From 432ea28bb1e273d8fc139ed6f1b159f8565f4e11 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 31 Oct 2024 12:13:17 -0400 Subject: [PATCH 01/16] Update DomainEntity_EmailUrlInfo.yaml Removed materialize as it causes a memory issue on larger data sets. Improved performance of query by splitting the logic. --- .../DomainEntity_EmailUrlInfo.yaml | 72 +++++++++---------- 1 file changed, 33 insertions(+), 39 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml index 58e330e28dc..fa36c9d41ac 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml @@ -25,44 +25,38 @@ tactics: relevantTechniques: - T1566 query: | - let dt_lookBack = 1h; - let ioc_lookBack = 14d; - let EmailUrlInfo_ = materialize(EmailUrlInfo - | where isnotempty(UrlDomain) - | where TimeGenerated > ago(dt_lookBack) - | project-rename Email_Url = Url); - let Domains = EmailUrlInfo_ - | distinct UrlDomain - | summarize make_list(UrlDomain); - let Candidates = ThreatIntelligenceIndicator - | where isnotempty(DomainName) - | where TimeGenerated >= ago(ioc_lookBack) - | extend TI_Domain = tolower(DomainName) - | where TI_Domain in (Domains) - | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId - | where Active == true and ExpirationDateTime > now() - | where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;" - | join kind=innerunique EmailUrlInfo_ on $left.TI_Domain == $right.UrlDomain - | join kind=innerunique (EmailEvents | where TimeGenerated >= ago(dt_lookBack) | project-rename EmailEvents_TimeGenerated = TimeGenerated) on $left.NetworkMessageId == $right.NetworkMessageId - | where DeliveryLocation !has "Quarantine" - // Customize and uncomment the following line to remove security related mailboxes - //| where tolower(RecipientEmailAddress) !in ("secmailbox1@example.com", "secmailbox2@example.com") - | where EmailEvents_TimeGenerated < ExpirationDateTime - | summarize EmailEvents_TimeGenerated = arg_max(EmailEvents_TimeGenerated, *) by IndicatorId, RecipientEmailAddress; - let Candidate_Domains = Candidates | distinct TI_Domain | summarize make_list(TI_Domain); - ThreatIntelligenceIndicator - | where isnotempty(Url) - | where TimeGenerated > ago(ioc_lookBack) - | extend Host = tostring(parse_url(Url).Host) - | where Host in (Candidate_Domains) - | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId - | where Active == true and ExpirationDateTime > now() - | where Description !contains_cs "State: inactive;" and Description !contains_cs "State: falsepos;" - | join kind=innerunique (Candidates | extend parsed_url = parse_url(Email_Url) | extend BaseUrl = strcat(parsed_url.Scheme, "://", parsed_url.Host, parsed_url.Path)) on $left.Url == $right.BaseUrl - | where DeliveryAction !has "Blocked" - | project EmailEvents_TimeGenerated, RecipientEmailAddress, IndicatorId, TI_Domain, ConfidenceScore, Description, Tags, TrafficLightProtocolLevel, Url = Email_Url, DeliveryAction, DeliveryLocation, EmailDirection, NetworkMessageId, AuthenticationDetails, SenderFromAddress, SenderIPv4, Subject - | extend Name = tostring(split(RecipientEmailAddress, '@', 0)[0]), UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]) - | extend timestamp = EmailEvents_TimeGenerated +let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour +let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days +let EmailUrlInfo_ = EmailUrlInfo + | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains + | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period + | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase + | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated +let EmailEvents_ = EmailEvents + | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period +let TI_Urls = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | where isnotempty(Url) // Filter for non-empty URLs + | extend Url = tolower(Url) // Convert URLs to lowercase + | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL + | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator + | project EmailUrlInfo_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, Url, UrlLocation, NetworkMessageId; // Select relevant columns +let TI_Domains = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | where isnotempty(DomainName) // Filter for non-empty domain names + | extend DomainName = tolower(DomainName) // Convert domain names to lowercase + | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name + | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator + | project EmailUrlInfo_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, UrlDomain, UrlLocation, NetworkMessageId; // Select relevant columns +union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data +| extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column +| join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID +| where DeliveryAction !has "Blocked" // Filter out blocked delivery actions +| extend Name = tostring(split(RecipientEmailAddress, '@', 0)[0]), UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]); // Extract name and UPN suffix from recipient email address entityMappings: - entityType: Account fieldMappings: @@ -76,5 +70,5 @@ entityMappings: fieldMappings: - identifier: Url columnName: Url -version: 1.0.2 +version: 1.0.3 kind: Scheduled From 1a336f7a2df78226e99ccc02f61d07b7ef6bfeb8 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Wed, 6 Nov 2024 13:26:44 +0530 Subject: [PATCH 02/16] Update DomainEntity_EmailUrlInfo.yaml --- .../DomainEntity_EmailUrlInfo.yaml | 88 ++++++++++++------- 1 file changed, 55 insertions(+), 33 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml index fa36c9d41ac..9dc1b0f59bc 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml @@ -25,38 +25,60 @@ tactics: relevantTechniques: - T1566 query: | -let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour -let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days -let EmailUrlInfo_ = EmailUrlInfo - | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains - | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period - | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase - | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated -let EmailEvents_ = EmailEvents - | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period -let TI_Urls = ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period - | where isnotempty(Url) // Filter for non-empty URLs - | extend Url = tolower(Url) // Convert URLs to lowercase - | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL - | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired - | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired - | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator - | project EmailUrlInfo_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, Url, UrlLocation, NetworkMessageId; // Select relevant columns -let TI_Domains = ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period - | where isnotempty(DomainName) // Filter for non-empty domain names - | extend DomainName = tolower(DomainName) // Convert domain names to lowercase - | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name - | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired - | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired - | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator - | project EmailUrlInfo_TimeGenerated, Description, ActivityGroupNames, IndicatorId, ThreatType, ExpirationDateTime, ConfidenceScore, UrlDomain, UrlLocation, NetworkMessageId; // Select relevant columns -union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data -| extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column -| join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID -| where DeliveryAction !has "Blocked" // Filter out blocked delivery actions -| extend Name = tostring(split(RecipientEmailAddress, '@', 0)[0]), UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]); // Extract name and UPN suffix from recipient email address + let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour + let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days + let EmailUrlInfo_ = EmailUrlInfo + | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains + | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period + | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase + | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated + let EmailEvents_ = EmailEvents + | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period + let TI_Urls = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | where isnotempty(Url) // Filter for non-empty URLs + | extend Url = tolower(Url) // Convert URLs to lowercase + | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL + | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator + | project + EmailUrlInfo_TimeGenerated, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + ExpirationDateTime, + ConfidenceScore, + Url, + UrlLocation, + NetworkMessageId; // Select relevant columns + let TI_Domains = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | where isnotempty(DomainName) // Filter for non-empty domain names + | extend DomainName = tolower(DomainName) // Convert domain names to lowercase + | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name + | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator + | project + EmailUrlInfo_TimeGenerated, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + ExpirationDateTime, + ConfidenceScore, + UrlDomain, + UrlLocation, + NetworkMessageId; // Select relevant columns + union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data + | extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column + | join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID + | where DeliveryAction !has "Blocked" // Filter out blocked delivery actions + | extend + Name = tostring(split(RecipientEmailAddress, '@', 0)[0]), + UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]); // Extract name and UPN suffix from recipient email address entityMappings: - entityType: Account fieldMappings: @@ -71,4 +93,4 @@ entityMappings: - identifier: Url columnName: Url version: 1.0.3 -kind: Scheduled +kind: Scheduled \ No newline at end of file From c6058a13ce157ed79ba2314319bfd079b6e6caab Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Wed, 6 Nov 2024 13:26:50 +0530 Subject: [PATCH 03/16] Create IPEntity_Workday.yaml --- .../Analytic Rules/IPEntity_Workday.yaml | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml new file mode 100644 index 00000000000..59276b8906d --- /dev/null +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml @@ -0,0 +1,79 @@ +id: a924d317-03d2-4420-a71f-4d347bda4bd8 +name: TI map IP entity to Workday +description: | + Identifies a match in Workday Activity from any IP IOC from TI +severity: Medium +requiredDataConnectors: + - connectorId: ThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator + - connectorId: ThreatIntelligenceTaxii + dataTypes: + - ThreatIntelligenceIndicator + - connectorId: Workday + dataTypes: + - Workday + - connectorId: MicrosoftDefenderThreatIntelligence + dataTypes: + - ThreatIntelligenceIndicator +queryFrequency: 1h +queryPeriod: 14d +triggerOperator: gt +triggerThreshold: 0 +tactics: +relevantTechniques: +query: | + let dtLookBack = 1h; // Define the lookback period for audit events + let iocLookBack = 14d; // Define the lookback period for threat intelligence indicators + ThreatIntelligenceIndicator + | where isnotempty(NetworkIP) + or isnotempty(EmailSourceIpAddress) + or isnotempty(NetworkDestinationIP) + or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields + | where TimeGenerated >= ago(iocLookBack) // Filter indicators within the lookback period + | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId, TI_ipEntity // Get the latest indicator time for each entity + | where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired + | join kind=inner ( + ASimAuditEventLogs + | where EventVendor == "Workday" // Filter for Workday events + | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period + | where isnotempty(DvcIpAddr) // Filter for events with a device IP address + | extend WD_TimeGenerated = EventStartTime // Rename the event start time column + | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns + ) + on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity + | project + LatestIndicatorTime, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + Url, + ExpirationDateTime, + ConfidenceScore, + WD_TimeGenerated, + ActorUsername, + DvcIpAddr, + Operation, + Object // Select relevant columns after the join + | extend + timestamp = WD_TimeGenerated, + Name = tostring(split(ActorUsername, '@', 0)[0]), + UPNSuffix = tostring(split(ActorUsername, '@', 1)[0]) // Add additional fields for timestamp, name, and UPN suffix +entityMappings: + - entityType: Account + fieldMappings: + - identifier: FullName + columnName: ActorUsername + - identifier: Name + columnName: Name + - identifier: UPNSuffix + columnName: UPNSuffix + - entityType: IP + fieldMappings: + - identifier: Address + columnName: DvcIpAddr + +version: 1.0.0 +kind: Scheduled From 16050e01764b4c998409b93018fbe7f6f0748459 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Wed, 6 Nov 2024 13:26:57 +0530 Subject: [PATCH 04/16] Update Solution_ThreatIntelligenceTemplateSpec.json --- .../Data/Solution_ThreatIntelligenceTemplateSpec.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json b/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json index d855eab57ec..53251bff1fe 100644 --- a/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json +++ b/Solutions/Threat Intelligence/Data/Solution_ThreatIntelligenceTemplateSpec.json @@ -72,7 +72,8 @@ "Analytic Rules/EmailEntity_CloudAppEvents.yaml", "Analytic Rules/FileHashEntity_CloudAppEvents.yaml", "Analytic Rules/IPEntity_CloudAppEvents.yaml", - "Analytic Rules/URLEntity_CloudAppEvents.yaml" + "Analytic Rules/URLEntity_CloudAppEvents.yaml", + "Analytic Rules/IPEntity_Workday.yaml" ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Threat Intelligence\\", From be93e8e610bfdd4172a619f94c1cbfa1c611abbc Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Wed, 6 Nov 2024 13:28:10 +0530 Subject: [PATCH 05/16] Solution packaged --- .../Threat Intelligence/Package/3.0.8.zip | Bin 0 -> 56532 bytes .../Package/createUiDefinition.json | 16 +- .../Package/mainTemplate.json | 939 ++++++++++-------- 3 files changed, 557 insertions(+), 398 deletions(-) create mode 100644 Solutions/Threat Intelligence/Package/3.0.8.zip diff --git a/Solutions/Threat Intelligence/Package/3.0.8.zip b/Solutions/Threat Intelligence/Package/3.0.8.zip new file mode 100644 index 0000000000000000000000000000000000000000..f1b51f2a144db141be9d3a21997f084a69563e99 GIT binary patch literal 56532 zcmagEbCe`)^CsN3ZQHhO+qTVV+qQe!w(V(S+P3ZK?(KP>XZQR5_`SPXC+lQZornrt zamAf+mx44f2nqni_lw=yOcUVWBe@;`03Cn;z}U&u(8W~MQpD8E($3Pw(%z2F%Gusd zRRtCR9EgzG{O_sgPhsxr0Sy2M@>lpjZYinr&p4;UQ*Vj z$V)4@t`|d{rlm>TTre5!Imw-o1~7dI+U#nZdFPbKXpzPU`NPO1yPrBRp&i_`48JGtAp@$+DS z5O(ffxIJ^2sMJ62BeU)Esq4H9HjXL(8FYH#S9%*OQ?% zj+-G51FuV#6Aw;B_saj`BxiEc)g{-AJior1T`9^ELjqkO5`rbPX(2h;8|3UU=6iG* z*pQ#tS!zUA?Drc_8zzV+5B~}IwMq%K9ide zFjKez=WJjZr9FFuFQr^NW762>4nGF|E%PJIB_3np!fB>+?(L8l@OA4 zaE8n5X{>l>%#OGm-l55d%9IM>iDypcPLF0WNJpPJ4Tk1T|Y+fW*__8GhaLE?r}Ln-mP;Q4bh~H z+$Tp4c?kf59cFvw3^Hn`)3N#phr%?pZ6XXl`Glc7A zyd)&6@dPH8O0Gdptnw;i{>=NqYU8gqwYPCTK1|YqZsA>*0b!p{vYK1^l94yiBVX4E zi<2bM%uqSeVk#B2z)-uNNInl^Ux`k1ltR~^9H42`*?OgU*7znYQ|t)sCBS+@U_?;3 zY>>mS?y?ImDe{7Mu-n=I)Js3Jf6`vsX*u;Q%Hk{8Ur5`~9nb*@f-M?4u}es8|D0W+ zs=noRqBbe0b`v+U7-=g~p3a|2$nhD7Tcy{(qq+|krd|S_Vi(1z?d{7A?4(RydUCm#g|l4MX`GRNuY8ZD$Vz(F;8t%=4CXyTo4|p^g-Fu zS^MJPNJn1k?0e4hq&Q+*p_%>>(JYym(qU#j94iYG0(U1=RU2g-$FG z9ACN6E^05*K<5sH=rPc`=#A?I@3>2frA#1KLAL<~aub$T`?V1+LNy3c0jxWUGqk7h z`|(}zOjqW456^|yWL~9cYyOa(eK^w7n|F6yPGLpCQep)Z33NcW`|)FC6cH04m;$se zQ8N6^$x#k6)SjIm`7x~ixqx3WApX$Y=&zvepzi)H_@M3&+%kt0*LQc#+b3#R51LeI zh)g*l#B2d~HHphP%6kS+RxBX+T$)~A^4P=yg6kuzk#gG01)NQS|eQK;xk`;4Jzdg~BWO>gT zple)guVf%gMt@W;E>yFhEU~WRQ#@5tJ+fne>;ox%k-LEAN#}+4J!Jl@0cjj$Lh2)z zHAT9Wj5#qvDGjQPys?+~)E40i9>6Q3;&UM?&sQFRlQf5fYXrJc6`{`vgB`a3%ilz4 zd5*wb62TY}h#&QVqF}7Q)M_rEoB;#A5AQ@d2XSQp6hrGadf~r7L473svaWCa!)1)e zVl(MlIW7`3Ny=hEk4L{fe*3u`x-fit#U17j{TLv^q`>SA??5m>e z$!m#v>NbXKE^pHiEy>m<^O-5sJX8kbUcly3Ejo-!T$rqBA=f#rL*m(pCm>WuY&uXO zqc|q3f-gfsK0X0l^v`7S6FbE(_nGwLr}5PnpLucxcEGLBtKB zo0+snacg+KAJFq~XCiC;V#Tmy!zaBX`{dD$mf_WTu_{JYheN%0-U{!H z0fW0e`=WHj`;sG*2OL??*K)>OVHkX)!EmBvrHlsnOOO}Duoshy^O zn@^ajIhLEkG1~@_&N>fnG~NF^X*@-{`{sa3K3^OdZLEuA@lEh5RAfgzur{tH%k$JO zkmp+Gr3c%L7u7CZ@cZoJ_uL9>&pHd!hvSJ4>Ypf3x-(N22nZ5chL-2Ukxj9LBt%rY zfRTj@nF}^oV6TCc8(Cr&BJvMArAZ1bj86~ zaU46JF}}%h4|v2Q;nV|OC~9inTRhvHXHGY@iITB@XN@TrxnupE@8_f;Z39QCWq+`gQ z8TLDN1T71iqXfytP?8Ks<}CqUa0tD(*XYGmL+JA4IZetVpbAPPpgA{A@~19yHD}(-2M`f8rs_gUPE^Q*e3r!W7OF4?oGPQx*lo;KHcX7O?* zAe=lMV`rq`GP7}sL6Dz_)8``so7RnFz24!J@d`? zB<3TdZ1eZby2ZK1%6rVF!>%_?lP2-2EzD@6!ik5Nl4c_T>cr1r=J+~^ zLunuhXmpPX8QG9&o?_eGF7{$wtj58~-9L;yvMBm8Sdg1HghWk^up22f=`}|BhJ__r z>I3lEqgSr6aT*t6N3OMhvzbC$CaN}9<5&Ed_5VP=73V-#$F)bqL+$`)o;+9Ylxq}MM-lPK LGVS?17k34~h^OcC~EWxas!;9Y`4? zv<4ZWf@s^xJ8&9_>tYJ}=0<2TXpsXlhSRIY9}LYg5j5fJEiHpU$eK*-dG8xxZVN&h zZM?aTLDkBd>t+_vAb50}^VF>phbEn*&vw`ut%5fjYJe>KXHu0`-Vk*HyQl~TWJ9-# zJai2p{w;`}OHQpbpJ*K2fgcMI2-0r$xb^Dstpi&oonZWR0=F^bo*xFNn_>^B$Fo;)k{fxAwFzD#M|yacqk8Fu!i~>bo!4Kw1KVgB>q8C$31%uoU*3Y$ zs*pf*ehnqYX<@JQIy)K&rohTC;cM&wN67+0JtM=f(mv9#fZFbVLG2~lb?qU~6p(zy zeh50Xh5QKQ6{;n@3<1@viw3?UZz00BIH2Sqn-l_>WwWc3I!nda0CHDn^N9X(@tY~# zS9XZJUp^q0-@y8_3?JCy=%rs7A=}4L*17O{m0@pIi$F{9dY-QsmoMk)WROw9w*E(v-=b|jq^+>?2^y_zO zc<(tcVpt2O`mbLXaINAUY}+NMuB$9cHp;DN%NjVJxgP5>ak9k4X7eq<@$lxioIR@g zd|1Tm`!-pl5_(CpMa5=Pt-*=E2KR4YHbx}g9lUw$?hz!HR#^C~%={7Y+nCwJF9; zla|dF4C)15(E1x%7^U?uU0nwP<2gOmn|R;Y;Rz&}2pz>C)yHAONxHifGI1&S zIs;0nr+LzXWyEq58GRc;8ERIg@y}Kn$Y>pAMP*974-sM>f$LC3T#E83DVhx1aF%2w z({`0Mtj$1~#kI|HTm3T%)mmq#zdwgl2N=bnF$8C<&JWEJjaEEn%Qp(Zr4s@j=rxYx zZV@vQug(w07L`^kk_8@N)AT_y{ZRU_c;!tP&L0;^kPRx1SP+)?(ae_Me|^o)*3J~* zw^~;+KuO*7HoIu9HB{%J*PF@IFPOk%LFbDxh-dfz1891CIQdF>%R)OnTKdEQjpc?F zns+%oMxhDm)$-d8$2KEdProyuVUP6!rnY|Ow_V>0pFhvFetW$w1KTE=7ROOOz({&x zwVqDX=RB5#w%eK2yi(10uVFnRkMk`T_BIW=6?vesVq~ff#xFEECklgCR(1Qr)6)Hg zH^8-)Mr1CR zk1aXtz-K1q(rshY4HgL4Gun=KgGKcTdR$$)K8uoKX*Y`Dco)D$sN$kLSQr`eEkWU2 zoX1E+@!qybNYxzlPjm5OmbTpKb-oTDTi9pwZ~uf-geKtY8}~l_?BT`6 zv&16l$#>fSnRjs8`lE*Osa)>^Gs<#zYdRZ99nI{~)uY={QoB3s6jj7>kOfB%l=fPK zFm-zz=E_JzU~y%}Lvf*v!O=Zib|d4d*+t$T7PMkrcfsm4%EtPowI^#90ZHZC6}?`TZG%xi@aK{vM$aBG*(8~Mcn zst%xiR^%glr=&vp6==Sn{Gf;NLnC0i_3WHYN(nUYq+8=jrqoNzDK3p|2&$D|z&}6v z6{Nu-?6A9Ko{#_l{tnO-{?BNQ;{P{VoBIU`fcQOHvo*A|Q!%x5u=yUa{eMHXLjr2^ zr-#hM#;zn?#qc)Qj=^Tobv*H>I?uZXVt>-{FtPX+TcuWAUs4 zj+DV|2utZ@<}iEO0Mh`F0Yu_=xBvyt;tvdqTF30S8yMcm(i24>pxSys&CsK**{#my zaT_1fdyCq(@sm9FO;2Lbn8v+J^Q_Cp#c?arIX z&UbI8^h0id75shf{bO)2ZmF$Qfv&$Qech_yPiq;!DU|Z>$@=iAEr!69f;<#7ky6M&XNKqvc>rWW+26p@ufggas^cL$#W!H zpEKq|f?&&{3EKX;=3iwX?H_Wgwo9&yAJa}}AHI_5b)045{)0p`FE$ItvOoQmbZR-X zz^~>bG$RK)>-ZB;2=*3FA6SBYdK<5~-XDSn5ID>sZrGqI7b@sQH8iN35zIeOVeNx` zLIuXVSPqip*g9kOR&7;gt|nroDpch!i~tJB@b-q-q{!VkEhj7zb5=%bJMCrjaNz5=(q~y1_43+~iAZz~h1ObF*_Mjyg1XmZ#3zd!)8WX;tOFjMD$= zdSI6>_4`NH=TVKEU*pIFdzPHvJ)n$V|1wacx`DWLM3&>Uzi^G zzZ30IqW~+lV5)$HC8L)1@-bS;2;r(q_WHa4zAq`^ z8bGAXtm#dCVvY=W31_L%fV!;+XSEal#1 zm$PTQzQyaM>^Dsy(I>^Zw>jxKGAcz=zjtjD%PF;J8Irs4q)bK)p25@Ct7p?2`(dz0 zQ=O3lr7`7uWw|wY)RoeN(peHBD)G}SCC0~AE+Z+RTe4^a{Sj*Ugz)9NMq#nKjiE6n zUo)MWGz*^Iw>Z*_?H=4ObQyf!!vlnE^Xkx&o#8eVXs&X`7MH1JZ(sH1i=J|=8pE>v z&sjzBqf3g7Odmm^lYGzp6B@rNnL8Fp4D#$rlR1Xwpec(t^jaLXO_Yk zUZu52Mf~$Q{RU;$LErk*cr&BBSikje>7jahKaNXBJ%tf_o4^_@(!v@Le z$04&zh@ITb!s6Z25Q;XMK|u5FBd-EZ{(G0tv@MgyMy1}Niti+aMkb1@gbfE9S((&C zMxd9G#kKemX9*KNCV}(!TPQc3iJ`GCTFru=FIo>etk}S}VvD|kN{$1z$$@5vNKFik z8ZziCRT>*HrIjiZLoF8wq-WMrt}Kv$qNgs3{+0v4|@BToj6&D zwc(t9h&tnmy%yARzofx#hfN;Ixa@)9KFeI|G!FjR{m82-||<9RzDGAmC>%@$K^&mCDLHR z5nO16B#XkD>|Pl$wo6_;tnw^Trrkr65E`DHP(s<&w@2`;B@&DM-)6x7#|$k)ZuSbJ zT}5BC5>f9q4UE_txe+(~WVdy-(S1fAAOYJbnH|@9QKKe4=;hOI@wk?ue-d7F+2}x< zt!7}TTlrvX5gie8m7f@)sX1CdRWCY4N@m0BY73Gzn^6Aby3B)jea z3xL(e-eijzW?e8h)LUSimtakZ%FM)|t1DLHHa`qV!P@0gRmF$N;cHZZTpgD*J>+T( z(Wzj~K@e;992T_ao6`fxuZs(S#c zEWQ!ItZdFcqFq32R$*VY1iOEodJNhO!b32dmxuex=~bns##3X3tHU%H|8q*U1IIVsK!~ zd3jba7o6bUXRQuR8IW*}wf-R0nqwy#%~NG&qV=0CeAPX?WB|q4@bLuMmBYmVmoT;D z*|n5Cmt#1(3vlLNPjuY>^`x^hB)M;5O6?GOLDQ2OlxYGL%F zRB0}r_oLO{DB$_G1fii#VGWKX_f2AFg_c_l-ddE!i5pw%5GAnhELQ>x0E=y<8rR}s z$zphd^LRJMBk_25Y-M&HX^V*f;>;XdhuUWK&nNpeS@OWTmz9;(*@xLa`2P^c5TQH6`s>2` zv_fk{!CBI-L^I8T%BaYKiZK&jXHoqov9Z$R*#8_$NV>DNXq|6dV0k=gtk&e2hbuzb{|O|?;99ErUwk(hUizEYqA3Mh z%~k#y`&Oe|OP?TnwR)ZbY-?05=l2b)-G@cQ3kg+R3eN1l8dr-HhC4AH@1?)2b@`3U z{J*R<(5Mbvu1fMZm(ep9s(A>8rsQCl=iT*{aF@FZ%_E^dW1|adkTzK&xG~pD^lX|L z*mqX{Ewlfa@o$-F?FNTy=9n-~H)z^68<>g%Z<3T0m3REK&Ig0lb>+c8)RCdFw#WeJ z*8Xq#s7A0hRP%b0sRSfup24g4B35=*v1R!^H&9p(kW*un%C+9ix;z&-$T21B@nrQM zOdfqB=`SWhzadtvW_a+Oi&g7*~zQt4UH);*vEw@ zo{f)WhRygdh;lplr?lX(7?^0Stur}UCKI?A4BV|`!HivtWyvZy(_zGu`W?!W_88=x z{|iT8{4Gv6;w2-MsqYG3Z55vmHwe`RUnB^O=pk#VKC7{NdhGYu!x&x;O#d%-RETcA zXH0%agVSo~JE6^=3hbNpYonKCpvVf%-ftR9fKrwAvExIO(<~--eU1MT_sst$?x%0! z4ip}$c(~Bi`k2C_=4NDF$LjMre~B-IHh;4ErzQU-T~s!2wQqDs)^gMkCRl1NGYE#UgIU?j$na1^wV-Lpgm#b5 z&X2ETt_&}yYyDRM|ebc@)r66T7JE3PnvXigK?PjtFpTn> z3d**n=H+!32stn@yAsq1|AjLkxtul!OaFRw#=dg#sL9j7nHZA&6vn!jQ2jrXwc6^1 zs@GH1N~5|k5%Wy$rAARMuM&CiNXUbsaRqFI)w$PpgZB}H%AfCbQLy>HA^dK6f7eC2 z-)%@xYBs@I`fqWe=B-x3RhgTP76D%HhJ7yuW>+jbYvE|q%E0Die=(8o-_{NNX^CL| zmn*ry!~cI;7i6@~`@qAu5>~6eZ(Ort#Els1D(ec5nlN=IaJh_$EQQ9}a(n=ureqhk zu>H>*6OiDYlG~lDmY1NZX*`b~M?P4l@9u#5x^o~})u}2cx{ZA}* z&K_+4(}EAK9&o>X`Cj9R)jV80K7f6<4K0zzcVzRjCqqm?*0N>g(R|AaVP$-6u6pqf zT^~$2`~ORUE;Iivap_PtOw5|fvl`GhpP9wQ-E^2G!9 zi|+l@WF=N&dYNF@Uc#rqy1;5MkC|x&{}2HMFDUF}Ykh&nE#mdx@K_~@$$3Q+wFdXM`O0zSX6Yt`momgRi904*(vAX z+%y9@Jl2FhRe-Se+6R#~`7nGLZSW4c{5`5^k5O3tG1yI|@X-(vF;8d2a!mt8*{|6zxLqtYo(uORPNW~FEstG zESXT~Nq7ezbkhyqC)Y*o$w_hAu6fm=bH|l@fCPaF*&QMu+fRq_|Z+tP$`1Wl;V%ZaXCSS=$euhW%SSG42hkp zY8s#r8AQ`VvUD#2Dh(3u$e1_ucaW5tw3Vln2AJDz?Xq&3yA!vRXTkt|}Rd3>O1TQzm#j4hO=FB9egt&)|-UP95FR+yV7b{SFaMUS*r*kan!Zx}r8fDY}=N z&t-MOpdWjHPRncxTo+XQz%uOp*#eJ}47~+^mH`0}914BnXBS|zNuj8;R9<)Y1xfB| z0j-GHhwfV{oNX&n2S@tx2R>RBGMD~*2)^e%9zyq#8he&P8g!vo-RUNiUI009If)Tv`dNC1f6e4u*h5XtP{ z<=Og4MsgRL-ii2{`#p96H35!3o(4?b!zpM+fXxlGWAVSbwRu2peobh)cXqilq6WN| zBGK8~8Hm1uD{gtRi*TyhUDSfV+|rvwLeo0JH>zTo=yAX*NNaD*?}f#rvwbnB)7|fQ zhxU0sn!&094#mXaD2ba>Zm12ZvK5<)cGjj9;svd9nv?}O9C@Ge8cA&zU;#eFuWd&N zs8Nvtu&N$WkZEt{6{oaMJ{2dRWu9D=dWKZgk$MUz0HtFQS&q+~U%-1{M{k6@8CJ#I zO=w=V%DVSfo2IBDIF#liu@ln_F5xIXU7^Lf41)RnD^+b{@TQhMz2e^#%W0 zrAeoUDhPO0lzyHPtnPw1nr+Z!LSO{L3Fj|WX%3VsYx&96TxBOVl~kZlsy|#C=z}&6 z#uShV{;4%!shAN6>$vs#ps4m9GbDtpKAZ;nNR^>dH8|YIx%m!#lW7@r4+bK(*r#84 zFr0fHV9;v6T}*Ddlxiz)6-5)wtjz^pV^X4B@F-Kj>M_3dk1F+#j}*Qo&Hf3! z=0bMOaqQ}yDfO%C6d^}#uuZVgjZTK08oG)|*p^|Xs(FFVz<}md!)Dg97O*8KVXG~O zhQM7H)u7WWOsNI$^hpycHUKp5iOjiuORTqvaJ>a6U7KH(bzEthS=QPa{J%#_*Fcv| zUVnHvB8Xvw&y5J$P{9p&JpAVlG46tQSnwc&iqKF@R(`6R*}z5x4q7Mc85J@CrNFue zsXoWa$*qH!t4qbuJd^jbAi86szjJ{(zHfKFUG0K_>Q{SXQTFPO{Op(6VeE$d4RBxC z&E+9??uqk-`^H$HI?()<8RYr)NZzbhJmc9LLwnrG07ffg#>BUCTgKS9lx(Dr2P5jW zx=7TOV%Q`PB15DRW%wit1toO{HV%X!er|~k~M}1pKe^pq%pZ&*FlmB zcNc3gsRIBzEQ$o{{PMm|>7qSjh~#+sV`@+-4BPyn39g~HLW80Jr1szI0udmKYzlkR zG(EQYBB4JswGFPhR0^BhTF{o+G>m~$7sZi%>SdjGfT2p-8abf$Z$}l=ZE-}g#p}yC zpzi0s@8oG>1L=sg;flwcRfPtbSU-6k+Apa}Bj~~-ANnz|69(U5Yaz&xqZwN=B>W}W zNl|bV+(*lLf)XhgX0BCQ$(~EJp}km_8c*qXD0^FKHf0vB;zCQF5R9-vl-MI3cJ^bV ze#z$nelp2_W)>`r4y<9rPk(|5VGCiWk~M${GXJ`dxRx$OkQq>jMI;e!@WOoIn>XnM z{Q|GZ(*6l_gCXO3F{9`BM*g)yXBh8XN92uOyb{nX*1=wDi<;>YO(Nc4h z(+Nl;*f4SU^jS1y?cm9sjOJuoak1@M$K`LT6QsN$TeP&~2Cs4G(`d>asoCH8&J`@# z^kX*2(pSR|Vb6%8F$=I{Cc1P&9;>b{a z8lkcaC5;}$Vh0i7Je1l8_B(PZVc;%AxYX}*h}k^gZTKDn(g29$M+7K2vOgM4@2dn1m?JR@Q$72+2q?%51Q4)r$Y;^G z!O|H>7$hE6+$ymYGUXioA=wo4l+>X2+8(e&qFsE5J9!osWH8Q#NA0h|_%3&;@tG#GfX)3(1Ct6Kp$gTuTPNs4o9JtD6+8DW|BZ z?@|UucNc>{QkZ*7Y%=HdZ4r!o92}TJ!JADL-l-K}4Kb72Y9l*66h_pXCq{HXpoet6 zvS^>^9@3i-I_%3Y3~#8(=>xe^B3vVcckcOHgrA&1uQQ}W!l9For6?f>`LI{6>>IR) zuap*X5XkdU;wylWbgJjS_)y`VS|oWj73)?&%1}i=6QaBJc6qy(^vT_EIT-%g%KiS+ zi(h6(BLJE2fTBWa=S_!VWni}g1BY+;^6WwyJ}H(E&>%C|Qm=3$6}vSacBWz3n!u7v zh#+CpQ}jIH6;#h^Gz(CFMB_+{zDe3MtP8#axVa$acUgj*Ua_2x=k3P5A@H*}@86qkY|`m4g_3 z1rn_(U!I>&F-Wt)_Y^7UE$oMZo4GTW+B$q74}wV9z1$!AP{#RMMB68YV{XiF>k^Tz zyIYDWo8j=xd0uVq0kpm$@zq4ox0}J<=uf{xy`c}+9In|mxb^MD2f7=TJ&Ja>VE@Qj zg9RMVT3~_Xesdc}bVZBcjx5@1N?_j<8-$PPl#wrB{T#uK&bcju2apvu$Pe>fDtJB! z9i&(%bH$yQ0dY25?5)r!o@s}K7!b2%C}>MGI462T0(b_xcfw%o4a;ITR}8^HgG+B{ zYzqVsJw)r|(&-YTC_DifMa<2KLCVNMiitsTrhvYmyGYFgB*niMrou#R*l>(~GK6RD z!pjceRSe=%4dPS`U{}cK<4d;{aoH3&J+&A@J)@O4Z0|y{W-DdE3zuCr!LqM7we@Ej zg2jlp!IE1HLb~x}8w`JM3eTuz#(mlRT*|GsnNhPlv-$aWGNYz-xjJEDaeZoInp=s4 zC3X&Ivt-|O7?V%jO@fRdA!28;bpj~O-v$-QAU(2r0&5BiMYMUYz00W{tnysqP3Ao^ zh1*8r#eM>jc%@Zilmu1gA^GbtLVKu-R>&wdI$xR#?LkE2LLY=3fZpcV5JGOd2Le8W zPRV^yuh+-jD_mmZk(L8DgeKdri*eYNq=K1w-5HstU{Ij{vP2dYal?#>OCg(Q#b{>5 z%@EA#V(sXCK8klJ&`uyj2@GrTRe!rtN@Hg-m)^i28QmW}ga43a=`@>QT;35c(agwz z__Uhc7wmzjg?+Hr6=7&|^mtY2%J{(*U)46hso!=K~ zevAg^bB%%d_bxqDiZG~4q2E0uP51@_C^NdjODkth_~t?*GFy~#izhiif{TMh^)L#~ zM#F~cj;~d?%OO_lurUG|Hg=(GBEK!q*RDo=Z6I)t7nRe&``2gQ7y9Sbp5&bDkLnV}kM*fL!|G47mJ}%#kPEWV?Edujfa~V*k z^EU4V@MLow=`#Q69|<^yQSU8S+n!9joL}sQ*bD6-N-6Q>O|W8gHG(YKkH0u6Z5OGi zsk8(O`#z>l@L!b2DoAUwPHA7mE)hFn#kaNPKf-kbBvmc(5cEwby0VDfLb{v9FM^%E zzkUkW?b(XOssAOnn-aHTJMd9=#My~MCp)uxh-E zWK?u~;Z)sve1W8}?(F7{)-jvgNX=p1nxPOVi{E0s`A2?y>Wkt^tljgXNihgYXezc$cj!r0uI?WeoDn8Agp1 z2Yjh-n~(5p&%8L!Z}AP!n#I%Ch-I?41{S>^#M8axFCdgZm5xkIu1`UfbIXyC#D2Z8 z$RmtYMghS5e zTCe!SKEYu)u*>nXY;UwE=E55Dd&%=oGzy&S5aJX`WOQUv%nWR;QOFnQU>~lEc^;i# zN+g@RLDk|Mwhy07BZVtyB_YqftZgJVId!l(>4NEM)0?YD+S5Z zM*E1!TKU5sG^vXKriu-TH^qseS6e=~k{x#>r+ZPHeJK^JTanZRU>ow}aj={UpeJ=Za_|1#hz zuc@m2g?#Z#D0r3_717Kg^TvVg>e6R+v?=3g!q|KV*VMY&KAMnDx32=hMp|^zQ;)7l zYD84GIl8w;1!NZId?ywKCAxRr&UWz488C{@Z1mNP*iCvA%uA}}POabb3{jn2f!&4z z5RLtmvnA*{mbMAYNjb9jPMO*^+md51zfu_QR12;-$D(W$n?fbJNN(y&$P4q^Q0wSW zY20T+a6r)v2T?~TL}>3Ff}w{Hu=nb_b3-4k{FnkvZ4f>EYB%(a|45}@SRjRLLSoYg zJUaS4bcvsDXIq;=Bx{i9@<^>>9*Nb@!dGKvc5Mpf^ z0vQZ1LU#$z#nq_ZlO+W`SWm=lPjGy2pCq7|yJ;NOvE{Ay%xKWitJo|*Vl0cRZZmBh zz@m)h!`720QNG41XIo&2#kFOwvAf7Nv+Ru52k5^KF_97UxwiHKk&lpbh_GF3;$oA9 zJC|syGk`iTa`~4ck`BY=oQMwG97Dbr%jLKve?P0wuwF7)9UU>hatZ$g zgI1cn@tsT71YxlB{{@%d#6ZXt$9zv18n@ksWTY>v`I*Jx+QX04vg~a{k8T^sU}UBTTx$ED_UHZGayxVUMo2_dIP8 zY>0GrzGA5v$M1$r#;+b$hr&91ijKUf5ct9a=B5nruaVScOq8%`x>_KrUnoC%lxF|j z8Q(l&s1wM}q4F!By%K({U?)BAAj6FWQE@S&)@c~nuI5$D_aC5!g9ZEk(t->Cu*S#+{5qr?0d`8k$ z1n#|Auy7TET7Yg4RW7R_7os{)+a*n>S-X)QdEVL<;klz@NrpCCi;;5IWxz3GpjZR<=!%}~x+!=pGBV}qx+ zFifly;vo-~LKX&bFob>{iUwqz`%N1ZqW6ubq7JtU|{e=3&9=W zsu#Tld<hm=!I9Vt$Rf-4snTYntMBpgy9l!YBYoDoW&;J=Ky;LK;fKpJc-6xzp4Kp<#VM7BLXFPRT7qh(T@y|MVz zPwweKO!t_7+FSgQgwPsi7Hu`t&uhG1nPoP`dAV|))vW0{Wma7_(?{KXex-ppo&S(2 zKtsM}_UwT$n^8gD+V%WnPSqk_5L?4roW-UCb@CXya09(&j-s)ZEuW7!#h;|z(+Ro( zP=L>O!KHU0B(#Xp2^GfKo{nH&0NvSdvd1||#m%1?I}*GB=l!&5XokyGda|tR^`q7& z-Xk%w2AaNArba|$U!x5`RLS&+N|i-D03)lS0_tmEyVo+y(?3@z%x4Ex zDJO|=z=sPgFHFN(I?%XN{W_emdcjQ33|lD@ybTXTqUr7d`vtr77-1%{%g*cfA?)=z zq8Qu$zcz*`)fwFgUQ#ov`dJ*LzWk7`QXr$8w{#9RzA_OU&BifBOwTw zNxi~J7(lyKk*__6@OB!T99)WMZIEa2`N%Hbble85FknxjMPEZ)ST0FV?A%;jE8y>g z9UAFX90k<_KZa=pY999FgxQJ!6R5o>=u?Vg1b;OJ`i5XbdKn(VVtM`CaQJ19V5)v& z1`gxZM)pYq1PF1&saFSs3^ghY?w~A9lkwx}s6Y9RBn+(E*2NgO!XgrE>wy`ouXaAC zeqBNk#h)h^NQ2IiC$&f5^#+>-m4bd;Hhz-l#I61!c0A#cSQDe)-d-O}-+`_E6z)Up zJ!d-~6Ro`e$jt`XH;Gw$V8g#vkL9)drnHyd_DeT@t%+ff@I1t7+fVo-sRtwa&ii|7 z)C)QbMaAGeGH2VDqdS1Ih9DerV)8OMm936N7r5V-$-H(+;^q&xa@2d~6Ms#47a!Z> zRzZX89Y#iXI?42rsspM?cydu<+pagLl#5kSnvJCa_=p=znT7eq_S@`f9E*ECTy}k> zmhXyA?0Zl^g*=#;pGjNlkwX!g%+0pZ3N`SZlWxj-z!y%A2iTCi_;$l zfi&ZSh+>S!^%=;c$NXA31~Q2Zdfy&TIfi2H@Z=>YCY+9G5EeaeCM+Pm@7>w}ky|4?5=bTc_T>1W55{Ji-k>=pkl?~O_6ae5r|dtbcr@mW&^o)V9-UJD zbB@yL2O5mjIMkF^Qj?mdbNnieTwHtDx*CGMiX9`KhZq`)yXY%;G*}bKK7jS7^!6nz zebAeFTL-C20>&90$o64e`+D;f)L15{o<{~b-cj!9;zv|i1OywPAF-L6C^K0&5QbFz zhA?DNwVXM(K5}6zsS2UweqIq(JU@TUoN5YY44`*K6)yiTy52EHm#zua9^2ew+qP}n zwr$(9$F^a~GCQG*!dtbl z*jgzXUEXyvpd`sG#9i!CDyF6m!mJ{SCpw2unw^KWeSd$Jx^b+o>{(&U2@3jy+4EdG zXe70Dxu?%s-Ht5Km;((tyx6@p2%~pFK^;e=mv;&y>>;LLRySh8p=^Y_AAlUx2s~Cm zOUx{3;1JD!M8?1zg(raI0j;S|-d@{q%u;rBu}`{!0CGjA^j7|qSUAuCjMX%*%A)(A z@ADCr%LD!M@n627#y*$UVz8QpckC9#PWcyW@97I;6fdZ(0xA#9shbGQ4mep9Vzf%M z_DG)Fbgn{5BiUr(G2DF_cmHm#`}v5pmvbTA^`$+yuZg^fAl+-VY!?P%&-T+ z1#@hsPZ}sW@0o2vkrrS6EPXp+qob5&G!5#XJ|3MpUU`QS+lDoob3W#6ZV^F;=Kvtj z^r-nOazF7}!i1Mjm2S;{l`7qsWx7}j^(l)gEA+Gi!P}0U|CF>!Jg*p^P*Tc2RAt<} z3Yf%m*Ol>_l)AIeGth80qPM)tALQQo;jUDiN3bILHk2Vq< z+-t7de#oPl)CvYMJ1)ujWYD8^Vv&=xc?WB&vTtVBe#C87zru^YTVMqb;H-I|grHw! zHBTFZYvx65E{0@o{;Uu=RaASCxi5J^{*#++k-b?*i+Ktqye=s;#_V}<;NYRcK(v(F zEs3j+iy6Xf+$KN7>T)}e0;$0aTah2>A>?9&n`AKTNI=w=u?c(5DkEv)3$yhZI5DeY zEdd93@)CHE!2MRzkYzBZ)GT|jQo|t|)ZV%C zaVrj8;AWZAC)7iYWAbrMdTDw_F<#c#>~p9Yk4*&SW4zH8b;|kPSi=1K80$)-5m@K6 zN4x{vIyPr6Fe{V0V?^*GxBzmD$lCaXu|R%Klwn+9$Z|T~7;#Z~wVa###g|B) zEpy$-7};!YakPT9Z_d=ox>Cr7TagS{2M-RsMyP5V>ckW|gfM$2s5DOElM&zIj3Svn zvxE>Mrs}Y5EVm8^2F!H3JOtUgAQ%VMbCz{i2K>Z&VfP5{UXOp0cC>8@M9!>yh zHSx(117_wNFk_o%z82{OUqnOjg}U_kNF#f6-sl9E@sm_m*#zE#CrYLJnar3Popvzz z2i>juG&h{v+70=~N0|F=*a(+*l*hSO12l-f<8;x!fvOEiE54n9#Y;(@j7EFHkNcbH zzm8I+yv~@(xi#)StFc)>4hGM!y9io1{=<1bQG8-LR(z546gLonlqbC~|~+I|=Z zh`()8Gh zm?4mwjTBl?o32&?f!ontY_?Bji@oE0Vql}APuO+ka#ar+SXIPJ<5>qyR&^JD{Xfs6 z^*aTFmr{yLRy(%3^Rj>Xj%xlA<$kuudx_8!C`r3eroz6nG~Ge9_ z0`KOUobiHR%<-_9h?t%IvPkw0qIBp~=gyi8!e3Mktj>C#5p(*|L!6dj;MIQ_=qw_p zk%&qCVoBvzmHL&qFlyDzXmTi0|#YZ^4(>Q{CY5x^e-BgDTW+BLi>JJ(gGM9(_Rn5H;|pr`kI$N*jkKLGHt) z&OEWH-43jA42l@5Dwmp?^VTj*5C_!_51i zq_Ww6pHB^oURB+yXWCL{(xNZ8$ukEB&i#kqp?GIctRm~=JJ<8T>+FgTeROlOTu+_e zI66>4>48w3rpt0a_e1?(TcYnnnO>0{A7@lmnB&787mv;(c5sx}P%4-0TScvrJcAgf zgzEY=L#A3`I$Y71w3DKp01@ij)!knSIj%Cox`QP_9DM5Pb=4h(%2kd}WXn}dl@_{- zW7$4@@iy@LS#a8*%HNMcNaeou;<0qEZUVUVOGEVmq!9 zt`Ly+KubZxcZ&?2P-#5j&PjTCEG2!JI3lXMEDqgAuvCU)QC)`UIj$%=-@0u&Gp6N@ zsIcFpntlcG;kTwNx)zQ>@E-~Uo)M^`)QrvSl{8{BZo(Z0%O1G2vadcy7Ce~?Oq29K zhic4NJTg{QWRNdc5sqd2eETArPi68vlCWRb)H2G6%-T8}Zr8yXVkUxswg6=i`bCq9}BNZuY2I{uF*$z zf|TGuKA2+Ey>&u~O=4XZpAl~OkW z?GM-_62d+Tp-A~4Dq;pa9={*Q@{+TbQoo5gzZGV%H7;&{(>T}sGKfjhR!QCd^JeVD zNn)c=PR{;LDICu1rSQz9Q_jg-^Goo9LM$vI{#f5-qXW27LOy5 z)yZbGf26UKfO5Q^gnbDMR)|>g5^5gbi$oFGvq2?0{|>^ zBYD~nL-ts+$I(TA(gO*^-d&)EP_Gp>Hyu3j$lOtTL7Fy7zeweo@Yb<98WT6(ZMuEp zzeRcp;^Ya)hB#k>mHP==J&S~jQCUEi(@fimgt2%vI0OK8&Re=w*n!zY%oL22L9oZL zvG208Fjo$br@^3(RC9l}wE-L`3_Kba$Is~lvwg-;6qdXN|AV-sRDvWS6Ao%`l zd1o0kWj=1S3!zWY%Jim@4!Vz8JVXd{I4jiZ)p%wqsDJ+B6OnN;!p!ZmnZI^2IF!SE&{ope`~CvBtOxb4=N_o)k(94;#m;fY+FRc9>FgP0Oa2ln-WX1vTtx6u1$6SJ6Y!}>d>rk_P)t;bgcQ2Ry$uUbkL?eHjeaDe zzJBhvHoa8O4`xj97AxLM@(+@Y<8ZRou0hvG(ro%uJmjfJ*Ri#1hHGCxjaRjhSg?(D5v+9co5I~G+!A(lq3weFNlV3qeDdPfd9p1mFDUgL0Kg8` z>;CfRk?jz%(2}@6ZaDp~Z~a#>eM!zMj~`99ai$IdQ&pxt=7A>9c!HkVLp0qLSHnEw z+agsc$NvUYt_1SG(%Y<^=w_zcP$Ry?R{TRrT=80FbR(f{hEP+JXj2>3D`iK5D^x~s z9RI;G=u#kLSJAA z94!!f#sD4o$4*c70oLPGc24itx6jWl2XqFo0Wr<@;?gwwGtkKb_}vfD7(`jV*7d_Z zl>rp3!sq|l+pcdPtl&aalD$=H`$OFTINN;V7v4XieJSruht|0PYe%mg%8t!U8DCs8 zn*Sv{CJhLdL5|F&EibI!LF4lW4nG6W`;1%R@*8r~51 z+?B%(J2Dw$y$&BIKu|EtS+u3Ja{|mjF5ebg1*18&GX>u>AzI0T%rCJ{DI1Irr|Tq(#56Jm$PbMgqnJCH z%+;et$oxG8gEfa<-8ThOrVtB&)kf+Zq`p>A`|#Ty6^DU24EQdbyNtZ&?0h5)2+d{f zS)%o@LriwM8K&Kz-6z2|lMfd=5lRS05{!81?HO=A=53*Wp~~h9y?h$zNv!I;EY%0c zq>Dg3R$b=t+*o}-3xRUF$*18lHVn;^;_m>cAL23h`~gvP#bgRI?|~-bcV*@XDyW3)r~GbjsOvEdtDK>H|v8|v-=J*Espcc(5&Py<5IC%f{9tB!RO-0YKF zqex4Ax%9rBY@2h``AG>yCqKctFw7#ewTLxGf_9(t0Pm#ryi7B?zCC<$`Gq2o|%$2$Mzkx&+Z9Kcdp~hz7;3#bpoT zNE2OF2wm37vm1Ev;#`r$Dv<_>GIOnbQl`nfiW#m}BsA@4mkiK3R0pm*}mA)~rud{nGaC66TA%i{^DwuU4i@x2uKTbct z$&gZuo|#9S8nfny%ZRTHxAKRJcUn=iHXrw-i}egpS#P|Dp#kXnJXu`dRCeO<#JZ{N z`qY_JQx=Z)rN-A@d}szdOHB4r-TQL9-=8#eFA-A598gLdEIB%?;*vW!wj~@f0GHQ4 z_n{#K(j7?EXKRRYHs|H0!B+WF`jstZsYYn^9ugGgJURf3yrvqCj^O|(NVnm<$Iub#L%C5r z0CxbqlIZ-Nuy!#&)ptJ>e|};Fr2-sgNBko0{p3b|7%{7CKItqzd!m0>UUIwEmS5?T zto{@ALy!4!DV{Km`588i4KsPB%ij)S{iuyzDP;M`L^btmWcje$y!69*@BgRN@?w@A ztH!M5F%4 zPU|q1cDsf&hhN3R_otph_f&*_XwtLHARrYOEpwZscGCKK4Zzjos~Tf-ej+O20;Y<* zR3{)p2kL#fYR}Dl*i_jgi`3dc!xDD28t{YSPu=tYPp!u+m~{lJmmJvTf6DdI{wfEv z%EG4ntDHYglGT5rUg)r^zsiNeu7Z9%hne)y=5GbD>ithSJuTE@t4bCCBG;5BcacgKL$m1BWg!;BsI2Xb1}&xMK?ajj_7`31^>US846sh}rL5H|6%d_P z-zJYN<)%TU)#%pycnniOK0b98Er`4`52fcv!bZQEj&4@RQdC9@M0N{JeP}|?C(7j^ zT<#31Lym~}rm(*7P-$ePU`KN<*I!_ZYCBl%)lw#jn<=7&zhN@BPH8jWvox(lUiQyP|uHKNv_<-f4%B;N6+Ms-J2c6;RcS8Ib z40Sw7*!^XC!2SjTJpw&PMe%g8YF|>M++P$k&ywg;n76Kz>O#mH!>6K`Wm*)MJ=3oC z=>;%9GJI!hInKTkHMxqh)ir4lAx<;7ATF83;adc=ItJ--w*(rW)dj!Hi`(&GN)34`+Iye&qzgC4g zO+T}bOr7;Ye!O4ZY&(}pX4-(4^;Q>iLKfD*2Th0U&)KHjv~+rZ24$lXw?j;&UT3Q_ zf0!WFZHf9wZjmg3fI&)LC#Ix%xF$5=?Deg|#-XU)jbI!R>u`kK)G#-lMQK4<>47bG z`2fAfhCrBm834u9LhF})8aLagq7`9KhTHD;#K2|5q^X%#7j(lyZn7E$!#>>Q7~|P- zIzwQR7e2>3_=Bi#wDSR;uX>JMe48Iw7bqD#&C%qKBiQ?A zM>+PV_>%7A+c$dhgQ6f{nHJFkY$<`iZ zRM_iQZ&Fk@gLH))<)eE&y4&00%J8PEdYCoJ+Ub|1f9b&Rhn}7bid}(pPzaC{ZxKfW zWbFZs`Wo`e)2iZ|Qd3VT#zaoGeP$7`)aLZ#LS}qzpU7VSuhlRD2Oh~$8;z)j1Nd;dWFESadToU z*AY+fkq$PxGotA`c^_ko2{cHAoR_~k{5T1{7PF)db0D6nX~-^r<1LIr9*@xec%ZPYC6@6c0$>$rH{eJ*qCzUFnj3$~Ct@3A|iHj;-Tlt0%nt@+Zzdx0-3l zKx+e|5p}_NS!*Q#HCCfYt|^~oc{g(6^29fU3Ot?m3*KTzv%wxlWR=J&#$lX2G;~kT zg={b}%Ic&vD~uiDIl)PK_&+Ui z9CxJ-S=a`tgQ-?O&&r0cP`Hfii4v@U2s*C|=m)NV;JqV)20`{T7$V07M>rYM>5B2G zGa~ROgizNNeXlSg2w_IcT~J&YX>Ye!R*8MwA~I;Pl@4jvcN^XD_Bv_(LkROAM&a=E z96i=ayhN|H|4bB459x#4;>NasOcIV*kuF=fYWFVZ^WYb(UnaqOibu)qI>>3WcJM!1 zf+{s}llOME2pt*HNrc=onU@Wj;QFPjv7FSzV7o(VZ@Op!^zO#Td~s1;Lfz@dM6(yi zt_c>9%4%w4Ry{-yrtna|tSxgYY94af?6XXJNk@4XbMR3-#iJ=6>fZA$^Dh5+S3%%bHjdI2EL{$yK&DuLo#`9Td)& zQB(1JU>Fg;D_Jp<*ahQ0M9*R>##Ib)P`(<9tekUwPzL**JpZUV*wYvrK|dOetxVe-zRe6>v|{=;*!eD#6ls*@g;n7^#{mjlw zD9G#YO{U^k~YJa zc^>kf8ure+t?MJ-{ z0qz6GGsf*KHIp9sr2S2x(NS*Z(4*QJD6@q61R5Z4=R6K)Lpd~NP)0y@LJTn`5S@df zV8T6W0NcXxJJ5MN@a@CA6!3L<5c8s$$s($EwV50z$)waGvMqu;_3vwE+% zmRV*vvQn;Gu+Sd~WVGVbYgX~S%pmkg;f9U`MFLC6gS;f~A=>BZeOMZbFN4miFGVBg zXIt`_ZURdlj;d^?+@LI{AS564`=d*V5wFOkbi!z^wTHkY#%3kGI{s z`l&VKhRUtBo#><5P3fb4y(mZ{VNPfMjpZeE}Mx5-# zyZxzx>re;~*bG?V4J_7=!9dKH)`j2=>L~@)t5}0g9tf!U^3837)bBS(sWjyX!iOo7 z4mBR3&AtyH4G~R;wzg>qots?QCn?Y9hstxu)#w)ZGr$M$OwH}`j@obnwyyA#I7?IJ za|7hdk&@3C-D?1MfDxUrbRzp5O+Ld{4D}|GRnsnaEkS<1sD>*sjnk{th?xD6Qes>`|u_zV2!XaFBMVUUv1=kT?qaeTShnliph zJzV(&nF5)AJ`Fu3A(U9$BrHv;sHmL_P5=RT07_U}_It39+D=0bdgD*3cp zqAq^oO>JA`oWW2;ZA+~*n<8nM6)`47>H`UdDAZ^jte88>9)w*&P{dlQ?t%=}(gQ@) z`F^&C>3UsoSoGRoXeoWNl`rJc1TIE3c!|@e4>@A2aOb`CW`qz{6N#9HY9WsUxT7kS z+ok5~wS4R9Gx-$#x)!1K^zK_*>fpE}73XQEn&T}1DfktE1zaI zPnY!`H&r@SD%`Bper*ChY=v=iZo4@lX>kqWdX60+Z_gEelA$3Qynq6MdNr;(W!r1xEKcRxfd@(NC+mi}rwy5tF zOv97|4N^jmQ*Vnw-wXPsz1Oq6FC^CFX6Ix4BQr>M0Fe;l8xSMev7U)Ez#q~!L-~em zGwmUf2l6AL6tqOn2#&oUL9~4V55Qe^*zi;n<7-h>i$aEPQkJ?!1k}GyiJf#WhjgWtFBE2)7X`H@kAvCPa zTJ?C&yh0q~EPOvqwj+~)a(wJQVq3KgD>Wo@Oau6x-9blwBk>-Faa>0>v8Q+-5;$x zsl&a7@bnTgs}hWBTpMKlE48>asmKDO>yTVHW)#jPR{pTx_Z{g(r{4j_5&~7LeS@9! z`QfyWsKw68%I)F(bnhbz`GO<`iN0f3r#;28tUa-m7e8p}0mvf&RyN2Q<_@B_(Qgz^ zyHM?)uo`xPe3W+=g@dv>2hA)A!-{x$KRW!pKb-#Q@%FjzEw~WPLD%+HO4L6*H3w$P z?ehM3KYW}%>Rdcf+~LxF->Z+pN?~#h89CcP|1e<2WsU*tyayPU90eQtC4o!h`18bA z!zoI9+_Uj9CCB`B$zITZhn?uzAggGfKk;c39kF@?D1sB=LA1itq2%tU7)?bJ35JW*~w zT^!SD<+bK$3$`*tTn>UxA9>fmF!baSvk|Cc-E*li=E$d#+4fap@Rq%gT9Z)rSJdz% zfCUe|WY^IKC*dTLS`lBwFCiHb5!V(gAVM-b$i{mA{p2m9fv;Rji4xm)4l+d5;1VJbKC z_C;=Y(zf$~yr0|{;MdU2FQEDUoz%sY7{Kaz;jU0u6C1kEk^G~D4SYgt{Jt5C-9>5|A}s|$A$NX=2s zs$*PUO#L>&3wr$!o1Yw8K$X2d|5F;469vFBBY%SCGXE6qY@^lP*Y775t7Fv{q&Dpy zX7&sXu~xjOr3k2qBmPc5@{98k3C;9%uRb%qhC|sM=Y}Qf@aq}YbnNA(&ImLue5o!O z#2XyhQWq$Rn;d$l$45&2?&F2_8s?NYEn|{6pxHSj+9;<>{ zl{L4up$gp$lmV&;`-seAW|#`IjT0~`tb1}<%~5S`yIL*_m}i9 z@Eq<}f++ukBKc1J9Q?mH-gqEr^*R5bE`J zmEm#suVCE7Llx!WUgPR$xf&cj z>wcZBJxGf{npj$!#5KkcL}#1!EA9JP`bD$ra$o@jM7?x2IfSaOQv!nF4=mk)zKYc` z%NR=7S_eO615KCv7T|kJagV*`(O>{i?nY}W?|*}(;ZGZdRQNvAN@1cJ^8Sq4I-5%f z4j$&9dgFz7$fwcDA@@}B91Ffj@TYt9ZNdVZB>}$=K%-7QIKH#vRwJ8+e{{34s4_Gw5L`n_v- zvpe|H-PX4HKVnwnW>`*X1@{7pzi$ioO!ush+~-vroZ|PE&Gwb*SQkewc;vIxC@_uI z8#?b6s-R340$e*n$3;nvL~0^yivOJ+h_=Ny=uQCRBaB(Z%JOrcf;_Yj{}QVY`Zx+Y z7uMV_cR#sj|BXQk{I!@6l6I%s@yE!O91*JhD8FlPse*=zQmc6wHFI{=$y?@cn7o*T zC|=?DszFx0ZA;cH(6KGx?kqRZ|RP63g`DOLaTZ)DZ35pFw zUG!gy7zz%=Fry^Z{t)0Pf`WLslw|NHSSl$fViu7jQAqFw-wr$@2K__9Bt;mZhF=FK z$B~e>0kKCpP=^#Y=^{dgK{U785hbnq*Yp62&wnLpR$gn??~RyjI`PTT7@RGVs}32l zdnqjSZq?8Rx4CIz63t|U*(fZT_LG>Xx)$d|d8I_jl_p?wP5_64dl(&DyAR9-QcW<_ zy~~JoMn&pTaoEdB`G_bSBC47!?qhpERjAmB5VAU=W{WqO!C)lE*n^~U{{e#~t-1v^ z9|U3S0hP;T^j}`VSc0-hrS(-Gtq8;ezifkW1> ze|6esIy2oF5nFkteLUSV@9;~jIBQ~JCs#Inowar98}3foHQf8466{27M`d6##ClkM zW79p;Z)_6lfu$nc3AH)gI40U5BsVAjw+QDqd5>4i?hUnPHz=r(BhqVs&6jiAx|G$n z!QZN^=7xNwn&=F!SA@^6W_~VUAc!Ra5Jnv)p41xhrjDvo98dJ@iI^3ZEt_; zQc)51^WCrdlV4sK1^sk@M@QQc=EvPfhWGO-_x`&P{wlUQlMl=>1663GnKriZfgHy( zAd|~%AeWVUm^(3Tmh7EP(rPqTziVrmubY$;?Dmuh=ot8|ew+gfDZ~sG`eHh3`d!_n zdw9bWzU3WZ#@t{&%cU#(`-zGdkd7N!#vq?EIf_(a76;paKge}I%VSz(0k(`tF zo+QAT?G*Rk8t)t@DRj|>H9*-wIh|Rb!In!2Tj-Cl;+3E+<(+G)alGGX5X_(yc&$5! z9)GnN0AHue8AqH^d5wU{88t-yNIv%^oY9b^lf<5YdehIPwq!YT>Plqf*s*xx^zb>h z#61S~UBqEE^Q(V~mr>(LApnrY5tnQt@yP86zsr4MX<^pgSEBrG7FWZttDeD>JXy+7 zw)n)tp;W{wH4JKe$2Cck#nw~YfKG3t?!xjU%^>x5S@&&Fu@_^eh@-pA=7Lu6$G|ZN z+pfY2oqmEQ7tV_7t+^5W`f5;Qk2#SAoddS$oG9)gri4;tCB4nAKu?0sbfC%+j#VLC zhA56P&1mWMZB8LvsA6-I?^3{T@%?*$E$N2zJg-FN7h#Fw{1)G3L9FNazr~sY_K3IQS;gEg+_e+Ua={y&7}NnZiM^QSo<+zr8#|AxSQodH~9t7>ZLL?NQr?KJfbJmM}&g_wV5D2$a)t1LvdZt25Mbvf(}S__<9%7Uat% ztJm0tOYt}%^c_Lsi36`gjmDiPnYSIa660T&URAH#D233LyAkHv9V@#?sS1J zDYTv7$4D?5ZZ}sf$qPld9IZ_Fz$XgBl(tQ^w73GcdqQUh<(clfyTUhQ-gqs@5U#vN zl5tjkB0ivYMYzmUG&zGe(p@Oz{wVjBfT}o39;O83+QouYZDfN4y_AOsX9O{t@b(oB zcui)3Nj%H*RX%z zW3nZrIXxFwr0c7I(Mp9$hu7ONcXB{Q!C>m5{8%OOlQ=Sv&O-X+iQTCeTta}OxDs!F zwCN6EysY4=MqLD@30p=7kV?1s+W~hruslp;Li3X7Fn45G+P(}7jSdr90E?rZ00bA7 z)12u27`>H|=z3bh|11>TuW6O#_WtJ=y56TH479XhPd5A#qmY9Cix^FWp8d6nm+47h z9Xl=uSu@rlDZM_;39=To0$ckpsT(UvM?SI*w6^4||4r)RV}6sm28$r;|B^amrQf8E zcZ{^PTaTcl1me9dLgC>w<3GUQ`3o2xPcd~WA!_HFS$j;0?pXNp>5unV9zo=cA^g@A zSUJEBS(Lm-L2nPD8uM2tLp)*uLV$Mfgx8CXMOb%3W%E!EY}B`mDWqJS*%a7N+j+`t zS;^E6skpx%zJEkkZX@3Pm|dLLz6#&(;{0TB>%6fBUam*^zBhQAlrRhJorh{bBNq~! zEWw;)qdD%%k-;G_C6(~z3{RHEFpuKQGk^>(JfLD@-36Zuqyalq3H{rf7Mb#s&JERp zhlT$PqPM^gP+pLl$%ROxq#J&ogQ`Yu72#4wt0A{cH>K+?P;%eSDP8){Hm1ja`uF3* z_({;QB;qFx{2>z}rzLsHBcmU|K%CHQGcseBQj4EU;^;jK(u+8lzE%C08BR*hn>2K` z3A+95N{1Ih+``PSmAaUCczkmwUhB8N3|7uNKS0Fqa|@#(WGbKU%!LzFECD{2@np zcPhOyYt%cBH*HT>dz{?&NqQr&7;BUu*0Lo+Z8)2mIox| zT3uu+9+%zhr4rOPhPRe{J=kQg*IA9X?JtheCYo)pm#4F9TYcEveC8W!3Oiez^g-R+ z2+$m`G>p&LyE0ol5H&EHUv{&%J(Cx;?6SA9+&mj+bMrTDBRabpFVSTfz9ibZo($V_ zNci_2{kUoE3{*FZ2enR3sjh7u?#&eMqfp}8@{MXyY0y0i8e?UTFW)gvlPDEt4c-%9 zaUs&RT+iC>JFT!5=YJpuey6CL9j8fJSTWM}@ipLOTQyC6 zs}fl(=lL8LJ=sI=9kPZPNEciYSel>LV-ngc=Mz}A*+YWuzhayb4^OUr653i#*6R}5 z`to|iBHF=1`&0ka>=D^)U5FByEpPfe!(%AX>*qVd*{%sq(c+)=o05PFHB7l7>FO1z zR~tddlK|pIrLuDVxSf&9zC7y3i5hXipk8apc0$Y>B#k@@<}7{rh#!~Qx(L2l+uoJY zSL%6&v)<^;g!e0gKNvu*mCbxKvV}WF0tG%K3njOaab$pAt9`ee54~+=5uCL5Mtzkn z!Dfj0p>O6%G@o1DbW?O5@4gM=!b_G_2$=2smvjVipV2y&?k3UjAk3&U1w zPBn$|Ohih2)kCHwV6}8b{Nt&=>~h0#v;LQFe+Te7G84=s2*Awy9N@8H_o@^bh{`m}Ruuj^v!Rveu58RpmFu9jmq5=IfQ^FUq6|^WT{>s@LJ*wNHH$ z^j17|&6qYkbrfcVI<=aqRvg@1yN))*7%iT2nHMHkkT>2$zdvLLU9;<&^AqknGhRkI zC*3d+PuVZ9u=Q?-UA0y)C$OzEUisP=U3S?oZ=PJcU9~ittXExhu8vjvzh@N^-8ErR zz20E`I-J3O4)^t9n*6hE{q=(NvXi^!YrjtyNOs*md#}sfJ4LqlI|jAbGX)^T>F3V< z`tG|&9~1EtRrlM=ZRW%L`^d|uF7}gk^sR8(Atx7;>V(5DqProgp*-f%#PP{vfWVB* z4&^jt%LFG77vS$d1&H@t)TD%PU?PB9*f(oA4shs|MWf6JsUIftgkHc0ekXc$bT9TV z6waURcu-WP&D7aRMYR{`9k{{8)T$BmSvRuntXoI2#`GJ8bQB!J;(1tfuf1tQ*ZP(A z)l5*P2Sd8dd7iLdgbf8@ECOZ%rB>64m(5oj>MJj}B4bBo7tO1OS}?AR22_&b96yRv z1q6PRpiTsEd$#dCC+9P9QW5Zz6Am{=G0+01jjor*(?tyHV?gzM18*|#V$dXWLKox4 z%DxRf2HEPt9|iVLA{z>%Wvh3s2hNpj4nfV8AEA*dm#-DeCYP_$n!}lzT&#z-9gGdT z#abK+=xRN#9r245Uq;`nDiS0c`8}XjuOM)V7c-eEPbz* zYkz|!u92=QhPg`O^sr_c3n#=lly9G{u z>~6GLH%6M7e`Ylw;Hc$tTb2@VF7}CQILjk9YO);T4o-(8ROG~XHJgMtv=c<)$VnVj z&Z|69JeoWb`$s}R`2F1!l7cn2IM5)i^$!~ABW?!4K-_XVmCOQDOimNg(&>=irO$5@ zyP)|$kl|S%870d6d`ot@EJ^5L;>OrJiLCJ<%;Asdyq6$zU$Sc9Z=p%Fr1z`<;%vQG z8}Uen)2EaOul^+Fh4POqx`oy;vZ_NtL?B429zmaPinZqt5P10iL2cLqYwqY@j8)CF zCO9~c({B)5E`JCi=?#s3S-D2Zd58%5D@mD+TW@`x)hI~Pb3g5~>LRR*HcpdUAv*<& zA^z$T6)B(7BAbMKm?#QfyTmu&R|pFT2#+#>{D8`cCx2GwhjzX!NT>_zs_CecIbj&l zmShaE50@h1zf0Mt!7hSGLEEjSO5JwJ`>rZs1u+$5Kif^|1d0MSB45Uy0=Pn<9W=-1 zkl2s%gTwe|)qIp0p(H@wa=j01UiuDwO^j>79-B4rz+cVqm@zA_JinKW zlca^3b4}97=)a}^5 z46<;1P859`2IVyyHW@*1w2#)5dN<*~TjYE`v~MyINQET*O=~>_h@(qg0U3H{-2Vb` z*QAM+*V3IiR~`^~G-uCK7Qbs0ha0GWm6DtqLJienOGYqGtL)$J6omtyyGB;eu6Go! zAwfXj^|+>BL(U9esSUenn6ch6snuHt64Ji_`xlc{y3&+S)ei|BjHdimMbjn_S?(|J z&`m@6(s}G4%m^FgOXwCDXafCc69nupw%rt;GLE~srw54fB=?6%L=&fe=qrbEw#MIq zq>UNk2&%SjxkiXtvOWd9@xV-Gp=n(I`hMVin)28w6~sk5O|F_V4^v}}5SWNzR`iM5 zz?z5MVMS{fq|@R>g7m_7=v2!2v-6KE3b$UUQ%^OX>sGM}O6-1TB9JH$g!VPE zfZ$@-0_Npg0>#}=v{HlM{u%=$H%5IL38MSLzJYQb!L9unOu#6Dd%>F}|E`3MW{Sve z1VFY21UDy*V8yfn9FW}qZw!#!vxyMg{~u51*cfNjt>M_VZL6_u+je6%*2Kxgw%M?; z-Iz_%G*)A)!I`}8Ip@ps17`MKxbAzeHH#Ed;SZ7MC*TRrch#2LLzyVdJ(T|y+V3c9 zvlet9^4*X+i}s&EpFTa^L97Y$ zM#e1K=j(gT67N5ZyjZl{k+f z&7=BM{=RtM6eSg)-|ddsYl_AsajY@PsC$J^iOI^$Y2>%q)RtJ0Fs*Vj={P*Vat^gP z)$*~eiYrs;W+W$~7@4A@lW~3*g(71{DA;7u0irRcbs%Zv?HASgF{Pq^9~2cGYr?@( z&brO1awss506BaeR3v=!B_({FZ0XA8R97!}t%@ZtXEvS0V+2vw4E=hs!&8sGowD!* zub?=hkW+K;jPtp=(bYo;0GhLoDGGc6i2q z+(4ozT_ehK!FNzRFc(g{pRP-I0b^4_Sh;;gOHe+Fz2@7x38!G%CB9z0nXapH*@HGK z^3sfPMsri_JP*sqA`G>rgnw}$*{8X1%R9E5kd%qRue%faI&qAVg(f!K^z=loE(7HO z@gPW)D+f)T0-s#-vs_VJp1M_ZF1!Mp3ZaGyAPd)>()V&aiH5fJyCO=6@6QgNdo$j6&S_TX0DyWgU7V3-;a*D&%hz8jv@f(kGWWUz)a z`8}v6L1o77DzTK7l*7SXBbLRQz5rxVJP2BPvA)Y?dW2G4NYQR*Jk=h z0yr2aB%j~dB71h%ZB~W&$W1dCN`6~gI5ZiHB>)1=q~N|BOp{oh%46n)yI!#Y)8U++ z=1k!yn_{uJ{Qw*Noak9e(@$-TUI)$=T)95Qn*Jbj8~pPW1JnTSjX#8gb1!HBOIujc z_-c5G*;ovKraTrclGSiPx+I=_Y>(OifNi*pGn`xkF9wuL%;-S5L>})aLg`@<%HLFY zIpJA%)yU72Q2Kcih`%LC5`QzRl$b0;NfLtdku4^5=5v=N0XSCotRfuFA@*ct5Q;j$ za7Xe{sl=CIMlM0uhx1^uBOWuuD{^LXQ`|49au@$Xqdz9d=p$+aSl=1 z>??4j7y}V3@5R3o6I^+r3i23K7HpSOnQh(l@V{NPEH+tFNdjP|49X;3rv&yA4wBg} zTe?Oy8wR>NJYa6QGrhS?kl8Mm%F8sT1n?opA$?Ch;0ONV@{wImsVg*ADsHYzY|6+1 zACp45Gr)ag+lrleHklK}xMvf7KwJthF54tKs?4#s3zL3=YE$e zS4C+JwmT(K5Dz=muU2qpsv%!}spa_-zC-Qu(5!(}iRxucMC1W0!2Bu``R2;I8g02K zRYqpFdQLa!hDDfGELCx+pk0KPq7_GHh~+}7Dsa`d@VyDY0jmGwfzc67spz=CpImsC zA#=ALsCyrJDt=dGKJ*O^H)43Ak}4ba1p{x#KtT7NZ2oNsg4tP>ZnLi@ z7Z~kOV_Sq{m7HQt4h~q=F5MWS_}q-{qdeMq4%j3qO>rg6*b~ zZ&Q!}W5xLE8YQSY1J99=h*3@eMtH2u%87{M=WXM3+QLs3k?E-v=pP+Ndm<;UuMiW2 zti z&FckazMqgGGQ@Vna@jLEvmYUX|AS6cHJh>V<3EaNx)P2SQQbNeXGP#W3T82)4j@7@ad z*%OoKa=-o+)HmrKv2-lT*7JU_DYVmD{i*wwb!tZHXl^2q5)k{nc(|h>P!htfj77~L z@vt3X=c?~Vz|>TeW2jvhrq9VAU5m%V(U9*pvQyshWu)CAgq^6CZ{mAk)J}AMRaVeJ zut72B1$1dq`T{pOYOs|(UM!It5!~6%5vz+J zXyG(>59?@sDJK3XUTlI9=qtR3AJ^4b)1CN`f)>0C0TVxvr8aMHzX&J_XD!{IHIYdf zS#2~;%M4EsPlh)m>O?K@llVm{Jhd^qJ?@kGBP8dabf%>6jqv^Y<$O|p*{1W(U|I9pk4^a@EW_;SLk8f51huLitZ?$k6X32Tee zrDBlGqa_!B;xR)yVqv3(ves4W6ri~+zcaBhB41GI) zzdr5C|3qJ5%Ey5xzM28Q#B3gAYSK#V0n88Q?>!xNH#Q}EE*m#}BqI|xamIO!XBC$!5&yw{vqSUu^}yA@Y?LrEefo(IuIo#f`a zMT7$gbY@gFv68Xl_;_3(vLTA?~;5O_0-QZxw;8jDA(AIcf_39XBevJ|Q{ zt4?Kr0x(q3zQ z)6N)&J9c;!hT0T{P(Psh>&+<)k3^sElk(vzG>h5LSs2SZh$sy04YLrqC3#u$$OrK$ z47s*WqFw$fDX38x!YqiQaO7$yiUMkt2{;VBs>*aVKwaJhXv74E;cwuMJk8LXmoLXP z&fX)ZWnEh?EbV7;ziu!P=5UJKwE?!i)+Z*&8)%%W9I_XoGaZPDm4o;2yR&%J9pExSCR>IHp7BSpuS50Rx>aBB3EhBR4KY|BB@tf z4NZJYY_jxc#S?D{1(q&JAcr^z>Ylj<%Q#EXB?zKH6^|VisN%`sDh^w_xsvi=2%k#u zLg@wFnlil4?)jM_kE&O8>`F@hFcyqG?7ZEH&qR_Wz!Bj2Bb0Sv{63Um9m5w%sR*Z;V4Y4fHT6zVrB<6>O_6*t9WRsML#6HG#2(2 zWzzh@CZ`_IRh<}Xq|f+TRIYyfJEhMqX}HhzPY%rdY-e+T!z1>~aEiq)+Wii8Y*g6U z4oXnQZshyO!7j|&^%TZ$g6Oe_Ofa|N;mcx*i5%5%@>skkSuW5LLu^7t9J!Z=$-+ds z8U|#fufucF$+1J?rB^gQ&l6zB&Id~VAz{FXXSDtK6-T=jvx6aqtDvSUyHLRzr-m3x zq-d5dGcu`&rO*&fOPG3wbycG<hx;4ooVQ?1{j`< z%p~&AgeN!|p!JeSo{ZVwVV3GZ^%a~aqmXW1WM`QMIhCHLn`+ztH$Hz(Xw=#|0iCT- zCo2x#hyG$)76!_Hl4VG9%>L9BI(go68##fUpP9&+im)B7c6U{^2$4!{$hCgS88wueX}$;? zksz~j=^RUCjw^FphGEu$`y)yf{9w{@DpDdVxgsk>2fa1pT&)Et**(i3yFiv>BKtYt z;4_^J?S8{pSGPv zq(t18_GF;$P_sXB45`F&&@x-6>`03QB+C=WF=&4cp_+K$60f$1)$Ja4RG*fgh-rmD z)cYQ#`Le=BB_Y9~Syl~+?K~t0aP7jwze^HQ8sdzzts*1F%iocI0yz&H+LhGETerFC zVazZ>9qIV9==nKnA%ex1vGSbMViM$|cd_!~GABWH3p-ag1$FC|!*E)XeS;^P0tj3GLHoNPRte0(SpJs5Zyh9MVM`Mup*+N@EaX-tYK5^EWTF@oaj z+&4ZKvG~3SBCJEk!H4qun}W)kAfb1c_xEHE?gEZ~U$mz24Je8 zgus6vu}I1fp_*b;Z^I6sXs43(W6>+4$sR*+Ywaah?U6<+<;7E=nXKEh)F9;KqB?tY zw4*RU_CZ77D90?3MHKXBX00-n3BWw`N6F@G`dlIQ;>ntpVLG27jkS=l^psifX0Kkn zp>2mMUr^MNZ5jvVq2gNduA1(;=Kfec!uZ$as_IG zot`Qw4a{gt5sGAsV(b;+Nifg_zew$vp$E_nj(I~#p0|UEb%;6c*Wd6@?@K|UPO3_w zdNFSS*&fVw@)MLD&)+K3A=>Q)eBqECOv&5jU=`5()zn$qr~#9kIRuaFaHwEo6n(Kz z;Psgo?Vuy&T0$ix7vz3vLptw3uecr#oKPP)I?Z@E)3EmHMS7CV1RVuqGA=DI3m@rl^L4^g-N?BilZ zLb6Rs4=RQo==hMm@&?U>vO?MQtoiG{C~0wNV<%vQ5s3sP;A685E3<+srUadV3pP)P z5o{_%I6{fb`ef%c1bqi@QbJs}=B2+&v^#9!M7Q`SbwxrsYl+COmvb`lyOok(T=%nk zyi#7xL)vZtsj@_00VL+fIu zcphaHT`+}ox<5bOGTWSvLnbQK+ZYV2_?EZbxk1{}zVkPEZfW~7 z2od8YsUA1)iECUR9>NpFaMp{OWzcboLIDi$!hvH8CfjiQJIHt1gbiNZJVvw>RAJ0Ob$iQO)V>+o);e zaEPcx&~XZ)FH3g^c5wS3G;>^|q|>k(d^5ZQL~haD?qF=l635Wv8kGBMM5QK~G*wKE zfn|nfNs%zRu{w&eHOC?qtH`cGr@GFN{O(>)_@BWGw;dW~M!YixGt2|B?NU2!i9Yr_ zLal0kpeA=lpu|Jbdt1jZtG_*^!L`T%wv1uTcsJtM`_R4)_}p4GG^~P*^2Vy5KdBq& zy5%dkAJO9X0b%8dZA4E8$0Aw8e` zVLcxwUc>`89A%vMjV_ye5U_8{?IueU<(|xUhW6d**j)I$tYCm{AfOwp;B_-K$Gbxg z5nZlq4r}J+GS}d!=6+%Q&8NZJ<6fp~`OQ7}{kO_L_ea=4Bv}=oC|ivFG{CJXFY13j zakqtSScEblw4@)rCTi19$R)coiE#{p0#7+t_|R)b+_L)5b~I%Y53^rs)CEV{Ca_qP zBHj-(D^~0+r%p8khgDH6c_VHDDOPhMxM7On7+g*t%NoYeZPi1~P1G%gvpE^4t^^;| z;?J!OhH6Ed{vCgA@Tw$8JbCs4E`V2YY%}hycFRW=odz$%2$2)ksXWc2*L3#<#;s8pnOQ* zS*-ps*n}WL9MHesh+7e;LX7MUXofKKxnIl|;5p9+ zOCrQYMV@!lpONZr{aNe%vRc%Yas1a|Uz^_o3>ngJO~DUk^UCblDoS%f3|^QAsFX>(LFW%q=dLdEbR^xVgA4z}>UeZru3a!|i!^s|fJ%Xzh{27WMkSQ+_ix;uM=bWc zf0^BY^P$J2iPD?q{2y0r2hxP7$#S0Rpm}BJu^ZoY4C$Ux-(n|6rsMy8Nd$VO7+RW% z)**wnLVU!mI<`xMF!4ZNLoeI+@+;QRm_~!2fO^gb2h4t!PDRaVAFDXTzPrq;f$Hoc zb+deRw06bYx#4h?x&eEOLD+hW^bjp=%O{9w&3kH`qRYIZqU7(fbnTK<BAIG?#p6q9AhI;{<0Y!+<{lfEc6D(l+8~0>NDRCEVYY`73=888{MhC}X6bDo z?at5mkbFZ1xLsd)vyFNhIs!vzYQEG5fErD4wX77<*iSMiR7-XdM7#OHynl(8>Q54LpN}&TQO^4KX z7Vy(!%&I<1p0Z?6$up_0M(*z0PTzSF$&_3|w2}H5NsARXJKZ%pVc|DYFG6<8Qzw;N zFN56cStlNLycRVm!V(X$Mu}Pna%5Bn)@!DHOTk-Gg1-Kx=fvA|!YcuvhL2T77_578 zJ4%3KlKKX;kk(}x_ITpD?^UehytLdxpl0zO8_Nwp%MANlj+6jkh}MA>OrNV<*#vj#@mx$5w259V z-G~Yj=<<~EsIlWUZdM%h(fXR1?ij8tpJ*6ZY}CfP>c;N&7IBV2|g|M6m2- zk+2R?*uskh5i8+XM4iT`w*V)W#4%I86iTWz3L?ZElr%V!hEZqQ@bbfhTd7(6ZiWeD z(7A)qlP!#ozb4l%qBg(@h_uLiN_f(S+Om@;<3NuVxv?&>iYJ|~K1v`U{a(3Bvy`?1 zhm5rF!T%#JpGJd12Iio{i?=+E6Q|fU*h{T=>gp^I@5MnI5;dOh{A)DcV$frUxk!Hubcto6Q2{&EX!DIX2JB>_$Axj)n+o_ zJ5l-oy6HdB1Ix08DE>#>zO<1Tv*ms9O}f&WXvWu7&0o<<6e9-IRr^@eLxuc~-3**Z z6|tpOkx|zg!XT6|r)wxh|28Z+w}rTvHj+uD=md8uJvS?1BL#$B zxR?Xsa{OA3HYsfE0M&)(V#&N4)4uVK>9R-L)72vHaE5&%AC^citHOiE#4j6WM-`6# z4`5%yrIqyS3jYl!AJbs{CQx8X%QbMTMZKI+GvALawiHu3F4u2QqaeYO=zD*nB=QS- z??6>%dpCtls@72Ex%vZmG&ijoJ@~QhxN1cy08!iiCU{(287tTIW8@|I+A|H(<^kT~~}gZfzBQ^g6#UJym`D+D5uhj2|$4wPagO zd{?>sJr;xnqZ8EeZNc#sTI31-?X~LK_3|Gha9$?xI`PT(w!#RdljIC)L9P~DmUk6g zQb6^7Zy>Eu6c`q|x6gDpoV7V~Nl@&ibSiUNh@D@Avz0uw($z(A(HnVfB6CrvigSUD=r>u{rtP3!9~P z#O+e2s1#FJQ=tyB)pn>wcJT``GbNX?2D^5&n;t!-BmC)-?rCXxNNKz=#xSEAJvwe@ zIO!AoO3HL_yX8;#B!+Ogak=OW6Sj0Y0zeE_Cl#DZ=pif)fq(Eop70!XMy3XMpXxh1 zeY~yMtHHRY6B(uzUdj_dLx$6gzpRH?R@RvXVx7!M`RfEUfT(!EF<_irs)dTC?%!EM zA zm>s2X+Y$n4#R#!cb-GYteTtCcnb+vn=v8tKnqv=p>q0q6TkYJO6f}Cu_E+f)3EVgF z1}54~-QfC(#Q+=bTk9*7Ec}}&9u9MTKS8hPu!%V2$=jL6q_L85x3FaLU(wypF`Cht zIHr4s8It(963grB;@YC2a3?alXaP&gXoFVbPL6zmKHCXCKiZ8`_@y0hb}W^Qd19EX>g9}1i9InMQInWH!zye_0y?AN90HIYN~6&j3Eqzlt>LS{)BN!0+%tw z!k1TE#CK0Ec*+0%X1MZ3rlevRW)uGbK&QCe8$$6~jsq&INk@U;QyefZ=T*TxycAj= zl=|U7sb4zEEc`R|qkpFUZ(;ESaFatY^UEUpUp?F!#6JJa7|?$?3-gzzQLGbytjZ#Et z-=pkfGwk|`AsM>VM=H8Bm8OU^{+9xnUu*_sNtGC`W|G5pSie^tx&LC)<8!FH)52oy ze7A~Wtbt%b#*a7GMBl$>nj;fEun@(~Na(dpf;`p0KyIyR2Mj>mp#6YS7I~E3l$3>- zZ~tk%;({4{v@-nVlr>*OhtpAf+53^teERQ_$o=-M^f-G#Q90?Ziy4<~X5v&_2}Xov zi@}OUOuBAJO+$D|-P*L&laJ5=A_B;2(% z9drF`x`z0maFQ72eUkd>_Qot?x*mD#?R6M0W6a$W_pXAhZ)Qs>>D;EuU zJTJ~X<{MsIFVd*-ofhw*ENE#HlF*QPJ6+`l9kLV&$AO!w2SKW|Xi{}Sen7Fa0e96G z`qb`}2D@f8WuN@;AKhB+Dz6IO7igUmaN2039};*}lppb&eYb`1{=5!K$=3K1VsUY=Li@D0Oloh3d+aF_ycFj>Z8VRZ&$7k6;*;q|D8g!@p zljG_#qCRiA_-y8eayyd)z`Fj0X3?plQ4k#y2oO{T-m{zKLRCZu>BTrp z@v5lOH87?+nQ}2I)!Q*(DAFYu`tA-#6u-l! ziW?SN8GF2pPsf@`z7!1H7Gc>k*1Zy9oWqzK6R1v-fcgR>fXv24`c_i_th0N)dz10I zeBA5#=zMv&Hob&<`^V}xr1S6N1?uhoPapDJ5b{&STIUO3;T?Km)sJV)@B8<5k(_DT z=>e2nL=6k z;?UY%ghFE14$gD0UUNG(8SBZ%rF9lrT#f8v$0w>|0u{5A3kf4|9Avh;Qz=!He?x8I#vUhH7EawAUQ)Ucyq zr~2LXycVy&lhI<(SR2)EWiqBse!oCF9Q@^{<1_fH$7;ZKH^$wY=%uOrR>Z8yohQ1_}F+m3shU zUv~~KIv2NODT&w>{Px&&Q=gyRd8>h~j}aqt16l6u<8Y`d*7`7w@QAewLAooC%r+Yf z@*eweoac&TKomZL;q)AVwv0m*(+qyYiad+bj(^HR6z+kRL(g~Bs%-pX&wvx|;}e2L zDGw#irFvmA10+AmywL`kre>M__@LFB`fMRL-Bh8^wCzVl$?m z=?&$)=0*`M2)8Eb_XArp+2&iS=Q_+>JVkN6ApSnpwP4uv=&nskbYly@?nj42+q^su^c5D zCrbjH;ELu7%l4EqU+2P#!4ls;Q&SHg@7SitzC1U8!)5!gZL5W-i)?S>`Aktix6F3F zGdF(CB-K=m*I?X#v5R+g^kYc#I=NW==wb=J{@}Q|k1Pg)$7)G4a`nc`#PyfOFdIv9 zL`x%DJ-5F{3|7yL*g!xm{W2RNcjy`#Z?R?afaQWoOeA#aP`cL4zT{(!t?nG;E6!<3$o_+6M+EePb(BE zQ%YZ6D1IgJmJdA?l>b*M_@HJ}c%f#IBMU82z)|L6d&y?Xc{bBiVE5<8tXFUA$WR4; z<#>I{&09d&g%sGQ=!}9d{R(>UMxqU*>Rbr#f52eT5~F_tpWT9WkM(8Ame{q9q0%8; z0@NhnrxPPCK}_~aI$7|WxgKL$H?CzQR=n(DBv(9A{A75^4o!?=J08tx8k5-zfQz8? zw@K8@lfUO8hP!mAB-9%qqTyFA6gl>JN+G}1CRy?=3cBsvsJT4rYD0hA@%J?}X^hyG zImd&aaB5Pds&oNlCsniwpc z?F;10&EzZsdt7+c12C${>1dK-E?(&{j(Fb&_#Lc|p#jD~Ln0iC!RVh6RhqS(P%|Mr zqNR(2g)gpl$RtL>B+SkvgFp0^eeQ0HeOf@7!N+4XZ-jbh-p<>*$}~*I{Vx*9*Q;aO zUV`m;&<*VHX>s}`go;+DK^`7ga0FJ&`MO{1i~NcW)2 zjI0>56%)qRfh$=Kv0~J&XTeRrIQgSI_MZcn`#cg7wkhuHo;p-$*y$#htPu$M+w87c z90!MB*y5kHRCk2$#q+>Sa$LZc*RQD?6&1-oHvZ{Y?{n#WwO7GWZqDMp+W{n3C3-}l zyT(dKevPL|5Q5GrvS)?&8Lm9LK<&b^*k4qrmtm5i%G}1X`N530GEN!7+r6~ZBo=wX zCw?#C+>loK{bHiLSkr1;=_T_Qv5*iU&xGCA{^GL7vAMP5*6NW7fp&%cGtHDz(po!S z;&ZqK-klL-!?t1WRDy?$I8|{CP6w?FQ%v%i+i_*_Ap~Z1j3PDTIXAYjq!Z~DYtz&k~?Qp=T%$*9=4Ud z6vzyH#H;s*Zm3wcSz-q|kw1srEJdH5UhvR1gRfx1b-v~d0?d}lUJ=VsGr+@j=+%hA zXWJ_}snCSad%3Y4MSWQEz;}@0NI^zHG+~hA1UGyZ0%afk(9=Ew?Io6|-~ZEbq66yV zL!L{hOy9@BZmA(}1N?T0RStg#@*9%)I(iX*g{BHBZM*)g>E1gfZnOrE9T#@2m_>qF zqN-l~eK3^s38`4=@1B2#rT@akP7E1lM&#z{p>O6n+B^?V90}s?ffn0L{ZTv_hzdSo z4;S)2(jvm3@=_w*=|Kbb*Vocm*GE#N+h7L<0)z5cM-!4O#rS=Z;4IwkubpneAAXo_#H>I_LH4d2>}Jm*?s!`U^|51;heb9b?DHp z9M}kp^JQzH z1+evJ=fbNy)poXf1QI%2t2!vGNZd+wkgx`uu!ZbJ@Z?|rvDlXLJk&O^8u;`u5@~WV zY!`@X<65vAL=c~N)%P@EvR%M>HH-GX*7YqE_532pZ`twPpyb-Kv+dVwbpEZ-sz9-w zOY$M+D}nLg^%m`xa52~M*mBAtk1X4J$)A(==#=tj-{3%Qk&8B$*52-yzoe`mH{aVk zKm2b*9_ruEOKx1<8zcxr?_uGMn4pPp`5l07EWR-AM}lF-L2PSKJ&&R|nZ%dK=sZ zm>(J&pZEeU1%prk+UokgqWa+qRbu$4W&$Z9?LT?Yl$nV*w?24Rciaqsehu!_Kfp+E z>A%C6K5jZlGZO!-x`el-LAR2p=oc0Tt1i6j!`c>Gx4(*os(>=zcv` z-eex{zKT{jxuFR1kP4Ez)l##|5C!dAzZKSDO9*Bm6z1dAR$x1)0fS7vJS+RuRiC#5 zRZ(A#sG(P=wZVV*HI1;ld`S1d4HO4{x&!wjVY!_VLhC}C)$ya^jL@|2;Ip4z7MogE zN`9=i?XZAQ><09Zkt`h|BD$KjuauDtOc-BXy|RVs^Hin3B_TF98l&`qAFTW=qY%S) zkaLltz%$X4uhRb{z=>hC@Wzlo>?fh7aJKV(rT@1@bruHFM8W;w!`2um4$FWA(c3jp z7pn~FVj~ZK%gy=!7QMBSxJ`T?1~ss<#w6a3POWVa$O&mO{H3QpBiY4ik>j%Bj(KyMupRI)S&r#q#3|vnYtuDrmzaM1yve zNBGRS!eS)sop6NNHUVMuPEh5tFFkZu(&4ozxz+II7HB+a)-bM|Q3m3Ay0TcV2E#58 zF6r46UzhW-X-*sY=!vk+!6xd!sScE=R)wnwfR4D(R3I@9mWuO&jTs)O*fl8wO(>eI zU;`!xDJu;Ucs-D`MJv2~^os@td;|xAF z5#<>@hh?H(y_ZPqJxkE$$=kaRHJTN?m2zPk;tm$UZFj3Ro!|agphQ z)@@}A9{a{l!RvEZIp5qT^Zgr1!;(N^clsqbceI(@(xUBtA)xQ!&|8yzZV-PlB~R7K zf*m^c?1d+GD=5f6+V8hL9CC0v*)_P17Q`!bw(3;82)2CwF$!P-W-Kz}867Rwh!zP3 z-gad-4CgQ3UtYRjl1d#HQm!Wr4ERa*P9A5|ME)&LZ)r9 zY8DRHR*ic@wo|n&WMuAh2h4&oKaR;dt*Hgpw$NPlVY zFt`zRlkLV4H!Nc&kj#pzN=QV zFu+YPQGOS<3D91ZhkfnPP`sjjVlC*v6`WHp-Bx+dFfC^Y?Vixd{2?iN$WhyRe`P&- z_k(7d)`8kzc+Kf;_-0{s_EVi2Sk2m?vY>gU9kzpNivL`g4cn2;fhBLC7TKB@R2EF} zf0hN!E0;4zA$6Ye;b0)@<(LO*_sT!pz17YfC_wsmIzq@Hg2bjMZ&Cl?LjRm zye(2ab@*Ool`U5Il*e*$uicuTve>Dz;i^4 zULcF*TYRIXqwUU4n>B71JgBtSs~($A)(LdX8SFTJp z=<3A-DSn>Z^I2$ zU~w$L=HDN&&5A(-_TDs<^CQdy#eW`ofP3)!vyQi5cUiG8Um~wg>Epi56f<5zf7)^% zjO|MFBnsK^SrQT|v^42gaAY>t7D;_e;p_>~TSBPmUpRT(Em#pp8e$l}4Zff_6SFxT zGHvsJaVF=I+U!;+Y&s)!x(g)u1o@nRC(Nk6R5>T4F^-bu*!0x(ANze9`s4~QwUp99 zqj}U7%U)SFn>@=A>V;%FE1*)u=7tb06y<-$` zKN6EiQ0G>ZPmq6+n#*$0v~U`3Ve%UO*h|xuT@>es)<@eB6#uF>)au2e_3V zy~M06KMos6VzvB7VlpE{${hF*r@i6Koz;NG*4wU#J)7M>Vg}jmFV|?US=Kl7y3InI z5Ve#SYm6b8^X}tTT75i!q&5kH9dN!O_iB^o-vB{L5;tNBO+JNcg&46!XJ@Ehbd_?J z#V-O-D<1R5?mHRY5*U{km)toBYfBqR3bvURjW+h$I{nL)S~+n{JhXWBlOG zT@C0ZZcW<4FLSEO+MZhAZab%=obdJHvL@g6e`Ctm;y$DNR28tiv?KX?pU(ZLBgYTl z>!&mFg?>)`H#%d9DC9^$2-A?VRldi-;lhHCf;3521=DFZt9#LdB-S}+)ncq**`GM@ZN2>0w{Whu8ufvk1X3U zgL|u=-Fu2(`9M#!pWX2rRUPyumu32#7xXn8=_FcW$Ut(YTyk;=fgXsMBXV zTNqvFpdI#fnwO%Wh^;rF=we}vyr>l!{uM|ixjuo@9h&T<8bm%pIVS+DwT1v{PINjpM?1)5bg{yA8-g+^C<-u6JLcOkht(w} zbTRA7PE{CjQ1YJbW1`=$G)yGzKM=>`NvDEsRXz|z!~!wfBjhSm-zFNCe=!2QM$QTt zcL&YMz2o#4Vcx0v0<&mYZ>WJU4u9Y)L(5Jrb0Z{%GwSCZLtXrVZ2+=faz(tQl>-04 zdZWxT@9|mr52OMB6$GBBf4`f|k5f@*C#c)o5}Aq>%Wy8qOZag#5`6a}3>$cwFl``x zD>!s2m92H~!AHk`Epl0!YuE)ji^SO+ns_v=LJJ7@8Z{sDYi%tj;<(N=WU%v^**kdU{t z${cIa)*{v|--P!ft}l_jnvQ;=uDn8>RJanlMCB-fCywb*p%_j>{RqAd%U`-lq2mbP zml0@@-F1O|Y31o^JF=wX-I;kI4I-<#Jt}Zy&4w#9CXCB`{O{e0R;KN$t9Ke>}yHev}fS<~+=;45eCq)LHgM~!q) z&NxUt2>o$;HQ_-JG4*|j$iM0H9cm5e9qR2wKK1oPKEALXy?;}%+~Fo?3=}v{Tdpb% zswnpaXs|%hS=Q#y|4f=7l%TUHT0eemIELDpu(|@5eKtB?<1HmwPW?)w?Ae)oc#tP| zPQkKtGs%B7e-ZL;dmXb7c?ZrI9(}V(+Ein6qgAq+Ku4lpHmOBBcHAY5e$1%ZeoB4u z`h+bgUeYh6Tvaef3IB+7l`;-jlf)#s70WikyK z%LsTK%cR~TiaBU%w_jmFI!6x)zJq&ysAcNd#AXJ{M2dQ1#`33J2 z303JUgADEMYMF)Z3cfAfC@oXO=ShNbG4;ipJ`;a<`BrtmK+r17^}L+l{Cb~oXmQh= zog~8qi=W`b?~&qjdHRXp`J_1ouqYs!_d9i`qkyYXjM$osxd^y6`M)6(Y7q!^+9{qk z_t2R8H}idCQCl4XMz*X4)wBcOomIN`CN@fL8;?cxjhs#0P6(Y(ifQ9bwi=Y654`nZ zA_4;>eu01C=#l)N%B}+_iswr&Sp)p+dP;y>ak+{MV7GX((i$(%|DBqh?cV zEvv+Zwh0ny91{A8`|g9Wb?jOTq{n1jCb7hoZ4-C<&8UD%}u2V}*A zX}YFigKt{FBpi6K$)Up7g-g4iwPK# zb2#0&^itOIOmdMc8W+OVVSXtgY#)I!`B4fmCJ){^;0)eEDklhrvGrDF)2_Zu2-FBb zt~Co(lrMEmWkM;Kta^!S_5*E`c212cUS@Ba-~kGJLMvwCnhmD7ZVY`^1{7&uy=P`q zo8oH1xCYK3Tug1}Ab7DT>0@o){;A$0LY4Vyab;N3$EGI5m5+Gc)aE=ZJz|)BrmaB#?((=~a!B4^!k2U|j#5=>6^9KkT*N>mB!gd_~ z>Z{E!!JgZz1auE|rsoAUp326*|GxMt4ab}giHve>>2>4q`e?U)yG&bKeUYF~V#r#6 zu14p0JH@+HjsHDd(8n!HScpL2%e&tfUiZPPn`z}$k70DVe^0C5AvvwK z?VX)M5lZ|vMBdIOS-P5T#l927>;B6p6I2@Fb z6osN^m6u67AEQ=I(5j(>2CX&?F?j%&lgqMy_waJJxS=g-tS2 zb3#Z2MZTpc#pGmj3F4tt^fWMs(se2=VT@gJkAsivD))!Hk0+EX;yXfD_~z(hOt z0~5HzRPNE%bf5n{?Tq#9i;AFZ@!=f!aZ)pPejk~iRHv}JBde9te`5tyJ@z%~!2m=m{5& zW?;JS{1o#R8#fpIYx}aZ0qaNb-%20OUxg?cJXB0mf*0rz8$`T(myrh%cpuYF#UO@5 z|BNL@mI@jv1&Nb^-ra~QAnW_kU?`jv>7m{LS!A=efTijsJk|suM$T3KEDI)nwrpyw4>M}6OVYQsG zRS>?baN+&jEeC9#^sKyn-GSmDPN6TA=7ajZenP!?dpO04Jt8~?J$t7yRyrSdDHVr$ zMZ}pYwr|fegv~`LSit41)zf7B);`IKR2q)r&HKILK*Rk8PJGGj3IQ4?3fl*niV0-F z&o%HR>)_pSY;-fagLwR#?zeG%(@9#c+&n?cnDF>n!L2=NgvJjDjM1Hpq$L?LxYGjC zziu0zs{b?MGYfQ9Oa4O68PwA#w37W=kw&qH$VR*XL-xY*@Z~`H0gbGG-TB+MM{~QK zzSkaAUSgPlYOlj(qZ802Bk57&{JDwF73?@7^x)IDm>U?(4OPlysz|kkXJG(D&Io3sIdW(aNospf%&8 zt+{}HZ^OmV?3Egtol1f&3wZubYdt+7) z_b^~fY7fEhTHb3>;QFkeJEd16``Jre9-fj0%qU^~~ap ziZ#7ol}AfSm+=cq4oSG34vF^fD!%QPi0+78u9Rp2Z<*fj97`7uT|1-l-LPeBz`uN0 zom&x5b8>mynaZicZ5#QUr)*b5-6284DOXO9S8|WsXIIqcVgN^t`Di=6`nhP6q^t_- z3Wgml#?~6Y=M^@pwk2eoVC-+ zZ^9ba+c(WlB}YW9I^4&m9Q~vFvJb+*%N^O4s#_@gjV6B;FQ)>#l~m%DA0978U+K9e zMjF6)GT0J8cm;LM8Ga|Nb!6U0TvhjdQNQZ2RBGZq{7q$b-IPybI2pkgni6J6-_x!k zh;Fx82ET2VMzSE6gbo8^T>fM|gqTNecNxZT21KEewDI~nGeVZY`m&fLfpr=dcG(df zbkUCYS?425mkFO9eb?Yuf^YZOCDA zT^C@(xX5|$DAgLF7dASXcWQ;5?tfyxRSg!F(4T#7`mD=%Wj0y=PY?KslVA)tW${D! z`vgnob!^|b0&R=#G(I3k>3rJ- zT!An*u0XyaGdErzD8TEZr+wRCiS{+fH&c$ic5VP?>P7)%bfajl+U3MKV#b?F#hn6f z z5*MQ3?P={N4tiLda8)gvs!>qy@o@7QF+($2XMVJ3z+_&IWs5mC;2P#~;&5$|ozwi| z9EEdMiE}LmHJR7_)vUniySwVWdq{I^S96+Ae4JF@=%~iPp~BSwEIVJjmubrSnX!@l zNaapmX-q`lp4S+|K!)JE=gVp@!VOP4LrVP+Q>99*g{>8O%BnWhYvei^-j?!4y4L!I zKa);6?kvzr1z7y~F@|^@+?b9YnAY&(iWF|*l?Y`zi!ldvZS*|*Pb~Xx)>g+6r{dedX}`y zl6#qt7W-4HSV$)2JOoc^&~*19aQz1EO~WC*Z+cb#s#8POmg&nXLkZ-m!0sRYce&xk zi#aCv9eIOYd}=Ia^`c_b`7b>1oTtmb5|~Ao2lqLbjOBspVvtdSs5hdm(ut;Du?q_V z=r-EtK1m?qc8RV&i3C)bm2#~ETCtF4Ndbr|gjPh$E`f#bjO@%9w1&F^5d&lK+9hrx z1}?Dys^+(@2`rx7%92C8)bH@5BzcH#42H%)$11$%p2S0Bt}My(ShdBa$ie2^wYQjX zzrhAs`i;ggq++iACPv(`qqcZecXGJ`bB-uSAc)wbB})#MU}tOlDJ@@6w6xkvstS_? z9RzP;v~Z#rxunhP=)VRD^s{L1C5jD)Jf7>TzL`fSNiAE*8G__}pirGA`M1XWiobj1 z4y@D34*F~rCxDTaTFZk&{)4Ws+>0b3iNANGnmxJge_CBCnMZDal%!g#kqxsXrkyi< zn#c00yr(y1Iqz?Qy%h_FPJ26EhDmENaa29>R>G^hV)lwfQ&C<4WU|aWgqa(;3=7{z zp|)q;U4lu}9QR;hd>3SKN*Gdz)0FB-o&|Af=eYaWRX62>R0afy0 zdd2>0P+D4Wq*C5($i&~zz5%33#OI&Z=E~jGS>>;24%zw0j9jafxvwnMN^Xlv#B(SF zg^%YknsWMX6)l311`F7ONK)d)M2SRunOIkQBYN)ojfCdI8F=WApqbxph{4qc{sgSo z9f4;JK9H{~?a+~7TV)+NH^G>WWl|SHnKWMXyO0f3Sqs07y(snTsDcM){AsQE^k%-N z1;ifr!gFpV9J8`;rCBlK_6`K?tK?Zn4~cFJ=MerH!oSF8*Wt(|0%dXsz?F%MY;aY6 zi5HPfHq@dONs{KRL`UbJIy+B47AnZ;uzVDD6t}##doW?B;rFFM?C!~C2YmC-F1^VL z_;FkahdPvg^?~c(blCUYN5m%eu*3{YFI~wl870N=<|@jIuwRSkPavejQr}U{Uv~)Y zX_pM`hC-hfmrO8q@|pTp6QVfB;)oIxPpinh$|}hw*9bvHlr7#N2-3%-+_?Utja_@1zkP)h_ z*k`xI^y4Vs+{=hz`zg1SMJ>fxZ)Y+IO|+F{cPI)3=elkxhc~j3qfcPAYgVqZu9wnw zo_wn$f-B(I#bQyoY1Bm0v4Vg4yv^q6WCZK=#-QCC_NWtBZ1>IeWFaOk#WAY9|f_Jmu|%k#1Y^P{JIu32;Ucl*<2VVS?>!DJ_?132@cI`fhZ z`#Fit0rD(c7wXxNlVOYOU-Gxb-@Nr2-rZKqPt9{U;`Y6s3)mPf5dvTQqv|`n3|sod zvG*|MBJ{3hp+DlA0Y+lTzry89G^#AZ{$NfG>LFjmRg(AFjUj|KOgQq{f#6<8xg`>K zjs1FDHDEfY6?sSiAy$nv#EUj1bPPAeXCuNZ&7r8yYq&?sozNd}GFxqVWbQl1U7hTM z0$HJGokH@6QG<{<$j!gq5U2v>!T@h74BW5NRZmmw?sp6jDRbG-dD2O9h zKUL*Uy$WYm;m0T~s~%bPT1WYRs#~!@wNEq9U8<=xNbD|?U7vLP_z{??wnHx%cVVC$cTi(mddg{Ka*zMlFZ%G zS4nNhnyUR=yc%z6uDh6ybWBOVgk{syNw6prtZ$Qw3j>{YEy+vy2r+;CMtbUWF@DWU z{pz4SqB4Yeb08@B!O5kK)Fe0h%ZT4xhpk?~4CkBC{OgqNE3*41O&cyL`7X)Wc^)OJ z4=(Qn=IPUa2)>hZs}4Y3@IIJsK`5K&O_@ynmB?8=QNm5}9MXSFSnXKI&if^iqvb)g z)}2dlmIFy0NOk=O%%{J)1Po(w4rJ>r}-E=?AQ*n&{lMlTO7KD;^q*vtw?jg_@gE ze=x%vWu%Z~v$c4$HEm}19S09%5j%rTjL{~hJY+z&e4t55>Ud1*cq8W^*Lba6Ns6_^ zL$0q9iTnH=%+81vCKf|!&}-zxPAg;$<|~)~^S&dxc!lr%1IvzQhGxxSSsk(enM6M` z{90%v6~hda<}q)HPcFjdvIy|zV{-{nvB>g~K@#4}=jGS~ zGoDMOQf!RUvu0iX%RJg=tng$xzI<$=+4?6lp4o|c^Eo-5)hv6&5`uM1`7b@HEXSe% z*|)KfUUyhw`Yp|6VnV`h+sE6^xykn?{z;wq9kXvNEN0N%yt3f-*+pia(lqX2XgfI0(ED0Ha- zfHrzyv!I1(YZJrXh)f@E1as5c1n+92hZvB{k_F{{X;A*V;sXL&4kXle8$F_5BbejX zCW<2fgfAk~8pvI0^w{|S>iKt|=70!-fC%DQP!zyw0WyduSexjTpo*#=<426i2g?hOF+LqKs4O&cbG#k7 zxh{)(Aq?dH#rPcVVSIcB%T4-_n{XM_3t6Dh9CDN90OP|5K6^r#8ixw|*%nb{eyjBO#IR|=p8`pzX zOQbQ5F~XL?w;oB4Bs%Qud7Y$@mo$nhy>n?w-=Ka>=E&Zw;sPu%*PyEAs%lZld@gEO zQ&!~DO_%n&EoxPI&ibkO4UC`uG}0SA*zQJYg-fLKg@$+)E77)xg1}#-j$^ z0=CDFFHI3lO`1n{L7?|vKp;908|c42^+7kkY}{a0?l2>`3hX5u0e6SHARag%T@Xfw zWFR73c7D5?T`!Qw&cmAogoA&B_~+|?lJEc||5E_U|3w0&0)d>Z;0QyQ^D8HS>c6XB bVdJ-31NMJeJpthj7cQ{<1deAjH>v*s2xh?z literal 0 HcmV?d00001 diff --git a/Solutions/Threat Intelligence/Package/createUiDefinition.json b/Solutions/Threat Intelligence/Package/createUiDefinition.json index 863d79b9586..af6fbaf66d6 100644 --- a/Solutions/Threat Intelligence/Package/createUiDefinition.json +++ b/Solutions/Threat Intelligence/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Threat%20Intelligence/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Threat Intelligence solution contains data connectors for import of threat indicators into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.\n\n**Data Connectors:** 5, **Workbooks:** 1, **Analytic Rules:** 52, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Threat%20Intelligence/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Threat Intelligence solution contains data connectors for import of threat indicators into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.\n\n**Data Connectors:** 5, **Workbooks:** 1, **Analytic Rules:** 53, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -954,6 +954,20 @@ } } ] + }, + { + "name": "analytic53", + "type": "Microsoft.Common.Section", + "label": "TI map IP entity to Workday", + "elements": [ + { + "name": "analytic53-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Identifies a match in Workday Activity from any IP IOC from TI" + } + } + ] } ] }, diff --git a/Solutions/Threat Intelligence/Package/mainTemplate.json b/Solutions/Threat Intelligence/Package/mainTemplate.json index 6f962281184..6661e8757b2 100644 --- a/Solutions/Threat Intelligence/Package/mainTemplate.json +++ b/Solutions/Threat Intelligence/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Threat Intelligence", - "_solutionVersion": "3.0.7", + "_solutionVersion": "3.0.8", "solutionId": "azuresentinel.azure-sentinel-solution-threatintelligence-taxii", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "ThreatIntelligenceTaxii", @@ -150,11 +150,11 @@ "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','96307710-8bb9-4b45-8363-a90c72ebf86f','-', '1.0.2')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.2", + "analyticRuleVersion5": "1.0.3", "_analyticRulecontentId5": "87cc75df-d7b2-44f1-b064-ee924edfc879", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '87cc75df-d7b2-44f1-b064-ee924edfc879')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('87cc75df-d7b2-44f1-b064-ee924edfc879')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','87cc75df-d7b2-44f1-b064-ee924edfc879','-', '1.0.2')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','87cc75df-d7b2-44f1-b064-ee924edfc879','-', '1.0.3')))]" }, "analyticRuleObject6": { "analyticRuleVersion6": "1.0.6", @@ -485,8 +485,15 @@ "analyticRuleTemplateSpecName52": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e8ae92dd-1d41-4530-8be8-85c5014c7b47')))]", "_analyticRulecontentProductId52": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e8ae92dd-1d41-4530-8be8-85c5014c7b47','-', '1.0.3')))]" }, + "analyticRuleObject53": { + "analyticRuleVersion53": "1.0.0", + "_analyticRulecontentId53": "a924d317-03d2-4420-a71f-4d347bda4bd8", + "analyticRuleId53": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'a924d317-03d2-4420-a71f-4d347bda4bd8')]", + "analyticRuleTemplateSpecName53": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a924d317-03d2-4420-a71f-4d347bda4bd8')))]", + "_analyticRulecontentProductId53": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a924d317-03d2-4420-a71f-4d347bda4bd8','-', '1.0.0')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", - "management": "[concat('https://management','.azure','.com/')]" + "management": "[concat('https://management','.azure','.com/')]" }, "resources": [ { @@ -498,7 +505,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.7", + "description": "Threat Intelligence data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -657,7 +664,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.7", + "description": "Threat Intelligence data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -816,7 +823,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.7", + "description": "Threat Intelligence data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion3')]", @@ -1059,7 +1066,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.7", + "description": "Threat Intelligence data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion4')]", @@ -1327,7 +1334,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.7", + "description": "Threat Intelligence data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion5')]", @@ -1486,7 +1493,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ThreatIntelligence Workbook with template version 3.0.7", + "description": "ThreatIntelligence Workbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1590,7 +1597,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.7", + "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1671,7 +1678,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.7", + "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1752,7 +1759,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.7", + "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1833,7 +1840,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.7", + "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1914,7 +1921,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.7", + "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1995,7 +2002,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -2049,31 +2056,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "PA_Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -2129,7 +2136,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -2189,6 +2196,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -2198,35 +2206,34 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "FullName" } - ], - "entityType": "Host" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "InitiatingProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -2282,7 +2289,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -2342,6 +2349,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", @@ -2355,26 +2363,25 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -2430,7 +2437,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -2490,6 +2497,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "RecipientEmailAddress", @@ -2503,8 +2511,7 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -2560,7 +2567,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -2577,7 +2584,7 @@ "description": "Identifies a match in EmailUrlInfo table from any Domain IOC from TI.", "displayName": "TI map Domain entity to EmailUrlInfo", "enabled": false, - "query": "let dt_lookBack = 1h;\nlet ioc_lookBack = 14d;\nlet EmailUrlInfo_ = materialize(EmailUrlInfo\n| where isnotempty(UrlDomain)\n| where TimeGenerated > ago(dt_lookBack)\n| project-rename Email_Url = Url);\nlet Domains = EmailUrlInfo_\n| distinct UrlDomain\n| summarize make_list(UrlDomain);\nlet Candidates = ThreatIntelligenceIndicator\n| where isnotempty(DomainName)\n| where TimeGenerated >= ago(ioc_lookBack)\n| extend TI_Domain = tolower(DomainName)\n| where TI_Domain in (Domains)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now()\n| where Description !contains_cs \"State: inactive;\" and Description !contains_cs \"State: falsepos;\"\n| join kind=innerunique EmailUrlInfo_ on $left.TI_Domain == $right.UrlDomain\n| join kind=innerunique (EmailEvents | where TimeGenerated >= ago(dt_lookBack) | project-rename EmailEvents_TimeGenerated = TimeGenerated) on $left.NetworkMessageId == $right.NetworkMessageId\n| where DeliveryLocation !has \"Quarantine\"\n// Customize and uncomment the following line to remove security related mailboxes\n//| where tolower(RecipientEmailAddress) !in (\"secmailbox1@example.com\", \"secmailbox2@example.com\")\n| where EmailEvents_TimeGenerated < ExpirationDateTime\n| summarize EmailEvents_TimeGenerated = arg_max(EmailEvents_TimeGenerated, *) by IndicatorId, RecipientEmailAddress;\nlet Candidate_Domains = Candidates | distinct TI_Domain | summarize make_list(TI_Domain);\nThreatIntelligenceIndicator\n| where isnotempty(Url)\n| where TimeGenerated > ago(ioc_lookBack)\n| extend Host = tostring(parse_url(Url).Host)\n| where Host in (Candidate_Domains)\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId\n| where Active == true and ExpirationDateTime > now()\n| where Description !contains_cs \"State: inactive;\" and Description !contains_cs \"State: falsepos;\"\n| join kind=innerunique (Candidates | extend parsed_url = parse_url(Email_Url) | extend BaseUrl = strcat(parsed_url.Scheme, \"://\", parsed_url.Host, parsed_url.Path)) on $left.Url == $right.BaseUrl\n| where DeliveryAction !has \"Blocked\"\n| project EmailEvents_TimeGenerated, RecipientEmailAddress, IndicatorId, TI_Domain, ConfidenceScore, Description, Tags, TrafficLightProtocolLevel, Url = Email_Url, DeliveryAction, DeliveryLocation, EmailDirection, NetworkMessageId, AuthenticationDetails, SenderFromAddress, SenderIPv4, Subject\n| extend Name = tostring(split(RecipientEmailAddress, '@', 0)[0]), UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0])\n| extend timestamp = EmailEvents_TimeGenerated\n", + "query": "let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour\nlet ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days\nlet EmailUrlInfo_ = EmailUrlInfo\n | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains\n | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period\n | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase\n | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated\nlet EmailEvents_ = EmailEvents\n | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period\nlet TI_Urls = ThreatIntelligenceIndicator\n | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period\n | where isnotempty(Url) // Filter for non-empty URLs\n | extend Url = tolower(Url) // Convert URLs to lowercase\n | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL\n | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired\n | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired\n | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator\n | project\n EmailUrlInfo_TimeGenerated,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n ExpirationDateTime,\n ConfidenceScore,\n Url,\n UrlLocation,\n NetworkMessageId; // Select relevant columns\nlet TI_Domains = ThreatIntelligenceIndicator\n | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period\n | where isnotempty(DomainName) // Filter for non-empty domain names\n | extend DomainName = tolower(DomainName) // Convert domain names to lowercase\n | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name\n | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired\n | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired\n | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator\n | project\n EmailUrlInfo_TimeGenerated,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n ExpirationDateTime,\n ConfidenceScore,\n UrlDomain,\n UrlLocation,\n NetworkMessageId; // Select relevant columns\nunion TI_Urls, TI_Domains // Combine URL and domain threat intelligence data\n| extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column\n| join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID\n| where DeliveryAction !has \"Blocked\" // Filter out blocked delivery actions\n| extend\n Name = tostring(split(RecipientEmailAddress, '@', 0)[0]),\n UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]); // Extract name and UPN suffix from recipient email address\n", "queryFrequency": "PT1H", "queryPeriod": "P14D", "severity": "Medium", @@ -2620,6 +2627,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "RecipientEmailAddress", @@ -2633,17 +2641,16 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -2699,7 +2706,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -2765,36 +2772,36 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "SrcIpAddr", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ], "customDetails": { - "IoCExpirationTime": "ExpirationDateTime", - "ActivityGroupNames": "ActivityGroupNames", - "IoCConfidenceScore": "ConfidenceScore", "IndicatorId": "IndicatorId", "ThreatType": "ThreatType", "IoCDescription": "Description", - "EventTime": "Event_TimeGenerated" + "EventTime": "Event_TimeGenerated", + "IoCExpirationTime": "ExpirationDateTime", + "IoCConfidenceScore": "ConfidenceScore", + "ActivityGroupNames": "ActivityGroupNames" }, "alertDetailsOverride": { - "alertDescriptionFormat": "A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator.", - "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC" + "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC", + "alertDescriptionFormat": "A client with address {{SrcIpAddr}} requested the URL {{Url}}, whose hostname is a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator." } } }, @@ -2849,7 +2856,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -2909,31 +2916,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "PA_Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -2989,7 +2996,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -3055,31 +3062,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "HostName", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IP_addr", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -3135,7 +3142,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -3195,6 +3202,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", @@ -3208,26 +3216,25 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "HostIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -3283,7 +3290,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -3343,6 +3350,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Caller", @@ -3356,26 +3364,25 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "CallerIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -3431,7 +3438,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -3491,6 +3498,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "RecipientEmailAddress", @@ -3504,8 +3512,7 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -3561,7 +3568,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -3621,6 +3628,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserId", @@ -3634,26 +3642,25 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -3709,7 +3716,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -3769,31 +3776,31 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "DestinationUserID", "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -3849,7 +3856,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -3909,6 +3916,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "EntityEmail", @@ -3922,17 +3930,16 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -3988,7 +3995,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -4060,15 +4067,16 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "TargetUserName", "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "HostName", @@ -4078,26 +4086,25 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -4153,7 +4160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", @@ -4219,6 +4226,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserPrincipalName", @@ -4232,26 +4240,25 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -4307,7 +4314,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", @@ -4367,6 +4374,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "SourceUserName", @@ -4380,10 +4388,10 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", @@ -4397,28 +4405,28 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "FileHashValue", @@ -4428,8 +4436,7 @@ "columnName": "FileHashType", "identifier": "Algorithm" } - ], - "entityType": "FileHash" + ] } ] } @@ -4485,7 +4492,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_DeviceFileEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "FileHashEntity_DeviceFileEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", @@ -4545,6 +4552,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "RequestAccountName", @@ -4558,10 +4566,10 @@ "columnName": "RequestAccountDomain", "identifier": "NTDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "FileHashValue", @@ -4571,17 +4579,16 @@ "columnName": "FileHashType", "identifier": "Algorithm" } - ], - "entityType": "FileHash" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "HostName" } - ], - "entityType": "Host" + ] } ] } @@ -4637,7 +4644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", @@ -4709,6 +4716,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Account", @@ -4722,10 +4730,10 @@ "columnName": "NTDomain", "identifier": "NTDomain" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", @@ -4739,19 +4747,19 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "FileHashValue", @@ -4761,8 +4769,7 @@ "columnName": "FileHashType", "identifier": "Algorithm" } - ], - "entityType": "FileHash" + ] } ] } @@ -4818,7 +4825,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", @@ -4872,6 +4879,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "HostName", @@ -4881,44 +4889,43 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "CsUsername", "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "CIp", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "AzureResource", "fieldMappings": [ { "columnName": "_ResourceId", "identifier": "ResourceId" } - ], - "entityType": "AzureResource" + ] } ], "alertDetailsOverride": { @@ -4977,7 +4984,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", @@ -5037,31 +5044,31 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserIdentityUserName", "identifier": "ObjectGuid" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -5117,7 +5124,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", @@ -5177,6 +5184,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Caller", @@ -5190,44 +5198,43 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Account", "fieldMappings": [ { "columnName": "AadUserId", "identifier": "AadUserId" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "CallerIpAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "AzureResource", "fieldMappings": [ { "columnName": "ResourceId", "identifier": "ResourceId" } - ], - "entityType": "AzureResource" + ] } ] } @@ -5283,7 +5290,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", @@ -5343,22 +5350,22 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "TI_ipEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -5414,7 +5421,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", @@ -5474,22 +5481,22 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "AzureResource", "fieldMappings": [ { "columnName": "ResourceId", "identifier": "ResourceId" } - ], - "entityType": "AzureResource" + ] } ] } @@ -5545,7 +5552,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", @@ -5599,6 +5606,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", @@ -5612,26 +5620,25 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "TI_ipEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -5687,7 +5694,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", @@ -5747,13 +5754,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIP", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -5809,7 +5816,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", @@ -5869,13 +5876,13 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "CS_ipEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -5931,7 +5938,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", @@ -5991,6 +5998,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -6000,35 +6008,34 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "TI_ipEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "RemoteUrl", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "HostName" } - ], - "entityType": "Host" + ] } ] } @@ -6084,7 +6091,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", @@ -6144,6 +6151,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", @@ -6157,26 +6165,25 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "ClientIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -6232,7 +6239,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", @@ -6298,27 +6305,27 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "DstIpAddr", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "IoCExpirationTime": "ExpirationDateTime", - "ActivityGroupNames": "ActivityGroupNames", - "IoCConfidenceScore": "ConfidenceScore", "IndicatorId": "IndicatorId", "ThreatType": "ThreatType", "IoCDescription": "Description", - "EventTime": "imNWS_TimeGenerated" + "EventTime": "imNWS_TimeGenerated", + "IoCExpirationTime": "ExpirationDateTime", + "IoCConfidenceScore": "ConfidenceScore", + "ActivityGroupNames": "ActivityGroupNames" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The source address {{SrcIpAddr}} of the web request for the URL {{Url}} matches a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence feed for more information about the indicator.", - "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC" + "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC", + "alertDescriptionFormat": "The source address {{SrcIpAddr}} of the web request for the URL {{Url}} matches a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence feed for more information about the indicator." } } }, @@ -6373,7 +6380,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", @@ -6433,6 +6440,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserId", @@ -6446,26 +6454,25 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "TI_ipEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -6521,7 +6528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", @@ -6587,6 +6594,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "UserPrincipalName", @@ -6600,26 +6608,25 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -6675,7 +6682,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", @@ -6735,6 +6742,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "HostName", @@ -6744,26 +6752,25 @@ "columnName": "DnsDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "RemoteIp", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -6819,7 +6826,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", @@ -6879,40 +6886,40 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "csUserName", "identifier": "Name" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "cIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -6968,7 +6975,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", @@ -7028,6 +7035,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "userPrincipalName", @@ -7041,10 +7049,10 @@ "columnName": "AccountUPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "TargetResourceDisplayName", @@ -7058,17 +7066,16 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -7124,7 +7131,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", @@ -7184,6 +7191,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -7193,35 +7201,34 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "FullName" } - ], - "entityType": "Host" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "Process", "fieldMappings": [ { "columnName": "InitiatingProcessCommandLine", "identifier": "CommandLine" } - ], - "entityType": "Process" + ] } ] } @@ -7277,7 +7284,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", @@ -7337,6 +7344,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "RecipientEmailAddress", @@ -7350,17 +7358,16 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -7416,7 +7423,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", @@ -7476,6 +7483,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "User", @@ -7489,17 +7497,16 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -7555,7 +7562,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", @@ -7615,31 +7622,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "PA_Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -7695,7 +7702,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", @@ -7761,22 +7768,22 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Compromised_Host", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -7832,7 +7839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject41').analyticRuleVersion41]", @@ -7892,31 +7899,31 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Computer", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "HostIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -7972,7 +7979,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_UrlClickEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_UrlClickEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject42').analyticRuleVersion42]", @@ -8032,6 +8039,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountUpn", @@ -8045,17 +8053,16 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] } ] } @@ -8111,7 +8118,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject43').analyticRuleVersion43]", @@ -8171,6 +8178,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "user_name_s", @@ -8184,17 +8192,16 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "access_device_ip_s", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -8250,7 +8257,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "imDns_DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "imDns_DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject44').analyticRuleVersion44]", @@ -8352,6 +8359,7 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Dvc", @@ -8365,49 +8373,48 @@ "columnName": "HostNameDomain", "identifier": "DnsDomain" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SrcIpAddr", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "DNS", "fieldMappings": [ { "columnName": "Domain", "identifier": "DomainName" } - ], - "entityType": "DNS" + ] } ], "customDetails": { - "DnsQuery": "DnsQuery", - "QueryType": "DnsQueryType", - "SourceIPAddress": "SrcIpAddr", - "ActivityGroupNames": "ActivityGroupNames", - "Description": "Description", - "LatestIndicatorTime": "LatestIndicatorTime", "IndicatorId": "IndicatorId", + "QueryType": "DnsQueryType", + "DnsQuery": "DnsQuery", "ThreatType": "ThreatType", + "ConfidenceScore": "ConfidenceScore", "DNSRequestTime": "DNS_TimeGenerated", "ExpirationDateTime": "ExpirationDateTime", - "ConfidenceScore": "ConfidenceScore" + "LatestIndicatorTime": "LatestIndicatorTime", + "SourceIPAddress": "SrcIpAddr", + "ActivityGroupNames": "ActivityGroupNames", + "Description": "Description" } } }, @@ -8462,7 +8469,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "imDns_IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "imDns_IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject45').analyticRuleVersion45]", @@ -8564,48 +8571,48 @@ ], "entityMappings": [ { + "entityType": "Host", "fieldMappings": [ { "columnName": "Dvc", "identifier": "FullName" } - ], - "entityType": "Host" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IoC", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SrcIpAddr", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "DnsQuery": "DnsQuery", - "SourceIPAddress": "SrcIpAddr", - "ActivityGroupNames": "ActivityGroupNames", - "Description": "Description", - "LatestIndicatorTime": "LatestIndicatorTime", "IndicatorId": "IndicatorId", + "DnsQuery": "DnsQuery", "ThreatType": "ThreatType", + "ConfidenceScore": "ConfidenceScore", "DNSRequestTime": "imDns_mintime", "ExpirationDateTime": "ExpirationDateTime", - "ConfidenceScore": "ConfidenceScore" + "LatestIndicatorTime": "LatestIndicatorTime", + "SourceIPAddress": "SrcIpAddr", + "ActivityGroupNames": "ActivityGroupNames", + "Description": "Description" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The response address {{IoC}} to a DNS query matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator.", - "alertDisplayNameFormat": "The response {{IoC}} to DNS query matched an IoC" + "alertDisplayNameFormat": "The response {{IoC}} to DNS query matched an IoC", + "alertDescriptionFormat": "The response address {{IoC}} to a DNS query matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blade for more information on the indicator." } } }, @@ -8660,7 +8667,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imNetworkSession_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_imNetworkSession_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject46').analyticRuleVersion46]", @@ -8805,29 +8812,29 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "IoCIP", "identifier": "Address" } - ], - "entityType": "IP" + ] } ], "customDetails": { - "IoCExpirationTime": "ExpirationDateTime", - "EventEndTime": "imNWS_maxtime", - "EventStartTime": "imNWS_mintime", - "ActivityGroupNames": "ActivityGroupNames", - "IoCConfidenceScore": "ConfidenceScore", "IndicatorId": "IndicatorId", "ThreatType": "ThreatType", "IoCDescription": "Description", - "IoCIPDirection": "IoCDirection" + "EventStartTime": "imNWS_mintime", + "IoCConfidenceScore": "ConfidenceScore", + "IoCExpirationTime": "ExpirationDateTime", + "IoCIPDirection": "IoCDirection", + "EventEndTime": "imNWS_maxtime", + "ActivityGroupNames": "ActivityGroupNames" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The {{IoCDirection}} address {{IoCIP}} of a network session matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blead for more information on the indicator.", - "alertDisplayNameFormat": "A network session {{IoCDirection}} address {{IoCIP}} matched an IoC." + "alertDisplayNameFormat": "A network session {{IoCDirection}} address {{IoCIP}} matched an IoC.", + "alertDescriptionFormat": "The {{IoCDirection}} address {{IoCIP}} of a network session matched a known indicator of compromise of {{ThreatType}}. Consult the threat intelligence blead for more information on the indicator." } } }, @@ -8882,7 +8889,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intel Matches to GitHub Audit Logs_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "Threat Intel Matches to GitHub Audit Logs_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject47').analyticRuleVersion47]", @@ -8936,22 +8943,22 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountCustomEntity", "identifier": "FullName" } - ], - "entityType": "Account" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPCustomEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -9007,7 +9014,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "DomainEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject48').analyticRuleVersion48]", @@ -9055,22 +9062,22 @@ ], "entityMappings": [ { + "entityType": "DNS", "fieldMappings": [ { "columnName": "DomainName", "identifier": "DomainName" } - ], - "entityType": "DNS" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -9126,7 +9133,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "EmailEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject49').analyticRuleVersion49]", @@ -9174,6 +9181,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "Name", @@ -9187,8 +9195,7 @@ "columnName": "UPNSuffix", "identifier": "UPNSuffix" } - ], - "entityType": "Account" + ] } ] } @@ -9244,7 +9251,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "FileHashEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject50').analyticRuleVersion50]", @@ -9298,33 +9305,34 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "DestinationIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "SourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "Host", "fieldMappings": [ { "columnName": "DeviceName", "identifier": "HostName" } - ], - "entityType": "Host" + ] }, { + "entityType": "FileHash", "fieldMappings": [ { "columnName": "FileHashValue", @@ -9334,8 +9342,7 @@ "columnName": "FileHashType", "identifier": "Algorithm" } - ], - "entityType": "FileHash" + ] } ] } @@ -9391,7 +9398,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "IPEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject51').analyticRuleVersion51]", @@ -9439,40 +9446,40 @@ ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { "columnName": "TI_ipEntity", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "NetworkDestinationIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "NetworkSourceIP", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "EmailSourceIPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -9528,7 +9535,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "URLEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject52').analyticRuleVersion52]", @@ -9576,6 +9583,7 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "columnName": "AccountObjectId", @@ -9589,28 +9597,28 @@ "columnName": "AccountDisplayName", "identifier": "DisplayName" } - ], - "entityType": "Account" + ] }, { + "entityType": "URL", "fieldMappings": [ { "columnName": "Url", "identifier": "Url" } - ], - "entityType": "URL" + ] }, { + "entityType": "IP", "fieldMappings": [ { "columnName": "IPAddress", "identifier": "Address" } - ], - "entityType": "IP" + ] }, { + "entityType": "CloudApplication", "fieldMappings": [ { "columnName": "Application", @@ -9620,8 +9628,7 @@ "columnName": "ApplicationID", "identifier": "AppId" } - ], - "entityType": "CloudApplication" + ] } ] } @@ -9668,17 +9675,150 @@ "version": "[variables('analyticRuleObject52').analyticRuleVersion52]" } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('analyticRuleObject53').analyticRuleTemplateSpecName53]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "IPEntity_Workday_AnalyticalRules Analytics Rule with template version 3.0.8", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('analyticRuleObject53').analyticRuleVersion53]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", + "location": "[parameters('workspace-location')]", + "properties": { + "description": "Identifies a match in Workday Activity from any IP IOC from TI", + "displayName": "TI map IP entity to Workday", + "enabled": false, + "query": "let dtLookBack = 1h; // Define the lookback period for audit events\nlet iocLookBack = 14d; // Define the lookback period for threat intelligence indicators\nThreatIntelligenceIndicator \n| where isnotempty(NetworkIP)\n or isnotempty(EmailSourceIpAddress)\n or isnotempty(NetworkDestinationIP)\n or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields\n| where TimeGenerated >= ago(iocLookBack) // Filter indicators within the lookback period\n| extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId, TI_ipEntity // Get the latest indicator time for each entity\n| where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired\n| join kind=inner (\n ASimAuditEventLogs\n | where EventVendor == \"Workday\" // Filter for Workday events\n | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period\n | where isnotempty(DvcIpAddr) // Filter for events with a device IP address\n | extend WD_TimeGenerated = EventStartTime // Rename the event start time column\n | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns\n )\n on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity\n| project\n LatestIndicatorTime,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n Url,\n ExpirationDateTime,\n ConfidenceScore,\n WD_TimeGenerated,\n ActorUsername,\n DvcIpAddr,\n Operation,\n Object // Select relevant columns after the join\n| extend\n timestamp = WD_TimeGenerated,\n Name = tostring(split(ActorUsername, '@', 0)[0]),\n UPNSuffix = tostring(split(ActorUsername, '@', 1)[0]) // Add additional fields for timestamp, name, and UPN suffix\n", + "queryFrequency": "PT1H", + "queryPeriod": "P14D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ + { + "connectorId": "ThreatIntelligence", + "dataTypes": [ + "ThreatIntelligenceIndicator" + ] + }, + { + "connectorId": "ThreatIntelligenceTaxii", + "dataTypes": [ + "ThreatIntelligenceIndicator" + ] + }, + { + "connectorId": "Workday", + "dataTypes": [ + "Workday" + ] + }, + { + "connectorId": "MicrosoftDefenderThreatIntelligence", + "dataTypes": [ + "ThreatIntelligenceIndicator" + ] + } + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "ActorUsername", + "identifier": "FullName" + }, + { + "columnName": "Name", + "identifier": "Name" + }, + { + "columnName": "UPNSuffix", + "identifier": "UPNSuffix" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "DvcIpAddr", + "identifier": "Address" + } + ] + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject53').analyticRuleId53,'/'))))]", + "properties": { + "description": "Threat Intelligence Analytics Rule 53", + "parentId": "[variables('analyticRuleObject53').analyticRuleId53]", + "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject53').analyticRuleVersion53]", + "source": { + "kind": "Solution", + "name": "Threat Intelligence", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "tier": "Microsoft", + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "link": "https://support.microsoft.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "contentKind": "AnalyticsRule", + "displayName": "TI map IP entity to Workday", + "contentProductId": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", + "id": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", + "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.7", + "version": "3.0.8", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Threat Intelligence", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Threat Intelligence solution contains data connectors for import of threat indicators into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.

\n

Data Connectors: 5, Workbooks: 1, Analytic Rules: 52, Hunting Queries: 5

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Threat Intelligence solution contains data connectors for import of threat indicators into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.

\n

Data Connectors: 5, Workbooks: 1, Analytic Rules: 53, Hunting Queries: 5

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -10017,6 +10157,11 @@ "kind": "AnalyticsRule", "contentId": "[variables('analyticRuleObject52')._analyticRulecontentId52]", "version": "[variables('analyticRuleObject52').analyticRuleVersion52]" + }, + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", + "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" } ] }, From 2db2d1a48e6cb42b145cc7d8a959d923bc2324f0 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 21 Nov 2024 10:58:58 -0500 Subject: [PATCH 06/16] Update DomainEntity_EmailUrlInfo.yaml Fixing format to meet requirements. --- .../DomainEntity_EmailUrlInfo.yaml | 110 +++++++++--------- 1 file changed, 55 insertions(+), 55 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml index 9dc1b0f59bc..35fd0588fc8 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml @@ -25,60 +25,60 @@ tactics: relevantTechniques: - T1566 query: | - let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour - let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days - let EmailUrlInfo_ = EmailUrlInfo - | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains - | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period - | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase - | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated - let EmailEvents_ = EmailEvents - | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period - let TI_Urls = ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period - | where isnotempty(Url) // Filter for non-empty URLs - | extend Url = tolower(Url) // Convert URLs to lowercase - | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL - | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired - | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired - | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator - | project - EmailUrlInfo_TimeGenerated, - Description, - ActivityGroupNames, - IndicatorId, - ThreatType, - ExpirationDateTime, - ConfidenceScore, - Url, - UrlLocation, - NetworkMessageId; // Select relevant columns - let TI_Domains = ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period - | where isnotempty(DomainName) // Filter for non-empty domain names - | extend DomainName = tolower(DomainName) // Convert domain names to lowercase - | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name - | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired - | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired - | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator - | project - EmailUrlInfo_TimeGenerated, - Description, - ActivityGroupNames, - IndicatorId, - ThreatType, - ExpirationDateTime, - ConfidenceScore, - UrlDomain, - UrlLocation, - NetworkMessageId; // Select relevant columns - union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data - | extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column - | join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID - | where DeliveryAction !has "Blocked" // Filter out blocked delivery actions - | extend - Name = tostring(split(RecipientEmailAddress, '@', 0)[0]), - UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]); // Extract name and UPN suffix from recipient email address +let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour +let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days +let EmailUrlInfo_ = EmailUrlInfo + | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains + | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period + | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase + | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated +let EmailEvents_ = EmailEvents + | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period +let TI_Indicators = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId + | where Active == true and ExpirationDateTime > now(); // Filter for active indicators that haven't expired +let TI_Urls = TI_Indicators + | where isnotempty(Url) // Filter for non-empty URLs + | extend Url = tolower(Url) // Convert URLs to lowercase + | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator + | project + EmailUrlInfo_TimeGenerated, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + ExpirationDateTime, + ConfidenceScore, + Url, + UrlLocation, + NetworkMessageId; // Select relevant columns +let TI_Domains = TI_Indicators + | where isnotempty(DomainName) // Filter for non-empty domain names + | extend DomainName = tolower(DomainName) // Convert domain names to lowercase + | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator + | project + EmailUrlInfo_TimeGenerated, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + ExpirationDateTime, + ConfidenceScore, + UrlDomain, + UrlLocation, + NetworkMessageId; // Select relevant columns +union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data + | extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column + | join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID + | where DeliveryAction !has "Blocked" // Filter out blocked delivery actions + | extend + Name = tostring(split(RecipientEmailAddress, '@', 0)), + UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)); // Extract name and UPN suffix from recipient email address entityMappings: - entityType: Account fieldMappings: @@ -93,4 +93,4 @@ entityMappings: - identifier: Url columnName: Url version: 1.0.3 -kind: Scheduled \ No newline at end of file +kind: Scheduled From cc198e92e2ff1eb81ebe0f3c60cbcc35d412514f Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 21 Nov 2024 11:20:16 -0500 Subject: [PATCH 07/16] Update IPEntity_Workday.yaml Fixing required format --- .../Analytic Rules/IPEntity_Workday.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml index 59276b8906d..7539acdfb11 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml @@ -23,16 +23,16 @@ triggerThreshold: 0 tactics: relevantTechniques: query: | - let dtLookBack = 1h; // Define the lookback period for audit events - let iocLookBack = 14d; // Define the lookback period for threat intelligence indicators - ThreatIntelligenceIndicator - | where isnotempty(NetworkIP) +let dtLookBack = 1h; // Define the lookback period for audit events +let ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators +ThreatIntelligenceIndicator +| where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period +| where isnotempty(NetworkIP) or isnotempty(EmailSourceIpAddress) or isnotempty(NetworkDestinationIP) or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields - | where TimeGenerated >= ago(iocLookBack) // Filter indicators within the lookback period +| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity - | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId, TI_ipEntity // Get the latest indicator time for each entity | where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired | join kind=inner ( ASimAuditEventLogs From f50d50216301412145a5cbcb7ffc6cae65e1418e Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 21 Nov 2024 11:56:15 -0500 Subject: [PATCH 08/16] Update IPEntity_Workday.yaml Formatting --- .../Analytic Rules/IPEntity_Workday.yaml | 77 +++++++++---------- 1 file changed, 38 insertions(+), 39 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml index 7539acdfb11..ce55abf02f8 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml @@ -23,44 +23,44 @@ triggerThreshold: 0 tactics: relevantTechniques: query: | -let dtLookBack = 1h; // Define the lookback period for audit events -let ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators -ThreatIntelligenceIndicator -| where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period -| where isnotempty(NetworkIP) - or isnotempty(EmailSourceIpAddress) - or isnotempty(NetworkDestinationIP) - or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields -| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId - | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity - | where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired - | join kind=inner ( - ASimAuditEventLogs - | where EventVendor == "Workday" // Filter for Workday events - | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period - | where isnotempty(DvcIpAddr) // Filter for events with a device IP address - | extend WD_TimeGenerated = EventStartTime // Rename the event start time column - | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns - ) - on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity - | project - LatestIndicatorTime, - Description, - ActivityGroupNames, - IndicatorId, - ThreatType, - Url, - ExpirationDateTime, - ConfidenceScore, - WD_TimeGenerated, - ActorUsername, - DvcIpAddr, - Operation, - Object // Select relevant columns after the join - | extend - timestamp = WD_TimeGenerated, - Name = tostring(split(ActorUsername, '@', 0)[0]), - UPNSuffix = tostring(split(ActorUsername, '@', 1)[0]) // Add additional fields for timestamp, name, and UPN suffix + let dtLookBack = 1h; // Define the lookback period for audit events + let ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators + ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | where isnotempty(NetworkIP) + or isnotempty(EmailSourceIpAddress) + or isnotempty(NetworkDestinationIP) + or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId + | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity + | where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired + | join kind=inner ( + ASimAuditEventLogs + | where EventVendor == "Workday" // Filter for Workday events + | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period + | where isnotempty(DvcIpAddr) // Filter for events with a device IP address + | extend WD_TimeGenerated = EventStartTime // Rename the event start time column + | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns + ) + on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity + | project + LatestIndicatorTime, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + Url, + ExpirationDateTime, + ConfidenceScore, + WD_TimeGenerated, + ActorUsername, + DvcIpAddr, + Operation, + Object // Select relevant columns after the join + | extend + timestamp = WD_TimeGenerated, + Name = tostring(split(ActorUsername, '@', 0)), + UPNSuffix = tostring(split(ActorUsername, '@', 1)) // Add additional fields for timestamp, name, and UPN suffix entityMappings: - entityType: Account fieldMappings: @@ -74,6 +74,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: DvcIpAddr - version: 1.0.0 kind: Scheduled From c3b66266f512aff3bab4071c53f26e1d525b8f42 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 21 Nov 2024 13:25:32 -0500 Subject: [PATCH 09/16] Update DomainEntity_EmailUrlInfo.yaml Fixing the YAML --- .../DomainEntity_EmailUrlInfo.yaml | 110 +++++++++--------- 1 file changed, 55 insertions(+), 55 deletions(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml index 35fd0588fc8..6cbc6b6c4fa 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/DomainEntity_EmailUrlInfo.yaml @@ -1,7 +1,7 @@ id: 87cc75df-d7b2-44f1-b064-ee924edfc879 name: TI map Domain entity to EmailUrlInfo description: | - 'Identifies a match in EmailUrlInfo table from any Domain IOC from TI.' + Identifies a match in EmailUrlInfo table from any Domain IOC from TI. severity: Medium requiredDataConnectors: - connectorId: Office365 @@ -25,60 +25,60 @@ tactics: relevantTechniques: - T1566 query: | -let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour -let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days -let EmailUrlInfo_ = EmailUrlInfo - | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains - | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period - | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase - | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated -let EmailEvents_ = EmailEvents - | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period -let TI_Indicators = ThreatIntelligenceIndicator - | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period - | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId - | where Active == true and ExpirationDateTime > now(); // Filter for active indicators that haven't expired -let TI_Urls = TI_Indicators - | where isnotempty(Url) // Filter for non-empty URLs - | extend Url = tolower(Url) // Convert URLs to lowercase - | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL - | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired - | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator - | project - EmailUrlInfo_TimeGenerated, - Description, - ActivityGroupNames, - IndicatorId, - ThreatType, - ExpirationDateTime, - ConfidenceScore, - Url, - UrlLocation, - NetworkMessageId; // Select relevant columns -let TI_Domains = TI_Indicators - | where isnotempty(DomainName) // Filter for non-empty domain names - | extend DomainName = tolower(DomainName) // Convert domain names to lowercase - | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name - | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired - | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator - | project - EmailUrlInfo_TimeGenerated, - Description, - ActivityGroupNames, - IndicatorId, - ThreatType, - ExpirationDateTime, - ConfidenceScore, - UrlDomain, - UrlLocation, - NetworkMessageId; // Select relevant columns -union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data - | extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column - | join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID - | where DeliveryAction !has "Blocked" // Filter out blocked delivery actions - | extend - Name = tostring(split(RecipientEmailAddress, '@', 0)), - UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)); // Extract name and UPN suffix from recipient email address + let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour + let ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days + let EmailUrlInfo_ = EmailUrlInfo + | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains + | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period + | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase + | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated + let EmailEvents_ = EmailEvents + | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period + let TI_Indicators = ThreatIntelligenceIndicator + | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period + | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId + | where Active == true and ExpirationDateTime > now(); // Filter for active indicators that haven't expired + let TI_Urls = TI_Indicators + | where isnotempty(Url) // Filter for non-empty URLs + | extend Url = tolower(Url) // Convert URLs to lowercase + | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator + | project + EmailUrlInfo_TimeGenerated, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + ExpirationDateTime, + ConfidenceScore, + Url, + UrlLocation, + NetworkMessageId; // Select relevant columns + let TI_Domains = TI_Indicators + | where isnotempty(DomainName) // Filter for non-empty domain names + | extend DomainName = tolower(DomainName) // Convert domain names to lowercase + | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name + | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired + | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator + | project + EmailUrlInfo_TimeGenerated, + Description, + ActivityGroupNames, + IndicatorId, + ThreatType, + ExpirationDateTime, + ConfidenceScore, + UrlDomain, + UrlLocation, + NetworkMessageId; // Select relevant columns + union TI_Urls, TI_Domains // Combine URL and domain threat intelligence data + | extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column + | join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID + | where DeliveryAction !has "Blocked" // Filter out blocked delivery actions + | extend + Name = tostring(split(RecipientEmailAddress, '@', 0)), + UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)); // Extract name and UPN suffix from recipient email address entityMappings: - entityType: Account fieldMappings: From 76ddb22bc94d67ebb5bd088455b7f08894b120b3 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 21 Nov 2024 14:10:54 -0500 Subject: [PATCH 10/16] Update IPEntity_Workday.yaml Added Mitre info --- .../Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml index ce55abf02f8..66b6b96d7c2 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml @@ -21,7 +21,9 @@ queryPeriod: 14d triggerOperator: gt triggerThreshold: 0 tactics: + - CommandAndControl relevantTechniques: + - T1071 query: | let dtLookBack = 1h; // Define the lookback period for audit events let ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators From 77bcde7a4485e0b295a8c225e5c1bf9144d42917 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Thu, 21 Nov 2024 14:55:15 -0500 Subject: [PATCH 11/16] Update IPEntity_Workday.yaml --- .../Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml index 66b6b96d7c2..705b0a25933 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml @@ -1,7 +1,7 @@ id: a924d317-03d2-4420-a71f-4d347bda4bd8 name: TI map IP entity to Workday description: | - Identifies a match in Workday Activity from any IP IOC from TI + Detects a match in Workday activity from any IP Indicator of Compromise (IOC) provided by Threat Intelligence (TI). severity: Medium requiredDataConnectors: - connectorId: ThreatIntelligence From fbfd486698b8027162878b4910fe4bed8e21af97 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Fri, 22 Nov 2024 08:45:42 -0500 Subject: [PATCH 12/16] Update IPEntity_Workday.yaml For new validation --- .../Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml index 705b0a25933..6a7ab357682 100644 --- a/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml +++ b/Solutions/Threat Intelligence/Analytic Rules/IPEntity_Workday.yaml @@ -1,5 +1,5 @@ id: a924d317-03d2-4420-a71f-4d347bda4bd8 -name: TI map IP entity to Workday +name: TI map IP entity to Workday(ASimAuditEventLogs) description: | Detects a match in Workday activity from any IP Indicator of Compromise (IOC) provided by Threat Intelligence (TI). severity: Medium From 1f4f0a2be1e3f7904b2b9c566a5caabd90f71b58 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Fri, 22 Nov 2024 09:51:59 -0500 Subject: [PATCH 13/16] Update IPEntity_Workday.yaml From a3604e9dc511009e65b699983a469f14898a9bc7 Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Fri, 22 Nov 2024 15:03:30 -0500 Subject: [PATCH 14/16] Update IPEntity_Workday.yaml From 22749e26a8fcda28c8def1870391939c18cdbfaf Mon Sep 17 00:00:00 2001 From: Josh Kolka <120500937+MSJosh@users.noreply.github.com> Date: Mon, 25 Nov 2024 08:47:22 -0500 Subject: [PATCH 15/16] Update IPEntity_Workday.yaml From ccf1254983233e27784865bb7ab759d1bf4f8392 Mon Sep 17 00:00:00 2001 From: MSJosh Date: Tue, 3 Dec 2024 12:08:41 -0500 Subject: [PATCH 16/16] Creating Package for new detections Created new detections --- .../Threat Intelligence/Package/3.0.9.zip | Bin 0 -> 57318 bytes .../Package/createUiDefinition.json | 88 +- .../Package/mainTemplate.json | 1696 +++++++++-------- Solutions/Threat Intelligence/ReleaseNotes.md | 1 + 4 files changed, 868 insertions(+), 917 deletions(-) create mode 100644 Solutions/Threat Intelligence/Package/3.0.9.zip diff --git a/Solutions/Threat Intelligence/Package/3.0.9.zip b/Solutions/Threat Intelligence/Package/3.0.9.zip new file mode 100644 index 0000000000000000000000000000000000000000..d38de41431fe2eb4d8741ebfd6031ef7e7a074ad GIT binary patch literal 57318 zcmagEWmFt((>00@?(S~E-QC@S1y67p+--1o2=4Cg1Pzej!QI_G_#wIPbJp{$^S<9V zYu5aj>DgV^uDz?OuWl82NGMD&Ffdp!M592RbYb%c3^Xt>=rS-cocC`(JDM6hn|`#E zFg3HZvvjru+A&!<0qsupUmTZP(cZe*eE?C9#y=>2%!QuvOzTNEIfWOyZbiB{@Hf+l zhsOo6OV&bJNV<(F>?zK{G>ulw7ysWdV-!lm} zLuYhEY+q#uS06n#WbS;`-em3XQHsistZmww#eGhWGm*TReyhy!m!C=?81H%=Ay~kE zDB(jO@k#+ImIleGY~wHl^ntsD+Hf%YlT%kOOr!wCHzysTss@!GQ;Y%!mdhuLO*Yt- zLj>P~6{RG82jXzEx_MjclCbh3KZ0_FZfN7hhY2LZUxBCS@M-c{f=1Ygj^|Oat&^(X~F%K7tBJAw}MmfbKt z#Urc7LS;*d9n*!>h2v<|Y(J|rH;^Dp5}FIZnfXNQRwZWvix8z3{B{s?P_WKS1fuPm z)58pvLKrD8>M=4Y-JQgO1BZQ{)$vcPEmcEZFi}dPwtlE^n2%IzY}eEy0u|e(Mj{f^ zA_L`OWV?BOA8-;OQBZ+A##b z#k=6m4{YNi(6)+#9Fde#W(Y;XMS(grI0>VFxLn111r8JPH4mir0W*~2e$s;%nIqTP zESHG&43`qpN}Zl%Z>1`kz>vzJlz(x%rzcFNw=|NaAwMHRFQIR)eRkp5BDo2hg|vBk zjMDukPfbfwF#(y@TTkUptBwUK6nj-n`4n#acrn7-XCqWwNp38>LB`Po z=_kVM?K@#(n^T?0Df8>G3wl7e{Ok3?%Gq~88ZZ6Z{9R{#5SRD~8ETL@Qt85V{@Oi5 zZL6BYGiXjtk+w`w1Wh~b04Mam$G zRG_kK z6Jv%%Xo@DXZa!u53x;SUd0G&P&O5+Uy)0&ahFE~R3m{iC;>2`X4;CPefRpeiBk}(z z--IMJsp%x#>?^2-(QfEk%Ac_97!kfJM?_btasQ#EjM^JsQ+}8sE{a!avq+2C%koPA z1?f<^^a06+suDeo^T5fGk{E%I7U}Bb-VafM1049@a^+;ST)3+E* z`S%xy?CG+JF7?!DwI-qpWunULXqX950;`+9RHbv-j<`|v@R=t#G}n#Ab|$}Rj5uKu zzgrd*C3+aDAuJr3PpW9)uqL5ZcMBnE8~Vn;)ld95(<HFM8@9!-7RD3>F;Kv{1 zie;YaY7{?wA1wjtN@V;4T-P8`c`ouFb#1b8n(!c30v(i#=1%EofbMMD=Y;6u;2-=S z%g(jAPFc&Ou8kB?1;;sF7q>Bx)y>!eNkv&P7A~?Gc60*E z?3&xyE|%p}H=L7K(Bi9N>N3S>;CfJ-U|(hL&y)P{Y(72j7i8@kST13gCJ z5UgDtZHlfSP#6b;AsFLS`8_2JA%ue@L(z@{+4OmqBR5{@@5Uvh3F6JKd>fa;SKJgP zKW<}S)I)wV21yRhTuvHNQ)tf^Gd6L|ld12NYYfQw!E89+q^nyVB{;p5dia}!{emI) zL`NFP-I~CwnW?cjXewN&IRtE^>@*7>1Wn zm;b4}Q*NDYFkNs>q3bCb)g2Lrj>tQ?NF(wIG8Yv!SbSl-lMak5ux@Q3bsoe$0A?~W z(B}{l^vX%*>Wnharr$k7+09BRI&q(0P z*nVBj)DNx=xyJ&hDtV9vyYL0H27);1$5??0q~b?LZEW*WrCRUjg1Lbr!28Gnhl;1Z zdiX;zR;TJGTDr^0X9zM!Q32Np5PQ#8@Oz&l5jWZT*}akaDi7psB9Wk}*&3xv{_;<; zX>C+VG%*CGMkAwfN)UAB$=VOYTA*m%XKU5$A=w|h`lQ5zvUlh_w9^p+X$ z5*zAt>LXJ!kAC#-&jYdjX;ku$nsJ5)X0NqoI+H?%$IhJ_uwh1m2)4*JT9 zszet4MPywiTxm>RK^oOsTEvxu7X^w|KAH}by${_eb%bjZLnIrZjkxex;yfft^r$ug z?!M@&`I}?Sr(XX+*NVxgAsyl+DRY+QY-Vp=-i3H|EnEmi*BMVIGm7Fyp1ZuPKz~D% z!8kHB^Pzffnk}d*$qabpEA-n~p&eDkhb7Z2qNBCiN^uhs9M|!bCl-LE;gnFN7qr=6 z9P0J%xaqyXt;jx{)?7?T|ClF~m28SVEIQ?}&DdcoxPnIJuPatjumt)axG5bnuse+q z3C^C@UvrGC%x0)}(2rd>D`;$?JZI&`dSe4e$+w%;XH%2^tNiR4Ff^%eJVI``6g0`ME<8B2QZx1S(0vT*RZr4xN3dB2nLeIFJ+WrU6FCvAtYODZriW=EK5QC}mq>HWuEjYgR- z5i9wNG5v%CV^T~`y>|Ha2q=-%$EkDqa7!X!DC#X5d)RUw9w{7!Ymx|iRit{McP5t< zHJBA#q5kF}Xt~@2b+mdocn~5}5FU%pILfa>A-g2NAlwA6O$aYKPxhTE-iEdla!9go zXOe8+_C3DNNMCfH-7-ZfT#WTWKcrY>j}WFd@EUU~AUqwZQTg3_Uwocp-p~JjueO6N zF#z)m8kGH&_xo{1@Gv@*-f@;|?sJ7BWCaQ}pjbQYTGOY&bP1ExVVylkiE+rEj#l@X zS(1q^6fehJ1LJ{x9Dp1EyQD?ML!kk0!o1|M;s2a9KJ4|uo-(`8xCfF}*M=qXC;;}E z6a^IeJGT4$!QK%@&fy`#`~0G8@a<7lr7?AF-_Zn%#aVM6)1;Tk=bPHN4DV=vGU-?0 z%rPz5tR6GAQ3*X^5#*dWr@DkH4}N^<5Y;cf4RszjLG}#;%z}#_&scerD z!+?(&VJU~H6`LF#n%i)TjU3F^QW1xfRlS6fbLtVx;}5CaV!9z{SFZvBSUksLHG?w8 zaK@BBesrq-;)+VBn3HYsvNS1LwGt)^8?YHAAORc?0etZ?U{8!&e~bz^sr0Bz#JM|3 zhYgI55>SU08z)Fp7Q6i30aN#9H;+*eA3C7Jsw$ufO`{aPh8ba>Hq!acBERbE;3FrP z1HoSA)8Pvy_yNivDh(stFo{K=S!T6FZ0pH~g#`i*fvGF>7hXY(B54xjr@5p0x-owT zQG+9uiA>h_!4)jD5O)SRkEzdLF2l!9y6seZy!n~t}ZSCOv({{Lk z7$NOGL=${v6xQ^t41c+44vn4{eh`PG`iDB#>mPYkV^f{rpZT=C@kjTIZVPtlpd&$v zXcX5lvcx5!V#Ok!6fZYpRBarMpfx64dKPqf5lu$rtNCYqojXad%@;6i z4^9gb73?*`)D`sD<1Jrr29&JH+C=te1sVzpQ~62uU7>G&qbx95BBEvfA-=enLNLQ4)xzMb9s`^68hR!XnGc%Cng> zkl+noeV{f3yr9sS9|J6=#_hsn^#!UvC+1u>&f{@*Ul@;sDal4xI&R)1D-lhw-`Yxb zpyEwC)ewIq3D{H94dj3MWQYxU0>UEN2FE-CF@Qf)(>a|OnR$a)uc03Y@k{86qXUm z)2Y!wb@KvbQ!DT?l&#Hp3aLUo5a&ouRd|&VixRuv=mb(9zC0T_sqU#$oy>?)6bhg} z*?c$mK=l!lmCpG9_1YdP*%WQO7bOq;i0BE4lN1Bl>F5yD>kQ_QVCaO{Ip;Erf|vZO zC0Iz~TK*hSF}BhjCp2W6ViSy{i)98yj{#hSp|h-dGlU#V84lR4=ix>B@OUhagWFN% z78ddazZHz5wGWXMUu3WX-@C?Qzt9RESoH>*{(e4de&fxf|;$= zm*Lc-_O(t{B|>%^*N34@TF-IQ@0I!t=iwSM%l>`qRO1)qww&j8?{c9Awvt>xu*M|E zrm{FMMS66F+2{&TjIkl0=yAw4>>K(Hp$ABTtU4%7ysrVK5k};rj#60LG1+x6gLrLc zW%tI1d&XXv{7&}#tIELm&$qvnihO~*;8h8=2Em=bk-2ex_DI8(!R0eN;AK)Bg-#rg zhV1N=BC?fXjvKsRKK)GQqc~)|0DxgLWWjMsa_4(8W;>rv0d05zE>Mqiy=)XB zY4|wK02{ceH{E2=Xrvq$f;*7uSU}Kt_%<3+Em^(L-Sq}Py2<9s!p8apS8iWSbXe$KP{HLutu9C z589-cj9BNXv-dr#xlkI*h(gi@368HH02^XF^RG|P))L*FNZ1rwp~|-;0x#xXdwk&D zck4)sPh->1vOM=TIM%a!E!lVLIRT5I_E!Aa<3FB(r_)vED^|XxZEK@%u!_j$y{VXf z4&{<0sApR_H8+5t76%f|a-6TlcsgnN=OVayy@4;>Ye@02A_c!Hg7v=qUIZK-~A1?&{Gg$POrzaVd&Qlhy# zush=?iz?#2ZgkJr?_;>4S%VGbzS)bkG}eL1j{bVi>a^fe>{=qsfTGz|8` z0}`A{qc|l6Hb>reXWoYaB-P!$n=^~I)?BA2X;Z`F>Vk6;M(Wpf9O92$04qdPojBU> zW*KNY^t_oSu4CUB>~WMR)uPtgUV7zG$(6DSTrud@g_qp2e69ke`0Zu+dya-*GQB;i ze~DSE9`V>R1KmCL)e$51i|BHk>lbbJChQu#UB7Z^T+sY?>ZlJS z-VAWHxR_+XV=Pzl)s0EB)G2-s&oWaHpkjRReuA$2yeyd0Dx`w!==ou;urSa zmC0W8%Xc39R(9ZlqEX}<#<2gdg!P|VkX4SHweU#LoGBH7-b?OSv8qIk@Ux<<))DRr znt&?Xj{rt!m&x*SWZhU1qDIVF(R9&E8(W&p8gJxsI*{u(bc?SaKu3%?GwMRO*K~iv zDO+dCeEeQXwj`*UWshgmHK)J$SL8aqpK;dRX_}&Yrso zU6CZu5eUZ%{H~smZ7W2!{d_Cst&#&HiB4Z6z$(03iDh0|8S`Zyj3V=!t)Ae zaJ&(56T|C8>y)~A4RdBXD_zYBQ^d#i?Hk3e-5Y>s4S(ZpHRnOoviOiKl4ryTC-;Cs zG81k6JpJdIqHzP=M(&e#gPNiagN~|}M?v`(B7#>oPsoz_BSc*T_4uy2kcEn0(2{q} zKNptO%$XUNIBiEbVA>&_52{=n0OIG)&J!m$NF~dscw^P%UY{~dYQ%6b7nhkn13zVT z6(ubMR``hHF{)yTWbJ>*tG~Ym^yo&=FMt-0eXp_d^`+D>f%Cp>(+@9So}r( zO_|BIDuk|Hiy>8SNw3AyE#1uUo)8!&zCP>aQ&NONRI%Ee)oh6yqLQesT33|1xq3L9 zF?Pu>#9%RSQqjnat4fE?Ro}kUFbZ37D^{!P2xCfxFqX||nJ-w6WTMK8`gjWrkW2WBs}z>LKlB0EYh=;;T2T++fZ zb`mGAoQs4fx3Mz_N`Ax)XMxSkhy7$qKB~~D=@_3F!9uqb2xr=&Cl2g@VZa!pWZ3och^%cQL(@E#ghp%TV(ydkL2s-rqV20fc_-Hob6slCSJb|@& zhu>H$_H;zPvX+FcdGsEQ9T0@Ad6-DrSFYQtPTfbu)R*;#9)Q#YTWD7CnghedtxNBi zIrnL^UE8VB$Tc5~` zeVHkPmU&?NYPOw+BFhpZ$`%9Hf)M0IJ#z0y+tgFDYS{ZZW0|Cu_c*$u@zCkJN=f^= zY*{EV9~%c;s|~69d|cj_vfQej8k2_ta0NuUF3$l1!JnammKcGsHP?dZFSC-`Mej$Q z0cC<_Jyk`6o-%NZi-Z`-`lK2-nx_iIY`EHYdy&-UK%|?wk}Fi$HiFUA5(Y3n^5=~J z$Oga~CW6iA%7K&<(l=vh2>KxI^bAMj4=x3A-UV&YYsSe+k^zWfCG^9)qV2H$`KUz& zrqN_jUj*ezxcGSvdti^21s8&wJ@qF*B8oK`-8BUtE2)R+p)^o;6rqo1+EpdvT1eGO zX3D4tZKNzqW0F*6hYJ}h(fgbC#Td{wWWbUxjR^Qo5M4@u9b8a&{9}1(%){1Ub7iP1 zqH)|<)#}GmSfXnI?pbOjDO1Bm;QVR_42DhKrO0G4Hs7OIxjJaU>UdB6M}`~*Rn#dH?LXaF*aCxDc1BHOI2tq#(jh> zB^}Oy-zak_h#&=uLMfN2$CCz5mcct(!p0`4G{wv6RPZ)3_B%U|T!1lK_4ct^K+Hm# zZy*CSOBUG?Y<4&$E;ata*!~xT@Ev1hVYmn+peFW_BC+0fzCOh0=pZl~y73O_ciH;g zjSyIRrSWuA`-`^%YL$s3b3Ft&7LvEUFUSUhz zCGk;7+-Y#u>)IAX!-J#gx-OizJZ5p7NOWNHW1X%*ptJm0d z^;ey|SdbVS=3#_Ys^7C)|8I7`DF2gPaxb|o-91Eu2QmS5A{L2}ba$||%SX@Y8>3qb zSAZvq%CzUa?R|%M1@{5c)he(t0&5ir|5xmP1NkHN`afb95jV5^5}QP7fB+q>@RJMh zVpf6BFj~u?Ep|~VH}QQ1QoO;M10Y_bU%U7phWSqnx?bzN%6NGSuRl`N{3F%V>giig zY_P&l2lP;>VQa@3wJ~6){l%;{i)Q?W@45Ly$sfVj|C^im_uRk*tf*n_{2C^v%d^sr zt9PxiY(BLESeyoien0LRbe=pE=UF9muM)+8Wtx1q-O0bUTm08{!`bh)V`Y?kk0Pkt zQuJrL;_}%oi089E9Gu<-`kf$Y*W&$Bzta3+M;AnNXUK3i{9k>=3;wIGlRx^J&gZC? zmWxAe3V2^cR?IZJP0v1FKe18CCv11^PBV4x&_K{K$$~9#V;A8HpWN%8;_+WxkV#ZA z3>U=2s_cwDw@EUUkk$4cr3%(aJ*sH!sUM1`NKd#VT%@*W#=j`|MDlLnx1!& ze)(6V!~Y@Drl4q>mMqP0{$+Ppys$R2OR*aJ9OHTmm zPSR^CfaQva1b@-ah&XvStQ=P*W7s<%ax9EXy8e8d&XxO#|ae9My6 zycSASW(P*&CBD#frwbj>nKEp^`-f7ec){d9maTe+aQOr=oTE8|Z&{vUPGqpSTlB_HD~zf4#+J!wvZuW$5-pvbEO zju43&W)`bgowLk@qNa7FzbJ$Ln7-~^Pk&6$_3n4Rrl^06`f)lS=@fr&lDJWE6>126 zLkv;5B|}h}1o=sm1lD!b74&}*7A>_!o+*Ddzde~hGOjw}n)7B2NYFpJ%yNSW#iusz ziXCZ+Uemdo?w^M8pUQ?3uCJG3iav=)FAq@o89?&=C{5GwJiV6R774rz5O$bn=hEB4 zc5>$_wbh)P^uJXLskpx;Wo3NaeMiwH>NpoU&}-2HjFQ?r9^Xwi_x77;6BY2|@|nFh zk-irUWz`S=LnzZ?x4zUBfAt9?VXFt(?mApg5B1khRm_PS=F4@H5s-A0oFK2oa}g)|rIq{-e{#o1}jxmp{c^CQkG~1G?=`Zcqu@o-gPamk(V# zP7PX007^*{6+WN9eP(*E#&RW41UfntfBWHgYfsBX(QX7UWv~Fmb|`*Zw;O|zTW1WG z5->M>WSB09`(?iO4E%*~HB&D8JM8>vhv-l`4}CX(6+!<#x{-=L27>1*>QDE4VLSb{ z=G2*oOiHut%%_jSRrwI`zw`h&QMNqXnA%=8i3)!H6@vjb@wCv?p-FKk+ zo;d3ojEpIp$W&(CcM=`zN0(S>K@lG&4que|o^jIN8ON`9^;6k`gx~JaG2X z)j5EX<&oeBu7Abk8G-AoDbKslIR71X{>veFqW_=YJq4GKGpZ57im?~2Z7a&|VGK~b z*OWRe8#B+qT#4HLx261xAQ6}G$L>o$4ZFHhT0q@uxWsWNE#rCIqYG39%6U8RdcOZd zPfmh&oY8KNly_z!WL)i)zYEe-(bi1tGF3CP0`%AoyT=);%YXg@YU%K|}*Q|4%AF8;_DRO-ZKbPyUe1#$unh|Jzfg>sX zQgCtgcW>0z=E_wlCuAZf_Aqe}mt!=VJ7k>ezc)s6BF0#wW@%gd9XsO(--3E~P{@%c zQ9oyrdbX*3uTha5hT1jYFk6VP`SDfNCBZGhWAKggcRc3PYzl-b3;K%}vHr7IA*E=U zcLaW}WRW_@;}>ZC_*}-MnXVI#82aBE%3*!qGR4XEzdFgrcY2WhL@Bz!AqgXT1?o6yo^X6gJtb55Ums+QyAwi8&9z{H!v`t>Oc#i%0CG+nTBrxVYlfG}5yF zmIpmBIHLk9Zp(u(7&SAQk!R4S+^}kGfmWbTG5`otb~=H3K8nJwF3B>qXg=;6Me4ec zae|!re9_MgGze;B7AI-$&?pJGFR`E&bH*fdd$oW$lhyFZV+tRvU&f zXkOt`pFeS`31ca5n}o}e5^~Vf^XVJ`xHp1{^+u8Gc_lbHlBSGpLO$5LLaYjx<`J{+ zcN2t&p9YjBjuJ@Yb=DY2-p@o)>Ai>Kzlpo)NT6@@v&b>ZcVD84UmEE^O<_4D@XIIC zJ9S`u)cP_oyB6=-DMTYz}!uyMm;jqa%a9iamaP!;NqKm(fM7r3lZfvTYIKJ^ohMM z%viT^euvItdwSTw3*^nZJL2)kdG_5LiPus%SFQ*z7(1hy%)=d z8DD}GW;|!e#K|I@#IT7tyL4>?!#TYwC5wWKwoaqalo>l|BX8qy*h0q+1j4=0ztSI= z$J^#&gf(mcp%Vs2c5GrBVhZo;Yua{cUN8;!ytU{Hx40FM^w5?4MQW072x~-*FW_G_ zi<$5ANH9BmaCE*|5wr@Hsk43^cRoaHONcgaf-f)Uf2B(lV{*2>BsIgiFA@m-)S9~Q zg%eqk@OYi#>afQL;WiPVt&f(Zi&&uz&xfO%lzqbR_jsXGw%nl z#Rvmas+z_CEyK3%6#DOqZEhc0UC#TnIy%dLx~=b7*QvRkqMvC}aa*4nRIOIfh10rL znCX+tx2k@1$+62>=4dOBRjl%MGxEi(!WYgiUako{j1W5Xo-hbUX&=6?JaO`^S$146VDj zZ=elth1I#{WO7|P{QeLEhGCf+h>0Q!df(L}KeGY=CzyMzF_^B6wk1 zlu%e~C3DlLqb;SkGIzy$6?O@9ck=x5Zw6CAYe;peHdF4+kaF|e+?F!a)^9MRV4rLH z&ci#!CUr9{t~)~-Ni|RiqbPtj8T2qCioq*&gr0|TEh>u9RyCUo2g2jD$cIt1VYKMe zW4FlnmTn=p>C?mFiZ9D8@2fDz7-86#@1;h6t~SO{;Ws&%bM(BcA8<&~wAB%-fJ%#k=@Uy$XtjRd4|Ez&qVLV3v7}SrJOU zGesEuxc8T-g4%4{m;eTH0wu2aWO`2a*RO}PwfX^CJgvF?_P=XWBaCLaifKQ+<8D+VDVBtu9J9OqqP$EkWA`{q*V%nHl*AiDc zr>S%s{go1=xQzk#0j0MZ#mvdpzJyA_1L>*deuqtM$3|z12ziRxde`@%+KOP4f1hj` zBD3aL>LQGdM(L61f?uV{{kErk+L^lgbI^rso=sOUi3~{+wBB|a*2=GNXT>+ zTwBf%_aucpefJ!fhNcpx!ua8ybExma?6a^0BbyLO(IqQJjn~%HtL%*Npy(wNzJC)SdHS@eq*<>o~8YPEK=^nBObqzEQpop3e5g ziUSx_Z?`h@5t3Pr*Hyj=Oz$-WYpHOTt-2<|x39rgI%;xs7i!EP7RV)R(@6Qz4k`&O%wZ+ljM_KkdO?uG>bvgCDphqUyb0?|jSBK!W)pwe z%UQZda;$uXy#QC2n}ofF+^14fPnum=CS6~!x+B#dZIdCgL@rH1S>o3KTuNa}nQ+C+ zfvwjNGt2OMcFNC)A|t2GJw2Q*BOq}lw}23~A0Mw6eV(@mvS3)=w(|mj_)guu)>wn` z_B>sYDbv>t_voKRQTAWWv)HJ-rQn{lN_EWL!!RxaK{-oM!l_blX!PDv+GtHM-MtD! z(hwzO;G!R>ooYmnd$arK5$GSal0?SbL-ti=LjZ4XeWw+IwG1_PzF@v$Wo}eg60<@F zYh`Agp~^Z0y7_1r1jaEUMBK`iNXE%LgGpT%xHP!lZ{izkQ?n*u!g&!bO@1BTFA*bX zeE2=aeVAQ>8H;YMnPG@3zaGsXn_R`D!ufW~JI7;M^hJQjWsqG?od@#%O_cy>&;4di z$S!EJ8Ig1RgRZ9cUxh$xrf4Nttm|{-spksNA6?dcAV^)wK4v!wjk*P_bMAE{@Yc0! zYJb?{SNDp3h|y8~{Ouem>*|1Y9sTA9pVRI~iO5QVH~j)}R}7+h?29IJ_(J^0ZBZ4H zSX8eU+)3#Bh(RW4Bn_x9!nks|5R)BHx=Fj^?YR=MU}72rEhaY-LRR^>jPVdp*!dJm zDrjoLhmWeL$CAPf!JaA-{2HRXNd*LQsz|05A@v_f*KlN{dFAq)@8(K_0OC{v9QdM} zj>WeH$Uh0Hrl2#Va4N&-O9civJ#(c{Yy>@xEN6Oth0<273QH`Oqo~f|xYiu^ofWd2 zZjs3y82f}>flyS*r0Jx46;6N%(p`scI3C8LkJ#Z}er485=e3Pcj4Vl7MK+)G*<1J2Vt!#pH7d+n%fDV$2kw9HVkvw&D3Yr>F2#;wq`Z`jbFA`(iiv}#&*|l;}GcrI#$EQ;XCZyhBSk%6S7BnsTnMa|GFE#_>1Rx+EW21?S0ApZIAUccx0^2Y2( z%ML=fV|12>xxnn^5!)&uTN;)EAzQ7S=H;bn*D9B+=1)Q#bz5m2bLHk|Y*-qz{`Yvy z>%r`9RkvAf@)sRKPFg=owe`6xZ%6fu?;c0>M1QQXy(i8fRr`Dgrzl4He6A$f?|?LQL@QBUWc z{6clrIcWDB)}_+OBFG;{Qrr(I+|4_1PWmj59I1&ySHqmt$yp*UKjE7~Lb6&vofk_# z@TuBoM7-?^r2qLqlkSTbNuI8(-tDo^Dqw!;r9k2IkyhO&$x>fBEupV5QaWu(`Ggi@ zDU9G7GSdf*Mbno}C6-yGAx0i)4U)|t&+&Gtmz1!-)v(-tN*}mIt5ZjHEh1$re>U~I z61cZIx1XP2lRzw0W~%JH_C$ebCECX?2U=PanoDL%Kb39sIN6L*<>H(IzB}wSYi{$r z*D0QH{Gqlcp7FbO`%ILWb(@-q^-&F#kJqauiS{@b8K<|K+!)W*ml?@X;j=D%x|bR6 zGuE@&`;67?0VH0Lj$I%1w3v4^6+>EHIaE+kCSvt?%bp?{R2MR-S)0petoWTZ4-K?9 zhw22+Ab{!(<*4s1jYqPU0b)zsDX{oa@w$CcwS(G%U_^9LDh2H7OhnSgZjN-EErAiWXfJ(Yt+ z_I*u)z66>i5VP12jQ9_!=Fk8lvmhtOot-n81~aC&%UcN=doB~_7jN#=2d1WG112da zLq8#SY^F3?_bKfK)YI?sQvRo;M!2_mX4Yg2$&-A=m|499v6I{q5XNl+-8{d1AwD4M zLa?8O6<&p4;bc&JHDgWx5ezfTuW)A@D+(iKd*p{`Q4XX@9TQ+v4Yo_f%WUG!0q;US zID>m}w(+~TVs@^D!$vb@%Ba~pMz70A!eOO|r~MTY1Cc{u-81V21rrphiK=N-F5iD>y3AWO;cyeXskl&34(xJd?DuF7a%Haw?mDoFtRcN;f( z>}$I}h+;xpI*Qtr#k*gm=OReN?eIw+81utCUYC@s6G*uzLTo4%(otm^|Z^{vxlbbSU{GAFXe0N@jsL_lNd_l4BRC!hcl@i zz2%KLG~+#U`-*GQqPilV<~wgy4po`6fRpX^Dw4ZLc}!$W>aBSx!@e!L8SB2e9xEC^ zjfW}#)&{e7DzLqrn{eEMy2<&6wk=k#AXc5&`h06MGrCxEl;dbx@WMD;TiNj>0KUrz~pzTElkggtRO4A8pcf-b(jnY_y z?Ag=6ej9H=8>Gn$5g0u5Z;D=V#t$(|CcI(^JQPmc@chiH&s;1(!>X%P13wQ^F3R?M zOuth!5RF0BO>|ewO0eZ23s13Z7HlbVQz$5FNheK&#PB0xXLz&hjxcSXRD2#Jw1W#h^oLcQWU_kMYbH7W^-qRcBWrS zpI>7}<1@&3hMZp)j|%w9LaMof6$Qh^duFDip!uALC8I8v(_a}5lwG@+53E_BC=4Co zdCniXiJJ0g(qlkTx9xGVi|0wVV zm-!8i`&Smt$Dr#DG}Dn8lIVklF!2=z;;pUlh~u)J-(l!nA9~l!KU5q2q-4Fha0fIDLc1W7y;CxGjleOxQqU>s&=%l%uz zU?L!1dM!X509>ZhCk2Lp8eknZ4u)uNcOLdHEzpG^>4%+e5d1%FOqVD}D{E4uuJ)XD zFA9Xri)~K0cLS9i3f9j_5+QaVSICcB2GGe#HdMCWx}QeI-2Bp(YN;S{9>O{w16dC~ zt@(TJCD1TOD;1bqbxGCCJEZGYfU_5`9yDL7b}awuh&F2|xFulhuO+Cm!+C=|1IbrR zaWPgsbk1Ao5{(^jEoC*EaYbdDX-6}?gwH%y%(7H+d9QF?2wyoAm>#K^zIn75i%rEC zTV;hz*>Uoj5#U>Izlk>(TS^tIANO?-Ct2OW!HLMXC|iTW*QTsn0%PlH4vCq~3Ic^W zGR!JWb@d_5e7h}Ot6cY4zC#wo3ZC7=p;Uf@Q>bN-KjwO@s$R2f^u#uXz3FFr{7v#% z4559|*%`8Qo4`YjxvKUodql z)@5|I<@dXNk%e(XX`ZlGr4cl4@Zpk}Z_So-Nz)5TzygmH4k?lYtN>6D!Fj;qDB=Qy zB9#2~ROOohv0*~682zy)yM9VJK9^eoH;dY5Y_0g)+~zfoKAXZzNTE+@{<0T1N#M;L zzSPLDs~AleY1a(BrvC^~*VlV5cXy(%T%g7g0rS2Dm zgXVCl8|qoK+*%_H!8>WU362X9X71JDsZPyPo!V0w@i~#%HOj`yDN|eU7ZS~3QaS*hicIYOxFpCaduzD z*(}-9iTJ^x-oU-E<1+xq0W7g*BwhT?9l_s3L%(^ooW3|p$?)k$Aw^FSuGh!7HHJnT z@!Sv{C1(*SKSEA)95d3lE&UF{hMTXI<%A-YhS=$;kA`VM zuC_b1j~HQ)#VW~NB+s{&;w1ddiveGS{h{YuZ#2{z{BHEr)Q4o4PG$JALhiF-0HSUy zv@$UbIPM<5Z!PR+WNC4LGlp^{_rt+N09?GR6q3~P@F0xB6cozy4{2xrbxMNk@X|nf zFdqT%dcBED%K(Ve)f$zLV0Ehws1pJfuHP&WJGbXh)>aUGeSEOJ`xYfi_!~#=`Mbq9 zIq+bzmgALgJ`UQ#IYF*HdS5+l#`+n)Ka4ACGA%|F+K6T1^A>VP<1uw=e!oD;af{DI zXVFt$o&{XXiZza~mN8i|#dnpnBG68^18q_Or3{btE}uVeM)HsCb+4fN_?Y0GirXfh zfL{yr63cov;`A!UnW%-xZ-tyg<4%P~8*~_!g1G187Y5&zB$VuBIF za$r4b$?-^S3+&|kzP#AD2mwJ`Mw~z-(Pzzja;s+!i(Mmla-VD1m9pk0D93r8{wjtGe_sxB65(fOGfhQ;{r$$_5*dBy_ zgIClBSyppA22E94X-Zr-DHTnqFW)JgYR9_L=f^hZtoH-1}f3|xs_y)Z{ znq=rCWUA#rWTG#I=L($1i?|A65Z=e(HFY$srM@x{zF%ELLEU}eOi1ay?3#S zdOJNmLTSgY1jhKZSS8tGq?o#P5FA!d;e|58Vf+Xdj^9z5BuKI$b|D)>dqFlSb;Se@ z^x!e~>51@Kzl#_?eOE#OEhSE$>`lvSEn*BiE(EYExcA zVGoz=TvuGbFWC>AJWgyRaSY0?dEqH?_jQ^NTGS(j$dsnZ3R6{Xmh(eM#1bT-KBtl5 zz#aIE&`f;3`(iq?B!-tSOeVIoV>=Vu#>BR5+qVCF=bYRB?!{F|s@HN#1@=xmEUB%CIE;|;!UB+)q8agVD6WswEe=^wf5BJ-+gU+l*3 z9+Ri&AU_)m?UPNk8CR7w4? z6JK^W#mFpqWk%i|OW@AM)+eWOO7Y+P@WAQ+iL^i*O`H!r){j7+V5eR+Mn?2gmOez_JyjOMF#CS0DKC zD1J^MiaHh^u%<*@hODP;q56I(VO7tZi4JK7j^#x;8goO_LURRlWy?NtN3GwcQ};t@ zYh!;<5Bxk}|K(gtHF>()n}lQy=0OP&E5ZEayx&v3rVm0Q>u+BU%`sb+M?qJ#3L^D( zAVr$INjq;m>Yz=!B)$06uFb=w&Z((+yMG@^oBlkVqt~gOsu{RJt)o@Q)ifeiD_aTQ z^zobpb`{!(%%K+{0fqibda@T~`yJrkvT_OG_&2O{MtR}h)AfTS6E*-|)3 z-%tAK07!n&MD!Z7HmZPB0bs1FEQs?NdYeT0EC{yWlsbi9SahloWq&9k0up&`-l|kQZ$cm~uw5@xMsFjWhE4Wr8L5DxRa$-b&*;cm2g{opY**@c|fd z)=pSiQp`a!;B1`gH@Sa5@;&$oEXIXBGPqAx&Yi)VNiu5IYeg%}ddBOii%CW@LX7q) zsw~fA@~~SL48zNwp78!Lx^@N0i-`U3*z-lIG=Rg}d8ScLW+n{3u)JbGF*^!{0bazq zL}IGHs?J2^k{Y~)+o+`L9H?3k}Ktz7SkO_@&5kz|-E; zCT?Y3axk2KKs^M?YTjJ_tV()+@PzOTR*aLk0C0cBdRo*@A7&9fY{%X+dXH6hiCP67;Aya@ji*KnwM!Rq3z9ZFHMq1B(tl zCIM-0h|h)f&fbMV(wEH9wZ}4N`X6z{VaDAf0rX2`Pj4@nPsSQ(5;yNR^lVz~TTOo} zn6pw+DT{8CaLsi_E$xXGYeuxHq)m^G70b=;2{dwk1jhCkCTE41GOQOA!M?w_H!M_r z<^71XTIC~d1(yvs2uY-nXFbr|A>AMUB+JwT`_?qo%NPpqMzrQ__4i*9Jv#0lty#2l zUVnsew1Zvt-ALThNc4T%1v4Oa*VRl6vnMz9U!=sQp2|V@e2dbv7e~D46bcpM_SacjDdbqT{|t0%dFUfRoo zF!(Vfo`xSKY|hXRV10N>C9wlb9R+gK zxDz>?V=2ZPC0Yk1`A3LLf&xh~;mRra^`#uHCD3XprfFw83+jY(>rkwFQ>7mdJPhQ_rBgsX}Jrl}UCsIEt(J$2~8(r~b0he%m7-3C=B@w4rPI2^l|6 z-hp5hx4cUg3~IQP6f~YeR-3Yhj|nJEAwnDTNXhK8t^c*oCM3@QD)f5xE|l8E-)< zo=Kjm>&(2F~u$3z~!(^w1l-(_UR&ufx){ zMxH*ssC({d{8kCz=0o7W*GR_vm7|>8^EdWnz3Gt55k@Rhb|fVi!3g`sNKSuY{<#>o zx)_|Sw(P?_t(=*GZsnovq+_q4`w(qth!g0AF7!_MQQ2py8~mFuf`Bnhg0BcOwnNwL zl|ta0psX!S9hS|xn)#=$lVXY1{(+*Yc9F(xc|k1Ct2fyyi5L%Y3ViYVK3^?Awchtw z0m@auy*UcQFt)+XcxS+8Dh{96DnOZh8KPyV;rI%EvY7 z8S~x2;B=z+Vv+0W49DT=J&3FOOW35xbEZ@&-l5 zMSdBi_Xh@fv3NB-{lAVjfqx|(MHDuDrw#}h7)sS{R+%;aKsKm&Lms4#(G`#AOu%fz zRB*58KN}TY$o6`ul+-4#Cl3_%xopNZLNWxCQreTn6rr0uHxs+td7175cLDB(EqMLk zL-FB4hQyN)5dbGr<`ROt5yPfaXt-=WeIkqlj^Uoxn0%Hvp6-4l1SHul3c4Dg)aAEe zzRV?v2;a`_#0rsn>-EBf$%87ETNDjR)zI>%<~x!Uk4a?=ij!N`1URY?9t4)m#;ssN zKV!%Tbe4`~0YUeLaRr^%A4hBMKhhHR8)Y_pL+kKjMky)$cm?}gWplKTN+$}W4;QtA z1_P9txk*-CgDz4uq^mEVYK0xNJOkC;YF+L+KQ&jZhUK@uW`aqyI%de#@Fw*cZZ9Y{ zqN6gi0^Z>aCu{BwFFv+CEU`*k01fH0A;ecr2yYyn-;c znF27jV;901frDg(oClLbDy=^i-wl5hrpV9ErNMk4>L5F`OA88LldXY=iapw-BTH<} zd~8p9^A|?CYIYy337HsP-p0-Y!1(-)1>lUI4q@pQeuO$KlFeV_CDIzdlicBH`3K=o zC2x~q+5Tw6eb{&@_-ou?i=&;aLXHk@benNoG_w zojD_0S&O?qLrD09+`^!ZNX?J_hbgm;&+WH;x@eQaBHUrhGPJy=)xiy^p`zo`$gc2D z+l?r!(zrKOhx4q_RH+HVSx8&}jXw zO^O|w)36~_lO4tO1NKn0cIasYXP;4uCf$l}K-iBn$rK?#MN}|g zzvB_>{&xI-%r1CbRsNPFS>#_Ee-SwFOS`%F15$@gG!`Hw`W{1DiyZ_-`0zTnA7EZN zouV5oAN7SP_HKOtU{x>AYX0Q;;#WdtoUAIHWR&~%fyF3xLC6KP9fPj2So&$Vfh4%! zrjnegY|^tC>ae84Gy;QjPb=P+9~%Rje#P}vCNo?|2ZwjcO;3eZq|b)mI>mnTcr(bA z92xVz*4*}p#je)kBkdY{((MlGABFqZ=6G&=scJ?2N$@*mO)->S{X_rQgvPsf;4IF1 z9m@TCeT*qpat-@aqt6$2=V6W83B>}?9@~wIM2uUOz5*_A!kA7DF$>M+_(Jcg+YQ_? zWO3Ww!5%MHcTSE_xIlsXK~UE!EBohPe(R{KCf(g0PBu#QJlXI`i8OMCMTnwXUb5vQ=KguiEZ>i{X(h6$dn+(=9um}Gy-y+s(%s)@nvoGO>&@4Z zNSm*}xa(fwhsB2oNn7fv`iaHiTO;``z!JdR1z=#~Vt210%0s7Ta~~I;9e=0i`~9h4 z_5<86l!Vy&r)W$r-6hoYQ}p6bQlMlPuEb~{uK3hpx>b88B>$GYEt!Ukmb0u2Iot;X zZh#xXRrwboL`>tvB)H9^=4jo( zY9H_Jd_0zV1uZ{Hx~%l|vSDDh6<~`XKCw6`xUFF6fTsURUPbxE98pz@`Cd6|zNI`B z!5q!Lga~#J`WsJdKzD`k0mXi(++2lvs=@d^J+uuAQ;J5y#G@RwV$sM7^Fjner8~+r z(xk}*RMTAj29@sJn^jV6G40rWv)*IEu#*W>hL6HH=hIa_Y2WC}X=oIaE($)m@}pniivE=KG#;fJoo za`8jai&)PgaoL#rcr?;rAEv^Y5)3v^PT)E!z-8fJFx+*DH&5ctxprOls0ls#d5sZ; zNZU8{tORlpp}ihW!_`7HGS7yA%SnRvky}1(_M*^sL3GKUj?>z)DH#7zA6c2@T|9k7 z@-ib@YTlIuu}`M!`|HHPvE2vkyKGemIX^a248EmZlB)ZO988zlfjC8FK%>CFOQjFv zBJiwLiegg&5Sk4XbP#T%uR=eCA&`5fJAw?k58j;nM4%0Gf#ldU(cajYX5%r)@s?q8 zKiLkiD>NjV?(l*Kia(>dZU3xyEU6u3w5B@U=y0<@#NmW56LkM~t$b+w)au%<{*!Bg z;67eHVvloxHu|r%FD!O1OX4>sl-ZD4B`USLJDf0e-C$cN^Ep6z7$AM+-W|1aalb)k zg(|H`ZJ|yzx%Job4kzqUmvH9pS@Ak(A10~oeYLaKu<2nsa)pY+TbsB!D_*gGVp=9? zA5dUKx+Q~*m<%j=bv=AZgtFu)&#*H}qe8K+b2h44^&8JP5|iXN`*hNISPIS^QYH~{ z`fPaCdS9G2j$3hff8t+^rzc8AUKrZ`Xx^k=d#6{gS$MKx-eL3XOSTmk|+ zv5Er9k+$C*!GG_Q-0x)Cu`tn6-4`K>NenWCm%4%pz06ZO=ijE$XK!$SB0GrGU55`3 zU6ejzF_LqH$@fJ%3=oZ42HHy=JP0aL<6Nj^7N3LH~GpB(&34hWJZsIMooT zsYDvnStXj%w&9oWFKW-M3Oh*f{F|<`eaiSFPYHz&ED+>4ll~d@s;Ke%{0%onneWr;@bkcK zanvgDp7-;1ohW+r+_0-%^8CTD#gOmxp;2b-L*whEb@h{x2%1ZAc{2-#_aTSY%9_J% z=fnGS`sFn=VsYbR@a){j!+Tt>NLl0@Yl_p^#02KJz1OAX`2#%|EM%+_bDL3bC&qqz zmMR;fT!0TRmfql(xNYC4j?z`vD15lyW!$2;;3K=Q{>S?O(Z$ie_#Q7+_+kC1U5%{t zW(wCEN&8X)ed}=#PEx^&pFUr8mOtd`$oj1g>RH!6&Vw$-o$e8oGyf6N5xVP9Zh~EFbS@-dD6Aoyz*W)=SqHPn``vU*h(& z{WTSrLo;v$zLsZaE$+6XaJKNn$s|0^ptaUY^I_M{jE3@2n13ZyeVgQc1^PU}qY*K5 zPw?VRM4f+Kyuo^G)9YZ8R-Au$>^VURbA1}2v*UVzd8q^!x7%8wg%>s5C}9`CbaKP^ zGR#vHM}?FF_47vIWu~s|$GLKqz=>ja-p0s!P$S7w-o{FbWP1oKy~iBlHy_&QmYs_z zbzP6SFJcPG{YqX(B#D!HMXf=!dkyBc-Sa#m_fzrviR`1*&-asaj86B~hq9{Gst-cz ziR+-?qBB*+aN<{`1kQhj{B~LHuQe}o%?XPicT{i3inQmhlr*S2?NKv1UH0&*FrE?N z;G!+JG&_xZGPY!^uS7@=2r-CDRh17{E4DQSQlnK#GyL(cR7D&1S+0!2Yov@!*{K#( zm#4q4{5rvYbBnxj-R>DwOCFscaMjFeUdIz{x)^Y|EM0oVUOt*ftV=h#*n^kpZ#0a) z(lxcMHuLR0K(@B65<0lyUK^Puy9n>2?%!yvdDd83B{z0OtnBNzwlz-gSCpzRoZd`q z?g}xwxPU*BG_-mgd!L825_+cRwKiY2X-Bki6SqCpceLMn+g#@B${t(=Wt?%R*s?u} z+d6oS1a*;YlYt061?H|EGj6<+N4Ngz@BCekPLDDg>R%?m^)8$2{My^Lp@B2ce{e3l znwld{%Mg*92<@_q3VV4B1TRrpMt-mzesjfRJX5yi^><=t6Rzj6kJ-pISG-_9XyEaA zPhT&mZWq_9{S|FIZBFVjU7N94S+DWOzmH6HxWT$0IlSez?>wt<({d}-8(gs-T#&V1 zH)dijO++1G|!U{)-UmgV9jGjxKR1JuxA=YNQUQ)w$4Bkg zz``D$Cd_VdA<)ne5&yV>l)b6P8KIBDsK3xmQP4p2o3piq{MnX~gJ~e%%IC-n zh7JL>@?j^b@?k3D69IyZLAkXYVw05Q34q8J6U?4XK_T)Q1Y!`W{UZJ7FU2n=FTtIH zv3p-#bV@yeLBL&pdWKwfjgPW5jF$GDHg_8lk)9cz`+*PA(&i_<$K^vOi)o=(Jfz|vgJ1HH+I8_8!%YyBm{ab=?^OkY?xx_d~1mKO~_iF4C z+>;f-mIf@}4FpUCNbH48;;vhHdur35#2V%&#jxwJK^5gq*19XtB3wE#nmS=+jE27s zU-&3ozn?!h{IWD3kY12D!E9>=kOUTAz0^8{M$(A3P{kT?7JmkHs|JE6RtjszpD`Z{ z{D6Muo9m0`lO~bu9_IEH^U&l(90^F+zYV!<&o@=bWGAU$cyD31mTo}6qU5KA`|(Y` zk%2L3IGz_b?v|&X9oe-uj|TURMn@#~H%p(iMoaR>8z+z)-mPSM9Nr`8ik@ana;zuI zeCezY@UY#lyLvk_%e%bu=ol;u zuOYRoj^-opA5E$$E9wD-W1gZpkpZl^jFZSYxg3!Y39FQJ>ebv*my$_(!FumK2Qv!o z4MMLUD0d7iwOMYWDb;E%|LostQGaB`O%ZjP@CD}!%!yQ+W-92RJwG$xotJ2w@idx7 zj#j-^OrH^y-cPr)yY>|sS!!fD8U2o2tBpqdMwa-rRsfts9rWCbxqv;Vfio!8Y<(nV>Bv5pyTBo+`>SnMKBJgnHxFcM1M^gn?mBiF);7AcQl0ZHv?j}lubzrE{m@$gdtEk=RiXmF9QH##~hD29sQsGo7 zoOgkM(8C}sJg3>U35no;-q^;2A{5#is7MGKo7D5W73o9J4$ZtWjLQWd7LeX}1uZ2O zVT&e0fVKte2ErLYvzbQ$dqtCcsH=$yXguuOB*lo}${k{vVmzwu9@cZJ<_KP&~+#!N5({|+bR-&Pb4yUN%rHq?d66Gh(OA{(WTOarC zr2IC%t7ov+p|VVkOgZS6VY5@g0F3Vs1?ZXOdzxy%ty*kmD~MxM84I+pw1S4h9+7xO zqbl4tS@lGoaZNWA0?;~WxktZYB5I>Gka_AbR_ueTVTT^(DeGvsKd_yI;wh>Z%NW4( z9N=egP@=0#+p2~1hvm#SJ|K&kY)+hQPq`S7DY{kPLihAULG||q6fQO42?}I^^}#&x zG#mfaSw6q{LLK6g8NjX~Vw87`XP(ZAnWvX5#^&U80?*HVCKbaVj`owoHIosKmJZFn zu}D$zbn69nzfj$o<4)!7DxRaCN(+}cy}8irbjF^`(%>slw}e#TNhB=Gq#=IVNXykn zS&RmiMOiGe{KoMt$D3q~G9|45;Emw!A&B*Ft|_V|eD7Yx7x=JXA^#_eETiR9?gi=h zARiuY6X)4 zE7}4e8!E<`pKS2$@b+J{h2F}Q6s3nX!v@Jl0YJxZ2n+y5I>$mGrGG(n(pq_#wYA9( zvo{L4nB{trHUjMo$kU!pRgOr?ko3E-QPIZoL_0NJ_THqqos^+H2}EUx@Z=D?K;Cg# zX3D>aU^v<7^?q}<4<{0ghi@<>)?Jk3XuANvP_}Lra7j_ znWNppHkx$#%PN(yP6GV*0$dpQF8>ESo-ScQMRnS}@^ZfmVS4b5kin`6bdOuYD(4|3 zfMALiJE&&c!regPMJdm|f=ohB3oj(AhnhhfSBmRNvutSX!Pb{2Hy0b4ww5kBS7s~7f2f*{Isn# zl=>Q3EpkR1Z<1??&`dV_%f$X&sIhApK44(#ZQf#^0f942e9IRZO4xRs#032;8uyqx z4gi-476jF2PvBc0yZ7XO679={U%C$@6hW1S09qE#kQ62`|Ali@x~5^(u67jT54b14 z4gD8ggKyD5wrdWxA>A48?*t`i;BGWnBgSVCvIM?&jI|`=c`v6d;hSlFKl;;NQ^v2W zT8RJn`8GBhhbG&Kmg)GM9qWNYQ7}2v39vmE+R@O9Sl%-SL<+(g`MHYixLv&f}|Vt#JaPA&6%T;u7Aa3{-&JE zt`9TH!3-fca2914ChTDL=DTQO6c%Cq5hmt>uv==!PFu(ve+YO#VgC5G{5qCg!kvzkzW<`@LnL}rxxIaD|c0+9pLD?@$ml&*58dY0Q zT2^o)g@n+z^Rwj9!d$QfiIlqy7K|bXEFKbXUoR$<)|l$AAgjGc{lrRv$+v0-!_b67 zOga^y=a|E&6aZdj9dLj_SA3BPfFmbkknA_R6XMrF^AIhME+7TO1YzmqFdItS`-S)n zdMq4c^7g%1zRoyOh==I_rlo2!nWR|a_<}fyjA^#us+9c&$|&0NTOnwL*>SD3M37}; zLRR8O;Y1Y6qZKmJMfXNGZKp3BGchQITin;_QL+`ZYfVNlLLCc9=aYHL36vB(pt~s^ zy1@4r!obbGtcgOad5gQD2-Kc794)PY9D!gv@wF#b+8FSy{m+^}ohb32STzN)YKEfr4sRU@`!MA9`nB)YY{DpD1W z6^gkjY2VidzBNQ}I0+e>RWQ3i2slNF{W?@=u2W<0s1ZW81gVy7N}Rs{a3T}RT)J0*CZ*E!x5IU75nG2k zxGrb4XZR!pg;zxRB1CN>f~w9u1TsK%{uXn2>Y-K-rQr@=V99Z7lcf?JW`c~i zt4E~!vw(aOZ1RMzUGSwQyERdG8A(+=_*o(5vWU{X%Ms{w-I#DuAjVjCAh(sGPrnef z{9s@op6i<$22!+P7}TI*;8hb)gj0c}Qx0})mkaM$;SEQ;e7A@}c~dr(WjEbYJt@%$ z=JWNJ;(=UEZ6FguYS|N0~e|!a3S%R5kJSj3(qu0TGt2FQ4N zM#YlRzs4AIYAvI+7JXxMv;sK=ZW^TLZwx%iBVg&njvSCLdJfB)eLy&q@Kjb&yi6)G z{@|T#Cd9p*BqYTQi~@PT7bAjrgkfr%0eWN4Iv!^$CYR28%v?nv!qC9!PQ|r@_cWpj zR-C=WsT|3bZ){J6!19$xWoOI*67_OmEc2WtVp2>~v0Kht^!}?<&}2@fFc1zn&XF&< zrD#%R@Wb6w4i!N>^0l&I!qE=0TE40gH&$es{*tP~g3Kh>a$m#k{fsnTes6}5J%78f-( zdKZr?)#tsN7I%A2ErGJRQaxMlhn=XUZKK53Eix%i8tQin2+@fxY~2$Jw)-2i6eJsiG1_G1 zh-!&IxVwSZCPp9^tA_NK?D-eRX`1v(6LrYfL{ctyDJ6Qq#`n80kHVERa*D0F#fp(V zW6J@=Ae!znvHj5Bjs!cXj`>8Gt_@`MZGebbPrcjV6?c5fl~L>pQ+#pjSwBa}Eab^& zhPoI<+)F@j-U)Bv$_uXa2%cA0hXY$O3#bICaw; zVm!j{n;H2M3gI>~+B>;eIB@2MaMv>SKEoXBvOw9(N-2`vGJ!F6VCR?|oKEoDLxLJ! z0!~3PL)&a*lL`vF7_x@5Uno{B`nsM-8d}^RsZuqmR=~52n5>k6tQ`gmhq80zSVsz1d0KcBa?8lCoN*9*E2@l z^XVeY1=5gUO4BH%(suWd^D#>X3&faLH!930_0<9La&-aee6xv0pnU%O#@4Nu(URCt z@g-0`EPXF^saxMAEN2d0tkL{J^?wQo*0~edb&<^`YV#v2Uy=tBc1gbKd-p7*xvIn( z$_*17M@#yC>W;ET*y{uuHQrkNfdU8$lD9OOQqYuo{`S7rv&uLn z=I?PEEt_TIvsA&uii`!62=;j1DPtr;_DK+x`cqV+L`#6KujnVq0|a`gD*>$GcJ2i3 z>J!p&!MyGz6W{(3uU@nU@7;Q2J?&pdrKfL6JyuXKXx1iK{pqpN%M#G z|K)wMtO)*Z>Yl`gWhU%S6gZtj4Uf7@sCp$3?1q*ahyM#}P)~{x^OtJZgc|h3FW5b3 z?h$6(kk9_rax!Tc@> zeCQP}sDD@(_+MpzHBA*$)dTs-SK|<6<9%@+n=JUlGh{L{PpWLBln<&Lv$*NH`(vJ@ zNmBc?V6N7%ki1;GxC*^VL=z`3dpX^VS)9K_awBT8; z@oJK~FXYWk^TH|S0uVw7cJ2nsu)0r@ASvE8Eny(EhxXvMU{7_$i2hk_W-D_SW$Wge zfnv~V7^GG3mkh)tXo+Ka2yvCPl_+)!Yj&;KVu^wISs^y2ZX-cdbufv-VAod51$v%| zkuzM=gTwc2XKcc5m>O^MovrP>inwn(#PVA>={hyD6f z8-XERd@F&W_AWhs2gdnJn2UXX*`)vgF1E0JzUbCDTlue>N`NwAirDYr?_GHdM@>#N z*fPP)0MEy+qo#|nBkr$^TVhZh(PjgcSAnHzth8d6<|=c zAfA&XebmGod2cE#GpwevTKzpw6UjE+Ic|Qx4{=@GQYe)cA^XUVer4NOtr>xx_x9@l zW!qpMNhz3*h>o)CPG4%4{`q`Qii$m{ym_E>6aJ*2pMXqxUIO%9 z9mr2K&`18}wd6N6@xzu&w2+8BVeMG`@(P952ml@$*fSJWI@j}O; z`Fl$xF-OD zb1YG6dL*MM+-8Em-xW6g!H+6_>y>SBeElp%HP>g!NFXQvK;` z#9fQ+c>9sL|Ge-psL&VfuE+^lo(V?^XpwlJd8tsKj%f8;|0Qr$>dGT<0z(lXOh&}c zBDbT(dBLLCr0zwwKKYhce~8ysh#J9rR1v}(b7y2WC(My`^PY`@<@Hj&Lf}NkoF_p% zR~+zLjQFcT){uu{|ARvohEa9jUi26b`74S7l-UNFD-W|MyQ8*mphg%!?1zE}|(}o(o)S;7ZeEI`0M=CS6Q?FWyMnay%hZ8dk7AP{baQ zj(SPC>?w2ROe$LRa8rcxV2*CMTqW~9AI>{g+O2j2L?c_oR}zC+bkpoS@5vpwY|ESx zDQQx3jc!dKd{B%kY&nyc6~jp0+ay-g#s$Db;%?LzR=5?0e54|#i5BITvERPR=W=UP z{HcUCkB|Z<)?fmbg-oX?oe*zYM9GFSpAqO5VsF18h55=T>oV!rR^e+fgQ0}LaacgwDf8PBh##i?qy{i9RB%#NX?@Pg6jNek4WM)Z+d z835r3HuFVMKhm`+G7g8VyL~UZQWTjSO zkpfHpHc9OaqliRGvB50-=3BrgMIV}8Y5yJIq3?REZomnDLdB#&gZ@K!Z+wFdkCMgX z>fN=)S6Z%`)JQ+rQG53mVpk%C!heg`9#aS|72Jck;3iswXaiv!K6WaDoQ&D6Ku3;X zY=WY~?Wt0_N?n%2<>7=i)~__byH1*RZ+`oG90<5*dQkgJ2oW_L9}Ce1oRVP9JN}cN zKa1v!pNHKi6nA{x1wx* zNvhwKa zaGS1dnL@di2%yMAI$yGdTxQj-hXS~4!16lSse_zSxK+-xClWfi)Xy-&}BlE_BMJO2s0id{AZ=WHqBnl|wEqz$xX zonPTxksvaCB+f|U+vV5jA>3)^lpX@_<(XT5kV-x<#|>rLc^iF;5tkx0kl(0=PPc{M zc@G!v6DcK3K{|k1$Jc({lmxgK&Hf)toRRKNHQJXRndk@iBKmno$gkuTcx;H(;g*x9 z2c3Y2Kj)JjoshAwG`O3BSztG_BpJLRb2?Vmt?S3d3zA$gX1Gw+Zq{iGx{n0Hl~U8~ zlJ$AwZ4k=WT#uO3Fv1c?ua$Z_v8+2MSQyZ4rFpBZ`0Eo*w9`C~UDv-U&>3~eyS|_I zjQ}o6KSp2S?de}*wELY>bd4m44=Q`tR`CurG{2X@v?K;V%7R)QJkaN3FCt{RTHPzG zrVIEm?>I;NHzbJf3_PaNKHkt_cszFie<*&2g{m~Remxjg72#h&iEQ+gH%=HM_3+)ALSWv)-l4mSL;`7I~;35oOx z8?txSf2ixU^xHUsZaSk!tH_pqwGe0TXea0%oEjxs}dx0u|N4vIXq9E8d9N@R}jsODx^y>xUHxL z5m>HYrmm1LV5FZf1R{<6{M;h@vOtGK0;AL#TFSZsmx-*&q*C0Y#d&uC5RzA z=}`vyF^Ups^=L<(&I(bCZ%mltBEb51EUSa`)$3$@|7(B3rDZ7Thn!^~R%T;in$%cG z5GJ3%6w!`@Y)I@~(Oczz9$%Y%0%uL^Ctg!bQGG9b*+6tx7_LEV|NV!m*Hr6_@E`N+ zd78FxQ%mYrZ)0NcH^Ys#;(*6A#El}aiX$`6qpkL4%PWKb?D2?AT=R(4rs)(^7k0YU zUTk68ni)D5S9DZ2QLC6#WXhx`SJZ9InCudP${bFeT5{7*bMq;=-=)eDkXn+~{(sON zudTn`|3Y_mPto41Ql1_Rr{4IyGH>d>Dqe}8A-AUIxc>e}N;7*D6p0$g2SH+`pN6*$ z(l2x!Ya3hbwU*j0SAs%AHF9qo43YI|vVE8Ii!C^2Eo|2wWenbb=C5BH1}~ZZqt&Fs zD!zF(CbD&k#jdUowI^21&my@(#J(POyAsK9_Zn{PcRu2_9o{mnp5!6#E%Hpba1OdT zTQX!E673ZET9YA>UnqO0@mx_)`1{zs$OLE{=`R45z?rp)$9tdZf_O1rf%wd~5*v~p zJ(OBanIxwXqA#S~A#d2^fl9<;#Z?csFBYaB?KcNvNl z5N~UoR`33wj^Jr-WE#bIoA8}+5CmCLlC{f;nCDFRMZ8;`nBYD(-|fuWcWO?{$JK*B zPNzD>E>3zEON10}ubld;eayitFjLB^BXyCT^jg30AUzLB)Pf>`*rNcCqo#iimU_Bh z4zjy~y`J!hwW#5Q{pBD{|GomYQh%_ak+rhozkprTxcy|p-2Eq$H@$$ta`9il)?CO% zw5sFm+RU?DGz>O9=aU0wX-JN2_T^ZWFPyoi)<-mNEnxWlfG#Em2{6ro)ZJbev`+#% z*fz|rH!!<_K%_eE@9Y#}OQx(W1OG$P^j}IK8@{PfMb&?CTljK8eBV<<6QnYC z^nSz3JLW~DE^-C@(VgQ5WDiSKs+dCnd|z+k_7q&srufL_V^tg2Uj;Hq7#QUP*6zl> z2USo&k8ZGeMB*;da2*-h|Gd(2r?A!9(tf50W0e-qqC=*+)5oe0#zUore0q_f7-c*m z@bM4ZMoC~3J69H-$`<(731^HZc(QRw_W{$7gSmzr<8gVuJk}xWl)mUDVa3-^-UX+W znd1^kzYEUfM~A+XYPKoPZrHUbWs5|TEfd(X5>pEBBWJF)7?2R@2v|W9%5cqcwF{x| zH4(g`dD3Gb%CL&NKaQIFp6-z3C{6iM?PpifOYz|JqULnG_yjKBSy}Tfzo<`_hoXYgIE}Q6EcEa{xqjvTPK4Y&p$Qb6aokb1y@2t zDNn2C&P2t~awhnyfnXIfC%TjAu{?+hX1oO#2s>d$h7{I?_CP^r&jAn`go9x`hYAAz z3%QHe%1Jt4m#QyKT_Sr`z7~I2_A6&W;q$X2qi5m5&+MJ^UD~x|4$k+}6D6_?2@pH8 z3=utpF~JXN;2N3oNVMe^F6a=G0oRV;&Iq0$;z7{YMW+4l zfd&Ke%#wV)Xl-yd{_r1ion)Oo2k2-0F@oK%LO56WXyQIt=8u!ifA@j@DNXM|zU16# zp!&~HCOG?pRHGu4q0L1A18rvcx8h#z8OPn2kECE0TC`9Ct7=TGfX~H^Mw`ap))pUG z4F|+%PFXn1Nv6s!MbVgL1y5pMib4PO@{8n28ACvn5p*J=G5->|+Yhu4rVpgeFI&LW zf!G(>WYujg4r1Asn&>9n1Q-zzqC00es(hWNfwB? zK`1IP6jDPdYVb$Eb3&1H;{|p7fa8y(yfV$yIU&F5^PM1v%6wNV9rp%@P_!vY94n{* zToL7?yP_cZ6}dx1d$2j7^IU1Bw>xCx8=DkaF?k#Ug(@VGs}asJjFjeN*5PH`YTJkt zMCZY13C<6JH2;sRuZn83Yud)$-8HxccL)&NwRmwa?ykWdiWHY3r8q6_w73>)ad&t9 z^Ss~Tzg7-*vT~B_x%bQ^vj_eys?;Vp1~M@YqB%i4et5Xy7!UHr&cxBC5WAFdvlSka ztzFlq$N*)J%YvgN;B>C?yjrv$LcN*XONKjYbB{tZPvC)Q8x5+Q&6;@1CvM?Qp+#RW zRcK)uOp}HQs}zQ^hw)w5`-W}~Kl6U^;|)Z|shS}w`K&*R znp7F-N$-n2vL-CJ#FCD;#d3bKnMJC~s>^81jBihFVz1wM-Xq)cNb+dY_Xim5oy(T1 zy<@VnT$s0sFw2^I$Aa+F{0z7iNtmF7mkTMwY?1ga>qJ#4-9I16p3Y|)yKxadj-!w? zLVzNVV%NWjbS!ENW6rdVZT`-yPj7M=P$`}t_!jk8r#L0GcNQ=eO@XQ-ydc@GCs3`00e)SQ-!Gg?NJHf10=OvsCg%HvMvO#Uz)J7;G_ zw7MY`4s<|$=EWO}6vu=wG(*&)gfO#a&VP#GbS$~XF(C%lPz@Z}v)-3?)lh9+L~-U- z^j`E6V>8U-Nw^l&6R~`xf>7Z*_9l#{3+H;2RW#(OZqD@sP68jgZvrICH@x}6wDr3@J3lwz+`GV)rbRaG)-may=h zvYErVG4O|gnq(v35wRAXNibAnkhNn*u8K^JfaA+p(PGO{Fp`lGRw*r}AR|*^;3EhY znapOsTw4C7sv!I)fxqFoB`d|fvT(H&Ngq~P$;oLtV2dwT7NoWbUri&4*klCgVa1`~ zxYW#MT~w*t(4e5b1)~_lIw(&YJBvN1avz1za>@on!09P$7V9*B#eUX`Wg{cLGXm;I z#BW5d;wR#}cTMmGdO4Oh0?hs}Cy*6+@+7fbsBFoVi4}tF-OS6pam|N|U@3_K1aT-y zGPW-}Lia>gZ4fLZG|9O1FJ&7dmwjpRNg2~d%K>jw>1PtJ^aq7!N2Mk_VO)fQu|I`Wo7TN5T5e&uDlp9Oj|TKkH|N(l4#p%;V6bHf~I z@!d_~b^CH|Paiq_N$H#@Am^^%E8{7;nRY52MhTkU~bIcgFq!4&wK1_Pa_hB zzJ(ZX_Btb}dsyekGO0B# zj2#o?9S(WfkDof9qiphGP3pRQ@6lfgsQG)*Hda^u80P(}MmzYdY$(#(W&BRuW-QDH z_w`dF7b<40V^#Q`zMg#U@wHq#>Z)?eiERaf26YYPCzo@q1%Y8|(U;`cK122|lWd5p z1Er-3W11x&&|pkrskr>2q*e50N)aRftn;R!n{^{Brsvh052;!$hz@|9qFY|6CC$`CAN;&++##$TFpY<8Gh=viLrw8)|JX0W@P zDKThH6IK6TX~0PC9c!LdDNUtgnmWlGkkva*8keg&1=D>QHpyDN#;weSH-y8LaD zNzD-L6fXO48&f8q5D(>3QVVi6a*4Q#snF68!MPs37ABje1zzal)9rUQacFkSO1Pu} zpfUf8*c9PcCHJ8^fLtT&Lu$RRsc2+idNvNT*isPe$Gd4I0WYrOdb0f6=w%sX1AT)f zaZp`DC*o(4oxw+RYAN$cTXGU|b4?;)pYW@UNL(W3jhgiqkZr1Bcum0G-@5|gp~SD| zIpqhmxqK^%wFJ71=zYo>WGvcXMbK?F0tPw3EFF7)eCRAkHd^Q=0!m9u&!^>wifgl= zOQLk{l={7e@0gw(zKS-a-y}U|D39O+i$4mdb12tXM0&siYF|I;RiW4O*MsWO%

| zgZjrCo#N~}F52EhVUvEH-SVT9snQFemQouRV6FzV2TMtY4pLgP!Tt+>r+i`gC#lOy z$kKU;S8X8u1(6|Y#&Yn4Fr)J1Q?Ie6SW*_|C$~85!+i8eq1iI2c%%tjd-}X z9bKli3wcrU1+!CI{lb)lA${Ga5I5N90OpNEUT~$-cn}9B9kq91y+A^^JsiI98q zZKz@WvW(7j#t!%Ap?|r*JX>k=>vwo3{mA)38dP%LqpmvpPk2RoA9^{=kx*W7BVvES zZCK6WgxP6X=Lj1KLlW;0F6a0JvqHlGoozbjGM4yf!K>wpJHuTC_`C>VNNr)j4 zi%JY3o}vsIi`&O2Bvljzn<}T&bnYts-)fU*5m`?9?|a5ln$x5QImZ{2|4QiAvDCFC zDS{GqP#iz2#1A6*BL5>kz#1lNVupacF-uWBm7VzdLz<<}U$lx+p})k1U}98}ovWtE3T}-ngZUfuGCWNy zj(*f5^+uDAjW4t7#*rsp@4^}ghS(|8$75|GG+n#ZD3|OwK;#HN+bxmP$6{b&98@>M zc}P@rr!b@l55;1yJ&|A{1}w>a4p#B}WsIWx)ftyytj)hTGpg?BP$l|ma7sf%j2+q+YF=rl@RqQs3xFK8$CyX` z2q*lzRH+N;s&L>OSmQkr#}BNM4gA`v(q@*`9QUXHCAHct-7Z{*VaXN|)qN97QeG0T z8~upPHzw^;i|6^5)+zocv6YBzsU_v79+-MT_}3O^CxtC^{2yH(poiTo_>vF~C zMsO=dSs0v^(08h^gh~;EVb{lUJ)SQ=AQ+3v^aHmTq_q}2D=x%L_%7Vtd3{8_Lw>H} z6DatiCIQgJ>mU_>FYCp|pqr*Jq8dTB)7_UclJF78>s{Hh3&d`Lq9kY2Oxy%Z&&kx- z1nV<{5&e-SXY{^^T7H^$4q<%-NeFAE6d`G|vbi?Hf#GKj!Y>g@>EH0k88<#0YO}ED zIegnMGh)bWBe?fl>H_>FY>Skq-$<3zqJ((xSLd0a>+LQjH6Ntm?42pd(o+-sQXywzGHVm|K(T5m^#XM^yB1 zxJUic=E#Svrw_TOQig3l@x>pPn$?iZD$K8?TiCw%ws$$rD%7#tgP~|{RzVG>h;ddy z4+nxOP=*Udb9@#G^of8(D4MHgNIWq6K^K^6%Gy-=A(Si4$bkXh-tmD>)IKnka)7uh zn=5<}BY3NQ3;Oo|{>4W+(I;VXhfuvsSxy&|b-EpNW4AyxbleSaZ(I>m_=;$6-ghh< zxlqbpXYt?pu&^|kIJ_X{Zp$gTpD}E-OS01vBwE9=xW8BQV*6C`4 zjhKf!haJW|W%x28+({v$>1r0&7H+d6_zC1AVs8p^!-_nx-#3@WyXhrr5xQfry`rNQ zkY`cYzrl)IB*ovO^tl)(mtqB%b$y~!mc=ryyj-(XH|t=ir-6egNDCk0Vx&8gY6#p^ z{V{dh%EZhjQ7rj<{w!B}0O8M`l_%G`NQ{$h5`uIp5f8ed1o*;PulhD2-)Y}iYIFRP zRxO|Yr=8HO@Vef5<`sQpy9&qR^h!wKEg!U{aeGO49|I2%yFn*L30MyaXlU*B?%Dgi zG^Zf;<2ONUIzuoqvEq6p-9q#8=;A>O;@^BH;B!`2;jN-M#7q3@)AadieziJeS=QuA z5!`uHmCkXt2|xJzJZ%o~R3df={V+snor||epxM?R;g-(|cSur(s49y+?d~)yT7YhZ zr#Use0C}%9fXrSs(XD$U&@oVqa=>4x&<`S@#b`%n5TVD4_pyFwe{%uBPjAK?Ykg)1 zsGn_1i1~SaAf?ks5Tgvih}1=9`AJ76ACvS*Z}-o4<`oENuCdBU)Vj(Dn&`EEx?8yM zYyNE9Dpsj4c7`VUKO8cv4gfDUXrhO-XHwR1O0WJ^WH2}-D01HYY&Zh`OLny2Oy=dd zsPWUG$hphgc9Qr3!^rJuq1GlcHovy(&v%p8y#JoX)+gNGQA3a1Rs=8jA_efRU;c!N zNiBM;j=sXi^7~>qEL1tJtH9O|Y`Pf3k$US@vr*y)OtvC8gy;**|7o2y4WmP1*(8av zNg)w!CGtUXoV6e^2sXc^tf5T@D*TE^|Gv4X@;5z?lf?ukM5rj6Sun)CJxVrTnY#O0kAkZ z?l5hR&FTve3_NQyL@BSwI)KEazLJ$ zZt;lhy&QDZR}s$xH0h<56(MoFAUtF6AuAsyrHTVfv?>;<-uk(aj`R-)$wddazad9y zZg|-6HLP~fhVyK1PRQK|?@={k$8A!s>tS#5S~6GML{lvjL|BFyU3zz4)4-|>otWn zl==^fReUcdJgJyLyTklmgk%T{KM>B{zI78GG@*bm`Z3@T@%f2G!XZ?*n0WBl?~%57 zzko}@WBv`(kzh$?ylcdwhHX@UURACo=D0@c?+u2^>Up}4w2(p&3qe&4@+eA5ZvetA zo*i)iY6WI|#mv1TXIL5?`p#GVWF1+EX#-E8b% zIPdk4*R=tGC`duER7%-dXr>I-abgr`&0>!9@ha7s4~E0D(SV=mRiqg=alukHvI}(7 zv6h>wQbXJ~1V7GLm}Mv!Hy&`me0l5Nih+kLE0Ea_n`KZbNKRt6T}RP;7yJT0UxLMj zA*sp5U4MDKAE_B;a&mJT#n1T0>WiVxq+u-82>Qv*?ybvLtz-86mV>8ldRVJMyRdyA z#eLj%+E6Aypov;!r$>f5VXG4C6}z81VVd=J^x2ao_3u9n@xf^sf_Dt@GCh9%Om4p!tB}AKB5Q6q(n4uZE99(V6kf^J83- z7ZzWH@`=l-^)bbP?NcSJ;m|@`r&mzCtDY<6mGHG(=oeVL$O07i^H4@Juh8@X0}<9E z6ju}&0F2Y9&&l!u(WVTz6cvCWgGPfwVo&6vbnMIRy-(Cd+n$*^Tbg85k>x0sK!TKv z+GI&0ram+fV?k$R@PWQs9b^nmVGrI4UNxX3rfnd2|xA=YVi(wUc$!QgjG z^|3MYNvH-ev#z|vF7`Pd=qeCCX^Q@(5(btj-T?FU*R%_CH($R7pR*Ic{~Pq;zM&;? z=sF!J2=6N13I?vplgXFPASBDXPnG~(Z!`g_o-wwUb*t%J&rb5ihrW!1o z1)V9^D{YKd(hE%?j7urR&@Hr8=iYBHwG@V^K)*(u5z(Xr56iT>l%96n*% zZUPgVT!IJ0{^T7YSR3nl3x&s_mU|v1cyoYIw!}p| zeBB{m4sK0dp?xVy?dGH<9PO4)nKVIQ&PEo)EF#5`T+zVZGp1ueL{GA*w9)b@0Qf<+H&U8zJ({R_1N3Zm5(Ud8l8vV94H^zxZoJvEUhT>m1uRMc&lf}s?#bF!z#Q+ zXcXIXZBSDH56bhtwdw^!ua-l%FZVd!KNtK~tY;>CQHYh^M`GMposU)+O zjB#bkaixZBzod)l?Pt-_a8ExWgx_Hr0A0MEKua>T$VZI?ETxym3lAl%v%X{2Eh4333~g?0%W-Y%(;a-g0z1WW8o-A_W%Gf^C&g~TOu?sq>A!vQfJ=^ zR82y^6?3ihB9Rh--+lS6h~^%j147F)@5Sl8w4M{yaXQSu_uv_i^qlu}=^KCS_!y6J zh)av~#{sdD@TBe_FOi$zz+D?pRP+1Zn6x_C@kOU$Ip=9z?LW8)j3w({P9*PLPqdF6 zG7o0?vHuF!N7pa@FdM zzsKrtk0R!;AN$*L4APrCD!lO79&y-fv-ynRS;#0lm!uJB=kcyLottpzQt zVgpVVbWy6)`cw&nQUC>hbM}s)3u1ek2Xy%G4;bOP0O#SZpU|eG~%uwnrsUr}2X4y(C!O6-Qa;zdW{R91Xpj z3lw%DSf^{V`zLKll%We?F%|gX8=-8*O|9Ahxwf3Ll=`t)H6IGd5|81~7e~Bqj;?IY zxaFr8Lz|pA4{fVdBsG3@V>biPAsjfZmGp=)F4Anv`&=yZCVFEY?58zxI*HP@n?TB&D@MCMh{+IvcC1XbkEpw7{BT+|_glkv_BrO5QuaA(i3YNsLmMw>|zX8;|4qGN$#PtT(2mN$Vlo%EF~( z0N_G%)&4KL;C(_DwDu8=`qJ3(sg-5kU3;ZtJ?|U(k%xPWIPahc^%%=-+rq4N%-zwU zm`&*2jJC~ESA>i5dN{XvgOpThLP(nzE;^!J%nuq)C4pBJWQCc=@9Ns;V}C@h)qd1y zY{AtNrX3DkKJdcTZv)4tmNSYP5mExS6Z2!|g}a3U=3bXJ2m0R-EaAu=(KMK^;y^Y| z^k6@}k3|I}++|>x#TXNnjM*YnglP7CLPv{V zD?o>+8#>`w(HIPohPV=6{sGCHrB^V4zj7p__kUu+G&56)5N$Opgj{ii>$@~uaoL-m z=mWC&Z@+#4MBOeIz|;g=KO+nf!vxUia)Z{tZX}4BtCf5BnlK|`VlAw_@gUS^{sJKL zKb^%Kz!q`SQh^8;NrNXSh&49I9KlaKHK03BPX3%>5?T%c&fs9<;X{Ad~E^-cJ&t#^L#eU{b^O4c8On@0-YvgaSrwT6v@^ zV_`ULBzqb-Riu`9d~1lU&wy)>jhDh=cGE%#5h=BWf!y>lJC+dYeL9*GK!V@S`kPEOCCwC zT*+KoNP_+JomR#;bex+)I53DAwJ|yz!nChUkNm<^OXEuQsM9q{&N-UCRYKCk{EJJ; zd`DbgmRb@a6psy%s;*A?keh3V1*Xvryq2OY8Z4-8ATuwNu4aGvV|Ag{&w=6m5oi>s zT{^|#lwV05cTpjNE!?)jz~XKBR6_U6st8sZn{V!QZXU->_=x#DbqIn{kL3FfhO3waom=XLNA!AO_#C>Y;8DKaAB%Z349=`U ztm20meTOPv&hV*FDcD$ZYP6B?+j8nN`<^ z1DHQz2hsBa`w_^WAZ8dc>%f~t##zBebq?zT^2}mIL=q}POn6dF*(RXa74!rs_=Gu7 zn)U1AfD|I%0&U-}tux5edC4|%OOjXT9UL@WG=(mpck^LROC=QWfKhdZ(FS3cGZ9&u`Se9UHFgTSlEk(YBhF&|T9H>1P0qe15f zorcsH5-&@SZ_kbo_d)l+CzD@$kbEjb4lt0mZ6o^hUP9W}C0>Gn4-Z+%Q|^l5#fTP=$Sr>;DzamY9ddQ>(i<}i&W_oJP#3zm+gHKs ze@Qh^N5%DN;ssXA%V*OcrXRE1?p4FzMP?S1BHe@)Lo2>YX_TCDY}ND0l3W5b&}56( z;iJvYV!P0=vR!K_wrS9+46%+sr9CGod>m6Ca)^@o!u-1er9r+{6;Kp6eX#l@#O7D} z4dspFD6y_zfvM!%XE{-anRfeFj79e51lOzF(Qc)TF(pE0W#3Z9Ni_#D1-)~IupYcj zJjGh&!K6Z-fGgaT3>9G-o;Dz=Fw4l5@)OTUzea2;C+bRi?*ol=1h#&{VT5Wpyc4W! zPejnMlZtYw;q)tqP4z-*>};Z9ym({@Q)vuO?8V&KTZ?%MTVWnS7}iX;565aZw_F5vO73U$v8N3ah02 zAM*fZikeT#G!4Bm%F7Lv#-gCkql*2t#GWnB&y*7vcmc)%hwP$Hq~Z=Rr_+L-pV>V> zyY>=dRpG}~M*m9NLXRY(Mtp`{k38(Xtt0Mvf4jizvjhu>nwxmIDYoy-dhP$`L{jmY zCbT6G{bk8V;P?4s8N!_&PBu~s$=REw^?4^ zAlWpIRIVaI>SyBtRK+He^`1XF#CyJAF=m1E{gm}YwfakbTqnF5E4roTKZr^<6x8bV zSraJBEMq8|PymXXcAe70D5s!T6oo2~fCH5wa4kq^6RjelG6ZX)St(L~T)mXHmLIt& z;u6h&fF=G11hetWFQjFDrxb@}nx1a+tR@wdFD4T(_|L`xk2D=mk7Ce$-4F~+VGqP{ z8z!`gjFJ9)@)ykBF7cbO<)K=i;ho^1A6%utT9(6^8J8j5MiW9K#et|omaL&w4YrQ3 z>s!)a_A8yQF>58m5CyL~=?j!Q8%uo=!E*Cw$513F%LCAzi7Du0?1|ifWb9E``JhAQ z?MDiCODbkCYSxtl8kG7wIz7%n_e}vdj(w>yB|+7$^mx^UMG3j;G7i~OsS3ui071Gd zpc0<|wdxaC38FH%a)>26Sg)dJ%@L+76Ht1hJJ=C1DnfDwfoU)Ed`OGJteH~ab24S% z#~@01p2h>bu0*8!vY`5JSLYhgV*pZ((ybN>!^lf*mLjX`Tu=vd=c+=EXje@}xeLP% zqX$h$JjnJ2__iy-VF_!HmgVEwk3h&`vuM-e;MB7x_=nx=*xJ-n8IYrcO1SXgKg?QD z4V1Xp4hz&0vh*p&pi=EuDb;PLW7oGjD%*;>kt{zK%1Oude=tK4ocLPaoaK7$8NQIg zxYK$0l~XJ%Gog^oQ@NTk$Zv0E$W`0H2J2#%9okw3rL4ZBnaz)DHUQPd32<~eIbN{4 zmw9fI5$H*uP-b+Eq}7V%0N}BC;3U<*W3eY12;k_r6dXEC!V50r;&4FT+Erv7h$#OHkK`W^n8qwQm}Ops6bDqAp3{Q7d=r>bhoP>p6MMO= zrOm%%Z%cFP`oQ^hl%{Nv--m3aR(M=$e6jsIA1!tSt|v{mV2+5$>%}b zU>Pzbd9uJB@QEZ-0KM^z-i)RkY&-h8E{T?6b(LA2^#cI)jyo{z^Oa%=2!<+*>x+8h zhtKLIP@QM{WQ20TMlv`}+)UOPN~F$$X|thU8+;2--3`o@aab~&X5y;@Q6gN&8|eVT~U zrPxFXIJg{$DCh^OG;dfS=WiZ&W3lTkwVM^6b<&1eP~}Xh)KK+Uj8WlnlkvnGpqTlvi?=X(R6ddPiv1o==F44lZdPhjLWzd3^|MrOJqL44&m z^UDIB1ekSFI)hq#G0_NoYvS(@b=XGPZU0u|Mq)1b%GyzB2?tB)&;pm1JVB>LRrUcB;%4YVycRU78dQN%xLRpq{dTGazopRC+2&Cr z<`DjZx4bjFE;NC_iM0M%v5`t*x?*u`T^la1?4-Gk1GLiuZ)fWa~bl48(7-)SFEgvHI_sYX|Rb#?Sh^L>I z2px)ja8iqg%`lhvR?HFF2GEea?KsR#&Ozty-TsS;blEO3`r>f=_`}Kg)*<(^e@|eC z%-zcK!WcF!x^0P|yVR`ns`vs!lwHyhN+ommr9%Uokr|0NRfGCPAy*mhQW>Beh(E25K3D`~i{FP|4y7b(AwLw-0zhmKkN87E$K=Q`{wYa}BcY zvyY4*_F!+S20b1(U6;()IY6VQ!x}-AeUk<=4@#^}ayp&WWRyZxYqQI=N$)tM>2XHb zFbR2B$VWnyhBc2xK;NXEK#xtSz9^3)yW4;rD|jbFQn%Bp@{jQJYIr?G&>OM8CJrPa z_b5ew?TL+6Ob%|F&O{*@1=oSzzhZcr^_+0!XQWo*Plz6nJUo$^(n=`%M(WbtY^-`B zo>qjUWFS3>(IN(G;%a?b0WQoOYsYcW)zJoczLSKA;wN4MBjjVp$O2jl+&|D%40y<8 zA4W4AYj*rO9E%oW-;_Mg|>Z$m?}MIN(=@)aVMk}pPs)wxvzt2tUajac?bzm+H*C{G!~lNIT%-u7zcH;~!!YVGwNM&gZPuof*1MW~av#t;XQI8K%&bTYSRPsSv@7&>t}d zBQ*yjlOXc-LZaqkB*r0s(pxK{&g6>oGRklal{Q!-U)44Y00~u|xzbyqJ9-ODqtYr0 zqb7Cn$fIs3336{@wn^#XD5x$Q4=I7O_Beq-w}co33k7uhU|o!g9F-!`Nh)TK@au1H zUR#M0nufY)J)8OP8L-4kbk<0;l#M*(X^kFg5vUk5aMevgSfDR zj~8*o;y}7$Ts^WliP;41hJP)@(8bh|CVVqd+}&moRdupj`)`uptNG6h{D}xy3ncKn z%kX@c@uE5U+Q?5mx1oVfRFHr%|C$Z7D7v8 zU;x3|!29hgu4eIkS> ze3R$XRHaCEG*nPo9;P^A)Q11{XZW}dO}la`e<(i)lJ!ZI*yjV#-5ddecF}uXMi9HP z(Y{D&n6+;9mg6fBTFwRAt_{l((UQ1}u<5&<=w?HDA5m4?QH)kxtZ-la^V;qB`}OXJ zfJPWQ$(Ccw$h0c#c8lcJur+g|(pXFQgV!@->pGMR1&!s~5CdD1(rk&wTLr5a1o*to z@gGsEWZr;-@GRAq&N(S@c@0Tl85_mBqolQ*SRGQ2IRPTC=n7j)1f3CT@|k-LYZs(C zU80I};OF7xDn>;~{W%4Z1)M)Z<{L=G26&j|kXQP2jku~ur;H4hPCOvCY`tchxzuoofYp;G_TUjsm}}wq}g> zf#S+g|ilVk%+MQUs#1-`1OX-^}cAb zMh5G^WKTiEYNUm~_a&as>@5m*j}2+>`EF3OVEn_Y_XGOG0iLLF0PQ33lQ2|lUXZ>T zi=25Zq8~GKgE7Htx_RET7xFVt>7-lSPd;nzY^(Hz131I3c=_zBJ_dT6!G300`62mb zt%$~DwC3PyT?X8!aeCq0oOg%3s~Q5Fje^IYq`*}?nI<}%!9SOa1A&4NUeWkNQ*W+% zpcBmI8voTxB$LtX(fqVgXZ&$qm~YX2JLJ@;HWnlqMVrWmdI-TMt_j=?y`8Zbd=Qwd z*XIZb7o7OL^vNI_PV49X)NbQLzERC8;aclzWWQZ`fuyZciRsF@M1r;0tDL}emrqZx za3K3~dx%(>nV>j2Mf>99hsDC@(5D{wKPXP|8$vX<5iLKb6_FfGyu9Ps=2F4ba7xTT z6p5Gr2B%UBA5pK=NK$DtrisJGMZlwDGq1@u`|YiHEg(CF(($;VA~sR4!%_)AeVF9j zG~XoI-^S(NFU3RCJx%wqHmV4Ns84>H!$vBexzrn*H;|7oJdDV8{vp_uA5HN}m{2`w zu?kxvQ7WahlR?!u+@#206n^y&_FsJ%&rZ`qosYiV)#!?Gtx&2VZ6iiLf_O;@SdqYn zE*N5Pn1x>G!E6S`4=%=}30c*=lPPp|nO!=Bz9Qk(k#@1;ECxocR$d!DE+-CsxXe{4 z$9)+DxwZEh{222af({6_$}7+6&Z83V7}V~t-rky}b;UI{h9(wcvHd<9)mGny0c*yk zjV)-K38%B`rQFsQv_^1nb34rm!NqxzWi@^+`9JA{*WL(p(RE6I6X^0Ubb~Nr;{_CL zR?S9bExz!suU7T1g$Rx5@3)HEY}n@Qbb|p7IH}MpTwb^DInVe88)Fmw3K|o$bZ$z3Vm)zohO;T$NOuWtaT9 zX?s7gfK;`R^+EFOb@$_2tj>K;!Rx@@?~u2mKn!L&UIZ8HqjsS!S7V17xP~3l*}J{) zRvzl*?m60$VSdG`Jzotk=PAr<8!WDt{11iO6+lAiyA~C!eXm7SCsXJ*dGHKieMGCZ_(>t8GZ(}aYWAc5T%<^| z*wlgyeR}pyjeIycPEx)zOu!4+N543KKB8xV6+~SR(z9^4#*cX&I3@-klKRY?zkT_4 z6lbX;1~TSh?O`f5Le%gp$1B%-?6j@9ExO8?YRfT;7==#suI!ZB{Sq^3TWDAKG$0|lu7udw-rmXx!+%fplcxZAa;Q}uJ53c7$I|3nM^-U{c#c`9@tt54p@Me`U#Jy5>)wsh9zzi12O(o`Gerqbg<3>gkl5FyJVFBVw*33J$Z zGD7@JdqA3PHE<=~nJ0g?E2S(m1v~K3@7m}qiNj{X@`M`uPxxWF@!{H#u7}tA=&Z7q z?@3mnXL37X8oFpNh`GRV)lNdC!UIkSPel6Im<6^%CwuNJDcw)$mIs=)Ws(jo*6bMT z+A}3P{mi^9>8P~^)My0XmWQhZzbwWegy2mn25-9u>haL8x`Lb}M)6!@nAHB3d*z5& zIT4KOG+mXfIZF}Jx}Of#rS_FTL-gC}8GXo_D7%c42!|=oqu~AkDJ`A}adUGZgOzmy z>iW96<8NQZEQ{`N(phE4>X?N*okKVSPuK$4(t((Yzo!D93Avg4pyAD)%@@yEO1 z1*X#ht6k0W(XKA-+hu|df8{%?$t9DO|M^|fhkqx|9EJ<1SzJm#70xc&LpbNKh3dpZ zJ?lrxSIJ+O=PD5xxQ~X`}*)?WN3pe85dlRnI}*w8j!|@Lw~N!M<2T4QkV*Kh}TEOol*6Uk#?ss=~Mk)WynS z^IbBZ3(n}g3~pQ$(d_uY2vRbFH#+~?x6py~qZZ+Z#4+!mC(q5x{N*^Ag^t`y2Jf~z z>4lE}nW2A3FZkSvW1a;ra1sCWqsOfwk~5|%BV#4xjH02xV3|4Uoy2eyKK@NXHo(qn zUfgv?IwP42u|`rs0ezUY-E!9_qXMv3Sei`Vk?5ATV3~A;FZjTa6whjZBfeuqm-kwt zomL_-^>oIMKpZt(JR2_@xHhtNfR)3f?{%+R*4198<6oyM|2Ugxr=EuFI&;YA=MwaT z2?o}5`QVOZ?+|+9bThJtvZJ$%S@MT{wV`N!b}(;2Of=iW%%p@3r`hj z6H~ST-;jx!31foQhRdX&@dKKydEXx-!ec9v+OOnRx99uE|tlq7tmf_G#mLG=pK#6zp=Lc`+5uY={ zYt@_7STPf_f@G?yE%U9$&BxWoi~kDTi@?e2h1`wD8rwCM`mlXyf$O{0dz~1$4=r%5 zHy>3}z_?Dqf`qc`9HA5YP=qV?m&_@c3-il5?@}PcQfGjV$Zd25)z$$;dEwKZVOt6I zl^dgX*PX>pz*FphE`0MF+ZRXt4L^u6UDDfKI2^Ks>^5#&MFfNld)li1g6-rQ9g)smCut+>ODlFn*>S&6%Gjg zeh*`Q7kIHm2<=>4v|r_#ddbooRo&$Q!!i&l#>*Lb$FD>N-;9l?Azl*sn~f2C`tD-B zy54xg^?RpNK?P}pGRWub={jrYN87mq%W&5{j#ZfpkY8rH&9$;&8Y&D254{h_x24n~ ziXa+lY|=@8G8kwQHU1|8GdjK()7X_DJw=m`LbCQ(Vmt_&3l<0;o-1xicz-zWPYMhU zNF6EUkBXOp?+hHNx2T-$*?zzY$NCLEI+I;Qn6c?8p!mir_9XVVp3{b2$#mlr!u!|_ z#(PQD4!p9vOQ~B?S`0!LJkDnLK2uLG0dF>Xf=B-1YnHtcPhwz=f3Es9=fXZE@*6T>NInAstRg)DIAN9S{N)Gi<9T=gGe%w3|#DEgw&?Kv_UHc(l=w4 zq8^kAXRgfGA0I-sv!KQ&4@XBKuV?$b_Mm~PZz2uVkxPf7(g{=uO>m%uv;-MrgfKrEqbUhfjTr33{0yHO@t6`GJ#cB!@_U(E-U~pyb!oIYqY( zJfEK>H<3L00ng~;-$96Ij!}rPVNAaBFvw(PrWS@lozVVU&Oj?b9CmShpnF~bI%J8z zS*U)qp5$n{9}X#>|FYYOMljWtL@|`q_DBZ}wfOInwQX;K1jKt7L3QCNEARwU(ol4!|eeeC= z`+aw0SkTkc&NgjiU6k>%?xQfyCTo*O49b=k#4e3{@B6#8W;9fn=QQdy`=5Fop$|MjPaV zkFOQ-P7EZcd#Da6!4o|Y69<8p4(R)~Lyvrt8EVSh5ATXMN z3+|5q(`)j=4Vv}&cl034cdhBKi!yZKFQ|B%?`(0kVzq=eYc=0->4VaNIUjOq(WMlw zpo|yGNrr{%lU7i5g2Qji(M{APqzoyAgbi7V4$dF!$07Sw&GzCA6)KhP6oe32VNsmQ zPMk^$!iUw0v29)(wc1x$mJRetY@YL_FZw}S^GhVUxURjrL54rHzv2H z?c|wa(?9bjOV&z0|CEPyj_A@)tK&~7{28}2>NJ10zn!Y|AoJ??CJl>Zx`V!as%daP zG7sgjvB&hSq{HwWl+fQ!u^$N+;Pn{u8O@=*Cq(p{4b|eI`z69$_a&xTC}=DQvVB<4 zSPK^fc}P292B;O|KBEjHd}H!0S?gKU(XEO5Bd3NhZ7y)n9dBnt-?hT@0@8+f1*oeA#f_jEjrym4?7F?jA^vv99zb=xUGak<#RQpTC$XD!=R7W%O=K1&R?vT#y zd)pus-_;d-Q~XyXP6x_qL-~NcdF)!>e*98Qi{;=L4KolRZG67 z0+)GTXnj#(i`mQrrIqC`Z|3O3f0Z5W@GL-WwV>XTn?L#M*%$2#s+M{XBRp++6LC3# zyfh~?-B2aDaPR2QcBiVZ=rOf}IBvgP4v@ph{V_xCK}y`{OpZ4O=ay^UWJ*7T_vNJ= z+lYAVwGa_`DICFD4d%uvhoiC^N4k9~?TaZm(|*Ch)oB&=%l$APt5hIwF>B68(hI^H z@hvrF)$I5x=kOr*&(>{32i9U#*hVIDCS4&f>QfXXF}uD&oQ>u*IQrD9hzLH3>eh-rf5nJ*rGyY-%= z(_z-Ey+pZ^cd^_;b|#~^WHGY5*E-ux3c%`(>>ZF>We@h?TaAm#hrv3+VOE)_cF2(M z;Xzg_5$}6hQg10WZfagkL%WO9F=*af`u%X7Z-MdLkN?-x+8-JLar9IEgi^V>q>kpg z>t2b1k6+C45oq1%(P0wees=c)z4&&ha+K5d8FxgviA2@o5?*U}0}!X_CyGRN+RrlY zjY$HAnn@8ac1Cx({G8;a@po6gDVQmge09D8MdRWWT35>wf?2ebsqS4)ne3}rzR;3l ztbBY&_xba(d|DI3yM^;Hx=k5hS63j`9ANNts^Y!7bCCY1X>2--vRINN$czThi0=^# z-gvOAA&3Ni5`$SCNVM3N1RI-yu0CDV7BgpKK&Ky!Wr4FGr=zw)N^Bc?`{#PminkyK z=|4>&X*DHm)mWpshcA8WS5fRnR;2w&C=1rev*SMPJS`2@_@jmC(zcccvuRU39tULm zDaJ|UUMs-ddME+m*Ic*G6y0aXoDpe(kCm-hK5RnxT(wP~%hNQ{Yx_}7qvU-FaG zmUXNm6$|u+x=-#wK`%SK9IFFR1}LXQxN*{u8bd5@MX4*QA^aS#TKbH8iPkwMjY(Eg z6mD&C%qXSPW>@E3rvZW@*f6@N5(msW^8G%mI^G*?n#e+IRfOxwd+^#RN1P0^eJ(-+ z>gcbW)A#9Cs=g)Xdzg0uw5YPPoz8YSAlIYH)v8oMseYZL7>NmJUN!mgWwtwjAdg36 zG`+g;p*Oj0sT4gq`Uf&Do=NTEZNVRWE&wmV9vJ(L`laNGOkU_tSnSF!CYo{l;P*w~ z=8VLcC43Lg_y)z=0~Gb$lih|&NRJYRupApNn~!rd8)yb@I|ohAYNx^Ub5;y{r|e#` z=a;Gq8twOkw#9*T5b&5#rdj+~^M`)TuV+B8J1KdujR>LfQkv~%lsxt}aaxBkK3gvu z3Vs4<)$k@w%>ZPk+5Y>>Lwt_aZoMl{4zcwOLacSD_Zi9EG1me6Rrd(R(Ya39M6n!UJkglKg1Kxcv&gcS6+)5H_uAIIImH@aMt49OZcKvqHZf=P!fYgL$+t8UI zD9v74xr$-x(;x6pzF=u2@{mv~D1*MY+y zs3{|C(%;M!zj(xXH_CtMV$vfB#``GhV^05@B2nf{5Rq`y^lZvUPal8W4%}w!xvb+w zXgRjkF*Q@XN1&2NB>KVb^+Mv{Ny~+VkV>lK)S`|~b@P245_@~{ObsM7P%_ptMnQ%p zc}8R2tz>d5rcv z#oRv&(@vgN?X}QIuwlIHe=uJ5Ow0@7o)>*zYe{Eq%*rEeB*auRfk?|G3Ta;Brzzr$ zL*EyU2zmic#=GHZKu2NRt?%n` zk<q2UEIp>HJ*@`$nO$Y&yXkp>`%bRN;~-I&o>5 z_gX7*WIpfJ60T^s&s%uO)P0pD_t@SiCES*Fg?X+*jl`pN{H|w40`ZaZh=cF1f1SQn z-VsmNsBwW<#{dt(JBJSFEb5Q6xg;cBH zp@`A-?c4a%Dft0y@Q}GoBO=)C;EIq>3ftP<#&y()KFkh|OgdsQ%SqgyRA1>3_wZc= z)bTHsbNbT*MaF2%q*pN;Kvp5SmtXT1kJ#8j2z3F_bu(c^m63=k-;ct{XFZP?vwqA5^RHULgcHn=jmJo(&!8lp}r}0mMfFv7x?Z6ez(E+ znnfQwwaTT++Q>rnPM`QiSXsdtOi36%dJD{s+9l;oxCo3QKP-qT z3o9!8Ru)@b2Sf*c0$ea-qfD_-$jCr1@{8l^;bAyx=W8NrZ>!=Q^AB8$oTUh*Gc#5` zjfM}|w0^{%tdajU$^ApkA0B>xKrxPEWn9{G%NHI)6AKpGk|^x8z^AVUU#2QyX|)`! zosHKV4SR!IrEGd4Z=U*|yKNV}>a|(EIs#n#?<;*vPF-f*u@Oz~3J&l5{ikf-x$UAh z@jxr|0qRi-!8C9;aF9VL%y}-(h~sRDdzZH9TxH{2P8=o{IlOVNx9&ABhrxN=PO9aD zHdBP+Wb|Vw+nQoRVh4|ISAEe4-`zUHUk@*z0adgIiG--Ro5NzJW{A&ZQAUjBpgZbe zcAs|D7K3>#wIR%oxpLlkgb!eM5);PKWON9);z)Z8AtWFOVp8{WHUDc|V`CKszEHs~ z%zCDWcdnnci;?h_X!BCVw{%x43~r>OY45&4U<5a=P+dm9_YGU(g+te^Q5==%AT!5k zk39T6RF<_nZep-vst8}|%G^amiJ4i_QIK-n%n2P~_ltbj;tG)QS%Xk^;ALz_b4Vf1 z;&MNZd8M^;g@gp#@)I70p7u){qBYhK!6f|Bu_sLEEGMShupQ|S!B4C}YpmM{1&{|F z{%W&>JT9Fc@S!8q?V=qHOpbAn6ZA;~3`T%*xV-qcy{x)c*t7b4bs3aI7St^q=Mv9T zu@wvpgMS4zcYwbgggxDCn=5F64a(NV8YWO(x!l3dKT=QhYMZ;B=JCz=K?#%p@*b*= ze7aj)fn#x%j{$U8)C$?FZl*ZEtW;3YQoO3G}FZ`jHbv&hhHfnYR7#=Tq@AL%1JO;)@45%}PJ zKt+lK(q9l~`rSSkYW`$sP6E|4Z@d?6wugUXD7n*)Ayn7VipUD(i90_?n&p+gh>{`XE{Gi zwT^oFZtxVM;7OW90?MT)8L~2xB#m$t{Bp6Fbmx8#iDwViXx<+(z!?PyI8KS=>}`Q) z083H?cyh)zxvZ?NKKF$tb{f6vFOwt7E#Edt`51Mamiy!|UXyl_;uPY2o3PF!sm_!i zgYRtb^Md$g%^VB|ZG{Zj6k84`1QMsGoX=}n-867HQz*?_r`+|FQeDbaC%6b=Y3MVPxS@JNp17t#7C#&ji-ta<4c+q#gB(u(9E`W|dDW1Ny=mGiA|)v;+BU zJ9x3c#z|v4``BUnltuDFZfcYminM6{Iz?JZyS2*cwb=6&}Irq;9~ zj~m;A)`dKegc(f}8K{K`7=6l*0I}l^Z2P!I`hTNw88TVS$n)VFtM=cYCcFrMlmCRf zIKE3%5>KJySBobW)p|``Yf>QXJm}`!B99~L>bOTQr3DM54EQqi#xb~CSd#=6sagde()UDXW z)t|5@qUdxWx;^62xGtFyaX@1KSW!lFup?%8M9Q#Cr#Z4mYYLi=EAvPX6=q$z`1 z^{3dO_URgt;a)eav-=rQxPgF2Rx%0IUy7o5zAK%X8@E$l^C;WAdAldV1WsT@3jP6U zD{I=5zQ(a|AA>3t#LEd|Km$I~&8#-|(%c6op?RzT9^ub8U|wNtM~rzb{3= z(xfR3u(YyzbrrWht&N~cH8|l{R4@~JFsW>Z)2Lo&8^RS!u@%$DbROE@#}Ald~IDmdKnlDeW(=c+*=1eLrF7^ic2z@tRVabCzRP#7W=|d|FDy}c) ztVmQhcp?7k`RZ?_rr4>jGbzDWTT&*L2mT^q6Q+!fdbz4-*o%lKve$C6k94R_AoC3b z2Qg>DTUwhb3i%d+C~CBT_gzzQlApHAwI1wHQn^!g{)1j0B7F5vhxy{TZn7aN)ZF2C2(wSEE4NK*SNI0m2h=kWyPDn^7dte5qg z6OL;J(CpIg@lpD`mcE)g+iZXz#qexb$r$E&R&zpk%Hwg&m5)iD2LD25nK)Ny{X*xM zIJaSvY!l~qm?YQ48JQ#-=ANYu>b?+=2JWMclfqkt`X7H$VPW=)4Li1c8FUN+;|GVz z_!*8-7d@-XFFr~!*(@}W-K+Fpa*dwsuqX`F{@GbG7u-fDyXWe^Bv5|z%3`yNd#m%^ zY%nrw^1`j~EOEOay6lI{vspRs39%Pd>->`xp~?Cdk&%KQ1>fY<=!aBLK(;^59qBl@ zA&ANY8B2~|nf#PLf?K?O@Uu&ux9gq8BM4vDyIwqolH=zlKcNN?aAmflOU$P@i*hn; zzVJ$uKlKz4uxqv=fBA8`#m_Qz-m3>S$B70Iq`tsaDFx*0m~AC=p?ror!}ua|=Lzqt zdLaRX$Y;;-yauuDpKVXNo`s6Bo0kWP1vo2Qoz|LqMXGbwPSN*o{a8H$2(@P zPN2$9ju)D(5#bE!wFaH^axJeSYUTvmOgS=)6Qms4=01DRhpeBvt2ROoo}f`7e}pXG zExte*6jCY)6(-sTxlKWG*po=JE{JY?` z!Wfm7j0(5+4lPg6ivh=SZH3R|r2Z!OpN}$MO?p-=PW}y3xR4UD*=p#u`8WMZPYtB+ z0%mX8zZq_}mMtT8vKA2khs15=5IesDy*kzdyi^;B_}qpjJxwurh5pG~gUOroPu_=7 zs@nFYvii;Ra&3<>9NPZj@D{_t@*fWWe>t-lLyX-T;y*at+Hmm{Q}wRDs$L?U;2FJ& zv6A&aR#L#gzWWFE6$aMyA6Sv+QzjYHZ_1h_95!1kFyyoUA^&-A@$@h2{|)*x&@1$> zivI`b?FZo%`tP9O7*OP2pu8#e`Ni!RP@8{&3VHk0x~VkDzgZ1llQa7D9>ynpeOZaH z3*VW%3@(zjyni!YLfmmRv6OB$-O`i%@EFqK^II-VFhtu5+nIJUIqsT`^<7wEKB6Ul zG)8K1g;|})U~zihb@+y4ws!Q}E3Tyzs=aIcGjXjIqa%rZk*CNgxE5XR59E#1Ir4@~ zUmJ);1)u@|00aOMTc~-SlJjp61pt6s1pv@u?*9AX@XX21&&k+T)#-_=m#d$vx0kS+ zueaBK7V=>_q+oUe04NwI1YpYgUxy~<($mh>%gD*o#{*N;e`m+VyL|==bH-p&o#orB F{{rqUS4aQ= literal 0 HcmV?d00001 diff --git a/Solutions/Threat Intelligence/Package/createUiDefinition.json b/Solutions/Threat Intelligence/Package/createUiDefinition.json index af6fbaf66d6..72b5e9731f2 100644 --- a/Solutions/Threat Intelligence/Package/createUiDefinition.json +++ b/Solutions/Threat Intelligence/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Threat%20Intelligence/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Threat Intelligence solution contains data connectors for import of threat indicators into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.\n\n**Data Connectors:** 5, **Workbooks:** 1, **Analytic Rules:** 53, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Threat%20Intelligence/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Threat Intelligence solution contains data connectors for import of supported STIX objects into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.\n\n**Data Connectors:** 5, **Workbooks:** 1, **Analytic Rules:** 53, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -67,84 +67,28 @@ "name": "dataconnectors2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The data connectors installed are:" + "text": "This Solution installs the data connector for Threat Intelligence. You can get Threat Intelligence custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "DC1", - "type": "Microsoft.Common.Section", - "label": "(1)\t\tThreat Intelligence Platforms", - "elements": [ - { - "name": "DC1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Use this connector to send threat indicators to Microsoft Sentinel from your Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MindMeld, MISP, or other integrated applications." - } - } - ] - }, - { - "name": "DC2", - "type": "Microsoft.Common.Section", - "label": "(2)\t\tThreat Intelligence - TAXII", - "elements": [ - { - "name": "DC1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Use this connector to bring in threat intelligence to Microsoft Sentinel from a TAXII 2.0 or 2.1 server." - } - } - ] - }, - { - "name": "DC3", - "type": "Microsoft.Common.Section", - "label": "(3)\t\tThreat Intelligence Upload Indicators API", - "elements": [ - { - "name": "DC1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Microsoft Sentinel offer a data plane API to bring in threat intelligence from your Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, or other integrated applications. Threat indicators can include IP addresses, domains, URLs, file hashes and email addresses." - } - } - ] - }, - { - "name": "DC4", - "type": "Microsoft.Common.Section", - "label": "(4)\t\tMicrosoft Defender Threat Intelligence", - "elements": [ - { - "name": "DC1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc." - } - } - ] + "name": "dataconnectors3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Threat Intelligence. You can get Threat Intelligence custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } }, { - "name": "DC5", - "type": "Microsoft.Common.Section", - "label": "(5)\t\tPremium Microsoft Defender Threat Intelligence", - "elements": [ - { - "name": "DC1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc. Note: This is a paid connector. To use and ingest data from it, please purchase the \"MDTI API Access\" SKU from the Partner Center." - } - } - ] + "name": "dataconnectors4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Threat Intelligence. You can get Threat Intelligence custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } }, { - "name": "dataconnectors3-text", + "name": "dataconnectors5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "After installing the solution, configure and enable these data connectors by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Threat Intelligence. You can get Threat Intelligence custom log data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { @@ -958,13 +902,13 @@ { "name": "analytic53", "type": "Microsoft.Common.Section", - "label": "TI map IP entity to Workday", + "label": "TI map IP entity to Workday(ASimAuditEventLogs)", "elements": [ { "name": "analytic53-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Identifies a match in Workday Activity from any IP IOC from TI" + "text": "Detects a match in Workday activity from any IP Indicator of Compromise (IOC) provided by Threat Intelligence (TI)." } } ] diff --git a/Solutions/Threat Intelligence/Package/mainTemplate.json b/Solutions/Threat Intelligence/Package/mainTemplate.json index 6661e8757b2..625fc627722 100644 --- a/Solutions/Threat Intelligence/Package/mainTemplate.json +++ b/Solutions/Threat Intelligence/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Threat Intelligence", - "_solutionVersion": "3.0.8", + "_solutionVersion": "3.0.9", "solutionId": "azuresentinel.azure-sentinel-solution-threatintelligence-taxii", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "ThreatIntelligenceTaxii", @@ -492,8 +492,7 @@ "analyticRuleTemplateSpecName53": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('a924d317-03d2-4420-a71f-4d347bda4bd8')))]", "_analyticRulecontentProductId53": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','a924d317-03d2-4420-a71f-4d347bda4bd8','-', '1.0.0')))]" }, - "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]", - "management": "[concat('https://management','.azure','.com/')]" + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { @@ -505,7 +504,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.8", + "description": "Threat Intelligence data connector with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -523,7 +522,7 @@ "id": "[variables('_uiConfigId1')]", "title": "Threat intelligence - TAXII", "publisher": "Microsoft", - "descriptionMarkdown": "Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send threat indicators from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2224105&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).", + "descriptionMarkdown": "Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send the supported STIX object types from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2224105&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).", "graphQueries": [ { "metricName": "Total data received", @@ -629,7 +628,7 @@ "connectorUiConfig": { "title": "Threat intelligence - TAXII", "publisher": "Microsoft", - "descriptionMarkdown": "Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send threat indicators from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2224105&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).", + "descriptionMarkdown": "Microsoft Sentinel integrates with TAXII 2.0 and 2.1 data sources to enable monitoring, alerting, and hunting using your threat intelligence. Use this connector to send the supported STIX object types from TAXII servers to Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes. For more information, see the [Microsoft Sentinel documentation >](https://go.microsoft.com/fwlink/p/?linkid=2224105&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).", "graphQueries": [ { "metricName": "Total data received", @@ -664,7 +663,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.8", + "description": "Threat Intelligence data connector with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -823,7 +822,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.8", + "description": "Threat Intelligence data connector with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion3')]", @@ -839,7 +838,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId3')]", - "title": "Threat Intelligence Upload Indicators API (Preview)", + "title": "Threat Intelligence Upload API (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Sentinel offers a data plane API to bring in threat intelligence from your Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, or other integrated applications. Threat indicators can include IP addresses, domains, URLs, file hashes and email addresses. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2269830&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).", "graphQueries": [ @@ -897,12 +896,12 @@ "title": "Follow These Steps to Connect to your Threat Intelligence: " }, { - "description": "[concat('To send request to the APIs, you need to acquire Azure Active Directory access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token \n - Notice: Please request AAD access token with scope value: ', variables('management'), '.default')]", + "description": "To send request to the APIs, you need to acquire Microsoft Entra ID access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token \n - Notice: Please request Microsoft Entra ID access token with scope value: https://management.azure.com/.default ", "title": "1. Get Microsoft Entra ID Access Token" }, { - "description": "You can send indicators by calling our Upload Indicators API. For more information about the API, click [here](https://learn.microsoft.com/azure/sentinel/upload-indicators-api). \n\n>HTTP method: POST \n\n>Endpoint: https://api.ti.sentinel.azure.com/workspaces/[WorkspaceID]/threatintelligenceindicators:upload?api-version=2022-07-01 \n\n>WorkspaceID: the workspace that the indicators are uploaded to. \n\n\n>Header Value 1: \"Authorization\" = \"Bearer [Microsoft Entra ID Access Token from step 1]\" \n\n\n> Header Value 2: \"Content-Type\" = \"application/json\" \n \n>Body: The body is a JSON object containing an array of indicators in STIX format.", - "title": "2. Send indicators to Sentinel" + "description": "You can send the supported STIX object types by calling our Upload API. For more information about the API, click [here](https://learn.microsoft.com/azure/sentinel/upload-indicators-api). \n\n>HTTP method: POST \n\n>Endpoint: https://api.ti.sentinel.azure.com/workspaces/[WorkspaceID]/threatintelligence-stix-objects:upload?api-version=2024-02-01 \n\n>WorkspaceID: the workspace that the STIX objects are uploaded to. \n\n\n>Header Value 1: \"Authorization\" = \"Bearer [Microsoft Entra ID Access Token from step 1]\" \n\n\n> Header Value 2: \"Content-Type\" = \"application/json\" \n \n>Body: The body is a JSON object containing an array of STIX objects.", + "title": "2. Send STIX objects to Sentinel" } ] } @@ -943,7 +942,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId3')]", "contentKind": "DataConnector", - "displayName": "Threat Intelligence Upload Indicators API (Preview)", + "displayName": "Threat Intelligence Upload API (Preview)", "contentProductId": "[variables('_dataConnectorcontentProductId3')]", "id": "[variables('_dataConnectorcontentProductId3')]", "version": "[variables('dataConnectorVersion3')]" @@ -987,7 +986,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Threat Intelligence Upload Indicators API (Preview)", + "title": "Threat Intelligence Upload API (Preview)", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Sentinel offers a data plane API to bring in threat intelligence from your Threat Intelligence Platform (TIP), such as Threat Connect, Palo Alto Networks MineMeld, MISP, or other integrated applications. Threat indicators can include IP addresses, domains, URLs, file hashes and email addresses. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2269830&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).", "graphQueries": [ @@ -1045,12 +1044,12 @@ "title": "Follow These Steps to Connect to your Threat Intelligence: " }, { - "description": "[concat('To send request to the APIs, you need to acquire Azure Active Directory access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token \n - Notice: Please request AAD access token with scope value: ', variables('management'), '.default')]", + "description": "To send request to the APIs, you need to acquire Microsoft Entra ID access token. You can follow instruction in this page: https://docs.microsoft.com/azure/databricks/dev-tools/api/latest/aad/app-aad-token#get-an-azure-ad-access-token \n - Notice: Please request Microsoft Entra ID access token with scope value: https://management.azure.com/.default ", "title": "1. Get Microsoft Entra ID Access Token" }, { - "description": "You can send indicators by calling our Upload Indicators API. For more information about the API, click [here](https://learn.microsoft.com/azure/sentinel/upload-indicators-api). \n\n>HTTP method: POST \n\n>Endpoint: https://api.ti.sentinel.azure.com/workspaces/[WorkspaceID]/threatintelligenceindicators:upload?api-version=2022-07-01 \n\n>WorkspaceID: the workspace that the indicators are uploaded to. \n\n\n>Header Value 1: \"Authorization\" = \"Bearer [Microsoft Entra ID Access Token from step 1]\" \n\n\n> Header Value 2: \"Content-Type\" = \"application/json\" \n \n>Body: The body is a JSON object containing an array of indicators in STIX format.", - "title": "2. Send indicators to Sentinel" + "description": "You can send the supported STIX object types by calling our Upload API. For more information about the API, click [here](https://learn.microsoft.com/azure/sentinel/upload-indicators-api). \n\n>HTTP method: POST \n\n>Endpoint: https://api.ti.sentinel.azure.com/workspaces/[WorkspaceID]/threatintelligence-stix-objects:upload?api-version=2024-02-01 \n\n>WorkspaceID: the workspace that the STIX objects are uploaded to. \n\n\n>Header Value 1: \"Authorization\" = \"Bearer [Microsoft Entra ID Access Token from step 1]\" \n\n\n> Header Value 2: \"Content-Type\" = \"application/json\" \n \n>Body: The body is a JSON object containing an array of STIX objects.", + "title": "2. Send STIX objects to Sentinel" } ], "id": "[variables('_uiConfigId3')]" @@ -1066,7 +1065,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.8", + "description": "Threat Intelligence data connector with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion4')]", @@ -1082,10 +1081,11 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId4')]", - "title": "Premium Microsoft Defender Threat Intelligence (Preview)", + "title": "Premium Microsoft Defender Threat Intelligence", "publisher": "Microsoft", "logo": { - "type": 258 + "type": 258, + "options": null }, "descriptionMarkdown": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc. Note: This is a paid connector. To use and ingest data from it, please purchase the \"MDTI API Access\" SKU from the Partner Center.", "graphQueries": [ @@ -1200,7 +1200,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId4')]", "contentKind": "DataConnector", - "displayName": "Premium Microsoft Defender Threat Intelligence (Preview)", + "displayName": "Premium Microsoft Defender Threat Intelligence", "contentProductId": "[variables('_dataConnectorcontentProductId4')]", "id": "[variables('_dataConnectorcontentProductId4')]", "version": "[variables('dataConnectorVersion4')]" @@ -1244,7 +1244,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Premium Microsoft Defender Threat Intelligence (Preview)", + "title": "Premium Microsoft Defender Threat Intelligence", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc. Note: This is a paid connector. To use and ingest data from it, please purchase the \"MDTI API Access\" SKU from the Partner Center.", "graphQueries": [ @@ -1334,7 +1334,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intelligence data connector with template version 3.0.8", + "description": "Threat Intelligence data connector with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion5')]", @@ -1350,7 +1350,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId5')]", - "title": "Microsoft Defender Threat Intelligence (Preview)", + "title": "Microsoft Defender Threat Intelligence", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc.", "graphQueries": [ @@ -1412,7 +1412,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId5')]", "contentKind": "DataConnector", - "displayName": "Microsoft Defender Threat Intelligence (Preview)", + "displayName": "Microsoft Defender Threat Intelligence", "contentProductId": "[variables('_dataConnectorcontentProductId5')]", "id": "[variables('_dataConnectorcontentProductId5')]", "version": "[variables('dataConnectorVersion5')]" @@ -1456,7 +1456,7 @@ "kind": "StaticUI", "properties": { "connectorUiConfig": { - "title": "Microsoft Defender Threat Intelligence (Preview)", + "title": "Microsoft Defender Threat Intelligence", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Sentinel provides you the capability to import threat intelligence generated by Microsoft to enable monitoring, alerting and hunting. Use this data connector to import Indicators of Compromise (IOCs) from Microsoft Defender Threat Intelligence (MDTI) into Microsoft Sentinel. Threat indicators can include IP addresses, domains, URLs, and file hashes, etc.", "graphQueries": [ @@ -1493,7 +1493,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ThreatIntelligence Workbook with template version 3.0.8", + "description": "ThreatIntelligence Workbook with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -1597,7 +1597,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.8", + "description": "FileEntity_OfficeActivity_HuntingQueries Hunting Query with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -1678,7 +1678,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.8", + "description": "FileEntity_SecurityEvent_HuntingQueries Hunting Query with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -1759,7 +1759,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.8", + "description": "FileEntity_Syslog_HuntingQueries Hunting Query with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -1840,7 +1840,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.8", + "description": "FileEntity_VMConnection_HuntingQueries Hunting Query with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -1921,7 +1921,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.8", + "description": "FileEntity_WireData_HuntingQueries Hunting Query with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -2002,7 +2002,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -2056,31 +2056,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "PA_Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "PA_Url" } - ] + ], + "entityType": "URL" } ] } @@ -2136,7 +2136,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -2196,44 +2196,44 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "Process", "fieldMappings": [ { - "columnName": "InitiatingProcessCommandLine", - "identifier": "CommandLine" + "identifier": "CommandLine", + "columnName": "InitiatingProcessCommandLine" } - ] + ], + "entityType": "Process" } ] } @@ -2289,7 +2289,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -2349,39 +2349,39 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "ClientIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -2437,7 +2437,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -2497,21 +2497,21 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "RecipientEmailAddress", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "RecipientEmailAddress" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" } ] } @@ -2567,7 +2567,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -2584,7 +2584,7 @@ "description": "Identifies a match in EmailUrlInfo table from any Domain IOC from TI.", "displayName": "TI map Domain entity to EmailUrlInfo", "enabled": false, - "query": "let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour\nlet ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days\nlet EmailUrlInfo_ = EmailUrlInfo\n | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains\n | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period\n | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase\n | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated\nlet EmailEvents_ = EmailEvents\n | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period\nlet TI_Urls = ThreatIntelligenceIndicator\n | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period\n | where isnotempty(Url) // Filter for non-empty URLs\n | extend Url = tolower(Url) // Convert URLs to lowercase\n | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL\n | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired\n | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired\n | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator\n | project\n EmailUrlInfo_TimeGenerated,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n ExpirationDateTime,\n ConfidenceScore,\n Url,\n UrlLocation,\n NetworkMessageId; // Select relevant columns\nlet TI_Domains = ThreatIntelligenceIndicator\n | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period\n | where isnotempty(DomainName) // Filter for non-empty domain names\n | extend DomainName = tolower(DomainName) // Convert domain names to lowercase\n | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name\n | where Active == true and ExpirationDateTime > now() // Filter for active indicators that haven't expired\n | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired\n | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator\n | project\n EmailUrlInfo_TimeGenerated,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n ExpirationDateTime,\n ConfidenceScore,\n UrlDomain,\n UrlLocation,\n NetworkMessageId; // Select relevant columns\nunion TI_Urls, TI_Domains // Combine URL and domain threat intelligence data\n| extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column\n| join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID\n| where DeliveryAction !has \"Blocked\" // Filter out blocked delivery actions\n| extend\n Name = tostring(split(RecipientEmailAddress, '@', 0)[0]),\n UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)[0]); // Extract name and UPN suffix from recipient email address\n", + "query": "let dt_lookBack = 1h; // Define the lookback period for email data as 1 hour\nlet ioc_lookBack = 14d; // Define the lookback period for threat intelligence data as 14 days\nlet EmailUrlInfo_ = EmailUrlInfo\n | where isnotempty(Url) or isnotempty(UrlDomain) // Filter for non-empty URLs or URL domains\n | where TimeGenerated >= ago(dt_lookBack) // Filter for records within the lookback period\n | extend Url = tolower(Url), UrlDomain = tolower(UrlDomain) // Convert URLs and domains to lowercase\n | extend EmailUrlInfo_TimeGenerated = TimeGenerated; // Create a new column for the time generated\nlet EmailEvents_ = EmailEvents\n | where TimeGenerated >= ago(dt_lookBack); // Filter email events within the lookback period\nlet TI_Indicators = ThreatIntelligenceIndicator\n | where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period\n | summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId\n | where Active == true and ExpirationDateTime > now(); // Filter for active indicators that haven't expired\nlet TI_Urls = TI_Indicators\n | where isnotempty(Url) // Filter for non-empty URLs\n | extend Url = tolower(Url) // Convert URLs to lowercase\n | join kind=innerunique (EmailUrlInfo_) on Url // Join with email URL info on URL\n | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired\n | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, Url // Get the latest email info for each indicator\n | project\n EmailUrlInfo_TimeGenerated,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n ExpirationDateTime,\n ConfidenceScore,\n Url,\n UrlLocation,\n NetworkMessageId; // Select relevant columns\nlet TI_Domains = TI_Indicators\n | where isnotempty(DomainName) // Filter for non-empty domain names\n | extend DomainName = tolower(DomainName) // Convert domain names to lowercase\n | join kind=innerunique (EmailUrlInfo_) on $left.DomainName == $right.UrlDomain // Join with email URL info on domain name\n | where EmailUrlInfo_TimeGenerated < ExpirationDateTime // Ensure email info was generated before the indicator expired\n | summarize EmailUrlInfo_TimeGenerated = arg_max(EmailUrlInfo_TimeGenerated, *) by IndicatorId, UrlDomain // Get the latest email info for each indicator\n | project\n EmailUrlInfo_TimeGenerated,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n ExpirationDateTime,\n ConfidenceScore,\n UrlDomain,\n UrlLocation,\n NetworkMessageId; // Select relevant columns\nunion TI_Urls, TI_Domains // Combine URL and domain threat intelligence data\n | extend timestamp = EmailUrlInfo_TimeGenerated // Add a timestamp column\n | join kind=inner (EmailEvents_) on NetworkMessageId // Join with email events on network message ID\n | where DeliveryAction !has \"Blocked\" // Filter out blocked delivery actions\n | extend\n Name = tostring(split(RecipientEmailAddress, '@', 0)),\n UPNSuffix = tostring(split(RecipientEmailAddress, '@', 1)); // Extract name and UPN suffix from recipient email address\n", "queryFrequency": "PT1H", "queryPeriod": "P14D", "severity": "Medium", @@ -2627,30 +2627,30 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "RecipientEmailAddress", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "RecipientEmailAddress" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -2706,7 +2706,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -2772,32 +2772,32 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ], "customDetails": { + "ActivityGroupNames": "ActivityGroupNames", "IndicatorId": "IndicatorId", - "ThreatType": "ThreatType", + "IoCExpirationTime": "ExpirationDateTime", "IoCDescription": "Description", "EventTime": "Event_TimeGenerated", - "IoCExpirationTime": "ExpirationDateTime", "IoCConfidenceScore": "ConfidenceScore", - "ActivityGroupNames": "ActivityGroupNames" + "ThreatType": "ThreatType" }, "alertDetailsOverride": { "alertDisplayNameFormat": "A web request from {{SrcIpAddr}} to hostname {{domain}} matched an IoC", @@ -2856,7 +2856,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -2916,31 +2916,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "PA_Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "PA_Url" } - ] + ], + "entityType": "URL" } ] } @@ -2996,7 +2996,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -3062,31 +3062,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IP_addr", - "identifier": "Address" + "identifier": "Address", + "columnName": "IP_addr" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -3142,7 +3142,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -3202,39 +3202,39 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "HostIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "HostIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -3290,7 +3290,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -3350,39 +3350,39 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Caller", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Caller" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "CallerIpAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "CallerIpAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -3438,7 +3438,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_EmailEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -3498,21 +3498,21 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "RecipientEmailAddress", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "RecipientEmailAddress" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" } ] } @@ -3568,7 +3568,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -3628,39 +3628,39 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "UserId", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "UserId" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "ClientIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -3716,7 +3716,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -3776,31 +3776,31 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "DestinationUserID", - "identifier": "Name" + "identifier": "Name", + "columnName": "DestinationUserID" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -3856,7 +3856,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_SecurityAlert_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", @@ -3916,30 +3916,30 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "EntityEmail", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "EntityEmail" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -3995,7 +3995,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", @@ -4067,44 +4067,44 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "TargetUserName", - "identifier": "Name" + "identifier": "Name", + "columnName": "TargetUserName" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IpAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "IpAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -4160,7 +4160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", @@ -4226,39 +4226,39 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "UserPrincipalName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "UserPrincipalName" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -4314,7 +4314,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "FileHashEntity_CommonSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", @@ -4374,69 +4374,69 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "SourceUserName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "SourceUserName" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "DeviceName" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "FileHash", "fieldMappings": [ { - "columnName": "FileHashValue", - "identifier": "Value" + "identifier": "Value", + "columnName": "FileHashValue" }, { - "columnName": "FileHashType", - "identifier": "Algorithm" + "identifier": "Algorithm", + "columnName": "FileHashType" } - ] + ], + "entityType": "FileHash" } ] } @@ -4492,7 +4492,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_DeviceFileEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "FileHashEntity_DeviceFileEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", @@ -4552,43 +4552,43 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "RequestAccountName", - "identifier": "Name" + "identifier": "Name", + "columnName": "RequestAccountName" }, { - "columnName": "RequestAccountSid", - "identifier": "Sid" + "identifier": "Sid", + "columnName": "RequestAccountSid" }, { - "columnName": "RequestAccountDomain", - "identifier": "NTDomain" + "identifier": "NTDomain", + "columnName": "RequestAccountDomain" } - ] + ], + "entityType": "Account" }, { - "entityType": "FileHash", "fieldMappings": [ { - "columnName": "FileHashValue", - "identifier": "Value" + "identifier": "Value", + "columnName": "FileHashValue" }, { - "columnName": "FileHashType", - "identifier": "Algorithm" + "identifier": "Algorithm", + "columnName": "FileHashType" } - ] + ], + "entityType": "FileHash" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" } ] } @@ -4644,7 +4644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "FileHashEntity_SecurityEvent_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject19').analyticRuleVersion19]", @@ -4716,60 +4716,60 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Account", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Account" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "NTDomain", - "identifier": "NTDomain" + "identifier": "NTDomain", + "columnName": "NTDomain" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "FileHash", "fieldMappings": [ { - "columnName": "FileHashValue", - "identifier": "Value" + "identifier": "Value", + "columnName": "FileHashValue" }, { - "columnName": "FileHashType", - "identifier": "Algorithm" + "identifier": "Algorithm", + "columnName": "FileHashType" } - ] + ], + "entityType": "FileHash" } ] } @@ -4825,7 +4825,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AppServiceHTTPLogs_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject20').analyticRuleVersion20]", @@ -4879,53 +4879,53 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "Account", "fieldMappings": [ { - "columnName": "CsUsername", - "identifier": "Name" + "identifier": "Name", + "columnName": "CsUsername" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "CIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "CIp" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "AzureResource", "fieldMappings": [ { - "columnName": "_ResourceId", - "identifier": "ResourceId" + "identifier": "ResourceId", + "columnName": "_ResourceId" } - ] + ], + "entityType": "AzureResource" } ], "alertDetailsOverride": { @@ -4984,7 +4984,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AWSCloudTrail_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject21').analyticRuleVersion21]", @@ -5044,31 +5044,31 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "UserIdentityUserName", - "identifier": "ObjectGuid" + "identifier": "ObjectGuid", + "columnName": "UserIdentityUserName" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIpAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIpAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -5124,7 +5124,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AzureActivity_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject22').analyticRuleVersion22]", @@ -5184,57 +5184,57 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Caller", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Caller" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "Account", "fieldMappings": [ { - "columnName": "AadUserId", - "identifier": "AadUserId" + "identifier": "AadUserId", + "columnName": "AadUserId" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "CallerIpAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "CallerIpAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "AzureResource", "fieldMappings": [ { - "columnName": "ResourceId", - "identifier": "ResourceId" + "identifier": "ResourceId", + "columnName": "ResourceId" } - ] + ], + "entityType": "AzureResource" } ] } @@ -5290,7 +5290,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AzureFirewall_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject23').analyticRuleVersion23]", @@ -5350,22 +5350,22 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "TI_ipEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "TI_ipEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -5421,7 +5421,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AzureKeyVault_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject24').analyticRuleVersion24]", @@ -5481,22 +5481,22 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "ClientIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "AzureResource", "fieldMappings": [ { - "columnName": "ResourceId", - "identifier": "ResourceId" + "identifier": "ResourceId", + "columnName": "ResourceId" } - ] + ], + "entityType": "AzureResource" } ] } @@ -5552,7 +5552,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AzureNetworkAnalytics_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject25').analyticRuleVersion25]", @@ -5606,39 +5606,39 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "TI_ipEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "TI_ipEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -5694,7 +5694,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_AzureSQL_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject26').analyticRuleVersion26]", @@ -5754,13 +5754,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "ClientIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIP" } - ] + ], + "entityType": "IP" } ] } @@ -5816,7 +5816,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_CustomSecurityLog_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject27').analyticRuleVersion27]", @@ -5876,13 +5876,13 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "CS_ipEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "CS_ipEntity" } - ] + ], + "entityType": "IP" } ] } @@ -5938,7 +5938,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject28').analyticRuleVersion28]", @@ -5998,44 +5998,44 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "TI_ipEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "TI_ipEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "RemoteUrl", - "identifier": "Url" + "identifier": "Url", + "columnName": "RemoteUrl" } - ] + ], + "entityType": "URL" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" } ] } @@ -6091,7 +6091,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject29').analyticRuleVersion29]", @@ -6151,39 +6151,39 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Computer" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "ClientIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "ClientIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -6239,7 +6239,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_imWebSession_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject30').analyticRuleVersion30]", @@ -6305,23 +6305,23 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "DstIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DstIpAddr" } - ] + ], + "entityType": "IP" } ], "customDetails": { + "ActivityGroupNames": "ActivityGroupNames", "IndicatorId": "IndicatorId", - "ThreatType": "ThreatType", + "IoCExpirationTime": "ExpirationDateTime", "IoCDescription": "Description", "EventTime": "imNWS_TimeGenerated", - "IoCExpirationTime": "ExpirationDateTime", "IoCConfidenceScore": "ConfidenceScore", - "ActivityGroupNames": "ActivityGroupNames" + "ThreatType": "ThreatType" }, "alertDetailsOverride": { "alertDisplayNameFormat": "The IP {{SrcIpAddr}} of the web request matches an IP IoC", @@ -6380,7 +6380,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject31').analyticRuleVersion31]", @@ -6440,39 +6440,39 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "UserId", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "UserId" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "TI_ipEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "TI_ipEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -6528,7 +6528,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_SigninLogs_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject32').analyticRuleVersion32]", @@ -6594,39 +6594,39 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "UserPrincipalName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "UserPrincipalName" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -6682,7 +6682,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_VMConnection_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject33').analyticRuleVersion33]", @@ -6742,35 +6742,35 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "DnsDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "DnsDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "RemoteIp", - "identifier": "Address" + "identifier": "Address", + "columnName": "RemoteIp" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -6826,7 +6826,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_W3CIISLog_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject34').analyticRuleVersion34]", @@ -6886,40 +6886,40 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "csUserName", - "identifier": "Name" + "identifier": "Name", + "columnName": "csUserName" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "Computer" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "cIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "cIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -6975,7 +6975,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_AuditLogs_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject35').analyticRuleVersion35]", @@ -7035,47 +7035,47 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "userPrincipalName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "userPrincipalName" }, { - "columnName": "AccountName", - "identifier": "Name" + "identifier": "Name", + "columnName": "AccountName" }, { - "columnName": "AccountUPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "AccountUPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "TargetResourceDisplayName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "TargetResourceDisplayName" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "HostNameDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "HostNameDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -7131,7 +7131,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_DeviceNetworkEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject36').analyticRuleVersion36]", @@ -7191,44 +7191,44 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "Process", "fieldMappings": [ { - "columnName": "InitiatingProcessCommandLine", - "identifier": "CommandLine" + "identifier": "CommandLine", + "columnName": "InitiatingProcessCommandLine" } - ] + ], + "entityType": "Process" } ] } @@ -7284,7 +7284,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_EmailUrlInfo_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject37').analyticRuleVersion37]", @@ -7344,30 +7344,30 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "RecipientEmailAddress", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "RecipientEmailAddress" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -7423,7 +7423,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_OfficeActivity_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject38').analyticRuleVersion38]", @@ -7483,30 +7483,30 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "User", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "User" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -7562,7 +7562,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_PaloAlto_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject39').analyticRuleVersion39]", @@ -7622,31 +7622,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "PA_Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "PA_Url" } - ] + ], + "entityType": "URL" } ] } @@ -7702,7 +7702,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_SecurityAlerts_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject40').analyticRuleVersion40]", @@ -7768,22 +7768,22 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Compromised_Host", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "Compromised_Host" } - ] + ], + "entityType": "Host" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -7839,7 +7839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_Syslog_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject41').analyticRuleVersion41]", @@ -7899,31 +7899,31 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Computer", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "Computer" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "HostIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "HostIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -7979,7 +7979,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_UrlClickEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_UrlClickEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject42').analyticRuleVersion42]", @@ -8039,30 +8039,30 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "AccountUpn", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "AccountUpn" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" } ] } @@ -8118,7 +8118,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_DuoSecurity_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject43').analyticRuleVersion43]", @@ -8178,30 +8178,30 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "user_name_s", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "user_name_s" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "access_device_ip_s", - "identifier": "Address" + "identifier": "Address", + "columnName": "access_device_ip_s" } - ] + ], + "entityType": "IP" } ] } @@ -8257,7 +8257,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "imDns_DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "imDns_DomainEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject44').analyticRuleVersion44]", @@ -8359,62 +8359,62 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Dvc", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Dvc" }, { - "columnName": "HostName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "HostName" }, { - "columnName": "HostNameDomain", - "identifier": "DnsDomain" + "identifier": "DnsDomain", + "columnName": "HostNameDomain" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ] + ], + "entityType": "IP" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "Domain", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "Domain" } - ] + ], + "entityType": "DNS" } ], "customDetails": { - "IndicatorId": "IndicatorId", - "QueryType": "DnsQueryType", "DnsQuery": "DnsQuery", - "ThreatType": "ThreatType", - "ConfidenceScore": "ConfidenceScore", + "LatestIndicatorTime": "LatestIndicatorTime", "DNSRequestTime": "DNS_TimeGenerated", + "ConfidenceScore": "ConfidenceScore", "ExpirationDateTime": "ExpirationDateTime", - "LatestIndicatorTime": "LatestIndicatorTime", "SourceIPAddress": "SrcIpAddr", "ActivityGroupNames": "ActivityGroupNames", - "Description": "Description" + "IndicatorId": "IndicatorId", + "QueryType": "DnsQueryType", + "Description": "Description", + "ThreatType": "ThreatType" } } }, @@ -8469,7 +8469,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "imDns_IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "imDns_IPEntity_DnsEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject45').analyticRuleVersion45]", @@ -8571,44 +8571,44 @@ ], "entityMappings": [ { - "entityType": "Host", "fieldMappings": [ { - "columnName": "Dvc", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "Dvc" } - ] + ], + "entityType": "Host" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IoC", - "identifier": "Address" + "identifier": "Address", + "columnName": "IoC" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } - ] + ], + "entityType": "IP" } ], "customDetails": { - "IndicatorId": "IndicatorId", "DnsQuery": "DnsQuery", - "ThreatType": "ThreatType", - "ConfidenceScore": "ConfidenceScore", + "LatestIndicatorTime": "LatestIndicatorTime", "DNSRequestTime": "imDns_mintime", + "ConfidenceScore": "ConfidenceScore", "ExpirationDateTime": "ExpirationDateTime", - "LatestIndicatorTime": "LatestIndicatorTime", "SourceIPAddress": "SrcIpAddr", "ActivityGroupNames": "ActivityGroupNames", - "Description": "Description" + "IndicatorId": "IndicatorId", + "Description": "Description", + "ThreatType": "ThreatType" }, "alertDetailsOverride": { "alertDisplayNameFormat": "The response {{IoC}} to DNS query matched an IoC", @@ -8667,7 +8667,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_imNetworkSession_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_imNetworkSession_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject46').analyticRuleVersion46]", @@ -8812,25 +8812,25 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IoCIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "IoCIP" } - ] + ], + "entityType": "IP" } ], "customDetails": { + "IoCIPDirection": "IoCDirection", + "EventStartTime": "imNWS_mintime", + "EventEndTime": "imNWS_maxtime", "IndicatorId": "IndicatorId", - "ThreatType": "ThreatType", + "ActivityGroupNames": "ActivityGroupNames", + "IoCExpirationTime": "ExpirationDateTime", "IoCDescription": "Description", - "EventStartTime": "imNWS_mintime", "IoCConfidenceScore": "ConfidenceScore", - "IoCExpirationTime": "ExpirationDateTime", - "IoCIPDirection": "IoCDirection", - "EventEndTime": "imNWS_maxtime", - "ActivityGroupNames": "ActivityGroupNames" + "ThreatType": "ThreatType" }, "alertDetailsOverride": { "alertDisplayNameFormat": "A network session {{IoCDirection}} address {{IoCIP}} matched an IoC.", @@ -8889,7 +8889,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Threat Intel Matches to GitHub Audit Logs_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "Threat Intel Matches to GitHub Audit Logs_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject47').analyticRuleVersion47]", @@ -8943,22 +8943,22 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "AccountCustomEntity", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "AccountCustomEntity" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPCustomEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPCustomEntity" } - ] + ], + "entityType": "IP" } ] } @@ -9014,7 +9014,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DomainEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "DomainEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject48').analyticRuleVersion48]", @@ -9062,22 +9062,22 @@ ], "entityMappings": [ { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "DomainName", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "DomainName" } - ] + ], + "entityType": "DNS" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPAddress" } - ] + ], + "entityType": "IP" } ] } @@ -9133,7 +9133,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "EmailEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "EmailEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject49').analyticRuleVersion49]", @@ -9181,21 +9181,21 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "Name", - "identifier": "DisplayName" + "identifier": "DisplayName", + "columnName": "Name" }, { - "columnName": "User_Id", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "User_Id" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" } ] } @@ -9251,7 +9251,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FileHashEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "FileHashEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject50').analyticRuleVersion50]", @@ -9305,44 +9305,44 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "DestinationIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "DestinationIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "columnName": "DeviceName", - "identifier": "HostName" + "identifier": "HostName", + "columnName": "DeviceName" } - ] + ], + "entityType": "Host" }, { - "entityType": "FileHash", "fieldMappings": [ { - "columnName": "FileHashValue", - "identifier": "Value" + "identifier": "Value", + "columnName": "FileHashValue" }, { - "columnName": "FileHashType", - "identifier": "Algorithm" + "identifier": "Algorithm", + "columnName": "FileHashType" } - ] + ], + "entityType": "FileHash" } ] } @@ -9398,7 +9398,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject51').analyticRuleVersion51]", @@ -9446,40 +9446,40 @@ ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "columnName": "TI_ipEntity", - "identifier": "Address" + "identifier": "Address", + "columnName": "TI_ipEntity" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "NetworkDestinationIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "NetworkDestinationIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "NetworkSourceIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "NetworkSourceIP" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "EmailSourceIPAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "EmailSourceIPAddress" } - ] + ], + "entityType": "IP" } ] } @@ -9535,7 +9535,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "URLEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "URLEntity_CloudAppEvents_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject52').analyticRuleVersion52]", @@ -9583,52 +9583,52 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "AccountObjectId", - "identifier": "ObjectGuid" + "identifier": "ObjectGuid", + "columnName": "AccountObjectId" }, { - "columnName": "userPrincipalName", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "userPrincipalName" }, { - "columnName": "AccountDisplayName", - "identifier": "DisplayName" + "identifier": "DisplayName", + "columnName": "AccountDisplayName" } - ] + ], + "entityType": "Account" }, { - "entityType": "URL", "fieldMappings": [ { - "columnName": "Url", - "identifier": "Url" + "identifier": "Url", + "columnName": "Url" } - ] + ], + "entityType": "URL" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "IPAddress", - "identifier": "Address" + "identifier": "Address", + "columnName": "IPAddress" } - ] + ], + "entityType": "IP" }, { - "entityType": "CloudApplication", "fieldMappings": [ { - "columnName": "Application", - "identifier": "Name" + "identifier": "Name", + "columnName": "Application" }, { - "columnName": "ApplicationID", - "identifier": "AppId" + "identifier": "AppId", + "columnName": "ApplicationID" } - ] + ], + "entityType": "CloudApplication" } ] } @@ -9684,7 +9684,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "IPEntity_Workday_AnalyticalRules Analytics Rule with template version 3.0.8", + "description": "IPEntity_Workday_AnalyticalRules Analytics Rule with template version 3.0.9", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject53').analyticRuleVersion53]", @@ -9698,10 +9698,10 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Identifies a match in Workday Activity from any IP IOC from TI", - "displayName": "TI map IP entity to Workday", + "description": "Detects a match in Workday activity from any IP Indicator of Compromise (IOC) provided by Threat Intelligence (TI).", + "displayName": "TI map IP entity to Workday(ASimAuditEventLogs)", "enabled": false, - "query": "let dtLookBack = 1h; // Define the lookback period for audit events\nlet iocLookBack = 14d; // Define the lookback period for threat intelligence indicators\nThreatIntelligenceIndicator \n| where isnotempty(NetworkIP)\n or isnotempty(EmailSourceIpAddress)\n or isnotempty(NetworkDestinationIP)\n or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields\n| where TimeGenerated >= ago(iocLookBack) // Filter indicators within the lookback period\n| extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId, TI_ipEntity // Get the latest indicator time for each entity\n| where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired\n| join kind=inner (\n ASimAuditEventLogs\n | where EventVendor == \"Workday\" // Filter for Workday events\n | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period\n | where isnotempty(DvcIpAddr) // Filter for events with a device IP address\n | extend WD_TimeGenerated = EventStartTime // Rename the event start time column\n | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns\n )\n on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity\n| project\n LatestIndicatorTime,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n Url,\n ExpirationDateTime,\n ConfidenceScore,\n WD_TimeGenerated,\n ActorUsername,\n DvcIpAddr,\n Operation,\n Object // Select relevant columns after the join\n| extend\n timestamp = WD_TimeGenerated,\n Name = tostring(split(ActorUsername, '@', 0)[0]),\n UPNSuffix = tostring(split(ActorUsername, '@', 1)[0]) // Add additional fields for timestamp, name, and UPN suffix\n", + "query": "let dtLookBack = 1h; // Define the lookback period for audit events\nlet ioc_lookBack = 14d; // Define the lookback period for threat intelligence indicators\nThreatIntelligenceIndicator \n| where TimeGenerated >= ago(ioc_lookBack) // Filter threat intelligence indicators within the lookback period\n| where isnotempty(NetworkIP)\n or isnotempty(EmailSourceIpAddress)\n or isnotempty(NetworkDestinationIP)\n or isnotempty(NetworkSourceIP) // Filter for indicators with relevant IP fields\n| summarize LatestIndicatorTime = arg_max(TimeGenerated, *) by IndicatorId // Get the latest indicator time for each IndicatorId\n | extend TI_ipEntity = coalesce(NetworkIP, NetworkDestinationIP, NetworkSourceIP, EmailSourceIpAddress) // Combine IP fields into a single entity\n | where Active == true and ExpirationDateTime > now() // Filter for active indicators that have not expired\n | join kind=inner (\n ASimAuditEventLogs\n | where EventVendor == \"Workday\" // Filter for Workday events\n | where TimeGenerated >= ago(dtLookBack) // Filter events within the lookback period\n | where isnotempty(DvcIpAddr) // Filter for events with a device IP address\n | extend WD_TimeGenerated = EventStartTime // Rename the event start time column\n | project WD_TimeGenerated, ActorUsername, DvcIpAddr, Operation, Object // Select relevant columns\n )\n on $left.TI_ipEntity == $right.DvcIpAddr // Join on the IP entity\n | project\n LatestIndicatorTime,\n Description,\n ActivityGroupNames,\n IndicatorId,\n ThreatType,\n Url,\n ExpirationDateTime,\n ConfidenceScore,\n WD_TimeGenerated,\n ActorUsername,\n DvcIpAddr,\n Operation,\n Object // Select relevant columns after the join\n | extend\n timestamp = WD_TimeGenerated,\n Name = tostring(split(ActorUsername, '@', 0)),\n UPNSuffix = tostring(split(ActorUsername, '@', 1)) // Add additional fields for timestamp, name, and UPN suffix \n", "queryFrequency": "PT1H", "queryPeriod": "P14D", "severity": "Medium", @@ -9736,32 +9736,38 @@ ] } ], + "tactics": [ + "CommandAndControl" + ], + "techniques": [ + "T1071" + ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "ActorUsername", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "ActorUsername" }, { - "columnName": "Name", - "identifier": "Name" + "identifier": "Name", + "columnName": "Name" }, { - "columnName": "UPNSuffix", - "identifier": "UPNSuffix" + "identifier": "UPNSuffix", + "columnName": "UPNSuffix" } - ] + ], + "entityType": "Account" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "DvcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DvcIpAddr" } - ] + ], + "entityType": "IP" } ] } @@ -9802,7 +9808,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('analyticRuleObject53')._analyticRulecontentId53]", "contentKind": "AnalyticsRule", - "displayName": "TI map IP entity to Workday", + "displayName": "TI map IP entity to Workday(ASimAuditEventLogs)", "contentProductId": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", "id": "[variables('analyticRuleObject53')._analyticRulecontentProductId53]", "version": "[variables('analyticRuleObject53').analyticRuleVersion53]" @@ -9813,12 +9819,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.8", + "version": "3.0.9", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Threat Intelligence", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Threat Intelligence solution contains data connectors for import of threat indicators into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.

\n

Data Connectors: 5, Workbooks: 1, Analytic Rules: 53, Hunting Queries: 5

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Threat Intelligence solution contains data connectors for import of supported STIX objects into Microsoft Sentinel, analytic rules for matching TI data with event data, workbook, and hunting queries. Threat indicators can be malicious IP's, URL's, filehashes, domains, email addresses etc.

\n

Data Connectors: 5, Workbooks: 1, Analytic Rules: 53, Hunting Queries: 5

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", diff --git a/Solutions/Threat Intelligence/ReleaseNotes.md b/Solutions/Threat Intelligence/ReleaseNotes.md index 1eafd5311ea..87bc2358067 100644 --- a/Solutions/Threat Intelligence/ReleaseNotes.md +++ b/Solutions/Threat Intelligence/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.0.9 | 03-12-2024 | Creted **Analytical Rule** (IPEntity_Workday) and Modified **Analytical Rule** | | 3.0.8 | 28-11-2024 | Removed (Preview) from name for **Data Connectors** Microsoft Defender Threat Intelligence and Premium Microsoft Defender Threat Intelligence, make the MDTI and PMDTI data connctors available in gov solution, and update descriptions of data connectors. | | 3.0.7 | 24-10-2024 | Updated Columns of **Analytical Rules** | | 3.0.6 | 24-09-2024 | Updated Entity Mappings of **Analytical Rules** |