From f3e0d913c5d3792a8db5dc6a47361d6bbc986b37 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Tue, 28 Nov 2023 14:34:13 +0530 Subject: [PATCH 1/3] UI corrected for AzureDevAuditing --- .../Analytic Rules/ADOPATUsedWithBrowser.yaml | 2 +- .../ADOPipelineModifiedbyNewUser.yaml | 2 +- .../ADOVariableModifiedByNewUser.yaml | 2 +- ...NewAgentAddedToPoolbyNewUserorofNewOS.yaml | 4 +- .../Hunting Queries/ADOBuildCheckDeleted.yaml | 2 +- .../ADOInternalUpstreamPacakgeFeedAdded.yaml | 2 +- .../AzureDevOpsAuditing/Package/3.0.1.zip | Bin 29343 -> 29795 bytes .../Package/createUiDefinition.json | 12 +- .../Package/mainTemplate.json | 1321 +++++++++-------- 9 files changed, 674 insertions(+), 673 deletions(-) diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml index c124b9cea46..659fd15c2c7 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml @@ -1,5 +1,5 @@ id: 5f0d80db-3415-4265-9d52-8466b7372e3a -name: Azure DevOps PAT used with Browser. +name: Azure DevOps PAT used with Browser description: | 'Personal Access Tokens (PATs) are used as an alternate password to authenticate into Azure DevOps. PATs are intended for programmatic access use in code or applications. This can be prone to attacker theft if not adequately secured. This query looks for the use of a PAT in authentication but from a User Agent indicating a browser. diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml index 5fda3fe0c88..b6d99c2d3b7 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml @@ -1,5 +1,5 @@ id: 155e9134-d5ad-4a6f-88f3-99c220040b66 -name: Azure DevOps Pipeline modified by a new user. +name: Azure DevOps Pipeline modified by a new user description: | 'There are several potential pipeline steps that could be modified by an attacker to inject malicious code into the build cycle. A likely attacker path is the modification to an existing pipeline that they have access to. This detection looks for users modifying a pipeline when they have not previously been observed modifying or creating that pipeline before. This query also joins events with data to Microsoft Entra ID Protection diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml index 6a19df06cb8..aa9cbb8f209 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml @@ -1,5 +1,5 @@ id: 3b9a44d7-c651-45ed-816c-eae583a6f2f1 -name: Azure DevOps Build Variable Modified by New User. +name: Azure DevOps Build Variable Modified by New User description: | 'Variables can be configured and used at any stage of the build process in Azure DevOps to inject values. An attacker with the required permissions could modify or add to these variables to conduct malicious activity such as changing paths or remote endpoints called during the build. As variables are often changed by users, diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml index 1b532a33d5b..5566e1befef 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml @@ -1,5 +1,5 @@ -id: 4ce177b3-56b1-4f0e-b83e-27eed4cb0b16 -name: New Agent Added to Pool by New User or Added to a New OS Type. +id: 4ce177b3-56b1-4f0e-b83e-27eed4cb0b1 +name: New Agent Added to Pool by New User or Added to a New OS Type description: | 'As seen in attacks such as SolarWinds attackers can look to subvert a build process by controlling build servers. Azure DevOps uses agent pools to execute pipeline tasks. An attacker could insert compromised agents that they control into the pools in order to execute malicious code. This query looks for users adding agents to pools they have diff --git a/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml b/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml index 7bf14cdc8a7..0c11e771bd2 100644 --- a/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml +++ b/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOBuildCheckDeleted.yaml @@ -1,5 +1,5 @@ id: 940386c3-4b2c-4147-ac8e-dcddedaaae52 -name: Azure DevOps - Build Check Deleted. +name: Azure DevOps - Build Check Deleted description: | 'Build checks can be built into a pipeline in order control the release process, these can include things such as the successful passing of certain steps, or an explicit user approval. An attacker who has altered a build process may look to remove a check in order to ensure a compromised build is released. This hunting query simply looks for all check removal events, these should be relatively uncommon. In the output Type shows the type of Check that was deleted. ' requiredDataConnectors: [] diff --git a/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOInternalUpstreamPacakgeFeedAdded.yaml b/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOInternalUpstreamPacakgeFeedAdded.yaml index 1d5524fef57..16ffe6edc83 100644 --- a/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOInternalUpstreamPacakgeFeedAdded.yaml +++ b/Solutions/AzureDevOpsAuditing/Hunting Queries/ADOInternalUpstreamPacakgeFeedAdded.yaml @@ -1,5 +1,5 @@ id: 20be967c-4923-4c4b-8e1d-e1c95d537dc3 -name: Azure DevOps - Internal Upstream Package Feed Added. +name: Azure DevOps - Internal Upstream Package Feed Added description: | 'An attacker aiming to insert malicious code into a build process could look to introduce compromised upstream packages into the build process. Looking at internal packages can have a significant false positive rate compared to looking at external feeds so running this as a hunting query at least initially is advised. If an environment has low number of events it can be upgraded to a detection.' requiredDataConnectors: [] diff --git a/Solutions/AzureDevOpsAuditing/Package/3.0.1.zip b/Solutions/AzureDevOpsAuditing/Package/3.0.1.zip index e7506294fc32cf6d3775fdb35847830653d2bbf2..b003ebcdbbfbfdf9569ab06b23d5bc7c6df91f86 100644 GIT binary patch delta 29201 zcmYKEV{~R+(=`mowr$(CZ95&?#u3}LZQC|GPCD$^cD}yu=X}Tae^!mcnzQy=yYl}6 zAD#l^D#?O^p#cE_K>_VM`)Z;)*Mj?F0|9vl0RdqqGdbfVvZKJ{w6wSP4jvnHxF;$L zvnHm+3KyF>s0^Ucd9ilHsIq| zP8=l%7E8R427XOu2UY}LOb!L61(r%~1f~Xv>HjEY7IT0rp*@K50zC;%E(hBSV8Vi< z&i{p3B{DET|J#JLnZc10-UFhPC2BJ6_Q3Hw3zslLW+fI3>0mRFZxf2MJh6hKGTi~i zE{H4~Ix@WlVlW!&SU6&qKPZt&UBAq3DPveoKRuP356ONJ-_ICp--!|LEo5Yem4p!x z=rV<~3l)yeNbXMdo4o~*A~7veI~#O%TE3v>qzUNg!CZ-O+h_)UY-#T11}bEHzZl?f z^qa5klA}%t>T~j2{wAi`*+1a7YG{tROvykfG<`$PAc8s1qL~fYEsvZ?OQ>x&c+G`o zDoiHX)B>rNeU$}I;T!N3bYyFlOt6@S7PM#cQfkl@Pzh8>I8y*?CaIrMj-^e;D#)>! zqrvAX_woZNwRt4lbFf3wh0sy06;eB$|DJTzG7#4aJe^$~+&a=q=gArEimO}R8)I9VDD02t5bf4v-h9n?I8M7$Xc z`EXxTtaQLkzv&DdH$(7ta#l%Sfu?$^aHA-v89x59tYCRHS2m}{%{gfi6p6wOGY}Pq zAuY2Ep>s=%gnQ|wYXU+6CYga00da-aqKe&ESN(;T`c1{U?z}mmr||(d;b$KI<--iR z&6}ZT@{rhY1wa@%>@Oq{A)UD7{L6aU*fwu;f+#WMw-((GYS~bao2n{kWQyDBpzM0n zE?f5Y_fPS3uMcV9>}hRches!8*LHE{qoAJ;VwZnwnCeIygk2{!sYsL?3AL?h;PaF; zVuL`n2Mi)3+()46?+>hwlT15g2TU!g26Y}c72linGXOwD^v38_$13Z!H@OKa)Vbx| zibB<`5SL^Co)s*oFlk$<`eM^0817J_*NWr!W~{9zaBV+CtV`>ijCP~*p9QUT{J8zs zDcs@JZ4MiPnCz?yVSd;Eqy}al*aJ%lpuWjw?8p#PTJ5w|x>#=#3^SLaY!Dsins;=cl*rG_wp#2qW|jI;WCPEz3rvuJL^Yxp+mnwZu=c3q40P3jpCcjvnGeZDVXq) z-b^6E0UBD!UTVo{9NI0Hs?AcacV{H-U4Eb47C=jiQB!3ZaU7-B9X78+ce+s0h>S+b z14XYTWoFu{n$>YD0pv($GDw|3pgMu%6rxXAdaGjL3H09J0-~i90x-|XT;0<%rhjE5oDJO;GPEOB1(K_ZFmfw`a3u>vuWAb^7GQR|NouXHcPQwv z*01w%p#FL{Y&vBTJc$+so};QHoMRb`WAl-8)Vw2|1YbvXIZ36!>c)&8mp)Kk1&~kx z5vURshu09zrcgjfq4v~dW_KD`=EA+ z5Te{xK+ar+fLW{rl@?l!x`5lL5H3}!X5JwDBeGAQX4-q1jiRZX0&i?!Z89ztYQ3O| z9h@4kmpRG935j|)!vGU$VUems1L*Q19|)RYh|R0j>gmvq&FI$s3o;sNdd6Y0F`BgB zv_O=;S!A*kN;ak+0J=`8bDaSxNEij#4|(?v#-v#wN*lN23WV_KYk_yFDbdBJrp7AH z1SL``mynUG#aX-wFWzzg7?e&=`bhO1IRL~XbeFENQZ4jWAfvi7GZCJ~1OPRK{v~x5 zTrm=O=^6Z7$7B%5(*XX5rQl-*fB1G@bny1^H0X&~o7`~CXrRLTLg@2hF2EDUN4$gg zVDCrV3w(?5*?8wTfFobS!7eh!6=*#mmCYRb8CW})ergq>89bwWV}RaWoZm`r44AOF zP&NHQ=eSdha>1McY2L_#3}7ZBK`=nm%nfzO91Vi5hT3D0aP&wAoSeZfG7nX|m-@3b z&7nq>xMU8QZ17zE?oQOj&!!Czqb02zj$v+8K`$jXG%=PENpW-atV}fv?tIlh zl@@{{&#j$OO58cdY|Mep`#uB;9GmGT zu&(WI%+6PM1{)pGUy4-?*9;1M?@AE%?EDS9}TVXYkPqO6Ks;fhXSqo45=? zb`Pz}qSWbg0wVmA2>GPW^{VwSc^q6aPFtr&wD|A}xtwB+j#F$QD}(e+n|Y6e8N&~P z3C(J)T=v(ItAZqMlP+RFXajt zryz9)X<8Tjm1-v6T}O*`MQHs*8n%O^)>%{U2}IG=2~d|U8eE1aTAVg>iaBb<2(&uU zDj6CsCQbx{l{if491xW7vo>n)rdAqpHEHvRxvvisd0T6lC%Bjg?S>A9Vhn4b?BB%R z1UyiR8YQRF zvjg$U0PcQA{>ccmkCyTLN)5ouO9qAst1=eO4SpjT@T!rKn;l+ag=;OfyQ*Q*!I#?% zxfEMuTY%pt7Y({pfs5}SYhs#C-iDq@#r?&Oz;LEt$l*k481BwqyEQ8_!<_HHH$SA1 zc-PjDIKKYgOULukepW?%li~8igLXntT9MJX2LQ=6WSI86hNW+xYXR(FFW2plU?l7C z&WwFSQ4HiwgoJp1a5l)Lac}jKV)?gd4JC}?@ctmF$^K#1ArQcVVJN3x_qWh!lhli4iK z@m*~0vI{|0i*rF%)(*CFGei$vFD3rH9wy~WaMUE)(N7!-5BjZ@M2d{RCRBH&aTTToOgGiZFp$C;IN}E1m06ay z;K(4X%Ppv2z<(U9<#4Xt?&9d+*8RYs;9VwD*4Y)GNW{ zceMDiG}`3UI|$~iI`#sth|=qYpPau8f+z;{X=?^y;NNY>&xow8Jw_pR1H8;@ZS3t>^M6Lr!TKs}v3Ix$ z>kD;i;S1kmafr@t9m~DG0Jx;@Q)@CP;(A8;4;RSl<}h}(#S?wbPWrlyHMVc$t3#(@ z&i(5th{p5NEN;a$u>Kk*3|A6n=7A_fiKMUgXy|GSu{q28aK5|X3AHW#HmCNi+A&tZ zbq9A^rJ!KKV?ezWKT1n$f;rK!c+M9@e~ekMW02vvY#_4>GTOn60iVeX3*hY$2Pwgz zDOTlcr;eUR>oXuo%=^JP+8z>t2OI3>=pv8pN6V0k zD=BY|p`Uf8qjROzar=oPM-Bvu1KwG`JCPf zZ6NtF13)${Ayo8xfKsURexzT+OX&)D`!@QS$O^m)h6V6b=(Lv2;$}d(cthN8o3|m1 z_6^e(Ci1R;aO)q8w19ggTN^i;f-T=Zhix*?@6J1O|z+S&oc!uXkQZ~+$mdI$5}}C>nrKCO~{wp zeCL)Kf}<2a(Vlh1(d{e#`}exO#PZ*owz``lw`;k-0A$uMx@Kn;Y_D=f$o&^RCiJq{ zcPJdCMU=%fAujn*^(kA9sJzUQDwWfRG!7+`=|ru!^$C36?Hg&lNY$SBP!dQ?uGK+F z*dIiQ8>O?~%wr;ST!4xby^c};MWVfJCyFPJAXctX?ERF%GJUMuWYHa?$f?HKD}IBD zBN^KdfJD3{G%qM#J<}lidy+v+COgCBIjFIK>0c2Yc=RLZrXh)4iB%F})pS|ag(dpq zTpJ+?IoY9qx7(rAd1H~;G0#&r9LP!-LeI80E}k>m=GObY&{&H7L~^!nAM2a$L&E1{ zXdP#~a9TL~z8Dbi?PL!7(rY4%86k-ib&Rkxz`(C&(uIJ5BwqwuGP+Qnliq8FRmRU?N=?Fp0Z%8OoOk?ESpR!hZLoOt%c08XJMg(|tjAxz;E07J!m$FcK zkfC$Ij>p$csl-Fj8&I72`|)2!ByrX5HuhW;;*Cr|%mak2K}@v4?F~=knfQozyG%9w zfb)oCt?3#;v;Z>!K0Jb`k+f^1O8gMd0CRi9P`i=PJ3eV&Z)`N`q299Eo0$kGck7Y3Ai-H<1i;F zYh6qVh_&`wd3>$0f65Zs-tmLq3L4W;igb;4gJ*cqlxsUrI!QsLN3FCrf2nUAO`V%Q z1{CO03f9Sm$n0}O({tx;Th`hVC7~amFXl|kY|jM_tDDvO?R%T>xQmWcmNL{!w8RAHd_C9WBv}7(&Acs{HSjdvZAq}P6L@4pN2J^bkgH00P#!w> zT4LQd*XPtP7LX>3$aGey(nO@;qHCP>tblGRS6zxODeoH5k%K40}*{=0K zMfLzchSB#95AA!zcEP1gq5>kC(5g}Meju+%&9PA9&7eipKJ@p(kDGLbI~-Gcy|btQ zQgX(?NZ&?lgki6D*3^KoC!V1z>0H>cw_7fcu`Jx_avurBF``~aePpT_@VZH=ySZej z9=)@Hx3=jgX1dY-twKYG>BJVxpt{j<2s*jDR+<|`TP6KQQ?BG-`$tSnoUtmb^4KQa zi+bPlWdZ*(g+}yc20|z9wXXRJpE`cEf%P%3(^`*_sk_O3b@!Vo0^RJ{L-cb+7y(XL zjV2D|EvRfFsF6bIRDQV@Q1z_9ZMi3+*9(z=UO^>LFPnS6J>iTrXY!PM_Lp_78^4|c z#?`>zu|252X2Q^8ZFUxe(Bc%*_dB4@BzEirXdDcVVunTW?x@ttt=XQ`DSW|okd5B` ziWtsgkMp?a$%Ho8aSvhs<&Q1a8!MUVLCR)Is7&#Iqb;GyKF?DNU_ZJzb>&e)$;70> z1Zb7xS`YF*jJN1oyO`BtGqxJ8qKA!X$-cXV7MfAt6El0^N$5GPm?3RCO?8U7vtVx* zrnWD#pqbzk0>wc2r%Xjnx)s(Ohvpw2j_Re(xL?@eSg#l+dz|EDY;ME{qq$CzG(;K1 z@Yw8pvHAEUVCg#mn5QAmuB(JQP;whJA|7v29)qOhUmT2g!}*}+#)_Jz(6w8?CRc*m zz9$S5KtilxJw8gBf%SJyH2rE-046ZU&Ys4v5WBZS$Zfhbxx>-%mz@CJ`AeA&J-n=6 zhyx+)3$;UrhIj1|ouFJhz^e25Lbyh5^4ewB0&I}FMPJ{$OUPR`|?w) zZ2GV51SgJDyGwj;y|xY1aN1Q-cb<-PWV`sLH_?&fFkS(_BKg!n>1X~Jnz%QW9AmMO zYn88)lzCAw$3jMC6%XWX(Hd-GlD!^ev^zV{J7a%6RnME!hX^2xZ-L@41s#drB(rqc z;Fbh3Js<@@w8-#@V!eXV0P1Y}4je0-y@w|At!*#WAH%?hBAG=t5)jMhzo(M8g2Ghr zsW$}C4$xxH8Hj5McMcfvrleO4gI~<83d(_~$#e`I%Xzl>p0hg|h$~}Ce65@Tiw-q+ zH>(}lmrQ#>=~tA)0nQ$0$F+e?-iQZp68Qu);Zs`x5E_#ua#0Br_w@EJEW9Z<&$DaF zTmk+P_*9e~A)Nw6sdPBd&K)xeK?vu@)9BM<_4^-Lziq$U-K`q~ZJisZM02s-Yf9U3 z?HAEGA4ZEVj@j><&m9fzl2@DR{+D)L$=77EOecrEbW+aGCS0#8NrSU+ogJJaLaUu< zjbj1&OG){z{N+&&{^CwUNQ$f>z~1f;=>PvEeE8o>xY?ll_lY(T&{}KqJT?|UU*BcB zEy-`U>I+fpN<+E|C+79bslCZ9b)EBWOu8pAiBF3L5=;o56oH$V+u5~wW48}J;K)$| z4>@HFXFTy9DcY8;3l~y;j}7|kyZ$F=VGxkwI(Blj=WuGIp&otjKuLK%<*LBqJbJ=c zU3Qc|9i(U_P=Aw3nPwce?$`h@&SUD6de9~Im^+D1QS*J5&9wOOXG+9h;H%#I6W>FX z%!m4wp(^^RxtsqG#iRla>yL@KhoY^~+=EoKOV%4ft4WHOy^5#snqtRZO^Qaj_RjrB0akJ z&}wM+MCtO}1_N}EJw#z|dY6m1IT>$B?` zEPwXiY>J6(G~eYDof-=;TevZ=8sdLIH8~Z9O3_keJ+?T1^Kj6mhcxA6ay)IIFdzUWvIoD-?&YrVB*s>goE*-=Fk4kto7Q zgFC@yqDlgna0r49A~@7Prqz+-O!Mu=rCoS@+RzE`^!4Sw{Kx`Kzj(Ic+vza;{C*5) zVNz2FS$jk0nU(U^C2t97JOY=jj&z4;rkeDm32Q%EadsL{oh#`i78fZ>@i>7y3MWg& z*yT0eZFP3grI!r9KiI$fD^r7==`iR^yu%rL1Le^a3*R|rOO6w$DYu>MRa=9vp^d=V ze;|Q2eG#*J6rBXHy;7#W>}u*-ekz|#WITyJe{P|gsI{eJIbPh~ny#a&96$Xqo9d7D z2cF2ZDLDI6kI#|)Y3&wpUq`D|eyAxIg@VI6cZDVCe`+-D2t~n1k}*!eZ1M{%Bokj= zU%WMpBeVCHWH^0PnMDpmbV-+AYU<=l4UM9Ls)1UOK578q-Z2Ql?foXibT~v}Wg|!x z7_pgmyqmQ-*EM`Rc{tgphA#)Mb*y9{JlQPmv+KxOhQP|(spnX7x1fjGxvgY&oh?r7 zD2vd|@u?2BCej9~7=bdpge&DoXsV6XOt;p=#$}^L9%3kMSSL45v1(Wpn(ObLL|Zqk zu?^Hvnm`Dkv|<=^8i6G2a6PioM2CRF_|lj(=5hiSj_;cy)cvJn3l<1O4l2U&|qANtVqA#u%e zzd*VTu&rt)3YY4*kg^syP{jg7WzYZ%9+bhuX?QdJZSL zykI0NsSu64VY1#E2n!Dpt)SK5L;GmE$WD0=v~#c^`}{A1kN+=&oBzweh!`18m}?=t z0j;$-0l+_E2vzi87ifF@C0XDkyfQAUW^;uLb#LNA`*&6 zya_+2#GdC)@)wZybS0$i`OH3vzHTY*+?dSjUnkRr4CCS8%Hs@y!9Zil^(VT!(+Ie& zj&iy7V4mDKVA6n|dXd~bT$6xLWVQ2_9B(NJ0=kt;4(C zC({`Tr0N!{AL*WksrXi4Pq6iW4xImU@cZIF2kV)3qjPu=O-WBC(`nK96Og)g(}Td} z%oOH(JPc0Qt!>Gp#|YN$JP0_5%ng6Euse66n*!%@lL08An`+nclQAqJ09Y$8eK|o> z3l`mkO`I5!tKW|s5D^%(;=3LfD1iHV6DPv{SIqf|I0C= zcJxu+io-K3rvI5Aopmxpj1vlzD^6F2)6qi6dYS7^F9X(3rL}kWXBt2t;-eOZ;*j6C zNchIKVfm-y4~Tkh;NS4o9$ewDfRFrAA0D@{K#$@J^2-1I-ji@>Lo>|L`ys za=mfzKUu6b?74ucGoll#Bt+6x+HRX4x#!=@07JV(&>xS3CoTGYWqD516h=}3%- z&W9@_(qjS6#h9Aqr1U7@^^Zk(irfB&Mm_z1=%=uui?eXe-iPziyuVJMGxx^KXRMOG z701R35x8RtwoW)!VK36pReqhC!{D>G@1pxpPs7z5&NE=Nc%YI-c$o5=N$#ue;lcL3jIAxD}?1KOV~#Ik&r!~ol(OZ387VMiS}+?8$|wLBTh~WN)wR==05HbNW%O-U@S$1aEP= zjC{*aF0B{DN$E7`#TX|IE-@Df(9Pp-HJD^`g_VD#_+)vAyaPBUa0E`nJRM;z;?{?$ zwJ~(VrU#lb#(v?Vb!EIB)RK?K`I0_Yn4Oj#lzZtGQjYNa9~$=`dYoE&8Ub#eldEQ$ zUrRCx=|00IbiEj1Z#%pd;l)+7r#?3)4zY`vV0$W)^x0WvwXp+ptTEh=)pQ+N4|j%? zp^apktrLJQKDK!x{SxMB*v*Yk=qk$Bk;^K1d6H5ik4=XS51BWHH}jx}$dQdqG!S8l z#9fHH+2uO2tVa0JhWGyhm;D#YGWEs)6BMGcJaoK))~yzChD9cGSpzhAoWpoxaqNNL z)w!$hDZJD4)pBf<$Qtsjw@9WyN1mgGp)vsGI#t}y<6;n#VO4+z5pffBW+1

IB_4 zYk5Rt_--c%^M0Krsf~0AqMuJ2?M;5Dpgx&L&(5g|6sbwd+U3Y(B7i)P4;P6M#y|P? z1%EN7!lb8*((Fm?9wEN`C9Sc`tZ0td8PdUrIYd*k*$tPaZx5Tce_A6kX>Ip@cL1Qe zKlf5Sr4K;9`92+7up4~51KZJru`Q53W$#S#ZUZhEb`5m^)a=^&oOZ6UN@wTqt^uxcTX0$r-DFD% zzB=1WN&Gj8ALq8)+h)JoCf$-IO?@B^CksGVNgo!ZcWBl*z;yy=E0u~~_~enPk&WS& zxT4aer;v~ziqRy+li==llT`R%7C|UtI>rFOi2=||lvX0izR*w!Fc{8E#`*() zy=sxvBUt$~Qd=C4O6*5Q4>cx)kp^N*ERorJqn&{dOG2OlAM|H<@f$)S$L?fFyj9J- zJo$sCE8KmWg!5wNNDrzKZHh;ljYw#@ff(4^P`?5MM9YT1A4pI!t4-&2hw0{bhs_N2 zuDIJCNIrJo9~WJaegH`p2g)!M-8m&w$f|JvS8el8#(^fl&qo zG1fOc3mQ1XlDDMZUq*_lYc>;@B_zw&vxf?#g_n3JjBHX#uT<2{dVJSaTg9yyK%qRx zg8r%ocoBy4Ky9bA&|A@FN|goQ9t`HnX;o^vkoB4Kkuub!5uw&(U2o!S+}<>FtIM{E#U;4YCW-#MJQVV> zg|K-=zvKg8>i|nDVOgp=e@77=`f>{hWelXqQ6H_Hrm*N7WjgvpgeOL5R6@>i6)ebP zr`}BYeUqOmS6UV=lXXh4a?vX zfQy{cYP~(d(qqCR`$t?yn=RHA{mIETgrDrkQ}{-TuBJ7p09Gq+0Z_ZxJ0S#bZ3*uj z`9k#0+^bb^dc#*rwWd&Z#y??_J47(@v_Yga0`e+_EY0?(xGh^tY=V#Xuo}QyVRCIlX(P03M)$;gg zbRCr2`x)GjS!cY6i^_~cD{d%h9$3hF9GnQ%m{ftONheHzPo;gAaE0n$`MS-#SYJPb zNqv1bs^|7;U&#?VY*n3UfPOgWJ?me4NH}mA_5!@75^I`2A_7_!L;fwJSPa=3Y$j~L z)y)y;W@BY@Lf&22#m#zI;A~#$v$hcAd@R_;_t3BfX>SpDPYM`YdLwDMZpsJblkbdR!6aF0hq-4`b-o zR-TJh+RgR?s7;C&@imQIw1sS(=T8UY9&}o)q%~G{U2FT31zy7MtzXs@P_Dz^&1*~> z`}-iRVrMXdp6wS8o9f*jI?n89?Cq^Mp#V$v+1^9>(hOZD^}Pmw4<@V9#kVIVjSY1A z->w}7WIhRu)r=mi`Z59mbNEL~5?f=0w{Od-OErNiSx+9G?q3f(#jUsUOewRKhB%RW@jC{-o8Rg;oJG2g%TjYZw%bacX54gL2WgAQ#wzKR2nnYH*j)j*kdk zOoEn?C$UBxN@3pC_I|gB|KiomrlQe6h9u+)LPk@>UDT|W`<(zb9tjg?b|$97VuL3} z2C=)KoC(X=q?hy!ExsQ1}Cm?U*%EH|zdYiTTOUvEI#R8=Ip3=O% zRv;wSsNILpldYTIem+P5s=Kz+qGm;)c?-YO!u=z2r*F$1sbq(PFl1*{o|gAld-!t> z;$BO;*Fx30qgePdLA47cb_-zf+2W+-3Rq#w|F|U?-)VFA{)G|OLvd7F9AGEmgX-lb z`r#~kQ$At2rMvw4zgCtHS+?J%6Nb6=dq;GZsFRoO_<_|fFQ1Dd-oZ=0_yll-M~tyI zZa<(;qUoES1Z}3G>72+y-1&hSYHQ3&g&N%uQJYIUMk~rRadqlo0Fo9JlADt9gXqMj zFbLJ?NIN)!7h=oZh^Y%W=%mU*4e(8*^zSwTYA}VOv^T;8L@zP+G8c;5)5k@3kslrV zYco|dP|#f)?gZR@0Lc=mB{!Qpt@WTdus+$fJ6AnyeSgk(N4ifv^jC?~ISuj+SY4X_ z#6kee8;kU4!M~K>1L~fxCr;PA6x&4R^&aOsPdN_)l{F4NDD@At;v+cp^!?_=9*^f) zk-y}`91?vfiU?)J9PFu#n7>BET6V%4ki}f%A>%2E#_iY_Ac>3E+r3*iEl9dZU*yCD zQ5QY7;DcJWj)RdFyR6JO#U2M3-hkO2IX-mJaqUkR7EIi(0Ym_f&F@RL7FHoq-g!3H zCQ_XD*|Rr9atlH7mCFYbfZ_c?{j8{iNWJ~3p8e?;nwO=84aTmkA|>Ae|z$UJdjfvxIJt?5&7h8-IL2IccY`Hk7848W}kB zB$bD)e4>5;(98WQf~=ei%fmZ~G@HrC1jW&3bi%y>xuM-O8M21Qqk=AF{!M7F?kBWX8iw?@!4XfOrjpw$ko z@^TSJdyb5skuDO<$6$td$i~5g_M5;yYOOYvra?jrut@xtUaDfK;Wfo-{Kr#6|CKCU zsjQA?_Q@K1xO!JM!+|>=bel+AU51wdVSqt6Ge2h{ed(`OK<0tCpIZfL<)(>k1lLT2 zMbMBqU$+cP-+8rJ&SFdo6To3{ada>}$Kd3AJtyDu(M_ci&>#4yy0SJ8I~iSJXwdZI zaAVUA*ji0w>%ZatAY8~3u8B^8f{9B8 zO}LqHFa^t4RmTw#rVvd)A_ya7i6n@lUB4(Jrcd-#8O^5Kg^MDeX^yfG-hl>&UIfq0NaAw>(T_b5jj#~{=Z zm{3{dkXR4e_)`2mmaabR+(}4F%R#~j;2HzM?M_0Wgw|rZ7;Pk5S=phZMI~_Js2iEE`OSvSsi9(AfgL4L)u;y236!9eGfJSiB~@Vcvk*W&Yj; z5aT3VJsn0ID2~JF;3ukPX?db0M3`NSv>UVBuWwKX-;}Ezu&9BKje9JD4xNA?6IKRF zr@Rt)h=B`DI^ns2^406AM1_me+Bg5;#zOa$(|FtzQBiz;QwXU9O5#jzVj3s`;OwVz zILPWTp$Dwhs5NUT^IeP)a)8Ct{R*^cbJGbq1Iry8nql)}7-9Y56HOc!5E}GOu~Z12 z(m3Izh9g4FOqK6j7v7>SiGhdtKBH|fxTf7%4}d%*O+UaD=gY%CORt&~{dZpqUX~;Z zVZ@6w!gq)l@?i1rQha0Znm367OQj6iBblev2Bp*$o1x0T@Ay9dW>vW8erjs)!(YY| z`3mE_*`*u5{2-8S!BQV97?v{pvNd=$L5ffkI28dd9dEcCnv^8ykH=oW31)OSBbqM% z^!!C&4wm&G^g1Bh<-r7pMgXFT;o3le!>S+wb?=A)oM#gAG~G(C_BRI;@F>h7%SQmW zm;BTnuaP}9@xK12Pz^9a6w8;l-xqp+O$>-yO3UwuXX%Qtpb&&!5pe4ZS7jC3ETA2w zGP7Zmgt-~aZeS&7%IoN5#qRr_O>b7+2Me4Rv%5X9$iNhNcN3P)h=%q>hper!{x!0c zF`k(=t{LTLZ2CyQpS(N?IBU^X=&mKYf~pbF*9xeHTByI-C0ooGlGYD%))$*DeCPLJ zXyffMxzmYke&Bo;2RDd+NtOv8yeE6^Kj?Bfq!-z0I2J;w&86Uo$*{&GL`CRtjHJja z9kGG@j^JrUFCOUnbPA#El`GSs{uA~_%YDl2?DbeY>i!CLOMY1f;B)nm>(Kdx9dlnWMDphqD5reOePHa&}h zyLNUeE?kK9aAvmBW^poV*E7PqPWXD7`b|eP8=3MUi|M&8ixN4Jgts zQe_~Byd60v9Fxl*d$#jYF+Vsf5J^cqs^c+H07@W((84gY7wEPFsu3RC=gu$B z^dB*07Ci6-XlB*VzPqhLdd~Q2P8=!}31=qN%pMIZ{KoSFneEjBd48}je~DbjQ&!Yq zI83MF9wcXG5*SXX;6YCy^xl^b+h{i(snjVkr3Ya#uIg}-cg`p7K3APzzYLmWDu&Nj z0PwWrn0QXQ-!d1j`;-}9@D(1k(8vtozeFR~VD{Yv2zK5nn-%0>KIH@q2bQ^g;YCD#5dw1o8ceof8P+=IKH{p zHwRb2&+u&d8Ex&Zd5lJTP1oNSc(gUc0k!|M7G8I4E50FgU={r(SfnPn_Mg_axi`4| z*Ao!k|7mStZTYo{1yEJAb$%36N(G48TI$BYC3R^nkCLAnh#Dbx0gokAMOc%h|2?q` zgC|_(3A|c%7$pmVKDKi{$v+HNaQ1ofLOF<<#lFn1Yc`rVG?#hY1b_qqO9Y(ZhwD58 zB6_J`+>*Op^L%2&7#RXvd3{HEOhi^nWYE(0Z2sqQ><6?+5~#ytEam{DIo}F1q}65( z5F#k~J#Z91Lr%iM9lad!&>5s(dRNpC)(bU%53lr%aKs`tNiE1Kt>M=D-h)F?nFvF$ zba51>3PZ@Ps5Cr zk>ZC;W^gmYZHKqraH(X=$OE~no+Gw})XQc0$TficgDwj7IN+_3`8#0zp>nWvF{>nq zU!ZlvwOMl>6kQpbv}AETbFU& zoesNJut{NUWzjnt!ln4>iNnm6*wSxQz7gqS!J9l+^a5Wee_qqN#5ymu;7Pqa)qLSS z3ik)w@q>h41%MpJqwe_8#e$n5S=ypLer1@l_socAPskRsHO)+3Sdg!$#*hsj6~p*{ z^Kt;7%vJgS`nYF-l-I#oNIMrz8b|Ov@)rSm6gv`?NdehzMCdhGY5cKyUGK#cZ@nX1 zOM=K41%GIOD>%TYRtxO=;I3}nEaGI;=RTnwFb6HyJ;cRN9iI-neGmpd>^J%;^-2`9 z2)n$;1j9t8k0#~rF?CCvWA9fvB->PW1lna5;~ zSb~CxGj=`T&TT#(rVLl@>>1@*5wT@fO!NEHw4}WTy<7Y@XEZSgf9k(Y#B|vT<`ITr z09_OocmOi+aE)%Fl}%E9#lv#yq|fLVe0~1=lGq3>8TpcuCW~4sI}*A;NSbUB^4yjo zb=$@rTw{c()dN^^l{ByEs+%qF>q$9&1LePSYMPi3(_+O&MvfJSGav;+b!bop0hCqU z*n-B+l|r~4qpd_eqd;5=Cp#M+jZ#Sq;8HsJP480VDNqv=jq_MxnJM0-gx6a^GoQ$E zEGRj}rBX(eOKNsZZZ>npW=ozfH>Gu0x*IW&OpHbvk5HhzzNtBnIwKH$YDC_6Pf>OwBo-;Q(73LC9pE$1GrJyMCLyI z-|tE|p+tt*jAn6>j^BE`u$N!O#?m#zw#z4`d+2i3{_hiM-wck%2q_d;zrb<$EP==j zBt}e>oz1Tth&&iWF z?Z?GWp8=ys1Q+%jL41=UzH_HUPZ;oEdHt4QSOYlbZMR?t#6uqdHq0&~sMX~ME4E7U z8q`)_mBXODyi3pLw!{bi+XxgTj_;sWr4~LDQZRrmx886_(58Fr;%I@1eK^||4$F)C zAWjpegoNq?TH~%}+=;ktu1qug%LLycHL&D&+=ZsrE01iUC%6Pa61ej93K+)2X=Zhr z7S_*+Va1Acd;a@?>zh~jd9igrzibOKn9^gn22Xz*3v~)!--I!CavMNXr$pQ4B^$WbOHHr-_H#ZR7Uw( z=y^#rKsXS-U@_&hi$W3k75XEsO-&NGmy4o)k^GYIRQtL@B_BesmQA|EvO*FeaI-~? zlT1t_bAm;ZXTJfr$X&PjtD(Fuwl*V|VAJdDlsIvFQIyr=#H2j@aic%;xG4tbA@MNc z_;18aEx#?mCVd9Ex8VjxSqcJZ13(@d!7(#H2YVu{hGH6Iyl^_IVMm zqN-&XRy<`lIa>(t3aM1JkV0j2?~1w^h%yywyOp!TIR$9J-y2R~$_r@1kJVfvJ_0=P z@4_DU%V39d0|nlH*p%m>#1&?rrS4V9qNIF2F7p63Kqwz#l_bvkgW2dA|9)b7^S1MO z%*_cl62s%V%O8%NtT6@D9ux^4uW`B}Qypnj(7P|c*mok%cI;BtOx z3}VUTO(+@3&^KVoCE*8_o4OKuGUoRQz`Mn*e2`U*pFpH3AlODvMv798=t$t(!*J(t z-AMqT^&JX%ss`lf^R9NBG|s@@h-yd;@OuOEcz!mc9h(L-f1&DrhiL2#-YgLG90>HY z^LN1CJ;O8~)=}2LwjB@`rvD`?Co>3_GoVoTn{HopYFOX9+vqFyWeh~|12cc>@GC>@ z1V>#A-XpzAb?bhK z*&QH5q)yiG%Hln9tIfSi!)mAx_CrBa^x;<$JFyeMav}3BLB6d^2dF)Tai> z7w*jeGx#jCpMTWeezN;-P`l~o{u}u;eSKd~98$N9$~RATIR_(f>3!o~;&QZICJUdB z6Nq<3Z#|l^WKQ;Mab(OWyh$UUCsIl1#L_s≦>njQM})n=AWb-r2Jv0an>o#h;?% z#O!m#f1kfP4)s~0e{VEuYr*48R*e9*#Z>f_0_a0zs^Dgz2IJ&Zmbh6a6Q$pLOC_p~ zwV^WA{H(3Q6tYmavI0$Lelw*S)98enRWY_EdTC7QdX-hGjeXsGt~83tY*yi}?p?1q{chjAX!G>vqB=Ng*KdBU{^(8SlW;eZv+ zgH)Ka-I9J{2Y&*FwnKG1d%oHvMIfr;|LEUZ3n9NacO~9nAVPqXd#+Vjv;FG5Gpg8; zcVUf!XuEvkW@mnCw7oW2qIUs&giJB&`;`1;o2|x&F}R9pHqi-(swcqezvHOM>Je}y zWb@~e*u`R?;;b$oU~+cXW9xG1SI!cAe2abfe(B!h37GN?*ACMGw@tLq=+}e&3ZG`L zT|Qm)D*fcB2ZCzH{Ieh0k6Ijwm@3yCg9K)iF@QH|S>aOXtL%Bcn{x-)^6dfpCS?17 z;D3iLN7iwjlzk5uiHoqvPTv=7KuEXA&E@w;jHfctdmDDi88GDA__lYd%3o5;)lZC3 zV?osq(=3WF6&KD;pXV?aK6A#nPwU!(l9Pm=p7C_PWrG6k!`QIhaKPfZ@gd$}`K=N& zLn7-Z%^p7<92hQUyr}|kK!O|lrcm=Fovk-pnG$wubb|cD`D1fQ>lMSoOw55bY{gqo zC(uAe^@!3N-KU5H-fo%Y4$jj^P(4l8Vs8%NFh&}(iD3^;?;dD!&YB;vf6-Rxwm`wt z{B)#y(|xD0u9R0~w^_w9ynu83l)_Ee{K+bUVUX*~fqr8^7kdsEtu9TM&~}=1zZ~S$ z$`2JDA^Z@alRmpSJQR#`6rTDiiWdM(yYZVJuzzLtsz0isP%EOFT)Wiqb#!iYz?Ev5 zE!jnhmH(aI^`0W)Ho&xNfoAnr9gTQe-0kxoKd|_u)MFz&JU>@_KH!X&+gs0I`OzG- z(BkJv-1I$5gfa#Yt^<1tfTY)#ADGI_Jvy#ey4jfJ_gZPUoG;%&8^jT75$@BIZ>5;x z?^Mu_<1LkW9!cUM>>!7$3mzCvB2v#8`K-%V|8O*C$}G;dJUMMP{iZCu99uAVn+aF8EcG}{El*)juc-PQLrq1ItAS`>Im zg6;e9B^+Uz%j1r;+swl=?A8oBqLlu1gQ56t4w|q|DgH}U6ow|-egOvg-k5+_@GXXo zUf&NR1aLW+4TUM`iCmuIj1>zpf@IRg;d3K@1PsP+PsNPmbY#RPV&scx**xo39Oe?+*2B{S*H&0VtMDzZWeHQfL)W%! zkt1tvKcJgI0GW`~XE&B4ZmXcmexplNvJeBfLa*$8tsbn{?a`t9AsW%#Vy6X&k8V`i6=o}+IVaHC8?0@=}2ar_#dc}Py-`dZ-Wh^6_sBiH! zmkvl0m^8T7bL0Yx^rsh?lo{)y3@ki~Zwqvd3Iae7Rgsi4gJ0?6b4{6wvBize(ovEw z2CFyPWyu02+CvS zHoz^~Bm>@7?c7yTGFuWGF3@n`IR2g1=qD zssM^@!93>%=2HalL*V-<=mksmj_=(c3?#8BcH<+_tdooSJ)DSOS zCC7gy%c%joayAv@FMLRngj7)yQXG4CC0rxo|L zi=l?0n%rz#7lZCaliCVFS{hG;NpJ~8yl#ZLtK^MYzPpacYLO}WZdZy@~@e_KvLUm94 z)N0(o~^6ysDS7s|60;vwn89gNW+={P~Z&wZh=YS#SmVM{% zsguU7jb&N%pL2=l)5+)5U{Q114WOogv#K)aaR*hCfTV6}z6orx22F{IP$Q`Zh7-c^ zztRtWJt`FHw~S$CwF1o?;tjJAZnL7TIF)H=dtqUz#}6AS1er#qU8&{29w(0<{H0o9 zzRzFq8YZ%^r94kXdMrX5&;ow-vQrAl6#4gh^>7pX7!t%PdOzy%B#1WZV$Z4uHCvkM zX|I*XIQXOaEfI5akI*(>1!fh5o3;sFkdHo?x4p5pieIwu&Rn>QF^Bhx4knhh5`rIH z8{JZk;7)OVWBLI-)`xhv0z~cb_^ef=L_b&CTKXfVKQy}>^^_TXrw!m9vXm=*w2Xgv zUK90z#%)NhC&6h-=G2&*GUnIhJ~u1JcRnjp5M(~YRvhiDNCx&n3tB+W)dz4^G9EE^ z1j(mGvi{lfS(jhwaZju5H(O81$RDqQ6RI0#)mA4XC0k?DmgO5Yx zxPSzin7RXrjxqozALsOM3Ado+zQBBulLy&+^K8c+Pb2`k|MCXCm#ia#`aM$mg(-$u z)Pq3cn|9R6=D5Cky@i@fZ8>k2$vD0{)uv`6rinx#B+elYapl5J6S_T>B^q@(+Q<=_ z2RVVbEmDqrwTW$#7EOgM51PIB#ld644D5j;_4lAP5i?}RAi*SqRY9(6Xu)SzNx+n$ zFsx6@mN$T{>rQOG7;@j&t+L|tcX0i_W7I3UM4_R1;b=8?AR3k%_lI+P*?5;;=f)c_ zj}DlY_I<{eHDqJwX+?2k{@CL+z>#1i{4$0hfueTB~=3KvijnV25HF>}0I+QL;8d_}g z4hX8wRZv2qP9r6JPbycFk)xiNS|zS#iR@4YL_xF52;M@meNk<=fwXa3{Fyj=q&?`p zd}YCS{UhaYQw7rj?_!CaLrq3{cvWSOLX#hGXsu2>IjKu(QQjiaS*kWmr8etIEh$&#zgQx<1as--!uO^GQA zAo0X}qw--7{L%7ZO;G$5kS@h`8pcX%s-T}J6^&lC6y1wer!InPieywFyb}!er6P%A zhfGqzu!uP)P4q4!y~IVkVJv3qRPtLdsU#gVMr>(%IwMok{V4inmoG_GwC9PlypWvx zMKEk{=%%znkQDn|I1>Kz9+W1yHWFq@opedqsIELLrusCjmC|1N~-n{-@IW)F9H(M*KDQyaIJe@t?j)To3)nrW3FS3 z-4~-7a{)f%j#FNmP-;X&Wi>HcF8`BxQ!DHsJv*o+O={Y;)X6b1fmeaytfv0+4dI40ldPwBB%8KXGvK*lW#Hj?R#R_j6cw z&)RX>j%07q?qSk=af@CSl8vK09`->}P$tt1`PQm7vE>P*zxiyCjffTcyLIbysQvyK z{q}RL6&PTsaa_4a_w63?^+!;?g6-RMnjq$);}6H&fyQ_gfA}aN$P4qBVLblojR;0o z{mhGbEqhLT3mf|E`>`Mwm1wFNeih0Sfk@+$F)_4VTnNC^2!YQkI3lzbF;_oVHlG|* zbzb#LbJmLyVCnQtjd`_NmV-ZhTxytug?8zp-$32F$22n*5NGbe=qkcD%04^Ip4~?x zYA|V$`Lh*a)i~2$c50S=RUB&FMC-6>tQz%P%YrJ`G?QpD=YK@|aNSgDd0M9S;Rx7@ z_R}HxJ-fx)Tm$;H-anMD2BEy)tuo%W-~JQeuz;-R`ECCV>0=uT93bQ7@^YPtF;#Xy zj^^R^FLi{xRlfH7U+M^Xn^~eA*{=etH$#ekkRg7PCrvEJPQgq?bMZT9dNfjj7^Ck4 z_3oAN?wJNrb>|@UF@ykx&5MRie~6d>u~O#PMd!j}KQsg9GXB;lm=tjr(y|EPYl!3N zF<7~;jOr0wDD_4#5-4{y??3nGNT))3KKcr7QklUMt?Yw$!)|W9xh_ZdW7u=ZQ4C@D zOYOE}Bg!0g(70+68Ij_uv#2QDx!{#ni-sS8==*hp(A^bU)uKegX0r`ys0cdQVdVYp zeH)_0iAuvUVXtQ9+BYF8dM@-r%0 z3%)2_?^VawVK1`B0aJBP*_IN1j%ERqR1Ps?fy z1up(D6mZL-3xQf}xL>On@aE$P=w$sEeey(Mrhbl!vY8S4}w zF%Q@S?6ke7bqo&Voc3!!X z^~Gtf`#n;o#3Pzj_sk90@Ayb7P$=6n^Y(D)YIr7NPJ9`kkk_^JIgzEXImliwU#4U+ zCF4jjEhNT3XyyTo<`(0CRK2)J_77fa8~2VyE(xKYIHouBw<~53v*PEm#8}tlSZdgi ztI>w>5sEXMcIb605KuSNQ;QB^i*ad4oP-!janYX;t{;z$_yPXQ;OweFNG-v&0`qQR zj2-PZ&Lb>VDm!IjUl}`9p|UmcHJW82V;Cn+8xh|aTgd;z$K@rlCk|(yKLCFSvOvJq zW4=k4cfvsLA3%3L6?p~y%jIVJnS-Eowr2QBRKdS8-BDp=c+>gtu+AYUchKH|A@smT z(eDD7hv2HM9N5N4Nz$Vh&(?oEuA36usI#Yy;qC@NQ2y>G1bRiErk+sue;ZidCtbUB zG@1}?Kq(fGU0o+8X>xPUtuUEl7Tdw1jD%%mOr;JI4YS*KM3a(KZ%@XDPcxy2%ecY~ zHIXzxjTS|Z3~|u+-KYNbC>iY4_+9WjExay3Q4L6wrL2LdEm^Od|D%9(v0h^NG&XXO zDsEA(j*cf?dfX@pd^m{GVy}+G@AehLM))rJrhv%t5^+{73{#4;=z7tz`@mYm%umP6 z#h?k)hd3@Bxh2tR?;r4C9Yh;XteK3ib-CmFWrdsgiK2t8MrMPB!F5=`PK|n3la&DA zTNHYO8lTF@Gt5i2Xll9EOUY_IX@v{4k1SwPP|Y z>E|lpN?;NQgixqfH<9axg~!!f%|z>hlR(O?tcQ}zf6DC_D$P6{i|`~{$1{t-#OS** zFhj9iSyq>SUM*AEvgsf51k{O#YCmr~=QFuMVl9{RVy*{{iC~c4=n7y2ctmOb*-1xR zHhL@3=IiSD$h!YBX1c2=`F>MUx9{>bh2o-~be!ufy4$zcbH|sWOQw87w72n#J&$>y zqqc|)@JaUKW;xAw#W)k5R=?~uzgsuu!}5&YWnwvAm&yT6H7wX)0)PzdN#LBIL_`w! z6J{+YV)y!BL+U`K^tOV;jmG{XA0&0J9c>|YTtbjX2t=X=)xZcG{ko!tSmfvBRbM*T zz>X+TX^V*$`m6@e2yNT(lj@XvAnI&cjnpJ@O-id#h+lE1i?y_Zl9zW7H}OH;`BZu8 zpMm`2x>dDtuZ3+o1#pKWP{Aqj>%R}#J3YoR8KyriIi2wN2)TDj*L<4aU!5As5f_zU{TN9B8!;EV@GcJzqL9aZds z?g%2~5loZFciM`ys}tb_8w9Fb=TLezEd{uGWGE2Nj5$^)4EP_>Yz+pL<*&iUR!}5k z4hQt$m!$0Ri+r5krnQ+}=|}d9{^Q#g@JMoY7aVKt?b4rVM^?;mn_B{HC0&{QN6oyMN*)HBd1T@q4n%9W3+U4g;X6FXVI z2dK{fCXq2rN<}ikG-RznyNYS3hOi(sRJAdqn*fN+N=sZ5QiH2+o@HazrW;Yms!ppH z5Y5!BpSyJumQtYgtfg%%y7L$*n>8V1E_kKstss;5-ldI+w>O`EJAxP&`j_f?+Qq-( zBi#&Qe;cKW9~j#$iNY&?EWD3TSz-P%5y+v#*KE4k$tb-7Vw z0Sllq)&PeZw~nyneB)S7&(`4r>Xthl4Vh6P=jz1j>QL!Wc1|s;0;gO<8r!Db>$BSt zZkrW7(P-YNjaWL3c)H1cj}x|GvNuIWM>Z~MuLxAP zV_vVWBlmucs{f7Zbln>w8F{DfH00c+YW9I z)F}#Wm|G@Y6H9j(6GARL29II$z*Z5H*fZl%c%ls?MCp1ye$cUE6;xGfJA*+f_5dvQ z*)>v=byk7xQh+0&R6Fw%={=3@40I1%3~wdvh)z}oGQlwCfV?&s`p;|3)oo5#CPaD_ zC9Y0|!3ekiIjyY@yE`D#cUM*j54($rnIHBS8+YGJl~)FE zt7tfdWm=rtwDX^*ehAa4Ss8+TDZh-d^5+qjDY0Y12)wv@1*Dc_9$je%+^}6>N*A~* zNtMn09h1$^%OxrIvQN9)=NXLTXJQ*tsUL-Ym@*{rbh-|&dg9m_ulImTK{`&0oj2Ll zqh^u0a8$3A&z6V!x$eSO(L6(+tzKVxx0Yg>U+Kj!Ta%VJIBs4TPe`q~V-b|;T$D1` zhSr?IvD@c71t7Cri+c*$1eF^FwUSZ4=}1~_`jSW$j_%4J0#U%37a4&?;}Btoy@gs? zo6q_&5cj1}h*LU59xx;(;^A1wdF6z#uIQntq~AG77Q)84MPo*ktjL{h5L2U^O|Fq; z#VdGE2`MA)Y8M$k51|ziT?w;I%17D^27PUaoZ0oXP0@(eV(*^E8d^xdv?M@lEl zVx^A=tqreolBGrXT9eHygxMc_32|J0opkX64R%HoUM_aZ(cp(~X=UaWksKl;vY z9RM~s#1gOnOeDOXU!Q)F`>P#pPG8{m$&O;cG@U2YX=zf&*5pTQ-`7){fmIcT@--U6 zF@@AYqJWZ5V~>R3?DIJv=LuT5x-mNb^L_g)8__go`$f6r=O=<4;(`agSv3&A)V`kUS9rJ(mEN$xF;d3GRl;E|8WCy|+@F;Hqai|O0VrLN zQd9)btskCU{?OI0BWKjk1hF;U*UoOQh7hK|?T)&SOMwE!?A?0FVZQykox}cV9Q0z; zk>fdNhvIL#fQe~Ri(qFVxG;aiCNKz>)t)x2xlch%Zv0_4T+C?PO~=SlY;Tgm56G-W z{x~!Z#CT794{LTYy-Vyr>cYR1Rsx_mLa)^^|<* zhcuE%ZBrk!x9gm~GBHTqbJJR4p9Lw&SMN>~oc$iUG4s=-CcL!w!Lb5~EL^ce*vOGW z8W?=O9OufDb}g-m%1wM$w-5Y63pEOh>wfrGUw^%2H3y*5WClr6eg3!u6bUXnC@AJ+ zcRz1dEg8yD(`RU6$#ec6nbGloWXA7v4k`vkr2}f_V1dr#fv7zWU2fc%^rrW;BBx2K z^0dOj)91p?^U^1C;c$Z|L4;#$E`cYM&t94lTQ@NSs2f-D)%L=96`;@`DA!{`@NFlZ z^?>pk>J?nFzP%m*Ai3|jFZF6HT|6$(4xY(>dhqpoQ8EzWs?X$BDy(4Hxq5Wr!5A@p}paW~cIOx&v=V zxLmq4-?%XJalTkg-sw1d+S!GhyHt_W#6pO9I+2eImuYz>V6IteQx29OKVj}CYrVdr zbg3^z0MJY*Ig;q7-=DpR*b!rC*~OocYzE%6*iTInqw-^7rtZQ5@-7&}j7Nf`;W>>2 zH<<93!OEDs1}TEAJP6^Yh&ds}nVs9PBj`d_dpj3nXV(+nJb(S8JnzJKCcf5SqfD)t zLD|%&MprxqdyOzRD{CnLY4~*eNypLfg3dn+Pf{txR@y?JB+b#9VnGjl7MtRAmD#v0fSdEDa%8=ZfA_G78- zU14ps3|x6z- z?m8|1+wg^o2#gs|>M%5^Na$EI=?;Ync*3%Cer80n@ZaM0jGRP`x5Le|BQXK)_P9t` zcu-LZNmO}AzD2}I4TSTwunw6XX7oAB&187N!)A%g24Gy+HTG^py=VB*@`%RgXGRDM zHsa8X|SN<#&_n97*NIZxg* zJVn;N5jk!ttb>AIxy8XE=-;bMwSsWkBtEvy4q z5N=tjSwla7WFV${5go3ouXxwY+xy4u5t1!^fyq4C_?=M+y!Niz(+`@U#o+k4=iive zlq8VXQ6z}i*P2Usg``;s7VnvHg5(DD10|#D^Lq(|!40wNy59M>+OtO&fIR*4bLZ$H z(%m;!ilQP@__P^*P9Uc@%Jc4+X^gV+@f4q*jKe#C1VW|5HNI3%AY55NS8CmpQ%Y`x zmI(o?g)qkD-@2!)09yBA8g_NGBiwOIlV*%lkc+4Ot4Cs;0Ihq$xaR9=cFjr?bVzLr zvi+hIs!M?Au_!37q^JAgNV(9uPj8#;12$K)Yg5GMS2N4h>y$vh)Q_mlFrIi&A zv4E(P@p{)$;ty$L=fm+>;ff|XDm-AkEZ}CK+VVJpg6Zp3NHNZ+GB;^)K?={lJ-GxH z4>SCvo!`0b5$l1m!f|E~Nm2o&i4whq`Zs>!8kwGvc}OE^yo2@Nt9N;8q0m>O-Sd-7n0<5HAMGp~O^Mw4KT( zRGxM2_7scNo!Tc-g=+xa>=}S|az7*9{cMd1e^?^RMTZqv4EZ6a+mj$jJtlsV?12q# zMJ*OV;*Ry5!cRn(OG*tCWcuW#2^_F3lpUV3_}woPpv?nN0F!%$2-2h>>l9ECUx8kt z_k!>~T@Kb@*7WQ@W3YtN7bLtXYy!{ABn8V(9weenqWapUH&jolO?W9jU`gOsZmIc< z3@PAk2#skWGHiv_1d!3cW`NLN8mc zoQ(&a=H{ZSbvN!A-4~E)>C2`yE1FIC4;3i H=2$Mo_WbbrTkUN5?x(n z2*E)YGa8q2=bcf&VZN@5oeL8gLXj!cf&ugkTYs%*?vg8IK(xrttqNN21nSKFy%hAl;^|pV$Jx5hf^S3e zRmv$7N2L#|g%6V3XbyL?oC&sq2(U&T?~`lN62FDS7A7OcHAqbV{RL+HxQ59pg9m`O z<3l#c$Fkaj+9NpYur*C6OX_Wm#>N)N2|fdIawc#g4(pA_SQCV;V!p>*0D@J^MtXh(sFQn4 z&GjEKVDA^lyeZW-0daf8Bq6;I?IfLXQ3AyB5y#M==FW@^tbgqE#f%d?gp_O&+2CSO zqLKE-O`jF=voirGBh?)!hJR&k-TR~^lUR^7d{qLZ%{V%h zGO#08?2larp$(+(#<>{0lFz_EefB9b2iQE_^#Lt_um%m(R%H2x{>OlD6m+XsF|SD1 zCdrKBftqcfSE4dJj=Ys;Sc~Z%z*%o>r$K)0U;JvlZxg#lv&z^&DebwMi8xm`k2HCm zwH78j-s<5yi;V2n4Eg}=DG9&I>uglU!wA)UgOl^ncGNQv{YaE-Jo&%KbI?CD zW-sZUj3*C-892RojnK}FsjO&#B2Rm)8pr=&j~W?#RAvFR!6An5a58zwbBB~_t8pk` z49c<1$Q`MefyZ-e)ZIWv9uhN%vMCL*-AYn8-e3i6Q+pDuZe6T8eo)Q`o@QtJ#3^{E z&6GhPIc6x}Y-|&;b61bqq9eN#<7x9<$)@j&XLSvH?vwd=trbD0LB|L^f8i7Hn=%o4 zhJSbd(u@e`?D>9=-AF&`28&k?Q&os7G77yC4Tu6ahv?7M@S!4r7{`Z{*S=v%VYED= zXU#d7%Lg_1^&vpjD@4!bdD_8x&&26eO=Kng)H6NPse-R?UsTsvR<`AXGE|&wEk5hG zBOJ)XdK@ErXmUTXdu{G|U@pvr#9PDdW;f}uWDx^I&?Ru8#a-c>{wl%#4ZZBV6OQ3M zBt!Ydkw%a{ySxLv;^B(fro=dg0NgPWZzk}e?y9dFtBg2Yx+aMLoPK)O`7zEJCKUXf zt%LAS+PrJYIg?(;KbehPG&G#`D-Dma(=aOxC;CmjnqKYLJ?UcT8zw6)>MB$@wwsFa zH#UIL3HHzvGrmaYPI=Z7uUUVak+Y>Ss1nOSXn3>G{%_YS7`&)=Lp!TZ8{*cN+B#pA zGI7xt!QNWd8Ty6cTaPDtJQ1Da>P7+u%Co7_gm7u8?dT6kAmaT=qmw|}LnZBJ-Vn4J zoKP2vq_Q+O#V%A-gV20Cg)GnQA3cJP-5P*|o_=0|Dk6nj+BAk17nGfhK>w0OMm|jj zb%3>i$nr%c>bVyLC_3Q?6%+o`cCH{(Ez`ohAlfUKgGDrAXfjq}fYTULHS3E9a2}Ih zLHeT@kg->gz4-wG(}&5?FpfNk>>N+q`4nCw#@o*yFV0Nwm3ujq4N3tki|uZ?*M~-}8IquJ!K= zeGv2Fq%6Z1m)BUjlwI%r0MmR>$2J?J<}~Rfyly_uINyd46WIbf^2+u_#A$wXC%9+e zLdCGYgNfC;8Kawdf?M%tHEBn^P@#c4Md?c8n|2BrdvrZjblVAZj*^9rT>%sV#=-UrSCUN#?KIOevZWg{+Jefu0`$MLTP4c^K~lz zTppvB!>s)DMika#EG}t=j30S@{D0}ANkZ<#SAZPFn8Jbid6bC2qK8IQZwKmZ z0NzmJC23v(T*MJh7R}Sh_*v3q0*MLR?61d-CJ@y9tD51@vD{AbUjYZP>%TjuVs7o~ zO_Ez3$t@(jZHxudZAntW%HBGEAAUX~wO$cUpfXSGlA`GcNytztxwTWfY+sBbDtM0`Ax@FO*F2^@X6 z_9yE}Ie7#a!{YJ{98o#o5!EG1i7(hnf(P|sG=7q5H5+zi{5Is$GJj^TrwUY8%{C6G zv&niY4OCZOl@_i00!(p3u68j}2c;Q+f8D%aG}QC7v%r8=HN%>SRaq-xKqU2P(CZXh zg*;JE^#w*9>btP|z+~8O7-uJG-?kygVj z9|ve}shhzo45S}%+}2=(?BTW>cG1!+XnB zS_KOBpw27QyUmVr{AS!pPBf{EYw%5af#X_EEU5~>Y!G4;P6?{pNZL;*`7bqxmZ=hG zyAJ zJ%8F^AH}eHROk0~NM>lz(L$oJJ{P$OlLok<$s!zapvD}3C)y=K+LVAAnMOeKlId*w z*@+C1xP-O_Nf95t!5A?UK~aNW##$0-Rpm6RkT~b}w*}IwDmhBBH4!ygJ{V=*2>So3 zsRBWbQj7?J6=h7I$N^@pBmiUoMNWKQ6{Sy-dI_=`=b2y&u5bIQR26cX{44AV?o|t! z=G)Kx9!9oveFYHytxpB)m^!|`V>9GlEW2;ij{gv3s12(%93H2IcQgb;@euiB%*!u~G55==E#R=L%9+pg)bK>VcaOar6`@G5{Hh-+bQ?&ogMlp$}{r(si7EN?RZM1gfc3Q4rxuR*)-S>wGr&r_elT={4?ET)5z z8E1QplkLUpHJ;_=Ud|*{HeK)nKk(qpfstifYZOCH;3~ z6}MLy7C=5o3EcVYq|){D1?%(%G`%x-#F~8k1^TVVT^ge{gcqc5ihxVO3|?Lx<;Lev z-d(OPV@Il{6>Mm9=wQDx*O@(P`mbsNTFWm`&pSIC^!4w5=V)m4|NS{LQnfPk(~e&Y z;8|8V=*=N?u0xvB9HC*q)MQITq7WNo+zpmS2p~mKn+TDXOH?(8QO#qHU%=XEq+vG^ ztS=gd`uW16JGYTg1rajDtm#h=j_wLDL{?%JKKU(LYTw$UuIaN{bN9Dc$){GyT37h) zRQ7T`b;}o1_7aEQ9-&%Y|HQv@;Wb|LBpCGfo{Z&G!8!*2E7}x6MzswOySk2raF0?H z07>YARH*E)AIGP%BB+@mKS?sC`bQZaYI-~YRJ0^K{`ZSWb|cj`sYxcUJavlrWWCS-C^TJ&o` zM~w-tPM_$V=c*p*+Nayjd&jZ3yYk`W-&EXYwoEo33yey2@a7s~p6VST{2PB(_RBZK zKGlO!tN%9&Q?ZaUL#SF$uaBTgmtd#tODtb1(p}Cta;O)J#WYGh>{G4UMG6e9z?5z| zd8b`5TXqD%V>JNJz8#qCNELWq4^(64sgSOhJr-+atD~sXnrW{3%9<^LhRjEO$T~Z= zRCk>OAi5dySFr!h8g3t)(|vC|-hcnj8kOuCFm;#04}k#M?(25GtS{ezU1mAsiu1N4 zed|$ageUp_>p9sVBw!4CyPq>4OIlTSS@dIyW663#2Dq7-4S$4R^M5j78_D(O8_5;m ylSD}l90C*U|K}Ty$;2)^B>&&DtiOPvfxh+l?*|S>3c5BXySq?AkGuYR^8WyjBXuqS delta 28757 zcmYJZb8x23_dFcib~d(cCmY+gZQe09+}O5l+uYdB26t@z_W69@s`uZk=5+PxuA1pN za~+<6<{g7#E6IXGV1R&tz<{Lb_-g*)i;@Y(1px{Cjm->4(AL)0GjL+iuJBt~gsosr zmtEeRh=}NpD@hN_rPf8A9sSi-w@O;&zF-UKJ`h22go@fu?%|Kj}Z%wGIt8I zTBN(1cG8@rnZ=$P*&8ySJz_NO;>5n3gG&%4r4k?Z$8ZaocQdMk0-3VC3ezt6281*c zIvSHTVlX!9bO=h8F9ex!WvAR`F-t^6CnKG!*N?42zPCZtQ}m-;}4LEGB}=@R`Bbb@LH>Nw3w{Y z$pupNTWWJ|qW9n%=xDa;DNs=w^=LO1C3KLRpg&Pzkc~ksS*70kxffQLYapkm_PSpd zTuV=-RHo6aFQIqISA)iNmwq^CfAl9|lz}=`;%jZ_;SP$l$D^N|ABtL3Nm3nD&m@a{ z3BENkfXF9Vu~&{EGvgZ^C? zWq;bDr=GX^lUSj9xV`n#mQ9uJlrQ8I)Wc`q7nICzW(ucOIJxJn0ihUN2tDD!7?N@e zFxuzz=(s>%Z8K1EF!6NcP>3_MdL_K3hO%L9+D~PR`s3!Hj_N1eg!gHp_h%ERc2DMx z(GxP`O#oq}6hKTOR5D@Ranf?$)IM)umN+K#y%rk)J#S>lMOzloKh9~hTX?qPm?n2W z)f18C`z#5TwV+GpeC^`s)*;3A7x4B(@bb>|j#}^+*pQ+CO?mA9;ui@uY1wczumXM=%KM|yi{mP+QgFec4!gwhw~8P za)$=AH-|?PTt+=Wu0C3JZ$iIM>;s+ zFby@#0G;##AS3X9*lEmbUj;HO$Xki6ZB zCL?W0!*Z{c1aiD35weQkPlH5a9?`ETu~oU?0{W{5g?R<1TM zE2%MThwx%hYR}_G1@)iAu_Km*3f-c$3@NHisZfd_d`$Zk_mT$0U(o04yruepa6qYf z&oCs6>6()Mv<<8euAbKi)(-Ts0RFRJPNX9Tw=?~rYU{NbWjby@Ap0C)70EQ*pBwK0 zk1=}IGB@RhbiAx_EuA%y{X3uQ+*|yIOjnn&Dow0+!>% zCt;?8Pc2@CL=LJ=SIcHr1eGFMGinC#f)8ucN_=c|l+lw=<_z_&h$RHatQ0XcN6-*- zF{ixPB9I$q>!K#l%~7|h0GyqqfWVV>vHP@|+#XnPm;fD8;4!chOEzQ7v1P-jL__p! zqT}4L6LCC2k&N=JI!uW^{HTdOh=woF`}Km5YPc1aK)G-3bDZ-HasS>aDbHXG{D4Ve z6*2KJ*^aT{!q}f&f;VW5nJ;>w0s}t-88OsRuLC;{p_O-MBO}%s1Rx|(M3R&s7otHo z9wKgZ4SGSI_hWfY1p?VT5r%}2A%~U@;a4KeQvCEoK*4k0R(`*n=8)WCa7G7uPA_~% z-@!c@UJeb;fL;kQ?Bb#0(tt99(OFNUAwaP5>0;C(mclbDH-YM1{_skS$|8 zZJBnBGRT(~_>n(w1Nb?aT+QFFZjppC8iGYZdq(Ni^JC$!Hy9<0ZD=m4-T=dQN!V-P zG`mq;FeG@XHt~t_%0WGh>4trCWEUg}o4hXaH+KE|%JIB}45HFPWCdh+7I`_mnNs!y z#%mcAW6UF}>kWp0@havtlqG7tw{5%cdnw5_ z(okRX4NdR<&^SSo0FW%nj9z!*#hJJh$QsR+HzNmonfPZxO{nJur*FFOhHJ+TBjlN< z2s=?&c`fO19)N|Hj>5kC9~yn=c`805vz~z%KY-o41OZa2GL1nRo*6FHqgHT}h$d82 z2bF}X?CnDXca3ZtOnoQVGjzIll*`DkU%bsM;Hvf_tZ0&)rE=`Aj&1RxQH&^d-|DU8 z%T|*Uh4hH9oN;hX3u_D5L`vmZ22Y_!-pbJ2vCp_%*#N5FP@NOkTHPP!)VD6BkwZoe zmPcIWC^*X5~I*boj_;Q5<1Ndh=pe&#+@h+OIqZe~f9;C zTMZJOt^l1P4@n<;A}XhP$DQ-uSwrG=>Xf4gR-p&O9Kji?orJ}39=~UR>BzkVzmNlx zTS{lbRs(-(@r42k1)AOCUR*2*oWZ7y!)*L+Dpf-Q15`9y{a_EV?dBzuJ6n?vP>42T z)?mj?z9ZFBTdq25jhX@F%kel~VoJx2y$7J_XMht8hA1pWu0V02v=NrXRUL@Z9McRq zG&eW8NP9E$%H8pXQ+c4h2In%! z6@YqFmCDx?sgr?uA5#m=#Y+K;TB|ag!X4=;8sxcwmW2;lc8+-?wY7z9$jY7B8vPC( z@{cf&Q(6oxs~n5y7arXZy{Zcpv!+8NBu{&>r^M!PYz!gZO0xqO9m`m9@2wm>pTx@M zAQZ9b{d40P!d@v|WVh+c=Y>+WZ+4-@C?FHw4bZ`Q*iqNA#k=(7ZYkFlj;^a{gUEva zMV1cYONx$mezn`rs(ljk9B1^hU;-P0WqbJ{ro`+$X2s*fjG^~$um75DKa-4$Pjb@yv8|so7!mwOE0Kb5B0(X)yw9VqbTC)` z1>_^xOfPssH0o;yG!;H}Wt1}25dcOL=dbMtQt1r})PsC)3}%3mPm-byLRF_mV9H?C z#90cLg8#&;X2jPi6|~ueX57^P9GUIfSI>x7_)4b_eVAow{@xWvy~Z7%8C3aSppooI0SA+Z)$(g5p`v>~I?7Ss z2hMIf9eCrhHCx47P1CZqe(R6P&47mR^a|IW>zst@fH6*W(sm@$dkxqlKxG%EEZR`> z8L5iMYO`NP8@isT4FPPe?Asye$DQgGbK4h#cE~G3&{y^!mTT8}0UY8fB5EaQ?Cz$I zMp|2}>ia(275l;9ts#27P|H&kez2Jko;CGQRUBtcgk>S+727HJe&8n=4V(pRHZjP- zAd76;b0YXHuWHMmqgf3d+`rtho*i7p^iK8^Y8Xu3g{nJRW@5h3HPK%R8&lj){RYD) zTR20{xoiTfhZYpj0qj2!?*vv;yNw89Ua#SH4!Kjv3PUsj9fYcwcfJMl+JuH=MSEoqU zs|P#*qL2Yfw8G5fMdvRoP98yU^}gk#R)RM8annt>#FW3ySel2M!*=^pv##eA)AsYX)R~g zfdoXxuOv?+B=;MaM6uZhf)Z_6dQvH+b;*MC$ThegK#J`hMzHvSFGjLFrqpwPNRVgU zJOY9WX}^cEry|dNlsauxE%`0hhKH6DlmjF;z8RQGNrjBmpLRAuCU~Ny*iqa;=3870 zaHBIb(Y7Y76NLMs+HTuQKg(5}-Xf(bO3xQjB)~Tel`G;THect(x&zW0y61Gj=JX{1 z;DI^>ICW4sB)DSC`<5meL(Mz)CU8E5cIia^df&Wu)M|DUnPKu1l8>B;n^|FOh{78w z+ix-YJjI z2gPJSwMPtHQqwD&wkSHwkglW+6LhpD<7g#{N{L6@9vJ(~o&L=|!lzB`<`iT~=+}Jn zZFGZ_qDW}UJRE!<;WL|}dx?z*HcMEh0-)j!Nyy@Pk`4jb8$;@|mBi^#0%W$F7Lhy!sAG-(?Kf*8n-A(7%?7i)qM-d`hNATTkhRvEbR}Jh<^8ZUq9mYa`OCv7+?lr=_g(eW~K|#Y@rsi zTty~nP1O*?_OlZIK$?>o@ zlEQ+}SFL-nOTA$<{@H10U;qGh5@vtGv+A{P-H`jlf6R|-&dp=V9uvNyU(0p?F8}}B_+LZ$g&v!Mmd0BPxto%S{ z)jWv#hkDfSUdA=McpBThFZ(KQ2LG=GsbS9n`AxZ=T4&X?C`2Y_{7`=nK)Tr@Jp16z z6`by`)9P_D_cVW%d@ga`@O*`>3{SyL34r|x9}jjUkv7#AdKRH@c1?*}=kqF$J86K< zS&Sn7sAn_g!cRnlfbbuu=hjr9Aice%@X)kL5P#5|l%&V%!5)p(qnB_ArPgashOXGU zgJSKL3WYd(;62tXIvXMg0i^D%ikxHh6hvY)=naa~d$U8c{(H%{8l?qp{jIbO! zIG>y0OOBP6aEVK>olUvZ$AR~k!m3Ilh}EvC<5wRaoUvSF63~bjK&84wHUF<`!Nw7W z&#;!YoEeuIeHrmm|BHW_AsAI^=}a^w)>km$!(V@croAyU`PvokarDGpThEh*Xi=5v<3=+%@U2virp!iD~|{D)#Xxf`lNV zMT>;~npip>+(7vgaHg=dUHN3eW3^|Z*8`P+SxzljC!2G(HSU5kYyOz@_n2+9i?EIo z&dnjfsV}&%e%#P!b!KLT*zye8?<WycQZ)s)=qAbBG>Or~hu$&T0*aK-!BydPbZviuOPWNKP& z3bMipw1U11=PLnf7qMAx#BL&#_p>uEI&`(u!CvcoVQ0-_iaeDTF{V$Ys!ob@kV7p?R>2_9?v8|IF=;A&j&=6x3 zC*ZL6qu}QUNWwF;5a5yf_L_g)qd%ed@W+go!kuGAod=Gk=eEV;f+WmUN8D?EnLTR?hs}l zAqs@G&DRa<8#r)8bG3BpWGl_>3gqlR&s>z-F8P=Lt)pHvZqdtI#KDhsAFTDZEo}z-zexyhu61K+pP)sqV zL0OXkq}xHVvBJXV@(fD)10ymWy9g|Bwt%%}d+R>h-F=X!5-Ek&;t=zfQwxe*0l`Xm zwEF^ByJ(S@BE+?%hlY%J&E?%bz6$zpvS<)8C`JmN21~TSU~}R8d6Fdq}ph)YqSlD&s#1{z%^5Q+>NI+>)}p6la#}YIoI8WV$b4SODBi8&~hgL zyJp&dEk4sts508#N7A(qRgOLEyT9)n`v0GThy0s@Ye5c~5o>{fq-21Dp#GbU+Z$Uu zsF~Y4*%`Z;GupU1I$Y*Bx^A|nM(kcs2S8VQTH4LQa1MNT^KEx@$hXeyG|#Mb^e`RB z!3XD$NRp~2x}0xb1w09W0HmYPM9@^|YZ5p77t;AbW~C4v^eYLFjq@O!0gu6eypMzPB%guKZnm@ zv+3MbCrk#uhYsz>H|eeK!i=9 zm1Ilti<*aHHB+O^oVL^NiZNkOy!}<*hUv|)n9>d{p#Fj%GhE^~!Nqw03s=zRnp`X~ zVNGr$ahzO~CusKiZX$v^7MmqhfV>ncudI?Ec{(A$j(fVU2gvO63Dq z{^(_Moz5{a?Z%GvqTUIceKuQ%eLR;6BnKC{{OFzp&Nn5`5>19;Ix%?9F8Jhc_fyNL z2%@L8?H#);0ANcvtbo?J^G>6ircfslW|RU%1oc9-mpipK9o%Wqb4O<|OTbcIs>9*sOg)CmUQLZiqbmxIp+DKe|2csBMhp2sXSddrt4VCqTlW%f-L^_@y z&r`T{J>)aRRwLeUCN8kennrLuIOVZNI8nL)&Y#)L9~4iw0-BiKG9Q! zRo5KC`IqU2tOph;x6k9L9jq@I0xBtVa)EcK1wG#*fjKcyd2mxmYoIRVJJryuK zEwQ(9md3UhhWz>L!lE|!91sr~ulUilb7v6cv=E|kfjBp6Q>1cYX*}dNU=bN)?Oi(U zU7zh;&|}-nquTrPdU)-3MlY+I7Xco9T>btagd=*q$!@*qWqYaCR%p0+ zOpRS+DS<51xKQw9XUMcqBkzTS=tWt6^SMk7o(`RMRE?=?FMIJca^!{XT0=TyG{J5d zk5Ds9limTYAeR^$0hytq0|mGb9Z&b3%mb#TOJyP*U|rgkA}{bvhFyJC;fOXX1t=pq zUWd@L)_hbb_z>tf)!Z5sjdgj|28GN@=eAg(Qtw) zzYk3wv=zN$(t=_juEwL-_^92303H3k0sJUwK7wZ#sos7p7hlH!2jUjz)rXWGSIKx{ z-(0H@P&bsQifJ;TAVdEOQLI&1G2-!`5`Wej(ilrfV$;o4rUpYL7+be-a-IA`j2v#q z+vw+>bCmBMAGBD1j3*A!HHsT1Qj}FrB<6@~-@%qQimRqxiPttdyHBKra~=-gi)x*A zkp#K-f?g2q9;`iZ$J=4yk>KiIok=&D31L&b#0sTM?Mv@<-c4Yw-O+Ah_&Tp1Luig6cxOdsNe5{jrodbkQtsSpJX1 zpTwMEojX{o7ID?;|43+0w3sTkFU~i4o23UpOl9>Cx1#!R7xRy9A?hu`n+oCV0!$03 z))GNSQV9$iDc&*}c+?kCFN-%46@^f{Hgw<1c<}>(a8TBV06^WvAAq`ntBT)X;`lUo-05@ZSRCnL%0{}PO&l}k z;xJD0FgVj`{rgMvmw?vVd#`2*3!+zkiE%%F6~o5UDjQtaI`X^H)0eUlSBtTb%y|Iv z8ehgc$=b8@7BRMm`i6nT9rtA_<>ew{J>rySm=fkMO_#_k<4Gf*crA?ENPx;Dp)16b z!lZ%y@;{uxe>iQ;|8QFW!of>}`BKT&wVp@#Q%ikQ*Kcmr6H|!vL0{&4e4t#u7oWz%chU0Hk$Mw&NTGXJ zTjG%*>mdUuANxc9=B$&@o5EDD!@_5e2c_^gNg7>~pDb&9)+3i36GM7P;Xf4}9X$v3 zBqb6D`{%`cI2&soAF7kb4*_ik4eXO#Ojq4HK(l=Xr!Rjqe7!_O^OPu{Y&J}2bN^$6 z{eO(m|1s+Nj}hX3jOhPkM7|#n59p$W{2wJn^e5VHBGmp3PA8aV@XLTee~aklF3Sik zHir0NvU<2BnKUd5fy_WG(u;D3HS|L2#&*q2iA0QL1-*6O0&BW5WsRX%dn74`&{#LMljLKKzsVz33^h zr%A{L=E?s_iV)jl`H32H;;_E1O)9oRW^q2o1h3x*5}hirqzfEAl!MxdHT4szbu!;fRl2SWf=W6ox};h4IAIJX+0SAi@4SI$_A=I{Q<%~$la zA3){rUYDaRbz-1ud<9Y4xUj56H$=^eNCkFeiUnW7;l%tnyrZ=VCqU+rVI9M8(S={+ zGY!=))IKZo5Vmr78NCtlo>RQi^CUr-;Va+Jg5EwUsp(LIAV0;WH@62!M_(P|L^Sfh zP6zeKKpa|tXBgdP0X{;k&e$vKZV~IbY;Rz4jDJ@As@>LC4%y16 zckajop`0&G;vrC5{l~z76(KY8!OmqG0ydkB)5hod%zCZjg{u(Fv-VQm71tVAa zmA120{Oq&OFM8YrGiWYx0i@@*!b|5Tv8$m^g~m&RcR)ehbWbVsCStdB0N);Dyy8DW$>BOl$7t}=~>&6cqU+Yj(oIc+lAqs`ks(s-YRp$bGvhxdKZ4kqgd&)d>U@H)Zj^F4^ zu2+5!V1kWJ7Jtsv@E*k?0|b1(www4Clu~DUr+FTnAF}8Ax6j5bRIzfRWR;o)p(q2S zh!b5pzub2G-Afk!O^eJzTr-Pj9ycE#3BS66s{rBWUv{ADV>)bNb_t{xT87f7W7k=(UU|29P4aQvwJ(`k5@009$$IIEt@XI%*lFlsBN*t7@~C_F_*on;S`#{ zpqOPAxy$M?0^ifQ;f~=2qZ{rnG2duAP5~8mB5tZ2MI^2ClXkfuA>k8p!$|h67gldd z!%kU}D5W2JBrkA~#*^cVaZ`o(8|pt#>*li%My3d2T$921Vv5pd^L??jL3_7c$p!1R z#y3`GrW-H)ms!-Y)pCd?dSffK5o|(0!7!(Z=9#8Kdm_FK|7gyOq54xRy#$^k(*Xvv z{j%T`bkfjCvnZ}5obyRf?=KDXmN~HQOa^OmrkLzR>qLcyavB=3g7j9y+S^Ux_|70; z$R;$!_1$T(ai}0;t|A<*FG9i*(Of1aO=cw@i(_}>_Rp79+ZqLPe@P3+D6TirCK(RH zNwY(>jL#w#AkSk*t}XQKmL3>oOaoq_agNuaxi6!NejzjLlzyuMnC=kM0VAr;5fIql z;9e7qnLbRb7FE9GFj)S#eP>UX>S!nIfcA}Ep6%Qyle;GZ_3fKudR<8-vYWE$bN6dk zoyDrBi75>d<#qgY(*ohdVQlH&76*(Pf_iqzAQt()5=B%c)N)vy7 z)f`)FZ*8?1&&w?ItkJp`LUUxe!*lUXEvNfj_)TVMCeHfw=KMLd%(bA{t04FIj`i1qI!^~I|xS(eY%^K^C!34JH*Ph1P-?0cKejmi^T zx~31uy1tzJK1}|!6uJ4SktXWk7CF$!kgV#n zj321y8g3HOr|^-ELlqunEbSAe#~zA9ei_NwwyTbFUkHZ}HMc;QMF2+7A=ebQLclV$ z)Q(6UU6~4x;+N&@{x?k$`ibqeci*vXE>(seP7h`4M(tjGV7P7&^BW$Pw@uNp2}vih z&+{v*VNIbyABkc7dLK^SM*$NM=w+baf8MoWIKjgO0LRu`7uG+T!O+RDU{mfXa4Rl8 zZcOlO@XeeKrJH;c2gFl4tz!K2%P672PAgtB80L)L!LF*Crp5j>DC8Vr{!87{|BEMn zpC-Pqz04(Jv&Flt8q=z-k-i7Bk0kE&Vufl{`Sk`-pB`j%hZmDh|5i0EKvjtSPkNP) zn9dk%o`k7)j(uotZ$_^}KNv-{9dxvPr)k@kZl1P%mf9`f6*X`_-*; zXNUzifZISIKAys*WwAdCz$#S?Zh6D3xjX5T`(mg85I^!^dt7&MK9#xv`q=WximS0l z$-ya30mtU~06UeZkLu?pU4CF+ zFV^gCwP>+O7ibejj^gzh@?LBq9do)o++NJdE$)UQ)G4SIQqaxT_AL zqzfs+0bbSKpfxk6Yd|9ebxSJnE9k%1spScmC2i2vP~t7tb1(GV`vShyFDBrOx$-J&dNYMAnXX$x72XcP4BD z^d7|xGF@n#R{XUbFZL(@?H@)sWvU|-a49Fm5x|v5b4#V%I6Wz1q)S{$=MRAlPEb-j zF}t(Ead8Z5%KHNz`Cpx}jner032=WyXRQR880+S%c&Qh>TQrroqhk$YO3MSh{L2%s zV>OdxKDAvIGMy+(Qr<8%H#ABJwo9e8^UXU`JxbN!_*C}{Cg@wzjb8*2&c9!>f$R_Xju@)_&q5Zkaz*)0KJX2!-qKQ zU4>Ud%kI*n)1;>sP9L*tw?)+r&0_z)V`2mLeL-}9{5Nv$LrZHo{+nG=@AkiQd5+?5 zSD}srlT{xdv1^8Rvi9y%juBgku01viALxc-N?j?Ga{Fu#?Gve9!RABkc)%opUiHG? z>o!%u&{spjI?8B*p{bq~nx2!g*x99R+I-P76{BQJsUD@N){6mvJJ>+uwhhcs#JR9q zX80NBVNTd}Brq~{%36ZNHnzd_0Qrk3a5z-I+uxJtiL;Ybpws0Z?u@A*sHV+F^R$gE zmX)c~+2fG#epJl7A-1VTGoA||`x)(3)Pdiq@a29%v4zM*l{I5^WQB_md3rJR+0otb z?)AE%nPJi@s`z(9N^!Lpiz}uOqsz+8waTYMXK113nntth^FF!Ce{%V0P2ku@h*Hy* zP(ahR!s@N>srR$PnLzsfIlBED^e_i!)3s5r*7GXacGO!B!tLV}x|uHhWyLBq_|Wn+mf9 z<}(OjjSr&UB9g5{zaM2l&W4Mb%QLa6VLNshxM0Me@!CS+iBT8<;L#0GbMYTu0Sfto zLp12+#NE5*3Q9QFeI^Z&_a^cUAN{OHmT5@{#F8*d+BN+~Dq!6oQ;f%j3F<0(=)tiZ z9pZsJxFX29o}m=Oh)lPOwbO7mAuY^KH&F@e(d|B`gB4WLiBUMP#ZEW$N#DigRI_ z#yJz!(D{5?&0?jJF-Ob1GC9aUYEyiVQ#GbF<RTd{&@ zyprfQM4>3_fHeI!eEvJ^79Y6@ZMrfWx-a&z6$CEdf$bYaCsRysg+ zenk;Nn*<9W^CHV^cF3LLBz(e?6_p&136fe6O2$Dp&(aiylBlWQ{bZ#VO7W8Hqy@oM zVtT#P%yp#iQT)kii5ml+&Qst<$^friZn*&6UQ4(PucDaZ2@KyLhsi#a6)b8c-B`lHdS5U<9yKy6%C0p`uX^(S6HPxthHhBwV)}zrwH$b9* zM|~FUe%4l%32gf5whkCZ7j3VY?785^f^abmi|m#yL-PI}gujE48`PGX^ihV=iuIo4 zxS#=~sc3Cr1!g|tXl=+m*HYC4&c452l2Khv2{;#}A!WCa(c?&l>%=3j#?7@@z?9&1 zEICXiwf%lhpI7~BBj(vUK2nPo1x8HWkavUU;i0QX$MoJG!5_Fkk*}0ui8DWqSQi{!+QuAIlpI6KdpVMtMxgtB=~*)i~TLDrYG4OC>WfP-28o301O=pn?ywnq@Z8ch!7}F**}wPS z=RlQD5np z#Sl&wqq2>xr`yvdboVTxyo!yzImLQL@rMgCdrd)w{U+}7BXw1_)DwQjmc_K#J(-C! zQ&P>cq9pC9>|=fbe3)v%SH&@Vh-OE?c-^9xXsz!oSr2q!jpF@p0aYn1p8B)nuZPRE zr!1m}WA2P>)JsK(zW&dnS=(WN@lueSDwnLDl1XI_H+j8}CAK=dVwA!BcclF}o=lMY zt7&joC%be~mK_02Gw`XkP~3Zf{YdZ>MDtoc;{GOhZ*#@pj0 z3$DqN$t{!Tk?Ikpk+sKLrxu0A4zA>N$hV5mXV@Fb>~2RuX61oDzf3;2R&zL)tS zeuWAU9K<7`5>V+QH@#ug=I83eb8?+ocO33?Yv>bqVqCd%m-PzQ2oP-_Btb_Lc zQk2c7FEYhHs*iWpPYI4pKE`%pXZ0kmU`U3GzNA zmer1@j2MhU^py^R#ax6GT-JhaYKQ zK|N{TXs?RPB_q&xj^!J#E20kjyP;{)336SX_kaMIgNZfo=Pg_&w&5nu!+5eeQ|}~ z*8w@;8*|yR_kMw`@4~})WNIm|)nN0r^wZ!QlDx=PzQSGfnpMT6(~}@q2M7+(^SSp* zy#&qrl|EutUH`Jp_P=ZcZZGsa@8LV&nhTDn@jAdKTu43#zZ7RrKdSFQGvNp~np31V z8SksO%_~{Xb53V@Pvh-|LUWdVccBC_02mq%?{Ve&$>mkijH00S?qh@}EP_p5l#oDN z;72dLDtgI3s5|EGuf7&OV<|y61Jo_5y9Wi{FEk}4U`I=_$jNAJk2**0MEGE+COuLe z&GXw5s_CTv@ClBEu1V0I%$hjbDgKAQrsp z^&k=cc)6SBM;h6EW%uM&{h7s+3t;((OYb#tgL3~E?(Wq{J*TIW0MFgW_b>(aL61!M zDvGF1<$9}~^8okLGIc$%zrUEVcSNRil(DP2qrNX+yI;Kz3SZ{Xv2)wYf1XA~n@2{U zdMfB~Z!676>$NL(RI{LI|BEq^(f?wMvvKkLa2OTicwD~JoB{K7|J z8<$CZJR&S$B{Mh{1vuAhD6*$IwpE>VpBv_z+ghJ&uHT`ElXS09hJwGmAFXqOHr`6YD?FD0isYW735 z8jjuZ&aqD|is|dR>Pq2j70|s=+ouIcz7gjAECuD+CB5te0jOHmb>)pY$*H4o5bFo~ z7)Bg2R#&flI=g+a72BTKZQ4|?d6e<)b|N-sKz$jJO%hDB1}WDNGKB1M=#;e0?dLTa zj&SP7e&m= zIF3KZyIDBw0p26*x_TRL8aON|ziL8TQGat*$<+%Le7d~Q$Db2pa#vRtRJv)+ep+f( z-}a%2?5y;zxGS2|4?HPP{?G?)*|o?MB0Rh&fZg3$1>_#V!;~ibcj;R}_A2)#?Wyk! zy$}#7jUc`aaKs}Yqk+2kR*2k0`L zc|bN-1fU-(>TY)>Iu3KS&W)FHCT`a@HEL$fQ@^233G*fz`FZM%F;|p)Y?JaQSsOQA zC41oNhWh?ceTs#;WP{60N#+hQO^~632VrsmT(O|}XTe9cgIz9#(@glwL`v{9qJ0ri=OX%I zs#hW~YZbE%W6dF>ABZfJLnIji`S%5K*)iD7StRq9u*v+(jA=1CMl9*%eUkDM)P9bA z*}XjSuHnn?`IS^u{8JYEo2EV-%y7=B3!z;iabm?HiHT+YOKYI1hL4vEEoS<02}}dL zCV=8qLiXnuU7=A-h_Y|Srw`OCuc6%nA+wPV1Q!A%QnzA5g7ztzi=bMFpI*m_X6vLE z38!h6mUm2=&L3@4d!F>f%FgLFe|PtAKjjf(tn-a67W#|#63g1GrW-?2A+5S9Ax+79^d-cF_?quNebYA!u)&GS~WRT};w%M(&+TZpy& z1L~xojhW8KNbv56^3vH|E*zpBx9|Fd9#XwXjx!~UhAV}&y^cO6VF`5GsNyxSUI6S( z$ZA2*Pcxj~N_-w6@dc|CAz4ki|H?gbwq?>x9uq#qJWmSI3V%J&U)>Ye8jvmxtxcj% z!kPRrPnWfA|if|h|{Y^ZP^ zd`ntb`xWb)GEA1{AwWgf5c|WyHp-AOhvKIhtpJt$CP$Xs{tn!UY09jDA9^< zzVkOd&ldV*y?Vq%C>w(Pg+_`soy>5Pvf+~+xC6K8c0ARinCy0cq6&}S> z&-V&sB;{!-dE*0AO{+QJ&i$V0^?)~3#Uyps?eGeH<)+#Tn%Mk^MM@6L9(+I;D$AiC zh167pViN@38B7%?CaidnKl9B6+~pQljk{qPwkM7ll&c8r7(Ia0FM~`FTxM|QCZdtfKDqmQ)ShvQl`ET5xY?jR_N`Fs)1W_5j~q@oq1zoX9fR6cxJzC zk802j39|Cu0DM1&ZgpO@QpU}dNW=($>B%wHwSJ!UPJi$5{i z>>@z@Lax+t8ea|*hE9^c1o=NqgLM^OvHc&8b=OzKN)49s0I#}5Ig+G@6$R5`6C@Fu zntZ3fXIHe`Hc8X0-|tp?S)`HL)QPVKf9-0p*Z>|@qxY0PF#v<|_awmDuOr5QHW^4H zc-fQx*Va2lNBTYe+p%qPVoq#pVw)4&M#q}iwr$%sCz==&+j)C_&-Z`!p7g3!C*6D9 zReRT`>e_dIRXihPuEMfp*LKt9-Gf7eTp|8>d=T4Oqb?_s=WVphesAQI8LAM_ql-Jl zU}-V;7)8m9Kkrkw0ziM{x(;Wkd@1lhe08gQA$dwU!i^5<^DxB_0@J(75-O<;Y zd;VX)>A+Y@zPX{; zm(_N4a5*>-Wt=H<6avMs8P_(=cjl97V7Y6AKaSg|9*65;b50>bCmpqX))KLM$ji~4VhGN9H zo*3UEYYl*WP_J+t~7^*&_Y z5&_$nS&|!(aTgU|DT_;5uOI4?^J>qHiTB<2ryf0!zbo{_e(P?zk}zI349XkXjF;zT zCyk~5l$0@BFfz8FE5l@|uprXhjhmfjXx}7JPs7Y;zB*V5fGM%_ch!R&(Q}&D2noSQ z;q9n&p}Ga}?gV+W_B9#?YI(3)^59FxbHHMMA{EmS!{p%KVL&EiE$?KmJ=azGj~wFx z3}R2RpEP89yIbg}$k~%GSz^I&h7%e4k;%B#!Qo}})99!YJPKkSWCi~xQO?4{_b}|j z!Y!aY>BqT~GUk$;sZHlxV3!K;hq(D}vqUqqf<$a%PF;Qr?uwS#efbV41fBwXkBNye z&4@R2Kl3+LCk$1d!wSP8E#dAWsFbZKTojP@r)ouG{ZEOeA+hS}GYCwu(NX)bg~~NR z(Qw2xbmg_O^hIlU%1`RujpKT(?szVO*P8?9s!S9)m0;7YL=E z#43~(b7kyWptr6}#jW4kl&)vfz?O!97(I4#rcT!BS%Yz5jn(jAJH4@v5W zP}J^K;#PLPsoKGGt0Wp^=P&ITKWeGO#S_T?&XM1Rh{oPq>%;3a3E zY`w3~ce`G0yoUj0YE|skqczjobH8_Evs~AcjA}G{R_)TveaU-Xm}`0SGweNmG?Kq< zdabByBolkxw(H%#%x@*m#%AHCagUpG(vD|1|M-^@J~i~yiL=0z5b(Zj|1TxRj)5r= z;iHe@ub&Xg$X-H&s5g;!`m;=&Gd$Gq-0}nqV0n^&J75lKy6q13>S(lGKTVN0DOZfZ z5#s;ph=UO9WL44aMC+Xk`+6Mw;mz`ABBF5PtxU*1_c|o4KwP(ppH5NtiLb-kJzvaw zr@nV?GDUXDFEpkw1?d|L{fAYG48{ottMR-NC~jH6mbY^oi0^wU;!PQMq5}PO@V4_F z;OUUN{@{CkdF4>d4{xSRcE>GU;?R@VxO)5J_qb;Dxq(aMUV|rJ=sVPmZSNhg?-?Gp z8{SuMM4An*W+Qy~D{*@_MUZng+rqnZ){z_ck6To~-A>1u`>U=>d#n^!ua5tm=X0feVW^`k_PF&cEyu|qmz&Y6^TbgSsW<9 zslnApOnxs|jM+ceMLy#~(oCuLqY3;mSbtfGZ^^sZ196WRc}WE;0l0S_@Hx2{lQWnsD z`n!2CyZ_icV@^K--u-21WP)oy`_@UZ`xAf-p;jwutq&+JOIH~a4jh^Wgb2OQIa~=9X#pUVtB4u=T}*uws^Mr z9dDE7UZr$SBr%KC=8it+^6in3o2hsIG~2bnT|V9%A#{Oi7SPo-p-V8+4}S%vO!34w zJurCc`A--x(ho24wR`6rML3)0B$hf7?`S!%HM0~ZU$Z3_d*+M)bur%T;(xlBP(dYY z0RE0mra(cafuq=r&D2&JmrW0<`2?z-LxJCV5zYE8W(N&R$az=A2Wxb2l7>$#jzoTs z?)e4qx$j$Qor6_EvZ32i^1l=CB!j#kV(&4ZQY!e?o%&B9GeUwv{sP&)JVZQm1`lfD zBtC*kvJ%M;*`9Aqr4~C0ls69H8}=_~3$sk4kY^LLWIMCABQR0ALTVm`IR~k;G0<X7{RT7e%#yk*mO}td7_|3SHlcL zgFQmTMbn}|MOuxK`&4fGd;0IV6#&U-0G{ZbwqFF?Zzm%5CqUVoGz+|2WU3tBH>=6g zcRK3?T{nN4%46A)fM6xPtoM|M6%21C`P;+VZ)V->c&KnE@-cIl^4vf4X3)Os^vQF+ z>@6to{L4Uskn1;=>z$h~{KtgCq5?8v4++R!xr~cA91zBS9aPQiT&$^le*?fc9OLBx zd{1-~KPXPNhjn!w`i?T=F)J#ES0t>Dt*1rw4i|{@6lqq^2vW0YGNQBL(r8{={P&Iz z2lovLbVHeO4FPLVh&ncnb|H)R^D!Id3KEqwnP}bi`cNx6Yt@*Lon*QB3PjVH#83Cu zySb$X{2$u!GmEt{^R)_BIRHOb3EJ#bKi5IWD(*~Wpn^DA1uBRS;KcR5vee+eiEE4> zgZysD>FT5ZEJga7@~;e*`eKBPns9BGptLpfoCw?42!383-jT02sXtnH#MxcFS4)2z z2eNTP4Z%vq$y#irxIRXVs{8gZDF zJ{MAWnnom5J>OyZHS1gNYo`W-y~H;I0SHPfp+ z1&m?SZ=!&L46sjOk?eIjoH`%lN1nh}W3KN_uu5{Jip~o-<`|Mjc;qEtI<)v(>`L&T&FP8bPQZ=MLFI`X|cP6TL!LQ&yr=4e$J>9~H9 zm`nlsqh8DRyfWOzvV7%SqAC}eV>jsz<6TT%>7tr9t?~URt8p8CMbEr(U3nDtR(h>f z8?&|{CTA|Z7_+$f$>ET&8XsooVCuKiuU^KXk55i{nY*1zP-!1x51TI+WsOQd<0{Nn zq4PKLz_&xs=F9@45JL_ag%&-zyDkj#e*v6z$p(S;0z)|=bU<0VsZ77w*lE6-!!6k3 z+~8nm63Py}OvkDX3$LM-VZIyXk`r=Aud7v~{zEQ(x!z%zrV9gpmEf07f+O8>56!+h zu(&!a1r}G1-j}$oEjX>nxr{OL+l!Ka$+e(zg9Dkv-)1`anWlJK+N*Thfz3!XKox#j z^8Q7^9owW~zFxiAm{Vs9NHgKZN|RD%Q^fH^cM(f6HqAK^)Jct;JjbBy?ft{Xd%cTx zc{-oTg2Npmx85M0n)KG!1h&m8V$ZEH6^S_KHLv>kv4bSIHN;mDT$x0G7`*b zn2$LX>ISZbH8>6SXBfO8Q3GAkgca%lkxfcRfN-Q9DL02S6dg1hy)0y=*x)rhv3xoB zd>o~}AAv5m4KA+8*Bz<@vA{aNf(&7zHR0l~Y}Qh>1pA~DIlhzMzb=tg0AhkR$RSC6 zxTk+{n(SHjV26vW5|Jh+-)Cf5WP?A=74h8*lK1ZZ!WHEH!6SeEo9VB9@02mDbWf!~ zJOg}~)Ly$goZveALuaHb(V?2TJ3uQcor7uUY&*2^DEx=11YLk8oy;9dW&Dh2712+I z$z|Gdnns@RX08zIFim_wZc9qAh77wsTx|-AMaQk>{1v=@cW5{x8MAa3-OL_k%^#3^o*08XXMqL{mb)c&TBE@P&RV01hhcEjJs$+m5TW^JrDGI;-gW zq>r6sjUuBsodut74Y3vov$^|{f=lsEPZZj1squN7YRI*FtKQ`cO@zvsE@m32u~vNW z_kdj_43PCR5X*`3GNek|4>jfh4Dckwo}%&)lz9>fe|Htogf;<ehv+iRBX4+_eR57WMFju-xlX ztHam`7$#67xKW}dZV@%afz5r75z$!lreO0vBaw1Jg4`nE8W(M+TBWG45ZqC|NXMHw z((aR?NtUv$C&qxEZK|1Sw<*FC#}xyCApT+GQG)Oxj2$i8$Xt87dV{Djwa}T^ zG1P$QWRF2`2~z<&e{$N%TZiEInL$*d80!BED;BN-uAq$o@}u8LjL@7wX@O!#4IFGg z00-NBh_QT|b6A@Ww>i21LW8^QRCIyh$Zddq(XNtF!}nM=T|Or%CZ6L41gq92cydIW z*dOk0MN6`l%^OMOdPxEGxQ|k*nZ|?|NIR}-%P3SrO0F}j)-f0iIN#El+!?-?ek3&L z44AN|$f!s2s#EYJxo68Is-?e$t4S6A-DQ^1>6Vct3Tli~+i&)|*Q2JmbK9I1lBYoh&X2k|ziYgyrz-=w` zMAlji@{$D~Zbl*CB7{{y(4x3my+Z+(5HpIssGs!UaG@;#p~f|591GqY1x`~fC_+VPe%5x&(X$gbw?EKjOoZ0qaUQ4d@@k5^bZL_s7M$eA zs_an0o;9zAgqhLTooS0nl@WmE8)v=`#EAk>OxGf7ng{CvpH{1+e;|^kQswqQmqtj- zEcV>;Lq=$WQh8oCtO2Xaytl&ob%Ze+s6XHQyPJq{LMm1?41Lx+17}II@{)=#tI4|D zND8Se*qH+CZ)cP_sN?$Z^1!nPBK_m}`T2RL`r7zT=Z%oSh+LL1CL8$aL4Mu3k`9FW zSeWHf@bNT(@wF++Zs8J^*r|>uOxW!n;qTqG39_?V3 z=nEkN&qP)Uz}f4?22dRHm)gwxpYWQc3Iav;BI;%jAtr(RN@RVEGOi0O&r|3=JwjSu z+7TRgQg}WnCT*0`XXsB$$JF=~j3UWQOwDGbHFlqH)K^vqt#qfNr5~6g7Uau5vb>J^ z4oQ@GbE-jcCxC0j?k%HWnqXpzBAgPKeY-_EKi3fVk8e^xi2guaBC1qH{`PU%7@15gn<9x z{}DfN#z5i(j+=uog)vMtMSB4yj2@VmP|XK`qd##9d`Rm=NS<&M6pA0S#-~p>69_#B z&#_rg-K3j|1DnP~zq&m3fDazd40p-SGqsb_?@jeOQ z_qvkjxoODN=gS|^iSsLCQCz6b547Rd_3Gf$$DFQ1LbN z1`!4pH=--KfoLJ!*?{+wzh#RDFYU@ou8d2U;ECs1lB~k=@FvE!n#|$uF7D^byyqB9 zclmjKLOWLw+PeMM@GFIeiN0Me#q}@%tUimrh0xW?8h9j6l5~;bwYZ&YBg|(WIOVJq z`d#o(Ov0idF9XPKRTrhd9lTeG{k<6eEgKB@oOq~_!kX5XlIt6Uo|fAK<*sPLuTeNy zftimgSR*_3Bxa<-j_E=*|GE-JV?IvF#9+IyTy_g{zYNb7@0;$o+R^@-tMEnu@Fq3@DJ*DX%ovv2eIgWJ{+sdLOP4e9y4u}`zpa*bq)TWu z?P$xa@SgT|qmItLneN77_!x$k$ucX{g@dswBLwT`u{K@0M?ty6eJs&5&2=@}LgX^r zsSf)49b|=IP(#$74}5VJB=7qgesC9rlb1Cu{cXhohpc5E{RhfJ@U&or{YCln=?*KUfMskrzcAJRUZYkQJKpQ$EQbB{XCR zi9WygBRa26xIj6(5ZBD=EGcopnFi-FgEh-V;|K!P^h1c(o1IrI4vrjCh(}}23Emyj ztC)RT;})T5h)hbd7EvsKO6m@i7kxnHh1LZr%ZCiivS0~QI7}KD4fok1?KlG5*5{A- zRKgDor9zsz*uFA8s~{%J8jx1^fWEU}oJ#y2nuEbVltq>Ir5Y}yf*r7lTmwN=zIKk7 zF_b5>VCIcoT(u|E?|E_~LEla$Cm^}5it!`uMTC|^NDSJ*qN&ROLD&j>kPi&hWmN8R z!rX@7988dEp+-r-H$=9x$_^sT~oAgi*}A3T0(M<3lY#d_U?K=k>W-@%p`cAhwPt8PUHw94u5%G_pYxIbmbc6?W*d5c)}mAk-!a?K@ezn&yC|Pj9aaf zmc8}t%cQ@;m-MXB8$RQu(v_@I28+;BhySX{VhY{_2p!9fO$J_UkmOB`a<$F{sQMLa z1}dW=AtMCSMI*kDB`urw>W7I6x8_p3N9HD_p%66|sb24576^GsUZ9dJ=n~WWqvE1?=FralLFp0io~YQn``e`Nkh5&i3tmD<9n8wCLDRJ{Q_`-77sJxn5E{B#5-P`@-0j*p>lB9Po=*SjL{l) z#Vs}(<3GZ^hQqE82adq_1+cmuvllSUt#*ESTae@VzlU;xFk*u}b(7Bj0BX#W-K@ z3Wux-4=iC8#R`CBt`==@}+V>P( zp_30$%9Mxk$rORnUYP@oc8Iff$-LjTNd$N-6#uZL250QdLUtKagpq_++C?X$1{vYm zZ-z?j4EXz*)DsLz&U%1qnlyqS9a0e!)u|Y;6k-pCQaz4X4E-6p&?+3Bv%@ZO@O;_m ziCS)vTx$LYIL|d;L+=nhnZc@s$BoFaNChw zAt(QX%-fjK9!+C-p!M8>l>6OyWwPV1s}y!Im|{cdC+TtE;QN|dETNu0t1;keNtYwj z+=AEBl-Epr^J#(Bmi3DJpo}MG6J&y2_o-WPBnlZ<2fbLTZ3Kts01xbWfVHWa(m@1 z+F1bKWpvge#$@PbC@FPC!XqHMgXTCQoS|Pb@FA!iafHKxm+~hYa!4~&16m?81D?kO z0%^Gm&9AvL&d0CA`Gr^XG0MVXrb|2q*YlwDE(^;S-TWc^Jz^j>3c^rLKUr8T!4sR} z)ztJKHafQe#70pWvR%9Mk(e3OI!Fz*6YSgeEXSuoWs!+Ih5$|cLro}QD;v%uO2Ylr ziQdSWM0^h6Ogs<&giy2XZi$v+eX^$O_6;O&L|(#`*XcLdSLUe0<&tv@y6%my;Kve- z2oOSQQ_gtlEfF^}M-f!BHUvkKUut2_!4P=*3yVUzklSvZFLHgfZL^rLU3CJx>|7RG zwOLzGXze&>fHl&F5;!T+I?*j=1aith=z(GWX5=QWO#$p+N)|n*hXIdXo()cEWaFUc(>4SPrf)0srD=1;|UP#sKmgD|r z8P}<5l=Ts(f7>!-dzcn6RI_8#Vjd7rz%O z-Jez9gCl!=P=adDqn^y}vNFqqX}XH4ReeV$@MiiTXn5#!6h`253;f?^qqA)vl_I*Jr~QA8YPY5DbqNbVWRiy z`}Im&3Q*>PYg&-U^sz3iY5DFNgEr~i#Ip$pHs%zJ_|C-{Mj4Lh=x{n1JNP^1%NWNK z-)K6Y9=|;$ItN{5M1rylTAJD=>rSSIzIL1dU$FhTJbp5$Dx;DNr&a{?Q&%E>*I+j& zsQ_TP8pja+H1mrqH=ko7?l^nZz$jh#@HC5}4q%1!;@^waZAk6z&Y)g{i*o^90KjL) zQxJ0hCD9p!ZKKci+tE`{@rtpH(#>Y!x05j0)HByyt;CA^Wiq_kjJHnX+Oj3x2x_)}3ppq-pC;QCuT1nz(Zx)tu1w!}*9cX>sXdfbPNsgFQ+I+Er4I6smHhbb~gk)m) zrL(AQ6ES%96Vat|f(I9bFre%jNBsx`8)2O}DNkN`H~71RfcIO8Ap>Lb^=da---xlVKY&)s)8OdM;5qH+!#1tXTr^3MUDMvBl)dT{QezKa=wXL?!2T%K$jJIHGeWH^H(J zjuWe7C^s3pVvhl)J(!Q)4##V?#&R}&1yh&!QcH4Ai7fj}7Z}D%=VLut*0Pdsd1j?uvng4ME>+$Vv{4LQZ$EOQ% zWS=?gj`Bd1Et6IlM8o+>zz52?uH0A6il2Dbz zOe<_@i&@v1>wMqUhmN_WwgXb8@`}17(@S^=DJ=ss%HcOk^p1DkcKu%z?M&HDdQqo^ zG$G9WSGS{nCoaVGpJPv8uQIZ2X8)Dl&cTW03xnzRBSEe1S5=kHr|9v`hN*AZ&c zuOLYzV6y80bA80k5#rDW%zOr!KtTv6h!C)x`QxKzEv_0tnr2gw*JML5#PSKe_mxk= z+pYpXDWB2+@RqYd*fV|^FsAZZOvFa{_UjZW(W0Nrj=kojE9`j+t7dv2GiUw7@*^{A zg?Q`5a;yHipeaBl3Flb62CI;Rux1^30{(d&;|A!%zJ^;~-LqLBm>q)cOt&_9iSI#DW_Qq`MHa=4SL1`)7*Bw03+42xQu;z*4+5!F_}Vr|u-0L@kssv;lY!BZ z>Gu73Ns^o!KmH`4cp43X{+Uo=W}YCN4*&V=FSe=+*8pHQ-V0KA>L8PdnwC`?5=2QW4Vom%g~6&qTCVDHz= z0DaK!i%T@2AwI9m?cX&J30%@1c|s6c-_dEQft!f3D+Sw)%nA(onGvd$;>=F62_qRR z0o5+z!2t@unW_}&R#99>ao7XNbt&Sv81&IFZOr@|v}dtJ;8~((^_hn!+VP zvV)KO+Gd&93wZTGW)920mC*uMCP@KYS@Lz+|65r;8gOMuwDT^d9p40$ti)7&3X+5u z#T9?qp$Ob8?W5c7qOYiHj>5O^gbx80fuJK%d>fa?8H$0+_P?s#HC6aqR>sBlSPeu_ zn(MY8>&#noUa*Uvsy`W@bRCK`3I@`bM}Tl;XyqoP!rt8;$ma}LruSAS)k)tXuOu{q z3~werAvJ(L*=KRf&s3sP2$~lD?!-TSrVyNn@V`bik4qj`h>i%f6~H}OW)Bo7>W0Dp zAp?)V9cveKmXBzTk;tJWD8x$#HjQHzP9?@u=+EAtbWxxAh<~!K(-s+pxu$xO?r#l( zMi2tm%xkr_EJ1v`7>4Ac5+ADbhIH56*Z|sCpzl}TLi3dNK&JHC5B_r@vcDj_e4Wl~ z{WqXS&VxvY3Jrh+d#|W6V2;#@0ykDS<^|8S{z0VwHdbg}jM8gq!!RxHMT(m+<&Vrg zB+iW zM#7(j`J)(za0ShKjhf^aBCs+D6T>5_834VN`li^O`nIoejLHUjc3MHykMcOcm%=Ir zIDdMPm4k?jW^ax}aB7a9u3YIa#|a44_mK5NSdiDvTz9VW}?9e*ZHpjPlkbteYi-TmuV7 zIS$-sMrhQ7c>pQMN&Ad)nblis`%r)up@qN#s$1mp`LMFpiMiZZ!a+b{I_%UJ6X_3w zo&Y+|B*<@AI&8~`_1rC4iiawmz-5O>Qf5I}!+!Ro)&4uA#R#~(kn}UH9OLD8Kq2MX z4;WjY!JuymO0a>G9tk|EsTohTXEe5^>C@IY*cy*sw+S5MXEU#lGupzHf~g&7!@)}?(mrr222!V99d6;c4EwE2iCmdaj?Q~6S+d(Y0!D2t=2F7` zE@HJxPD0swHVN1|@{R&sqyJn#+ zZ8{uou=T7Lu;uosvoSV7vR=qI6#THhzo>;-TPk9=zJI87u-N)%eAHgYECY=u@UprJ z+l37F-{7j7V0M6i7Nlz2FFEZ-i8ueCVooq;nky%73+F|r7L&?U({39J z*F~qVngB-E1)FyENxJsilSA%j)a##H)*)MLzuM4tw-1J6B#)4=`jan|r^p zFDYwyb#To1z==*HSb@<=$Zx?jZ4vpJ%3NewX}aiIIhqtY@Yejb1Mf4zMv s%7B7lfc*db4`AY+GZ*py-#d|kuSEs{1t9@`wkC4Be1n2?`sexo0O~^x(f|Me diff --git a/Solutions/AzureDevOpsAuditing/Package/createUiDefinition.json b/Solutions/AzureDevOpsAuditing/Package/createUiDefinition.json index dc6ed723a0a..b05794dcc0f 100644 --- a/Solutions/AzureDevOpsAuditing/Package/createUiDefinition.json +++ b/Solutions/AzureDevOpsAuditing/Package/createUiDefinition.json @@ -122,7 +122,7 @@ { "name": "analytic4", "type": "Microsoft.Common.Section", - "label": "Azure DevOps PAT used with Browser.", + "label": "Azure DevOps PAT used with Browser", "elements": [ { "name": "analytic4-text", @@ -136,7 +136,7 @@ { "name": "analytic5", "type": "Microsoft.Common.Section", - "label": "Azure DevOps Pipeline modified by a new user.", + "label": "Azure DevOps Pipeline modified by a new user", "elements": [ { "name": "analytic5-text", @@ -178,7 +178,7 @@ { "name": "analytic8", "type": "Microsoft.Common.Section", - "label": "Azure DevOps Build Variable Modified by New User.", + "label": "Azure DevOps Build Variable Modified by New User", "elements": [ { "name": "analytic8-text", @@ -290,7 +290,7 @@ { "name": "analytic16", "type": "Microsoft.Common.Section", - "label": "New Agent Added to Pool by New User or Added to a New OS Type.", + "label": "New Agent Added to Pool by New User or Added to a New OS Type", "elements": [ { "name": "analytic16-text", @@ -384,7 +384,7 @@ { "name": "huntingquery3", "type": "Microsoft.Common.Section", - "label": "Azure DevOps - Build Check Deleted.", + "label": "Azure DevOps - Build Check Deleted", "elements": [ { "name": "huntingquery3-text", @@ -412,7 +412,7 @@ { "name": "huntingquery5", "type": "Microsoft.Common.Section", - "label": "Azure DevOps - Internal Upstream Package Feed Added.", + "label": "Azure DevOps - Internal Upstream Package Feed Added", "elements": [ { "name": "huntingquery5-text", diff --git a/Solutions/AzureDevOpsAuditing/Package/mainTemplate.json b/Solutions/AzureDevOpsAuditing/Package/mainTemplate.json index c583b655c35..b6268370af3 100644 --- a/Solutions/AzureDevOpsAuditing/Package/mainTemplate.json +++ b/Solutions/AzureDevOpsAuditing/Package/mainTemplate.json @@ -36,224 +36,225 @@ "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-azuredevopsauditing", "_solutionId": "[variables('solutionId')]", - "analyticRuleVersion1": "1.0.2", - "analyticRulecontentId1": "acfdee3f-b794-404a-aeba-ef6a1fa08ad1", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", "TemplateEmptyArray": "[json('[]')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", - "analyticRuleVersion2": "1.0.2", - "analyticRulecontentId2": "4e8238bd-ff4f-4126-a9f6-09b3b6801b3d", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", - "analyticRuleVersion3": "1.0.2", - "analyticRulecontentId3": "bf07ca9c-e408-443a-8939-6860a45a929e", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", - "analyticRuleVersion4": "1.0.2", - "analyticRulecontentId4": "5f0d80db-3415-4265-9d52-8466b7372e3a", - "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", - "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", - "analyticRuleVersion5": "1.0.4", - "analyticRulecontentId5": "155e9134-d5ad-4a6f-88f3-99c220040b66", - "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", - "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", - "analyticRuleVersion6": "1.0.3", - "analyticRulecontentId6": "71d374e0-1cf8-4e50-aecd-ab6c519795c2", - "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", - "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", - "analyticRuleVersion7": "1.0.2", - "analyticRulecontentId7": "4ca74dc0-8352-4ac5-893c-73571cc78331", - "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", - "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", - "analyticRuleVersion8": "1.0.2", - "analyticRulecontentId8": "3b9a44d7-c651-45ed-816c-eae583a6f2f1", - "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", - "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", - "analyticRuleVersion9": "1.0.3", - "analyticRulecontentId9": "89e6adbd-612c-4fbe-bc3d-32f81baf3b6c", - "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", - "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", - "analyticRuleVersion10": "1.0.4", - "analyticRulecontentId10": "4d8de9e6-263e-4845-8618-cd23a4f58b70", - "_analyticRulecontentId10": "[variables('analyticRulecontentId10')]", - "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId10'))]", - "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10'))))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId10'),'-', variables('analyticRuleVersion10'))))]", - "analyticRuleVersion11": "1.0.3", - "analyticRulecontentId11": "5efb0cfd-063d-417a-803b-562eae5b0301", - "_analyticRulecontentId11": "[variables('analyticRulecontentId11')]", - "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId11'))]", - "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId11'))))]", - "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId11'),'-', variables('analyticRuleVersion11'))))]", - "analyticRuleVersion12": "1.0.4", - "analyticRulecontentId12": "ac891683-53c3-4f86-86b4-c361708e2b2b", - "_analyticRulecontentId12": "[variables('analyticRulecontentId12')]", - "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId12'))]", - "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId12'))))]", - "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId12'),'-', variables('analyticRuleVersion12'))))]", - "analyticRuleVersion13": "1.0.1", - "analyticRulecontentId13": "17f23fbe-bb73-4324-8ecf-a18545a5dc26", - "_analyticRulecontentId13": "[variables('analyticRulecontentId13')]", - "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId13'))]", - "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId13'))))]", - "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId13'),'-', variables('analyticRuleVersion13'))))]", - "analyticRuleVersion14": "1.0.3", - "analyticRulecontentId14": "d564ff12-8f53-41b8-8649-44f76b37b99f", - "_analyticRulecontentId14": "[variables('analyticRulecontentId14')]", - "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId14'))]", - "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId14'))))]", - "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId14'),'-', variables('analyticRuleVersion14'))))]", - "analyticRuleVersion15": "1.0.2", - "analyticRulecontentId15": "adc32a33-1cd6-46f5-8801-e3ed8337885f", - "_analyticRulecontentId15": "[variables('analyticRulecontentId15')]", - "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId15'))]", - "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId15'))))]", - "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId15'),'-', variables('analyticRuleVersion15'))))]", - "analyticRuleVersion16": "1.0.2", - "analyticRulecontentId16": "4ce177b3-56b1-4f0e-b83e-27eed4cb0b16", - "_analyticRulecontentId16": "[variables('analyticRulecontentId16')]", - "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId16'))]", - "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId16'))))]", - "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId16'),'-', variables('analyticRuleVersion16'))))]", - "analyticRuleVersion17": "1.0.3", - "analyticRulecontentId17": "35ce9aff-1708-45b8-a295-5e9a307f5f17", - "_analyticRulecontentId17": "[variables('analyticRulecontentId17')]", - "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId17'))]", - "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId17'))))]", - "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId17'),'-', variables('analyticRuleVersion17'))))]", - "analyticRuleVersion18": "1.0.1", - "analyticRulecontentId18": "74ed028d-e392-40b7-baef-e69627bf89d1", - "_analyticRulecontentId18": "[variables('analyticRulecontentId18')]", - "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId18'))]", - "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId18'))))]", - "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId18'),'-', variables('analyticRuleVersion18'))))]", - "huntingQueryVersion1": "1.0.0", - "huntingQuerycontentId1": "c78a3845-37d9-448e-a8cd-e9543f00bcc5", - "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", - "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", - "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", - "huntingQueryVersion2": "1.0.0", - "huntingQuerycontentId2": "7b634263-9971-4887-8ecf-0d83ab9c7370", - "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", - "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", - "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", - "huntingQueryVersion3": "1.0.0", - "huntingQuerycontentId3": "940386c3-4b2c-4147-ac8e-dcddedaaae52", - "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", - "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", - "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", - "huntingQueryVersion4": "1.0.0", - "huntingQuerycontentId4": "47857f1f-f8e6-470d-b132-03a8a606b3f4", - "_huntingQuerycontentId4": "[variables('huntingQuerycontentId4')]", - "huntingQueryId4": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId4'))]", - "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4'))))]", - "_huntingQuerycontentProductId4": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId4'),'-', variables('huntingQueryVersion4'))))]", - "huntingQueryVersion5": "1.0.0", - "huntingQuerycontentId5": "20be967c-4923-4c4b-8e1d-e1c95d537dc3", - "_huntingQuerycontentId5": "[variables('huntingQuerycontentId5')]", - "huntingQueryId5": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId5'))]", - "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5'))))]", - "_huntingQuerycontentProductId5": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId5'),'-', variables('huntingQueryVersion5'))))]", - "huntingQueryVersion6": "1.0.0", - "huntingQuerycontentId6": "76f626e0-4c78-47d4-aeb6-eaa59f4f2ecb", - "_huntingQuerycontentId6": "[variables('huntingQuerycontentId6')]", - "huntingQueryId6": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId6'))]", - "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6'))))]", - "_huntingQuerycontentProductId6": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId6'),'-', variables('huntingQueryVersion6'))))]", - "huntingQueryVersion7": "1.0.0", - "huntingQuerycontentId7": "3d1aa540-b4c7-4789-8c4c-4174b3c2371f", - "_huntingQuerycontentId7": "[variables('huntingQuerycontentId7')]", - "huntingQueryId7": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId7'))]", - "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7'))))]", - "_huntingQuerycontentProductId7": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId7'),'-', variables('huntingQueryVersion7'))))]", - "huntingQueryVersion8": "1.0.0", - "huntingQuerycontentId8": "5b6ab1d9-018b-46c6-993b-3198626fc54e", - "_huntingQuerycontentId8": "[variables('huntingQuerycontentId8')]", - "huntingQueryId8": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId8'))]", - "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8'))))]", - "_huntingQuerycontentProductId8": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId8'),'-', variables('huntingQueryVersion8'))))]", - "huntingQueryVersion9": "1.0.0", - "huntingQuerycontentId9": "0c149cc9-78ba-4be1-9f7b-018288e3a829", - "_huntingQuerycontentId9": "[variables('huntingQuerycontentId9')]", - "huntingQueryId9": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId9'))]", - "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId9'))))]", - "_huntingQuerycontentProductId9": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId9'),'-', variables('huntingQueryVersion9'))))]", - "huntingQueryVersion10": "1.0.0", - "huntingQuerycontentId10": "2dfa9c23-1590-4589-995a-d1486be66028", - "_huntingQuerycontentId10": "[variables('huntingQuerycontentId10')]", - "huntingQueryId10": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId10'))]", - "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId10'))))]", - "_huntingQuerycontentProductId10": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId10'),'-', variables('huntingQueryVersion10'))))]", - "huntingQueryVersion11": "1.0.0", - "huntingQuerycontentId11": "0fa523de-ce23-49d0-87a4-e890028e1e50", - "_huntingQuerycontentId11": "[variables('huntingQuerycontentId11')]", - "huntingQueryId11": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId11'))]", - "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId11'))))]", - "_huntingQuerycontentProductId11": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId11'),'-', variables('huntingQueryVersion11'))))]", - "huntingQueryVersion12": "1.0.0", - "huntingQuerycontentId12": "cf0c493b-a8af-4b32-8c7e-d4303f3a406f", - "_huntingQuerycontentId12": "[variables('huntingQuerycontentId12')]", - "huntingQueryId12": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId12'))]", - "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId12'))))]", - "_huntingQuerycontentProductId12": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId12'),'-', variables('huntingQueryVersion12'))))]", - "huntingQueryVersion13": "1.0.0", - "huntingQuerycontentId13": "df205daf-fcf3-4b95-a7fd-043b70f6c209", - "_huntingQuerycontentId13": "[variables('huntingQuerycontentId13')]", - "huntingQueryId13": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId13'))]", - "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId13'))))]", - "_huntingQuerycontentProductId13": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId13'),'-', variables('huntingQueryVersion13'))))]", - "huntingQueryVersion14": "1.0.0", - "huntingQuerycontentId14": "2380670e-e168-4a99-9529-6c4d127b3ce6", - "_huntingQuerycontentId14": "[variables('huntingQuerycontentId14')]", - "huntingQueryId14": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId14'))]", - "huntingQueryTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId14'))))]", - "_huntingQuerycontentProductId14": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId14'),'-', variables('huntingQueryVersion14'))))]", - "huntingQueryVersion15": "1.0.0", - "huntingQuerycontentId15": "42e69ff6-719d-4853-95a5-2b211e2bb031", - "_huntingQuerycontentId15": "[variables('huntingQuerycontentId15')]", - "huntingQueryId15": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId15'))]", - "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId15'))))]", - "_huntingQuerycontentProductId15": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId15'),'-', variables('huntingQueryVersion15'))))]", - "huntingQueryVersion16": "1.0.0", - "huntingQuerycontentId16": "3cdc5404-15ed-4656-8eb9-60bc8b495934", - "_huntingQuerycontentId16": "[variables('huntingQuerycontentId16')]", - "huntingQueryId16": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId16'))]", - "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId16'))))]", - "_huntingQuerycontentProductId16": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId16'),'-', variables('huntingQueryVersion16'))))]", - "huntingQueryVersion17": "1.0.0", - "huntingQuerycontentId17": "800ae9c9-0280-4296-821f-c6e0a473fb41", - "_huntingQuerycontentId17": "[variables('huntingQuerycontentId17')]", - "huntingQueryId17": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId17'))]", - "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId17'))))]", - "_huntingQuerycontentProductId17": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId17'),'-', variables('huntingQueryVersion17'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.2", + "_analyticRulecontentId1": "acfdee3f-b794-404a-aeba-ef6a1fa08ad1", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'acfdee3f-b794-404a-aeba-ef6a1fa08ad1')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('acfdee3f-b794-404a-aeba-ef6a1fa08ad1')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','acfdee3f-b794-404a-aeba-ef6a1fa08ad1','-', '1.0.2')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.2", + "_analyticRulecontentId2": "4e8238bd-ff4f-4126-a9f6-09b3b6801b3d", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4e8238bd-ff4f-4126-a9f6-09b3b6801b3d')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4e8238bd-ff4f-4126-a9f6-09b3b6801b3d')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4e8238bd-ff4f-4126-a9f6-09b3b6801b3d','-', '1.0.2')))]" + }, + "analyticRuleObject3": { + "analyticRuleVersion3": "1.0.2", + "_analyticRulecontentId3": "bf07ca9c-e408-443a-8939-6860a45a929e", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bf07ca9c-e408-443a-8939-6860a45a929e')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bf07ca9c-e408-443a-8939-6860a45a929e')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bf07ca9c-e408-443a-8939-6860a45a929e','-', '1.0.2')))]" + }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.2", + "_analyticRulecontentId4": "5f0d80db-3415-4265-9d52-8466b7372e3a", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5f0d80db-3415-4265-9d52-8466b7372e3a')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5f0d80db-3415-4265-9d52-8466b7372e3a')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5f0d80db-3415-4265-9d52-8466b7372e3a','-', '1.0.2')))]" + }, + "analyticRuleObject5": { + "analyticRuleVersion5": "1.0.4", + "_analyticRulecontentId5": "155e9134-d5ad-4a6f-88f3-99c220040b66", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '155e9134-d5ad-4a6f-88f3-99c220040b66')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('155e9134-d5ad-4a6f-88f3-99c220040b66')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','155e9134-d5ad-4a6f-88f3-99c220040b66','-', '1.0.4')))]" + }, + "analyticRuleObject6": { + "analyticRuleVersion6": "1.0.3", + "_analyticRulecontentId6": "71d374e0-1cf8-4e50-aecd-ab6c519795c2", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '71d374e0-1cf8-4e50-aecd-ab6c519795c2')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('71d374e0-1cf8-4e50-aecd-ab6c519795c2')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','71d374e0-1cf8-4e50-aecd-ab6c519795c2','-', '1.0.3')))]" + }, + "analyticRuleObject7": { + "analyticRuleVersion7": "1.0.2", + "_analyticRulecontentId7": "4ca74dc0-8352-4ac5-893c-73571cc78331", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4ca74dc0-8352-4ac5-893c-73571cc78331')]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4ca74dc0-8352-4ac5-893c-73571cc78331')))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4ca74dc0-8352-4ac5-893c-73571cc78331','-', '1.0.2')))]" + }, + "analyticRuleObject8": { + "analyticRuleVersion8": "1.0.2", + "_analyticRulecontentId8": "3b9a44d7-c651-45ed-816c-eae583a6f2f1", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3b9a44d7-c651-45ed-816c-eae583a6f2f1')]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3b9a44d7-c651-45ed-816c-eae583a6f2f1')))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3b9a44d7-c651-45ed-816c-eae583a6f2f1','-', '1.0.2')))]" + }, + "analyticRuleObject9": { + "analyticRuleVersion9": "1.0.3", + "_analyticRulecontentId9": "89e6adbd-612c-4fbe-bc3d-32f81baf3b6c", + "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '89e6adbd-612c-4fbe-bc3d-32f81baf3b6c')]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('89e6adbd-612c-4fbe-bc3d-32f81baf3b6c')))]", + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','89e6adbd-612c-4fbe-bc3d-32f81baf3b6c','-', '1.0.3')))]" + }, + "analyticRuleObject10": { + "analyticRuleVersion10": "1.0.4", + "_analyticRulecontentId10": "4d8de9e6-263e-4845-8618-cd23a4f58b70", + "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4d8de9e6-263e-4845-8618-cd23a4f58b70')]", + "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4d8de9e6-263e-4845-8618-cd23a4f58b70')))]", + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4d8de9e6-263e-4845-8618-cd23a4f58b70','-', '1.0.4')))]" + }, + "analyticRuleObject11": { + "analyticRuleVersion11": "1.0.3", + "_analyticRulecontentId11": "5efb0cfd-063d-417a-803b-562eae5b0301", + "analyticRuleId11": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5efb0cfd-063d-417a-803b-562eae5b0301')]", + "analyticRuleTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5efb0cfd-063d-417a-803b-562eae5b0301')))]", + "_analyticRulecontentProductId11": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5efb0cfd-063d-417a-803b-562eae5b0301','-', '1.0.3')))]" + }, + "analyticRuleObject12": { + "analyticRuleVersion12": "1.0.4", + "_analyticRulecontentId12": "ac891683-53c3-4f86-86b4-c361708e2b2b", + "analyticRuleId12": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'ac891683-53c3-4f86-86b4-c361708e2b2b')]", + "analyticRuleTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('ac891683-53c3-4f86-86b4-c361708e2b2b')))]", + "_analyticRulecontentProductId12": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','ac891683-53c3-4f86-86b4-c361708e2b2b','-', '1.0.4')))]" + }, + "analyticRuleObject13": { + "analyticRuleVersion13": "1.0.1", + "_analyticRulecontentId13": "17f23fbe-bb73-4324-8ecf-a18545a5dc26", + "analyticRuleId13": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '17f23fbe-bb73-4324-8ecf-a18545a5dc26')]", + "analyticRuleTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('17f23fbe-bb73-4324-8ecf-a18545a5dc26')))]", + "_analyticRulecontentProductId13": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','17f23fbe-bb73-4324-8ecf-a18545a5dc26','-', '1.0.1')))]" + }, + "analyticRuleObject14": { + "analyticRuleVersion14": "1.0.3", + "_analyticRulecontentId14": "d564ff12-8f53-41b8-8649-44f76b37b99f", + "analyticRuleId14": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd564ff12-8f53-41b8-8649-44f76b37b99f')]", + "analyticRuleTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d564ff12-8f53-41b8-8649-44f76b37b99f')))]", + "_analyticRulecontentProductId14": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d564ff12-8f53-41b8-8649-44f76b37b99f','-', '1.0.3')))]" + }, + "analyticRuleObject15": { + "analyticRuleVersion15": "1.0.2", + "_analyticRulecontentId15": "adc32a33-1cd6-46f5-8801-e3ed8337885f", + "analyticRuleId15": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'adc32a33-1cd6-46f5-8801-e3ed8337885f')]", + "analyticRuleTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('adc32a33-1cd6-46f5-8801-e3ed8337885f')))]", + "_analyticRulecontentProductId15": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','adc32a33-1cd6-46f5-8801-e3ed8337885f','-', '1.0.2')))]" + }, + "analyticRuleObject16": { + "analyticRuleVersion16": "1.0.2", + "_analyticRulecontentId16": "4ce177b3-56b1-4f0e-b83e-27eed4cb0b1", + "analyticRuleId16": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4ce177b3-56b1-4f0e-b83e-27eed4cb0b1')]", + "analyticRuleTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4ce177b3-56b1-4f0e-b83e-27eed4cb0b1')))]", + "_analyticRulecontentProductId16": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4ce177b3-56b1-4f0e-b83e-27eed4cb0b1','-', '1.0.2')))]" + }, + "analyticRuleObject17": { + "analyticRuleVersion17": "1.0.3", + "_analyticRulecontentId17": "35ce9aff-1708-45b8-a295-5e9a307f5f17", + "analyticRuleId17": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35ce9aff-1708-45b8-a295-5e9a307f5f17')]", + "analyticRuleTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35ce9aff-1708-45b8-a295-5e9a307f5f17')))]", + "_analyticRulecontentProductId17": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35ce9aff-1708-45b8-a295-5e9a307f5f17','-', '1.0.3')))]" + }, + "analyticRuleObject18": { + "analyticRuleVersion18": "1.0.1", + "_analyticRulecontentId18": "74ed028d-e392-40b7-baef-e69627bf89d1", + "analyticRuleId18": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '74ed028d-e392-40b7-baef-e69627bf89d1')]", + "analyticRuleTemplateSpecName18": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('74ed028d-e392-40b7-baef-e69627bf89d1')))]", + "_analyticRulecontentProductId18": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','74ed028d-e392-40b7-baef-e69627bf89d1','-', '1.0.1')))]" + }, + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "c78a3845-37d9-448e-a8cd-e9543f00bcc5", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('c78a3845-37d9-448e-a8cd-e9543f00bcc5')))]" + }, + "huntingQueryObject2": { + "huntingQueryVersion2": "1.0.0", + "_huntingQuerycontentId2": "7b634263-9971-4887-8ecf-0d83ab9c7370", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7b634263-9971-4887-8ecf-0d83ab9c7370')))]" + }, + "huntingQueryObject3": { + "huntingQueryVersion3": "1.0.0", + "_huntingQuerycontentId3": "940386c3-4b2c-4147-ac8e-dcddedaaae52", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('940386c3-4b2c-4147-ac8e-dcddedaaae52')))]" + }, + "huntingQueryObject4": { + "huntingQueryVersion4": "1.0.0", + "_huntingQuerycontentId4": "47857f1f-f8e6-470d-b132-03a8a606b3f4", + "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('47857f1f-f8e6-470d-b132-03a8a606b3f4')))]" + }, + "huntingQueryObject5": { + "huntingQueryVersion5": "1.0.0", + "_huntingQuerycontentId5": "20be967c-4923-4c4b-8e1d-e1c95d537dc3", + "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('20be967c-4923-4c4b-8e1d-e1c95d537dc3')))]" + }, + "huntingQueryObject6": { + "huntingQueryVersion6": "1.0.0", + "_huntingQuerycontentId6": "76f626e0-4c78-47d4-aeb6-eaa59f4f2ecb", + "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('76f626e0-4c78-47d4-aeb6-eaa59f4f2ecb')))]" + }, + "huntingQueryObject7": { + "huntingQueryVersion7": "1.0.0", + "_huntingQuerycontentId7": "3d1aa540-b4c7-4789-8c4c-4174b3c2371f", + "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3d1aa540-b4c7-4789-8c4c-4174b3c2371f')))]" + }, + "huntingQueryObject8": { + "huntingQueryVersion8": "1.0.0", + "_huntingQuerycontentId8": "5b6ab1d9-018b-46c6-993b-3198626fc54e", + "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5b6ab1d9-018b-46c6-993b-3198626fc54e')))]" + }, + "huntingQueryObject9": { + "huntingQueryVersion9": "1.0.0", + "_huntingQuerycontentId9": "0c149cc9-78ba-4be1-9f7b-018288e3a829", + "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0c149cc9-78ba-4be1-9f7b-018288e3a829')))]" + }, + "huntingQueryObject10": { + "huntingQueryVersion10": "1.0.0", + "_huntingQuerycontentId10": "2dfa9c23-1590-4589-995a-d1486be66028", + "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2dfa9c23-1590-4589-995a-d1486be66028')))]" + }, + "huntingQueryObject11": { + "huntingQueryVersion11": "1.0.0", + "_huntingQuerycontentId11": "0fa523de-ce23-49d0-87a4-e890028e1e50", + "huntingQueryTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('0fa523de-ce23-49d0-87a4-e890028e1e50')))]" + }, + "huntingQueryObject12": { + "huntingQueryVersion12": "1.0.0", + "_huntingQuerycontentId12": "cf0c493b-a8af-4b32-8c7e-d4303f3a406f", + "huntingQueryTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('cf0c493b-a8af-4b32-8c7e-d4303f3a406f')))]" + }, + "huntingQueryObject13": { + "huntingQueryVersion13": "1.0.0", + "_huntingQuerycontentId13": "df205daf-fcf3-4b95-a7fd-043b70f6c209", + "huntingQueryTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('df205daf-fcf3-4b95-a7fd-043b70f6c209')))]" + }, + "huntingQueryObject14": { + "huntingQueryVersion14": "1.0.0", + "_huntingQuerycontentId14": "2380670e-e168-4a99-9529-6c4d127b3ce6", + "huntingQueryTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('2380670e-e168-4a99-9529-6c4d127b3ce6')))]" + }, + "huntingQueryObject15": { + "huntingQueryVersion15": "1.0.0", + "_huntingQuerycontentId15": "42e69ff6-719d-4853-95a5-2b211e2bb031", + "huntingQueryTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('42e69ff6-719d-4853-95a5-2b211e2bb031')))]" + }, + "huntingQueryObject16": { + "huntingQueryVersion16": "1.0.0", + "_huntingQuerycontentId16": "3cdc5404-15ed-4656-8eb9-60bc8b495934", + "huntingQueryTemplateSpecName16": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3cdc5404-15ed-4656-8eb9-60bc8b495934')))]" + }, + "huntingQueryObject17": { + "huntingQueryVersion17": "1.0.0", + "_huntingQuerycontentId17": "800ae9c9-0280-4296-821f-c6e0a473fb41", + "huntingQueryTemplateSpecName17": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('800ae9c9-0280-4296-821f-c6e0a473fb41')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName1')]", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -262,13 +263,13 @@ "description": "ADOAgentPoolCreatedDeleted_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId1')]", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -321,13 +322,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -352,18 +353,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId1')]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Agent Pool Created Then Deleted", - "contentProductId": "[variables('_analyticRulecontentProductId1')]", - "id": "[variables('_analyticRulecontentProductId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -372,13 +373,13 @@ "description": "ADOAuditStreamDisabled_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId2')]", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -431,13 +432,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -462,18 +463,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId2')]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Audit Stream Disabled", - "contentProductId": "[variables('_analyticRulecontentProductId2')]", - "id": "[variables('_analyticRulecontentProductId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName3')]", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -482,13 +483,13 @@ "description": "ADONewExtensionAdded_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId3')]", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -541,13 +542,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", + "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -572,18 +573,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId3')]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps New Extension Added", - "contentProductId": "[variables('_analyticRulecontentProductId3')]", - "id": "[variables('_analyticRulecontentProductId3')]", - "version": "[variables('analyticRuleVersion3')]" + "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName4')]", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -592,19 +593,19 @@ "description": "ADOPATUsedWithBrowser_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion4')]", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId4')]", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "Personal Access Tokens (PATs) are used as an alternate password to authenticate into Azure DevOps. PATs are intended for programmatic access use in code or applications. \nThis can be prone to attacker theft if not adequately secured. This query looks for the use of a PAT in authentication but from a User Agent indicating a browser. \nThis should not be normal activity and could be an indicator of an attacker using a stolen PAT.", - "displayName": "Azure DevOps PAT used with Browser.", + "displayName": "Azure DevOps PAT used with Browser", "enabled": false, "query": "AzureDevOpsAuditing\n| where AuthenticationMechanism startswith \"PAT\"\n// Look for useragents that include a redenring engine\n| where UserAgent has_any (\"Gecko\", \"WebKit\", \"Presto\", \"Trident\", \"EdgeHTML\", \"Blink\")\n| extend AccountName = tostring(split(ActorUPN, \"@\")[0]), AccountUPNSuffix = tostring(split(ActorUPN, \"@\")[1])\n", "queryFrequency": "P1D", @@ -648,13 +649,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 4", - "parentId": "[variables('analyticRuleId4')]", - "contentId": "[variables('_analyticRulecontentId4')]", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion4')]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -679,18 +680,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId4')]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", "contentKind": "AnalyticsRule", - "displayName": "Azure DevOps PAT used with Browser.", - "contentProductId": "[variables('_analyticRulecontentProductId4')]", - "id": "[variables('_analyticRulecontentProductId4')]", - "version": "[variables('analyticRuleVersion4')]" + "displayName": "Azure DevOps PAT used with Browser", + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName5')]", + "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -699,19 +700,19 @@ "description": "ADOPipelineModifiedbyNewUser_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion5')]", + "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId5')]", + "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "There are several potential pipeline steps that could be modified by an attacker to inject malicious code into the build cycle. A likely attacker path is the modification to an existing pipeline that they have access to. \nThis detection looks for users modifying a pipeline when they have not previously been observed modifying or creating that pipeline before. This query also joins events with data to Microsoft Entra ID Protection \nin order to show if the user conducting the action has any associated Microsoft Entra ID Protection alerts. You can also choose to filter this detection to only alert when the user also has Microsoft Entra ID Protection alerts associated with them.", - "displayName": "Azure DevOps Pipeline modified by a new user.", + "displayName": "Azure DevOps Pipeline modified by a new user", "enabled": false, "query": "// Set the lookback to determine if user has created pipelines before\nlet timeback = 14d;\n// Set the period for detections\nlet timeframe = 1d;\n// Get a list of previous Release Pipeline creators to exclude\nlet releaseusers = AzureDevOpsAuditing\n| where TimeGenerated > ago(timeback) and TimeGenerated < ago(timeframe)\n| where OperationName in (\"Release.ReleasePipelineCreated\", \"Release.ReleasePipelineModified\")\n// We want to look for users performing actions in specific projects so we create this userscope object to match on\n| extend UserScope = strcat(ActorUserId, \"-\", ProjectName)\n| summarize by UserScope;\n// Get Release Pipeline creations by new users\nAzureDevOpsAuditing\n| where TimeGenerated > ago(timeframe)\n| where OperationName =~ \"Release.ReleasePipelineModified\"\n| extend UserScope = strcat(ActorUserId, \"-\", ProjectName)\n| where UserScope !in (releaseusers)\n| extend ActorUPN = tolower(ActorUPN)\n| project-away Id, ActivityId, ActorCUID, ScopeId, ProjectId, TenantId, SourceSystem, UserScope\n// See if any of these users have Azure AD alerts associated with them in the same timeframe\n| join kind = leftouter (\nSecurityAlert\n| where TimeGenerated > ago(timeframe)\n| where ProviderName == \"IPC\"\n| extend AadUserId = tostring(parse_json(Entities)[0].AadUserId)\n| summarize Alerts=count() by AadUserId) on $left.ActorUserId == $right.AadUserId\n| extend Alerts = iif(isnotempty(Alerts), Alerts, 0)\n// Uncomment the line below to only show results where the user as AADIdP alerts\n//| where Alerts > 0\n| extend timestamp = TimeGenerated\n| extend AccountName = tostring(split(ActorUPN, \"@\")[0]), AccountUPNSuffix = tostring(split(ActorUPN, \"@\")[1])\n", "queryFrequency": "P1D", @@ -760,13 +761,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 5", - "parentId": "[variables('analyticRuleId5')]", - "contentId": "[variables('_analyticRulecontentId5')]", + "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion5')]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -791,18 +792,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId5')]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", "contentKind": "AnalyticsRule", - "displayName": "Azure DevOps Pipeline modified by a new user.", - "contentProductId": "[variables('_analyticRulecontentProductId5')]", - "id": "[variables('_analyticRulecontentProductId5')]", - "version": "[variables('analyticRuleVersion5')]" + "displayName": "Azure DevOps Pipeline modified by a new user", + "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName6')]", + "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -811,13 +812,13 @@ "description": "ADORetentionReduced_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion6')]", + "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId6')]", + "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -870,13 +871,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 6", - "parentId": "[variables('analyticRuleId6')]", - "contentId": "[variables('_analyticRulecontentId6')]", + "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion6')]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -901,18 +902,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId6')]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Retention Reduced", - "contentProductId": "[variables('_analyticRulecontentProductId6')]", - "id": "[variables('_analyticRulecontentProductId6')]", - "version": "[variables('analyticRuleVersion6')]" + "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName7')]", + "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -921,13 +922,13 @@ "description": "ADOSecretNotSecured_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion7')]", + "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId7')]", + "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -980,13 +981,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 7", - "parentId": "[variables('analyticRuleId7')]", - "contentId": "[variables('_analyticRulecontentId7')]", + "parentId": "[variables('analyticRuleObject7').analyticRuleId7]", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion7')]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1011,18 +1012,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId7')]", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Variable Secret Not Secured", - "contentProductId": "[variables('_analyticRulecontentProductId7')]", - "id": "[variables('_analyticRulecontentProductId7')]", - "version": "[variables('analyticRuleVersion7')]" + "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName8')]", + "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1031,19 +1032,19 @@ "description": "ADOVariableModifiedByNewUser_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion8')]", + "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId8')]", + "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "Variables can be configured and used at any stage of the build process in Azure DevOps to inject values. An attacker with the required permissions could modify \nor add to these variables to conduct malicious activity such as changing paths or remote endpoints called during the build. As variables are often changed by users, \njust detecting these changes would have a high false positive rate. This detection looks for modifications to variable groups where that user has not been observed \nmodifying them before.", - "displayName": "Azure DevOps Build Variable Modified by New User.", + "displayName": "Azure DevOps Build Variable Modified by New User", "enabled": false, "query": "let lookback = 14d;\nlet timeframe = 1d;\nlet historical_data =\nAzureDevOpsAuditing\n| where TimeGenerated > ago(lookback) and TimeGenerated < ago(timeframe)\n| where OperationName =~ \"Library.VariableGroupModified\"\n| extend variables = Data.Variables\n| extend VariableGroupId = tostring(Data.VariableGroupId)\n| extend UserKey = strcat(VariableGroupId, \"-\", ActorUserId)\n| project UserKey;\nAzureDevOpsAuditing\n| where TimeGenerated > ago(timeframe)\n| where OperationName =~ \"Library.VariableGroupModified\"\n| extend VariableGroupName = tostring(Data.VariableGroupName)\n| extend VariableGroupId = tostring(Data.VariableGroupId)\n| extend UserKey = strcat(VariableGroupId, \"-\", ActorUserId)\n| where UserKey !in (historical_data)\n| project-away UserKey\n| project-reorder TimeGenerated, VariableGroupName, ActorUPN, IpAddress, UserAgent\n| extend timestamp = TimeGenerated\n| extend AccountName = tostring(split(ActorUPN, \"@\")[0]), AccountUPNSuffix = tostring(split(ActorUPN, \"@\")[1])\n", "queryFrequency": "P1D", @@ -1090,13 +1091,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 8", - "parentId": "[variables('analyticRuleId8')]", - "contentId": "[variables('_analyticRulecontentId8')]", + "parentId": "[variables('analyticRuleObject8').analyticRuleId8]", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion8')]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1121,18 +1122,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId8')]", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", "contentKind": "AnalyticsRule", - "displayName": "Azure DevOps Build Variable Modified by New User.", - "contentProductId": "[variables('_analyticRulecontentProductId8')]", - "id": "[variables('_analyticRulecontentProductId8')]", - "version": "[variables('analyticRuleVersion8')]" + "displayName": "Azure DevOps Build Variable Modified by New User", + "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName9')]", + "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1141,13 +1142,13 @@ "description": "AzDOAdminGroupAdditions_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion9')]", + "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId9')]", + "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1200,13 +1201,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 9", - "parentId": "[variables('analyticRuleId9')]", - "contentId": "[variables('_analyticRulecontentId9')]", + "parentId": "[variables('analyticRuleObject9').analyticRuleId9]", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion9')]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1231,18 +1232,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId9')]", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Administrator Group Monitoring", - "contentProductId": "[variables('_analyticRulecontentProductId9')]", - "id": "[variables('_analyticRulecontentProductId9')]", - "version": "[variables('analyticRuleVersion9')]" + "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName10')]", + "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1251,13 +1252,13 @@ "description": "AzDOHistoricPrPolicyBypassing_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion10')]", + "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId10')]", + "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1319,13 +1320,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId10'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 10", - "parentId": "[variables('analyticRuleId10')]", - "contentId": "[variables('_analyticRulecontentId10')]", + "parentId": "[variables('analyticRuleObject10').analyticRuleId10]", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion10')]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1350,18 +1351,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId10')]", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Pull Request Policy Bypassing - Historic allow list", - "contentProductId": "[variables('_analyticRulecontentProductId10')]", - "id": "[variables('_analyticRulecontentProductId10')]", - "version": "[variables('analyticRuleVersion10')]" + "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", + "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName11')]", + "name": "[variables('analyticRuleObject11').analyticRuleTemplateSpecName11]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1370,13 +1371,13 @@ "description": "AzDOHistoricServiceConnectionAdds_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion11')]", + "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId11')]", + "name": "[variables('analyticRuleObject11')._analyticRulecontentId11]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1422,13 +1423,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId11'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject11').analyticRuleId11,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 11", - "parentId": "[variables('analyticRuleId11')]", - "contentId": "[variables('_analyticRulecontentId11')]", + "parentId": "[variables('analyticRuleObject11').analyticRuleId11]", + "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion11')]", + "version": "[variables('analyticRuleObject11').analyticRuleVersion11]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1453,18 +1454,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId11')]", + "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Service Connection Addition/Abuse - Historic allow list", - "contentProductId": "[variables('_analyticRulecontentProductId11')]", - "id": "[variables('_analyticRulecontentProductId11')]", - "version": "[variables('analyticRuleVersion11')]" + "contentProductId": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]", + "id": "[variables('analyticRuleObject11')._analyticRulecontentProductId11]", + "version": "[variables('analyticRuleObject11').analyticRuleVersion11]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName12')]", + "name": "[variables('analyticRuleObject12').analyticRuleTemplateSpecName12]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1473,13 +1474,13 @@ "description": "AzDOPatSessionMisuse_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion12')]", + "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId12')]", + "name": "[variables('analyticRuleObject12')._analyticRulecontentId12]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1534,13 +1535,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId12'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject12').analyticRuleId12,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 12", - "parentId": "[variables('analyticRuleId12')]", - "contentId": "[variables('_analyticRulecontentId12')]", + "parentId": "[variables('analyticRuleObject12').analyticRuleId12]", + "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion12')]", + "version": "[variables('analyticRuleObject12').analyticRuleVersion12]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1565,18 +1566,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId12')]", + "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Personal Access Token (PAT) misuse", - "contentProductId": "[variables('_analyticRulecontentProductId12')]", - "id": "[variables('_analyticRulecontentProductId12')]", - "version": "[variables('analyticRuleVersion12')]" + "contentProductId": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]", + "id": "[variables('analyticRuleObject12')._analyticRulecontentProductId12]", + "version": "[variables('analyticRuleObject12').analyticRuleVersion12]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName13')]", + "name": "[variables('analyticRuleObject13').analyticRuleTemplateSpecName13]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1585,13 +1586,13 @@ "description": "AzDOPipelineCreatedDeletedOneDay_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion13')]", + "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId13')]", + "name": "[variables('analyticRuleObject13')._analyticRulecontentId13]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1666,13 +1667,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId13'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject13').analyticRuleId13,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 13", - "parentId": "[variables('analyticRuleId13')]", - "contentId": "[variables('_analyticRulecontentId13')]", + "parentId": "[variables('analyticRuleObject13').analyticRuleId13]", + "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion13')]", + "version": "[variables('analyticRuleObject13').analyticRuleVersion13]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1697,18 +1698,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId13')]", + "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Pipeline Created and Deleted on the Same Day", - "contentProductId": "[variables('_analyticRulecontentProductId13')]", - "id": "[variables('_analyticRulecontentProductId13')]", - "version": "[variables('analyticRuleVersion13')]" + "contentProductId": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]", + "id": "[variables('analyticRuleObject13')._analyticRulecontentProductId13]", + "version": "[variables('analyticRuleObject13').analyticRuleVersion13]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName14')]", + "name": "[variables('analyticRuleObject14').analyticRuleTemplateSpecName14]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1717,13 +1718,13 @@ "description": "AzDOServiceConnectionUsage_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion14')]", + "contentVersion": "[variables('analyticRuleObject14').analyticRuleVersion14]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId14')]", + "name": "[variables('analyticRuleObject14')._analyticRulecontentId14]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1778,13 +1779,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId14'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject14').analyticRuleId14,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 14", - "parentId": "[variables('analyticRuleId14')]", - "contentId": "[variables('_analyticRulecontentId14')]", + "parentId": "[variables('analyticRuleObject14').analyticRuleId14]", + "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion14')]", + "version": "[variables('analyticRuleObject14').analyticRuleVersion14]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1809,18 +1810,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId14')]", + "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", "contentKind": "AnalyticsRule", "displayName": "Azure DevOps Service Connection Abuse", - "contentProductId": "[variables('_analyticRulecontentProductId14')]", - "id": "[variables('_analyticRulecontentProductId14')]", - "version": "[variables('analyticRuleVersion14')]" + "contentProductId": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]", + "id": "[variables('analyticRuleObject14')._analyticRulecontentProductId14]", + "version": "[variables('analyticRuleObject14').analyticRuleVersion14]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName15')]", + "name": "[variables('analyticRuleObject15').analyticRuleTemplateSpecName15]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1829,13 +1830,13 @@ "description": "ExternalUpstreamSourceAddedtoAzureDevOpsFeed_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion15')]", + "contentVersion": "[variables('analyticRuleObject15').analyticRuleVersion15]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId15')]", + "name": "[variables('analyticRuleObject15')._analyticRulecontentId15]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -1888,13 +1889,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId15'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject15').analyticRuleId15,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 15", - "parentId": "[variables('analyticRuleId15')]", - "contentId": "[variables('_analyticRulecontentId15')]", + "parentId": "[variables('analyticRuleObject15').analyticRuleId15]", + "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion15')]", + "version": "[variables('analyticRuleObject15').analyticRuleVersion15]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -1919,18 +1920,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId15')]", + "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", "contentKind": "AnalyticsRule", "displayName": "External Upstream Source Added to Azure DevOps Feed", - "contentProductId": "[variables('_analyticRulecontentProductId15')]", - "id": "[variables('_analyticRulecontentProductId15')]", - "version": "[variables('analyticRuleVersion15')]" + "contentProductId": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]", + "id": "[variables('analyticRuleObject15')._analyticRulecontentProductId15]", + "version": "[variables('analyticRuleObject15').analyticRuleVersion15]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName16')]", + "name": "[variables('analyticRuleObject16').analyticRuleTemplateSpecName16]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -1939,19 +1940,19 @@ "description": "NewAgentAddedToPoolbyNewUserorofNewOS_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion16')]", + "contentVersion": "[variables('analyticRuleObject16').analyticRuleVersion16]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId16')]", + "name": "[variables('analyticRuleObject16')._analyticRulecontentId16]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { "description": "As seen in attacks such as SolarWinds attackers can look to subvert a build process by controlling build servers. Azure DevOps uses agent pools to execute pipeline tasks. \nAn attacker could insert compromised agents that they control into the pools in order to execute malicious code. This query looks for users adding agents to pools they have \nnot added agents to before, or adding agents to a pool of an OS that has not been added to that pool before. This detection has potential for false positives so has a \nconfigurable allow list to allow for certain users to be excluded from the logic.", - "displayName": "New Agent Added to Pool by New User or Added to a New OS Type.", + "displayName": "New Agent Added to Pool by New User or Added to a New OS Type", "enabled": false, "query": "let lookback = 14d;\nlet timeframe = 1d;\n// exclude allowed users from query such as the ADO service\nlet allowed_users = dynamic([\"Azure DevOps Service\"]);\nunion\n// Look for agents being added to a pool of a OS type not seen with that pool before\n(AzureDevOpsAuditing\n| where TimeGenerated > ago(lookback) and TimeGenerated < ago(timeframe)\n| where OperationName =~ \"Library.AgentAdded\"\n| where ActorUPN !in (allowed_users)\n| extend AgentPoolName = tostring(Data.AgentPoolName)\n| extend OsDescription = tostring(Data.OsDescription)\n| where isnotempty(OsDescription)\n| extend OsDescription = tostring(split(OsDescription, \"#\", 0)[0])\n| project AgentPoolName, OsDescription\n| join kind=rightanti (AzureDevOpsAuditing\n| where TimeGenerated > ago(timeframe)\n| where OperationName == \"Library.AgentAdded\"\n| extend AgentPoolName = tostring(Data.AgentPoolName)\n| extend OsDescription = tostring(Data.OsDescription)\n| where isnotempty(OsDescription)\n| extend OsDescription = tostring(split(OsDescription, \"#\", 0)[0])) on AgentPoolName, OsDescription),\n// Look for users addeing agents to a pool that they have not added agents to before.\n(AzureDevOpsAuditing\n| where TimeGenerated > ago(lookback) and TimeGenerated < ago(timeframe)\n| extend AgentPoolName = tostring(Data.AgentPoolName)\n| where ActorUPN !in (allowed_users)\n| project AgentPoolName, ActorUPN\n| join kind=rightanti (AzureDevOpsAuditing\n| where TimeGenerated > ago(timeframe)\n| where OperationName == \"Library.AgentAdded\"\n| where ActorUPN !in (allowed_users)\n| extend AgentPoolName = tostring(Data.AgentPoolName)\n) on AgentPoolName, ActorUPN)\n| extend AgentName = tostring(Data.AgentName)\n| extend OsDescription = tostring(Data.OsDescription)\n| extend SystemDetails = Data.SystemCapabilities\n| project-reorder TimeGenerated, OperationName, ScopeDisplayName, AgentPoolName, AgentName, ActorUPN, IpAddress, UserAgent, OsDescription, SystemDetails, Data\n| extend timestamp = TimeGenerated\n| extend AccountName = tostring(split(ActorUPN, \"@\")[0]), AccountUPNSuffix = tostring(split(ActorUPN, \"@\")[1])\n", "queryFrequency": "P1D", @@ -1998,13 +1999,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId16'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject16').analyticRuleId16,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 16", - "parentId": "[variables('analyticRuleId16')]", - "contentId": "[variables('_analyticRulecontentId16')]", + "parentId": "[variables('analyticRuleObject16').analyticRuleId16]", + "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion16')]", + "version": "[variables('analyticRuleObject16').analyticRuleVersion16]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2029,18 +2030,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId16')]", + "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", "contentKind": "AnalyticsRule", - "displayName": "New Agent Added to Pool by New User or Added to a New OS Type.", - "contentProductId": "[variables('_analyticRulecontentProductId16')]", - "id": "[variables('_analyticRulecontentProductId16')]", - "version": "[variables('analyticRuleVersion16')]" + "displayName": "New Agent Added to Pool by New User or Added to a New OS Type", + "contentProductId": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]", + "id": "[variables('analyticRuleObject16')._analyticRulecontentProductId16]", + "version": "[variables('analyticRuleObject16').analyticRuleVersion16]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName17')]", + "name": "[variables('analyticRuleObject17').analyticRuleTemplateSpecName17]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2049,13 +2050,13 @@ "description": "NewPAPCAPCASaddedtoADO_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion17')]", + "contentVersion": "[variables('analyticRuleObject17').analyticRuleVersion17]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId17')]", + "name": "[variables('analyticRuleObject17')._analyticRulecontentId17]", "apiVersion": "2022-04-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", @@ -2121,13 +2122,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId17'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject17').analyticRuleId17,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 17", - "parentId": "[variables('analyticRuleId17')]", - "contentId": "[variables('_analyticRulecontentId17')]", + "parentId": "[variables('analyticRuleObject17').analyticRuleId17]", + "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion17')]", + "version": "[variables('analyticRuleObject17').analyticRuleVersion17]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2152,18 +2153,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId17')]", + "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", "contentKind": "AnalyticsRule", "displayName": "New PA, PCA, or PCAS added to Azure DevOps", - "contentProductId": "[variables('_analyticRulecontentProductId17')]", - "id": "[variables('_analyticRulecontentProductId17')]", - "version": "[variables('analyticRuleVersion17')]" + "contentProductId": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]", + "id": "[variables('analyticRuleObject17')._analyticRulecontentProductId17]", + "version": "[variables('analyticRuleObject17').analyticRuleVersion17]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName18')]", + "name": "[variables('analyticRuleObject18').analyticRuleTemplateSpecName18]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2172,13 +2173,13 @@ "description": "NRT_ADOAuditStreamDisabled_AnalyticalRules Analytics Rule with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion18')]", + "contentVersion": "[variables('analyticRuleObject18').analyticRuleVersion18]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId18')]", + "name": "[variables('analyticRuleObject18')._analyticRulecontentId18]", "apiVersion": "2022-04-01-preview", "kind": "NRT", "location": "[parameters('workspace-location')]", @@ -2227,13 +2228,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId18'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject18').analyticRuleId18,'/'))))]", "properties": { "description": "AzureDevOpsAuditing Analytics Rule 18", - "parentId": "[variables('analyticRuleId18')]", - "contentId": "[variables('_analyticRulecontentId18')]", + "parentId": "[variables('analyticRuleObject18').analyticRuleId18]", + "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion18')]", + "version": "[variables('analyticRuleObject18').analyticRuleVersion18]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2258,18 +2259,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId18')]", + "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", "contentKind": "AnalyticsRule", "displayName": "NRT Azure DevOps Audit Stream Disabled", - "contentProductId": "[variables('_analyticRulecontentProductId18')]", - "id": "[variables('_analyticRulecontentProductId18')]", - "version": "[variables('analyticRuleVersion18')]" + "contentProductId": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]", + "id": "[variables('analyticRuleObject18')._analyticRulecontentProductId18]", + "version": "[variables('analyticRuleObject18').analyticRuleVersion18]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName1')]", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2278,7 +2279,7 @@ "description": "EntraID Conditional Access Disabled_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion1')]", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", "parameters": {}, "variables": {}, "resources": [ @@ -2312,13 +2313,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 1", - "parentId": "[variables('huntingQueryId1')]", - "contentId": "[variables('_huntingQuerycontentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion1')]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2343,18 +2344,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId1')]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps- Microsoft Entra ID Protection Conditional Access Disabled", - "contentProductId": "[variables('_huntingQuerycontentProductId1')]", - "id": "[variables('_huntingQuerycontentProductId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName2')]", + "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2363,7 +2364,7 @@ "description": "Addtional Org Admin Added_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion2')]", + "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", "parameters": {}, "variables": {}, "resources": [ @@ -2397,13 +2398,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 2", - "parentId": "[variables('huntingQueryId2')]", - "contentId": "[variables('_huntingQuerycontentId2')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion2')]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2428,18 +2429,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId2')]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps- Addtional Org Admin added", - "contentProductId": "[variables('_huntingQuerycontentProductId2')]", - "id": "[variables('_huntingQuerycontentProductId2')]", - "version": "[variables('huntingQueryVersion2')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName3')]", + "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2448,7 +2449,7 @@ "description": "ADOBuildCheckDeleted_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion3')]", + "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", "parameters": {}, "variables": {}, "resources": [ @@ -2459,7 +2460,7 @@ "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Azure DevOps - Build Check Deleted.", + "displayName": "Azure DevOps - Build Check Deleted", "category": "Hunting Queries", "query": "AzureDevOpsAuditing\n | where OperationName =~ \"CheckConfiguration.Deleted\"\n | extend ResourceName = tostring(Data.ResourceName)\n | extend Type = tostring(Data.Type)\n | project-reorder TimeGenerated, OperationName, ResourceName, Type, ActorUPN, IpAddress, UserAgent\n | extend timestamp = TimeGenerated, AccountCustomEntity = ActorUPN, IPCustomEntity = IpAddress\n", "version": 2, @@ -2482,13 +2483,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 3", - "parentId": "[variables('huntingQueryId3')]", - "contentId": "[variables('_huntingQuerycontentId3')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion3')]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2513,18 +2514,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId3')]", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", "contentKind": "HuntingQuery", - "displayName": "Azure DevOps - Build Check Deleted.", - "contentProductId": "[variables('_huntingQuerycontentProductId3')]", - "id": "[variables('_huntingQuerycontentProductId3')]", - "version": "[variables('huntingQueryVersion3')]" + "displayName": "Azure DevOps - Build Check Deleted", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName4')]", + "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2533,7 +2534,7 @@ "description": "ADOBuildDeletedAfterPipelineMod_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion4')]", + "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", "parameters": {}, "variables": {}, "resources": [ @@ -2567,13 +2568,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 4", - "parentId": "[variables('huntingQueryId4')]", - "contentId": "[variables('_huntingQuerycontentId4')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion4')]", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2598,18 +2599,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId4')]", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - Build Deleted After Pipeline Modification", - "contentProductId": "[variables('_huntingQuerycontentProductId4')]", - "id": "[variables('_huntingQuerycontentProductId4')]", - "version": "[variables('huntingQueryVersion4')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName5')]", + "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2618,7 +2619,7 @@ "description": "ADOInternalUpstreamPacakgeFeedAdded_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion5')]", + "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", "parameters": {}, "variables": {}, "resources": [ @@ -2629,7 +2630,7 @@ "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Azure DevOps - Internal Upstream Package Feed Added.", + "displayName": "Azure DevOps - Internal Upstream Package Feed Added", "category": "Hunting Queries", "query": "let starttime = todatetime('{{StartTimeISO}}');\nlet endtime = todatetime('{{EndTimeISO}}');\nlet lookback = totimespan((endtime-starttime)*10);\n// Add any known allowed sources and source locations to the filter below.\nlet allowed_sources = dynamic([]);\nlet allowed_locations = dynamic([]);\nlet known_packages = (\nAzureDevOpsAuditing\n| where TimeGenerated > ago(lookback) and TimeGenerated < starttime\n// Look for feeds created or modified at either the organization or project level\n| where OperationName matches regex \"Artifacts.Feed.(Org|Project).Modify\"\n| where Details has \"UpstreamSources, added\"\n| extend UpstreamsAdded = Data.UpstreamsAdded\n// As multiple feeds may be added expand these out\n| mv-expand UpstreamsAdded\n// Only focus on internal feeds\n| where UpstreamsAdded.UpstreamSourceType =~ \"internal\"\n| extend SourceLocation = tostring(UpstreamsAdded.Location)\n| summarize by SourceLocation);\n// Look for internal feeds being added from a new location\nAzureDevOpsAuditing\n| where TimeGenerated between(starttime..endtime)\n| where OperationName matches regex \"Artifacts.Feed.(Org|Project).Modify\"\n| where Details has \"UpstreamSources, added\"\n| extend FeedName = tostring(Data.FeedName)\n| extend FeedId = tostring(Data.FeedId)\n| extend UpstreamsAdded = Data.UpstreamsAdded\n// As multiple feeds may be added expand these out\n| mv-expand UpstreamsAdded\n// Only focus on internal feeds\n| where UpstreamsAdded.UpstreamSourceType =~ \"internal\"\n| extend SourceLocation = tostring(UpstreamsAdded.Location)\n| extend SourceName = tostring(UpstreamsAdded.Name)\n// Exclude sources and locations in the allow list\n| where SourceLocation !in (known_packages)\n| where SourceLocation !in (allowed_locations) and SourceName !in (allowed_sources)\n| extend SourceProtocol = tostring(UpstreamsAdded.Protocol)\n| extend SourceStatus = tostring(UpstreamsAdded.Status)\n| project-reorder TimeGenerated, OperationName, ScopeDisplayName, ProjectName, FeedName, SourceName, SourceLocation, SourceProtocol, ActorUPN, UserAgent, IpAddress\n// See if there are details of who created this feed and when to add context\n| join kind=leftouter (AzureDevOpsAuditing\n| where TimeGenerated > ago(lookback)\n| where OperationName matches regex \"Artifacts.Feed.(Org|Project).Create\"\n| extend FeedId = tostring(Data.FeedId)\n| project FeedId, FeedCreatedBy=ActorUPN, TimeCreated=TimeGenerated) on FeedId, $left.ActorUPN==$right.FeedCreatedBy\n| extend timestamp = TimeGenerated, AccountCustomEntity = ActorUPN, IPCustomEntity = IpAddress\n", "version": 2, @@ -2652,13 +2653,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 5", - "parentId": "[variables('huntingQueryId5')]", - "contentId": "[variables('_huntingQuerycontentId5')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion5')]", + "version": "[variables('huntingQueryObject5').huntingQueryVersion5]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2683,18 +2684,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId5')]", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", "contentKind": "HuntingQuery", - "displayName": "Azure DevOps - Internal Upstream Package Feed Added.", - "contentProductId": "[variables('_huntingQuerycontentProductId5')]", - "id": "[variables('_huntingQuerycontentProductId5')]", - "version": "[variables('huntingQueryVersion5')]" + "displayName": "Azure DevOps - Internal Upstream Package Feed Added", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName6')]", + "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2703,7 +2704,7 @@ "description": "ADONewAgentPoolCreated_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion6')]", + "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", "parameters": {}, "variables": {}, "resources": [ @@ -2737,13 +2738,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 6", - "parentId": "[variables('huntingQueryId6')]", - "contentId": "[variables('_huntingQuerycontentId6')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]", + "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion6')]", + "version": "[variables('huntingQueryObject6').huntingQueryVersion6]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2768,18 +2769,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId6')]", + "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - New Agent Pool Created", - "contentProductId": "[variables('_huntingQuerycontentProductId6')]", - "id": "[variables('_huntingQuerycontentProductId6')]", - "version": "[variables('huntingQueryVersion6')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName7')]", + "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2788,7 +2789,7 @@ "description": "ADONewPackageFeedCreated_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion7')]", + "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", "parameters": {}, "variables": {}, "resources": [ @@ -2822,13 +2823,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 7", - "parentId": "[variables('huntingQueryId7')]", - "contentId": "[variables('_huntingQuerycontentId7')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]", + "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion7')]", + "version": "[variables('huntingQueryObject7').huntingQueryVersion7]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2853,18 +2854,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId7')]", + "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - New Package Feed Created", - "contentProductId": "[variables('_huntingQuerycontentProductId7')]", - "id": "[variables('_huntingQuerycontentProductId7')]", - "version": "[variables('huntingQueryVersion7')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName8')]", + "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2873,7 +2874,7 @@ "description": "ADONewPATOperation_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion8')]", + "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", "parameters": {}, "variables": {}, "resources": [ @@ -2907,13 +2908,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 8", - "parentId": "[variables('huntingQueryId8')]", - "contentId": "[variables('_huntingQuerycontentId8')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]", + "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion8')]", + "version": "[variables('huntingQueryObject8').huntingQueryVersion8]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -2938,18 +2939,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId8')]", + "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - New PAT Operation", - "contentProductId": "[variables('_huntingQuerycontentProductId8')]", - "id": "[variables('_huntingQuerycontentProductId8')]", - "version": "[variables('huntingQueryVersion8')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName9')]", + "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -2958,7 +2959,7 @@ "description": "ADONewReleaseApprover_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion9')]", + "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", "parameters": {}, "variables": {}, "resources": [ @@ -2992,13 +2993,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 9", - "parentId": "[variables('huntingQueryId9')]", - "contentId": "[variables('_huntingQuerycontentId9')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]", + "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion9')]", + "version": "[variables('huntingQueryObject9').huntingQueryVersion9]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3023,18 +3024,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId9')]", + "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - New Release Approver", - "contentProductId": "[variables('_huntingQuerycontentProductId9')]", - "id": "[variables('_huntingQuerycontentProductId9')]", - "version": "[variables('huntingQueryVersion9')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName10')]", + "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3043,7 +3044,7 @@ "description": "ADOReleasePipelineCreated_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion10')]", + "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", "parameters": {}, "variables": {}, "resources": [ @@ -3077,13 +3078,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId10'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 10", - "parentId": "[variables('huntingQueryId10')]", - "contentId": "[variables('_huntingQuerycontentId10')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]", + "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion10')]", + "version": "[variables('huntingQueryObject10').huntingQueryVersion10]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3108,18 +3109,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId10')]", + "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - New Release Pipeline Created", - "contentProductId": "[variables('_huntingQuerycontentProductId10')]", - "id": "[variables('_huntingQuerycontentProductId10')]", - "version": "[variables('huntingQueryVersion10')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName11')]", + "name": "[variables('huntingQueryObject11').huntingQueryTemplateSpecName11]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3128,7 +3129,7 @@ "description": "ADOVariableCreatedDeleted_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion11')]", + "contentVersion": "[variables('huntingQueryObject11').huntingQueryVersion11]", "parameters": {}, "variables": {}, "resources": [ @@ -3162,13 +3163,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId11'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 11", - "parentId": "[variables('huntingQueryId11')]", - "contentId": "[variables('_huntingQuerycontentId11')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject11')._huntingQuerycontentId11)]", + "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion11')]", + "version": "[variables('huntingQueryObject11').huntingQueryVersion11]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3193,18 +3194,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId11')]", + "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps - Variable Created and Deleted", - "contentProductId": "[variables('_huntingQuerycontentProductId11')]", - "id": "[variables('_huntingQuerycontentProductId11')]", - "version": "[variables('huntingQueryVersion11')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject11')._huntingQuerycontentId11,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName12')]", + "name": "[variables('huntingQueryObject12').huntingQueryTemplateSpecName12]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3213,7 +3214,7 @@ "description": "AzDODisplayNameSwapping_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion12')]", + "contentVersion": "[variables('huntingQueryObject12').huntingQueryVersion12]", "parameters": {}, "variables": {}, "resources": [ @@ -3247,13 +3248,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId12'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 12", - "parentId": "[variables('huntingQueryId12')]", - "contentId": "[variables('_huntingQuerycontentId12')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject12')._huntingQuerycontentId12)]", + "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion12')]", + "version": "[variables('huntingQueryObject12').huntingQueryVersion12]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3278,18 +3279,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId12')]", + "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps Display Name Changes", - "contentProductId": "[variables('_huntingQuerycontentProductId12')]", - "id": "[variables('_huntingQuerycontentProductId12')]", - "version": "[variables('huntingQueryVersion12')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject12')._huntingQuerycontentId12,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName13')]", + "name": "[variables('huntingQueryObject13').huntingQueryTemplateSpecName13]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3298,7 +3299,7 @@ "description": "AzDOPrPolicyBypassers_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion13')]", + "contentVersion": "[variables('huntingQueryObject13').huntingQueryVersion13]", "parameters": {}, "variables": {}, "resources": [ @@ -3332,13 +3333,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId13'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 13", - "parentId": "[variables('huntingQueryId13')]", - "contentId": "[variables('_huntingQuerycontentId13')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject13')._huntingQuerycontentId13)]", + "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion13')]", + "version": "[variables('huntingQueryObject13').huntingQueryVersion13]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3363,18 +3364,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId13')]", + "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps Pull Request Policy Bypassing", - "contentProductId": "[variables('_huntingQuerycontentProductId13')]", - "id": "[variables('_huntingQuerycontentProductId13')]", - "version": "[variables('huntingQueryVersion13')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject13')._huntingQuerycontentId13,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName14')]", + "name": "[variables('huntingQueryObject14').huntingQueryTemplateSpecName14]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3383,7 +3384,7 @@ "description": "Guest users access enabled_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion14')]", + "contentVersion": "[variables('huntingQueryObject14').huntingQueryVersion14]", "parameters": {}, "variables": {}, "resources": [ @@ -3417,13 +3418,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId14'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 14", - "parentId": "[variables('huntingQueryId14')]", - "contentId": "[variables('_huntingQuerycontentId14')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject14')._huntingQuerycontentId14)]", + "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion14')]", + "version": "[variables('huntingQueryObject14').huntingQueryVersion14]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3448,18 +3449,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId14')]", + "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps- Guest users access enabled", - "contentProductId": "[variables('_huntingQuerycontentProductId14')]", - "id": "[variables('_huntingQuerycontentProductId14')]", - "version": "[variables('huntingQueryVersion14')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject14')._huntingQuerycontentId14,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName15')]", + "name": "[variables('huntingQueryObject15').huntingQueryTemplateSpecName15]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3468,7 +3469,7 @@ "description": "Project visibility changed to public_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion15')]", + "contentVersion": "[variables('huntingQueryObject15').huntingQueryVersion15]", "parameters": {}, "variables": {}, "resources": [ @@ -3502,13 +3503,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId15'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 15", - "parentId": "[variables('huntingQueryId15')]", - "contentId": "[variables('_huntingQuerycontentId15')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject15')._huntingQuerycontentId15)]", + "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion15')]", + "version": "[variables('huntingQueryObject15').huntingQueryVersion15]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3533,18 +3534,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId15')]", + "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps- Project visibility changed to public", - "contentProductId": "[variables('_huntingQuerycontentProductId15')]", - "id": "[variables('_huntingQuerycontentProductId15')]", - "version": "[variables('huntingQueryVersion15')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject15')._huntingQuerycontentId15,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName16')]", + "name": "[variables('huntingQueryObject16').huntingQueryTemplateSpecName16]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3553,7 +3554,7 @@ "description": "Public project created_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion16')]", + "contentVersion": "[variables('huntingQueryObject16').huntingQueryVersion16]", "parameters": {}, "variables": {}, "resources": [ @@ -3587,13 +3588,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId16'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 16", - "parentId": "[variables('huntingQueryId16')]", - "contentId": "[variables('_huntingQuerycontentId16')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject16')._huntingQuerycontentId16)]", + "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion16')]", + "version": "[variables('huntingQueryObject16').huntingQueryVersion16]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3618,18 +3619,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId16')]", + "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps- Public project created", - "contentProductId": "[variables('_huntingQuerycontentProductId16')]", - "id": "[variables('_huntingQuerycontentProductId16')]", - "version": "[variables('huntingQueryVersion16')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject16')._huntingQuerycontentId16,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName17')]", + "name": "[variables('huntingQueryObject17').huntingQueryTemplateSpecName17]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" @@ -3638,7 +3639,7 @@ "description": "Public Projects enabled_HuntingQueries Hunting Query with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion17')]", + "contentVersion": "[variables('huntingQueryObject17').huntingQueryVersion17]", "parameters": {}, "variables": {}, "resources": [ @@ -3672,13 +3673,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId17'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17),'/'))))]", "properties": { "description": "AzureDevOpsAuditing Hunting Query 17", - "parentId": "[variables('huntingQueryId17')]", - "contentId": "[variables('_huntingQuerycontentId17')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject17')._huntingQuerycontentId17)]", + "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]", "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion17')]", + "version": "[variables('huntingQueryObject17').huntingQueryVersion17]", "source": { "kind": "Solution", "name": "AzureDevOpsAuditing", @@ -3703,12 +3704,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId17')]", + "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]", "contentKind": "HuntingQuery", "displayName": "Azure DevOps- Public project enabled by admin", - "contentProductId": "[variables('_huntingQuerycontentProductId17')]", - "id": "[variables('_huntingQuerycontentProductId17')]", - "version": "[variables('huntingQueryVersion17')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject17')._huntingQuerycontentId17,'-', '1.0.0')))]", + "version": "1.0.0" } }, { @@ -3748,178 +3749,178 @@ "criteria": [ { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId4')]", - "version": "[variables('analyticRuleVersion4')]" + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId5')]", - "version": "[variables('analyticRuleVersion5')]" + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId6')]", - "version": "[variables('analyticRuleVersion6')]" + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId7')]", - "version": "[variables('analyticRuleVersion7')]" + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId8')]", - "version": "[variables('analyticRuleVersion8')]" + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId9')]", - "version": "[variables('analyticRuleVersion9')]" + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId10')]", - "version": "[variables('analyticRuleVersion10')]" + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId11')]", - "version": "[variables('analyticRuleVersion11')]" + "contentId": "[variables('analyticRuleObject11')._analyticRulecontentId11]", + "version": "[variables('analyticRuleObject11').analyticRuleVersion11]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId12')]", - "version": "[variables('analyticRuleVersion12')]" + "contentId": "[variables('analyticRuleObject12')._analyticRulecontentId12]", + "version": "[variables('analyticRuleObject12').analyticRuleVersion12]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId13')]", - "version": "[variables('analyticRuleVersion13')]" + "contentId": "[variables('analyticRuleObject13')._analyticRulecontentId13]", + "version": "[variables('analyticRuleObject13').analyticRuleVersion13]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId14')]", - "version": "[variables('analyticRuleVersion14')]" + "contentId": "[variables('analyticRuleObject14')._analyticRulecontentId14]", + "version": "[variables('analyticRuleObject14').analyticRuleVersion14]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId15')]", - "version": "[variables('analyticRuleVersion15')]" + "contentId": "[variables('analyticRuleObject15')._analyticRulecontentId15]", + "version": "[variables('analyticRuleObject15').analyticRuleVersion15]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId16')]", - "version": "[variables('analyticRuleVersion16')]" + "contentId": "[variables('analyticRuleObject16')._analyticRulecontentId16]", + "version": "[variables('analyticRuleObject16').analyticRuleVersion16]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId17')]", - "version": "[variables('analyticRuleVersion17')]" + "contentId": "[variables('analyticRuleObject17')._analyticRulecontentId17]", + "version": "[variables('analyticRuleObject17').analyticRuleVersion17]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId18')]", - "version": "[variables('analyticRuleVersion18')]" + "contentId": "[variables('analyticRuleObject18')._analyticRulecontentId18]", + "version": "[variables('analyticRuleObject18').analyticRuleVersion18]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId2')]", - "version": "[variables('huntingQueryVersion2')]" + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId4')]", - "version": "[variables('huntingQueryVersion4')]" + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId5')]", - "version": "[variables('huntingQueryVersion5')]" + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", + "version": "[variables('huntingQueryObject5').huntingQueryVersion5]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId6')]", - "version": "[variables('huntingQueryVersion6')]" + "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", + "version": "[variables('huntingQueryObject6').huntingQueryVersion6]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId7')]", - "version": "[variables('huntingQueryVersion7')]" + "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", + "version": "[variables('huntingQueryObject7').huntingQueryVersion7]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId8')]", - "version": "[variables('huntingQueryVersion8')]" + "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", + "version": "[variables('huntingQueryObject8').huntingQueryVersion8]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId9')]", - "version": "[variables('huntingQueryVersion9')]" + "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", + "version": "[variables('huntingQueryObject9').huntingQueryVersion9]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId10')]", - "version": "[variables('huntingQueryVersion10')]" + "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", + "version": "[variables('huntingQueryObject10').huntingQueryVersion10]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId11')]", - "version": "[variables('huntingQueryVersion11')]" + "contentId": "[variables('huntingQueryObject11')._huntingQuerycontentId11]", + "version": "[variables('huntingQueryObject11').huntingQueryVersion11]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId12')]", - "version": "[variables('huntingQueryVersion12')]" + "contentId": "[variables('huntingQueryObject12')._huntingQuerycontentId12]", + "version": "[variables('huntingQueryObject12').huntingQueryVersion12]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId13')]", - "version": "[variables('huntingQueryVersion13')]" + "contentId": "[variables('huntingQueryObject13')._huntingQuerycontentId13]", + "version": "[variables('huntingQueryObject13').huntingQueryVersion13]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId14')]", - "version": "[variables('huntingQueryVersion14')]" + "contentId": "[variables('huntingQueryObject14')._huntingQuerycontentId14]", + "version": "[variables('huntingQueryObject14').huntingQueryVersion14]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId15')]", - "version": "[variables('huntingQueryVersion15')]" + "contentId": "[variables('huntingQueryObject15')._huntingQuerycontentId15]", + "version": "[variables('huntingQueryObject15').huntingQueryVersion15]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId16')]", - "version": "[variables('huntingQueryVersion16')]" + "contentId": "[variables('huntingQueryObject16')._huntingQuerycontentId16]", + "version": "[variables('huntingQueryObject16').huntingQueryVersion16]" }, { "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId17')]", - "version": "[variables('huntingQueryVersion17')]" + "contentId": "[variables('huntingQueryObject17')._huntingQuerycontentId17]", + "version": "[variables('huntingQueryObject17').huntingQueryVersion17]" } ] }, From 7335cbc0a0820c29203e7d209ddf90cc86931459 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Tue, 28 Nov 2023 14:37:38 +0530 Subject: [PATCH 2/3] Update NewAgentAddedToPoolbyNewUserorofNewOS.yaml --- .../Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml index 5566e1befef..1116052fa92 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml @@ -1,4 +1,4 @@ -id: 4ce177b3-56b1-4f0e-b83e-27eed4cb0b1 +id: 4ce177b3-56b1-4f0e-b83e-27eed4cb0b16 name: New Agent Added to Pool by New User or Added to a New OS Type description: | 'As seen in attacks such as SolarWinds attackers can look to subvert a build process by controlling build servers. Azure DevOps uses agent pools to execute pipeline tasks. From cc4934f45adaa02ddb69287098068d4d447f6394 Mon Sep 17 00:00:00 2001 From: PrasadBoke Date: Tue, 28 Nov 2023 14:42:52 +0530 Subject: [PATCH 3/3] version incremented --- .../Analytic Rules/ADOPATUsedWithBrowser.yaml | 2 +- .../ADOPipelineModifiedbyNewUser.yaml | 2 +- .../ADOVariableModifiedByNewUser.yaml | 2 +- ...NewAgentAddedToPoolbyNewUserorofNewOS.yaml | 2 +- .../AzureDevOpsAuditing/Package/3.0.1.zip | Bin 29795 -> 29795 bytes .../Package/mainTemplate.json | 22 +++++++++--------- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml index 659fd15c2c7..183ea14a2a8 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPATUsedWithBrowser.yaml @@ -30,5 +30,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IpAddress -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml index b6d99c2d3b7..4ca036e417d 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOPipelineModifiedbyNewUser.yaml @@ -60,5 +60,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IpAddress -version: 1.0.4 +version: 1.0.5 kind: Scheduled diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml index aa9cbb8f209..bbff6ffe14d 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/ADOVariableModifiedByNewUser.yaml @@ -49,5 +49,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IpAddress -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml b/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml index 1116052fa92..c0ffc901034 100644 --- a/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml +++ b/Solutions/AzureDevOpsAuditing/Analytic Rules/NewAgentAddedToPoolbyNewUserorofNewOS.yaml @@ -68,5 +68,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IpAddress -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/AzureDevOpsAuditing/Package/3.0.1.zip b/Solutions/AzureDevOpsAuditing/Package/3.0.1.zip index b003ebcdbbfbfdf9569ab06b23d5bc7c6df91f86..32d5fa2798f4a9336b4875bcdcad7a2348e02e07 100644 GIT binary patch delta 22258 zcmXt9V|Z9w(@m2!w%wqy?WD17TWxHg*tTukjnUY)+1UJY?|Z-hGwV6eSu<Oz#TDxGwi?mEMGk4< z#t=MU{Y^-Hv=|{k2atjC5JI}Yt*=45lQDfkV6Txda@Dq7^bz4UNf9P+8lOVc`S}U( z@E?H9e*nM#1%Na*0HAt1-!;|4xDp-_@*xl`UBx*9+6)JTYHiv(B}%_7-8+l+0z3gu z&x^q|UF1-wZj7M4@9#tv`?FvRy*)@k0N5K1jmTe$?@@i8(!7iPQKQ%h(ufO}0qwr< za){I$2-{m%NDIe$-+Ftp2rCW;pr9aMf@_lG5dZXUBLxU~K}k&$?hzOu_hnfqob@9Q zAva<-RdO(ppsZdlEx~MG{^z{?pL6j4oPBC6;0)9y#gPDRe?rwd1XwIckJ|lZJZ@hw zIk-tU29qS2j3s#D&80BI!W}z?1;!uW1{+0$#MgME?$)q;cb(+!!Hj8(xqdi1`toQO z{3>_sTUH-#hV+eMmTVmM@-V)CZ4wP$`*pFoKKW z_mj*_QbGiV|M(Yj)mP427#mYcnIom?>KiQHqX7vH@QUt1#z|agne5 z51{Hl0QY|YKK;LP*H9T^XuRLI#Dl zj%(6%?1bHGU*|OlA{{qy}xmY43U5+8M@{pd&TR(e) zj}p=|8DJZCJAC({E!%gPz{A0gb(@?qgjC`AAA-sMBkWpm-o-@lsQ+PpL;jIe*Cgd8 zzJnD$&+V-3>W)P1SPQFW)fc^vwbumd2HE(Z^T7W*AAC9^5dw%wH)Bm%#kI@vb)9{w z24CR_FmnU(Nv`dLT_ajC-IKlz2)J%)U2~Tl9b++o{&}G~K5k`%`14IbMsBpUXMDqw zvXiUzIh&N;`la*kXk+trAz!P{brD^=M?FN5pRg&X)haub)U%rrnqmpREeao3RM_G{ zrnM@M8_FF9WE}AR4MvEM$Nt^@s`FP;<1v+{l!>++-}2V2*L zqNB>&wXnoQnCI3L>u$>Ls#q4Bc{HHkWM;~Qu7LUHuTN`N-~X&_C_1vdUFSWjbi z*t==IVZ`$}^bh?cI0$GlIP1qKjx}}7Hf~-?_F&bXf~)37)79he_(?J(UDL~G3xE&$ zS_y=JorItraL3BfuCg1AU-AtTl#zFE(U}LaW5L+ueAA^o5hVzfR-eK$MKT!5C*bk< z3$<#B1wv+c!lljJAy-#-0bLyho3;%f+>3h>tQLkd=O`#CbOwp+Yevs*hxHQ6Fb@NY zAO}f3_xW2o#25be58JP@Q~)_owF?b+NcCY&8Zx3WBFi?S?+ln^YFKUH%(KuPAsz&0 z(JUmdEEgPiyc;Z@Q}9=p3sz$rG9x&QcC_hs(ygw~L1W#%a(H9@Qy`-)!#eBh1G61o zv%!Y&-yDT_TD+LW&NdThBH>R$3cijGV3A?d;Dep?U9Z)`b2o(=xdLr+t;KHi1vdT_ z+y2%ekj=ISA-oxJCbcFla5Ui-G))4z;i2>!+V*FE*bSpKgRH5%)7UZG1uJ&{wYED5 z@ydv6JnO#n^zUn1^LP3VO%&a#8p3-5GU26uYAeUy|FSZC{FsBg(^HwjX-Hpej34e{ zfakHqE)=;tlNylp`7*}}ZIogCgG^Wp939$G3uW~x{d&>^5B=p2h+iqEm z_3%vI>DOa_0gVWOh(&G7t&|euk$J1N8O{CQhdX|LcxD_toc|@#Lc--y;MZt$Ker@o zBbapgokwRp&J~J{#VXmM;0>haHNN!{3P=3u3i1Tt*#8vT><+zfOIKsgrJ2BU+wgDx z^<@t40NkrvxuBXh1yA5`^7TF2jcbCg1Od(e%9<64gUD&MJ z>vl^3ozm@%_5+>={oJ#wZ0!#7>O7hNZXHAVo7|LFVK+otfNnf>sTuAMO-~ZX)@wLX zc)0So^KHw<(O=~KnVpa4w~~$thsT&-gQ4m%dA>Rj_&;MQ$cKAFz;(4yK&=9Rn{^ZK>AW|OW>o+{mB#*hWarO(TRm^oMJXQh;b zzLWt&>OMJ(7K?&BNEn%Ko>~Bh%*Zckr~Q2x>4TPXARmcVzc=L9D?1i+3W!4-8Ov}o zFqNV@3=bEXK_n3brTHB;iwrv(3cjFBU-1T1!48Ey&wj=iY0HC%j9}!^W4`#r-+0_D zLxNJyR+-mtdNy1-D>!7%HzcIM;$3$*WR|1Ql#%?VCBIr3RgE=cpLEPI!Prh ziJJG8@#96X+NcVylpM42T{V1cePOy0_9@6H1I%KR^+(~wcK%E#{?u}cKX__{iGcBi z;fk*{p<4H4OJU6+{4LT&hw2Xh!CxjeB^I%kMA0U4r;r)bLC@qHKVj=e*W>O=+8Bb7-^BPu*c%;IU>e&zwkMJh;)vOp>x`eC z$*xxN;FWjm`juDveqcT;pPRl8_^6a4*3?fhVgpR_CLy%b5KU#5n*S9bdy$;ppkodj#sz7S*P0G=A5wQ@{p zbl5-iO3Jq-l*u%oelzXY%iN{w!YH6;^0BA44|$C@4T!Fvvbm|0onQQ6XI}`^yP+1e z@d%iYtg7iAXT_{jh{Lb!F`W652y+4)8e*7~N;W!OrafhpBq)Zdmx$)2>j}r_7xxsU!qR_qT592D(SI7 zo~g=W)U)&m?+7=ym3D4C7HQpg^(J`aT^0?@^h77WOO+3X0W`dKAX_1oVe^r`Nvd;O zByKct8h7?MnVPerVOxPPpwll=uWQP_7HK>9s8b!|FV)F->(hM9>*)3#Vr@&?P9V+? zC&ia!rbCQFhL+#>b21ZVQ=>F;f$sT>F=5J5ZecIS@Dhp!lGS|3)8JWYpeTBK8iNBd z3F*|UrlhZRyjHC)KrY1@s+{^tJzDie*A}BCo0|l0Oo`L$z}( zkLALYmgXna#Js8xtmS;>CckOTAE(bx++Hdw0{h-(w?Q}a>BV@%TMz1eG6n8rV+V!sspDHGXSI!?wQderT^k2W9e~4{^-Qq10Ln|D&k{f3! z8D;ZSS*3tHz;(~+==f1#t>8APr@v%AT~nC;UQwHz%nO}Mk6iUmBi)4=>Gn5a$x!)X zGt+hPeH&WF=!D<8c0R34HeqF9?PZaP4QJgBoh|um1KC3a!5K%jNP3d7%A3sMGxxCr zKvC@s{QbUdy`(=ViScsk5wq~elF0l5gO~0_lRY{e*eKdLNOJZk{M%GY{+ha%$9=zY zde@8?uZokYhiH*QC%u}u}Ij;A;a82T)anwA0sT@}`8P}bEfGMq!wa})GKGB=Wq=B21Qo}VC;DIfC zN~|aVMDP;r(@MJ3$?b)|#QKHTM78ex)ib76Xf0qC2+98K{xp7ajaD>Wc1ygZQR@XF z!~CZ@GjFtwQN}>_U4Wg813xxG;8nFO20)gT(fZ!x&={I$h;Dc3OM)eE)qw2PI3f%$ zVVhC1rJf{PKw3X2AZ&OEkDu6jNjyq=tQS)NRJ@en$ij&U&jpH0hPk=%h*bY77QXyh zu8u!2NGHjpd@*LDVv<|?Gfz@Wiq0K%&{#O}-cY4Q$)q-%rc|Y`#c%VRKg`bFU}HW0Yv%k?-DB;MRMlzb>~V9Ly6$b--28{P zel^;pncan~h6*rrUOf?7f^u#j@)xUL-Myzd@~>G<^BC0p%iO*m>tWiQz5KWRFNDB~ z)y?NUdA*^I#M#4q@(D!NBOS6b3|`C;;P_k1>iXeRBjhd8`xvj*c(0%Y45Ozrr)fQ|58a6;S38r8HhiW2d7ABswl3ki%oIyR`T5< zZQ43^L7F>+m}{es^6JG(Pm4IymFP(1I&~T&ZHiqcn#@NiL)|09876@@1CIsY!{f_M zh_L^%P*Oip{t+y&yb>5-^83XMweG5k83+2a&(B!%Xr3`>4m}(GkNcN`ltil|=6>rh zS*h#PXaHG%_`EGZb)k6?72%!vU`%~GCUTJx?oC2~WkT8s%#cRi zg_!rv&p${D+r0CjPEQKoVzinOKi3N19t446%*sg%uX;h@3J5>AUYZlTuc?B0ArWgj zl&h6{k>zpQf0{ERdo`~Uinm+wK_OSBt2zq_Bc8>5`ypgg-=$IuYzHC0^Qs;qT$|

g24iWskrpE7&dc4*$oi1CzgJQm=cB)VAfs)<#dZ&Vuc%zuu)70thLZ3!9O_A_6ZJKPQg==* zm@Br7cQ7cVFT$0KLc71d{QGWsr{*B`xH$C90|vehp6BqfQ&rUXQ>d68dE)Z}t~kGn z*IP$SN60gaDC(s z<5$;BQv=pZqi_g^-J!cCC`+P8y8+rXq|-|y(#*bSeD91&wVwq)vjVq~&J%$8r=`%1Hh|l0sek3dQ&rAsHhFzIe^`k=kFlU-tly*Jr-Q zv!Eitpg*7zAIx8!mHQS*1kqI6IGQy-+5$z|H$y zUFqEVT(^t(Z!L~xqoz`zBn;ZRTv;354+GF0Il;#fLLW=G~8re*BWe8ubM2qb@lzZ7Yu8iRVxk0O2>T10w+#DY?J?S%t+I2dmTG; zVFYpivNfv3_2-(BKPx2|+xLJ6iSIJ*93KuWFt|JMD}F`rU_?B!A5Vse&moo(@MdoX ztHOEs)hlKkB^na!(fI8=f4+#Rj<3muV*VSGI7zfwi%o8a$Di!HhW$eu{|LIB)L}Wn zM!C$3?K!wuwj)VK$z`1J*j|rIva^Wb3UccU>7Z)hX8%l?Ltu+p0r&L@`yepJTW1R8 zzz|e#K!CbD4Xc*rz^-WjD$!66z{2*Ddfaog=dwzgwWb#51}&Gv#Mq(&y*+(lmtZNf zRZPy+#+e-EzL>8a~BV!5Jg`t2h*% zq-bSeD4@^AGB4DW@@mDGKTpcYXkY6m3tE_=AGhgzsP*SGkw8Evvxa_u@ zYg(;Xk``x7CUF6*XGyRGml9+S4sOXujLCr^E#+x<|JnmuD~Le?lZ3o zsR}Iq$?L+;ypAslCM`J5C6VzD5}%dhLl!Eb-cWcM^XE?uB4;Ad#kS8TR&!V9$WA|r zpDON6q$(F;>kT;N2? zLKNuARv^cF9_uIU6Ir96573SX>4oprXCU|?a`DEuYM6bs0$2{Zpe>q_G*5zrA~kNa(=IYkN2gE>CM&lyFQ7;uMzg!x!SH2lFgQXJYr++ zx4l)|I{hmn0fZ*!8YclRNUcd&t@L&Tbvt?hyNRzsc46M&*QeI@E!^FcSQ6DZ4ZP(b zo$CK0&GfItx6J&HlkSCov{wJL^koU#=Ok~Xm>7<<3}oKPgpI*N(xMze`CB5$ycj|W z0uE?d?pbWMXGk0@fzW{)*nH7;XoQ$r&{{E+@;CH}t)l1ex1}KS8ZB`t+(2X)$-vqT zL_usY9C6i_Pgtc8+h>8z!m2!mK`%+f3)vYDBtyqA@p7NL zk;Nvy$Jg|d(wI^G83V(GT41CMOemjxkR7=GVd-ao*R!uF9cX8p@_`{<8*xEuYZNh` zz=wetyiETDrbYjPZpJSXpN9CjDc?BSm|A7vim4slFwL(EwBvvp!NPhH1l0Ek3)%@o)g}Y^uE!=Dv$vSa;|;%ID+`gw+;*2s6`h9N)X z3KepI$9?oAT0x83}Ig+p8ZL*D!P5qKSV2i5)BNeCX?=s zNr_E>N5(LBWqb1+!~4ZBz^mUt1i10p=nk^*#a`_v5XX~S?4y?|lS6BX|3aJ}Y(yD?%118V269ouhLs+juSE~%U2J>@?HgZ# zRRS5Q^GKnX3A@nT*y8gSuo?tgMS^F+nFU1B<>ND8$M4*K2r1ycEyI!nNtJz1pbD+= z-XGd*Ta49EU3Xh&gGu1e0cuImKca#if`e!)ez=D|!aGXd{t!+;8u~>X2t*0{mO&0a zQ^!7@ez^VK7X4$6&ELq z^!OziE|{opRLgE6Xerc)x1S2nshxI6W&QEI>4*A|mI)zcychHKm$MZvH4F!lzF?RNghkc@YZ^0&o+O~|J>?aFSDZXK zVbpVBR(RiTC_$x#j|mHO?S&%oj9^v-O?u#HO^mL~c74X@0M-OXcX1n;+^DJ|iGz&p zP90bBZMlSgewGWbf@FW!sWv!lx%9k%81-#HQ8i4Q(6v~2{&|nr*o)emRT9+zcK#rw zLAnttZ}P=CY|uC)Y=$!^q*#kh$T6zC3G1x%ml3sTaj>&4m%I3Pm)oha^{1s{BCmU! zqE?#xLC-x7AkU4H*x?uA>I$iYFn#5xdPV*DR4+V*-!lAKP-4o+j>v}iVg&^bc(J=7 z*H4m>%H#D&Q6(o0GjL+c_^9c=1XPNo=mzG>fdpmL^}eObl3GsgCG|?Zh)&LU0%$BE zNN-e8Q(4gy`QB5RuPi++%nT)2>@o?=g0V{Vym7ApS}5_%24DLjj!!?ILRpBm+NJ5& z1ETGijS1Sx%=#NSOYy!So!OSFCssK9@|L6Mr#pBZa2U5FiSYH?-&*HF%;yiozaae$ z3zvs4goC>L1Q>$i$eGYm6k%x~;*G_&D6!WeH%5!A<%BYg?)XAau3CKy7W`KB&_WH8Go<;)$+%;tWgMqNV;M{#Xu0x8ANNLj^Dj!EvL|@ewD7`M<$%Zl%b16@yVe|Plf3e&x^kxXNpz;!&Ikf#Pt~Z#kuf#Qp03caBkyk(B=+niys?GtXl-HEAFAqT z@4QMHuoEIyCDClfjMyeF)+u$3zh<=<=7M5<-a=jDfJ5>8gv&>Zy})(u)T|j|kDf;0 zZO`KpJAr=QO#ZysrRKNdBl*+czfTV%i_Yt+W}ioXShWrC8y>~ea?ZmGx0r*mukgZ7 z7kM`99E*jY_gbjKobN(~L?Qz>l0+h+Kk7T<2WOnIh-3tR~lR9h9O9%lC7DR8-LK>WV)3C!zyi(5~ga9dLm_IoRxU3nq_g4z$k-1#PU^! zSqAg{i0|mxFd7kBpZsbpGtNGU0#fU6B6=ucEY2=W;E zJDqo&hR3DG>5DEc@rg4UZ}*X391M(W3oOICR#pO)VS3HkXblAK0QwS!)8S$YGeIA1 z&WI6pB!s|GJxCcg{3{eNNcfS>;F60$VAJ(CHpcfP-vzS+N521ehV@?ifWLqM^ag7g zPNcdG57tkY*|mr~Us?|@Ss7`-izfXg#c_0vFZWt%k-&me=H_RxpBne>S;_)YZ#m?k zO$U5ASvBH1WaPJ~Y4#x4k?|8shKLM&%*gXKn}h>IFYn!sk2ks&gdC<#gQQ&5FIok- z2lR`AAKUgarz~wwx|Chx)F8co16^FVFZ#`Qgh*#;NWgn=$QZLoOi;O}DUR;~SNdB-3MoxG;Z444p8+R;H)+q+dbhHU(-4gzIdjJdcs< zKekz!<2Qs(Sn@tCyjXXjvn3Rpr#F?2F*F3Z@tRBw(R@V21gen(*)jv|m{R%fS3i#n z6;!qB@I5Z!7t9Qhu7)}hr4*lE9v`Dgv}3Njj`Alr?RBD4U1b1M8+6`8;Sr^Ql$Q)@ zL~Cm{Iw4BcRL6AUX^W@p<}4=hs6`Q6tKNuBWky4<+ve(x+DGgUXw31UmbT~k-;d+O zs2prXV;?G)*s9ThOaYso`**=5NN13&=zbb$ zo!qzvuO6CaBs8Y_eD;?2YnDx+)WmsBmTc`t^^IJXO){at)ACtb4v7|Ax(@myx*vXe zWr2fblTrQ6zfwP|1C_4h_R}J0+!{nBD{z`_hG{no-h`TQrLmBWX;IRRdeZzNiE*Vp zY8oNUuwnA|p5F!kCM07-y_u|GdK3B3;&~#`lSJH7`#^l>GRXIPiP)vN7{8Gs+y=n_ z&y=AFIe?EuMoKOFE79lmy>|dvx1X{QPc;7vV}DB3_=X3nTV`rc5Q(41-vPb~U;WyZ z&H#&p!EZ#}Up8CNup`@QYjN_fd}1tEBAQ9QIz=?|cK(iR&OM`@;u*xY7|qAMXpTF= zl{UM~rlk+ZJp72fRE%pKFnOoEs@gT0cF+>S3IdY1la~%zNPCRY+L_9q^F2u)r1Py2|#yw8Tq z^#a3k`uCfELgo}3Mfo7HHSqT=r*&O;Jh~}ymYU5L(!A+yQwa@~?EvKiIqqaIolU7%oo@q>za>gh%%i`(>4zb@R$Y% z^QM~2uhw}#|7xW+llu+Ib!*juj7|n7(Dc5dQ+??xUqR(0&eb5^uH;EE8XdWLAIqZicmdKwhA+xpP@kabt@uv_+Li`aj`dceQ6|(92I(fY zB(5mprm7ZpBp#~XkF+H64po9j+EIhry9;TZZj^2YpWO2Wy_d4P9q@!(1lw2q)xnO- z{ytf!#(n-pa_!`4N0FR4N7HnH&Uvvm_rua_s;E{pU7k z4i_;LC(opcoJR8eN0~HE^O6ZxtdcgB=@wBpZlqBV@2gKge5TrAi!*;%=Rn29W^bIc z4|Y}T2=pIn`f`vWxZWytnS+!D08!xgo=o|;&T>6uNttvBYp@cca7g#rJEJ6(LedBbpku; zrFwn0%&BzVoj3Asb32u5L16}E9Qnmv_>w?MFC#OKxf)O6m_jH&v`xoxgAg}q7w#hL z6sCLxFD%JY#L%*`0DXJRDIFWR$&*wl?k3biyu*yvxuCOVDb}-c75M=|%E@|Im4%bt zV1c&rCvByMW*XK!P@;m{l+v#2(3ppjsmXaEII9Eg{(WfE0&p%uaAwO> zjvfaZ99o{-HdqsD$M^)n+o%+SGLQjTjv^Bhn zFy4e1uBBO*ExyqvbN?5E1{>*tS>4ZGL`z0#RTU_4C}-)UxCus$sNs?S-OCMADn^u~ zn56+#bQVjDg);HT2tB5T(tgePq?JF$RQr`YzntU;HSswXsLcHudzXHZl)NMxWOPTl z+X_(i;w)W|#$NBgEI_{#A`On(Dz zFp>PSDqVEp=-=dTDZV@r=un*i5BfAu={udm3P)-hM~tU3`odq=BLVFy3nu!-Dz=X@ zvyrkwllU6~xLjwB&bxSLmbUfI&DEf*ZJ>Bq8mhid!BvU`2TYUlzSH)j?}m?r4XKvA z$1~+yOdk_x1LY+rS$vj}*T=>MCNiK6M(-PoQy&YQ0%pm-$Y)5}BJtNm%Z|FhLAsWU za*|Oeob3#V$w(US_S4?KglTo`vpT~Srv2f%61pBJie2gju7-XJYS@lh-KF47tvoCJ zoQqF^AAI}nvw``S>ynJauQjs!k4U)xLd38DQaIL{P3RDY+qXWx!TP|f=s7@^D>>$< zBJnoD>UU~L+!NTdPVZ9TnWq1h@I^pksg;3vq6C{m>i9hyQM#xjCJnOmaJYVU!Nl$^X?t}^+Uz~NvUwb!h3%0tf z9oSMlgoT{VXn|Uy+>LPXDky;BRpZ>_pZO>^&BP&lmIb4{+KCvsyJwz$C6)IQ6t#J` zq$ZpDt|YQ_0aX-zYfrYS-5&iAb98#N}#{I+uOw0#Ky-DGbY{eN4_LQ?*J0 zsAqGKAHF_tIC|OnHxws&a$7{ic+(VZzS-aCvp8u@aPskNgVloe$R(ukG31_2!D5z* z1*J0kX+*t=V}#{tb{q#UWllWuyMzjN6G*~BE#uG>cse_W!VeV7%+M6z=1!rXsY&xo zHiz)P0-;&b0AWrgurhcwwyzM;Mg%vKqNKJrofklLw`23wQUz&H9Sn;~{*ka7r0lzl zYe?*DatUm4ArkKaX{mM+4HHRyo5Cc0h(cJ8u+i~8sZ_Y}TWvr0#YXVSj*dIt?4+X3 z3t_Jf5qn(xRxI4DfxqaxYmdqgRj{v=G$^IpR~V?EfQSmSA96iBNy8RMD@cJYl1zXZ z;~CnyR|K9^C{IKKP9S^FU)O*>Arp*R*;~wm3qhg2F|xTsB2_Phg@=}UoF*&&Hu$#0 z7QPe*>}c7PD)$MATih+hHB!|*X-kZ!XAj`TMWX6| zL!in9f$;?FJ((X|4!bcz5L#P%xA~5%vl?7kQbtFXkn!N8>2LPS4b5RF0&wHUB!0hRyghg`{qEm4> zB?hRk|CVhgqr0EDO3Lx}@a1e3&*A{}g@^;UxLaDqmuI^|*?v2S0v^~#c7q7zY{anA zYNj46s#-GXsc9poymdJlbB3WeQD_oea)wxx*YW`zLEYavuYxw5K>WWX13{8ahx)SoI3YpGrT;v%sEggG2m3cP*S3351l3A!4)}VnVGlvLslErqA#|_1eg-8uccr@$Z*yY6!f!FYZ zzwyC(y+ijYySnZ3ZVw8SQ0@n49kUxU#wop7BzumrRg`vT`TzUJbQ;|&=Cg=urNNeD@+$+N9U*TV^P6=Lh zpFXUffi;BcUndxg56wDd#K^<6Bl09wqHhMt1083Gyq*Ckj>z9#DshAjVuVB741c@w z(g`WFCD3pUU8n$L&XaPQaAf>Dt#&A5N0N<@l`|(bElzpn#82Xw5KUch2ACJK7Y}^S z5}ufFt2GEzmsGD|Y^||_mjUQXKQX5%7Ir*(XF4`9E43L@BgBZhi`1d<%fef<%Xf&A z{EkeJUZE{(Y!j|}-Zw5b+~ns7qi=AYTyT~J27~}Rj6;cy6DHdda}=WX!UN0g z6P7JZM0_(CgPsOUUbZsZEQClsTLy~nP#=jK$t$Qf-3KHVWOk;9uY=m=YaD(A*Va=* z$#T?7MlllD{*-+x!WQ#ZF=19R74enR@}d}0cLBkhZ``-6ddJk$3XRBhp^|1+8LS;M z8zQup&9wj}T2u^~rFV!_fp;C#>_Vz;+f0b&lj*$$>+q;L z6#Tw=$xy!_?Zl?t;gQJaRL>|c0*DIL%sg+9nU1bDg6#t5?+C|VHs`Z9-d!`!hXy5j zt+lMX`tvMOCBU}wDb$t~p-8m@F_9_?T%QG8B=A|mv2oQg{(l9B`&q#`#75o;bZMjv z5bH1@Ov#s`)T?X#Bw;Q~XuclX31>3B3N*s-7fl(E%kIj`@Ghv{{rVJ@4Z-+@VlqRA zg;qYQ4)Y&@9;WN0$lCg+mUE~H*Y{0ou17dl?v{r28U{Dj4I@B+yA@2J3j=t%{pkJj z!dhVMK&jKT;F$gl74F=+-`{)Prvz&zMvyWEwPb@xxG)S+ZREL|v`N@T+p=;(-M`|d z)Ww|jQAE!;H4Q=1>S&XfVbzbyyMC1*28ER>49$rl!hO=}k5y1PF9`B0TnZr};}OkG ziN);CixDQy)mkKI9lrlPO$cmQ#>=6G^)8^!pM;twpbI4_oGp+OQv7kWRA_WJ+OZAY zy+yHvnIKhUN-_RXOBlM$aR#~h`W}FT^p?kCKD5f+$DBwspb%;PdaGgMmWGa^ zb9wrWNMU8|qC(%A9|*>eo>=PZzd{DLtL#5T(K5WhF~~0q3?oQ-U(46E?hG}a*X0_Y zvIaZl7=Mb8&@gK=m?fjU{XA_d(pir2=j1jHKjFVEnSmd}iN#6FxqBNQ{W-57?T0nnLFsNk0!#b zSo{`A2-VeHrf(qEDUb0AT|AUDt!r@m;vO{Ob>q*57aJEkj~h@nGo?*a7iT|kWi__6 zROM%=Iu+YJ8~3xE)QdnRlaJrcE-(r|mfONI?C*9}fl#gfgl&DjSpS}NQM~WULt^@; zU)V_UTs>Rw6#c}^hLCDK0*KS$m7t?d5i?LJV%a>M~Sr(Y(Y*g8VHZ)Ig=(VbeG zz7m(9(e3U|^8W%cC9>w&oIa298mjv1v@<`HQBYVuoA0C}xr?p&1vMTwHiba=u?x++ zhWX252GCsQ%$qcT<)G6WH20NK&z5()h3h#`y*A99BGM8Bnjwh_h{{9~+H`qSr99zq zuwv4$YY@!l=BC$c2(y(89+>MjOt5+H_c1K1_HUq%?F^^|es+~b*RS^<rJ$^KFRhP2Wf}OWT%A>kq}4tcJ>XYm5eN%A)>n z|F>pqZvs-uyS-b*PPT-dVSU|p(v-!jz79V!2KpuKFbUA6*|plNU_SQ=@nj26;$7gg zLH4jrqSKzVR*x{K{NtF+6ro_$^xP3|volv6CQgMOWC&M*Jc|+d`!M|H0WG&_37-Rx z!8!t`V^_w`2Z8z7PpGMkL`z@G9=XU@J3v|CJ026C7P={TD4ucQs|6a@>DmclxqXXi zvn_OcyYZiqYX!qm--@Efp0${Hv~6J2uY#&7JU|^%gYp>9c%QJ`vr~~o<%R~lu8gak z1x!Ol)4LkuJ8R(=HJrFKjcRgOiNA?I6g?2)U~qg3Wcd|ShS*)aA67p*E@6DXSVkJS zW9=?RVqVUsOL(QuHHHkRavT9BW}Ja0EJQQOpoxIO)n@2OP=yE?yV-(~j#z*_d#Amr z1Y1xdMdgQpJJipA{eo@l+$pYmXC!Z%FrCBQ9MuipHjTA|&Y9_X zujk)coqp&p=%rCQEZJ(%LF`|`5A4sDdqzBFdK*92P^>=N5|&eu4uf*FCXSN4D^?7R=xUXpQlq1Po3ul4=cZP~S%)!?28@8v<2 z(K5NGKi`D+lx3(+A8>;i5ya%$DN?0i3`;HKw23Q7eC$A&JKW!D7cat5N`9#CJU{4L z=Omfu(m1k0-A@(bUPlX2xPur)WCqU3Pjg^Lq4G%*4uRS5wf)AxiI@b?(9WNG`bySW z7*;DJ{!~%rvZm+%i@7Q-9PKw)m4Z+ikS%Q9oE}I_*Gp zNKC3@Jnf^c-v1|!uHuulFPKRe(Wt*ZB7T`Nr{bw;r}lT2KHNgFCEdAs!~`Bb+{b9I}yX^XPW z$OQBZgQCl3&I#KcSt+<$<+EB}-kZfieC^jeCSYwQMhz(( z$-`2LFIw}|vt&vFznU@-epc3xn5tM(^0MtOnNe*-#g&`v+1hIykpvH`w4~~rW>Ao_ zSOdbeq>&u9cn*KCn@ISGnm^Z#wyZ*+yONM`9yW#)j%r;|`c8y=Mp;J7%#aO{k5jN1txKSVOw3wh)~D5)WVs0OaaMDIQfPc! z_wB);nA${)&Zol(goEV`QC=VwQ+BDD!5!*po+sxwgJc_h(1&SVxuKien2gUOYWqEr zRC@B~Go8fcXbl@sHZ(`}cRSKkido}p%hD1qy#YmpcuVadB|BUAV3X=p7hJ192TR|1 zZ_%pjs&bsW!=0cO+k7{oHIl7qF1EMjpw$==-N8(`c?#UjgdqcrK{)`EfBO*IH(>NV z3d5rBl^^&v*h3ZWKaGzahaNR3?s*zT6F};H+>Shy>JOv^sqPlzLSYV6zADN5+svr?x0%7tEi*iVs@xhnN;pZ^R*3F)w z+O%0(4urCbLS438Y<_3px-4qNsgJ+9vNRTT7lPR{O*xJadM&sX>v(F-*^omGT<<># zKO9P<>Zci91Ns-tN41BBK6fhJTPvY61?l)8$?+m};2^$q@i9X6SfcKO4p`6K6lz7C zZ_kj%$uh-!c|JtSFLtks*mvjFS&ya2sADl$226r=?sOyOG0WfAZ z4Zv5E#^i9{*N9Rrx{!wgoDnf;Oi{BNstGU2UK4k0Tu~OelP0N-n1HOGD@pP5ZYw#Y zc<|p68I8%jMj=sB9o<=*Cis5Bptgmd{Xgk0;HEApPr&8JWFC_9y2X!VZciZMRjUL{ zWE5Dq5$|sQqxBAP!Jk?m)en4%y|oE}EDB9#Y$|b!X(X2v5Z~qhJkN*s_qW~6gWJ0?iK zojJE3^(Ll$D}GF@5$?PWJRn?47c;(ic<@;e5xOqa%;A)4C+HduQ&cmL(?eg6O20!4 zk4c7Ay0kznUEj;ry_UoM(=gaKaqRgLj%H4*0N~C#4pR5SWjG|EA1<2Ja@mf=PhhILN<3IM(EFai^UG2A2XUL97+BUKyb9rDt z(n}lqj6s}Cz?MLstdE^7AX_Nb_DA-hm)qMx|4T7M0_#

    j-oMJ}CEaRy>rAIcPQ zCoIi=D$*R>(Ghh6`+j&=zsc@)R)kfayWzN#G+p~CUP&D2P5r&(7drV^k~n1!z9~lA z>JdtZOc3J(?8U#Z?6S1{%N2`=X@pIHjGXVScHmh6QG!yfl2ZYT0NPA151?vOW?;&&cIVxbfm5vSrX&cY zDv?bQBbQo>SUX>1aSM2XAu)srYC~WK%ioc^E3m`1p$3q`{5V)@B>$d^$GO<^fm}zc zOWl@YFu5m@nV8noa{ebioUMXo~(NoA!CA(N;jFiSN08y=W+ zv~0CUGH#JHJ*RnTGCG+kpfW5Q%7dBz85Q@ek{;q-ep!<)g(ba0$=8om1wHKl#l7en zRNP}yFlb;k;z@E8<5S^mL^NLoUh_CZ zj-SO45b}%tHAd2r`gT8?hLjCB*FTD%i+@NCCRqXIO2gE?_mTa8E$dwCYn>V@lpu?v z4nTet7-dLx0CU9Z*?$obj&H!5%wlemZ-*}iT15)w))iB`+%+>tPml?O5(K8>WYqKZ zFtSX&fNF5*F@|06yngz`c7Rv4?b?V~ObJl|gh;p+UnFCN$kvqPwDJFb=+(VuHarfC;k_aV)EBD;ND0sL*}_JFcpdLXA)%pq#RIv za3JE+F;2BSm^^LKER?XQZds)#T&dz*Cgao5u5bkWE2`&wg%N0jJ}E5u zk0f!C1;)qIY(oz#37pCrYQxH_as#OS?2t<%e`U-W($qLzidi!X!`dgJd1kv918bvh zzt6-9%hh05;Yoqea~xt88DmAB5$ zDUj3ic4?q{(tq>sfLLc$BchHS?Wtf@3lxbcnM~lfEzB-r)$oq4D`|$@;F|egD7-rF zSw&vYKPJJlxKu(zjBsXy+vA`Nl}0o&8IiBKtS}}D+%#8UhD@y`32}BU{t0<$&pz-b zUM96f=#RmqyA`1qZ4m?u^DrolB30z0Z5kr-xZqwqKqrRm8-{g;^(#iY*cs;ityYro zVhy7|OD_<7snNwoDf19VaoA0rXd10%&NDv)m`@*lHqkF4ch)Sq8T!2Jf0f@%`#Lts zPl+$=WV-Ex_O)o73qTj?7d|z)J~l<@I>!fM`aoMOT}slB<>r<(H19J~agkD%p>YP| z;{*MgaR~-3w1U>8!ikG>ob}LNB7LN$No?(OsH&tROC1EIbdgKsnCq&vzQM?+owzWd zni2p`r#Vm{?PC?(c=E=Nw-9|eSeQZi83X>TbY-BsLl2L_CM>eTz;crFdJRLbT#CBe z)^P^OSm%qaP|vo)$M1U>$ci|KLn7Bpp=*gAhs;0I&zLd-%`)T!Pe^zuCMAO~z%a}( zz0J2*oe+>3&$?r&v-|Q^XGhBz9VaM^rpltC>O}hTz)d{vIsK(KAi8MVL zb1{A^WEhZ{!!w+wA6*%Ju+r+xXE!!lb&UYrGd3{e)8-*=ingQqYwDdA8Ia_Pm@h%J0f z>f6_(s4K16pv%f){Y25=glk0LAka>|4cX=?j5MS8sOkNL2mR%dtnyA1?tsbWzc-9! z`HS?oXa{}5x$o-rqf17crX>66GJqz4e64!lzn*85>YavXcZ|$eS_`W3xs|fi1z2&y9fM$7?e;ZckZ;j>rzie1xbGi7 zVOCd*qMydMu%jT4neIJ#6MZ(-OlHuz5kp=k3Ce38hy>%2xs0?;4rcm=t~L(+?63E{ zy~vb~sExbXF3ir?$}Xrak?El=oDRM83?ISgLS}@>WhpA85VTFb^{N3>o=AJc7#JGZ zg9^|#H0}e{i5P1aAQ~O09#|Qko(gBJ_P(<30`#)|dqMW>3KP{q7l<57nRJ;CMaiZ^ zVKOyO(X>+Ta9M{Jn{n`L#Lsu^so73sL1oj=>UQX9WwUGZQ{Xj))?D)oEh+HF_CMW{ zb=+q%)Vt=Vk%zl2yuk1(n?9f`4CrJcu@t~l*{*5}06i6jC{#wL9W4$MS>k+E3t?&N zUl1*kZv?p;U$4Jna3LA$T#AVMzFks*4hObH(b!RKD0CWGhJDNha!Y=24lNmAPAuJ2 z2vn){T5h*m23b7vjpoH{dV5aC;ftHfiz>5)M}yayM@F#Ksf-0iKrtbH+~o6IuE0Sz zW@!vOoL+ZGR|!Uzw!Q|QehY>`N0h?E`|A=w0D%ENul}+Dl|p{dyoP|MZRX2ksX!<= z+mSb#f;af8lj|Tmi6bGtWBiyax;E17w2i()MIoL-;@3eK>5#;kz$Ww5|2uqv0f_ME?Ey&*4s1m z6g4y>5)J-(>g^ru!U!`O4Y0c}C;H258RZ?X#{;DQdZ&OSXe+&dIa`JoK5QOOzJXmR zvSELQUh8n_<_-NRm~B3PiVk9t>^d%D)TsTviRhvw2*$&|zuFljN$Y1zwP<~CQwYg{ zA<9u{P)8(f>Y~A8i~Z=pofn>_UPgfz<0JSZC8EU%?IC%8<~&=*Y}{fGrPrQ`)Dzk2i;L6O+MaHK({(9kTup>cF) z{#CUg{uw`8{-G~W3Gq>c1 zQ$pI*oKUjeMmt1mSeuRs61$7QTWd;ubClWnKPeVc*ZZ9vx;NL7VHwqmX!)rwt#hVH zZBbO?Ve-0@FM%^|M)%T~;tuga6+l`o%ryFCg-uLDdLdh?sV|D`@PEip~3s%t5ddFWLTX4-;8Mf`8`X2|V-tHNJfH z$Hb>2nniZLW}3>G4?r8uqT0j$p2V^Q=lbjYf*OS><*Liz7|yeozJ02l?QdCLrYL9e zU@xZsz&m4kIo->LzgW`JMg*m=$^ZIsFjmgvLCy|A>Dj5Qi;yEzST$PS)UB38<8`{m zPB0sf(QMw{TC=C82QOi4wvQ3NL$|RzT#zlBf}7#`BWIWGqKBxX?m;y}u(Q}`o#QTp z%C0x^3T;Rll`U)@X2J|Kvkj@nw|*$H26Fs;-}oC6(8D7cE*OGaE2i`+)m)PVo6Mvl z0`j>CbZ~Jy*%L9(;yyH-0u~|3X&1ke z^;IE{yuUv)8~?W}w-P=9Vbqt6qIp{Mn8$KDnk9<9czbIf=7V&&uyhY8`QBZn;_Di8 zymnMJpPhM^##ojC2(UBPnH5PSI_TtN&4N5BrPELT=bq6QsFQ4y0_cRp9Zt!E;f3|< z_HsH8ztb0Zuwe0iCrAfG3Qj($vA6=!8Dsh{gA;o&2|o+cne}Y%8wBeXvVO-{>`G={ z4AR9+IjAKVMLjJk-Vsc|BTtta$#H`!Q5_&`kJwBF$aTMGnW<>ii$`A=LEs^-$F10^ z5m7O(#<+1Q#pp1un1&KZvp>@eb{VR58TR08vy+NMJlE-~Uoo!}jLe(0-mCvm_A|D1 z-;$iTEEpkj)Kx>wJ!})ngWZ+!U~2sbQ+L5z%t@g1(1NcYu~Ou!{_R|#LN7&G8V{=D zY0+V+KUX(r3~}OicrbN}yMEYPdI@eWTlC>64<%$|uT6|;dIKA!6-w=39d1hha7s|2 zJa;M8dxER9dFcf)ZdYlch1?E~s5Yt?E0+A!af_%Rorrb(QRInvk}$qevrwL>jsS}% zMWjyl6nyfgtsRaWst#XZ@;6h^j*OF0wX-J~5+TB$AS9la9^8&Ln>T3R6{5i+J z)j&`p=QuY$vvNVyCV5Y6Vg0JTmEwavs`K*&4|WGF6hXlY2@44l5Mbu%(8c`Z1NVxG zDDGn)DhaU#;wMTjS%~*qqCruh1nwqqzNs(UW(}pnx;0VE#`k+4Mmijb2qsQJj>D8A z&&9&WBOjkPn3|d?v*E?Dk(4!x!(qkTjDUvcFnfEU5kgHh(r>~r_&$j;mIqOC;uuJq zAn!jl6%+is(6B5M+)nkBya!$=vT1Mi;5jT+oDtd9kp1OtjYQdSNNxTc3)JuY1;|gJACX_tN!WdM<*I-AnU~dA)y! zOPx+BeYXfrA%!N>otbO1Ta}U?FObf$eACV$SECMu=6_h>OouP-DHI4Thz6?4n~Z(c zAOiP0rB25pJ#$x3qSRpJUT4G9@*kEx9mjoA!O&}Y$W;|4t<2sFuV8JW?stuZX7HuU zQm5jT(!=#%!$jJFK0n}!yGi$Gv`7xlm80KRll&`THzm^yvwS9XDxvIaA3BDpLw`mr zGT}T~(6u6Px=pXtjN*+K)M%hC{HtyU0zKX{(Fs0<=N+ho1B$~(5p5ltHG^!zG~>|DN^^S zD@LyqKaat&<2SgcX}HO$aAA0XlXStY)`I{1%hFw1#TAlzA?+Bysw?+%ScWocJ_zT_ zRRsl`v)FeNoNkL$kc(_jfXIkB9h>cM{x)YQ#K=o^$Iq&*1phoFJ*w=L)3}FyqN{dR zr=wU9z4Wbcn1Koq2dl`l|S8R$o3DeG!}={@gJ2?wCF#YdUh!ZR}&rh zki^zgk$yfR=pg@){q^7XLvueFI^VA_I(>_JpP%;amUFd!!Y?3B^xLBfM?F3N7e(Z{RlcRQ)$sa{ zTuTIVt66sY9~ednTPd(?c=B{;MGk)qg+sLR&Gq>LSuqEnBnvW6z1d8n+(;@K&UXvF zJcx)+(ow^NGS$gcCqvx|)aekipoh?w zRh)k@+3QjKa<2JhN|dRkWlGVbAPxoR!$}ShNS)$4Q2FLXrt*zj`)12nsPQRRl+7)!=rgjUMij}^m_6z}4!-p+BDW*9hcmVfc;LX@3}>Dpu=w$d-U zGiV|yxhEvztU^&A%D4x_ z912m7LR1(K63n0wT_^xogZgP=xzK7xxmK0!uaRo|%z)QlDe~J)2Px(ze(=tF+-wT$ z8v6~nW*s-0RLJj$cdU%=8T;*lvo!u$OD&_;bnOje5WOYd`Mfi_)q`y}-dNW+JHbw= z4wK%okCC?^k%}$|Es;n($tIhcZ-R{9A|O%BAaCK9JRGrZ8}&{ zag`)S7bkQ4y{P_wD3>GtbKSq(65bHfXvF4cMj_xxj$DC;2{F+Y<)-fR5P~R zI<9i2tXpx~pXNWx{r^F>pV-_a{|}L%Qw9J4 delta 22258 zcmXt8V|ZpuvyE-rwvCBx+qRuIwrv{|+qNbX8xv<@>*k#A+`s#&?x(9))vDU7`rrik z-~<>>Q3ezY4G0Jb3TV%{0j>cXe#qHZ!)(C)^H>WAXr*Zq8yXA{ClFFvfs0GWq#0s2 z=GtK5#ek4$v)6yqJ>KRQyOx38CzuhSF0h^-%82?bd-@UI-Y|Lex_$R2aJ2g*QzYM6Rv}^M?{yfXs~e={ zQv<@m?L4BI;}Iw*pSSS(GzEO9jVz?caH5NIMzWF$k;p41>)rma@DPy-T6I3Ox7PFQ zl-EEz2Me53ng>c9Gpo_}OV8O-2uQ`PJ7lMP2 zzs8d{B>2D8kpHd5`+xuUkU~U0LPOBth5sUBFkfV1jL73T;VESsZA5{xk~F}_$JQbt z5F#4oem)T6{e>R%){hBrYzIKuyxa$bhFHNFX-Zq#15Q$EhCoIK^liO3#^iVVQHNMT zWi!oCDcys|Ia`Y~D?RaI+~DTJo$MBnP(0#I_&LRQJ-3oSfV8G6A#Km5_ek_~N^xgL zrI-IWna*bz4Fy*oWe5xe8cD1^(A}Iwz-_db%eDpc1iT}wo;Bxq zONtZF0hTiDYUN2uWweBY=kGyqyEt0*PLVyCPDvnDHdy^gchybBHUhhYt^eD=`M(W* zpZ~YPYNp-DEFMH-(u2uVT6F$6q>kOx0B|`oh50TIgA;a3Yx2kug0(vjL=4bvZY zeGKregksC0a}}tm3g$Q<*o?QScEgH}zJ$(&pE6Dk7P0}hHA@L7c^10iV7M1^%^xl7 z#+~S@z`5L{AByOz+O_<66pIJ|*1}6)PSDtlMYo-4_h6sls?r#uv_aAuD>un^;mKTc z3_3Ktc|=!lCkVCa6VM&}`kwzOb#u-ckQN}_lND0Nvy2mDTzR>0^Zo-WO-SE# zkYzmJSQ1D_b?P{Wn~kN&=h2&&YTxQ!5M=a?X5Y$-8DfM`2w7pQJUqa&KEk3^jW5=1#x)Y) z%Lwk*!1V{kNGF4-bf`nm`U`uN%oN4HxAc$sqoSwXxB0?6^F=>ujv<+KT-kw%u+clV zSq!T%ln4FHwE*d;fz8>!?$|k;@@2oJ5(O(GY+F_y%tE zWGv3yGe5-d6uK@BHfzr&D&PMY7IDt;z8Zn=;O88bB8OcZBj>_9Q;aG(|Nj+Bib!ZHM&s@KX z>^(dTRdYB`gVExF0wfIaRxv`j3gRS&+_Iz|k4R0WXR;eZ0y>_h^{=Sw88Posn5cf(G@G$K05VzzQkXkchj53HfScWSM z;$q|+S}4QBn%f`Uemw9g$vUWT=dZGJAU6cLg@ov^HF~jCQiF`T(uh5l5?$^v4u|(V zJirG9UmugbxwNInHm z*<4|O^0yS9EDzyVj&U4;lQ2(5Sc|yTA!;oQov^9?#*9&8T(r)N=lxppu{dAS#|pEP zvi))|okGfCo`0=zzpclpwWbi@<~X@(rua1_l8|mQY(iIy5q3AjTM(XHMY`*9bK(#? zi3v6*Gf5wvrI#DpF-IH1{a8&`p>=Tq)1(ZoBvWi1=whSm$5KyWo(5gq_=K(^eC@fc z5*NoQHFDT=*zk~fqj=MIx`-Uv$VB}SmPp)%xa*y+!;7kfZ>@O$JGjjEQ5LD!`k9~* zjpU%?^);_Gi8CxRnak>-$>SWx5{qN^{Vva3eNW(>rY;v_ql8zGXS{_0nF8&3j_L+V zFn?3U{5;MFFd3EwXb=(CQK$R!+a{0EeX|ya)rW4jf-rAaS&~{we?j!|X`#Ky4HncT z^XS?+Re>TkN?N-dnv4gK=kehpF~ayKUq9h5#8jAccT$=?sNN#Pmp`R7bea{-5<5dW z_%MfPNHn?Ovh?m^)AmgP)Dx3dc5Zk2RrY3|swedT$XA~y1M_wR_cvf$8Zfp6QYY*k zN#3o%B_o`|>9li(zx(THP6?*fySm+ZHcz9kGBvUh+%K-EG^t4>-HnYI zO+eQaZZl=fBB*vA$yp|Ei&-nAuv!>LQ0$mHDjggOvjXTsG0r$i*b~DGx^>f$Ebg4H zv{jAMD$k(0zXGYEfE8P(>=(XeuofuHFP-~ymco_muVQa7zu|Ga$RZt8!bRwbHxg8? zQ#eY`G>R2K5qCk+?%lh1%oz-ZGn0{C{~xbfB((@uKK0aQ$HNl);gJLNaUrDs*b+-* z_MT{G;DeG7Xuuo&DPH{A58)$svLxQBCSIQWfs-ZfUJb%IQFEj_74cSuLyZO`wA?@p z>`f@+00EJ*q0c)KRLpAA*_|P}xt$?11KmsR);kiw+s^C#f(z1DlEuCf48Qw`77U=8CP3?e8A@WR23Z z&p2Nf6TN5lK9c)Z3C*n&7}!l+7h+uUwFMkH3Vg-Nf=>?ybEUK@RUOE>%(+Nu>e7f% zYqHK4F*a^*8oK30TZQ5h+$obpe_kF6IhjHLY+jMETmbCPUrS+GD%yWW5FL7R3kaq4 zCCO3mt(_*Z=p3cn`$B}qhiQ~U&T!=|$Yds8O!Qy*rOoo*B?k5Y zU)ZV8cd=i_U5B{(WF5L#JQ?}(mNx^aUF@9@f;TpVwhnzEdZuqxD>%L3D z<#sEniEhO5%yi+TIyxHd)CUZEumnTy34Ptf&Y3rRfJSS1eAGMl%kBO2ugI)3p2S3?$DkF~6gBoOWIXnd zf7F;%fvHL*jDt_6eU@;A>RtM}O+Q)xeFT&IcyCb4?bW)JC3M)RI#maKbI^SR=>7E& zci=MU@tRDmX?lwYXi*5+60NcrwAEivScCgHOQ4gDmCXrxb8Z(m^Ts)LN#PfPwp66L zVxWVeYYda!@v6ij32NItgW$L9dVtWn;jvEBhS6(5bCF6RotH=>bri6ffXw7`bTuuyLL{8Hl^n zZnlzAU)pi4?MoJT3cs~}T9HTj8wPJ)W7^Qy3uzTQjS=){zi`l4=XTc)IJKj(x3}Vi z`emQ(J(w@W&}mZFqYrpvvMOD8c~DeeL#O}k+OALLlfYQb=&`IPEf6q^fA~v$W0dgv zWijV+lwMHk%!rLbu|o}YKp4nmct@WBUy1(D@OHDUNwxa@uVuz zDOgtO3)L>T3Q1AaZzhYGiiq292qV#>Jj@KSXB6Q2k?##fQ!Jms+CQl~pft z#dN=Atw%;6k11|O!0?O-y!AVHouQk7JNGRD^LF8shTrGQshvvlw!eAX7tTei#p#)k zc^fAnZ|%~;-6wjJwd+IE-N(fOr23Z9yscIsB-XIahtHF(i{E}ONC2voQ&_ZzH|G;i0h#+q9q2f6Zb*&aua#`F4E=WmK!>Y&;LMKK4{r?olY3$+UFh7 zQKCj(y5$E}ySR8Jf_MWj@#GW05gswh-mrOxK7poZdK|Q#il%)m199UAW}u}$BN=LV zMMP~bjCLnTwv70$x+?GBjvV(l@*jJmWl7WKmT7M(p?gK~`Pc6Ax-)gA?#ewz7 zuHCxqX6xNP+ZpaU@z7f)PUqCm*JpKU+>V6+mID|GcWc5wmEZn+_&a{G;-%0kJg0j< z+i}9VAE>0h|3;~|uNfb~p{wUNCwhN0$BO(RE9#KwLs3L1BkEvJWyt(7EZV#kUXLv5 z8V?yyQ8Z@9J`YJ;#NOuJvTi}rN%|x!Du}w^u>l{{ym1taw9si~#wmK=&+r1wcF*yq zgATy8KbfC5ar;XI;8_2>U~6XmA;LSy=GsV#^Ez|-f=F&5NWOIOT_+80_v>av9E9ua zPju~1KG3`@Eo?A$Tn%VGR6Q*RVkOtHA4lrPM2=tBWdW{WD#d(hn{|9zWdi9GsdcKL zx0oe#17t5n>{|F^{Ypt&g|(qHmDI?YM=z~6nfxLT+R1mftIVHve`fXi|Ef^FX zO`2Cqn`4;*%eADPpq&~)*PwwEko^`rw91PG9IaV0enz@TFdzMC;z1h+586)xdqC7m zZ7NN@xaI=!OM0oYfx6cutI@Wny52KcxMJB)o|y-0?4jx%nG6T+e9%oIF*Rvk284bF zq0Ic8@$_GRGy^jC#r)hVP%GC>Y$Ld)BP@aj#rV3US$fZ^&2koEQkVb^3kxFy={fqx zXRA5+p7(Cbm4Lp$dzGb?IoOHl3V?xrz| z@4==|Pco)L&gM41T|S<6k)1o4GO4n=tA#n>O&uKw1xP3{g=(ZRG53--`3EpK+K*i? z#ZaBEmAR{(n?C&U7r{$_7b&=RWJv+4oLRXCsS_38BtcZXa3)408U1|t;t&yh zs~T?%%1^}rA8H^TBoRoF!s=bhk%mzSH3TM97Fi_L{Z_sde~(|6Z+7k^q^0E`VFYju z0pWJXp-?|oVmcXZBp!l(qars31^<#t8SHG`y@Jvn)%^@9ZmH}J=LHZf>W_=CW$>W0 z1$yhhU2}AXU3fb3paQXYjeEnq0JBT~xd|Y~Nw|DCh}c&cgVV-ORLRoxL`#S;J0ET{ zV!2&iqYl0*SKVh(1sxspSO6V720 z-Ca)OaaBY`@%~BiLm3b#fitm=sjmoUKbgZpR)-1QZ>>tLQA?TcVuX+bESBz9phcUT zPRJQp?%>b_n;*jn>ldGB;y8~`uX}=}Oz@D#2`@Pm5o%_tblWoj5_LfgJjC}NZF|l& z<<7bf*{I;Z^HlKkOS}+9tT-cli+DZ{79Vhv;v0k4v`+l1lp%XK z^MqQzl)7R)RO$B(-}|4e3KyMs4RwC_i+CbmA)FVxbfc#)1kw#y>LYoBQU+sN{bv)T z2t|PtVc^oS`isE{34*?O?A5DaMu$_Psq%MEV*+!qth*o2{W6^%OmJufAQ~91^#nMq z^5Rgpju^msCNY4AsTO+GKRKB9LL4%D1aP~_4_)!<*^}e1tJ{UDfN`Q&zP!EO(A&Sn zfT&+-`F-##oe>rkg3wC>ZoT0utfK1$v?EkzHf$0wR|DDgtOSjD?LDm6y`MAbO)7g} zfpemE*T)tan8L4aLNXcA(7x!9wKdkp!@n}dGSkL1qWl0xruX!F$%_-G&06wZwM3Ut zH3E8?0o73RbyquN3mJn_dST9bqEm&h{5}k=yxk@@+L29noUdZw`teW6(%}QQWRHFO zoh}FT!W;ERKTv9ODL7&>tT72u5&9Y;DY8n3Z6H4*cv{el`#ayALTGzr%e1Mt!(M2) zPq>}E?u!8W=Dc%b3T1=2U~vVy1VS(B`e0^LGZ?rlrzc`Ug;;l|W=oB}5~(;}cxq=Azk*!j zXmZnO*b9F)Z4V?>{sKK0HOQrDv1H;@(?$d{fh`0`(*`97*Az>qep|Y!TK$*T!l~-H z>NrKx)xrL(31woP-+7%{l~DFiUZ;QOwR{#qT0&WP92-0iiJahzC|u!BPl-!b#7|S4 zym3!YvvI#D-BY7IU;8Qr;d~g4sv3kfDAG<+B_N2rEmJ{1qsvZBZo_Jn#f)W|jBen~g$x&iHCh94ZuX zXC{@*ZgngChO+|c&E*Bxhz47*43*0Z$Tr@*&Ij&ZS8Zc}v3{d;#n9OjJS{mUo|Dd}^ttOEWyS}5g$FG(GDEnr zNaPC4o|^!{)+=QrWe6yoz#G^HakmZ{FyVXnPWNYq;Tr-+&F4M(*PBV71i;~H8Ie*A zgK07}+N=$e?{7vo83qmW$C->_5z%uwLo-IG4t=(T9!;v0<>FVn|kCsMw z?KjuL>#S_V*N65mqdx@;*96yob8V}8z1x47fav_gwSl$ee@!fas-ms)qnJ`EKvY*! z*ZME0OKW)){Zv6z3Aqb+ETJmG8YTR1iKQ7l;WCfmRkOn=SqSv7o%2b)ZMcH7&ywfM zK~ydFq>cXq*l6O=T;^~S#0gj;;0)ee=NJ&tOa0=0x!X0(B}R;rA+VL#wWr5KWTiv~ z{ra5Ae?N+SgBDH#b-0hk?1wbxTVjT^TCV{@1SP)(j^by?N!Y)kmn9xNh4f4Bj2gsx zqUP`BmAVp&SfD1U1zDyw*m&K&b0{hkW(bxFkJK6i&{QM9#pYq{yib5OKu<0~rrR*1 zj}91p>JW{v^rrX6GOMe+YVzTk_Z=eI_FQP>e4xo$3+w_!mKavdJHz($9Qkj>lUr@O z4a65bE!}YH^?S4RJ84m@jPFU$Qnoz}GM0vm?=qRe%?LLgUUtGIlPx3nWiPuA+2&I( z7Ud!VD*(AW9Te)Zmj>p~fU&#EfzpMnk|2^xM9E3rpSdHLgNAsDS8?U6t-dw>%gi=Pab1jV6sFcpUzN z06l^oiOM98Y&ZPlIaqP*zG+qW$rEq2JzG~sI-=PJM~;&{a8 zHlb}6TDEJDi=R3^9d>g+41CCMtubeRg~VTK{PC@k;*WZ%$WQveyHw>s-*KXh%B22CBz>=$^cukkxY=NJT%kk?e zzvI+2F(Ibeij9mMD-Ne$5{BwPzX}2yBGVvlVNfvxp!7tt{Uaiv7^&pAY=Al*aj zhPDE6_B~9`xk*cuVDgQ|1q5vFd&QD&44OO3`yj1=Hf%&&5w>|t*)McEVL4|8wv}^W zcrm+s3&xyxtyY9%SkXW7uOBXJ0b|`H@5{kWxH>2&sQOwIK->hg_&BZgAgAQ}ob%KR zpvX$Xcy*CzpWG_geMa9Cd4`*9jDB_vdD(CRleV@|}avt=6DA13$?sevWG zl!gekFNu0ek#(oI{8kQLop$j1}At=z_UBYP+P*Lg0nWK#7g)BTc5EETG)C3=3{l@5xSA*E-WTX&=WmC?_(@p<+qzF&nEr>XoJ>DlR-Z!t zPr7~4i9ub@PJ^%LhY=9P7tGv=gK>uHF^-xjyhnnKpw|z<68L)lK{BcEvg^_Q>>pfI8WLJPRks4Y3GmH21wHEg>4Xc43*cSy&(VJgM z?D$s9y=dBB?==Oz5K(rw&R`eLhYuL`(5&BdV4<} zI3%wdl&&7^a`uPe(tF3e#AInZP3GV4#}RLeUb;16$(-!j;>eg$c$0?Tk0q1PiKTFk zB#taA8S}U4n<{%_UfHuE0an>o#qT0x#O$-ge;z;D5A;}~f3E==v^3#yCaQ)vMV0jw z1L#AftKg=g2I6Fue{r)+Buc&bmWo#$X+dSG`dM3r$!DQ%WCfbg{ANluqR|dDt72?P z^irSH@hYoS8D(?BTSQ}RSUM zd+cbGVcqvy!*bO!^ z4&mIRX&CDK&NVQZ^@M8+poy<#!vQOt1F0})yC!|d4t@s=ZiZ@mc7L==2t!oGZ|hxK z|3H3n?o7PGK!gA%_gty4W;5=&F|62m#x#KPbo|A{w4PA z^Qmi>Ct%VyTq{f)+&0lZqfZz1BYcXzcJXA{tMr|t4hX6Zb9*ne54AWFF;%uH1_{h2 zqaSa=vcd&W=&R&;wv%(S;oA-NNyzpF!T$&1X zYTDEJnhgrH7h}zK%>j$&%7=K1<+pOoG>MF#6ni{iEI2S+)M#DV0SRvOlS0*#bf(U1 zX;R3o!3lDk^ULOf)+>gEnV17>$cnd)PN1HO>K>&hx>o@Qyv;Jp9h|3upn8g~+1?z& zVU#pv9m5`+-aXLdj5R-C@4U6pZJvUs>ETf4s_RC5RWYx~ZoP_SXddV2A%&Z;>77*= zLq8Yb%YlBSPZxVOQeB!ZuH`i0elftQnI9@NO!y{1Cv|#ta3C1xC^Y$16fXdna^pAO zXaC6TQM*?~p;kaQ`RnqNuf1cf9j;Wtg`HmS zv3-koN?kU>gR?V*$9>Ld+1=F)mM@I~3r&6iN8-BgX(E&n;VQ7F07!aW`M#<2?7ib^ zrJIdeevg$_^V#AJw0<11CgC1E`9_K<{#FJ37~Zck&qE13ge~N7HNkzu2}J5yL!VW- zsyvMf-_HU4)#KUEsi7*fm%p|lH&<4+&HMeEtqfh5J4l>ZzyG%xPTBKNZ$ixQ?|3wQR|3NP~ox#rtLVi-^|;O&yO72 zVU2A+?yxLM=;Q6XcchCPm~saIt=)9`IbWQEGEzqv=`ZEOU2*YZb9V4XSOEPn1LOR~ z6tHBai^-ZZ0JW*L@(yooXv1HKG6E;mEF!K5p$max3R}=DzhrpJ*2busA(~=T3U~NN zIM=K6J4EK_s}t{5|Ld8nMS2g^Bhol>KB}fegRsKc3SoDtbZL#r#I4k%yAG>6rXcBo z->62~h(djc;-DDR&kBqJ&;Uxoz%>9Vsj|!x&I_KYsarymm`@M+f#|-%S+&Ok{ii=| zpSzt_^`h>T(!=kpy^iQ+V~0MUtrFp-M(b2CtWfP#XSWJPCQ+IDgVuNQgP(P63`1^0 zd~G9uJF7`P&brBp@u27E_Y9DDA@2@|Wg3yJvz)_ROu&c;KCbwVG5|@MpE^;|T*L)p zd7rfkx5C{o`}D6C(vM%Wg=>TE810c&Ee>Yec~Cflzz!22bb^@5jZk+Q6<~06)(VFa zA?A@GZMTMT^qe|Su>q=qJ@s?B!NKWjQ_gHbFIQFzP|LT~ZpW-H4b5;^cZsCBM-;l# z{7ip8)8yJOw2z;0LIBZnkuT8cS-7UHSc9cBlEh%VgJM$0-=WZcc$bP(nPtHoBJ)oK z4we$MvcR?}mne<~VR@_Vt6R(1nQEurs^{sf(H^Kj;8?*O+=XE#^Zv+FD_N{Ijnj=p<((=s0>gnE*y6AsuR&2b zUG;Mh)<39TF`9Y-urlkw=I!D%ltgviH6R%*P+i77e{8S~Jr90FZYVaFQCl5697sCD zAnIo*E|Hi5G79#A->;yQi*0~B=7-|3F$m%p?2!F;NMq){o`_PG z%p6iWqb88`Nb56TYba%t)%V<>2o9-`EPAn>z`W`JV^VPjyB)4eziC76E;f8FB&)Fc zwqRp`wQKWiP`oHg%`o36KKiC*X31zpVGB)AmbI#*Ac_HZH#BuNiyvhpJlej()GPb3 zDLsv5OgA3%Q;1y*9(Rx;8(X-%wH9LsiqM$^3YEr^7d73L5putS_65BSjeIk`*Eb~}@m z7Q@9-oVhP}1>0)Iv3Aq`q^+TGq0(+dk8Eg3QV(HWu`?H4y-kIanx!lwzR7D@O?(|R zmbh)Pm)OLmTk0U!SvcGb(Q5l$)zWNkWo4`iC|0*yHU8^8vlON6YW=4hR?dU`BoPl# z{;`%RygPA9BU7m6fs5X*7b@Zty8B=eWIySme{Wm^^Bmlkt4xXVnj339od<;=C|awlJ^Jwrw>p&lnd z;Z6Mg+TQHOACAUE$BXbJiWjfM*5#$fmMjs2Apj44xpJy*8ZoserdeO&m zuLo|lVK+-w&GinBiLTaad5pauvhQyKcFs|%mg~T*f^d^|flHFHN3-^KrZ&+lM(){5 zHxY*LKH;InvNk;6;~T>}@=>g5c7FN*i1B{7`{in+PWP`m1u~Qi)$QNAB6`DsxuvM* z%;$NniN!VHZC+5pgY}9nDNs}v6+HPx>gs^Sgb~URD zpqF7x>S7E28iYB4@SY8TS3=ns_N9wXrr%lYT=BaQOf^e!|3&x-H=&R;#zU2NIRin| zpb$Ft>U&I^E@Ms*U-K3JsxHE#{BU18}K88Tp9aoHBE9!J}LQk#1T-CX*oIA^S0>_PfQ=^9Ylm z^4DH7iXFKHGDSJ^=rOW839hIOe2#35u}zXDWrYnFvYqJVpQpxIs6P%AazU#?rU(u} z0!jKS0vtCG0xwMB0Kl}t4=C@}Z7=5Tdy$1=utOi$%8IY8;D$qos5ca`LIbnHu^P@m zWOP@~Pp6KuiEiDl_4n#L>gu#Kxmh2kkoCRiWrg*H6ZbcN2i(!{uUraN;^|58J^ENn zILp%2x4{p@xwn|rAH#WIcSim{5T*|2%leNqWWD1aK79HNL;;TQ-C*L@)8e1CU%7fe zb0yqBC~vBPY-~ z^n-iDn!^|sR0i;#>IxS%ssCbaeK04HK0-Y4fHp~Qw1FQ*?Lk#9YYin{J3oL9j>(+<`NL zsx;n$S-URQCe9se4S6kHo73F{q#SK3quFC${$^oQl>$hPtSBFlYVaOesS!*qXvRm5 z@`wm5o!=oTsJ#?R>#7}>!Wz&d@d{WU{dM(Cc^SV^a=BBYP!8}pG`mxRTt4lDAT;~t z1%WDxn0|~Q3AIq?5W_JE>Qg+zKhG8a&kONYd@a+{5;M>)GlTNz)TuX;VfLx3mEXJo z$khHO28(ipsntr6F?n#gdKJQVNDvlFU%$B7;tBwNV0eV1Xz>Yzzkj#qQFDq_jB`J} zK6X+*8NHh(-)T1d5953odN-6Nte40iC_)Vpi`YY)l~=K!2&r)@aa0tIQp%z?&#wfG zSu&M*N}|k)b(AM{DKSO2h@P-vX_JV;xE0Wmuh{fd%iWqXzgzq!bOPsYD$780?#QFP(#Hk@rV@uQ1>FARl z#!#-heF&?fJx-lu1!deWgQ5CDHznnRBv|Id;c;FLz%_ui;L%FzB}>A_bY!6bXlgT1 z;?o>4^Fg48APIv)Y{+>d^(yU8%+7S=w@kmR(YC?b4v-NLQ?-V977Q}_VBz6evla8h zH6OS&cMfK)S6e?$I8M~}Ukzu?_;`#u&$uZ=Dc}s0R7I#b{7x54EHQ#~ZNYyVeIy7B zG4w##7?0I7?V#pl;TW}$lGMNe*j3CEIDt>6V?_|KZ3B}Rc*N#XZSUD`&5*{qtK2Dh}ZqrDEF|(D&Lp_QMNM)J=5biAN5?h}! z@4eTFM@0(#Tzj-TRkv!R-)qO)s{IYrPbv?n`5(aE0)q18ZQf_n1ke^80vvJ&o8l4u zV4?)UF3n;_uz73NBj}j)GA|c2?bz+it!c6!#)F)dqseD^mB~)|B8^JMMUeNgKmgC9 zxZW$ka1fdV90MHLJTmlvn!K9VmaJF9-)HZt3@bI#Y`ozU5+iJkRKG6=^wqq2O)_Hv zac1sxEZeo7(=xS=MuC>Ko{vZ#Sj<=F8&P(2|6%!>Z9 zf9`+-1EgG?UvDx|r^_BDklkJXX&u4tlx}?g*E)jTWtM0~4k$zE&Jv;g$q>EGlO&K~ zA!Q(^yxa`6(iH%x#FS1EPktbOTz7@C23 z6@Lft4km)z2eT;hF~Ib2AF4c5LUIo-lz7J-4V1ZF@SA^fpjM{37<&UYuFT+yR`SNa zWihkbT$7;=81Wc(5P=;5t=n;ELY$`vnovn1##dNz5*DVu5V+QCRrkde{(c;auJQ|7F=xC-9FIyd71J&eG)q?x?Jq|b zMIMssVXc0$gy?lE^zFQ@lHcet*$(kk^jBZgt{;ly456yaR_cisYeru|%iQ@JG&_%& zvJiv4*G5Ha!W5+oT~pQ%3@VL6zWMa|91AH0^UXRC-HdS3Zd;i`q9X!E zv~noDs;Bx3i=;v>(z2RDs}}{y?EIC2L=ifh~7244XhQqfwSXF zGKVvB?{HlToerS9$Ge0G4FqZpR&hyJ3rG3BF~_Idb!yFh9Ge5?OC1@6<}8Sdveqa zFKTZtrg>PUPAb4H5Nt106wN-vFm#QjJ@YsbVS3c!`P#M6wl|KQRg(dwOp;iPaQVlkie${GP-v#V2Xh4D0l$R0XbBorN8Dn*cRnC+nh zvV^!=M=}mfnlWiy#x+)`vA8}`v@l9!h`pZAA;rd%crd`TNlrkH3PwjkwVEF!ZHzZnU+) zaUoQqTOB@BfA=Vj-Mw_=CByd;EuQY)&#VW~ag%)o@sHb*`a@^d6w=EEq6v=k=pLUw zk3ApKZmIHh;l3tNJ1(<82Q49~>SyW8+od$0Wur_OD!sC|{2rZ@Pm6OJ=gFmb9RRsK zvPxL6pBMs!2d-0sB0gbYE#zuU#Qx2nb%{U9rFRvCu9SA4`QM}N)#Gir&MOd-2);<9 zpr4R@#~araAd9@*+-kr7tYbtJD7VMN3x3rAXN0!z`AT%jJmPn?u0(1Ox+JCjl#gF_ zqmH$(1ecYy7d7@q+WS&|9+(B&bpdQwtv_gDm`uAt<0@m8_zpaT9GsnC8jsMN6|yw~ zll5y>y>q(@!};wz=#*9*Ot(w~O#FiJ`+L#tyFfEYjgO%M8?Ds)f(jZ{*^BV2SM(KS z^t1A#N?_I zUijmGLbDYRc$S|!GjlqCPO=Jw~CkbzK-J@0p^)LfkjxWin9&0n-I%@a7I=ZOLQE6wpGhO zCUZ_my)9Qdsd1?eu9@7++8QLk_?tvbJ0%fG580Tt4B;Z8t`Y)Zgl(*9XFxH=H!Ur3 zNk|Q@xqXq2Rh?-<8m~I5`2}aHX7$peo$xyaLf1;t+Po)^j;uukMCy`TlExA&iRVMo zh+t>)Wy|4PaiMvwS)f|{D>~XkEAqEVqWF=n!va6NGT_(8#Iz;ahB03bH8u}wn*9z1 z8;mG3$B0}q&7C-4+c)ZJy~rGj+(;c5e8MWig8iLsDLq@8qgtoj@p#yj93fXbR!5s$ zo2+YkNu_$)C8Vi+#;qZ{1NN>(!2_A{ox+f@%aE%F2Fs!bd28pSDKY*g$Iq+UNd`=U z!r&xf2Qqt8Xl!)-vhEsJWhdtC`X=%qU`*|ARF})aFyScR{dNbb(>&ty06L!S9R9}S z>cK7jE}Yj%#(@xm_0XP@l1TudqS$^8iCFBu*l*iJLEKdZv`-2Qk67cxi?91UzBkx2csa72v?n}O6-W=s zkn@e&P^d}>BP>HryCb?WzHUW{i(_Fh?A?E$wby@x2BxdoE2vFh;wZgQ%cjiLq_2QM zy~!v9^MtRA#TJPcRk;Ty;+Gq}b^dmu1qco+gN}-M`zHz!asKLjM|c$?EEx?g+ENkjn$32s%BN(0^73L{Ps|*w}TvQu?%5O&E^gEv38J!_o9q zR{R)o6A>{x8YnjEd5|ct^ygGocMQukKeO)Oy-5B1L9J?O00dfo6=Uhg^+O6!VoQ%2 zczOMnT9SEut>u5qe2FGm;HD^1Hve~AIzKO$u-wxw?f#H!D3X_+d04q&4B~Ox0N2Cu zCcNsIZEvE%9Xtj8BrSHqcwd)-QR>n`txh&u7QA-NnWv& zz7$+FA~3@uU3Jj}NZ3(dp=Q?Ri(U-KLn%1iv^KswB%!frIQmImIUbY?N+=SM96RB! zunA7#m{CPb5+`f8)F>z88w6?53hpyJvWWY-McS_;2n9G7ylmt0(RO`+Y(0(f>4H59 z#!nboT1uU4x?T*L9+&!K#nUB`(kIxq#y1)9Qu-<7RyTxZ~)t&Nscv|URZ&N3go8#Nz(2^^YhK}` zafBZF;9lTS6w9720n1-&Pd;m*JLe zbi$S&8DPgt>oMQ9YbMS%Nxq*~>7MKiS_fuaCe}TN@D?=J>ul%_4;LiY9pO8H&$zr! zILbxFM@oX;1*H6|LxjvBc7sWfjq|54h{Z zEX<4Nc}AVdnPqw@H$T_{c2wzefIHS<{BJ@N|v`YFG-=8JR9y78XX z;*SKN%nTAI{|dM-5?HdASIEikdD*P`Z6HHIlc9kw%l@yJ(fO~Kv30>lPOG5!hk_xP zuj^zm>VQp$6DuaY`6I2!amunht+4RyrEv42^x5o3xc;*M>vg-GhkOQ6ov|#o9<_eJ?7E=jMnp z*>MpQw;z16&Zq=*#{xv*IZe2?XfRj7N@)A~DFSU=u;C_fIU&WFT{}>tD1w#;dza(q zHH>N_F|uZVQlx`7~K%tbj>Zoi!(|?3g%Z zxW%3uH7BDyGmy?TrN94esqtkp|9eDMpQ2`w8m2kfS$}SgoT7r`QVKo!Pr8HsF@hHI zI)R!jAP%|>{uUo6ywDy-#)SXF^>b1L|8yKEfPct7)r(82-c`J8c78dN z$^EU@NFAdwk8|SBde^S^VJwB+|5b67VNpg+8<1SOyAhBE=~!A)1nKUOMrv7Nk#<=^ z8lze#D!{}6 z(njC^qAe%&T_ug>WYa8Y-}=Fn%}^w!7^Qv_e1qr368eKT2--EtyV}7ai~btoa{?No zv?kEaZk(+-k|IclJu{&ob(P3is~63n)y-xJGS0B+yQm=A7f^nh(?dpIlJO6HE9fKo z0)3}$Q_i1abhA8)b$TDs=Umglfr2))d-Em8bjS*`uL8!z3*H2>tWTseU(T<`sHFX@ zi|^Bu+a<8KpwodA&QOH0olf25_s(q)+}!Z(v2uMmn@cJjAI)Q_4~wtM(bf8{rNFXz zzG2T+e|PIo?8_GjMwz8LOH^w!V|`?m&kV57|~CljCd3$hSSuan6hvk z?la?oEEZhdMg8*=>xp#XwQ=*N0eNS}-?tATx#kB4Ua;L znu&3YFI92Um~{$4;mAKdlE4r$?}by@&!@RIXb(NZZ<^%X90AK1r<^L|s9$$~N|6ue z+#KB2OW20J$}->(YHt$S00st~Mn1iSR1^x3Yqv;c(&kBDXUo6)!`ofa$wtV0+NAK= zib4B&AE)ancH8Lh59SnON`PnLnFGn+gageg<%`8F$|Jvx%Pj~g`A7YtxPUu6iGMa0 zI$7Y*d$JuRprG4JCW+#}0T+bl|cruxYKeliALg zl+R|P&86p?pIv_5#Cu0Xbn+qF=cgA3y&0Ne3$o+@-O=v-Pssst#)Gb0A&C%v&qCprZGa2Ro_x!V&p1{wmmEoGnbsN2 zPai}jjKv5=Bx&tLfg$JF#7a}g|CJ;qGMi?N(KoZon`P=x^lKwpgh`c{0+yLFa>JWJ^}5RvIjO*bJL zSK^`emY5WCK9v+hb*3r{=`hD6hF?sM!5F6AX%NCH9Gdpj6U+Bo*V+petM}YKJdHL$ z__%Q+Ts1z&+y}W>(}g+`Xv9Vpmh}b^q`NWVs$70}U|dJ(S%yv(pi>QW?g55kOJAsT z=VyX*)1)^ACrh><>VobbyNv|vUu;I4*)w)YD@#^@Go3XjT84|9o-_f; z^9&S9Y_))hz=#!yr}*pWvh*W$x&olvg~v)vhnY};yRikNZj)(mYQf4~DHwWe&%8(O z4^pU5oJQ6Ubo^t$|Ld|TGtAMaQJOAA#X(@eU%mO7iaFyryFVDVmy<)H*H*V~b&=0( zWUfi{c6%=jYh(1)#&ktIn{1$GTb=D7a37?Jk@EX>mcrZ=cLXJgqSc^^uf&)ZCErPP z+&CmkzL!v~#0aY+X_pe_E;r|Bt=fOCXXovxJq{mWnGtr^PJ2PCSdRAke zd|8~&Tw~GBKxG>GAsQcgNm|7vh8tViK(55N5N z@&`2`NaIA|yWR1knB|yO-;&dn<}@ZG>(<&ts3hAfkZhc*h|{ zvy65I8d+1<{-RZ~V>0b71l$UIS$}|VGAmE2Ti$A?jd^$$a|;oaZ44ZR5qGDr#lN+< zWf{Z5c<6k^7vg+%-idHPU|ZC(J2B^32Jb+k2}zu86+!R4>tAH-bXTr`Z|O^@g>z@G zu^mR+A^RP1trmGzziBGWWQNwPzUxpRRE)ucnJ7hpUe#zhp zF&;lL^zJPM+}6 zd@)XxeDaZqXDdcGPb(bg!rmh++f1~NEI-mGTMz#?^4!h0tc8l&h7(xcVRi2v-o_Yb z!ph5PF<8f#(Kh9q&*sfV;bA9?NAfM460Aj z-)}K+D+p@$3ZA`S^*ALDSz-65om)Pf^Z3g)2HgAj5ge}-kTzC=hVPM~MY*s-FCv#a|vW`j^`m8{5o+lYP4d< zbNyYh1IFS_;6qtSpUrIdP2hks-zj~A866i%49i!;UkdkI&gr^y$u9?(|J3{Ly52T? z{loVu6P@}8gsM%*rp1w8G3HsKC~^ETjqPF)#S-R>*J?CrK(89x6Aum`*T>QplCnR? ze9lGIFj`cP_tazW{!|}#wvm@GM5|UN(V}vVu6bR?dtpVQ9tgJ3{YsngE;`^fYk8#E zgcKs91)g(=TYL5iV2O~N*65j44O}oyMc$DKa1zZyFiI(WUR%ouTJ2KwUh&b$x2~3E zT}jw=HCcH%S|gQM7P5UmKe_$>dW!;32&ioqFloYDeo|E(__{<%;Re`IB{0S{*>~o5 z#YHV|vQtqE8z8MEvZR8SUS-N@X+i+j+VRfGho#XbyoJd znD*N(X&JlGzn&wr{=FT%!w&5LLSU@uCUUc3*2AuYKj8}dpVp>2u28B`cBfqN9iDj#bSJAYIs zsjPZq=*?4NR8Od>DvfQctTomA7Db$F^I7-@zElNhXEvOWs@3oErEJa-d6Xyj0sx z6pQ}4`A>>9V7i%EOuX^g)uqM;v{?Vm)a|RA-)Ju1a-(6?mqUrKyiNcQDaIU?>Yl7S zVQR48@1|Ul1&6F$Gw`7~66}RWM=OYORnxq}VcBOl#3fO)F@kwLM zQUvpZ$lpf@QqOLam^1WTgLOb_)BXS|FFj@A)xexPFA~^7^gV>Sx9*53Hyf7Lc(r_Z9jo|mi%Y}O6Rrjcxk;-;lNeZ4tMON3BT1H@Jt~EBvUp!bGlmnctrPEy) zQ&CFpT9>vSuJOMd(+v^vjjS;dn};c@v1$7>vqRqIV%E$ZsSt8lBuqc$*PU#TLnH52 z4!XN`9M!#%uu)HAiasWfkoEB7nr3A`Eh~}-`zO)7H=v^R0E=!6*D#5QOY=m<=UI3V z2?Ox-m5Uh;1&hLa%&`nUGZ{5le$8026g9HH7OHvrPG9$ZL4ef>FAh3Y4W z6dwpd#ak==|M3(C`nkqgCjjuRn@BPLXhep?vrgEPafZa{ArFQA=1} zp7iHlifROm(w;+}LHHjLj`${-X`GaHScXw{SSIvFwcjO$kxxt03<)^|*Ef$910M8t zN$Trdlx$F+p3yV^kY_JvwghH9Amt=OZAa`pPx(YiB zq^r>pdtqwWe%NV9R~r#@{p(z?A*w)n`Z>12Qsgz%+IY&u8`4ly@#t!!S!?Pv-<|4; zd}1DrMdm?nk~|Tx{X(u8>{0DN5B7CJMy}Ok6OLd@}inLOQmgfviA8xTVKwj^I;-K3n|2b z4|5WSEvO=s<%Q#sjXA-doRDcc&XkZ!wYr9B+waZ$yK3}G%Ekta1(IAA0}Q;h1+_sL zKa!Z><)Z?!N+K`sCYj)H4L0T<@_Oo$SUM6hT>sQm?~sjBJh<=5N_dfxgUFgqM8rKt zPC_S~4VUEecphy^9UZ8Yh47*kA$q+dfeVq zaOWJ(_%2iph61^(qN*(W1~~y9mXH{d2mY$YKFfntS9*W%eUFB6Zw$0(0uHY(|5wH_?yfJTdj>W%i zr@X}jtWiRidKg?$idTN&zm~`TxC9I;cVDb(`~N7O$It`rRg_<@K zSFGflOz8A0T?U*R{*?i96XG=)eC3yxeTpWenei?=lpjG7pusGVZz-=z$!Pu!p!<)P zFlm-cl~sI&Inbp8fGO}t#k|<~#j@h9C`9%5w>hc~Ic%05HpJ>f>r+$zK$O-1Nc}xu zOPtN$--w{O_#J3GxYJAYOfa&J)B}|ep)Nu&e0BZ{RFh1Xin~pCe!qFmn`3!@(P)WQY zmIT^-a=S|k#cp5P^$o#umFK?;wZT=|Z%pOR_tcN(Q2++;A)O&3A)aCvOuJ zcEgdMw`a_x0;{=$k2zC-JbDX$5ZCIK$!Nb~LdM8Rl}Po)(49SX#`#nrm`uHcQ}3qF zOueI;`+iM_^S)MlH{JW${bc3&u*xSN$5N1Q?ep{nw)p}vXfPi1m2ui=Gat7}hD>~_ zaVhAHL)(WhQEM2nbz|#BIlj|UD2#f|w$uljPU|T%<%mQv~F8yd>gtVAJS~NSzh-)J)FiepKKP3A!8pncM8nwC# zK0oh=yWI$WFoB(dnN5upU0Tf+ca!_`y-(W!`Do zS!UyK!;W;nN{d8}CE1?YHtys8wN6l;CB>c@mR`-{E>_uO_86UR4VO8t?z2Q!oj?Z7 zV)?dGo^M-bapb)H41M4V-LFiD$TBijNaOB3=d9g~2Y|d5u`jb}v#OHsf6`q+k^7oy zzT~pd=%YTNKBt}GT%fw$6mrYHAI#j^vaGx2DUH^~oi|JIXw}!;Gj4icx3h8oQUIFl z9WrvBB87&FeD0gJ-ptROqa0;T)a-UhzJ>=Sm_c85zJE6Ri9D# zJ2L%dNDc8b^CMuJrt&{DVH4xY!yV%>