8dI-Gy$aUD1F4K{u?mGk)37o5dQmKCPvmz)JENx?i3 zj9x#oq%JI9X*$sLe1@`sP2z;Ip|Wq@nx@Zp&0L+WEr%cxU#hb%djsbb6^ZxaqlpMF zG%RxD7>b1jN*E~S6u{tn9@`)Ot$zQ0pAE;k+<+qz*U(7uF&$qGYJIFXjmqe2U38y7 zn+muLkCLftV>NzU1iwsg7eMJFHsw)&;|Vm@0l4--fUoCG%%4( z!wiA8^W$5s`<2NbyG;aUqw_4>VF1<)K9be3$q*{U=h)`JsQS=ARBOAoDy~_TF`ThB zSE?}i54ddfuC;qK3%X}|U4FuXX??lXbeIeV&g_^!nFU=|a%i^N-ZKd(!+P64H!k1% z+R?y80~kH<|NkuLcdBeOSr|_DN7*w>WkW^epM-tFFb$v9!d;8tl8EBzse>KH8&n>B zX7I0VkB%lljoD+35&0wxnL=FmgZtvX>EHGHJ8967gV;;T1hKEXlkp`?wM~ z&0cL3Qozhk|7F&B5!&N0h}iB`KzrozBHF5GhxfTXz_JzlCjXmCUd!$=Iu^iTEuVK2 zpegr2C>vNZdYR_1>ojm7Z(#2+<;eVnD6mx^h=lxwr3VmEIx6j?@t?$F^zybI)~4`v z8l3&Za9KW4JXeJ3Y==U970V_L9#sR{d=l>_8RYG-G-*8?C47sLXb@IbmW@tRzCYNQ z$_(o`70y*0SF< z={i)uGh5vW0AZ6_uwFdl;kE0u|1L!X$v_MV0UuyKpvJn7W@XQ&L9q5La2R3i>hWuv z>km0g^I!A8(owbs*8IPn#z%UiEL>*Z26VU#%3_B;nBGP6#mV$DW}(~>XG?IN z5=OkI`II`fAIHiUQY*F+;a{1T$n23#1;awnF!1RhAZ}8{KLcc5Xtg&GCP%Rwo|JX6 z4P{-2y6I^c;~+Bo@>dv`2WHn(B<7v%L1xQYX$eWm8XFJ+KX>O(UV4q1=ySXNNZwI_ z)Y&qS6K1QUX?_-b0NRI66k&Pqr(31}L?cbFWhLa~lKi1yXVJdE;N2KD?Qm!kmkVfx z@t)Ss>vi&e{Wf9WYHDgc_#2D%x&^>A)RmW^q$RBSJP~l7Jzp80twR4VFz>0b_>6qC z3Vb;J&Wg*$MJ2TO=3~R-q2+dOl1}2!pW^RwM4IaxDPHX_J)SFc;ED3K$K_6k{-Y z19enX=?!-B|2SH5-u4$}%rP#6!L)PW4pU=v=`P+Z)ST740o7F1C)5;nPHy{XG! zmo=xuUUFj9)9ESK#)NOW3Hpw5JojgGG z=Hl>j<4Eb~#x&8WZe`yTSZ|7biHOcE%d|#bdntjdg}1lp_^<|Pk|ZdRhR>jWe8WyPIq#0- zF7GW(^R>s}_QFBOcEw~Uc}DnE_^YevS%21kjXFx~K`y*XNg;Dfd{3aH8hN^(E?X3< zDd>PO@O$ag`aP&W2W9RatTn`5j-m7yQ;nP~`NfE;ccg>dR zDDI8P^RR?zfG5`KlGGmnZCN1FWjLz$xO1cxcx?I5ZSHGV<}_ z{QH>W7g7?ECLAuOWUl$+g;q^TNy+VT{<-4!*x?7UG{Ic2_t>Fkoz>)-=a(>EGO@^5 z_B9VpzUOnY!r?TkjOcZ=FtvXmd9km)d2^qtldV?jWZ0}1zivhG>jW!~!6Tt2ai6tF zCB8KXnvA7TSTEMZ+^u@gskw%7Eq}*C1M%{iMs~L>F}yt9)Sr?p7DV#isy%G~lZ!C+ zm*&1vUTAa-U3M5Az3j!##Jj5}v#WkL@cpEV7@WC-Q7xix!#V46V?SH#QziT}-=xv9 zzfk}jqM@lk#oPgR9RTiA+XwtN2V7ozKY`C;h8`xjOs9~8+uwZH;~sTL*D*ib0{Olr zbF9apzo4KoFEk^tLO0wk*K&w(js1#wqnDZ8vTn;yrEBlnn|S;bz~s16Jyj14Y|H5j8YU* z`(IiCYT-wu;qX*2nLZR3o_#L<>ZBZ?I{uSgseQ62fI~iHKZc-@ON1KFpR_*Oj#Q^)-JI^Z(UDKzb(E6n9yQPRSLn*OP(xTMb67H%9w9T9UW1* za2z!|Kel{+ot-EB?{iSGqp@#k7(*{JT0N@^82WuWP&5GoAs2rhsyMhnw! zr2Qhb(LUCY#(K@fzu+$t>IC?v3PD*~Oy8x`Z4ZZm02s4n0EOKxP~GM5ta*XUVZdDw z!X)*v!1phclFjSwk9_ehGZ=pa0Q2K?$r#SLi1NppUyWSVw^bL42p7qOwiRgfi!|lA zbp*e6b|IehF{5iSdG?Yln6OwD154AoLbpa22EwF;{uL;LiUwMi4;vJPI=)QLba&@j zHq^tKc(wJCLL*$=MZW`$Ow;a$%NBqM>0aMRzAK|dF}do6C4as0X2&T>&~=`pYb#^ro9erk-SYD) zSrutAUrs*W@z&@*ZCthfp>TLelAwv^2EO0^Q)*bi#g$z$$kL5yxc|l^fuL4>4R4C2_ET zN87vJpA<3~OQT>MNvC}k#k;ragj{I%ZFfd`pQGV3jC?Vq%R-77?YcwD%ssq~yQM#DbgauVaZ$O3?F6#? zDY=u2;n>#pg@pn$7MF6G0*5AFLw<)LL?E!6jI3^bbPCUAsRO*JwX8_#tx7fzY>gUX z>GT{7CK)&nhc*aqW}&Bn?NqI)StxvUXT|%^y?0Q$;s5ZS|I=P!zEC)m%e`Yu=I!hs z`2g@R?3#GFcq{H5+H2fLVtvlw>W1OTtdUQaS!_Qh&%m)u&!4&?U(Ke{*px?pyHcOK zOi{4;@bJSYn$Z*rb(g6^Q_WlD<428a9|jd{FCD`?Bz6=lZo}0!i}d?@lAcn9z=$*6 zv--Sj!1h{`yHF=oQ|w2F(Gt;B9=>+fPiPR^bER0SSR1adzH>CnMxk9yU4**08OB2zoCh&HN9AN?PLIiptPf zSTK2aImE3=KOhmHF^F65p08HYCD>At$w?|Z+}&>nPmg7rS(-_z@0J<)IY6H=K7C&l zXw!-w_XjJ<7M-NFE-51_%u<~V?x_kFpRm?x-!?XkV-35+&ka~cxWpP#pO`$rgtF$p z@KjT(X-0W%OsPFlFr0al{`ZsPI~B&e5}lUti^aYeEEyRtXuizs7~v;NsL1U2_dyzi zf&B9eAqgcbYNX2;{5d$tg_U)^(eijJNJaPga&GyAu3>vyVLC2{wMBA zb#D#Y@=BKwsQD}E3Z(YTeue|XKvT;akADbJy5dpXnYvMW-(4K+1Ik(P*y@+r5g~71 zhvDOIGYbN{F_|ZP+!1^?E9c9jtB?5kRQgq_o{vROMAl(rsNclD?BiIkTzXe~C8>xk z>8MvM(;O|e4dn<%IVIj7v+;kwwpYwf>9~{2Sq&}lzILbmvZbP>Y(23&r>ro9i{NNQ zfE9EqQ2tYrIhY)5eucYNwA@md)&a$zuDWJETvYO^14E#={d9|3>nzS8HfFydYp%Hf zyYP8VqMzwJ)lOKgc>BsV#&3j0TN(oA$|csi>|sm-ixQ`#*4sUD@hzH23&Wg*Gg^Lw}B^WwG9vBQ5F0!W#Za3|g#{Fw)c_`#JAFPU5}FpxU0$ zK(J7N5$pq^+e-1L?{D9sPZ!+{USB^>?7qFYVT7>R_frLWhY?h2&|D384veqxwRdB` zv>qQHPwecL|E;g@-_-R{*+{SiO&L>ClIxu;*3vjlwF$v_gPk$v50)y3z^Zp58XC9` z4$?2|i?z0>L_|cTYHj$1a+xas=p;IfMh|BWUu6hv6-lD1eulB!;C-cjTYNQJ%%cXp zEFrv}x0_nRL5PQ6jM`Jbo9A?Kg`yG&ikp2+VYk&Wdm{ftCP09Y3wQ`+o}|CNgmwY^ z5Bq~DkrxFB^+XMJ#T$x1C9~j5c@K{!F7}^4f9{_dU+deP9+iS4wInK< z$}Q|Z48M*}wO^IVB+U?isJJfuEr496>c&(v@m7%ddN2#lDo2&5)5xwPAJX8w%Onk? z6K8^JoFxSX&1FccylCVzhiegiyOUF$txaT#_Nh?(1scmHLZ$rt#9pn%9gU{4_W^sF ztr=EPk$HcZ_{7!;=Y!E(u+y^x2l{EG3)t+3y14GCtgg83nHvanFzwM<|mZctG#6rEB3lam-PH~a@?n`huNQF5))G2 zAZW-4SFXA_!|zETJCj&Io>EK0J_EtKoogXv%*ERR!6gzS12cRbnA6_WlO{U;!gUgo zje{ayoF)$C5=#TU>No@?N2M&u_3Y&nq3vm&EA3plkg8QLijCrR{OX!f;b|1uBcp?_ zD4KRE-pNCZ0)_;v%O|yWVksJtbQL)aA-V@@;v9R$#xeWfSU&L+FsJM8E>WJC5Q1sP z4XJc3toW=SN1`vEcNBcS$vsg~>>FzuC^{-nY22#fPx-{S{&B|5d`8b5`{l7J`_Nwo zY|4(IHM*tsBM9ATEB1@NpJg(!FEe?}>rq(b40{od&IA+|$5|}%v@9!FX3<`8h%V=SJs&sP7MHVQslLnG5;Wi% zvt)NnQkuGOd82h5X~5OQTd%xLu;1-{Omx~l0L1&xabopbs%W|=e%tnTKCE+KeCA3E{KkoMjk`rgOH-v9L3FdZ<7W(!So#`7t z}Si?u-^wxwlr-HOBSmbK0NeVyzeB?GhltMeT$`hoQ!?hKn^*_nY4$@{3; z;BCI?OAe}$JB4DSnCO>P)&dmKx{~k|LKp(sZLb7Ga!e0pP&%IrKS(G~|w zxoFgAiK6Ep>jX^uvMSyg>eqIEo?$^QD~WsYF_;A^^TO>Bt(N&#nnb?!sFVyW%>8IX z>b>=n`unWJ+43r#E&O;%jW^o8vw?h;KhTxr_mo(UZSxOzFpk?i+T6@&j23$a8g&QH zSW~+W41781nwM?g#n*y^$t;TZ^5ueC_#@m;%?`8aX+MOW-KnPU|0eV1Gtv`OuYWM5 zeQDLGwFrKFc``g(ZB1t0kxApXMKr)+&}|FPmr5!^6OyPk{|5^Y;gpBd9>+UpPXG;RzJ;zpIO!9(FFDk(ATjI!I!rFVw~1uXOOOq9B_ zq|MZw)awE)X1ro}qia?=N!4u~RmM_b&=LkU zby^K}{uWS{d5U9CXRU>ixdMxhSGzLFw+B=-)8C!;C!X07ZkK?87~;V7>A!vp7&4NL zKLp%$C3Xp%3vKD#Z;E%`-cq;C-9_+DT;FR39;mo#Y@<@SoV#{qQok8Kes_LN9v&Fz zD3HOc)bED%{%zhKMaZeRot)0=`8gDoNRfoR_*4j3DZWIxsE)D>(`!wN&bN{&=Du)4 z9Yl#Qsri0gNsDWeQ?}}`yWifpdvOu$2i7R0A}KehtY7+!DIRQdgV=SnJtb}+7{jVm z#$Kp!Kzg&GdFyjz65xv0(Z#jb#Mk1XranL9DfW40VG7@{;Tuex5katqRIvWlocNNj zFR=jfDQRa)Qj;n@1{)0mXCXPymX&Qu!1tvt#p%Ycdq(QwzTS;(Uzpo`{&aD`az^D3 zoh~4J+=>s1xb2tOU@1!5)_KKsPimhbGWT5$?jxa^82;45Wavt%1Daqe7hY^|^|wB$ zpLw|?_PmR|6}|uAi8(aLu+#eyLwKK+N_u7O+$@VrJ#XqKwDWBEN8$Rc0QOcV;Uq-# zOa0pgwDxCI5W?)2EAc_xb)Cn)eO&!oS^6ctXm<);&cE5*HdB1k z;V7?{l=|L?~achksyLweE#v2i|tR{A;b1a;{vN*D2Pjd<75?u_KDk z`De>^HzI*r_=&oRu++T_BnS_|intB}Qj2q{Pg&}`%*1a274gs9}IBuCJ+;6{Yxo$%s3u~XiF6MemQ0#+KZ6u?!3J%peOm$gIHmtfj(>+(Z`sL@==nb6AUD-fh!MR{ux zB-_;PrTYJAJ?ltpKgZ5`Q&$Ua)UrUmPZW5Q-^Y{ z$%9>aMHxY z^so!<5^zlFNFbjWqlw;zzgzgByhz#bJRbt?i|wR49e<4Sw&SRo7_~kXcEQe6Ur{P$r4|~1}4)mF(iR95No1u>Lm@$zDLS9T&)*E5F|9ylA3%`-$ ztRJW*dv)>+G736Ds80Ct(xjw1jp_ajsQk~x>q^AjrX^|uT{Zk0?63_QHB`n8k*z*St* z@9*z#=jH*u;HCANTXIasTVrpvI)8D^^V}3-*Ko|Y6(*x8=Tjy1J^j5K&kt8-3t+5OcT1^OLAV{{BUlh@O72BKn-<8W zhQJ`T4X^R5zX1cqnX2HR49b>kQb8dh5EiAO?#Or{d+jYAP}<|sYTuSxpLC(Yxwe|d z45QubqEtaaN}AIiIvJ`Ci=}%f{$cUYO&G&i{nIAsP5nTK9@stKYOb&1`Qm1lkCARn zS*c#Q^BK!NYT2xggT7o1>K!xB4-E5`7<9fu&-DMhJhRF5J*m<34lA3Wc`=|MW|r|R zgN`)%fUWDQL}YY;of(~x3%ec7SDpyv{K@n>R(xa;N7Ja4qES>{%hxP$GU{!MKS#gt zh3I^gZ|3)jCrw~4s%BBynO2Giowug3Jgm7Aj+xG__M?DYd#%};p}zG?*M0@}-)zm8 zwo%U-?;{p=t(#%iS$1*H6|q2RU#NjwsqCQ2;T&ZJh=VX%5svM*YEjQ&`!^l#SLTTj zPQ%v3m;5rOMGZkcjKxRwrLm>dlvi7+H)Jdq(ERMvnBa`VB~O|jo_53HZy7BvVuId? zZ2y|MrAI#NCSBQWTMmh^L4>9)D=^msGF%NRBsDe#HIKW{K&teq)K~qZKLOSWVVAx^ z`QRtsTH`-2ttoQ5F;h#57E8|t&0gPz;eJNPnp}o_A9ytSM2mCM-$K@=wcp+xTqp@E ziSRua+Fc~pD7&;I;ntrz7yVBh>YpiChahFO7+vAk!^UD%&A>c-ifBiUA?45IAI8@1!i87ilit;_uo#caVHiVV?jtppw?zESJ?83&*VL70PFs|92OJg733?r zOJ{!xh>eLHQA&1L9pn)u78`gnI;a$OW_Wg!D--m`Cox{!LoO+9(~6bcI`e`eYIcK$A1W3TQLDlXRc!T3NNSNpT?b@c3Ajwne_Hi;&EP4oo{?( z&^MgijmkgmtahvC2MYRsKQBuh3rj^7_)3qD#I$1I?d>8-&H_ZvVB5ki=8KzGqmh-= zAheS<>9{#55dv2#JTIOiE;ioJ^7|=Vz;9s5bA?klkSH2<^DU&phC|`weyb=iv-ETfaNx(5KnuBn;Xi zXoSV>T<^Kcjp?+(Fd1y-cs$QE!+^mNV|dkD%7_HxF!G>$)%ir^Rn*1lz>{wsL}%IA z6}&%Jp__fOSZ|xD;Zvd0`Wty0ejyU*3Bls3E0oO;et|`O7E18P8!==v z_DMT96|GOF=oalb10|#@RxH!)uu)LWpBgzD9l&qRJVbFAgIpd`hZVx6wYMqQ=HVs@yZE z>NKkwunv+^kGyNywQsq6Oc-Y0TCMqRH15S37 zx2LCMiCf8<4x)!mIAG7`FO{ zqn3Fa;SW23QZ$Ft>`2tfRR2bj3}w53*iuloELJ~;Y6z2V`N+QtfzH%g@)_~phIDhx zwPtimU9gD>4nu;1-|Kx{RY0?9g=J!rN2zfxNw-O;VDhOrX)u`7V3F4oF*skB-v$eFQ2k$`qfm_Xd){| zFT=WGgR*v!EBxD3__Cy`Dm2IQa@JbDVdXuZmTMd)5Ak`us#?WJawdkqB+L!@!k1qU zubC-bO`D4lBI&o7R;c8QCi~@&u_NGs|J8 z%E`#fOeo7U-oTjsL=0y|9og3{dBRN7SaBa9v&t39hqGPSYFbicjQQV-8U00b@Gj6n z`>8%xVqj!U3FNR{Li=y$Bp__reX)I+$E==bW>T=NBpR=q!-<#r^vMV~ep_Hw! zT)?rYyhBj@?fuFi?3A0*OobA~(B}89UwXcjRG*#rO84rJxRk>+cbJ1ABL{BEp_h6- zI_L@GlUpB!Y-)PFhj!1Qy%-Ezs5X@G3Nu3=N1u~quq4@x$kgv* zd_{cDxf~typDo2QF_$KWUR?9435Cr^Pw-fae~pwaVjR1zr|e6X{=Jm2SZHpy#QFuL zc}CS$l#Z?7EE!Jj=PDf*miEV1wqNcju#~k{2*)N1g6RgEhNSHK1!qYP3=uvhkV9yo z_m7ptrd!}WRF##UAxkMD7dFI(2zH5J)Tq1gNCd~8zAy=bln$SJaZ0io0yCRiC3&%_ zimGxgq!7;3R9YGn$64I@897se7$6wjvLdM7lz#lr_w1VobH_}*>ugVO5}w|xHtV^b zChEOvomi6sr&u%R{7$x|Jcab}K|})T6PdmP8SCX&D9-o)HU{!8)X%k7j3AM|@d`b8 z)ptES2QT7N_x`*US6KqyyU9Kx9s3}7Haz3kn5vdj&sTkRFYnAG1j z|NcS_EfqzPK;uVD5}4LHTW9SM63{@1g=CR%R2 zHq)i#P33&t=ppWvi+&qb7S<{^Cvco6s&-@dL8rM_%=_%?+7TMCM<^_8Z*S{ug&-fk z(zkkaj+H+@WxoF%{YBM^J1*z9{(y78iAk^Me*2bfqlVSiDwdtOxyO3m3wlBVl(;c+ zv75mWqUIU5%s41Z#b=D>$6qQ^8Bo%^4;v_0kS>r7!(hJ{&W$a&pvVGEQ9+EW-4%&h zhLKVCI2?qfcj&=w@DRwHqhe^(zVb<*k+maH!QV`2>&#n8;_ZPu#bf;^Eayv^_F%DjbLj@!2q@+AxWJbu~_fe^J?vclk-*9C+N*$v^~Y1L@*OaGhacI)|?*snTL@P+^W@ zM!)Q$e1O+w;gxX$&M>Tg->7%^%fEp;CIVB8IMkG`v(p}L3I)H`_ z4HVf7Y7D<-`tIOl6rY+zS(M+xhYc&9{Lh*dzSgCH@?b4F4f^~{ng+bzA}tB{y~e%F z{yJ;lEMuuwIh^-5HHj?#xYX8k8;cw6Yn4Q!N)P_=ChNO|CR?ZTa^vYIqr#8{r*CD{ zRF>ML8xsKL03+=d8Ul-thQK!ni>SuDxK);B<~UNkJ0|Ra1D^uRIc-Md?vixI?(?yn zyg>HZDfpK_#PWvzY^ToSqv@N_%R;_yn=;bliH|Q`+c=S|OC3!Mx&iv~*T^7vSy5B4 zpWI?RWiU7-d96#=!VeZi0IE9cfKdXGIwGNxuU8W=eVLyiK&`uJvN+#zviclLacnGN z;IV+KM3b!ST&ubf92g@~Ur9RP{$OwiK3u-vtl&82Nh;unasyQbHoIitPt=J(G8vQ1 zWM!Oc!SrWVgmx~vyIvc>nw&){jpIDg>LYUARcsgCwkStiD2^5nnAu@@)7@q;n#FAb zXKdVuVIgbUl0$CYli#5J?3`oX%yJr;o078-PS@!lN+(zSEjf{1qFU6SKBcEb6dBOa zBRqIvUN)MwEn8Ax#Ygg~%B=v6Te|mV5kHd9m}hyGWRL2HBJB%tBKphzL@jCDzJaTFu$>?@9WM_X`{m)>kaMCc%$ zm?=*4>D#<72|-0^>(7p%NH93eU2ia!u3y!%`|6jvN}y1ZQdRAi*has>)2->WYJUZAsDD$xl%}*?CtIWIREo>6)roL}ods($Z6^eF2<> zwd_UvxQRj2B}4S=^ruW#N{K3_r4DPuScOb zmhVyVnfN;;CWH>k{lV(umw&}WASAVk_PMpsL!20~k=pv!_LR*Gr2j0znV0t+5-%{m zP{qH=NMhEasEX}=*bCs{ycEW@haryA@tPo_U6&qdlv6cXiLtVC2lbh3778H@upV*v z9xK9%zPM!1qlGI=UD#DA>3=8|S0aqGJX-#o_`5W%i}yZCdqf@r4FNTQJf3`bfiNS4 z3xq$JJC?xxBxSbQHk$#a&r7HHN{mtK;_E&t(o?vz`LDALzVtY&09&lC#L)WRg@@&q zF;?O?@uHmvENoC};!IY^>Ark3MqQdjXPgun620z#eXQTmv-ibgyd~A%Vi5{Rer`zt zCeeq_iVL-*VSZyU6|X+f3$V{1i#p(!JH_PIg+jmjl`W6MnlSl3bA2U38Q`@m*Ou z0=+(Y7u2&+(4dJ0j46+Cu1ChE(^6MYRaUM<$YWYa@mJ16RbpdNFH6vJ87+V=!)|)N-^-9LKhcC}Dj~%+%Nm#M~_Mr0ZmUvWI}Z zur@gIHu#f&3iegQix9nzfL+LevJSiRt-X4!cEm%Ru=6YuwYL&H0ux19erS8v)5mW+ zL1)H!X^GOh@&i(l#jRuBM-K<)%|*8<~K1gTG^R*>>)7SGCBL&S6!6{f5cJ!QC@iDqt?!G zk=t*@Sc)1D&6(fuHyze!JWg#_byh9Y*;G!1FkxN*n%(lI3OnyRJ#FF9|0a@UL6{jL zLZmre>2o}*ZmizwoKYW{vKUj@FjySi8X1H?##!`MwP1b@LNM!(;b+z1IZ#H9b@=OO zs+hP$>@xY)ye&VVjp6w=lAGw!q?P(+4dv!*tyEvmq)m>-FWq-qqZ5VcQ=iLo_1jTe zw|D)!xS#uB{fpbBlkk6+R{!nihKF)BulFM$clk}eM&VGcv-KDpf_ZXs0+x{xx3MX> z2?=3L>9QNi_W)O?uM*y8!MA#KpRM0JMY*lbLu^5NX1)iLnc}x}!XLyxvsbC;7~Vhz zwY<_qQ+IdtY?c%xKzqOQKL;I)g{Wgj%aY*dG3CEUipV}9LVw(S=*MnO#VUx4TL}xh zHrdwaj-t&_D=(#{(|YveF}FjV70`06CK!3Vviem@_adZEIZiGhKq-qQ!6p=;V=NWn zkrHKsa8{3kUs0o|j%2ioiR(1mN6@ZRMvssYX#oTgLOQsyo|^tmxwNgzsRUyD*+!7T-{tS3tzt^lnbc6Ml5h zx8pAG9RmOz#S?krYS&q^IYI38WmuJE#UJH~ZfhL3FosPVonW&5(nf9X_|Z`laSNTJEkawm7gbWz zqUS=fCTyRQKSNSpT}F_?vHKtJuSz0~0#4ki_fRd!^*{caU;cJ9e7t3s|Fzur)@Nt7 zPBZWW2m*hoq@=_rAOMH+`)X#tpvl?*Iyx3s_C{WI4n#(J-NAA>`!gTm*701e-H9&fCEyQ?bn}W{8!=f-+yEr9#=tn zIL^+`(>+gju~zPHA)a`r>aAFyK`(e8=V*JdZv9_SM|l z7JU5^ANkwg{_9X(_W%1ou~z@53yl|t|K`v3{J+lg_k--8%KyWy2lRVP9RIgB`~Rm? zn#Sf1@BQ~uAeuo~5Vw=vta;+`{;7l5s;tWe*Wa!T!#_UWF!r9Z>Ep)vw6L}W)u&$k z4;Bx!N``Olxg$k?d=3(>MXSk>CMTXjPLYcgomh$dbraQo_~%vREf_1%m7jfv$>>HU zEQscKDoMpeix$%v4UVAZRa)W~Q`Ap&5ykZF2Z+c9f6|;eaN4N9 z?)>cxSMT{yQYHDroF0HJ(&KZvULellb^MDq#-#cin|>E_I9rIneF781e|`cIVtmI} zrapWTZ_S#A2Z&C1a+D)xv@dHjV|~p`->(}xgI^n~l`mM>VfreWkDU|*{K0PS%_P~L zV{YsfDVw)wl&kdDRFbhx{*OD}=?!@BvA#iESn-Lzn5`|_iyfOqs`MA-_KL-|b9t!E zu<8nyWF@fl8%oXN+9kU8rnJ<;n6O_p!GQO_7R z{7ao}(ZTXOke+DehyYvp^cOmO)6*FS5A3S>-W9tMq{RnDO{ph;QFx;(#Z%_s5dA$V zNFHUbVat}frTd%`=l8gQ!e7^Ek_%_}uix&DCL8w8SO~lDd~6kSUPa85U1nygyFofOT~Za6^8n9KE?jpR$ZJw~1_z4t;)+JQ)O(-iBNU zc^B@q)!&lCJ1B$ll4hEQONIYyS`6v@$E=`tIya9WUXE_LkvxJ%#QTi`zc;;Bmkw33(P<9pm~`j(+I;|U(#Y;`4cI^^EKdAc@b*Ozr zZ){|F6eY7Qj@Hs^g9sAOYk|Qxr%u>8p#Hq`$=XVgV@2Ab-GrjcAM^lVss`MlF1s^d zN}F$@?hPMK4lBG}VyYU9_4 z+?Wpx6Y7xfw(?0zxeF(I1IDo@u^Za2{;|AGB1GxFnppc+dAP%yVHrx?(HM%DjY-8m_yC+2E(u>^ znMwNtO^^)BV&k(Ty4DnF$E%KTo8k1gEd23Vk5{Q{iT=;A#>u2}{oAqbVlp%3zKxNc ziQ3D0+SBs#qo)oWgfg4IN~+3R9zav}opNO@R!oAlQ!A@8zi_SL9FMGV_s7OW=L@)g zRkx)mxq6Fl`&9bm0-Ure#RWrCftZTp`ua5* zcoTWD=pa{<^rC8+Wm=)k(O5%BXZUpEY{%1-#I-WQwo5fhp7BY{Q_ zEP$~y>ing?qP5u+l^7SAhRc|da69hUMfh zSvvu^cmL`rZ{RX_zvFYSrch;>u2y4#^aLX>e}{vjwqVhk>~te%;Xx<$7Q<;aIhq%F z(OO*646og^-ulR40<@yNSel@)GBXM_>q@OhPP_c=`B6h1{{?)V4^KrB&|HfHR{Gk( zAF2n36}X3mI#pC`Y&Z>AL-Pm3irrE~%9}GBZ6g)jOh~BJd}UyE20T9nSq#A5APef=?=`eM zqQ6xPrXz@a6hU5&pqvd6x#=#K&z|Y&mMabL=+-< z&a9zy(@`^Y8P&T>4z5vYU)$^wmxiw#P{p@;7eg%C_u4#sDN zGZr^x>AQ+hlQ~!LoH#o+b3lD5FOTo<8az|6F;5pl&DS@4*m?&x%&)90c2G=K=u+?9 z5$46h)9^EPsK4yTRO?M}!7bPc1|-W!_k_Uo`IL4>U$Ao5#bX2O%Nrjd^pr-v!ie0R z{7`>ZjWl_w!C&Sjw-U7&kB*bcKer({SKRH0J;#Yg8p~Zew&a+ornwZSQ*pT7jC0_Z z3709A*%3_Yz6E6B>X%RPhMUx!oGRcXW3|p?udR{lX|i|oAZj9zE?=DL^J^FBJrCQB z7YlxuVXO20jmt2X=O~K>d^PVD4)N00>(B@uCJtO4B@6GlqHauIBjbaVrks zyDCR1vG!%V|8wih2X>70`($iT=KB$y%5EotPlYH_6Aa!2a0;ze%2-w8DbK z)a(B0G0ZdCVhZ(e-5hdpyJJIlSeYC|e)0Qv-uYMbpQQpit|5Wwe*5o_%jdIo^^ zZL_RG2Z~Krpgt-W=`0vkV1VWtR{kexBt&C0(CdrHRu$%%t*=ljYAIZ%0S+_6gi&zX zNw0VuFID$A=98OjhH zZl(v1uH0VT<44}_a4igRz0{mcdxT$sBH_Gcp}{XJJt!3$-z`gpC9y99wfU=zY(}7- z2_>aC**eCbJNq3;QeV4E10aY$d0i*eX;&~{b0f?7uioaq&wteqpe6@ftRm;YEqS~I z57pLb&(LxtRR*WGm1G5lejm9*_%|mycE52~NcoU; zpP%|q%w_sC{D9wffm@TLA7#`gZJt|0=S!;PQO7uULidYtSG7yf`Y1t@BphYAx?a%W z>$tC;3vxSoZ^zwaGm2GMNaseIUg8}25Ka{pg>pATNkWq{AUb_DnU8B9R z7jwmnKKnxy<;74Not>L&(({$~!+!Iv5CcMiKBf^}XBGP58XFrQCb&;St1NqWED>8FeN{kwH?&dGO5_)>ot@o`m!qc8 z;YMbjR(Z~iEP?g3t({#l(z3bvQ}yu#b)Gsb=Ee$Dt}q`&D~+?QhH-fotHfcqJ7b*2 zUWA=}IPlwYw8XH*)ot$@cc{+Q?)o{wuL1X?wWXu)TpT`EnAPiZp2z0$s%jOt<@F~Z zKYu{>gNp$Izv$&**QtFb7k~A6f8T!G7SJ9-dM$pH5!yg8BOf$4ZQ|FTcaXVxkI*4* z>s)q!x*}arqXQ2t4J?!Dq-XqfY-`%LI9^q~?16+|O?Ck8v0=-94Ib_oo;c00G(L7ORx5tw>EV|WC(N6ZHU0irb zd2Pe$b{omOFMhK+g<-D`N*fMGhK}(hrj4FjT>6wx_yBXt??H~DTpL`a(VKWIu{!Oz zv17CvoCAp}xLdJri}O?egVTI03J3arxFF0L4``|3A%$2pr5B5T{2smGsWSEHH)=TH zh03Aq4E#Sp#cp;JWJNfq0BEW8%ZO0eZksQ@Hr+mBbibf@o_ZprbaD zz@@C1h_|d^*EF^%Up;=D+3zBm1%t-5aIOe6&j=sDCCYQl$ti4>12sJ~B)PA(Kk4FD z?{z-m?h0Ey?CWl3_Fns(-dIJeVSUK}Wn9_2!3JWjrn(j=9a!axxWjBTwe%=o70Hl< zojh~sr(q;^^PZ(AWQcZ&cBkA^ezaWYzHTsCgZ$wAFGaSmDb0~rC9Q^Df&f7RY=ZVu zs5)9ue@h>Ny=2^7txwyVRD=lBb&Q3^T2neGC?bW_rbT;?nv-`rQ!oc%+n(jNr@c+7 zj`W;QzhL#zJZP#Po<@sw&P#6E%Qi}m1R!J%lVJAR$F*w)))^VH^R0i)=66T8cod5G z_8i_OFGyXF@o0F{1|(B`=9A@PFX#@rIGJ!aCqlcaXj*U-Pmlr#NG*T-&h`|*OpGU- zdvDdPp*aM24SUD>W?zX#@NcdR33ovrsr5CzvopxYpW9JWm^JWVkqKnNx)XX2Jh-(+ z1;Vc3>%g;S5*EHV(Y$kdiDzD@uHHSwlLgB1yuc#C0PXFT*_AKN~0!jB~TDtB0rwuo1P9qgmPzDG_w{(r} zxbelpZzft{dE-za*xRy0b-#k*8!xTlkl3R*fHVYsvd9sr6t;?Jc#*9zc znD_Z5A|?R{8Zw?rFCA;oP`N-NBgiHkAB=-wHkvC*3`BzCKiJ8sZS*EuLk;+YC@t6H zD7)|+L=<*WneonINx7ModVtU~4>~e%4}BagCKFL7Ub#LEEW~q^Qe&oXyGQ^0ATAgqS-=@zN$7yD((aZ3aeb}Q;Ng6QFhNTtJ)#5rE8#;!%37Dus@#i?>FF905qkS}t?8!roq{#8;Q7_{gA!?-$&PTc zs5r>)Q{~{wMosd`7{98Zfkp^0CZ*ND{DI|d8rAP_>arH=GsPIN7AFS0`X4zv-3@M zcF`tL$;kz+Dob6%w4eYpHZ~FcN4BIqHh@4ALu7lkTK0z(vO)>+RI*YW`61M0C(Z5Z z1B-6SkEvzW;)L}y_xCIrG_)#B;t$4if^f)HJ9isgbKyMf5kgf!e+fX{Kh)L-F4PJ5 zT^z7h-=zw;tFr1KUo$bukRMf7^IgYH)YMkPyvizo3iD0So)*N06_`Gr97KWaC6@qfl8`z#si^EO+S&8o&hch$QB zU*s zinvutta*ZT`Yu{-kNUxTCxBNxZ$w%()1q_Catg}pc{1-gZhNTMuSWd^Apu7l0<qmIPcx4PKA%b>kuw)G18T`^VtzU+$YM&L^kpV~zNK@4B3r|R> z;TJ>?MRKdIN=c2yDM~T+Pq3yKW{vjd;lx2KI%5K~JtiHQIq?gtCr;u{JDa6;1O2!p z;FDuVJcwAQl~SQjGrj%_mnf7X7iP-yX-5NQ_VI(Cq*@bipbhFl@uF>Nn1K_)wx;M` zzQ7ZE+HfO(4mPoL0AS5xLVME^EH_mHVgl?6@>t*Vm=M5r$mJ5QQ*W=#kwW-3@9NJI zB&feKN5AU4vTJIe1n@7TOsQ|Tvwl}*Y!{o11=8J{HAY|LbbCY~HJ7sJn2CJu5Gx7=&kA@5nze1UA+vDemqTVpEYdVm8v zCnBx}C?@mwLqhYJ{gjfGa*{1{Zdr6;K0Ze%udzZMV!3#h7JwQ))+DC?^rNZ51W4QF zg*0@`^bj(SaR4^O&au)Mv)%*kCL`K8A9IkdZow_iYry#@-G5Z%V&moIHC7sBLNmIe zTclT4>5-D0Y2bChuTiA?X*e_Or!49!`nXGB_jd0SS_u%R2a)MIyUkFy*WRD?LiA%2 z`4l7N;+fYMklVcu1|lZL|xw`OyFeWdK077B=ds$rF(C$0_*JSl8K z3!kH!VzVXszpQT)){^@crCtbXw-TxbzI~kZQfV5|q`8^{YN{W7=B}2sra2pp!G(L{ zq#vkQDNGUINI;qgjY(52?97j0otv?*8JfSD1ZiE?>4Vr^iN46;&X1{Wq@{j|{zfY%s#5@E=k{IGPemePxN|xKa-1fZX0J&*y2}K3a&%M z*w6qWta9|Ed=&Ht-6U8}q9_P^a*o}+!UU++C?j;`r9&;Lt6fzB;A3wC|H&RrB0i5N zs|O~-jGtU)TFudIkaj_d30 zZHo-zJh-WJ0u+tmvBSU4cEv#Y1^`AJ-~?gHHN#fR^^1vugYaqI`Ou&ri|_?bPUy9s z|IA3obR7Bgqme?lgs$ZQdJdRG;zS&LM#aLW=1dZeCl6(yV0E}tK$AkoIf3~Q^m;;S z^()g!We%P~VLv0S=Wf%V0?LEmWnic8&W{l}sXq%+9?|xZ(OprGTedE99SPckJF#F= z1n+){JA*c~CLxdP>4Irjs%@|oRG>6*T3DUz-y@Cy+)!)Qpr)a!U7e$)ek($}m73GR z>VqFh5MCK?V)lIZWxq&L?9q?vXr=7YsESVy)7Z9XhZ3#djms2cLB292zZWo&I0gxG zO4wM)=U`CEiO7V3j3)$({bQ#)22E?-Xi>#TZ zl!*cw~lSc`n~Me@nt^78VTEk6|G} z(h&hkI*W>tospEC@bUZ#lx66oz9%`i^~6XTN3>Z487~E|^HuNPm-8T!q$D%1#1r078a(g(IyZglN&{XIktK;SE^W=W~j z(~&2V8)^!sqQb($2MhkV@cr-rdn|kge*6887|XBihJ}0+AAXg1Bk{_p^{rFQ`P$Wy z_}S%UzF62p7mZ?VON6%K+n@aM$$To1Ob(=!50Bm4i)8~hl|sAzL~eL(IK9?f2R7N* zwT{QJYTQRG{45NS=LNfR&5{F3{`Ez`4&?A!HFv&@ls$mxXissS%^u)gP9}D^ZM@vo zgg9miL?&NKNbuvov?@^GZ54hD^BIf2W9I={y?w=|fG;{rf=cf`Ml1Fq@AXsRXJtF@ zV#Z5?xS9Q8_fK*xj!)O~g}n=K);_SVkaqsoxgO)jIg)!==1pnCeVuaMzn>Tg`q`uO zJj}$#+>TH=dRuT+a)NnUb;PP4Axv(sLx4-@hx~yGrGFm0YN%c-K;!_G)V1c;*E(&3 zHjLenb-qEGf=yh*hS%b}qdv*VzFGTzV_pD%!FtKo8xQ5^Dvh>k#Gi?$oKDmteX z0$M+fc0k~Zk;3e7MQ2Y-=%c9pyzeK8*U$PyWy`LcUV%HKePArzJG#k-*-POMVJjXw zGF>8~*@*N2NB!Y}Q%Fm<#i7iTj>2HoJyuR8kL-|tR6`@hjrnlfWq=PX5F);^A0s!| z?d!ZW~(q2(Fb#aUjRrG zl8K0CeEx~+za;Ud^uLw04_9v{J(pD+tzIGfp0rQR(;obacn1m0O-$1B0slP3D`T05Kwm^mk5bIqyd)g7CYdKMnxEKH*gKP)K$nh3340wGojH)Fh<4 z^CiVV<$2~dX;0bU+RE9pP8C7XhUCH^+klkH(h;BbQVo<8*s!x+O~x_~;ax0slFg#C zYWqQ+rQ4zvq9;55J#fQgvQXz#g8Iqg*4pP<=k2^pAiG+V(4bG|Rff;?#g>n3$gxT~ zD|EUR^62?)&AL8>KRas&g@XLiOcE`v^M5VDZ+Tn$LXLHoKZPf^pFkL+frk1;W|0~xm2cIF+_dg}Wt-C8G^G;J|IRtFZlEjP6rcQbnjho0i( za_jX03~SA0ub#fH5|2i70LuYqXF1~GA$@e!NAK9B%Dw7|ob`bewb8r!dfo(JUI;Iu zWJ}`xMZr;$@Y*i!&$KF%Z4~hUz`2h^%E4*+3(~pA#E4c49mVKhSE)+!o;iGmBE zNx*k{=FfsEyrb{E>5;R9bN9|4Js_=xP3mZTir(f^?bZUvB_0;Iu!vLjZqppTYgLn| zEPV|%uBg%tA{{Q42jnMCFt~tw?e6U(mqydzALsIv7@%3Xcc-FG|={8LD z74iyJknt=gK$-=-EV7LN_+SsTe;#^A_x@Sf4vBI$KIvsm%iP@KYqDQU{Wpqk z(skI-wI65>@({@+&Vq+%`%Ei%C5disL?IgfM;JsDT zGAe7a+BypIp@lT#GPr?w{Y zbA7ZOKCqteVZvPSJp|Mta+Wh$r6LGZx+hE9+xeoPsOaeQ)))98PhRI+nJ5%$=U_14 zt<#QG2D9neY7n~IRi=VLxOaVlq`Z8X$H2(1{qimIw#V3rdFgiFk6o2u&(DE@I@m>D zdC}*(ID{O2gKvEF>fP{wmGMol1}kKm+h$5R(4H=gmMvK{QjJk516t<-GNqyWO8W^0 zFvsbx#X3Wk3fnYQ)Kxed5LeY0wE~TvXbk=dKNbl%<#?XTo9W7z2sSyu_o|tmJLi4T z+@8JfPLC2cY!)NLNaQl-xpBR{hFe9KimtZvrP0-MZ<44481FEn%Qs2Y>$lgoQA2Mg#WV@S&Q`nP zm|@^-JeaN5nXv$a)2Yh1EwhB9!8(oq$0z7tm-)pgAt#!1328IEvJ84?7c@;YGYzN zUr9_Y(1CY=EqYZ)w-nn4*gsKN&I2sR(Wg(i-M$!BE_B3CFXm0VeazNIQ3ToS^2T#6c*bbJ$3l0^2)IN;8Q>(=gl%X`LPv0 zvfiWp#pc&^34sf!y-Ag^;C*7_s1}=7@kFi9FC82|oM|JVrkyDjpu9LhVWr{;R{Gh)5OI z-0GwN>#U4q`f28`Ua?!^wzdW;&qEa^cgJbYIew3|X1>vHM>DV2+c{#suN8B>Nwfh(ac%NBlv36Io*sV7&DVQfC_L_5 zVomQK>s7(}_+~HlXLX#)#)<)YUB}p+cXhkCTEHE*tF+EnsQ1|x_J@tq$&Wq-Md~f}DSFkuJ+0?3vSqA(H z;#XQ#?q3KMPk;d(l+g-pq#=OioNX*C4dtnrTs7J}r=aAPeWb^dt(SeFAR%#oX?fYu zytr`PZUdbuJqbwt$j9I@S4@-A&>*@Ca`F?vpTbkcW7M;zL|^VY0y2#>26=~U<85nU z1dWNpXh-Y5nmbSc{Aq0)RZGh>T_KUV>^&hhB5I4ylrHtX75TmKOYKp1h+6wJ*>Y#o zN9S!`Lm)UHPrpH+F_l*-iANDq&BTrm_b}g5&%d`oL_+aw z$vGb~D!%CC8VqX(cA6`=W^1av?FA%dD!&Ruz8BmyvVZYc+1w)a=LT;2Ivuu5cV~0? zO*I9**t6WOX0Fb(a(&oDbw9br8@=)~#@UIVdXK`wK(9Ezbt?fjhS%-`iM~4A`qYcx znDr94KxA?vvyETZ19df{7s7Rubc+o9V+_AN{LYe(9v7&-=WetrIhN>w&t4dz+AH{5 zUbw)M?kUuYFX3f1{dC11Fz5DRzll{+w4DAP_C**DhYwL=6%>KipZ-%$`5>x?I|3)i zifZw|668ipXvaCmDt-GswB$^^04t*7*V$4Vf$)~w(pqzmg~lv);nmFI-X@lTE92{f z4{fw4_z%5)zYrn%QcgatK+?WTs~*>DG6_|6LIP3OAP00@EUS%(JN~5i`!k`M*Z9Qv zn2|T2lqWmJ3Hr_a%!>s673u2Vqf3I-BcG4u*?-Jv ztjdI+m4W!seLv^I@%UKJsWwEN=aLC>a`fcUuHMR8aZ;pDE`P{*J3SQ^vzpeVl*@~H+PSv zrS_Kr0RbCo#o?v$unT-5iXtTho35vbpdi`3d!Ou`SOj7a>eHLUnP~3^zxzv5ddmk2 z`P{6U6B^@5y`wubEjc+iKDlQ?Eg(RuqN0+gmOB8+-};)c#+sO4()-CDt)eoxr8H9- z$p6kk_x1H1%hv(i3R#5`h!eY!3K)FLBue(JD*gHxEOv|A?8EL%jqx-C2Zu`FXRAqg zpw&2r)XG3#-_Hx@?XgOy?TH5PDus2{(m)h-mC@p?~CLm@Xo|kOJ#=jrE(ALp;KbjX|Sy}~1 zEHuZRe1>jrDho7N(o-4Zb;Z22*>Zjte%4OaERJ~b0xJB9Z4!eM(Uj2JDtGCr4_fG% zza|u(l68Lq-w6iH?&lE0fuCk@Yd)ah5&r>TzIVgNsNxh4dRaU+_hqwY3kk+{MLSDa zm?;_So_~a$FJSZrTn68%JN2r?2%eoAYqR1`kBJKDau}HKIi<^iMh?fXMgX;ZXUy$+ zrVMv3e&B}{kFNp#wLb2Tq2>Ybquqv^Mn2y3dvhClg+s^m7m=SGfW5vWI80LCcH*Eo z?3@3%Iy@TO!hH>QrXlu`^K^HD^n0zX_?|XUFTYS1G?Z1jg0K{#}!iEn8K!b zUD8KP@b~8bhFO1S^Yco9eDW7L2*iOd%ka;**$8#P?v^z!nd+!_PS0+?jS2A~`DvT; z@sZ=d-v(*xlZ@n%?m~Bi;(dy~IoB26^u$~O@uq%rqUiIke#0BfPo0lOcOwm+2fiOq zxl49%axA18NO^N@LmY@kF=m$IE^ivQ)=PUY)Iv_|Zy|-V_$j&aZ9hmi7nJ3{{ zz4G$lW+cKIvXSK-gma<3O;<7sz=-O_yP*{ouUA&S2`nJ2=P5))MBbHp@hhf@6y|8f z+{jsL6l|^R~IEJkj$%C%|D*YKdJ^Qk0P*nW!vzpv&7)D>u z0$qV{TtSf%*o>qm$8a~TsDmsUnvmTwo;-$N|(^rW=hdkz7WProiIy0GFGsFqwJ-RWyULGW)wpt>c?!@7iO3alDd?O+!-Y#+O#h(Rdnf68jEElU0U{Mh zhK3ZJ-$oyUKblPpky<^}mKN?a4u8ntF~JeOJ1;xEh9sg5m;FQ9k52;GnWteQBUL=h z33^h#mzOSeKU|gvRUGCp{Z~Aw2>5tK0a9`>EJhd+qsWE#Ma$~9s@7a$^rwACb|K?U zpsUK;w2aIK@)z1|A>$m;=Yi@gzeFpGFs`5RCc++CHx5m3nFOb4NA@KpM~8|aYY?ad zD((;%9u+4exu{DxEOUZ-P_8{Gw42|p!rSaFU;}DJH2+~!d%CK=+nvh}2!f_aYRaV{ zC?C%G%muhMeJ zb=(rPBi>}jCnNBW6uD47=C1Yp`GioB1K2HGu3=8-V@y&~=mWHq{7pzh{u-KQ)?t5% zQ5z(9C7hRmmTpBo{hY4(XthAg>e7r-&~-CIRLwz(n?kDz?=dHk({J39WVcWx7(|Tz zsK(Rnht|=1zI^DkUDFNxKCdcXmtlYcT|v3kG04rT*lsu@`=;Q_&N{RT8*(odaKC&4 z0CXbsn4cEV8vDij{uS%MD)I_7s-&K0xiOS}4h5mAoVSSxqc&%A zBY~A#qLm9?tSaFr(*Cy6ZhfF>%-di-=DLvsbUy_Lo7Lgw3l5;U%TY`zaUW#>wh32A z5nVGCTUJQoF>d>eeerD6hf>%ftBXU>^MnP5QY1?PtU7yVjJpx}RpSntiHc>07|*J- zul7KM6VC;fD~j(eYVaCEt|_$MZ( zG`~`mnX>Smc_!j73%-dWKc33G$jp$k@ck(wYFmGixhuO8nGKjqRIa0~70TcDb3iYg z+}yuQVZ{uSr21Hef$*$%(}O5FMol`mBJ=7cEquR<-p-Ui8NZ=o9ndUa{{ht*wZJ1> zv|3N*=EUy-h>$>lu~qj~kAoQg@KO0juT6s6rHcvdb?lV@~I z*T2Jez@4AsaL%OD z4fG;xIDlwVx>uuce?SnBAqdlva5=7-pB)5Ij+vNvomvt<{f z@`va0H48zN!b&Lu*%y*BdF@j{MZB)#5#S(B4>+ z4#Sl$>9Jb_thJ+F9>wp6M7k^&BVgV#LS~J;%CFwh`?7`F2*b>4gKi6AcOd}T2!ta^ z)<69o=BSm_&|3abuy!?IP59qyw#a@sXTd~~#_PzVIXk!I=JCGV}F%<44;s(5qd z#Q}54m^I*%-PofZ7xw5!e`EEYVnP`Iqf0y1nvo*BT?CN$5*BD(+y61Z_#W0&MW3hE z->(lrAs7Iz26L|{8}v+$WFs3wd~iUSV_3|QhLwny5T6OBW}iy?xG`o^;7g~Boof8D z8*vXk5G-bzc%qH|qWcf>#*1bG6`5aP@Sw_rP#Z6nry@o4WKqU|tq7tu;n1Keb6&JJ zXr%d8I~vLjhQ!Y~wkeOdQvix$xP1t}3{!m;bg$F*ZGKO)-3ctGl^K}4W{ofr$0>4Z zk=7o3&HddPh|OPTEQmcIFxGFgib(e|sz*?`5ku{?u+V^HQsFTW0ibj`@j2h5<+x55 z*?9b&EW)jDHtZOCME`V{YIOdOvg@Oh4x^p2mjLS0+TKEh5JHXLnunjnFW)q{T$w39 zbIh*MH>p4bG}Bcamsh4#@p50!$KQ~FcHsL!i1aw6u%;se3zl>w`8cIs%GCkQz59-b zok~FN;IXv&+)Cu|d;)8oF;y-fr)oPOMmac;ri6t^Wk2uE66&ICQROfn*)ArASO2!7 zCFWj{@DJnUeBT#q^^@T5D?XeAu)D+kI=?oGbg4od9MrR4s0AjsR*io6e&*rJxwfky z5$s}+)4iRY5m6V5EkdDAo#0y<7Ru`yiEcyWTty(sV6_E$>& zSXITVpZMw?m${FA)3eOqXC8mX5jR!;$2`;=Hj6pDn;UOC;wb8AIr%x*}`de4=^a%AO7Y+$_Wk5O7m_lKu* zo@pK|+k^f6OilwbkSx1(-=Ou*a5W=tSP0$rS8vkS79|2V4<2I;89*^U2@5%73G9{$ zEhAj#g(XnDe^F%1mBCe2!AB>WS0+t^?`|B2V#tH ziERc)WbwY{JPTFtNdeLmRqoOgA#?vuPsFI6lmN~6@C|7~e#Siweh4uoGbO*#$8iH< z51_*IxGUE`QZeo4&#i|}^to!LW;a~QTu>X08WE2qspzId+8K3p(p{ulnJE1u!EJz@&kbJW_69V=Cz7S z+19`G%3^SszBb=yx53ej~sW0bM59L}KR zxSh7c44eX$Z9QfFZ{BpmDR(yPv|GZ^`3MGTEZ;N z5hpx%hNL6?uvr%Ht~+H$!{2ar*;-fx!|Q1Y-~ZYA+NwLA{#+bxC*J?xqH$-!CmFX9 z4s{YNnT%avyfv4dsUmp6Ge#y3ygFCZ1f_Vt9rW2_IZn8Lm{h4+lItoQLgKTYg0-Ul zFhH?hB`k6nD_TZn;rahXQ%7jP4 zd-#$4Eo``Y{vab`CA$KzDN6KMGFY_qpJ|;mpd__i#l_+jUl@p!^Bc?EYYvBlIB1FI zDZw8T%E@=Fc3Z>-e3fhT=udv{ivd|R$I=X!r+ZDtQw#F%NFpc%;i7(^Wzu)@?rImV zAMEW}c%qH~eJLN%Si1c#?cDDxAKU~yazgI-=7Xu@lz)HIc!c(j743R}^`?D@lUvA^u`W!~zCd5nA9_jO*^dH(;u{|hEv#1vBY#?G&g0#H$%58Cib+|KAvRB4lV zj(W=gSN5H-s3^=NU9D^_p3Q@+zP^5R`S{pgI^pmYki=w>5Z?EdE#Q@7pc!BH0vFdW zgpmEiQML>UDyjfrcDVM#;e;Us?CphBbAcL`Od<8wSq>~_Boo@~FMPfZ6llK$OZFEMUe}*}eKIl(p}kd>JL=|>KN<%e zksm!umrbtSD0-U#z#G<1PAVgB4fORtoE2%QR#_IpH0^J%U07#ZTM zMMqZ}$+B3fD1?_Q?A;Skav7if+Y|fGKd8k;CIoeOHhcoWB@V!snyKe;XYRz1bAUZ` z?6|d}t&-$aJjlLBISr-nZy;gYGCrhP>-Y6r+$hPor1{d!1jvdT)w^M?o^&R=wps_xG|q@<$SR4SB`k!j|(YVxa^ca=i21rJ5GE5!@u zckfC7UuDMTO1}Pbi;fmWzwxg962MUjE{}KpbUbg>`t&5S-=6PsKPF+pBz52SjM#~_ z_I;xfYj?OJac^9-yuMgZt-dPaKIna?SK@wgcnw6B23^bsQwYe%9l@I;5wWq^{BC-= z8*H_}+tbc_N5q%P`Od3m6CdBS!GP*>1@f&EzduGD0ub64aUu6sO>s2oH-zz?zHT|e zlu`5b_g^{y^mR@29@V}%@fd3o_{J4*FTE~R5HBdJj5q?0e7f^%y=ZRCrU+p2kYA345@ zNz)JOruw&j=+74bwY{yzZv8l~EvoWjEwT8ZsPb(o#soqhBsv;`smtuF!UV0$+hFVN z>uU|;zy1!pil)w6qKvVWT-u1B09xWIOk(0fIT}vXg?l6Y>E8TbnGt_oV$#hPmp%j; zV4PD}nJOg_=#VM=euC5z0RfW@W>vQ+`v(UC z`QwErVyhGiv@7oWjcBi;$o> zR38Z419PSL%iX&BlC*!yh9v#QV!9eD)q^c#RDd$?**mY>sx8&2>B;Xv-DeCV9smsM z{F6jGdwbzl(U8$2+oSzx3?FZohX@EKD$n=#_um7I^x?XV1I;{UtibdEpzObQcCO}Y zqkQ@DkI$DiY9to+RCo-cAGgQfg2Sx-eAbgp-b|oRy29U~w4k*xlQ;##-n~{SoL38F z3GWU@mE`jE3}gib=u`>@Nn?V`=MPt#@JyPv#yk!NTQQcG<@nkrjZy@FBR?n!@4tJ3 zz~8Y4+G4Ciz@i}j)9~*0#*elm2^GC{2&j$4-XE>Kl`k`txly=KEi-&_J6$3Ks__Hw zy4_krI+enfl!mJxPV=6>=gNRgnqH`CcedaW=^F{gwJIv9vFkd=y=M4cJp#bBCGmTa z^u)d$(}8|C-(Ljfx==lCW~EX39d&bfs@Ek=Q+n6MSCsoT{K_A`SB*gGb&cx(xaJAi zTekiRV9>h=jG@h31{CwA?q{Nxt8qGkzB0X48kKrI;}$P?FT2Ro0;!sA{6})+TEWcF z&ueYq?&)6RSqhqLg4y7AGQPWO^ppA-68HTy!K3=??)*zSboGW)=i?tRJTKn)D8en?BB*A8aMqV+$A3oz3JYAFo)9Rz5x=}qJU-e3hSs4H2S=5$@7MGJCoUL%E$b#^AZvwBZ=@KTsAPVb#OzN4# zW$2|ss7B)DV%1sm3NEi)N~(yJW7wyD0XHc!9fOI?dBxFd3xlG4yRl_!YZnolQpC?3 zaUmombePYHug^{5ye|Oy7~4vJoy7d*+Vb%#NjDa#|Dyj~E&zl?Kv9?6ac{a%j@1wH zhHhJvE{~Z4oGfL&u{49uVKEKn5O_?;arJ}^4PS*4aTf5?GFmUZ%>PJ%>ITMYGG35{ z^Af$SoMJ17>grnX5CehX(wv*kO^E3J9=%q@H>2#w3jX;Pu zDlc)MeUN;+R|2BieMAL_1lc;69}{gOzB?q}#(46i4Rk!2j84tL+Q_rpa7NObauail zhT{T!1XNTH5(!vMH^QVd8}79qa=fgMfDqAtbQE%f|F0+JuU7zK;^%AY?%^?1q9=9} z(FG3FSU5O7W$XP*_vIGy-DD&?*97a2YGuVPN;WoSFa6BS<9c7HRXp~Uti0YDZd5lO@t)t z{eZsOW+20@s;GLqfAIysB~jz~lAZZX^@C<=*=X8NdLfYG&7lUdh?kM~Sy5mssCrzR zMLp+srUgQp1ibwJ^0WWta-&_5ER86Sei$6WZz2L9$KhxUKYkLVhUZdBKwa9!i26)MSM8@!@~je_TW@QDLg#< zdv=#25Ci31tE0O`8GKocsJGY0Bjh~C3kZ`SM{1hwuRr0xuG0x6z>nz*i7_!&Rug@Q z2(P*epb!h&P?E+KpDs7a;D@Pl)^OrJC;CxQ@;TXKQC`f_GR3iH4AhB+WG&Bdu@A3EVwE*k3;-o~*NKs(pLq z!FkU;nQ@xGp$*p4D6fp2HKu~jl*n{@d@vOJs_ z2<(6yo@(_k!1m)UTN1@s;+)Hs#h;_|zx*_Ry|jFc`@H+$^i*{FzIwl^bJ}YMP0nMn z_d(C!LUO;?kHMh!3Dlvf?-jvXkn7H=0`r}&Fa-+_y>_tRiXS>Cpt6sUx6jbdFE4S? z_&aaF)4u$L)C=-4DkqgB2-HYG1HB&@_))B!ls=Y9Q$dkV3j6wAUqADwDS;HCRk33*_-#{StDZ!3&{yyD_gZ!#i(@V4iZ0*no~8m^ATRy*3-kch2nQAs_|vF6l`dW;|d{i8||05ezJL8e;5b#q;yv~t|OFR)n%5FSjYrM8q zPTLoem3<2C=|S6iYW@#tH8642hSD?L+dqL%m5!2{dRs{vDgvU7q@lb_6aN5d%+CM# zhyb(;0l~qKPbQPf%HHwtHr(HhPmv3uKgQRvhvWHnlqxKJ%t!8RZo^qp$26}VJb17% zT4Nm#d-MCZc@QGIKKD}+E>*JT+~M=8@`&(d!(w87DIgi@!cfOu|2<_5CWf0~pJrw> zfy4H>MwR7IPIO2;#>$N~nDLT#bOW|)44sO9MpP7E+pj~_e}~!q^Ax1DN6Qkehc;IZ z4xr;;NgXZH((r;bQf4x*RKg+7Et-ywm1teZJ0pY^@N(rUFz8tX)nlQ!=~i%;)mLO| zG|va*oNR|l>wC<*AFepw`^=}v9&!;a8ITu zv^{XqpSyqIue4~bn)mdf77L@t#x@!J{?YTLxaS=2QVKa)z-mui{whA441Nsq-}5b4 zoF--|AkY-E)n%o^&V!ghKDiKlA4dy#uEmd;u%@1-tPo!a92Es+loVIB#ulm8p+U{! zUI6jw{M;EFHlZLiZ~AD;C{Z$rgj<_-(2Q&YjwJb}uO}p7xU)c2bGtFWK0hex->=1m zmshGEQei6H&Pl#lyxb9%|MDB+TzAkLrC46zxps(ppHMI|^XW4JUBMRaKY#guyBKPM z`uW=m-&~#yeHTCgwI|P8w#{j2Z!isk?@sr*deyDlLj>$#mx~w`Cc|DO*u(BIajJwc z{)=a={unB0DZ`N${FmoZ!RD+N&(C$P9Mi-vh(%gV}Lj+#-x z_XmYAGAuNRNVw>C@KQZ!0Ku!ZT0xS%dkI}PAu zanOR!&@wfp_9vm{zd0`0>*emththmf;-GvP!$T>5=yadf(|El_=g#W()UwXvHK=)c z{0O*~#^VK?Bw!OS?YaEK+0}JxAUYY5O_c8tCAL^K08l*MgOZ01-Hte!2f;zoiEP9{ zo|pJqwf3J2Ef!k`^Hr?e&xgcdTe6@sq5H9d^V68Uo+s*xYW_5NT9n3@$IZn}Z<{r& z8VbivNcbYIv@9F(t?D^N8Vozb;gZiNX+yxiL>K6DojqqbaQm65x1AjFswE|;4y=qR z$U64MHNGssFOG(C-xmJA#E;@?|IgUe4cFHD zZtMT>$@=xb{Kvlm1OM_g{{ILg`hN~fWpg38;rq)?0hcDjWk=T6ijT}K{_tWzh7{@N z0J+~kKl&|yyQ8!FPelwDu5P+G+-Z!?jL2>xAM zHZ5NJSD{QN#QVE^vsJRMyKPja#M&EqxXg~xNe3~K+4iLiQNYRz+at;pgq4+5ld~hn z+z3Jvz$^i#odoT_#KW)?{RjQB{Dap+Z8bO4xJWx|BPAV{+$C?jfX(yO4H4YV5+A>6%>-$g`fE$$Rs+EO&N2y~ z&egy*LY|q2Jxcm*UUDG)#+!k*`iwN0G1JPC48-V#tUAS5m5{qjSar$3n zFZ!j>gS>(7+J6cCWq)5)W;)v#_F=o9jYF)X&LL|km;2EuTniN7ryo&G#y$@C#x$8=;vkO-;#qiMxR|@zJCI- zeSLfK&qqVp{^sv6N=p>0A}N216bersqJU0)r7R-URq>7XXWb=!WesmHS@->ed`<${ z4@}g6C8I52lI53yJ_Q{$UP6sa=cuRQ>e^CXf6T$+d!3uHzx;1_mofi>BL)9pKZ_nV zp!k_+aeYl6ZMm~=+}>^!fYKeSyXMP4c#}7~k?!yhPL}6{g1VRlQGvm~HI-tBS^3LT zKP8_!x1XvK)x@U_NU*~O#e?nL7DgJ|J=eB1R&_3nM;?Pv7LIoujvs8R5W;r&KG{~FFd_9vqYSt@~qfbWp z3Kt;p0kLdEn}OX!Tf>6$f}L=(9M2~WH`7Rbt zSNq7dd1OkPmqAyt6!WU`z@D*P_fL`hLM>#-#aQi;%30#c4@?J zAHdI?udC3-yL!iRo*OT22amHR*+h9!mG9e)=iItU7^G?#eo1TX9f=2$YiMlukdu^W zw_XCDmyWjyIo1#q6NFbXP3CxWnEuolDljye$)aJKz zj7{(dSx*kJE1EmQoi}dC@_7%-ti8M|pZ<%P8Jo`Ub|X2^-#R&;v43?y33QC@_p;*) zWgL(Z0khmx`j%^AVX8d5e!lM8VXzp*uZNjNOlWqWN;E&>P@-o~d|rd++i)9_NjoH? zlhhvjj>dRp*%u&u1Y1_xFLqL{WR-*)hA~I1PJ}=phzC7+`qJv!nlA8KR)f0&SUrK6 znUpv9fuW)8=*t}+`@w<0(NT27u?(AFS!PQv-$cELapL_$DN#M~rq*_IC&fCeRg@l5^(3EiZOd&!|o0y-(`_F&No$ROGZN zg@tdq9DjcWJ-IZEGe9_Snn+EPA!OGDG2i#&I#0E0y8AXP4s~O}L$0O$#a3s%LwzDH zdvV@I1&P(~C)?xq2_75cg>|QOxeIp)R9MfR`GS5)2GDYDHP(P5>ou5z-wz`)b8@zo z?$tD+HW|vVUTw3b$~Nx+V&khF>Y<8-7|DMv@!+bq=mvCmGzja*dX$h11DE#_g8FaS zz)Is2)j$l2$e7HdVvHbJAwyY`nWW!?&GR^X^r6)ac@%52ivd(;(DuXzo`r40oNiK7g|ncZCLo;B1_=c7^}~sj%nV_ju{jo z(IOh+IN%-V5w7t%o-@kc$HKj!qUDHu>k({lS??eS{lUZzUWIQep4o=00F{KdczJ2V(db&x z*_jR^1YeY~U;{0c{88uj?&U2Jh;(5nWf(4UoF?M}Ow73Boi|TRGDN;$4;qTT25b6` z-3^A^M^M6WPfPS0No%GnuU%QNWcX1Pj=CFkrRd zHvQ(Jfxkn|USk!$%)ODge?8IdC~*Y^b>*$l^k%|*hIN-YiB#6?z!LDUwF30z=!xU6 zGOc=aC>1Tna5iwneS=C|VG(;1tw+8-lr#%arC3<_wzjt6v4)oo zE&m0Uz4}kEY!G1uGZPk+=kNQZTB_tzDqW?jQlG6A7uKTCPa!ep-i2%mhWrjpxC*G7 z8(5kAAA!iWFT?6e1WS#`-XBosCWB=na`6nnhj3w$N7EUQY5mDBGb@u ziV=Oj4n;(be$%U|ot}5`r$%q;lPt!Vqu$v;2K9bUj8~nhpN>QVt`-YGF(j%xxkRpp z0{g^+d0#yCLVnn7!dQ08Z+U_EG{fyNjCa{DavsG`~rF z{nL7^*y0(E#EXeBLWN?Mdsq-)ER&k)-~)%RZu{wrvG!QL3kp&A9K_;ki{f|IBh$ts z2KJu|qPtty2@Uz*m%0GnYSi%oj1@IjO`icDLnY6`Y$ZP@tA$RJ7X{1Q2Z2dhvg? z|60hv;1?bsnH?$-atp>kq6{VBg*6n*?2UDHir1fvKRa>1--9jf*6m-F8UWTkWFYb0 zQsmkPx@N%n*2OF&B)EU7VfC@I&}Ynydv;Wz&A6}krY8fY(O%#>XCJU~?E6niP!wBP=teEfaHNi*g1KY*4 zA1vTm4J4i$0$|vXer?L}NRPDEe%BX_#`8=-YCWWny6UY)W$yawE&IH?*2=}wwEXl& zR2aWDUn(yB-c@Xk^r` zC@!Cf={)kilE=a0C-{DyaBeAVqu1b9?@}0^_juYOf9t%$DEU{>e05SPtW( zwUxaqu}Hi{1KWYioX+`Xc2k3;(nvNs3kP+Rfsg3@t9xQLE42|FE6c{*6f8|U!Y28< z1Un`W+E@W8aN;0q($d$iiTzN^XRPa~X|xjz9l7)(E+XmaQy0-n5UUiR#U+FWWf7AM zjZ;l*7cdnM(oNXw4}OCw$>v_7!43QSw$M_-0Ow~k2TDlYB}zo1+&XL_geu{c&c~jC z&P<+6JSBUIe*!=y9pZ<>8O~Lb#1+ZBftl_S@^fnLk`f*mskikfuO7{;uR=0~$i<0(GWk*`+%6TkXC(_f@vTuhaP(zQFDD#yrV znugYZqelq{n^HFvbbYF=>3~%+&+F1=-A}rhcYg5UAuxkWA@R-hwaDAvjcK?;SQ9{f zwi#E?BHLLlO+Kk7KB19MwHszn^cU$Oe7U9$nl#zdU3i?0#hR11PQjsFQIg%O(_ zh2l)qrmjW4v$NqEKPEU+OvzEfAxi$7;ME4Zxw>ZKAM=028JBv`3Z*8)KMJMB7L2;t zf+aJot;3QuoT~PPTVb*sIB@`j1QzNt9&v6jJ0ltBV%Ieh`>EEcQ}Zoiz5sv~-OKrw z0;oy;#QIk@@xxS#i@b5=LR_%Hph?u&_;ouECxJ$lxxxTYaG4$@wXAeS?eDP9uY56< zB&QI%N{YY0zaPk6UvBHN7Mhe9-n;5aEVKyOE#E6E51qOGgVkv>eB^P*Or!+u}DZl zfgU*Bm371@D}0$Y4NQXhM8HsD`jLqkDu%>M(?xHjHWDkB2A(^hfWpGX54e0nkjutv zzY)&mxYxi9t#GkfsR4U>GN5Eh=5iX(`PNwyrT4nyaI`DRbZR&oeEY5Vjy5e$#LcZG z*lCt_!{v{vDwPhwwK$W{p9M_62>=k|UcC>{{y(So@fmur6X#ogKh`d8JY?3@lOg8t zL;QX}pP180Q3Q%~?7!ECZQv*&V)}W1p72tz@tm)3O8HM-XZ#kEVLk?!*20-=U_jQ4LSFAU5(DoT1v!eI9R4$pH^y0#XOxj`b6Z||urMXNBDZBafn2#W@?t_`CWXV8~>@7Vkqn*q`Co}4E zP3?4}mFpW!xEOMtbtG25$^H-xum);w^mx_W^(+eOn{)_!6OMa}jm`cZ8XmyM!!E-l zQ7Mm-!6>vaNRGXp*%`A5Kat7_IAp7@`C^J71-R1r{rL9|h5_asbC=)i^CF=U_KGzb z33Xe~^d&?oVt)kNH*%&W(@~M_VBM4Hlp`EVvRQW2w1M?NEQl^?8NiioxY&+hWHjks z>VmrDK!=Be!Ow%ue^>efkOjWzJiiMBoqU3TX*;0fLMU#yM5}e!3(e~B9Pqk*XF-C> z_D1_!Dh;zcMm%1K_J=!Ah7qut`d-Yx?bKOIPxWj8lZBx)A>^Aeq|#F6gC2&adl&U& zsRQBZE<6kj+K~JE`)Oal13oV(QdDA{W7~g6$20)`F3A4^kNKv*^$ZFxm`yG6SY25*5k{a(|Vwx_WWtU=o2OshBL9bR&sy~2pL=PHynb%twhRDze`%&Ngb zJYpRv8Od1tzJ2F%zPQpKLF=z01c1g1^!OFghTv2rD5W0 z5MBnO$?!HU(L0aJ$8XeXr7e8QGm;3gSrXW-iqunCx5tZ=7Ku%`ImPs~FE0A3jufga zwce z_&)UwkbQDp=Eg!p0Ky1>+@$rtCG}L8O(+*f*&PQl@O5;@&@s9mN2%r|^Ous;blu$X z?*9Q`cEJWxaWFeU@zrFc`92kR{fEUfSc86zElH796$vqyBcvE~+0(uJue%!~=x}uM zhm~`7zTfmQO#Glkr26<;3i~kJl!Lh#F~b*-yp(5gu?Yxj&Uv(dE91uLSj5l2lDb_l z_Ey5ioW}hKb2RqU+%qvj!@Ng5@W#S5JkTF*+j?xLkdi~bi@?s?>$T;l*#95-lYH?oOO3AK`fML~0%f(8UM=!7COv0n9?jmv2n?bYx@%2ZQhYJKDTB zO2^BOK*x=d%P4#FyzeMS;yn!uB_hr%Y2mm;tA2h`-=?M}v|r*Mj80%N%K59p!bw1X zi34RN$go&3I$G;vy7j{wyBsf2%YeaEBUdeEehADqWvMVgQ9EA>!0z*t8WA;Du30*_ z)ho^OVB9fZD5ftO?Kc%?Tqd-(+~4)Pke%(-?Ri33#b8IBH4OJqu=Mt6dx{yo@GUW7 z{QH2&OR*B>gNlfg*laEf3pr$v951BRdJlcfYFHn!VWb87$nV|RcM~xcTSWrnH`W>q z6?g3i;cWPzL8n*lVnCY7C1=vfGjbO!A}U)n?W9(D@!_Sd`L4xkUJKVD0Vmsd3oC%% ze*mnY>arTKG&_;dR7A_nmH`PmpV${ZDe)>ev`?nI)H-%^wqVwgnheoql8OhS-jMc+ ziu?!{xu z76!kf%?MPd(8(Q`#{aT++Oh0a*sw3$(S1S8(w*pnjA{lz5QBpqn}O^)PG9IOQ+cQt ziSTEYxZbara&ws6P(eR-Bn7`ASXlkwK)hBZX_zc_8`N#aAM*3-WMSAdjX6_SO%HC~ zBs4Bfsr7IgLWYcKjphyJ?Z>Z*YQ9d@>0u>)%iucheEsu|&6X!{IoBh_*<|lQ`dy&q zY%Ly|0E!AbJ0L5I&4NyG9qe3J*84s&MCD9LF%Y9a0bc2lkH$P>H_!mHm6Vu*!}I?L zUuBaF*N0aY(yFqUpC|j#!sDYX_TW{;XbVI<*6&l%&XLdaQ$gQ-=rqmvi+~+4S|}`L z2>2jp$Pz2nsYbGGPBb-5&w+rCd|E!-uI6R|ByIgW3{tKFIX|?1@z*&bL3d?NqzeiV zi)WwYT=#HMXv*c0HbuUPoBJ7f3IC}r4+(sNg#P^#i-^D`E2g+0wxakR z@147oQ>093A_*dA@c_?MZ-4Jxjh&MZx82%yKpNg-D6S@@Z-$B^*m47w9G7v&dkiLE z09iPDs{vUMrd^7s_)LkKEG#0HKanfjE@7-1e^3PjCW7>70%F{dl@ya3tn#Bx_>rZhu0M@cY`Ad*Sh&hkaB!ix71hXm(qq6r0SoZtTB(Ym(gKwwO=IoN#V< zYuEgK=sF2L(4MwO<9$eUFk^gY*rZ`5q&e0~`~`f&)-#Qi=dvbRtMvJ?ot`uAej&#> z+Nj)6;`PKw?zaXK`t&vWZ?e28SQEiCidvhNtJx6QjintIStI9d^3*FP~N&Xs@?+If3F#+3#KI*7)va5B7HH12%mn_#-)>W8Ubr}&CWN@I3o z$zM6sJpG-}zL@wWZDqb4P8}LzGW4PAlksM^eSAhbsZ*i@4r?6t8!uf?xAHFOd3ZGc zq&dpAcPsNPE?-EeJAp3(Uc!8^pNBuTNuC572sG{fr&C%A*womz<=D7AJ&9TCA zR^3b^-L-J*cBU2zhW-S+1pWQcj+o=K^8*~n>y70w{+1^bI>oT(n^z;6#|M;)g=+7t znBd6w#+tKvj~s7#KR^GV7g>RWZBeiCPUoFlPn>tBjI4#X=b3lr|D-wY0h(ih^bAW# zo-8~k1n1Egj(oz;M3P01hs5^{gP1nby%@;8sXM4xK2D!^&*Wm)(_t%@JHFj5sutc~dK#^9sRg1)-s;Tpkcesh4s9TwxYDgkgV*ZKwc7X-leV#p8Br!Bls+8&3a}t-2(PxM!FEA`30OHlmu>LVotaBW+rmZ?#cAghCoFT&=RXIB(&-^3em^hBlF=Oo}o_Qz^X! zPG`~RNS0bQ*!UL)&X&Ra-aK2DJ~PB4L^Yo>#IeOf7B=-W=*7c7$=mt!W_n#~JsDF> zAAZsyNq@cXP$FWgO>=5oe5NyoeZ^UsLFdi8v+pKdRQtY5l_#xh`UTx*;OmC}= z3=DOFIB&}VR1k|KjTngX<@vH-^=a+4^^)-8lmu?P31&s*oo{yMUlm>N@L#|1XK4FZbxtL>`9I>@-@0hAgCzp39-RPzH3l~lOR48+X{`PfXaCsE;h#$jQ0){(a=&H8+xRjkTa#t;$ZH|Hmd0)oXfo zNL|Dy8EqSy%JxjXs{m=-(ULOyj;}wyQ8zGbF8whT>}x~o%~49clLL#-kO>PjpY*Hd zUP6bQ5Z2(pW@yUUGNu9PkjCrR3KUVv7ttqW-Wm&kxjy-=?V3?bH%ZQ>=Ewy&)Vl!`ajNh6J?Dlhczwr)v)*X{f2GrBj&@%sek} ziyLkqaXIaJlX{&$C^PC)6o}h8+|KokN=N{TW&6oV(_%YFd3k^87@!7n{%zD_1x*G$FlF>%At%W3wXyElh_EsZ_36nq4_?Hfzn!GivPmh&>Tc zuB5_7x$t}JAxs6w^l{$Y(IAWxv5(tZY@8Cdv(u1+Fy7Ayp)4A>D-ut1OnLKj!*6Kg zvR$DtnbX5+8>QKCCvIFKZfG^fx2JhZ!Z{?a4kKTReGl44o2wZYxExI%dVi zIvOvjr&qmWsJ&#A@o-rDf4A-+G>k37RZ@N(-o(K14hd|H`o5@8Lu(Lrx(alUz1FK? zr*@1rKgi!u_DEGPJ6hak=W5<>7M!C7BM`$cs~i*uW*eCWPC{sEICQ&qrQI9fwQ}Ta zW)g(YB%I_{l9n>$2-)rB1V<#?G%!jfj?Styg|-?5$>r_`naE3pCLiA=dS&YN*Xl28 z_GE^{IXZNdKw4*&^3TG|-746$b*7SZlQL8UN}Ef{$sIn2ZaPPlFm7K(!9x1-3Ui1- zDa@7ctA9d6`z$l4?@fE*JoTu{qH=xZjLiJ6yj6$c(=0dUgL8(iEndfom!v^Xzo@t- zCa0#FM_LgiBm%w$2eb5B5O^dio=|bUYUh}!f3b5B8Ho)HA1!l@Ysm#!)BRtuDE5as zNS9+Z3}N9N?BE#_d?SbvBuo@Ac*~aHE)R{0jP(BXOSl}&vHD?LeOVnYypTzQvy@qN zoy?_$&j_@+6i33=){I=`R>dtG!zvx+x4^=c2;0ht`V)${F+^dS(Ec?fq+*gCIFM*r zM%iAY+}_4Gt0G>am>i4_WuC44$Rk40yRBC6u`#TB3oub!YHKe>5{ z<}t^W-9Fp1{1EHPn3~5fg1^4}Hcj&Ht2*c6Vnk6V4ZR@5H3b$);gmL-lg`ZhT`6=X zUC}(ayS=O68`-DPdfQ1j2l=lNR1diGcdu}2`pw^A+pgt;1IqNycct%_BTp!(yHrTK zl=1e$wpUD(%n~%kZ37N0)3F^RxI?4jtk!rjkg8*6L;i4c{=m1vRv1ZkMb{UD-mFkinM((c z&^@;g{j|I_&W#!C+7?kzhc8`Q%CmNWH}jOKD)&N=*tVpz(~-XO_3O6Wu#Bf2velM;OPpXK4`(H@1kq9SZXccHn%vG#2pS z#rG2gEd0sI$q$`KLiaY)Rq&Fu(8)mOEes6|mnH!0JT1!e=8ACr8}(<9DcC{&@+IcQ z#l`EltnQ~LI};e5o}T9yIjPp5*Th=Pg&KcdY8c|mV+}a!hsMDGkg%L_iE2q04B{yl z0RZNFJ(c)tNRW~Maq@2`V9&CQc37SDyT%JO z0CZ6Qx-imQDkbRa*PkxDZpx?#5~`-#mh&+-ZRG1A& zB{OKN0CMnR_a{UTw#$|yT&OkXaNs1*UJ=1`yqfaHVdRC~${HJX3jxtmf#n~=@*oyN z*NELgDN>6XeYDSQ=J)m)ZyKi?HX7qb!}9q`>SHK$a{;`3=UXrB2ixU@>Tir_+ugB! zT6542wtU|U^UeV1?TLZ_6)d1Z@ZUD`>%koiwgP5ybWp0C-172Lb=iPLqtD+Y6}|)A zCn@La7`WiK^NrMpNxii1>)8^xVl+PCwU2pz^yjoK`2ykDoNdQSzTU#~j$jn0)^WrA zBLW?PQvSP&j6^?;z^^>PvXOvb-Dra1mp>{h6`elcI7^y2eCZvn$97NP@b4OE+dgeycPdk^|Dd!j29~|(sQ0+vrpTo8| zdvYEv7d7(@*49sTA<+{W`ooxLS2((R>hnV?&R$h1>lL$E@R*kzwtwK^=~W>{m=d!Y zbJ?AAaB@50gAL3Y1@uz^t4IrIp8n7SPEe44_%)2(chVl%Oj^Jk0rEAi(e-RM=%zh9JCOh}ez`nDSgF=)d@zq2c zr6PHgzo-GYkBwPDz8)r#DXXc|SuSh{Ky7aZtAlw95!crVrPXCq~W-KL1|Nij!4-kb*Ji z1t=pwN=3sdq1!!FQqS}G7{zE;>kkimwm7yj`PnUJK3!NfrU}YKQOgx=C~Y?NC9>yz z>J`ZlODz0ANy&4xo~i+@?v5_Ef>$<;F8};_iIi~?_`V~IIG^cO7{nSfS`WT7pZW2? z>TP^+dsrUm9hgtUex1cxEDY|_t04>u@^1Pr8CV-0P#cK>1(dUf}x z0j;;TQ`5bQU&Akh9;HxCrW91RL?7)mqveAc0y5egLz1V{58Ui!u=yralnwAVud?di zjrEC8svdP(&l7yixD02aTErLAFvHE9!cNX_PY>>D58o>=JUtRz@gXL}Z6E65h~4v+ z<>_XW^-wjrvr}?F{I~fh*3B2(*l4{i6`S)-`A{we3p0x+T`woq)$-BrvedsMVaAPY z6wa74@{DTF?zp!eJp82}`@X*^E;c4Db4K1kjGjo9^=&+LPC!2vdS&)f3Mmegm*RI= ztdMPoXZNyG9s7CAEL4Tawn2lsV;RzYjU>+X9 zA|(w=X>eU^!&`@=UR?ccZv7)$7+N%F|6T$DR@Mc=acaF)+4E zj_RFCc!|+~rTKiLmYLTJA|m4O+=dii7k!N|zEh6&V0@(^`l*3?l@2|9k@ISd%EInq z+M0^dw3BNSiU)kTJ*zrC$N2E*|xXr*Vx1!Bs}7Zcl-+Sg8m2R)#hKb1$>hLR*1zydOni z{(EhHyl3S*gptMomF91(>|b8;<-b_w3sDdtuKDN}7j^ML?rRQltR`_L?TqA$jfgP` z=Nl)XA1XQwIX|RlKP??ZG^*Cq;ehR#Dmw*a)?G*?^==|s{wt#JnpuzJg1F@?tPMky zSW3gVmu26d%_0!(!+T-uf_Z%wblCg1mE{D*bTQ7w>I6YMHW#eZuqfCYytl#r#bs~V z`q7|^&y*q+orTTzwwrQtCCdgvPgNFi?K0DMqp7C1+t%{u;nncwv1av?ycuKB)0?8^ zIaS8I7*}mD{lp>_&F@&#*15K&6eI3HT`W4ktgW;zDZaklCAF9rWe8S?2|t-g%zb+{ zE!=vCAb!O^6%ktJB@P+OUNw9pKvKCiU*_u7W1|Bj_PX&W<+^dOB3=kNd!epD#NaHS9~f6)b15CZLHf^_C_5z8^Oz zuohz@ujpWwi;WB9vV5xS?4kPyTkqqKe=_n?03&ZNEAF5@(F!o~sO3^1P|?GqBkL}z zIM~ksAE6sq$EI`@r}5wiz{s=6&dFJ9K^I$G_Cr7TiGZPux&j_|G2Pzy653<39x)=m z$E2jB_X*$5>&Z@L5S@q<1MX7ZkrV84kByO>Vpk6nv6J_*9u6CW5A4?ZMdIkS0C6T{ z5{G(W%`o>D9wsL6e?IySNF%h>kmLfo0g11fD#b_nh_=F?n)q8{BG4ARf<~;c8l=9Gtyd+!J6P@j`$pfNmMMH%#7kMA(ag?5<3(QCjfFXcHhUew;QjVbg#csApmBBkn~7fD3us&^#wg%VZCwr|3%qbheg?Ld%(7W2#R!y zl#&9{rKGgL3>`{$cdC@qNVhaILr4sr0z*mn(9+#q-_5(v+56q+?DJjU_x!^%0~a&% z-1Dq^t@Vqgbyk>1hK3Zdl!jNkbu_=i?yC%lw)^@uK^~6X<$7vL#!moa*m~#pmt{q| z{m?J(e%sF7NEeehRvik$AGh8*9L{hz|6BIu&`r`ijFGB6c8{KN%eSY{EF|%?f_k)* z;I7*OnPqXw%hujk^a5P{_Yqdu5{nbvtKAt`^I#`?!r9%IA-OYBRu93C2W}_COMl7S zlHH3jJAXPj(+QAU+CXuf@7Z;WoX5od8!*xBT5vdAu_}O5!(GXVJvDMuy~hDnP(7~S zs=X1;mBXPjP4*>+WxvU9Lwm-ebs+Eh{f0m_Gy42(lIZ({R=(f_(uMJGi2+H6)|d0C9@^1B_b zn?D%Iecg`n;{f_RS%e zB>Lx@{P&aObC(ySn45|Ome+-_zs7|1bDq*W^KF(bb zTZ$p31Q%JaaTuZ|==A17Aoe;!ZXAJd9Blt@i~7$8%d+~=0yZJ5*9b#Xlq9pUyfgjp zjag9Hn93XA>F@tCA(MLfOJ?rYcAJgv9LG}jL^`_`@-+eCxm~b5!`PTw8t7GmB<5GC zP>PMcNemew^2hSNo(I@;I**KJw_zf9u_RM}E(^+*DP}%_yKxBb$AwpRVD;n*&61){E^G(>#p(x-0axp5@rvDECOs|N5%_uPe|OpV@*-Fz}0P zTf*9S&iY;&%W#EMBI`}kc>l92{8l|B&YAvS~0y zJzX^mac?5uS-C;zf>wv6D#p6#^}Qj4?nq>ZWK2YO`Nd)`C$WIuty&fTQ>qjvBHTZD zUmm)be#07`Ap5fGI?0fozEu4ufYj$n-oeP>sK;+@XG~f{IhF#kE?M|o@cAo}ASZ){ zo)&_jLTr&$^+oKP3D|knVMg+>`9yp74b7;f&BZZ`NlOGNF{&RKz z?PPhnPcMyZveXG1Oh^&#if9PE4q&nV+a|t>!wkvT`p#o{{R5Rf)P}yuT=Ko?x%A5p_vdL zr*pnD-kFx7n-!H|IkqhSYuWzs1gAt$fSqj1e9UZJvMW)g(8E~Ec9gNAAIkWXjt!&jhu4b)!cQ=cvpA?2@5!yEIg`>und$2@v0PgWQI-4Fk!%;6x~5>Y zXJO7PmUk5-RT}>-O8+Zfo0;ZtMwKwu-m#Xz`=D=!q0)@6kJhc^@phzR4|)VOqq{$* zuMu|=$k#>nGUtvkWw*-Pq|3MRCL2~kX=yB9K{s%5S!+%SdSOR%UnPt@*S_kk^$ya* zN|Bh3CGhj~UO*9j+M6zf{9@;xwoVwtvLC8@q-OSn<&=k{Oo6Q7c*y#Jk8j1AW80nrjIF1m|2pWJay$n>v+n_2n&{6;-PEpO1m8qk+!9~AGqAi zH@?pmh83OWjpM0nB({2!WT4Of_$zbj$iOWGx9!v2bi7uf<+80|Q%=Ow{Z^*l<=oGA zcBWV08mgl0hx4_ZDr@|nSSwqp3YTp4UH%?*U;TsoPD3gGwcvj{OTYR)K++M>+m&-0 zuF^CHLTh_sNk~0$jOk0eojPA4merZSG72XKE%pNs93HgB$CXW4#~n{cd8gqANA|Dy zPpZ*yLpP*db5oPY(A=Wk^9(iZ-*uO2EYe7$cJae36yxl|jt_vLycDsxB$r^AT>U8% z>2^R7@Dl6l6$yZ^5RW;dYu4dkE%0?naQ_4!3PHpAgl$ijuexmy(6kzwSS^?+P-Ig*D$EKIwI4lPdB^?}N7Lp;CvJ=pyTwRCp;$#t(;Z@Yv`o+-jf=Ug32XVeCB z7)>9RXKt*YH5|=$HpSK1su0?EAxy8=@%`z$PDW_!w7mOO$5}?fh$RCCU+pWd8+9yP z#~6 z`@q+Kj=Mamgnj(j&Ew%6Kr)b8?w1yndOK+&Z)bwY`;O}<@rVfpp(mlP`nMm)Yvlf7T!b6Gj)F*> zq#n8fUU!Gcb$TiyTLpGntv$meOoRtNk{Oo*N7eG%FuL|A1sfiwGyXj=pME#k{6=ek z;P&bwhp6;qZb0nc{}T;%A8*)W6m9)>s|=dBlV-_ z`qjiWDC>75845O5(m+?~bg%Sr#VG0FYz^qodi_7 zr__VP($@CYUx?r_Rn+}l!^J!qluka_)OJ{A>4}xub>@+CAVCfS*nAOv4>!$d|NABL zGtcSAl=w#KKRM+>#Hrq9EqTePT+lTptDtT3tyVU%@_6DxEX&Igb~T0qQlHFEE}59n z5ms7NPP-{}2WNMXf*5U5!foynWiK!6{zTZwuKvmXW$Anw{sV0sn$<(t7saMAa{Qk+ zo>NxSBF3!g;1{2UieHyR`r5!ri-cqZmrg7%Smdp9zbgANOi;`=6uX^#1E`39kjG|skJo2Ma`ZniGM(4 z?h@^bjL7$>4WF7Jd!;cWg)b+cL@iOCB)1W**bv#N9tspSBC?mY4FmKUVcP-nr_v0j zVmXASmZl*fIs2$VBX)W^)_2K}M-?q5-GPZ3SC;aohc+ndR=c7PN{mB=*=O`;9J=O-kWWB~50rNC z_iPN*S0Wp!x>udY2u)Mf9K=ZhG^zCjJ2I7eyfXJ9awY&m0}Hyt0&-7S>t<-zo{CV4 zN+$VjO(d%laZA)4MuW@u`IAbs67*-T2d)$kjvU{&LKzsKvH9dr$2R%VanXSse7rG7 z+A}_y_g!GN^%e@*JMr-OQI@3sst%VOhtkF?x;wc?4WBbbn$0eT--A4MhHvS8G+Utp z=!%iVvXiB%U)1*1=RYObXv=*N-){T;SzPH=IySTz*B9r;jjMerv9}P!rxkgVi=yQY zuH^v~tYc?*x~cy@F41d3Be*==GhZMsYl>f2htyZT4vJ8b()D1^3Ng#^NRgsVUNt-O zFkL0exBP#LKdl4Zm`xX!Lo{KCwFOh!}A3_ zXZz1zR_C9ehn3|Zw%anO&ly-WtmR{!ojKeUtF;VRsUFMpRP(DLZiM(g!%l_kBBRlx z<7yu_#V?N?CEkVHc%vkb;U$!m|BDEB@KuicCu)uAvDx=_X_&Vjz#6C;gC{Wn7}`}B zLXo{ny!_SNO+|$VZly)9IuwfX=P={oX~qz|h42p$gJ=}-QS`GO>CPzA=IVvkvBs3q z-@D6?2=|8sN362T(Ka&GFX47^``v18e=3fjF_bmOQX@@^ZO@}!|i1!+~h?}~#`nlwty=ltP)wS{~z})A1PApMNVw&Bd$<8)qzA$vwK{Nhc*Q+Qx0fQ##M;z z@kVQYDLgU)8Z}>T_}cu^rzuM^Tbiu4KjQ1x;d$ar`T2F+`z?NHBzjMdmayi?YynhP zaM5=Eju%JgU{I?`ngXjeJESW7hlpr?CGVYuy{feR7OPPnM!b(xhc27t1_CGMcH&v2 zU`q3MWL>n42!fFMcUjhexg@k#N<^dub&!Q_AJj=<(0V<8@j|PJhQPaZAp^aLkKyvJ zH^cphettCf{`;?`FAFFd;r`*hzL0M)`7e0I)`FV6&l`|ty`5y9x@L%O_VcC}_*LNy zJVR&IeD^Jrj!AAC;Wn6H8<);B)bY=#c+nu zJ9~7VP9mhYTU37~sAl~?^u%D?E_Estw3(Z; zK-^+KSeP}@FAI~+dBa`J$M{Ohd->yI7@q-4Gxg^*Wd)~#2MOzS)wS?Uy>I&&)qX{) zS{k8CUi^2jmZ%|dt3|rsxBI3|L3SmsiNg=Q*^WCFi*}Mk)kMYzY8aEO?1A`**#72Q zoT)Jka=YN31o|O;rU+>WE`h}ZVsqR)ScpzYN7AWB-D{`dVJ@$Kt0e#V;L`lBj!TFU zlBw%B7hWlt^eU%1?YXFgEicPBh$?)13jBKG)c;xC6RpyYE!wQeQ#3yi(Cqo-j zFRttN*)y@tB=M?xNd%a9#7kTumsLvSq6`bc`6_ZIeW6$ryV?S$ zrMAC%xcwkn>xEmATf_1UALh)m6J)h%B#WtqC|NCd{8F)v5w1O9*bUT8odD$0 zD-`r?^sN<`lKRnluO#7LwMv-e#{(?R*#+@3g5P4)*8kp!4e#Ki77CV-){zPk(*4N^ zh0-JlzwEUb!mG99ICGu#>C_k@PB&fNJt&eGUu;QjdDb?GO`2I8p}NsXBcrddb^jyZ zbkr2360gaWnm5)Xdsr@>p()movFyWI?S3!y>G82ws8zmujv?AI`}$PTc6D_H`D4=W z7MD|R;}l3k>Sb<-qcp8KZq`?Ce-j;Dm5 z-W$!%)PObQM#u$?#<(!IhpS~cCUR&=?RtHU|Gpg!jR3$QIP9N`{PkNfF1oRD62r)7h#xf@R~8C+g>m?kqdOljLdnDf5=|DA-j5=GSZj&P@cq4l z_WnW^T+Z^W|1s|Gif7Gt*@#=>t|SxSMgzE+B;9|s;~ByaTA-GYXRnNQu^I8oYgaTq#PzQubmgsUI*w~PO; z)8%@&IODIKjW(ko?gUrIJ7sh$x7-{bcNrNAjRQF%9@Z9?v6-$!b281_Fr#9NGmY0C@=nKpI($Czf0RJg-OENcz^p?%37*vaN9!zEGB^Q)smZ%)fccB8T< z9rMYd=smam?&g%>#r)sT2+s-y;_@kU9aALpKa<(M%`L&4UzcKP*g{FaR&q4}wf(vb zLqkc%1y!`vDtmGALyOXsXgE7*h8-i^Aj(u&_>^BeF|{DYI`|U3ri&iZhWb@rB6!H8 z*dS4TQtqmf^E1(1FHyW*`ZhmHh66Tv;-Oy%xiWJxIr>wbv36CWc??qSU>VfGj`Q>c zKqZ1r166@Xbnq#y85oQ>fh zeD2(&Al}q`()L8juXUjB-ZdF_%~RdXm8#XCD}wAgy~zmkE8VDj=)r(i@x01P##KX; z=o86Ib#qmC{wR0zIO~X1s{^BIM9?&?d$U7QJkgq09imU0CbvNqa-fE0+s!aRT4xW% z%{$US4p%~hC7^F2gbtjM*9z1pCLo$k)` ze1q32?MRBS8>i!11}s?$WWmKJxq4+hu}3vDXD=UmK$jPRYQ9L$y*ugnx8B6Q9GM<6 zm2ag!O9KpqmnkMmb$-;3QY24R(36!^)tVTSgBHibYp*i;5p`D!7rdUXHD*h{FLhQu z#~(9uO8n=B@@0@ljgq|RJ7}^yKfm5)T>@b_ceYZu|D4h!?Y+hnCpCU*$VFa|FNw}n zl#-&lBm?Z-0_l@^tNW7tdl;dh9+*2}yId`TWQIRnJb3e-)KU=SEcpK6($u(Q5hJ-e z`I$n|OumrK_+l~5ZlYVg<*bdL0SLl?WjFG{nkf#V{xO5=AfF4@7XDaY=-XR6d5pT6 zGG>;I)ohl2Z)?p2%$Bw_={NLkO#~_`DrVk>>SOf><-X~fpM21vI(M5L#=iVvZ#Kk7 zeCo_mEmfgnNUlNA^Ow$Ti>70G#TCTHX@B|sMG3lMv@-OTXtKy`JWGK>J=u4}TLD^s zW^NhLpdkM--fVh~+Ox<-l}>3_nndfRFy-b z>(tW7L_90|G~DUj<^^ea0S~N9nG^=$s4b+|NqnrPNR=%VEnhbp{h1iV5zki}t<6b# zfF)RuSu9n7(#j$u9yqP&VPsJC%(TqbtMLat>v5RnP+cN?jcCw$T_q>1v1)mI5b?zE zu%uOCKm-oK>_@zo%3VGqMXTKD*e??n_)X|-epb)RSN?}XOn8`Ghd>MW>xyR$95Pk} zc_~R_vZhnQqyp{2Jw4O)#%Zspf|ci#O{y^PWFxkgWb{!l{(TD7KYLMqmAMg|A{zdX zAvOSFVqv^|*FpsAV0%4yH-B=?IikYXJkzd)lFfDWNooLyo63aQop_Ood0$>GW)IeM ztWx7TsJY37V>0-t0iqKU}O-Vbg`5UjQL@&PFjsdNxkAD%AT+JO0oZqKCFcp=y zf|V6^GfZrE9KV_C@5+fRylr%Jq~v+JerkY^9scYyWcZpX1(lM#MX4l3&5rz;{{8n> zxjz&D#Yb=MBSU=&4b)BD>&m(k-P}KpOl|-K*|!E2T&FW?uW-h&)@}}(Pc!WgF9z2D zqWS=4^c-p+l%ltc0JJVL1xBUWK*w_5+zl@AgEA>F#Feg)is~oeHHM_2ZAYZ8YWS!g zUmF7)O5YGU)YaAbqP=Eis&nHdiHF&%O_KH7`3Q5`IUUs1wo~`lPA0{n6ktfL>YjS;DOpYO zIf=v1cP8bOQ~mC03dMphZ8$Z{h!BUtG-$%Wdmf&wgH}ir0i!jR3eXNN+12>f=o-{? z9ool; z!3Y-hw2J*Uo2wyeT0=sgVc~IKJ)&+%{W54(+4Mihjj!E0T}m&F#XcqPD0cFa7ry-) z;`wi<5J~_=x|W1-xVfQ;yv@D1{jU3)`8(YIdI$f0mhK%3twbGHv`+=UXxQ9W0`MZq z(rYb#U(I|6jk%P5AQNj!c@x7m5EERBf#E zq;nj9yL$Kj7p>UZT7)WQv!k(YUP~;AK}=SHEwA+Ilih~!4`ekn=)`>x<2MEk!h6Dm zn#gM*;(r~<)&En!Zm*(aOT1|L&gb@o;(Mh)KmNIJZ8gmHxpy>@swylyWIsx4wA{5q zza?w4Ro8Q)0;)*}{xu*a-5&dY+TF=(0LG5Oc|!1fl9JXK^W)^2sz%GhS>K#zOkF4Czh4o2^ZCJRa=6-ash|i+z0HYJv27XwDvO%_*PmRUkt~iO zd4IB$x5l2~h69mj6g9AdpCl6D9kwY&qDJL~Y|1!vcj&0=i6Ts0ze;yXx_!h5l<9mA zQ3-v%VQi~Tyh*n1r%Hc^B=&j)-an4?t74-{@d3~tnahZI3P=tfVoQObfAwprvdP88 z5m&lHBO7y|o>{OS?pJiJWYbGV_!X zsWyh@%Vsi1Y#A#$RjmR!ID2TCh`gdYG3G)JS9=dzver*P(w#$xL_*d4JL`BpPlqn( zN$9fHc&jtw-zYXv5V^^sK@<`-p){9Nr9IMlJ5|>7_I*u8yr`(TrKT~Lqr%tgUs>OP z_9j4$*k}fcaULBs=3*D*E-XaEs0MOhzH6bs%A7M$`KICQ!f*VWl=M?dK3Ry&5M=t` zyPfo_KTRfNLeQ&*fq1t|x$a);(C(I6K(YXIC$o)zA)|%iQjHE^0|^|-Qi?0h>wN(1 znt9s=sUZXZcJaGea3K+ijkHU6fbi$a`_V{OwT7$lsl7y{zF6Ete}6YXddplSpyuP$ z6|`E|{IqvV`w5@&C`<5<5v4U>ZO9V;TTjs@Dt`L9|%3yeg$9 zlKUYewoyiI^Lgx%YVy)&0MX4w@7zRA9jr~$Igc`=j^uYlfsX7s7Y80tNQtVu^6HEw zeF+i{g4yo2bhh6UR(SaKH+6C^b3-G~(eI~`I(eJ#31Zuy-u~}60Dd|go|x&n3IAj_tfE5(wShETfFZbXdcmyBp#aRfmPqtWk>(br8+ z+o=u*Y4<7)u*Ej?4PzF{JrK){O}4dc0CnXxM+TMD{ng_qHP8&*{1z5~u-Ca+PzL`J z>gxlS>0xb2W_)@LsKUo-gq{=(%k>Ul%oGos5yO=56!U+{iH<~ak@cr=Pg3&IbH81q zELvO)XXt5n;DgT(E(s*~#+S7&B6^jV86~$Drerx)KqNFMd)J=5L@ z%QpS%_?)ao&CK2L({25RmAaRb=Y9KvYD@7it6_k?5n}%}Hw}C%G7^Wo-`=&J&*23! z-%s5IwiK(jGW>S%$NX~-djV`^#WSrO{V|rc^dwE=o9Cbd%i%E5Sohs&UCLl2he#iK zk{~f-cl(%CieT%R#NSp@jCn3>S-?@RwAPxJ&Vk9N*0F1ka~5qM>&T4SiSo!?#A|9q zOUv2$ROTw5FvQJm8HMRsPRy8D-zH_u{oq&ju0_H81ZFAI?N;zDm-qvW6_#C0%SV`e zL1rT(%!;2Lk+|CKM;$^tQhaG`j|mcKJvZILz*j+=sHv1Vbm#4Er|6t;TJGmdHCCiE z`Q5~qdUR1GJ1#6I=yyY=)U%@WtEA39LvCDrwWs=J3N2S z*(hYDbNUUlGBGx(;n>ZZpe*IpIUD_dZROWL(g)_8F&5M`XHOI<7+&d1{gfoWcVDxy z5p@r{jO%B4kxJx5jSwF#rFhoDbvAbO0q2-^e6HB)@Oa)1CogW*&segOx_3yTHWbqN z?cGauE9C63#Ny1?vP)X+2^+=xs#w^zDulu7LSx4dCA0dw&xQMY5z*8Xq_YV4_MmG0 zGx~#)3dlw7do`s{Lw9y)%QK7v$aFRYrz*WV0CS>E$dG`Dt9SIE+i3Efd}jgq_N!aP zQ&GO67jXnX-XlR;w$}csLW`4lk=dpF|1$IqsZHWD&%r66fScO!ti-zTi z{NUbbD{s0-t?_ay}Cti}lD6 zb|88XOU(A2qBtkBV8 zz`(-Fu|ph+XAb8mE$X0Y#v{0Nkb}Kt_f)DZAM>iS7eq1wlIl15;kH707WaPEUZl3h0#u;a7P2#w$X4lCC$&&wZdN($raby%c^Uiz&5|rT`*rT z?YR@TPBY|h6xd_64rwJG*zz7m#svz+lwtLvnm~SnuvAeUsfZPJl2;&yY)Jnu6DUi) z+K6(ijpfcFTKYTdhM0z^hpiM?*X}R>cntD*btuMG+uZl>c4Bl3RMkK3lyRv5ONiT> zB=f%AUR;1(gj&!hFS04lDJ%GxJn@U&F*HAIexlv^tYl`zB%_*o)%XFhChV((m6qZG#o;QO zk9175`PJxHjqB6?fdSjT%F*896OXtz-qKa-r`^ma>577mo2-`v-nvTl*iTeT^++m0I+5O4x-?Gl$R z(go=5TG&E5#5~5MUB~R)Uzg5k*=Vao@5hm_M|4RoX?q~HrilW;KVGP8q0>``Bw zP=7mNujmwisCi7wZ0fNGXvX9^@tUl8IX`ce=}riLAM05@1Kj>mp zdW`^nr`3M65a*oC^d{7=EK#}O;^?x>0smaOixE0URbOFu;r(Z~?<#q2bu`wb#IXJv z6V-A6C)31%a`*$2s6C&;l{Uy1P>aiMek zAZHN`F~7~XEOFc;t7D`bvt9-%eE3bz1~2|T)!I++@`zjiM9R`af~p`UQehG0d358x z;}JJ;EW1#b)WE5DXkk(kNsH3e-?l&lk?xmL&DpiF$yIG7EG&ngqT?rgkzC3u!U<6U z&A)F2Kj0Ahm>yZkoPFrfH$0-FI4+^`_M!)41)G*o&sjD+b66R6DOW}DH!cK4oh5F znaxENj1WB%jHNqcs?i1=ltRiY8J|8)HpQmF|Ks;4Cp=}kG;sn5=xX=by)Ed`!QAoz~WS z{nNd&R}MS&?{y2f7Oj*VBcxv>Bb{0V`Y`})VK)3Q0i;{2L6;-tnKL2N%C?3$IAX#R z7!f#55KC!~=VW`Rd(YUB?>%8mXA_S@HmIp|eRWHIzqegXNTJ}_dB>BEEJHX6QiL*> zG=V}L`uY} z-|j3h4FW7|_>Rrd2g(C22RF8Y6Lxv%%n1-}(wKNMpV4~O15TY;u=KH!Ir3Fda3Sz* z_|?>>kso{LV2n%&&H}l${^1Q)D7&`?r2?n-LP#S+!|U{94yUOhovyRBLnnOtF9z!q zr=DNnW*lO-UgJ23P3ZfBnAzqMmw7>LRP98zc}~^%=Q5G>$c|lN^OBA#ITdFq_o*ZR zyqOw=EUSLjKCHSHO#G$V_^)2l+hoaz@gG2SRG|8Tp1C~c=`i}V*smsCWK{iu_8oUL zQOp2=1M)FXk=XEwn{G@MF?wNga#qh;P1h=q>t}vRm5o8ujuvNO-7s0ZBKN1YN%WI2 ztRv*;=IXphw=VszZM!l3PhJL`LV2t=sa*0X<43q9GLUE@T|!OA3?X}iIsw+D$bHft zPN!Obv)`4alsJa^Esab7|9G?$=B%_-Ye3GMdbnh{!O;D14j~_P_1a^2> zQh07EDk{E{k!vw8tP6~w_Sb)NTxL&}Y}+$~hKhaeVZSe|^ty0^LM04<(O5RA zH6&6%$YJ@hRkENa^A)JTAg&wN3Rg7pX_(;Y3(%v^?cnmhI3O(9z$=~tu7f)>w{alr ziFsG+96is3gr+JWwDy*RVr<1?fmEanrp^zp9d?;gqLikr-8o$|i+5ZbCSFqc?!=;XT;%38)}Mu{jNY}g-)Xowf|7YF_b>Jc zpJB!7a;fLDUL0?W;=nJXFX15qSHLs}?iG8mU#DJT6w;#q!3@k~;c?l128LkXb;fBz ziu0-KhGx}SnkJI@+}&G3aIL|^NQ>+iFp=l@$}Fn->Y;vQPveaXaORPjdOho7C4)k3 zb|VV4*w+GE6x(o1YwPU6hz^1++k3jWrQ%v=dZ9V*9_p_`7t>LF&0B}snkTx|5W@;| z3Ci=|z2D0`{=|FAg-{*CcZ2Gjyqq=!u-A9^3?sfb!kZE=Uc(nK#&bLBibI*`xrrmz zD!Mjg^xvh*Y2hjNsl1GPW{K(2`2L%k&KXdh4t1$I^rtGBs!ij_%vV_*RR;7f zuNB>rBB&f?z}SK>n%2o7`I=X6#%DglhC24CYc@ug0w13z2jSuE; zBOOEaz^v~e=G^6fxG2J{y<4mdZ}e>Z16iY%r*t=?8>mtg5cKxbdp2%BJd61 zMMt7t?c`ToJ&Pt@5mr~Alf3VKP$O`-!#0sQwD0PSvo|sh%r<`L)_bk)0Li8qnNLy@ z8Gb148P2*Y6_fG`G4a=L-`={o@Z36Qv`%Mig^Il0TdMyCd~JsAt^C6$z5P!ML0CBx zYtOWO&*VGVcW+wdlOd^_lhvx^)v>w>Ij0l2u2z$1IO0+&CCe5S|Tusk{vYp}*SO)h$&+5jA1J;@ME^J7_yz zGKauqEix|nrm72WEc};edqj~)`@5M)bwnj zIGn5PFjJ(MNi`RF6zSdHchU9Ek%{S`a^jDqRh&KG_`Czj_cVVy5 zJFK5dgrUZoy9)^FMG>1dZzL@e@Ush6>W*^6O0TB-B%n2wmY=xm;?XL8*%Bt6-m{W@ zJh`=D3GNmbs;@6KfAay&+sBIf{DgU1N1&8sNa0R4@RA9?$$0yy*lLqg=$MA-xo+-o z`NSEkr2Tf^p#%OKR|ntJ7S`0nKf9Y&tGA2!FgV&s(fxbhC)Nq)Glg=oQ_a+dVo`^R z35Pd}CgLbOPep`-XcrTG_79G2R1eaaJ*gJv9CyVleK~v~vwd6etbmYtP$s7+6~k*M}VsJWYFwho(!M8maTJSR1(Xuk%C55EH6p;gMKxGqn=$3#Q2_aibr6QzZ; zvZfcpW|MttnN>o*Kjl(J3YYG-HusZHFol?d!PDLznUmvl@F`0%)Lc~?+5X_=*LO32 zZ(p}XC2^Q7S>|jmx{Tw%UPLjHGVw&I`3k4YC~9fkt7Z5U9>A{9Eg2mZod!8O8A?f5 z`g0k~?30sm-)fE2_hVxURQ}IMz{CSNtA1zDZgKQ#j+!u$w+cQSFVb39$U9r~uuH!f zVup<-zyD$Nnx{;Ea>*}g9gEPeZBWPEv+`q7(tR?3lT4Gh@gX+9j*Z%zYM(#4s5>+% zs8W0eYSd>Oj1RZ!_OPw$T=~FAS6-p3^M@YQ=lm0{OWJMyDehq6@AhD%!iUlAS+$d< zF#MkS{Cw(0|Ao%_d|VM&h%ayEtxjN@_GP;}dFO;Mh_UQsXhc{4V3l)uy1w3aMY^R$ z{P=L(n(gB+F$;9fU4ExcFh{rMfuy7)epLL`Vj}!Y`(4q1KVbHF^X^t%VR2UwYn_@O zwSlf|)64O)i>zOG#gnOCI)1DKtcq*-Ckv{;c^$8=t`0@JFnxPLt;zsH=y>LW#8S7) zf!J&O=aYf#N#FxtSaWVCe(eMQ+kJ)BV}C~ki-KLO%l-Tt{g4~`BO;!6f~;Zma#fkA zJ?_cZa$OwsdD{HGetxhHcDp>;UAgOKzWQBzm)&fTfl)o>JMY*qA}TRr++xK7GH8Wf@G+n_N3Pr8;(v55;`N>7%y)H zmWMx`HVRQ$=HK7+>Y~|*`5cHqbILHu{O9UY>JVGaLQMRsT6@`o3)oIbbzE#Il9J8q zjpoz)GKTnAOGmP4Qjn0DXN&eJ&Hu&Um0%Iimk)r89K9{ZD8 zH={yGcbYn)@vn5EI{1U?kF}7lJKwY5^#;}K*xuUJ*cbP)-gknOuCHG7(ttagy-4fm zv~&M46o15l&q4S8@71lWf`DY$MP83H%cCMrIt4jWW50C3IDe5k@<=~qvM`GvcrouI@f^eT zaI1i1a+RM6<88Y$3qXWK;j?X3xWTw~!8+65zi@jgv_uOEJif4@7ZWnc)k!)Q<5>)O z^v1v}4HFettsdg*pUoQ93Pg6ct5Tv_1}l;H+;fir(00|mjGGl(Y;_cp(~(`10l`bL9`@beAy77Aw<*QMu%=~Dw`7TB&w%U0$$K-Re z-s+Hy796Ou(jP4){oS+!AO~Q^eG_5xu22OkQ@@67YAs8(P`6(Vfu`zA8B`!7jc(V` zSV>b#y%3o?CP(7*I!!?puuJc}3=-yP2KXptXg1|AuF7|5h9O~({oNxVV;Ll`{e3XD zjgv7LP@4Jdp!x$RcP;sMt5SrqhGN@f+3&m1c`=bLE=>?nFHkvBjPLXA{tQ$4y0oA8-)N_Nc zd1$?947Ea6XE1e_7G+5OCgJb%maG7JI2(H!B-TUc8|~^)1+v)aXn-!T=Y=}>C1&LF z6)NS*?Uv-`$+~N0Uqro;=bg{~p0%)WY-jyMXH4l+GQErqP1YUV_3oyDwc^LI>OUA3 z_AM+ca(@7_#Soz6uI|hiSaEjGwfSL+ifRwurLlAFtZJ()!YRx8=o0r3n2l)`l0L$I zXkSoq<1LHF3zq^!)s5!KzI)ePa(-`(y0skI;u_yL5_r+t3W+<*#;(=os(iXIdACHs z6?u!YdE}E+=ursyx3Aqsu9cMxzuAq})zmae3w(;o%Uh#fD)$!ZdXtUTQ*Lfj#Ch#G z@bD6MuW6cktDWwz1VvD@Hp7&2Adjhd7lj+)`+}!H0;)xHVn~uioDnA!I=TPkgWCiOL|e9C>)=yX{t`@hoejX*YyfJ!DV4-YR(~K4xxf zD@`~LFh`;=~KwNtG1=jrfq z2>tk(<%Qe9@h`;;2<@}vJFw@WV!5rjHW53p$OYit08H^Y11``mx|Mdc1vRS-oKyR3 ztn)jAun`2DS1DN%RTus~^iE)v$=-oYm^_^F(O*M_mvx6GqQ7~EwxJ%9DqTZdDP$`- zzaDl;S+x}dnb|>d=*oy_f8CWOmlk#1av;~LhUrCW#;&r}vK{E>;J=T6^LB~rsG@iK zD?TwmL$bd5LZ}EBk(ZHc->#(*T7VJj8GzIok6m?YCj6kF_nD92qmIA#NV}Zb)Jf;I z;Ba+pnNq7Xee25M+o@GvjH`92T-Op3*Nwz87x=|USipY!HCPf*R0?C9c7quDA$=H;?in7js z)R4=iGPqjcysRs!#iW<|`3_DZ)k2D)G<3u-G`7T#6pFIxehMxhd4x}awb-A}sZWR8 zgRl~W74=HlD(}R%_-8mO$BBku@(f&dG^PX(*c($_bTL|Qf?Tq2#}LsvA-Z~7cJMHb z!5Z%+IqgkfZdNP5Jekh=i;x!|TXm zGc)CJjMYxJBXIQ>Pum?Z9ZC?#w}&QZ#Aq_tlikT%N20&8)olr8@GY zDmj%u7j%(+h~P@NEMk-VUitkMXHJ3bbWTVHh$U&yPwxBl%9KdOtut(dL1oDK{|0aI zRflXWr{AIg?2;EO&Zy$sR>vPSF{UPx{8hP){&?4q&!yg>A01Uo^Qq^k(Xv!jQwsF3 zWO(sXIqad#BV|R{9UiO!g#b*O@eWz73+TN?%Z|pK;9E?S&bX;t-vYwyo4$}e$-x|& zI z2v1rTRBgDk6pkTONA?}yQECmH7({;&i0v^XU&>bLlqy{r)b19Y< z6Y3cq95uPDRo?oW7uL!{la9 zRy&g}-D;$2TwN0OzRK7T-QeDxESjUl7fNv1X)zh;?ghfT)L?RMd89L#n+Fe6kO5<| zls^-WU3t165igl}OYZGLUM$t@x#=z66@}g<1fe2Y8;t3MAQQ3CY`vng#KgqMo}C2v zJQ0CBi|?LEiO?(d^{sNkBW-a>2#kQjjYYdEw@gA(oSK(+jHmqj9nE<)Y_eBB^|V&V z$jBHNmMo^r@>@=!lnUa0enzc{+xz>z5b3~>pn*ebsjj`lLzNBw%mY&ki@XF$&^<5? zUCfgui&YQK@sd+%A)iW}K>y(^l4JWzf%u5Kkvq%V*dz}#w}=lsG3*oc2qbQS0->yk1>xeTroW%F?{JyCH@dJ*`E))c$U1B zfhH|zID@;nU@{gHtV0jYvH`fAi{{S+$F9wC5FJ9hIzZ=NbPr?}LNQi5}elrAt7Vp&MzCmIkGzyN8e-x*HUvOQeUE9=aQzlimB?b)WBjf1lUyk01Xq z>#nZMT-SM>=W%?F_dA*5G*P*+z7Rv22)=ujk+RVtk5JW)jL~ao*X2Vz8oDQPI+;?M8ENY)_sAMk3nqKG_?1V;AoDvan ze@YYJ$0KN8=!ixdWlKAV3WjSj)xw!03?U{12IO3^dP%CQJj;09i2$8g~lCD7q z#rFv`O|_clkrDKH9`*Tg>qm}n6JI)1vEH?L0JW9sqNQDq5+aNhmaP#rdJ0(kzA(9{ z$SvxcgSyg1L`v8FyQ5%=@6ed4e=3sw7)B42e(5w_G&L z>znI%IJ{q%rbM~7=!9L!Jk3^keM{>1Wp;|*#WdtOfN;fVVtI!MJVFZjlWY;SSE{rG zAA>4^G`S4WI2nPdwcD8Z1P?vL5e_S{= zeU8II8aZZL#VK{<$|6WFa0v+XIjVn7k~@;MTU~v+z&?wPit+|@w=YIT$?z>e+z@ zXJu|oRSzKz`XqwqV zU&d@{0FYZ_1_~d~q#P7s0j7ir=Jd4p)C|$0I~>Fn2*&OE(q3@dg_{5_gK5g*OR8Rb zSh1_o&l0sbNy=|{Xd`h-B+ss4T~_{OG{#m`H7p_^SxDcO8t7`2&KqTZ>@W->#tBo5 z@nFB4gBg`ekcV6_WJ%Nd&^80NVLdbuJ`>rptP!ZG#GCFolGsHku!{+)58L0jDz0w4 z?VRCpur_D^)99zetqGpIt;Gbd{~|b8aH)0iJZ;-9Wd}K;hpFs*Yxr(Q@e0-dT(wxp?TOJI2c2YC9meokX9kiM5~=+ zW-d-~Z)SgQF`?Cjy?#GC@-3Ss74tuM8(6G>7}*Q&Y;3Mp>%+ahQlYpi_AJv-BaC8B zrS5?dcBP*1Ko*EZJD28U>+mn18%rGzrx)(p*)+~q#itqe53fdgi!Qi!m-5FO_H!2k z`U2wzgPc7Y&Z7g+tB;{Cto!bP+<&qyUSJ zeeUYoqr7f{cJuO*#tzH+*h(~20)<2fg%{Hk2|VuTa}qe>_#s?D<>hSq$niX}uN|7a z0?rlq(vjX~`Mu|4Eozq~I-ejIHumfulVvQdC7?@nP}|^g#L-tEMMLX$z9XdJGG)(Y zO?tP#2NpQ+Jh*wnvdM?-{%d$!M5WZ%j>*PE*+-9j&7u}An9WAa=^WQAZln6?v<6^T zA135k@0FVzuk{P!_FY?~p0g_(=+#UgURbOmd1LYVj=mS%N;u+uu4u#WV8MrP(W8XI z0YjNuSIc)hAc?kUv$KPaK9g=jR<TRyvY@3wfdaMz-B9K)XGhpm&oI0Z4G;G{4I=u{{-*!$LWWVk(YBOcHMS_S zmzI5PUDaKT3NB9LIyPYq@C35g1e!AMyU+Xm+y@$ObCGxGey&%2`QZapn_T%yK037% zWL%r4+t9b(yf2W7Q75&`KWt;0)h;<<7sA**+r3Z?W*B6n>k)0JA%BVmo94S2mvtEK z&6nYtXfAv?+ac-aE74m{az&fv zNWGJ4^U3ft(5P=<@6}_HmQ|n|hvlBW?)u5@d)dBRG{(0+fM9SSk1YLk;g#U-_xm`; zsili^lpu=6gXe2)2H3<6skd7feN8!S`lySlpQ`KsEV&TLLPw6N#_Efx^hQp{+F5@z z7i;FievLmKa;OOH8OUlE=U5k-B-ptFKMkHlgKj=mOMJVbIaEVf10poleNjn*uIsVn z_U&EI+wbPwCr%J9Kjcv$$!e%_i{?%55+%lJo*JqF5_fVp9Vz$N6PqWWk|qWjUm34E zKO6wX#-)yv_EonA$S|R_1C-r?FxcO}hjvgvJdrnp7+W@=JeMOr-dBpLl7pkTvhW;l zbz#AKmDNzEm$B(r#pukd>!L$RZ$9Uq5+m&xsSw@AWqo zbM=DCV6}@Q&S(x1x7g3CpIZDqUnV?eZ-7p~XTZ>er$$js3kW!FfAcH;Fy-6>{3bVV z-aOuqlq+|_$U*1q6%~Rq_9Ys9n0b@EIpu;g`tgOLu&-$I8;e{r>oOP?kDnqMG*L^5VMN!HYD{4{(hQSL4(+EYv}R2_ z4ckguKscPd-v#L=7EVuXxia&@^Iahti zSGJNyko!;rBC6OZXNc)W&o_NC*C$6Rl;@U0uOewQu42oN>*&*~@gu9==`Wn-)6C(A z=kgz^LP(n3J6;tH$B#u0)I((eByvdfObFB7-c6PE)|6aNcJMyyz$u&PDw*P(rJznTC2UiCfK#7n|j^11& zwcVMzG!G;a_zKjOZ^lPpoEVLyG~bNe&zO9({&E8&0?q`GN<1N_IM@-su6vMOOVQg!yu&E(Io-EV((o-~Ir-Ie)`4WB(BGxk(-Qo}HFNCk=$u7=T zL+r47!jFU})I4o|?|cf;jE+s<_UV3qw~#j*45_DvDCX`M;eKJ=Ev6y8L&-unvu^Rf z>pGAg!pz*cR{&^Y-##K;Tb*mGUa?BJ;(vbv?|oc$$}*Ns^2z|aB+aY66)V94%?dvk zna-Mwc8_rTz`P{Rh<2OUzO}}n!P9gcU>nP~)>=aD@eRGX|NIj6N$#>UhYN#JaM2-N zu-1!K%p@|mtx#Dzm_N3XhBRADP$F?ee2J93=xM>^Iy_0SU=1WXoz+(=K2+r<|=2ketTE!Wt;ltmDZ;vc(cEAIR&*PPu$Aa|;jfLVc8z8q$OH z?c2ANAB_#@^Ag$wgQrbqRqsKJPnPD1WONcBKj#>{AmiW|(VKZ^V37Mmej=6l_)K{^ zye=o_9&orqEpR!^9fQ00mn2$Y(hN0ErDGUcywR`##+fi*tD@`Jd_F$pEgCnwueU9a zJ<^-ocIj8|$=+Ok@Ta1tQ*=P=Wn;J=vC9tBK%Kyk{!B4syA}}H(ZSdPVuoh)o2h{k z%tSb`TQ37%SofBPZ4mYEV`(~w|fofK^p3GobkA0Be-e90TL^tQI;i- z15PNo-ex`#8=`YL09G`lX>$I>03ws80jE- zfOy%U*9}H}?zyxUuip}+e34R+NWS(GPAnmC$ro-^5*2?P9Y1<-_?9R@neMaCQJLTH zTIWJ0e~h~Z!CR-FUr07jm`kLndDq%8h_`+2$(+3;^pnGe6ZakRB62G^IDz|&T3AwI z8c=#%gU(3Luv05ux3#%=KrgBn6T;%S@jc>T8JLyzooxx_g{RL+X!zxzo#D20rw~XMs$EyOIwT6yR(=q13(;#Fu@u?thDdz+Q*Nnk@Tby@_cQh#kL+zhMbIFbt)&c6ocQt zxmouW^$6pjz*xGK(E5+jjF)%^iv9~Lo0dWVYE(}z&NO#AW_g4nerOrU` z=QROZIw+ZCj?9Krs8_ugwXuoVsgf$CcVZwVMOi*rSEYDBuA2**bYEw`2|vcf)Jswq z#3YXhU?b%mwMj+buj=z#Wk&AUxo-&|caXz*VUdyPgq*(KfzAg!+E79oDk^z>FYwXI z7A@t-(21e~!#yA|Uvx=|FcV58Rq+4}u@7xFO#92qR`AbdW;XvLqZk^>$ z*L=Z|VvnMB8#$$DylRjxlKE2t(%5fGb>V#M)#)>4U;1jQzP-26eFiIm><-4=1_zC) zeX+t40Y`0Ax<;OR1Tt{#QNO21oIS~)+Gm%;XrHcA`T*;f?kNQs#2u!^?1`@{aspG9 z+nIVnyMS>gb6I@HjOb&3=uUgBx)2_WijBe|+>|XeWLxz6ErJqV!yI(} zircHVa#6@H+<{xeRB-W;hI3PQXZVceL*c3$EksT*zN1cTi|w`j$HPS2J_gwO60$Ek z##lD)bC+yi8$!(KPF@zJT?9kU;AV@4f!bMqzq-x5h_N%tZ%|D1P*Dwr1m`)^JN0HI zaXkUc04Q5Z{?Bz}B$eTH*ceGMV7d=woBzkHSBK}g@#SA!!d^Q})+s&|0 z%ruzNB5gTsB5SXcVMz|96}~*;$5kBK&2&p_9~w@tbDen=iy1@TRYyk0?}7}k z&YH!>kG?vjQ`6~n7Ws?R{}7ObvI^*1A&02*HEM)>aFBTpThlm#x}J!o`sdp6P+6JG z%q(yM&}!B8xcr<~R3ql2Xy>K_KpNv&7SXXuotENj z{Db(^4EWKuUAHgK;1{K#UVaal1r$A;*$JK8_#b3+cXzkg_6vCB71ncWcK1{y9I;R?6#yr zMWaUPyAtFr+YE(1TE?dQkaXEo+xfPKaaT)tG(&7oy9)sV(U%kTPLb#x8f?zxvI4!TKM5eMeiLs8aR`%c#WwO?;R@FEn0-2I*c*|1h%LVv>6- zyRBCW9{Jc$L%-qID~`qyE$u5c$;)x7xrfv!x`Q1>58e?ixID53#1y0G>mJm^@RZ73|H2E0#w+u(JE4+S});__tPg*~ri zw8)y~3bMJUU`$ow7v1$(10IpCdi-B5tj|&o{SM}-3z*X_7pD||dt&+{g;Aa>HU+fE z`PmG8HdQw>8&kPisWcKsN;RUSg!HaX5(D*Luer2C#Fo;SRs9X-c#5#StxN+0Dr!#1 zc=&x(r8oDNI!%DSEKg!v)RP$)lmSPp$*Z`SX`VHDTCMm-;4`;?Yu}*TDGrT)T*Qs8 zvVK0V?B$-fpB}+(zccKuzXP%;L3Nvr6I`Rj^z;uI`L6Ie-cRPZV?2E56PQPfejoh_ z0YPRnt{ndX8$JO6IMse~30mtPMf_S-J@75At*um5Q1CP>Y(zKn^9$>efa5XbIPX-$7C zSHyOv;V7qa(!HG^PQcCg^eC{;&dp@rwx1uvC>GB7HM+aQ{qn?UIJT4#Qwt3p-81^o zlA=L-;pmQKgJvc?Sm4ohHU-3s@g}M)M-fDKQN>ZoO^YaX3CBm$L-|9P_1hrj(uaGO zXPZ8OfwWpqi`d{qo^vuBe+Zjq6q-4#-kIO&APa?$KCTGHL+hi96C?_J?(w$7WA_yJ zQ{oVnVLt}bL-~S$MhJ=7&#~++In`S=*C*nVu%zV$&=}kx!hJ5>Eozeyl5lwmY^+`RbE<$`8 z#S2K{79hMmH|@t@ut;!VPJ zePBuT79uBR(Neo*nnI=)~>f=;@g8)m_&QV=OUTJ*47?X!k+nY zk-jmp;=>F_DZO;Ys#w%YG(PsYVR8jBi`GXNpF3z76ghR#0I>NgdH75{q;7IuEPy=j zr}ojv&1pwV8-v8&fipEB9ZbZjnAx(y)Pt+a%rfCJS6V*ORO?J7ykBzddrkWc?LmT>(ImWXd&u)Q%<2?V@E0n(XLvbpdm{hTmGd!A%1Z#joWow*Qm z5z|nEWI9G{dvHYBKK*{fJPx<{)gxfp8iskdKliLaU*#2(#k}Co3;z=6xBv8;e60i%E1BK zFx&)kmT+}<_`3J~2X3e)Z41*DT)mkKF?z;1Wv2{V(K`ouAu8Jc4<*abJf^ch=|K>m zCFG|h--y&7i)w;sxpd^%zANiL>7s3}F=~36&ko-~=)a9?yhpeF`sGv1jJJs0=8wp) z3YeP)8$=AljlzGmC&3HTFpH9tYvO{d2Qi)~#Ufk^Ou#ZHdFJpvd0Tj)tn|o&M)|o~ zhbF&)9?mr_Bxf!I`6DSirL9Ci9KIU@iTeZd%%e7@C)G60=C+UDMFT&E)IfGsNX`xc&`X(4V>)>+l_BY(wEX zz_JWhK!z?Fx|Zv?}s!pY+R8Oq8N00QQi+Y{0QrZN26uDv#co z`_<>W+jIT9|NTV|#`GQlZaCB+X%B_qPX$I!u9UQN2~bqI9$h#%o^3e%C^M4#7bIsn z83gp_0slYl@un}u=bNWjzOp{M4rqgYn;= z=6}6jF~^2!<--@Qr6ce}FJ``;*5e1TH~$wi=eG~iRJTUdAns&J60EE3pC1TkZgRe? zY=(K&tCr8w8CabEhP3(j5BKMHdJ#`fZczg+FsS=jj@Q*qQ+@K=t3K7>|HA9L{u{pV z|6l(lc!U4T*O$9`RKFo-{`zVEc#-qzzyEZkro?$R!8_KG>#~fkpfEGkzcR@(Kbf_< zXyVmrv0*J&O~$v8AN1c8CD;Af-}N&wu5u6mfA`P8xHH;*TybQ7Jy{h7X`NbYhE;$~ znEw)*u6wocdQ8Cj2GPaE3^KjU(}Qk<~uv_Zi~9pE?K=6E?afF_TTUq5u+HsQS#0do7~kNS3?#0)KYXI9Nfl4)!{O z8$fHUuKGW(>^f(l>&AyvQ3vXmEJ-|)>gt>9fBl~?5mR^YIWZfl#od}-*)TuvB_3*h z!D+I$Z0DdbXyu_k&zdd%T9P|vz03SZ>t6TaJNW(GUhA@|HV}#jY@zuGhE1yhcS_;0 zUts7G4DtB3D&HYN&dK^arji+AY%BCjUjc?>u(Y7yC*b)u)w2EEPjiiFXFfZNG-lnp zcTM6mFW~RZExbrSRV9k|f<76?dA1a!k756P?u=IlEa11Rlc)QA5ai2Iv%W?1KMsP^ zk#R%)yZSM3EkOXiSzWziC)KU-KYu&}HR-Ji+rDcFafM54SEC{mB6UXEut2KE6! zGW0FowW%-VzVqDUnb+-tH@%tHKkoRm#L%BCIyTA<03Ly}oXmY_mV(tH5Y!ei6~Ap; z(&{N$5O)5~F?uKF6km@TJza_$b|qpeH4G8*N= zIH=AX8&?6*R90|V4~rfy9&~tKLkq!lzm7SjvLiRlDeV(06x;*5(p@?h2AOZ#;NoBG1Y?L|iYn#B-{CYt%cUC>j z!s?A22KJb4Cf$F$^uE}3n=}Mmb7YS;dRl;{s@hzdLm&{IuQCX-%_)!Um@h}pOYe6x zfflL{n-XDs)F z&2w~ExH||3n|qXpOdi25)|oTwctbLt>Vk38d5t~Lm(Wp!FtjS#{DsVht z13!;EFhU$OA`(A;+9LGp9`qY3P435U0}5t1dgvygIUs8$l*n@e82*JqXgU0R>v(0$ zZeHOoCX+M3;`SwaJOI|^{L)@9s;`=lLT+)gkYe}X2jWZ7^KGHq?=`J4CAlfuGHIes zCRAP6Q1t~rznzF(G~id&u2gK0+jm>3n2m!=*d0SiP%1XM>luo~e^u#oZ@XMFX)NP6 z!~O9qg6L@byWizvB>wvHsE`IiF>Ik^Rs`f*rcX9i;^j+1ZITMrOt}QI+*C&|;}6rO z9iF@4YYvQpm2x(>qSNq9ZK;!Ee*@TdzX4#bQn}=a+lLG43Zj^f>PBZ(^H!eSJ#b_R zH(xq{54M|ZRfXg-Q?5C<9^||*Vwr}s5*+<}nJYqm@$#&8&au!sH{s6}H%RU1dcZQd z{H^+ok->qqpzmhU-x2zSS*mm#t8|LrVP=kMK$b19W-t=zFd4qaD zP!m+muKqEnWuEiEvGBmzH>2VAHx}8!aw^2>AwGFziy{>~esgf~ z@^g246h#R@(mdeBqXlEv-$oE{y~JIfBjfHyHilRHMSpjjL73&{XbO_^XhmP25YusO@0niCBTiLvuYw=`3H#=q= zKiW@qCM92`4FNB8!!%D|?ZP;^O3Fdd6shM}h-_i)tXOHwtj*^Vj*2y-VXiQZE-zi1 z*apkpa0dslyNfLEE6?vlhF{IknNJ?u^RZN13?IFPleU^|#G>=wXF&VDFQ5hAmDN0} z`q!Cwhl~Up7cZ+D7(R1G(T;4tR;e}FW8^$Yl}y$9?l*wkS;M+z-R-c07^7Eim$VG6 zF3(GJCKzO`Tg$rge{SH#9tX2o7;Tz$ahj|p0t_E-At zwKa`VVUbKngoUz1j0dVC_!q23bt9L^tvsZ@?3N|1MbgRz$=U8w>!)gqk5w-mc-$t{ zk=kxein~%hjqm?)9S*FP19S5HZwbaPtm-X=9F`veCqXsEWCI^^uRRLVH=glEPvli^ zn2arwa3zPqcqUTi<4pQqkZm5~S)w1ixQ&&r%kv6Xee!p)klQwetE-=|LcPgO!(~B# z4wYQs-&ljkhRpU{HTMD?jC97?E#B_CDo6FNDOrDV1^R1jg|Lrpw}jooz{5sFV5~$h z5e(RR17q zlXQH`_=TMwcP*Nr{TPm{cQf!v8a9^BFDI~O$qcN;a`y1(;XLi?aj z<`l=cOJx+><}+0!EV9B#U$EAYW|jb&K0RT;G19lxuhkvtDu- zL2=D}u!x$cbld++gVbi+h4Y{FKBRkU`3kbOW`$DRm^fore9y6fWH&7l8O;PFI-jB_ z>R2J{k)L5xH1IJtP*d(sRJcw7Vr!|o+CQEoFm0;V_IQ|kN%AR))&++Kb#;M?|BJ;I z80xm_e@t|4={k%gu6^^i)RGc%5DW@iQ2QsgZt{2y9@nP5_C!xwnz=ZsPWsmG{d&bf zXE0;zW}{lwb-4MrE1?9{K- zI6sLv+5*nTAfT%waKqoecnFeSUspi`wTpc1ymH=)CSIy#}Wb1T5f zBR}j0&~L{2RMo%A(o3Rk5_rUZ+eG~KvZEdmN&05i#K>pvveGo7efVIvJQsLdB2MTF zz&R9JA&P=KoENe#p!#v~tZZmcxJ4t#7Vjl}5yV0m<-VNuin0-LJEXekmai`lo<|<} z^T{h$F1&&%3+uHTjDaLxjfh4`>;!!iQLY5Fj3vp%V0lKDgX3j?^D=BTJ52xM585$m zOMTy_f#^U8-Ym1R_~|E$aPho3S+q)qbI0ss%KdwGOxM}JObH)Y!{<9x`I-GP7tU;` z0B>sLmvAO^7r+KfJ6MjkR3pRUIA*J z&#+#<0)%P1)w{CbVJcNuqWBZ_y?%ng~U%q?%cu%vKDWH^K?(WCH zDB(u^L*2Mj=^DaNa|8&>s8hMo&t$q zRb^J%o|*V?Kd=lQ)aTa!Vi7U3h_#Y9`iP(%ldyW#A$p}iupmQ0@+^0q?ChP9g@n+` zUIuBvT9PoJ>b(lSjvLb?k)LIShS%atad-=71O(Msbdh5_iWt7`y|e`EPbP>M3XC-@wXYm6gb%I|vU zW~~~bo;Ul-qV{;SzWVZfB;@!kG%wkdcxtoE4q>r@Fc?8vJ8b#;nxfnsVRtQGz;MxwfHvQmc9!Eb4eH`f<3T3swc z)8*|rGNnbi0Y*Jim8DJARYoPNvrcyk1A|=nC9238Q>S(FeRI}SR&~>tMxvO7{#keV z_dl@%uabB@?pxIcy%y0;oH=c$n;yU#0}?1Kmmf|~YQ}znX{!z@D(J9vhE!jG*Z4K_ zFRyP;zMm5+iTh(Rc7J&&-BkJ=JWVZ73tNoxW`JCgu~!CV^R;^H8Ur}h^pj~R(ipnY z2GNzQfrlt0M%61oE!xFgV7|UevayOa6vvmZV$hR;saJ_C>e_ycUt4tR(Tt^&8dqio zIvd+})YuA^I{HCL6ouYQ2p$%TFMYTvON=8ALZ>zOo8g2p&%^t9sylEBa6fUj`hQ?B ztv`Pf=~vy8@Tnpz0$sFXBbJXS1)7i0F&lI}8~$J33S%mxYq^RPhsMw*Sg;oO1Iu~ybbocIzn-^D$$^OiFd z{EGtVua}uKGuu}#S_}(Y$gLlXJ?{(1OvZ z3~3;6Xxq&{_bCdhCqRnA^$Efi{PTtO&PZ-P9`8r)>%$V11NaS-ud3LVRV;%V5h~$3 zq!aFYp^&GsBZLp&jBY&}a`|pO2G}@ESp8V@UwzQok9O6QDqJ{{>e|^JZDjXy9 zc9+cagYq6^?eCU;TOf9UvWt82)W%H?YG+>g1Iz=^^>ESuo&vZztc0 z#8p^=NgvQru8&J+6F(Cdzg(Wa-vdlEbG~H1JvDB4v5ZBAP*=gN`l0zA6yYmr3fx>O zGAPgVbb=w!Wkje4fJZqL$H=uh&-#7K!qXUN{d?QUkIl5;fsWXsh6fh~VSFqK4Bk;q z1syQ(c>Xih5o4A#VF$7skQ=`yE>!(xEt6jdguE}pK56B#mQc>``=aFMf5dZf`BG6=05>Paeg|y7@_UIw&5y4AAQRDnr$lEI zlF;M<$vd%c-qz4mztt}7b@7F~x9zKaw}7quUXfut)?)hDzW($g_x=Tq5S0(bqKXp} z9v~Jf5rofn^*`Z8TIVP)wqEJ;)WXqu6u9+~%GUl;Mb2qW-V|UOT>1G)|N55Cw{LxI zMo96ZAEZTBE_Q{jRzkv^AFff2<9!d3nr7pW4$3ZgpqBgC*AJ@H`Q-PIs7fK2uV>&H zkMXV`)Ph0MXG{mdC@Clk71F>oiVk4rEm7XoN@i}CT}w~rld{mPDxmsGrwWJqEjwM8 zQ7H;Hk#`FS9z~S0=<8J{nwAB@CX`?1=$lEk#d#MAjGpe>nRKaGGJu06^AV}X!7<2S z;+(uKNAK=%ku>6&z7~o>H*1%)yFgs{BTFYks(Np(} z+^IT^yuVna_977agj>bd_FmfuxY}@LMm~O(d&)j*Rm9&E_wTzBGyFL=hzq0?saHN(f z5>{z}hMe^H#At{|do;9E3A}e6>Qnl%o?Jv)(`rz3W^t4!m?3dR1j6G)7~*)h0SFC# z^aiBVuF=Qt4AE!uqnDEQY1GnsP-DpzKz7&=5i4cY>t3ux%Y|)|E$Zyc4_T2S;ij)+2i%1P$d<=05{CL7O0DbbA z2qJm;cA~n7@q$YYA*SC}ngLT!N}y^>kq;yio<9|EZlQ z*tM#1|J(g;3Qx#7j+KNG*nUciA%A`{!}Apkxm2fBi3h)uRqPNwINRFzNXfXb_!>1g z856LQh3FJ~=E2r2Sb8L7l|z_s<1tLj8*s0R2NCqq+J}>aT0Vg?!swWe@dN$$Zy|Vc z1CI<&=1oNJ9hJ2=Qx}w+pU%>J!XN1Bebyv{(Hc8?7plsbp85b_!GDdek{mAtaIgdC z6)=F2N0EN|3^HWoi&4$pxh5@dQ66E6INEtLl7f8mLsnt>yEfjp`L+JleQc6a5!=E; z`v_W(L~HMJUv%V#5@YZJfQ@e`gJp2x`JQV3SvI8KgNK20($&M^||nY}+hjH99rOR!ULYq>LU zm}(oO4E(obDCYkfq z=N7?D|NLVs@_`Ryok#T}KiVCMen$2_iogFr_`5$!b)}qS=*7U?Fi_LGmudHx738-g zn7_Z;(6qM@-Bh%fTW5_w7t|koyecMFHy05eugo0OA7I#i^Z(EnH`Myjoq^Bq?_Ql< zq1lN1KY!GLaq^<-2YVbD-)?RKKYeR6%({bt&S$}zJR+TzHrDZxyqZ=aKSMj98O2S_ z;LW#aKD_^TCt`rx@BeDg@leuFM}MYteST9U#+*#ioLuR~g!jt(}opty|}Oa9k;@x}Je|L|{g($lm6%i3({iYw4Z<#tXC zJQ_VReTa%@cK$5d*I$vlSYZIaWfhVerEg>wERR81%`-;a(emUF;e5035m$J0sGk^5 zdU_~KE#~j{vhU&lFpvNd05!u2-`z8;`?{9;57lXfsl>DPZcQ;!jolZeFi^pY_bjj1 z8=Fug8*6!D!JqW_*NMmBCJJ9b-u+wKB%5frV{bb+P%CLj`Ow%SgsAOvKGV%A_rb`>&}efKX0SDB8|v4Ht+p;6dQ^Px;wOZCDJ&ZX1&PM6chev$OMwvJs`VsC&0iGB`Dxpu48#i<5!z3THcpZ@m~D>rY8#iD+7Vci z3h$er;Fhg>3iuUr;`Hq`6exdR3)bH~2~ly|JkUKnG=^U7{N>Qe;lcsZoZr8$oVMQA zkY>*-4$rIIOs3&|^zvQzH^_Lqrt=6jj;}&BqH!MLF9_?GcI>24><@wIye4O@gz6v|4Y1+qw}EaA9b%USLL*w<18L> zNg7gJkp8upqo{VoSx3;fn=B=vDf{qw`YAJ1|0cgcXM!)0tQ4e(r{5KO`!&^+4hC*n z%c$Bv{^&)=9T!F-{^oR^oibuUNH0b$c4ek{v{&*j`|cAtWlG$U?{f7O%S#+7V5YB$ zpFXj?NkqhFywW1?!3(ZeOTCG--^&cii-35REJa_w(P8P+A?t9GhnkDM?(bR3 zt=%8@uEs&onj&bJJ5_C1XjIiXmEp%V(tB`$UyDe+u7G*-t|0x}OAB|FjXid@$_UnP zNL?|g9YjBOhD1eCzjJDa-89xo0}_j8D*$= z$an35VIj|0mPo02a(&e~*{wQtcFkE%GIulN?8Y_ltEC8wv_ffKbKmP&Z6J9a1M7|Q zU-)?zUM`hgOp2xuY>Kj) zlF=&}GS&_>*)MMsduz)=KXFI9O=Z|W)ZVeSeYR}##nY->boY{HuBeiJBP}0IQegr- zXKJUpxVa^>WnmdMi(Nm{jWBi&4u-YU-r#X|CG)#1Y}ReXP)K{k+_~QvjfSQ5_9lEd$KejNjPIf~gKyQPb$tdmT6G;)U}9Nh0+XZL_h?9G zM;|tkgV8F^0%LUjB{aOvJy}fVvIjWonU#gbq)uu5 z0NUgBegLS)-(2I~;`avH71D(6xD}$YaM7QC_;h;BCLewNu2r?1QA-2X-I*#TVDnNy zu~Li)XWqFj|0_gIih{~$FY_F-X^_drx*hfGotT^D8upI!e4J||nNo_hFAOL%w{t`AzhkWOYZz+AbePm19_cnH<)!^h{R~I;;731-+p|K=5Z{;Ya zHy_ln5es<`PedJ^MG$-I`Ol#bC2sX{x@*nr8v~}?=b|Naf(cZx@*|E-7xptI$kJv2 zbkT~v_);0c%~TnDl)r1}&)2wKuOU;~AQ$4M>cB$1MTj3$#LO?ErR~tUxqElsH9l7R z>%u&X>m2U5i-5;dk4f4VvuX!JjOp}F)HJ6>)4uv11s2``5m8TOY4#}4!4?A={&m-EBS2vySJ(y9-+cn3CNXW4GZs*cbk}3n{?VrPx zi5Z2Z?W<~27&8zT*v8Iw`x$4$&}y}e30uq1cHoANi?7JW4l;~fvbQH3yB(8Gt8V(j zneVN$2QEosOJrtkQQ%PCY?jz#+K0x+ZnlF4iN1p+-HZ~(b^~JgEzj5P=P@j?Bk?A_ z*4yRzI_>!yiboDmX+p$4er`Yu?lqo;6(4@VuZwzLl~%(RwaER~J`KD$&Hl>I=RGz= zy9MWQde%1aCL;-E$0Li7$#>t?3lM3|mMr2qy>IwJ$u8VQ-N|gtY%9ltjHF;Yk+A{k z99UEriQFbii7Du3|K>(ZcC2?a4ylPSKjEniJ(K))^Zn0^(mDZUa@mPK{ux+!T@x=Y zNi6G-TdFVi)DVAZ_LakHUw5qd=Q;1_mCufblT}uEITh~M520HPS8mZ{&$GV!c`E(W zLCZU-0-Zw$cjl-?)xK#{9#T8B?+`8)J=rSG%b@sCDkJ}a3hplo-|FS@hMH?CXHuq~?lgc|LfMxd*F{ zAej>2&+HrBw9QrMoKP)T-c*ov7ltCBWva{!ye~) z9l4m+E!3c<-j07 zHc`F{&mnR!uzb#5P29KI?(xiZ^FGg`cO9kztdQZ8`Pjj|kXtFVx77$nk^b!FdneIv zkqssN$LrNR(UA{zJAFp^zCr)&(qto#N&q*?*3i<-V_$S(SZGB5pP z=I!8A30^~fPsr;=-p54@Uk{IKxpVgok_%-KcM#Y66>|97vzD233VvSkXVa>R&D!Qv zB=aviR%924*Qh*#=Ec5DoPyBq6SHCjZ zpI6w}M($y~kX&&btQ{M5K!v{TmeKH#d?Yr$MO^0SkwnLvK*gJ!Lu;hWYOvK@|PAXu^TMl*=I zP-5+bP0QS6+aJ)b@O~9vLFP4lIhnpe)Ptv`$=}Xa;9;;ch;+KTEARzosOrSmxp^^i z3vt4m@rH9`FJ=kKzh6UIajyAp)vbcuS|PH2xA{ciY8ED(?b=ekM@ zu({fdx++j1!Nsji8RU04%rRK%NiOIw@wV{w@$E_+%<3#o^o1ML*==S_+X8SIP2Pj= zt*xD27<{QO`2;?!$MFd`m#euWqdK2$!6GBcKsG)ajj@UD;_RSeY{{~zprS72;{k}f zQ_r^tck^=O3mWXc<966gYJ>>5oQ3Q4(A( zm@LLiMH@oe_m({@_G;7r4|#7D6-WQIiQ*8PK;zQE-Q8V-yOZGV?vN0H;2PZB8g~f6 zJ-9mrf=lCYD(_iyzIXm>zH>2a&DGQetD&2stEl?*-p_u7Q<^C7wg=fR?fTFBANR|5 zV*6w1w}I>Yk6~W0-d)%e6&01tHU;~yPh94 zlZ58DhJiYe2Xi8{1#n{-p30XiRLvIM+IPM`;V=u#P%>X$;L8YKtg|W&HkGzUxre%k`9gDDUQL8XHye28KM~q&B(M|H-SZN7dd_FW}b~E zP9!-F$oP8!biYt2qW^%#YkICf%mWK_)DqqPTOHYVrin(sqK85*q~}bx`AHXDX|*3| z$r8NWe_RY>P8O(Tp#PNhegDH8{qf@WuS?(EFwZGkOFIf~4zcQJ2%KTB-~zHmE-$AB zNtzGY^*QfrelvfYYALasubMIC*Tqil70@vg5%y0xgbwfnS~IuE%zT$IHl>#*3TcH; zJYvwT?i?|1WFxrqjhY&StA`)SK{S?%xJX>7Evc!6vhF`hBt-tar)GabBqN^dS|FlYRxQT6 zgL_xyh@rYD&{$>1ER)YbEScXhU^A#PJeaH-+*UxWd)zZ9LzR+2plf|B>FHeA?ntb=(Tai z+ksnui?4wAz~sakH|Hcf4Vir7+@4QI1AgksgHlU`Ws@ zbJxQPM(Bl4@kN;fdupBtf5e^ljM}0>l)uUCa$R&&K%OJ+vVJq$nv=Mi#N@ffsetCE z3cc|a6mjq@UQ)jml_&8RfY=`aCg)1E-%AuzEX-9w^;=}#zhgj z#ymb=YVcI+U+%re!((o1xLIm;4Y#mb3YwE_xbeSEdbRX?q%|>Je@qBV2_RXVp2K*) zS8;M$lM&U`)qT7;C6|CVOc^uto`#0T&X}#HWt7(uAlXR%&SPJ84I@Dcgr6MN!iEx? z2AzK#>zpq)HI1eaV?AwuY81ZhesTkpv)9DnWs~c}rG`RV&GSnx<7xFEJ*YUdsiKRMbrm@m*Tvw@AR4Lf&?!Bu=Z; zNIyHW)kOml5m@UqArQ!nXbvfk@Q08R88iYx;dMRoYO%}F>DQi{Vca$gYDot@;mETs z{`Z-mE_s87ic*%1{82)hjs%b5LKPym2<--SgsizL?0v_LA)V{~Fy41A&GoiTH zFxP*oyM~W@KaF6C1+Zmhnb@`QSKt11)>bwB$F-kzkh@)kQ~QDCcUp?$!YxbNqfOW< zFWTi%?Hn!yHQ!kP=`mZh=Bw7l_)FK%Sw?y;<{)z_T$Xr3@F2XS>O%HK*7!vNbh+)p zdXo{}%@%QwFjhWyV1M)QhBqF(aXV#A63Q3eIX*EMwf=Zh&x@!-MUQyQ1buX)mS}jj zy7)`1`bhD6=t9kn(RYtq{8kRB7+fM8x{)35QM1+zr&e4<=CiW-rt zj(#^;S`&+dz7`j)J;JU1I=7WC@W^Ioh<*F|}{-eRDH{ zkKm9qm3?`{+}4q)%yFLc8ljPnnyzbYkl{nT=)F-OC@#`Z$m$L;eQHXvjCtbU3+R;C ztCQ22%8fEvchWjagI`m1J)!36L>F?>jTTn>pW{FwK89yHi!?zbV z1s}@XJcPNRN_7j{!w!YqX`Q>q=`3BKK)=+xpO%`lsDjYnVR7Dr2@%P(Rg4&x#6SPG z2-yIwoc=KLfeQc1Z70s1BNilCSzE#TS$i7roqF+LkfS-Sy1wE&h4{NFrP!4ElEd6E z!6QU42qDwXF2!3jhT|;T*NenINGPp9&}wCFW&WhYl9b}aHLv#-gaj7uW9$&J1cmd8 z-jEYfBBF=5-Db|HVp&j5`r+HKsdwI44Wr~C_YhHT1q0iCI0;#q(1#y`SqLaTkbx;z zuo?P3e2?|SI=0P?`v%IPW*uYWa>c_23t`Ado&cC z*);e%iQ8^P4?m!d-8o(C@ixE0q(k&HmPSP;$+pb@8y|JDfqeXeL7%QsojIakAJz5NG9~G(Sx^eQq810)PzP* zdOcV1q>RsE!VF^i4rdPg!l&166BhtzjCmhAea^ihuG3b&zjHrn=Zv(SwkHtOhdQuL z19>T(8A7V9UVn=AIxY_F?L^*Y3VN$oZ=WmkVbu9P^&nGdTppEbHdW1(YRXwA_q1?& zKd%UY+P8L(S>6o9D0$TH%I|J22}pURLXU+?EH}3L=+pSmF+ikT{!mi=#(k zNN~!X_jXx+V*YbajVg$zIY(-8HLTC$FIJ&5<+`fLEQYjy=AMe!9MNDUf^GK;{BOuL zDh+r7tA@&wm}Uh6uBHZNT7ERTcFs93&^veX7`L~hK1UxcS7#dl5m+l)Wm*cEXc@Sp zQpQ!<<;ez^o&anu76*WI!>JsqgN&8W8-eVb=TBI|;B-FcWY9>;{!=hcnm2w>oA~kN z51B}9-*;^#pSmgy*~o-EHU2U9Uxznc6eCwuOA~XlKS|;95evHUuG%dO8ZofWg9X;c zz3JNh!;zBcU2T^>^QCoIj3eu8meMfJUdrClaIq{+3A({5`z#)xZSw|giUS4`R)Ut* zBKr7W?iMp_``WKVMyk^}IjP!?vds_6a%is_2Ef!2(L5rv&Ta@2ZwQBp!-Qi?VE$0D zqq;;Z#)mG1*}_O{(-TOuTO%0xY}qC27zXUJ{B+ge*34I)AH z1tFSZr1n;Uw5#d+X@^$Zs+OG z(D(idyT93WoSprKcO=A#e$ci5|IJVSg2bPRwY_wSoK&Ru2irv`Q(iMWlkV^A3{&6$ zLzfx301+cCHKkVGO=nq^XehtjLu5#XQIBKE(TdUCvspxY8;deDYa$+37qYYb!~htr zAqbFU7jf>^mpL73so^yfd~o1wnDl*6sT8_T<3s{<7Zw!lI=%)QYE)JQ5 zg}m_~_VvF6{hd$MXX4U&t_v}gOCEVE!XU5`JvgiKm=f^3XB5<3ATb76?*Aqy7hD8` zQ6%sP#^AzgoT0-=xPrDYg6zUex$Ui{eAfO^+*z&~Pv4XqC}LfY;!B0IfF@@3_`RQX zB!dt``1CYKus1v4kIgiT<7&>=mxTc}n|-OlSs%AdfP z>M~YzgP>X+h?#}(3#5taIypIU0*>1Ulezh%0s(rDkB^o+y;ObE)0!P7Ds5_w_VXrw zH=XLNrkxdV>R;h{giy95XcNES(kawgjmI{)1}_Z(1@YGh%#dxbFX4p}5my*1fqMa})ZXi>1D0v9&P z*&0?8n%aPK23F!w4Q(fK7$dPbgsHfEnPCn#tYoXThC=zzxO4>dcR1t3J;&g-v zIQXYAZ@1|t3K`t$&ww(-5LUpw6R!ec2;BQ&*!LDce1#u~xmmcj5CLU;=%%bEpxnlQ zEB(4eK{oJMpc8>I?yFsXTF&u#@>4FSlV#$)L);ffG;Jck<|Tn%mfP@#H{1%1ALz=b0%G5fOnt<+ZJG@E+66TeK?wJF-bwW7a(&A} z!hY9`Zt5eeZ39p2eNIdqqJ9w9U$!-~y>)SjbLW;~>8FiAm@5IJ5Dj4pIhT@ zVT^@6#P4wS;X zCuj41!ls*Uq8=)3=GG7R-OkMKq5{|PH7gB~%7gMZQV&9N%Bum^VkK#ZqLrDSx~nx^ zwOI^O7=kP%^K6Am7Df@nNakdzA>Ak|+YVYo9o<9I6;vO47E6sxK4JPFAqs4mjLdvX zDZHr12B~qpJC?a~(~TNN2#+Qt?3l%A*M)Va6FpH`3KBGd8#w%&uH!T)X^uhmI_m)6 z#=9){xEdDz>6qA1mE4X1ypLPAbMRuUc2n!}GKvxn(dn%|b8Eu%D=WwhMi4e;+9NYm z#Dz1MOxvlRE-iz{-XLcU^Kc`aa`5`>2W_og_t>)Q+qpaPS;HlH-MNG(`=^Kc%%i- zCu3m~_NG`hOFptG=TF^{uY zQC+PK^e{JrMhBWz=igPF&0v&)!K3)Z!~)3b%=~yL&QCl70=h2e~t@A>tiY>pdVRbzr^IWKp7+Qz+gzybspbu)8KRU4~AiZ~A zK)%9ia+?0(j-Uz)t>w3TpUAf)c;aN)<_I4jY!;hNMKHY^wMPCPv)Z#M;Q%R=7o}O^ z>^0{?s#MyW$ybgPvb?$Rl4sbBwWkMujCEL|Xk=oTOkVvYiRU|=Ni-Hlfxcx*h-sJB zQQY5g%EID~uBSWK68+T1_muR1S$Vc!t;NRji8Re$Q91m|)jH5#q+tWonLM0r@|d^4 zyB3*+e|k|&zS}HJ;T;LVaU{3F%^`m5T*NK@Wx5zX{)BeZ7g?QNC%jhL-W!*M>VBaZ z;qh>lxbn2BzZl4>%~O;Y2O@~gj-ehrT|%BUsDc8dirTUs94g*-cubdZUhIN8mub0& zo<>?>SN$I5>8oN`Dd**RTD?sI0k5teDUHbW{Y={AElQBy27Cd-qif_D7JnT;4!Hd> z{p+P%-ZS^o)m`H>98br;-n_@FM#N!0MAn}<94Ux9XnRjwJU{CdGil zGjDsKSWB^yxw4FK->fC`9_qa0IHX|I%NKJQ`O!@Me7fwG zQieE>l?p%U%*VP-;LObXcM9c;+Lx@$iuC$#)p1^>%eR%~OU1yR*jV@%G-Xn3f*Uxm{$r>(tExry6* z7T)cxzB|P2l55`rjeH;Vgj4!w;ZTQTWKb{Z4HZs6_(P&$uksBxM>pX~9pO!f;OvDK z-xl9TnsR^cbXDN1(-X0t6&lP6mN8U3mNd9CC{!~>u#pT7)f@riE*-HAn0d;s>3J)x zdf#97fWKtVNJG{fXmQwh5?KIc$nqf~)`DKFl7jy0gzuG3k8Svuoh(R^LMgGOf}yF% z;MMY&_jb;9CVdy8RKt&dmhA`obV*9p?cx@ZZzk@8LGQfHS|*$;t(q#v=n(EwdqqT% zn^vE-qsFOG$fb%w;Q{r&^+mjB2fGIqzcx|0?6M}!``m()#+;sp;tnnB1j>( z?UHo1AvX#_sX;^8Gqb6mUn}aKxSF(MT?H?6rowjE%niDt-@rCmxs1WsJ6@*Ev>Uzb zoPxL>Ks7Z5MNSeS^EG&KoT-URwH~aE2$b-Zm6l$@Fk)~-Y3~sb4%l&7b2V=FQI94Q zVyrZ1(y*K_QKtfZ2sb0;4?fAr5O$SZYH+R&dkX`wfKmm0&T_7f-Sg}1m;0@Vy{6TY zJm~}&7M+SnEe2}|2H^&Sv^xAe9oO?_{PiE)AG|z`Z+6WMH+=EBlyRWQKgu*x{O{{Emdo^2; z{D-RQO6|;u;P0=Urs0j*ZNBDG6MY`b&E|yAEN_>mSh|ka+%o#&H{q_NA z@97X@tSt53bU8ePJdy3*!Q6!eei+?yz9l)O@%Yz4SG2pQ5|?S^i4LB(HQn8TT6;ik z-K_#TyBQWzqr@IXMx??Yw(^CrKbgmLjd({fBRV|-{oGvC%1*1vCC@5$aWAlbzpJTv zCiGY-8Hz{Y+|X~$&?gz$Wn=F}emrBXlUZwM{Y>kK=*g3W=>{g1oL~RPq>@K4KaS@x zNfzShL3S+Z^sp&bWvqpN5|eOxQbj{F{ax|o%8GFn1m1GG&EqQD^f9^-{}R+u`ytvn zwrT9|=rnS;;&_TTO;mJVlv`+`U|7?bN&fGQR}dIv%dh{8*457{`E7rw@TaKn+>=g`32L<3eLg) zunj6X{fMZUhdlznsF07N(j`)bSDD&i?vw4JNKd=KsA#X78|zt&k2E)P@n{Aj?Bmlt z)`v<7iYJ`rhV>5f(HN*gaHC+)|g3`S`E6|zg+4QkXs|uqN$F~3(C*JvfU|% z^E>JZcFTI;QGE6mRu5#YVLfD~6%MM9@?9j(qI9pH_}Fo2IB6aIuVwX_WHJs`U+@t5 zyCA-l&D*aQmivlUUeVOn7DIEIwXc&>DJ(XRPnfal-IH)CjSE%o+%$^A5?0DZ$XADy zCzA6k%dJOyo=`yr`KnUsxBN#a8z_QQX0g00bw8fOA7%DG0IUnx{WD@g|BVRYFmg

+3>hUjxJ_Jtou6b_ArQi3LskGOenLFek}qiU~A&NpTdg8M1^L zFfGxQ;792X-F`DbLrW`b&}8R`YqnFINkL^8o&TzbN5u;+Ap=$Z-KQf7QBmlGzhpqW z!$OTjhcgi4dEJs6t8aU<;_Ei?8OQD3qu^~8x5EAPF%?B1x7>SD1dSv-CGaduJLY}r9N4&sel5D;&4?88;$@n#vQ8^b6G#tMc__n6Cc+QwyV*7w+$Wg1Og(z$ulQ0t(|z);_nE9N`7OlPrDMt|^nhe2pyF2Nf~XDWrBR1}`y z`{v0-=ddeSBbiJg@qCqOxRiiIzPdF!xZId+n3{ed%hH-lJ2@k33Bi!nveb9aX)#%^ z2v#8EtAIfp_Itd-mbUkf#EDb#&&O*%LsNF+gHTwSszEepe`yFQLUllpy=NpEHLIJA zcvnYDwkX~DY1~j*7^NRN6&#UT-2QR2CM=e!*Q>+>__C4+Y52xPVARRnTo>`xB>h^> z!$i@AblXG(4xIf4yZSl7{HdjT zd)}#{;P4C!8P@@V9-2S#?~(UYQ~OjgMC+V)RZcKHmbTUw;K$n!dxdw0B#t^Pk`plr zsScEjlj#;49cT|g*LrGbPr}B)gmi4!$jejDWl;i4SBj@w-ajir8;oRje#5yX9svJQ zADXGE8ID5C_v9Mh1x!*%yE0gT5%H{>-daF`GIONo#-CN!!w7#@$C$U;%Z=6me~8D0 zLiU#Xzwhf20~qS!2K`IWL|Rxs@04xC0X+S5pXj$ak!%rB`^K ztjKiUx>YgjomKYQ-Y+{xW_NXU%1&*N=04VT$+Aaop2bl?oYzebX4{%j6Wt0V&2pkB zUcxF2yCi5;zW<$?#{p>vis^hRmdy+-C}n>3_a1EnPNF={Ym%l?TA4uPQ99rQc(ZgB zzQXO0N-7rgHp_RS{lL%unZ)rY56gd~IP1yRPA2 z`(RCUVfQ0}<GsW8ZT6w{gT128vWb>BL?n2RM;~^Rv0i&s}=xKyKQBF~VOA*u((0u<=s?)*o^X z%SP7W3D6Pld&>K<$k-x^tQjbm0_{~<$?KqYzUHsP8B+7?^mN?~83C&TU7Ak?QjG+a zOKbC1-cgBqHWiKI3$>=@+)7wC*(nOQRmUntwdMQlE8`H2(JTJ4}e=!6{w)7>j@{H zT@go?Ns{WW=rwPI35G>9N0t>5k#7n}rr?NfS% zQgZCmBlfI&g&KUqi-nSFkkm8&cN(~9<$>?+n$vzwPdu&$;U_~ZW?sp8B7L_veVz?8 z)+Vk)s7r@K;Q%DQsB`sbCD>O z27~gHl4Y!Vj2i#Y0c#Wqk-4b*uWb2k2KUQPMjP+f%f5fgnD0EJJYIoeD0%!>Ve`8S zK76L7<@*VhO#hplH*%KkJuub>fK+3h^vh?ZIPEvOJ02O^{$?GA_ahh$BTAQyqQJDf z8sW}gUfa~$)?i4E+}2cLwT_8(#s5HmUdgiO&QGnqZmDF zoXv4huq)%XyVo14*4iyZHCXid0N+((_f{)K{1a8YV3@x?3Vkj48-j;s&Y#>ixp&>4 z=-pSS&?0%i5!wY#yxw~`G{rkorIF~cRr zm8E(*SCcgH-6qYgFnKtRXPkzZS->w<%p%IcO3PZmUKs&!cQedk#I&r@G;7a$JMW6V z7P(9rVaMGpR z&iLS9?De0y(!hhM{9LC`z196Bqv28+;wq+i+ zF7xKk(y=j8z7Q=k{*iSJvmMRtAs~oG0<9J}Audy#BleVNKp7c`S=ek%F|XlQ3%+N@ zg`vx$G6!&ww%FLw4zy5Z2c4N7#)9SFTMTB;nft8sd|`L`_3$>1 zp)}{Sta#2e)$zy(AHYB}oojXtb=T5~ufGrhC6um>XvP@v93nVbY56n#q%9;bidbrq z4V2y%IrLWtn<2e~>Ve{^MR8*mSDhx?EaahU}%I(%J7Av){X(F+J z{-Ak*I4duVEmmZJ^u%>D>y^`IWaQ@3DDWJ6^BO^uP72u37@-ZJ1DCR4UEs|(F%<3K zCt5O1399ImQw)GE=QQ4wMph&{_0vy#9W{=mD@yIA*yKQ4!HI)pY{qoibR|-nHpDvk zo5oFL4d$Gq0F%~<-9bu9#{l_CvBan33GaUSjl}I=HvI~vFV70EGW?7>S3u=R2M@pZ z>@ZLFg;#mhG8%5GE>FI+Z&&0vA`hSdRUu{ORp|Ct_!~&)B((IRKDOOW&GOvpbHKfB z6zc0At|TrLr%yfFS}vG^sT=%J*Dk_qxG_T;cX4iW%swbfS~szOE7Aczpt}}yVvf01 zOYZ3WtQI~&WMDrM<3N#flCVkm?Lw9=auaQ$K zAQSYO*N~ci866A_~QuFic z{e}CeC1r`_Ran<@e$bm!Z48Ip&lEWdUHe=gYR4y9p#Efeg+S2Yv?^;!4)`!@dj1WW zsbZmO&Xv)|O7biK11gI0^>$#X6Wu^UKVo;BwoF1Ke2O~vuLE1AZ8l2er2kdy_)ioM zN7UG7tK~Mcg9k(^-|Cy`e54+Brc2OTevNb~F7&k}-U7_3428fE@Zho`DM(=BzYf!D z+65uTW1-s~mEVWwzX-*H0Nq2mS89AW41=+#2#qPwZ#iPt2~Waii@7297xiX*7%QrQOAz0TqJqt5E>@QG+x-gy zO1y88Va_P2fwpnY`np#itp>=c;txxY7pspA!U@1IFs8@;`Ce2*Ln1Z_1>+A&G{Z;^ zX+RISLElqM_f;dRPfzVOQdFG4;M#|D)@CAgQX812CYH<6vg&eWcs~VDp_5S9RHuu{ z@p1m01p;>((-GI-9P9tFy|7eYT_+#H?rJ4xL>(PHItb_&b=letCvzX)Jp@xLct!69 z=CgSh58Zv>7ARKUW2Gw|N{2@~NmVCAzn_PEKj>tH?CGsn_ja^Ed6Z#ko7ZilDD5h> zd9VZ?9Rky4nji>wZ3-4fMIVe*Qf7b{mXuyPK6iGM7mX6>D6eFU zlwJdzp8`{OibdYmXyRAX+Ud?GopZ2|iykn~Jp&RF`ZpEbMfc=25^7aX46X1TP=RS6 z#ohLK>tX6dzjdhuto?mU+0!~tV-pk{)2wUJt5?D5@JYe;zyqncIe6fItyZN$Hjkii>ZKwbbu8g0PSHNJF( z18m}b9Kh1jl-w>f$ZLaU8F_iV^et(|b^BI5f>8RkWe6+{Mss$=l>ffnL&(i%l_8CX zS-s`z>lmc+Z5F0uJD=f4A-fV4(q`{3Z+Sr#!!Q7ZKgqK&?Q}*6G=hamx{gFMgL0l) zlKQz$fnG|Uo>3*iG#}lgA^c}=MSKB;|M}GL>%~Yloo4U*yUN+ZHt4go$1!j#8X#ek z(gP#TxKhpH!4~%-uww7-NQ&j%g(c(X+>#~W{trjO(pk=Uo=ayO`O=d5+a`@;JMiw$ zgxGFX+o?_uLj)k!EZZG}R|9g@Er1wyyP&@AufCy7g8^Itx5td1EiQHxUK9KMdM|=- z7Vx}iZTI3DW!&aDZOR}>MS``qj)KHlP*5;9!;r8$F67ko3iaapGGUM9`-rXM`ai(B zOL&wx64e4ik02l<#SeD816XVa)c{+>x$_Pm)O`sgQ4fCwjX1(7TPlv;r(M7 z_E){v)c2=CE>?hmo6+xgxu|xnyUB(Z!+5(*o`3K`;AsHjZzGC=>G>OZV~nVq*86I>oA8_78$IE~Q_56xlO0ki;U$NtV(hj?Mu z!bTZd;IYQf7TN^rbV_iJaxtFtY`NPciS&d6A%0QNglRS|!eaViTQMhQd$m`I53FLA z43Ks3LVuiL6U{KBF736qzwf!Xr_uRdwqnXB?;W}GH#XK9ky|llA8@kRhcQ^c+LL1@ z!&<4EUwRD;=PON=V~q;ImzQ8MigMd*^dk4x=(M3=J_>4l^ST01cSe$Lu%%UhWgnxh z0H*Wt752M1Kr#r(sTh<_%L~IWP|e#1wlf(Ai<`8j_xHFOzeLP}unL7Eu?H_tl;;Gs$7H-y{=vL#iq3-OiIv zPfJU~q`DX8znZW@e6<`sb2+Tr2gd74AtwG4=5Mx4eR zA&7daDyt0V_LNb$)Ba`7P@}Aj6*~6?L!iDD%9TnJ%NJKE5 zw^kso_FDE3&VQfmh|F6(rgu$%8=%Ma{h_F2sf<)lL4Ek2I2^$QNZxHXpXx6D)KYt{ z0}>>K$(QxQj09A$#2mp2RgYu5UFZ0(y2f;9dxnEx5^dbMe%Qn5qJThrlKn6wJQ}{7 z9Cd5#;C=Iwe+2Yo`j=Sv-IFo`R+427HjXhFLMNDgulxClb3Z?(P$g6Fp6L$IL9qbB zBNo#D0o|nrE=z2VPcVrL33MYQxO8P9nDB5GvLetD;j78siAw_iOqWAaFNAv~GXCC)wKEd;?JBFQPi1nH^2x;Et@P7#-5}_4VCuL~aHb zYE{3c=myb=Z{OO@l)QoUgC;jG=>3&S)!VHatohlu%G4mkng2~~zk6;wopCo8aS(f) zVE|G8D%WN6y>6H*6&z)=bI($tC8jBR)K2A5uN*hvASEUp09;O((bkS z1CdDN-j#^Quf8++73Y-j%@LQKX%?Z7j%;**^wUe9S*Iw}^>D^^Yu8c0g|juT(x^ov zi6$Dchl$62F41l2B`M0S=W@|q6f$UMJ`>Jio)rs^3>^XVPYqAiR43#ouM0aU!hCBg zQ|Q_$pB`=|mf1-6FDFEp*49KX05$(t0G#^nJl1{`nVO+Izulu@873$2LIslo zjYzG|`*JQKPs&P>G$q(4mCD(Mk-O62{J&kZZ@jv9?)uf1ci0<9Lo-q&Qb6xWhJq?# zdZWJtLE)DScB9sZxq20&I-(Pvj@LlJ9i{IjA-arXe%UEw+s05a(L5!4)^n<>Q{=&#w+p4koyM(a&#pT_dpHrwFe~Wl|Bd%&)*X z4aup@u77H8NZa;7zu#}Ms{9c*B=E~$DhzcH7H|j=mKzPiO(u$J{(w$35<@$fNU2u1#VB zZ==L$5mVC$UT6})Bhfze?*6O_YKUal@HBrxbCdQbBk({#C4v=r!DC%I*@*Z8doX5y z*Jeksi>@sT1q)$1b2p9&cCvuM{z2nVPOpbYpQnw5UHhgKn;W+$R zt90Pjqtcik|HI3**QN_9^W_C5k%u&;*z1Q{Q@$o?7lj5ypX-omu9raQUt}+J^$l`( zNb=ibQw7etI2t-b%V7@7!P*R!KC8j`hj@#%Ea_LX*(27t+#m*cF^l$KE@=Xlezsz zn-&X|bU_8-j{W`pgWvd|aV?j7L(Q(+EO2f)x~FTux?W&FSE0L7(G)4&-QvE$b-cSB zBUU@q8FpPu<}eY^fwsg^4-if}#Gt)`;Np_Q`D!*?I^}p;$dCd2ygj z3+UbiJ>vnOrnH;JUXP&q&F2EoKfL&`0&0bBmVXsLek+}U$mt=Z-GTrgKZ!;uW!SL^ zLzl=A=wQl*5n<{0`LctcEi&TKEs9A@Lv5!W)nV=~qUyXMjx0v?@<8N~S*@x6&58E% z>2z^SFR-5=baLUJTPs-rKY*Cqp(N>MnbUQvpgknx2iSgcP>wtfhw4Oo;`~`aU=iOF zQ$Ma#|EyA2%qas^M@omfoi5sTFgEw_5sR2x-gF5M0Sa_RhwbM6{Sfa}&n7`9;Cus6 zjeoFoQHk02MjqjUcZGRR>kw~a=W9c#n$~yHN!qK*e%=iYjpX4oJ7>vmdEPue?%&&n z$wW?Z@1Q`Vs?BST5DHd9d@!?!$einf5bt!BzzSGmyj+v4t*Bmu`e%x>j$b4&XvV|? zcu+@Bqn`LCenyJk4sL~`4;=aympme;GIn>AqrbFJQ4|F3N z)vAD5%n49?n}Gs#vHch2f&}8h-ZqwVd0#(0p7ww}G8sxZ@?nS3(_6@3ihtP7K`SBJ+3*61kUV9=QbFOAg#E0!eL}DJm+x0h6OK z>z|+B@@9q`U{b|Zg6QCq{)HAlx5dW2By_#sNul}@AD2`P+1bEPIPj8rR*p0}HdU#z z(X2YO34KsVC5+PK>=&W58ooQ_7#~9uaX9S&Y@mo@J#Dr~oaOcON`~9R(YgNVt>&42 zq6oKM2`_6t7b>`;z?g6)OPxh`gk(U%hVR9fVMsp<4Tyk7-?pTP>T_gce^I0j_wIir8OT>(Fa)%Rkxr-1Fr zAmIBz0Ps&dVVUj3Ro=P4!!5cx8T%Ljvk)*WVP_B>3yR1G1f+$4+{#lWTQBGh8{=Zg#H&N3!+#sP#Wkoj2=Ar~*$v+5 z5)X$7m5+oUKT?+npI9EGxz`WP3h1`ZpC`WRfS-kNIZq%ikCP*cm9ns%U)1uo9s%(P zo>CpdFN6Y~rlf+t7X^WMT&nff_b*9NYi#P6FA|F-EsUN2h}?Q#_P8N zy7`Sw3DVTdr#_~@ZQ3mikMT<>&03cOk54oD-RclE(Rr_ak~WgQ2Xga6u&bdSFBe< z8d<}3qV9PCDcs8ZlIh9)NyX{}O0@Mt*mM~=xEa}VSc(bl^8WsdPPF-z8I@Vlzmu>S zzvNGnCG?Uvx%TR!sZA&eRLF#ld1 zSwW_6*x6NF)aU1FEAXp0E9Nh{(%IS}`=zco2i6OaK5K2r0{Dy3+u`JktdGuUJ#2c_ z09el*M?LR5tuY(0gQ?UltI{b z-WF#XZ6p-Zo{M(|i@BX;(fb2&g-}8!YFNfMgjmp&i?mUZ$xh#=`{2WwweB|JWR_{Felf3=%`e)envI3Jm(62;R# znAg!zws?fO8>D#08QQffR1dS>|NDmcwB!fs%fdtI_CMm-q`2g+27LsXBW$VJ^A_T zm;e1I|L-`-|NGYxV@mlH#lKe>9Go~>7AD3>{wd4F^it)kzq<58V#(b?)RaytJ%7}q zgOxk>+51g(SLKYu!Hjan8Ro%{W8K+%kT9j_AQ zi_^F!{U)A~&sG6`Es`UkSCkz6pztLvjpqG8SRpY0lil{v)F@-KsL{Af{`Rzy;YeC)Y#`Q-+wGQAE@+F1Rvz%RoBX|{?ssER6CG&;ltax^(M>5tZ3$cNouGurtx$J#55OiU$t1i`X!p}-*@&5G) z(i0l}zktzxgj;({WBlQ*eZGsgJ zuc&9%RcX-h7Ah3oX3EDP?ZJ!BLQER*qu3ZsgQG-Y5xX0m?Wn*JH$@7QjEp74h*VMC= zi*^d7<&K$eoO!xzN}cw-p_}zCk}3Sm?3rl=jWa_szTATt>3k#+^ebwLRMdP@vf@+) zsC+7S^I6U+WXHA+SZXvhQQBPstTZgp@VVzj`QnR?!i0QiTEJOpc0BuJ*GF_TH@sm_ zFoing-c9F|(qmmx!Y+J$&tlF_4*&#w;L@Ed6nlK-moW-4_*ia_auL4#L=6}}C7I1P z8)*@EPQo&KWKIT^E;I+$w(QQ=gK<5cr$jS_JlcxFD}j?v2y_V66-;8gJxVoGZ&>h( zntG>XIEq1S?fda6KT+VCl0tPCt(?hF?gE}PUv>hwg;+z05Y#=c)F;gi=R9VuzjaunQ7?U_H>DFt7vgqLcf}rM^OS4k{)lnUufSumOUbiiWP4 z+cl5C8SqM=Gg2k4SPo>e`hYJnT4q)^z2KiK=#89M>i3BMs}S7iV56voET8~N_Vq^H zh9ItHS;6xVOm|Bhn68&>csh~mj8?HT(+NA#)M+kFrsZ-<4(e^dzN{B= zI9wD{Em3C(5je@^HD4-t6&@EyM?v#ud^NerB_JUo!NtPrG+U*XyJEHV zqZmL0Q@6FX-OQ&Ks20ToI0@cgL!dX`k#DrHA)hs__F>MU%WW}Bw||9+ZeuNfOa$2K z*QDLDErRq|JJ0w0e4dr>nWPg&`fZv0bGLjLV}50n*Ybag!e#1?#ok&^7w+RRnt`X| zS@}^Ys4vVh)RD<(dLo*u9Pg-wu2o8m<^dk~D&~i5$VNAVIg9@#QP=PNs*IBrvXMX6 zHwvZ~`nhkn*NxGV)JgBQ6K6Xc7s||%k3C|KrsJ#q3tz{*a^Dosy=<%J%J%Et-DOs1 z46zgji=xYYLX!=ERM*Wq>S(zuGznR*8Uo_pRi(xD^}E`IRbQy<&4?I|f8xk4%#lkV zO9!6knv(t9FM|^1)cpLAeP^(k_YMw5k1H$bF~LR=_f0gf0W0Clva+&K=xDhO`VhXQ zvJs+?s($xM3M5xfO#Dv%tSHLj9)`qxvq#SreXI7*)6`kYcWEl5vOKj#6^9eXz?y{j ze6P3d6D#9B-mi7M_~|bfq2q9d*UwqF_42a%WO8z9QDIK}jmEaaPOD8~Fb90Vm20Gx z#A3fi*nh%ImlFZZ^x1_|RB)95)!K*py&CLsm=(6Taymx!*H%2+YD*F+yZGgIfx0+U zJ|MF>`QruHxuO8BwaTDR#fwX@lBZ~3NwKKO#MIfMJ|?fWS`mKoBxm$yT6)|ccrJp8t7+Kcn{>QzbFLGZ4tke(H| z3EB7G4gPUuyEmrje)~!d%tvtPXlbbHz7kE&-b}ywAYNa~KZj9`g#4MCDTirmRmY{q zfCo%z26Cjm7?aGMckHAP`BU{~1@fyQEfdnVIXn?_@wYw8;?3bjIAky%3w=K6nZGUX zMfj$N3s?05Zv7bWH&0d$M{FffJb!*EO9K%!@~)H;7KIY-aFE*o%-?$CLD3`h%KV+Q z>V{j3e62Em7LY$$yIQyB%HIdE0vu@rboI}r)=0SJ=%0`$CbivPDpd>&;L-gV-1Ow4qNAxxns5A3N!UOBYHz2a=GQQ4 zd~7~Dm{8((*dsUS5~7d@Choa?X#Bk5EuFxv(zFN&^L4kyuh%^pRNssHTKbm#|C*3_ zSOQ?kH@q>O)n(Sah!w^IinkV}#XO~M*X&hy`|Z|B4g{Mpn{cOlQBN092wVY!KP&iY z--6R25|mj!z{j2V+DTO?maRQo_OaPA;V-xDy*6uX*U;?Y{Syphg6Uz2yZNL{Pgt@E zgyY@gw-Z+S1KkLLj7{(|Oh&%F>ky@ex9WzR;tipEm6n0p9-=VRWNN#5b-)%F*0edc zM=B+m+7D8N{c}^l?Z zr~(HgQQ!$DJ9maVQd~@sZCkw(x7OqwqD=qLuJP+ng8z^M_Pl z^lRLtFh{baaHf@>o%v9Mf8IVH8HJtTAh9r%zdoU0R8G6mOTaIFY!^`a64L$sx0YnZ zK4NNOkQ1&G-o9W}&6!O@{ajh?3<*|39>2hR)m34p@n-kc0Zx|wJ16&_qh8XS71sIG zg1cV=oIk~YMdpKpFy0Jqm<9IPCwn7N%)a5yX2%MYII)Y^kVk)o!{Z(RlXOIz?!?xn z&z%B}!3_s-`KRwi!F7VVJ=+JC-z1fC05BR=j?lb6qi(r*qY6!1VOSl%G`W6@vkf&&*|nS{K$)UF7+2lN5>NE zpMDFToDNA%G#U*gNP!sL-sGbBY9|`l`|~yuP$m`+C)B7-ZYz`o<;JQF;C{TKq3Ii^ zQ(7C5AXN}0YHn`EoqL-)Xg4HSP+l4kd5bTb&XQcRr81+Q!q1xszqs%RXQS8#n)I;W|;E7LzTL;GdGR-SBkX@0``S zwjpoon3t7xc*8;1^LB}5aBy%mO$_n;%hIAC_a-?Vog}}Cz`#iH zAVSHg-l+4sTof7=`C;fWje$XGAGQ~(O$_OWM&;+U_S2yC;~S140VV}J=J!6nXex1} zpa>zU!D%tMxOX0_vD#yS{~0=ZG_!WYj-AZsgU{$T%yP-RY1KjOGSbq@n*!Y2s=A{> z)-2WzjOV*Nn0R=24$P%O8xzIa5(6BmLNcDaOwI>0#_Mn2|KJ>7LJ`%705j<+9rt&i zK1q}CK7A_R@^DiyFXUExchr9QXL~!VI^fiQXr$Tw_KXVZz&NzsQ>?cLk&Y^EO9r6y zJnasXOE4@Gtz!CUH~Bzj47sjK_O80d4{h(8kj%y?d>Pev`p9BawP(mVIE=_Dn$Y#1 z{DXhf9LLh&wjb1M-KuD+$6@SHb5_~20MC(qHw6FL(Pzc3l*q6m7;6M~5<0x+GW+5t z0d+Z5bftu%bdzyGXyAS-FDm3zeKy3<@CWj-+W4@JbNk3978#Pav-^_kPD|x>==XUH z^p1MHSi>)Z(+5m;cAfs>j?yVO)Dxa15vdnL9Ck{TE0yudRiiBY> zg$J;GFvvX~dcVzq6g>UxwvYso7t`fJ8X!b`sx|!pj;|_$M5EI=-7~S8s^_6h89VQH z%}7u7N)!|inA#RNI=d4GONhhx50mASSlO#C-Hi2AoEw#{-@xkmqmU?SC|9AKr<;=&4HSt5TYY};%SqNZmVWWc`CfZpy9Ru<9gFWST#Bf z5%^4e!uqC&31>$R+c%}_P8CGR6Aiz_+&{O0A^bpFpjHwFFbO+Sn|=NLp;S`Q-OFua zkiJRFa^piG=hK0j-=KH}zPCS~PsxzAF3r_R{kY|^XEepLY{C9yirZZU8cw{Pid2R$3dWZJ6oT-L>Pn!&5{Kj zb|$0v9d>g2*?HAA22)<=c&jxwHc_oz+58NyCe9PkdTrc|J_ej2Rj68x_*B?5&1v2S zMnlPzebFWIw_k1FE{LS|sOb(U9U2eSFHPnxlSGp2AOWcQ^%7$!aGUg$8}>mK>X**4 zEGfvhSoRa`!5u4Kr67BVOTEfAi{B3#83Hso?!l=WG@|u^n(Tm>n3(2FclXR)S8shvsmDr9|0q3mO+lJ85DMZml{uB{m_-GPQfo)ch74wG! zHKB-WJHQUm_my1R@73L~=NmZVXdTC1IElcLxd)Bvvt%59_07H%@r^_D6v*+Gtqv-t zghJ#mo_X>JscOOqBqsL@1!fz?G^&vI~6?yFP zQ@v0eu`clB3nGBUM!4LU90Rr5+W`w7o>!t{pwt3gRP5ha0j^$#2*XRnyjD6mq$1pW~rmpVfz75scNi!ZONK`b%ke-@brL`b1VdEB(G3+%}SpY6DGvy1L zFzyLKW#g|$ctqW`2VOhAUrfau@iWBy`2ww6bcvKUzkymLCU0f#Z&U??jFcL;cyw25 z(^N`v35X=>a)%adhAcm(s?9|%i0z}VPVGM|{>WZoBd}$qmvNaq5ATecSC)WP<#f)x!I0=Tl3egj{AjC9!%5tDQkHgWC1oJ1PZ`!^Nf>hL?UA zB&svovrZ-~i!OS|slWE8Zh7~N#@1*=+$ z5+Mo7d!`Wg6%{EHnGY+Sl(H56eC+GGMwMAs`Rgd(b`5vkX1BU|o6V&BW&#J&qpL;N zLnU>)&?H0$GR#Pyuj$mYZj`lv&nJ=e*R1fYram^3iUFka$wRH$uG`Q|F7dMwzZdex zoA6AxCr45IJlV)*7%hv=X`F0O%&VE;?KKI!ceO6a+lM^tb1A3#9xo}}?Q2hILNS6c z%As62mCNpBEY=u>>9ZoJCYpb71ihcihfW}xT{rZCjI444)@(@OKA&-~e4w2|PUH5Y z162?Ba39`(Zg}Ew*Lf`x2fce6R5{q7b`L5Me>A=zW23j@3MQHBY{vg=HO%a*N5bf1 zXTVasaoG)ty1oG-D6RwiCdN~q?jyT5WT~BrY^_1g+-ZMWk5>g91=Z!MR47W3)Pq8g z5xkUr@6|PUz*#STS0MLFVo<{Slx*e%Vq0?aW$=QjcNEe*>waXtb z_+s?xM}kuc?7c zdOe(T9yu}GYHKhD9sR28q06FklG2kTv}ocF@=5f=Z5^J99@#_&J4eTK6Q)o#j}UDl ztS!jxm8mVZLvnZyr$R>NCuJ4;_iTr(VqgsbMGJKF^&|jH!52q>C6z6Fbrb#2966aoA9<7KO zF1Gxdm{5UlT)x5}5y%|E!Qu5uO#~4S$xEX80#s%I0%dP_MMafo!E;_^rw7N@0c`Sz zbJclYu_3?95T8mS@jnasA%CckcAn`7JnkG)GVz=Ww}e=v6fw-&qnjIIdMJa2AP0B4 z6VE(r8?Tan)*V?uJUPyy*TCTaoloB45S^ zn0t)~BO=_03`;EC2q_8=vu7~Fs1G-LIeND%e80SYO_V}c^5`gOn0dVyy<7QS%4C?xHIMFjRV!{Ic`*oEy^JJ z`o6G$ZCmQWYC+8Zg1meE0wC`=*aZ`evFYh5mGp_Ap(Xa)<%;3s)zVMKjiLl{2b$_o z$4*YYawwl?=X*eVr^kP`x$dI&CzaSWDU{9q@&3|Tcp14IXdnp=Y(w!)>(Ks`7Beyr zUaQ$k1?pxHnvxFCgE3fGY;x)C_9F}Dvoq>T6Z1O}w`~1^DdvY-{Us$_dK#hHp{i7O zT6k|0RI89{^E>srVhE73{ULR5;~o5V^~Iejee}C;Y0Y9{_UL1}KC-EQj-01dfm6a6 z)x-6$$+w}<>&;49Y@gw+l-|Y5bhh)|If*P17GzFE**Jlj14mZv60dh43eFBd{5YW| zE*^@&W1QO@@vq_K*3$0(7X0Q3=~_kxx4HO`+S9}Vndcqjkk14SclwU{YRh)RCY?q%(=f{Uk1+1QG7W5o% z?&9$Zjx&qsYA6q*!FXc6@=;J8asIUb^A%36&sP%s;bDoOi=TSLjloaS>v86ljnV9; zJ8y>59SHq8Zddn%KYw_8rt72U4NjTcLnjpEZSC#$Ohsxf%{S%)eRI`zag?=>_>T0_ zhEk@Zl|O}QOfZoYtISmH)tk@G>~Z?NQh&@Esax*lsgFgrt?kuSIA6YLaA*)UoK^?h z)V$5@e))2O^(%gUjV7ag`!&<^8ijW8PstQrgctDZ1Xx(6JfE{F0i0s<=qRk+xy#}B z&pSRqQ3rvI4^i3~;z7!o=r_u3*LHyX{1bb$*xeNe0<)#-RIvT$V=T{0f^SM;SNsc zI%6tR?E&@%15=yG5qwc9wQx5158+qRl_Vx`O3-jN8|7T7bLVP-S8E1>YMV3y+#-1? zf+&Fr3x{54OmUkIeZ_H^)U_xlQsYcEVm*04Kw2h2G#Wl!rwL8@#(&_}4mW0-X8~`G z{3HBfP$3)AZ24rNe?$8@*09fswhg1gC&iNx6hq(gU9CQ;x$66J7UskP&G>6GhnjRy zpVTAg_h&sIsqCiUonPVjkUffWoabj|>Y|oHb|u}z4}wb2>qK{6DeL`A)ps&+-GPK0 zeyR{M9@#AAcg7lb^6al(z3TRYMT9&|>Gp|X2$A0oh__tPh|p|9yODU%Nb)Z*ZcPPk z5lAz}xPmddt^pB$s{}KOnN#O?=d8|Wxo@$GFxVr)Qqt0a@AA*R_14lr?qz$Z`|BeO zK3yl8iFDA9+MBPM{~BuF+@?~tCo$b+dgytCivO>GV4iY=a|`OABaxm`qv1o+$$F+N zJWZXNt3Z83LNb$trrJ=fk1PTGdx;cZ?qi#2tkgoiNGaE0EK1lgF{*DuU1CJH`9zn{ ze6 zAy9g@*w;__ysZC8B{Qd_tX5CxT>Q1<&Um&n!Oy~+?ij*+1=|{l?Cyut{y@36aKSK4 zAAT(j$u%|w#F(P>xw-=LoCQUMe*!no?{1?{=y4841Id&?W2b|LD9k6N2?R`132P7M z>nd&(qXmj!#0#TXbah~0_l@`HP*mvER7H8Vq#$rFD9GV3OMS?50nY2MAFcH`bam&! zc2~8?5+?Aj^3(v*XTwQR+u1Yd36q#e;`C1Jf}D)(c9R75x%Gd`a;YDJ|D_Yu*&>DctdG{EByJ0aiaxDaC-|@YB zpasp$?9{O(%Fr~NOYPrCuJZ_O=}GmhaJh%9>MBqkQ%;PZlzG*odq ztiN9x=jx&@kbu5m@I2PkXX~)i^^zIqtzs-_9LrU3=?-u5{i1~enk8L!-2VLmFm}n1 zGtB#Axl`!MO(FAXto#+nROCLwQ*OGrnQ}pPRmbFDH81{R*}Bn!;C-1xeVKXq1W{I5 z9dh*QjC&OVyUOjT#i?RStG@hfgIUmo1&^pMW`qx^t0OEbaLpZ&dE`&ZFCQW2MI2(= zF;yV&;=*^}emUtlKJ3kzx0lVns`qVpg5syG5QUQE&{wQ?b5m!^ZT#IEKC2xj1sf!! ztb{v5H$Q6H_DO7qN}^%RLa4cFuigAw_nZ%qJZ&c7|=<)+Dmf zj*Ppz`*SXTgiWONkb5p~byU9);xPByiw`A>O)9C8lz>uicz1;dS-3%Cw;6qvrZe{U;NH# zcu}E~>W=KiW0Jr*n~I6=D?+_%@rKH4Pmraso|Y>oB{XL8ZQec!C=@Jo&8!9~ScS}1 zroFMnQ`1pvoo}4?N14?rlI&?}@1P*o|DZh?Vn)Iis1=1T)mVwT^ZR=kSlIRTXC?19nYEQ!WdR{#{X3pcwN=fVJK^UyB@S8{N*%W_W;SD@WcEgi?t#Bzn1K_-*PD;dvY zU7Y+cQ{zYr9{W^nUA(u_%T>(Q@C^3F%mO;i#{^0&8@h7(HUGq5JAo&PCG`)sV*4kf zjs78(#TyKw52T6{Q`+&W;L(~@3%%$-QmxYfptTQQ{VE8PPJj^h=?tqC&CXuHdA~*~ zU#WGXbt`*|(FQd9HZKsBcVto%>YPoBw#8^cIxl%T{k3t=g4ch*`FG%5aY@T+U~(L}8rnF$GxaX?A##ty(wp z$pjM%6@og+)*o|+wPHFh*M@Oi=G7nK0>~n-D5RAqLmw_dA~KBRwNp?2M1hKSWlS_7 z8heA&zGBLwCqEpXyWk^HLyEqE*-Uv>Gv|mf5uw7dpnj{d4O9f7LDauD9h6P8`XVNpsj12#D3}z!%_I})LG)-iTj{%TF3rpI zUuh+xH9!y$6^&uOmOPKC(|EUF1Tdv{7jxG6B{F^>3Q~7Lp_lXc^=ZDfsF_(lAtV0( z2eCMpT)opswd|=vRi<;Yf;vqu6Dnxp0j~W;nl%b>exswK$_wNmC1l=*WYv1;dN;`O zKE-9xY#6&zo&3x1ucB|WE$bPfJmZ2UhTc%|3ywzoUiJ(d9}yl?tsd=*WVt9b{l~j% zWC&|>P81zVKd3jn-iL(u&U^Q>P7(x`P`BHf{usUJ(}?IjFk>YiPdmhTm3u+u%1Vpw zT^g!VuPSo<_!uJ1Ax3!HJ0i7R4(h`g`69`itp?dk^^a#4Q4yIlC1d2|dejcSs(dov3x^)pMC<6Z!NLg`jhAyii@q7o$ZR*Yh&TW#PS_Kbgw=0zyno zJr3vEIh`MDLyP6pzD-}@CFF%#?(Qn~W-267B1%+?H0Y6x&*Q7u^?xzgZYDYPpe-~M zMAj+g$V8kIara7qky_N5a>ZL^PFdOY@$=S2@YY%%B+ie~-E0_WjOzx_-dPml8_7S=lqczQ*Znr`JZp(F;>v zug5u6*IrPd7r7P5I8m2jL&c;1Xi_RLD%3KzJJA|+3n~=Ge-tm6n;U-o){1M6FX{L< zIwspa=tFO0Xy3Nk?-|gL3F&F7T3Zmk@QI(DJc?X?!V`6lsBTl(rT7LDz4{pv{>f!` zi*bO0INL1kB+2NsM3lNd{TIHzqmAt9QydBG2^(yzkqPsK`YKdnUitHgIDQ9zsB^`$ zW9?+U&rDATj_m~w!U7TJm(tk{&~#Wy@Rk?qCF=j8`*3qASGRl6pz_&YAK*I8oKK%b zCMFVdbyIApp%%tYc|M7=9^OQ{)S!_|ewCI+!!#-OWN0(RJ^O;JYr0C4=RPW(qx^XJ zzUWpf>%RlN3}ZaI3=PBT)`LqR{|Nq+6FU!|`=X1^)PSPTv*Z?lynKCEA!pd(zs~LT zYD7bwS)+3Jk4FU`q!&6}9CzkS72vU6d{trOk$YpeVB5#!Z0LV7SMLyj911NjTR;{6 zx*R9`IA82t(69gKxOXKbDE?TQ&dLsxgp5*==Q&&^hPXYS6=1PgDG9W$teucLpry=I znr1*b$SDT=R;Zm8?t`quXTa&8g897s7F?M|sv@Ey3cQKR?cVxw9jmmQqKr1?`z3$p zkphU-@lF3iWXbR$r{CQ&v)svhgeGI8`bCT!gsb?;TUw%m9-pqA)m?Z!0qv)C`6Wwn zb8b1@JvP3&-lQLO-;f`+%I9&kD$5E<9U0&C0)5nZPy|>mgNeibwq-aYz1Ey&Z=DNo z{WOUU_iyq`3>2*9#l>=7Xo78_{32HgDf#%bjiMJPw60Y9Z4%?NN>{d1Vp$0fWK7QM>DIZ-@l(P5oUPZ(^H-CT(8m}3`DnwELOUV4i|YooNh#u#FcQ} zz1IPidw}L&Fj=&|Dkr2O${XzM#@ZqkQw+87?%DyLgv;vA4s{R_&qzufF>r8j-OOZw zo^5un4>00^$c30D*z0>&aiPSGwO_9}L4g-(D)QJDA57q6xE%A>6(`-O=@;BPO^+9f0w8WFpj8r{!nvAqs>0NMCw%7{0?m4 z&s@{IG`bewry>0kZN;d*1R2dU!0u|)h72j4kJs05Gu)7?Y)O0VGc}c{E_$F1FA|-q z3cX-lw0hUF5Nue6KH0$y9Jp#aIyxu)6+@CGI!$YrmUED48J?b_Ijbl{(puev`cqi~ zen{!we4UbRy@`N;z#3Ra73Kicr~;Lgv-?v5=%k6%^}JU(Xx=2XT=c=c{|r8_ELC>{ z?N*9?2KDP3`X`eK*7?n^F9Y$zYGxwiUp#s8XdwAkR9WC*(RIn)>@`wrYjx1McwnuB z)!u^C#?YgNRqYCbLm=1povE=d0nCR%YNSlCsnO#jwowNWa)r}7B0RNPY^)0;dh|y2k7su-N8MVIJ7_u7 zsUmB)BBZ~+J&z*uyb{%&o%GST{*%l(NZE_Hi$*-G+ZjTXqvLsSZ8Pi2qY8kVL8Zc$ zvz1XB1M%B-mK4+Qo250XotKBRsY;&Nr-17Dn?`T;Z_+T zMPc^BM&~c;%Cn%s&RR*xmhh^3Pd|J4kgbpTeJezX zz<@9EzG;@val(VSzop5ya%9k5l7c~QN>A>3MXwQLl&1%%m6ZqbYx^_-H(Yv3ZPly# zDbzJ^Y-`9Ws}N~Mx8Tu50$LwE$fe)B@pe0(5J*r!E`|?O#lkrsI?%HSywDTkhtuQq z-As1X0o0zfAv$8kM#r6LQ4sNn;DL(phK%Ki!l=+8UBLP=<<(kG#Le?y{m35}M*Z@_ z)nz&{gGo?g{dn06stJ0?5wptX@hhUz%x6$I5^gHX{T{RlArj_ZPZ7H0btLaK+KCI4?-qm*fpvTtn zP%rXvP*}WNc>SjN>dx*jS}LTilxzz%#21D0IsUDeVJt2X3xNe*H;iR{g9L5@rmt2K-2n>v+H$M3{;rdIrm=1mrdkN zo8(#Y9M>IJvzT)s0-A12O(L8AD^l~Td75sJ@frXikSl1QOxJtxbc zCzyJ<${*kyJV;cGH96PrfHK9Bm;wMw-R&5Hu}&nS3mu!kZyKiLBX>>pQ)Jw#spaA` zh0MR8onxd>xMnb_x7+-Q*KZ!8#fW^`o0Gcw?<-8YofBP7dHG+28-Uceh@$I?r0BBc z$4Q{j1<6Ne*XLBqu7S=UNeLX>7W#S+#qzteyS(`{USVM=U_obgfJPnc#%q_|``%j! z56MxJn5sWMr>VuHS+5DjLv&iiQ3F849QRyJi zzYKduvux)q+f~F9fC`guE9yy|m>?&7tL5$EbI!%6lCLGX=zi!9brU)KgJ)A)610E0 zJthI)&g*@T4{rAzb%M@+zCjDG84ha<|NNFTdjt)SDwN<82NrcT!LHlQHHhXoALQMQ zQCrQ)U9F8`jx0$O&a=ax288U8T>eL}hm6MH<^h>UK)^PW|8P3FY){*1p(wZk^uykS zgRR=Wh`bb5-5MM{Lw%$CFFgC8t?K&kcyI#kL=vEw*6OD*;pNKJx~^l}wbDJ4w|!9# z;s&Vw(3=3X#ASP`Rl?A!O=wvV^BY@{ry-YoKvQc>3+%(LpXf)-X|Fsv!MR5t!eVei zk*q3Mp*uayO)Kw7li`;HYEUZ{GWu4KCV3y=nsIXJa=U3Q0aAbc=*A->9X(ysNk0rja@d zbNvCH7x|E|m-tU{HiRDUQ20Do8l{09)sJL^ZKu1Sq{*tr=4sNcr)Gny(3PI=2jkuM zMH*F*aL2(B5k2&z)Rd9lJ1{A~As*xNxDWctZha8r?DbNQ7{!D25R{7-h(!<^1+nt- z=iuwZbp^cGz{Of4iXSr?IroKG$$5_bFyvb zT5PzTm6;Jgk(f*1Gmj<|g>OSffP}_pO}GY9D-8=xyDoVzPlIE}dek$PT{~$|K}SdC z#;cUITjl#CBt-b(y{A#{&T&sp%1opeQSw zqJPH=riif*{ssf_JTZAn*|Tusyt9`W#)FEcRakd=4~qz#9!-}Is1sWi7Beg-53YwZ z_x@~k3A=TROdDRodIp~za%1z8V4|SR zcB|$Y>T?IlVh)g%D7zNo)M+~=s z#9ew?ODdPdKafq~P~=F${fPSKb@fY_S_^!UvH@*)mgU=m zXc7`~Sux5aa8IPHi{+?7#J_y%$De63pW+%QRCv*?iiu^FkOZHU5ill7#H#TYK6gXBDAy|aOEET$%1_wf(jQ>F^pk9v6pBo+XcK; zlU*;=0|pO+*FgX9<&yj6XLZo>czI{{9pM+RH~JJ(AuTOAqC9msq4$&LyDq+)C@uG@ z4&5x<9+6a#uvYt`O4BiF>opu$@n?Kl6O!h1Jw3K-KTOA8z$)VM=4bG_OI@a7%spz}4(lOz;;^Mu=DIWB~_g5K>w}Y?Ig)3qoXL3^3 zvh=w9S_R?Ia9@PNP9wsZHQpY)c204Ho22;qORM&R)I^@cX=6_vfXzgVNbSlr_{0;U z&|ri@9p{iTTOExD;`7)eUO2ixCB8h{w$78bdUvfuyT`AD59HO8J{ACmVg2(Q=99l` zQ%%>Bun52XUaBw$ALuw6;6m)OB1Q5q-y5&93%jJC=Fc7m&@=Yj3Gk4PsajOsPsU0b~LS-w4NGQY%kG<}pK5I%7B z1En_nSJA3Y|8iF3+B@X0(=E*_hz+)k$^+1kHmSuXjp(}etAXys44LA=y3wZK9O*3* z+5%Ga@GHrniS7*4ZVDh+(#J*6$o1-iQgv9mPnd6^5@!0Y${Uwp#ziugr=)|n#wfxF zYj-G7E(~n!nF3eCKDd;p89v)JC@ob)#EOLUD*3OR7TiO2v@9^#5d%pDKZwuUg&+%k z9v8jW5c9haz{@x@roIaMxk~pFBt)kR1EgO}CXJ6gyB`v+*&UK*z3~K|+;ig#3e67+ z{01dDRUhEnW9RDZ{Q8qQ=03SYaz(1KARQvrNDwC0)Kzx=eo8TMQF#x|8mkd-VsgK| z-pn%7+}N42PG#pM=jh8F$x!LlbshG4@WBw0e~P{l+O~R6z@e-P1Bqm-`EvXcr%>N& ztTPDSarB`9=e%*&C+ttYT1hc`6FEZw7v#H0E3r=3+WvacV1>gn>EevfBy|SLaqZp}uS9ee(dip7X|s-cwkir?^6x zU?Bo#W>Euci7HRfi^Xm)W-)9<+cklR`heQyHuCbv)2G7k8_qr%bmxl-GiU){Kl3G#34&5kWx1h`TBe`GQsmQy|JjI0|{ZF#WUqW zIum&EMpL~EwHcAMTEc!J(skJgzD*LT#y#y9%XI|?a(dS8-}2)_*wNQZ{y5(el+q4x zsibh4$(kP@8WgV|B^87dczp$39l_u6Nbr6gFJ;aR^lR$9`&$TyK3zmYRP(4(iU3t#a}p5n5o{k`r*y*RkGnlBXj7fs#30zdHrRh7vI?uP(7OKp7?&F@7uaGkY^V#22 zp%aT59{`mF{KXn}iyI8bvIn37|4fx@2w3sDj4F}s-;0Zg7#U@|1h>Y2N5RvueN{o7Q(~tw)W$pP!E9O8=!SOvn4H#d&+ZSIUc(P66A2+ zKBT04iiWs^0Fip_xbjl{X#Y*Xs>s5}>)jG=(Pv1cH^4HR<#b2{2+7teNh6w7R>1B> zuL;3r;}4`P-Au6Fn6n=hr^bS#)YmN=imkqX@S9Bz2`OnFukx`w>MLI_cOBB1sWY!> zyq?tjv%a3yvV-q!FihYHM!V}#YPx{ryE_ZocKDo`--e2Pp@OU)NJ8x=_0z#$A zqtL?|wkc2~H737e>48hlxpDAH#l!iX^~vCrc}dg3(X7)WEJpXCr-hos-llH!3|x5I z@oE>NH%`stv7f~-Q41;*D+!L>(j-cc53p;X?>puxEW%bvywIijRI$oaK`{CoP5-`r zOP-6+#^t+~`HIi+uJ)l{5d!)4j*mRGix|cuaQ7AaP2tBfEkSN$51H0)U9raKw}BRK z-u1}CT@-WhPI{9|&Cj#645!2`Yf+GQ@h1#VAfp#sDjfg@fBBUb1!a(PDg`_Gik*rw zt&>&`xAhD?N2U2nMu=c`v0pCsSauT~wvKa0I`hlc-kaM_EVzRejX)R6M2=H_qv>i( z^Dy?8E2lpXY2DQHT{Ww%lu{7QL78vp``0t+A7GX&X~_V$5;jH2O{a*2-=6mH_4DCr z3lfp37#t=v9wb#FR++sgF<_$lou8?Gt;4@C}vuEGp}7&_Qn${TYe#!S$x$ zT=i0xN`dN)*5B*494LftyqKekqFvdx!uj3)-PHCW2vnmX3MU>k-;xHPcWvF>b>O9F zLSEC#d>OhuXwfwqjL(80MfTn!GDyLvWKb)0~ z)HO>senMT59VUIz12-Jl5H|v$JI4UqU#=Isb8?%lr|JRiY{Gn!UbT=m36SIx z>g9I@gCzxPEL+Xusb0*U+$FEWoEwW8HI%l zWrK`u$l!WGc#Cf<_hS*wR*pgL2W*W%zZ*blG@Z{alPQ&mb!1{CckLzE*MLKc7ULrf zm0Y{Kw%cKYna7kjMfalVG~OKApR+7iSJ%aU5@J)d1G=_^y5LfVU=bO2;{=0?IpDQ< z6r#JI8z<2rh^jYPH!66ly12Q!XSp|AK;O#vUrwaU9963&E#n5QRV_-JgYcw2Ty8^u z_}32(iorqlW?I(ObN6t0Om!19R}V|O8Kl?a5~bipo^uQdF@PwO>JVD3>f0C3-x|0H z9g}=Nq!&?5mmqWR&qgOdD#`T{`%Z9wg}*&fP~##;j3|_I)uGeUQk|52$c8h=gC*3n;Es&Vt_+A~_Jz~ncnn_$AOATD~F9pps zsRdF!L)iNYf@SY91g=8geMREe@O->?a#nx)fr!8LB}xZ~S!IgvNk~{r4D&g6-X8Wa z7wCnxXxiF_bE_Mn(4oVBsu^t0Kw*2D;Afg|%M zsIa|{leDlX{N2@6(ACXtu-Ha6tT0hW*$1K`#v9Ch@or}e~?^4{6IFe`Qx(zlu&hZIJrPOP& z&Iu9uFz2IRRbNjh$_ymHwlv5E6OT$Oak}|g?2>3NdA9`?rW^CU>I>&2b zK9+R=F){r8!*xySf3WwRQB9_8n3h3jKu|}D2#6J=E4`yw5RgvjMSAbOTLw|80--}_ zArP8$qy=fA_gXA0{cW~zVX{1`)kkHvu8IyIB!DomZ#kHy6!vo0=rhX=*LbS z04jm!Lmo1mxnw<3kRjC(#Ch-a>(_^TQR82~3V!9)EO;XS?pXWbxj%m!inkfa%CE}O z-6<8N6ApT2p0Ofe{rqgMjml`w=bD}*FWSud;McUT87mDK#k^lgJgb+k)IN0%$8=ii zRk5h=!AEb~?mmIjkLV@5cY9$AVj6$Fx*#*b*;)m9qiD}|x`Cjt*$Z~X8!wz(*9QA; zQP8xHw$}fs!vahX?+XV7^&Zb;Zvb{oE(fXI0SNFsB1rlfg7V;6E#i_oW|n-K(O7;{ z?p%FzITff((7dQ~nvOeZgn10JwDUpK@v+dvsq+5cueMl}yv5Z$Q~s1DJHSGV`K=o! z1>2u`hwa#O?8vkKJ@s*F@?N>J!zJow+g}Po{l_OeQCzwf7yaqBQ6D|1AjK{fo_*J( zT3vZ(c_ydxjdQBQOdYS~=1XFH8%WEUVY-?1nRfQrODq}D=TxmfAxNuMQJ`$~OnN1guXhvOACHYGD^EK0+%_aEJt_4Q54 zM8K^kKJ;S}Zls=yzj7>lO@~ZfpF_XO9m3SpMN&aLmbXEP_mFO)7Ol3h+*#3{0Dy-W z`|K1o1!_sNj&}WKO!esgFw=V1&Bg(suT3W_F>s5B4QF6lbsRX&%?~I^eFCO!c71Ha z8OJpzXZF}we8&AD8}$+91($*F+*FgsJ+!#VWq=LP`I4rqnOG&YQY5o?cN;KrPIJ0h z>l)B0T4DGh)zi0Lt^+!-^ndZRNkF^i){s#Z; zytV;raC&Nwg;S52ipZg@w-4bx3I;pw)KE1xHn^0V2I7mVX}(^>_`69ZHcZcD|Ff+A zJ%E$=#~R|7?tB?YY-`)1oG&-`pKW@T6i~)X*}k>8`4P0SHgtO;m};`w5J)l9x@kt4 zY?26+AVBx4nRg!4vzYvL!=^rd0I_E=LVL!j_w^)Wy9H1h$j1S)sb~4lsC0_087Br& zB^1l1miWEbw(xY-*%-`;(kaaRTo6@4ME=#iztp6!I;K4q=|W@Xw3=Vh-gsL^w3Gc6 z)d|dh`@@QsKS;Fu6|kA8$fjNKcXtnO7k_i%&f=vDuTy{LCA;T}wT~~G&vvJBw0lUL zae$irK4yf}GLvLyb4`)CPcQiv$5P`i0Q+O@1OTcQz6V{8>`D|IGYvjul~?Nd{Ks>S z@H|d6Wtuab75k;HmuRoC%gV|+_@3ssjA);gb~}5kULJF9b&wVS?Q^ zS|XTPnLFcd((&k=V~n{gGsANiqM;ou$1Y2#(H@~O4SS3e{*R9N<>1hQV<)A>^X?CyB){A(rvqEK+ZCiZ&fHkyvhJtE1*|+Q3|=9lH<= zYWnE(7u1?P`_w2ymHXln0NyK)SzKt%e$`2?d3Hj=rzQFW26pbzeG)WzhEpqbR) z6I)>WZG(`8mTALR%r+iuzKOsPb-@(iT|^79C=MDD9gqn9ldiYCms_2_A9+E)P|(-Z zw@Rx?-l)Ij(mz&W0eQ!$N73~*;ZnWHZ!biw0+RJP&(g_l)4TMo7+am+p7bnXNP&Qt(nbSGA}&omJxYeT zrpo6T0H?9|E^muS?fX+A!CxG9DGV)4yj* zox2#J7>R2$fCZ#X8M^klkIii3MooHb>+$oeT0?els78CaU!Qx(Vh?we^dG>8Z9^a} zcC%IRwX*H!tRi|4i%jx7W$J-Fw*q;l{R#P;A5|{c-N_Mc=k4H5RO%wCI;Qy^a4~ss z*DR%vddv`u?PP~MRqHJWTiam^NihwK3vc;l$xGqAPa%ZE`3kOzN%jDZCy8Wqoej(j zdmB??6oxdpTbbwq=Vjs2K~;H+ok;4q7pL<VjW3{`Mw11J*bPpBRJ{UD9ykf4T%F3Q@!tkY@vd+by&kaix^x~ zogeG^*{2jdHP8JEtsdkC*{Kv-@!g>$xf&}3UaolKtNoU*xd=hf+WTRRRs@(r@(|gZ+ zPmxNBa{|iW=l9?Dgl+ zr==Fv%+S#7N0HQ-vahS#B#4~@+GK@oaB=~M8vHX!2n)nV+Y1WW&WYy;Bv1)&rpnP& zZJ0{unz z0t@7Z)@$t{*Xg9VceOzWs}4karlSU^i3r-I!Er=fVmpm{9b2c*-jL=_4sT9v%!V-A zCBbUwUSJn^1hyKSKMmozsJ-~!U=$vJF#dVDjNAUPa3?pfSZ=Lq!X7`^DPZ1N=rsKW z(}J6@V~90$*A~1gL@BBGws@fa7(^#bzd}Kol-s#YD$}Y=qE7%HY=azc_0s8DsXmnd z{oyO(en{>9I3IWQZhz%g3q$e5-iSV(3^NfkYS~CR8y%$-{=G2>(-U`x?5e6;$hLv^ z7W|-G5B`_Hh@MTt*~E@&%trOx_aNq!tNwBU1G~u{8dPNYMJ);1_wQGYvJv&)i#q=RbrgNp#@ljcN+ zx_E$ujKlVuz0H$Ygv|I3@PLN(iAvCQo*s#Py&9ZOvt#{as_Z~k(X{vKf|{9XHg?>m zprBY(=Fpa~f5L5Foxg&8MqU#=!=rld7E@FRNV>$$gjiOL8q+j5E_?1Z)79?eyr&V( zSH8I$mHG1f{7eyDN`Rz2hzwqRV65s^=*n2RQDsviC$IpQQ{Zr2iB{_JW&5piPjF%$ zT&{9qSl7OQdO9HttiI{M<~d+hpK_ zP43BA3*o72W#`Czw748|4uyEVV1f?sip}P%-O#bg7brUOG!m&8%{-ZejL4L`GQdIk zXWjg4i1C!$aQKkMdJ<7#AnIbh;_D=VcE~r`)3Ny#1>*OJd3-(Z^DD-AyCqjUKNw}0 zgiDH+k2{BO+VUGeS@^8N*8gx(=DL?~`Gk9-@OJC%*{nqS&IU=g1LwnKM6-wm49cU; zLb=U-?l;wH+v+KIC{hg0E~HC4%oCX2f0(tWxQZGG7c>2yqu!iVb2nCx*L~az<7*wM zBzY{Xix3#mlCbG;o$#Cso1Jv&&iOoLmFkY~xi4$yFnzd3r~_)B(so2A0B=sPXTA zT?voi>k+bl!c^C{NLfp%R``ve)pAFdXb z5SD#D&&ttoEZzac)%cg!p{xnxeM3Qn*x@Umha zwX2viUzWVj#a3ShR+NV5Fv8@!6PhWp?5TAWASdSaOJ4YQ(I!FW_H&@0rBiU!E)Kq^ zle$39dncU776X7m(LHPwM|v*nZe!n$+u&c1(AQmD;mF_Bwh>ZHG(n8smb5qI`(NTu zj`yXUww^-Y%BU3&4eO%gEm9z92{MO_+*O-zJZC?!Zi}dC`d1@%wO?>^od5x93ULW$ zaY$sV9qy`_yp{{4XpYuwcTx4xcWPePsweJaT-X!)AKZc*i){ThmurhrBcJK3-5+Cx zvFqm$6d+j`VRZxYluW-uB)h^>w#>df?UIAd#)~^5(2?9|x55=+2*gKouU5+_kY*0q zu+wp#8o&R3Z3 zGYyETGu$5?N!{|CFw9-OA-W|7Q@04nK}vC=?5wJ<`>YjlzK4Jn5^%h8G-|ukwIecM zu}yT6TixG$e6cw&&^>+<5@>RAs9y!7XjU2JGQn>TqS*}M_EAzgWv*+W&6AQweu1U; z;o9!?Wr9?`$@)BcITPsyn;x0)4`P}fR67xLVt$cj!FhYp2N5xl)UXB{pAW)pFNP~YS!?-29Diz@@l(9@#7=Tg$7gE+8NIz1!R$Dif4nN9FupLV%C(6Pzn%l4PaIIBGVUQ4eM0lG3lx( z6RX7jBKMIg_uS277^L6bu6)eAsIP?qk zx;d(1>jCwr)z;7U7cIq^geM!r_yuyt`;3B^B%6ZjMar9>Z5%Q1S?B!NU+FZr zR#rgCM%Ah(^AKK^ zSoaDn3d^h{xn&B_28n&u9)%xZYQV(IApR-eBx+L_MQLDYnHI=ytC>T?sVWAlP9e71 zIe0X!(bU0O?q3#+iF+dvKxfz{q$OUy{fycG16|_-(D|NXBA4vV*Spinn)(8QuI#U-$KOiBoyf#*$0{QMmGL|rFuM~mQuz1pbE$OkY=raK}1AQO6Kb+ zxMc_hZ04A-&TK=AdtItOV4bL~&xWwvUFxI3eM%o}u{w1W{l++_p&K4+5UB)>rypWQ zs^P(|*JzjRuba*t!8l=tg)S!87<-4_mY}p|EH%K}~ODWsPS5$*Z=D$G~X9(P&L%YUz~w z1eE&EUMH^c5`KFe?-D0463pzk0pShc*j|EKKaLf;qLs2hPy@arm8A`^HID9K*4D zIx6U1)biMQxiKX^^?!bZ}Z?Xdkg-@hk)j^yX{>`h%ej(cD- z3kocK5HbjmNaP*|3d5xBZfqywC2n=*q}mfO5=^pB5EdD)yfQ#jj}2VY70VvE>sRZ>Ty|faM#4f_d26R<*T^ z*}-b}gMlN@8&KL=P`yDb&olJ^b|&t`Z{(y}7@v8?B!g1uJyZD%Hdm7sO#`^=cLqY)qUU>5_gN z#|;31p8gkqoXDIT++C}EHTHV-TCq*3?HF&OJrHD!zO6T%W{4M?Vs!241*`{K7aNmG zM~y?8fpx~rkzcAhSfDS)@Ujjky4pmeX+Te>=c!U^*>}tE&ucn|AD~;<5J!f2 z6~~8H2wUmu3-(b8f?+N_1RwFOd9^WTkbUi7CL`TL*0UQwm$Y_H3ziJ;_v5~RHn$%A zY=p0+SCjl$(nuvXzn^6YoU0w5AOBVsfI9#EJ$x{^$dAKLD(RmGr|Nwl|9#4_r$4s~ zcxs;C=YM?dzStiNKYw~^NBlM8k3(~zw4Vp3UZ${oJWKklKIumEkAuIzd+P3=?SD_| zqLtX%=g0pHAoIUJWsUp!(>0cVe%eX*o6Cwlk1_Wu83s6=vqkvs`i<0A->3S|eEj|Ye@5z`-~aRYKi~gvf0F;ZE}wo4MK`}M?>ra~@Sb6YiBZ!I zrOa4i-{ET?KWhT9nkZG|9H_Ei`=VMh`b90uaw^;X`1zh6pQ)a$zwXSEgrluqB_#1+ z^a)_(pFBAF%QKV=v1R)C3711? zaX|{P){H^C( zHsWb1TPbEYVH^`FIdE4uI)C7Faw1*b#l7@Je#t~;nIqZ?cf#H4M~+&)$2)OXh3eL9 z63gxK-6@NS{>vI}C0;`UaCb{Bgn3@2a;>m$7nw0uS~qifJFEO8i|97ifMcp_Ipfr8 z-IXC*yWDX)CZNlL%0S#EH=Q0|_j6tT_*>t}JHfHA%Ph!kaOiBxh=*Y_*2!w;3YAW- zHlkm&GUumY2%)WKMA}eN*JS&%;H{)oj9;+asZdHNilYu{j%4H$4u2-qh)?lA8@V+E7P7PSu?jNvFPD*`r!}N3IK=ZcW;(Ud-M zHt72hgE&l@cYmMpT8L2Ll~u0k`xK`#Q@eJbLj+a^^FBdt$PNi*$siB5HBc%lC|q7n z{U_v`Xotcy3@4ojwogz;00}T^ww_0O@yxjwptdD1=JM=1r1q;(ZlR6CS~qMk127_+ z?*7U_Wp4`G(#LV3vYj2n(DyJIMZ%6;N4{U9=GMx{?GkIYi)&?;+u%yhn9`Z8?1`)QhCi2IIr%+QtC7- zS*TB!QY#((ZKozh{I52Y^`dZPpKU10?!Tec^ zQ)ASj%3n;h+v_{#fD5XaAd4jU{cE6{dPOe)7A-$gmru~3Smnq9)jW%TJb}KYV1u?X zj0he`$)Em)pO%XFuunL-W>ao+iQr+M0&)9Ni0)m!b^v>GCV70Y=M1YpD$)Jr-CA6k z17-MOnN5pe2Y(yDxG1a+b(XIV>yMj1N~I%&hSs587?yo1S6FR=PH<7{a!*yxlM5}> zYFWZ|k4mrSBqI=2%E;ebdT$d;Hd{WdR)k(hyS=Z~u#d4*QVF|u+3wm%xXFm!WsH6K zOG%GKIc#5nc5SUxB4ms@o0~IbC2Bkqq}<3nGWvjR!ddI6S9q74e%J9^1}m80uzDF1170 z53&ntr5k~ZX?n~|*>UE! zPu?JBxj~kbt1ZN%>ijX{QZH49K>WrHr6S`_7N%=YC(NT7E|)xx#Zj6x2dli_RP1hm*rZ~+zI@S7b*Tnc(-E=-1;F1;Adv}8Rk=*&?<&S9J zFc2sH;xy&Yh3x;=a17Xl2Ra9iO)TNXeM-@+mkF$Hpz1M#$8*Z#~EBA9yxoi}l-`a~M`Y0T#?+h1xN z&{Z~1%tYUnMo|~J@$L=dw8AfBoDGl3%G6!o6Q>;S*H6q2R)4bmNt$^dcQql9gS19yWHl_+cw!7c8`KOrsP7&fj}*rbd>+_V zFfLkjn=MibGW+_v4X*rk3VX5b%{@Y1KWBnQ#&~<^bL`2cOk?q>emRPfo^l5rRnLqG zj|>y+`MQvZ0LCja1w*%n4Qq^!mv-6CeNw$@R#v`O;+2zJ0rnrxi%6I=df=(v9QkN@ zNB(q-=^RxUi$AxE4!NcNN%yy_hNHD$zo~Hcz8p`BRIgo5x&CbktQ6X%(aZMCiUBcG*)_ckrc3w2A2DfvqJRy9yC=?;ZRXj;?Oo(~T@@z>Fy z&#Ivwlsz2{r7K|8bxZPtIJbnINJtW`UN9an?K{mzNj<665t!>#(2>b~20eRMY46(Q zu%2U1>!bCkHI3C$CF8Euy7n_7nhq#Ol3|&xmRowi$;B|V_097fUgg|(Q4ROlGE0oV z$215r&!0|8S6^Pr{c83#i^UCdv;mct?%BP5IdNuK=y-o@QwzRHf9$nR3wak9elqjw z!+NZJSoa|(m1lMU=VYd$xKHbB(K@dgO|p5QcbN?}ZmJz-bJ)o}R;8d<(%7KwmY|8c zPM@p4V`eL!2$GPKQ1MUnmfN3`vOv4m0=htXzMhM*&0CvgbL8w zUE*P`d*W)4$vG*&5xxCCsYcDeoRPQ5xXu9^ST;zGls|jT8ID;?RrFJ^3Ffp6xivoiZa|27RPhpkowT9_VQ#wur z`;chr3)IJN2?6-#>@R_GrjP+pTKg~HT!g^-FpY(@0Eeg_T9+b*U9rr9<{=c ziPcMyy&Bf9G19A;YuMT|jOj+=U$9*$>f#MEY5LO9jHPo8{%XO+!0KT|Z+PL_m5IqQ z9!b2@i@L$x)#(6Nl1$L}Zu*6cL-Xla>Enz%qMAT*;ZD1-?BP*AMp)>%Q4AH=Y72LA zLJQw{p6l2nuQn}j_OBmv%MI_@p#H#k1S=`(u@7^U5}Brgnr=qy_ONes$~BWeW)mMu zRUBH69p9VmqD{KmE&DY}jAFH7VVyWzz5F{2LbCZRhU|`un%|5`#^G{vAbN7^N#l;b zX_ST{>3*Dj>GnrNIBXWE+k}Ph`KopQCG;{DgLj`)V4qn8s2yZj5v>YU_m5HL-{aM9 znue{`C1|l_c-pvkTWs~mni(abrI=D6uJJMB0ya%`$%$rZkv22elOVyeDM!9fa0XVd z0?-=JMm9d(2ZJB&XNdVG8t{c4n~L{j*9O~TgL>S^XkDN&nUqM07aAELF= zVWkD#!Q_I!C)vyJ&~udL#6nJ20o$IBYghFGD|{j%u-x}#l*;L_C0`!-C$!j&fxGYC z^--HX%YjOFJ-+IpOeBW|R>&nt3AFt`Pcp@oa2Ye3E2TkgQ?qOOezs5Cxa-$<&Z(sKSgHp>9 zQKtnQ#nak`Zm+)Fvl$~ja81U9>ukU6VIzW?H>DZuYfLjNCraIqTLj!I@a2AcWxFf+0SO+>Sm**qI#cO_UnIbdOvC%&{vAMD#cxuGN zvSz0%n=`dU4Z%{h-LSU!J|8*EQYkQ&^vz5o?u^_n8Ye7nC#BP z78d&rH)aE)S3pM&Y7t|gjUG+r~mTB}jmvTRYiIgP@Q z>FQid&ruj@&uia}f9Gc1a-1ueXnsGxhL+O$>72KK$x`7JVc zqY?g{i%g%bck;G7Yb-m$!%WZ%i7l~j zTUrDhDBIa76}noBuFUp{H@{m@aX=3t@q=o5YH_#HB5T);%m#m@p0!Lz%>e06S9W-^%Qd0_MoK{4HwvddHlGg9<_r1Ce^_)npwNxXlp#`d zefEb(Lp12dxa>wxEb%sKJ3Enz- zUT%u5J5z*+@QTB*V4yS=HI=j6GRBMW{b41&4QH7zbiKJS@MFbeKOxr`%UjO$WpC^X z4Oj%O%iRo7Ps@tNbjjJ2*<6yz*QaIw0s=7Fmu`8@?p)UHoihZ{7sx=}@xb+;k z&K@i0ewN~Na>5F4eK@@}@Lu+HRK?D>UR;Mj&L!1&wSG~?BJ&WflHPDOEmy;yn^zj8 zqbk17r>qFvx&|X^2Vx&3OapsWJ2BI5H_dOn`R)X#dd@Yqx6%w*nJ20nW{YUM`TKdwB@<(mp=GvYn-?C?Bn;YiXLQCzw7pebYq0_(P z!By(CeSm0W)p#hYN|vlnTv$bMGM$VXf90%Elk_ZpIXA9-H=X3(ch5L~wKX88awFQi zatEAP7ipLIB;fM7d3N0Xb}xO8Otc}fZ4-{*ymUNkhUckq%cQ7c9o_~#3RfG* zM&=|A=h7?D#dvLeY%W<)^SRqR@|<8fk|EZVU(FfGr5oMwi1;ovIroi`Y|*UpxJ z4n-gW@|!c#h_v;BKuA-7&hEZG^k=%}=NVqDd}56MAbEAuCiK`&+P3mZhA$P|dwum& zpZ{yoqF{2KA>Nlw4t=#Jg>Q_0x#srGwDU$!) zsjmOy38GFkz+9n<#*xV!lO*ink;=bwed-i4my|Xo#v3=izucFvJL0*p5IYA7+lGUl zh>HNNwO{-d&^jn0At3bl!Zl1)$1{5%&vawF>}zwLMU){_>q;z6_3B%Us2|P|qqE_|-P%RS9I+)r2 z;3iBgfJ88u^ubCLEzl;SHFWJSV^UlcNqsgS_#ge{`#~zEkbnzQk|f@NA=dz&E7+gN zt|9j(ei>l;LiOFJ*#xIOGdMp+y%AaVA^&B1N*XT&I#;=^($X0?`d@O*KxBot&7YTp3xFaY#3>~4(K zEr9+gvl+PxMpg1h&i?NQynmAIeh<@3XYk&Bid|D$dDUr zFoYriMM9Hvoz8YV82Y%skneaQj%F} zN_8&^1(0M=X%U;k5=A}7W3oQL+wfJ~1AV}59_}t*0ep-XB;vsqfVnq0polSnQsWhd zw*X2ff7G6^Zju9!2~H5m?WU0c^p3e2mmUCgVRY^Ns=bf`S}UOeh|^OXz^An9@6>L9 z(k;wB8)Y80#ceDq6&so4l91Z&=**9O5KTj-u0)}Tjj3w%5*pKa_HS3Nf%(+)8-f7V_x`-gEt~3&!b;vc02@2lQ3+@t zF1ZJh5d{ns#MNH8er}NNBF?q3ri6lOs(jx28#Dl&l3bbJ!Cn2rwq}c^sJm+Q8Ne@Y zTR`dgEtSPjCS6F?tW4J-d6R=+yMw```hjqJ$6$XIG+1g|RN|HZsMD19ph%#*F+&BA z1sVokP!hD(I80z9@3U02(Ct+T^UgT1hity{d2@R29f}|BV_{uN*yIKUo5C{pavpAj z(eU{Z!+uFMwZz1tUncIlB!tkv*NrWBgIMjEWp5fHz^EYt6Sbm2AywFRnVtiNoTIC><6 z4HUCLwINfZW6$*iV3$81W9u>i3mu?N#O~szZF(wq!o`Xo9X5ZIIh+6}87BaVH;*{M zXJ-`Oc+Lh`1PlOb{zT6e>@OSEWjCp#%|>BjDXLlOWNV-E9$#+FPPdrT(#`W|FndvC z&-;BM=*3t7<_Am|{U>SqsGuSZ9V@tHU;0x}E|VKH+xytVHIQ#paW&<<8Isp|zO{0# zSl%Qy*@Lu!9sn*x2Ipubb;aHXFx2uqwRb3@so`cDwV0Gq`w6?*NO|t?{h5FO;~T8Y zx(7+1ELpQKA&)P^13QhMlx>$fLFN|Z^|n|s47fyyZH(sm4M_5RSt;-!-_CTKa*3Fl z12V5;8gaE%w%-RelCP`hvo1iAg8;hnFT= zJZMJRQcR+eL6jn{W6_^v7%vyr963u`tf&gl|1}p8Lc&SG_}tilB^_{ln}k^MRWxIJ zzSaBoqWR5t@#{g%{_k}izI>7PG<7biqBK{>8q}t1e%CO-Kr}-Dtjml>4Jf6g9NsB@h7IK?sPr|yltrB**F`C$C#Bz`1Ve*S{ut;R zjI5rPC7%a8tPfl36*G%2=AF5PHGcv*drZBb!+(;HTNum=^Cj^S@;D!=K}(rDW?Vcp zKA1c6jT@-(B2W>(thxKQku>f2jcV++PZVeQ!EE1Wqefq(>#_ik@W~Npr795jhs{sv z3@)8LPt}Qep^aQrfh@gr20h*7NaC`3Cfg`uskDK-=xDn`W*|$U#A~6YtJF(G7O#XfnaRr2rOrF_;5GoJt*kHT@8C9!j`ILK<+>i_>gz( z0PGp%d6GFV($- zwzK^5TxG6|E}cbAcpA-?%QDwRiX;#+$TYsdm_4vFC88qkeh(;GiAAMQ#DDVp_Q0lIYNU ze4g>66t66-!Fv~LNGnc)6V8Eo`=D!I%QdX;P-|=8g-G^)hV!g~KYTV|-UVkI} zq`0})?BT@5M1fhrQPeHE+C40oT>t~MKfQ5FpOm25K-Y2nbsKDTWv{7e9|z;?^crW zq#CQ)rjl6u{2{{7XUeUwK)?Fv@-O=#?hBB?7UuFa1_oaE1z+Tg#%E!(yL{cP=ZFY$ zPT9l6EG3CO2Ppf?nxpoP2fhcJzDR4fht5ZTus#V9f6@=iE&ZUIvI{T3gKq*}a5uud zU`|Q+f%~KrI$N{QKrmTaoPxXZo2|`T`mHTAGa9IuWH1XZT>>0`6{&tSU4Uq`k=8Yr zp#tqQ*=G?2lPzqUy!azPQ?ce`yAXLKYW@OOQBzoV#Ose=hy{0uoQ^!h%hswgSWEDM zzEJ`dwUlUC*pWaT=T&c16#>jNP{01icua%4Z{$?rhBrd)ag=5Rei^}>VTf`7yKI># z=C%?IApkgxAIVgvJ(8^eb0P*H@`*=%vi%t6gUd3CllucRMBI$j1iGD2_L*{F!o$3D zB)XGwM&_6C%PxqgZKoHtwWJlz4p%4pA?nrR0ZZw&hJh6r&vZqOJY}nI$3nzIv#&8Z zvZo`-=xhPC(rUWKi}8; zm+O-+<@H(xk{+IYXFRvC?Qqj98W=mqwO474SlyE&d+Mo1guA4sXfpw($LeP)W|RMks&6z zTovy#j&~89d8(4819ikdwNp);LCw`*UHdu__i?A7QJ=!v;`YZ290Qp|zIDU`@nG)N zsLB46aT!ERv(gUWhrvpwIm-sP$Vs&ZZX?w|#A`zm+u%K*sX|Kd?Qmi7@=@QC%DrJ- zyuE`>^w*WkP zK@CnX;{3$lArg6Rt*2)ZCrBay756H6k+9LO%fVINfLhtCT7u@ zhx^68c!gIflNOQp&=b8TXdSHtr5A8EJ;F#uXyocBu8+F`#TyE{FX<1uTKZa#tG1?T zlxYGza?4J427sqz!E{8+u0Dqnm&ry2Cc`bL4iS~B-iaW?NK=U@)r_~iDbs( zliq^`*fKPtcjZL<anJOo^7YWmFRM)6%TNU z4#p&2zWURggw~NL$bvTDe;B_e)0tP>N%``H5}4G?%znE@k`O;EYNi&14l_aP)*@^j zq4^}m^VW6Wr8MEC)VCR+Vl+M@3Ye!8+6TGW_ES|wLmIlxXHO0_#g9>}v!f;vxx6=` zki!?Q@!wk+DP#^Q&(&JU0p@|z#Ciofgr`=#Ya$16%tbLo4FOxWISJ4wgFV1 zZZOY^}K5+_nEBChknjXO%ESpY4#9XU;kIQ&4Fld2T}cj{aHBcLEE0jU#I`!a{R z07v56!N}W-EzcP2qNP+>$l{)bGiuZFTIoJ8jV#YKMEUpCcc*wfL$H zquE3ByxW?$9`&R=Fp?f~&No@9P`PJqt^> ziVB8USPvD@2-pn1r!(|@klW4={I{b|vZ^0JkMBjW*{Ks`VTQ#U-m6a=8*E}@&lu+< zC>DivFg!4RBEG%ZNYb|pE=bfgTPG;ia0ZIn&)B&oC z?*~~`%Uh6XZQreCpqNze#yzGI5gyj^E7P(Y>MmNmmWu{ALr0S7bx-0+aSFgvsr9uU zCY6scB93FgNC6^#(WBVCl0C7_S7(0+&fD;K-HC6xg{XFRT=Yo#(-1AUA;=GUzm69a zx|1Ud`fGiH$jSL1FC&B(moiLN^UFgixP_%CT;TP6fOmBjxF(*oNB10>X*5Egg)yMt zUv8WWZNVHm$oi4$y#V~q4LBp!U)nsYT2=Q%4+lqC;Ky3Hrv2C^| z+oT8ZgD22c)eRcLU2~s;amsf< zp%0D5+^5Tyq?tKO){6ftIM`{xN8K(vUT(*rspn-z65e+MWmWG&fvbyAGb8bNE05nX zWc&~IzB8<;tZf%%#CKH085L9nETf1tk=_zJB2^(2se*uXfzSz25gSdV6Cf&0snVqe zr9^5Z^co>T2rYypl!PQ_Ws38D-|ur>=g;}0f5_fDD{HUytoyl(AL)bn9bLTNIxte< zty<;&DPl>Wyx*Yp>X_fAq`G>!Mcldk^x9DI!Ggv=fGRvh$rb+xI;~8_bF>9Ob7&(2 zUc^`n5EZU|aMknlY0pV^dYf~LhXlygZN0bwLjZ%5w?H-=TMbkRM^y>F z?o}R}7cL)J#DKcK?UfEkN}P>DPRk?N?iKe&&LiQ21z_*=0M)+F&_o~>*vZ~JzUO6C zC2Ya$X8Fgi=rpU*?+c9xV!RQQS8Oj8=DXd1-SP*AK?Pl$xb`$p9En()Q0>vCP)gfR zqd;j#7kB0Aj%AJ>tGxPjuh^>2NtFqB`6qf=XZ|=2zmUD@3JqI%`?P%B2tD@WR%@2& z4EZ5a`w&kHnphG)C|yJVXCl}gyQ1X~d4NLte2x@p1wuMdFKx2(oTe15z1a+6NnU1J z11L@@XvCmj)M3{WOR31=x6`pV(*UnzgeZ~ocK`tIcZ zFQp0e_y5ZxnE&UUfq%X$@Ba(W|G#kN-|_hW9l?Lcf{*Y2bw}_o)e>nJVGmPwlB}o! z*>d&><1`O%F!Mn3c+OklZvW#A|8a^!V3BOoqDj`ZD{KwrcfrkRrN-r>r7e&A9Y!J- z+HOP*#8f7`?Te}`%#hc82i<0G)~A|$jj#vEVv&DK>6)Tbq%WzLARrpzNaS5D_UEq~ zi>%U3YrY$$<0t$b7ZOEV_ZFzU5KQuXiDNtVqWR9L_Np$Rwxxi`?7uY;DQW7wv%A}+ zaXS9xrv=8;K>-)#d~?MlZ*xfv8B@v8%Ho5&l}p5A)B2;^1l_Jp+*U3tFyFrQTTT{Z zn2NzZ>jmVdm0uO?zj{-ba71F~HsW-jH@5Yw!v57$odSYl!#TP~YjkP%20uDO0y){> zdl>ernj3)cQGeyXz6VeXC|y{1Es1ap!7VvP>tLY`@mj^W&jh4LYQ{o2Ef3K3p zX(LBEYM3?0eU`H#rjuVeaUV9c-C{UI^$0o^#WKoV`J7_|L*t&4LZV-IA=>Wt?N-V^ z>_Wkxj~#m#tfF1g2ga_XSCzl1-aDM~&)A)r05(Zs8%x7#h(iT4_9?qv8Na{s$fu4~~)|NEQNQE7QB@cKPuAZ&YH*v1dF z^=f`|n&m@{dm8@S?wVnWbjfr9G_`JSKi}Ct@UoGVnSKvCIQRbjY0SH~DEdAfZ2t0# zx5@eK0wSkZchq{<* znB_SJypEkBTR`%_;2VO$&nKf&ljm^T^4E00zkjWwDay__&XAhDvAoHcFadR2$n6bo zuN^_~&4!axGGZrmHIniindx9n;^WN}q1oJ@GsV&+_pz^G?K%lG_nz@)omI*Fi#k49 z+MnM7E@OnHt6xQK=X0WW^PQuhteF2m56&5f_s&?e$6p4K`)-!nm#6t`BpIyM@O8Q4 z6|}@U`xLar##~gv>@>~x7I+X$NMHW>xRuUl5)|S6kJZ+DFOIPJRb78)xD9<>=08W# z#jb!`;!Cx~h%O?$&*uL1*~OoqWq{B6wZ~&x(Agd=QGLs z^LC5>KB{)USVs*x=eR=1B4q?7t_fB(+zxx&6{~Dc%pL3>M z2b@9!8z5S&x~rroBX)eV60MG*R12sy@6Sj7`tywc{`0@K1qdtLLuR{lZMu=KuU@37~XXtjyNZI(acJXT-g z^+f@gBFpo&+5p%kt%lD}5~0{sKLuKTaXRARYAWMz^!~Jy8xO|4Jbrn)iGS}`FET_C zyZG+)*YN$C|a;=Eb^(hXkdDv2R)2I zPC0ictWl}!Pz0E^kmQlPplEqjb|OG6!3;@IWk zPg55_UySGCr8QA~AVv4{VZK>hWAON}0`;pu$%%bmql8tA%L4@CH9u~+PpeOz3r-K` z(xZpzjT1M%XR*B6?)j6nS3xr}>r!qMdoB<(zjTP9j4cZ%^b-!taE! zS|x$MLJEWyN=WZnutjb)Zus}7AI?sfTlq$6E~cVIad8i!VJMuF+b!jnz^F!fZ5UDg z2_VfNN^IQ`ASRnxzX7kE7#_H==g_%hXvM%((IMp429*k2y?~(=`XHOh=p^;j;n%iU zgt)ug^8Rc#1LSB!mK%toR~w<_d9EEX0JuDbQpMc+_VG?(!`f&sIJsJQH!%L}vz>H; zFz2$=*3`R|B>ag-@=$?+&M5Bk3v#sW>VlmTprDXA^ zIz(sLY1+DNoF>;N%q+*#d9!|Op_e$2=dk5XTvbQPV8sKi0X(J?IcDjC&d?43R$=BL zi)gME27m0@18CW1rFZezn>#WezkjhLpn6!hEF1##M1tlvnToyZed75u26@2tLXFo9 zJ_HF1;-LrB)y@+A#b&|+CtM3;4}dP5QA`M9HkNPg$7~xz0`P%&WTswr!@9$lu#Xar zpdAUUzC^CZpEf8Xgq2{Zvn?viYqsk_TS%jp%+O_k$e9(qq*)hSi#bv{wp@n=nPK8% z9_5~pz}M!s;p*bZtl3%{yoY=rgr#z@sS%wti<2mH6+X zW!|184%y0G%r6xaPDAil3an8?fknyf3fH0I0h(*k_p0G}?=8#CIQOm;jru#3#!9z@ zj8Vk==Lb7U+spCkN3JMIvw??^Blu8>JZM?kvj^}Ta<@EOPV38G%xpr8(@S_7Ha9N?Ggj;V9 z$OTmR+ZdCp>3xRKlb|1%cMlkSaPBdeY!rFe4ol+x1sQ-HZdyC%0gS%|_!u5`LHh^D z)USN$1+9j;u_0<;K+69Zq_^ofX9y8K$TEz2ndM_)}>n5X|3V({oX;Pu4XyQI&`w*p09Nl{m#!^ zixnaS-HElXl;GXx+C-!RWs%giE~-f6Zq zP}HmXL>lPQRC+`M2IvP2iBy`C;@3|d5|&R#*@%0Jz0)i#e>N}1rU z#xE;4)4wi;ud*Khs_@1R9Wx>;DC&f;9L)pgBVl?;0yDjghE)$a!xe3}F zCU?1Wc7nQ2JPpaq=bX?cb#t}%4W-w6S9KAD#%09oSG(qh79tiKI$1SH!lz~Vooy$F zGLjkYw5(qvJ(mF@xdD10ZNeyT;ew)3^+C(fA~oh56mXQZMIEt*!RM?(mNmUG8M3I% z_{=&&Bdetxu$OFV5I68Nz_}9RnYk|3cJ_?W@SY{w>(2mqrFtzcQ^{frI7~(HxPE`{ z^-^{=TQNg+I9uY2PI+AMHzDKv%?5AVoX(`u#d(|QzT%QLNlK%2(FKo?9wS2dL2exb z|7rEHc6oS3kl_GhQ%9QKtE&+QJm|>dav8)NzXo`Z`C?vyhKuMb?LpAgXB6>uRzOFR zF6m_)Aw+kr5mrRwt;bkO{h>g+Am72fJW{rQD2F3j4#CV7e4)g^W0P$)wOzcDdival zI(8-kL*7bA0SM%S01ju`a|EkR)bkK`14|%wLJ+wdAs=warAl++*OPJ2DhI6{9Wa^s zK}i%;UQRy)-P_oRgbg-I7$>&<6jZ=PsGy8sQsLPlr8+Y|5Pa zmP)Z4l&rbwmM1-#tLZdNK~;nY68z2g9KN+lFsKcrWXk$=516~)5WtM7JV1|ji$wrd z$@|CTivpP$reRtLxjgh*wTI}9o8{MH-oxt5s$|(r17=_f88)vXd~p30&rZ~8eOe_m zaJgor5tcA|LOW?R_bgd^uh#bmXQ4EDa5gCy!)s=a$~Tzb#t8w>F8q02Dg$4yNvS`H z3T&Br>eNS08gwya=jtEyOHdRBy%tk~reiy&p{iSoOys5|5R6@~(q~_bA;t&VzNq5_JA|>xtdX*IdgF5R^@xwf zPzEUYr^a|2-|5D+bvwojh(w@tm$W{qMy= zEGodF@tcsWI6n)C67!2DpZHNgfli5Pcm_ zOR@|Y@i2BhVj4QNgXB_z&X#TpB$r)OnNw;og5eKt+66Nb-`i|7d>kBg7YWzv;@mj! zCv1XRQ1v)q6ELhgKj^*BTPxgduq5e3hDc77$av7`9qOcBoD1z1bhLKjHT5z-_Et;T+m0cu!)_5?O7(Ggw2%LN#u~+NZpX@_KDBz_` zL*pPvo{A+gw@7E%Yetw~c0FY1N2-rIE={k%!Kb*Q`4`5}2aNK#W zt+DAm)4aOGXlwE8!k}10`Y<(T0`kJ1;wv_y}Di5^DN9dqa z0@iS^m|cXJcksr9!A&C_@x#DCK18PU$Lo>vC$B|6D=4l#9}6gzb3=i6h^_5y?3h=B zGHCG87ggPup7A|a#Wl0@i`53q7e2TDjRrjS3p45xNDZj4MZ7M=XR&{loAp!fbX|w!{YCZ za;_R@gE$?dY8z)(WaTnuJYLebC7HQFfFmc7SIWzN!W?U7gDVDJ-gJsEJ))Wd>O)ZN z9I;vo)UUYx$tH}x7G-%aXN<-zf=3eH8M=EP)kzODSqvXn@4fplskHyBd+TQx8&vlg zw_h*oDynMp^>3cSHs?{?WR!T^NsbS|O*T3uo{7b6xT~Zv8CXgbC@{Vz$euh@ghPc-_^wTb-0H2IBCnRKCt^0T$_QWWV<}`)R&+fW9SZsOj0k{}F%T zrPBL__fWPJgiVjcX};1 z7Cgmw%MS7s4%e~O1;zE}>zHid%-cc)dg3isFSlhPkg#6}LN}iJ#L)Mso(LHEjyb?5 zBVO_v9u_?Jc_-0MNNb;aVX3p$)>lk9U^YV5Hn`KVnv@rSqkhsBaGAFb9~>w!S2fh4 zW(RG~n4fMWvDcydxQNA43(v}dvTaq~4KTAJIl(9T5hwb-e}(Unf8yW40)2lXdwBx1 zYhjL&h8Y0Y%Go?g@AlM`5n1rY8131b8Y}!_U7PZSejUpW%nVnv<*bX9e*0Yy`x_Ed z^G%-X?jXS)x`du^Vj;@k;J{{j@Z?j@Yi;=qY!0mi?v>m_#n;$skfhi8$XXxoUBJli zV$(N!3;j`xj3|-^nR16Txi2P7C2ol07r3?BC$y<}0usiq*;sA%DxK=t+4kHVYPwb% z>4$^wtzA%XaoLvr?v(lMhQ*^L-||$w8;rq;rjmLZ)dDC`uQT#8d{^74NN!+i$ueY7#hAS<&^bz`@@*kVF`v3~|UDBhgAC7zljAlDEiIDTL8uK`+ z>6B^{Fe*)+z_ZyxYRAALn;2C8&B$nh9d*N!JHN(|vi6~92fEye3Z>K`r@dd%$H3{| z?wRt?ZD}jO-wg0s@*irIt)3KKD6Y2U`FQeDKRia@V}K%CK7+5-zO5!%OU@N_%*zPi zF{9725U-Ph-`(eee(RBjU8I}9iPLUP)6EwIVZiB|Wkz?j#d}8Oz%zXzfW79C>W8#0 zS|qKaLY#YcEA~cb_Rxeg%Cp?B1rAYZNVLRb>=sK&nIqnn^zr81qz6(P@p9wmlm{l- z;Bu*t#-*am$GqyCF#9{XYkI8Pox)C}QpHY53FPaH0z&Z6MDJ3=@}KlyN=v?y=b#La z>g<82B7{Hnm~_oUzcR=hd$?0v2^(&b>lw7rt(pZwAxk~(*rkXUiCCZGkza$B7^3=qz<~UbyTETKM~cE*E&{gjbe}cHzsa7O}!jBC8#pV^-ji?6$C#2 z?eb3S{y=MS^Nf!}rp@YoxAMFi=E{iSBZ)EYgXwUm-XqHHZRZP$MWSSC^!IS4#tw1x zW_HPxe_62;Xv48tP6PXdEge#yZ%hBfMj@o#u)tssA)7IAKRIIhhdVc;8*P{Uun(}M zA=gruaAoX2DK|E z+S29PBXyeIF-a-$g(xg1)zy$8nUfEzGgN5`@cr>Pb%$4n`{+A^!f~h0MUK$S zBgMXx2y|%Un#b1Gl6mRUXUSH4L16|%_o}SOZ6%d)a+8b_vloRk*z-Q;g|CiXn7Qy7 zS?I^W@D(017HeSSg5Bh4Z$_(Zl#to_QAx7IAMr-dD~Bv4GsEXU1aaBA2bb~GQ<1^= z?_U&qv=oJ{JW97-m0f(t^Do^Z*l~Ur6g8+_4GZSM6N}Yc&PZuVJ&*qCxf}cbN4YOH zOX{=^0Pi!9ZaCdUXM(kge5hgc^q9`m#KC8AlR=OWjGgd< z^rQoi$<%q1k=COD8q@vv#_o*lBANQ{CLI=C3b+rSyf?PNj9;d@4w0{Jz z@2*!vfBe{0g68DDTpYDpN`e(h7yIoxz+UMV8DXC?Pk}>{v;AsYHH!Cj-v+MsQZgoL z)q12LvUSOp`uzCW9sk)2-Fl`*O7|=O#*voC90d;Tp#i-SQju18Z_ZP3nF6I0xx#NB zz9EymvHegWM1qX8?y?0(KacQL9{Jia(hoDSK74XFUg_RBvZ_%n1`rdSU^cg44XY$Q z6BAIH<&_w{O$VH=6G_sAR=Xw>k|+I&v=S5>@GJ=ZJH{a^Ml}{F%OEUS(}a93*hbb$ zKMRPqf!#R4X4u|Wc{fHD)N|h#kJg>B`Ooo;&YWHH?pJ6q^^B2B~K+=RClHtd8H1>`tx|unbxPLIt|b zeP^JKc>%b%@_;}bkCSpIRV+(cB*{HGZ-2p(A$In^VYs36hF^T2rvclz(2R|^jlRw5 zYuKIz{XL}d`}3cB*J(oeM^{X2T#fx`J49lS^CP2QHFp%h(JD~(05()I-++_(hDsy1 zc1V9BGx%zLtRJw9ca8{ut@OrmV8EJ0F=9Kkrxej z9u2bRL1;V`rA6=z%mFO;J+|_?3-!8FZ2b46MxbShgBsq(9kxNkVRLj_;AiWoaz<8n zp>l0>;V!=~$lH*fO?p?$zw{!4()XRI^tExTDqCgvURF%`XIOdXkI(52YOZdxc^CE$ zm=~t2++B(5L-=$5fK8Jph)XgD((->XJte5*Rcbu8L1uZE-S63wVMOq~dO}xp;%309S3v zZ8rkC@Cr7hJ2ia3qUgr1*1}KAxsim1N@5)Z?R*hMPP_!QLu}br*o7zFtNc2>IsQUe zjy~ltsuYc8A~RqY3@AhOFw0g{31rz8&+3-OtGBFaF201F&^$I1coINmXZWL7c0+Ud0Ir96gtUK1nDIekde`A;3+ew3He7JQ_gP?zL5~vte&{l}n3vB|T9{WI!Vh_pi^`venjR%BL$^ zf8f<;rlZU`;T7_Qfwza8k}PvS>XQK9)m3y93|RD01>aifnFF9Oli#aO|F-yUx0Eq# z4~d6sfhuC%v^MC9f0aVU(*~g5upGXJVGDgtN)^kkk}w}C+yXDn@uDg>(qdKHd_gOq zA|}Gl8e&|yt3#N!sxdEB>UcvfkA1wmQc80fu|5$^q5aJ^Iae*Mo?wD896|QPi9ubq zpLD(7^kqr24U%WArjV|K?Xt-wm8qa1J1Zz7V#7_sab8`jIBgCNjWRQR6>nBcBbPDa8HY zx4A9z@q$e0l@a?)1CUPWa4hfr&8Y?rxW#$Vbcl0T_C-C#TF8fqK`9UJj|G#)iJgMt zrcT4IH}Vy~$>~m^WhyF~V_~*b)gqH4$C4oBBRL7+0C4E*&wX%Rvd?`y#g3S~jo`xX z;cm3nu!Z>Y_>jgNNWf*GsPo9>7u@j`+^4CE=IPAcM(xRG40g?A=erWZsk+u%d1BLx z2$lEnIv#46@8+lz^WxW2d!MBbMITl?T~`~XVVFbQ>OXM#Jb}UWa=1QQAdl(db+Ceq9LnwPS%p~zthvgS*u}9gYu;(w#|B9NjPe>n`KqoLr9FdnE{QIah~-zVnIeLmw~N)wm!jmgTZ!TL z_vG!o)1<-*%Uf^Pr`#yz>?oCNS_|@MMQ|dUF6+XPYKs*IGS=uG=F19k>7wdj;d}$k zK`#jLYhfC$B8tu_z))C}n&Oq<&T*O|h!%#&%AUkhy+1PzJe|I{{kxE4HjRFW$h|>HQh@=^In2 z2ZllLuP$iaz{79nS?A=SY%f{`2T)&5UmX}}qaQ|?+#{aSgg=WE zKD+yI*Ip35@iNlbxoU)pIv+XM$J!!r*{2H1Q2Fa-2ZK;)a5=PG)vJ6HTjYel50FDS z-znfBly;A#QvX*|V^**;^SlF`A@H(G#`V6*F47`mb+dHhv!pYBmRrbg8U5$vn%KJbDGGAQ0=M2bjRp;z(W0ahR_l$l1oXz7{NeLz6= z;F!maJ9$zcdM?x{J%b45q6fdTl+=oYX**UwjAR|^l9H%R9S85s&qK2nXi6PcnZs^4 zeHZHW{an=xe>e!bxECWiv&Fj&V>{y}WW_%%dQ~vx3c#eJrni% z1Oe%ZOYgxUst`n>ZQeSV^Et-7xW+6Dh@ybJo)G5M!iy_|o#vgTq$B0F-Jt5squd7z z4;FaWI?D9AR?e-BBeQTjZD=~Va)$C~*^h_GS#iutY#FRk*CONx1VSTDbNbmy;=Frt3{c@~ zaaaUy+hpj{;hhq2hcCCyd1DS1tvKtUbmz6Wg$>P?SLO0=G?6Z>7#j&(mBLFuF-Rku`Q)hM}to*R7! z2JW;f6W=J7wA;GhsOF(L0G~^PI&zYVW1&^|QE6{4KW)K5xkoGA2lC;2GH$;=hiKd1 zW;jn!kyX;N3dmI4;OF$*L!Z3%G9W16){&4Fr zo~&uTVN><28P`zS!Kn!vbK^R`3#iFI5tCN=tY{rtyka#~I!yj*lI0pTNM$;%I}hCK z3trqh6S<35t`=&{0>OsmT*1@XxP%esF;60h&FEncNKF`OZ2s8wIU-5cs&!Mu+IXgH z#+!H0;zZA*@P8gBFa|uWN6>dW?%8qi=%v8n;}Gsv`IiL=5uRdV?MM!D;RCY3cdV0u z59#T~li+u!0?k%?#wd41JkFG8jHQGR!Sb|8Dt;{Q4uDR#29q+(EpQq>WT)g-aPIh> z;*W%K*mKCTH#m)jLX>=aLRZJXoRWecuef?L76Glj+b)N9a=EmEF?W8RC9p$KKcY z7@P4XU&;#0v_v>VT#xWp{cS!dAdddK7>csu+Yv)7V$eeS&hifBjKN8@Tlzhw` z2M>n~&$VZQ0g!V5X;q|_X4kUrHC%%Bzq#4BK^=ow?wgB~vze(6E_b$M6oImT#;;(o zWMu;sm%>pXFm_rY=O%DWm`+CIjtAya?r#>vi7-H4V-m?_4+mn{(;u6KaQP`Y(i0*E zvUBA;;Q`McW1==7YO483t4QQJ1$0}7K`vdE>zz8c_`v0zoCCY7Wa)>2$(4yM`w}$c(j|T-<2fMe%=+n> zfS};H`Y9D^9?d%{afooDQEF>&Vp>tG%BzFl8=v@cr{J00unOx>HbBz+s`*LF2B8h)U7n7Xkl>YkyuGCP>{-D*%qbMF z^9{7tum-Q!0uhylRYeEZY9qvzA!Tprf0ez zNbGC@C$Kalm=f@knHyVQ@UXY2yD9?gp-0A5{^RC#Gy%o~dOn5%&1>1i0I0r`@hA?; zKEN-q=WCubraeNP=J#I!4_y-ELjJ*8i!z$VsM;OM(%Bows3u5`2Bes37pd(Fd^ot< zy!K1@t{?OeZg-el$1RETHT{yZ_&Xy!w!$22j+LwOW+U#Hn8=_NMvs>#!(o4IR=96J zFz_25){G8auJJeqiu&SIT#N;XhAksOxL;_N2Q%7p)({}9yo|E)<65kYWLO~AILK2c?skJxTe!JL-pJi9yZm&K!o#I!R;99S1}H75; zV}`}UV}iM2DjV1!&O=n$wr{&DDTnlAFurRRw+hu(Xn_bo&pW$!wZx{*P|5bq)jf0T zPV{-I*_N%>%j>%~v=Bqe)P=9Q=3ivJ-AYhOHg8}u6~lNcvD&U}47a7(7MprN;4r7N zDQK;6A-`}gUVMRNiMw$TJ%!my5Zr6T-*v0<$sd)U3*sgZCySN4hcR^5J;Y6t1j2H@ z8^9nND-m-*pDF`Fj(P($E~)btU-bqEOz=cLs7m3Cg@fkS3Uyo%pVs#NX5voC+|N+g z`-uEB1<6FA*)H6}^z5KQd2yCYE?`&c>*aeT6hJ<7(8mo5i{!v5o| zBYOjw<*QEvZp6`^27rd*FeJd@8k+G^eBW9EtGXLQdyUNP(GsyEM8RE;Xj*t=r zI7vvH(!DhTH~f#xu<7T(vc=VI#6ChW>t^#4Dj;%Ufi^zQf5=9jXH*gP>w|e#7Nh&B z!7jE-ver6|%byCd=3ZTV5i;4u7YVVpi9SVKZu;=TdNsYJ_HhaNQ3Zs9Xw z;7EoI_DD#X6a*~Y>;L2`{Ccw(M@sxs$`DnF9Z;Qw)Ny}^C1XXj2_No@rzRPZo|drJ zmk((>Sg6Qnj4?JpF0_!}^Q(FX&v0lx21 ztBH4SodV5Lq_$k++?T@F69DQxY><{@vnNY8{&Z<)Pu<;h`FfDYNsCcE`&i|c<{E`- zGj2AQWpY3FUbph#GahKn^SSsmJ6~{?zR=D~ECY1B7b12tyKM~g{D+`YIVDD)6F}DN zr(1JGa1?kBpviN)EtR~qJ~+6So;9uwY5}34w_Kr%!#=6QAq7QQLnJg71lXY~VZmg? zq;xs~0;IQ_>FSb|6FJG&M!j0z6rJfZpdt$GNBs7oG;+{ z7)%3Zgw+&bJ03z?$Dot7laf-=|FdK=?itlfw5g%@dAkrU6akvo)r?xkbd2P3oV($q zYR`l>kw;UWPDiLlcgBur*Fw1Wl-xo6q`mU#9)SKig-R>rNXvHd|mgs_6w;`1)x!fjwQz)jXzARC!aTZj`wx4O6Nd zGT`wg+&wGZRo*j;Bsm9@CCc5ax&-sYgv~QQnk#uvI8Vb~b+Y{Xzi!|JxzRMC2@NZi zA|qz#z;jmHIsy_E6QF)h^j?yzrtcN{GSzU8=$2pDMjI_rz|-XB5qtmMNRhVWO;}L8 z65kKd@{iV&YgB8CJ-i=mO6HNDjZMy13qDFSSx~IJcx6EBUiI3jI~HizMS1k)@i3af zL4lh&7X#ME5rHamlCb8Kz8BzNq5ki|0KX&7@9T7)@ ztP;+ydiXc_SY9~8F#410Im085fBNx0H8ovTMe7KVAm?g#v9aoV6GP&FA+;9*R#4W-zm1lp?{D?cOF$3x}kzP-I1 zU_BBr=IMY&;C)#lu_!C&h$}`Kn+X>Fm1WYD2p?+oPs+ zmimQ;!`g9Hhr-(P0iRRO%nHGfX^PK(!qds`-)B?FcV^Nla|_wQQHSKhxT8=` zH7IXBU~FAb+U0(woJd;U0ypITTlA#+bnw7c9S@NbE~U|;mNr`23PJYtjCJVY?A#Ll zcO!I{f|e)UiBC*~+L_;lCWGYcPB_#kt3DG9gdE$wVl>QtiU6&FOLvK(3&Dp3aqCuHn2rVE4!(wbOlI{9*VCQXDd zC9M`vRZm38{4Rmqy2-PoD(!tD+TvCa(BlO>)SQnZw|p#fQUO#d4;+M^%GeuM@LI

fNWtor@Sdp5;m`2-=o8bj!5ymi?}S zluFQ?rQJ$7u1k598NdC8l>O_`{Ee|QY+FlYgFlZ0_`dAM_r*cLbFu*D73B=A>1WM< zVs682HiLHZJ(}y|i`MK<#JD)1DOW|BF#rcf6c{U+4Q8s2-$!_qQLpVsvX&}{d%1*3 z!~@-%*@Ap>#tQaYJ?X7SFYfr9Zg}-(m*wYQLe9<}-KX8hcIi=HINYO1f?wO`XPC18 z?5;Cs&#vIi$M`$TntIBb9#L3;mJRpE=?D7z!?FlNiM8-aWd=9=?)f1w(yyyV-4>Jp zL1;X{0W}-|B>pn866w5tamA0ZAkO5f90;Nffql*tE74z6f*oYSeSX^r{4JMhOuNnx6_9 z0K$xly!?Q3cf~@lOLnVOHSQwJ4oMH+n=ncK*k`g(sVax~{Qjb<6OlRj@!PGUTO>!E zVP}PvsytSO>W>Q4Jj?cEHT1#zlyNfy-CM~ceP>0zGG8VL8~eTuD^(qPuUiQv?mCfg^kyR6uP1S@*2Gz1Cc{kg_OG8v#=hD&25X)c{FBzw3k&Fikf8$u6+ zWnbNkk7>fCofuvPgQ5$3Bh8n~PducS8$k`+i!04)fgyqKd3(x9SaqG#+lEfRem>nkd)%2~>Gt8*{oj7ws@WQ8n@yW0TzZwD$o(Bw zErg(_ks55u}Et;jXG(;gksk10S zWg+BBnrCbcOH^q>ymz)lQsiyn)6ng8c0c zeW!iDbJ!ZR-@lL-u#ESrqhwNCCPNmAeq)IWMLr9Cb$xrWYa+}{7n{hL*v~qEJ+yv| z`aPm7=)xCEmkgUxu8H3XDvt<;S+B!m8qDkvF>qi6o1?upUOpUxPc4UI;8RycX4vH6 zQb$gp?K5OE=(JS!V^zM=3I`w!9Obn)qC$Bq}f#6pOHc2TW^JKn$TvQd zC)E@!C|7&&S=K6ndazs&KH-k5xcPK1`4ce~_xY4l;AF5)_>E<%c1X5ihKl?RowLX) zJ-|xhOw@_woaB|Du3Yw-fpmqNaz~&!*Sfl4-B1X!a-nwW$pS6j{Nx#zMA&GKT%EtJ z9w1`gGlGbpv%jG6W~0cjM_aWUKyjOh5uQgYP==JkX&CR0&oJZ`RcG({+jk<(Tme7a z$aAzxZ06T0BC|2bZ4vlVr2xypMEK;U$d6;?X+6@2<@th=8_Bi-!M8uOb?p^wfZp*S z$<)T$He~9Fq$9&az&!LrTr-AsncWl~t7k21l0oHb2%6y?M#o|i7S5?oeL$#(##C1k zVl3g)id+_9{|DgEx2aY&?Auu}Q8kv6Yhs|>!_LIB3FN$4jGq6fJU7F*ID8QcXZc0+ zeHL@p?@}oMfAT?FO__>-#u2bDWQ3|>&KU%$&b+t{XL^2 zEsCdN{?U8rYcXzg1g~b;;YTHrnX@T5uC-wp^%u8tl}s)*4SsqZZ11a7x;=7Di;JRn zH{BsWcbwI8ms3aF9Q_zA8839PK5-MAEKK5vpt%5g>V_589;K}>l$#R1{&mayf8SF1 zzi(*}g*o_~d#Ao%t9zAuVVOPo^4)<4Qdj9qy;vPP=<$fh(USTfCWDAE{eX5*F`r+M zvqQxC<@WR(S-?j_)*b23&q)Zb4EB zJoF>L4b8PfZk}pj^=N)@>P#YcmG>BmX?mrlDY@SA*k+7ub55cEHMj|$4skz!&!a>J z@`2FU-6|z3TJEM)oKXWq@8+(iA7`1XbA4IfagcBah0Jp`pkHJ;A3Uu~ZcVl|93tFz zybbt~zQ(7THqNVDCffh?%+~R4KcD%FXbHDm!pMKI)G2C0%+-AeR!f*~3H2AgYc3uF584UYM}JCsSK3(I?STaQ!HQ+PA`lDj z)l1g4U_ev0rEFc15Jv>l$-UJ^9&P*i4keZz27?kG^6w+Kz0^_6tf4J_(2Y+J51Aps zxq48M96o)yca&J(edqcl4-$cnSV4uq=|@Rv^v^+26MUUezO~hjzgpM*ieLxlzM-!^ z#mubpDTVjC=n%x-$;Uwuw-hq@9)Nr1{u1N*?>${#W~YDi&#=UU7p;@R4Q4%{bCNNn zb^XRPePw?Ri-ya5CKz*dGepJ?O_XNN&y`=MPxU4nxwXZ&wWshIYdR{%?5d_VH*xnU`G1W()CA)tld*Eu1UH8aG0) zI`rONa~-r8B9J~66G_dcDxBtv?g4LDThQKfwa~txza1woG`pX#&kiEkS3%Yb;Gt;r zEt)GTx4Al9xzaYk8gkM zoaX*kDR6;-mA*d5Ne(yUt`oMA*WWhNOhUO0c0|G7&u1!$xBc><_b@7^J6@Ei-ZaOF z{yC0GgG5!D3K#N>pdBA-6zG>Q6;kpgJp$NPTCi4)RiSu+e?*rhrq<$j>mD&{CB zWj0#uZfaTSx58w*i?b9EiuWzt@PFh)1)xs)+qfh-EdBT#w7n^zWq1!?JVxry&-t^Z zzmlE4GU|fKi74T!Xs?+K>_0gsqv1K~J22~-x`~=`;yWF!s>h}*;r1FLActNj57~q~ zfzS4o=gmm=afZM}fAsuyQO|!a`i67*#x28<8X>{!+TIj&_#rJBd7Y*~fg+dd1u_s% zTY)!s=;7YiL*{1CI=}puhzLvC>W?1Y72E#0BI4&2efKL%N$%MSwqRmH zk=I?cS1vPWs`JsAU;tbhIeA8&!l=RhiQDF-GW*9!?Bir|b+|5JPvNd-z{?{Z{_R?M zPP0m?Z1?%geby>D=Q8=e4fB35FuEL%pTAaO>YT2+({CUB+a3Aw%0}#zNzQ8ZJEff2 zJ{1E!9Mr%~eMrfbGm>}1uUo^P*{N^P7u~07(47k`_>`nne%XkBKFO?p+uUb_*`r6` zs>vXsxO-mN{~k0h_%ooTG?mS&d4YmmG=k7q~5CbcgdLM2YU&h{@J$K(Zj%4 zCH>GpGxv~0yo^*{tt4Ud)C2?n9nLL?(D`+A`KZ+5uN+x!wXKch)-$06A~kKSqFc3+PhBI?ajDArc+C_dDdxWB0mIN?|L7b+Z5x0 z2b|k$e2s{O>2QURL+bOxT*<&mW_rz?PssjoxZ{-=jT1!-eshF*M47VpvS` zGzLa|7aHJ0%)!u3So6ov{`xWp{{=xL!eS0ONNtcdi2fh{|Idy~P0=2Ip-%p_|~c9gW?w^jHV&|;+Dn6NV##rI~W*cBN|;4RL80snzWHB-Q08!$7KI_lhEjk zNQ)<5X4h+--|?R|FaG8R$e*ye=|PtvB*SJ7jD|IsjE&wIQB$0{mRQB@5ttG6k2sa4 z*`~U;np>_@OB-{*Wl}=%0gI{HKI}dB&TOPHaKqXmdy@&Of2nbAvc+7tEJ?i)JWP}Q zXOsG2LX{#z`FIXOG6EbR1Vp@&dmQ{w^fSmA;#`chIbcU`dAFtQ^yIlDGy&tyb|8Cb|5-^ADho@yAVmP-p<~fIFEb6XxG23~!W`Kio%gnXR zUmm`RhxIMFbArtb^}Q7LZTC4hYH5ON-P+K0((}vC!*5eRax{`wo^lX?F(Ng|0Nzb3 zI5~XU9z{gY0W)z4p8nqM^WqJw`pC;B{KV$f%dpbNC)-DWu3S!?Wf-ZPyAZU%Y;@UvV9Yg5T;*nIAdL>KA-pih40$6g!Vj4I=j;+Fk>)3h2QQw8J z^J$(vH4ddE76u^s43##NB&%Hi`1;ZA6_2wkv?`Whf)OX93>+MD5y6Q!ZAetKVnDy; z^pC3+wySQ(ewWdbXmEMBEn-;1!ZQf{x{8J(gWW)Fk6Ngu_P}C-#Uiix?eh(!XX+{S zaPR!L(-PDPezNlmv1%(y=_=W6?1l09=ZX0OFAt3a?yZfD) z*%vit30mSB8R#8iVSBuh*Uzc0L50{mH+(y$xV%-kPU{f@^8frJ@Tp=aj-Rn zkt3o-e`bR9`AO=Z2B5L>2A5Wxe%bB&&t{C&T}E*i;tL|zunCr3<&cBTSp0sR4BduE znPBV`9cNqsyww;S_}#<9`;;T})Vh|Yl#aV9?&l4EkvEJlu$ z*Vm7k_quqaW?+~q9)EKL&^y9G$*w;{BBa0`HwReP<;JJyXjKyzCkz(`jV#;u%M2D* z(kXItd9^v%nYo+{ym7%Y939wmH=a)?dCw+#_GIETyVA>9!HgUmjG{op=3fWo-2V-o z|IcP_Z`-5Qu^*0;V9ML2))xIZV8co(vVs<^9lChm%#1GLh2smlHg~ch z`q|J$O|{T_8H~j`ac^3!(a2{vYA)=1k?-gJkH_~l8yRRya=>l}2gBoRm5VdQe4c`cw?0`N+^9Bxf$!sT3l6%6m@6c+%Ht zDLPlzVpky=<;3|P*QwM^4h6IGwxOS@Z@d^NK`}D3JAj90SYJ5q)vuc|o8g9szq&El zDi^X9-Wi`B4_w5X)t_+yrL<0Wva~QfZriOSr=FTnY}Af->#4cEHf|m=6)elOK#t|P zlwS}4rw5jB$}TmDJ9sn7i>}NPuW)U!F7wIGOYkN6=NkWbTE3P@7Bcv|OQBQ5VPkyb zZ+tJJZtNl$;VAAF2=XcgS(a%a31y~ z^n;;CjBT<*juf@1JaX-Ln?la10PArC<`Zj}f9Li0n-?drd}}N`dg;d+^E*Gq9Ne;`7A2oeiaVAv0%ewo)9(7UZ;)b){v6~51o-0X#j!L_gfrDVW(%V zAYM{9*vqrosUS?xMOZVUAT;t<1`1vpci?KDp6y%+fA&gG<8MG9w^rT%mRY<17Iud)vLHMZ4y{gJ-NI(=Gi;@G*w~?kaWTU6g^u@yoR4E;O}$!!CBZ{F?5>hEHB-C>BGUfuQrj|aIaW70#c_ZZwpLl zwERj@dH)@7HOhFQ(djD> z{?s$Qe=7r{k}xD(l8B_WN%hvRWP@up7E%Lpki&Hi8MHX|=eWp!d;f&+6PEbb0rAur zx7K^G2Q&(cD+5gLMa9q6xixl|Pav^#rD6Q3m4!voU@MfCaD%@K=ho;r;ujO4MYU^h zy!z++hsfbyuM~{lI(|oe)TPcsemO5oE5k*4a$|~d$M}t5vUjCP|Fqax2 zebgOu2P|$X@+xw&i@_*g=lYL(>;1jg?ce@B_T%-li&EsU^kaDUt~@@C{{VE~pVc4d z{`>167R|2zK9B#dhmY@rpZ=PE56iQ#3ziVCVD3gv z3v|`Hd{=v(loE@Gr^IT%{)KBI4fVDGA4RbrW^Q+i(t>VXKs8T)EiA=rj@No?BcvQU z)R19>SY)yiq$BV8&K(YUOsM|rqrm)CPxBp@Zk$y7XH9OO3OCa40gedLF~#c4f0A^m zbZ9%v&sFL@WGPImAaldnwxEf0u$8W%K`HjwLiZ2 zg+AOux>PQouW$H%o|`(pSm#SpR%8wsw8R@k?xP1ULHZF1kLnjLtv8R=IX!c2#iPLp z-6HpLg;3|acoUtrb4o>D+l73A-p>S|dd1DpPms&CWeBYViGUXQ4cyUUjq~rMptQl> zkGGJ~R_vDYKU*+>7=AIfB4oyXYXEMC>RfYwBK@T%iqweK3BQQh>Qll1`DGPO*na~K z86KG?^^-f9gyuppz`5T{o~kPddz!*YUu}1}w%k1}O#iDI{T2GltTA+@Ta~8Hz7R$& zo+s#!(w#@G;yqMwGf9B=HKw;fnyMI#H=7R5@-4MQQzSV4^I#u_7RzAM`(2u^h+li2w>%987m_e_4Hc?Yb^fBhFHz?aO)s(Mz){flPY*`z3cbn0PMLrYqOoCwP z!`0eEXlMF0g-cUSE1i?zjpFt#3g@i)rIh+I zZl=i5^Z5FI8n43;h&xG0^p0GUH2@^KRZQ}_7ciHxS&{Pcf?sd*9#!D>-~2Mx3-q9> zxqQJ4ks+y6cMGx&mG5-9I`0TLvw2t#bV>H6`h4;x;x>19Y+D0Ucisk#v1#+YVY%{dsgxdC3JIVFL#IG^F* zIt4Ktl&kWy!#4fTI4x2GQXgD54WxM!;3cN)>};S2;4GI8q=EDc0!y3F5QsBJsZUn{ z8ae*Ib+*)A81aU@{`)|WvNBt(>ZLJA4~-)RFD2i~;{|@1yUwq4_m3FW z_Gzb&?;p*@8tCYt=n5G_mUd}g3>vF@&9r1HZxN}%*m89p5V!^+l5(@nARte)`txH| zhd6cpFsguUd*ZO}w?>F=P#ZvRo!wqx?Zox|KHm=+3y!U+H-DpNQILHVCWhzlJ;*^s zNE%VdL1ax;eo^f@fm$5j4lb@BYCu!axk%+Zs=(W4vnD;H9wt_68~`zEp6J0>t=?&v zVvK#!WTI>BTx;sF6OR^&7U&yD&7x^Dgsl-j67|RO6y}g@a0TQHAA&!Xs$xjQUpV^M zW^aVVc_&r0(FC~>vR_r_vSrUlusAgNBh$ArF`A|5Y^Y3?$2}KOTjoC0N?%jEG;agO zdSMPggXaaQ-ys7K!F9L$)-4X57hF!1wp%`ddXIn;w3@aBf4LqvetT|@uWukPNFHl= z$K*U~9N;T2AjZzhyoGij8>2IywBt_DaQODQY0ERFT#y^BP&Ly^fBz3c_)xhp;C||N zsGxn5{bSJb1;JdP4J&CQ?Z8NEPLgdh2=;`tEw1{O_?>tX@&)N2nH!{pC(;9DW5qm?cx0cS~kg2z;jw!=2MUBvW! z`R6=h5(`$2Lj!HX;*F_x2A@E+)9=wKo?scgg1aV)ogiSq&R22bH6C^#O=r zt*wa&&LNo?MPH54B|vnuQEX%*Ko0`l%B<}<2zCCBH$kZ!Wxhrlb<+jg5I;vE9;Me2 z`x$69I(F$xrKkm!#BVmrA_SXrq;iS!bv5k92bADp=Cz9csA#DJZYqD1@s>_X%4rVsI#0JDlkN zIWMA`f;^4Pok03R-HzOQ3qtqPJ{DtV%dInBbj4Xk$`bMDJnYJZD~^9g%KAVoy+B>+ zW%ggtyPd$^=8cx&28Ii+8BU-$BiEQA3*QEFIM*=A{(mYQ3+gcEzA zVX2ks5Fvd>_xs(epLEJLQK>hWz5I;g#(cTzT%xLnA-_qB_ho8P45?v%MOb$InUY2& z#r4gpIUd1`XglTn^kXtI{a|zj$47}nR)mZuI3*jpYTXL9-dj`-t|hekPBDiJ)J}S@ zlZDFFkadrbO>DV92hAQJDg&S5pX=kfL1}hsevV@@g6XU_F?h1Ud-NFAdt=nC5i6Ln zZAF35H&d)j3XTw3+~0GRmWTjs?B(YMY~MfpX>P=+L<2!gcWyC!3crKlY+nvT8$0Yc zmMr5CodYzE?P+H19(x2tmwW41C6tc9QMXR8(Y@5{21L@Z(fbU3pN!24C&c(K_|8nU~oWtEHKXp&=L zrS6e2G}<-L%&p@7j(Pn;^;F|rsIXY?BH*?45=!05M=u|i+kA}!PH#5g4vj)w$`Tx% z&S@=nX?#nA8E&Aiz5ZO8h__GFsR_8X+wv6ZYZ)Tr^6OFq# zZP2;ST~YP7z^yA;k(1SIhtC=ZWnNwiM1gNeuc_Wn&lS7AstJ$I?yNP|jHe;q_4;be zQjK2&wEs0lB@^OIpVf0NBRFjY&Id%wINfjtOW0VY5=)02yIKbu!>RHZr7Hv2BcV1J zrMI?qk)%)=tCT#sHpoNOZ{lYuN1VHZ6V_Z5W z>$v?_qgLS?kdyi{EjyECGs*^R?Zmhi#pTK}^|g~_w9$;wy>gFaTKje?%zN)k?7rC* z&4DtRR~vA5akON`ZGyJYlV!dj+(AU)=0+%9*TY#7JE~`tD1Y;*&8r3ZZr|L#<1bQL za;}8BIia~YnwfSpP?V+PubcsfKh|Nj{@{5@K<{{(jkwm)^da%_Cg8Ug%?I6P=n*UK zt&KZzus7O+dhaaoSl_AU@)?t;ic-^ZsZgRdmXMX=v(jzCBb6$1)a@~W&o_hCcASD3 zl#?-&!&8#(!I?UfbaAv8J#(0}?CaJzUYRwbm`W@IdxXPYfTNUQx${4p<>TZaN#5z zmjC+xtO8>va1q-QY7^nY=U18fS#m{0l01ckEG~QOk#6&-2m8_VRF&H@N^8G*qv;O0 zIe?GIc3uOP#qa{{zr7Fo@aK;C< zbw2^ihf%N&XYgcBtdDtOykNy+Yi850Rx#8g!yZl==qlb1Z(6NLI>tEqQ%ha^h)EE- z2(u#VJ15_;kse6Eqe+4dK!}8jS~!?W4K|cKrTXqeb@RIWLB&XAF{>j$zqFbls+afy z#!XNH)rVspDzsRQQ$v8wi==D;CcelW+fI{yygpTpxw8E&l>X$`N0kUn3L+0K!uR1% z%MQ-ms}I_z#aMby|MD6G>V#SEb9DUI-JL}3m!7xrt`vf0XJ)V8yMY%^5&t@*Vwx+3 z*fP_=G;fL&hn59B0s4b(yOVNZU5U-c$58JpN1f9c?;*@DwP?o-4r;^0pLzPLkIx`A z$q1@SY;J`R+%n8T{`QQpHGytK^}}Sx%-O_O&ng8%eQm`DP4+aYee~L+zyo$6{{B-D zvKlY~Nv$e$08hNqih8jVrVpBMKqV$8T?X>;vrI293D;H1xUft0mzxfKgyH^I9pr2+ zvPHk4k!4cp8zACtby|7w{;_%vA|pQvk!_IU>UoCOWQg3R0zRvrM?$H!CV~`7I%}3; zltHZ}Fe>w2*k|8=o^vI2)5r&**~kWtrzqmyItqk87OM&`l(I`U_h zsjmQ}Rg0hCNn9lFEM~BvJ-E^@RDNFc66^^D@u8LFBtZoLh)If!e} z_)f;Cnnpl~i}h%=-LQLGnn$$RNfKT@I(~hk&MW|CWQ6SlBClqFt8d=RpfNVKYt$nn z%P!Cxjd@%|OA@L#>Ocn9=GSXHLE2=(KuQuVGor=+ld4DCn-|=dhbr$F45;GDt1*E< z!@Rlr#$741lxpdikP+Lun#_BS_h^m0^T0V0U!3aWFRm7~)6*|uh9{5~)R8ZDK|E48 znk|dF6KP6t%bLQuvRZ9Rb9Nbk&8wO%Kyz9X(YBRj6DhZXhnPk$xuoR?f`7gkrL=PC zbv=qdu(>QU-}Q#YqH@R7pFwE3xib2dlPGnQnuZ~}?U(d15G4>Gq&?9tGOV}R?*wZ- z1Ya@h>~TnsOkdT8+M zXML+c01u9n{uxtj&mAhw1^co;H&3Map2k~K?|fiY?gV^r152GRPzQUKRr&yhx$PT^ z(TG0mHflTb1vbQ-&}bW@yhmOVO@b987X&W%Ey-U#fZ1!|7cksne$$p&xU>yXvZs{* zdbRHU_5~3Qe;fCqUJe2;o3lGeM~R)1@%#4qOB;``^G?HXhJnsb+cy{hWEx+sMPiBF z0%uRzO;6>`!O?aKDa{To`v0~6!;6EbqC1g5%I%~B;?;kun7r(5TSqkUdipaEw*L2M zMqrPeYI`2V>-IfgcaA+sq>iY`eTC%vmloCj* zQQHX``29SB_HPI(jXIQTzfgwqIBVdB3nefd0&ewOF%=cXn~|F(NXa11g4O*2rW|?O zXLy1)?}`;(=&)gy)XiVsh6GL_%@^biy~+>kqlc6yzkOJ7gFt0W%g99=#!gvrn2i6| zb1$ZC{NP{@B}7dIS%8sijS`RF=SP`d^Bs+x86oS220@S|G7*JdSwxfUHsAlWJ5-u) zRC~L40pZmX?NbXWLLkyd;^63xYNzbge&WLDNqVN*hGd{MO;eTa3G!OTO?K-dY(tT zqPtWBd}aU5Gj8<~9b2KbVN48)GE_nR28a!(Q$ctk7g2SK(T# ze%G1ke{z)mb#zjpO?c$`n#_sD<4pVTnliktMeOMHphYO`uWZ9JIi=UTq$qKsg`VvF zN62vFN%6_R$>T)*ZPzt??L73T9o{}uhh&eP_cl<9%*)Cv^hi@-on+qAc6SzJP4V!R zd@8F*SYG2PrJxwYJ?&7v#9?Y|MQr4JqXd`H5U>U_9nleoaK=pKAL|1# zy0fTIoBWB!mi0co>?qELo2MYGwzxRRnc}%HmHzoNupZX9rZh}&h4xm`jOr^TOSHnp zx{V2T;-9#RS zRqYtxRwKlt+l>la3|rx*6&D5Z{4pxcKB|T`v_yk*D)Q2LnQB5L!GU>V2jyz8N=gKJ zw~GJ#jd?ATqA&)ALXuYUz9bMcsi30Rw#M$Qr!-rQ7TKui!&i=3uZ$^mwplT2!`;_G zUEDtNpT6#WhFODc$9{FjCR#{0QIDuDsqz%;Eg9$f*KPy zx=@!pmkVR~m}N$q&xo8dN-=#GkM5}>SX7s;*8-!74Kiziy;O_`!I0OqD`H6N0OK@G z`3ateq2P5d*=4hW(EZh$SNa zzkTWaJdBf)e{IX$Q#WO~p|uc1NH;rpqrrEDj?A1oJ0>+2C1P$VxYU%K&g8cCN$s(a zhYq^X*2x|wYNqbkxaF;v^x&C6qm`K1sk#ohn@VtlL!;9h?h4Wwv5GP-qm|m6mR|0T z;{h!SVGx>nHZ@~{*$h&|<<-r1bZ(pN2*DvV0OK_lgU)74a9s6Op4L>TVV0J&q*-?q z9yOd(NeN$H0XSq@Fpa420x`AF4Z}cPgUIHn-&D@U+TA0mp3jR{Pv|EzP1-5p<_5Nt%RC*?XdL^^TkHa1dAuC8oR`lg;L*r=|p9QP)=EH)VA>ZFi!r<6^* z!uwvq$l%%7>?qD9#!gGv>|T^A0fy8Gc6T=4j)*AU=O{;q(8EcgD?tD^kSk3ZB3j&9 z5(78Cs7<@$jExUmG=1QdZkcn*X(61Zp(k+Y4U5enjWjj%M zuEm|?u_C&K>N;uEKx-u-m>TWvhsYW$KT5lxr~eHM>l|fchiySuIIeXb29Wpxw(!(n z__wjDVT6-`_6Pt~3v{C8uIti+uH@`5@S1YM_`#zfMYTp#&NaD>a|`=x zy*`O*Ta1)K2<>!ad%ARtPI?HI*1P15_~;y`NTBlZjYZ^XhBrFQh>eZLZlu)is?Og z(A9>+=Dnya>*|IT!WF6_z8fY*a>;g=|Dv?BX)~AQ$b4X~m4ROJ$Cr>(Z6bl+Ey&uq zhc68`39)W1e|M$wPH};4VJbY`WzxI6m0_~-&dD_;nbwq(zVeVgefY|^*Lv%sc=4XV z0r$LMIM@7s9c}aT7+X?YMh$ke@D9!1dKNcG2cFs6tZ^w@^GpS`6`5&?R(MS$ytD6h zSGL+Id0y}&S)j%LWxzy{7m0miV8$kr(U!O-x?p5&TYUVEeO#~M)@BwrQFPE|dvtb+ zP|;tS*!1gvj=4?GGpFtw9bq3^FGZ(CxmGW=o)t3G>G^b*LG!p~zqV`K&q~KUJb{dEfCbm$N6n0=b#D2yTjF5QIP zwY(oMMtfF{c!YT|y@?S=6Hm9*ww`v%f#Oye(fR-+zArYMKXl(mQ=g>!9wtG)K>`Y- zx(y+cAod&%^%z~_4zb&lb^he%0PKsvhYS4$$fAr5fi9fzr$o6K)kl3((3mNYk2)1~6(lMyq_LKc z)9yhnubY8h_b(2)R0aU%I^ScS&Vs5BJEVH)Q zMs_ST`XyqB7@`;$c}3Udj^zcHvAbDb6aM5`n=9Kd`3M3jUPWtF!t70jD_vLJ4yTtU z-7`M1|M1}MfX)tPQxz6O4*ANZVIJ4J1h}rw@+XcoySY^N-P{@pRlzLLBn!jvlTg$4 zFdFENg&2LbWVe)oDI_0xJXio=N#2x4R)UeR&m6t8HQ_G;$vhQpe(6T0{xkK;U`y;; z{HV1LgDb+OgENGU<0p@()J?crv)09JIM#f7=ljZ)GF_UbIX8{~z{e7D;p-tP`jXNR23L?vEQjoA z&8<|GG;!R=zf|Y);!Okc5fY``PnYOnNPV-R+jo;s!{-(g&7bZ3wrTIyHlE%g48QYY zO$jxSbb`du#`1Bf50yX%sj!YQ2M%`I327D_-Iqx#t)A4BYtOA6CWCEH{7Aq`-+C4L z7Z;@g@>qhXS?!Au6(X>R61dTmOJi&|^#>uNA{M4@hR)Ki-qb?kX_|2-G2mr$dh-6N zzP-Gsgb#9W8|;`FjB%8_-Tqe#ArHn?_|#n|LeA>xPU&;+&SVb8|9#fRZcMyY;-=Zf zP7OJ%L{P21qLgT)L`m*RK5JG&(fR%2^ru$@;h1*3ikUiVe7da=@!((C3JH9c=KD!{ zv28eZ(O^pHx1%AgQryk>;@S~MtPkBXKlmoMt_gO7$6G>aO3l1YkF75O;a&03mqw&+ zbKREB@43Mr-`e2TT}uZ@6#I;`q;?jDbmM*WuI07ksO4AZ4*8b;(@WjLw+denRQatx zT1zYrPQ6t2b~*N^HH)N;Q|GVAK33q%yYyJKP>}65y21?WGH8%q_=}wCXTv=afEPJA zFxQ5P*E~~PMkLtw9^P?y(4xV2F1@v$6wJV=_w0uekgYruXQ0L(tn!|i>{J}LyES8z z#F4e9Lp555U+Z?pqjMDOjTaG~?}y<|iHG`|tkC&hS9y?o`-&K{(f_<-_G)5P_1h?P z$d@Kj-rYHAKC!tJql?jLynbNQRLUKd${{H|U+!DAy1mlNX*S3@$!D+B!F%b-&j$pb zs~;@bI=24&*QTLDoKu3`WJrKem<cH>}uGxnSCA5cj-E6ixib6R`A)Hgq%8-nNgT;NFCbp<=e`c zEjj|#zy-nIRNlJnVMc1m{lNlSRH^rRxcYA|U#})-(r(E@(e<;9Dp-}hW>b3Vvv5u{=2ywn1r8|$|axCSr4w~GY;T6+kGyJedZ|78{B<0KQ5 zEhev2{cH#|JN4KoU@iP52|(hsqE-+16D?LyS~ZO?WhP!tp|^G}P$Z)5T5a)L1-3aM zpHv+M`0fN)5I69m(QoBlYaNty>lWU5x^l7~vm%~yY(0+`Tz60RCtuLKNyiSj1+CBJ zI#lZO0284981@3G9JMu=;1DTCz9mW-=B9csbY>oM9?CaJzd!qUr59n%Yns~5-CsWF zWJCEt9W_!T85*oPHQX0%A9@pzY2ec8rF$~dm7G*pu+w;PkXjwv_K>2HD{TdLK=6dE zIm#fFrL5`A)y7S$%t>@{k0&(vt;}Yvzp+A(iwi=5X>x*T*L5AI-Wl(Gx~_90f2#J# z%jx$uv#G*XR|gq|@AkWkOToqqcQJFWxzFu;1mdo|zP@=eZDQ@nV8X3S5g7D;>6B}0 zZS```TlGC**=aT8Qw<=#`7F-2jmtM1y7xTe zlx302OM56r5N(LWdew;htjMP!_;a13fDF$0(`9Jbk2}2J^6k>iSO8GsJM$hP%&(#% zO#YxaULX2!TRZo()BEksi-P3lE;$5^vwK_vu`4%I*mLl0S30}O!;e0_dQSDN-HPes zi8iAFbQkc+)*1p7WqG%RkM2fbh>>D~YjZzM*c)sgb2+U7bg8rEU= z=yZzuuNQhRFT=zzNBWMH3+~Tvw5m}Vw#}Q%-O%al1$o>?O6xyKW#_Hpc1H+4Up~0k zCMD{()>>{w@B^UybwKRz{m)>Iqh-n2e#+)*d~IkFhjnG@6L?bD`+%@!k3#2uF@<%hn!0Or<9KJ0jX>lkW2>o(ndtn0w=Z{9{p0V zfVJM+GG2ST`>cV6hfWYVk-n6{hDop9XaN^EgpF)``g z&$8~y(b>S%#1{SuV*G2FHw+5h53uIXk|5GsTs&M$Gp0#fe6}L6}-5o+u zM(t-UZ}tbMj{Mvl5CpiwX{L>>^`Y@5O)Z;Ni8kse(r|nCcSMjDDmRq2P^IL6nOwsc zn+s4+xW&GwdAueU6qd+z^jCHA_K{(VsdYqo*`DJ5*M0{OY}`V06T$!T9?-=K*ec!< zVmGcgOBi3~nCA0)2Y$LO$rqu%d-I{-F;37o%8R32wyz`;^~~O_Z-G}x@o~RkoL@BS zl-;(lB2cRwRtVnQ<@2i)W>CO(2n$OsX*^f8=69Xhd?|nZ{_w}UHZFE?3ZH_n*TPJ^ z{}hXE1cgwaLQFe=`)L8nB*F2ZPEo{>q`j$^!>r31gx73`Z|&Z@{R)}VE@{3k5=(#2 zQ!X@U$nQTOqt)9CqkpFNyd=NM!&NwaQ)15NBs>1K_h5qEr9>xS{fO9{GUDAo^LJKc zPkAAfs}21Kre@~@1X9&d(N-&l4{f=cUE_{Ka4Q}@Kc8HPXUlOTk;>#tG86Y=ynv%S zB+ngZ#m3{Ip01cz^rnrKHwx{Q^WMWn$-i4u2o1(Jeu*KH@uIjBcaC4f+?4YA}>2VKR2TTb@S8brYD}4hegV} zlIdt7TE(KJ;u!O;xok?@dKQ5{j-JZ+mHBrJE09<4_vQ-th!q>65oM(%VTlgs2U4SK zouQ-3Go_Z&g%>LOG&a!!s6i1eRo{@1=x1qeC4|*59YZCwk|NKpm4JP zDQU39nSY6&b;h;+f=m6903zDb-XQr}mHCVb7{W4L!m&=Ei<7tbetvlag>i2skSFI> z7VDWh^fJ?5XRB5ISWOHTeC*G+D?tBccFG{pSh1?mZxYR)p|Ca0A{^Bci88HnwQ!bp z2>RBz$Q{rrov^^C-##7?^o%^R)X;!X!=6nVx;tEnP?H~u9qs2?%f3jM(ov0 z*os*29MSDvqbORR$V@I};|>xM^hKsHsLd~bt2EKq#n<$9it#ArTTjsRd?79iex4xU zB>C@+fO;ZJDDCZDmXu%Wemg`k18r8ZXU6f6Jt=NwsxA9}wK32MkH9b0*ky3JyUNa0 zI}|@!KlCO@X99>_tNq43?Ze@Vn^t&q=n`d$P=?VS=tj)EC`UL?Qx!EV1~#B1R__V< zq+u<9Er;wnj9b-MkSBe)v*6m6dq`kA0PFW+sp1{HHIprzmg?ghB<0?V9PK)Fifz=(@ICZA(Ug?#kcS%aemG&aehpgg4`zKl=coo-;4Ai=b zSlDz_VukQX6IhHT_lQ;$LiUm6FV*>qu-BhWdqp0QG8|YwKH_8D!6z&nn3hxo=uAc^Qe?d5oXfKzvoF zL^2x>7%j$9KabZ3Ums|S_2T}|IsH&M7i>ZlfYF)N?W%8~&@KNn{;!`~<|Wt@M*~{o zmKlu2#?qdjBH6vFRxfu>zc0+yY`j|eaG^HzJsvC)dD&=~_7^Qns&Bs_;uO*gFnN}( zaH-Qoq0JvUcdZw-22kc?#Gf0PyE(bo_094GPk*s?AcRbZsAs-(DyaOV&08i^k`Qt} z`qY%dcwn#M+z0(elN5E2pl^@ZmKli`3IZM*qExTB^5dQv8kxBiY5a@5tKQlnJXB^7 zII!&GD#8x77KWwLgKJfp$}jK54wLeT`!776vpLH`2F(E88^#Wa_0VEig$0Wzd9uXa z>}kN7?CtOb8{KSbX`ReQ3@}9LLa-ei(g}%;!;@iTdGuPGQ7D0)zqrY>p$mBNO>S|P z=V-B^2t+k=ge16YD*)K0 z>YxdgkGuTLK))txoM)~`5)9ptnJr|8>667QmYpN6F5nDG!loh>1+>j-7i`us$@@=D zT~;D1*;ZWz9s*$m=u9m z66i5|k)1jdZzU#pQ(^fl-*HT*dv~uT<%RXOP*uva6Q)9lQ!`d(@FGxxBj%vO*YfO^ zv!i@kX&!4uf>H>I<}9y)D7E+z?Zttqr|F2n(^;3Crjx{}iHp&ntXnhP&vOrXGZLGC zlA5jo#ET%)KX;z%?%jG5uM)doB3PvMYo-H;N;;;j$2_0y*JF#J`u}G)>=FXTnhtA` zk&E!5l~M9PXLdCG!M^K6lh2YDMWMVcS}P~csN`Q?4}!{10}<`&D(v_0vnsFV&U0GDB2=!v$8uBo9f%R%L_+P$+`m~=)=pAJ0aud) z`){Tv_NyX9t6DIP_1ra2+No?3dNj7A^s`DM@PoF!RubF!AB#CDVU-^{g7NaFv;1Zj z^MQ*K4aT3X<5&D|3~ZDl;X+}d8;bL!1Pykas?CXXb3AMNTb~s z0%b?+vr@11|H}K5Bz-gS{>8^0Z2~35)vde_6k78YO`mA(>+_!?LgiwIdAL@p-378|3c<@}P7FWIwcL;j6p&Wp)d#INYc z&%_#dG#GNa%sf*<5nQS!Ok=~35q)1AK0{vm@`%9vqeeNRIrU1Fd*qZkkN2vCTswb{ z=jwqzflL>bGa>HSO8jLyQ#~XRxg~?7W0xDHC!2OjmzFM_QqDYr!DDT&f0iY!c9O4Bq!+qBY!3a-PxKzP z|Da$SyW!?>^~gUPTzXLW0vRxDMYcS(zgptWoYN8bwistkMd%JW5m&v`5u@M3nOC>J zedtg1j6A3i@i6bkVL2(~nH~7{T3qtZu@Emlih~kwy3whmEI@ws)s34P(ffh8>MTF~ z@q@<}V7EDkWH-%5?vvA&$uclA{Vrt%LO{)Mz!>kJE}+%yX|k}WTZp@3R)Lye`4yMZ z9k*n8PnN-rJuT=(#0}_c%{(Mt*}41SIU?(I!u{F1PpS^Q>KM$6YBLRh?E0rm} zBO(?Lnzr(tsu~3UK6s2>-8g;eGh7(zqi$6e6TP6!s~XPKbmr6*#C)Djajlo=J^OCh z+OSs>gUH*xU+t^ugPQ|*tHN~sz5tTjGbfWibSmmdHLL6wub1O7yPSzpo^#=L6VGqCT z8^X{jxKBC$89rm~FL18;8TG)pSPmD2ytO|Tvf7OH%-r;_-*cvoV~tNJ*qqnj9&GwL zL)ej-xt^&%OP@%sm+6y@LsK`WBDJZdRSPdkp_Qn=&#{rOQKll5l`vS28!rfc$7xEG z%aIjyB~^>&U<)urK)62I2#Q9TU_K0Dwp=;QIKvFCN0cp-XQ<+>BPTtlMk0;)+i#+D z)u}~w3ooY@Cs3@QdiVJmn1--`8h4>G{n8YA%u}@ig5XE|a~i9O7ty}vy6(!y8&463 zOX_@F-^%C1pbT(;7^0Dz;Fe_Fe5&0(3b>}LqCEM9X@eC`I``zZrqR>cUqi5PIWIh7 ztoq{zs%TQ09=Asg@3e=sxwAOP7wLJeLqK@+o@QQkioQ-i~1TJ;a2G|@8Q zu+sD^+_%3V?~#M|GZjjHofKz+ghg=6ak*X9wfp{}fv;pOO_>F3>l(xKXTLqp;q#MD z9~%R20l8nVq$iqldcvHe_FHBc0l}~utIig2wUy1k>zr9+^wLUyXVWN0H`88a>K89N`+>hdAvL{om!MXa& zbGbyhNH_44Wr1!TdoHgaYUCqnPUpi@&hf;-?chjc=n7iR(b;N&N^;x(%T96^)M z&d<@lFgAFqdMa?b_T@T{43g*laWQE&X(%ta|2Oo1sqp(K?ZG>%;6sw*fQ$ zU(4bWSbc%>(En(3Othjzuc zW|oFB!=1jCmiMM_D5k5EvK<;~Spi||XPTIOZEkOyp3A*drYsZ!UDm=)IJdkC_O3i8zdMq{PvmY-B=~6S>K(w;vAc0z-G`WztE3=1rbV z(PrtRM9sCuoi8sISE^4F@0i;hQoM6JfOMj1d2rO#e>Bl>hJMEN@ACJC7h9)6Xwkc> zJtrTU{VGu!OYb^a5u);B-wqEC&;%1*_-#kRK5fd7ti$x^X(!9!#;Hri1+9Tc4bnshCD44K&F#^}mPlQ@H63q-c z^^@`uK8?V(3HcT0J%;VT)`YMxU65~>-S1b5qFi*GNW)iBC!pZQ_`f@uDRk}F-8w_v_Q zxKy3f^1<&&E8_8^hrHif zM^ndqtU;%$+3X%<%9;~wwV?$fX#D_yYWn-y&c@i~zFFWc%R@{Z#4LQY7`}_3(K{UV z@_2c3^Q|~g&Udt5C@dm~fsxH)f7>3!8WWk?8eSewaRULHnJ9Q!F4egFbLhN(%6lP~ z8#W?@cKsQQo;9(P9qwnnsYSd6zz^o9t+|=;BUfH$3KDj|j}>w?14J94|0T*Fc6j{;lUIB@%)&u`MF%h+J%;ZUe6{^%02NdPVuk`3_O4 zra2WumRBp>NWsm{iT`|7ihJf4D;zHDxbIFCJI-+Kkw}3Mr_4MrNF+@zd z`-s9TL?Q?v`(cNCZ2ZNce?9>GN5r%2RQZ#LjVw?~2tK2(DLxYpZL8qSpMB%VRRwSv z3TioVX$K;+XAnJlcK216cpWI`(z$Y-s$BC;%57Ut{P6Rx*_^wOdl=ER1VgQj0`pmi z85tJ>#8f4Y#O_?bK}Bd%Koz=mb)nioo`&o1w_?$W@TLCupO1-Br!4jBe>7;=MR|Yg nzgqVHeMJB7YuBS Roles | Rights | \r\n|:--|:--|\r\n|Security Reader | View Workbooks, Analytics, Hunting, Security Recommendations |\r\n|Security Contributor| Deploy/Modify Workbooks, Analytics, Hunting Queries, Apply Security Recommendations |\r\n|Automation Contributor| Deploy/Modify Playbooks & Automation Rules |\r\n\r\n### Onboarding Prerequisites \r\n1️⃣ [Access Microsoft 365 Compliance Manager: Assessments](https://compliance.microsoft.com/compliancemanager?viewid=Assessments)
\r\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\r\n3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\r\n4️⃣ [Continuously Export Security Center Data to Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/continuous-export)
\r\n5️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\r\n6️⃣ [Configure Auto Provisioning of Microsoft Defender for Cloud Agents](https://docs.microsoft.com/azure/defender-for-cloud/enable-data-collection)
\r\n7️⃣ [Review Microsoft Service Trust Portal Documentation/Audit/Resources](https://servicetrust.microsoft.com/)
\r\n\r\n### Recommended Enrichments\r\n✳️[Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n✳️[Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n✳️[Azure Firewall Premium](https://azure.microsoft.com/services/azure-firewall)
\r\n✳️[Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n✳️[Azure Virtual Desktop](https://azure.microsoft.com/services/virtual-desktop/)
\r\n✳️[Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)
\r\n✳️[Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n✳️[Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender)
\r\n✳️[Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)
\r\n✳️[Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n✳️[Azure DDoS Protection](https://azure.microsoft.com/services/ddos-protection/)
\r\n✳️[Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender)
\r\n\r\n### Important\r\nThis solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. Each control is associated with one or more 💡[Azure Policy](https://docs.microsoft.com/azure/governance/policy/overview) definitions. These policies may help you 💡[assess compliance](https://docs.microsoft.com/azure/governance/policy/how-to/get-compliance-data) with the control; however, there often is not a one-to-one or complete match between a control and one or more policies. As such, Compliant in Azure Policy refers only to the policy definitions themselves; this doesn't ensure you're fully compliant with all requirements of a control. In addition, the compliance standard includes controls that aren't addressed by any Azure Policy definitions at this time. Therefore, compliance in Azure Policy is only a partial view of your overall compliance status. The associations between compliance domains, controls, and Azure Policy definitions for this compliance standard may change over time. ", + "style": "info" + }, + "name": "Help" + }, + { + "type": 1, + "content": { + "json": "# ✳️ [Microsoft Zero Trust Deployment Center](https://docs.microsoft.com/security/zero-trust)\r\n![Image Name](https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4KvMM?ver=13f6&q=0&m=6&h=600&w=1600&b=%23FFFFFFFF&u=t&l=f&f=jpg&o=t&aim=true \"Security Policy Enforcement\")\r\n\r\n" + }, + "customWidth": "40", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "Zero Trust Model" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "10", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "text - 109" + }, + { + "type": 1, + "content": { + "json": "# ✳️ [Trusted Internet Connections 3.0](https://www.cisa.gov/trusted-internet-connections)\r\n\r\n| Security Objectives |\r\n| : | : | \r\n| Manage Traffic | Observe, validate, and filter data connections to align with authorized activities; least privilege and default deny |\r\n| Protect Traffic Confidentiality | Ensure only authorized parties can discern the contents of data in transit; sender and receiver identification and enforcement |\r\n| Protect Traffic Integrity | Prevent alteration of data in transit; detect altered data in transit |\r\n| Ensure Service Resiliency | Promote resilient application and security services for continuous operation as the technology and threat landscape evolve |\r\n| Ensure Effective Response | Promote timely reaction and adapt future response to discovered threats; policies defined and implemented; simplified adoption of new countermeasures |\r\n\r\n" + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "Trusted Internet Connections 3.0" + } + ], + "exportParameters": true + }, + "conditionalVisibility": { + "parameterName": "Help", + "comparison": "isEqualTo", + "value": "Yes" + }, + "name": "Help Group" + }, { "type": 1, "content": { @@ -131,7 +188,7 @@ { "type": 1, "content": { - "json": "# Zero Trust (TIC3.0) Solution\n---\nThis workbook enables Security Governance Risk Compliance Professionals, SecOps Analysts, and MSSPs to gain situational awareness for cloud workload security posture. This workbook is designed to augment staffing through automation, artificial intelligence, machine learning, query+alerting generation and visualizations. For more information, see the 💡[Microsoft Zero Trust Model](https://www.microsoft.com/security/business/zero-trust), 💡[Trusted Internet Connections: Core Guidance Documents](https://www.cisa.gov/trusted-internet-connections). The Microsoft Sentinel Zero Trust (TIC 3.0) Workbook demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All TIC requirements, validations, and controls are governed by the 💡 [Cybersecurity & Infrastructure Security Agency](https://www.cisa.gov/trusted-internet-connections). This workbook provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. " + "json": "# Zero Trust (TIC 3.0) Solution\n---\nThe Microsoft Sentinel Zero Trust (TIC 3.0) Solution provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft and partner ecosystem. This solution enables governance and compliance teams to design, build, monitor, and respond to Zero Trust (TIC 3.0) requirements across 25+ Microsoft and 3rd party products. The solution includes the new Zero Trust (TIC 3.0) Workbook, (1) Analytics Rule, and (3) Playbooks. While only Microsoft Sentinel and Microsoft Defender for Cloud are required to get started, the solution is enhanced with numerous Microsoft offerings. This Solution enables Security Architects, Engineers, SecOps Analysts, Managers, and IT Pros to gain situational awareness visibility for the security posture of cloud, multi-cloud, hybrid, and on-premise workloads. For more information, see 💡[Microsoft Zero Trust Model](https://www.microsoft.com/security/business/zero-trust) 💡[Trusted Internet Connections: Core Guidance Documents](https://www.cisa.gov/trusted-internet-connections)" }, "customWidth": "79", "name": "Workbook Overview" @@ -148,9 +205,8 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Section\\\": \\\"Assessment\\\", \\\"tab\\\": \\\"Assessment\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Universal Security Capabilities\\\", \\\"tab\\\": \\\"Universal Security Capabilities\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Files\\\", \\\"tab\\\": \\\"Files\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Email\\\", \\\"tab\\\": \\\"Email\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Web\\\", \\\"tab\\\": \\\"Web\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Networking\\\", \\\"tab\\\": \\\"Networking\\\" }\\r\\n]\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control Family\\\": \\\"Posture Assessment\\\", \\\"tab\\\": \\\"Assessment\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Universal Security Capabilities\\\", \\\"tab\\\": \\\"Universal Security Capabilities\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Files\\\", \\\"tab\\\": \\\"Files\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Email\\\", \\\"tab\\\": \\\"Email\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Web\\\", \\\"tab\\\": \\\"Web\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Networking\\\", \\\"tab\\\": \\\"Networking\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, - "title": "TIC 3.0 Capabilities", "exportMultipleValues": true, "exportedParameters": [ { @@ -166,11 +222,10 @@ "columnMatch": "tab", "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "37", + "customWidth": "40", "name": "query - 107", "styleSettings": { "showBorder": true @@ -366,14 +421,14 @@ "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, - "customWidth": "5", + "customWidth": "10", "name": "isVisible Navigation" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Section\\\": \\\"Resiliency\\\", \\\"tab\\\": \\\"Resiliency\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"DNS\\\", \\\"tab\\\": \\\"DNS\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Intrusion Detection\\\", \\\"tab\\\": \\\"Intrusion Detection\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Enterprise\\\", \\\"tab\\\": \\\"Enterprise\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Unified Communications & Collaboration\\\", \\\"tab\\\": \\\"Unified Communications & Collaboration\\\" },\\r\\n\\t{ \\\"Section\\\": \\\"Data Protection\\\", \\\"tab\\\": \\\"Data Protection\\\" }\\r\\n]\",\"transformers\":null}", + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control Family\\\": \\\"Resiliency\\\", \\\"tab\\\": \\\"Resiliency\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"DNS\\\", \\\"tab\\\": \\\"DNS\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Intrusion Detection\\\", \\\"tab\\\": \\\"Intrusion Detection\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Enterprise\\\", \\\"tab\\\": \\\"Enterprise\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Unified Communications & Collaboration\\\", \\\"tab\\\": \\\"Unified Communications & Collaboration\\\" },\\r\\n\\t{ \\\"Control Family\\\": \\\"Data Protection\\\", \\\"tab\\\": \\\"Data Protection\\\" }\\r\\n]\",\"transformers\":null}", "size": 3, "exportMultipleValues": true, "exportedParameters": [ @@ -390,11 +445,10 @@ "columnMatch": "tab", "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "37", + "customWidth": "40", "name": "query - 109", "styleSettings": { "showBorder": true @@ -590,74 +644,35 @@ "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, - "customWidth": "5", + "customWidth": "10", "name": "isVisible Navigation - Copy" }, - { - "type": 1, - "content": { - "json": "# ✳️ [Getting Started](https://docs.microsoft.com/azure/sentinel/prerequisites)\r\n---\r\n\r\nThis workbook enables Security Governance Risk Compliance Professionals, SecOps Analysts, and MSSPs to gain situational awareness for cloud workload security posture. This workbook is designed to augment staffing through automation, artificial intelligence, machine learning, query+alerting generation and visualizations. Recommended onboarding steps are included below, note user experience will vary by workload.
\r\n
\r\n1️⃣ [Confirm Roles & Permissions: Microsoft Sentinel Contributor for Create & Edit / Microsoft Sentinel Responder for Viewing Workbook](https://docs.microsoft.com/azure/sentinel/roles#:~:text=Azure%20Sentinel-specific%20roles%201%20Azure%20Sentinel%20Reader%20can,and%20other%20Azure%20Sentinel%20resources.%20More%20items...%20)
\r\n2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
\r\n3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
\r\n4️⃣ [Add the Azure Security Benchmark and NIST SP 800-53 R5 Assessments to Your Dashboard](https://docs.microsoft.com/azure/security-center/update-regulatory-compliance-packages#add-a-regulatory-standard-to-your-dashboard)
\r\n5️⃣ [Continuously Export Security Center Data](https://docs.microsoft.com/azure/security-center/continuous-export)
\r\n6️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
\r\n7️⃣ [Deploy Microsoft Sentinel: Zero Trust (TIC3.0) Solution & Review Monitoring Analytics Rules](https://portal.azure.com/#blade/Microsoft_Azure_Marketplace/GalleryItemDetailsBladeNopdl/id/azuresentinel.azure-sentinel-solution-zerotrust)
\r\n\r\n\r\n\r\n" - }, - "conditionalVisibility": { - "parameterName": "Help", - "comparison": "isEqualTo", - "value": "Yes" - }, - "customWidth": "50", - "name": "text - 106" - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Recommended Enrichments](https://docs.microsoft.com/azure/sentinel/connect-data-sources)\r\n---\r\nThis workbook leverages 50+ Microsoft Security products. While only Microsoft Sentinel and Microsoft Defender for Cloud are mandatory for this solution, the following offerings provide enrichments
\r\n\r\n✳️[Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n✳️[Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n✳️[Azure Firewall Premium](https://azure.microsoft.com/services/azure-firewall)
\r\n✳️[Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n✳️[Azure Virtual Desktop](https://azure.microsoft.com/services/virtual-desktop/)
\r\n✳️[Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)
\r\n✳️[Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n✳️[Azure Defender](https://azure.microsoft.com/services/azure-defender/)
\r\n✳️[Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender)
\r\n✳️[Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)
\r\n✳️[Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n✳️[Azure DDoS Protection](https://azure.microsoft.com/services/ddos-protection/)
\r\n✳️[Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender)
\r\n\r\n\r\n\r\n" - }, - "conditionalVisibility": { - "parameterName": "Help", - "comparison": "isEqualTo", - "value": "Yes" - }, - "customWidth": "50", - "name": "text - 107" - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Microsoft Zero Trust Deployment Center](https://docs.microsoft.com/security/zero-trust)\r\n![Image Name](https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4KvMM?ver=13f6&q=0&m=6&h=600&w=1600&b=%23FFFFFFFF&u=t&l=f&f=jpg&o=t&aim=true \"Security Policy Enforcement\")\r\n\r\n" - }, - "conditionalVisibility": { - "parameterName": "Help", - "comparison": "isEqualTo", - "value": "Yes" - }, - "customWidth": "50", - "name": "Zero Trust Model" - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Trusted Internet Connections 3.0](https://www.cisa.gov/trusted-internet-connections)\r\n\r\n| Security Objectives |\r\n| : | : | \r\n| Manage Traffic | Observe, validate, and filter data connections to align with authorized activities; least privilege and default deny |\r\n| Protect Traffic Confidentiality | Ensure only authorized parties can discern the contents of data in transit; sender and receiver identification and enforcement |\r\n| Protect Traffic Integrity | Prevent alteration of data in transit; detect altered data in transit |\r\n| Ensure Service Resiliency | Promote resilient application and security services for continuous operation as the technology and threat landscape evolve |\r\n| Ensure Effective Response | Promote timely reaction and adapt future response to discovered threats; policies defined and implemented; simplified adoption of new countermeasures |\r\n\r\n" - }, - "conditionalVisibility": { - "parameterName": "Help", - "comparison": "isEqualTo", - "value": "Yes" - }, - "customWidth": "50", - "name": "Trusted Internet Connections 3.0" - }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ + { + "type": 1, + "content": { + "json": "# Assessment\r\n---\r\nThe Assessment section provides a mechanism to find, fix, and resolve Zero Trust (TIC 3.0) recommendations. A selector provides capability to filter by all, specific, or groups of TIC 3.0 control families. Upon selection, subordinate panels will summarize recommendations by control family, status over time, recommendations, and resources identified. These panels are helpful for identifying the controls of interest, status over time, and impacted resources. The recommendation details pane provides a mechanism to identify specific recommendation details with deep-links to pivot to Microsoft Defender for Cloud for remedation. For more information, see 💡[Microsoft Defender for Cloud: Security Recommendations](https://docs.microsoft.com/azure/defender-for-cloud/review-security-recommendations)" + }, + "customWidth": "40", + "name": "text - 5" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "10", + "name": "text - 7" + }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", - "crossComponentResources": [ - "{Workspace}" - ], "parameters": [ { "id": "99a47f97-1aa4-4840-91ee-119aad6d6217", @@ -669,10 +684,6 @@ "multiSelect": true, "quote": "'", "delimiter": ",", - "query": "let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=True);\r\n SecurityRecommendation\r\n | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName\r\n| summarize count() by Family\r\n| sort by count_ desc\r\n| project Family\r\n", - "crossComponentResources": [ - "{Workspace}" - ], "value": [ "value::all" ], @@ -682,32 +693,32 @@ ], "showDefault": false }, + "jsonData": "[\r\n {\"value\": \"Universal Security Capabilities\", \"label\": \"Universal Security Capabilities\"},\r\n {\"value\": \"Files\", \"label\": \"Files\"},\r\n {\"value\": \"Email\", \"label\": \"Email\"},\r\n {\"value\": \"Web\", \"label\": \"Web\"},\r\n {\"value\": \"Networking\", \"label\": \"Networking\"},\r\n {\"value\": \"Resiliency\", \"label\": \"Resiliency\"},\r\n {\"value\": \"DNS\", \"label\": \"DNS\"},\r\n {\"value\": \"Intrusion Detection\", \"label\": \"Intrusion Detection\"},\r\n {\"value\": \"Enterprise\", \"label\": \"Enterprise\"},\r\n {\"value\": \"Unified Communications & Collaboration\", \"label\": \"Unified Communications & Collaboration\"},\r\n {\"value\": \"Data Protection\", \"label\": \"Data Protection\"}\r\n]", "timeContext": { - "durationMs": 0 + "durationMs": 7776000000 }, "timeContextFromParameter": "TimeRange", - "defaultValue": "value::all", - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces" + "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, + "customWidth": "40", "name": "parameters - 26" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=True);\r\n SecurityRecommendation\r\n | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName\r\n| where RecommendationName <> \"\"\r\n| where RecommendationState <> \"Healthy\"\r\n| where Family in ({ControlFamily})\r\n| summarize count() by Family\r\n| sort by count_ desc\r\n| limit 250", + "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend ControlFamily=iff(RecommendationDisplayName has_any(\"email\"), \"Email\",\r\niff(RecommendationDisplayName has_any(\"apps\", \"teams\", \"meeting\", \"call\"), \"Unified Communications & Collaboration\",\r\niff(RecommendationDisplayName has_any(\"dns\", \"domain\"), \"DNS\",\r\niff(RecommendationDisplayName has_any(\"endpoint protection\", \"malware\", \"file\", \"files\",\"IaaSAntimalware\"), \"Files\",\r\niff(RecommendationDisplayName has_any(\"Security Center\",\"defender\", \"adaptive\", \"HoneyTokens\", \"honey\", \"deception\", \"intrusion\", \"incident\", \"incidents\"), \"Intrusion Detection\",\r\niff(RecommendationDisplayName has_any(\"firewall\", \"watcher\", \"proxy\", \"certificate\", \"url\", \"web\"), \"Web\",\r\niff(RecommendationDisplayName has_any(\"network\", \"segment\", \"network security groups\", \"subnet\", \"application gateway\", \"security groups\", \"IP forwarding\", \"port\", \"ports\", \"networks\"), \"Networking\",\r\niff(RecommendationDisplayName has_any(\"backup\",\"denial\", \"DDoS\", \"load\", \"scale\", \"front\", \"traffic manager\", \"pool\", \"disaster\", \"region\", \"redundant\", \"geo\"), \"Resiliency\",\r\niff(RecommendationDisplayName has_any(\"encrypt\", \"rest\", \"transit\", \"data\", \"http\", \"https\", \"TLS\", \"transfer\", \"transit\", \"Secure Socket\", \"SSH\", \"just\", \"FTP\", \"server-side\", \"storage\", \"database\", \"databases\", \"SQL\", \"disk\", \"disks\"), \"Data Protection\",\r\niff(RecommendationDisplayName has_any(\"private\", \"vpn\", \"automation\", \"playbook\", \"logic\", \"notification\", \"authorized\", \"safe\", \"network gateway\", \"express\", \"VPC\"), \"Enterprise\",\r\niff(RecommendationDisplayName has_any(\"recover\", \"log\", \"configured\", \"configuration\", \"identity\", \"privilege\", \"admin\", \"authentication\", \"JIT\", \"just\", \"password\", \"time\", \"sync\", \"vulnerability\", \"Vulnerabilities\", \"updates\", \"update\", \"upgrade\", \"audit\", \"account\", \"guest\", \"shared\", \"access\", \"machines\", \"rights\", \"VM\", \"key\", \"keys\", \"IAM\", \"EC2\", \"GuardDuty\", \"logs\", \"CloudTrail\", \"MFA\", \"External accounts\", \"accounts\", \"config\", \"credentials\", \"privileged\", \"owner\", \"owners\", \"login\", \"logon\", \"virtual machine\", \"container\", \"containers\", \"Kubernetes\"), \"Universal Security Capabilities\", \"Other\")))))))))))\r\n| where ControlFamily in ({ControlFamily})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by ControlFamily\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| project ControlFamily, Total, PassedControls, Passed, Failed\r\n| sort by Total, Passed desc", "size": 0, "showAnalytics": true, "title": "Recommendations by Control Family", - "noDataMessage": "No Current Zero Trust(TIC3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", "timeContext": { - "durationMs": 2592000000 + "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "showExportToExcel": true, @@ -718,6 +729,52 @@ ], "gridSettings": { "formatters": [ + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, { "columnMatch": "ControlFamily", "formatter": 18, @@ -727,7 +784,7 @@ { "operator": "Default", "thresholdValue": null, - "representation": "pending", + "representation": "Persistence", "text": "{0}{1}" } ] @@ -756,11 +813,23 @@ } } ], - "filter": true - } + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_compositeBar_Total_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_compositeBar_Total_1", + "sortOrder": 2 + } + ] }, "customWidth": "50", - "name": "query - 3 - Copy", + "name": "query - 9", "styleSettings": { "maxWidth": "50" } @@ -769,13 +838,13 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=True);\r\n SecurityRecommendation\r\n | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName\r\n| where RecommendationName <> \"\"\r\n| where RecommendationState <> \"Healthy\"\r\n| where Family in ({ControlFamily})\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Family\r\n| render timechart", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationDisplayName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend ControlFamily=iff(RecommendationDisplayName has_any(\"email\"), \"Email\",\r\niff(RecommendationDisplayName has_any(\"apps\", \"teams\", \"meeting\", \"call\"), \"Unified Communications & Collaboration\",\r\niff(RecommendationDisplayName has_any(\"dns\", \"domain\"), \"DNS\",\r\niff(RecommendationDisplayName has_any(\"endpoint protection\", \"malware\", \"file\", \"files\",\"IaaSAntimalware\"), \"Files\",\r\niff(RecommendationDisplayName has_any(\"Security Center\",\"defender\", \"adaptive\", \"HoneyTokens\", \"honey\", \"deception\", \"intrusion\", \"incident\", \"incidents\"), \"Intrusion Detection\",\r\niff(RecommendationDisplayName has_any(\"firewall\", \"watcher\", \"proxy\", \"certificate\", \"url\", \"web\"), \"Web\",\r\niff(RecommendationDisplayName has_any(\"network\", \"segment\", \"network security groups\", \"subnet\", \"application gateway\", \"security groups\", \"IP forwarding\", \"port\", \"ports\", \"networks\"), \"Networking\",\r\niff(RecommendationDisplayName has_any(\"backup\",\"denial\", \"DDoS\", \"load\", \"scale\", \"front\", \"traffic manager\", \"pool\", \"disaster\", \"region\", \"redundant\", \"geo\"), \"Resiliency\",\r\niff(RecommendationDisplayName has_any(\"encrypt\", \"rest\", \"transit\", \"data\", \"http\", \"https\", \"TLS\", \"transfer\", \"transit\", \"Secure Socket\", \"SSH\", \"just\", \"FTP\", \"server-side\", \"storage\", \"database\", \"databases\", \"SQL\", \"disk\", \"disks\"), \"Data Protection\",\r\niff(RecommendationDisplayName has_any(\"private\", \"vpn\", \"automation\", \"playbook\", \"logic\", \"notification\", \"authorized\", \"safe\", \"network gateway\", \"express\", \"VPC\"), \"Enterprise\",\r\niff(RecommendationDisplayName has_any(\"recover\", \"log\", \"configured\", \"configuration\", \"identity\", \"privilege\", \"admin\", \"authentication\", \"JIT\", \"just\", \"password\", \"time\", \"sync\", \"vulnerability\", \"Vulnerabilities\", \"updates\", \"update\", \"upgrade\", \"audit\", \"account\", \"guest\", \"shared\", \"access\", \"machines\", \"rights\", \"VM\", \"key\", \"keys\", \"IAM\", \"EC2\", \"GuardDuty\", \"logs\", \"CloudTrail\", \"MFA\", \"External accounts\", \"accounts\", \"config\", \"credentials\", \"privileged\", \"owner\", \"owners\", \"login\", \"logon\", \"virtual machine\", \"container\", \"containers\", \"Kubernetes\"), \"Universal Security Capabilities\", \"Other\")))))))))))\r\n| where ControlFamily in ({ControlFamily})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationDisplayName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationDisplayName\r\n| project RecommendationDisplayName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500", "size": 0, "showAnalytics": true, - "title": "Recommendations over Time", - "noDataMessage": "No Current Zero Trust(TIC3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", + "title": "Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", "timeContext": { - "durationMs": 2592000000 + "durationMs": 604800000 }, "timeContextFromParameter": "TimeRange", "showExportToExcel": true, @@ -787,7 +856,91 @@ "gridSettings": { "formatters": [ { - "columnMatch": "ControlNumber", + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", @@ -805,15 +958,28 @@ "columnMatch": "count_", "formatter": 4, "formatOptions": { - "palette": "greenRed" + "palette": "coldHot" } } ], - "filter": true - } + "rowLimit": 2500, + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_compositeBar_Total_1", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_compositeBar_Total_1", + "sortOrder": 2 + } + ] }, "customWidth": "50", - "name": "query - 3", + "name": "query - 9", "styleSettings": { "maxWidth": "50" } @@ -822,11 +988,15 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=True);\r\n SecurityRecommendation\r\n | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName\r\n| where RecommendationName <> \"\"\r\n| where RecommendationState <> \"Healthy\"\r\n| where Family in ({ControlFamily})\r\n| summarize count() by RecommendationDisplayName\r\n| sort by count_ desc", + "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend ControlFamily=iff(RecommendationDisplayName has_any(\"email\"), \"Email\",\r\niff(RecommendationDisplayName has_any(\"apps\", \"teams\", \"meeting\", \"call\"), \"Unified Communications & Collaboration\",\r\niff(RecommendationDisplayName has_any(\"dns\", \"domain\"), \"DNS\",\r\niff(RecommendationDisplayName has_any(\"endpoint protection\", \"malware\", \"file\", \"files\",\"IaaSAntimalware\"), \"Files\",\r\niff(RecommendationDisplayName has_any(\"Security Center\",\"defender\", \"adaptive\", \"HoneyTokens\", \"honey\", \"deception\", \"intrusion\", \"incident\", \"incidents\"), \"Intrusion Detection\",\r\niff(RecommendationDisplayName has_any(\"firewall\", \"watcher\", \"proxy\", \"certificate\", \"url\", \"web\"), \"Web\",\r\niff(RecommendationDisplayName has_any(\"network\", \"segment\", \"network security groups\", \"subnet\", \"application gateway\", \"security groups\", \"IP forwarding\", \"port\", \"ports\", \"networks\"), \"Networking\",\r\niff(RecommendationDisplayName has_any(\"backup\",\"denial\", \"DDoS\", \"load\", \"scale\", \"front\", \"traffic manager\", \"pool\", \"disaster\", \"region\", \"redundant\", \"geo\"), \"Resiliency\",\r\niff(RecommendationDisplayName has_any(\"encrypt\", \"rest\", \"transit\", \"data\", \"http\", \"https\", \"TLS\", \"transfer\", \"transit\", \"Secure Socket\", \"SSH\", \"just\", \"FTP\", \"server-side\", \"storage\", \"database\", \"databases\", \"SQL\", \"disk\", \"disks\"), \"Data Protection\",\r\niff(RecommendationDisplayName has_any(\"private\", \"vpn\", \"automation\", \"playbook\", \"logic\", \"notification\", \"authorized\", \"safe\", \"network gateway\", \"express\", \"VPC\"), \"Enterprise\",\r\niff(RecommendationDisplayName has_any(\"recover\", \"log\", \"configured\", \"configuration\", \"identity\", \"privilege\", \"admin\", \"authentication\", \"JIT\", \"just\", \"password\", \"time\", \"sync\", \"vulnerability\", \"Vulnerabilities\", \"updates\", \"update\", \"upgrade\", \"audit\", \"account\", \"guest\", \"shared\", \"access\", \"machines\", \"rights\", \"VM\", \"key\", \"keys\", \"IAM\", \"EC2\", \"GuardDuty\", \"logs\", \"CloudTrail\", \"MFA\", \"External accounts\", \"accounts\", \"config\", \"credentials\", \"privileged\", \"owner\", \"owners\", \"login\", \"logon\", \"virtual machine\", \"container\", \"containers\", \"Kubernetes\"), \"Universal Security Capabilities\", \"Other\")))))))))))\r\n| where ControlFamily in ({ControlFamily})\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by AssessedResourceId\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| project AssessedResourceId, Total, PassedControls, Passed, Failed\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500", "size": 0, "showAnalytics": true, - "title": "Recommendations", - "noDataMessage": "No Current Zero Trust(TIC3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", + "title": "Recommendations by Asset", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", @@ -836,7 +1006,46 @@ "gridSettings": { "formatters": [ { - "columnMatch": "Recommendation", + "columnMatch": "AssessedResourceId", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationName", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", @@ -851,14 +1060,7 @@ } }, { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "coldHot" - } - }, - { - "columnMatch": "RecommendationDisplayName", + "columnMatch": "Family", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", @@ -866,99 +1068,111 @@ { "operator": "Default", "thresholdValue": null, - "representation": "warning", + "representation": "Persistence", "text": "{0}{1}" } ] } }, { - "columnMatch": "Severity", + "columnMatch": "ControlFamily", "formatter": 18, "formatOptions": { - "thresholdsOptions": "colors", + "thresholdsOptions": "icons", "thresholdsGrid": [ { - "operator": "==", - "thresholdValue": "High", - "representation": "redBright", + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Medium", - "representation": "orange", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Low", - "representation": "yellow", - "text": "{0}{1}" - }, + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "rowLimit": 2500, + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend ControlFamily=iff(RecommendationDisplayName has_any(\"email\"), \"Email\",\r\niff(RecommendationDisplayName has_any(\"apps\", \"teams\", \"meeting\", \"call\"), \"Unified Communications & Collaboration\",\r\niff(RecommendationDisplayName has_any(\"dns\", \"domain\"), \"DNS\",\r\niff(RecommendationDisplayName has_any(\"endpoint protection\", \"malware\", \"file\", \"files\",\"IaaSAntimalware\"), \"Files\",\r\niff(RecommendationDisplayName has_any(\"Security Center\",\"defender\", \"adaptive\", \"HoneyTokens\", \"honey\", \"deception\", \"intrusion\", \"incident\", \"incidents\"), \"Intrusion Detection\",\r\niff(RecommendationDisplayName has_any(\"firewall\", \"watcher\", \"proxy\", \"certificate\", \"url\", \"web\"), \"Web\",\r\niff(RecommendationDisplayName has_any(\"network\", \"segment\", \"network security groups\", \"subnet\", \"application gateway\", \"security groups\", \"IP forwarding\", \"port\", \"ports\", \"networks\"), \"Networking\",\r\niff(RecommendationDisplayName has_any(\"backup\",\"denial\", \"DDoS\", \"load\", \"scale\", \"front\", \"traffic manager\", \"pool\", \"disaster\", \"region\", \"redundant\", \"geo\"), \"Resiliency\",\r\niff(RecommendationDisplayName has_any(\"encrypt\", \"rest\", \"transit\", \"data\", \"http\", \"https\", \"TLS\", \"transfer\", \"transit\", \"Secure Socket\", \"SSH\", \"just\", \"FTP\", \"server-side\", \"storage\", \"database\", \"databases\", \"SQL\", \"disk\", \"disks\"), \"Data Protection\",\r\niff(RecommendationDisplayName has_any(\"private\", \"vpn\", \"automation\", \"playbook\", \"logic\", \"notification\", \"authorized\", \"safe\", \"network gateway\", \"express\", \"VPC\"), \"Enterprise\",\r\niff(RecommendationDisplayName has_any(\"recover\", \"log\", \"configured\", \"configuration\", \"identity\", \"privilege\", \"admin\", \"authentication\", \"JIT\", \"just\", \"password\", \"time\", \"sync\", \"vulnerability\", \"Vulnerabilities\", \"updates\", \"update\", \"upgrade\", \"audit\", \"account\", \"guest\", \"shared\", \"access\", \"machines\", \"rights\", \"VM\", \"key\", \"keys\", \"IAM\", \"EC2\", \"GuardDuty\", \"logs\", \"CloudTrail\", \"MFA\", \"External accounts\", \"accounts\", \"config\", \"credentials\", \"privileged\", \"owner\", \"owners\", \"login\", \"logon\", \"virtual machine\", \"container\", \"containers\", \"Kubernetes\"), \"Universal Security Capabilities\", \"Other\")))))))))))\r\n| where ControlFamily in ({ControlFamily})\r\n| where RecommendationState == \"Unhealthy\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by ControlFamily\r\n| render timechart", + "size": 0, + "showAnalytics": true, + "title": "Recommendations over Time", + "noDataMessage": "No Current Zero Trust(TIC 3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ { "operator": "Default", "thresholdValue": null, - "representation": "blue", + "representation": "Persistence", "text": "{0}{1}" } ] } }, { - "columnMatch": "State", - "formatter": 1 - }, - { - "columnMatch": "ControlID", - "formatter": 1 - }, - { - "columnMatch": "statusChangeDate", - "formatter": 6 - }, - { - "columnMatch": "firstEvaluationDate", - "formatter": 6 + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "greenRed" + } } ], "filter": true - }, - "sortBy": [], - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "RecommendationName", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } } }, "customWidth": "50", - "name": "query - 4 - Copy" + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=True);\r\n SecurityRecommendation\r\n | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName\r\n| where RecommendationName <> \"\"\r\n| where RecommendationState <> \"Healthy\"\r\n| where Family in ({ControlFamily})\r\n| summarize count() by AssessedResourceId\r\n| sort by count_ desc", + "query": "SecurityRecommendation\r\n| where RecommendationDisplayName <> \"\"\r\n| extend ControlFamily=iff(RecommendationDisplayName has_any(\"email\"), \"Email\",\r\niff(RecommendationDisplayName has_any(\"apps\", \"teams\", \"meeting\", \"call\"), \"Unified Communications & Collaboration\",\r\niff(RecommendationDisplayName has_any(\"dns\", \"domain\"), \"DNS\",\r\niff(RecommendationDisplayName has_any(\"endpoint protection\", \"malware\", \"file\", \"files\",\"IaaSAntimalware\"), \"Files\",\r\niff(RecommendationDisplayName has_any(\"Security Center\",\"defender\", \"adaptive\", \"HoneyTokens\", \"honey\", \"deception\", \"intrusion\", \"incident\", \"incidents\"), \"Intrusion Detection\",\r\niff(RecommendationDisplayName has_any(\"firewall\", \"watcher\", \"proxy\", \"certificate\", \"url\", \"web\"), \"Web\",\r\niff(RecommendationDisplayName has_any(\"network\", \"segment\", \"network security groups\", \"subnet\", \"application gateway\", \"security groups\", \"IP forwarding\", \"port\", \"ports\", \"networks\"), \"Networking\",\r\niff(RecommendationDisplayName has_any(\"backup\",\"denial\", \"DDoS\", \"load\", \"scale\", \"front\", \"traffic manager\", \"pool\", \"disaster\", \"region\", \"redundant\", \"geo\"), \"Resiliency\",\r\niff(RecommendationDisplayName has_any(\"encrypt\", \"rest\", \"transit\", \"data\", \"http\", \"https\", \"TLS\", \"transfer\", \"transit\", \"Secure Socket\", \"SSH\", \"just\", \"FTP\", \"server-side\", \"storage\", \"database\", \"databases\", \"SQL\", \"disk\", \"disks\"), \"Data Protection\",\r\niff(RecommendationDisplayName has_any(\"private\", \"vpn\", \"automation\", \"playbook\", \"logic\", \"notification\", \"authorized\", \"safe\", \"network gateway\", \"express\", \"VPC\"), \"Enterprise\",\r\niff(RecommendationDisplayName has_any(\"recover\", \"log\", \"configured\", \"configuration\", \"identity\", \"privilege\", \"admin\", \"authentication\", \"JIT\", \"just\", \"password\", \"time\", \"sync\", \"vulnerability\", \"Vulnerabilities\", \"updates\", \"update\", \"upgrade\", \"audit\", \"account\", \"guest\", \"shared\", \"access\", \"machines\", \"rights\", \"VM\", \"key\", \"keys\", \"IAM\", \"EC2\", \"GuardDuty\", \"logs\", \"CloudTrail\", \"MFA\", \"External accounts\", \"accounts\", \"config\", \"credentials\", \"privileged\", \"owner\", \"owners\", \"login\", \"logon\", \"virtual machine\", \"container\", \"containers\", \"Kubernetes\"), \"Universal Security Capabilities\", \"Other\")))))))))))\r\n| where ControlFamily in ({ControlFamily})\r\n| where RecommendationState == \"Unhealthy\"\r\n| parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *\r\n| project ResourceID=AssessedResourceId, RecommendationName=RecommendationDisplayName, ControlFamily, Severity=RecommendationSeverity, CurrentState=RecommendationState, RecommendationLink, DiscoveredTimeUTC, assessmentKey\r\n| extend Rank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, 0)))\r\n| sort by Rank desc\r\n| limit 2500", "size": 0, "showAnalytics": true, - "title": "Assets with Recommendations", - "noDataMessage": "No Current Zero Trust(TIC3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", + "title": "Recommendation Details", + "noDataMessage": "No Current Zero Trust (TIC 3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", @@ -968,21 +1182,30 @@ "gridSettings": { "formatters": [ { - "columnMatch": "ResourceType", - "formatter": 16, + "columnMatch": "ResourceID", + "formatter": 13, "formatOptions": { + "linkTarget": "Resource", "showIcon": true } }, { - "columnMatch": "count_", - "formatter": 4, + "columnMatch": "RecommendationName", + "formatter": 18, "formatOptions": { - "palette": "redBright" + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] } }, { - "columnMatch": "RecommendationDisplayName", + "columnMatch": "ControlFamily", "formatter": 18, "formatOptions": { "thresholdsOptions": "icons", @@ -990,7 +1213,7 @@ { "operator": "Default", "thresholdValue": null, - "representation": "warning", + "representation": "Persistence", "text": "{0}{1}" } ] @@ -1000,131 +1223,62 @@ "columnMatch": "Severity", "formatter": 18, "formatOptions": { - "thresholdsOptions": "colors", + "thresholdsOptions": "icons", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "High", - "representation": "redBright", + "representation": "Sev0", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Medium", - "representation": "orange", + "representation": "Sev1", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "Low", - "representation": "yellow", + "representation": "Sev2", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, - "representation": "blue", + "representation": "Sev3", "text": "{0}{1}" } ] } }, { - "columnMatch": "State", - "formatter": 1 - }, - { - "columnMatch": "ControlID", - "formatter": 1 - }, - { - "columnMatch": "Recommendation", + "columnMatch": "RecommendationLink", "formatter": 7, "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >" + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "linkIsContextBlade": false, + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } } }, { - "columnMatch": "statusChangeDate", - "formatter": 6 - }, - { - "columnMatch": "firstEvaluationDate", - "formatter": 6 - } - ], - "filter": true - }, - "sortBy": [], - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "RecommendationName", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "name": "query - 6" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let ZeroTrustTIC3Mapping = externaldata(RecommendationDisplayName:string,Capability:string,Family:string) [@\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/ZeroTrustTIC3Mapping.csv\"] with (format=\"csv\", ignoreFirstRecord=True);\r\n SecurityRecommendation\r\n | join kind=rightouter ZeroTrustTIC3Mapping on RecommendationDisplayName\r\n| where RecommendationName <> \"\"\r\n| where RecommendationState <> \"Healthy\"\r\n| where RecommendationState <> \"NotApplicable\"\r\n| where RecommendationState <> \"Removed\"\r\n| where Family in ({ControlFamily})\r\n| extend Recommendation = strcat(\"https://\",RecommendationLink)\r\n| project AssessedResourceId, Family, Capability, RecommendationDisplayName, Recommendation, RecommendationSeverity, RecommendationState, DiscoveredTimeUTC\r\n| sort by DiscoveredTimeUTC desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Zero Trust (TIC3.0) Recommendation Details", - "noDataMessage": "No Current Zero Trust(TIC3.0) Recommendations in this Area. Confirm the CMMC Level 3 Assessment is Enabled in Microsoft Defender for Cloud: Regulatory Compliance Blade.", - "timeContext": { - "durationMs": 0 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecommendationDisplayName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } + "columnMatch": "assessmentKey", + "formatter": 5 }, { - "columnMatch": "Recommendation", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go To Recommendation >" - } + "columnMatch": "Rank", + "formatter": 5 }, { "columnMatch": "RecommendationSeverity", @@ -1132,12 +1286,6 @@ "formatOptions": { "thresholdsOptions": "icons", "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "Informational", - "representation": "Sev3", - "text": "{0}{1}" - }, { "operator": "==", "thresholdValue": "High", @@ -1166,8 +1314,10 @@ } } ], + "rowLimit": 2500, "filter": true - } + }, + "sortBy": [] }, "name": "query - 6" } @@ -1180,168 +1330,6 @@ }, "name": "group - 1" }, - { - "type": 1, - "content": { - "json": "# ✳️ [Universal Security Capabilities](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\n---\r\nUniversal capabilities are enterprise-level capabilities that outline guiding principles for TIC use cases. Universal capabilities are selected to be broadly applicable; the same list of capabilities apply to every use case. However, certain use cases may provide unique guidance on specific capabilities where necessary. Agencies have significant discretion regarding how to meet the individual security capability requirements and address their particular needs. Agencies are free to determine the level of rigor necessary for applying universal capabilities based on federal guidelines and risk tolerance. While it is expected that agencies may often be able to employ a common solution to fulfill multiple roles or serve multiple purposes, the selection of an appropriate set of solutions is left to each agency." - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "text - 105" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "c93e24ce-ec5c-4a5a-a505-f69f222f1c57", - "cellValue": "Backup and Recovery", - "linkTarget": "step", - "linkLabel": "✳️ Backup and Reccovery", - "style": "link" - }, - { - "id": "bac9107f-354e-46ac-b4ad-a3e6e0f55cb0", - "cellValue": "Central Log Management with Analysis", - "linkTarget": "step", - "linkLabel": "✳️ Central Log Management with Analysis", - "style": "link" - }, - { - "id": "4ffc1b21-56f5-450b-8eff-0ad8878d145b", - "cellValue": "Configuration Management", - "linkTarget": "step", - "linkLabel": "✳️ Configuration Management", - "style": "link" - }, - { - "id": "8d000886-a46f-4445-ab37-3f8d85d1a03c", - "cellValue": "Incident Response Plan and Incident Handling", - "linkTarget": "step", - "linkLabel": "✳️ Incident Response Plan and Incident Handling", - "style": "link" - }, - { - "id": "5716dd9a-2dc4-49b6-8159-6ecb38cae5b8", - "cellValue": "Inventory", - "linkTarget": "step", - "linkLabel": "✳️ Inventory", - "style": "link" - }, - { - "id": "fd99b1dd-8ab6-458a-9750-9bea08680143", - "cellValue": "Least Privilege", - "linkTarget": "step", - "linkLabel": "✳️ Least Privilege", - "style": "link" - }, - { - "id": "e44f9cc8-c90d-4180-bc5b-05ea686c2a48", - "cellValue": "Secure Administration", - "linkTarget": "step", - "linkLabel": "✳️ Secure Administration", - "style": "link" - }, - { - "id": "3d6bbb2b-5f84-45e1-840b-d5751ae01724", - "cellValue": " Strong Authentication", - "linkTarget": "step", - "linkLabel": "✳️ Strong Authentication", - "style": "link" - }, - { - "id": "39eeaf42-397f-4f0b-9ecb-6094cb499da5", - "cellValue": "Time Synchronization", - "linkTarget": "step", - "linkLabel": "✳️ Time Synchronization", - "style": "link" - }, - { - "id": "7a410392-0071-45de-bd44-6c1a302099bf", - "cellValue": "Vulnerability Management", - "linkTarget": "step", - "linkLabel": "✳️ Vulnerability Management", - "style": "link" - }, - { - "id": "85947fdc-7b1e-4ccf-b381-e14c481d44b2", - "cellValue": "Patch Management", - "linkTarget": "step", - "linkLabel": "✳️ Patch Management", - "style": "link" - }, - { - "id": "c785c05b-3c23-440c-880e-d137a5129d57", - "cellValue": "Auditing and Accounting", - "linkTarget": "step", - "linkLabel": "✳️ Auditing and Accounting", - "style": "link" - }, - { - "id": "c05f7400-cd07-4f88-8b83-01e7a423b212", - "cellValue": "Resilience", - "linkTarget": "step", - "linkLabel": "✳️ Resilience", - "style": "link" - }, - { - "id": "e1e208ec-51b4-4a92-b4c0-3b642dad5710", - "cellValue": "Enterprise Threat Intelligence", - "linkTarget": "step", - "linkLabel": "✳️ Enterprise Threat Intelligence", - "style": "link" - }, - { - "id": "ea9cabf5-fb7c-4243-82bf-ec8bc27d563e", - "cellValue": "Situational Awareness", - "linkTarget": "step", - "linkLabel": "✳️ Situational Awareness", - "style": "link" - }, - { - "id": "cca8efec-9930-4851-8245-6624c437608e", - "cellValue": "Dynamic Threat Discovery", - "linkTarget": "step", - "linkLabel": "✳️ Dynamic Threat Discovery", - "style": "link" - }, - { - "id": "af1e2514-78fd-4553-b883-e7e509081cd4", - "cellValue": "Policy Enforcement Parity", - "linkTarget": "step", - "linkLabel": "✳️ Policy Enforcement Parity", - "style": "link" - }, - { - "id": "e728fd6f-9b96-46e7-b657-7b94a4333060", - "cellValue": "Effective Use of Shared Services", - "linkTarget": "step", - "linkLabel": "✳️ Effective Use of Shared Services", - "style": "link" - }, - { - "id": "51a146f0-a041-43d3-8ed8-f2d03ce3a40b", - "cellValue": "Integrated Desktop, Mobile, and Remote Policies", - "linkTarget": "step", - "linkLabel": "✳️ Integrated Desktop, Mobile, and Remote Policies", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Universal Security Capabilities Navigation" - }, { "type": 12, "content": { @@ -1351,7088 +1339,8564 @@ { "type": 1, "content": { - "json": "# [Backup and Recovery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nKeeping copies of configuration and data, as needed, to allow for the quick restoration of service in the event of malicious incidents, system failures, or corruption.\r\n\r\n### Microsoft References \r\n💡 [What is the Azure Backup Service?](https://docs.microsoft.com/azure/backup/backup-overview)
\r\n💡 [Review Your Security Recommendations](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n💡 [Configure Recovery Service Vaults](https://docs.microsoft.com/azure/backup/backup-azure-recovery-services-vault-overview)
\r\n💡 [Leverage Azure Blueprints for Landing Zones](https://docs.microsoft.com/azure/governance/blueprints/overview)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Backup](https://azure.microsoft.com/services/backup/)\r\n\r\n### Microsoft Portals\r\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\r\n🔀 [Recovery Services Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.RecoveryServices%2Fvaults)
\r\n🔀 [Blueprints](https://portal.azure.com/#blade/Microsoft_Azure_Policy/BlueprintsMenuBlade/GetStarted)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.BE, PR.IP, PR.DS, RS.MI, RC.RP](https://www.nist.gov/cyberframework)\r\n" + "json": "# [Universal Security Capabilities](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\n---\r\nUniversal capabilities are enterprise-level capabilities that outline guiding principles for TIC use cases. Universal capabilities are selected to be broadly applicable; the same list of capabilities apply to every use case. However, certain use cases may provide unique guidance on specific capabilities where necessary. Agencies have significant discretion regarding how to meet the individual security capability requirements and address their particular needs. Agencies are free to determine the level of rigor necessary for applying universal capabilities based on federal guidelines and risk tolerance. While it is expected that agencies may often be able to employ a common solution to fulfill multiple roles or serve multiple purposes, the selection of an appropriate set of solutions is left to each agency." }, - "customWidth": "50", + "customWidth": "40", + "name": "text - 105" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", "conditionalVisibility": { "parameterName": "isUniversalSecurityCapabilitiesVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 0", - "styleSettings": { - "maxWidth": "50" - } + "name": "text - 105" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationName contains \"back\"\r\n| summarize count() by RecommendationName, AssessedResourceId, RecommendationLink\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud: Recommendations for Backups", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Backup and Recovery\\\", \\\"tab\\\": \\\"Backup\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Central Log Management with Analysis\\\", \\\"tab\\\": \\\"Central\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Configuration Management\\\", \\\"tab\\\": \\\"Configuration\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Incident Response Plan and Incident Handling\\\", \\\"tab\\\": \\\"Incident\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Inventory\\\", \\\"tab\\\": \\\"Inventory\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Least Privilege\\\", \\\"tab\\\": \\\"Least\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Secure Administration\\\", \\\"tab\\\": \\\"Secure\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Strong Authentication\\\", \\\"tab\\\": \\\"Strong\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Time Synchronization\\\", \\\"tab\\\": \\\"Time\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Vulnerability Management\\\", \\\"tab\\\": \\\"Vulnerability\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "RecommendationName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Gear", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityBaseline\r\n| where Description contains \"back up\" or Description contains \"backup\" or Description contains \"back-up\" or Description contains \"restore\" or Description contains \"recover\"\r\n| summarize count() by Description, AnalyzeResult, ResourceId\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Backup & Recovery: Baseline Assessments", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AnalyzeResult", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "Passed", - "representation": "success", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Failed", - "representation": "4", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "cancelled", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 2", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Backup and Recovery", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Central Log Management & Analysis](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCollecting, storing, and analyzing telemetry, where the collection and storage are designed to facilitate data fusion and the security analysis aids in discovery and response to malicious activity.\r\n\r\n### Microsoft Reference \r\n💡 [Create Diagnostic Settings to Send Platform Logs and Metrics to Different Destinations](https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [What is Azure Lighthouse?](https://docs.microsoft.com/azure/lighthouse/overview)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)\r\n\t\r\n### Microsoft Security Portals, Features, & Admin Centers\r\n🔀 [Resource Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResourceGroups)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Azure Lighthouse](https://portal.azure.com/#blade/Microsoft_Azure_CustomerHub/LighthouseBlade)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.PT, DE.AE, RS.AN](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "Usage\r\n| summarize count() by DataType\r\n| sort by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Log Events Count by Log Type", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "tiles", - "gridSettings": { - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "DataType", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } + "columnMatch": "tab", + "formatter": 5 } - }, - "showBorder": false + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", + "customWidth": "40", + "name": "query - 8", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 9, "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationDisplayName contains \"agent\" or RecommendationDisplayName contains \"log\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by RecommendationDisplayName\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud: Recommendations for Logging", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "tileSettings": { - "titleContent": { - "columnMatch": "DataType", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "2adea420-fa6e-4073-8a78-1aeada742e2c", + "version": "KqlParameterItem/1.0", + "name": "isBackupVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Backup", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 } }, - "showBorder": false - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "union withsource=_TableName *\r\n| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(\"second\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by _TableName, _IsBillable\r\n| project ['Table Name'] = _TableName, ['Table Size'] = Size, ['Table Entries'] = Entries,\r\n ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable\r\n| order by ['Table Size'] desc", - "size": 0, - "showAnalytics": true, - "title": "Log Table Management", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Table Name", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Table Size", - "formatter": 8, - "formatOptions": { - "palette": "purple" + { + "version": "KqlParameterItem/1.0", + "name": "isCentralVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Central", + "resultValType": "static", + "resultVal": "true" + } }, - "numberFormat": { - "unit": 2, - "options": { - "style": "decimal", - "useGrouping": false + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "Table Entries", - "formatter": 8, - "formatOptions": { - "palette": "turquoise" + "id": "04e846bb-6bca-4981-863b-76f4e8ea5667" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isConfigurationVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Configuration", + "resultValType": "static", + "resultVal": "true" + } }, - "numberFormat": { - "unit": 2, - "options": { - "style": "decimal", - "useGrouping": false + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "Size per Entry", - "formatter": 8, - "formatOptions": { - "palette": "blue" + "id": "7498b0e3-e4dd-44c9-868d-d5baef71ba17" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isIncidentVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Incident", + "resultValType": "static", + "resultVal": "true" + } }, - "numberFormat": { - "unit": 2, - "options": { - "style": "decimal", - "useGrouping": false + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "IsBillable", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "True", - "representation": "2", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "False", - "representation": "success", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "Important", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true, - "sortBy": [ - { - "itemKey": "$gen_thresholds_IsBillable_4", - "sortOrder": 2 - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_thresholds_IsBillable_4", - "sortOrder": 2 - } - ], - "tileSettings": { - "titleContent": { - "columnMatch": "DataType", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } + "id": "7010b3e9-27e4-40b0-8d4b-fdd05f940d92" }, - "showBorder": false - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 5", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "union withsource=_TableName *\r\n| summarize count() , Size = sum(_BilledSize) by bin(_TimeReceived, 1m), Type, _IsBillable\r\n| extend counttemp =count_ / 60\r\n| summarize \r\n ['Current EPS Average']=avg(counttemp), ['Minimum EPS']=min(counttemp),\r\n ['Maximum EPS']=max(counttemp)\r\n by ['Table Name']=Type\r\n| order by ['Current EPS Average'] desc", - "size": 0, - "showAnalytics": true, - "title": "Log Table Events Per Second (EPS) Management", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Table Name", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Current EPS Average", - "formatter": 3, - "formatOptions": { - "palette": "blueDark" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal", - "useGrouping": true + { + "version": "KqlParameterItem/1.0", + "name": "isInventoryVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Inventory", + "resultValType": "static", + "resultVal": "true" } - } - }, - { - "columnMatch": "Minimum EPS", - "formatter": 3, - "formatOptions": { - "palette": "red" }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal", - "useGrouping": true + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "Maximum EPS", - "formatter": 3, - "formatOptions": { - "palette": "green" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal", - "useGrouping": false + "id": "c9285caf-952f-458a-ac89-3fdb2871151f" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isLeastVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Least", + "resultValType": "static", + "resultVal": "true" } - } - }, - { - "columnMatch": "Table Size", - "formatter": 8, - "formatOptions": { - "palette": "purple" }, - "numberFormat": { - "unit": 2, - "options": { - "style": "decimal", - "useGrouping": false + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "Table Entries", - "formatter": 8, - "formatOptions": { - "palette": "turquoise" - }, - "numberFormat": { - "unit": 2, - "options": { - "style": "decimal", - "useGrouping": false + "id": "356132e1-e5e8-4fd4-8a56-95bd91bc9470" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isSecureVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Secure", + "resultValType": "static", + "resultVal": "true" } - } - }, - { - "columnMatch": "Size per Entry", - "formatter": 8, - "formatOptions": { - "palette": "blue" }, - "numberFormat": { - "unit": 2, - "options": { - "style": "decimal", - "useGrouping": false + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "IsBillable", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "True", - "representation": "2", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "False", - "representation": "success", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "Important", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true, - "sortBy": [ - { - "itemKey": "$gen_bar_Current EPS Average_1", - "sortOrder": 2 - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_bar_Current EPS Average_1", - "sortOrder": 2 - } - ], - "tileSettings": { - "titleContent": { - "columnMatch": "DataType", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } + "id": "8d5eb913-9e91-4f61-930b-26335aaad1cf" }, - "showBorder": false - } - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 5" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Central Log Management with Analysis", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Configuration Management](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nImplementing a formal plan for documenting, managing changes to the environment, and monitoring for deviations, preferably automated.\r\n\r\n### Microsoft References \r\n💡 [Enable Change Tracking and Inventory From an Automation Account](https://docs.microsoft.com/azure/automation/change-tracking/enable-from-automation-account)
\r\n💡 [Ensure Your Endpoints Are Configured Properly](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines)
\r\n💡 [Secure Score in Azure Defender](https://docs.microsoft.com/azure/security-center/secure-score-security-controls)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.BE, PR.DS, PR.IP, PR.MA](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecureScoreControls\r\n| extend Percent=PercentageScore*100\r\n| summarize avg(Percent) by bin(TimeGenerated,1d), ControlName, SubscriptionId=_SubscriptionId\r\n| render timechart", - "size": 0, - "aggregation": 1, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud: Secure Score Controls (Percentage) Over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityBaselineSummary\r\n| summarize count() by Resource, PercentageOfPassedRules, CriticalFailedRules, WarningFailedRules\r\n| project Resource, CriticalFailedRules, WarningFailedRules, PercentageOfPassedRules\r\n| sort by CriticalFailedRules desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Monitor & Enforce Security Baselines", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "CriticalFailedRules", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - }, - { - "columnMatch": "WarningFailedRules", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } - }, - { - "columnMatch": "PercentageOfPassedRules", - "formatter": 4, - "formatOptions": { - "palette": "green" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Configuration Management", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Incident Response Plan and Incident Handling](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDocumenting and implementing a set of instructions, procedures, or technical capabilities to sense and detect, respond to, limit consequences of malicious cyberattacks, and restore the integrity of the network and associated systems.\r\n\r\n### Microsoft References \r\n💡 [Quickstart: Tutorial: Investigate incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-investigate-cases)
\r\n💡 [Use Jupyter Notebook to Hunt for Security Threats](https://docs.microsoft.com/azure/sentinel/notebooks)
\r\n💡 [Tutorial: Set Up Automated Threat Responses in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
\r\n💡[Overview of Microsoft 365 Advanced eDiscovery](https://docs.microsoft.com/microsoft-365/compliance/overview-ediscovery-20)
\r\n💡[Learn About Insider Risk Management in Microsoft 365](https://docs.microsoft.com/microsoft-365/compliance/insider-risk-management)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) 🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) \r\n\r\n### Microsoft Portals\r\n🔀 [Azure Portal](https://portal.azure.com/)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.GV, ID.RA, PR.IP, DE.DP, DE.AE, RS.RP, RS.CO, RS.AN, RS.MI](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityIncident\r\n| where Severity in ('*') or 'All' ==  \"All\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Severity\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Sentinel Incidents over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureActivity\r\n| where ResourceProvider == \"Microsoft.Logic\"\r\n| summarize count() by ResourceId\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Sentinel Playbooks Triggered", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Incident Response Plan and Incident Handling", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Inventory](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDeveloping, documenting, and maintaining a current inventory of all systems, networks, and components so that only authorized endpoints are given access, and unauthorized and unmanaged endpoints are found and prevented from gaining access.\r\n\r\n### Microsoft References \r\n💡 [Explore and Manage Your Resources With Asset Inventory](https://docs.microsoft.com/azure/security-center/asset-inventory)
\r\n💡 [Protect Your Network Resources](https://docs.microsoft.com/azure/security-center/security-center-network-recommendations)
\r\n💡 [View Installed Software](https://docs.microsoft.com/azure/automation/automation-tutorial-installed-software#view-installed-software)
\r\n💡 [What is Windows Virtual Desktop?](https://docs.microsoft.com/azure/virtual-desktop/overview)
\r\n💡 [What is Azure Resource Graph?](https://docs.microsoft.com/azure/governance/resource-graph/overview)
\r\n💡 [Azure Arc Overview](https://docs.microsoft.com/azure/azure-arc/overview)
\r\n\r\n### Recommended Logs\r\n🔷 [Heartbeat](https://docs.microsoft.com/azure/azure-monitor/reference/tables/heartbeat) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)
🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n\t\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\r\n🔀 [Azure Virtual Desktop](https://portal.azure.com/#blade/Microsoft_Azure_WVD/WvdManagerMenuBlade/overview)
\r\n🔀 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\r\n🔀 [Azure Arc](https://portal.azure.com/#blade/Microsoft_Azure_HybridCompute/AzureArcCenterBlade/overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.IP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Asset Inventory (Azure Resource Graph)", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 8" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| project id,type,location,resourceGroup\r\n| summarize count() by type\r\n| sort by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Asset Count by Type", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "type", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "ResourceFlat", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "Computer", - "formatter": 16, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 8", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "where type contains \"microsoft\"\r\n| project id,type,location,resourceGroup\r\n| summarize count() by location\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Asset Count by Location", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "location", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Globe", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "Computer", - "formatter": 16, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 9", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type =~ 'microsoft.operationalinsights/workspaces' \r\n| extend state = trim(' ', tostring(properties.provisioningState))\r\n\t\t,sku = trim(' ', tostring(properties.sku.name))\r\n ,skuUpdate = trim(' ', tostring(properties.sku.lastSkuUpdate))\r\n\t\t,retentionDays = trim(' ', tostring(properties.retentionInDays))\r\n\t\t,dailyquotaGB = trim(' ', tostring(properties.workspaceCapping.dailyQuotaGb))\r\n| extend dailyquotaGB = iif(dailyquotaGB !=-1.0, dailyquotaGB,\"Not set\")\r\n| extend skuUpdate = iif(strlen(skuUpdate) > 0, skuUpdate,\"Unknown\")\r\n| extend sentinel = iif(toint(retentionDays) < 90,\"If you have Sentinel, you can change your retention to 90days (free)?\",\"\")\r\n| project ['Workspace Name']=id, ['Resource Group']=resourceGroup, location, ['Data Retention(days)']=retentionDays", - "size": 2, - "showAnalytics": true, - "title": "Log Analytics Workspace Inventory", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Computer", - "formatter": 16, - "formatOptions": { - "showIcon": true - } - } - ], - "filter": true, - "sortBy": [ - { - "itemKey": "$gen_link_Workspace Name_0", - "sortOrder": 1 - } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_link_Workspace Name_0", - "sortOrder": 1 - } - ], - "tileSettings": { - "titleContent": { - "columnMatch": "type", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "showBorder": false - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 9", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "Heartbeat\r\n| distinct ResourceId, ComputerIP, OSType, Category, ResourceGroup, ResourceType \r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Asset Inventory (Heartbeat)", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Computer", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "OSType", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "Windows", - "representation": "blue", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Linux", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "mac", - "representation": "magenta", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Category", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "trenddown", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "Heartbeat\r\n| where ResourceProvider in (\"Microsoft.HybridCompute\")\r\n| distinct ResourceId, ComputerIP, OSType, Category, ResourceGroup, ResourceType \r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Asset Inventory (Hybrid/On Prem Joined Machines: Azure Arc)", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Computer", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "OSType", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "Windows", - "representation": "blue", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Linux", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "mac", - "representation": "magenta", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "lightBlue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Category", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "trenddown", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 8", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Inventory", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Least Privilege](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDesigning the security architecture such that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.\r\n\r\n### Microsoft References \r\n💡 [Administrator roles by admin task in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/delegate-by-task)
\r\n💡 [Overview of role-based access control in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/custom-overview)
\r\n💡 [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\r\n💡 [Azure Active Directory Sign-In Activity](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-all-sign-ins)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [AADNonInteractiveUserSignInLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.IP, PR.PT, DE.CM](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AzureActivity\r\n| summarize Activities = count() by User = Caller\r\n| where User <> \"\"\r\n| sort by Activities desc\r\n| take 250", - "size": 0, - "showAnalytics": true, - "title": "Azure Active Directory Users by Action Count", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "User", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "info", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Activities", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "IdentityInfo\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles_ = strcat(AssignedRoles)\r\n| extend UserPrincipalName = MailAddress\r\n| where MailAddress <> \"\"\r\n| distinct UserPrincipalName, GroupMemberships, AssignedRoles_\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Assigned Roles & Group Memberships", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "User", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Activities", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 4", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AADNonInteractiveUserSignInLogs\r\n| project AppDisplayName, Identity, TimeGenerated\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by AppDisplayName\r\n| render timechart", - "size": 0, - "showAnalytics": true, - "title": "AAD Non Interactive User Sign-In Logs By Application ", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "User", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "info", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Activities", - "formatter": 8, - "formatOptions": { - "palette": "blue" - } - } - ] - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "AAD Non Interactive User Sign-In Logs By Application ", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Least Privilege", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Secure Administration](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nPerforming administrative tasks in a secure manner, using secure protocols.\r\n\r\n### Microsoft References\r\n💡 [Delegate Administration in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/concept-delegation)
\r\n💡 [Start Using Privileged Identity Management](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started#)
 \r\n💡 [Customer Lockbox for Microsoft Azure](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview) 
\r\n💡 [Securing Devices as Part of the Privileged Access Story](https://docs.microsoft.com/security/compass/privileged-access-devices) 
\r\n\r\n### Recommended Logs\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Security Portals, Features, & Admin Centers\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Privileged Identity Management](https://portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\r\n🔀 [Customer Lockbox for Microsoft Azure](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.MA](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "AuditLogs\r\n| where Identity == \"MS-PIM\"\r\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n| extend PIM_Role = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))\r\n| where UserPrincipalName <>\"\"\r\n| project UserPrincipalName, OperationName, PIM_Role, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Privileged Identity Management Actions", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Secure Administration", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Strong Authentication](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nVerifying the identity of users, endpoints, or other entities through rigorous means (e.g. multi-factor authentication) before granting access.\r\n\r\n### Microsoft References \r\n💡 [Plan an Azure AD Multi-Factor Authentication Deployment](https://docs.microsoft.com/azure/active-directory/authentication/howto)
\r\n💡 [How it works: Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks)
\r\n💡 [Remediate recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-remediate-recommendations)
\r\n💡 [SecretManagement and Accessing Linux VMs in Azure](https://techcommunity.microsoft.com/t5/itops-talk-blog/secretmanagement-and-accessing-linux-vms-in-azure/ba-p/2278735)
\r\n💡 [Eliminate Password-Based Attacks on Azure Linux VMs](https://techcommunity.microsoft.com/t5/azure-security-center/eliminate-password-based-attacks-on-azure-linux-vms/ba-p/2271139)
\r\n💡 [Quickstart: Create a Key Vault Using the Azure Portal](https://techcommunity.microsoft.com/t5/itops-talk-blog/secretmanagement-and-accessing-linux-vms-in-azure/ba-p/2278735)
\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/defender-for-iot/how-to-security-data-access#security-recommendations) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\t\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SigninLogs\r\n| extend ResultText = case(isnotempty(ResultDescription), ResultDescription, ResultType == 0 and isempty(ResultDescription), \"Successfull login\", \"unknown\")\r\n| summarize count() by ResultText\r\n| sort by count_ desc\r\n\r\n\r\n", - "size": 0, - "showAnalytics": true, - "title": "Authentication Codes", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "ResultText", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "contains", - "thresholdValue": "Success", - "representation": "success", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "error", - "representation": "4", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "not", - "representation": "2", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "tried", - "representation": "2", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "invalid", - "representation": "3", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "unauth", - "representation": "4", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "block", - "representation": "3", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "Invalid", - "representation": "3", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "expired", - "representation": "2", - "text": "{0}{1}" - }, - { - "operator": "contains", - "thresholdValue": "missing", - "representation": "2", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "1", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": " Strong Authentication", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Time Synchronization](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCoordinating clocks on all systems (e.g. servers, workstations, network endpoints) to enable accurate comparison of timestamps between systems.\r\n\r\n### Microsoft References \r\n💡 [Time Sync for Windows VMs in Azure](https://docs.microsoft.com/azure/virtual-machines/windows/time-sync)\r\n\r\n### Recommended Logs\r\n🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Portal](https://portal.azure.com/)
\r\n🔀 [Virtual Machines](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.IP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Time Synchronization", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityBaseline\r\n| where Description contains \"NTP\"\r\n| project ResourceId, Description, AnalyzeResult, TimeGenerated\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Monitor NTP Syncs", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AnalyzeResult", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "Passed", - "representation": "success", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Failed", - "representation": "4", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "1", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Time Synchronization", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Vulnerability Management](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nProactively working to discover vulnerabilities, including the use of both active and passive means of discovery, and taking action to mitigate discovered vulnerabilities.\r\n\r\n### Microsoft References\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [Secure Score in Azure Defender](https://docs.microsoft.com/azure/security-center/secure-score-security-controls)
\r\n💡 [Azure Defender's Integrated Vulnerability Assessment Solution for Azure and Hybrid Machine](https://docs.microsoft.com/azure/security-center/built-in-vulnerability-assessment)
\r\n💡 [Threat and Vulnerability Management Walk-Through](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, PR.IP, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationName contains \"vuln\" or RecommendationName contains \"assess\" or RecommendationName contains \"update\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by RecommendationName\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Vulnerabilty Management Recommendations over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecureScoreControls\r\n| extend Percent=PercentageScore*100\r\n| summarize avg(Percent) by bin(TimeGenerated,1d), ControlName, SubscriptionId=_SubscriptionId\r\n| render timechart", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud: Secure Score", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityBaseline\r\n| where CceId <> \"\"\r\n|project CceId, RuleSeverity, Description, ResourceId\r\n|limit 50", - "size": 0, - "showAnalytics": true, - "title": "Vulnerability Management", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "CceId", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Defense Evasion", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RuleSeverity", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "4", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Resource", - "formatter": 13, - "formatOptions": { - "linkTarget": "Resource", - "showIcon": true - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 4", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Vulnerability Management", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Patch Management](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentifying, acquiring, installing, and verifying patches for products and systems.\r\n\r\n### Microsoft References \r\n💡 [Update Management Overview](https://docs.microsoft.com/azure/automation/update-management/overview)
\r\n💡 [Enable Update Management From the Azure Portal](https://docs.microsoft.com/azure/automation/update-management/enable-from-portal)
\r\n💡 [Handling Planned Maintenance Notifications Using the Azure Portal](https://docs.microsoft.com/azure/virtual-machines/maintenance-notifications-portal)
\r\n💡 [Managing Platform Updates with Maintenance Control](https://docs.microsoft.com/azure/virtual-machines/maintenance-control?toc=/azure/virtual-machines/linux/toc.json&bc=/azure/virtual-machines/linux/breadcrumb/toc.json)
\r\n💡 [Scheduling Maintenance Updates with Maintenance Control and Azure Functions](https://github.com/Azure/azure-docs-powershell-samples/tree/master/maintenance-auto-scheduler)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n\r\n### Required Log (Log Source)\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Security Portals, Features, & Admin Centers\r\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\r\n🔀 [Virtual Machines](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.IP, PR.MA](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationName == \"System updates should be installed on your machines\" or RecommendationName contains \"upgrade\" or RecommendationName contains \"update\" or RecommendationName contains \"patch\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by RecommendationDisplayName\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud: Recommendations for Updates", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 4", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Patch Management", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Auditing and Accounting](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCapturing business records, including logs and other telemetry, and making them available for auditing and accounting as required. Design of the auditing system should take insider threat into consideration, including separation of duties violation tracking, such that insider abuse or misuse can be detected.\r\n\r\n### Microsoft References \r\n💡 [Create Diagnostic Settings to Send Platform Logs and Metrics to Different Destinations](https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings)
\r\n💡 [Tutorial: Grant a User Access to Azure Resources Using the Azure Portal](https://docs.microsoft.com/azure/role-based-access-control/quickstart-assign-role-user-portal)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [Auditing Microsoft Sentinel Activities](https://techcommunity.microsoft.com/t5/azure-sentinel/auditing-azure-sentinel-activities/ba-p/1718328)
\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Resource Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResourceGroups)
\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST CSF Mapping\r\n[ID.SC, PR.AC, PR.PT](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "Usage\r\n| summarize count() by DataType\r\n| sort by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Log Events Count by Log Source", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "tiles", - "gridSettings": { - "filter": true - }, - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "DataType", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationDisplayName contains \"agent\" or RecommendationDisplayName contains \"log\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by RecommendationDisplayName\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud: Recommendations for Logging", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "DataType", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "count_", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Auditing and Accounting", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Resilience](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEnsuring that systems, services, and protections maintain acceptable performance under adverse conditions.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Azure DDoS Protection]( https://azure.microsoft.com/services/ddos-protection/) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/) \r\n\r\n### Microsoft Portals\r\n🔀 [DDoS Protection Plans](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans)
\r\n🔀 [Availability Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FavailabilitySets)
\r\n🔀 [Load Balancing](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n🔀 [Virtual Machine Scale Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Compute%2FvirtualMachineScaleSets)
\r\n\r\n### Microsoft References \r\n💡 [Azure DDoS Protection Standard Overview](https://docs.microsoft.com/azure/ddos-protection/ddos-protection-overview)
\r\n💡 [Building Solutions for High Availability Using Availability Zones](https://docs.microsoft.com/azure/architecture/high-availability/building-solutions-for-high-availability)
 \r\n💡 [Azure Infrastructure Availability](https://docs.microsoft.com/azure/security/fundamentals/infrastructure-availability)
 \r\n💡 [What is Azure Load Balancer?](https://docs.microsoft.com/azure/load-balancer/load-balancer-overview)
\r\n💡 [What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
 \r\n💡 [What are virtual machine scale sets?](https://docs.microsoft.com/azure/virtual-machine-scale-sets/overview)
 \r\n\r\n### NIST CSF Mapping\r\n[ID.BE, PR.PT](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| distinct AlertName, ProductName, Status, AlertLink, Tactics, TimeGenerated\r\n| where AlertName contains \"dos\" or AlertName contains \"waf\"\r\n| sort by TimeGenerated desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Security Alerts: DDoS & WAF", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "3", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >" - } - }, - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Severity", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "High", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Medium", - "representation": "orange", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Low", - "representation": "yellow", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UPN", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "IncidentUrl", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Incident >" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "city_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "state_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "SourceIPLocation", - "longitude": "SourceIPLocation", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Resilience", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Enterprise Threat Intelligence](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nObtaining threat intelligence from private and government sources and implementing mitigations for the identified risks.\r\n\r\n### Microsoft References \r\n💡 [Connect Data from Threat Intelligence Providers](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence)
\r\n💡 [Microsoft Security Intelligence Portal](https://www.microsoft.com/wdsi)
\r\n💡 [Microsoft Graph Security tiIndicators API](https://docs.microsoft.com/graph/api/resources/tiindicator)
\r\n💡 [MSTIC Jupyter and Python Security Tools](https://github.com/Microsoft/msticpy)
\r\n💡 [Use Jupyter Notebook to Hunt for Security Threats](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence)
\r\n\r\n### Recommended Logs\r\n🔷 [ThreatIntelligenceIndicator](https://docs.microsoft.com/azure/azure-monitor/reference/tables/threatintelligenceindicator) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)\r\n\t\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender Security Intelligence Portal](https://microsoft.com/wdsi)
\r\n🔀 [Resource Graph Queries](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.resourcegraph%2Fqueries)
\r\n🔀 [MSTICpy](https://github.com/Microsoft/msticpy)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "ThreatIntelligenceIndicator\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| summarize CountOfIndicators = count() by SourceSystem\r\n| order by CountOfIndicators desc \r\n| render barchart kind=unstacked", - "size": 0, - "showAnalytics": true, - "title": "Cyber Threat Intelligence Indicator Counts", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Enterprise Threat Intelligence", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Situational Awareness](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMaintaining effective awareness, both current and historical, across all components.\r\n\r\n### Microsoft References \r\n💡 [Get Visibility Into Alerts](https://docs.microsoft.com/azure/sentinel/quickstart-get-visibility)
\r\n💡 [What is Azure Network Watcher?](https://docs.microsoft.com/graph/api/resources/tiindicator)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Network Watcher](https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, ID.RA, PR.DS, PR.IP, DE.AE, DE.CM, DE.DP, RS.CO](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize count() by ProductName\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Security Alerts By Product", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Situational Awareness", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Dynamic Threat Discovery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nUsing dynamic approaches (e.g. heuristics, baselining, etc.) to discover new malicious activity\r\n\r\n### Microsoft References \r\n💡 [Advanced Multistage Attack Detection in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/fusion)
\r\n💡 [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\r\n💡 [Heuristic Detections in Microsoft Defender for Cloud](https://azure.microsoft.com/blog/heuristic-dns-detections-in-azure-security-center/)
\r\n\r\n### Recommended Logs\r\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) 🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "let AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indicaiton from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//witdstomstl\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignemt\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to priveleged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlasrRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privilleged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to priveleged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| where UserPrincipalName !contains \"[\"\r\n| where UserPrincipalName <> \"\"\r\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\r\n| sort by AlertCount desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "User Entity Behavior Analytics Alerts", - "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "IncidentCount", - "formatter": 8, - "formatOptions": { - "palette": "redBright" - } - }, - { - "columnMatch": "AlertCount", - "formatter": 8, - "formatOptions": { - "palette": "orange" - } - }, - { - "columnMatch": "AnomalyCount", - "formatter": 8, - "formatOptions": { - "palette": "yellow" - } - } - ], - "filter": true - }, - "sortBy": [], - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "SourceIPLocation", - "longitude": "SourceIPLocation", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 1", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"Sentinel Fusion\" or AlertName contains \"Anomalous\"\r\n| summarize count () by AlertName, ProductName\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Dynamic Threat Detection Rules", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "3", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >" - } - }, - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Severity", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "High", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Medium", - "representation": "orange", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Low", - "representation": "yellow", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UPN", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "IncidentUrl", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Incident >" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "city_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "state_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "SourceIPLocation", - "longitude": "SourceIPLocation", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Dynamic Threat Discovery", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Policy Enforcement Parity](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nConsistently applying security protections and other policies, independent of the communication mechanism, forwarding path, or endpoints used.\r\n\r\n### Microsoft References \r\n💡 [What is Azure Policy?](https://docs.microsoft.com/azure/governance/policy/overview)
\r\n💡 [What is Azure Blueprints?](https://docs.microsoft.com/azure/governance/blueprints/)
\r\n💡 [Password Policies and Account Restrictions in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/authentication/concept-sspr-policy)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\r\n🔀 [Blueprints](https://portal.azure.com/#blade/Microsoft_Azure_Policy/BlueprintsMenuBlade/GetStarted)
\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS, PR.IP, PR.MA](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| summarize count() by RecommendationName\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Configured Assessment Policies", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecommendationName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Gear", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Policy Enforcement Parity", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Effective Use of Shared Services](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEmploying shared services, where applicable, that can be individually tailored, measured to independently validate service conformance, and offer effective protections for tenants against malicious actors, both external as well as internal to the service provider.\r\n\r\n### Microsoft References \r\n💡 [Get Started with Azure Lighthouse](https://azure.microsoft.com/services/azure-lighthouse/)
\r\n💡 [Customer Lockbox for Microsoft Azure](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview)
\r\n💡 [What are External Identities in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/external-identities/compare-with-b2c)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Lighthouse](https://portal.azure.com/#blade/Microsoft_Azure_CustomerHub/LighthouseBlade)
\r\n🔀 [Customer Lockbox for Microsoft Azure](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/Overview)
\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, ID.GV, ID.RM, ID.SC, PR.AT, RS.CO](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 1, - "content": { - "json": "### ✳️ [Leverage Azure Lighthouse for Service Provider Access](https://azure.microsoft.com/services/azure-lighthouse/)\r\n![Image Name](https://docs.microsoft.com/azure/lighthouse/media/azure-lighthouse-overview.jpg)\r\n" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 1, - "content": { - "json": "### ✳️ [Use Azure Customer Lockbox for Shared Access to Resources](https://aka.ms/customerlockbox/insiderprogram)\r\n![Image Name](https://docs.microsoft.com/azure/security/fundamentals/media/customer-lockbox-overview/customer-lockbox-landing-page.png)\r\n" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3 - Copy", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Effective Use of Shared Services", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Integrated Desktop, Mobile, and Remote Policiess](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDefining polices such that they apply to a given agency entity no matter its location.\r\n\r\n### Microsoft References \r\n💡 [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
\r\n💡 [What are Common Ways to Use Conditional Access with Intune?](https://docs.microsoft.com/mem/intune/protect/conditional-access-intune-common-ways-use)
 \r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Endpoint Manager Admin Center](https://devicemanagement.microsoft.com/)
\r\n🔀 [Microsoft Intune Portal](https://endpoint.microsoft.com/#blade/Microsoft_Intune_DeviceSettings/DevicesMenu/overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.IP, PR.MA](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SigninLogs", - "size": 0, - "showAnalytics": true, - "title": "Sign-Ins By Location", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "map", - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "labelSettings": "Location", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "heatmap", - "heatmapPalette": "greenRed" - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 1, - "content": { - "json": "### ✳️ [Control Connection of Endpoints with Microsoft Intune: Conditional Access](https://www.microsoft.com/microsoft-365/microsoft-endpoint-Manager)\r\n![Image Name](https://docs.microsoft.com/mem/intune/protect/media/conditional-access/ca-diagram-1.png  \"Intune Conditional Access\") \r\n" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUniversalSecurityCapabilitiesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Integrated Desktop, Mobile, and Remote Policies", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Files](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nFile-based protections including anti-malware, malicious code removal, content disarm & reconstruction, and detonation chambers.\r\n" - }, - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Files Capabilities Overview" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "c61c3951-546a-40ae-a680-74638b772d80", - "cellValue": "Anti-Malware", - "linkTarget": "step", - "linkLabel": "✳️ Anti-Malware", - "style": "link" - }, - { - "id": "6a592926-301d-44d9-8915-359e443fbc61", - "cellValue": "Content Disarm & Reconstruction", - "linkTarget": "step", - "linkLabel": "✳️ Content Disarm & Reconstruction", - "style": "link" - }, - { - "id": "ec6b5ffc-7d3d-4a93-b1cf-e20af0b57f3e", - "cellValue": "Detonation Chamber", - "linkTarget": "step", - "linkLabel": "✳️ Detonation Chamber", - "style": "link" - }, - { - "id": "33cb9a0b-8e24-410a-afd4-81d9e201e7a3", - "cellValue": "Data Loss Prevention_F", - "linkTarget": "step", - "linkLabel": "✳️ Data Loss Prevention", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Files Capabilities Navigation" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Anti-Malware](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAnti-malware protections detect the presence of malicious code and facilitate its quarantine or removal.\r\n\r\n### Microsoft References\r\n💡 [Microsoft Antimalware Extension for Windows](https://docs.microsoft.com/azure/virtual-machines/extensions/iaas-antimalware-windows)
\r\n💡 [Microsoft Antimalware for Azure Cloud Services and Virtual Machines](https://docs.microsoft.com/azure/security/fundamentals/antimalware)
\r\n💡 [Microsoft Defender for Cloud Apps: Malware Detection](https://docs.microsoft.com/cloud-app-security/anomaly-detection-policy#malware-detection)
\r\n💡 [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)\r\n ✳️ [Azure Defender](https://azure.microsoft.com/services/azure-defender/)\r\n✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender) ✳️ [Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Defender for Identity Portal](https://portal.atp.azure.com/)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for Cloud Apps Portal](https://portal.cloudappsecurity.com/)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS, PR.PT, DE.CM, DE.DP, RS.MI](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| distinct AlertName, ProductName, Status, AlertLink, Tactics, TimeGenerated\r\n| where AlertName contains \"mal\"\r\n| sort by TimeGenerated desc\r\n| limit 250", - "size": 0, - "title": "Security Alerts: Malware", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "3", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >" - } - }, - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Severity", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "High", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Medium", - "representation": "orange", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Low", - "representation": "yellow", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UPN", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "IncidentUrl", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Incident >" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "city_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "state_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "SourceIPLocation", - "longitude": "SourceIPLocation", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where AlertName contains \"mal\"\r\n| summarize count() by ProductName\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Malware Detected by Product", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Anti-Malware", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Content Disarm & Reconstruction](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nContent disarm and reconstruction technology detects the presence of unapproved active content and facilitates its removal.\r\n\r\n### Microsoft References \r\n💡 [Setup Safe Attachments Policies in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/set-up-atp-safe-attachments-policies)
\r\n💡 [Threat and Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
\r\n\r\n### Recommended Logs\r\n🔷 [EmailAttachmentInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailattachmentinfo) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM, DE.DP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "EmailAttachmentInfo\r\n| extend Detection = strcat(DetectionMethods)\r\n| where ThreatTypes <> \"\"\r\n| project RecipientEmailAddress, FileName, ThreatTypes, ThreatNames, Detection, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Safe Attachments: Attachment Mitigations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Content Disarm & Reconstruction", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Detonation Chamber](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDetonation chambers facilitate the detection of malicious code through the use of protected and isolated execution environments to analyze the files.\r\n\r\n### Microsoft References \r\n💡 [Submit File for Deep Analysis](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts#submit-files-for-deep-analysis)
\r\n💡 [Using the Built-in URL Detonation in Microsoft Sentinel](https://techcommunity.microsoft.com/t5/azure-sentinel/using-the-new-built-in-url-detonation-in-azure-sentinel/ba-p/996229)
\r\n💡 [Safe Links in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-links)
\r\n💡 [Safe Attachments in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-attachments)
\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals \r\n🔀 [Azure Portal](https://portal.azure.com/)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.CM, DE.DP, RS.AN, RS.MI](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where DetectionMethods <>\"\"\r\n| project RecipientEmailAddress, DeliveryAction, DeliveryLocation, EmailDirection, EmailAction, DetectionMethods, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Email Detonation: SafeLinks, SafeAttachments, SafeFiles", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "DeliveryAction", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "4", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "EmailDirection", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "Outbound", - "representation": "right", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "left", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "EmailAction", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "4", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "DetectionMethods", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Detonation Chamber", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Microsoft References \r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n💡 [Hunt for Threats with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/hunting)\r\n💡 [Learn about Microsoft 365 Endpoint Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about)
\r\n💡 [Configure and View Alerts for DLP Polices](https://docs.microsoft.com/microsoft-365/compliance/dlp-configure-view-alerts-policies)
\r\n\r\n### Required Log (Log Source)\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Endpoint]( https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "InformationProtectionLogs_CL\r\n| extend UserPrincipalName = UserId_s_s\r\n| where LabelName_s <> \"\"\r\n| join (SigninLogs) on UserPrincipalName\r\n| extend City = tostring(LocationDetails.city)\r\n| extend State = tostring(LocationDetails.state)\r\n| extend Country_Region = tostring(LocationDetails.countryOrRegion)\r\n", - "size": 3, - "showAnalytics": true, - "title": "Sensitive Data Access by Geolocation", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "map", - "gridSettings": { - "formatters": [ - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "warning", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UncommonActionVolume", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - }, - { - "columnMatch": "UncommonAction", - "formatter": 4, - "formatOptions": { - "palette": "green" - } - }, - { - "columnMatch": "FirstTimeUserAction", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "FirstTimeDeviceLogon", - "formatter": 4, - "formatOptions": { - "palette": "yellow" - } - }, - { - "columnMatch": "IncidentCount", - "formatter": 8, - "formatOptions": { - "palette": "redBright" - } - }, - { - "columnMatch": "AlertCount", - "formatter": 8, - "formatOptions": { - "palette": "orange" - } - }, - { - "columnMatch": "AnomalyCount", - "formatter": 8, - "formatOptions": { - "palette": "yellow" - } - } - ] - }, - "sortBy": [], - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "latitude_", - "longitude": "longitude_", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "labelSettings": "city_", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "yellow" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 12" - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| distinct AlertName, ProductName, Status, AlertLink, Tactics, TimeGenerated\r\n| where Tactics contains \"exfil\"\r\n| sort by TimeGenerated desc\r\n| limit 250", - "size": 0, - "title": "Security Alerts: Data Loss Prevention", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "3", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >" - } - }, - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Severity", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "High", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Medium", - "representation": "orange", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Low", - "representation": "yellow", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UPN", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "IncidentUrl", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Incident >" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "city_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "state_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "SourceIPLocation", - "longitude": "SourceIPLocation", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isFilesVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Data Loss Prevention_F", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Email](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nEmail-based protections including anti-phishing, anti-spam, authenticated received chain, data loss prevention, DMARC for incoming/outgoing mail, email encryption, and malicious URL protections.\r\n" - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Email Capabilities Help" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "75486fb8-e143-457b-881a-b1acaee05453", - "cellValue": "Anti-Phishing Protections", - "linkTarget": "step", - "linkLabel": "✳️ Anti-Phishing Protections", - "style": "link" - }, - { - "id": "a4879110-271e-496c-ae2f-7e30296af266", - "cellValue": "Anti-SPAM Protections", - "linkTarget": "step", - "linkLabel": "✳️ Anti-SPAM Protections", - "style": "link" - }, - { - "id": "bbc29b77-2e9a-4438-970f-e0abfdc8a3cc", - "cellValue": "Authenticated Received Chain", - "linkTarget": "step", - "linkLabel": "✳️ Authenticated Received Chain", - "style": "link" - }, - { - "id": "43972d55-2e0c-4660-ac09-91459af1713e", - "cellValue": "Data Loss Prevention_E", - "linkTarget": "step", - "linkLabel": "✳️ Data Loss Prevention", - "style": "link" - }, - { - "id": "d7f5b5ba-5ccc-4043-b403-f046b15a853e", - "cellValue": "DMARC for Incoming Email", - "linkTarget": "step", - "linkLabel": "✳️ DMARC for Incoming Email", - "style": "link" - }, - { - "id": "42784042-f170-4520-bf7f-8f765ca54584", - "cellValue": "DMARC for Outgoing Email", - "linkTarget": "step", - "linkLabel": "✳️ DMARC for Outgoing Email", - "style": "link" - }, - { - "id": "50c50837-7378-419f-b5ab-60a4f50a8e3c", - "cellValue": "Encryption for Email Transmission", - "linkTarget": "step", - "linkLabel": "✳️ Encryption for Email Transmission", - "style": "link" - }, - { - "id": "8ea80e97-f1f8-4f1f-9be1-85f5b2974254", - "cellValue": "Malicious URL Protections", - "linkTarget": "step", - "linkLabel": "✳️ Malicious URL Protections", - "style": "link" - }, - { - "id": "1247fbc5-40c8-4326-8e9d-dc7dc6387e65", - "cellValue": "URL Click-Through Protection", - "linkTarget": "step", - "linkLabel": "✳️ URL Click-Through Protection", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Email Capabilities" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Anti-Phishing Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAnti-phishing protections detect instances of phishing and prevent users from accessing them.\r\n\r\n### Microsoft References \r\n💡 [Anti-Phishing Protection in Microsoft 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection)
\r\n💡 [Configure Anti-Phishing Policies in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/configure-atp-anti-phishing-policies)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent)✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AT, PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProductName contains \"Office 365 Advanced Threat Protection\"\r\n| distinct AlertName, ProductName, Status, AlertLink, Tactics, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", - "size": 0, - "title": "Security Alerts: Phishing", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "3", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "uninitialized", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >" - } - }, - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Severity", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "==", - "thresholdValue": "High", - "representation": "red", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Medium", - "representation": "orange", - "text": "{0}{1}" - }, - { - "operator": "==", - "thresholdValue": "Low", - "representation": "yellow", - "text": "{0}{1}" - }, - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UPN", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "IncidentUrl", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Incident >" - }, - "numberFormat": { - "unit": 0, - "options": { - "style": "decimal" - } - } - }, - { - "columnMatch": "count_", - "formatter": 8, - "formatOptions": { - "palette": "blue" - } - }, - { - "columnMatch": "city_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blue", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "state_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "colors", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "SigninStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "blue" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } - }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "green" - } - }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "Location", - "latitude": "SourceIPLocation", - "longitude": "SourceIPLocation", - "sizeSettings": "Location", - "sizeAggregation": "Count", - "legendMetric": "Location", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "Location", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "blueDark" - } - ] - } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Anti-Phishing Protections", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Anti-SPAM Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAnti-SPAM protections detect and quarantine instances of SPAM.\r\n\r\n### Microsoft Reference \r\n💡 [Anti-Spam protection in Exchange Online Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/anti-spam-protection)
\r\n💡 [Configure Anti-Spam Policies in Exchange Online Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/configure-your-spam-filter-policies)
\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| extend Spam = tostring(parse_json(ConfidenceLevel).Spam)\r\n| where Spam <> \"Skipped\"\r\n| where Spam <> \"Not spam\"\r\n| project Spam, RecipientEmailAddress, DeliveryAction, EmailDirection, ConfidenceLevel, DetectionMethods, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Spam Email Actions", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Anti-SPAM Protections", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Authenticated Received Chain](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAuthenticated Received Chain allows for an intermediary, like a mailing list or forwarding service, to sign its own authentication of the original email, allowing downstream entities to accept the intermediary’s authentication even if the email was changed.\r\n\r\n### Microsoft References \r\n💡 [How Microsoft 365 Utilizes Authenticated Received Chain (ARC)](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-utilizes-authenticated-received-chain-arc)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where Entities contains \"Fail\"\r\n| project AlertName, AlertLink, ProductName, Entities, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Review Security Alerts for DMARC, SPF, DKIM Validations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >>" - } - }, - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Authenticated Received Chain", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Microsoft Reference \r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n💡 [Configure and View Alerts for DLP Polices](https://docs.microsoft.com/microsoft-365/compliance/dlp-configure-view-alerts-policies)
\r\n💡 [How DLP Works Between the Security & Compliance Center and Exchange Admin Centers](https://docs.microsoft.com/microsoft-365/compliance/how-dlp-works-between-admin-centers)
\r\n💡 [Email Entity Page](https://docs.microsoft.com/microsoft-365/security/office-365-security/mdo-email-entity-page)
\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 3, - "content": { - "version": "KqlItem/1.0", - "query": "InformationProtectionLogs_CL\r\n| where ApplicationName_s == \"Outlook Web\" or ApplicationName_s contains \"exchange\"\r\n| project UserId_s, ApplicationName_s, LabelName_s, Activity_s, Operation_s, TimeGenerated\r\n", - "size": 0, - "showAnalytics": true, - "title": "Email Data Loss Prevention", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "UserId_s", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - }, - { - "type": 1, - "content": { - "json": "### ✳️ [Azure Information Protection: Email Classifications & Labeling](https://azure.microsoft.com/services/information-protection/)\r\n![Image Name](https://docs.microsoft.com/azure/information-protection/media/recipients-only-label2.png)\r\n" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Data Loss Prevention_E", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [DMARC for Incoming Email](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDMARC protections authenticate incoming email according to the DMARC email authentication protocol defined in RFC 7489.\r\n\r\n### Microsoft References \r\n💡 [Use DMARC to Validate Email](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email)
\r\n💡 [How Microsoft 365 Handles Inbound Emails that Fail DMARC](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-handles-inbound-email-that-fails-dmarc)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.IP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" + { + "version": "KqlParameterItem/1.0", + "name": "isStrongVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Strong", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "232d115f-5a82-4a70-aa2d-12fb00993230" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isTimeVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Time", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "da3d19be-b7ed-4449-83ea-c9a001f54315" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isVulnerabilityVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Vulnerability", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "5e32dd42-2359-4ed6-a5e9-303873a50442" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "customWidth": "10", + "name": "Hidden Parameters Selectors - Copy" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where Entities contains \"Fail\" and Entities contains \"inbound\"\r\n| project AlertName, AlertLink, ProductName, Entities, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Inbound DMARC Failures", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Patch Management\\\", \\\"tab\\\": \\\"Patch\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Auditing and Accounting\\\", \\\"tab\\\": \\\"Auditing\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Resilience\\\", \\\"tab\\\": \\\"Resilience\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Enterprise Threat Intelligence\\\", \\\"tab\\\": \\\"Enterprise\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Situational Awareness\\\", \\\"tab\\\": \\\"Situational\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Dynamic Threat Discovery\\\", \\\"tab\\\": \\\"Dynamic\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Policy Enforcement Parity\\\", \\\"tab\\\": \\\"Policy\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Effective Use of Shared Services\\\", \\\"tab\\\": \\\"Effective\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Integrated Desktop, Mobile, and Remote Policies\\\", \\\"tab\\\": \\\"Integrated\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] + "columnMatch": "tab", + "formatter": 5 + } + ] + } + }, + "customWidth": "40", + "name": "query - 8 - Copy", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "2dc83cdc-c5e9-4ea7-a986-0294effc2e8e", + "version": "KqlParameterItem/1.0", + "name": "isPatchVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Patch", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isAuditingVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Auditing", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] + "id": "be23e804-75f9-486d-8478-8af0ed3b0b6d" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isResilienceVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Resilience", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >>" + "id": "41d2063e-0f2b-47dc-9c7c-2cdcdafb80ec" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isEnterpriseVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Enterprise", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" - } - ] + "id": "b2752897-08eb-4f06-adae-d7e0b278acef" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isSituationalVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Situational", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] + "id": "0531d0e3-8eb9-4c7f-bedb-d29aed642c1b" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDynamicVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Dynamic", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] + "id": "ee837eb2-25bb-4a51-bdd7-5d58640fb780" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isPolicyVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Policy", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + "id": "683d9906-de4f-400f-b92e-8f6d5f346db7" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isEffectiveVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Effective", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "DMARC for Incoming Email", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [DMARC for Outgoing Email](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDMARC protections facilitate the authentication of outgoing email by signing the emails and ensuring that external parties may validate the email signatures. The DMARC email authentication protocol is defined in RFC7489.\r\n\r\n### Microsoft References \r\n💡 [Use DMARC to Validate Email](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email)
\r\n💡 [How Microsoft 365 Handles Inbound Emails that Fail DMARC](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-handles-inbound-email-that-fails-dmarc)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.IP](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "6e5570df-f9fa-4ce9-b79c-74068100c9c6" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isIntegratedVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Integrated", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "e7db70e6-eafa-4cb0-ac08-58719fad7c33" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "customWidth": "10", + "name": "Hidden Parameters Selectors - Copy - Copy" }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where Entities contains \"Fail\" and Entities contains \"outbound\"\r\n| project AlertName, AlertLink, ProductName, Entities, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Outbound DMARC Failures", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Backup and Recovery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nKeeping copies of configuration and data, as needed, to allow for the quick restoration of service in the event of malicious incidents, system failures, or corruption.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Backup](https://azure.microsoft.com/services/backup/)\r\n\r\n### Implementation \r\n💡 [What is the Azure Backup Service?](https://docs.microsoft.com/azure/backup/backup-overview)
\r\n💡 [Review Your Security Recommendations](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n💡 [Configure Recovery Service Vaults](https://docs.microsoft.com/azure/backup/backup-azure-recovery-services-vault-overview)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n\r\n### Microsoft Portals\r\n🔀 [Backup Vaults](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\r\n🔀 [Recovery Services Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.RecoveryServices%2Fvaults)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.BE, PR.IP, PR.DS, RS.MI, RC.RP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 0" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "Text Group" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"back\" or RecommendationDisplayName contains \"recover\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >>" + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"recover\" or type contains \"restore\" or type contains \"back\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Backup & Recovery Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true } }, - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"back\" or Description contains \"restore\" or Description contains \"recover\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"back\" or Description contains \"restore\" or Description contains \"recover\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"back\" or Description contains \"restore\" or Description contains \"recover\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "DMARC for Outgoing Email", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Encryption for Email Transmission](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEmail services are configured to use encrypted connections, when possible, for communications between clients and other email servers.\r\n\r\n### Microsoft References \r\n💡 [Email Encryption](https://docs.microsoft.com/microsoft-365/compliance/ome)
\r\n💡 [How Exchange Online Uses TLS to Secure Email Connections](https://docs.microsoft.com/microsoft-365/compliance/exchange-online-uses-tls-to-secure-email-connections)
\r\n💡 [Define Mail Flow Rules to Encrypt Email Messages](https://docs.microsoft.com/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email)
\r\n💡 [Setup New Message Encryption Capabilities](https://docs.microsoft.com/microsoft-365/compliance/set-up-new-message-encryption-capabilities)
\r\n💡 [Define Mail Flow Rules to Encrypt Email Messages](https://docs.microsoft.com/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email)
\r\n💡 [Manage Office 365 Message Encryption](https://docs.microsoft.com/microsoft-365/compliance/manage-office-365-message-encryption)
\r\n\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
🔀[Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.DS](https://www.nist.gov/cyberframework)" + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEmailVisible", + "parameterName": "isBackupVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Backup and Recovery", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationDisplayName contains \"encrypt\"\r\n| summarize count() by RecommendationDisplayName, AssessedResourceId, RecommendationLink\r\n| sort by count_ desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Workload Encryption Recommendations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Central Log Management & Analysis](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCollecting, storing, and analyzing telemetry, where the collection and storage are designed to facilitate data fusion and the security analysis aids in discovery and response to malicious activity.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) 🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Monitor](https://azure.microsoft.com/services/monitor/)\r\n\r\n### Microsoft Reference \r\n💡 [Create Diagnostic Settings to Send Platform Logs and Metrics to Different Destinations](https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [What is Azure Lighthouse?](https://docs.microsoft.com/azure/lighthouse/overview)
\r\n\t\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔄 [Azure Monitor](https://portal.azure.com/#blade/Microsoft_Azure_Monitoring/AzureMonitoringBrowseBlade/overview)
\r\n🔀 [Azure Lighthouse](https://portal.azure.com/#blade/Microsoft_Azure_CustomerHub/LighthouseBlade)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.PT, DE.AE, RS.AN](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"log\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >>" - } - }, - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type == \"microsoft.operationalinsights/workspaces\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Logging Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true } }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "union withsource=_TableName *\r\n| summarize Entries = count(), Size = sum(_BilledSize), last_log = datetime_diff(\"second\",now(), max(TimeGenerated)), estimate = sumif(_BilledSize, _IsBillable==true) by _TableName, _IsBillable\r\n| project ['Table Name'] = _TableName, ['Table Size'] = Size, ['Table Entries'] = Entries,\r\n ['Size per Entry'] = 1.0 * Size / Entries, ['IsBillable'] = _IsBillable\r\n| order by ['Table Size'] desc", + "size": 0, + "showAnalytics": true, + "title": "Log Table Management", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" + "columnMatch": "Table Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "uninitialized", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Table Size", + "formatter": 8, + "formatOptions": { + "palette": "purple" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Table Entries", + "formatter": 8, + "formatOptions": { + "palette": "turquoise" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "Size per Entry", + "formatter": 8, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 2, + "options": { + "style": "decimal", + "useGrouping": false + } + } + }, + { + "columnMatch": "IsBillable", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "True", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "False", + "representation": "success", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Important", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_thresholds_IsBillable_4", + "sortOrder": 2 } ] + }, + "sortBy": [ + { + "itemKey": "$gen_thresholds_IsBillable_4", + "sortOrder": 2 + } + ], + "tileSettings": { + "titleContent": { + "columnMatch": "DataType", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "showBorder": false } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 5", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Encryption for Email Transmission", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Malicious URL Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMalicious URL protections detect malicious URLs in emails and prevent users from accessing them.\r\n\r\n### Microsoft References \r\n💡 [Safe Links in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-links)
\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEmailVisible", + "parameterName": "isCentralVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Central Log Management with Analysis", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "EmailEvents\r\n| where DetectionMethods contains \"url\"\r\n| join (EmailUrlInfo) on NetworkMessageId\r\n| project RecipientEmailAddress, DeliveryAction, Url, UrlDomain, EmailDirection, ConfidenceLevel, DetectionMethods, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n\r\n", - "size": 0, - "showAnalytics": true, - "title": "SafeLinks Email Protections", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Configuration Management](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nImplementing a formal plan for documenting, managing changes to the environment, and monitoring for deviations, preferably automated.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation \r\n💡 [Enable Change Tracking and Inventory From an Automation Account](https://docs.microsoft.com/azure/automation/change-tracking/enable-from-automation-account)
\r\n💡 [Ensure Your Endpoints Are Configured Properly](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines)
\r\n💡 [Secure Score in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/secure-score-security-controls)
\r\n\r\n### Microsoft Portals\r\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\r\n🔄 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.BE, PR.DS, PR.IP, PR.MA](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "DeliveryAction", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"config\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "4", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Url", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"config\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"config\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"config\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs\r\n| summarize count() by OperationName\r\n| where OperationName <> \"Other\"\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Review Audit Logs", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } + "customWidth": "50", + "name": "query - 4" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEmailVisible", + "parameterName": "isConfigurationVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Configuration Management", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Malicious URL Protections", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [URL Click-Through Protection](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nURL click-through protections ensure that when a URL from an email is clicked, the requester is directed to a protection that verifies the security of the URL destination before permitting access.\r\n\r\n### Microsoft References \r\n💡 [Safe Links in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-links)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Incident Response Plan and Incident Handling](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDocumenting and implementing a set of instructions, procedures, or technical capabilities to sense and detect, respond to, limit consequences of malicious cyber attacks, and restore the integrity of the network and associated systems.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) \r\n\r\n### Implementation \r\n💡 [Quickstart: Tutorial: Investigate incidents with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-investigate-cases)
\r\n\r\n### Microsoft Portals\r\n🔄 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.GV, ID.RA, PR.IP, DE.DP, DE.AE, RS.RP, RS.CO, RS.AN, RS.MI](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "title": "Security Incidents", + "items": [ + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| where Status == \"New\" or Status == \"Active\"\n| where Severity == \"High\"\n| summarize count()\n\n\n\n", + "size": 4, + "title": "High", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Description", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "60%" + } + }, + { + "columnMatch": "name", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "5%" + } + }, + { + "columnMatch": "severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Critical", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Major", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": null, + "text": "{0}{1}" + } + ], + "customColumnWidthSetting": "5" + } + }, + { + "columnMatch": "message", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "70%" + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "redBright" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + } + }, + "customWidth": "25", + "name": "query - 10" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| where Status == \"New\" or Status == \"Active\"\n| where Severity == \"Medium\"\n| summarize count()\n\n\n\n", + "size": 4, + "title": "Medium ", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Description", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "60%" + } + }, + { + "columnMatch": "name", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "5%" + } + }, + { + "columnMatch": "severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Critical", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Major", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": null, + "text": "{0}{1}" + } + ], + "customColumnWidthSetting": "5" + } + }, + { + "columnMatch": "message", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "70%" + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "orange" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + } + }, + "customWidth": "25", + "name": "query - 10 - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| where Status == \"New\" or Status == \"Active\"\n| where Severity == \"Low\"\n| summarize count()\n\n\n\n", + "size": 4, + "title": "Low", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Description", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "60%" + } + }, + { + "columnMatch": "name", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "5%" + } + }, + { + "columnMatch": "severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Critical", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Major", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": null, + "text": "{0}{1}" + } + ], + "customColumnWidthSetting": "5" + } + }, + { + "columnMatch": "message", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "70%" + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "yellow" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + } + }, + "customWidth": "25", + "name": "query - 10 - Copy - Copy" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| where Status == \"New\" or Status == \"Active\"\n| where dayofyear(TimeGenerated) == dayofyear(now())\n| summarize count()\n\n\n", + "size": 4, + "title": "New Today", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Description", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "60%" + } + }, + { + "columnMatch": "name", + "formatter": 0, + "formatOptions": { + "customColumnWidthSetting": "5%" + } + }, + { + "columnMatch": "severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Critical", + "representation": "critical", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Major", + "representation": "2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": null, + "text": "{0}{1}" + } + ], + "customColumnWidthSetting": "5" + } + }, + { + "columnMatch": "message", + "formatter": 7, + "formatOptions": { + "linkTarget": "CellDetails", + "linkIsContextBlade": true, + "customColumnWidthSetting": "70%" + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "min": 0, + "palette": "blueDark" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "showBorder": false, + "size": "auto" + } + }, + "customWidth": "25", + "name": "query - 10" + } + ] + }, + "customWidth": "50", + "name": "Incidents" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| summarize arg_max(LastModifiedTime,*) by IncidentNumber\r\n| where Status == \"Closed\"\r\n| extend TimeToRespond = (CreatedTime - FirstActivityTime)/1h \r\n| extend TimeToResolve = (ClosedTime - CreatedTime)/1h\r\n| extend AssignedAnalyst = tostring(Owner.assignedTo)\r\n| extend [\"MITRE ATT&CK Tactics\"] = tostring(parse_json(tostring(AdditionalData.tactics))[0])\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| project IncidentName=Title, IncidentNumber, Severity, IncidentUrl, [\"MITRE ATT&CK Tactics\"], AssignedAnalyst, Classification, ClassificationComment, ClassificationReason, Description, TimeToRespond, TimeToResolve, IncidentStartTime=CreatedTime, IncidentClosedTime=ClosedTime, IncidentBlade\r\n| sort by IncidentClosedTime desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Closure Reports", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "IncidentName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "TimeToRespond", + "formatter": 0, + "numberFormat": { + "unit": 27, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "TimeToResolve", + "formatter": 0, + "numberFormat": { + "unit": 27, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + }, + "sortBy": [], + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 100, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + } + } + }, + "name": "query - 9 - Copy" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEmailVisible", + "parameterName": "isIncidentVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Incident Response Plan and Incident Handling", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where DisplayName contains \"URL\"\r\n| summarize count() by AlertName, ProductName\r\n| sort by count_ desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Email URL Protections", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Inventory](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDeveloping, documenting, and maintaining a current inventory of all systems, networks, and components so that only authorized endpoints are given access, and unauthorized and un-managed endpoints are found and prevented from gaining access.\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Resource Graph](https://azure.microsoft.com/features/resource-graph/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [DeviceRegistryEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/deviceregistryevents) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### Implementation \r\n💡 [Explore and Manage Your Resources With Asset Inventory](https://docs.microsoft.com/azure/security-center/asset-inventory)
\r\n💡 [View Installed Software](https://docs.microsoft.com/azure/automation/automation-tutorial-installed-software#view-installed-software)
\r\n💡 [What is Azure Resource Graph?](https://docs.microsoft.com/azure/governance/resource-graph/overview)
\r\n\t\r\n### Microsoft Portals\r\n🔄 [Azure Resource Graph Explorer](https://portal.azure.com/#blade/HubsExtension/ArgQueryBlade)
\r\n🔄 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔄 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.IP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| extend Azure_Inventory=location\r\n| extend M365_Inventory=strcat(\"https://security.microsoft.com/machines\")\r\n| project AssetID=id,AssetType=type, Azure_Inventory, M365_Inventory\r\n| sort by AssetType desc\r\n| limit 2500", + "size": 0, + "showAnalytics": true, + "title": "Review Asset Inventory", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" + "columnMatch": "Azure_Inventory", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Azure Inventory >>", + "bladeOpenContext": { + "bladeName": "InventoryBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "", + "source": "static", + "value": "25" + } + ] + } + } + }, + { + "columnMatch": "M365_Inventory", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "M365 Inventory >>" + } } - ] + ], + "rowLimit": 2500, + "filter": true } }, - { - "columnMatch": "ProductName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "where type contains \"microsoft\"\r\n| project id,type,location,resourceGroup\r\n| summarize count() by location\r\n", + "size": 0, + "showAnalytics": true, + "title": "Assets by Location", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "piechart", + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "pending", - "text": "{0}{1}" + "columnMatch": "location", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Globe", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Computer", + "formatter": 16, + "formatOptions": { + "showIcon": true + } } - ] + ], + "filter": true } }, - { - "columnMatch": "AlertLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Alert >>" - } + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" }, - { - "columnMatch": "Spam", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| project id,type,location,resourceGroup\r\n| summarize count() by type\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Asset Count by Type", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Mail", - "text": "{0}{1}" + "columnMatch": "type", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "ResourceFlat", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "Computer", + "formatter": 16, + "formatOptions": { + "showIcon": true + } } - ] + ], + "filter": true } }, - { - "columnMatch": "RecipientEmailAddress", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 8", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| summarize count() by ResourceDisplayName\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Application Inventory & Access", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "ThreatTypes", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "DeviceRegistryEvents \r\n| summarize arg_max(TimeGenerated, *) by InitiatingProcessFileName, DeviceName\r\n| summarize count() by InitiatingProcessFileName\r\n| where InitiatingProcessFileName <> \"\"\r\n| sort by count_ desc\r\n\r\n", + "size": 0, + "showAnalytics": true, + "title": "Software Inventory by Initiating Process", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } - } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEmailVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "URL Click-Through Protection", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Web](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nWeb-based protections including break/inspect, active content mitigation, certificate blacklisting/consensus, content filtering, authenticated proxy, data loss prevention, DNS-over-HTTPS filtering, RFC compliance enforcement, domain category filtering, domain reputation filtering, bandwidth control, malicious content filtering, and access control." - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Web Capabilities Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "02e1e8dc-ada0-4398-a18e-ee6a27a4398c", - "cellValue": "Break and Inspect", - "linkTarget": "step", - "linkLabel": "✳️ Break and Inspect", - "style": "link" - }, - { - "id": "73c46479-2507-480d-81c2-59b8eb2dde4c", - "cellValue": "Active Content Mitigation", - "linkTarget": "step", - "linkLabel": "✳️ Active Content Mitigation", - "style": "link" - }, - { - "id": "899e3919-5a81-48ad-9fe1-2b30ea75e063", - "cellValue": "Certificate Denylisting", - "linkTarget": "step", - "linkLabel": "✳️ Certificate Denylisting", - "style": "link" - }, - { - "id": "134c9530-0a39-49e3-af06-57a55a4405a2", - "cellValue": "Content Filtering", - "linkTarget": "step", - "linkLabel": "✳️ Content Filtering", - "style": "link" - }, - { - "id": "654216c3-dd72-4350-936e-fbddc7403bfe", - "cellValue": "Authenticated Proxy", - "linkTarget": "step", - "linkLabel": "✳️ Authenticated Proxy", - "style": "link" - }, - { - "id": "53b5caf3-9696-403b-9aba-501f81f28a78", - "cellValue": "Data Loss Prevention_W", - "linkTarget": "step", - "linkLabel": "✳️ Data Loss Prevention", - "style": "link" - }, - { - "id": "1399dbe0-3ec8-4aca-a6f2-159076019a67", - "cellValue": "DNS-over-HTTPS Filtering", - "linkTarget": "step", - "linkLabel": "✳️ DNS-over-HTTPS Filtering", - "style": "link" - }, - { - "id": "4c24ab6e-8548-40ad-8e13-6f57a9216e8f", - "cellValue": "RFC Compliance Enforcement", - "linkTarget": "step", - "linkLabel": "✳️ RFC Compliance Enforcement", - "style": "link" - }, - { - "id": "3330274e-62a3-4080-818e-e69976148766", - "cellValue": "Domain Category Filtering", - "linkTarget": "step", - "linkLabel": "✳️ Domain Category Filtering", - "style": "link" - }, - { - "id": "281a70fe-cc00-4620-acad-fa927c48575b", - "cellValue": "Domain Reputation Filter", - "linkTarget": "step", - "linkLabel": "✳️ Domain Reputation Filter", - "style": "link" - }, - { - "id": "8089a515-f341-40d7-9826-4d88a34f5f93", - "cellValue": "Bandwidth Control", - "linkTarget": "step", - "linkLabel": "✳️ Bandwidth Control", - "style": "link" - }, - { - "id": "a3175efa-dcda-4782-b216-e9bbdc6a8903", - "cellValue": "Malicious Content Filtering", - "linkTarget": "step", - "linkLabel": "✳️ Malicious Content Filtering", - "style": "link" - }, - { - "id": "421a85e7-424d-4bbb-8c60-cda8e43ba959", - "cellValue": "Access Control_W", - "linkTarget": "step", - "linkLabel": "✳️ Access Control", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Web Selector" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Break and Inspect](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nBreak-and-Inspect systems, or encryption proxies, terminate encrypted traffic, logging or performing policy enforcement against the plaintext, and re-encrypting the traffic, if applicable, before transmitting to the final destination.\r\n\r\n### Microsoft References \r\n💡 [Azure Firewall Premium Features](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n💡 [Inspect Traffic with Azure Firewall](https://docs.microsoft.com/azure/private-link/inspect-traffic-with-azure-firewall)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Firewall Premium](https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" + "customWidth": "50", + "name": "query - 3 - Copy" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isInventoryVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Inventory", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "Resources\r\n| where type contains \"microsoft.network/azurefirewalls\"\r\n| extend ResourceGroup = substring(id, 0, indexof(id, '/providers'))\r\n| extend ipConfigurations = properties.ipConfigurations\r\n| extend FirewallSKU = tostring(properties.sku.tier)\r\n| extend ThreatIntelMode = tostring(properties.threatIntelMode)\r\n| extend DNSConfig = properties.additionalProperties\r\n| mv-expand bagexpansion=array ipConfigurations\r\n| extend PIPid = tostring(ipConfigurations.properties.publicIPAddress.id)\r\n| join ( Resources | where type=='microsoft.network/publicipaddresses' | extend PublicIPAddress=tostring(properties.ipAddress) | project PIPid=id,PublicIPAddress ) on PIPid\r\n| extend PrivateIP = tostring(ipConfigurations.properties.privateIPAddress)\r\n| extend PrivateIPAllocation = tostring(ipConfigurations.properties.privateIPAllocationMethod)\r\n| extend SubnetId = ipConfigurations.properties.subnet.id\r\n| project-away kind, managedBy, plan, sku, properties, identity, zones, extendedLocation, ipConfigurations, PIPid, PIPid1, tags, tenantId, name, resourceGroup", - "size": 0, - "showAnalytics": true, - "title": "Azure Firewalls", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "type", - "formatter": 16, - "formatOptions": { - "linkTarget": "Resource", - "showIcon": true - } - }, - { - "columnMatch": "location", - "formatter": 17 + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Least Privilege](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDesigning the security architecture such that each entity is granted the minimum system resources and authorizations that the entity needs to perform its function.\r\n\r\n### Recommended Logs\r\n🔷 [IdentityInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/identityinfo) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### Implementation \r\n💡 [Administrator roles by admin task in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/delegate-by-task)
\r\n💡 [Overview of role-based access control in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/custom-overview)
\r\n💡 [Azure Active Directory Sign-In Activity](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-all-sign-ins)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.IP, PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "subscriptionId", - "formatter": 15, - "formatOptions": { - "linkTarget": null, - "showIcon": true + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"identity\" or RecommendationDisplayName contains \"privilege\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true } }, - { - "columnMatch": "ResourceGroup", - "formatter": 14, - "formatOptions": { - "linkTarget": null, - "showIcon": true + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| project UserPrincipalName, SignInCount=count_, UserProfile, LastSignIn, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Review Valid Accounts", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "SignInCount", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "UserProfile", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "AAD User Profile >>", + "bladeOpenContext": { + "bladeName": "UserDetailsMenuBlade", + "extensionName": "Microsoft_AAD_IAM", + "bladeParameters": [ + { + "name": "userId", + "source": "column", + "value": "UserId" + } + ] + } + } + }, + { + "columnMatch": "UserId", + "formatter": 5 + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "yellowOrangeRed" + } + } + ], + "filter": true + }, + "sortBy": [], + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 100, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + } } }, - { - "columnMatch": "SubnetId", - "formatter": 13, - "formatOptions": { - "linkTarget": "Resource", - "showIcon": true + "customWidth": "50", + "name": "query - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "IdentityInfo\r\n| extend GroupMemberships = strcat(GroupMembership)\r\n| extend AssignedRoles_ = strcat(AssignedRoles)\r\n| extend UserPrincipalName = MailAddress\r\n| where MailAddress <> \"\"\r\n| distinct UserPrincipalName, GroupMemberships, AssignedRoles_\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Assigned Roles & Group Memberships", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "User", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Activities", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true } - } - ], - "filter": true, - "labelSettings": [ - { - "columnId": "id", - "label": "Name" - }, - { - "columnId": "type", - "label": "Type" - }, - { - "columnId": "location", - "label": "Region" - }, - { - "columnId": "subscriptionId", - "label": "Subscription" - }, - { - "columnId": "ResourceGroup", - "label": "Resource Group" - }, - { - "columnId": "FirewallSKU", - "label": "Firewall SKU" - }, - { - "columnId": "ThreatIntelMode", - "label": "Threat Intel Mode" - }, - { - "columnId": "DNSConfig", - "label": "DNS Config" }, - { - "columnId": "PublicIPAddress", - "label": "Public IP Address" - }, - { - "columnId": "PrivateIP", - "label": "Private IP" - }, - { - "columnId": "PrivateIPAllocation", - "label": "Private IP Allocation" + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" }, - { - "columnId": "SubnetId", - "label": "Subnet" + "name": "query - 4", + "styleSettings": { + "maxWidth": "50" } - ] - }, - "sortBy": [] + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isLeastVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "AzureFirewalls" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Break and Inspect", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + "name": "Least Privilege", + "styleSettings": { + "showBorder": true + } + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Active Content Mitigation](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nActive content mitigation protections detect the presence of unapproved active content and facilitate its removal.\r\n\r\n### Microsoft References \r\n💡[What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
\r\n💡[Azure Web Application Firewall on Azure Front Door](https://docs.microsoft.com/azure/web-application-firewall/afds/afds-overview)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Secure Administration](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nPerforming administrative tasks in a secure manner, using secure protocols.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation\r\n💡 [Delegate Administration in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/concept-delegation)
\r\n💡 [Start Using Privileged Identity Management](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-getting-started#)
 \r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Privileged Identity Management](https://portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.MA](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"admin\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"admin\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"admin\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"admin\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AuditLogs\r\n| where OperationName contains \"PIM\"\r\n| extend InitiatedBy = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)\r\n| distinct OperationName, Identity, AADOperationType, InitiatedBy, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Privileged Identity Management", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "OperationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Identity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "InitiatedBy", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "PersonWithFriend", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "" + } + }, + { + "columnMatch": "ComplianceDomain", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "yellowOrangeRed" + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_thresholds_InitiatedBy_3", + "sortOrder": 2 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_thresholds_InitiatedBy_3", + "sortOrder": 2 + } + ], + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 100, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + } + } + }, + "customWidth": "50", + "name": "query - 9" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isSecureVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Secure Administration", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "let FakeData = (datatable (Message: string, ruleName_s: string, clientIp_s: string, clientIP_s: string, action_s: string, transactionId_s: string, trackingReference_s: string) [\"\", \"\", \"\", \"\", \"\", \"\", \"\"]);\r\nFakeData\r\n| union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"Application Gateway\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"Application Gateway\" contains \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"Application Gateway\" contains \"azure front door\") or (ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"Application Gateway\" contains \"cdn\")) and (\"SOC-NS-AG-WAFV2 - 1129440\" == \"All\" or Resource in ('SOC-NS-AG-WAFV2'))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '*' == Action or '*' == \"*\" \r\n| where '*' == requestUri_s or '*' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule contains \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \", 1), \"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule contains \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule, \"):\", 1)), \"\"), Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Azure WAF Events", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Rule", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Strong Authentication](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nVerifying the identity of users, endpoints, or other entities through rigorous means (e.g. multi-factor authentication) before granting access.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Plan an Azure AD Multi-Factor Authentication Deployment](https://docs.microsoft.com/azure/active-directory/authentication/howto)
\r\n💡 [How it works: Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/active-directory/authentication/concept-mfa-howitworks)
\r\n💡 [Remediate recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-remediate-recommendations)
\r\n💡 [SecretManagement and Accessing Linux VMs in Azure](https://techcommunity.microsoft.com/t5/itops-talk-blog/secretmanagement-and-accessing-linux-vms-in-azure/ba-p/2278735)
\r\n💡 [Eliminate Password-Based Attacks on Azure Linux VMs](https://techcommunity.microsoft.com/t5/azure-security-center/eliminate-password-based-attacks-on-azure-linux-vms/ba-p/2271139)
\r\n💡 [Quickstart: Create a Key Vault Using the Azure Portal](https://techcommunity.microsoft.com/t5/itops-talk-blog/secretmanagement-and-accessing-linux-vms-in-azure/ba-p/2278735)
\r\n\t\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔄 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"authentication\" or RecommendationDisplayName contains \"JIT\" or RecommendationDisplayName contains \"password\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, { - "operator": "Default", - "thresholdValue": null, - "representation": "warning", - "text": "{0}{1}" + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redDark" + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"authentication\" or Description contains \"password\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"authentication\" or Description contains \"password\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"authentication\" or Description contains \"password\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| where Title contains \"auth\" or Title contains \"password\" or Title contains \"login\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Authentication Attacks", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true } + }, + "customWidth": "50", + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Active Content Mitigation", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Certificate Denylisting](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCertificate denylisting protections prevent communication with entities that use a set of known bad certificates.\r\n\r\n### Microsoft References\r\n💡 [Certificates Used by Azure Firewall Premium](https://docs.microsoft.com/azure/firewall/premium-certificates)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Quickstart: Create a Key Vault using the Azure Portal](https://docs.microsoft.com/azure/key-vault/general/quick-create-portal)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isStrongVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": " Strong Authentication", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"key\" or type contains \"firewall\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Leverage Azure Firewall & Key Vault Assets for Certificate Enforcement", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Time Synchronization](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCoordinating clocks on all systems (e.g. servers, workstations, network endpoints) to enable accurate comparison of timestamps between systems.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Time Sync for Windows VMs in Azure](https://docs.microsoft.com/azure/virtual-machines/windows/time-sync)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Portal](https://portal.azure.com/)
\r\n🔀 [Virtual Machines](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.IP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Time Synchronization" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"time\" or Description contains \"sync\" or Description contains \"ntp\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"time\" or Description contains \"sync\" or Description contains \"ntp\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"time\" or Description contains \"sync\" or Description contains \"ntp\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description !contains \"runtime\"\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isTimeVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 2", + "name": "Time Synchronization", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Certificate Denylisting", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Content Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nContent filtering protections detect the presence of unapproved content and facilitate its removal or denial of access.\r\n\r\n### Microsoft References\r\n💡 [Azure Firewall Web Categories](https://docs.microsoft.com/azure/firewall/web-categories)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Web Content Filtering](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/web-content-filtering)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM, DE.DP](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Vulnerability Management](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nProactively working to discover vulnerabilities, including the use of both active and passive means of discovery, and taking action to mitigate discovered vulnerabilities.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) 🔷 [SecurityBaseline](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [Secure Score in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/secure-score-security-controls)
\r\n💡 [Microsoft Defender for Cloud's Integrated Vulnerability Assessment Solution for Azure and Hybrid Machine](https://docs.microsoft.com/azure/security-center/built-in-vulnerability-assessment)
\r\n💡 [Threat and Vulnerability Management Walk-Through](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Defender: Threat & Vulnerability Management](https://security.microsoft.com/tvm_dashboard)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, PR.IP, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"vuln\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityBaseline\r\n| where CceId <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by ResourceId, CceId\r\n|project CceId, RuleSeverity, Description, ResourceId\r\n|limit 2500", + "size": 0, + "showAnalytics": true, + "title": "Vulnerability Management", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "CceId", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Defense Evasion", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RuleSeverity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Resource", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + } + ], + "rowLimit": 2500, + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 4", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityBaseline\r\n| where CceId <> \"\"\r\n| summarize arg_max(TimeGenerated, *) by Resource, CceId\r\n| summarize count() by ResourceId\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Vulnerability Count by Asset", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Resource", + "formatter": 13, + "formatOptions": { + "linkTarget": "Resource", + "showIcon": true + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "CceId", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Defense Evasion", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RuleSeverity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 4", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isVulnerabilityVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Vulnerability Management", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "let materializedData =\r\n materialize(\r\n AzureDiagnostics\r\n | where Category == \"AzureFirewallApplicationRule\"\r\n | project msg_s, Resource, TimeGenerated);\r\nunion\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s !has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \"TLS extension was missing\"\r\n | where msg_s has \" Reason:\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"TLS extension was missing\"\r\n and msg_s !has \"No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | where msg_s has \"Rule Collection Group\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n )\r\n| summarize Count = count(), last_log = datetime_diff(\"second\", now(), max(TimeGenerated)) by RuleCollection, Rule, WebCategory", - "size": 1, - "showAnalytics": true, - "title": "Azure Firewall: Content Enforcement", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "noDataMessageStyle": 2, - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Count", - "formatter": 8, - "formatOptions": { - "palette": "whiteBlack" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumSignificantDigits": 4 + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Patch Management](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentifying, acquiring, installing, and verifying patches for products and systems.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Update Management Overview](https://docs.microsoft.com/azure/automation/update-management/overview)
\r\n💡 [Enable Update Management From the Azure Portal](https://docs.microsoft.com/azure/automation/update-management/enable-from-portal)
\r\n💡 [Handling Planned Maintenance Notifications Using the Azure Portal](https://docs.microsoft.com/azure/virtual-machines/maintenance-notifications-portal)
\r\n💡 [Managing Platform Updates with Maintenance Control](https://docs.microsoft.com/azure/virtual-machines/maintenance-control?toc=/azure/virtual-machines/linux/toc.json&bc=/azure/virtual-machines/linux/breadcrumb/toc.json)
\r\n💡 [Scheduling Maintenance Updates with Maintenance Control and Azure Functions](https://github.com/Azure/azure-docs-powershell-samples/tree/master/maintenance-auto-scheduler)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n\r\n### Microsoft Portals\r\n🔀 [Automation Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Automation%2FAutomationAccounts)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.IP, PR.MA](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"update\" or RecommendationDisplayName contains \"upgrade\" or RecommendationDisplayName contains \"version\" or RecommendationDisplayName contains \"patch\" or RecommendationDisplayName contains \"java\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true } }, - { - "columnMatch": "last_log", - "formatter": 8, - "formatOptions": { - "palette": "greenRed" - }, - "numberFormat": { - "unit": 24, - "options": { - "style": "decimal", - "useGrouping": false - } - } - } - ], - "filter": true, - "sortBy": [ - { - "itemKey": "$gen_heatmap_last_log_4", - "sortOrder": 1 + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } - ] - }, - "sortBy": [ - { - "itemKey": "$gen_heatmap_last_log_4", - "sortOrder": 1 } ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isPatchVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 36" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Content Filtering", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + "name": "Patch Management", + "styleSettings": { + "showBorder": true + } + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Authenticated Proxy](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAuthenticated proxies require entities to authenticate with the proxy before making use of it, enabling user, group, and location-aware security controls.\r\n\r\n### Microsoft References \r\n💡 [Plan an Azure AD Application Proxy Deployment](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy-deployment-plan)
\r\n💡 [Configure Real-Time Application Access Monitoring with Microsoft Defender for Cloud Apps and Azure Active Directory](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy-integrate-with-microsoft-cloud-application-security)
\r\n💡 [Protect Apps with Microsoft Defender for Cloud Apps Conditional Access App Control](https://docs.microsoft.com/cloud-app-security/proxy-intro-aad)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud Apps Portal](https://portal.cloudappsecurity.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Auditing and Accounting](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCapturing business records, including logs and other telemetry, and making them available for auditing and accounting as required. Design of the auditing system should take insider threat into consideration, including separation of duties violation tracking, such that insider abuse or misuse can be detected.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Usage](https://docs.microsoft.com/azure/azure-monitor/reference/tables/usage) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n\r\n### Implementation \r\n💡 [Create Diagnostic Settings to Send Platform Logs and Metrics to Different Destinations](https://docs.microsoft.com/azure/azure-monitor/platform/diagnostic-settings)
\r\n💡 [Tutorial: Grant a User Access to Azure Resources Using the Azure Portal](https://docs.microsoft.com/azure/role-based-access-control/quickstart-assign-role-user-portal)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [Auditing Microsoft Sentinel Activities](https://techcommunity.microsoft.com/t5/azure-sentinel/auditing-azure-sentinel-activities/ba-p/1718328)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST CSF Mapping\r\n[ID.SC, PR.AC, PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"audit\" or RecommendationDisplayName contains \"account\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"audit\" or Description contains \"log\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"audit\" or Description contains \"log\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"audit\" or Description contains \"log\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Usage\r\n| summarize count() by DataType\r\n| sort by count_ desc\r\n| limit 100", + "size": 0, + "showAnalytics": true, + "title": "Log Events by Type", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "gridSettings": { + "filter": true + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "DataType", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "count_", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "rowLimit": 100 + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isAuditingVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Auditing and Accounting", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"MCAS\"\r\n| summarize count() by AlertName\r\n| sort by count_ desc\r\n| limit 250", - "size": 1, - "showAnalytics": true, - "title": "Microsoft Defender for Cloud Apps: Cloud App Security Brokering", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Resilience](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEnsuring that systems, services, and protections maintain acceptable performance under adverse conditions.\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) 🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure DDoS Protection]( https://azure.microsoft.com/services/ddos-protection/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [DDoS Protection Plans](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans)
\r\n🔀 [Availability Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FavailabilitySets)
\r\n🔀 [Load Balancing](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n🔀 [Virtual Machine Scale Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Compute%2FvirtualMachineScaleSets)
\r\n\r\n### Implementation \r\n💡 [Azure DDoS Protection Standard Overview](https://docs.microsoft.com/azure/ddos-protection/ddos-protection-overview)
\r\n💡 [Building Solutions for High Availability Using Availability Zones](https://docs.microsoft.com/azure/architecture/high-availability/building-solutions-for-high-availability)
 \r\n💡 [Azure Infrastructure Availability](https://docs.microsoft.com/azure/security/fundamentals/infrastructure-availability)
 \r\n💡 [What is Azure Load Balancer?](https://docs.microsoft.com/azure/load-balancer/load-balancer-overview)
\r\n💡 [What are virtual machine scale sets?](https://docs.microsoft.com/azure/virtual-machine-scale-sets/overview)
 \r\n\r\n### NIST CSF Mapping\r\n[ID.BE, PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"balance\" or RecommendationDisplayName contains \"denial\" or RecommendationDisplayName contains \"recover\" or RecommendationDisplayName contains \"back\" or RecommendationDisplayName contains \"scale\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true + }, + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "green" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "latitude": "SourceIPLocation", + "longitude": "SourceIPLocation", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blueDark" + } + ] + } } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"dos\"or type contains \"balance\" or type contains \"recover\" or type contains \"back\" or type contains \"scale\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Resilience Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true } }, - { - "columnMatch": "Count", - "formatter": 8, - "formatOptions": { - "palette": "whiteBlack" + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where Category == \"DDoSMitigationReports\"\r\n| sort by TimeGenerated desc\r\n| extend TopAttackVector = tostring(parse_json(AttackVectors_s)[0]) \r\n| extend Total_packets_ = tostring(parse_json(TrafficOverview_s).Total_packets) \r\n| extend Total_packets_dropped_ = todouble(parse_json(TrafficOverview_s).Total_packets_dropped)\r\n| extend TotalPackets =todouble(Total_packets_)\r\n| where TotalPackets > 0\r\n| where TopAttackVector <> \"\"\r\n| project TopAttackVector, TotalPackets, TotalPacketsDropped = Total_packets_dropped_ , ResourceId , SourceIP=IPAddress, Resource, TimeGenerated\r\n| sort by TotalPacketsDropped desc\r\n| limit 100\r\n\r\n", + "size": 0, + "showAnalytics": true, + "title": "Denial of Service Attacks Observed", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 0 }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumSignificantDigits": 4 + "timeContextFromParameter": "TimeRange", + "exportedParameters": [ + { + "fieldName": "IPAddress", + "parameterName": "IPAddress", + "parameterType": 1 + }, + { + "fieldName": "ResourceId", + "parameterName": "ResourceId", + "parameterType": 1, + "defaultValue": "ResourceId" + }, + { + "fieldName": "Resource", + "parameterName": "AttackReport", + "parameterType": 1, + "defaultValue": "/" } - } - }, - { - "columnMatch": "last_log", - "formatter": 8, - "formatOptions": { - "palette": "greenRed" + ], + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "TopAttackVector", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "TotalPackets", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "TotalPacketsDropped", + "formatter": 4, + "formatOptions": { + "palette": "green" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "Resource", + "formatter": 5 + }, + { + "columnMatch": "Total_packets_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "Total_packets_dropped_", + "formatter": 4, + "formatOptions": { + "palette": "green" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + } + ], + "filter": true }, - "numberFormat": { - "unit": 24, - "options": { - "style": "decimal", - "useGrouping": false - } + "tileSettings": { + "titleContent": { + "columnMatch": "IPAddress", + "formatter": 12, + "formatOptions": { + "palette": "auto" + } + }, + "subtitleContent": { + "columnMatch": "TopAttackVector", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Resource" + }, + "rightContent": { + "columnMatch": "TimeGenerated" + }, + "showBorder": true, + "size": "auto" } - } - ], - "filter": true - }, - "sortBy": [] + }, + "customWidth": "50", + "name": "query - 4" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isResilienceVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 36" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Authenticated Proxy", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + "name": "Resilience", + "styleSettings": { + "showBorder": true + } + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Microsoft References \r\n💡 [Microsoft Defender for Cloud Apps: File Policies](https://docs.microsoft.com/cloud-app-security/data-protection-policies)
\r\n💡 [Content Inspection for Protected Files](https://docs.microsoft.com/cloud-app-security/content-inspection)
\r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)\r\n ✳️ [Azure Defender](https://azure.microsoft.com/services/azure-defender/)\r\n✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender) ✳️ [Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Defender for Identity Portal](https://portal.atp.azure.com/)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for Cloud Apps Portal](https://portal.cloudappsecurity.com/)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Enterprise Threat Intelligence](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nObtaining threat intelligence from private and government sources and implementing mitigation for the identified risks.\r\n\r\n### Recommended Logs\r\n🔷 [ThreatIntelligenceIndicator](https://docs.microsoft.com/azure/azure-monitor/reference/tables/threatintelligenceindicator) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) 🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)\r\n\r\n### Implementation \r\n💡 [Connect Data from Threat Intelligence Providers](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence)
\r\n💡 [Microsoft Security Intelligence Portal](https://www.microsoft.com/wdsi)
\r\n💡 [Microsoft Graph Security tiIndicators API](https://docs.microsoft.com/graph/api/resources/tiindicator)
\r\n💡 [MSTIC Jupyter and Python Security Tools](https://github.com/Microsoft/msticpy)
\r\n💡 [Use Jupyter Notebook to Hunt for Security Threats](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence)
\r\n\t\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender Security Intelligence Portal](https://microsoft.com/wdsi)
\r\n🔀 [MSTICpy](https://github.com/Microsoft/msticpy)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "ThreatIntelligenceIndicator\r\n| summarize arg_max(TimeGenerated, *) by IndicatorId\r\n| summarize CountOfIndicators = count() by SourceSystem\r\n| order by CountOfIndicators desc \r\n| render barchart kind=unstacked", + "size": 0, + "showAnalytics": true, + "title": "Cyber Threat Intelligence Indicator Counts", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| where Description contains \"intel\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Threat Intelligence", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where Tactics <> \"\"\r\n| where Tactics <> \"Unknown\"\r\n| summarize arg_max(TimeGenerated, *) by SystemAlertId\r\n| summarize count() by Tactics\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Security Alerts by MITRE ATT&CK Tactics Observed", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Tactics", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Defense Evasion", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "yellowOrangeRed" + } + }, + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3 - Copy" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isEnterpriseVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Enterprise Threat Intelligence", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where Tactics contains \"exfil\"\r\n| summarize count() by AlertName, ProductName, Tactics\r\n| sort by count_ desc\r\n| limit 250", - "size": 1, - "showAnalytics": true, - "title": "Web Data Loss Prevention Alerts", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Situational Awareness](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMaintaining effective awareness, both current and historical, across all components.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Get Visibility Into Alerts](https://docs.microsoft.com/azure/sentinel/quickstart-get-visibility)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, ID.RA, PR.DS, PR.IP, DE.AE, DE.CM, DE.DP, RS.CO](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| summarize count() by ProductName\r\n| sort by count_ desc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Security Alerts By Product", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "uninitialized", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" }, - { - "columnMatch": "Count", - "formatter": 8, - "formatOptions": { - "palette": "whiteBlack" + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where isnotempty(ProviderName)\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by ProductName\r\n| render timechart \r\n", + "size": 0, + "showAnalytics": true, + "title": "Security Alerts Over Time", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumSignificantDigits": 4 - } + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "uninitialized", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true } }, - { - "columnMatch": "last_log", - "formatter": 8, - "formatOptions": { - "palette": "greenRed" - }, - "numberFormat": { - "unit": 24, - "options": { - "style": "decimal", - "useGrouping": false - } - } - } - ], - "filter": true - }, - "sortBy": [] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 36" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Data Loss Prevention_W", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [DNS-over-HTTPS Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNS-over-HTTPS filtering prevents entities from using the DNS-over-HTTPS protocol, possibly evading DNS-based protections.\r\n\r\n### Microsoft References \r\n💡 [Web Content Filtering](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isSituationalVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Situational Awareness", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"MDATP\"\r\n| where AlertName contains \"URL\" or AlertName contains \"web\" or AlertName contains \"indicator\" or Description contains \"URL\" or AlertType contains \"NetworkProtectionBlocked\"\r\n| summarize count() by AlertName\r\n| sort by count_ desc\r\n| limit 250", - "size": 1, - "showAnalytics": true, - "title": "Mitigate DNS-over-HTTPS with Agent-Based Web Filters such as Microft Defender for Endpoint: Web Content Filtering", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Dynamic Threat Discovery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nUsing dynamic approaches (e.g. heuristics, baselining, etc.) to discover new malicious activity\r\n\r\n### Recommended Logs\r\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) 🔷 [SecurityIncident](https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Advanced Multistage Attack Detection in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/fusion)
\r\n💡 [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\r\n💡 [Heuristic Detections in Microsoft Defender for Cloud](https://azure.microsoft.com/blog/heuristic-dns-detections-in-azure-security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"defender\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + ], + "filter": true } }, - { - "columnMatch": "Count", - "formatter": 8, - "formatOptions": { - "palette": "whiteBlack" + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let AnomalousSigninActivity = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where (UsersInsights.NewAccount == True or UsersInsights.DormantAccount == True) and (\r\n ActivityInsights.FirstTimeUserAccessedResource == True and ActivityInsights.ResourceUncommonlyAccessedAmongPeers == True\r\n or ActivityInsights.FirstTimeUserUsedApp == True and ActivityInsights.AppUncommonlyUsedAmongPeers == False)\r\n | join (\r\n SigninLogs | where Status.errorCode == 0 or Status.errorCode == 0 and RiskDetail != \"none\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Successful Sign-in with one or more of the following indications: sign by new or recently dormant accounts and sign in with resource for the first time (while none of their peers did) or to an app for the first time (while none of their peers did) or performed by a user with Risk indication from AAD\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet critical = dynamic(['9b895d92-2cd3-44c7-9d02-a6ac2d5ea5c3', 'c4e39bd9-1100-46d3-8c65-fb160da0071f', '158c047a-c907-4556-b7ef-446551a6b5f7', '62e90394-69f5-4237-9190-012177145e10', 'd29b2b05-8046-44ba-8758-1e26182fcf32', '729827e3-9c14-49f7-bb1b-9608f156bbb8', '966707d0-3269-4727-9be2-8c3a10f19b9d', '194ae4cb-b126-40b2-bd5b-6091b380977d', 'fe930be7-5e62-47db-91af-98c3a49a38b1']);\r\nlet high = dynamic(['cf1c38e5-3621-4004-a7cb-879624dced7c', '7495fdc4-34c4-4d15-a289-98788ce399fd', 'aaf43236-0c0d-4d5f-883a-6955382ac081', '3edaf663-341e-4475-9f94-5c398ef6c070', '7698a772-787b-4ac8-901f-60d6b08affd2', 'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9', '9f06204d-73c1-4d4c-880a-6edb90606fd8', '29232cdf-9323-42fd-ade2-1d097af3e4de', 'be2f45a1-457d-42af-a067-6ec1fa63bc45', '7be44c8a-adaf-4e2a-84d6-ab2649e08a13', 'e8611ab8-c189-46e8-94e1-60213ab1f814']);//\r\nlet AnomalousRoleAssignment = AuditLogs\r\n | where TimeGenerated > ago(28d)\r\n | where OperationName == \"Add member to role\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = tostring(TargetResources.userPrincipalName)\r\n | join kind=inner (\r\n BehaviorAnalytics\r\n | where ActionType == \"Add member to role\"\r\n | where UsersInsights.BlastRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend AnomalyName = \"Anomalous Role Assignment\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing Add member to privileged role, or ones that add users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let LogOns=materialize(\r\n BehaviorAnalytics\r\n | where ActivityType == \"LogOn\");\r\nlet AnomalousResourceAccess = LogOns\r\n | where ActionType == \"ResourceAccess\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous Resource Access\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversary may be trying to move through the environment. APT29 and APT32, for example, has used PtH & PtT techniques to lateral move around the network. The query below generates an output of all users performing an resource access (4624:3) to devices for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousRDPActivity = LogOns\r\n | where ActionType == \"RemoteInteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | extend AnomalyName = \"Anomalous RDP Activity\",\r\n Tactic = \"Lateral Movement\",\r\n Technique = \"\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. FIN10, for example, has used RDP to move laterally to systems in the victim environment. The query below generates an output of all users performing a remote interactive logon (4624:10) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousLogintoDevices = LogOns\r\n | where ActionType == \"InteractiveLogon\"\r\n | where ActivityInsights.FirstTimeUserLoggedOnToDevice == true\r\n | where UsersInsights.DormantAccount == true or DevicesInsights.LocalAdmin == true\r\n | extend AnomalyName = \"Anomalous Login To Devices\",\r\n Tactic = \"Privilege Escalation\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below generates an output of all administrator users performing an interactive logon (4624:2) to a device for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousPasswordReset = BehaviorAnalytics\r\n | where ActionType == \"Reset user password\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == \"True\"\r\n | join (\r\n AuditLogs\r\n | where OperationName == \"Reset user password\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Password Reset\",\r\n Tactic = \"Impact\",\r\n Technique = \"Account Access Removal\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. LockerGoga, for example, has been observed changing account passwords and logging off current users. The query below generates an output of all users performing Reset user password for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalousGeoLocationLogon = BehaviorAnalytics\r\n | where ActionType == \"Sign-in\"\r\n | where ActivityInsights.FirstTimeUserConnectedFromCountry == True and (ActivityInsights.FirstTimeConnectionFromCountryObservedInTenant == True or ActivityInsights.CountryUncommonlyConnectedFromAmongPeers == True)\r\n | join (\r\n SigninLogs\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Successful Logon\",\r\n Tactic = \"Initial Access\",\r\n Technique = \"Valid Accounts\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may steal the credentials of a specific user or service account using Credential Access techniques or capture credentials earlier in their reconnaissance process through social engineering for means of gaining Initial Access. APT33, for example, has used valid accounts for initial access. The query below generates an output of successful Sign-in performed by a user from a new geo location he has never connected from before, and none of his peers as well.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousFailedLogon = BehaviorAnalytics\r\n | where ActivityType == \"LogOn\"\r\n | where UsersInsights.BlastRadius == \"High\"\r\n | join (\r\n SigninLogs \r\n | where Status.errorCode == 50126\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Failed Logon\",\r\n Tactic = \"Credential Access\",\r\n Technique = \"Brute Force\",\r\n SubTechnique = \"Password Guessing\",\r\n Description = \"Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts. Emotet, for example, has been observed using a hard coded list of passwords to brute force user accounts. The query below generates an output of all users with 'High' BlastRadius that perform failed Sign-in:Invalid username or password.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"Evidence\"]=ActivityInsights, ResourceDisplayName, AppDisplayName, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; \r\nlet AnomalousAADAccountManipulation = AuditLogs\r\n | where OperationName == \"Update user\"\r\n | mv-expand AdditionalDetails\r\n | where AdditionalDetails.key == \"UserPrincipalName\"\r\n | mv-expand TargetResources\r\n | extend RoleId = tostring(TargetResources.modifiedProperties[0].newValue)\r\n | where isnotempty(RoleId) and RoleId in (critical, high)\r\n | extend RoleName = tostring(TargetResources.modifiedProperties[1].newValue)\r\n | where isnotempty(RoleName)\r\n | extend TargetId = tostring(TargetResources.id)\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | join kind=inner ( \r\n BehaviorAnalytics\r\n | where ActionType == \"Update user\"\r\n | where UsersInsights.BlastRadius == \"High\" or ActivityInsights.FirstTimeUserPerformedAction == true\r\n )\r\n on $left._ItemId == $right.SourceRecordId\r\n | extend UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName) \r\n | extend AnomalyName = \"Anomalous Account Manipulation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Account Manipulation\",\r\n SubTechnique = \"\",\r\n Description = \"Adversaries may manipulate accounts to maintain access to victim systems. These actions include adding new accounts to high privileged groups. Dragonfly 2.0, for example, added newly created accounts to the administrators group to maintain elevated access. The query below generates an output of all high Blast Radius users performing 'Update user' (name change) to privileged role, or ones that changed users for the first time.\"\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, RoleName, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority; let AnomalousAADAccountCreation = BehaviorAnalytics\r\n | where ActionType == \"Add user\"\r\n | where ActivityInsights.FirstTimeUserPerformedAction == True or ActivityInsights.FirstTimeActionPerformedInTenant == True or ActivityInsights.ActionUncommonlyPerformedAmongPeers == true\r\n | join(\r\n AuditLogs\r\n | where OperationName == \"Add user\"\r\n )\r\n on $left.SourceRecordId == $right._ItemId\r\n | mv-expand TargetResources\r\n | extend Target = iff(tostring(TargetResources.userPrincipalName) contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(TargetResources.userPrincipalName, \"#\")[0])), TargetResources.userPrincipalName), tostring(TargetResources.userPrincipalName)\r\n | extend DisplayName = tostring(UsersInsights.AccountDisplayName),\r\n UserPrincipalName = iff(UserPrincipalName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserPrincipalName),\r\n UserName = iff(UserName contains \"#EXT#\", replace(\"_\", \"@\", tostring(split(UserPrincipalName, \"#\")[0])), UserName)\r\n | extend AnomalyName = \"Anomalous Account Creation\",\r\n Tactic = \"Persistence\",\r\n Technique = \"Create Account\",\r\n SubTechnique = \"Cloud Account\",\r\n Description = \"Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system. The query below generates an output of all the users performing user creation for the first time and the target users that were created.\"\t\r\n | project TimeGenerated, AnomalyName, Tactic, Technique, SubTechnique, Description, UserName, UserPrincipalName, UsersInsights, ActivityType, ActionType, [\"TargetUser\"]=Target, [\"Evidence\"]=ActivityInsights, SourceIPAddress, SourceIPLocation, SourceDevice, DevicesInsights, [\"Anomaly Score\"]=InvestigationPriority\r\n | sort by TimeGenerated desc;\r\nlet AnomalyTable = union kind=outer AnomalousSigninActivity, AnomalousRoleAssignment, AnomalousResourceAccess, AnomalousRDPActivity, AnomalousPasswordReset, AnomalousLogintoDevices, AnomalousGeoLocationLogon, AnomalousAADAccountManipulation, AnomalousAADAccountCreation, AnomalousFailedLogon;\r\nlet TopUsersByAnomalies = AnomalyTable\r\n | summarize hint.strategy = shuffle AnomalyCount=count() by UserName, UserPrincipalName, tostring(UsersInsights.OnPremSid), tostring(UsersInsights.AccountObjectId)\r\n | project Name=tolower(UserName), UPN=tolower(UserPrincipalName), AadUserId=UsersInsights_AccountObjectId, Sid=UsersInsights_OnPremSid, AnomalyCount\r\n | sort by AnomalyCount desc;\r\nlet TopUsersByIncidents = SecurityIncident\r\n | summarize hint.strategy = shuffle arg_max(LastModifiedTime, *) by IncidentNumber\r\n | where Status == \"New\" or Status == \"Active\"\r\n | mv-expand AlertIds\r\n | extend AlertId = tostring(AlertIds)\r\n | join kind= innerunique ( \r\n SecurityAlert \r\n )\r\n on $left.AlertId == $right.SystemAlertId\r\n | summarize hint.strategy = shuffle arg_max(TimeGenerated, *), NumberOfUpdates = count() by SystemAlertId\r\n | mv-expand todynamic(Entities)\r\n | where Entities[\"Type\"] =~ \"account\"\r\n | extend Name = tostring(tolower(Entities[\"Name\"])), NTDomain = tostring(Entities[\"NTDomain\"]), UPNSuffix = tostring(Entities[\"UPNSuffix\"]), AadUserId = tostring(Entities[\"AadUserId\"]), AadTenantId = tostring(Entities[\"AadTenantId\"]), \r\n Sid = tostring(Entities[\"Sid\"]), IsDomainJoined = tobool(Entities[\"IsDomainJoined\"]), Host = tostring(Entities[\"Host\"])\r\n | extend UPN = iff(Name != \"\" and UPNSuffix != \"\", strcat(Name, \"@\", UPNSuffix), \"\")\r\n | union TopUsersByAnomalies\r\n | extend \r\n AadPivot = iff(isempty(AadUserId), iff(isempty(Sid), Name, Sid), AadUserId),\r\n SidPivot = iff(isempty(Sid), iff(isempty(AadUserId), Name, AadUserId), Sid),\r\n UPNExists = iff(isempty(UPN), false, true),\r\n NameExists = iff(isempty(Name), false, true),\r\n SidExists = iff(isempty(Sid), false, true),\r\n AADExists = iff(isempty(AadUserId), false, true)\r\n | summarize hint.strategy = shuffle IncidentCount=dcount(IncidentNumber, 4), AlertCount=dcountif(AlertId, isnotempty(AlertId), 4), AnomalyCount=sum(AnomalyCount), any(Title, Severity, Status, StartTime, IncidentNumber, IncidentUrl, Owner), UPNAnchor=anyif(UPN, UPNExists == true), NameAnchor=anyif(Name, NameExists == true), AadAnchor=anyif(AadUserId, AADExists == true), SidAnchor=anyif(Sid, SidExists == true), any(SidPivot) by AadPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), NameAnchor=anyif(NameAnchor, isempty(NameAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_Title, any_Severity, any_StartTime, any_IncidentNumber, any_IncidentUrl) by any_SidPivot\r\n | summarize hint.strategy = shuffle IncidentCount=sum(IncidentCount), AlertCount=sum(AlertCount), AnomalyCount=sum(AnomalyCount), UPNAnchor=anyif(UPNAnchor, isempty(UPNAnchor) == false), AadAnchor=anyif(AadAnchor, isempty(AadAnchor) == false), SidAnchor=anyif(SidAnchor, isempty(SidAnchor) == false), any(any_any_Title, any_any_Severity, any_any_StartTime, any_any_IncidentNumber, any_any_IncidentUrl) by NameAnchor\r\n | project [\"UserName\"]=NameAnchor, IncidentCount, AlertCount, AnomalyCount, [\"AadUserId\"]=AadAnchor, [\"OnPremSid\"]=SidAnchor, [\"UserPrincipalName\"]=UPNAnchor;\r\nTopUsersByIncidents\r\n| where UserPrincipalName !contains \"[\"\r\n| where UserPrincipalName <> \"\"\r\n| project UserPrincipalName, IncidentCount, AlertCount, AnomalyCount\r\n| sort by AlertCount desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "User Entity Behavior Analytics Alerts", + "noDataMessage": "There are no results within the selected thresholds (time, workspace, subscription). See Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel for respective UEBA configurations (https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)", + "timeContext": { + "durationMs": 604800000 }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "useGrouping": false, - "maximumSignificantDigits": 4 - } - } - }, - { - "columnMatch": "last_log", - "formatter": 8, - "formatOptions": { - "palette": "greenRed" + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentCount", + "formatter": 8, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "AlertCount", + "formatter": 8, + "formatOptions": { + "palette": "orange" + } + }, + { + "columnMatch": "AnomalyCount", + "formatter": 8, + "formatOptions": { + "palette": "yellow" + } + } + ], + "filter": true }, - "numberFormat": { - "unit": 24, - "options": { - "style": "decimal", - "useGrouping": false + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "green" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "latitude": "SourceIPLocation", + "longitude": "SourceIPLocation", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blueDark" + } + ] } } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 1", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - }, - "sortBy": [] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 36" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "DNS-over-HTTPS Filtering", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [RFC Compliance Enforcement](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nRFC compliant enforcement technologies ensure that traffic complies with protocol definitions.\r\n\r\n### Microsoft References\r\n💡[What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
\r\n💡[Tutorial: Create an Application Gateway with a Web Application Firewall using the Azure Portal](https://docs.microsoft.com/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Microsoft Portals\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"fusion\" or Title contains \"dynamic\" or Title contains \"anomal\" or Title contains \"behavior\" or Title contains \"learning\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Dynamic Threat Discovery", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isDynamicVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Dynamic Threat Discovery", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics \r\n| where Category == \"ApplicationGatewayFirewallLog\"\r\n| where details_file_s contains \"rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf\"\r\n| summarize count() by ResourceId, Message\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Web Protocol Enforcement Alerts", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Policy Enforcement Parity](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nConsistently applying security protections and other policies, independent of the communication mechanism, forwarding path, or endpoints used.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [What is Azure Policy?](https://docs.microsoft.com/azure/governance/policy/overview)
\r\n💡 [Review your security recommendations](https://docs.microsoft.com/azure/defender-for-cloud/review-security-recommendations)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Policy](https://portal.azure.com/#blade/Microsoft_Azure_Policy/PolicyMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS, PR.IP, PR.MA](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc\r\n| limit 2500", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "rowLimit": 2500, + "filter": true } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 2500", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 2500, + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isPolicyVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Policy Enforcement Parity", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "RFC Compliance Enforcement", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Domain Category Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDomain category filtering technologies allow for classes of domains (e.g. banking, medical) to receive a different set of security protections.\r\n\r\n### Microsoft References \r\n💡 [Azure Firewall: Web Categories](https://docs.microsoft.com/azure/firewall/premium-deploy#web-categories-testing)
\r\n💡 [Use FQDN Filtering in Network Rules](https://docs.microsoft.com/azure/firewall/fqdn-filtering-network-rules)
\r\n💡 [Azure Firewall Premium Features](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)\t
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Effective Use of Shared Services](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEmploying shared services, where applicable, that can be individually tailored, measured to independently validate service conformance, and offer effective protections for tenants against malicious actors, both external as well as internal to the service provider.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation \r\n💡 [Get Started with Azure Lighthouse](https://azure.microsoft.com/services/azure-lighthouse/)
\r\n💡 [Customer Lockbox for Microsoft Azure](https://docs.microsoft.com/azure/security/fundamentals/customer-lockbox-overview)
\r\n💡 [What are External Identities in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/external-identities/compare-with-b2c)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Lighthouse](https://portal.azure.com/#blade/Microsoft_Azure_CustomerHub/LighthouseBlade)
\r\n🔀 [Customer Lockbox for Microsoft Azure](https://portal.azure.com/#blade/Microsoft_Azure_Lockbox/LockboxMenu/Overview)
\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, ID.GV, ID.RM, ID.SC, PR.AT, RS.CO](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"guest\" or RecommendationDisplayName contains \"shared\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| where UserType == \"Guest\"\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, UserType, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserProfile, UserId\r\n| join (LastObserved) on UserPrincipalName\r\n| project UserPrincipalName, UserType, SignInCount=count_, UserProfile, LastSignIn, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Review Guest Accounts", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "SignInCount", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "UserProfile", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "AAD User Profile >>", + "bladeOpenContext": { + "bladeName": "UserDetailsMenuBlade", + "extensionName": "Microsoft_AAD_IAM", + "bladeParameters": [ + { + "name": "userId", + "source": "column", + "value": "UserId" + } + ] + } + } + }, + { + "columnMatch": "UserId", + "formatter": 5 + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "yellowOrangeRed" + } + } + ], + "filter": true + }, + "sortBy": [], + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 100, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + } + } + }, + "customWidth": "50", + "name": "query - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"shared\" or Description contains \"guest\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"shared\" or Description contains \"guest\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"shared\" or Description contains \"guest\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| where Description !contains \"not shared\"\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isEffectiveVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Effective Use of Shared Services", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "let materializedData =\r\n materialize(\r\n AzureDiagnostics\r\n | where Category == \"AzureFirewallApplicationRule\"\r\n | project msg_s, Resource, TimeGenerated);\r\nunion\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s !has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \"TLS extension was missing\"\r\n | where msg_s has \" Reason:\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"TLS extension was missing\"\r\n and msg_s !has \"No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | where msg_s has \"Rule Collection Group\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n )\r\n| where Action == \"Deny\"\r\n| where '*' == SourceIP or '*' == \"*\" \r\n| summarize count() by FQDN\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Domain & Category Filtering", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "FQDN", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Integrated Desktop, Mobile, and Remote Policies](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDefining polices such that they apply to a given agency entity no matter its location.\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation \r\n💡 [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
\r\n💡 [What are Common Ways to Use Conditional Access with Intune?](https://docs.microsoft.com/mem/intune/protect/conditional-access-intune-common-ways-use)
 \r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Endpoint Manager Admin Center](https://devicemanagement.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.IP, PR.MA](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| extend DeviceOS = tostring(DeviceDetail.operatingSystem)\r\n| summarize count() by DeviceOS\r\n| where DeviceOS <> \"\"\r\n| sort by count_ desc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Policy Application by Operating System", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Diagnostics", - "text": "{0}{1}" + "columnMatch": "ConditionalAccessPolicy", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + "customWidth": "50", + "name": "query - 9 - Copy", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where ResultType == 0", + "size": 0, + "showAnalytics": true, + "title": "Sign-Ins By Location", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "map", + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "labelSettings": "Location", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "greenRed" + } + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUniversalSecurityCapabilitiesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| mv-expand ConditionalAccessPolicies\r\n| extend ConditionalAccessPolicy = tostring(ConditionalAccessPolicies.displayName)\r\n| summarize count() by ConditionalAccessPolicy\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Conditional Access Policies", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "ConditionalAccessPolicy", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isIntegratedVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Integrated Desktop, Mobile, and Remote Policies", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isUniversalSecurityCapabilitiesVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "Domain Category Filtering", - "styleSettings": { - "showBorder": true - } + "name": "UniversalSecurityCapabilities" }, { "type": 12, @@ -8443,117 +9907,57 @@ { "type": 1, "content": { - "json": "# [Domain Reputation Filter](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDomain reputation filtering protections are a form of domain denylisting based on a domain’s reputation, as defined by either the agency or an external entity.\r\n\r\n### Microsoft References \r\n💡 [Azure Firewall Threat Intelligence-Based Filtering](https://docs.microsoft.com/azure/firewall/threat-intel)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" + "json": "# [Files](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nFile-based protections including anti-malware, malicious code removal, content disarm & reconstruction, and detonation chambers.\r\n" }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isFilesVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Files Capabilities Overview" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isFilesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 106" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "let materializedData =\r\nmaterialize(\r\nAzureDiagnostics\r\n| where Category == \"AzureFirewallNetworkRule\"\r\n| where OperationName == \"AzureFirewallThreatIntelLog\"\r\n| where msg_s <> \" request from to . Action: . ThreatIntel: \"\r\n| project msg_s, Resource, TimeGenerated,ResourceId , ResourceGroup , SubscriptionId);\r\nunion\r\n(\r\nmaterializedData\r\n| where msg_s has \"Url\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url: \" Url \". Action: \" Action \". ThreatIntel: \" ThreatIntelMsg\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Url\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". ThreatIntel: \" ThreatIntelMsg\r\n)\r\n| summarize by ThreatIntelMsg, Url, Action, Protocol, SourceIP, SourcePort, FQDN, DestinationPort, TimeGenerated\r\n| where Url <> \"\"\r\n| sort by TimeGenerated desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Azure Firewall: Threat Intelligence URL Blocks", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Anti-Malware\\\", \\\"tab\\\": \\\"Malware\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Content Disarm & Reconstruction\\\", \\\"tab\\\": \\\"Content\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Detonation Chamber\\\", \\\"tab\\\": \\\"Detonation\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Data Loss Prevention\\\", \\\"tab\\\": \\\"Data\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "Url", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Diagnostics", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "Action", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "4", - "text": "{0}{1}" - } - ] - } + "columnMatch": "tab", + "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Domain Reputation Filter", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Bandwidth Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nBandwidth control technologies allow for limiting the amount of bandwidth used by different classes of domains.\r\n\r\n### Microsoft References \r\n💡 [Azure Monitor Metrics Overview](https://docs.microsoft.com/azure/azure-monitor/essentials/data-platform-metrics)
\r\n💡 [Monitor Azure Firewall Logs and Metrics](https://docs.microsoft.com/azure/firewall/firewall-diagnostics) \r\n\r\n### Recommended Logs\r\n🔷 [Metrics](https://docs.microsoft.com/azure/azure-monitor/essentials/data-platform-metrics) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" - }, "customWidth": "40", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Bandwidth Control", + "name": "query - 8", "styleSettings": { - "maxWidth": "40" + "showBorder": true } }, { @@ -8562,385 +9966,1759 @@ "version": "KqlParameterItem/1.0", "parameters": [ { - "id": "5084e141-6c56-4d7f-bd8a-09f7ef9af1bc", + "id": "a206a547-329b-4003-8832-c16daacca6c6", "version": "KqlParameterItem/1.0", - "name": "Resource", - "label": "Azure Firewalls", - "type": 5, - "isRequired": true, - "multiSelect": true, - "quote": "'", - "delimiter": ",", - "query": "where type =~ 'Microsoft.Network/azureFirewalls'\r\n| project id, name", - "crossComponentResources": [ - "value::selected" + "name": "isMalwareVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Malware", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } ], - "value": null, - "typeSettings": { - "additionalResourceOptions": [ - "value::all" - ] + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isContentVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Content", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "1f176b0f-1f2f-4e12-afb0-3f10c834ef24" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDetonationVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Detonation", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "b17f2902-5d29-45b2-8712-bff5b7dd1487" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDataVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Data", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 }, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources" + "id": "793ffbca-13bc-4fac-9535-048cbd9efc54" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, - "customWidth": "20", - "name": "parameters - 1" + "customWidth": "10", + "name": "Hidden Parameters Selectors" }, { - "type": 10, + "type": 12, "content": { - "chartId": "workbook76864ed5-dd34-42d0-ae35-f3db9f9e8f15", - "version": "MetricsItem/2.0", - "size": 0, - "chartType": 2, - "resourceType": "microsoft.network/azurefirewalls", - "metricScope": 0, - "resourceParameter": "Resource", - "resourceIds": [ - "{Resource}" - ], - "timeContextFromParameter": "TimeRange", - "timeContext": { - "durationMs": 7776000000 - }, - "metrics": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ { - "namespace": "microsoft.network/azurefirewalls", - "metric": "microsoft.network/azurefirewalls--Throughput", - "aggregation": 4, - "splitBy": null, - "columnName": "All Firewall Throughput Average" - } - ], - "title": "Average Throughput of Firewall Traffic", - "gridSettings": { - "rowLimit": 10000 - } - }, - "customWidth": "40", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "metric - 25" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Bandwidth Control", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Malicious Content Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMalicious content filtering protections detect the presence of malicious content and facilitate its removal.\r\n\r\n### Microsoft References \r\n💡 [What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
\r\n💡 [Azure Web Application Firewall on Azure Front Door](https://docs.microsoft.com/azure/web-application-firewall/afds/afds-overview)
\r\n💡 [Azure Firewall Premium Features](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS, PR.PT, PR.CM](https://www.nist.gov/cyberframework)" + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Anti-Malware](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAnti-malware protections detect the presence of malicious code and facilitate its quarantine or removal.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)\r\n ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/azure-defender/)\r\n✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender) ✳️ [Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)\r\n\r\n### Implementation\r\n💡 [Microsoft Antimalware Extension for Windows](https://docs.microsoft.com/azure/virtual-machines/extensions/iaas-antimalware-windows)
\r\n💡 [Microsoft Antimalware for Azure Cloud Services and Virtual Machines](https://docs.microsoft.com/azure/security/fundamentals/antimalware)
\r\n💡 [Microsoft Defender for Cloud Apps: Malware Detection](https://docs.microsoft.com/cloud-app-security/anomaly-detection-policy#malware-detection)
\r\n💡 [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Defender for Identity](https://portal.atp.azure.com/)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for Cloud Apps](https://portal.cloudappsecurity.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS, PR.PT, DE.CM, DE.DP, RS.MI](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"endpoint protection\" or RecommendationDisplayName contains \"malware\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| where Description contains \"malware\" or Title contains \"malware\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Malware", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where AlertName contains \"mal\"\r\n| summarize count() by ProductName\r\n| sort by count_ desc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Malware Detected by Product", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Defense Evasion", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isFilesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isMalwareVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Anti-Malware", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "let materializedData =\r\nmaterialize(\r\nAzureDiagnostics\r\n| where ResourceType == \"AZUREFIREWALLS\"\r\n| project Category, ResourceType, OperationName);\r\nunion\r\n(\r\nmaterializedData\r\n | where OperationName == \"AzureFirewallIDSLog\"\r\n | summarize Volume=count() by OperationName\r\n | project Category=OperationName, Volume\r\n),\r\n(\r\nmaterializedData\r\n | where OperationName == \"AzureFirewallThreatIntelLog\"\r\n | summarize Volume=count() by OperationName\r\n | project Category=OperationName, Volume\r\n),\r\n(\r\nmaterializedData\r\n | where OperationName <> \"AzureFirewallThreatIntelLog\"\r\n | where OperationName <> \"AzureFirewallIDSLog\"\r\n | summarize Volume=count() by Category\r\n)\r\n| sort by Volume desc", - "size": 0, - "showAnalytics": true, - "title": "Web Protections by Rule Category", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "noDataMessageStyle": 4, - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "exportFieldName": "Category", - "exportParameterName": "SelectedCategory", - "exportDefaultValue": "*", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "Volume", - "formatter": 4, - "formatOptions": { - "palette": "blue" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Content Disarm & Reconstruction](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nContent disarm and reconstruction technology detects the presence of unapproved active content and facilitates its removal.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [EmailAttachmentInfo](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailattachmentinfo) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)\r\n\r\n### Implementation \r\n💡 [Setup Safe Attachments Policies in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/set-up-atp-safe-attachments-policies)
\r\n💡 [Threat and Vulnerability Management](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt)
\r\n💡 [Microsoft Defender Application Guard overview](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)
\r\n💡 [Create and deploy an Exploit Guard policy](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/create-deploy-exploit-guard-policy)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft Endpoint Manager Admin Center](https://endpoint.microsoft.com/#home)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| where Description contains \"exploit\" or Title contains \"exploit\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Exploits", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true } - } - ], - "filter": true - }, - "tileSettings": { - "showBorder": false, - "titleContent": { - "columnMatch": "Category", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Volume", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "EmailAttachmentInfo\r\n| extend Detection = strcat(DetectionMethods)\r\n| where ThreatTypes <> \"\"\r\n| project RecipientEmailAddress, FileName, ThreatTypes, ThreatNames, Detection, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Safe Attachments: Attachment Mitigation", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isFilesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } } - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 2" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Malicious Content Filtering", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAccess control technologies allow an agency to define policies limiting what actions may be performed by connected users and entities.\r\n\r\n### Microsoft References \r\n💡 [Overview of Role-Based Access Control in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/custom-overview)
\r\n💡 [What is Azure AD Privileged Identity Management?](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure)
\r\n💡 [Secure Your Management Ports With Just-In-Time Access](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AuditLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/auditlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Security Portals, Features, & Admin Centers\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Privileged Identity Management](https://portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)" + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isContentVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Content Disarm & Reconstruction", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationName contains \"just\" or RecommendationName contains \"JIT\"\r\n| summarize count() by AssessedResourceId, RecommendationName, RecommendationLink\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Just in Time Access Recommenations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go To Recommendation >>" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Detonation Chamber](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDetonation chambers facilitate the detection of malicious code through the use of protected and isolated execution environments to analyze the files.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Implementation \r\n💡 [Submit File for Deep Analysis](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts#submit-files-for-deep-analysis)
\r\n💡 [Using the Built-in URL Detonation in Microsoft Sentinel](https://techcommunity.microsoft.com/t5/azure-sentinel/using-the-new-built-in-url-detonation-in-azure-sentinel/ba-p/996229)
\r\n💡 [Safe Links in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-links)
\r\n💡 [Safe Attachments in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-attachments)
\r\n💡 [Microsoft Defender Application Guard overview](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview)
\r\n💡 [Create and deploy an Exploit Guard policy](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/create-deploy-exploit-guard-policy)
\r\n\r\n### Microsoft Portals \r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft Endpoint Manager Admin Center](https://endpoint.microsoft.com/#home)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.CM, DE.DP, RS.AN, RS.MI](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| where Description contains \"detonation\" or Title contains \"detonation\" or Description contains \"sand\" or Title contains \"sand\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Detonation", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "EmailEvents\r\n| where DetectionMethods <>\"\"\r\n| project RecipientEmailAddress, DeliveryAction, DeliveryLocation, EmailDirection, EmailAction, DetectionMethods, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Email Detonation: SafeLinks, SafeAttachments, SafeFiles", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "DeliveryAction", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "EmailDirection", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Outbound", + "representation": "right", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "left", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "EmailAction", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "DetectionMethods", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isFilesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isDetonationVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Detonation Chamber", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "AuditLogs\r\n| where Identity == \"MS-PIM\"\r\n| extend UserPrincipalName = tostring(TargetResources[0].userPrincipalName)\r\n| extend PIM_Role = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))\r\n| where UserPrincipalName <>\"\"\r\n| project UserPrincipalName, OperationName, PIM_Role, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Privileged Identity Management Actions", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "UserPrincipalName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Endpoint]( https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### Implementation \r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n💡 [Hunt for Threats with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/hunting)
\r\n💡 [Learn about Microsoft 365 Endpoint Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about)
\r\n💡 [Configure and View Alerts for DLP Polices](https://docs.microsoft.com/microsoft-365/compliance/dlp-configure-view-alerts-policies)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Description contains \"data\" or Title contains \"data\" or Description contains \"loss\" or Title contains \"loss\" or Description contains \"exfil\" or Title contains \"exfil\" or Tactics contains \"exfil\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Data Loss", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InformationProtectionLogs_CL\r\n| project UserId_s, LabelName_s, Operation_s, Activity_s, IPv4_s, ProtectionOwner_s, ApplicationName_s, ProcessName_s, Platform_s, ContentId_g, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Scan/Monitor for Sensitive Data with Azure Information Protection", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserId_s", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "red", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "blue", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "uninitialized", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Alert >" + } + }, + { + "columnMatch": "UPN", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Incident >" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "count_", + "formatter": 8, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "city_", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blue", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "state_", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blueDark", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true + }, + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "green" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "latitude": "SourceIPLocation", + "longitude": "SourceIPLocation", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blueDark" + } + ] + } + } + }, + "customWidth": "50", + "name": "query - 2" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InformationProtectionLogs_CL\r\n| extend UserPrincipalName = UserId_s_s\r\n| where LabelName_s <> \"\"\r\n| join (SigninLogs) on UserPrincipalName\r\n| extend City = tostring(LocationDetails.city)\r\n| extend State = tostring(LocationDetails.state)\r\n| extend Country_Region = tostring(LocationDetails.countryOrRegion)\r\n", + "size": 3, + "showAnalytics": true, + "title": "Sensitive Data Access by Geolocation", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "map", + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "warning", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "UncommonActionVolume", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "UncommonAction", + "formatter": 4, + "formatOptions": { + "palette": "green" + } + }, + { + "columnMatch": "FirstTimeUserAction", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "FirstTimeDeviceLogon", + "formatter": 4, + "formatOptions": { + "palette": "yellow" + } + }, + { + "columnMatch": "IncidentCount", + "formatter": 8, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "AlertCount", + "formatter": 8, + "formatOptions": { + "palette": "orange" + } + }, + { + "columnMatch": "AnomalyCount", + "formatter": 8, + "formatOptions": { + "palette": "yellow" + } } ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "green" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "yellow" + } + ] + } } - } - ], - "filter": true - } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isFilesVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 12" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isWebVisible", + "parameterName": "isDataVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Data Loss Prevention", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isWebVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Access Control_W", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Networking](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nNetwork-based protections including network access controls, IP denylisting, host containment, network segmentation, and microsegmentation. \r\n" - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Networking Capabilities Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "24c6c093-03b1-48d3-8446-b62c7768ab91", - "cellValue": "Access Control_N", - "linkTarget": "step", - "linkLabel": "✳️ Access Control", - "style": "link" - }, - { - "id": "49076f2b-dc1e-4fc8-8a35-415b2bd20baa", - "cellValue": "IP Denylisting", - "linkTarget": "step", - "linkLabel": "✳️ IP Denylisting", - "style": "link" - }, - { - "id": "36a87896-a2b9-4050-82d5-36891c43b497", - "cellValue": "Host Containment", - "linkTarget": "step", - "linkLabel": "✳️ Host Containment", - "style": "link" - }, - { - "id": "baf36c82-aa55-42e8-88df-60bf3051c347", - "cellValue": "Network Segmentation", - "linkTarget": "step", - "linkLabel": "✳️ Network Segmentation", - "style": "link" - }, - { - "id": "2fcbeaa9-e652-4d47-a07b-0c3b9bc6b266", - "cellValue": "Microsegmentation", - "linkTarget": "step", - "linkLabel": "✳️ Microsegmentation", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isFilesVisible", "comparison": "isEqualTo", "value": "true" }, - "customWidth": "50", - "name": "Networking Capabilities Selector" + "name": "FilesGroup" }, { "type": 12, @@ -8951,677 +11729,2362 @@ { "type": 1, "content": { - "json": "# [Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAccess control protections prevent the ingest, egress, or transiting of unauthorized network traffic.\r\n\r\n### Microsoft References \r\n💡 [Security Recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n💡 [Network Security Groups](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡[Tutorial: Create an Application Gateway with a Web Application Firewall using the Azure Portal](https://docs.microsoft.com/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal)
\r\n💡[Tutorial: Create and Manage a VPN Gateway using Azure Portal]( https://docs.microsoft.com/azure/vpn-gateway/tutorial-create-gateway-portal)
\r\n💡[What is Azure ExpressRoute?](https://docs.microsoft.com/azure/expressroute/expressroute-introduction)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)\r\n✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
🔀 [Virtual Network Gateways](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways)
🔀 [ExpressRoute Circuits](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FexpressRouteCircuits) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, DE.CM](https://www.nist.gov/cyberframework)" + "json": "# [Email](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nEmail-based protections including anti-phishing, anti-spam, authenticated received chain, data loss prevention, DMARC for incoming/outgoing mail, email encryption, and malicious URL protections.\r\n" }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isEmailVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Email Capabilities Help" }, { - "type": 3, + "type": 1, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"network\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Networking Assets", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "json": "" }, - "customWidth": "50", + "customWidth": "60", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isEmailVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "text - 107" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where OperationName == \"NetworkSecurityGroupEvents\"\r\n| summarize count() by ruleName_s\r\n| sort by count_ desc ", - "size": 0, - "showAnalytics": true, - "title": "Network Security Groups: Rules Triggered", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Anti-Phishing Protections\\\", \\\"tab\\\": \\\"Phishing\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Anti-Spam Protections\\\", \\\"tab\\\": \\\"Spam\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Authenticated Received Chain\\\", \\\"tab\\\": \\\"Authenticated\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Data Loss Prevention\\\", \\\"tab\\\": \\\"Data\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"DMARC for Incoming Email\\\", \\\"tab\\\": \\\"Incoming\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } + "columnMatch": "tab", + "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 4", + "customWidth": "40", + "name": "query - 8", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 9, "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where Category contains \"AzureFirewall\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by OperationName\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Network Conrol Actions over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a206a547-329b-4003-8832-c16daacca6c6", + "version": "KqlParameterItem/1.0", + "name": "isPhishingVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Phishing", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isSpamVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Spam", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "5e162b71-5dff-4440-8bd9-111c1ec62efb" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isAuthenticatedVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Authenticated", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "37272499-cf34-4fd3-8f26-5929ea74e783" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDataVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Data", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "2086488a-60de-43a5-a31f-0ae0eca9abd3" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isIncomingVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Incoming", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "e35e9dbc-8e1d-4749-9fe3-6e1b7cc19f2c" + } + ], + "style": "pills", "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 4", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Access Control_N", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [IP Denylisting](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIP denylisting protections prevent the ingest or transiting of traffic received from or destined to a denylisted IP address.\r\n\r\n### Microsoft References \r\n💡 [Connect Data from Threat Intelligence Providers](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence)
\r\n💡 [Azure Firewall Threat Intelligence Configuration](https://docs.microsoft.com/azure/firewall-Manager/threat-intelligence-settings)
\r\n\r\n### Recommended Logs\r\n🔷 [ThreatIntelligenceIndicator](https://docs.microsoft.com/azure/azure-monitor/reference/tables/threatintelligenceindicator) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" + "resourceType": "microsoft.operationalinsights/workspaces" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "customWidth": "10", + "name": "Hidden Parameters Selectors" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ThreatIntelligenceIndicator\r\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \"IP\",\r\n\t iff(isnotempty(Url), \"URL\",\r\n\t iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \"Email\",\r\n\t iff(isnotempty(FileHashValue), \"File\",\r\n\t iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \"Domain\",\r\n\t \"Other\")))))\r\n| where IndicatorType == \"IP\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by IndicatorType\r\n| render areachart", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Sentinel: Threat Intelligence IP Indicators Ingested", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ] - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"DMARC for Outgoing Email\\\", \\\"tab\\\": \\\"Outgoing\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Encryption for Email Transmission\\\", \\\"tab\\\": \\\"Encryption\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Malicious URL Protections\\\", \\\"tab\\\": \\\"Malicious\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"URL Click-Through Protection\\\", \\\"tab\\\": \\\"Url\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } + ], + "queryType": 8, + "gridSettings": { + "formatters": [ + { + "columnMatch": "tab", + "formatter": 5 + } + ] + } }, - "name": "query - 3", + "customWidth": "40", + "name": "query - 8 - Copy", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 9, "content": { - "version": "KqlItem/1.0", - "query": "VMConnection\r\n| extend NetworkSourceIP=RemoteIp\r\n| where NetworkSourceIP <> \"\"\r\n| join (ThreatIntelligenceIndicator) on NetworkSourceIP\r\n| extend Indicator = strcat(NetworkSourceIP, FileHashValue, NetworkIP, NetworkDestinationIP, Url, EmailSourceIpAddress, EmailSenderAddress, DomainName)\r\n| extend Source=SourceSystem1\r\n| summarize count () by ThreatType, Action, Indicator, Direction, _ResourceId, RemoteCountry, RemoteIp, Source\r\n| sort by count_ desc\r\n| limit 250\r\n", - "size": 0, - "showAnalytics": true, - "title": "Threat Intelligence: IP Denylisting", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "table", - "gridSettings": { - "formatters": [ - { - "columnMatch": "ThreatType", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "2", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "RiskIQ_Lookup", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "RiskIQ Lookup >" + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "2477e9e4-bcad-49d6-a4b6-df6672debb7b", + "version": "KqlParameterItem/1.0", + "name": "isOutgoingVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Outgoing", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } - }, - { - "columnMatch": "RemoteCountry", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Globe", - "text": "{0}{1}" - } - ] + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isEncryptionVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Encryption", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "Source", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "View", - "text": "{0}{1}" - } - ] + "id": "1fa8afad-de60-4eb0-8a40-a43bde323bdb" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isMaliciousVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Malicious", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + "id": "125bc4a9-0a88-4bef-80c9-2707fa0e5f74" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isUrlVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Url", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "VirusTotalURL", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "VirusTotal Lookup >" - } - } - ], - "filter": true - }, - "mapSettings": { - "locInfo": "CountryRegion", - "locInfoColumn": "RemoteCountry", - "latitude": "RemoteLatitude", - "longitude": "RemoteLongitude", - "sizeSettings": "RemoteCountry", - "sizeAggregation": "Count", - "labelSettings": "RemoteCountry", - "legendMetric": "RemoteCountry", - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "RemoteIp", - "colorAggregation": "Count", - "type": "thresholds", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "redBright" - } - ] + "id": "e62d359a-891b-4663-9384-b7891d8dc461" } - } - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" }, - "name": "Threat Intelligence: IP Denylisting" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "IP Denylisting", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + "customWidth": "10", + "name": "Hidden Parameters Selectors - Copy" + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Host Containment](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nHost containment protections enable a network to revoke or quarantine a host’s access to the network.\r\n\r\n### Microsoft References \r\n💡 [Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/automation-in-azure-sentinel)
\r\n💡 [How to Isolate an Azure VM Using Microsoft Defender for Cloud’s Workflow Automation](https://techcommunity.microsoft.com/t5/azure-security-center/how-to-isolate-an-azure-vm-using-azure-security-center-s/ba-p/1250985)
\r\n💡 [Isolate Endpoints from the Network](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#isolate-endpoints-from-the-network)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Microsoft Portals \r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, PR.PT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Anti-Phishing Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAnti-phishing protections detect instances of phishing and prevent users from accessing them.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Anti-Phishing Protection in Microsoft 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-protection)
\r\n💡 [Configure Anti-Phishing Policies in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/configure-atp-anti-phishing-policies)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AT, PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"email\" or Title contains \"phish\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Phishing", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isPhishingVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Anti-Phishing Protections", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"logic\"\r\n| where id contains \"block\" or id contains \"isolate\" or id contains \"lock\" or id contains \"revoke\" or id contains \"quarantine\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", - "size": 0, - "showAnalytics": true, - "title": "Containment Automations Configured", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Anti-SPAM Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAnti-SPAM protections detect and quarantine instances of SPAM.\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Reference \r\n💡 [Anti-Spam protection in Exchange Online Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/anti-spam-protection)
\r\n💡 [Configure Anti-Spam Policies in Exchange Online Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/configure-your-spam-filter-policies)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "EmailEvents\r\n| extend Spam = tostring(parse_json(ConfidenceLevel).Spam)\r\n| where Spam <> \"Skipped\"\r\n| where Spam <> \"Not spam\"\r\n| where Spam <> \"\"\r\n| project Spam, RecipientEmailAddress, DeliveryAction, EmailDirection, ConfidenceLevel, DetectionMethods, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Spam Email Actions", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Spam", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Mail", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEmailVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isSpamVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Anti-SPAM Protections", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Host Containment", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Network Segmentation](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nNetwork segmentation separates a given network into subnetworks, facilitating security controls between the subnetworks, and decreasing the attack surface of the network.\r\n\r\n### Microsoft References \r\n💡 [Implement Network Segmentation Patterns on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-segmentation)
\r\n💡 [What is Azure Virtual Network?](https://docs.microsoft.com/azure/virtual-network/virtual-networks-overview)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)\r\n✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Authenticated Received Chain](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAuthenticated Received Chain allows for an intermediary, like a mailing list or forwarding service, to sign its own authentication of the original email, allowing downstream entities to accept the intermediary’s authentication even if the email was changed.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Implementation \r\n💡 [How Microsoft 365 Utilizes Authenticated Received Chain (ARC)](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-utilizes-authenticated-received-chain-arc)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where Entities contains \"Fail\"\r\n| project AlertName, AlertLink, ProductName, Entities, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Review Security Alerts for DMARC, SPF, DKIM Validations", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "AlertName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Alert >>" + } + }, + { + "columnMatch": "Spam", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Mail", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_thresholds_AlertName_0", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_thresholds_AlertName_0", + "sortOrder": 1 + } + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEmailVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isAuthenticatedVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Authenticated Received Chain", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"network\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Networking Assets", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Microsoft References \r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n💡 [Configure and View Alerts for DLP Polices](https://docs.microsoft.com/microsoft-365/compliance/dlp-configure-view-alerts-policies)
\r\n💡 [How DLP Works Between the Security & Compliance Center and Exchange Admin Centers](https://docs.microsoft.com/microsoft-365/compliance/how-dlp-works-between-admin-centers)
\r\n💡 [Email Entity Page](https://docs.microsoft.com/microsoft-365/security/office-365-security/mdo-email-entity-page)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Tactics contains \"exfil\"\r\n| where Title contains \"email\" or Title contains \"phish\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Email Data Loss", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isDataVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Data Loss Prevention", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Network Segmentation", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Microsegmentation](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMicrosegmentation divides the network, either physically or virtually, according to the communication needs of application and data workflows, facilitating security controls to protect the data.\r\n\r\n### Microsoft References \r\n💡 [Network Security & Containment](https://docs.microsoft.com/azure/virtual-network/virtual-networks-overview)
\r\n💡 [What is Azure Virtual Network?](https://docs.microsoft.com/azure/virtual-network/virtual-networks-overview)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Application Security Groups](https://docs.microsoft.com/azure/virtual-network/application-security-groups)
\r\n💡 [Tutorial: Filter Network Traffic with a Network Security Group using the Azure portal](https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic)
\r\n💡 [What is Azure Web Application Firewall?](https://docs.microsoft.com/azure/web-application-firewall/overview)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)\r\n✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)
\r\n✳️ [Application Gateway](https://azure.microsoft.com/services/application-gateway/) \r\n✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\r\n🔀 [Application Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\r\n🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.DS, PR.IP, PR.PT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DMARC for Incoming Email](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDMARC protections authenticate incoming email according to the DMARC email authentication protocol defined in RFC 7489.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Implementation \r\n💡 [Use DMARC to Validate Email](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email)
\r\n💡 [How Microsoft 365 Handles Inbound Emails that Fail DMARC](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-handles-inbound-email-that-fails-dmarc)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.IP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where Entities contains \"Fail\" and Entities contains \"inbound\"\r\n| project AlertName, AlertLink, ProductName, Entities, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Inbound DMARC Failures", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "AlertName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Alert >>" + } + }, + { + "columnMatch": "Spam", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Mail", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEmailVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isIncomingVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "DMARC for Incoming Email", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"networksecuritygroup\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Network Security Groups", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DMARC for Outgoing Email](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDMARC protections facilitate the authentication of outgoing email by signing the emails and ensuring that external parties may validate the email signatures. The DMARC email authentication protocol is defined in RFC7489.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityevent) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Implementation \r\n💡 [Use DMARC to Validate Email](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email)
\r\n💡 [How Microsoft 365 Handles Inbound Emails that Fail DMARC](https://docs.microsoft.com/microsoft-365/security/office-365-security/use-dmarc-to-validate-email#how-microsoft-365-handles-inbound-email-that-fails-dmarc)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.IP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityAlert\r\n| where ProviderName == \"OATP\"\r\n| where Entities contains \"Fail\" and Entities contains \"outbound\"\r\n| project AlertName, AlertLink, ProductName, Entities, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Outbound DMARC Failures", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "AlertName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Alert >>" + } + }, + { + "columnMatch": "Spam", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Mail", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEmailVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isNetworkingVisible", + "parameterName": "isOutgoingVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "DMARC for Outgoing Email", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isNetworkingVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Microsegmentation", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Resiliency](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nResiliency measures including DDoS protections, elastic expansion, and regional delivery.\r\n" - }, - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Resiliency Capabilities Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "e728810c-697f-4b67-a00e-1941c3b84194", - "cellValue": "DDoS Protections", - "linkTarget": "step", - "linkLabel": "✳️ DDoS Protections", - "style": "link" }, { - "id": "38a64817-5a62-418f-8944-041ab50fee2c", - "cellValue": "Elastic Expansion", - "linkTarget": "step", - "linkLabel": "✳️ Elastic Expansion", - "style": "link" + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Encryption for Email Transmission](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEmail services are configured to use encrypted connections, when possible, for communications between clients and other email servers.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Email Encryption](https://docs.microsoft.com/microsoft-365/compliance/ome)
\r\n💡 [How Exchange Online Uses TLS to Secure Email Connections](https://docs.microsoft.com/microsoft-365/compliance/exchange-online-uses-tls-to-secure-email-connections)
\r\n💡 [Define Mail Flow Rules to Encrypt Email Messages](https://docs.microsoft.com/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email)
\r\n💡 [Setup New Message Encryption Capabilities](https://docs.microsoft.com/microsoft-365/compliance/set-up-new-message-encryption-capabilities)
\r\n💡 [Define Mail Flow Rules to Encrypt Email Messages](https://docs.microsoft.com/microsoft-365/compliance/define-mail-flow-rules-to-encrypt-email)
\r\n💡 [Manage Office 365 Message Encryption](https://docs.microsoft.com/microsoft-365/compliance/manage-office-365-message-encryption)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
🔀 [Microsoft 365 Defender](https://security.microsoft.com)
🔀[Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"encrypt\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information.", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "isEncryptionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Encryption for Email Transmission", + "styleSettings": { + "showBorder": true + } }, { - "id": "b984f173-f46a-412d-a835-d4a2f66709b8", - "cellValue": "Regional Delivery", - "linkTarget": "step", - "linkLabel": "✳️ Regional Delivery", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Resiliency Capabilities Selector" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, + "type": 12, "content": { - "json": "# [DDoS Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDDoS protections mitigate the effects of distributed denial of service attacks.\r\n\r\n### Microsoft References \r\n💡 [Azure DDoS Protection Standard Overview](https://docs.microsoft.com/azure/ddos-protection/ddos-protection-overview)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure DDoS Protection]( https://azure.microsoft.com/services/ddos-protection/)
\r\n\r\n### Microsoft Portals\r\n🔀 [DDoS Protection Plans](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Malicious URL Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMalicious URL protections detect malicious URLs in emails and prevent users from accessing them.\r\n\r\n### Recommended Logs\r\n🔷 [EmailEvents](https://docs.microsoft.com/azure/azure-monitor/reference/tables/emailevents) ✳️ [Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Implementation \r\n💡 [Safe Links in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-links)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "EmailEvents\r\n| where DetectionMethods contains \"url\"\r\n| join (EmailUrlInfo) on NetworkMessageId\r\n| project RecipientEmailAddress, DeliveryAction, Url, UrlDomain, EmailDirection, ConfidenceLevel, DetectionMethods, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n\r\n", + "size": 0, + "showAnalytics": true, + "title": "SafeLinks Email Protections", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecipientEmailAddress", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "DeliveryAction", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Url", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Spam", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Mail", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ThreatTypes", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEmailVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isResiliencyVisible", + "parameterName": "isMaliciousVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Malicious URL Protections", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "Resources\r\n| where type contains \"microsoft.network/ddosprotectionplans\"\r\n| extend RG = substring(id, 0, indexof(id, '/providers'))\r\n| extend virtualNetworks = properties.virtualNetworks\r\n| mvexpand bagexpansion=array virtualNetworks\r\n| extend VNETid = virtualNetworks.id\r\n| project-away kind, managedBy, sku, plan, identity, zones, extendedLocation, name, tenantId, properties, tags, virtualNetworks, resourceGroup", - "size": 0, - "showAnalytics": true, - "title": "DDoS Protection Plans", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Subscription}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "type", - "formatter": 16, - "formatOptions": { - "showIcon": true - } - }, - { - "columnMatch": "location", - "formatter": 17 - }, - { - "columnMatch": "subscriptionId", - "formatter": 15, - "formatOptions": { - "linkTarget": null, - "showIcon": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [URL Click-Through Protection](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nURL click-through protections ensure that when a URL from an email is clicked, the requester is directed to a protection that verifies the security of the URL destination before permitting access.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Implementation \r\n💡 [Safe Links in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/atp-safe-links)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "VNETid", - "formatter": 13, - "formatOptions": { - "linkTarget": null, - "showIcon": true + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"url\" or Title contains \"url\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Urls", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true } - } - ], - "filter": true, - "labelSettings": [ - { - "columnId": "id", - "label": "Name" }, - { - "columnId": "type", - "label": "Type" - }, - { - "columnId": "location", - "label": "Region" - }, - { - "columnId": "subscriptionId", - "label": "Subscription" - }, - { - "columnId": "VNETid", - "label": "Virtual Networks" - } - ] - }, - "sortBy": [] + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isResiliencyVisible", + "parameterName": "isUrlVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "DDoSPlans" + "name": "URL Click-Through Protection", + "styleSettings": { + "showBorder": true + } } ] }, "conditionalVisibility": { - "parameterName": "isResiliencyVisible", + "parameterName": "isEmailVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "DDoS Protections", - "styleSettings": { - "showBorder": true - } + "name": "Email Group" }, { "type": 12, @@ -9632,728 +14095,3619 @@ { "type": 1, "content": { - "json": "# [Elastic Expansion](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nElastic expansion enables agencies to dynamically expand the resources available for services as conditions require.\r\n\r\n### Microsoft References \r\n💡 [What are Virtual Machine Scale Sets?](https://docs.microsoft.com/azure/virtual-machine-scale-sets/overview) 
\r\n💡 [Elastic Pools Help You Manage and Scale Multiple Databases in Azure SQL Database](https://www.cisa.gov/trusted-internet-connections)
\r\n💡 [What is Azure Load Balancer?](https://docs.microsoft.com/azure/load-balancer/load-balancer-overview)
\r\n💡 [What is Traffic Manager?](https://docs.microsoft.com/azure/traffic-Manager/traffic-Manager-overview)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Virtual Machine Scale Sets](https://azure.microsoft.com/services/virtual-machine-scale-sets/) ✳️ [Traffic Manager]( https://azure.microsoft.com/services/traffic-manager/) ✳️ [Load Balancer]( https://azure.microsoft.com/services/load-balancer/)✳️ [Azure Availability Zones]( https://azure.microsoft.com/global-infrastructure/availability-zones/)\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Machine Scale Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Compute%2FvirtualMachineScaleSets)
🔀 [Azure SQL](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Sql%2Fazuresql)
🔀 [Load Balancer](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
🔀 [Traffic Manager Profiles](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2Ftrafficmanagerprofiles)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.DS](https://www.nist.gov/cyberframework)" + "json": "# [Web](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nWeb-based protections including break/inspect, active content mitigation, certificate blacklisting/consensus, content filtering, authenticated proxy, data loss prevention, DNS-over-HTTPS filtering, RFC compliance enforcement, domain category filtering, domain reputation filtering, bandwidth control, malicious content filtering, and access control." }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isResiliencyVisible", + "parameterName": "isWebVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Web Capabilities Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 108" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"scale\" or type contains \"traffic\" or type contains \"load\" or type contains \"balance\" or type contains \"pool\" or type contains \"set\" or type contains \"manager\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Elasticly Scaling Assets (Scale Sets, Pooling, Load Balancing, Traffic Managers)", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Break and Inspect\\\", \\\"tab\\\": \\\"Break\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Active Content Mitigation\\\", \\\"tab\\\": \\\"Active\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Certificate Denylisting\\\", \\\"tab\\\": \\\"Certificate\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Content Filtering\\\", \\\"tab\\\": \\\"Content\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Authenticated Proxy\\\", \\\"tab\\\": \\\"Authenticated\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Data Loss Prevention\\\", \\\"tab\\\": \\\"Data\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"DNS-over-HTTPS Filtering\\\", \\\"tab\\\": \\\"DNS\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { - "filter": true + "formatters": [ + { + "columnMatch": "tab", + "formatter": 5 + } + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", + "customWidth": "40", + "name": "query - 8", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Elastic Expansion", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 9, "content": { - "json": "# [Regional Delivery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nRegional delivery technologies enable the deployment of agency services across geographically diverse locations.\r\n\r\n### Microsoft References \r\n💡 [Building Solutions for High Availability Using Availability Zones](https://docs.microsoft.com/azure/architecture/high-availability/building-solutions-for-high-availability)
 \r\n💡 [Azure Infrastructure Availability](https://docs.microsoft.com/azure/security/fundamentals/infrastructure-availability) 
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter)\r\n\r\n### Microsoft Portals\r\n🔀 [Availability Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FavailabilitySets)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS](https://www.nist.gov/cyberframework)" - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a30d01d0-38f1-4a91-9cf6-cdb181d676b5", + "version": "KqlParameterItem/1.0", + "name": "isBreakVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Break", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isActiveVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Active", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "b2b0b9d3-128b-4ec7-a1e8-287df84633da" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isCertificateVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Certificate", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "508474da-365f-43db-9c42-4331e8648144" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isContentVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Content", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "68f6fab3-9f4c-4ea8-ac17-064809f6740e" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isAuthenticatedVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Authenticated", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "a539291a-2744-47ef-9558-f15986ecf508" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDataVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Data", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "bd2ce9fe-9e44-4bcf-9f00-83a04c86e456" + }, + { + "id": "5cb17a08-31fb-4eee-87d8-abef7ecbb7e2", + "version": "KqlParameterItem/1.0", + "name": "isDNSVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "DNS", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "customWidth": "10", + "name": "Hidden Parameters" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "resources\r\n| project id,type,location,resourceGroup\r\n| summarize count() by location\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Assets by Location", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"RFC Compliance Enforcement\\\", \\\"tab\\\": \\\"RFC\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Domain Category Filtering\\\", \\\"tab\\\": \\\"Category\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Domain Reputation Filter\\\", \\\"tab\\\": \\\"Reputation\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Bandwidth Control\\\", \\\"tab\\\": \\\"Bandwidth\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Malicious Content Filtering\\\", \\\"tab\\\": \\\"Malicious\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Access Control\\\", \\\"tab\\\": \\\"Access\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ - { - "columnMatch": "location", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Globe", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } + { + "columnMatch": "tab", + "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", + "customWidth": "40", + "name": "query - 8 - Copy", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isResiliencyVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Regional Delivery", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [DNS](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nDNS measures including DNS blackholing, DNSSEC for clients, and DNSSEC for domains. \r\n" - }, - "conditionalVisibility": { - "parameterName": "isDNSVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "DNS Capability Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "9641ace6-28a6-492a-a264-cf997a0b2929", - "cellValue": "DNS Sinkholing", - "linkTarget": "step", - "linkLabel": "✳️ DNS Sinkholing", - "style": "link" }, { - "id": "58350f74-c87b-4110-aa84-2d34f0b7b76d", - "cellValue": "DNSSEC for Agency Clients", - "linkTarget": "step", - "linkLabel": "✳️ DNSSEC for Agency Clients", - "style": "link" + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "0114faf6-043c-452c-9249-34899d8965a1", + "version": "KqlParameterItem/1.0", + "name": "isRFCVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "RFC", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isCategoryVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Category", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "35f239a8-a4dc-4e7f-8b70-dd4c876151db" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isReputationVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Reputation", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "57218915-069e-4559-94ff-29144252c397" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isBandwidthVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Bandwidth", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "d77f49a8-0e58-46c3-b705-5a61736b41ea" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isMaliciousVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Malicious", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "a11bbfd4-4c45-4527-b1d2-6cab517590cb" + }, + { + "id": "a1bdb4f4-7f9d-48f8-8deb-e979a7e203a6", + "version": "KqlParameterItem/1.0", + "name": "isAccessVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Access", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters - Copy" }, { - "id": "69514c8d-8a19-48db-a53d-02c1e12cf332", - "cellValue": "DNSSEC for Agency Domains", - "linkTarget": "step", - "linkLabel": "✳️ DNSSEC for Agency Domains", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isDNSVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "DNS Capability Selector" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, + "type": 12, "content": { - "json": "# [DNS Sinkholing](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNS sinkholing protections are a form of denylisting that protect clients from accessing malicious domains by responding to DNS queries for those domains.\r\n\r\n### Microsoft References \r\n💡 [What is Azure DNS?](https://docs.microsoft.com/azure/dns/dns-overview)
\r\n💡 [Administer DNS and Create Conditional Forwarders in an Azure Active Directory Domain Services Managed Domain](https://docs.microsoft.com/azure/active-directory-domain-services/manage-dns)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure DNS](https://azure.microsoft.com/services/dns/) \r\n\r\n### Microsoft Portals\r\n🔀 [DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
🔀 [Windows Admin Center](https://www.microsoft.com/evalcenter/evaluate-windows-admin-center)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Break and Inspect](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nBreak-and-Inspect systems, or encryption proxies, terminate encrypted traffic, logging or performing policy enforcement against the plaintext, and re-encrypting the traffic, if applicable, before transmitting to the final destination.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Firewall Premium](https://azure.microsoft.com/services/azure-firewall/) ✳️ [Network Watcher](https://azure.microsoft.com/services/network-watcher/)
\r\n\r\n### Implementation \r\n💡 [Azure Firewall Premium Features](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n💡 [Inspect Traffic with Azure Firewall](https://docs.microsoft.com/azure/private-link/inspect-traffic-with-azure-firewall)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Create an Azure Network Watcher instance](https://docs.microsoft.com/azure/network-watcher/network-watcher-create)
\r\n\r\n### Microsoft Portals\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Network Watcher](https://portal.azure.com/#blade/Microsoft_Azure_Network/NetworkWatcherMenuBlade/overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"protected by Azure Firewall\" or RecommendationDisplayName contains \"watcher\" or RecommendationDisplayName contains \"proxy\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"azurefirewalls\" or type contains \"firewallpolicies\" or type contains \"networkwatchers\" or type contains \"webapplicationfirewall\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Break & Inspect Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "name": "query - 1" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDNSVisible", + "parameterName": "isBreakVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Break and Inspect", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"domain\" or type contains \"dns\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", - "size": 0, - "showAnalytics": true, - "title": "DNS Assets", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Active Content Mitigation](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nActive content mitigation protections detect the presence of unapproved active content and facilitate its removal.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n\r\n### Implementation \r\n💡[What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
\r\n💡[Azure Web Application Firewall on Azure Front Door](https://docs.microsoft.com/azure/web-application-firewall/afds/afds-overview)
\r\n💡[Connect data from Microsoft 365 Defender to Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/connect-microsoft-365-defender?tabs=MDE)
\r\n\r\n### Microsoft Portals\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"endpoint protection\" or RecommendationDisplayName contains \"Web Application Firewall\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"webapplicationfirewall\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Active Content Mitigation Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FakeData = (datatable (Message: string, ruleName_s: string, clientIp_s: string, clientIP_s: string, action_s: string, transactionId_s: string, trackingReference_s: string) [\"\", \"\", \"\", \"\", \"\", \"\", \"\"]);\r\nFakeData\r\n| union AzureDiagnostics\r\n| where (ResourceType == \"APPLICATIONGATEWAYS\" or ResourceType == \"FRONTDOORS\" or ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\") and (\"Application Gateway\" == \"All\" or (ResourceType == \"APPLICATIONGATEWAYS\" and \"Application Gateway\" contains \"application gateway\") or (ResourceType == \"FRONTDOORS\" and \"Application Gateway\" contains \"azure front door\") or (ResourceType == \"CDNWEBAPPLICATIONFIREWALLPOLICIES\" and \"Application Gateway\" contains \"cdn\")) and (\"SOC-NS-AG-WAFV2 - 1129440\" == \"All\" or Resource in ('SOC-NS-AG-WAFV2'))\r\n| where Category == \"FrontdoorWebApplicationFirewallLog\" or OperationName == \"ApplicationGatewayFirewall\" or Category == \"WebApplicationFirewallLogs\"\r\n| extend Action = iif(action_s == \"Blocked\", Action = \"Block\", action_s)\r\n| extend Action = iif(Action == \"Detected\", Action = \"Log\", Action)\r\n| where '*' == Action or '*' == \"*\" \r\n| where '*' == requestUri_s or '*' == \"*\"\r\n| extend Rule = strcat(ruleName_s, Message), ClientIP = strcat(clientIp_s, clientIP_s)\r\n| extend Rule= iif(Rule contains \"Mandatory rule. Cannot be disabled.\", strcat_array(split(Rule, \"Mandatory rule. Cannot be disabled. Inbound \", 1), \"\"), Rule) // Removes initial component for mandatory rule \r\n| extend Rule = iif(Rule contains \"Total Inbound Score\", strcat_array(array_concat(split(Rule, \" - SQLI=\", 0), parse_json('[\") -\"]'), split(Rule, \"):\", 1)), \"\"), Rule) // Removes smaller information if more info is available for anomaly score\r\n| summarize count() by Rule\r\n| top 50 by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Azure WAF Events", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Rule", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "warning", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redDark" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDNSVisible", + "parameterName": "isActiveVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Active Content Mitigation", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isDNSVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "DNS Sinkholing", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [DNSSEC for Agency Clients](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNSSEC protections ensure that domain name lookups from agency clients, whether for internal or external domains, are validated.\r\n\r\n### Microsoft References \r\n💡 [Enabling Central Visibility For DNS Using Azure Firewall Custom DNS and DNS Proxy](https://techcommunity.microsoft.com/t5/azure-network-security/enabling-central-visibility-for-dns-using-azure-firewall-custom/ba-p/2156331)
\r\n💡 [DANE Support](https://docs.microsoft.com/windows-server/networking/dns/what-s-new-in-dns-server#dane-support)
\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Microsoft Portals\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n🔀 [Virtual Machines](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FVirtualMachines)
\r\n🔀 [Windows Admin Center](https://www.microsoft.com/evalcenter/evaluate-windows-admin-center)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Certificate Denylisting](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCertificate denylisting protections prevent communication with entities that use a set of known bad certificates.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) 🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation\r\n💡 [Certificates Used by Azure Firewall Premium](https://docs.microsoft.com/azure/firewall/premium-certificates)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Quickstart: Create a Key Vault using the Azure Portal](https://docs.microsoft.com/azure/key-vault/general/quick-create-portal)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"certificate\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"cert\" \r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"cert\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"cert\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDNSVisible", + "parameterName": "isCertificateVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Certificate Denylisting", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where Category == \"AzureFirewallDnsProxy\"\r\n| parse msg_s with \"DNS Request: \" ClientIP \":\" ClientPort \" - \" QueryID \" \" Request_Type \" \" Request_Class \" \" Request_Name \". \" Request_Protocol \" \" Request_Size \" \" EDNSO_DO \" \" EDNS0_Buffersize \" \" Responce_Code \" \" Responce_Flags \" \" Responce_Size \" \" Response_Duration\r\n| project-away msg_s\r\n| summarize by TimeGenerated, ResourceId, ClientIP, ClientPort, QueryID, Request_Type, Request_Class, Request_Name, Request_Protocol, Request_Size, EDNSO_DO, EDNS0_Buffersize, Responce_Code, Responce_Flags, Responce_Size, Response_Duration, SubscriptionId\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Request_Type\r\n| render areachart ", - "size": 0, - "showAnalytics": true, - "title": "Azure Firewall: DNS Proxy Actions over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Content Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nContent filtering protections detect the presence of unapproved content and facilitate its removal or denial of access.\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Implementation\r\n💡 [Azure Firewall Web Categories](https://docs.microsoft.com/azure/firewall/web-categories)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Web Content Filtering](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/web-content-filtering)
\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let materializedData =\r\n materialize(\r\n AzureDiagnostics\r\n | where Category == \"AzureFirewallApplicationRule\"\r\n | project msg_s, Resource, TimeGenerated);\r\nunion\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s !has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \"TLS extension was missing\"\r\n | where msg_s has \" Reason:\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"TLS extension was missing\"\r\n and msg_s !has \"No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | where msg_s has \"Rule Collection Group\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n )\r\n| summarize Count = count(), last_log = datetime_diff(\"second\", now(), max(TimeGenerated)) by RuleCollection, Rule, WebCategory", + "size": 1, + "showAnalytics": true, + "title": "Azure Firewall: Content Enforcement", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Count", + "formatter": 8, + "formatOptions": { + "palette": "whiteBlack" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "useGrouping": false, + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "last_log", + "formatter": 8, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 24, + "options": { + "style": "decimal", + "useGrouping": false + } + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "$gen_heatmap_last_log_4", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "$gen_heatmap_last_log_4", + "sortOrder": 1 + } + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 36" + } ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDNSVisible", + "parameterName": "isContentVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 2", + "name": "Content Filtering", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isDNSVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "DNSSEC for Agency Clients", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [DNSSEC for Agency Domains](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNSSEC protections ensure that all agency domain names are secured using DNSSEC, enabling external entities to validate their resolution the domain names.\r\n\r\n### Microsoft References \r\n💡 [What is Azure DNS?](https://docs.microsoft.com/azure/dns/dns-overview)
\r\n💡 [Security Recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n🔀 [Windows Admin Center](https://www.microsoft.com/evalcenter/evaluate-windows-admin-center)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Authenticated Proxy](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAuthenticated proxies require entities to authenticate with the proxy before making use of it, enabling user, group, and location-aware security controls.\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation \r\n💡 [Plan an Azure AD Application Proxy Deployment](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy-deployment-plan)
\r\n💡 [Configure Real-Time Application Access Monitoring with Microsoft Defender for Cloud Apps and Azure Active Directory](https://docs.microsoft.com/azure/active-directory/manage-apps/application-proxy-integrate-with-microsoft-cloud-application-security)
\r\n💡 [Protect Apps with Microsoft Defender for Cloud Apps Conditional Access App Control](https://docs.microsoft.com/cloud-app-security/proxy-intro-aad)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud Apps](https://portal.cloudappsecurity.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| mv-expand ConditionalAccessPolicies\r\n| extend ConditionalAccessPolicy = tostring(ConditionalAccessPolicies.displayName)\r\n| summarize count() by ConditionalAccessPolicy\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Conditional Access Policies", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "ConditionalAccessPolicy", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "pending", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDNSVisible", + "parameterName": "isAuthenticatedVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Authenticated Proxy", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityRegulatoryCompliance\r\n| where RecommendationName contains \"dns\"\r\n| summarize count() by RecommendationName, AssessedResourceId, RecommendationLink\r\n| sort by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "DNS Recommendations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Microsoft Defender for Cloud Apps: File Policies](https://docs.microsoft.com/cloud-app-security/data-protection-policies)
\r\n💡 [Content Inspection for Protected Files](https://docs.microsoft.com/cloud-app-security/content-inspection)
\r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Defender for Identity Portal](https://portal.atp.azure.com/)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for Cloud Apps](https://portal.cloudappsecurity.com/)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Tactics contains \"exfil\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Data Exfiltration", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDNSVisible", + "parameterName": "isDataVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Data Loss Prevention_W", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isDNSVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "DNSSEC for Agency Domains", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Intrusion Detection](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nIntrusion Detection measures including endpoint detection & response, intrusion protection systems, adaptive access control, deception platforms, and certificate transparency log monitoring." - }, - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Intrusion Detection Capability Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "732ea879-9952-465c-b6a5-f85cef33927f", - "cellValue": "Endpoint Detection and Response", - "linkTarget": "step", - "linkLabel": "✳️ Endpoint Detection and Response", - "style": "link" - }, - { - "id": "d09eb27c-cab6-4ae8-978f-5bcc50a361f5", - "cellValue": "Intrusion Protection Systems (IPS)", - "linkTarget": "step", - "linkLabel": "✳️ Intrusion Protection Systems (IPS)", - "style": "link" }, { - "id": "e22ab1a8-ded0-43e0-b8df-68d75ca8d073", - "cellValue": "Adaptive Access Control", - "linkTarget": "step", - "linkLabel": "✳️ Adaptive Access Control", - "style": "link" - }, - { - "id": "5a55295b-0d64-4e5f-a84e-25a7bad66f5f", - "cellValue": "Deception Platforms", - "linkTarget": "step", - "linkLabel": "✳️ Deception Platforms", - "style": "link" + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DNS-over-HTTPS Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNS-over-HTTPS filtering prevents entities from using the DNS-over-HTTPS protocol, possibly evading DNS-based protections.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Microsoft Defender for DNS](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-dns-introduction)
\r\n💡 [Azure Firewall DNS settings](https://docs.microsoft.com/azure/firewall/dns-settings)
\r\n💡 [Web Content Filtering](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud: Workload Protections](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/26)
\r\n🔀 [Azure Firewall](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"dns\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "isDNSVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "DNS-over-HTTPS Filtering", + "styleSettings": { + "showBorder": true + } }, { - "id": "2674ad60-398d-42aa-a24d-7cbe20aa79a7", - "cellValue": "Certificate Transparency Log Monitoring", - "linkTarget": "step", - "linkLabel": "✳️ Certificate Transparency Log Monitoring", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Intrusion Detection Capability Selector" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, + "type": 12, "content": { - "json": "# [Endpoint Detection and Response](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEndpoint detection and response tools combine endpoint and network event data to aid in the detection of malicious activity.\r\n\r\n### Microsoft References \r\n💡 [Overview of Endpoint Detection and Response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.AE, DE.CM, RS.AN](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [RFC Compliance Enforcement](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nRFC compliant enforcement technologies ensure that traffic complies with protocol definitions.\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Web Application Firewall]( https://azure.microsoft.com/services/web-application-firewall/) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Implementation\r\n💡[What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
\r\n💡[Tutorial: Create an Application Gateway with a Web Application Firewall using the Azure Portal](https://docs.microsoft.com/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal)
\r\n\r\n### Microsoft Portals\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics \r\n| where Category == \"ApplicationGatewayFirewallLog\"\r\n| where details_file_s contains \"rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf\"\r\n| summarize count() by ResourceId, Message\r\n| sort by count_ desc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Web Protocol Enforcement Alerts", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isRFCVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "RFC Compliance Enforcement", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"MDATP\"\r\n| summarize count() by AlertName\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Endpoint Alerts", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Domain Category Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDomain category filtering technologies allow for classes of domains (e.g. banking, medical) to receive a different set of security protections.\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Implementation \r\n💡 [Azure Firewall: Web Categories](https://docs.microsoft.com/azure/firewall/premium-deploy#web-categories-testing)
\r\n💡 [Use FQDN Filtering in Network Rules](https://docs.microsoft.com/azure/firewall/fqdn-filtering-network-rules)
\r\n💡 [Azure Firewall Premium Features](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)\t
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let materializedData =\r\n materialize(\r\n AzureDiagnostics\r\n | where Category == \"AzureFirewallApplicationRule\"\r\n | project msg_s, Resource, TimeGenerated);\r\nunion\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url:\" Url \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s has \". No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". No rule matched\" *\r\n ),\r\n (\r\n materializedData\r\n | where msg_s has \"Web Category:\" and msg_s !has \". Url\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection:\" RuleCollection \". Rule:\" Rule \". Web Category:\" WebCategory\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". \" RuleCollection \". \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \"TLS extension was missing\"\r\n | where msg_s has \" Reason:\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \". Action: \" Action \". Reason: \" Rule \".\"\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"TLS extension was missing\"\r\n and msg_s !has \"No rule matched\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n ),\r\n (\r\n materializedData\r\n | where msg_s !has \"Web Category:\"\r\n and msg_s !has \". Url\"\r\n and msg_s !has \"Rule Collection\"\r\n and msg_s !has \" Reason: \"\r\n | where msg_s has \"Rule Collection Group\"\r\n | parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". Policy:\" Policy \". Rule Collection Group:\" RuleCollectionGroup \". Rule Collection: \" RuleCollection \". Rule: \" Rule\r\n )\r\n| where Action == \"Deny\"\r\n| where '*' == SourceIP or '*' == \"*\" \r\n| summarize count() by FQDN\r\n| sort by count_ desc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Domain & Category Filtering", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" + "columnMatch": "FQDN", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Diagnostics", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isCategoryVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Domain Category Filtering", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Endpoint Detection and Response", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Intrusion Protection Systems (IPS)](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIntrusion protection systems detect malicious activity, attempt to stop the activity, and report the activity.\r\n\r\n### Microsoft References \r\n💡 [Azure Firewall Premium: IDPS](https://docs.microsoft.com/azure/firewall/premium-features#idps)
\r\n\r\n### Required Log (Log Source)\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n\r\n### Trusted Internet Connections\r\n💡 [TIC 3.0 Model](https://www.cisa.gov/trusted-internet-connections)\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.AE, DE.CM, DE.DP, RS.AN](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Domain Reputation Filter](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDomain reputation filtering protections are a form of domain denylisting based on a domain’s reputation, as defined by either the agency or an external entity.\r\n\r\n### Recommended Logs\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Implementation \r\n💡 [Azure Firewall Threat Intelligence-Based Filtering](https://docs.microsoft.com/azure/firewall/threat-intel)
\r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let materializedData =\r\nmaterialize(\r\nAzureDiagnostics\r\n| where Category == \"AzureFirewallNetworkRule\"\r\n| where OperationName == \"AzureFirewallThreatIntelLog\"\r\n| where msg_s <> \" request from to . Action: . ThreatIntel: \"\r\n| project msg_s, Resource, TimeGenerated,ResourceId , ResourceGroup , SubscriptionId);\r\nunion\r\n(\r\nmaterializedData\r\n| where msg_s has \"Url\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Url: \" Url \". Action: \" Action \". ThreatIntel: \" ThreatIntelMsg\r\n),\r\n(\r\nmaterializedData\r\n| where msg_s !has \"Url\"\r\n| parse msg_s with Protocol \" request from \" SourceIP \":\" SourcePort \" to \" FQDN \":\" DestinationPort \". Action: \" Action \". ThreatIntel: \" ThreatIntelMsg\r\n)\r\n| summarize by ThreatIntelMsg, Url, FQDN, Action, Protocol, SourceIP, SourcePort, DestinationPort, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Azure Firewall: Threat Intelligence URL Blocks", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Url", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Diagnostics", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Action", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "4", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true, + "sortBy": [ + { + "itemKey": "FQDN", + "sortOrder": 1 + } + ] + }, + "sortBy": [ + { + "itemKey": "FQDN", + "sortOrder": 1 + } + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isReputationVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Domain Reputation Filter", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "AzureDiagnostics\r\n| where Category == \"AzureFirewallNetworkRule\"\r\n| where OperationName == \"AzureFirewallIDSLog\"\r\n| parse msg_s with * \"TCP request from \" Source \" to \" Destination \". Action: \" ActionTaken \". Rule: \" IDPSSig \". IDS: \" IDSMessage \". Priority: \" Priority \". Classification: \" Classification\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by OperationName\r\n| render areachart ", - "size": 0, - "showAnalytics": true, - "title": "Azure Firewall: IDPS Alerts over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Bandwidth Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nBandwidth control technologies allow for limiting the amount of bandwidth used by different classes of domains.\r\n\r\n### Recommended Logs\r\n🔷 [Metrics](https://docs.microsoft.com/azure/azure-monitor/essentials/data-platform-metrics) ✳️ [Azure Firewall](https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Implementation \r\n💡 [Azure Monitor Metrics Overview](https://docs.microsoft.com/azure/azure-monitor/essentials/data-platform-metrics)
\r\n💡 [Monitor Azure Firewall Logs and Metrics](https://docs.microsoft.com/azure/firewall/firewall-diagnostics) \r\n\r\n### Microsoft Portals\r\n🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "Bandwidth Control" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "40", + "name": "Control Smartcard" + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "5084e141-6c56-4d7f-bd8a-09f7ef9af1bc", + "version": "KqlParameterItem/1.0", + "name": "Resource", + "label": "Azure Firewalls", + "type": 5, + "isRequired": true, + "multiSelect": true, + "quote": "'", + "delimiter": ",", + "query": "where type =~ 'Microsoft.Network/azureFirewalls'\r\n| project id, name", + "crossComponentResources": [ + "{Workspace}" + ], + "typeSettings": { + "additionalResourceOptions": [ + "value::all" + ] + }, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "value": [ + "value::all" + ] + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "20", + "name": "parameters - 1" + }, + { + "type": 10, + "content": { + "chartId": "workbook76864ed5-dd34-42d0-ae35-f3db9f9e8f15", + "version": "MetricsItem/2.0", + "size": 0, + "chartType": 2, + "resourceType": "microsoft.network/azurefirewalls", + "metricScope": 0, + "resourceParameter": "Resource", + "resourceIds": [ + "{Resource}" + ], + "timeContextFromParameter": "TimeRange", + "timeContext": { + "durationMs": 604800000 + }, + "metrics": [ + { + "namespace": "microsoft.network/azurefirewalls", + "metric": "microsoft.network/azurefirewalls--Throughput", + "aggregation": 4, + "splitBy": null, + "columnName": "All Firewall Throughput Average" + } + ], + "title": "Average Throughput of Firewall Traffic", + "gridSettings": { + "rowLimit": 10000 + } + }, + "customWidth": "40", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "metric - 25" + } ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isBandwidthVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Bandwidth Control", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Intrusion Protection Systems (IPS)", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Adaptive Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAdaptive access control technologies factor in additional context, like security risk, operational needs, and other heuristics, when evaluating access control decisions.\r\n\r\n### Microsoft Reference \r\n💡 [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, DE.CM](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Malicious Content Filtering](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMalicious content filtering protections detect the presence of malicious content and facilitate its removal.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) ✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n### Implementation \r\n💡 [Microsoft Defender for Cloud's enhanced security features](https://docs.microsoft.com/azure/defender-for-cloud/enhanced-security-features-overview)
\r\n💡 [What is Azure Web Application Firewall on Azure Application Gateway?](https://docs.microsoft.com/azure/web-application-firewall/ag/ag-overview)
\r\n💡 [Azure Web Application Firewall on Azure Front Door](https://docs.microsoft.com/azure/web-application-firewall/afds/afds-overview)
\r\n💡 [Azure Firewall Premium Features](https://docs.microsoft.com/azure/firewall/premium-features)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS, PR.PT, PR.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"firewall\" or RecommendationDisplayName contains \"defender\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"mal\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Malicious Content", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let materializedData =\r\nmaterialize(\r\nAzureDiagnostics\r\n| where ResourceType == \"AZUREFIREWALLS\"\r\n| project Category, ResourceType, OperationName);\r\nunion\r\n(\r\nmaterializedData\r\n | where OperationName == \"AzureFirewallIDSLog\"\r\n | summarize Volume=count() by OperationName\r\n | project Category=OperationName, Volume\r\n),\r\n(\r\nmaterializedData\r\n | where OperationName == \"AzureFirewallThreatIntelLog\"\r\n | summarize Volume=count() by OperationName\r\n | project Category=OperationName, Volume\r\n),\r\n(\r\nmaterializedData\r\n | where OperationName <> \"AzureFirewallThreatIntelLog\"\r\n | where OperationName <> \"AzureFirewallIDSLog\"\r\n | summarize Volume=count() by Category\r\n)\r\n| sort by Volume desc", + "size": 0, + "showAnalytics": true, + "title": "Web Protections by Rule Category", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "noDataMessageStyle": 4, + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "exportFieldName": "Category", + "exportParameterName": "SelectedCategory", + "exportDefaultValue": "*", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Volume", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + }, + "tileSettings": { + "showBorder": false, + "titleContent": { + "columnMatch": "Category", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Volume", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + } + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isWebVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 2" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isMaliciousVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Malicious Content Filtering", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "let data = SigninLogs\r\n | where AppDisplayName in ('*') or '*' in ('*')\r\n | where UserDisplayName in ('*') or '*' in ('*')\r\n | extend CAStatus = case(ConditionalAccessStatus == \"success\", \"Successful\",\r\n ConditionalAccessStatus == \"failure\", \"Failed\", \r\n ConditionalAccessStatus == \"notApplied\", \"Not applied\", \r\n isempty(ConditionalAccessStatus), \"Not applied\", \r\n \"Disabled\")\r\n | mvexpand ConditionalAccessPolicies\r\n | extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n | extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"endpoint\", \"Require endpoint Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined endpoint\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\r\n \"Other\");\r\ndata\r\n| summarize Count = dcount(Id) by CAStatus\r\n| join kind = inner (data\r\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range(ago(14d), now(), 6h) by CAStatus\r\n )\r\n on CAStatus\r\n| project-away CAStatus1, TimeGenerated\r\n| order by Count desc", - "size": 0, - "showAnalytics": true, - "title": "Conditional Access Status", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "tiles", - "tileSettings": { - "titleContent": { - "columnMatch": "CAStatus", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Count", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "style": "decimal", - "maximumFractionDigits": 2, - "maximumSignificantDigits": 3 - } - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAccess control technologies allow an agency to define policies limiting what actions may be performed by connected users and entities.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Overview of Role-Based Access Control in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/roles/custom-overview)
\r\n💡 [What is Azure AD Privileged Identity Management?](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure)
\r\n💡 [Secure Your Management Ports With Just-In-Time Access](https://docs.microsoft.com/azure/active-directory/privileged-identity-management/pim-configure)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Privileged Identity Management](https://portal.azure.com/#blade/Microsoft_Azure_PIMCommon/CommonMenuBlade/quickStart)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" }, - "secondaryContent": { - "columnMatch": "Trend", - "formatter": 9, - "formatOptions": { - "palette": "blue" + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"Just\" or RecommendationDisplayName contains \"privilege\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } - }, - "showBorder": false - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isAccessVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3 - Copy", + "name": "Access Control", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isWebVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "Adaptive Access Control", - "styleSettings": { - "showBorder": true - } + "name": "Web Group" }, { "type": 12, @@ -10364,328 +17718,1504 @@ { "type": 1, "content": { - "json": "# [Deception Platforms](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDeception platform technologies provide decoy environments, from individual machines to entire networks, that can be used to deflect attacks away from the operational systems supporting agency missions/business functions.\r\n\r\n### Microsoft Reference \r\n💡 [Manage Sensitive or Honeytoken Accounts](https://docs.microsoft.com/defender-for-identity/manage-sensitive-honeytoken-accounts)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender) \r\n\r\n### Microsoft Portal\r\n🔀 [Microsoft Defender for Identity Portal](https://portal.atp.azure.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.AE, RS.AN](https://www.nist.gov/cyberframework)" + "json": "# [Networking](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nNetwork-based protections including network access controls, IP denylisting, host containment, network segmentation, and microsegmentation. \r\n" }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isNetworkingVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Networking Capabilities Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 109" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where ProviderName == \"Azure Advanced Threat Protection\"\r\n| summarize count() by AlertName\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Defender for Identity Alerts", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Access Control\\\", \\\"tab\\\": \\\"Access\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"IP Denylisting\\\", \\\"tab\\\": \\\"IP\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Host Containment\\\", \\\"tab\\\": \\\"Host\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Network Segmentation\\\", \\\"tab\\\": \\\"Network\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Microsegmentation\\\", \\\"tab\\\": \\\"Micro\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" - } + "columnMatch": "tab", + "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", + "customWidth": "40", + "name": "query - 8", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Deception Platforms", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a206a547-329b-4003-8832-c16daacca6c6", + "version": "KqlParameterItem/1.0", + "name": "isAccessVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Access", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isIPVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "IP", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "50ab20f8-9e71-4938-a67c-fc3cddda9d3e" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isHostVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Host", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "297ab54c-7fb4-4d69-b331-d06b5848b0c2" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isNetworkVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Network", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "4c49d950-1bd2-45c1-8a98-4f17abff2088" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isMicroVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Micro", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "cf2d16a5-def7-4887-87ff-188258574464" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" + }, + { + "type": 12, "content": { - "json": "# [Certificate Transparency Log Monitoring](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCertificate transparency log monitoring allows agencies to discover when new certificates are issued for agency domains.\r\n\r\n### Microsoft References \r\n💡 [Get Started with Key Vault Certificates](https://docs.microsoft.com/azure/key-vault/certificates/certificate-scenarios)
\r\n💡 [Security Recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.CM](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAccess control protections prevent the ingest, egress, or transiting of unauthorized network traffic.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)\r\n✳️ [Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)\r\n\r\n### Implementation \r\n💡 [Security Recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n💡 [Network Security Groups](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview)
\r\n💡 [Tutorial: Deploy and Configure Azure Firewall Using the Azure Portal](https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal)
\r\n💡 [Tutorial: Create an Application Gateway with a Web Application Firewall using the Azure Portal](https://docs.microsoft.com/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal)
\r\n💡 [Tutorial: Create and Manage a VPN Gateway using Azure Portal]( https://docs.microsoft.com/azure/vpn-gateway/tutorial-create-gateway-portal)
\r\n💡 [What is Azure ExpressRoute?](https://docs.microsoft.com/azure/expressroute/expressroute-introduction)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
🔀 [Firewalls](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FazureFirewalls)
🔀 [Web Application Firewall Policies](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
🔀 [Virtual Network Gateways](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways)
🔀 [ExpressRoute Circuits](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FexpressRouteCircuits) \r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"network access\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"network\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Networking Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where OperationName == \"NetworkSecurityGroupEvents\"\r\n| extend NetworkMap=strcat(\"NetworkMap\")\r\n| summarize count() by ruleName_s, NetworkMap\r\n| project NetworkSecurityGroupRule=ruleName_s, FlowCount=count_, NetworkMap\r\n| sort by FlowCount desc ", + "size": 0, + "showAnalytics": true, + "title": "Network Map & Flow Counts", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "NetworkSecurityGroupRule", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Lateral_Movement", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "FlowCount", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "NetworkMap", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Network Map >>", + "bladeOpenContext": { + "bladeName": "NetworkMapBlade", + "extensionName": "Microsoft_Azure_Security_R3", + "bladeParameters": [] + } + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 4", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isAccessVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Access Control", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"key\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", - "size": 0, - "showAnalytics": true, - "title": "Key Vault Assets", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [IP Denylisting](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIP denylisting protections prevent the ingest or transiting of traffic received from or destined to a denylisted IP address.\r\n\r\n### Recommended Logs\r\n🔷 [ThreatIntelligenceIndicator](https://docs.microsoft.com/azure/azure-monitor/reference/tables/threatintelligenceindicator) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Implementation \r\n💡 [Connect Data from Threat Intelligence Providers](https://docs.microsoft.com/azure/sentinel/connect-threat-intelligence)
\r\n💡 [Azure Firewall Threat Intelligence Configuration](https://docs.microsoft.com/azure/firewall-Manager/threat-intelligence-settings)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "ThreatIntelligenceIndicator\r\n| extend IndicatorType = iif(isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkIP) or isnotempty(NetworkSourceIP) or isnotempty(NetworkCidrBlock), \"IP\",\r\n\t iff(isnotempty(Url), \"URL\",\r\n\t iff(isnotempty(EmailRecipient) or isnotempty(EmailSenderAddress), \"Email\",\r\n\t iff(isnotempty(FileHashValue), \"File\",\r\n\t iff(isnotempty(DomainName) or isnotempty(EmailSourceDomain), \"Domain\",\r\n\t \"Other\")))))\r\n| where IndicatorType == \"IP\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by IndicatorType\r\n| render areachart", + "size": 0, + "showAnalytics": true, + "title": "Microsoft Sentinel: Threat Intelligence IP Indicators Ingested", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "VMConnection\r\n| extend NetworkSourceIP=RemoteIp\r\n| where NetworkSourceIP <> \"\"\r\n| extend FirewallManager=strcat(\"FirewallManager\")\r\n| join (ThreatIntelligenceIndicator) on NetworkSourceIP\r\n| extend Indicator = strcat(NetworkSourceIP, FileHashValue, NetworkIP, NetworkDestinationIP, Url, EmailSourceIpAddress, EmailSenderAddress, DomainName)\r\n| extend Source=SourceSystem1\r\n| summarize count () by ThreatType, Action, Indicator, Direction, _ResourceId, FirewallManager, RemoteCountry, RemoteIp, Source\r\n| sort by count_ desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Threat Intelligence: IP Denylisting", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "ThreatType", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "FirewallManager", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Firewall Manager >>", + "bladeOpenContext": { + "bladeName": "FirewallManagerMenuBlade", + "extensionName": "Microsoft_Azure_HybridNetworking", + "bladeParameters": [] + } + } + }, + { + "columnMatch": "RemoteCountry", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Globe", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Source", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "View", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "RiskIQ_Lookup", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "RiskIQ Lookup >" + } + }, + { + "columnMatch": "VirusTotalURL", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "VirusTotal Lookup >" + } + } + ], + "filter": true + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "RemoteCountry", + "latitude": "RemoteLatitude", + "longitude": "RemoteLongitude", + "sizeSettings": "RemoteCountry", + "sizeAggregation": "Count", + "labelSettings": "RemoteCountry", + "legendMetric": "RemoteCountry", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "RemoteIp", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "redBright" + } + ] + } + } + }, + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Threat Intelligence: IP Denylisting" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isIPVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "IP Denylisting", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n| where RecommendationName contains \"cert\"\r\n| summarize count() by RecommendationName, AssessedResourceId, RecommendationLink\r\n| sort by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "Certificate Recommendations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "RecommendationName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Gear", - "text": "{0}{1}" - } - ] - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Host Containment](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nHost containment protections enable a network to revoke or quarantine a host’s access to the network.\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/automation-in-azure-sentinel)
\r\n💡 [How to Isolate an Azure VM Using Microsoft Defender for Cloud’s Workflow Automation](https://techcommunity.microsoft.com/t5/azure-security-center/how-to-isolate-an-azure-vm-using-azure-security-center-s/ba-p/1250985)
\r\n💡 [Isolate Endpoints from the Network](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#isolate-endpoints-from-the-network)
\r\n\r\n### Microsoft Portals \r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] }, - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"logic\"\r\n| where id contains \"block\" or id contains \"isolate\" or id contains \"lock\" or id contains \"revoke\" or id contains \"quarantine\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Containment Automations Configured", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", + "parameterName": "isHostVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3 - Copy", + "name": "Host Containment", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isIntrusionDetectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Certificate Transparency Log Monitoring", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Enterprise](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nEnterprise-based controls including security orchestration automation & response, shadow IT detection, and virtual private networks. " - }, - "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Enterprise Capabilities Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "d492afb3-4b6e-482e-8d63-6f8e42b9c8b5", - "cellValue": "Security Orchestration, Automation, and Response (SOAR)", - "linkTarget": "step", - "linkLabel": "✳️ Security Orchestration, Automation, and Response (SOAR)", - "style": "link" - }, - { - "id": "d600f262-56b1-46d3-990f-1237edaa8eb5", - "cellValue": "Shadow IT Detection", - "linkTarget": "step", - "linkLabel": "✳️ Shadow IT Detection", - "style": "link" }, { - "id": "008f3aaa-4b7d-4b10-a000-3b249bffa4f4", - "cellValue": "Virtual Private Network (VPN)", - "linkTarget": "step", - "linkLabel": "✳️ Virtual Private Network (VPN)", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Enterprise Capabilities Selector" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, + "type": 12, "content": { - "json": "# [Security Orchestration, Automation, and Response (SOAR)](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nSecurity Orchestration, Automation, and Response (SOAR) tools define, prioritize, and automate the response to security incidents.\r\n\r\n### Microsoft References \r\n💡 [Tutorial: Setup Automated Threat Responses in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.AE, DE.CM, DE.DP, RS.CO, RS.AN, RC.RP](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Network Segmentation](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nNetwork segmentation separates a given network into subnetworks, facilitating security controls between the subnetworks, and decreasing the attack surface of the network.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)
\r\n\r\n### Implementation \r\n💡 [Implement Network Segmentation Patterns on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-segmentation)
\r\n💡 [What is Azure Virtual Network?](https://docs.microsoft.com/azure/virtual-network/virtual-networks-overview)
\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Networks](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"segment\" or RecommendationDisplayName contains \"network security group\" or RecommendationDisplayName contains \"subnet\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"networksecuritygroups\" or type contains \"virtualnetworks\" or type contains \"tables\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Network Segmentation Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isNetworkVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Network Segmentation", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type == \"microsoft.logic/workflows\"\r\n| extend Connection = parse_json(properties)[\"parameters\"][\"$connections\"][\"value\"]\r\n| where Connection has \"managedApis/azuresentinel\"\r\n| project id, type, resourceGroup", - "size": 0, - "showAnalytics": true, - "title": "Automation Playbooks Configured", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Microsegmentation](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMicrosegmentation divides the network, either physically or virtually, according to the communication needs of application and data workflows, facilitating security controls to protect the data.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Virtual Network](https://azure.microsoft.com/services/virtual-network/)\r\n✳️ [Application Gateway](https://azure.microsoft.com/services/application-gateway/) \r\n\r\n### Implementation \r\n💡 [Network Security & Containment](https://docs.microsoft.com/azure/virtual-network/virtual-networks-overview)
\r\n💡 [What is Azure Virtual Network?](https://docs.microsoft.com/azure/virtual-network/virtual-networks-overview)
\r\n💡 [Implement network segmentation patterns on Azure](https://docs.microsoft.com/azure/architecture/framework/security/design-network-segmentation)
\r\n💡 [Application Security Groups](https://docs.microsoft.com/azure/virtual-network/application-security-groups)
\r\n💡 [Tutorial: Filter Network Traffic with a Network Security Group using the Azure portal](https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic)
\r\n\r\n### Microsoft Portals\r\n🔀 [Application Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks)
\r\n🔀 [Network Security Groups](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FNetworkSecurityGroups)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.DS, PR.IP, PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"application gateway\" or RecommendationDisplayName contains \"security group\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"applicationgateway\" or type contains \"securitygroup\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Microsegementation Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isNetworkingVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isMicroVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3 - Copy", + "name": "Microsegmentation", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isNetworkingVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "Security Orchestration, Automation, and Response (SOAR)", - "styleSettings": { - "showBorder": true - } + "name": "Networking Group" }, { "type": 12, @@ -10696,88 +19226,1198 @@ { "type": 1, "content": { - "json": "# [Shadow IT Detection](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nShadow IT detection systems detect the presence of unauthorized software and systems in use by an agency.\r\n\r\n### Microsoft References \r\n💡 [Tutorial: Discover and Manage Shadow IT in Your Network](https://docs.microsoft.com/cloud-app-security/tutorial-shadow-it)
\r\n💡 [Review Your Security Recommendations](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n💡 [Endpoint Discovery - Navigating Your Way Through Unmanaged Devices](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/endpoint-discovery-navigating-your-way-through-unmanaged-devices/ba-p/2248909)
\r\n💡 [Device Discovery Overview](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/device-discovery)
\r\n💡 [Welcome to Microsoft Defender for IoT](https://docs.microsoft.com/azure/defender-for-iot/overview)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security) \r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud Apps Portal](https://portal.cloudappsecurity.com/)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for IoT](https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_Started)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.IP, PR.MA, DE.CM](https://www.nist.gov/cyberframework)" + "json": "# [Resiliency](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nResiliency measures including DDoS protections, elastic expansion, and regional delivery.\r\n" }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isResiliencyVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Resiliency Capabilities Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isResiliencyVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 110" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityAlert\r\n| where AlertType contains \"discovery\"\r\n| summarize count() by AlertName\r\n| sort by count_ desc\r\n", - "size": 0, - "showAnalytics": true, - "title": "Shadow IT Alerts", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"DDoS Protections\\\", \\\"tab\\\": \\\"DDoS\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Elastic Expansion\\\", \\\"tab\\\": \\\"Elastic\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Regional Delivery\\\", \\\"tab\\\": \\\"Regional\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "AlertName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "tab", + "formatter": 5 + } + ] + } + }, + "customWidth": "40", + "name": "query - 8", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a206a547-329b-4003-8832-c16daacca6c6", + "version": "KqlParameterItem/1.0", + "name": "isDDoSVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "DDoS", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isElasticVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Elastic", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "c6997d7f-b3e5-431c-b747-ea5a75b533e0" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isRegionalVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Regional", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "250d293f-5d5f-4944-8cd4-5ec0183b9053" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DDoS Protections](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDDoS protections mitigate the effects of distributed denial of service attacks.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) 🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure DDoS Protection]( https://azure.microsoft.com/services/ddos-protection/)
\r\n\r\n### Implementation \r\n💡 [Azure DDoS Protection Standard Overview](https://docs.microsoft.com/azure/ddos-protection/ddos-protection-overview)
\r\n\r\n### Microsoft Portals\r\n🔀 [DDoS Protection Plans](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FddosProtectionPlans)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"dos\" or Title contains \"denial\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: DDoS", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Alert", - "text": "{0}{1}" + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + }, + "sortBy": [] + }, + "customWidth": "50", + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "Resources\r\n| where type contains \"microsoft.network/ddosprotectionplans\"\r\n| extend RG = substring(id, 0, indexof(id, '/providers'))\r\n| extend virtualNetworks = properties.virtualNetworks\r\n| mvexpand bagexpansion=array virtualNetworks\r\n| extend VNETid = virtualNetworks.id\r\n| project-away kind, managedBy, sku, plan, identity, zones, extendedLocation, name, tenantId, properties, tags, virtualNetworks, resourceGroup", + "size": 0, + "showAnalytics": true, + "title": "DDoS Protection Plans", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Subscription}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "type", + "formatter": 16, + "formatOptions": { + "showIcon": true + } + }, + { + "columnMatch": "location", + "formatter": 17 + }, + { + "columnMatch": "subscriptionId", + "formatter": 15, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + }, + { + "columnMatch": "VNETid", + "formatter": 13, + "formatOptions": { + "linkTarget": null, + "showIcon": true + } + } + ], + "filter": true, + "labelSettings": [ + { + "columnId": "id", + "label": "Name" + }, + { + "columnId": "type", + "label": "Type" + }, + { + "columnId": "location", + "label": "Region" + }, + { + "columnId": "subscriptionId", + "label": "Subscription" + }, + { + "columnId": "VNETid", + "label": "Virtual Networks" + } + ] + }, + "sortBy": [] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isResiliencyVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "DDoSPlans" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where Category == \"DDoSMitigationReports\"\r\n| sort by TimeGenerated desc\r\n| extend TopAttackVector = tostring(parse_json(AttackVectors_s)[0]) \r\n| extend Total_packets_ = tostring(parse_json(TrafficOverview_s).Total_packets) \r\n| extend Total_packets_dropped_ = todouble(parse_json(TrafficOverview_s).Total_packets_dropped)\r\n| extend TotalPackets =todouble(Total_packets_)\r\n| where TotalPackets > 0\r\n| where TopAttackVector <> \"\"\r\n| project TopAttackVector, TotalPackets, TotalPacketsDropped = Total_packets_dropped_ , ResourceId , SourceIP=IPAddress, Resource, TimeGenerated\r\n| sort by TotalPacketsDropped desc\r\n| limit 100\r\n\r\n", + "size": 0, + "showAnalytics": true, + "title": "DDoS Mitigation Activity", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "exportedParameters": [ + { + "fieldName": "IPAddress", + "parameterName": "IPAddress", + "parameterType": 1 + }, + { + "fieldName": "ResourceId", + "parameterName": "ResourceId", + "parameterType": 1, + "defaultValue": "ResourceId" + }, + { + "fieldName": "Resource", + "parameterName": "AttackReport", + "parameterType": 1, + "defaultValue": "/" + } + ], + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "TopAttackVector", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "TotalPackets", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "TotalPacketsDropped", + "formatter": 4, + "formatOptions": { + "palette": "green" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "Resource", + "formatter": 5 + }, + { + "columnMatch": "Total_packets_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + }, + { + "columnMatch": "Total_packets_dropped_", + "formatter": 4, + "formatOptions": { + "palette": "green" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumSignificantDigits": 4 + } + } + } + ], + "filter": true + }, + "tileSettings": { + "titleContent": { + "columnMatch": "IPAddress", + "formatter": 12, + "formatOptions": { + "palette": "auto" + } + }, + "subtitleContent": { + "columnMatch": "TopAttackVector", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Resource" + }, + "rightContent": { + "columnMatch": "TimeGenerated" + }, + "showBorder": true, + "size": "auto" + } + }, + "customWidth": "50", + "name": "query - 4" + } + ] + }, + "conditionalVisibility": { + "parameterName": "isDDoSVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "DDoS Protections", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Elastic Expansion](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nElastic expansion enables agencies to dynamically expand the resources available for services as conditions require.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure Virtual Machine Scale Sets](https://azure.microsoft.com/services/virtual-machine-scale-sets/) ✳️ [Traffic Manager]( https://azure.microsoft.com/services/traffic-manager/) ✳️ [Load Balancer]( https://azure.microsoft.com/services/load-balancer/) ✳️ [Azure Availability Zones]( https://azure.microsoft.com/global-infrastructure/availability-zones/)\r\n\r\n### Implementation \r\n💡 [What are Virtual Machine Scale Sets?](https://docs.microsoft.com/azure/virtual-machine-scale-sets/overview) 
\r\n💡 [Elastic Pools Help You Manage and Scale Multiple Databases in Azure SQL Database](https://www.cisa.gov/trusted-internet-connections)
\r\n💡 [What is Azure Load Balancer?](https://docs.microsoft.com/azure/load-balancer/load-balancer-overview)
\r\n💡 [What is Traffic Manager?](https://docs.microsoft.com/azure/traffic-Manager/traffic-Manager-overview)
\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Machine Scale Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Compute%2FvirtualMachineScaleSets)
🔀 [Azure SQL](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Sql%2Fazuresql)
🔀 [Load Balancer](https://portal.azure.com/#blade/Microsoft_Azure_Network/LoadBalancingHubMenuBlade/loadBalancers)
🔀 [Traffic Manager Profiles](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2Ftrafficmanagerprofiles)
🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"load\" or Description contains \"scale\" or Description contains \"front\" or Description contains \"traffic manager\" or Description contains \"pool\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 12531600000, + "endTime": "2022-02-23T15:45:00.000Z" + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"scale\" or type contains \"traffic\" or type contains \"load\" or type contains \"balance\" or type contains \"pool\" or type contains \"set\" or type contains \"manager\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Elastic Expansion Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isResiliencyVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "isElasticVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Elastic Expansion", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Regional Delivery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nRegional delivery technologies enable the deployment of agency services across geographically diverse locations.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter)\r\n\r\n### Implementation \r\n💡 [Building Solutions for High Availability Using Availability Zones](https://docs.microsoft.com/azure/architecture/high-availability/building-solutions-for-high-availability)
 \r\n💡 [Azure Infrastructure Availability](https://docs.microsoft.com/azure/security/fundamentals/infrastructure-availability) 
\r\n💡 [Data residency in Azure](https://azure.microsoft.com/global-infrastructure/data-residency/#overview) 
\r\n💡 [Regions and availability zones](https://docs.microsoft.com/azure/availability-zones/az-overview) 
\r\n\r\n### Microsoft Portals\r\n🔀 [Availability Sets](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Compute%2FavailabilitySets)
\r\n🔄 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"disaster\" or RecommendationDisplayName contains \"region\" or RecommendationDisplayName contains \"redundant\" or RecommendationDisplayName contains \"geo\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 12531600000, + "endTime": "2022-02-23T15:45:00.000Z" + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "redBright" + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where ResultType == 0", + "size": 0, + "showAnalytics": true, + "title": "Sign-Ins By Location", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "map", + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "labelSettings": "Location", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "greenRed" + } } + }, + "customWidth": "50", + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| project id,type,location,resourceGroup\r\n| summarize count() by location\r\n| sort by count_ desc\r\n", + "size": 0, + "showAnalytics": true, + "title": "Assets by Location", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "location", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Globe", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isResiliencyVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isRegionalVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Regional Delivery", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isResiliencyVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "Shadow IT Detection", - "styleSettings": { - "showBorder": true - } + "name": "Resiliency Group" }, { "type": 12, @@ -10788,237 +20428,886 @@ { "type": 1, "content": { - "json": "# [Virtual Private Network (VPN)](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nVirtual private network (VPN) solutions provide a secure communications mechanism between networks that may traverse across unprotected or public networks.\r\n\r\n### Microsoft References \r\n💡 [What is VPN Gateway?](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways)
\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [VPN Gateway]( https://azure.microsoft.com/services/vpn-gateway/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Network Gateways](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.DS, PR.IP, PR.MA, PR.PT](https://www.nist.gov/cyberframework)" + "json": "# [DNS](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nDNS measures including DNS blackholing, DNSSEC for clients, and DNSSEC for domains. \r\n" }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isDNSVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "DNS Capability Guide" }, { - "type": 3, + "type": 1, "content": { - "version": "KqlItem/1.0", - "query": "resources\r\n| where type contains \"gate\" or type contains \"bastion\" or type contains \"route\" or type contains \"privateend\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", - "size": 0, - "showAnalytics": true, - "title": "VPN Assets", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "showExportToExcel": true, - "queryType": 1, - "resourceType": "microsoft.resourcegraph/resources", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "filter": true - } + "json": "" }, - "customWidth": "50", + "customWidth": "60", "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", + "parameterName": "isDNSVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 1" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isEnterpriseVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Virtual Private Network (VPN)", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Unified Communications & Collaboration](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nUCC measures including identity verification, encrypted communications, connection terminations, and data loss prevention. \r\n" - }, - "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Unified Communications & Collaboration Capabilities Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "fdf75962-e198-458c-a72e-e09df349b23a", - "cellValue": "UCC Identity Verification", - "linkTarget": "step", - "linkLabel": "✳️ UCC Identity Verification", - "style": "link" + "name": "text - 111" }, { - "id": "d0d78efd-c1d1-4444-9dd9-dc8e7654895c", - "cellValue": "UCC Encrypted Communication", - "linkTarget": "step", - "linkLabel": "✳️ UCC Encrypted Communication\t", - "style": "link" + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"DNS Sinkholing\\\", \\\"tab\\\": \\\"Sink\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"DNSSEC for Agency Clients\\\", \\\"tab\\\": \\\"Clients\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"DNSSEC for Agency Domains\\\", \\\"tab\\\": \\\"Domains\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } + ], + "queryType": 8, + "gridSettings": { + "formatters": [ + { + "columnMatch": "tab", + "formatter": 5 + } + ] + } + }, + "customWidth": "40", + "name": "query - 8", + "styleSettings": { + "showBorder": true + } }, { - "id": "bd2d8df1-8c53-48ea-97a6-11d0e04c1201", - "cellValue": "UCC Connection Termination", - "linkTarget": "step", - "linkLabel": "✳️ UCC Connection Termination", - "style": "link" + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a206a547-329b-4003-8832-c16daacca6c6", + "version": "KqlParameterItem/1.0", + "name": "isSinkVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Sink", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "aaf5f338-70e7-4910-8b24-0256c3e819ab", + "version": "KqlParameterItem/1.0", + "name": "isClientsVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Clients", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDomainsVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Domains", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "b454a300-8718-4f34-a5e9-722b582dc95d" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" }, { - "id": "792ebae5-b8f3-4842-b97d-d57514d1a22c", - "cellValue": "UCC Data Loss Prevention", - "linkTarget": "step", - "linkLabel": "✳️ UCC Data Loss Prevention", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Unified Communications & Collaboration Capabilities Selector" - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, + "type": 12, "content": { - "json": "# [UCC Identity Verification](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentity verification ensures that access to the virtual meeting is limited to appropriate individuals. Waiting room features, where the meeting host authorizes vetted individuals to join the meeting can also be utilized.\r\n\r\n### Microsoft References \r\n💡 [Security and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-security-guide)
\r\n💡 [Identity Models and Authentication for Microsoft Teams](https://docs.microsoft.com/microsoftteams/identify-models-authentication)
\r\n💡 [Microsoft Sentinel and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-sentinel-guide)
\r\n💡 [Microsoft Teams Meeting Attendance Report](https://docs.microsoft.com/microsoftteams/teams-analytics-and-reports/meeting-attendance-report)
\r\n\r\n### Recommended Logs\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DNS Sinkholing](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNS sinkholing protections are a form of denylisting that protect clients from accessing malicious domains by responding to DNS queries for those domains.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Azure DNS](https://azure.microsoft.com/services/dns/) \r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [What is Azure DNS?](https://docs.microsoft.com/azure/dns/dns-overview)
\r\n💡 [How to protect DNS zones and records](https://docs.microsoft.com/azure/dns/dns-protect-zones-recordsets)
\r\n💡 [Microsoft Defender for DNS](https://docs.microsoft.com/azure/defender-for-cloud/defender-for-dns-introduction)
\r\n💡 [Azure Firewall DNS settings](https://docs.microsoft.com/azure/firewall/dns-settings)
\r\n\r\n### Microsoft Portals\r\n🔀 [DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
🔄 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"domain\" or type contains \"dns\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc\r\n", + "size": 0, + "showAnalytics": true, + "title": "DNS Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isDNSVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"dns\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: DNS", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isSinkVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "DNS Sinkholing", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "OfficeActivity\r\n| where RecordType == \"MicrosoftTeams\"\r\n| where Operation == \"MemberAdded\"\r\n| extend DisplayName_ = tostring(Members[0].DisplayName)\r\n| summarize count() by DisplayName_\r\n| sort by count_ desc \r\n", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Teams: Members Added", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "DisplayName_", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DNSSEC for Agency Clients](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNSSEC protections ensure that domain name lookups from agency clients, whether for internal or external domains, are validated.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityBaselines](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securitybaseline) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/) \r\n\r\n### Implementation \r\n💡 [Enabling Central Visibility For DNS Using Azure Firewall Custom DNS and DNS Proxy](https://techcommunity.microsoft.com/t5/azure-network-security/enabling-central-visibility-for-dns-using-azure-firewall-custom/ba-p/2156331)
\r\n💡 [DANE Support](https://docs.microsoft.com/windows-server/networking/dns/what-s-new-in-dns-server#dane-support)
\r\n💡 [Support of DANE and DNSSEC in Office 365 Exchange Online](https://techcommunity.microsoft.com/t5/exchange-team-blog/support-of-dane-and-dnssec-in-office-365-exchange-online/ba-p/1275494)
\r\n💡 [Apply Azure security baselines to machines](https://docs.microsoft.com/azure/defender-for-cloud/apply-security-baseline)
\r\n\r\n### Microsoft Portals\r\n🔀 [DNS zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
\r\n🔀 [Firewall Manager](https://portal.azure.com/#blade/Microsoft_Azure_HybridNetworking/FirewallManagerMenuBlade/firewallManagerOverview)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let FailedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"dns\"\r\n| where AnalyzeResult == \"Failed\"\r\n| summarize FailedAssets = makelist(Computer) by Description;\r\nlet PassedAssets=SecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"dns\"\r\n| where AnalyzeResult == \"Passed\"\r\n| summarize PassedAssets = makelist(Computer) by Description;\r\nSecurityBaseline\r\n| summarize arg_max(TimeGenerated, *) by _ResourceId, Description\r\n| where Description contains \"dns\"\r\n| summarize\r\n Failed = countif(AnalyzeResult == \"Failed\"),\r\n Passed = countif(AnalyzeResult == \"Passed\"),\r\n Total = countif(AnalyzeResult == \"Failed\" or AnalyzeResult == \"Passed\")\r\n by Description\r\n| extend PassedControls = (Passed / todouble(Total)) * 100\r\n| join kind=fullouter(FailedAssets) on Description\r\n| join kind=fullouter(PassedAssets) on Description\r\n| project Description, Total, PassedControls, Passed, Failed, PassedAssets, FailedAssets\r\n| sort by Total, Passed desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Review Security Baselines", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" + "columnMatch": "RecommendationDisplayName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "ControlNumber", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "AllServices", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "RecommendationState", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "!=", + "thresholdValue": "Healthy", + "representation": "3", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "success", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ], - "filter": true - } + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where Category == \"AzureFirewallDnsProxy\"\r\n| parse msg_s with \"DNS Request: \" ClientIP \":\" ClientPort \" - \" QueryID \" \" Request_Type \" \" Request_Class \" \" Request_Name \". \" Request_Protocol \" \" Request_Size \" \" EDNSO_DO \" \" EDNS0_Buffersize \" \" Responce_Code \" \" Responce_Flags \" \" Responce_Size \" \" Response_Duration\r\n| project-away msg_s\r\n| summarize by TimeGenerated, ResourceId, ClientIP, ClientPort, QueryID, Request_Type, Request_Class, Request_Name, Request_Protocol, Request_Size, EDNSO_DO, EDNS0_Buffersize, Responce_Code, Responce_Flags, Responce_Size, Response_Duration, SubscriptionId\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Request_Type\r\n| render areachart ", + "size": 0, + "showAnalytics": true, + "title": "Azure Firewall: DNS Proxy Actions over Time", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 604800000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isDNSVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 2", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isClientsVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "DNSSEC for Agency Clients", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "OfficeActivity\r\n| where RecordType == \"MicrosoftTeams\"\r\n| summarize count() by Operation\r\n| render piechart ", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Teams Meetings: Operation Count", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [DNSSEC for Agency Domains](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDNSSEC protections ensure that all agency domain names are secured using DNSSEC, enabling external entities to validate their resolution the domain names.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [What is Azure DNS?](https://docs.microsoft.com/azure/dns/dns-overview)
\r\n💡 [Security Recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [DNS Zones](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FdnsZones)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"dns\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 12531600000, + "endTime": "2022-02-23T15:45:00.000Z" + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + } ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isDomainsVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3 - Copy - Copy", + "name": "DNSSEC for Agency Domains", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isDNSVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "UCC Identity Verification", - "styleSettings": { - "showBorder": true - } + "name": "DNS Group" }, { "type": 12, @@ -11029,284 +21318,1869 @@ { "type": 1, "content": { - "json": "# [UCC Encrypted Communication](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCommunication between virtual meeting participants and any data exchanged is encrypted at rest and in transit. Some UCC offerings support end-to-end encryption, where encryption is performed on the clients and can only be decrypted by the other authenticated participants and cannot be decrypted by the UCC vendor.\r\n\r\n### Microsoft References \r\n💡 [Security and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-security-guide)
\r\n💡 [Microsoft Sentinel and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-sentinel-guide)
\r\n💡 [Trustworthy by Default](https://docs.microsoft.com/microsoftteams/teams-security-guide#trustworthy-by-default)
\r\n\r\n### Recommended Logs\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.DS](https://www.nist.gov/cyberframework)" + "json": "# [Intrusion Detection](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nIntrusion Detection measures including endpoint detection & response, intrusion protection systems, adaptive access control, deception platforms, and certificate transparency log monitoring." }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isIntrusionDetectionVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Intrusion Detection Capability Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isIntrusionDetectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 112" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "OfficeActivity\r\n| where RecordType == \"MicrosoftTeams\"\r\n| extend TeamsMembers = strcat(Members)\r\n| distinct Operation, UserId, TeamsMembers, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Microsoft Teams Logs", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Endpoint Detection and Response\\\", \\\"tab\\\": \\\"Endpoint\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Intrusion Protection Systems (IPS)\\\", \\\"tab\\\": \\\"Intrusion\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Adaptive Access Control\\\", \\\"tab\\\": \\\"Adaptive\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Deception Platforms\\\", \\\"tab\\\": \\\"Deception\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Certificate Transparency Log Monitoring\\\", \\\"tab\\\": \\\"Certificate\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "Operation", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Gear", - "text": "{0}{1}" - } - ] - } - }, - { - "columnMatch": "UserId", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] - } + "columnMatch": "tab", + "formatter": 5 } - ], - "filter": true + ] } }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", + "customWidth": "40", + "name": "query - 8", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "UCC Encrypted Communication", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a206a547-329b-4003-8832-c16daacca6c6", + "version": "KqlParameterItem/1.0", + "name": "isEndpointVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Endpoint", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isIntrusionVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Intrusion", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "f683c8d4-894a-4863-a2c6-03d36d6d7819" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isAdaptiveVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Adaptive", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "27dcffa8-43ca-4d68-b69d-11dbd33dcbcb" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDeceptionVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Deception", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "b4f96879-69b4-45b3-b6a6-384a91e9569c" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isCertificateVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Certificate", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "51c9fd25-2fa3-4cca-bc9f-bf8b5d0a0e07" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" + }, + { + "type": 12, "content": { - "json": "# [UCC Connection Termination](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMechanisms that ensure the meeting host can positively control participation. These can include inactivity timeouts, on-demand prompts, unique access codes for each meeting, host participant eviction, and even meeting duration limits.\r\n\r\n### Microsoft References \r\n💡 [Manage Meeting Policies in Teams](https://docs.microsoft.com/microsoftteams/meeting-policies-in-teams)
\r\n💡 [Manage Microsoft Teams Rooms](https://docs.microsoft.com/microsoftteams/rooms/rooms-manage)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, PR.AT](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Endpoint Detection and Response](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nEndpoint detection and response tools combine endpoint and network event data to aid in the detection of malicious activity.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Overview of Endpoint Detection and Response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.AE, DE.CM, RS.AN](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"endpoint protection\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 12531600000, + "endTime": "2022-02-23T15:45:00.000Z" + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| where AdditionalData contains \"Microsoft Defender for Endpoint\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Endpoint Detection & Response", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isEndpointVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Endpoint Detection and Response", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 1, + "type": 12, "content": { - "json": "### ✳️ [Leverage Microsoft Teams for UCC Connection Termination Controls via Meeting Policies](https://docs.microsoft.com/microsoftteams/meeting-policies-in-teams?WT.mc_id=Portal-fx)\r\n![Image Name](https://docs.microsoft.com/microsoftteams/media/designated-presenter-role.png) \r\n" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Intrusion Protection Systems (IPS)](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIntrusion protection systems detect malicious activity, attempt to stop the activity, and report the activity.\r\n\r\n### Implementation \r\n💡 [Azure Firewall Premium: IPS](https://docs.microsoft.com/azure/firewall/premium-features#idps)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [AzureDiagnostics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azurediagnostics) 🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter ✳️ [Azure Firewall]( https://azure.microsoft.com/services/azure-firewall/)\r\n\r\n### Microsoft Portals\r\n🔀 [Firewall Policies](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FfirewallPolicies)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.AE, DE.CM, DE.DP, RS.AN](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"IPS\" or Title contains \"IDS\" or Title contains \"intrusion\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Intrusion Protection System", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureDiagnostics\r\n| where Category == \"AzureFirewallNetworkRule\"\r\n| where OperationName == \"AzureFirewallIDSLog\"\r\n| parse msg_s with * \"TCP request from \" Source \" to \" Destination \". Action: \" ActionTaken \". Rule: \" IDPSSig \". IDS: \" IDSMessage \". Priority: \" Priority \". Classification: \" Classification\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by OperationName\r\n| render areachart ", + "size": 0, + "showAnalytics": true, + "title": "Azure Firewall: IDPS Alerts over Time", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ] + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isIntrusionDetectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"microsoft.network/firewallpolicies\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "IPS Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "name": "query - 1" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isIntrusionVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Intrusion Protection Systems (IPS)", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "UCC Connection Termination", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [UCC Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMechanisms for controlling the sharing of information between UCC participants, intentional or incidental. This may be integrated into additional agency data loss prevention technologies and can include keyword matching, attachment file type or existence prohibitions, attachment size limitations, or even audio/visual filters.\r\n\r\n### Microsoft References \r\n💡 [Data Loss Prevention and Microsoft Teams](https://docs.microsoft.com/microsoft-365/compliance/dlp-microsoft-teams)
\r\n💡[Communication Compliance in Microsoft 365](https://docs.microsoft.com/microsoft-365/compliance/communication-compliance-solution-overview)
\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Security Center](https://security.microsoft.com/)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Adaptive Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAdaptive access control technologies factor in additional context, like security risk, operational needs, and other heuristics, when evaluating access control decisions.\r\n\r\n### Microsoft Reference \r\n💡 [What is Conditional Access?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
\r\n💡 [Use adaptive application controls to reduce your machines' attack surfaces](https://docs.microsoft.com/Azure/defender-for-cloud/adaptive-application-controls)
\r\n💡 [Improve your network security posture with adaptive network hardening](https://docs.microsoft.com/Azure/defender-for-cloud/adaptive-application-controls)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud: Workload Protections](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/26)
\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"adaptive\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Continuous Log Export to this workspace for SecurityRecommendations is enabled. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 12531600000, + "endTime": "2022-02-23T15:45:00.000Z" + }, + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let data = SigninLogs\r\n | where AppDisplayName in ('*') or '*' in ('*')\r\n | where UserDisplayName in ('*') or '*' in ('*')\r\n | extend CAStatus = case(ConditionalAccessStatus == \"success\", \"Successful\",\r\n ConditionalAccessStatus == \"failure\", \"Failed\", \r\n ConditionalAccessStatus == \"notApplied\", \"Not applied\", \r\n isempty(ConditionalAccessStatus), \"Not applied\", \r\n \"Disabled\")\r\n | mvexpand ConditionalAccessPolicies\r\n | extend CAGrantControlName = tostring(ConditionalAccessPolicies.enforcedGrantControls[0])\r\n | extend CAGrantControl = case(CAGrantControlName contains \"MFA\", \"Require MFA\", \r\n CAGrantControlName contains \"Terms of Use\", \"Require Terms of Use\", \r\n CAGrantControlName contains \"Privacy\", \"Require Privacy Statement\", \r\n CAGrantControlName contains \"endpoint\", \"Require endpoint Compliant\", \r\n CAGrantControlName contains \"Azure AD Joined\", \"Require Hybird Azure AD Joined endpoint\", \r\n CAGrantControlName contains \"Apps\", \"Require Approved Apps\",\r\n \"Other\");\r\ndata\r\n| summarize Count = dcount(Id) by CAStatus\r\n| join kind = inner (data\r\n | make-series Trend = dcount(Id) default = 0 on TimeGenerated in range(ago(14d), now(), 6h) by CAStatus\r\n )\r\n on CAStatus\r\n| project-away CAStatus1, TimeGenerated\r\n| order by Count desc", + "size": 0, + "showAnalytics": true, + "title": "Conditional Access Status", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "CAStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + "showBorder": false + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isIntrusionDetectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3 - Copy", + "styleSettings": { + "maxWidth": "50" + } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isAdaptiveVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 2", + "name": "Adaptive Access Control", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "InformationProtectionLogs_CL\r\n| summarize count() by ApplicationName_s, LabelName_s\r\n| sort by count_ desc", - "size": 0, - "showAnalytics": true, - "title": "DLP Logs by Application/Label", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 7776000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Deception Platforms](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nDeception platform technologies provide decoy environments, from individual machines to entire networks, that can be used to deflect attacks away from the operational systems supporting agency missions/business functions.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n\r\n### Microsoft Reference \r\n💡 [Microsoft Sentinel Deception Solution](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/what-s-new-microsoft-sentinel-deception-solution/ba-p/2904945)
\r\n💡 [Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/monitor-key-vault-honeytokens?tabs=deploy-at-scale)
\r\n💡 [Manage Sensitive or Honeytoken Accounts](https://docs.microsoft.com/defender-for-identity/manage-sensitive-honeytoken-accounts)
\r\n\r\n### Microsoft Portal\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Identity](https://portal.atp.azure.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, DE.AE, RS.AN](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where id contains \"deception\" or id contains \"honey\" or id contains \"HTDK\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Deception Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "AlertName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 1" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Title contains \"honeytoken\" or Title contains \"deception\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Deception", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"honey\" or RecommendationDisplayName contains \"deception\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "parameterName": "isDeceptionVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 2" - } - ] - }, - "conditionalVisibility": { - "parameterName": "isUnifiedCommunicationsCollaborationVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "UCC Data Loss Prevention", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 1, - "content": { - "json": "# ✳️ [Data Protection](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nData protection measures including access control, protections for data at rest, protections for data in transit, data loss prevention, and data access & use telemetry. " - }, - "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "customWidth": "50", - "name": "Data Protection Capabilities Guide" - }, - { - "type": 11, - "content": { - "version": "LinkItem/1.0", - "style": "list", - "links": [ - { - "id": "9c4b9c9f-7222-4a89-8f5e-bf41698143fb", - "cellValue": "Access Control_DP", - "linkTarget": "step", - "linkLabel": "✳️ Access Control", - "style": "link" - }, - { - "id": "51c9b125-5b22-48b0-ae6d-2504c7efb4cd", - "cellValue": "Protections for Data at Rest", - "linkTarget": "step", - "linkLabel": "✳️ Protections for Data at Rest", - "style": "link" - }, - { - "id": "1327dfc1-236b-4f1a-b92c-7b4a6999d964", - "cellValue": "Protections for Data in Transit", - "linkTarget": "step", - "linkLabel": "✳️ Protections for Data in Transit", - "style": "link" - }, - { - "id": "b0db0ea1-f337-4c8c-9d17-3cb221dc4378", - "cellValue": "Data Loss Prevention_DP", - "linkTarget": "step", - "linkLabel": "✳️ Data Loss Prevention ", - "style": "link" + "name": "Deception Platforms", + "styleSettings": { + "showBorder": true + } }, { - "id": "6f3d353f-c9dc-4197-836b-98243db6c707", - "cellValue": "Data Access and Use Telemetry", - "linkTarget": "step", - "linkLabel": "✳️ Data Access and Use Telemetry", - "style": "link" + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Certificate Transparency Log Monitoring](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCertificate transparency log monitoring allows agencies to discover when new certificates are issued for agency domains.\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Key Vault](https://azure.microsoft.com/services/key-vault/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Get Started with Key Vault Certificates](https://docs.microsoft.com/azure/key-vault/certificates/certificate-scenarios)
\r\n💡 [Security Recommendations in Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n\r\n### Microsoft Portals\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"cert\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"key\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "Key Vault Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isIntrusionDetectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Description contains \"certificate\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Certificates", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + } + ] + }, + "conditionalVisibility": { + "parameterName": "isCertificateVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Certificate Transparency Log Monitoring", + "styleSettings": { + "showBorder": true + } } ] }, "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isIntrusionDetectionVisible", "comparison": "isEqualTo", "value": "true" }, - "customWidth": "50", - "name": "Data Protection Capabilities Selector" + "name": "Intrusion Detection Group" }, { "type": 12, @@ -11317,223 +23191,1116 @@ { "type": 1, "content": { - "json": "# [Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAccess control technologies allow an agency to define policies concerning the allowable activities of users and entities to data and resources.\r\n\r\n### Microsoft References \r\n💡 [How Access Management in Azure AD works](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-manage-groups#how-access-management-in-azure-ad-works)
\r\n\r\n### Required Log (Log Source)\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Monitor]( https://azure.microsoft.com/services/monitor/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, DE.CM](https://www.nist.gov/cyberframework)" + "json": "# [Enterprise](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nEnterprise-based controls including security orchestration automation & response, shadow IT detection, and virtual private networks. " }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isEnterpriseVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Enterprise Capabilities Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isEnterpriseVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 113" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "AzureActivity\r\n| summarize count() by Caller, OperationName\r\n| where Caller <> \"\"\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "User Actions", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Security Orchestration, Automation, and Response\\\", \\\"tab\\\": \\\"SOAR\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Shadow IT Detection\\\", \\\"tab\\\": \\\"Shadow\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Virtual Private Network (VPN)\\\", \\\"tab\\\": \\\"VPN\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "Caller", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ - { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" - } - ] + "columnMatch": "tab", + "formatter": 5 + } + ] + } + }, + "customWidth": "40", + "name": "query - 8", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6a82c6f2-dde9-45d9-acf4-23e96b5b2647", + "version": "KqlParameterItem/1.0", + "name": "isSOARVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "SOAR", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isShadowVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Shadow", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } + ], + "timeContext": { + "durationMs": 86400000 }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" + "id": "750b4451-0f5d-4e58-95c2-c4b4c8991335" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isVPNVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "VPN", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } } - } - ], - "filter": true - }, - "tileSettings": { - "titleContent": { - "columnMatch": "OperationName", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Runs", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "a2f3d34f-7824-4733-bddc-00efb62da0f2" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Security Orchestration, Automation, and Response (SOAR)](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nSecurity Orchestration, Automation, and Response (SOAR) tools define, prioritize, and automate the response to security incidents.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n🔷 [AzureActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/azureactivity) ✳️ [Azure Logic Apps](https://azure.microsoft.com/services/logic-apps/)
\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n\r\n### Implementation \r\n💡 [Tutorial: Setup Automated Threat Responses in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/tutorial-respond-threats-playbook)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[DE.AE, DE.CM, DE.DP, RS.CO, RS.AN, RC.RP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type == \"microsoft.logic/workflows\"\r\n| extend Connection = parse_json(properties)[\"parameters\"][\"$connections\"][\"value\"]\r\n| where Connection has \"managedApis/azuresentinel\"\r\n| project id, type, resourceGroup", + "size": 0, + "showAnalytics": true, + "title": "SOAR Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEnterpriseVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3 - Copy", + "styleSettings": { + "maxWidth": "50" } }, - "secondaryContent": { - "columnMatch": "TrendList", - "formatter": 9, - "formatOptions": { - "palette": "blue" + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"playbook\" or RecommendationDisplayName contains \"automation\" or RecommendationDisplayName contains \"logic\" or RecommendationDisplayName contains \"notification\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } }, - "showBorder": false - } + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "AzureActivity\r\n| where OperationNameValue startswith \"Microsoft.Logic\"\r\n| where ActivityStatusValue == \"Success\" or ActivityStatusValue == \"Succeeded\"\r\n| extend scope_ = tostring(Authorization_d.scope)\r\n| parse-where scope_ with * 'workflows/' PlaybookName '/' *\r\n| where PlaybookName contains \"notify\" or PlaybookName contains \"email\" or PlaybookName contains \"teams\" or PlaybookName contains \"ticket\" or PlaybookName contains \"post\"\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by PlaybookName\r\n| render timechart ", + "size": 0, + "showAnnotations": true, + "showAnalytics": true, + "title": "Notification SOAR Playbooks (Triggered over Time)", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ] + }, + "customWidth": "50", + "name": "query - 3" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isSOARVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Security Orchestration, Automation, and Response (SOAR)", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "SigninLogs\r\n| where Location <> \"\"\r\n| extend latitude_ = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).latitude)\r\n| extend longitude_ = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)\r\n| extend city_ = tostring(LocationDetails.city)\r\n", - "size": 3, - "showAnalytics": true, - "title": "User Sign-Ins by Geolocation", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "visualization": "map", - "gridSettings": { - "formatters": [ - { - "columnMatch": "Caller", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Shadow IT Detection](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nShadow IT detection systems detect the presence of unauthorized software and systems in use by an agency.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Tutorial: Discover and Manage Shadow IT in Your Network](https://docs.microsoft.com/cloud-app-security/tutorial-shadow-it)
\r\n💡 [Review Your Security Recommendations](https://docs.microsoft.com/azure/security-center/security-center-recommendations)
\r\n💡 [Endpoint Discovery - Navigating Your Way Through Unmanaged Devices](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/endpoint-discovery-navigating-your-way-through-unmanaged-devices/ba-p/2248909)
\r\n💡 [Device Discovery Overview](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/device-discovery)
\r\n💡 [Welcome to Microsoft Defender for IoT](https://docs.microsoft.com/azure/defender-for-iot/overview)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud Apps](https://portal.cloudappsecurity.com/)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft Defender for IoT](https://portal.azure.com/#blade/Microsoft_Azure_IoT_Defender/IoTDefenderDashboard/Getting_Started)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.IP, PR.MA, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Description contains \"shadow\" or Description contains \"unauth\" or Description contains \"rogue\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Shadow IT", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"safe\" or RecommendationDisplayName contains \"authorized\" or RecommendationDisplayName contains \"endpoint protection\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| extend Azure_Inventory=location\r\n| extend M365_Inventory=strcat(\"https://security.microsoft.com/machines\")\r\n| project AssetID=id,AssetType=type, Azure_Inventory, M365_Inventory\r\n| sort by AssetType desc\r\n| limit 2500", + "size": 0, + "showAnalytics": true, + "title": "Review Asset Inventory", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Azure_Inventory", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Azure Inventory >>", + "bladeOpenContext": { + "bladeName": "InventoryBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "", + "source": "static", + "value": "25" + } + ] + } + } + }, + { + "columnMatch": "M365_Inventory", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "M365 Inventory >>" + } + } + ], + "rowLimit": 2500, + "filter": true + } + }, + "customWidth": "50", + "name": "query - 1" + } + ] + }, + "conditionalVisibility": { + "parameterName": "isShadowVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Shadow IT Detection", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Virtual Private Network (VPN)](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nVirtual private network (VPN) solutions provide a secure communications mechanism between networks that may traverse across unprotected or public networks.\r\n\r\n### Recommended Logs\r\n🔷 [Resources](https://docs.microsoft.com/azure/governance/resource-graph/samples/starter) ✳️ [VPN Gateway]( https://azure.microsoft.com/services/vpn-gateway/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [What is VPN Gateway?](https://docs.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways)
\r\n\r\n### Microsoft Portals\r\n🔀 [Virtual Network Gateways](https://portal.azure.com/#blade/HubsExtension/BrowseResourceBlade/resourceType/Microsoft.Network%2FvirtualNetworkGateways)
\r\n🔀 [Microsoft Defender for Cloud: Recommendations](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/5)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.DS, PR.IP, PR.MA, PR.PT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"private\" or RecommendationDisplayName contains \"vpn\" or RecommendationDisplayName contains \"network gateway\" or RecommendationDisplayName contains \"express\" or RecommendationDisplayName contains \"VPC\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } - } - ] - }, - "tileSettings": { - "titleContent": { - "columnMatch": "OperationName", - "formatter": 1 - }, - "leftContent": { - "columnMatch": "Runs", - "formatter": 12, - "formatOptions": { - "palette": "auto" - }, - "numberFormat": { - "unit": 17, - "options": { - "maximumSignificantDigits": 3, - "maximumFractionDigits": 2 - } - } - }, - "secondaryContent": { - "columnMatch": "TrendList", - "formatter": 9, - "formatOptions": { - "palette": "blue" + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } }, - "showBorder": false - }, - "mapSettings": { - "locInfo": "LatLong", - "locInfoColumn": "Location", - "latitude": "latitude_", - "longitude": "longitude_", - "sizeSettings": "city_", - "sizeAggregation": "Count", - "labelSettings": "city_", - "legendMetric": "city_", - "numberOfMetrics": 10, - "legendAggregation": "Count", - "itemColorSettings": { - "nodeColorField": "state_", - "colorAggregation": "Count", - "type": "heatmap", - "heatmapPalette": "coldHot" - }, - "numberFormatSettings": { - "unit": 0, - "options": { - "style": "decimal" - } + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "resources\r\n| where type contains \"gate\" or type contains \"bastion\" or type contains \"route\" or type contains \"privateend\"\r\n| project id,type,location,resourceGroup\r\n| order by location asc", + "size": 0, + "showAnalytics": true, + "title": "VPN Assets", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "showExportToExcel": true, + "queryType": 1, + "resourceType": "microsoft.resourcegraph/resources", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isEnterpriseVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 1" } - } + ] }, "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isVPNVisible", "comparison": "isEqualTo", "value": "true" }, - "showPin": false, - "name": "query - 4" + "name": "Virtual Private Network (VPN)", + "styleSettings": { + "showBorder": true + } } ] }, "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isEnterpriseVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "Access Control_DP", - "styleSettings": { - "showBorder": true - } + "name": "Enterprise Group" }, { "type": 12, @@ -11544,96 +24311,962 @@ { "type": 1, "content": { - "json": "# [Protections for Data at Rest](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData protection at rest aims to secure data stored on any endpoint or storage medium.\r\n\r\n### Microsoft References \r\n💡 [Azure Data Encryption at Rest](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest)
\r\n💡 [About Azure Key Vault](https://docs.microsoft.com/azure/key-vault/general/overview)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" + "json": "# [Unified Communications & Collaboration](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nUCC measures including identity verification, encrypted communications, connection terminations, and data loss prevention. \r\n" }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isUnifiedCommunicationsCollaborationVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Unified Communications & Collaboration Capabilities Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 114" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n|where RecommendationName contains \"encrypt\" \r\n| summarize count() by RecommendationName, AssessedResourceId, RecommendationLink\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Data at Rest Recommenations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"UCC Identity Verification\\\", \\\"tab\\\": \\\"Identity\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"UCC Encrypted Communication\\\", \\\"tab\\\": \\\"Encrypted\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"UCC Connection Termination\\\", \\\"tab\\\": \\\"Connection\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"UCC Data Loss Prevention\\\", \\\"tab\\\": \\\"Data\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "RecommendationName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "tab", + "formatter": 5 + } + ] + } + }, + "customWidth": "40", + "name": "query - 8", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a206a547-329b-4003-8832-c16daacca6c6", + "version": "KqlParameterItem/1.0", + "name": "isIdentityVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Identity", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isEncryptedVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Encrypted", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "9b640df5-5ec5-41bc-8e78-086304ed742a" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isConnectionVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Connection", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "893f0857-1ccf-4c35-8432-abe89d1fcf15" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDataVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Data", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "767d26fb-524c-448c-9240-40f069a8db45" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [UCC Identity Verification](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentity verification ensures that access to the virtual meeting is limited to appropriate individuals. Waiting room features, where the meeting host authorizes vetted individuals to join the meeting can also be utilized.\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation \r\n💡 [Security and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-security-guide)
\r\n💡 [Identity Models and Authentication for Microsoft Teams](https://docs.microsoft.com/microsoftteams/identify-models-authentication)
\r\n💡 [Microsoft Sentinel and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-sentinel-guide)
\r\n💡 [Microsoft Teams Meeting Attendance Report](https://docs.microsoft.com/microsoftteams/teams-analytics-and-reports/meeting-attendance-report)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where AppDisplayName has_any (\"teams\", \"webex\", \"slack\", \"zoom\", \"meet\", \"chat\", \"goto\")\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserProfile, UserId, AppDisplayName\r\n| join (LastObserved) on UserPrincipalName\r\n| project UserPrincipalName, AppDisplayName, SignInCount=count_, UserProfile, LastSignIn, UserId\r\n| sort by SignInCount desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "UCC Authentications", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "SignInCount", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "UserProfile", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "AAD User Profile >>", + "bladeOpenContext": { + "bladeName": "UserDetailsMenuBlade", + "extensionName": "Microsoft_AAD_IAM", + "bladeParameters": [ + { + "name": "userId", + "source": "column", + "value": "UserId" + } + ] + } + } + }, + { + "columnMatch": "UserId", + "formatter": 5 + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "yellowOrangeRed" + } + } + ], + "filter": true + }, + "sortBy": [], + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 100, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + } + } + }, + "customWidth": "50", + "name": "query - 9" + } + ] + }, + "conditionalVisibility": { + "parameterName": "isIdentityVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "UCC Identity Verification", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [UCC Encrypted Communication](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nCommunication between virtual meeting participants and any data exchanged is encrypted at rest and in transit. Some UCC offerings support end-to-end encryption, where encryption is performed on the clients and can only be decrypted by the other authenticated participants and cannot be decrypted by the UCC vendor.\r\n\r\n### Recommended Logs\r\n🔷 [OfficeActivity](https://docs.microsoft.com/azure/azure-monitor/reference/tables/officeactivity) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityrecommendation) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Security and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-security-guide)
\r\n💡 [Microsoft Sentinel and Microsoft Teams](https://docs.microsoft.com/microsoftteams/teams-sentinel-guide)
\r\n💡 [Trustworthy by Default](https://docs.microsoft.com/microsoftteams/teams-security-guide#trustworthy-by-default)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Admin Center](https://admin.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.PT, PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "OfficeActivity\r\n| where RecordType == \"MicrosoftTeams\"\r\n| extend TeamsMembers = strcat(Members)\r\n| distinct Operation, UserId, TeamsMembers, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Microsoft Teams Logs", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Operation", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "UserId", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName contains \"web apps\"\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "isEncryptedVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "UCC Encrypted Communication", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [UCC Connection Termination](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMechanisms that ensure the meeting host can positively control participation. These can include inactivity timeouts, on-demand prompts, unique access codes for each meeting, host participant eviction, and even meeting duration limits.\r\n\r\n### Implementation \r\n💡 [Manage Meeting Policies in Teams](https://docs.microsoft.com/microsoftteams/meeting-policies-in-teams)
\r\n💡 [Manage Microsoft Teams Rooms](https://docs.microsoft.com/microsoftteams/rooms/rooms-manage)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Teams Admin Center](https://admin.teams.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, PR.AT](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 1, + "content": { + "json": "### ✳️ [Leverage Microsoft Teams for UCC Connection Termination Controls via Meeting Policies](https://docs.microsoft.com/microsoftteams/meeting-policies-in-teams?WT.mc_id=Portal-fx)\r\n![Image Name](https://docs.microsoft.com/microsoftteams/media/designated-presenter-role.png) \r\n" + }, + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 3", + "styleSettings": { + "maxWidth": "50" + } + } + ] + }, + "conditionalVisibility": { + "parameterName": "isConnectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "UCC Connection Termination", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [UCC Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nMechanisms for controlling the sharing of information between UCC participants, intentional or incidental. This may be integrated into additional agency data loss prevention technologies and can include keyword matching, attachment file type or existence prohibitions, attachment size limitations, or even audio/visual filters.\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n\r\n### Implementation \r\n💡 [Data Loss Prevention and Microsoft Teams](https://docs.microsoft.com/microsoft-365/compliance/dlp-microsoft-teams)
\r\n💡[Communication Compliance in Microsoft 365](https://docs.microsoft.com/microsoft-365/compliance/communication-compliance-solution-overview)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft 365 Defender](https://security.microsoft.com/)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 2" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InformationProtectionLogs_CL\r\n| summarize count() by ApplicationName_s, LabelName_s\r\n| sort by count_ desc", + "size": 0, + "showAnalytics": true, + "title": "Sensitive Data Actions by Application", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Gear", - "text": "{0}{1}" + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "orange" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" - } + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isUnifiedCommunicationsCollaborationVisible", + "comparison": "isEqualTo", + "value": "true" }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } - } - ], - "filter": true - } + "name": "query - 2" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isDataVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "UCC Data Loss Prevention", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] }, "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isUnifiedCommunicationsCollaborationVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "Protections for Data at Rest", - "styleSettings": { - "showBorder": true - } + "name": "UCC Group" }, { "type": 12, @@ -11644,240 +25277,1766 @@ { "type": 1, "content": { - "json": "# [Protections for Data in Transit](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData protection in transit, or data in motion, aims to secure data that is actively moving from one location to another, such as across the internet or through a private enterprise network.\r\n\r\n### Microsoft References \r\n💡 [Azure Data Encryption in Transit](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit)
\r\n💡 [About Azure Key Vault](https://docs.microsoft.com/azure/key-vault/general/overview)\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [Encryption for Data in Transit](https://docs.microsoft.com/compliance/assurance/assurance-encryption-in-transit)
\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" + "json": "# [Data Protection](https://www.cisa.gov/trusted-internet-connections)\r\n---\r\nData protection measures including access control, protections for data at rest, protections for data in transit, data loss prevention, and data access & use telemetry. " }, - "customWidth": "50", + "customWidth": "40", "conditionalVisibility": { "parameterName": "isDataProtectionVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", - "styleSettings": { - "maxWidth": "50" - } + "name": "Data Protection Capabilities Guide" + }, + { + "type": 1, + "content": { + "json": "" + }, + "customWidth": "60", + "conditionalVisibility": { + "parameterName": "isDataProtectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "text - 115" }, { "type": 3, "content": { "version": "KqlItem/1.0", - "query": "SecurityRecommendation\r\n|where RecommendationName contains \"HTTP\" or RecommendationName contains \"FTP\" or RecommendationName contains \"traffic\" or RecommendationName contains \"SSL\" or RecommendationName contains \"TLS\" or RecommendationName contains \"Secure Socket\" or RecommendationName contains \"server-side\"\r\n| summarize count() by RecommendationName, AssessedResourceId, RecommendationLink\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Data in Transit Recommenations", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "query": "{\"version\":\"1.0.0\",\"content\":\"[\\r\\n\\t{ \\\"Control\\\": \\\"Access Control\\\", \\\"tab\\\": \\\"Access\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Protections for Data at Rest\\\", \\\"tab\\\": \\\"Rest\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Protections for Data in Transit\\\", \\\"tab\\\": \\\"Transit\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Data Loss Prevention\\\", \\\"tab\\\": \\\"Data\\\" },\\r\\n\\t{ \\\"Control\\\": \\\"Data Access and Use Telemetry\\\", \\\"tab\\\": \\\"Use\\\" }\\r\\n]\",\"transformers\":null}", + "size": 3, + "exportMultipleValues": true, + "exportedParameters": [ + { + "fieldName": "tab", + "parameterName": "Tab", + "parameterType": 1 + } ], + "queryType": 8, "gridSettings": { "formatters": [ { - "columnMatch": "RecommendationName", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "columnMatch": "tab", + "formatter": 5 + } + ] + } + }, + "customWidth": "40", + "name": "query - 8", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "6a82c6f2-dde9-45d9-acf4-23e96b5b2647", + "version": "KqlParameterItem/1.0", + "name": "isAccessVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Access", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "isRestVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Rest", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "b91d3f98-d0d1-4e31-a63c-d949e61ec08b" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isTransitVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Transit", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "a34338fa-6463-4b8f-866f-2d79396eceb7" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isDataVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Data", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "9a520097-2a54-41dd-bf84-7ca039dd1939" + }, + { + "version": "KqlParameterItem/1.0", + "name": "isUseVisible", + "type": 1, + "isHiddenWhenLocked": true, + "criteriaData": [ + { + "criteriaContext": { + "leftOperand": "Tab", + "operator": "contains", + "rightValType": "static", + "rightVal": "Use", + "resultValType": "static", + "resultVal": "true" + } + }, + { + "criteriaContext": { + "operator": "Default", + "rightValType": "param", + "resultValType": "static", + "resultVal": "false" + } + } + ], + "timeContext": { + "durationMs": 86400000 + }, + "id": "22c31b63-743c-4b33-924e-26a70aa0fefb" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "customWidth": "10", + "name": "Hidden Parameters Selectors" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Access Control](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nAccess control technologies allow an agency to define policies concerning the allowable activities of users and entities to data and resources.\r\n\r\n### Recommended Logs\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Implementation \r\n💡 [How Access Management in Azure AD works](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-manage-groups#how-access-management-in-azure-ad-works)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.AC, PR.IP, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let LastObserved = SigninLogs\r\n| where ResultType == 0\r\n| summarize arg_max(TimeGenerated, *) by UserPrincipalName\r\n| project UserPrincipalName, LastSignIn=TimeGenerated;\r\nSigninLogs\r\n| extend UserProfile = strcat(\"https://portal.azure.com/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/\", UserId)\r\n| where ResultType == 0\r\n| summarize count() by UserPrincipalName, UserProfile, UserId, AppDisplayName\r\n| join (LastObserved) on UserPrincipalName\r\n| project UserPrincipalName, AppDisplayName, SignInCount=count_, UserProfile, LastSignIn, UserId\r\n| sort by SignInCount desc\r\n| limit 2500\r\n", + "size": 0, + "showAnalytics": true, + "title": "User Access by Application", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Gear", - "text": "{0}{1}" + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "SignInCount", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "UserProfile", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "AAD User Profile >>", + "bladeOpenContext": { + "bladeName": "UserDetailsMenuBlade", + "extensionName": "Microsoft_AAD_IAM", + "bladeParameters": [ + { + "name": "userId", + "source": "column", + "value": "UserId" + } + ] + } + } + }, + { + "columnMatch": "UserId", + "formatter": 5 + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "yellowOrangeRed" + } + } + ], + "rowLimit": 2500, + "filter": true + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "OperationName", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Runs", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "TrendList", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 100, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + } + } + }, + "customWidth": "50", + "name": "query - 9" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SigninLogs\r\n| where ResultType == 0\r\n| where Location <> \"\"\r\n| extend latitude_ = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).latitude)\r\n| extend longitude_ = tostring(parse_json(tostring(LocationDetails.geoCoordinates)).longitude)\r\n| extend city_ = tostring(LocationDetails.city)\r\n\r\n", + "size": 3, + "showAnalytics": true, + "title": "User Sign-Ins by Geolocation", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "map", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Caller", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } ] + }, + "tileSettings": { + "titleContent": { + "columnMatch": "OperationName", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Runs", + "formatter": 12, + "formatOptions": { + "palette": "auto" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 3, + "maximumFractionDigits": 2 + } + } + }, + "secondaryContent": { + "columnMatch": "TrendList", + "formatter": 9, + "formatOptions": { + "palette": "blue" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "LatLong", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "city_", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "city_", + "numberOfMetrics": 10, + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "state_", + "colorAggregation": "Count", + "type": "heatmap", + "heatmapPalette": "coldHot" + }, + "numberFormatSettings": { + "unit": 0, + "options": { + "style": "decimal" + } + } } }, - { - "columnMatch": "RecommendationLink", - "formatter": 7, - "formatOptions": { - "linkTarget": "Url", - "linkLabel": "Go to Recommendation >>" + "conditionalVisibility": { + "parameterName": "isDataProtectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "showPin": false, + "name": "query - 4" + } + ] + }, + "conditionalVisibility": { + "parameterName": "isAccessVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "Access Control", + "styleSettings": { + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Protections for Data at Rest](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData protection at rest aims to secure data stored on any endpoint or storage medium.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Azure Data Encryption at Rest](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest)
\r\n💡 [About Azure Key Vault](https://docs.microsoft.com/azure/key-vault/general/overview)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName has_any(\"encrypt\", \"storage\", \"database\", \"databases\", \"SQL\", \"disk\", \"disks\")\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "orange" - } + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } - }, - "customWidth": "50", - "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "query - 3", - "styleSettings": { - "maxWidth": "50" - } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Protections for Data in Transit", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ - { - "type": 1, - "content": { - "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Microsoft References \r\n💡 [What is Azure Information Protection?](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\r\n💡 [Quickstart: Deploying the Azure Information Protection (AIP) Unified Labeling Client](https://docs.microsoft.com/azure/information-protection/quickstart-deploy-client)
\r\n💡 [Azure Information Protection (AIP) Labeling, Classification, and Protection](https://docs.microsoft.com/azure/information-protection/aip-classification-and-protection)
\r\n💡 [What is Azure Purview?](https://docs.microsoft.com/azure/purview/overview)
\r\n💡 [Overview of Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/data-loss-prevention-policies)
\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Purview Accounts](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Purview%2FAccounts)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\t\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isRestVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Protections for Data at Rest", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "InformationProtectionLogs_CL\r\n| make-series count() default=0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step 1d by Activity_s, Operation_s, LabelName_s, ApplicationName_s\r\n| render areachart ", - "size": 0, - "showAnalytics": true, - "title": "DLP Actions over Time", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Protections for Data in Transit](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData protection in transit, or data in motion, aims to secure data that is actively moving from one location to another, such as across the internet or through a private enterprise network.\r\n\r\n### Recommended Logs\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Azure Data Encryption in Transit](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit)
\r\n💡 [About Azure Key Vault](https://docs.microsoft.com/azure/key-vault/general/overview)
\r\n💡 [Use Microsoft Defender for Cloud Recommendations to Enhance Security](https://docs.microsoft.com/azure/security-center/security-center-using-recommendations)
\r\n💡 [Encryption for Data in Transit](https://docs.microsoft.com/compliance/assurance/assurance-encryption-in-transit)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n🔀 [Key Vaults](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.KeyVault%2Fvaults)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let CustomView = SecurityRecommendation | summarize arg_max(TimeGenerated,*) by RecommendationName| project RecommendationName, RecommendationLink | parse RecommendationLink with * 'portal.azure.com/#blade/Microsoft_Azure_Security/RecommendationsBlade/assessmentKey/' assessmentKey '/' *;\r\nSecurityRecommendation\r\n| where RecommendationDisplayName has_any(\"http\", \"https\", \"TLS\", \"transfer\", \"transit\", \"Secure Socket\", \"SSH\", \"just\", \"FTP\", \"server-side\")\r\n| summarize arg_max(TimeGenerated, *) by AssessedResourceId, RecommendationDisplayName\r\n| summarize Failed = countif(RecommendationState == \"Unhealthy\"), Passed = countif(RecommendationState == \"Healthy\"), Total = countif(RecommendationState == \"Unhealthy\" or RecommendationState == \"Healthy\") by RecommendationName\r\n| extend PassedControls = (Passed/todouble(Total))*100\r\n| join (CustomView) on RecommendationName\r\n| project RecommendationName, Total, PassedControls, Passed, Failed, RecommendationLink, assessmentKey\r\n| where Total > 0\r\n| sort by Total, Passed desc", + "size": 0, + "showAnalytics": true, + "title": "Security Recommendations ", + "noDataMessage": "Confirm Microsoft Defender for Cloud: Regulatory Compliance Initiative for NIST SP 800-53 R4 is enabled with Microsoft Defender for Cloud Continous Log Export to this workspace. See Getting Started steps in the help tab above for more information", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "RecommendationName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Gear", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Total", + "formatter": 22, + "formatOptions": { + "compositeBarSettings": { + "labelText": "", + "columnSettings": [ + { + "columnName": "Passed", + "color": "green" + }, + { + "columnName": "Failed", + "color": "redBright" + } + ] + } + } + }, + { + "columnMatch": "PassedControls", + "formatter": 0, + "numberFormat": { + "unit": 1, + "options": { + "style": "decimal", + "useGrouping": true, + "maximumFractionDigits": 2 + } + } + }, + { + "columnMatch": "RecommendationLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Remediate >>", + "bladeOpenContext": { + "bladeName": "RecommendationsBlade", + "extensionName": "Microsoft_Azure_Security", + "bladeParameters": [ + { + "name": "assessmentKey", + "source": "column", + "value": "assessmentKey" + } + ] + } + } + }, + { + "columnMatch": "assessmentKey", + "formatter": 5 + }, + { + "columnMatch": "Family", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ControlFamily", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Persistence", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "coldHot" + } + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 9", + "styleSettings": { + "maxWidth": "50" + } + } ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isTransitVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Protections for Data in Transit", "styleSettings": { - "maxWidth": "50" + "showBorder": true } - } - ] - }, - "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", - "comparison": "isEqualTo", - "value": "true" - }, - "name": "Data Loss Prevention_DP", - "styleSettings": { - "showBorder": true - } - }, - { - "type": 12, - "content": { - "version": "NotebookGroup/1.0", - "groupType": "editable", - "items": [ + }, { - "type": 1, + "type": 12, "content": { - "json": "# [Data Access and Use Telemetry](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentify agency sensitive data stored, processed, or transmitted, including those located at a service provider. Enforce detailed logging for access or changes to sensitive data.\r\n\r\n### Microsoft Reference \r\n💡 [What is Azure Information Protection?](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\r\n💡 [Tutorial: Discovering Your Sensitive Content with the Azure Information Protection (AIP) scanner](https://docs.microsoft.com/azure/information-protection/tutorial-scan-networks-and-content)
\r\n💡 [Quickstart: Deploying the Azure Information Protection (AIP) Unified Labeling Client](https://docs.microsoft.com/azure/information-protection/quickstart-deploy-client)
\r\n💡 [Azure Information Protection (AIP) Labeling, Classification, and Protection](https://docs.microsoft.com/azure/information-protection/aip-classification-and-protection)
\r\n💡 [Overview of Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/data-loss-prevention-policies)
\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.PT, DE.AE, DE.CM](https://www.nist.gov/cyberframework)" + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Data Loss Prevention](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nData loss prevention technologies detect instances of the exfiltration, either malicious or accidental, of agency data.\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityAlert](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityalert) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/) ✳️ [Microsoft Defender for Office 365]( https://www.microsoft.com/microsoft-365/security/office-365-defender) ✳️ [Microsoft Defender for Endpoint]( https://www.microsoft.com/microsoft-365/security/endpoint-defender)
\r\n\r\n### Implementation \r\n💡 [How to Configure a Label for Rights Management Protection](https://docs.microsoft.com/azure/information-protection/configure-policy-protection)
\r\n💡 [Hunt for Threats with Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/hunting)
\r\n💡 [Learn about Microsoft 365 Endpoint Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about)
\r\n💡 [Configure and View Alerts for DLP Polices](https://docs.microsoft.com/microsoft-365/compliance/dlp-configure-view-alerts-policies)
\r\n\r\n### Microsoft Portals\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Office 365 Security & Compliance Center](https://protection.office.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[PR.DS](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "SecurityIncident\r\n| extend Tactics = tostring(parse_json(tostring(AdditionalData.tactics)))\r\n| where Description contains \"data\" or Title contains \"data\" or Description contains \"loss\" or Title contains \"loss\" or Description contains \"exfil\" or Title contains \"exfil\" or Tactics contains \"exfil\"\r\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\r\n| parse IncidentUrl with * 'https://portal.azure.com/#asset/Microsoft_Azure_Security_Insights/Incident' IncidentBlade\r\n| extend SeverityRank=iff(Severity == \"High\", 3, iff(Severity == \"Medium\", 2, iff(Severity == \"Low\", 1, iff(Severity == \"Informational\", 0, 0))))\r\n| sort by SeverityRank, TimeGenerated desc\r\n| project ['Incident Name']=Title, IncidentNumber, Severity, IncidentUrl, FirstActivityTime, IncidentBlade\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Security Incidents: Data Loss", + "noDataMessage": "No Incidents Observed For This Technique Within These Thresholds", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "Incident Name", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Alert", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "Sev0", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "Sev1", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "Sev2", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "Sev3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "OpenBlade", + "linkLabel": "Go to Incident >>", + "bladeOpenContext": { + "bladeName": "CaseBlade", + "extensionName": "Microsoft_Azure_Security_Insights", + "bladeParameters": [ + { + "name": "id", + "source": "column", + "value": "IncidentBlade" + } + ] + } + } + }, + { + "columnMatch": "IncidentBlade", + "formatter": 5 + } + ], + "filter": true + } + }, + "customWidth": "50", + "name": "query - 3" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InformationProtectionLogs_CL\r\n| project UserId_s, LabelName_s, Operation_s, Activity_s, IPv4_s, ProtectionOwner_s, ApplicationName_s, ProcessName_s, Platform_s, ContentId_g, TimeGenerated\r\n| sort by TimeGenerated desc\r\n| limit 250\r\n", + "size": 0, + "showAnalytics": true, + "title": "Scan/Monitor for Sensitive Data with Azure Information Protection", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserId_s", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "3", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "Severity", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "High", + "representation": "red", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "blue", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "ProductName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "uninitialized", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "AlertLink", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Alert >" + } + }, + { + "columnMatch": "UPN", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "2", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "IncidentUrl", + "formatter": 7, + "formatOptions": { + "linkTarget": "Url", + "linkLabel": "Go to Incident >" + }, + "numberFormat": { + "unit": 0, + "options": { + "style": "decimal" + } + } + }, + { + "columnMatch": "count_", + "formatter": 8, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "city_", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blue", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "state_", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blueDark", + "text": "{0}{1}" + } + ] + } + } + ], + "filter": true + }, + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "green" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "latitude": "SourceIPLocation", + "longitude": "SourceIPLocation", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "blueDark" + } + ] + } + } + }, + "customWidth": "50", + "name": "query - 2" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isDataVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "text - 3", + "name": "Data Loss Prevention", "styleSettings": { - "maxWidth": "50" + "showBorder": true } }, { - "type": 3, + "type": 12, "content": { - "version": "KqlItem/1.0", - "query": "InformationProtectionLogs_CL\r\n| summarize count() by UserId_s, LabelName_s, ApplicationName_s_s, Operation_s_s, Platform_s_s, Activity_s_s, IPv4_s_s\r\n| sort by count_ desc\r\n| limit 250", - "size": 0, - "showAnalytics": true, - "title": "Data Access and Use Telemetry", - "noDataMessage": "An Empty Panel Provides Opportunity To Explore This Control Further and Implement Solutions • Confirm Licensing, Availability, and Health of Respective Offerings • Confirm Log Source is Onboarded to Microsoft Sentinel Workspace • Adjust the Time Paramenter for a Larger Data-Set • Panels Can Display 'No Data' if All Recommendations are Fully Implemented, See Microsoft Defender for Cloud Recommendations • Third Party Tooling: Adjust Respective Panel KQL Query for Third Pary Tooling Requirements", - "timeContext": { - "durationMs": 2592000000 - }, - "timeContextFromParameter": "TimeRange", - "showExportToExcel": true, - "queryType": 0, - "resourceType": "microsoft.operationalinsights/workspaces", - "crossComponentResources": [ - "{Workspace}" - ], - "gridSettings": { - "formatters": [ - { - "columnMatch": "UserId_s", - "formatter": 18, - "formatOptions": { - "thresholdsOptions": "icons", - "thresholdsGrid": [ + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# [Data Access and Use Telemetry](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentify agency sensitive data stored, processed, or transmitted, including those located at a service provider. Enforce detailed logging for access or changes to sensitive data.\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Reference \r\n💡 [What is Azure Information Protection?](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\r\n💡 [Tutorial: Discovering Your Sensitive Content with the Azure Information Protection (AIP) scanner](https://docs.microsoft.com/azure/information-protection/tutorial-scan-networks-and-content)
\r\n💡 [Quickstart: Deploying the Azure Information Protection (AIP) Unified Labeling Client](https://docs.microsoft.com/azure/information-protection/quickstart-deploy-client)
\r\n💡 [Azure Information Protection (AIP) Labeling, Classification, and Protection](https://docs.microsoft.com/azure/information-protection/aip-classification-and-protection)
\r\n💡 [Overview of Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/data-loss-prevention-policies)
\r\n\r\n### Microsoft Portals\r\n🔄 [Azure Active Directory](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.PT, DE.AE, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + }, + "name": "text - 3" + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "52668f65-b44a-4e14-82d8-c87410e7e5dc", + "version": "KqlParameterItem/1.0", + "name": "ImplementationStatus", + "label": "Status", + "type": 2, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[\r\n {\"value\": \"Not Implemented\", \"label\": \"Not Implemented\", \"selected\":true},\r\n {\"value\": \"Implemented\", \"label\": \"Implemented\"},\r\n {\"value\": \"Alternate Implementation\", \"label\": \"Alternate Implementation\"},\r\n {\"value\": \"Planned\", \"label\": \"Planned\"},\r\n {\"value\": \"Out of Scope\", \"label\": \"Out of Scope\"}\r\n]", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "id": "578b8620-30b9-4b92-abc6-997998bc8156", + "version": "KqlParameterItem/1.0", + "name": "ImplementationDate", + "label": "Date", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + } + }, + { + "version": "KqlParameterItem/1.0", + "name": "Notes", + "type": 1, + "value": "", + "timeContext": { + "durationMs": 86400000 + }, + "id": "7bd0d384-d3c3-4c77-9dae-d75e823edfcf" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "Status" + }, + { + "type": 1, + "content": { + "json": "### Notes
\r\n{Notes}" + }, + "name": "text - 1" + } + ] + }, + "name": "group - 2" + } + ] + }, + "customWidth": "50", + "name": "Control Smartcard" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InformationProtectionLogs_CL\r\n| summarize count() by UserId_s, LabelName_s, ApplicationName_s_s, Operation_s_s, Platform_s_s, Activity_s_s, IPv4_s_s\r\n| sort by count_ desc\r\n| limit 250", + "size": 0, + "showAnalytics": true, + "title": "Data Access and Use Telemetry", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 2592000000 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "gridSettings": { + "formatters": [ { - "operator": "Default", - "thresholdValue": null, - "representation": "Person", - "text": "{0}{1}" + "columnMatch": "UserId_s", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "Person", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "count_", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } } - ] + ], + "filter": true } }, - { - "columnMatch": "count_", - "formatter": 4, - "formatOptions": { - "palette": "blue" - } + "customWidth": "50", + "conditionalVisibility": { + "parameterName": "isDataProtectionVisible", + "comparison": "isEqualTo", + "value": "true" + }, + "name": "query - 3", + "styleSettings": { + "maxWidth": "50" } - ], - "filter": true - } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "InformationProtectionLogs_CL\r\n| extend UserPrincipalName = UserId_s_s\r\n| where LabelName_s <> \"\"\r\n| join (SigninLogs) on UserPrincipalName\r\n| extend City = tostring(LocationDetails.city)\r\n| extend State = tostring(LocationDetails.state)\r\n| extend Country_Region = tostring(LocationDetails.countryOrRegion)\r\n", + "size": 3, + "showAnalytics": true, + "title": "Sensitive Data Access by Geolocation", + "noDataMessage": "An Empty Panel Provides Opportunity To Explore Further and Implement Hardening. Controls: Confirm Licensing, Availability, and Health of Respective Offerings. Logging: Confirm Log Source is Onboarded to the Log Analytics Workspace. Time: Adjust the Time Parameter for a Larger Data-Set. ", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "showExportToExcel": true, + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "crossComponentResources": [ + "{Workspace}" + ], + "visualization": "map", + "gridSettings": { + "formatters": [ + { + "columnMatch": "UserPrincipalName", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "icons", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "warning", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "UncommonActionVolume", + "formatter": 4, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "UncommonAction", + "formatter": 4, + "formatOptions": { + "palette": "green" + } + }, + { + "columnMatch": "FirstTimeUserAction", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + }, + { + "columnMatch": "FirstTimeDeviceLogon", + "formatter": 4, + "formatOptions": { + "palette": "yellow" + } + }, + { + "columnMatch": "IncidentCount", + "formatter": 8, + "formatOptions": { + "palette": "redBright" + } + }, + { + "columnMatch": "AlertCount", + "formatter": 8, + "formatOptions": { + "palette": "orange" + } + }, + { + "columnMatch": "AnomalyCount", + "formatter": 8, + "formatOptions": { + "palette": "yellow" + } + } + ] + }, + "sortBy": [], + "tileSettings": { + "titleContent": { + "columnMatch": "SigninStatus", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Count", + "formatter": 12, + "formatOptions": { + "palette": "blue" + }, + "numberFormat": { + "unit": 17, + "options": { + "style": "decimal", + "maximumFractionDigits": 2, + "maximumSignificantDigits": 3 + } + } + }, + "secondaryContent": { + "columnMatch": "Trend", + "formatter": 9, + "formatOptions": { + "palette": "green" + } + }, + "showBorder": false + }, + "mapSettings": { + "locInfo": "CountryRegion", + "locInfoColumn": "Location", + "latitude": "latitude_", + "longitude": "longitude_", + "sizeSettings": "Location", + "sizeAggregation": "Count", + "labelSettings": "city_", + "legendMetric": "Location", + "legendAggregation": "Count", + "itemColorSettings": { + "nodeColorField": "Location", + "colorAggregation": "Count", + "type": "thresholds", + "thresholdsGrid": [ + { + "operator": "Default", + "thresholdValue": null, + "representation": "yellow" + } + ] + } + } + }, + "name": "query - 12" + } + ] }, - "customWidth": "50", "conditionalVisibility": { - "parameterName": "isDataProtectionVisible", + "parameterName": "isUseVisible", "comparison": "isEqualTo", "value": "true" }, - "name": "query - 3", + "name": "Data Access and Use Telemetry", "styleSettings": { - "maxWidth": "50" + "showBorder": true } } ] @@ -11887,10 +27046,7 @@ "comparison": "isEqualTo", "value": "true" }, - "name": "Data Access and Use Telemetry", - "styleSettings": { - "showBorder": true - } + "name": "Data Protection Group" } ], "fromTemplateId": "sentinel-ZeroTrust(TIC3.0)", diff --git a/Solutions/ZeroTrust(TIC3.0)/readme.md b/Solutions/ZeroTrust(TIC3.0)/readme.md index dc87a337f5f..8d9c9fdabd1 100644 --- a/Solutions/ZeroTrust(TIC3.0)/readme.md +++ b/Solutions/ZeroTrust(TIC3.0)/readme.md @@ -1,6 +1,6 @@ # Overview --- -The Microsoft Sentinel Zero Trust (TIC3.0) Solution provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft portfolio. This solution enables governance and compliance teams to design, build, monitor, and respond to Zero Trust (TIC3.0) requirements across 25+ Microsoft products. The solution includes the new Zero Trust (TIC3.0) Workbook, (11) Analytics Rules, and (1) Playbook. While only Microsoft Sentinel is required to get started, the solution is enhanced with numerous Microsoft offerings. This Solution enables Security Architects, Engineers, SecOps Analysts, Managers, and IT Pros to gain situational awareness visibility for the security posture of cloud workloads. There are also recommendations for selecting, designing, deploying, and configuring Microsoft offerings for alignment with respective security best practice. +The Microsoft Sentinel Zero Trust (TIC 3.0) Solution provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft and partner ecosystem. This solution enables governance and compliance teams to design, build, monitor, and respond to Zero Trust (TIC 3.0) requirements across 25+ Microsoft and 3rd party products. The solution includes the new Zero Trust (TIC 3.0) Workbook, (1) Analytics Rule, and (3) Playbooks. While only Microsoft Sentinel and Microsoft Defender for Cloud are required to get started, the solution is enhanced with numerous Microsoft offerings. This Solution enables Security Architects, Engineers, SecOps Analysts, Managers, and IT Pros to gain situational awareness visibility for the security posture of cloud, multi-cloud, hybrid, and on-premise workloads. For more information, see 💡[Microsoft Zero Trust Model](https://www.microsoft.com/security/business/zero-trust) 💡[Trusted Internet Connections: Core Guidance Documents](https://www.cisa.gov/trusted-internet-connections) ## Try on Portal You can deploy the solution by clicking on the buttons below: @@ -10,14 +10,55 @@ You can deploy the solution by clicking on the buttons below: ![Workbook Overview](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/ZeroTrust(TIC3.0)/Workbooks/Images/Preview/ZeroTrust(TIC3.0)Black1.PNG?raw=true) -# Workbooks -The Microsoft Sentinel Zero Trust (TIC3.0) Workbook provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft portfolio including Microsoft security offerings, Office 365 and many more. This workbook enables Security Architects, Engineers, SecOps Analysts, Managers, and IT Pros to gain situational awareness visibility for the security posture of cloud workloads. There are also recommendations for selecting, designing, deploying, and configuring Microsoft offerings for alignment with respective security best practice. +## Getting Started +This solution is designed to augment staffing through automation, machine learning, query/alerting generation, and visualizations. This workbook leverages Azure Policy, Azure Resource Graph, and Azure Log Analytics to align with Zero Trust (TIC 3.0) control requirements. A filter set is available for custom reporting by guides, subscriptions, workspaces, time-filtering, control family, and controls. This offering telemetry from 25+ Microsoft Security and partner offerings, while only Microsoft Sentinel and Microsoft Defender for Cloud are required to get started, each offering provides additional enrichment for aligning with control requirements. Each control includes a Control Card detailing an overview of requirements, primary/secondary controls, deep-links to referenced product pages/portals, recommendations, implementation guides, compliance cross-walks and tooling telemetry for building situational awareness of cloud workloads. -# Analytics Rules -The Microsoft Sentinel Zero Trust (TIC3.0) Analytics rules leverage Azure Security Center Regulatory Compliance mappings (Derived from NIST SP 800-53 and Azure Security Benchmark Baselines) to measure Zero Trust posture alignment across (11) TIC3.0 control families. The default configuration is set for scheduled rules running every 7 days to reduce alert overload. The default configuration is to alert when posture compliance is below 70% and this number is configurable per organizational requirements. +### [Recommended Microsoft Sentinel Roles](https://docs.microsoft.com/azure/sentinel/roles) / [Recommended Microsoft Defender for Cloud Roles](https://docs.microsoft.com/azure/defender-for-cloud/permissions#roles-and-allowed-actions) +| Roles | Rights | +|:--|:--| +|Security Reader | View Workbooks, Analytics, Hunting, Security Recommendations | +|Security Contributor| Deploy/Modify Workbooks, Analytics, Hunting Queries, Apply Security Recommendations | +|Automation Contributor| Deploy/Modify Playbooks & Automation Rules | -# Playbooks -The Microsoft Sentinel Zero Trust (TIC3.0) Solution includes a Playbook Automation for Security Orchestration Automation & Response (SOAR). This playbook is triggered when an Microsoft Sentinel incident is generated, resulting in an email and Teams chat to the Security Governance Team including respective details of the event and remediation options. Note, this automation requires configuration for Security Governance Team group email address and Teams channel. There is also a requirement to configure this automation rule to trigger for each Zero Trust (TIC3.0) Analytics Rule to ensure the governance team is notified for remediation accordingly. +### Onboarding Prerequisites +1️⃣ [Access Microsoft 365 Compliance Manager: Assessments](https://compliance.microsoft.com/compliancemanager?viewid=Assessments)
+2️⃣ [Onboard Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/quickstart-onboard)
+3️⃣ [Onboard Microsoft Defender for Cloud](https://docs.microsoft.com/azure/security-center/security-center-get-started)
+4️⃣ [Continuously Export Security Center Data to Log Analytics Workspace](https://docs.microsoft.com/azure/security-center/continuous-export)
+5️⃣ [Extend Microsoft Sentinel Across Workspaces and Tenants](https://docs.microsoft.com/azure/sentinel/extend-sentinel-across-workspaces-tenants)
+6️⃣ [Configure Auto Provisioning of Microsoft Defender for Cloud Agents](https://docs.microsoft.com/azure/defender-for-cloud/enable-data-collection)
+7️⃣ [Review Microsoft Service Trust Portal Documentation/Audit/Resources](https://servicetrust.microsoft.com/)
-## Disclaimer -The Microsoft Sentinel Zero Trust (TIC 3.0) Workbook demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All TIC requirements, validations, and controls are governed by the 💡 [Cybersecurity & Infrastructure Security Agency](https://www.cisa.gov/trusted-internet-connections). This workbook provides visibility and situational awareness for control requirements delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations and query modification for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective control requirements. \ No newline at end of file +### Recommended Enrichments +✳️[Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
+✳️[Microsoft Defender for Office 365](https://www.microsoft.com/microsoft-365/security/office-365-defender)
+✳️[Azure Firewall Premium](https://azure.microsoft.com/services/azure-firewall)
+✳️[Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/security/endpoint-defender)
+✳️[Azure Virtual Desktop](https://azure.microsoft.com/services/virtual-desktop/)
+✳️[Azure Web Application Firewall](https://azure.microsoft.com/services/web-application-firewall/)
+✳️[Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
+✳️[Microsoft 365 Defender](https://www.microsoft.com/microsoft-365/security/microsoft-365-defender)
+✳️[Microsoft Defender for Cloud Apps](https://www.microsoft.com/microsoft-365/enterprise-mobility-security/cloud-app-security)
+✳️[Key Vault](https://azure.microsoft.com/services/key-vault/)
+✳️[Azure DDoS Protection](https://azure.microsoft.com/services/ddos-protection/)
+✳️[Microsoft Defender for Identity](https://www.microsoft.com/microsoft-365/security/identity-defender)
+ +## Workbooks +The Microsoft Sentinel Zero Trust (TIC 3.0) Workbook provides a mechanism for viewing log queries aligned to Zero Trust and Trusted Internet Connections models across the Microsoft portfolio including Microsoft security offerings, Office 365 and many more. This workbook enables Security Architects, Engineers, SecOps Analysts, Managers, and IT Pros to gain situational awareness visibility for the security posture of cloud workloads. There are also recommendations for selecting, designing, deploying, and configuring Microsoft offerings for alignment with respective security best practice. + +## Analytics Rule +The Microsoft Sentinel Zero Trust (TIC 3.0) Analytic rule leverages Microsoft Defender for Cloud Security Recommendations to measure Zero Trust posture alignment across (11) TIC 3.0 control families. The default configuration is set for scheduled rules running every 7 days to reduce alert overload. The default configuration is to alert when posture compliance is below 70% and this number is configurable per organizational requirements. + +## Playbooks +### 1) Notify Governance Compliance Team +This Security Orchestration, Automation, & Response (SOAR) capability is designed for configuration with the solution's analytics rules. When analytics rules trigger this automation notifies the governance compliance team of respective details via Teams chat and exchange email. This automation reduces requirements to manually monitor the workbook or analytics rules while increasing response times.
+### 2) Open DevOps Task based on Recommendation +This Security Orchestration, Automation, & Response (SOAR) capability is designed to create an Azure DevOps Task when a Microsoft Defender for Cloud recommendation is triggered. This automation enables a consistent response when resources become unhealthy relative to a predefined recommendation, enabling teams to focus on remediation and improving response times. +### 3) Open JIRA Ticket based on Recommendation +This Security Orchestration, Automation, & Response (SOAR) capability is designed to open a Jira issue when an recommendation is unhealthy in Microsoft Defender for Cloud. This automation improves time to response by providing consistent notifications when resources become unhealthy relative to a predefined recommendation. + +### Disclaimer +The Microsoft Sentinel Zero Trust (TIC 3.0) Solution demonstrates best practice guidance, but Microsoft does not guarantee nor imply compliance. All TIC requirements, validations, and controls are governed by the 💡 [Cybersecurity & Infrastructure Security Agency](https://www.cisa.gov/trusted-internet-connections). This workbook provides visibility and situational awareness for control requirements delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations and query modification for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective control requirements. + +### Important +This solution provides visibility and situational awareness for security capabilities delivered with Microsoft technologies in predominantly cloud-based environments. Customer experience will vary by user and some panels may require additional configurations for operation. Recommendations do not imply coverage of respective controls as they are often one of several courses of action for approaching requirements which is unique to each customer. Recommendations should be considered a starting point for planning full or partial coverage of respective requirements. Each control is associated with one or more 💡[Azure Policy](https://docs.microsoft.com/azure/governance/policy/overview) definitions. These policies may help you 💡[assess compliance](https://docs.microsoft.com/azure/governance/policy/how-to/get-compliance-data) with the control; however, there often is not a one-to-one or complete match between a control and one or more policies. As such, Compliant in Azure Policy refers only to the policy definitions themselves; this doesn't ensure you're fully compliant with all requirements of a control. In addition, the compliance standard includes controls that aren't addressed by any Azure Policy definitions at this time. Therefore, compliance in Azure Policy is only a partial view of your overall compliance status. The associations between compliance domains, controls, and Azure Policy definitions for this compliance standard may change over time. \ No newline at end of file From a4a8e4b03c1b50c9e99e89686ebafd229044d03c Mon Sep 17 00:00:00 2001 From: thbanasi <54327442+thbanasi@users.noreply.github.com> Date: Sun, 27 Feb 2022 14:52:00 -0500 Subject: [PATCH 2/2] Update ZeroTrust(TIC3.0).json --- Solutions/ZeroTrust(TIC3.0)/Workbooks/ZeroTrust(TIC3.0).json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/ZeroTrust(TIC3.0)/Workbooks/ZeroTrust(TIC3.0).json b/Solutions/ZeroTrust(TIC3.0)/Workbooks/ZeroTrust(TIC3.0).json index bacaba371e1..3d1b9299bda 100644 --- a/Solutions/ZeroTrust(TIC3.0)/Workbooks/ZeroTrust(TIC3.0).json +++ b/Solutions/ZeroTrust(TIC3.0)/Workbooks/ZeroTrust(TIC3.0).json @@ -8172,7 +8172,7 @@ { "type": 1, "content": { - "json": "# [Dynamic Threat Discovery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nUsing dynamic approaches (e.g. heuristics, baselining, etc.) to discover new malicious activity\r\n\r\n### Recommended Logs\r\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) 🔷 [SecurityIncident](https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Advanced Multistage Attack Detection in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/fusion)
\r\n💡 [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\r\n💡 [Heuristic Detections in Microsoft Defender for Cloud](https://azure.microsoft.com/blog/heuristic-dns-detections-in-azure-security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + "json": "# [Dynamic Threat Discovery](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nUsing dynamic approaches (e.g. heuristics, baselining, etc.) to discover new malicious activity\r\n\r\n### Recommended Logs\r\n🔷 [BehaviorAnalytics](https://docs.microsoft.com/azure/azure-monitor/reference/tables/behavioranalytics) 🔷 [SecurityIncident](https://docs.microsoft.com/azure/azure-monitor/reference/tables/securityincident) ✳️ [Microsoft Sentinel](https://azure.microsoft.com/services/azure-sentinel/)
\r\n🔷 [SecurityRecommendation](https://docs.microsoft.com/azure/security-center/continuous-export?tabs=azure-portal#what-data-types-can-be-exported) ✳️ [Microsoft Defender for Cloud](https://azure.microsoft.com/services/security-center/)
\r\n\r\n### Implementation \r\n💡 [Advanced Multistage Attack Detection in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/fusion)
\r\n💡 [Enable User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel](https://docs.microsoft.com/azure/sentinel/enable-entity-behavior-analytics)
\r\n💡 [Heuristic Detections in Microsoft Defender for Cloud](https://azure.microsoft.com/blog/heuristic-dns-detections-in-azure-security-center/)
\r\n\r\n### Microsoft Portals\r\n🔀 [Microsoft Sentinel](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/microsoft.securityinsightsarg%2Fsentinel)
\r\n🔀 [Microsoft Defender for Cloud](https://portal.azure.com/#blade/Microsoft_Azure_Security/SecurityMenuBlade/0)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.RA, DE.AE, DE.CM, DE.DP](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" }, "conditionalVisibility": { "parameterName": "isUniversalSecurityCapabilitiesVisible", @@ -26751,7 +26751,7 @@ { "type": 1, "content": { - "json": "# [Data Access and Use Telemetry](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentify agency sensitive data stored, processed, or transmitted, including those located at a service provider. Enforce detailed logging for access or changes to sensitive data.\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/en-us/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Reference \r\n💡 [What is Azure Information Protection?](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\r\n💡 [Tutorial: Discovering Your Sensitive Content with the Azure Information Protection (AIP) scanner](https://docs.microsoft.com/azure/information-protection/tutorial-scan-networks-and-content)
\r\n💡 [Quickstart: Deploying the Azure Information Protection (AIP) Unified Labeling Client](https://docs.microsoft.com/azure/information-protection/quickstart-deploy-client)
\r\n💡 [Azure Information Protection (AIP) Labeling, Classification, and Protection](https://docs.microsoft.com/azure/information-protection/aip-classification-and-protection)
\r\n💡 [Overview of Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/data-loss-prevention-policies)
\r\n\r\n### Microsoft Portals\r\n🔄 [Azure Active Directory](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.PT, DE.AE, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" + "json": "# [Data Access and Use Telemetry](https://www.cisa.gov/publication/tic-30-core-guidance-documents)\r\nIdentify agency sensitive data stored, processed, or transmitted, including those located at a service provider. Enforce detailed logging for access or changes to sensitive data.\r\n\r\n### Recommended Logs\r\n🔷 [InformationProtectionLogs_CL](https://docs.microsoft.com/azure/information-protection/audit-logs) ✳️ [Azure Information Protection](https://azure.microsoft.com/services/information-protection/)
\r\n🔷 [SigninLogs](https://docs.microsoft.com/azure/azure-monitor/reference/tables/signinlogs) ✳️ [Azure Active Directory](https://azure.microsoft.com/services/active-directory/)
\r\n\r\n### Microsoft Reference \r\n💡 [What is Azure Information Protection?](https://docs.microsoft.com/azure/information-protection/what-is-information-protection)
\r\n💡 [Tutorial: Discovering Your Sensitive Content with the Azure Information Protection (AIP) scanner](https://docs.microsoft.com/azure/information-protection/tutorial-scan-networks-and-content)
\r\n💡 [Quickstart: Deploying the Azure Information Protection (AIP) Unified Labeling Client](https://docs.microsoft.com/azure/information-protection/quickstart-deploy-client)
\r\n💡 [Azure Information Protection (AIP) Labeling, Classification, and Protection](https://docs.microsoft.com/azure/information-protection/aip-classification-and-protection)
\r\n💡 [Overview of Data Loss Prevention](https://docs.microsoft.com/microsoft-365/compliance/data-loss-prevention-policies)
\r\n\r\n### Microsoft Portals\r\n🔄 [Azure Active Directory](https://portal.azure.com#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
\r\n🔀 [Azure Information Protection](https://portal.azure.com/#blade/Microsoft_Azure_InformationProtection/DataClassGroupEditBlade/quickstartBlade)
\r\n🔀 [Microsoft 365 Compliance Center](https://compliance.microsoft.com/)
\r\n\r\n### NIST Cybersecurity Framework Mapping\r\n[ID.AM, PR.AC, PR.DS, PR.PT, DE.AE, DE.CM](https://www.nist.gov/cyberframework)\r\n\r\n### Control Assessment" }, "name": "text - 3" },

e2N8p;64(3BalyTS4HKeqoi2TfSN|i}3Ex1e+{iqzC79u9MI&`Xk(vz1CHVL+?%~PAKT&AT5DfW>DvfEkO%(e*_(P3G@}0Jx z{v>*-V!Q|MbwO-^vS8|!T^LPRO{d?$=jQHaYi)+#s^@<{@CrZTwBEcfJ0+j7EOWbE zr#ADp7^m~GwL=WTLMK4AvjO7+>Eye*G-6r7%xZj+V_zJuO*}iKU7Br%g3FtV!amm~ z2cXJ)|H4pwf<}p)-?ze{OubIzF&a)lhr0I4F4Z5&L6U&dP}hqe7mrT_+7mH2H<=fZ zF`I-e!rk}B7@mcDG1nE;R$@gQYx9Dx#|c?3q8OE&vxoxJ#mHvJ$0<&uvmAPZ{YK{M zN#R%2E_SPl6Fc-|C|RBAfdV=1n0DAfe-}Cef*Q;#Q3Ab`9l@^7lEEM~dXu`(E|0A4_NKS(Vveo|)ws_By^1-=2BSzOi|e z)aN?q74EB=&{W%=N_3n=Pa#pg`$VpdpIdUdvWFta*d$XZc$47_Y_UEC@T znc%LZa!|+zH>X=XN@4ZoItU~#B(fFCSN(qBDu|ge4sRzSFb?nGG&pb6919LYQxRJ| z8uQo45&niJuA*LLOz9Oyd@SaW&*U6vb*1SbUqmg7xYA1%Sy4XSzKNMp2Jt^L1&m|Q zD-(Junqp|=-Wu$HqcZL6&R*G-iQsCGbsR!uK{aO|ZpD2zob7)AU>DnU~-gT-oPqOIG7+d{xQ`AUXN(F&Wkp z4@{S7!9LHwu{6LC`_0!`&oww4ld}J^}V-O4K{3I^@FQRJ!|b*v9QZrH#Y>k zf^>QV7_1Tg++LtHXQr`i{}b?Qy=e8{#!tuvuQbk~{bc#V?LSo`E8&Nkso7p1FsBEA zf!YVUSZ(VHd!MXL3a*RGTJ@1ME=8B^xMi({-;+(gjV}cVlT&MV%f>n1n<^b{SfiH7 zIokzgufOf@g#d`x>e)o|^v|l1EkMQO+VmnF{$)&mtGrUaH3DdbrU%d&XpcWl{Ym&HUxgQggZ~)uPiJlAkexXFs*Wz>mOES+~eP8L9WsPK8U&$ za`twvZ&sngD9xim(SuVS%W175v+ECX*B=-%BUz<~AmwcxOa?w@gfu~u8LW?H(oGGmwU{57 zmF^dA6UFLy2lX!QCQaW~QV+8ue}ynZdz5c$IptKUzg9E#auNKVz5nT78du~aN15Uh zS>)VCWb8wquKg`>#5e_{fjY}}7_!5OIjv)$RN*-jOak&)I?PQWGdRC{Ui9*-U}J%% zf4{$Ch+OwfeA-}y$|fyYx9;x)sX=Jk|8-EG2zEDy#GG6()`zsKjS21%he6wfO|A@f zQV1(iLI-!pOljAu^pUobW`%q|g2kxLb{&6N5EqHH# z@v+LzDf`2MFn?FGMV|epd6lG?7B*5A&(%u6tIz6q?oGg+goX@hS< z+zP>c8LYyyCNEs&8*UxFg+2@`jZkM$lSD$EvxOQrNo)~}k3 zj9sXHEU&z-ue=BliCWvC-^$%=$smt(eUG+$T5;pi3RFfe(R9nHI`@RsCtXpNm1K2z zv0IldK;8|tQBw3czSKBqoPj-ABz^Qd1nUSHW4MPj&kNO9*D)m$`YV2i1}#h$w7{^h zXf2J>QCxJLR8d~dqq(5u2vyX6+^cGB8cv=?M;J`72kq^^dkyU!7oxfI`*nQ&BAJ~S z`5$j1t^t16(+_P+569CuY@fUkJ6pBb$A4AY1|k2@uiKU>)SQH`va)=MYQnF5Y&5X& z~B)fqK5vxKavSo2Pyc4?6VhB`*zy3c?wfPT2sU+?MF z^Fbcf0i1>YGme8fA`w`qPNC*}Q;`7HT5jXq+zPb?b>_=aY}p@c9jB%}Y~3WXSTPZr z&6w?GVCcdJ=o1R85s*N2bcjENQ!iOM;HYm<-Yk_I-Sl*-(F-F&7C8b8Hq$tA6-|4p zh)m6?SaMMFBRH4^s%8Z(mj5~3Y44~l5c=~oiVfdzwjw8B(WovNgwO^+s6^wV0@g)@ z%M4n8*u;Ow4znhG2P{3L7;-On(B22bQ=hgzQz^$IUTkK+WoeqqW8@HK4GLYYx8#pR zwL~2kh5#R;$!D}0xcj2z&bxm<1@blSfA-ZBmRNF zLBztrG0I&Ws{L!CK28mIgjd3kW%<`4c}sKBDV2_Oa2WxGb2?kH9)XgXOpgP&LE0St~MM{gtc=yf@O zw>BP1{fQ$-ec^yp+9M(5hjXQ<+uIS1kdzIC#+W1po}gZYxBM&=h*F?}!SS6GQzhAq-_U%l|A5|wXql8mT0S3Uor zL-*Fxr5iV{4^$N7UXmofqRs!jt(E3fzks}p3s(~!EHBxwE4nz#yBVZMeC)Iu%fqW} zLQjtRHad-2hIOt^4?}Z98!*|t^vuT$C`!b8hW32ZO+4F+Tdk55eLudI=&v~LI)tPSCatGoAa(9B_YuYFBb}i${ znY56pzJ6$K?%|wSZwuZx#GYt?(@g_Z?pY@MKu^>o?nLL<+QvP~ZhlZoiz1Q@*}~1V zoYq(3$%8SjeeMHx=r?+nk-1B{i14tjZCjs z?P-mXVA(Gr;OOwoL2VpEbEqzsC@O0iD;N39cr;-Y#l-^`A=1?j#Y!?JY24wg+c4z$ z3l01TWrQ3OT4?WbG&c8jF4N$01hjj8HZa#UOJP9qT zI~9T(?b#b_FE&5Bpe$L6pCAY3xbvYay;Eks_7gLLEH@^{3)dt!K1RQd<%MypG3p z+{7&`denCIBk@SQo4Srktv3^%p_rVRm(}K2+R6vFs!q8^4r#u<%A(h{U2xWD9Eo7mlW(( zS;#^kgn^R*H!p3IVW!Uv@~s8bDF_0l3d95=1q#;Is=a1K+?tsR^tKFbE;{W##o`ay zrADG;F4ghx(PhGUo&vI~Dmb?K@#@}2M@1zpFF!b4yrxSA{noA*UengFbV6(w)yFB& z9EoT4cFe2oV2lLYqygsg1*^_~zGx$g2>3yNP?mbS)n)ltduc+ySCK8C3l89BLmvYl zF4AMM)`c!4@DssZ;kdeXhX=O&CVPC8ZLbx7PNZ` z6ZHHs0!9QB7BR|tA=T-mg@D`Hq-1&q6$3iY`jq>v@X%y@<76(1e@IMPe51r=!RKEY zQDFDv#j6I8G%5hraaMk1RQ*r!${Mr!{F~3y<<_c!U-u9e@1<=Zd7rRan}SXd%pL`KM{dy93a+?1Ia)%zg{X^j8xt z+_{z^<2h%)KW$RJD%V2NleJ^KARjlz7>fThIpcAD)M2Gp1SM1eJ(ao6h6 zAAE}=YjQztV{e#zT0Mpuo>v&s;-EAn^=)N})1B%+3?s71rc?&%eQXDfzw~lA?>$dq zd6~0r(ixKT&q^%+w2(%J+FxJ0ECbYZ_QND~%DE3+wub#NB|CMZP-)&IxXu*qSt5Q? zq379b;!$saO?Kb7D=~fFi!V)97l(}n*Qddt+CAJ*r~wEg)eW4st)9&6`?uI1L*0p^ zQWqtZ63t|1FC@bk{k`M2cVqjPm+FRnh$J}w(YbDyVpFN~x{pfSU47KOu=hd1>@v>J zzI*h^f2_s~CsxH-9o38r)C4c8_EyI5C}n1uDm7<$_^#WuOw;dkcwEQahYddV8t75& z_pLARYe}^5Dxu3+*V@N#@~qSn3=DO-*n8O+G$+$|hH2fqm{5Q=i|V!+>{SL<+r@C7 zc!aecURXOmGOJ2hhGpfk?>l8W3Ua;0gvpLk*g)l}jo<#BZ|$Ekt(NxOvzh~Eb8$QIu(fnI zm@+WEpzNQfO1BylJ)N2M5&FS&)j8c5CSu{=YD=|X_xD4y>CX?9zi7}$&cqnkr@=Q> zWO#gTTH$|dndEuRJ*Q3T_k9a`Q+wfHsJ=VB`o~m)$f|ql7l$xQA!Sxr4Q>(PE$xpO z@nojDw?I2V_-8IbcS}#aFD$jhar8_i$^_}+n8f3z4bDHgA~jCS;_ZK|R?Lb!{VrDr zUy!KS)P#J)rttfo3Au$e-B;=D=4}Mb{~Q8Zbq4;W0~ncDxm4JRp8ja#Az`>rM&>AU zuPCUOnAO|{WH6Zo~d_ zWhlLzq&FVUl#pY;_}a2ZAkP*cM^2ld%b;94t*)0Q1o9XKTuRT7Qc!vXczjjGG_;2C z)S@neE3OlLXD+o~+jG-+Zksc$MmET7dz`eIIYTp5T!VpBE?XS&t1HQmSp^`O2ht+C zWOf41GoBFM;)jEZH7r_qo(F$uUo+UVvR!9&Vbchj3V?ET%20!2eqI+?> zI_zus!6Ip(q+a@pu%sq0TE_P&Zdlksqox^yg#i4?yn^L<+M;)Z$)%_%syPdsckWgUf_#migCca-rp?^l#00Oiejz>7zf%Qis}9xf z(7Llyv}&sB<<;|jB*dI3PRJ@P?VR-EP1?L;-K&)D@<>C zEH7iU0TbW~60}FUOy{H?Dk3)uEec-s__{UIx|`w_O9h!GOWAtCM54Zio8e5GOPw(_ znW-y2sU_=`>uG~%IvONMl~npLHmv)Z;?XGCr5NDf$N?s z85h+jWv}!LSxG(SmEA-)ZBQvI${QU%=A|b-WyC^KC1^BWZNmVXfO=wSzHUrNX7tiK zrIN3L6N#(~YMzRbRp)=(mLR-d?&3}U;jal8%4yu09?us+Dr)Q-a;N3OYIYM4FLZ#h z4!g{C4b*w!=iL6um<1P38fbrdoA=gwl`^&Lh*j!nlh2f$t5#J-{!b%|LD8WhyL`DP zXCnHjZvsWXw0O}%7}?OPaP~ikGzDu8>3(D`c?y}{Sqff3-7_yc>%7WnhutPTCXaV4 zFjg@nK6E$jK~{#24EbjXnk0>@pj}LKe0_c_8^9i8ldr6GFH;L6YGqyYPfEJs-+B{A z@_4~QwG3_sF8vDNn~257v5Sbx1mSK@f}Uu&I-4Wfrjagqo0-)xgpHB0KppR9BQt zCpZc6vi&KOA;kSB3xj`!xSB4a*JgKX)}lHf;x|;LbE2|TQPPdP)Gof( zdpx-RUC5eYQb|3(-3^`ZW;s!|zt|l+xGFe#uzTI3iLm{hX$Ii@;#|OlX-RiJLZWW3Ja*<5|Y1 z4ym5X$QPRH&WFdc(qqFomOPGOugZoE;|U_Gnj?uI-6;)|rsJJ{Qy2H`mg$UMFgDLw z22066Y3-pwQK9&_t3)ZMLSKDSD|qAj9_?;jPvHS8?A1Z?lkhvh?8CWAANz}Qab(7) z_{67D6e{jMc37YlGSvbfM>tg5JKdkIGFvrLy<13pfo`NCRQxjYbZ&Ac(x8{w_<4-1 z+k1PbS5(t4omsXGX^~d}dRl{lI;DFo+d@Q9G(DU^5V4P!7P4uS8YsX_)|aRn=AG2p zT0e@io9k+^pQyL4Vs0BTCYI7=bAlagzbm4n(Q9pR@cIfH-hN$2zpTv86_>UI(vIok zz1r2$B{@>mMDJb=mzc|Ek)roRg4D`f2cM3{id0D0Mk1_q-3-^lMLzGkq&uP>e)Kbr z)+e={mJcYs&h0y~O)t=*a@eZTXVhv3E(5BMwkCAI4oq`T5!ZGvulH$ul#S=!)=+!y zX;dGkUlK8#yXW6p?P|7-A9Olu?Y;Tq)xDJ>O8pl)FF>v{3@QQWAh95`XqL)rWP?K_ zWd3u#I6IX?Cm3dQ9^p!unwc5mokK(|VuepkdpA8n0oPdQC%8bc+8F=-9_qwTMFX)O zcre}MoI&6_+Cee-RgQ_QyLuyMvN6oBra~AJ8;2?#m-y>jJyo~|J(lyshBFDw36yZ9 zfT(0!C+X#I5>b#Y@CR<2EpSLp`;diJq6Q{v8e;PO`fvEb<}^6{U;jBxPE4n&+srlj zDwWPr6ms3hnxy(gxB@Vu-GT6w{tH~p1e_R#ItR)y?Z9ES3_xn4H(3EgN@RrwgzgAK zTu&ZbcZ$zp@)?NNsDNY7;12d9{p0g?{0ec|qXzXkVO&0%ku}bswmXCV-y<@&*MlZv}7~QS>c8hK=Fk|Y6vsPj7GUi`mYA^5WhkKMq_kD~_L0_DX;1jQh1ld%- zeA`x7^L3*Gv8_dB{)<~%!&rk?&@~cCIYIh>Fx72p$04OWR9LI}`Ho3@o{JUnS(eJ zmFKWwn4K#LK~XicF-!TV3Z%j>#=>%)?Q%ZtqQ_)XtZuqUwm z;V&~2w=5QsKUI!+0nu4pAoAF(61U6eJwFLRqXz2T9^lmE2EH1Lr5zPOFAfAIgU~)+ zkb&7GE0f{~wrmD;oxx;+&iX3bFC1`4IrYjIju$*Cr4Ihe9~na}EOBo}`C<2M{qA}2 zHleg-yYU+^AgQJgaRZS-2+|zT_TcbXYM9UOMv!+^0R;;y z+W?p>d!1>I^I>D6oGV^xFB0okm!3)(-~atPfvGE1x@P=M<|kmf?Z>@G_;DYF;iV5e z3B5R8)WaA@rNrTrVX#IsJVKtirwZ?2#cD9TD+2(7=la|;0A-%Wx!p7VB$XU2u7)?a`2eG~?{kTJJkg!m7fedG3J?f$kpEv8TUzV2>@ zoA3{o5ci-TFc%s%%9!4C_1w-))-#KHSnIJ^7P;n3LGG(TvKg#HNcvcS^p&*Id#n0> z7EU?lwi-WgipAXd>x?q)kofxTsZ98_-u=M-XT#j$@4K|Co4Sn;Q@aXpZPLn7J}v?@?(M;qnu8|y^^Aww*D(aqaXn+1lT7&~>8Xpe4Vqi=or$Jllm zL@`aHIV+KEp#6AE50>ktO*`>WZA@c6zS%5#Kq@oYMI%cpRSG zb3&k7$FiwDg+kUnWCS{;?<4sVfD2ZGL6hBfdWJM;eb5g-TG=y9!ED!|?h^@c&TIM@ zcufp)27Uoygapch-(O~C@Ul;Ij-qY-ex3~{;dAiNScX*^PtHc%dm+)iW&1n!33meRoi(0IU|T{A z<6<&B8h|q2MLNAI5ilU&8QH6ia=etx_o9=+mmA(Ygj5>sq&^EZ|H_}q!kIAyq58Ty z-!eiMlL=^e4mk8eVg(@Qb@YRY%(z%&uF|A5Ra&Iw%j6g6RGvIw__27btrB0PL2TpZ zJa(kr_mTB|Uv#;U0NI3|$8%vve#-@vs06OG$1gz{-%vFOsEbak#=QgaW_U-UzZXUs z=$Hkdf{&G5G2C(@?^%q-^Dz82K&79vikWT=sOL6p`Jt}g?6V~pdXIphr{GmSzns;r z=XL7qQkWvmtr_fY-=hUxjvPoVkfQ-@kq;`Tm_n|0-xHjPr9}Zq9&NFVpn1m)GG9`9 zdOm61w!Uotlcy+cd$LA9IS{B zS4K&GZmQ+Pp)ljJ3`!X_&6{@UpJ^CH)rF3KRSWm^4J|5y%$De(?7R1dQ%|lhS$07h@Pm<%IfK_kYtc=)R|Ga= zBtA9Wpzmj9l_sj$HNC;HPIUZ|V6&R`&Yz;kwn)HoC3nWw`yfTeW!B z_=5)f>lZW6dvY4OveSDI%ePf>E~5y7M>gqq?;(W`t&WfqZEijn7F4FoJA z&0Dv1Y&%!-hT9g^wQ|ItN^xyIp&&DMZxpBVH@-90*A0x*C&#Xkn+)3#^I(VF0`?Xd zSNYJooN%APr^oR37cNp zzL~70>xmG_^ITVoE4Swr5iI^~etH`Bl{^J7Ee`ApAuxmUkCPvzlaF&s5|0MWcWny{ zSGH}2?|W1joPS<}4q12IsoYK04Y6;RvCXF zXUf>)gY?SZhn`s!roN#<4pt^yrj^{rUpwfi7eM6CdT*HnOPImA9d?rz!1~GJ+2nyC zhUN0?2=d!~tRn&>`R5NR4Qn|exP!T4H&W%RIyiMepgfsJU$ZIGuL$de`IPnvD+#=z zFmdgTqt&oU1fOo}Sy`fpQ9q%iA;2ila{Z`f%Bf$%2pYOBormS7yg=F*w7oEaGRo-WgZr<$43vXmCwDh6IV-S2OOL~r`SS?@ygJr zO{n*3;d*V^>>7`XnD3@4qEb?=uh@#=Bfog2Zzcw>@A|#~+UTPLW=g{JyK+ zI_iXYlf-s6ddX$1i_XY%yZ-qmgfUM}AL}LalR?L_i9;Iv(Zm0=e9col@3{Lk zP9O-bqPg&4zq>vlN&G$I%!2t9EhCN3cnq=~W%o7SwKuo@fzoyBv-%Zfc3Z)iCTgQz zbOv4Djlf59wUR1BL^+YO64$L6tG98?6pbyf=9iw^p=W>#pZ`2X;MhaOzdWYk>ZIT# z$$Qp=M*4rx7jK-G5EKIuD-ew%m}jLZ*WFmQzintjPmrg1}nU#J3R!eCbKTroEUguS63C&rHW} zTq$@lTTi};OV)Bt1|B;BSCdK67Y_2cNGo9Y>%oipL(L;hQuy3&oaOL+FN7LtNAgZ& z=`Ub}jXH1CdC{xG8S`+@SK~+*<0fr#ycRw13kc>|ypYKBZn8mCDS$NV35%JB>c8A7FzbbnXix0pyS{sw+})w6mFtr`^SKelI85M{fffLQbsmfG7n z*H4t$em9hi!%m#}LP5t}?rZQhmY7fl(lAbD(Jfe)Xcoa)sC?rIudyxRA? z9p)|6@s{}A(Cphurm3+hNjP%+^K=P)<8daeY4YOn$ss$6D%8i3@a^M*+r!WR%Ei>4 zRSC7Lzp7-h$siJm&nh;Q(<1p={bTV??}sFy%Bg{du{q#^b9Y?aoPLi5X@Z`If*MDd zQqgCA#h~-@{-#_^3%DS!0J?5XF&?;H>s%eTzt=z~O_omeflQXY)_p(FO0W#rPAK$~ z_NVXm#+r1wl3Jf4itNaVgdGmp9Zzdn|NLyiR3-uc*+=I_%`Az21d2EnXn`4m5iZ4_ z!k{+b#NYup4}nWLK)g={K4?JTy{j?*ZcLqTw%!>cN6wQj3c-L*oc7HUXee#d4tT;t zLW!v!kg0~h3I+~oh(@^Vf0t?OAcpV4x$){6`5A*>W(ZHkPk+6p`H&qLG1D9fO4z1k$PV zk82nkmkGI!&e3J8^wReZ0+S22kzub-{vLdv?Iqx~tRO`f_z%e@uIsJ@U;iX)jDrGb z7U%;>WF@fzzC;^ixxq3oG2g#Gji+@yL%>(>xZ%E&9S%EHuDIv*^-SVlOGwLsCRx!? zJhVr%O!&sWdGNvMk9wqkTU<0O(grqdDQxM;=Qg>;xKKVg)NZ+as&2RMl4glxZ>*cH zW_50a+;7U|bF&NbV)*zi_(<}lVMOdROZ5;dSabQ|Vq$HuwR4wlZAw4umuc7Nu%S)X zl=KY$gRMnQx}Z}9;sxC#WP8vb4+l@wl!kbn2I7xAp)g-@WxZTG-Buc>je`P^D!L9?Y}kzCDqo)xgZl>8~gz)Aq=zHM01t zCtLe5mYBsC{!95wegEK*-Vm!&@S$hFzvYq`3uR(CgvmRqll`BN`))-xZ-35lRWA-3 zK9L|L=!WmVvv+mAGYG!ZT(tTHfr)?oa|oz$0`KUP04H)HJ^RJBEKp>uhF!xe8k^@_vkZ#7?64X@@!<5;8X>099}S#e#Iih|Bb(g?*N!FwjUCH zl}TKuc}WM#QNpFpHxYu)>9ixZ1gU%g28PGM?p#ApNy!lvbsJC{77`Qa(o_}ov)x|lsK{6*D;qE#))ID2qecW9D z{kHNXe{~^ly}?6;17EB%ARYpQ;g{M>l%Z+3h0xu| z3dirU>u5KB29I{3pX;5s>4k2R`v)HSz9lpC>Gap`^aA!@4O8D=x8NX%K$)}Xr<1Qp zl=Q3+1lQp!<69wsRJFI7;hOFz)bSY*qF2)#ro*iXq;qU8cHhqdz<|xw&r>=>vrfMt zwDfO)B4ItA_sN0Rf3hZ~*a3VY;!tJ17w}t>0Zqu7U2c`-q1h24 zb(}jVfpmUfIBBox=j*)nTW6Z$yNs|_3wUB0C!p@ zejGj$6*ZwGb+n#i6aEfce1pVai#VLfE$MGoiO5D1q&sE6@3kd%D9=C{$fRM9E$*>8nX zmR-h6IKENvZke3v{AUzaf1)E~H=m=sNOiHdKVIaNOT4mpH_Xe~wBqNn%1k9+8iiBl zm;Y!!cudnq$Z>kELn>|CP+;xLjQlN3X^sOotM+j`E*Olw6}9)P1-E);W6DjU-6mQ^ zYmTQXq>a})nDPmh>U^sp^f9*NZbYO1|RzC6+ftD_NJ(fsyb&kbJ&Uv42!L7wW z!?Vmp=LY6^<>MPS;vUxH!xegBTv6n^E>Np@WRC4AAM4<|d;>qXNjtXtTW5G-G~980 z4NrFeB~70kp9w)SreA3D?Os8INrtR! zn}GI`Zmo+bUnL9{f9by|l|HR|p5zU`lt@XqiT^*3mA#LqMY+tP4F+S5-uH_o2dqLy zx%tyCSx(GW>aW)JVb}nhg1mDd81aW;!9Z`iJOObXTgATo-!|0% zcgcr?080BNd|X`=*f4?LG#&TLWHJm3;2ddY_P_tzMy zxE2EAh|MtKCV(iaP z5)}XUTlMeX`hUBr<^Pd#8SHn!r8g)D2Q;43*dK_|KpZ7`#jU04b|2jS&$`Af50^Hp zlvpj0GEwl;obC@MJi`Tq0o?z7jc?phYds^{l=(lu?kFkfyVbF2?^6m0XKT7*n7|Or0o$2&HthP^I|7UkqT*UbB2HF2d)?0@~6|L{z zCZqN7Bdw%@I#dXcF zXU*PgJ#~L>;u}1IM%RXzlruje41#cd<(lY;bAU*jm9;iw`wy0@RnOf#TQ3zW`hR`Y@u)^ms%@ z$4`8)U8>mId5wQ6?1rU1d<&u4H#hOnz&ZrV2gC%fu^PjUT1Xbi~EK$<(VB z2(HwU8joPBvr~TKkz#CrrDuE{9t#XbCM_EshB!%f2UptI2HW_CNLDv5kpHhy!_sGG zJ#?cdz&GPu!jCz0S!%Cq~ z!^OB7mF+Pj^g=$*ricCLasw*3LL5ER6Q63qiv903_`hF(Ynyv$gu`_~y_I18?I>IB zDn*&v`+Di{X>68 zC;=2kZ0LIH&(7`FkdOiFo!+O@wo!T7?#87=EaAqlepfED{)3;R?5l8d4TyFzF2CJ2&U?)IGJh~kf(^8aq5Ul0FDYU}wOh1vT3r@nx`Jp8JSoL>-_NWl9W zs4^{z{)-L<$cPHZQ~?Ts>CkRWOxaZk#QXd!*544+d&+yI5E93mxgvEV{12QO$0Ffy z=E29;KU4J7b>$|sQ6ZI19FCIRkK$%fWx!x+V)lJv(ff)n_hcSQ}29$gK z6)@OfKb%NigL>>Z$@hNPX`BBqdu`UIINJvt=r%R@D=+B3PaoSIB;MpIQLx3IA)Q|8 zf<+-Fprbbn*2!9tmov>nP-h~ts#M1<*q+7{4B`@cuJ-g0E% zp!y(sV^rPr%Z@pp^-xho-q8R%*EU7{!J^8{H$%JGn}X)gcK`RRo3UPJH~|Qqavtw5 zJ3^P^$RYPvAO?cokLECjkh{0KA)gCaVXWygwNxa?F$V zR7oC{CcP_AGZ4yN?RC*TEkiT`+S#ZCYmr~Bea!SGy}LXm!zra7)aDj%Pk9JyiIi z=1UeHQM>?#rxhG_ai?pn{MZ3VUskTdUe$6%z>&(cX2fUK=)TXzgId zwKO2t12lEcFVm(08Hd~olZwIRKis72vI&pr*K_xp2X!Jqb(CY)8t*osL1-2_DZ8 z+M9qX{a!;Z`Ltr2m5D}cv#|Cre1%W>W{PhKQa8x?-1uk9jv`nwVJTtBedQe$AYYK6a9gcxn#EbYY=5Z4k{3D z=I%BA&5APL3*M8+f`*ki{8|~v4tX7O|poO{v(8yVaNMCp_ zbKs5U##@r6@t<)aIbMjS1I=KCQ)-D~oqq!_pclv6P~PlVDqp8&;5hx+*mt>NH!*L} zp_8i$4z?H_Hyx9`+~MXZV*xMyh=ZQGLXK`YW&ngU$*>H>cVad`josXrDVVjUe8ZmP z5By|^+V+_3rG0>8s*iu)jmjUrSIJ3CB=ja&vMU_V*V@!v*eg{nUPJRkQn|urga&+L z0hS2WQOz86f5XNgzy{(lLNLE|1F01e0!J1SqP zHW>|lNCT>EhdgOJVWv{7Y^B<(*<{k=^Edh&7Btoan9=x4ze_p=*gdpFz7fNNub1aJ zr%g2-V@mD5VLKf&UAC9z?dp#mh736+wZHT3J`@#IeCt%(G-fIx=YbLjr&4Ke`uFXu zILLlR(f-!I*E_N^uz+oDn!#wN$|p|xfEYLvPHxoim0f2Saqp5$0a=gR7;junv*}rP zu%t-@ig+QAy)-CqvB}b$=X8Ue>UrWepz@@0IlbMmmp**6^eB*Br3>RSe!ERGvsGLOFOcz#sFMK6QpfmAd1kB*jqJ{9O4gt_&weXO~Mex$6 zByIndgZ<;4plmY1Lt71F1b_Z!_zjQ5x$-(Z)Z9nb&B?`_P-F==*up#P;@l?gAGk~r zH2|H06DaB0FmL)s_MeJ<)Ah&4rD@FDzCK38S~4{a(!XC>b_)zla|~Rd>|P)IRVYUS zm36ta=vP`9?Pw~tfI40lkgaFmvGeNsJI)(ioz_zCMW7xc_-;4E?LU=VC!Zt1KpNs* zb8PAU4qo?uB*@XK zBs%Hz44O6vGZXdd#6+uW-o*$(ulDp;D#JY^$pP&QunL0R0!d&RDrn?bs&4j5ycY#978P z1(5!Q`1+=cHJannhwf4?@1EuMPGtLbxRS6tff7cG*_Jn8Nf!}9GRqD;f{UELPyl@J zn}PVYJALYBM|FEfV87oj2fPg3W9yKv+z%uy@l)X^di;3A7Elf}F)2>LVGO-BF8yKs z#qd~~B~cD@(hsGGRgZacddQv<-u>2!jhNzWmk^r*FiVC2{}_2Dr=d??%*1yY4Z+$m z^soJ?SFyQuRlC8-bkCX z?d@HL`xhkR#O%B4R77EWt76KVOoL>_Pz&50l=yJ<$?m4iG5kM!|qv5Zw^Vo zK%%wb(9}HYfR27Yw0yHabNN|(DK5voZ`MN&f`_2K!oP%GmyYb8Kp6{AK`t=BM$QEwZdycPQfqhD|N63c9k&i16Xop4 zO84okgoM`q8_paa2kenq#?y)-3}S2z@U5YlNu=Y;s>{foi$2g=$JLaXX;>4Q`f!*y!(}adj1?aO>9oQ3 zdI1DOzZXUHjmvIe*PAttACiW z(c7H#ckh^~^~c;Hh|2p-RPs#YeB=BoH1c56y9ef-o91pFKJV>w!uY~D(iM3Cb@b;; zI*p?IDQQy>+vm~^xZ=FHa4((!)juvcFM#W2+!U5j@h^Vx&)A@+*Q<5MLAfNy6h_FN zD-lf=ak0Kg|1DkwQkh!aqskA)I=F~(5{?ee_vVdE}7(>WBZ7z<-`T-q&tBknATQLHWjOA!&ht@Vvdw)*K;F zle{O~E6i2z;?drl^Ot*j?zHQiM3U0q0%`wKniAb6tw4LDF(t;<#9{z)UpDe<+pP_@ z;pg)-kkIMkpNbLehF8Z3xl)>i?I$_+`dofyKi@FZT?)VQo3U3tAJ^}_9-SmusQ6wr zA-_iMj9ahdDQi1yK4j@whv!N#ye>~GUo^<5AzW2m4yPf1^i7f89AOu&!Om0Ln`%GIg?d#oUe`M- zKIe9KDQZvE2n#hwr*E9zt6IGow$NO}>eFltss67lgswz_7_GCP;c;%0zhUM#-%whU zp2e}?1@{$~dRTW@F$_A?7N-(j)&D%FxQ@!C>nDB8Nw@Y|@=XH6^qRfCo=+IYxspIh?ntf9{ut#q$ZLgjR#;EtIi86svq~ZQeEOBI< zK_>%qYOkN|+WoRhKe@oy4&C@D<`Uw1rMkH!9d78OR>?iCev!x0W%J>uI=0l~vT(%a zrg;Y)o8Z__ackdbrVrug62&TCQhAOG{`2C>Guqudw}o&^h2&WmjX z_u5WxhrXWd%Q2X5Aim&&u%Ul(b11N!_(i)%a>%>4?U;-)`mYxQ<=Ab~W8mJOrA&}` zb<^=~rm^>aph!|Wa<@c@#?#-<{4zDnbk{(J8^X`W4~s{%w@AKw`GomKyh1fHH+m?R zp=}CQUxOahndH0%6vTF zHzMsm8+@~_(PPs|%(20fdY44?BvD?`<=AocA8)cJ_eFKg^{v10Z%!sfH7@QIu5_+l z-+f`P*{lw^dAHzgx{G+X>e0;dXgJ5?zychQq$SH8E&hFK5Ssq7Sqw5}T~i}JK=}8| z*>oZ4^0R4QT;v#5tZZ2mzPxk7{ub=uxqgNTyvw{z?8YdGGj)lo5K{jkcNpmoDfKLm zus!hj6okDY(76rK3;EC59v|!mU4Fk2CLb>6?Gh*$OqN4z70n&zsT(cjBRS$`fON z>44`&T){W}u-hFkW=U}S_4XDywyBy?_)IWj^zNe*ZUav(x>t-w^@sYvP@4H2ui?`x z{oc`y(}%Fay|ak;(3fM{0@i^sj#?OL1or`ldJN5PD}Tf zQhhWpUm1wV>@`K4^6&M{+&U#1I*3Yao($p~zU*XTq*>sBSG=6Beb`fWKJMP}%GBPa zu!-yZUZVX++CW_;>deZQWdK2udoEXo2nM$F1d`q_;9O`HqPMOMryEhuBOuqE z1~_pzPhDwl!-OhJpuaQ4*l_Lc(oQfRHthPB^`YNvqZG)gg9has;=0Ccpv@(qx>t1ZaGNnGXa_Qo72zj@4 zPWBom8eMss`eAo5IGD7$H5^U|^*ns9AvOcl>qau_>_XnLL7Mn+twacfb0@4@)XNBa zxhT32qt;dLdX74&NfgQ-frDXq6KXd>-qc`a1Z@6K*Kznjp ztQ%zos-s3K1R%t03-iV;hl)mD!H^?gX<`c+li+^rljDPnk98*UKjtl7|0pK;&%4TZ zYcy&M1#$Ukt#R&3c{Ui@H8bkDW3>Jed_`yW`#M|QUaY0;Aa|)rxtRXwv;o!!UPem7 z36AeCFdl(g-@{t<(f6r9wJLMEy8M$eO;{6ih4N%}+k-=7h-M0Xsbv>)(H~jkY))x+ zS~pD%68ziXywkQSP~UyXtP+8J)&cX{ZpKcKfOQWO?Z6*>bK0u|ip-@OFS2qMT423X zNtp-R9%JV|zUnoH^xr)q^p^67Ua%5T>qYfd6X*yjY?#b_NcC5~;Pn=v!v09t(b6?p z;Bi3CA3!>Eop|=@xag`6Dp%j*WF)ZOzBC3c(uMuO_$9+DDyXzV9bj`butcZ zWBDP^dzIkZ&RoL>F(+`TBiI&^y~!*`%*oWFqk#fj2in__l`{J4*zu>pYnIV2g&Tt(av0{y zPT^GW309<(`wF;=G$uZ*G$=P`%J91Ge(=2hdShP3&(I*6iKbrMXZzOy%mJMUaj(%+ z(sv}YiOX^kTCvzdS&Q#YwWMx_KZGJpFd7<26J=P)p8?nv)v&sd$XGx8j)tKtjg?G)X zEE!9g!RBB67-2T4z#)I5xN!77XD>dW+?#s6$tj87zD!nk4Gm)k7xa^q)=;Kpc*rQF z;yaSt&#C3_ErEp<;JJ@%S{2K~Z_|RS!JFnx;y5@n1cTaG$+0w=gSHjcopH z7Hlg=9SHzWuP|-7pL-jF|4c2nN6gkLoA9yE4D$IH;DNI>-le-;U7u_*_l=qJ%eL#4 z@rp_UH*nre6|^Oq*{Lt#ef@JcT>f5*ny@Z@p3ZZJ4*4knI7MbW+lCjO~eGoZl6We z%HuLOyJ8)u+&{^g=MNk^FqGTIEzYb$+*1wD49gkGI9g054|u5BUnN!zHXO6nOcc@f z@jrcLrE3Wp%!(;$dAEtJ`8U$~PcR+CZ~V|mi}SJc(~aIwmz$d}Zyv5^b_|5{m7AxX zmG0(z)Q&*=?+^4f>-%z{=$(1q*m-e!lYPu~24lEF7D%Z?7WZ@@UHG|Lfu{e@&+WGH z+cui6kyCr@=;l`Db@}>XoQzvt(n>haD*p4t&dFR_tL=bY(XQC0>(?7`l1*s&J;l%6 z8PVl4U#*-#9IU#!Vc#FSL)Z9xdIWtl@BN2hO6N6z#bYeKoc-89()AK)305?7HPlpz z{oJNXKKhrXl>kxpw1rgZ1IVXYMUiOh5g}7>jt&Q!mNPA1Ls)hUV=Gm&7*EmR7T{3* zMyJB`gZJH~q}52epZb&CP!4!HK*dm<9LCdW@#0g2afboko4nRLquYQ`KFVZy`h9zT zRF(yR|K;>Nw;|?t&R4%WIPZNQ(aV2X2)N&U7V4A&o7_L3)a!S*eq$yy z>Q^BR$tli@$SVdlr~p|WUi!+uZ=k6Y-y8UnvHge0cXv!rSduJaH;%l$dC1&;$<0Nc z=_wz3qh1g-PUFw$ukCXG6x?hLuwi@AvvC?(*~yo!ZYRqv#L9MJp_*r>Z#7dvJ+p^X zXxK_#ZNIpX^bjC?3eQ6py(fyb!NAE%z+1sj`;2-)?*JBS}+do~VMU79)#I@Sc`$$xje+eWEBm4w|m%+|?&SF*K=R0~PKH|EqF zhg-eM<`QVGVq}zM8KRM(B*>^1Xu`u#W1g2Iv&vITQlp)h#yiY3@AIC#P%lvkQ%%<( z)MiB^<>OTdL5(BnnjFbhs1Af*^ergf^+l-tZj85ig@kG}=WtQ;d9LF3Y19kp|+Tz+?5tLgyvjNx#7ahWHS=SnB*;a|G814(XhJcOYyEq)pA4jT&=A$T%&bw*;b z-0@?I;EkXgTTWiyc))WKi;F{re1MQN;oFAR_qk)g_1-6m+nZnLunqnAPHVEo8w*kyC+6{Yeu{G^{e_jCq!PLqt0?wCNxWX4-0o*mo&eUFSU&ZHH6Bbq( zD{r9E5%c-9l62gG$1J}ZpM9dPA+`jK~h_u~UJnZVvVUnMkt8{F0Y}=yH|FJ}I zK@bYFR`!Gna(kJK$;x8Y|18@@Er%+@fb~$7|Gn32bBna=KAL?qNRa%Al*MEXDgV;b zDE-<|YM8#WHw3pjzfcYKgcvs8uV{}`kRQht|F$u(qd>icM=pQQ4elK^MxiA|PuP;k ziT+)q`BBciaQxW5o~TFjYO$)iLC#CyTvH#vi*d0>;`hbz2x*3*kKQ!05$R{qU^lTe<) zwZD6+U8>aIx?0MHqwKu)xI4v#mnYnZ#ST_pCtPn(?*ook*_;9&31G)BU&4e+vnP^4 z8$-TG(n*7T`cKM(LR$ujfrhsG&z#auno@8Lro3n0$G9#!S=#HY2Tb8z=5r^oAERpr zBD3%1RqoDXf(#n{^>FJqqmc@>Jwg}D4{h_Q&f-FcqKs=c9lnMZ!!#_78~EcrN@@sZ zs#C>_d~4)G=<%X#*t+jZR9ih($)~;xN(l*<61I?MZ88$!RLQkM3iLXGfl;CpX5^&5?L>MdHJE?fgHW_f~vl{6Spf9Yy?S&HP~xcUuLb^-r9Xyu9l`LUb1X2 zCS)Pb3^vaaea?)~==r_J18H=Puj-rI_DZY2A{j%{;EFTY>4wZxl;Q$a6S}jjg8H70 z>5P+$Wk(m1=J>Wszh=gKpQ!< z9d(&mx9Zye%CI+DvHpGS;K9JVW(@&(qC4`x0n^4u_(DEb{jgU`)syPthj}*1Gh;<^ zAP9;`IZ~q}kyOn&&CLf?cK@k=axq~X`b)i7hCWM}1}FefF=Da~Z$qlA6#KyNr)$Ix zAiwBNWxF#V_S$~lIN&*B4kvg2S(J7Ag5wQU?t2BQEv`*DPK=5n_j7yd`-xF@0}WnT zDziTd+3L2%;bJgWVJvR_Tt|=(>K7q3+gE|rL-b}hUz-O1U0db6i2>n0p%%JQnNsCa zP3Dq9QZSV#&&&khveJ!5&czZYpGbTtt>!&q@-;YJ!4&EtwNj4A5)(izHe5Np$`#?AbkV%m?s!ZK80FhJ0=U9&;wPd zKu#B?xfVJ7H15eMSaYccs@TzS+J$spsT6#lH+xlbtP!W~(!CddfThzl>m=fM-Xy=V ze%@ELGt>tj)!n(%{xuYnTO#$jxgK*taX(`?Do&?wF3lmbDl}=0e_i;b#XR_X@ioms z^vlnWc7(SO_OY=|um_~JaKV$0Ku{=5#_RCa{9~G3>|G;SNDnZ{>%hyagR7B7&7k5o zZ}WuZPMqAzs7NpERGL-`j7EBUia9?4+M(@>Gni+fC(=A1>2>c|KlUEVFfY z`mdY{c&;u8+2>waY+j~CDNI|OlvD@#t35eE;rOSfC0@`@iTdLj}4wn?&Thi9p=4^`|C)&gckTfadj$;LiQ;x-y(#noQN-lTls2J z1gLp+VDjDPuLu?zIBS{KS88R;AcDYSpmOa{Hq&kpEOg)A+VXZ0#Is&Q4ewaq;)XuM zX;9sp5V<9K!g{HZ8p$}0B_baV-&C>KvtRSRXU9$n>LTJ!X)etGYLR^c%O2YHRYK)| z8jMT*AaZOtX`5}Kn>qS2wO!ZSf=3=t3Xu|UFgB7|1P8NHy^t2+QYDfc>aE**y&O9R zk6s?6Cl@YrG=_i5zly>4G8SYXra=L>>^&p9e^?jg8|ew=fd6T-Z+Fu78-JLQKT znke)#&exT-X|~*OK?l z&4qJ4-$GhA5oR7-E)ia8^I1BtZHB3BtVeH`uOAv--^rmqIdl<#J+1ia_mg0zHGD1$ zCI^O6^#?Jr08e@}T3J{wmO(vp+RzsUu(!nlu_NDPiEccnVisWaHxB$+aaagNY6b$0 z11a3r$}*uEfKZX0b~(QC;`Ckc@&II!Pfd&6)}my#Qo!&G^&*YYrFQ?4F~O9hl|sg{ zOf_Wzz&5f-S}9LWU0Jf`60ltv0qp54=Nnw`-Z%i}-~;TqLZ>gPttNlM`H@Why}ju} zR=x*yx2{P7(>B9gR-f~bcVM!!{qbaW4o10}*e(9e;WQb*H`l6Tkhp11k!SIvkmu>= z0ki({AL4IkYrF-#FWRwA0V$^zI0?EZFg*(Rh)%c~B_H%Vdg>W5tji{$Ab!|z;JBZq{6xvb+;d|Dm zNK`Epb-5D4nhWT-q6XHXtB7ha?NGu8e*@C%ceeAy_Xo)UN;|LtavGhATvQmHTvGppVK?EDzu~YWB>ziRz?x$t7%>X~E+)%` z=%%p+{%~mmBq-i9^*I0(3%ED--Zp8}i|vDQ=Z334r0JSSiCiE0Q$4}w`vr4a5LUj^ zAJ(SiTN0T8b<7=Tr_evTYo@sU_&W`9(fDk7DX?$UDP2dFc99U$3lUejX?v)7fLwq3 z7%$xjgZ^gNaOdPS#0n^89}18*a~P7D%xI*Y)43qmojHL|-01&M@oFy=+u z1B00dFSYK5^SI9rUQ8F@LSYHJK7kf0Lk=eSvj&nau)vjOZ-Ehq$qoU6U&g&!4KV5j1 zn=Up};oYY8=WY|+oV-6Cb`wVZ33)$DUhjRKEBF!x`{XY1KjI5s^O?Gn4~b%|MX2xV z)odJ7Z({O8(Bg@vkRn*`))bCC4|2VMw6DQt?DeTmPM;&KBm7;vh#PX~3J(Md>Jp=_ zDO9AZ@J$xX_}pK}MJ-<Ev(t=Ah`HF_8Wg^=zB81BPY%u=ix1SBGo~V zaLoD0$CJZOw<2v(D8VyTLDgQR$-Y2SIr9`tLuJ-`fc{J*x^Ln9+421`@p_YR_Q*e0 z=xbFdF#*tx)8}C<8H27OX393Jr$;k%%jxoF%TDAp?5#K@B)Qg9vg~)NLo;O~qTevm zL*Xr{sptM^vOrCyzfPic_#i$#pvD%_@3S^tqN~Y&e{%x%XV`6Efn5MttlKTXiX{^a z7m6>`D4~HJm`u;)DI0q1Rco4EYSE^;y=%U259C}Md^_g2ShlgbuC=FA{e+YdORDMq z4(kz0e-aBT#d&`&(ZK6Ss^O@c#Ekgqk8d&2(ai1m%fBw|U#6zTN1LhZpE#3m-oi!Z zk%~75*f?HV0FgHoFjB~FYdPPU46&N#uB@3Qp+AR8dep3aOH^6$6RC+2+%G zM5@0bFP$*)T-tTL#%;2oO1Dn(Rj52)<0OcPgVAKJ?ZKm$5)YMueh$lFvt$8P@9%yy z@!RWSrb@ThuY5sJk9AFRQKb=kauHCMjVoRsx>Rv-#f^JjHj(`Lmj^k$r~Ql8*?M>N z7_Eoy>j&KzU)XNE{XrL=_1Acw2A7@$85?1#x}CMtOePxMdHUBSyXc@XuF9Rl+p*mW z5g;>!26|8xf%~4#9%!6g^99Nb<;mST=7R3vy$i<#)^Imc)8A<_^)N@YPb%LG-(XR@ zi!_M~gZUf6(qMJyOiD|DRO4f=F!a+@9vW zxbu)^V=u)=a*RqF>#siAgt`*z5%DvvQhq6Iz?s!HHNAds9%1dtGg&_3V)z7_cDFR=yFt~&cS%>D;ka!Hfvhu z#`IubG)>!p!lwUC$Ac#;&fbMnNo?Zf&{x4b z`BfdhMc@=xhaf(kR3_L5sA7CLp@4>L-U~RxJF}KsycbC-rH`a<+R!ZG3#k+_n zjH5>d-q zfPV)nPpJ)plo2IFD{EDQR&Z2rz8k3YQ6t)}oV(+8ULp=yb@t zpiv|q<&zjLpVHvnf98vtM}3OURm|bIy*OH(tZ5wJ7jWGY1tj?tCE99iFTyy+{&GWd z^&z)s05$As9~(Q+>%f+;N0v6`YYZh-friO};=IL9`qZmNCAe0H-(yXE7Z*Ls-d|t< z!R&VRoM%oH#_s}M2OL&p>|0N`Z%-mFYvUb9+5wq&QO$hQQVV2P_Ah|Jba9C?7(fNm z@rbS@+qdKxG%LkCV+J5WF% zH&&NY5%#SxtEv3A52S%LinR&EA~&owf39Atr@iwP84u&x71YKBWx1aW@#M5z2-Qm9 zP+lwOEA&wbY}}z^ep(dvo?LWD*0UbHT5~Zho87Um^c{Gf!0=J7EFyDC)3NmJU)gbh z2uZDo?ycvdVn*!v&|tFs{-(~^c% z)Z0ql(Ss)MnK7ZBZF|Q;xS$rnLsQxrTAwp-M@Fe{K2D@% zcS4%9cZ&fz#t`U9w(k0u_u9%}GUp7YYM}!e%>kc7bewD-=8Q>>Nl?!GaWk5)NF)V_ zZqf?E)>`z_yjo?mmupM-GWC6vBMlfNYPB}URQ`3WQZu9kKQe4I$%{&DA}(J3e4%eNGG6Pdy!gcr~3N3E)24%&JB z89?Rq6|$1TgrEpAI$Nq01g*B|m|cPrFxArwag)M3R$H3pp}Vffr!wIJX)D#6lIDb7 zX?-i{$A4%9oK*k$SxU&=Lr^B_YV5Ob4T%KT97OmUXMT~~ig&^Eu4M=tn|FOui1Oh& zv~FXYsLL?myPy{TQl05QB~HQoWJHa_o6}w)NMrxmXx$?|=lhu3D$6uw_BKx0b*~Rn z_zO+FUOVq0bry324AhrL$-Wp7$QS8v8mCnp`lz`4mG=E03YbqXqlDU{Nvq}0sDHhM zR!cC~E-*0n{)vsBq=KIm_`x4K_1C zjD`EXhN)_yYrK#%PE)2f3K~Tr6(E`=koT zE#k=Gs%kN`NpblLnKxK;o6XDhWV&^o@>7*U6D@b?rM0W{W*45=X*UDFq*^e?%3<{j z14FjnOsdnujhc6F)A(I0--G2MSgWo;*!*J*lj=Rt>AoOzBySswZypheVF;XHTPxP} zIt{yamG7Fb(l-A@&SM#7nt4sO&?Gu*$sX05Jju2BURQ^!;)n~ToKRUyWr>A{7S}8> z%K%dDi|{w$?alcriX-*;)~P05QXBGa=dNS?gi&2r?P8$|wfOMjV!}I+T4(>$>Jk*- zrjDs83sJ-V%mC=5Em-Yh+%Dx@UmD;x10an!t*4k0;Y8%!5x!|Pb_i+LMt@>1C33;n zA?RkjMgf(Qp%gr+(|Lq_fJ z6>YnDO?t~xH@V2L_n!YTuvMLF5sr@XWT ziWZJ1mC7QQG5d9^I7t1bj_`W*fjB26UWcG*BE-}MaotI{faU&Ny@s4qPQCEYOy0k2 z__pOtbt}rWs0%Qs$agAv;px((x2xea-guZAR4an}#!gitY7gmo8%;6;6=S3;J{C9m znk9Bs=3j7Rl$%gr(kvL8`;>pzP~xDd$&}?LMn1rz?)#)OyPKRsA6V%t-==Wte=BwP-*B6JJ+HPuZ+29BA?@SC0pI@tpoLbt*49hl|Nb zy*<0{G>N(OvVX#yO0`M3UZLFUy)a-pz$Ez8MD8ux|6lkOZds}brm|KjRLe7>`XPM7 z2s5}9k~HyIP|O1DX61qSEcZpo$6QFb3gW~QEnSZTJJ!_wSxtNEL~L;Ueu;^7lF~4r zjB*+7XPpQyC`8=HNLim>ZTWZUZZ-c%w!AA_)YfHvh(lhUde!^j`Kai_{gigH89v?s ze^V!^cVjQVrODEZ#Aw>d?vGPsRq1X5%|%^&$e$&OKOrx)B0owp+ndt*Rx~)1;;v~O z;DziW#G_14@=YoVR+Xjss{;Lj*vX@FKgOw(6Whb_tTAkt84C(0o0@E(Qd4?cr}hmQ z+C%+@_V7fj@9-0gc;N#0T+1GMND(O-)qyE7gx__YbkaS8_q`qVHf3H~Wp;>ze!YW- z{tG6)I)(X?=!(lGj#yc>Xln1>-jtSDMs@2aDo`0lsAR3RLXo_OKZ})jBmG4@5vAJa z;D`86)CWBj0ysR~M4J7+DYQn@CN+2%m?#Fn^fvz0Ak242TQjZ@>^K#fRAM^ur<|XM zL!s1|oT3%iK7kP#wrBd=&xO<|zG^(Qq2;8kwyjMYJmFnNXDlE|jknPJ;j&q@yuj0z zJ<3RFd&gj(gSvN4P1<%(mfQYL5SuEf+O!XEdt_Ln%z#;2&e-uq$GNTf*Y7>i@5->o zn|rYF*eczQj6LiI!5Z7`j^^C^yJ@}@e4Lt{g81 zA-g}nRKi=;8BcsVlmw3?u~+_7d-4q3-SS`?t*mZb8I!iDR_kzKuW42M9#jGVUX(xv zUy7jvK!!fj57=K;nBk%Qo)PDLs_c`pw|WwsrhBk*%ehL6-LYf@lN`Vy<^1%Ji#K|p z%5uC|6`x|$?{=d(N58QKI+-mfiNLRomfQW%u+sNuuxdU(%P0Ub(SU-{;St ze~_JYhb3p1@=*p)6A3}ORA!M`bU(oWk{V!5oacJ43!s@G$1V;uV@4_{CR#Tk3M1Ge zr%Of`C#)i0{VB4Sug@P~f1|hVt8k8Uc|E)m=^=lp&6H$2zELWg#5lzC`TjMFUBK9w z`Qn=Q<1S1LsRGn-B&HO5@arrkr@t02PvGulOAX8!U50&kM<{Ha$#04B?m8A-1W0}I zJ1=omJY#Jdi8jq7Q@To*no_fT+$ zz5`bgF)4$dF<DaDq`;6L^^%RLdq*l%D71w_xZCktD&HauHBNGp4t%;*c+EUZEP5p`I_4_nn zzBf)=v)|prk)W0=E_(s0I!yqPjS3f^OnTj``Wu!4#3oNnRp_7V!)QyS87E7<#}euO z7U3YF%Q);F{&qXF`SdW)3;Kp1E=kz72@2Z7&I)yRTfhU)`#78K!m{(nC`10OlN;6l z$JSd1MAfbD-zWkSf`o*W(%ndx(%nd-ba$74fFj+Ebc1x4h;+wDgLF4T&%1cy9MA9l z&Ohvt&CED^@3q&u@9X+pn}bxYgIO!imW6R^{FEra=$MUXrox5i>|q&>(ax#H-nocW7mj z!j+PSO|M!&bN$`tV%Zb9Z)pI}@MmZyC?mxV5yx}Gi-UBR)wmtXSA-Hiv$fVSw^9lU z*)uhhi{%cleDC;qf{7$C1!>%t#7=j7&&u0#ll0|*{7%N(ftV@1BJn>Ajz;fAAn^+k$dC^RN6P7FObph%T< zhi&RJSRy*#ok6g!E;lktm9ZhviNf(5VlZP$U2umIgTJpUgnf80MPy7qlg|CrXmcbJ zdFR9I;|vXSy3bP`pr0XQIaLw|1)+Ha_xe7YmOXWIjX+SFx@@+qC0rN+J)g#9c^zh~TGNEhqEU}32Rv+*@Umk6LpR?% z57DL`y$au*&pEF%P?T2%B6K7E~RyE{&qYAAMYc8C2#)SgiXAGL7Glw6|1n-^~J>b|Ba#O)zG`ExMnGDW@Y zsj#5qEZnV-{-nM)l&Q%5y5pP3wBOU)W)lo+fk+54*<|iGWg4;5J0v8|fodh-GttfY zS-!npUD;k>Oo=c4#6ke;so|6Gvnt79Iz1{>pY7}l_XpE+TRB`?Vn7iyX5ku1+S5t6 zq2)-~-oZt<5#@R#dFFrsdG(Mlomr{Hp#5jKM7XX$! zit(`AZw4ryv*W$fYwrv7Vb!L;<7Gb94HA=L{WhoERef)iMEru=P+ICJM(I|FUwYaQ zNzrYG%{@B5f4lvufDn;YJ27D&5z>1`n20~-uADpvA8rjxhE|_~=h~K7lm^DUsxdXj zL_G7mN}+9mk^MIhv{=pW&@^;14)5?23m7O;0}44IU9#=>8m1+x94z*ScMi zEFO&pN^vZgWL9>11j*uw57nou(BQ1Td0QWUtCt%}#X9=BDkN;@wo%kQ>)o2A(Tuh$ zUrAaM3O&;*Zf%RJZ(?1w`I0}r>198`(cmV^^S(xL*`!Bft}^Tfb6=5E`>u^MO)zOP z*#aGDR-4vKlPk+DWn_+}4}QTUUZ3(5GDH&eqw3k;%F8cnewr%R&miP>qOlXlLbqG~ zkO0aplA1eHCa>_(!;=KPd9CMbL`Im%14EjGc^{YYYDnc2N@pQg&+M`koZjWU}q40 ziGwy+>!U^{+Y2W}{~7Xdda5+|gZmhY$O7_f_JRv6OP{Ggel1kw>dc2h*o zY+G+I@;-NTNJqi<3Kd6c5UbpUmd79FUE)kfK?ww<{cAZqlZ?Nv9SqOq3rH5$-MkKG z>g@eh;|H4RQVYlsZAToxMnqtwp)sD2i1nC+Y|mIQW1RGO92uc7UX3LeS`jHdU?IAR z9;ab`@uIlv1uZ;o0BdJfWDQJFXiWMky`V)T}Hrpc8dxF%uir8}KF;Q&fuk>an8l$A) z3w8Y=>TlVnM3P^*4ycplLdK^BPoYjIwt8lQTjTE#uX|M9K&|7^h==4mSG%`wKnp7u z{`KdN@ax#B8I+oASfg}PFI&WXYu<>UlqsHUn2z_1o};-t82Qvr^i|p{h?|`; zH>9CwDcqnP%zw>W+i}X8GPLy$Iin&u$Obk%3;pk)W4iphD%Oq~(Qpx$0J7su`_^~6 zB|B{9;JpdcXOz+;$_{dmfc=IfU+Itl_rDE*<9#kaHcaQO2%M{Vbb0w>YYvn32lE@% zZ5a0AGnD%dF3rouD5n)vXMrV*LbnDMK-=%ppF5P>;_lnv6FT^1#lO1#$&5A{1IHI> zdplE7C=avb*T+aSm()U-kjz|;?(Q^;*D|eY!P#YnxbQu|Q;57IJz*XcG0y$%4O``} zQfjgUaiyW`M^er#d_}<%w~R{EFNO?q98FShCU|~d<1Y?}5*O1bBl<}qsW4fW7VK`f zMn{{sTtb(_kBvXGyVMKV?C8E%qtl4`ig6dyLBN^?y7OXhh6Pi^!=8(QY9zx0WRRiq zmC&|6%BJnjZA%X|W$qzT$rNa3Ri@gp5F^FJa-rKz14gZpiTPwv&7&6_=3}b<@42~y z81Y*Aja9hUF4j{1Bf!7lka^!QWo(*kYMYEw3r zt<1YFNV)A+z$2}STF*Cz-CZwgZ^p(Tje_Qo2<)Z`V2yEjZ%@a!Kq^$6VT4+&;ra{w zp{p^CLB6Y`(R<{(18>^IH6Zu=GK|3Gd7Q@qkx;^c0vIeDckC{sLe#LRSjS@LuN3Mb zmhKFDphJxtUTC!?RrO^-^^FvFrvo?MwOk5to%Zaepld8IUe}L(9;54rs^93U*h{M8 zp1IH8pb1F|Ld8i#RB#E*tdq`q*{v9I=Q#q1(wG%9ay4XTfmz$=EXgZq#*gfg{SlN> z?n-f+b5Z8-i(WBfAg)4I39EO{b+0c4xvVB1Fi#vKwTaqKN8vx})Gx?c;Ew@iL=!>X zRhAWIGL`alQQ*9YA$$-UCd}vDNgIS1F0HE6@5%O7>0=R|tq*tKQ37HBY2N8|d{h;T zSbez-V_)jO7q(sXawtRFEt}>~$ibO(B&w;yQUB9gy(e0AT*0ln6)~@NdHJ^m2#{Ug_%)Xy^K=&+7am&alcd64-Y z*|moR@cHqr@F_cNShZNF{6^o5DoIoR`G82o2ZbD|fXMX$FtgJW-(&+La}WEj7#Y1m z9)&-uQ1+pa3?)50tYBy-G*``BbpJ#z`bFZ%qL7N&7RFR8z6GorSOmS-vByLNr5_>; z`KX6a|7uD9%gOjD6y7ABSmNY?J@L4^JCqiqM}-#kTT>4(WBv~1_G=(jHfxxsLc!MK z(>@C@Gg^{(RVHZe*n?TN^9O{(=l9SbXd3)EYS#Kw5z^ z;WFv&>O`oyR9Njb=R$v?z+n~~i0dW)b3yL7scvHq)_eKM*wHky3gX){d5u_{<94xC zygbQH=^2&X*)aAlV<)cv3tja(95C^KTbj=QLM5`+t4Aj67Xv`Oo2js?FvVI7R^@AC=M5+4i9~MX+^Tdhj*Ir z3_$!2Ou71MNQ-m2@wz(fbYNPg=Q&(^X<&5^%rDNjK1?e^3y_$qrlOR@YxoTKg<4=P zj1fZM0V5^@N|~~C2XDlA-uBEVfrxF7^VAcvt(sXCw^;|2JJyBd=m-m${Y=Bv#)#jy zzpwEYyDv!a5^r6`s5j$t$I`z<_YBVEgikMglh7e1*#jvwbbc5_L}Qi4sKwPzSv#xY z*I|TRi;Ks_+U4m*@`QUcEnn7$81XMyO^1jYmwys&0wi^I9KA-55BhU%$%kC{rppFT zo^#MV9e4_0xmuOGfU{1i-JAK%2}~v!%%`f6oi|7P=+ufRL|BQ4I&qnFC`6EnF2-8D zJ$rGhJOPufp5`FE))T^n>?Nr%{58H5>rv)2kx9C^m?^oKpJBA*v z!-@Hnxrws$eJ{oQ1<_6VB7}-gI6`b1)^L&er9gAL!!*@Kj3FvJ z;nKL-SdNr~9&iE3;pu$c*N^{A!mi-Ea>lh;JuaWkwdkdCUh%Fo$myp@cmo6ItNfKf z17}xow1GcV*)Ou!`nhh@4=II$*x%P@fRw*yVSVCZ2EpYu8Wd=82A8wiOEgfuBgJF& zIFH&Wxd~0As(S8g0LSX7Xt@&a&j-!CXD2Qp6RZ^3xoS#p)R0YBCn}z4?3-T9>oDmbg&p`T1;rWW0zgAJpO!H>?h`)oFk5&VdD-x;iwp%;JX#`WXhbysi($ z^6hea+?=Put{qGo*-WZoo8DQW`E|NcoUHqN%zsBUxW4i4TxB^=019bFfG7GkkiAVb z7)~fm$KQY~miX~_XbqBC|DC_clO_kU)roo4wyfarVqL$+i9$)!>H=}R+ES@A0g*8( zSO%x*k^MJmvo)v7JKge8Hgi)?#uhr@Y>+W`9m)s2i?7w%z6p@nej#dYt!F4q7qYxr z5(w+f5*^P}0IH)wzA;Jp;9^`S$QMtsU({a@Wyqs9x#_~K%{yaJ7HFxljG`R6@M4Fq zO{~e!W)5;!gkbIaKx!#{8ap95B9VES5!s?CB;Dj)cC$dTep>Db%RcP?Tl zGj~x&5e;b}M~8K^2(>0vE4^y-k&owWGJ6E5XXc!sIy&Lg?Ihd|aMcG3QlEUAgCo^= z4ovrXPR_FY7?A9hi!a8!2fk8v8;=(u(8LFHaofO$n6WyU#+!cHgcsv^_y+4+j7(h& zuv^7?be=Z58z+)0?pyoXMTyqSASgR4_aqtgOZN|>Hf7IBHK2q%lU zCPCy|dF`A8^}{=$YsA}LFk{BdP5DY!Zf$X%M4Dv3O@q07AzY}o4$vVDE-p8sC7>%T z17gX>pd&@UiVr0axEn%wYwm<7tG>i*mXF9P`)QW<+;*(n#aMnVN@>DPo>h8tH7{c{ zi{LL9t>nCt;bgn-eyVffapSHEA=LNvn!lo&OXQHG8|dKOCQ0)+gSc-x)_pj%YiC=?0M4DCWTwGULT734!`*G6M@>;R zNXfafm-c6{4@~5Brn`N0twG?*^96$RDWVEw>rU}u*X0ATYA-hu%8_6K4pONXt9_Qy z#Hh3GHh&REH)ypmkFO7=P-bIfYULL`dau*v*#r`|W1#@2K zeP3i;>&_?+n6aa;>%`iWzIJ z+K#aqog{FM-zj?w%_cbsx!En8!lEvt*dR%~f3QpdsKg#G=;S3`06X+Sgb_3%ol zWUMo|&0r;8;3y#)S;fEerHYb}7lAI(cHU2gu6L=gk^`z=EMyjtdp5Dto`rk{a={;T zy@o~y%FxioNlC?Yn;$|KM4S^sYy+edT7^P7|8bUL2`4U&Iw<@WYQ91G#eOqS&V>I5 zuNFOmHX>adT-sFA`VW`w^l%d+FSlb}$_k$OoHA?Ty!xH->EcR<)Oz|Ld(h%jjZe4D z)!NZ`i7O@E%?{z^U7D{dMtLfeklO~{LTmK*{`~v?f){L1sL~PXp^_>X5JWcE_1 z-|THHR<<=S=5{EA54x{$pbU5gl41?U=$1M|RzHr<|aZKWa!Vm*CR5LCxY^&FOk%|24kCxsabYmhbw| z2M@3Ai4A!(^Uw1(wORZ1$pDKteg~vfGYPIbU8P*>Y7lX=BglHqigeXFRMH!0CsnpV z?KhdT4m8g00X-n5Tp&;#W)&Czp%Ix;Y8}4LJ(u`(b{jgHcI`%xQ`Q0 zIrtnXJ3AyYbm*bzWv*irH663dI|?>cFFlZJP-6`*%6Ep{Av9RJa7YXpVZGJXxS^M|9P+4bnxwQ9 zNTp|Lt@-X9o?%=Ik_q~liyE6CGcV^aNw)KjNgUDKM+Kp{62j&o5Py;`9*X}?jy273 zh{tKx+EsEY28;>g!K6NBaxXn@j=F(GblINx)N-OgK8?>gdiPl>XJD1tH{=XC#s2cB zuK{0z^=0o>d-nZjyVEfw-lv#Fpm{=Mxa$%^mu#E|(oZIGq_7Dhc#nQyn{QW}1CjQ_ z!lt*WTgKP5)>uZPncjSw!=%2eXRaZLE{CmkmJs=e#N0GgxJaD?iL7t(><_ztfrjW; z>Zyj#q1*_eyH9r~8L+pMM{c)3JMOGgi(NKMo#EymE_CMx@_yKyEo_#aKo*e&JR-|x zDL)0nQ)4Zok%1~S#}g8w#nBjOxiuksQ_n&Rpz9c9CD|yes1$eypR1dv+qNc&f-J;r z5ZN;h`sz%3)anULx|?0FTZL`v?V{rHERdj7-p<39X^K(wmR04Uh|4}l)ycE7#0GRy z&{Kant>Wejg#L8S4X(o-5e*y=B)+%a&+cP|;ka`y-XVgjh#<`I5EY8dj0U~ts4X03 z*{;gUp4U__y!z!mhY+pFULtsMl`rT$GEBC7<~XszK)U5T6H|4)cAO;n%W8GgE1f`6 z={rNEaaz}jB8^4RSZ9=Xj2QdyFG8oV2xdjMHu$!-T=DO#yAG@kSBoTE7?74KNX_cD zeXf_w3GC**Uwb;)^6=qy^UQ>)n`i#J97kNEN!(m!2V~LjFAJf&8VbxxOENgVLIf9U zoP9pE-7itSK37hbshx~?Zx81ebTC&aPYvV@OxwOakd7eV=O_Q!Pw(sZT>*h@3ieXz zeP~;(UA2J982>dDv8SdYH$0lqJ4)_r;^SMzTCTwCj`f3+JISuAw(Wc+Zwbmq_x?vS zmTslW&a8FBGD5~MIq#`ZP$lNA-x+bN2^u@$%OA(PMium<_r784!*84O&~TVjR}uFT zu01V^c9~VLcy-y zREgj?@I*LD%(v;A@l=fbMMaV&Xrk?RL`YNTwhtr>wxiN;?TbL~fkcM2u79hYu%F$ykdg*VSI#^u2DQI5uZR(6waa z>z5l5)HlKCx!N`jVh_<0hc{xrqRK&f_Z&vg_hz>Mhv4gUmFYMrm`FhvecJ}0BX2N9 zfysq-<&xMc?Z(v$2zF05vm?fag*FhX#3GoVK9-DpxFUZopC40Mi9YfLMksU8d>tOk zj{dq~Bi*yW$NL0&y6KP_7Qk+F=;E?BBQ^}o(%vA$f=xlSy0uuNJiS`b7U+vP93~!D z&Js6tf3shqdd{{g+qfJ=xEVrU7I~}P>J=EPtl7Kw7$W-Sn^!hehghGqiYXE>2EOg)`tBD!3Yf~+zN?vy02-c)# z#&3MZAA0zG2ULplcokrS^UUaOjb~HZlC-PK^)pBwgSJ%qBk@x z7H`VtIfvN`P1WbGtP(xFns0$NJmOw*ofHfo3hHK*8?g}r9t;(G=2OgVBcN(bbs{nA zY2_`p!8y@J;Cpi<(YTeDVziJ&;&|$Hbacde;*qr%I(WN+(WpR7j>J_lrsLRKhT-z< zif$j|lY-UZ=2MdvHt)qPj!9}1S;FkD)LPZMmrc-5419re)-(`|9<@b4SD)7%*){R&}pgAQ2x&e*TmY zFh%ZuHrTXdQ<#^Dmx?b17v^ zn5Zf-yGtKtjab%EGgiGKXqr;An>PAP6stPB9YL9>D3Oad-4^HXxR9M%5zr&F$8%{| z%C#vCO8C8`4*y+ie(;4)!OR&Tz=-x7Dqh71>LEpuLBwZ2k-7P1qVQoMJwwd)&i#XW zp*_>eC69{i3rnuto2!Rvm&>@1+Tdwhb zo3-6jcqF~eWbu39ZG_+z4c8kSKajD(G|!>jiRD?@i)49(sP5jP#oVrR$n%;Nx(!K}&7 zJ>rK{4!Pk%H1(NoH4Fv;NEv$H;5Yo;PmG=;>4WQtgXtpBK5c)oP5&pC)i1>t7lB7? zL=#6qSTzFHGe){P)W9hKkF*f#ZX>I6D8o?ZiN1dUW)G`g4)ZK}5J$uG?BcRUUYj-# zsG!nRi^E!9j^B$=_D=(8*QRp~Yin-0>?X4Lgf{i8To-Ew+y)=vd9(b;n@P~&dWZUE z%Yn))y{u`Uw|D4!2Q!H?iCc=7toGfd#1O0nI%hp7S8aAgrga8g#De?2^JS=ic4;LX zvF%$H2|MIvhD14pe(wXMw|i*T7uw>wwQX6}D-aYwyLHxquCCwJ5(Ew=`ZGSHr24U* zUsXxpQ}DEM15p{TMFe5fY(+5(UkL%;g)M*xN1FrN$lp(yPU%NpzgKD$1UfBu{1jp6 z1+AtVkLAwY9%$a1pbU6)rIzRPaepywSoxYjW@Ulc|`M@kH^9n!w z>A8;`LLk?jxg0<53wU5n{`Wy7`&C+|&)gmn;rTh$;C}Qjb1K45F9y|x&P=jxUvV&p z&HVP9A9XSRl#-PEFgF&YCWRXf*(5|;E~VX*xSFxc62h4keZapj{rW!bMB=&2Dy^W9 zU%?!f3(@l)Og=tvW*}j|e>{~P{?XKv-AS~QPzt@fl>(>xB)qBDjZrcYKg&xsyDpM4ZRU2u9D|j3F_xL zD|lsM`%A#QXwPiBB;a!%JbhmTYOiwKn*P+`9`$gNLX3KDW}Nh%7kdriaKEPJ%wLW^ zqsCMTU)(?qdFsVeR!ZK85(;M=dT8>#m!E|`=L8Bd7Oka~w#Xd;nEXMs8mP_8)k-LT zchyec=not>^59Dp&zFr@hN(2W2Zg^Rx1@Flc7x}B+VRfnC2;tG85V2Hmq43(Z;~!( zG!Sd0E;QB&Af-aeFIU<43GE`r(cu_PR(U3NKsk7o95sg7*=%}y&Krp9gPBl4uYM|+ z1=*ocs%uUaZ7EA6gNkTmq!^Q8EuW|OW;pKD&*tW+6_v{e_0J`EYXfSX49d-MvgpoF z-nUH~wb@*Ij7n`hqSRu#_9N*E5UyyBK^>pJ&M z72qgR?kSo}krN7r>)hHV$S==frt#^;bW%oXq*rCI@(ttt+T^vm#_<^gc0d7Wma3ZQQm6>)}<2m4v!p>99rJFN)wz#%>*|Y zE!?Db>&w!TFM{{r7h=XcGLF(KPAeLRN|yUJbDG}YiKPLYL#++=5?~!>)=7}LE2q