From 8b4ebedd586790addf48d49cbb7abda5b1e5cc53 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 10 Jul 2024 14:58:01 +0530 Subject: [PATCH 01/11] claroty packaged --- .../Analytic Rules/ClarotyAssetDown.yaml | 5 +- .../ClarotyCriticalBaselineDeviation.yaml | 5 +- .../ClarotyLoginToUncommonSite.yaml | 5 +- .../ClarotyMultipleFailedLogin.yaml | 5 +- .../ClarotyMultipleFailedLoginsSameDst.yaml | 5 +- .../Analytic Rules/ClarotyNewAsset.yaml | 5 +- .../ClarotyPolicyViolation.yaml | 5 +- .../ClarotySuspiciousActivity.yaml | 5 +- .../ClarotySuspiciousFileTransfer.yaml | 5 +- .../Claroty/Analytic Rules/ClarotyTreat.yaml | 5 +- .../Data Connectors/template_ClarotyAMA.json | 2 +- Solutions/Claroty/Data/Solution_Claroty.json | 8 +- .../ClarotyBaselineDeviation.yaml | 3 + .../ClarotyConflictAssets.yaml | 3 + .../ClarotyCriticalEvents.yaml | 3 + .../Hunting Queries/ClarotyPLCLogins.yaml | 3 + .../ClarotySRAFailedLogins.yaml | 3 + .../Hunting Queries/ClarotyScanSources.yaml | 3 + .../Hunting Queries/ClarotyScantargets.yaml | 3 + .../ClarotyUnapprovedAccess.yaml | 3 + .../ClarotyUnresolvedAlerts.yaml | 3 + .../ClarotyWriteExecuteOperations.yaml | 3 + Solutions/Claroty/Package/3.0.2.zip | Bin 0 -> 19771 bytes .../Claroty/Package/createUiDefinition.json | 36 +- Solutions/Claroty/Package/mainTemplate.json | 3767 +++++++++-------- Solutions/Claroty/Package/testParameters.json | 32 + Solutions/Claroty/ReleaseNotes.md | 1 + 27 files changed, 2042 insertions(+), 1884 deletions(-) create mode 100644 Solutions/Claroty/Package/3.0.2.zip create mode 100644 Solutions/Claroty/Package/testParameters.json diff --git a/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml b/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml index d8f500846a8..d920baaefc4 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyAssetDown.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml b/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml index 9316392b866..a4bc4368c46 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyCriticalBaselineDeviation.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -30,5 +33,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml b/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml index bc7705b768f..33ba1bb2606 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyLoginToUncommonSite.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 14d triggerOperator: gt @@ -43,5 +46,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: SrcIpAddr -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml index 69c4293a38d..096e773f9b2 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLogin.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -34,5 +37,5 @@ entityMappings: fieldMappings: - identifier: Name columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml index e820f3bb253..0ffb499ffd0 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyMultipleFailedLoginsSameDst.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -36,5 +39,5 @@ entityMappings: fieldMappings: - identifier: DistinguishedName columnName: SGCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml b/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml index cfdcc288ee3..db6d372edaf 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyNewAsset.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml b/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml index d4b6636dfdc..0d572c165bd 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyPolicyViolation.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml index a5c9cab642f..f4c64bb1412 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousActivity.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml index ec54e0d2aca..6da2925c08b 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotySuspiciousFileTransfer.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml b/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml index 983fcb6ec2f..c4eecaf4002 100755 --- a/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml +++ b/Solutions/Claroty/Analytic Rules/ClarotyTreat.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -29,5 +32,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Claroty/Data Connectors/template_ClarotyAMA.json b/Solutions/Claroty/Data Connectors/template_ClarotyAMA.json index 850433f432c..cfb37406b77 100644 --- a/Solutions/Claroty/Data Connectors/template_ClarotyAMA.json +++ b/Solutions/Claroty/Data Connectors/template_ClarotyAMA.json @@ -1,6 +1,6 @@ { "id": "ClarotyAma", - "title": "[Recommended] Claroty via AMA", + "title": "[Deprecated] Claroty via AMA", "publisher": "Claroty", "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", diff --git a/Solutions/Claroty/Data/Solution_Claroty.json b/Solutions/Claroty/Data/Solution_Claroty.json index 5c4edc5b005..2afbe791bf9 100644 --- a/Solutions/Claroty/Data/Solution_Claroty.json +++ b/Solutions/Claroty/Data/Solution_Claroty.json @@ -2,7 +2,7 @@ "Name": "Claroty", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.\n\r\n1. **Claroty via AMA** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Claroty via Legacy Agent** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Claroty via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.\n\r\n1. **Claroty via AMA** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Claroty via Legacy Agent** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Workbooks": [ "Workbooks/ClarotyOverview.json" ], @@ -36,11 +36,13 @@ "Analytic Rules/ClarotySuspiciousActivity.yaml", "Analytic Rules/ClarotySuspiciousFileTransfer.yaml", "Analytic Rules/ClarotyTreat.yaml" - ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-commoneventformat", + ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Claroty", - "Version": "3.0.1", + "Version": "3.0.2", "TemplateSpec": true, "Is1PConnector": false } diff --git a/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml b/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml index 46d6a2c13a8..4e77850826a 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyBaselineDeviation.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml b/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml index fabacda0da9..e4aa657600c 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyConflictAssets.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml b/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml index f62556d4420..cc40bd5c9e8 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyCriticalEvents.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml b/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml index 629cbfbdb07..a5d205d83ec 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyPLCLogins.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml b/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml index 87f0c37005f..6d0f6815d75 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotySRAFailedLogins.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml b/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml index 7ff4129e235..6b38fca0703 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyScanSources.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml b/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml index d57bc40237a..2fd4377e5e9 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyScantargets.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml b/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml index 7264df96b45..86ec7e0652a 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyUnapprovedAccess.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml b/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml index 7c0d17659e4..456ff9b7138 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyUnresolvedAlerts.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml b/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml index 8a3968bdecb..a0636b80323 100755 --- a/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml +++ b/Solutions/Claroty/Hunting Queries/ClarotyWriteExecuteOperations.yaml @@ -10,6 +10,9 @@ requiredDataConnectors: - connectorId: ClarotyAma dataTypes: - ClarotyEvent + - connectorId: CefAma + dataTypes: + - CommonSecurityLog tactics: - InitialAccess relevantTechniques: diff --git a/Solutions/Claroty/Package/3.0.2.zip b/Solutions/Claroty/Package/3.0.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..bdd1d766b89ba6acabeb8859e9762de17b088240 GIT binary patch literal 19771 zcmZ6xW0dGjv@P1UZ5z97+qP}nwr$(C?e5*SZQE~u_ndowygx}sYE?4lT$MSps!Co8 z7z70X0008u+xbF$wa2~57X|>JSQY>P{oh?9M-u~Q6BP?#6H^OY3ug;E+dr00cDC0z zHg=n=AD@7)_z=5*4ZvEm3$ELdmtb@gy8h0WEa#CzNGQ$1o7yA_q?BD2b^X3m-vOU; zpQNwcB+sT365GNKb{Y!Jh|lrfJG4;usVcoiQ?Cj#jSx>DQw$h?4UmnJQS@#)MwTE|_n3ulN#y?de-t2OE z*R4bk35=0mJx6^glhe)Zj932D?D?NcQ>jA)P-k_lLZ&bqV)+9c@W2h^(;YzOp#jqm zFH`@-P6B|DGb>l;^fZrp79bkX)4~ z2#sS4MSQ#2!vt}g?jxjwio?YXD^q;lxV-#TdOX(%qjAqSs~^@h84mYc$EyMM0yI| z)9m|w!G9REZ+uA1?$vj-*^1vTYD>qu2~&ph;c$-1Wa*(eBLo9c zV9#LaXD&?hXXfY$A0Z;su4wLN=>ecs7CLU7lve@U0D2W4EH2G=5vO?wqE0NBCzr_4 zQOJ?PGX#Z5PzrMm2($x-dG86-s0Wx(NjL5$pea3!r&RZxOa??r+V%UStENUELahKA zR9Kz>Jgbc(nDLS*6{hkj4Fz0Qp21kOJUgv|Y1S}7Fs^!nSVQCBG3A8-Kf(qanivlQ zRel8HhEpsdE!*$!!wJINmxe=9N_>IH0+tX5zpIude~`)@>B3vzam68alASnPhfsC~ zAPGc3umi#v^Cz&k8XW{dpLPd6m@Ex7ylCwN$%IUY!W?1lUeeD!N{L6OD&Qrqm_*?O z+h)-e&xN#StN$>M6cvxfNMVSO?{ub7)Y-V&SU*BxY1CH@xAIW9DT}ulg+KXVcV2?^ zX2qNfe~HHjZ6gVy+~WmKv4gYb;BUP$v;GICdrRx&7%@xnccIXgTpIQ|RE6L2&2k2~ zb@mxw!2ohDG&;ykTOYqX1Rq|(W!z0rH2?S=M0tB!67l7(OWH{C2%wSojnTax0}v9A z6ACz&u4T_4Ty|)k4jMuQWDt;mv4Q)~TrORLue~tF7KTx38fqjgvf?&T)ikcjQvFqD@MuAWEPlw~^tfdv^!M&xvOw_ZN( z3QIEMWlvMr;BNt*PLspn827ndDvhBrtT{I3ec-fNKG4@TrnPs+`lc>W2sQ~eu?mUE zs5q4T7}1>olnFrNDAcp~SdH+#nT_~hdPZaeeW?^9Vtm1g$eOff0)JfKX;YbOD1{p$ zI4LTH1&EeXN&Z1F0p+Sp>6rccJ#?(V@fZN&Oy?Rw*BTG!wo0)2<;N3<9dfu@v0UGr z5sT&J0|?dR8(i_;Rq}Q9qMv7g{3({GX--Jd`r5_9npd;bQ?nd$vz!`U0eYq?xz@j& z-%YUt#qZZ)wCW$;5^@S{9mWFNV#yq;?Zu4oO3jbcUi`<2+LzpORcHyl8d<4@9-!tp z3;sFwHuW7yNWyUrRcPm_xSmX=UBELt7nhv8;OT@oOl=l|ag|ex2n%=QGsDT>g8h}?rM|H3xsJc@;=f)p@;gsPuS~@v8>z4~^Si%dURx zOxWn*T?)%Lp<9wVPr=m5EEE!8bmPO)v2wh#F>PTqX}WQb(1d(5MiD>pZ6QPkq zu{UtqYDw~U(Yx1`k!ShbYM_(KH7O9Yq`f&b#>o_ zT=FNc4hZWaYUPlvO4L~HtNKE%U&jTM7pW-@30r{D5>1XiJJbZLG!;%=kP4h#b^^ku zM3hOjDoP<{Flw`Kj?%Xqj4aIu%d=&4mW8;+PEf%h7)wfnOs2ptljEy45UP$%R#1TY z7Ol%xM-VVlJC`md5iA%uQKH#S)))_0ncg=UEOQEHOZNLab^%8{jSem|UNo<^zTIW< zHb>oU1pgwW^(+CXu4DXI9N5E-iE1(BUq)?9cL_eZYM8l=NpI5Ed4TL=-7$7#SsYR5 zx^=KjEP?%=87X1uGYq|qHgf#NFOSn4ssp9ZStk6JxTybov=gyf}pdh=!Dyxds={$ueWqTJ8XYjBiBz?hh5$f!}eNc zv@$Za%pz%Lna3RIjbmZ8R~<~q)3&-(x`x;IEcsRw)&-ebhx?~ou^M+qx4Hjq%K`N(@7a0gEIX6C&0P%Cq6 zU3@VNAne2nSXWDJ70aXbL4PK;Lb`T+D|2$+AB%ie<*h}ESXYVd=E}2I4m?ZVPtJEL zmASS*(!^Ct)V3onZE6{I^EFj#;?27ooceH8w90_6=n4=+(4W+{_IglzHns=_f^<#P z#zumNNx`^D1kKQNX;`l>|cJ!I)=%tsp9 z+yImaG%T1T-g@v`pAMgxMCVn8hE9=1*@!f-x@j-wtEb8~?smqlz&-72<)izez1!uRi!8Fb=P%`3f;OmbUtHDK#(XP0)w++5ZLf70*@zW$N>t&W zq4zcFBcS!Q7ddh6E1utw`?MIhc{Z2sN_c1^DN~#R7zfmM2+=ST&&ESip&zr4});@#iP)< zo{^>zl;gL(HkypzM}1*%h(r%Ko4!5fs3Z=sjO+Ni1?T79aX@!T$KxW-!Mp#|4j>c(wcEvA~+Gz$jhw`I{ zMt+UbeCN`Wcds4S8kFXT?++&Q8;HpGD zgX2{>i4O*?e1IzHX}uIVH3$2W;S8h$=H5`kBIXQ*hto01WrO~sURvI*#&-=fO0(Tk zLN?Y_F8~6Vb~f)IaunnUMFQ0c4C%Ek<47p_ArMp$CSg7@8tvQze{ZZ<)$(=h#+Ut{ zACtZtmJ}{#E3vHP$=fyeNgR-pJ-=M({hyrSdb{`UKUXHx;{~h=r78X9K1kH?ve#J(F}Oh?a#=m zop@cG8@<|bjAmUlQOnA1qP@XFNP+os3XA~_@eOl;zmpnNgAJ3tmC?$u8={oycSLoX z?j0G=k`+&YQ7cv`)cV~Y96lR<4ybG`^Gx> zNuF9x2(2I4boTsLwU0ZqpVr5*L*Mgv_M~GRaH$sAyUGtRVm>{~a=n~5w5RvCQrdgI zamZgm@{YQ$fFe$%!rT{=N)|iHr8-SdP?L3N>?Qk9GSsA1`U2HEh2`Q0jyirhWc!Te zAat;)MRDz>ka%{)TEwN;v7vcigx~onXxwx(>JR4EvR#bTs4ySVy3s`SR6?Fcy8UpN zvU=}*0@JHj3O7RY&4B&Fsae26o;EXuCwgz71?43Y*>D-3DG zC3@L{nK|rBL^hl#$gk%t)1{Nc+vpHmSgll025SeH@K~4I%ZVWC6Mb|Jp2UH`yE`mj z;JNhW68mqVs2LCgx|~lc)XX@`(6}-!GHftB#$2UkPTB6FTp0ybyQ`++q9KNpo-v}a3nKUSL5A`RN|SdS4?%3cDj<0 z+PJ1Wfm{Mp!0XI($~wDFDt=c)#%r?Sf#M6@C$ZDiMS;a0HN20S4=1$ZHkr!n z&B{~v(#vt&axS#Eak#s12}V+xs~ZU(Cd%>5b=zjTT07mzON(QrM(;+;cQ8cxxRv7= z;FU(_Cm0z&YcD1ILb&uOmI|JdEDLl2EB$q>`4K!X-sfcBPcx`~~nC*jgzcswdD zK!nKdb#-14&X6hH4lQl=Mvev;<&XR8#F1L)+Wl{A=Zcx0B%#G#;EJ;japae{3(SxT zZM7KHgN{Ex`%66FCl>7kDXljBRzQS_GeV|2=Fp5TirmGkXO&a5D3{;SAj`cO?GXhM z)(O2<#G9<+NKa5Ienm*Ni}EOtADARi?~t{5+|$r?ijO9j@ci_PTfY(lVS zOGfDw8CM5n=x2SbQ=cpFRhz}U?~&#ynsL$m`j-Xc@6v)_;%Wuw5TbfQ1y(#Pg7aF1Nfell_=)n!V??DHM}8&#jg0#k$EGG(E_=Y=janUhMM zY#VbyH6mk7**<=*48vaRk8Df6N@)EguofRiPx>5xsYNy(4vTL)PZO8Th+)*8MewVh zdV^h#IykybNW;|29ehjb2~9v#HUfsQLq_js0wHzY3>rMc3z7AJP+IJc^AUibURgK9 zlX;xpdXY3V-f(k~i<=&ceqMvXdJAWeaeqwcO$P}H7<}Bk1~7PXLr7Dyi1yEU2&^ZB z(i1g%uRl#u$^#B9DpA){FA5kcoSk8|VQ^<3Yg8e$+`{Uo-yRTp(~9E&1|2o60Sv5O z5mFZ{pdmJW5L%B3wd27;E3DWRU1q`cpyfe&PpqgKfo55F7Q^GWp$tB65K=Mq@CIKK z)sgwtWussTtZ(rK6*+AH4a(pLW4VK;rVIApV{5AbUAdQm(5Vwg+4*D7MKCTExPo)K zgw##FJs@_a9uxr#IA~e@>zlm(hx(Wg0^Za==$X9+`TbZ`>P$e(jRK;^u?d!O#Ip@T z)p0&sQ2Y1)Pdot{|N3k+Y<~Cd|Lwoc3(@tTbh%-Ibd12uOEd^eP}Zm%p2eBs_+qto zU7cZJB1l>fcI>wo+A@IrX~*WVQ(qcu)&88dDoc8p$Sm1(pR zP6`4~ECCtw8sX*U|0*8>2Lv%?(Eu3Svn`}9Sw>5+Repq^@2)a24}TEoYJIU5N-Bga zrmjY-=cGK_hR> z4ZEW301eu7z5!tyhza*Y}4^f#DJn`)x*^+iXz@U-JDWZbc0^<>a8AEO5SZ{G@T-k3~W_ zY}3CF#q!MeCdHa!uk_-ZuuQPsnW%xq{L(Q1jIzhzXnM9 zXPjMAJSTH!#O_Y6>O4_8yn!`n2UmJ9wgMc60+n)b2`UPxY1+Eyw=B=6uy2dEi>ua} zfBRii2-T8QG@0Nm!U&vct#CXm>pWsDIgFH^qvup$i;Y(AoQttpO$b;dNk6pw_pzDt z^gTP0w*upEY$*-k?V}1NssNyLhD;j#y9q3#$Be{^{MwEQ`eT+z%s?IPk-(5Z&Za=p zPgwAD*ZVxSoi(wv$1E)zn5S$k7_DdLG&k63|5V`VLts_#o&x1m?c31>uuj>Ph76$J zJ8P<6x@pGisA~t^(p;pb{Q+yDDkQ6VX4ln=!#39@grKjubdk^G$*(R5mK4`=r|W7L zr~7l_r({}hp)66{pYgytF`wLOI*Iu9;Fx=RO?`|_v==Grou+?H=Ps*kaEtk_xPR-A zTEyH(x-+2@%x^EXo!ZAPVc^m0BPcRWAfECvb=ckPKnbDod!C=nC|)WdnMF=H`UrHJ zqqOFK9r=P8uKS+SAJcmi zj(UB~EC`U2%0EIuBbl#h#wL`fwrvB!)V2$uI07wwV4WK;qv_iurWLXNf+^9OJ)=K% z2VN_GvP*%AS@c00aSEkz4Cuu`LsQY%#+$p)Zy!nd-IL!&=2C%!X(EHHem!v>6v<0i z8^&8XHS`(SaRUvNQF-+l`qiwM4=Go91sTVG_k3*q19UvFJP8p((GR#%gEk*1{N#9Y_=HJHceclx>Af&Emw5-%zkjgq z=!z$I;(!8fo|`wC#6CN@PMeii5^k$i$$FT|=`9+|B$&M8d?CEwTbj69H*c8n2ckW) zp*B&DkIX`xOUyjez+jp|%P^J<)lvLbbG#tbE{4O}Npg2WMI;yUU3CC4jA7fp*;cpj z9b%W!I@k1l{eT@tNni~o>TNWkc@(a*lDh1T(=?VtZX9+1I@`otan5|#Nf}aJvmF4j zw1K?F)tc9x&}AFxfd~PeYp^ne2v9Tn1U30c-O)2<=rB6*i(76Adg#OyBK40Wuw+L3J8xkScTSjd z+w3i%$R_Vw5_)WzEyP>tA6gc*yCD@Ra_-R4=ETso(2i#o%)`E@BGY5B+({eg78;iw&VgZk7HIBC19esyp; zOYl;wW7(M9o8xn&-OZdm53FWei*~Mo$Y_P*3Bh@mg<+cmt<>TWN8M~MzgY;a;VWzY zc0{&Idi`+5O@nwr`y;|;eglZ>aXVghd!&n|`Gl&+@~P$Q$wFIol{ps95d3A?H>b))$>6(0x za_;YFVD+*TDv?he;FhgOr~!kBf%|K?W|OvHKczD$aUiIMl?#O0fDp|?a~F3uDj{iD z0*=YFb%oTj;?zLvnhn-0fS%v)+g}i&rP{AqzX4R+F=@s7<(tGHmGAs7jzT(=v>nxN ziG5-iM~jDZ5AGsxYgSCI$TE&T8$_JwO~c`i*8uj&X6j_hp;Jiyx9OmfrDSt~q?%K^*x#qQ53D-|tv%ulHNq%^1R9bKP*n^^w1rVB#BFy{wqtFyVtK*T z{@mgB<%Kd(3KfIV{d+@(n5a&O6jY1yXcgBpIpkmaP{z5YYRw8NcDTr`Z(0DOKh+rR zx++pB1tQ@$z&RI8RdHBs`BH?_2Oy~DkJzvq$FUJ zh{!4tDms;!>3den@~XEBWGpU9=_@@jrG2X9W2J50X|o33-+0-^-z?P_8^|G|0;M-el?zv}p}%9RZ!D8_ z>eSS-MY+!)H^yIuOqgB#=tbQ;dok3G(EX6Pr-rkYrEMccks;PSb$33OhIrMPku!FB z{%hrtHCMXAU<_~Ui0T;?;oztGF|VC0yu z0u5RezGY``#}-lAfE|QE9vIas;*ETSZVzg&9ZANlQYSQ#LpyTZ1lQy8zM5d%0Xs)> z#a!=6Ddkff6dZJ7s0w`*^jlq^#|d}V(O5zJf|s_;bF)mA}5{(lI2)Y1alXJsnS`vYLt!CLdaw9^%Qd73E}L| zI;5I;p$C~U!3%JVn!QB4w_?Rs`KEcc84_KVK;pQr+7eFJB; z1mp#dC>pkh}gXsZb zO*cO3>^~M_7lYE?@8g;k^XGNliq&(=OvkGAV&ejOa%%Q-gbXG)b`hR1H!&MXHZD|7 zpY82Fv(J%P+s!q|gG(uBa@SI;6#jcj;8;aj7hI*n;J(3(HTwGmOL?Uu0LWu7a`a_q z4`8S_WhL|;5&3EvmkQb$B}%K~qYjAtX$L(S`~ljsLmLm(d(!T*GfiXTu|)2#TCBeV zHEbRc@4-k`Ax%*I&Ls8_FODmMSbd0oo>s(E^)_NvJK9{1>H8(gOw^v|@G^dU6)kRL zHItn8OJ~T_6XzRswbXDvH&2IXs|{_B?;p2rZ**6gwPVh5W1>_Nd=8JVHoV`)}t^kO&fLrNH8}6nprk-hhj;OXc`ok>^Dhs&TuLk8>JGBnj2l|6;@f zg~uan_5&|3)3(qQ-M$l71uts!sM4Gjgrp4fwi)_P;FZAy7nUnZ2`&H53)`0~ezh0_ zR|2Qz!cdg-nDPnJalfNyf7a!E@F~M3rvQ&YN_uVcPhqZVl)IrKHsdU*UL%#6(+_&q zK05l8?>JRxPI_kv?bp3^ZDp(1L?GXvpHf9F zT#PXG?6x6kje3mkUzX%)IVvJ~)OQtcw#vG+kQ;+lrU;wh@(iqRsSGUsUjyM(WxPO!oM?_3qOq$2Vj->GT#@$az7@Vxjx!8Tb%FF7hn zH(ruD62;Y;iYkLBDu)QFWTeZ9kq3X7suri~+-et6G&cxJn!g1m@;Jbkf8za7#%3xX z(fum77FIbaZD&bsyjsVb5Kdz~8wGw>cQXEr#SlZj{fb_3<+C6b8L1>zl4z*fZ8BL- z&Cz1$=?`6^5ju@@ua-CJ9}}ZygDQ8u7n6(-td%kQG(U9 z@fj#)Vp+Z@eg0J}yQT5D6~Ym@cW4q7vRz$xSl`a8F8FLL6<){9xiS!( zFqQqG$V(gVfMo*%cgs4*1^p6=!;!4af*Er0UNLJ-RozL^&^pb_HDJjYdCzj{Tyh7k z6y)j|-yue~n1bNO}~jh1QAY-qM|q<^GlafYBi}@*eD>W&v~5QygG3;(N*Q z&m~(m1?7H?{aMQGg+u@TxzCm9wd%Z^koJ!od>G?KLQq54@HnOVbZ9g_YxAT+c#V7K z&^cIBxE4{i@>H9its?2>)}Y(`#VRwG2Mux$jA#+NO8>L{X0rG?$yhdU7~tPuxSVQG&zlR6bq;LnH#zW!#r%N9}%-l)W88d z#ujipO0IA;GEa4gHGii*Fi=9^M(QxbuUL4qCk0}Tj>F;r+h%cuP?Q?><1}cw;{|Ww zGeMBtfHk2*J#DGIg48~1j;g>4bZEphgku})U}j&;`V~lI(Pu)7lFzr(i;^MoP{kOsFEiAq6lla6a71XzTIQ`Y zWZ5Gth%Ew&%84gO4k$=vTIX;|T6LwS6yTU~j{6-^`b1(Ke_oQm&>kg;QRYw72ZE#o zZX}74fhGP8wLggYI_68l6#9R!)H;smf0E{sw0)s@{bIk+zB}#JGFJzEaeQ2qG!k`# z<0`y_;cOYD3?pCFk(gFVPWUnRaHsu;#l6`wVIwFPyBH!U5qYVRj4&AK8&ZeWk&Gmw z)n%=U)){l+F_gp>vWLfk7e@l=No!i>5K8|cgf@UBpDFVcU5-hRHEjwEPD{q5Cce<5A6KuXCyQ3sP!a%XJ2Kw}KnSeJ)% zMbE{*4~u1XH8hxWz=L)(&9dcD3WJe118^g53dD@vu2kw~)UHJ2t!h6;4`5(OyVYPn zHi+Ahy&~FV!WqC-8e7bd>e9OXu{qha6eR1AX=XX@`p!UUKJ zyYruhJO63eZG_?fPs3aFZln9y|J860_n(H0I|;%6KLFgTdpW0Qw{NruIeBA$d2Y<@ z#M7{=rrm`XjX?ACpd8f_@43^G%elUg05?R$WJZ%TSsc%(G*!PW0OUMh?tb&1n+r4C zTE5J24g}EnY_l7w76v*xil0oVT+@7=g=eKM4Jle{ux0j-9IA` z(Ss2JCR ztmK6k>ImmdF<*C3xE@rD(2aP}_-0srIaWuX$C~-;k@#ZGfc5?J1&qG`e8HCi20mRq zN{`03;qCwW!d=uqUjXh)1}TUN(UZjbmqw}o(%AR(%KTN*X9gI(OXUBKig(lV0o4-T zBV3d+N)L)`OzM;>Mp8!-ets(vxr7@Q0dRd#L>57K5|e$8z<@1gV0iSvGEiM0?NJEb zL;ef;aRRFOyT>5~ZM^WOu(ot9!kKTP$+^@$u7t@+#%%nGDDM5ki)oLE@ioR2*nCpO zF4|mjWEN@x0~}tueuNoqQC*rib#cSIRhm3~bSr}yoTZfE!jK_r0ZrT7a*@A@bf1+y zmkV~x$UNF!k$~A_LD9{^98u zmy%j&LmMmbkoD=%-}Ng4oHhn=?hfgG{&mD{PV08X0e^mi);Ujb{QHUXu80fkCk6Z< z!{Fy{hBsa)d~pQb4fhi^wMWN*Scw!LL6Nd?G@=%_vD_#5)sy#^tspCrw3}^-)BX}o? z5<89$Aj%M<@97$t`{@n~HWE5#%k03qt|ce$Ge-!!%IEp^u3KMZu4u;oR59as_rv&1 zKJ4dn%g-fazW9-_=4$OLu*ZeVjkve#(e6rQC(ifIG-`47>@1x;OdDB)$AS3JJ18CI zuw$pCrE$^Ll5%nB4JHP4X{36Mx7a6^*A#(w6KnBX{rvHk}8$Rve^nmdT%{Icq zX3xoSN(CA=lna9#aK*AZm_4{if&CbMvd#y;%ip;%y2iuQp^};{ei|2 zUX!ag^frLbsMkQb#QVB=29ywo0@C)`+Aek_mKIRSxk?FoHeD=!J*6BfivBD=632dM zZ=u5K*I72G`fedMc{umFk7Ics*ud0y9MJ*(lFMGw1xHlx=zF(8nYMShhL!VG>k61Zb zPY~2X&Ou!V6HC+yG3HJf+w4z3bO{x`N|t9w&?RrJutsd1LAf|T>t5Ez#2Qon^bt@Z zc>+{CstAUeM;RWA0}4fAwiux|C}Gxc@U1|z8PW3;!J9dk_E=`Z`V$t#prl3ItlOkh zsvo;})3Ut6UR~}1P%Qy;4lui3{she4;lAj)WA&0ZCD2%YYrt8z15B(|8m+AiX8KF9 zQ-SH7XcWJK7Y(So^Y}u+e5B8B7+$X}C!&M|UL7sZKVwm9yS6q3C6K4bomJfa4oU;+ zVFH#eWqvuttS!ahv zDE#JZg?tV;h#mClc-a#OQn-Zgn%9eOi*KZ!_@lj1d2k2g@?+nwOpsy_Y7Ph6AI?Si zKkY9FPe?C#Z>L%NJLAyiyWD5s&}%p#v{+U{YVUgz`uu)n@Rji=fRB#%h3MXhRs#u# zI{~pKLTziboEFV7Bw#{VW>_9;+73LIQ81h&KK2K9or zRqaHF(X^`<5!F}CF+1}eKz6Cf3rWpVy=jp}ROfu@ZC@0jyap;DyTN1AM~M5|JzMP( zV8|#$@CnacZ6CPK3g)0Mb>ZIG;z8g^Vz@8xb0g;**g@a8Pk-NG4kK392#N8wIrO-l ze=v4K4uw@}Cz%Il{9W1uPJ`j!=+d>s@(0__a#PP4UZ(LF*93k+6~*=}D$MC$=}2xV zu?ek(7Y*7edFz~OXJ*MW=VR&=sfW@4l3m(_0POJCVYpGedWybp#3 zuMmmC69-1<-V-VO1~@-Ah_%-6ON~7A6cy9|qW%5$xl_k++|4YHHznWyBMRT98|}$Q zwA$5S7X?CFq}J%o2YZXp;OHxb)!m)Wcr}=2s1i+Q!qGx$ zj7#NYXiZgy2=Ho{{NRQXolRDY#FyT|XC1gS!Vm5n^$oss*Yh~iH}Xh?LCQK%L#wG3 z{zf#JdB1)%%-)0we#(}Mgb#ujKGUG3_3OZhV{4NT_v)t4Xn?e@^t9u(cWr;dbp?n3 z^1&9Dt>^bdwzswS!*;5rwR!jJWM6ruhwvUk&zO&Z$AIX!$8`~?aRjpavL`ebt8$V~2f>ZX;Z?(4v=djg+$gwXAF^5j-vNj$Lh6?LmFdC43>o#TGhx5P*^%l& ztTjraw3v-ynr;rw{i3L9d;kw?fIZxxG&@kQ01==LB^_yL+ey^gVZiLf8EaH=7or6# z%t5iqhB?7~L)l~p>qwy(urFr>L?(CM*z-?Jr;ORj!&=>Bw6+E7-2^=iBLCT$F5OO3p))**w%D=^iw0G8;8!FoU6BBC#LcS^IbOaj#Acr?0$*)qi8 z?ye+Q9h_oI7hEOog=|I(<(mW_StT6G6TNGt10*Axlko>7>rO-S<9%wU2?--$Vity- zDt6>@rBdVs5fv+_OlI>FLF8JBABOL=(Isw`jYG4JSr{-`A-Bi^Hc9ON=cjnSVHrgE*`?bYePU)Lqh~Ohca^Dw^S(nnnR&V0 z7OIR>%;SA9?BtIC_8(0Qvonf_8a0^jWn_J~X_1YKhKXrjr3Ec`r?E*mUGGDf| z_gYC0+QASkirF%XSuskPj|?69Xt9jQZRO%M)0^*;?X*_VY(i2}j8@CZ;&~EUsRCAO zcyfsxUKTr%nZ|F1m&+2qeiy~BjbIdVu&QMsX=OmC4MH9lbqbSp$+OGjM>MXoy`HqC zFDsJ&_EmXSCtjD!Z7-KzT`0OlWtR|?*1#s!Wg}I|grs1*Kv&dJr#?_^hRwCwa8=Z>mb6SoXWS@i!Xld%s|M2@ z3S%CUU_L6VG@&dv(qIk2WR_A^OeIEE%H~!ivnz3_6|JSnC`wYxZIrRPG>a;A$2Vu(M5ob(Wi#BBnOqN+DGG^yn7Q6qEvn=ygWz0>Wnqd^B%u2~w@Gdh| zm6@OcESF+?{DJ%zRp#ftYV4<(6%rWMo^*Qko>iHsZE zl}EBVyef`GJU|W^k97;86{%q<$yoskZZ05&lRlkCW3Q6%{S-{wf@>MYge4UMhxS`V z5tM!1QLPOV+@`M9XKduiX}39EOHLj}-7sUWsRw71sX{PhlYVPOs>8W2VQU?+y4l|D zVvW*&hrsO~?*BpuUO(maDSA=+0;TNm`h14^<^3S{%FE?GdkY%`X{79qgaca$wYE(1 zP12bXZ$Pf$b>dEH@qvlq(NSH?8v|qCGQTpQ&KL(VcW`8t2k5E7;jOEZ&65n`YHWQ^ zz6xb%k@RK>1M1E z+R9y}Ss=mOd(Eei;Fi!p!aaNTq`hZje#~q5a%+SCofEPsg!&l}LDHzU$}-f!(ON4q z7z_MLFKf?E%!bPB;a`!WUngkn9L&l!E5lc$#x!*@exHV+21{F*y$fYtVdXqN&o#OY z5MLvpYAC^4c^qQCW1Ud7nBM%5iO%D>zZ2z(_M=OKW_=j@G3ONg&KXc>JOr90*3CS^ zQ*rJZb;8+>DNw@s#ychE1l%xIqLG>r-?U}#f%l%SkGR-N`${Lt?SzxHAobvUf_uG> zGO{;%jug_!RG&;@bv_i}>3XR8p#Sk5<31PvbYIuDO&YNz zk2=rng7#uhDRVW?Q@;9m|F;~UjM9W@oZgb9PsRZ82tnNgLxZN5Qds+R@h73$olNHbQrF-C{%v5^_OGz;RKExTx8?Ba*TS z-SD1IplT6OMMu-1fY@Z&`Xho2yyQVzGvf=l@OmC*TDA>~7oMRE{``+exL~2) zkP!m(bB!mAp#Z-M`dE}}f?hAo7{Mg@o#q(9$p%-_wGLa9Yebv?jWFyCPXMcAIk$78 z$u&dx3x+W9e{TJPF-$f_faZ7)>v(5#<73tF>g4&cuWjm~>aK>=HlCC-#GV$zR#kl3 zsO!Ka{UsqAoV}Xsk$H41^_bgKCcmLX;gZqB(o|(-qJmA9t17|1Y$j*bRO+(6AkwLV zu&4_DFJh)Czsi))&A?kmt^j3QRsyYQdf0lU(P5==JzXc~%6J}0>V(ZFwt_WYJ;K^3 z2nVABongZ6oH1)HKWtG-fzNw}(Q3^Udehn@+=e5B*(p*NZLq{Ts(@GPeUee@HuC6l58o?4!tTpQ z2Y(aTK&S(m;t25I>fd-QMBd=;HXygD;3nBZ9ss@Oz2>Aw?33P3WIQzCyLw1)$(+3W=QZVd>PJecPe(7m@^Yp>$4ccDW&%l4{Z0_VH&dCiV^ ztT-Mq4kCBzjkT}52OKIOb%cl!_>gYq>m;#hXezt2#SNo1db86(`q{}8`!@68$q3^u zpE?T7o-wxpm{taR>Che``bC5cD0H>GZsyVdenr4Tom8eT+%7u8VTNNb{f z5EWj`MpsXCpX%v|uwo36<%oK-%AHA6R-HH8kY+Bk!x1WVi?e4;TKC90nnlQ?fMGRo z)Em#*#L*lMcuOO8xe~y4mWMJPg{zjyVhT|o-0;-`nBkITwf~I~9kc~;J)tQ2d2He| zSZL;>!vNC=ohE}oL3B=n%5lPXeW?+WgOWf_;3V(nBIEWcfRdv>0uN$ffb;)N&CeN5 zAAF-3O$vD!M=$1rfM`ZrFqDp@k4za#>l*9Qmts^1CbI%ZbHuMJgGN(UxEMui(AtXR z=t~c|03%!d7m8*SdECsJNxKL+%KS`1`>%!60JgS5k%)({hI6%=stL4jqJ)-nb!*jr z#%GG<8?A$kM*Ztv;@(FJh;)Fmj(qpq|Qu zgy>f?EaWi0DxzVp3RL1`#UMQ}UFf82EfIcS)-#aFxr8L1lW{^$_#$8b*xAvV@gzeM zmfx3sU}43j=gu5KsP8Z#AHVMw+CX9G-5HIM2YtU>Ah>tt-us8I;-$gh1u?^w z<6bs-ix>B!-(X!J_E(4sjCvEb>CV4<(w=&$5`B-MKgyju^~#)n8G{N^C3)p9Q$i(U z^`=fho~6Z<(yW1t--kRN!27o^uQGWp?R%W}t(9SkjHwz$A*L$_nji;vnDm!E=Ojjd zt4UjIr>m=Kq~*z{H|$Nuhc!)YGFnVl3^{6IOsAX&t7Uj3pr<#Y0hahzsBn=G1F6Wy zJ1eKrw#d?2&&EIagR0?a8eg=8S8huMuKvF|t~;pdWed~GrChj_CoOaWgn)EGLeYo@ zkoE{&j6g&{u>c~%rT1cJ0dwhHkQxLGy@(J9Ep(OMdoP0EOVm5_X5PEM-yb_W-|o(y zJ$t^L*>Cnt(@(kX%uU5HV@GsHbIvP+=t&X=5;{t+=OtTg6e7!q1yoiBxOE}24%FMS z6x-ghacoA7pQf9Na7&=!Tz5M8eY5|yQo-uUHROuFGadJNL1UCT%QUt+P0fAarS6VO z-BBmsHI?mI$?GpxSJzjN#r_3RK-sU>w+?y-U7SCwwiK(3j9r79Rj+}w@W7(R(BfzY zIL5;4$cEk#J{JK;0rU4`(6>w`A5ntj6yyTnF=@gsX_N>^oZ*$F0J!P;$AD^U{#bR& zlCbql5~Eb+OqO5-*DuMd#bpgH+V&%Y^h&A5{WYmS}>T3;Y?3t#~*LhIR~ zC4RMW%BKt?n$dG3VWl|&*dHrOQJdNp7{{U+37VQ_ zRSudnF{w)B2w9Cc!rkX5!1%cY11slFE8kQ(`&}?jog#~S+S(Unn?7$dHF}^5HESHB z{LovE7)gY+YBWP~wWw4NMI*Fi2zMl3gLIeJ(0vq30KGy%_tzj&IKH+48{SNBv2FMK zgTwV+StyQs>F;nPC?ASVw%ShezNedjOQ9p!JQRiN;Utc^N#>aPekI3ajCj3YwBvE( zv36gG-J=)~uK?&|gQVxhTsp=Oi=x*!vU`G_CT4bt0LO@#YX!~8p_Pl(;adE}%&hy( zc^k3KCy7rCV$4VnP=JcxZ19druxNN|wYX!=3%f^qmJ{;Tt0_pQp64fkX7S`?%ba5P zMT~U*-5bdl#|;j%JNbJyE6Eg9g-0q zxUG3H7fv~dtY*x6;PX?<;bB~eC%XTz?3$3b$SQ<~euYVp0X}r2KXi{sOxMvpI&i$y zW9cvpkU5;XSU`6qaO-31GYXFMgT?#5b+I%fz9XdvXkc51nW^1X zG9uVGFK463u8|?RrV!Pye6WklNBKn`?9MCI9pBMP(*;(%JE2mxdPE`hmmuim8`(z` zdpKhF4@>BTavdeJT(|oIzaoR?t^#%aLfjZJOhGqkcu!7N?`m*PWyN!7Xw%$fhZh91 zsy!Tr(R%2D6uD;F?dW8XwO047-cKv&dk?&dnV3j4*6NV~S3$cJ^zlfHI4PJ2rZM`$ z5~-9`zOv~s0wzCiG!}!bmgMqmlVP!7G$=tPCtF$Hm-?l15QxKx?^$L0+G^m|VWc*iS2_N;>8{CuFNu_AFPsZyZJr zi0h`PUIrKw=%5M{!}LjN-lkGjSxGOFL^TP@ZxsB?7tx_-;PNE;jjq?J5XRlA2I8Jx zh)j8sZL-Cl$bK8B1HnmE$+Oe#uxeo62O_f}=xu1h8xA|?_euzRaQQoOhhMvD7ERh! zckGI6DMka5rCCU9C?YX{C9z=|nGFZ9&4t;?=Md7gxhofG?XH)rJS=fLf^baCxH~C?W!p*3QuC&*qi_yOh(rF9W>+e0}$<4cKDMWGs70es@DyDTjQ3%2$29ASvQNi%YKrxaFw6Sbna}lm| zx3F@MzG|w(B=ZJ&bO~=nj^X>fUHbsW8b@LROkbkonKfT;@@j~|Up|T4<9RP1Sp?sb zcFpKw2qCV}@ zsqky^-j&*Ito8F%ZIl?^q1nGqx|tt)teWv+YKtL9;W4&{PxBKpw&tu=bfiNadNp^p zusUUf1FCuIHs+0aJ47oC7F}jniZ}cCbz>tYXEFkkW^q*nfk%m0&bNq4-p}!$0}4IV zf2AeS8)!p7v6Zi>)XAx=ycvIW6{egWmGBqN>>kn3n6^O6`z7(c&>vi28WRPs)^@ku zZ69{CBhq9umxLJ)zjU--9na}JsnN;^8+sG&kDiG18GamOY+JNoYH&*i64jp9^(nEl|@E#E5$W=W|3%^?Us)(p2kqW2D>{ zw7HdXQJiq+P5zjQHc2^k*}2abWf_IfL=y2Xm+BOD@e3HkC}g~cRa`D}L}F;ri`@4Q zC3PE@ZrtIu{Bs%QW}@^|u~*?K;Q0d$d0Kr$&~P?wv@~KNoc(-D8l#XSSDQJC@MW35 z`l4lU_T1uRzptJB(cZCs)!}XY8Z7jYUQ`z*Gz^}k7`66Lq&5p(#UK!T+39y&xRm8} zu8+o%;FZ_ckjZgFVMhFAG)!eW1lFb1`P*KbHHzDQTT4+hxgRtIEwhIlGZK4fG$q}A-L~MFa4NrwLxyo+aKVeX}sn;aBGc}kw*Vp+h9ks0ERHr5kx6TNDP@)_!V{)}#RY%Uf(S5=k&e_a+Uw@Pt z?XK`CBIUEW(|~2V4u_`_jskteHewUOrIgfz-c0EYB~s@T;r2+JZ6uM!evunJWg&e> z+%mZbEjcM<>1MJ@hI4+xIV4!qj0D^Mgl*kSoQLktI3~oRN5AihHD*AahxWf?93Aox z>8FO)VM!_w?HHJfxwXG7_Ybg^?FU%?d5{bmJ+a5ej;P?5vr}+$Yu`E>`f!_)rz)1H z?-TPjjF6O#*aU$yKCGhjDCn$EI&$k{CUjS=H$g2|u4L9M+poNNjBmpURF}NKU&_c2 znP7%#H4wNz_$1cOLc^BAh5c*{6O@~d=sr0p9CgucbO^}UioDyEXc*`G>=p|Y&jp;y zH?@!ad$spFMn&7kYT&e%1K;lawj^}u#E*AKb>ZTCIxF=;&{&_6ij(4>Q\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection-ctd) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.\n\r\n1. **Claroty via AMA** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Claroty via Legacy Agent** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Claroty via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.\n\r\n1. **Claroty via AMA** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Claroty via Legacy Agent** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,21 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the data connector for ingesting Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Claroty. You can get Claroty CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for Claroty. You can get Claroty CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the ClarotyEvent Kusto Function alias." + "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." } }, { @@ -80,7 +87,6 @@ } } } - ] }, { @@ -96,7 +102,7 @@ "name": "workbooks-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The workbook installed with the Claroty help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." } }, { @@ -324,7 +330,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for baseline deviation events. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for baseline deviation events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -338,7 +344,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for conflicting assets. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for conflicting assets. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -352,7 +358,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for critical severity events. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for critical severity events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -366,7 +372,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for PLC login security alerts. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for PLC login security alerts. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -380,7 +386,7 @@ "name": "huntingquery5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for login failure events. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for login failure events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -394,7 +400,7 @@ "name": "huntingquery6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for sources of network scans. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for sources of network scans. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -408,7 +414,7 @@ "name": "huntingquery7-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for targets of network scans. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for targets of network scans. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -422,7 +428,7 @@ "name": "huntingquery8-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for unapproved access events. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for unapproved access events. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -436,7 +442,7 @@ "name": "huntingquery9-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for alerts with unresolved status. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for alerts with unresolved status. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] @@ -450,7 +456,7 @@ "name": "huntingquery10-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Query searches for operations with Write and Execute accesses. This hunting query depends on Claroty data connector (ClarotyEvent Parser or Table)" + "text": "Query searches for operations with Write and Execute accesses. This hunting query depends on Claroty ClarotyAma CefAma data connector (ClarotyEvent ClarotyEvent CommonSecurityLog Parser or Table)" } } ] diff --git a/Solutions/Claroty/Package/mainTemplate.json b/Solutions/Claroty/Package/mainTemplate.json index b766e9683f6..e82b4e64b03 100644 --- a/Solutions/Claroty/Package/mainTemplate.json +++ b/Solutions/Claroty/Package/mainTemplate.json @@ -38,12 +38,76 @@ } }, "variables": { - "solutionId": "azuresentinel.azure-sentinel-solution-claroty", - "_solutionId": "[variables('solutionId')]", "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Claroty", - "_solutionVersion": "3.0.1", + "_solutionVersion": "3.0.2", + "solutionId": "azuresentinel.azure-sentinel-solution-claroty", + "_solutionId": "[variables('solutionId')]", + "workbookVersion1": "1.0.0", + "workbookContentId1": "ClarotyWorkbook", + "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','Claroty Data Parser')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Claroty Data Parser')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ClarotyEvent-Parser')))]", + "parserVersion1": "1.0.0", + "parserContentId1": "ClarotyEvent-Parser" + }, + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "6b24f3aa-01db-4d26-9d60-538dd9a56391", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6b24f3aa-01db-4d26-9d60-538dd9a56391')))]" + }, + "huntingQueryObject2": { + "huntingQueryVersion2": "1.0.0", + "_huntingQuerycontentId2": "8038c683-f4dc-481e-94c6-f906d880b0ec", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8038c683-f4dc-481e-94c6-f906d880b0ec')))]" + }, + "huntingQueryObject3": { + "huntingQueryVersion3": "1.0.0", + "_huntingQuerycontentId3": "a81f3a44-049c-409d-8b98-b78aa256dacf", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('a81f3a44-049c-409d-8b98-b78aa256dacf')))]" + }, + "huntingQueryObject4": { + "huntingQueryVersion4": "1.0.0", + "_huntingQuerycontentId4": "15569b45-4c34-4693-bf99-841e76b5da65", + "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('15569b45-4c34-4693-bf99-841e76b5da65')))]" + }, + "huntingQueryObject5": { + "huntingQueryVersion5": "1.0.0", + "_huntingQuerycontentId5": "917364b7-2925-4c5d-a27c-64137a3b75b5", + "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('917364b7-2925-4c5d-a27c-64137a3b75b5')))]" + }, + "huntingQueryObject6": { + "huntingQueryVersion6": "1.0.0", + "_huntingQuerycontentId6": "6c43a50e-2e59-48d9-848b-825f50927bbf", + "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('6c43a50e-2e59-48d9-848b-825f50927bbf')))]" + }, + "huntingQueryObject7": { + "huntingQueryVersion7": "1.0.0", + "_huntingQuerycontentId7": "8e70ddf9-32c3-4acd-9cb9-59570344335e", + "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('8e70ddf9-32c3-4acd-9cb9-59570344335e')))]" + }, + "huntingQueryObject8": { + "huntingQueryVersion8": "1.0.0", + "_huntingQuerycontentId8": "de0fca32-85f3-45df-872e-41e980e5d8d3", + "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('de0fca32-85f3-45df-872e-41e980e5d8d3')))]" + }, + "huntingQueryObject9": { + "huntingQueryVersion9": "1.0.0", + "_huntingQuerycontentId9": "fad6cb81-9a05-4acb-9c5b-a7c62af28034", + "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('fad6cb81-9a05-4acb-9c5b-a7c62af28034')))]" + }, + "huntingQueryObject10": { + "huntingQueryVersion10": "1.0.0", + "_huntingQuerycontentId10": "3882ffbf-6228-4e1f-ab8f-8d79a26da0fb", + "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('3882ffbf-6228-4e1f-ab8f-8d79a26da0fb')))]" + }, "uiConfigId1": "Claroty", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "Claroty", @@ -62,297 +126,122 @@ "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", - "parserName1": "Claroty Data Parser", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", - "parserVersion1": "1.0.0", - "parserContentId1": "ClarotyEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", - "workbookVersion1": "1.0.0", - "workbookContentId1": "ClarotyWorkbook", - "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", - "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", - "_workbookContentId1": "[variables('workbookContentId1')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", - "analyticRuleVersion1": "1.0.1", - "analyticRulecontentId1": "fd6e3416-0421-4166-adb9-186e555a7008", - "_analyticRulecontentId1": "[variables('analyticRulecontentId1')]", - "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId1'))]", - "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId1'))))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId1'),'-', variables('analyticRuleVersion1'))))]", - "analyticRuleVersion2": "1.0.1", - "analyticRulecontentId2": "9a8b4321-e2be-449b-8227-a78227441b2a", - "_analyticRulecontentId2": "[variables('analyticRulecontentId2')]", - "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId2'))]", - "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId2'))))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId2'),'-', variables('analyticRuleVersion2'))))]", - "analyticRuleVersion3": "1.0.1", - "analyticRulecontentId3": "e7dbcbc3-b18f-4635-b27c-718195c369f1", - "_analyticRulecontentId3": "[variables('analyticRulecontentId3')]", - "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId3'))]", - "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId3'))))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId3'),'-', variables('analyticRuleVersion3'))))]", - "analyticRuleVersion4": "1.0.1", - "analyticRulecontentId4": "4b5bb3fc-c690-4f54-9a74-016213d699b4", - "_analyticRulecontentId4": "[variables('analyticRulecontentId4')]", - "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId4'))]", - "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId4'))))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId4'),'-', variables('analyticRuleVersion4'))))]", - "analyticRuleVersion5": "1.0.1", - "analyticRulecontentId5": "1c2310ef-19bf-4caf-b2b0-a4c983932fa5", - "_analyticRulecontentId5": "[variables('analyticRulecontentId5')]", - "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId5'))]", - "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId5'))))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId5'),'-', variables('analyticRuleVersion5'))))]", - "analyticRuleVersion6": "1.0.1", - "analyticRulecontentId6": "6c29b611-ce69-4016-bf99-eca639fee1f5", - "_analyticRulecontentId6": "[variables('analyticRulecontentId6')]", - "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId6'))]", - "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId6'))))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId6'),'-', variables('analyticRuleVersion6'))))]", - "analyticRuleVersion7": "1.0.1", - "analyticRulecontentId7": "3b22ac47-e02c-4599-a37a-57f965de17be", - "_analyticRulecontentId7": "[variables('analyticRulecontentId7')]", - "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId7'))]", - "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId7'))))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId7'),'-', variables('analyticRuleVersion7'))))]", - "analyticRuleVersion8": "1.0.1", - "analyticRulecontentId8": "99ad9f3c-304c-44c5-a61f-3a17f8b58218", - "_analyticRulecontentId8": "[variables('analyticRulecontentId8')]", - "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId8'))]", - "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId8'))))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId8'),'-', variables('analyticRuleVersion8'))))]", - "analyticRuleVersion9": "1.0.1", - "analyticRulecontentId9": "5cf35bad-677f-4c23-8927-1611e7ff6f28", - "_analyticRulecontentId9": "[variables('analyticRulecontentId9')]", - "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId9'))]", - "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId9'))))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId9'),'-', variables('analyticRuleVersion9'))))]", - "analyticRuleVersion10": "1.0.1", - "analyticRulecontentId10": "731e5ac4-7fe1-4b06-9941-532f2e008bb3", - "_analyticRulecontentId10": "[variables('analyticRulecontentId10')]", - "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', variables('analyticRulecontentId10'))]", - "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring(variables('_analyticRulecontentId10'))))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-',variables('_analyticRulecontentId10'),'-', variables('analyticRuleVersion10'))))]", - "huntingQueryVersion1": "1.0.0", - "huntingQuerycontentId1": "6b24f3aa-01db-4d26-9d60-538dd9a56391", - "_huntingQuerycontentId1": "[variables('huntingQuerycontentId1')]", - "huntingQueryId1": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId1'))]", - "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId1'))))]", - "_huntingQuerycontentProductId1": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId1'),'-', variables('huntingQueryVersion1'))))]", - "huntingQueryVersion2": "1.0.0", - "huntingQuerycontentId2": "8038c683-f4dc-481e-94c6-f906d880b0ec", - "_huntingQuerycontentId2": "[variables('huntingQuerycontentId2')]", - "huntingQueryId2": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId2'))]", - "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId2'))))]", - "_huntingQuerycontentProductId2": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId2'),'-', variables('huntingQueryVersion2'))))]", - "huntingQueryVersion3": "1.0.0", - "huntingQuerycontentId3": "a81f3a44-049c-409d-8b98-b78aa256dacf", - "_huntingQuerycontentId3": "[variables('huntingQuerycontentId3')]", - "huntingQueryId3": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId3'))]", - "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId3'))))]", - "_huntingQuerycontentProductId3": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId3'),'-', variables('huntingQueryVersion3'))))]", - "huntingQueryVersion4": "1.0.0", - "huntingQuerycontentId4": "15569b45-4c34-4693-bf99-841e76b5da65", - "_huntingQuerycontentId4": "[variables('huntingQuerycontentId4')]", - "huntingQueryId4": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId4'))]", - "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId4'))))]", - "_huntingQuerycontentProductId4": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId4'),'-', variables('huntingQueryVersion4'))))]", - "huntingQueryVersion5": "1.0.0", - "huntingQuerycontentId5": "917364b7-2925-4c5d-a27c-64137a3b75b5", - "_huntingQuerycontentId5": "[variables('huntingQuerycontentId5')]", - "huntingQueryId5": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId5'))]", - "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId5'))))]", - "_huntingQuerycontentProductId5": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId5'),'-', variables('huntingQueryVersion5'))))]", - "huntingQueryVersion6": "1.0.0", - "huntingQuerycontentId6": "6c43a50e-2e59-48d9-848b-825f50927bbf", - "_huntingQuerycontentId6": "[variables('huntingQuerycontentId6')]", - "huntingQueryId6": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId6'))]", - "huntingQueryTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId6'))))]", - "_huntingQuerycontentProductId6": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId6'),'-', variables('huntingQueryVersion6'))))]", - "huntingQueryVersion7": "1.0.0", - "huntingQuerycontentId7": "8e70ddf9-32c3-4acd-9cb9-59570344335e", - "_huntingQuerycontentId7": "[variables('huntingQuerycontentId7')]", - "huntingQueryId7": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId7'))]", - "huntingQueryTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId7'))))]", - "_huntingQuerycontentProductId7": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId7'),'-', variables('huntingQueryVersion7'))))]", - "huntingQueryVersion8": "1.0.0", - "huntingQuerycontentId8": "de0fca32-85f3-45df-872e-41e980e5d8d3", - "_huntingQuerycontentId8": "[variables('huntingQuerycontentId8')]", - "huntingQueryId8": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId8'))]", - "huntingQueryTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId8'))))]", - "_huntingQuerycontentProductId8": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId8'),'-', variables('huntingQueryVersion8'))))]", - "huntingQueryVersion9": "1.0.0", - "huntingQuerycontentId9": "fad6cb81-9a05-4acb-9c5b-a7c62af28034", - "_huntingQuerycontentId9": "[variables('huntingQuerycontentId9')]", - "huntingQueryId9": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId9'))]", - "huntingQueryTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId9'))))]", - "_huntingQuerycontentProductId9": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId9'),'-', variables('huntingQueryVersion9'))))]", - "huntingQueryVersion10": "1.0.0", - "huntingQuerycontentId10": "3882ffbf-6228-4e1f-ab8f-8d79a26da0fb", - "_huntingQuerycontentId10": "[variables('huntingQuerycontentId10')]", - "huntingQueryId10": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('_huntingQuerycontentId10'))]", - "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring(variables('_huntingQuerycontentId10'))))]", - "_huntingQuerycontentProductId10": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('_huntingQuerycontentId10'),'-', variables('huntingQueryVersion10'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.2", + "_analyticRulecontentId1": "fd6e3416-0421-4166-adb9-186e555a7008", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fd6e3416-0421-4166-adb9-186e555a7008')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fd6e3416-0421-4166-adb9-186e555a7008')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fd6e3416-0421-4166-adb9-186e555a7008','-', '1.0.2')))]" + }, + "analyticRuleObject2": { + "analyticRuleVersion2": "1.0.2", + "_analyticRulecontentId2": "9a8b4321-e2be-449b-8227-a78227441b2a", + "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '9a8b4321-e2be-449b-8227-a78227441b2a')]", + "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('9a8b4321-e2be-449b-8227-a78227441b2a')))]", + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','9a8b4321-e2be-449b-8227-a78227441b2a','-', '1.0.2')))]" + }, + "analyticRuleObject3": { + "analyticRuleVersion3": "1.0.2", + "_analyticRulecontentId3": "e7dbcbc3-b18f-4635-b27c-718195c369f1", + "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'e7dbcbc3-b18f-4635-b27c-718195c369f1')]", + "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('e7dbcbc3-b18f-4635-b27c-718195c369f1')))]", + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','e7dbcbc3-b18f-4635-b27c-718195c369f1','-', '1.0.2')))]" + }, + "analyticRuleObject4": { + "analyticRuleVersion4": "1.0.2", + "_analyticRulecontentId4": "4b5bb3fc-c690-4f54-9a74-016213d699b4", + "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4b5bb3fc-c690-4f54-9a74-016213d699b4')]", + "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4b5bb3fc-c690-4f54-9a74-016213d699b4')))]", + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4b5bb3fc-c690-4f54-9a74-016213d699b4','-', '1.0.2')))]" + }, + "analyticRuleObject5": { + "analyticRuleVersion5": "1.0.2", + "_analyticRulecontentId5": "1c2310ef-19bf-4caf-b2b0-a4c983932fa5", + "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1c2310ef-19bf-4caf-b2b0-a4c983932fa5')]", + "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1c2310ef-19bf-4caf-b2b0-a4c983932fa5')))]", + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1c2310ef-19bf-4caf-b2b0-a4c983932fa5','-', '1.0.2')))]" + }, + "analyticRuleObject6": { + "analyticRuleVersion6": "1.0.2", + "_analyticRulecontentId6": "6c29b611-ce69-4016-bf99-eca639fee1f5", + "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '6c29b611-ce69-4016-bf99-eca639fee1f5')]", + "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('6c29b611-ce69-4016-bf99-eca639fee1f5')))]", + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','6c29b611-ce69-4016-bf99-eca639fee1f5','-', '1.0.2')))]" + }, + "analyticRuleObject7": { + "analyticRuleVersion7": "1.0.2", + "_analyticRulecontentId7": "3b22ac47-e02c-4599-a37a-57f965de17be", + "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '3b22ac47-e02c-4599-a37a-57f965de17be')]", + "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('3b22ac47-e02c-4599-a37a-57f965de17be')))]", + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','3b22ac47-e02c-4599-a37a-57f965de17be','-', '1.0.2')))]" + }, + "analyticRuleObject8": { + "analyticRuleVersion8": "1.0.2", + "_analyticRulecontentId8": "99ad9f3c-304c-44c5-a61f-3a17f8b58218", + "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '99ad9f3c-304c-44c5-a61f-3a17f8b58218')]", + "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('99ad9f3c-304c-44c5-a61f-3a17f8b58218')))]", + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','99ad9f3c-304c-44c5-a61f-3a17f8b58218','-', '1.0.2')))]" + }, + "analyticRuleObject9": { + "analyticRuleVersion9": "1.0.2", + "_analyticRulecontentId9": "5cf35bad-677f-4c23-8927-1611e7ff6f28", + "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '5cf35bad-677f-4c23-8927-1611e7ff6f28')]", + "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('5cf35bad-677f-4c23-8927-1611e7ff6f28')))]", + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','5cf35bad-677f-4c23-8927-1611e7ff6f28','-', '1.0.2')))]" + }, + "analyticRuleObject10": { + "analyticRuleVersion10": "1.0.2", + "_analyticRulecontentId10": "731e5ac4-7fe1-4b06-9941-532f2e008bb3", + "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '731e5ac4-7fe1-4b06-9941-532f2e008bb3')]", + "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('731e5ac4-7fe1-4b06-9941-532f2e008bb3')))]", + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','731e5ac4-7fe1-4b06-9941-532f2e008bb3','-', '1.0.2')))]" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "name": "[variables('workbookTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Claroty data connector with template version 3.0.1", + "description": "ClarotyOverview Workbook with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('workbookVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "Sets the time name for analysis" + }, "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "[Deprecated] Claroty via Legacy Agent", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "ClarotyEvent" - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "ClarotyEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "ClarotyEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - }, - { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." - }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**.", - "title": "2. Configure Claroty to send logs using CEF" - }, - { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " - } - ] - } + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**NOTE**: This data connector depends on a parser based on Kusto Function **ClarotyEvent** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-claroty-parser)\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"cd8447d9-b096-4673-92d8-2a1e8291a125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"description\":\"Sets the time name for analysis\",\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":900000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\",\"size\":0,\"title\":\"Events Over Time\",\"color\":\"green\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"graphSettings\":{\"type\":0}},\"customWidth\":\"60\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"55\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(EventType)\\r\\n| summarize count() by EventType\\r\\n| join kind = inner (ClarotyEvent\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by EventType)\\r\\n on EventType\\r\\n| project-away EventType1, TimeGenerated\",\"size\":3,\"title\":\"Event types\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"EventType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"purple\"}},\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 0\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(DstIpAddr)\\r\\n| summarize dcount(DstIpAddr)\",\"size\":3,\"title\":\"Total Devices\",\"noDataMessage\":\"0\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventOriginalType =~ 'Alert'\\r\\n| summarize dcount(AlertUrl)\",\"size\":3,\"title\":\"Total Alerts\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventOriginalType =~ 'Alert'\\r\\n| where ResolvedAs =~ 'Unresolved'\\r\\n| project-rename AlertTime=EventEndTime\\r\\n| join (ClarotyEvent\\r\\n | where EventOriginalType =~ 'Alert'\\r\\n | where ResolvedAs =~ 'Resolved'\\r\\n | project-rename ResolvedTime=EventEndTime) on AlertUrl\\r\\n| where datetime_diff('day',ResolvedTime,AlertTime) > 0 or datetime_diff('hour',ResolvedTime,AlertTime) > 0 or datetime_diff('minute',ResolvedTime,AlertTime) > 0 or datetime_diff('second',ResolvedTime,AlertTime) > 0\\r\\n| summarize dcount(AlertUrl)\\r\\n\",\"size\":3,\"title\":\"Resolved Alerts\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"}]},\"customWidth\":\"10\",\"name\":\"group - 9\",\"styleSettings\":{\"maxWidth\":\"100\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(SrcIpAddr)\\r\\n| summarize count() by SrcIpAddr\\r\\n| top 10 by count_\",\"size\":3,\"title\":\"Top Sources\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(DstIpAddr)\\r\\n| summarize count() by DstIpAddr\\r\\n| top 10 by count_ \",\"size\":3,\"title\":\"Top Targets\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(CategoryAccess)\\r\\n| where CategoryAccess !in ('None', 'Read')\\r\\n| project Destination=DstIpAddr, Source=SrcIpAddr, CategoryAccess\\r\\n\",\"size\":3,\"title\":\"Write and Execute Operations\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"34\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventOriginalType =~ 'Alert'\\r\\n| order by TimeGenerated\\r\\n| project TimeGenerated, EventType, Target=DstIpAddr, Status=strcat(iff(ResolvedAs =~ 'Resolved', '✅ - Resolved', '❌ - Unresolved')), AlertUrl\",\"size\":0,\"title\":\"Latest Alerts\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":50,\"filter\":true}},\"customWidth\":\"65\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventType has 'Login'\\r\\n| extend User = extract(@\\\"User\\\\s(\\\\S+)\\\\s\\\", 1, tostring(EventMessage))\\r\\n| sort by TimeGenerated desc \\r\\n| project TimeGenerated, User\",\"size\":0,\"title\":\"Latest logins to SRA\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":50,\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"33\"}}],\"fromTemplateId\":\"sentinel-ClarotyWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "description": "@{workbookKey=ClarotyWorkbook; logoFileName=Azure_Sentinel.svg; description=Sets the time name for analysis; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Claroty; templateRelativePath=ClarotyOverview.json; subtitle=; provider=Claroty}.description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", "source": { "kind": "Solution", "name": "Claroty", @@ -367,6 +256,23 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "Claroty", + "kind": "DataConnector" + }, + { + "contentId": "ClarotyAma", + "kind": "DataConnector" + } + ] } } } @@ -377,317 +283,369 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "[Deprecated] Claroty via Legacy Agent", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "name": "[variables('parserObject1').parserTemplateSpecName1]", + "location": "[parameters('workspace-location')]", "dependsOn": [ - "[variables('_dataConnectorId1')]" + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], - "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Deprecated] Claroty via Legacy Agent", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "ClarotyEvent" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "ClarotyEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ + "description": "ClarotyEvent Data Parser with template version 3.0.2", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject1').parserVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ { - "type": "IsConnectedQuery", - "value": [ - "ClarotyEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ + "name": "[variables('parserObject1')._parserName1]", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Claroty Data Parser", + "category": "Microsoft Sentinel Parser", + "functionAlias": "ClarotyEvent", + "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Claroty'\n| extend EventVendor = 'Claroty'\n| extend EventProduct = 'Claroty'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| parse-kv AdditionalExtensions as (cs7Label:string, cs7:string, cs8Label:string, cs8:string, cs9Label:string, cs9:string, cs10Label:string, cs10:string, cat:string) with (pair_delimiter=';', kv_delimiter='=')\n| extend packed2 = pack(cs7Label, cs7\n , cs8Label, cs8\n , cs9Label, cs9\n , cs10Label, cs10)\n| evaluate bag_unpack(packed2)\n| extend EventEndTime = todatetime(ReceiptTime),\n cat = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),cat)\n| project-rename EventProductVersion=DeviceVersion\n , EventSubType=cat\n , EventOriginalType=DeviceEventClassID\n , EventSeverity=LogSeverity\n , EventMessage=Message\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstDvcHostname=DestinationHostName\n , DstUserName=DestinationUserName\n , DvcIpAddr=DeviceAddress\n , DvcHostname=DeviceName\n , DstMacAddr=DestinationMACAddress\n , NetworkApplicationProtocol=Protocol\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , EventId=ExternalID\n , SrcDvcHostname=SourceHostName\n| extend EventType=Activity\n| project-away AdditionalExtensions\n , Activity\n , ReceiptTime\n , DeviceVendor\n , DeviceProduct\n , DeviceCustomNumber1\n , DeviceCustomNumber1Label\n , DeviceCustomNumber2\n , DeviceCustomNumber2Label\n , DeviceCustomNumber3\n , DeviceCustomNumber3Label\n , DeviceCustomString1\n , DeviceCustomString1Label\n , DeviceCustomString2\n , DeviceCustomString2Label\n , DeviceCustomString3\n , DeviceCustomString3Label\n , DeviceCustomString4\n , DeviceCustomString4Label\n , DeviceCustomString5\n , DeviceCustomString5Label\n , DeviceCustomString6\n , DeviceCustomString6Label\n , cs7Label\n , cs7\n , cs8Label\n , cs8\n , cs9Label\n , cs9\n , cs10Label\n , cs10\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", + "dependsOn": [ + "[variables('parserObject1')._parserId1]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Claroty Data Parser')]", + "contentId": "[variables('parserObject1').parserContentId1]", + "kind": "Parser", + "version": "[variables('parserObject1').parserVersion1]", + "source": { + "name": "Claroty", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } } - ] - }, - "instructionSteps": [ + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject1').parserContentId1]", + "contentKind": "Parser", + "displayName": "Claroty Data Parser", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "version": "[variables('parserObject1').parserVersion1]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2022-10-01", + "name": "[variables('parserObject1')._parserName1]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Claroty Data Parser", + "category": "Microsoft Sentinel Parser", + "functionAlias": "ClarotyEvent", + "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Claroty'\n| extend EventVendor = 'Claroty'\n| extend EventProduct = 'Claroty'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| parse-kv AdditionalExtensions as (cs7Label:string, cs7:string, cs8Label:string, cs8:string, cs9Label:string, cs9:string, cs10Label:string, cs10:string, cat:string) with (pair_delimiter=';', kv_delimiter='=')\n| extend packed2 = pack(cs7Label, cs7\n , cs8Label, cs8\n , cs9Label, cs9\n , cs10Label, cs10)\n| evaluate bag_unpack(packed2)\n| extend EventEndTime = todatetime(ReceiptTime),\n cat = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),cat)\n| project-rename EventProductVersion=DeviceVersion\n , EventSubType=cat\n , EventOriginalType=DeviceEventClassID\n , EventSeverity=LogSeverity\n , EventMessage=Message\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstDvcHostname=DestinationHostName\n , DstUserName=DestinationUserName\n , DvcIpAddr=DeviceAddress\n , DvcHostname=DeviceName\n , DstMacAddr=DestinationMACAddress\n , NetworkApplicationProtocol=Protocol\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , EventId=ExternalID\n , SrcDvcHostname=SourceHostName\n| extend EventType=Activity\n| project-away AdditionalExtensions\n , Activity\n , ReceiptTime\n , DeviceVendor\n , DeviceProduct\n , DeviceCustomNumber1\n , DeviceCustomNumber1Label\n , DeviceCustomNumber2\n , DeviceCustomNumber2Label\n , DeviceCustomNumber3\n , DeviceCustomNumber3Label\n , DeviceCustomString1\n , DeviceCustomString1Label\n , DeviceCustomString2\n , DeviceCustomString2Label\n , DeviceCustomString3\n , DeviceCustomString3Label\n , DeviceCustomString4\n , DeviceCustomString4Label\n , DeviceCustomString5\n , DeviceCustomString5Label\n , DeviceCustomString6\n , DeviceCustomString6Label\n , cs7Label\n , cs7\n , cs8Label\n , cs8\n , cs9Label\n , cs9\n , cs10Label\n , cs10\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", + "dependsOn": [ + "[variables('parserObject1')._parserId1]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'Claroty Data Parser')]", + "contentId": "[variables('parserObject1').parserContentId1]", + "kind": "Parser", + "version": "[variables('parserObject1').parserVersion1]", + "source": { + "kind": "Solution", + "name": "Claroty", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "ClarotyBaselineDeviation_HuntingQueries Hunting Query with template version 3.0.2", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "parameters": {}, + "variables": {}, + "resources": [ { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_1", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Claroty - Baseline deviation", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query searches for baseline deviation events." + }, + { + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190" + } + ] + } }, { - "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", - "innerSteps": [ - { - "title": "1.1 Select or create a Linux machine", - "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", + "properties": { + "description": "Claroty Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "source": { + "kind": "Solution", + "name": "Claroty", + "sourceId": "[variables('_solutionId')]" }, - { - "title": "1.2 Install the CEF collector on the Linux machine", - "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run the following command to install and apply the CEF collector:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" } - ], - "title": "1. Linux Syslog agent configuration" - }, - { - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**.", - "title": "2. Configure Claroty to send logs using CEF" - }, + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Baseline deviation", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "ClarotyConflictAssets_HuntingQueries Hunting Query with template version 3.0.2", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", + "parameters": {}, + "variables": {}, + "resources": [ { - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_2", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Claroty - Conflict assets", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has 'New Conflict Asset' or EventType has 'New Conflict Asset'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query searches for conflicting assets." }, - "type": "CopyableLabel" - } - ], - "title": "3. Validate connection" + { + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190" + } + ] + } }, { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "4. Secure your machine " + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]", + "properties": { + "description": "Claroty Hunting Query 2", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]", + "source": { + "kind": "Solution", + "name": "Claroty", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } } - ], - "id": "[variables('_uiConfigId1')]", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Conflict assets", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName2')]", + "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Claroty data connector with template version 3.0.1", + "description": "ClarotyCriticalEvents_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion2')]", + "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_3", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId2')]", - "title": "[Recommended] Claroty via AMA", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false + "eTag": "*", + "displayName": "Claroty - Critical Events", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventSeverity == '5'\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query searches for critical severity events." }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] + { + "name": "tactics", + "value": "InitialAccess" }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - - }, - { - "title": "Step B. Configure Claroty to send logs using CEF", - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**." - - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "2. Secure your machine " - } - ] - } + { + "name": "techniques", + "value": "T1190" + } + ] } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", + "description": "Claroty Hunting Query 3", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]", "source": { "kind": "Solution", "name": "Claroty", @@ -712,198 +670,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId2')]", - "contentKind": "DataConnector", - "displayName": "[Recommended] Claroty via AMA", - "contentProductId": "[variables('_dataConnectorcontentProductId2')]", - "id": "[variables('_dataConnectorcontentProductId2')]", - "version": "[variables('dataConnectorVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId2')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "[Recommended] Claroty via AMA", - "publisher": "Claroty", - "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/secure-remote-access/) events into Microsoft Sentinel.", - "graphQueries": [ - { - "metricName": "Total data received", - "legend": "Claroty", - "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (Claroty)", - "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Top 10 Destinations", - "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" - }, - { - "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", - "instructions": [ - { - "parameters": { - "title": "1. Kindly follow the steps to configure the data connector", - "instructionSteps": [ - { - "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", - "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - - }, - { - "title": "Step B. Configure Claroty to send logs using CEF", - "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**." - - }, - { - "title": "Step C. Validate connection", - "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", - "instructions": [ - { - "parameters": { - "label": "Run the following command to validate your connectivity:", - "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - "type": "InstructionStepsGroup" - } - ] - }, - { - "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", - "title": "2. Secure your machine " - } - ], - "id": "[variables('_uiConfigId2')]", - "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." - } + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Critical Events", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserTemplateSpecName1')]", + "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyEvent Data Parser with template version 3.0.1", + "description": "ClarotyPLCLogins_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", + "type": "Microsoft.OperationalInsights/savedSearches", "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "name": "Claroty_Hunting_Query_4", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Claroty Data Parser", - "category": "Microsoft Sentinel Parser", - "functionAlias": "ClarotyEvent", - "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Claroty'\n| extend EventVendor = 'Claroty'\n| extend EventProduct = 'Claroty'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| parse-kv AdditionalExtensions as (cs7Label:string, cs7:string, cs8Label:string, cs8:string, cs9Label:string, cs9:string, cs10Label:string, cs10:string, cat:string) with (pair_delimiter=';', kv_delimiter='=')\n| extend packed2 = pack(cs7Label, cs7\n , cs8Label, cs8\n , cs9Label, cs9\n , cs10Label, cs10)\n| evaluate bag_unpack(packed2)\n| extend EventEndTime = todatetime(ReceiptTime),\n cat = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),cat)\n| project-rename EventProductVersion=DeviceVersion\n , EventSubType=cat\n , EventOriginalType=DeviceEventClassID\n , EventSeverity=LogSeverity\n , EventMessage=Message\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstDvcHostname=DestinationHostName\n , DstUserName=DestinationUserName\n , DvcIpAddr=DeviceAddress\n , DvcHostname=DeviceName\n , DstMacAddr=DestinationMACAddress\n , NetworkApplicationProtocol=Protocol\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , EventId=ExternalID\n , SrcDvcHostname=SourceHostName\n| extend EventType=Activity\n| project-away AdditionalExtensions\n , Activity\n , ReceiptTime\n , DeviceVendor\n , DeviceProduct\n , DeviceCustomNumber1\n , DeviceCustomNumber1Label\n , DeviceCustomNumber2\n , DeviceCustomNumber2Label\n , DeviceCustomNumber3\n , DeviceCustomNumber3Label\n , DeviceCustomString1\n , DeviceCustomString1Label\n , DeviceCustomString2\n , DeviceCustomString2Label\n , DeviceCustomString3\n , DeviceCustomString3Label\n , DeviceCustomString4\n , DeviceCustomString4Label\n , DeviceCustomString5\n , DeviceCustomString5Label\n , DeviceCustomString6\n , DeviceCustomString6Label\n , cs7Label\n , cs7\n , cs8Label\n , cs8\n , cs9Label\n , cs9\n , cs10Label\n , cs10\n", - "functionParameters": "", + "displayName": "Claroty - PLC logins", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType =~ 'Alert'\n| where EventType has 'Login'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", "version": 2, "tags": [ { "name": "description", - "value": "" + "value": "Query searches for PLC login security alerts." + }, + { + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190" } ] } @@ -911,18 +724,16 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserName1')]" - ], + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]", "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", + "description": "Claroty Hunting Query 4", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]", "source": { - "name": "Claroty", "kind": "Solution", + "name": "Claroty", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -944,108 +755,67 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_parserContentId1')]", - "contentKind": "Parser", - "displayName": "Claroty Data Parser", - "contentProductId": "[variables('_parsercontentProductId1')]", - "id": "[variables('_parsercontentProductId1')]", - "version": "[variables('parserVersion1')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", - "name": "[variables('_parserName1')]", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Claroty Data Parser", - "category": "Microsoft Sentinel Parser", - "functionAlias": "ClarotyEvent", - "query": "CommonSecurityLog\n| where DeviceVendor =~ 'Claroty'\n| extend EventVendor = 'Claroty'\n| extend EventProduct = 'Claroty'\n| extend EventSchemaVersion = 0.2\n| extend EventCount = 1\n| extend DeviceCustomNumber1 = coalesce(column_ifexists(\"FieldDeviceCustomNumber1\", long(null)),DeviceCustomNumber1),\n DeviceCustomNumber2 = coalesce(column_ifexists(\"FieldDeviceCustomNumber2\", long(null)),DeviceCustomNumber2),\n DeviceCustomNumber3 = coalesce(column_ifexists(\"FieldDeviceCustomNumber3\", long(null)),DeviceCustomNumber3),\n ExternalID = coalesce(column_ifexists(\"ExtID\", \"\"),tostring(ExternalID))\n| extend packed = pack(DeviceCustomNumber1Label, DeviceCustomNumber1\n , DeviceCustomNumber2Label, DeviceCustomNumber2\n , DeviceCustomNumber3Label, DeviceCustomNumber3\n , DeviceCustomString1Label, DeviceCustomString1\n , DeviceCustomString2Label, DeviceCustomString2\n , DeviceCustomString3Label, DeviceCustomString3\n , DeviceCustomString4Label, DeviceCustomString4\n , DeviceCustomString5Label, DeviceCustomString5\n , DeviceCustomString6Label, DeviceCustomString6\n , DeviceCustomDate1Label, DeviceCustomDate1\n , DeviceCustomDate2Label, DeviceCustomDate2)\n| evaluate bag_unpack(packed)\n| parse-kv AdditionalExtensions as (cs7Label:string, cs7:string, cs8Label:string, cs8:string, cs9Label:string, cs9:string, cs10Label:string, cs10:string, cat:string) with (pair_delimiter=';', kv_delimiter='=')\n| extend packed2 = pack(cs7Label, cs7\n , cs8Label, cs8\n , cs9Label, cs9\n , cs10Label, cs10)\n| evaluate bag_unpack(packed2)\n| extend EventEndTime = todatetime(ReceiptTime),\n cat = coalesce(column_ifexists(\"DeviceEventCategory\", \"\"),cat)\n| project-rename EventProductVersion=DeviceVersion\n , EventSubType=cat\n , EventOriginalType=DeviceEventClassID\n , EventSeverity=LogSeverity\n , EventMessage=Message\n , DstPortNumber=DestinationPort\n , DstIpAddr=DestinationIP\n , DstDvcHostname=DestinationHostName\n , DstUserName=DestinationUserName\n , DvcIpAddr=DeviceAddress\n , DvcHostname=DeviceName\n , DstMacAddr=DestinationMACAddress\n , NetworkApplicationProtocol=Protocol\n , SrcPortNumber=SourcePort\n , SrcIpAddr=SourceIP\n , SrcMacAddr=SourceMACAddress\n , EventId=ExternalID\n , SrcDvcHostname=SourceHostName\n| extend EventType=Activity\n| project-away AdditionalExtensions\n , Activity\n , ReceiptTime\n , DeviceVendor\n , DeviceProduct\n , DeviceCustomNumber1\n , DeviceCustomNumber1Label\n , DeviceCustomNumber2\n , DeviceCustomNumber2Label\n , DeviceCustomNumber3\n , DeviceCustomNumber3Label\n , DeviceCustomString1\n , DeviceCustomString1Label\n , DeviceCustomString2\n , DeviceCustomString2Label\n , DeviceCustomString3\n , DeviceCustomString3Label\n , DeviceCustomString4\n , DeviceCustomString4Label\n , DeviceCustomString5\n , DeviceCustomString5Label\n , DeviceCustomString6\n , DeviceCustomString6Label\n , cs7Label\n , cs7\n , cs8Label\n , cs8\n , cs9Label\n , cs9\n , cs10Label\n , cs10\n", - "functionParameters": "", - "version": 2, - "tags": [ - { - "name": "description", - "value": "" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", - "dependsOn": [ - "[variables('_parserId1')]" - ], - "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", - "kind": "Parser", - "version": "[variables('parserVersion1')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - PLC logins", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('workbookTemplateSpecName1')]", + "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyOverviewWorkbook Workbook with template version 3.0.1", + "description": "ClarotySRAFailedLogins_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('workbookVersion1')]", + "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.Insights/workbooks", - "name": "[variables('workbookContentId1')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_5", "location": "[parameters('workspace-location')]", - "kind": "shared", - "apiVersion": "2021-08-01", - "metadata": { - "description": "Sets the time name for analysis" - }, - "properties": { - "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"**NOTE**: This data connector depends on a parser based on Kusto Function **ClarotyEvent** to work as expected. [Follow steps to get this Kusto Function](https://aka.ms/sentinel-claroty-parser)\"},\"name\":\"text - 8\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"cd8447d9-b096-4673-92d8-2a1e8291a125\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"type\":4,\"description\":\"Sets the time name for analysis\",\"value\":{\"durationMs\":7776000000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":900000},{\"durationMs\":3600000},{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}]},\"timeContext\":{\"durationMs\":86400000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters - 11\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| make-series TotalEvents = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain};\",\"size\":0,\"title\":\"Events Over Time\",\"color\":\"green\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"graphSettings\":{\"type\":0}},\"customWidth\":\"60\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"55\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(EventType)\\r\\n| summarize count() by EventType\\r\\n| join kind = inner (ClarotyEvent\\r\\n | make-series Trend = count() default = 0 on TimeGenerated from {TimeRange:start} to {TimeRange:end} step {TimeRange:grain} by EventType)\\r\\n on EventType\\r\\n| project-away EventType1, TimeGenerated\",\"size\":3,\"title\":\"Event types\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"EventType\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"count_\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":3,\"maximumFractionDigits\":2}}},\"secondaryContent\":{\"columnMatch\":\"Trend\",\"formatter\":9,\"formatOptions\":{\"palette\":\"purple\"}},\"showBorder\":false}},\"customWidth\":\"30\",\"name\":\"query - 0\",\"styleSettings\":{\"maxWidth\":\"30\"}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(DstIpAddr)\\r\\n| summarize dcount(DstIpAddr)\",\"size\":3,\"title\":\"Total Devices\",\"noDataMessage\":\"0\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventOriginalType =~ 'Alert'\\r\\n| summarize dcount(AlertUrl)\",\"size\":3,\"title\":\"Total Alerts\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 1\"},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventOriginalType =~ 'Alert'\\r\\n| where ResolvedAs =~ 'Unresolved'\\r\\n| project-rename AlertTime=EventEndTime\\r\\n| join (ClarotyEvent\\r\\n | where EventOriginalType =~ 'Alert'\\r\\n | where ResolvedAs =~ 'Resolved'\\r\\n | project-rename ResolvedTime=EventEndTime) on AlertUrl\\r\\n| where datetime_diff('day',ResolvedTime,AlertTime) > 0 or datetime_diff('hour',ResolvedTime,AlertTime) > 0 or datetime_diff('minute',ResolvedTime,AlertTime) > 0 or datetime_diff('second',ResolvedTime,AlertTime) > 0\\r\\n| summarize dcount(AlertUrl)\\r\\n\",\"size\":3,\"title\":\"Resolved Alerts\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"card\",\"textSettings\":{\"style\":\"bignumber\"}},\"name\":\"query - 0\"}]},\"name\":\"group - 2\"}]},\"customWidth\":\"10\",\"name\":\"group - 9\",\"styleSettings\":{\"maxWidth\":\"100\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(SrcIpAddr)\\r\\n| summarize count() by SrcIpAddr\\r\\n| top 10 by count_\",\"size\":3,\"title\":\"Top Sources\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"customWidth\":\"33\",\"name\":\"query - 3\",\"styleSettings\":{\"margin\":\"10\",\"padding\":\"10\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(DstIpAddr)\\r\\n| summarize count() by DstIpAddr\\r\\n| top 10 by count_ \",\"size\":3,\"title\":\"Top Targets\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"gridSettings\":{\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]},\"customWidth\":\"33\",\"name\":\"query - 2\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where isnotempty(CategoryAccess)\\r\\n| where CategoryAccess !in ('None', 'Read')\\r\\n| project Destination=DstIpAddr, Source=SrcIpAddr, CategoryAccess\\r\\n\",\"size\":3,\"title\":\"Write and Execute Operations\",\"timeContext\":{\"durationMs\":7776000000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"34\",\"name\":\"query - 1\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventOriginalType =~ 'Alert'\\r\\n| order by TimeGenerated\\r\\n| project TimeGenerated, EventType, Target=DstIpAddr, Status=strcat(iff(ResolvedAs =~ 'Resolved', '✅ - Resolved', '❌ - Unresolved')), AlertUrl\",\"size\":0,\"title\":\"Latest Alerts\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"rowLimit\":50,\"filter\":true}},\"customWidth\":\"65\",\"name\":\"query - 8\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ClarotyEvent\\r\\n| where EventType has 'Login'\\r\\n| extend User = extract(@\\\"User\\\\s(\\\\S+)\\\\s\\\", 1, tostring(EventMessage))\\r\\n| sort by TimeGenerated desc \\r\\n| project TimeGenerated, User\",\"size\":0,\"title\":\"Latest logins to SRA\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"gridSettings\":{\"rowLimit\":50,\"filter\":true}},\"customWidth\":\"35\",\"name\":\"query - 12\",\"styleSettings\":{\"maxWidth\":\"33\"}}],\"fromTemplateId\":\"sentinel-ClarotyWorkbook\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", - "version": "1.0", - "sourceId": "[variables('workspaceResourceId')]", - "category": "sentinel" + "properties": { + "eTag": "*", + "displayName": "Claroty - User failed logins", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by SrcUsername\n| extend AccountCustomEntity = SrcUsername\n", + "version": 2, + "tags": [ + { + "name": "description", + "value": "Query searches for login failure events." + }, + { + "name": "tactics", + "value": "InitialAccess" + }, + { + "name": "techniques", + "value": "T1190" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]", "properties": { - "description": "@{workbookKey=ClarotyWorkbook; logoFileName=Azure_Sentinel.svg; description=Sets the time name for analysis; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Claroty; templateRelativePath=ClarotyOverview.json; subtitle=; provider=Claroty}.description", - "parentId": "[variables('workbookId1')]", - "contentId": "[variables('_workbookContentId1')]", - "kind": "Workbook", - "version": "[variables('workbookVersion1')]", + "description": "Claroty Hunting Query 5", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject5').huntingQueryVersion5]", "source": { "kind": "Solution", "name": "Claroty", @@ -1060,23 +830,6 @@ "email": "support@microsoft.com", "tier": "Microsoft", "link": "https://support.microsoft.com" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "contentId": "CommonSecurityLog", - "kind": "DataType" - }, - { - "contentId": "Claroty", - "kind": "DataConnector" - }, - { - "contentId": "ClarotyAma", - "kind": "DataConnector" - } - ] } } } @@ -1087,78 +840,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_workbookContentId1')]", - "contentKind": "Workbook", - "displayName": "[parameters('workbook1-name')]", - "contentProductId": "[variables('_workbookcontentProductId1')]", - "id": "[variables('_workbookcontentProductId1')]", - "version": "[variables('workbookVersion1')]" + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - User failed logins", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName1')]", + "name": "[variables('huntingQueryObject6').huntingQueryTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyAssetDown_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyScanSources_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion1')]", + "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId1')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_6", "location": "[parameters('workspace-location')]", "properties": { - "description": "Triggers asset is down.", - "displayName": "Claroty - Asset Down", - "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'Asset Down' or EventType has 'Asset Down'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "Claroty - Network scan sources", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has_any ('Network Scan', 'TCP Scan', 'UDP Scan') or EventType has_any ('Network Scan', 'TCP Scan', 'UDP Scan')\n| project TimeGenerated, SrcIpAddr\n| extend IPCustomEntity = SrcIpAddr\n", + "version": 2, + "tags": [ { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "name": "description", + "value": "Query searches for sources of network scans." }, { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "Impact" - ], - "techniques": [ - "T1529" - ], - "entityMappings": [ + "name": "tactics", + "value": "InitialAccess" + }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "techniques", + "value": "T1190" } ] } @@ -1166,13 +894,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 1", - "parentId": "[variables('analyticRuleId1')]", - "contentId": "[variables('_analyticRulecontentId1')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion1')]", + "description": "Claroty Hunting Query 6", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject6')._huntingQuerycontentId6)]", + "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject6').huntingQueryVersion6]", "source": { "kind": "Solution", "name": "Claroty", @@ -1197,78 +925,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId1')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Asset Down", - "contentProductId": "[variables('_analyticRulecontentProductId1')]", - "id": "[variables('_analyticRulecontentProductId1')]", - "version": "[variables('analyticRuleVersion1')]" + "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Network scan sources", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject6')._huntingQuerycontentId6,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName2')]", + "name": "[variables('huntingQueryObject7').huntingQueryTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyCriticalBaselineDeviation_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyScantargets_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion2')]", + "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId2')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_7", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects when critical deviation from baseline occurs.", - "displayName": "Claroty - Critical baseline deviation", - "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'\n| where EventSeverity == '5'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "Claroty - Network scan targets", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has_any ('Network Scan', 'TCP Scan', 'UDP Scan') or EventType has_any ('Network Scan', 'TCP Scan', 'UDP Scan')\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "name": "description", + "value": "Query searches for targets of network scans." }, { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "Impact" - ], - "techniques": [ - "T1529" - ], - "entityMappings": [ + "name": "tactics", + "value": "InitialAccess" + }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" + "name": "techniques", + "value": "T1190" } ] } @@ -1276,13 +979,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId2'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 2", - "parentId": "[variables('analyticRuleId2')]", - "contentId": "[variables('_analyticRulecontentId2')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion2')]", + "description": "Claroty Hunting Query 7", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject7')._huntingQuerycontentId7)]", + "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject7').huntingQueryVersion7]", "source": { "kind": "Solution", "name": "Claroty", @@ -1307,79 +1010,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId2')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Critical baseline deviation", - "contentProductId": "[variables('_analyticRulecontentProductId2')]", - "id": "[variables('_analyticRulecontentProductId2')]", - "version": "[variables('analyticRuleVersion2')]" + "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Network scan targets", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject7')._huntingQuerycontentId7,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName3')]", + "name": "[variables('huntingQueryObject8').huntingQueryTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyLoginToUncommonSite_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyUnapprovedAccess_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion3')]", + "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId3')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_8", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects user login to uncommon location.", - "displayName": "Claroty - Login to uncommon location", - "enabled": false, - "query": "let usr_sites = ClarotyEvent\n| where TimeGenerated > ago(14d)\n| where EventType has 'Login to SRA succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\slogged', 1, EventMessage)\n| summarize all_loc = makeset(tostring(Site)) by SrcUsername\n| extend k = 1;\nClarotyEvent\n| where EventType has 'Login to SRA succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\slogged', 1, EventMessage)\n| extend k = 1\n| join kind=innerunique (usr_sites) on k\n| where all_loc !contains Site\n| extend SrcIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "P14D", - "severity": "Medium", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "Claroty - Unapproved access", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventSeverity =~ 'Unapproved'\n| where isnotempty(CategoryAccess)\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "name": "description", + "value": "Query searches for unapproved access events." }, { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "tactics", + "value": "InitialAccess" + }, { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "SrcIpAddr" - } - ], - "entityType": "IP" + "name": "techniques", + "value": "T1190" } ] } @@ -1387,13 +1064,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 3", - "parentId": "[variables('analyticRuleId3')]", - "contentId": "[variables('_analyticRulecontentId3')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion3')]", + "description": "Claroty Hunting Query 8", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject8')._huntingQuerycontentId8)]", + "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject8').huntingQueryVersion8]", "source": { "kind": "Solution", "name": "Claroty", @@ -1418,79 +1095,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId3')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Login to uncommon location", - "contentProductId": "[variables('_analyticRulecontentProductId3')]", - "id": "[variables('_analyticRulecontentProductId3')]", - "version": "[variables('analyticRuleVersion3')]" + "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Unapproved access", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject8')._huntingQuerycontentId8,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName4')]", + "name": "[variables('huntingQueryObject9').huntingQueryTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyMultipleFailedLogin_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyUnresolvedAlerts_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion4')]", + "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId4')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_9", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects multiple failed logins by same user.", - "displayName": "Claroty - Multiple failed logins by user", - "enabled": false, - "query": "let threshold = 5;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by SrcUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = SrcUsername\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "Claroty - Unresolved alerts", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType =~ 'Alert'\n| where ResolvedAs =~ 'Unresolved'\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "name": "description", + "value": "Query searches for alerts with unresolved status." }, { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "tactics", + "value": "InitialAccess" + }, { - "fieldMappings": [ - { - "identifier": "Name", - "columnName": "AccountCustomEntity" - } - ], - "entityType": "Account" + "name": "techniques", + "value": "T1190" } ] } @@ -1498,13 +1149,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 4", - "parentId": "[variables('analyticRuleId4')]", - "contentId": "[variables('_analyticRulecontentId4')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion4')]", + "description": "Claroty Hunting Query 9", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject9')._huntingQuerycontentId9)]", + "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject9').huntingQueryVersion9]", "source": { "kind": "Solution", "name": "Claroty", @@ -1529,79 +1180,53 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId4')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Multiple failed logins by user", - "contentProductId": "[variables('_analyticRulecontentProductId4')]", - "id": "[variables('_analyticRulecontentProductId4')]", - "version": "[variables('analyticRuleVersion4')]" + "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Unresolved alerts", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject9')._huntingQuerycontentId9,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName5')]", + "name": "[variables('huntingQueryObject10').huntingQueryTemplateSpecName10]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyMultipleFailedLoginsSameDst_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyWriteExecuteOperations_HuntingQueries Hunting Query with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion5')]", + "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId5')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2022-10-01", + "name": "Claroty_Hunting_Query_10", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects multiple failed logins to same destinations.", - "displayName": "Claroty - Multiple failed logins to same destinations", - "enabled": false, - "query": "let threshold = 10;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by Site, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend SGCustomEntity = Site\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ + "eTag": "*", + "displayName": "Claroty - Write and Execute operations", + "category": "Hunting Queries", + "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(CategoryAccess)\n| where CategoryAccess != 'Read'\n| extend IPCustomEntity = DstIpAddr\n", + "version": 2, + "tags": [ { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "name": "description", + "value": "Query searches for operations with Write and Execute accesses." }, { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ + "name": "tactics", + "value": "InitialAccess" + }, { - "fieldMappings": [ - { - "identifier": "DistinguishedName", - "columnName": "SGCustomEntity" - } - ], - "entityType": "SecurityGroup" + "name": "techniques", + "value": "T1190" } ] } @@ -1609,13 +1234,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 5", - "parentId": "[variables('analyticRuleId5')]", - "contentId": "[variables('_analyticRulecontentId5')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion5')]", + "description": "Claroty Hunting Query 10", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject10')._huntingQuerycontentId10)]", + "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", + "kind": "HuntingQuery", + "version": "[variables('huntingQueryObject10').huntingQueryVersion10]", "source": { "kind": "Solution", "name": "Claroty", @@ -1640,93 +1265,166 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId5')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Multiple failed logins to same destinations", - "contentProductId": "[variables('_analyticRulecontentProductId5')]", - "id": "[variables('_analyticRulecontentProductId5')]", - "version": "[variables('analyticRuleVersion5')]" + "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", + "contentKind": "HuntingQuery", + "displayName": "Claroty - Write and Execute operations", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject10')._huntingQuerycontentId10,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName6')]", + "name": "[variables('dataConnectorTemplateSpecName1')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyNewAsset_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "Claroty data connector with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion6')]", + "contentVersion": "[variables('dataConnectorVersion1')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId6')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", + "kind": "GenericUI", "properties": { - "description": "Triggers when a new asset has been added into the environment.", - "displayName": "Claroty - New Asset", - "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'New Asset' or EventType has 'New Asset'\n| extend IPCustomEntity = SrcIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "[Deprecated] Claroty via Legacy Agent", + "publisher": "Claroty", + "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Claroty", + "baseQuery": "ClarotyEvent" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (Claroty)", + "lastDataReceivedQuery": "ClarotyEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "ClarotyEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false }, - { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "InitialAccess" - ], - "techniques": [ - "T1190", - "T1133" - ], - "entityMappings": [ - { - "fieldMappings": [ + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, { - "identifier": "Address", - "columnName": "IPCustomEntity" + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } } - ], - "entityType": "IP" - } - ] + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." + }, + { + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "innerSteps": [ + { + "title": "1.1 Select or create a Linux machine", + "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + }, + { + "title": "1.2 Install the CEF collector on the Linux machine", + "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run the following command to install and apply the CEF collector:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "1. Linux Syslog agent configuration" + }, + { + "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**.", + "title": "2. Configure Claroty to send logs using CEF" + }, + { + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "3. Validate connection" + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "4. Secure your machine " + } + ] + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId6'),'/'))))]", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 6", - "parentId": "[variables('analyticRuleId6')]", - "contentId": "[variables('_analyticRulecontentId6')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion6')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Claroty", @@ -1751,92 +1449,315 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId6')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - New Asset", - "contentProductId": "[variables('_analyticRulecontentProductId6')]", - "id": "[variables('_analyticRulecontentProductId6')]", - "version": "[variables('analyticRuleVersion6')]" + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Claroty via Legacy Agent", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", + "source": { + "kind": "Solution", + "name": "Claroty", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Deprecated] Claroty via Legacy Agent", + "publisher": "Claroty", + "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Claroty", + "baseQuery": "ClarotyEvent" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (Claroty)", + "lastDataReceivedQuery": "ClarotyEvent\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "ClarotyEvent\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." + }, + { + "description": "Install and configure the Linux agent to collect your Common Event Format (CEF) Syslog messages and forward them to Microsoft Sentinel.\n\n> Notice that the data from all regions will be stored in the selected workspace", + "innerSteps": [ + { + "title": "1.1 Select or create a Linux machine", + "description": "Select or create a Linux machine that Microsoft Sentinel will use as the proxy between your security solution and Microsoft Sentinel this machine can be on your on-prem environment, Azure or other clouds." + }, + { + "title": "1.2 Install the CEF collector on the Linux machine", + "description": "Install the Microsoft Monitoring Agent on your Linux machine and configure the machine to listen on the necessary port and forward messages to your Microsoft Sentinel workspace. The CEF collector collects CEF messages on port 514 TCP.\n\n> 1. Make sure that you have Python on your machine using the following command: python -version.\n\n> 2. You must have elevated permissions (sudo) on your machine.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run the following command to install and apply the CEF collector:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py&&sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "1. Linux Syslog agent configuration" + }, + { + "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**.", + "title": "2. Configure Claroty to send logs using CEF" + }, + { + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\n>It may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n> 1. Make sure that you have Python on your machine using the following command: python -version\n\n>2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py&&sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "3. Validate connection" + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "4. Secure your machine " + } + ], + "id": "[variables('_uiConfigId1')]", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName7')]", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyPolicyViolation_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "Claroty data connector with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion7')]", + "contentVersion": "[variables('dataConnectorVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId7')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", + "kind": "GenericUI", "properties": { - "description": "Detects policy violations.", - "displayName": "Claroty - Policy violation", - "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'Policy Violation' or EventType has 'Policy Violation'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" + "connectorUiConfig": { + "id": "[variables('_uiConfigId2')]", + "title": "[Deprecated] Claroty via AMA", + "publisher": "Claroty", + "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", + "graphQueries": [ + { + "metricName": "Total data received", + "legend": "Claroty", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (Claroty)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false }, - { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "Discovery" - ], - "techniques": [ - "T1018" - ], - "entityMappings": [ - { - "fieldMappings": [ + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, { - "identifier": "Address", - "columnName": "IPCustomEntity" + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } } ], - "entityType": "IP" - } - ] + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + }, + { + "title": "Step B. Configure Claroty to send logs using CEF", + "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**." + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" + } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " + } + ] + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId7'),'/'))))]", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "properties": { - "description": "Claroty Analytics Rule 7", - "parentId": "[variables('analyticRuleId7')]", - "contentId": "[variables('_analyticRulecontentId7')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion7')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", "source": { "kind": "Solution", "name": "Claroty", @@ -1861,151 +1782,190 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId7')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Policy violation", - "contentProductId": "[variables('_analyticRulecontentProductId7')]", - "id": "[variables('_analyticRulecontentProductId7')]", - "version": "[variables('analyticRuleVersion7')]" + "contentId": "[variables('_dataConnectorContentId2')]", + "contentKind": "DataConnector", + "displayName": "[Deprecated] Claroty via AMA", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName8')]", - "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + "[variables('_dataConnectorId2')]" ], + "location": "[parameters('workspace-location')]", "properties": { - "description": "ClarotySuspiciousActivity_AnalyticalRules Analytics Rule with template version 3.0.1", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion8')]", - "parameters": {}, - "variables": {}, - "resources": [ + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion2')]", + "source": { + "kind": "Solution", + "name": "Claroty", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Microsoft", + "email": "[variables('_email')]" + }, + "support": { + "name": "Microsoft Corporation", + "email": "support@microsoft.com", + "tier": "Microsoft", + "link": "https://support.microsoft.com" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "[Deprecated] Claroty via AMA", + "publisher": "Claroty", + "descriptionMarkdown": "The [Claroty](https://claroty.com/) data connector provides the capability to ingest [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.", + "graphQueries": [ { - "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId8')]", - "apiVersion": "2022-04-01-preview", - "kind": "Scheduled", - "location": "[parameters('workspace-location')]", - "properties": { - "description": "Detects suspicious behavior that is generally indicative of malware.", - "displayName": "Claroty - Suspicious activity", - "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'Suspicious Activity' or EventType has 'Suspicious Activity'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "queryFrequency": "PT1H", - "queryPeriod": "PT1H", - "severity": "High", - "suppressionDuration": "PT1H", - "suppressionEnabled": false, - "triggerOperator": "GreaterThan", - "triggerThreshold": 0, - "status": "Available", - "requiredDataConnectors": [ - { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "Claroty" - }, - { - "dataTypes": [ - "ClarotyEvent" - ], - "connectorId": "ClarotyAma" - } - ], - "tactics": [ - "Discovery" - ], - "techniques": [ - "T1018" - ], - "entityMappings": [ - { - "fieldMappings": [ - { - "identifier": "Address", - "columnName": "IPCustomEntity" - } - ], - "entityType": "IP" - } - ] + "metricName": "Total data received", + "legend": "Claroty", + "baseQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (Claroty)", + "lastDataReceivedQuery": "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n |where DeviceVendor =~ 'Claroty'\n |extend sent_by_ama = column_ifexists('CollectorHostName','')\n |where isnotempty(sent_by_ama)\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Top 10 Destinations", + "query": "ClarotyEvent\n | where isnotempty(DstIpAddr)\n | summarize count() by DstIpAddr\n | top 10 by count_" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } } - }, + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://docs.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install?tabs=ARMAgentPowerShell,PowerShellWindows,PowerShellWindowsArc,CLIWindows,CLIWindowsArc)" + }, + { + "description": "Common Event Format (CEF) via AMA and Syslog via AMA data connectors must be installed [Learn more](https://learn.microsoft.com/azure/sentinel/connect-cef-ama#open-the-connector-page-and-create-the-dcr)" + } + ] + }, + "instructionSteps": [ { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId8'),'/'))))]", - "properties": { - "description": "Claroty Analytics Rule 8", - "parentId": "[variables('analyticRuleId8')]", - "contentId": "[variables('_analyticRulecontentId8')]", - "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion8')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" + "description": ">**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution.", + "instructions": [ + { + "parameters": { + "title": "1. Kindly follow the steps to configure the data connector", + "instructionSteps": [ + { + "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", + "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" + }, + { + "title": "Step B. Configure Claroty to send logs using CEF", + "description": "Configure log forwarding using CEF:\n\n1. Navigate to the **Syslog** section of the Configuration menu.\n\n2. Select **+Add**.\n\n3. In the **Add New Syslog Dialog** specify Remote Server **IP**, **Port**, **Protocol** and select **Message Format** - **CEF**.\n\n4. Choose **Save** to exit the **Add Syslog dialog**." + }, + { + "title": "Step C. Validate connection", + "description": "Follow the instructions to validate your connectivity:\n\nOpen Log Analytics to check if the logs are received using the CommonSecurityLog schema.\n\nIt may take about 20 minutes until the connection streams data to your workspace.\n\nIf the logs are not received, run the following connectivity validation script:\n\n 1. Make sure that you have Python on your machine using the following command: python -version\n\n2. You must have elevated permissions (sudo) on your machine", + "instructions": [ + { + "parameters": { + "label": "Run the following command to validate your connectivity:", + "value": "sudo wget -O Sentinel_AMA_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/Syslog/Sentinel_AMA_troubleshoot.py&&sudo python Sentinel_AMA_troubleshoot.py --cef" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + "type": "InstructionStepsGroup" } - } + ] + }, + { + "description": "Make sure to configure the machine's security according to your organization's security policy\n\n\n[Learn more >](https://aka.ms/SecureCEF)", + "title": "2. Secure your machine " } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId8')]", - "contentKind": "AnalyticsRule", - "displayName": "Claroty - Suspicious activity", - "contentProductId": "[variables('_analyticRulecontentProductId8')]", - "id": "[variables('_analyticRulecontentProductId8')]", - "version": "[variables('analyticRuleVersion8')]" + ], + "id": "[variables('_uiConfigId2')]", + "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**ClarotyEvent**](https://aka.ms/sentinel-claroty-parser) which is deployed with the Microsoft Sentinel Solution." + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName9')]", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotySuspiciousFileTransfer_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyAssetDown_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion9')]", + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId9')]", - "apiVersion": "2022-04-01-preview", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects suspicious file transfer activity.", - "displayName": "Claroty - Suspicious file transfer", + "description": "Triggers asset is down.", + "displayName": "Claroty - Asset Down", "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'Suspicious File Transfer' or EventType has 'Suspicious File Transfer'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "query": "ClarotyEvent\n| where EventOriginalType has 'Asset Down' or EventType has 'Asset Down'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -2016,33 +1976,39 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Claroty", "dataTypes": [ "ClarotyEvent" - ], - "connectorId": "Claroty" + ] }, { + "connectorId": "ClarotyAma", "dataTypes": [ "ClarotyEvent" - ], - "connectorId": "ClarotyAma" + ] + }, + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] } ], "tactics": [ - "Discovery" + "Impact" ], "techniques": [ - "T1018" + "T1529" ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPCustomEntity" + "columnName": "IPCustomEntity", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -2050,13 +2016,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { - "description": "Claroty Analytics Rule 9", - "parentId": "[variables('analyticRuleId9')]", - "contentId": "[variables('_analyticRulecontentId9')]", + "description": "Claroty Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion9')]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { "kind": "Solution", "name": "Claroty", @@ -2081,41 +2047,41 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId9')]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", "contentKind": "AnalyticsRule", - "displayName": "Claroty - Suspicious file transfer", - "contentProductId": "[variables('_analyticRulecontentProductId9')]", - "id": "[variables('_analyticRulecontentProductId9')]", - "version": "[variables('analyticRuleVersion9')]" + "displayName": "Claroty - Asset Down", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('analyticRuleTemplateSpecName10')]", + "name": "[variables('analyticRuleObject2').analyticRuleTemplateSpecName2]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyTreat_AnalyticalRules Analytics Rule with template version 3.0.1", + "description": "ClarotyCriticalBaselineDeviation_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('analyticRuleVersion10')]", + "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", "parameters": {}, "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "[variables('analyticRulecontentId10')]", - "apiVersion": "2022-04-01-preview", + "name": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "apiVersion": "2023-02-01-preview", "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects Collection of known malware commands and control servers.", - "displayName": "Claroty - Treat detected", + "description": "Detects when critical deviation from baseline occurs.", + "displayName": "Claroty - Critical baseline deviation", "enabled": false, - "query": "ClarotyEvent\n| where EventOriginalType has 'Treat' or EventType has 'Treat'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "query": "ClarotyEvent\n| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'\n| where EventSeverity == '5'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -2126,33 +2092,39 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "Claroty", "dataTypes": [ "ClarotyEvent" - ], - "connectorId": "Claroty" + ] }, { + "connectorId": "ClarotyAma", "dataTypes": [ "ClarotyEvent" - ], - "connectorId": "ClarotyAma" + ] + }, + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] } ], "tactics": [ - "Discovery" + "Impact" ], "techniques": [ - "T1018" + "T1529" ], "entityMappings": [ { + "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "IPCustomEntity" + "columnName": "IPCustomEntity", + "identifier": "Address" } - ], - "entityType": "IP" + ] } ] } @@ -2160,13 +2132,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleId10'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject2').analyticRuleId2,'/'))))]", "properties": { - "description": "Claroty Analytics Rule 10", - "parentId": "[variables('analyticRuleId10')]", - "contentId": "[variables('_analyticRulecontentId10')]", + "description": "Claroty Analytics Rule 2", + "parentId": "[variables('analyticRuleObject2').analyticRuleId2]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "kind": "AnalyticsRule", - "version": "[variables('analyticRuleVersion10')]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]", "source": { "kind": "Solution", "name": "Claroty", @@ -2191,223 +2163,85 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_analyticRulecontentId10')]", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", "contentKind": "AnalyticsRule", - "displayName": "Claroty - Treat detected", - "contentProductId": "[variables('_analyticRulecontentProductId10')]", - "id": "[variables('_analyticRulecontentProductId10')]", - "version": "[variables('analyticRuleVersion10')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName1')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "ClarotyBaselineDeviation_HuntingQueries Hunting Query with template version 3.0.1", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion1')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_1", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Claroty - Baseline deviation", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has 'Baseline Deviation' or EventType has 'Baseline Deviation'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query searches for baseline deviation events." - }, - { - "name": "tactics", - "value": "InitialAccess" - }, - { - "name": "techniques", - "value": "T1190" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId1'),'/'))))]", - "properties": { - "description": "Claroty Hunting Query 1", - "parentId": "[variables('huntingQueryId1')]", - "contentId": "[variables('_huntingQuerycontentId1')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion1')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId1')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Baseline deviation", - "contentProductId": "[variables('_huntingQuerycontentProductId1')]", - "id": "[variables('_huntingQuerycontentProductId1')]", - "version": "[variables('huntingQueryVersion1')]" + "displayName": "Claroty - Critical baseline deviation", + "contentProductId": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "id": "[variables('analyticRuleObject2')._analyticRulecontentProductId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName2')]", + "name": "[variables('analyticRuleObject3').analyticRuleTemplateSpecName3]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyConflictAssets_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotyLoginToUncommonSite_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion2')]", + "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_2", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - Conflict assets", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has 'New Conflict Asset' or EventType has 'New Conflict Asset'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query searches for conflicting assets." - }, + "description": "Detects user login to uncommon location.", + "displayName": "Claroty - Login to uncommon location", + "enabled": false, + "query": "let usr_sites = ClarotyEvent\n| where TimeGenerated > ago(14d)\n| where EventType has 'Login to SRA succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\slogged', 1, EventMessage)\n| summarize all_loc = makeset(tostring(Site)) by SrcUsername\n| extend k = 1;\nClarotyEvent\n| where EventType has 'Login to SRA succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\slogged', 1, EventMessage)\n| extend k = 1\n| join kind=innerunique (usr_sites) on k\n| where all_loc !contains Site\n| extend SrcIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "P14D", + "severity": "Medium", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" - } - ] - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId2'),'/'))))]", - "properties": { - "description": "Claroty Hunting Query 2", - "parentId": "[variables('huntingQueryId2')]", - "contentId": "[variables('_huntingQuerycontentId2')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion2')]", - "source": { - "kind": "Solution", - "name": "Claroty", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft", - "email": "[variables('_email')]" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId2')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Conflict assets", - "contentProductId": "[variables('_huntingQuerycontentProductId2')]", - "id": "[variables('_huntingQuerycontentProductId2')]", - "version": "[variables('huntingQueryVersion2')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName3')]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "description": "ClarotyCriticalEvents_HuntingQueries Hunting Query with template version 3.0.1", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion3')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_3", - "location": "[parameters('workspace-location')]", - "properties": { - "eTag": "*", - "displayName": "Claroty - Critical Events", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventSeverity == '5'\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ - { - "name": "description", - "value": "Query searches for critical severity events." + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" - }, + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ { - "name": "techniques", - "value": "T1190" + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "SrcIpAddr", + "identifier": "Address" + } + ] } ] } @@ -2415,13 +2249,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject3').analyticRuleId3,'/'))))]", "properties": { - "description": "Claroty Hunting Query 3", - "parentId": "[variables('huntingQueryId3')]", - "contentId": "[variables('_huntingQuerycontentId3')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion3')]", + "description": "Claroty Analytics Rule 3", + "parentId": "[variables('analyticRuleObject3').analyticRuleId3]", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]", "source": { "kind": "Solution", "name": "Claroty", @@ -2446,53 +2280,85 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId3')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Critical Events", - "contentProductId": "[variables('_huntingQuerycontentProductId3')]", - "id": "[variables('_huntingQuerycontentProductId3')]", - "version": "[variables('huntingQueryVersion3')]" + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Login to uncommon location", + "contentProductId": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "id": "[variables('analyticRuleObject3')._analyticRulecontentProductId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName4')]", + "name": "[variables('analyticRuleObject4').analyticRuleTemplateSpecName4]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyPLCLogins_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotyMultipleFailedLogin_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion4')]", + "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_4", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - PLC logins", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType =~ 'Alert'\n| where EventType has 'Login'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects multiple failed logins by same user.", + "displayName": "Claroty - Multiple failed logins by user", + "enabled": false, + "query": "let threshold = 5;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by SrcUsername, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend AccountCustomEntity = SrcUsername\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for PLC login security alerts." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "Account", + "fieldMappings": [ + { + "columnName": "AccountCustomEntity", + "identifier": "Name" + } + ] } ] } @@ -2500,13 +2366,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject4').analyticRuleId4,'/'))))]", "properties": { - "description": "Claroty Hunting Query 4", - "parentId": "[variables('huntingQueryId4')]", - "contentId": "[variables('_huntingQuerycontentId4')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion4')]", + "description": "Claroty Analytics Rule 4", + "parentId": "[variables('analyticRuleObject4').analyticRuleId4]", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]", "source": { "kind": "Solution", "name": "Claroty", @@ -2531,53 +2397,85 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId4')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - PLC logins", - "contentProductId": "[variables('_huntingQuerycontentProductId4')]", - "id": "[variables('_huntingQuerycontentProductId4')]", - "version": "[variables('huntingQueryVersion4')]" + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Multiple failed logins by user", + "contentProductId": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "id": "[variables('analyticRuleObject4')._analyticRulecontentProductId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName5')]", + "name": "[variables('analyticRuleObject5').analyticRuleTemplateSpecName5]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotySRAFailedLogins_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotyMultipleFailedLoginsSameDst_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion5')]", + "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_5", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - User failed logins", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by SrcUsername\n| extend AccountCustomEntity = SrcUsername\n", - "version": 2, - "tags": [ + "description": "Detects multiple failed logins to same destinations.", + "displayName": "Claroty - Multiple failed logins to same destinations", + "enabled": false, + "query": "let threshold = 10;\nClarotyEvent\n| where EventType has 'Login to SRA'\n| where EventType !has 'succeeded'\n| extend Site = column_ifexists(\"site_name\",\"\")\n| where isnotempty(Site)\n| extend SrcUsername = extract(@'User\\s(.*?)\\sfailed', 1, EventMessage)\n| summarize count() by Site, bin(TimeGenerated, 5m)\n| where count_ > threshold\n| extend SGCustomEntity = Site\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for login failure events." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "SecurityGroup", + "fieldMappings": [ + { + "columnName": "SGCustomEntity", + "identifier": "DistinguishedName" + } + ] } ] } @@ -2585,13 +2483,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId5'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject5').analyticRuleId5,'/'))))]", "properties": { - "description": "Claroty Hunting Query 5", - "parentId": "[variables('huntingQueryId5')]", - "contentId": "[variables('_huntingQuerycontentId5')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion5')]", + "description": "Claroty Analytics Rule 5", + "parentId": "[variables('analyticRuleObject5').analyticRuleId5]", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]", "source": { "kind": "Solution", "name": "Claroty", @@ -2616,53 +2514,85 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId5')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - User failed logins", - "contentProductId": "[variables('_huntingQuerycontentProductId5')]", - "id": "[variables('_huntingQuerycontentProductId5')]", - "version": "[variables('huntingQueryVersion5')]" + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Multiple failed logins to same destinations", + "contentProductId": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "id": "[variables('analyticRuleObject5')._analyticRulecontentProductId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName6')]", + "name": "[variables('analyticRuleObject6').analyticRuleTemplateSpecName6]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyScanSources_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotyNewAsset_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion6')]", + "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_6", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - Network scan sources", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has_any ('Network Scan', 'TCP Scan', 'UDP Scan') or EventType has_any ('Network Scan', 'TCP Scan', 'UDP Scan')\n| project TimeGenerated, SrcIpAddr\n| extend IPCustomEntity = SrcIpAddr\n", - "version": 2, - "tags": [ + "description": "Triggers when a new asset has been added into the environment.", + "displayName": "Claroty - New Asset", + "enabled": false, + "query": "ClarotyEvent\n| where EventOriginalType has 'New Asset' or EventType has 'New Asset'\n| extend IPCustomEntity = SrcIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for sources of network scans." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "InitialAccess" + ], + "techniques": [ + "T1190", + "T1133" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -2670,13 +2600,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId6'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject6').analyticRuleId6,'/'))))]", "properties": { - "description": "Claroty Hunting Query 6", - "parentId": "[variables('huntingQueryId6')]", - "contentId": "[variables('_huntingQuerycontentId6')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion6')]", + "description": "Claroty Analytics Rule 6", + "parentId": "[variables('analyticRuleObject6').analyticRuleId6]", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]", "source": { "kind": "Solution", "name": "Claroty", @@ -2701,53 +2631,84 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId6')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Network scan sources", - "contentProductId": "[variables('_huntingQuerycontentProductId6')]", - "id": "[variables('_huntingQuerycontentProductId6')]", - "version": "[variables('huntingQueryVersion6')]" + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - New Asset", + "contentProductId": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "id": "[variables('analyticRuleObject6')._analyticRulecontentProductId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName7')]", + "name": "[variables('analyticRuleObject7').analyticRuleTemplateSpecName7]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyScantargets_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotyPolicyViolation_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion7')]", + "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_7", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - Network scan targets", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType has_any ('Network Scan', 'TCP Scan', 'UDP Scan') or EventType has_any ('Network Scan', 'TCP Scan', 'UDP Scan')\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects policy violations.", + "displayName": "Claroty - Policy violation", + "enabled": false, + "query": "ClarotyEvent\n| where EventOriginalType has 'Policy Violation' or EventType has 'Policy Violation'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for targets of network scans." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "Discovery" + ], + "techniques": [ + "T1018" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -2755,13 +2716,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId7'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject7').analyticRuleId7,'/'))))]", "properties": { - "description": "Claroty Hunting Query 7", - "parentId": "[variables('huntingQueryId7')]", - "contentId": "[variables('_huntingQuerycontentId7')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion7')]", + "description": "Claroty Analytics Rule 7", + "parentId": "[variables('analyticRuleObject7').analyticRuleId7]", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]", "source": { "kind": "Solution", "name": "Claroty", @@ -2786,53 +2747,84 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId7')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Network scan targets", - "contentProductId": "[variables('_huntingQuerycontentProductId7')]", - "id": "[variables('_huntingQuerycontentProductId7')]", - "version": "[variables('huntingQueryVersion7')]" + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Policy violation", + "contentProductId": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "id": "[variables('analyticRuleObject7')._analyticRulecontentProductId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName8')]", + "name": "[variables('analyticRuleObject8').analyticRuleTemplateSpecName8]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyUnapprovedAccess_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotySuspiciousActivity_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion8')]", + "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_8", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - Unapproved access", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventSeverity =~ 'Unapproved'\n| where isnotempty(CategoryAccess)\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects suspicious behavior that is generally indicative of malware.", + "displayName": "Claroty - Suspicious activity", + "enabled": false, + "query": "ClarotyEvent\n| where EventOriginalType has 'Suspicious Activity' or EventType has 'Suspicious Activity'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for unapproved access events." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "Discovery" + ], + "techniques": [ + "T1018" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -2840,13 +2832,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId8'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject8').analyticRuleId8,'/'))))]", "properties": { - "description": "Claroty Hunting Query 8", - "parentId": "[variables('huntingQueryId8')]", - "contentId": "[variables('_huntingQuerycontentId8')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion8')]", + "description": "Claroty Analytics Rule 8", + "parentId": "[variables('analyticRuleObject8').analyticRuleId8]", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]", "source": { "kind": "Solution", "name": "Claroty", @@ -2871,53 +2863,84 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId8')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Unapproved access", - "contentProductId": "[variables('_huntingQuerycontentProductId8')]", - "id": "[variables('_huntingQuerycontentProductId8')]", - "version": "[variables('huntingQueryVersion8')]" + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Suspicious activity", + "contentProductId": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "id": "[variables('analyticRuleObject8')._analyticRulecontentProductId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName9')]", + "name": "[variables('analyticRuleObject9').analyticRuleTemplateSpecName9]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyUnresolvedAlerts_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotySuspiciousFileTransfer_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion9')]", + "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_9", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - Unresolved alerts", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where EventOriginalType =~ 'Alert'\n| where ResolvedAs =~ 'Unresolved'\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects suspicious file transfer activity.", + "displayName": "Claroty - Suspicious file transfer", + "enabled": false, + "query": "ClarotyEvent\n| where EventOriginalType has 'Suspicious File Transfer' or EventType has 'Suspicious File Transfer'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for alerts with unresolved status." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "Discovery" + ], + "techniques": [ + "T1018" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -2925,13 +2948,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId9'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject9').analyticRuleId9,'/'))))]", "properties": { - "description": "Claroty Hunting Query 9", - "parentId": "[variables('huntingQueryId9')]", - "contentId": "[variables('_huntingQuerycontentId9')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion9')]", + "description": "Claroty Analytics Rule 9", + "parentId": "[variables('analyticRuleObject9').analyticRuleId9]", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]", "source": { "kind": "Solution", "name": "Claroty", @@ -2956,53 +2979,84 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId9')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Unresolved alerts", - "contentProductId": "[variables('_huntingQuerycontentProductId9')]", - "id": "[variables('_huntingQuerycontentProductId9')]", - "version": "[variables('huntingQueryVersion9')]" + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Suspicious file transfer", + "contentProductId": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "id": "[variables('analyticRuleObject9')._analyticRulecontentProductId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('huntingQueryTemplateSpecName10')]", + "name": "[variables('analyticRuleObject10').analyticRuleTemplateSpecName10]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ClarotyWriteExecuteOperations_HuntingQueries Hunting Query with template version 3.0.1", + "description": "ClarotyTreat_AnalyticalRules Analytics Rule with template version 3.0.2", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('huntingQueryVersion10')]", + "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/savedSearches", - "apiVersion": "2022-10-01", - "name": "Claroty_Hunting_Query_10", + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "apiVersion": "2023-02-01-preview", + "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "eTag": "*", - "displayName": "Claroty - Write and Execute operations", - "category": "Hunting Queries", - "query": "ClarotyEvent\n| where TimeGenerated > ago(24h)\n| where isnotempty(CategoryAccess)\n| where CategoryAccess != 'Read'\n| extend IPCustomEntity = DstIpAddr\n", - "version": 2, - "tags": [ + "description": "Detects Collection of known malware commands and control servers.", + "displayName": "Claroty - Treat detected", + "enabled": false, + "query": "ClarotyEvent\n| where EventOriginalType has 'Treat' or EventType has 'Treat'\n| project TimeGenerated, DstIpAddr\n| extend IPCustomEntity = DstIpAddr\n", + "queryFrequency": "PT1H", + "queryPeriod": "PT1H", + "severity": "High", + "suppressionDuration": "PT1H", + "suppressionEnabled": false, + "triggerOperator": "GreaterThan", + "triggerThreshold": 0, + "status": "Available", + "requiredDataConnectors": [ { - "name": "description", - "value": "Query searches for operations with Write and Execute accesses." + "connectorId": "Claroty", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "tactics", - "value": "InitialAccess" + "connectorId": "ClarotyAma", + "dataTypes": [ + "ClarotyEvent" + ] }, { - "name": "techniques", - "value": "T1190" + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "tactics": [ + "Discovery" + ], + "techniques": [ + "T1018" + ], + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "columnName": "IPCustomEntity", + "identifier": "Address" + } + ] } ] } @@ -3010,13 +3064,13 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(variables('huntingQueryId10'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject10').analyticRuleId10,'/'))))]", "properties": { - "description": "Claroty Hunting Query 10", - "parentId": "[variables('huntingQueryId10')]", - "contentId": "[variables('_huntingQuerycontentId10')]", - "kind": "HuntingQuery", - "version": "[variables('huntingQueryVersion10')]", + "description": "Claroty Analytics Rule 10", + "parentId": "[variables('analyticRuleObject10').analyticRuleId10]", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]", "source": { "kind": "Solution", "name": "Claroty", @@ -3041,12 +3095,12 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_huntingQuerycontentId10')]", - "contentKind": "HuntingQuery", - "displayName": "Claroty - Write and Execute operations", - "contentProductId": "[variables('_huntingQuerycontentProductId10')]", - "id": "[variables('_huntingQuerycontentProductId10')]", - "version": "[variables('huntingQueryVersion10')]" + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "contentKind": "AnalyticsRule", + "displayName": "Claroty - Treat detected", + "contentProductId": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", + "id": "[variables('analyticRuleObject10')._analyticRulecontentProductId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" } }, { @@ -3054,12 +3108,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.1", + "version": "3.0.2", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Claroty", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Claroty solution for Microsoft Sentinel enables ingestion of  Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel.

\n
    \n

  1. Claroty via AMA - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Claroty via Legacy Agent - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Claroty via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Claroty solution for Microsoft Sentinel enables ingestion of  Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel.

\n
    \n

  1. Claroty via AMA - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Claroty via Legacy Agent - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -3082,127 +3136,130 @@ "link": "https://support.microsoft.com" }, "dependencies": { - "operator": "AND", "criteria": [ { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId1')]", - "version": "[variables('dataConnectorVersion1')]" + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" }, { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentId2')]", - "version": "[variables('dataConnectorVersion2')]" + "kind": "Parser", + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" }, { - "kind": "Parser", - "contentId": "[variables('_parserContentId1')]", - "version": "[variables('parserVersion1')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { - "kind": "Workbook", - "contentId": "[variables('_workbookContentId1')]", - "version": "[variables('workbookVersion1')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId1')]", - "version": "[variables('analyticRuleVersion1')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId2')]", - "version": "[variables('analyticRuleVersion2')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId3')]", - "version": "[variables('analyticRuleVersion3')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", + "version": "[variables('huntingQueryObject5').huntingQueryVersion5]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId4')]", - "version": "[variables('analyticRuleVersion4')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject6')._huntingQuerycontentId6]", + "version": "[variables('huntingQueryObject6').huntingQueryVersion6]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId5')]", - "version": "[variables('analyticRuleVersion5')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject7')._huntingQuerycontentId7]", + "version": "[variables('huntingQueryObject7').huntingQueryVersion7]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId6')]", - "version": "[variables('analyticRuleVersion6')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject8')._huntingQuerycontentId8]", + "version": "[variables('huntingQueryObject8').huntingQueryVersion8]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId7')]", - "version": "[variables('analyticRuleVersion7')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject9')._huntingQuerycontentId9]", + "version": "[variables('huntingQueryObject9').huntingQueryVersion9]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId8')]", - "version": "[variables('analyticRuleVersion8')]" + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject10')._huntingQuerycontentId10]", + "version": "[variables('huntingQueryObject10').huntingQueryVersion10]" }, { - "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId9')]", - "version": "[variables('analyticRuleVersion9')]" + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId2')]", + "version": "[variables('dataConnectorVersion2')]" }, { "kind": "AnalyticsRule", - "contentId": "[variables('analyticRulecontentId10')]", - "version": "[variables('analyticRuleVersion10')]" + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId1')]", - "version": "[variables('huntingQueryVersion1')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject2')._analyticRulecontentId2]", + "version": "[variables('analyticRuleObject2').analyticRuleVersion2]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId2')]", - "version": "[variables('huntingQueryVersion2')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject3')._analyticRulecontentId3]", + "version": "[variables('analyticRuleObject3').analyticRuleVersion3]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId3')]", - "version": "[variables('huntingQueryVersion3')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject4')._analyticRulecontentId4]", + "version": "[variables('analyticRuleObject4').analyticRuleVersion4]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId4')]", - "version": "[variables('huntingQueryVersion4')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject5')._analyticRulecontentId5]", + "version": "[variables('analyticRuleObject5').analyticRuleVersion5]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId5')]", - "version": "[variables('huntingQueryVersion5')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject6')._analyticRulecontentId6]", + "version": "[variables('analyticRuleObject6').analyticRuleVersion6]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId6')]", - "version": "[variables('huntingQueryVersion6')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject7')._analyticRulecontentId7]", + "version": "[variables('analyticRuleObject7').analyticRuleVersion7]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId7')]", - "version": "[variables('huntingQueryVersion7')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject8')._analyticRulecontentId8]", + "version": "[variables('analyticRuleObject8').analyticRuleVersion8]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId8')]", - "version": "[variables('huntingQueryVersion8')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject9')._analyticRulecontentId9]", + "version": "[variables('analyticRuleObject9').analyticRuleVersion9]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId9')]", - "version": "[variables('huntingQueryVersion9')]" + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject10')._analyticRulecontentId10]", + "version": "[variables('analyticRuleObject10').analyticRuleVersion10]" }, { - "kind": "HuntingQuery", - "contentId": "[variables('_huntingQuerycontentId10')]", - "version": "[variables('huntingQueryVersion10')]" + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" } ] }, diff --git a/Solutions/Claroty/Package/testParameters.json b/Solutions/Claroty/Package/testParameters.json new file mode 100644 index 00000000000..c39c501b091 --- /dev/null +++ b/Solutions/Claroty/Package/testParameters.json @@ -0,0 +1,32 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": "Claroty", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } +} diff --git a/Solutions/Claroty/ReleaseNotes.md b/Solutions/Claroty/ReleaseNotes.md index 6c976c5c573..13166bae4d9 100644 --- a/Solutions/Claroty/ReleaseNotes.md +++ b/Solutions/Claroty/ReleaseNotes.md @@ -1,4 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|------------------------------------------------| +| 3.0.2 | 10-07-2024 | Deprecated **Data Connector** | | 3.0.1 | 11-09-2023 | Addition of new Claroty AMA **Data Connector** | | 3.0.0 | 27-07-2023 | Corrected the links in the solution. | From a215284faabd1da1914d3739b607a4fb11f9fdd8 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 10 Jul 2024 15:08:05 +0530 Subject: [PATCH 02/11] fireeye network packaged --- .../template_FireEyeNX_CEFAMA.json | 2 +- .../Solution_FireEye Network Security.json | 7 +- .../Package/3.0.1.zip | Bin 0 -> 9463 bytes .../Package/createUiDefinition.json | 10 ++- .../Package/mainTemplate.json | 83 +++++++++--------- .../Package/testParameters.json | 24 +++++ .../FireEye Network Security/ReleaseNotes.md | 1 + 7 files changed, 79 insertions(+), 48 deletions(-) create mode 100644 Solutions/FireEye Network Security/Package/3.0.1.zip create mode 100644 Solutions/FireEye Network Security/Package/testParameters.json diff --git a/Solutions/FireEye Network Security/Data Connectors/template_FireEyeNX_CEFAMA.json b/Solutions/FireEye Network Security/Data Connectors/template_FireEyeNX_CEFAMA.json index 3ae7af8b1e0..bee522e69ef 100644 --- a/Solutions/FireEye Network Security/Data Connectors/template_FireEyeNX_CEFAMA.json +++ b/Solutions/FireEye Network Security/Data Connectors/template_FireEyeNX_CEFAMA.json @@ -1,6 +1,6 @@ { "id": "FireEyeNXAma", - "title": "[Recommended] FireEye Network Security (NX) via AMA", + "title": "[Deprecated] FireEye Network Security (NX) via AMA", "publisher": "FireEye", "descriptionMarkdown": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) data connector provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.", "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**FireEyeNXEvent**](https://aka.ms/sentinel-FireEyeNX-parser) which is deployed with the Microsoft Sentinel Solution.", diff --git a/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json b/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json index feaac297f04..b408a455715 100644 --- a/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json +++ b/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json @@ -2,7 +2,7 @@ "Name": "FireEye Network Security", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\r\n1. **FireEye Network Security via AMA** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **FireEye Network Security via Legacy Agent** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of FireEye Network Security via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Description": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\r\n1. **FireEye Network Security via AMA** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **FireEye Network Security via Legacy Agent** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Data Connectors": [ "Data Connectors/Connector_FireEyeNX_CEF.json", "Data Connectors/template_FireEyeNX_CEFAMA.json" @@ -11,8 +11,11 @@ "Parsers": [ "Parsers/FireEyeNXEvent.yaml" ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-commoneventformat", + ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\FireEye Network Security", - "Version": "3.0.0", + "Version": "3.0.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/FireEye Network Security/Package/3.0.1.zip b/Solutions/FireEye Network Security/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..9c0ee9c666590bf9d4d4f93cecffaf97df33a856 GIT binary patch literal 9463 zcmZ{Kbx<9!yCqT_3dJ3YySvlk?(XjHu0=2I4i_oz?(P(ai#xZtyKH~^-t6qm?n`F! z<;$FWlYf#klXH}0p}$~4KtRAl~Dx|kcgnX6linOj&p zSi4y}IxyL|Iy#(dojPo^VSN}DT#Ec=6fm8#vh$3=mS_ym=2?e1vqS6bWE7C-PyCIy zobo$qQ7)${SV)$nT5(B9WVR_X*w5g-+;~=Kcn5`Qqy$Y zsLd1QYH(FDCcbO(QOHK7;AXH50!jPf=gZ5IFRR#DFavfJ-X2ah$&$m}RB*1{OLE@0 z;y+2-k2DAh;q(A%*NI3(79nY?=f4ZU_Pq$MBW~f{j0H5 z)G#1YM2?#1*hRT}c?TQOfMx@0DLM{HHLxML_?X=o_UO)$v?Et-4GGHstn!OrNllnc zwcYN`!MWXgdIEUty**`gtB2_J$Bu;=E3mhsGc3sb1u&%9eP^@(k{s@?N6S~}Td6J% zo6Ej;zasn@-hG=#sMpZxNp?l0{1C9XN?<2wSHS**Lt|@k>g=qUWA8@!?cnSH;6z|g zeC0--G$HlKQ%UJ9>YNuR%_!lsS@UJ_&oeoLu_tQy7N(qz?*08PYEWq|NGAZ;d%qa$ zH6>$A2!}ZieL!KY4O|aP?G&2w)W=EIP>S4KYN=a8UtaB(a17wSz+AWEa)wp8##Jfd z;HyTrv=o1GusOZlOPyS5yA^<6LGQc0mhu|MQTgWk8&)vP{j301hM6%^1Vn{ty9)z7 z)x`qrtRW_v zkM)OB(Y+C?o8anW2ojB_@~BqkBE2w?9v`at!VNP?OX^ohzmog`ss#}R|3-=-GjQHo zCO`z#S~7-NG`BB^nW^U8vU*qDmVJBrV$RZB?ez2)>-n$we%b#1+PY=_{X?qO%>gU; zW!t$E5g!?${n4*a;Lf^Vx+4mGIobAF0oh=H#H&kh0c30Ma?yeMn~bYmvMIfmAmRQj zv;m<4+aN@O<$LMb;{jtOKrNb1G&hCJe1i=$fF>!N#?1y6{lZsKpRKpOyEv(xJIUW? zZ&|YuV5216mHr*7`sGR^MotR~WtWUa5>6HbRbQQUR#t}L;o(U_ag-Mlf*LO3#JzRCb(Qr1BLe&f(K-`;18(d?| zW=znZ230a!KLzd@Cm31BbkJv=y|6Y?Yf95#O0gO#gs$L*e4hYUY|P~^bUAC6!8qiW zzr<#Zz7!g7py)Ajyd-M|JI9^<0%+pcgYb=J1=CD;1X}9inB@YLWy~_zbx?Zebv9)h z$Zkp)lcPr@WEQ^)I8jGuD7w>i9&C6vqh@$QHHJ*2O2Kt0qpN_BV?1Srhq4mUhv%y$ zpsC|VShacba$+xmg_WOSiNoj6<1!1Y`2OzR{9;tU3|nu|zmr_y-X~*(nDOzRm=C&Q zfHk{P7JSYEg4f*H1fPfR4({L)FJl}k=X+=z^6>g*W%e{B(ra0IQGR0?!iyig&MDF5 zR5i&AN;vQD5AyJn`XIs3Qj~HSzEA;aE;^J1rS8y-KNY03EN3BeH>1iG2@?Y*v3^`Y zXWY7ALhvH~W#z-C>YL*+z<3T@ax;C{n=Bn)OI*<0u{z-w3lK1#1{u5oL|Kv)4)PSG z&n?w}VDP@clOJ*JA0QBcob7WdjA$A-E^w1|*6Ys)b^6MfgWkg0QryW|bXi|RaUW$< zu*tmyjU@35+7nf8wq1CgYg&qi6GIwSb*9fFkt%``IXi?tG%?xQ*aQb6B*

Us5I*2A2Wu34})P-=gl5Z9M<} z`Jvj-#9Ja!Q*VUzckwUnhpCo&UD575V&2ajaY+fiY(s^*xhHv&7Wvf*GJ-487_pao zHEdg*v~*EMsBbz(2-{HT2*@lduNpnatx18rQbCsyje*<(Qe!DQCdlnDS zSoruyTqYubEqQx&%Pa8ixc>v#|6#>ka7&|Y($3D8EomST@o6Oe7Evwa*r&LM-19D? zicQ7Z!j6Bj|9S9;H{I1YnGkAt1=Dqd4dRfl2T#r_Vx;Mrn~AKN2r15=30s~Ju~9@` zSy+rg4eFFhH;omrCQ1JqQ%_2|97qZ1EIz=Rc1XGts+ZhE8Ji!2{L6|*pH!G0cH`vM#p*W0Q-L16d<7D@L z4d=~Rx3};rG`2FE=o%86GV*`9jxQ`%QjjA_gbKCmnf<%>1(4(DY>&9)27Cl&AYU|? z$uUJ{GxE>{>xRe>NHrqApKyWq^L>g1Yl=UA1Qb)mYD;uOlqcEAj4RTxa6S6*DcOC9 zIg}O(Q+_9hlpnOUx}lS|=z5CzSwwF~+anxJLb4R3F5QyssGX2Ie2>k6j=yoyU5HUb zf$)t^E@Pg6lPeZk>uv9yL@!7uV_Cxt`vvoNTp0{tV|$hcYOGmxMtpcz@9=`kaHd+agRGRtC0F z7W1Li-JD>i=P3cgYU|(3rVI`Yr)n4mfD}E5)T8}l;IYcyV@z2}xug;5WGXrczerJ% zzgcnGeqOol$a=x!E3vZT+^q{NzoYD=AE-YFI4JyDYI_dJ0pwi6w7`Y7Yd?s8R(gI?}wE^7smVw)c3T=lhm{{ISn_ z=~`$X$=yo~&zrYsc;~7Ebr6vzb1{PRk)-!Qjg*YUOEL!nc8><_xZ_cG8H|M7Em(L< za>n=FVCV4(m5k4cj*rxur}DPqkG#Q`R1G4W^Y&kw?mZL*8|b4j?EGQnDZ@#l4zk4D zx-RkWnXBsN|+C$*Al=gDYS!WJbRZ!v`RkyQ__hwlaDltH`t;e5)8m!nCW4X~L zTNGfVcaK`=N3g81j7zcr;l;TjRHF^kCP?edSl-9#RT^nuYAX3+S64mQ9O^7R$!MFr z(wURr6TDI#gMGxI-@WNy^z?0;m;1c4^djocOnp`KWB?hg*joY|RNMRS*TGV_eOC*o z30t`0ro7djFNe`t*zO=LQHSp4lTA{?^h_+{UCI5R?l{-_tH*rdD_X(3x5urpH1hm% zlo7t$Tw?@ls95vDcDiJJCI%FJdfJd1>K=Ru7YvI9fqWN6*fh*EwHyJ4O%qO?;k5Bh z>TI{40hE6a)T;eL9&5ykGmu}j-n6vt(t5OGOr z@wawL(tA*o2$-H4X(=6Ty}etj8J>=gENC#uH*Ai{+#0&I7719i9eJiL<`h8nQcFex zu3%r+OSag$M27EZT&%W#56ESxkP$`4ZH{cf;5wWyg|iFXcgHYF5{5SbxQ*hX{ft=# z7n;y7kb%eFSO-bdiGjghx9=g4aNCR~c_?B%yy?W`chF(67WQ&t{1AI$oN4tyCfsIo=TMa=8ud zB=5uoTpHG4vAS-31MZ@N7Exmj4ORT`*jT2@g*HatlK7UD%QF`v;xA}ENTMlZf3?}D zf&OT{PVW~E?{=5--f{t{QL72V2qSBD?fzLWqql>kQl2~f0=?)h8Pk2BH;gJu?IF;^ z*LFR0{aDrUFZ5S=IPF@YO-^Bd`p#=9XtDO=l0XbmsqZF;KDv`eWeWBJX}i%^fJK%F z6?la5(Ue7P9^e6OrZ-8;H8m;<*vWH3o$h9IkKZ;S-;H{g)9nr32UX{|nnD)KH$D>? zC`0IQtv^WwBdOaZrz_nPR2USjN(Z3eNR5=JoLSf(jnpee6+vw zVL)mGS5r>%IKdkPHEMZ)cB(O^aPS63Xulzous;-9%M5BCWiaD8beR(NqU8h#Bqo=2 zd~-XA$vFG{Qf+DHU{BZZDPYEeWSH0QgD_s!W(yuhD^MDaQcmzP(kzE>4<_fJy-6~Z z))mL^j#Agnd>-%m={!6qo&7D*-D|r*Ese^BSkfiFmTx!^4h{Gt&DDJk0Sv2k>9o-? z|Lh`(*~Y^0vUd`xN>)!5{7hNG>f|d=t|ToM*+&NOdpti?ty8KKmKeX!k9hSQCgq{f zau5?3dh!FHJkYUF8+Sd4v=#1&JWGdNAvc7<%M3LoUtNFS4i@#r0|~u6bP~CAnAJs6 zuutGxfOz!lo(Pyx5>8@QSJIBJz29QHWEy5imxBo(C21JHqKjgy#xWVQ6kLr`QWnU7 z_XaZ3vB2L5FD+tV2ZJ)zL#20A9e4S5S@7cu==B6xehWRB!Y}2e>`dL3&5rVYst~17 z+5C{e1{@8DrX*4?f9{Y9Gl=SdP%7|91X2aZ=6HFeuyycks%&N-O)!1Pq9|A`8ZE*` zR*bWTa5-NN&~gRYazz&Ud{P*ojv5&KHk4aJ&ql>)Sv_!@l>XAOp%Zj;%}Zr8x#D$W zLZZm09s`>6qJe77bbqi-h370r2sVD8ShB_)M=m$)VNoopm4`4rk zT#>r%B4oz!L1%8K0b(N#dV^1p2ZBjaP67b*xdR*)*^D7(Wg7spRX=@$$x1Vd8B`82{IXHshaAY)Yq;@|G}=>p@{%=YY#ot zV?GZG=y=_FH&tbABy;J{B7qqROen;ktZ>7d9o z4kt@1W-`>StC3iK!B0HYMC+Z@vYPsa2`6CEF9YOcL?M(g+#{Gq7T7;Xf{=f}&jR_> zkwKb#(LX)~L7Rdlc)#bv&M%@B;hw2;iuJ-xdc^`X^HoN~OX&ndWK##VQ-?B-I#Z^G=g&wuw`BsK3$j$PqPy5{?8?FOTi} zL(#R2kq(8}gqxfcWcdB?4!3wr@%I?onMTNlk2H19m+in^K_sp z=CL(mzvpxA)@?6Uo6q5aaF{#b^*w9_$02%zk=z+D!40#MwUb>k4%MnxCY`jY{l>_t zg3@o!#Dcsc(=7Dn@wK}ZF&~XKK*=cw z^U^0(@=64u+cA;VN8jM_?LG>Zd*f-{f`xWsqfHZGZ;L*J4~2@LpSX_`fVF(tNZuO_ zpQ({x3D*>1MXGl17M-1xoA6@^^VgWp%?nonz4Xt>b*u*tcDnB;B78LGc6^L#6{RB` zWDR>!#4*O}9Yv_@Yn?@2i-@~M6Fy2OKk`#-#$yElOL+tt3Z+Vem5DB$K!Xw)BY<_b zgQW2r@uYQIffcaL+w{~wIiB;A!>@^!^9qU3@7W*FQqK0Z*cdD0bw)$i{)=|yo}^^A z1QF+{l%~^!CUl9Z^J_~IJwJ;0&MQ@ZJr*YS!19-H)pH!tjhTQHS?=9PQwg@?v(SHKC^CMSbzYwJ zZ&8A0eE^9rR297270hOkzj#Kyrd$$kx-WY0jc`7fX;kR3ygtyptn*wJE#Y%$ zdT4T5dAHKvVj(fPy%80x>lUn$AZK+$4(iL}Rt13^B9<T(cveia zW1_-+7+mR*8#yUkp*WiP1jHYfBh?KMfE(x|AebIdthmDvDYtQaWo8OuraOuebW58x z0|{nn8-3anQ%Wr)`$kGA{nK@lru7IE_sc~@@VosM!wFSdDr-+Jp0|?LmIQL`=D>0g z$lpjyf4xN#XtxqNzG>uqiC*vOskM<7L{y2ryMX_D0l#>G*mV7?u5QGhb<|EfW7>mk z|7=G;e{K*zy{UM`Pj3PSyW@iH{;q(4snd?Snq0WRP-}myjAiV?IiYqN40PS_L2NB` zO*dOSkVao=0B?qxFOMzJ1YdZWhStK2!ruT>nNAbw)A@EH$1EQuO`=00$1U=n;g8Bs z?;3tWoJTv&t+P!%Pw<96Bi=xIz~*k-2~+g<&XoA~bA3;q7Sker2u`XmNY>X6?fm{Ex^v#&`zz(4!L!C!@oXC2e~9PiQwCuDF~A)utL2se@y z10g0@bQC{J93L;fXY6Pa_e1O5TjHcoA~_xCtS~8Fy?^E1h(9Sk4~``Rlb#*<9}aR^6PaQUxZugem0=K?f^7?^2!u zCl~|j7in+l1KUtWf6`BE_LJ5E-2ILTCZG7+H22w07 z_~_r46j5#79vm?$+%NjJaOviC)J1{%Oy}oR929Qyta!wog)4cm-D@&i=M4C7%7PvJ zT(%PFcnR^*!u%S0X52dOLtC}y=VLVM9K6_ep2)k!nFZNb#8aqWEP^9;d*bzXG>FGu zQ$2|kSgIZ6%kldCSa1dC2P}swkHxdwV!MKp3WK81u2CDWLE^Q_nB5Kjg_=K)e+&Zf4FjW?@SK<35+R4?l)x8`@eHS+M8KkwlWg0)k zf4H3{E8_RNWmjzwnyEWad3iHjOZyyY3JL#iV%d_BIOp_6-K`IG?yNX%EJdX6c*;ZF zq9T@ovHdLzEN&+GOBD0YjHmZw?AXkpd%V zmynY0eZM0-&Z%&5DoX8!Gw5(7k_Fqyt9&}Luek>mq>3cIR(e9a4%2Pf%F?FOMxt{+ko~xv#eZg70?7IBIjbZoQ!8_Ho z1V_Ktr3wvvf}pmT&2TfUvc{r@&TN@8=pST#zoc`o z`0~fIgKvZd=zMV}*PgDWpSyL0yR{J%5o*e0Ya;JwD^bKXLq?3u)D8n4zK~vn(78bO z+%QSG9qlI(%11Zs>c?_)8Ya-YwxRa8KosukN7>fhxZ=Ys;TQ4>McUd42`A%F1l*KK zkY8JK>a#@$LTy|^5502j`f2t(E*rVzdTnqL4xdG@RC8$0jHP8+>yd6c5;|zU+3U-+ z>|>dsp0HJQ?N1Y&wXSwOT%HljeGghmZ|i0~IY%DeK15=b%syoqCOO<(Vtj~WYo5B}j9*SugvBk&IB|w#UCFRWiJhwSRrg8|D;?wdx*J$RGFZec~ z_(wntXm_rYd`6jJt(;uV>0~V=J){8~jza8iUG7TC`(Q!OUbfeHZHL7uc;K}4$Xn`Z zq;VN)e5u85l+B8J`e=kh++R4qk+|cnlK}RqocdLwo<@2#5HT0Qzr~k~DUjT<9c$k& zc$ILCPTR+A+7nkT9*MeU!>yL$mpO_~(Ps7Cz8n>7T)P(g_qg{oFZ@BzIO@N%=CAE- z427nTK0r>Zt!2f!Y;&lsZS;1FOTI{;&oEtwGux}ksVkje=dQ>(v3ez z|Egvum}JPO#Z-l4$kVTi3?&`^OQKs_eQ2jrAWrv<6{RRpY7;Y=u=5zzMP};$o`+&%WwMRGoaqFuH1kP| zqA_HE;;Q}?qW0{`C68I;?dd}seyfqIBbRs`Ol#>A=NK|ZY5%37NDB4NJs#GTBHiVp z=lZPrbJrvJoOTx+8IfxFX}e%@)okkOYHe*Qt?pn#i(TwJo6v@M3#6^FPnM7iq zuM+N(heX;;@7>~1P&&VfC7FKyS!4KneAM5r&So>*6vp4XykcwJF5#Ig^QeEkb;b)M zSKmmB|Ne}ZlVujNkE>Tkm`btaRNS+E&8=U3DE&55cDQININZal;#k@AZ&+TIoVa{W zd{L+Y`qlNE@UE5dotGV&dx@G2w8+A~kG`UnlHT1NS;v2p{_juMVLfx*c_)oyb(qs4 zA2{d8BOh{1r&_|HMTc$2P7L}NKXGG!U9Y&RfSBB{bvv!9F72JIu?B~)ZuKcO*^v5N zkX+-R@;8CWZ`%}~-2XjoP2K$OWLw7}`7N+u{1aO`P_kh=>wvkWW{u*WXxxt+sn}KI zR5xjv@|d6EP}9(K>zJX30Js)y!tDg^9-pbDZ$6qCsm)4cmA1Pm_I2`{-yCR9CEauv zngL`Of<}4mx9URaS~?X{`6(vOwcB;3|6E4XZ%!*uFWpN6O)^<8YeBK}t1GvbhK&sJ zd*kc@XwRpD&p5nMzeleicCh551o*P@A3BOPz23x$mA)SK^OyrfEI!TzVD~;Bg+GxR zl?i))K;AS<8VNex-|1DB@U$KZRi&1sRAA`ZP^{*q?DfV!mJsfyCmn1NOuPmWnGR|@ z_1w$#e1BV7@!e{K0$K`?M;+rZmxm9|dt)u(JP0W`>?PF0n9qLsjENMkhY>iB;BE-p zOHuxHY=`-YhF_tQrykC~Xa^O8J=3B804KL>KsMICOwQR0%!V*ePlEp>2>*jD?}nZd z(dSA@q*dFWF>e)zA`7d0!{~JYS06oU5~%hu#Pb#v@iJ`B%sedZ?fluFfLk^&G``Yx zKeCp_dL9su5KB+T@^w3bM*Apf#S@8T8Z}bEK%P{*jI#2VC8|W}`cqc{#vj9I2mj^Z z=r82MA#WO?D#s6DUyGa}V|1>E>)E?vAV(y(z8iJA{Lt)EDnRabvlZPk-$z7nFZGU$ zi@;eab{L?c+j8G$&5^M1I{m3(ri!_{CG?1~R=#h~`plx$++Q4YCqL3`0Z(;5jN9>Z zPpn1B3ruiD2!2(*u4o?|4kL_x`2zItL|bNRuQ@ZGYe%IRT8d-%>)tsk<;;x9B|#VZ88l)L+86&8!^+h1D%` z4>hb=+t!VSMLFW|;ntmwKVw_@C&(8D3k&821__s8QYXD!TAnXUa2EU;n5fZDojy5| z)!oFT9vbL<#je^)W4^T9v~iBDzh3jyo~dpQzE`haP ykPxK*3IE#vU^e={i~Rot&;M-wuOf~AoJ;?Y{HY`h1N$Ec)W06~FX~hLC;MO0pqiHe literal 0 HcmV?d00001 diff --git a/Solutions/FireEye Network Security/Package/createUiDefinition.json b/Solutions/FireEye Network Security/Package/createUiDefinition.json index fb57b3754be..5f6ccbd1126 100644 --- a/Solutions/FireEye Network Security/Package/createUiDefinition.json +++ b/Solutions/FireEye Network Security/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/FireEye%20Network%20Security/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\r\n1. **FireEye Network Security via AMA** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **FireEye Network Security via Legacy Agent** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of FireEye Network Security via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/FireEye%20Network%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\r\n1. **FireEye Network Security via AMA** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **FireEye Network Security via Legacy Agent** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,6 +63,13 @@ "text": "This Solution installs the data connector for FireEye Network Security. You can get FireEye Network Security CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for FireEye Network Security. You can get FireEye Network Security CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", @@ -80,7 +87,6 @@ } } } - ] } ], diff --git a/Solutions/FireEye Network Security/Package/mainTemplate.json b/Solutions/FireEye Network Security/Package/mainTemplate.json index a8c0fc5f9df..fc2eb14e506 100644 --- a/Solutions/FireEye Network Security/Package/mainTemplate.json +++ b/Solutions/FireEye Network Security/Package/mainTemplate.json @@ -33,7 +33,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "FireEye Network Security", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-fireeyenx", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "FireEyeNX", @@ -54,15 +54,13 @@ "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", - "parserName1": "FireEyeNXEvent", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", - "parserVersion1": "1.0.0", - "parserContentId1": "FireEyeNXEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','FireEyeNXEvent')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'FireEyeNXEvent')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('FireEyeNXEvent-Parser')))]", + "parserVersion1": "1.0.0", + "parserContentId1": "FireEyeNXEvent-Parser" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -75,7 +73,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FireEye Network Security data connector with template version 3.0.0", + "description": "FireEye Network Security data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -422,7 +420,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FireEye Network Security data connector with template version 3.0.0", + "description": "FireEye Network Security data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -438,7 +436,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId2')]", - "title": "[Recommended] FireEye Network Security (NX) via AMA", + "title": "[Deprecated] FireEye Network Security (NX) via AMA", "publisher": "FireEye", "descriptionMarkdown": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) data connector provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.", "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**FireEyeNXEvent**](https://aka.ms/sentinel-FireEyeNX-parser) which is deployed with the Microsoft Sentinel Solution.", @@ -516,12 +514,10 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, { "title": "Step B. Configure FireEye NX to send logs using CEF", "description": "Complete the following steps to send data using CEF:\n\n2.1. Log into the FireEye appliance with an administrator account\n\n2.2. Click **Settings**\n\n2.3. Click **Notifications**\n\nClick **rsyslog**\n\n2.4. Check the **Event type** check box\n\n2.5. Make sure Rsyslog settings are:\n\n- Default format: CEF\n\n- Default delivery: Per event\n\n- Default send as: Alert" - }, { "title": "Step C. Validate connection", @@ -585,7 +581,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId2')]", "contentKind": "DataConnector", - "displayName": "[Recommended] FireEye Network Security (NX) via AMA", + "displayName": "[Deprecated] FireEye Network Security (NX) via AMA", "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" @@ -629,7 +625,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "[Recommended] FireEye Network Security (NX) via AMA", + "title": "[Deprecated] FireEye Network Security (NX) via AMA", "publisher": "FireEye", "descriptionMarkdown": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) data connector provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.", "graphQueries": [ @@ -706,12 +702,10 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, { "title": "Step B. Configure FireEye NX to send logs using CEF", "description": "Complete the following steps to send data using CEF:\n\n2.1. Log into the FireEye appliance with an administrator account\n\n2.2. Click **Settings**\n\n2.3. Click **Notifications**\n\nClick **rsyslog**\n\n2.4. Check the **Event type** check box\n\n2.5. Make sure Rsyslog settings are:\n\n- Default format: CEF\n\n- Default delivery: Per event\n\n- Default send as: Alert" - }, { "title": "Step C. Validate connection", @@ -745,21 +739,21 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserTemplateSpecName1')]", + "name": "[variables('parserObject1').parserTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "FireEyeNXEvent Data Parser with template version 3.0.0", + "description": "FireEyeNXEvent Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('parserObject1').parserVersion1]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", + "name": "[variables('parserObject1')._parserName1]", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", @@ -782,15 +776,15 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'FireEyeNXEvent')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "name": "FireEye Network Security", "kind": "Solution", @@ -815,18 +809,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_parserContentId1')]", + "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", "displayName": "FireEyeNXEvent", - "contentProductId": "[variables('_parsercontentProductId1')]", - "id": "[variables('_parsercontentProductId1')]", - "version": "[variables('parserVersion1')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "version": "[variables('parserObject1').parserVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "2022-10-01", - "name": "[variables('_parserName1')]", + "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", @@ -848,15 +842,15 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserId1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'FireEyeNXEvent')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "kind": "Solution", "name": "FireEye Network Security", @@ -879,12 +873,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "FireEye Network Security", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The FireEye Network Security (NX) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.

\n
    \n

  1. FireEye Network Security via AMA - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. FireEye Network Security via Legacy Agent - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of FireEye Network Security via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The FireEye Network Security (NX) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.

\n
    \n

  1. FireEye Network Security via AMA - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. FireEye Network Security via Legacy Agent - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -907,7 +901,6 @@ "link": "https://support.microsoft.com" }, "dependencies": { - "operator": "AND", "criteria": [ { "kind": "DataConnector", @@ -921,8 +914,12 @@ }, { "kind": "Parser", - "contentId": "[variables('_parserContentId1')]", - "version": "[variables('parserVersion1')]" + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" } ] }, diff --git a/Solutions/FireEye Network Security/Package/testParameters.json b/Solutions/FireEye Network Security/Package/testParameters.json new file mode 100644 index 00000000000..e55ec41a9ac --- /dev/null +++ b/Solutions/FireEye Network Security/Package/testParameters.json @@ -0,0 +1,24 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + } +} diff --git a/Solutions/FireEye Network Security/ReleaseNotes.md b/Solutions/FireEye Network Security/ReleaseNotes.md index 15434339cfa..cee2aec31ee 100644 --- a/Solutions/FireEye Network Security/ReleaseNotes.md +++ b/Solutions/FireEye Network Security/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| +| 3.0.1 | 10-07-2024 | Deprecated **Data Connector** | | 3.0.0 | 01-09-2023 | Addition of new FireEye Network Security AMA **Data Connector** | | From bf6e05b29499c48a1ee176680341bab7fbd65779 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 10 Jul 2024 15:29:26 +0530 Subject: [PATCH 03/11] Kaspersky packaged --- .../template_KasperskySCAMA.json | 2 +- .../Solution_Kaspersky Security Center.json | 7 +- .../KasperskySecurityCenter/Package/3.0.1.zip | Bin 0 -> 9830 bytes .../Package/createUiDefinition.json | 10 ++- .../Package/mainTemplate.json | 83 +++++++++--------- .../Package/testParameters.json | 24 +++++ .../KasperskySecurityCenter/ReleaseNotes.md | 3 +- 7 files changed, 80 insertions(+), 49 deletions(-) create mode 100644 Solutions/KasperskySecurityCenter/Package/3.0.1.zip create mode 100644 Solutions/KasperskySecurityCenter/Package/testParameters.json diff --git a/Solutions/KasperskySecurityCenter/Data Connectors/template_KasperskySCAMA.json b/Solutions/KasperskySecurityCenter/Data Connectors/template_KasperskySCAMA.json index 8e8f9a0232a..7b586cacc91 100644 --- a/Solutions/KasperskySecurityCenter/Data Connectors/template_KasperskySCAMA.json +++ b/Solutions/KasperskySecurityCenter/Data Connectors/template_KasperskySCAMA.json @@ -1,6 +1,6 @@ { "id": "KasperskySCAma", - "title": "[Recommended] Kaspersky Security Center via AMA", + "title": "[Deprecated] Kaspersky Security Center via AMA", "publisher": "KasperskyLab", "descriptionMarkdown": "The [Kaspersky Security Center](https://support.kaspersky.com/KSC/13/en-US/3396.htm) data connector provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.", "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**KasperskySCEvent**](https://aka.ms/sentinel-kasperskysc-parser) which is deployed with the Microsoft Sentinel Solution.", diff --git a/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json b/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json index 5a91eb30557..6b5ce0f578b 100644 --- a/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json +++ b/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json @@ -2,7 +2,7 @@ "Name": "KasperskySecurityCenter", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\r\n1. **KasperskySecurityCenter via AMA** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **KasperskySecurityCenter via Legacy Agent** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of KasperskySecurityCenter via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Description": "The [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\r\n1. **KasperskySecurityCenter via AMA** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **KasperskySecurityCenter via Legacy Agent** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Data Connectors": [ "Data Connectors/Connector_KasperskySC_CEF.json", "Data Connectors/template_KasperskySCAMA.json" @@ -10,9 +10,12 @@ "Parsers": [ "Parsers/KasperskySCEvent.yaml" ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-commoneventformat", + ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\KasperskySecurityCenter", - "Version": "3.0.0", + "Version": "3.0.1", "TemplateSpec": true, "Is1PConnector": false } \ No newline at end of file diff --git a/Solutions/KasperskySecurityCenter/Package/3.0.1.zip b/Solutions/KasperskySecurityCenter/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..24450eca1ca7dfb270b37b5e52e4e13cbeea649b GIT binary patch literal 9830 zcmZ{qWl$YJv!-!(x8Qzox8M#3Ik*OQIJlGG?(XjH9^4^7aCZs8-C^_HTf4PYySL{@ z*YtGvuc>*e=4}-PXc!y_2nYm-EbqVCnHCZ`Vek+Tcmxm-`2V7&&gRCh<{H+L<`&it z)~?oI2NoL_u*13bsl)yV?#H+MOUFLEdNY;eL;JOXKeQ@8m57EM@NDVCj0uOsNkG`B z{AW`tx|d6$c_nd6bSM0r-GBEsd90CfAn^>Hj;{23UG`t|K2gY@N+Ps`Ec;<$0JaJ) z>^Uz<^p>!bp3}(04IU{+s?|3y(~2{NIO|W_H!72wXnA`sk8U3ln?2NJI6};8QEfj1j$h6W2?z{Z^O&R~ zm9kPxUv?7Mwj(?g={(aptUXt@m@+UMPO$fl2Y}U5*0$rl*j{kbqpbKf9$f3v8TC~* zI)t^Vg*501;B13}=Lc;UxGXCJ~p= z6>{j5?8mEMw^J^O{=hr&g;x^&Et}2ReJd&Ntj#nr0Bmbv@q)`qGh*@XIk_*7{OTET zC##C=#8D_jm?SOAxLLzzliMW21$D6;vW7<PYj(zmBD?XgjiUs#P(At`_EG-wcEGAaZ?*&k7_3%8m7o-Sobmc zd-Wd_4NnDKCL3lY4wEp>8?}gP3;6fP49Ex09T6Vl>${X9k1?p&RWPn&fAqKQ=JqXi zfUxT5!3r4sb1Ch3y7Oyma#Qn&ldI`(i(YCjzOVpO6W!fErCJB2lOw>gvX;6Tk%Lp) z+=i#$RWBk=op(qmh#9wCGcf99AzT$B3e7nrQ8Pn3SU&?q>UdlqI_CJBHj&jSvx2GD zs%D6T@24cpO_@xecDTi{DJv0UyUkm0K_I_!wG_HO6eBuODG*tZ5>R~T&$5S> zx&-=2gR=6*i%l#0J>zxT0DQg%+0Vs2EM_s(-%?{Fdb&^wDE2A+Q9206mdCx7DTIN; z@rK6~P>0;}E1Da((e#&({=In%KDcuM9sM^1A4sqIYoPbHN&6U}x)9ocVHwwA<2IuY z5QjAZQk?au&hOm?_|l^c`Hs0`8{FX1-C=DRYYpgNySs2oXT&) z@vI)qIG(r9W7ME-^G?D}8x{V=Jo48vjNd@m#cstVM}>*|tO4H`+r;B0a%P5PV1{(l z7@4GazHNGN{b9TlQ!pN==7tvR-@>rbX_CJ=-&bx#6|F75H6KrSHRTNqe z635Vs3X(k=K^)hBk(wxUHa<#kcvwVvMXSHAKxxp128B=jABususCYI_Q}|{J)>0NH z&l~0>0%!cb>=Y{Wu>|F~-{WkMN+Z8R$0W*6My_t=OUE-4G?vFympurcoe+MlioL}o z7*R9Le922(n<LXfPLjf4fhrr{T`$8nd#?{t8)%&sTCKzM zi*uu?P*#UNFQ_1GcSB30Mu;_)K@3f6dvHYYRfdJG8I=avl3s%@{Gx^}_7*IP72 z9D>gcd-*fTJY?T}>|jrSYN?-e9T@^B+^LHo-_EDY57Lrz8nAhbOkFHset>XUxI<3G zM?+QXz%H^>rAhwJ`=Rsi#-$4F2uBPJe2vqgJIj7Vk2(nutOS80aRGvwM&_5P2h~`J z0FzA0{u$!U1zB4s9F+Hmg&!n5GjUPp&&mz&y)oxQxQg%JV%bD6jE-#E9_*2bm5kZ? zI^w#&5jhc7K)YV8L*O)b$X%nIfZB$h{VXrr(cqO7H$WJsCES;qWs=1V7whdviO|u4 zlnoB@=Pa8UVA;^tQpqS(7A+}`2AjZ7$XbT>+})C0CK)HVF7}Z{t~@#C-u)tbifYD2 z$RFX9cn;jS!=VocQ&m#r0}on-U`#A_qWlnN`?o&cM6xf`;g|Q%KZr=F4`!u$7td<~ zS`w25-#yQe-1TQq#V$G79fFVcg$pr`fx0?9cveXV+th6_K%-hwwe`d|&L|9VwQ6Yfb9rjO|FMY%pe1f`y*U4Eyb0OzazR zmfWW@^qP}@_*R9@Q>YQ6%netUmze{KOi75|FPTN*xEte+}_ddAHn~d+6F!@ z>(YszKdK%C6|L)1i{sD}8hMGoof$|qV&|CaSdJ?h=&-;-NmFZ*_d(>FIqcQEGClsj zNYZ~4@`q##N~70nh#2BQoVxpGrlcZVKi>Dr5LRE>#&UmmwA`oL{o3=y{7M@0l(V~W zQ^Sy>CPJ$FsUPZU1@CgrLWa)~{ErfPahO+K=r zYg}2%$nlx5!i4^DCT;I&h)T4cvLLdW*#_wHhuir0JbI^h`qI=ObvdD;gX1jn?nt~; zAbjGlyzyUCEtW$u;Sv&$M48!dB$YGrvgz&5Hp5AUCki+(e%9mSRw z_En3Ad1gLC@X{IVByehtr+QnA?&k<2iJ{5GBkoYCyDtlayD?VX`Z%411ixBvJC{Oa zG_oMccD3~zD8tdr3Rrj0$&&rOc&V;Cu7h``bibQ-0Xs2-(T86|V@{Z2r6ar~ zbA(l60A3JFi*!i16>x|VC|a`8C&?AJQ)c&Al~}+GMKcv49Tnnxk7@x5iOZK9Rk>q< z_sTWsQBv0zh3$89xsI7XOW2|_3&_T@(a%mqKamr$et+?&PE=s<{ zwIGl_W z!$kdN@CJ<(!|BrG@=+e}31^7fgcImTIU1c`Xl4zVvu$OsS2gR`e+$;7U|Nu$LanZ0 z_sQ;>!J5G{Hhjl@c+53`K87B5Rvv6-_obo1IviKdRNpfp%2qtU4*8`ghfEdGy(CS! z+$Hr&pG?zPCN3~QR1Y?>$zux67rFGzi&AJ_tL#7svc=bo`Yju-PzfrI4sCHvk$W}s zX&h`L6oviMq5w`V?9oOg_~|L8(ezTyB-FNL?FNo#IbMjYH!SYK{&}O;Q2&}IqA35h z`3ztyf9nKVgfsVgF>DB7gBUTIBvOC3hiW}QOnE&sSU*pe-e2n z#)4~V<)OgMn7+<4C{5Gz5QbOrri@d5i!j4$8#t8)MnX+O#kFW>ReF%#&%wNh2P;Vn z3T}Ux^F{h^($85-vUf0#euMM*wf(-DC=*qT03&&S1lD3N`i}7%Wp{hl<$9WtJ zg(K97-FM#n4*a3hNpY*Ttv4GNKZ(?))Z~Zl6yhJ(jF6Waj|?b8>%BE0goK|-6JGZi zA}w;q22kEXOY*6}-dywty)7K}2Q`l_;qn2~sgRZyztlj2>&h-p3zuOEH=<^miG!X0 z8Yd2LHRCmX>IMQ&NV2+{r33LD90U0${CelfTZLG-RlY~APrtb97{mom2zH$4%X#5& zH+Ihbf@r&26#nbbyF5wRNd7ddhd_lNtQ-VO2u|`-@m{v<0qzqeP4uRFyB{TO524i) zKSPF|dM<9p?F9|j?gxMML|X<^>rNl<)O{dY;4{6quT$Xz5^+q`O{Ot7ETyKG$+<|* z)WS(>U}y&q4B7JFd+y-cA2&6MX94pRfJi5?JKgduRgw1OgA)1Eg&eh;;HesPgSRnC zl$UeE9(iMwdQUJa2M+1T&yffsSqPk28yaQ80dz{tm=e(`sBXMb!q8UjjF(2C;9dXS zq#{*?Y7BNqF=d?60>j)nH4|Xa#dNDF7N6|n1C_CXUM-z?sdoHHA&^(l@7?(W+cQ39g2-i#4v2izw;RPK5_Z<&A@? z*{9U@78+sQf(36X8;EB#N+(SGgtz6mFJ`2oPN$UGBS?tF+0z60|L!tLc1jZojcGD)w5!iE`{F$bDu3g)SPjKYGZ1k z`Hu=z+)-KrnL<%6u==kC(vamvJ7!NhgaMPgOnfhkJZPm*E;UG0{Z$)BNk5~n9Z?L7 z_W~$d`z0ijPw;l5{is>;wboK*@57RK;{Jr)kw(yD8P?ZTOdKs@0w$D3+^Tl zqhf5udRDTcZY;d+k4x2W73(rT-|;~bBG&axd9$Q16@}(BrU(?vF(w4~{gh7#%~_68 zj(T*af)Qe3G)v(QXC+7IRgBlivo8S^K+exS-Ry>L92)ib$Yrv}C3NjvGgImN5inY!nn|;q*dv@Qv+ENpCu>gsV zc7Q(*R+e=Ho$X3*v5AX}q4EY`Y}>avhWaD@2P)=xQ@0 ziV1eb??)zR%+TM64&(od#R5dav8P|C7x)^RCqYEj477ctd6XXwJPz3J@^r0k(BGaH zD&_iYan3jbYP%gZrYZ^RN?&)27A*~oI z8fjr7%5#RTDW_4;r#pWSxR`Q+G(_uUbO=fZ%xLzY+Dm(e*8SY?H1JA6$i;Sj%keNV z>b`YDigL=b;(8ns#mrtnaDXosS9?3qnAKR?fttt&8YGCy$0@ zxL){6t}Gt59~)bV-|&f$*JuSTr^%9G9&tJ_RArD6)A?swvvW!x!JxqAgZ?MdNQkC{fK%f2U}L_ zODT5eoYVpM8Z4%hGu(*lQi{JGAUhJ&xdQ+!J!>aW`lg7xciLQwTnbz?o zv;WXd?2wqPgHX{BGLOZ9wb@@`IYf>(P{z{oq~p3ZI(*9{Oqa^@lFYeHk+!w5PB(Ct z`;tzB%6T%r9o6hc2c!M+RG|^d>|3%CvC6w2#C#fJ0f~iOD1O>tWD_y=A={qrmGOD3 zA+oxalYiq`4JPdd5~)76*eVRa4k~nQ@TX?~_b5SjSdLSoJ|u1MqIM+u&QF7FP5!BR>u3og?H$Ruv2!q4 z{<#(&tt+5^iw5P-g;71Xs;DmWKo!qR8P83baCZx7bqflSIyRoG9>HlE)HiObK%#;G zU1*g^2`^#-oBck&xZP3@7*2bpLe%U#+n}T+1o9UK*_=LAfYpM3M5c)-@N*jq@8z&h z>|Uw2br5_oWZN%9ELif2dTfWZ&$NzYpKg6prLdml-t&_GfESkka6JCRJ5HM2D(tjr z_QnYT=xL4qkyJQ3CVjr)essyYzbzRj>j04|Te>EnO5F@w~M(8>3yB@H0|3Wx*DD zV#Tk+HeVAvDIs~=h?6JcqvuNUM~FEGY0oY8o1dc{j~{Zg@l@`cf?NhF-h6-2+qU+b zhvPQ6aIbcbo=cQaKXd)zhKL922|RCP|H9)z?n;~(4yU$f@BB##DuW7S$eaME*WMW| zvMOR$9z*_y1G$>pgrUGll4a9W<6WJc(Tkf<$<1R=xKyNjdvFcvtp#oHRkV(;D2orc4cd(kA zx1IQkfA1s}>z#U`&AUWW%BK2ob6dOcLlsi>^d_Ny2;^YU| zf-HUY34_1!dch=353&>_OTca>G^c4LN=F&SZ0b%ixRmzAU@52ctf|i6w+&&|YNQf# zHJYDS;t?$bLS>%!|4&@5CYg5t%(ej30F4jwVEgIVRjk8JL26w!i zsT&?{)lBQyfV4vtce-Y_k4nJHCwrT41S)qcekh6N{+zH>tHfkl*M?8+$hdwiY1o5z)HD2A~AOFT=^H^+Qv zJzlX{3cHk$*?Q;tXK4$^@!&-|A1vRKd1C2;$xiB2yOo(`g}8^6 z3L7SKKMd1#ik8(&!>Byp)bi?%)2`dY?C7v0aH0f(Rh*Y?D3r~g@3x}?-$e%{zWj(4 ztV@;grd&Y6kzo|H?6}h3Sh6sH|2!B$fwR#=U>nY-lwSdqa-fGvQesn+iYYc?;jsKI zFziAc2`yx>rO3tFRy9XIq6gF+S-icUlPjc<;MzZZkatvi_9A;-o~YubFykJ2itHNp z;x{kTLHN|*pO&bGzi_7CRTeaOa%V0UFK-%mMy5d?((FI;KOJ<1_*|!ql~?yO-Bl&G zK(cT#8esKSe!=dwfgX-bb7Idm4E-{HSDCM>+uI#=0_WvW`wA`VraC7^rBHhQ4Vt)R zS@V(jGu5$1Jl%F@=U|ZtnA@d_3h0I%*jG@rKXz?B@tu?+EiKbBxh!Jtmn#LrA%PnP`*GE+9@+dO$*b zVl@){mGG@%3MKRc#Gkd!F0t}O85Ev%+!$2aH|#oXY&_lkK|=taFaXQVKvE{Y9Tic5~|Tv9gu)M$cJ6_ zq~qP|3;_hE>UPi!wWtiWmQCN#UHR%FXs&CBo^<##o+|VExFNW_!60}Nmo$}aBB~ri zxR0xs*FfrHn5Yk-L}qO85Vynd{26|i@VS_A7S_d&m_n>12CLyZK-dI`&7z@!o+L27U0>Z zB#-~y6fy7kP1^7nn+Vo63uR=ToI3~K!R7)}ahs$^d^xA6xwR`;l*T2y*91Cy<(^!HKm`p+s#*o58|13XDjzUj- zIV-xFX`OEMe&_Qi6q<_evVJF}0vI6$#TPD5uOzW0(al*5gZRLYeugJ~n6MqVUYam&YP#;}u|vpn(8MpC2fL2&IxyyaK9W35Gs zD)Z_0lPk~zo{kRhOo9WHQzk^E&+*DMXiW-!$W&mo_wpGt3Nch9YUs2q#hOTzac(?Y z9N24rx`upUEq~&lxPRyK_VfHWJAYmeS_Ugk=k&9{?Q}i+w!=#D!k$bIym?> ze%-&-51@bi`}*nI>M;@JVT7fB0MQLONK9jQH9lKrv9FpNx z_T156sb0?Zt&k5N(pSTqJpI#*KX~Ge;us9Ox0=DKDo8p`X(VURElr%q+g0Q2)=muO zve$Z+duz(e+0i#Z)QM3soQ`^Gf%HLv!e~BS)6FfHFn0u}g-Mlz$A~cWzjJ%~Bw-8g z!_=!o#-LL78PgVWM!S?;BKZ1d5}YRukagR-w)awvVl*p z?B}vkL0phF_WGSrvD!-kpmT-p5LNVC^MB}2Ux0||(;LQixfyM+_*2$^`ZN#Gqxwg>fs-b_@np(h=OiL2M!ARzl^9BHxkY>D zGK-Ed?#Kn|`*P`o%;FDFQFv;y!@F1M*K{Qwzu3jE1I+fn@5~1yE}ZOuF?1QU<=8B! z^28j}h}YJP@{FxO!FXR$9M0j+l2ypd6!*-x3iI z&Wf{(NsvnDSys6f^eAl{Ra12t*a<)X0dyrF<>;zipsn9U)_)KBp^Ud|pPO{&H=GDG z93&o$LBoNmh#aBVKqmmkRnlxqbYsAD1!!TOnMlAibBHkk$Dxao2t4B9G>FQ--$a`{yMKyKP)bRZF zP!bUB>5{`P|1&Ah9jp2J^+IxzkDQ?zJ;azVwZ;j@Hw*iCsqCi(Q{aQ^Um9aq~b z!^P2E>kX5Oi+30Q&&}*D2PH6XSzFfp`mdAoqdWKi3UgzEo#8tE>zJpY@qeea9QJh1 zuM?HEhR*ArGuU5b7fe@F?{aCbHY)R+Ew^cCyLYbbsJFat<>5^E35C|AY_BRdtomq0 z`S^8r)(&FcI@zqByQB=!ema*n)RBMQFq0TwpiXe~T7DO6Y1!s{fgDDOWCi{EVGBx{ z_NJrHV3e~t(BEs{LzK@`|C>St_apjPvA0K0=$$2UurE*8oY1+4I0Af-t}G_uJ&s*r zb_>v-Rq)-_H=A~nVnniz7PYv(n}Xl_d=&XaP6CqjC_>)kNEvx~J|8gsmd|DA&nBfn zV@To0IuMnl3c`>vvG@0j40SoSJFRG!SgE;`UYbXVD?9T?ND9$cL3QcS8Z_rE1c zZ_?||A!HhDBYZ|O8`+>v;rzMLdNK8_Fla;zD5T%5LmfR%j9*Dt z{Z{#@MN?st@*F8Xi8uiHC&=;h+iYEN=Ln<2ooFL{qL^ul9NmY=$GMjo`j;fYoRHn4#t)Wyrjoh^mornFd*`nmDb@G>X(3;)+y1Pt-+tN9FcZ z1BC6rBC_lpFyQFk9Ot7aKtJS_e^(o5kty7y_ zHISCzej%dJiQzYflxIoCAMdisoPZkBlkeFU)iYbh+P^KW#zK5Cf9bum^c%Rze0IeH zJ2^Xm9+5s&g?-)+MlcPj>&*6oC6A)jvZZ<%JHzuIC9lGF!5i-Wkfdi#3R(a8nX}% zjIhk`GmNKTMXkl2@i=R`<(4kp9KA^H>DQmI^O3_GN8@oHPw-ElpO7jFkWe@f|MN80 zKT#M05`z3c?w|b+vt9pplmDNr{GZbQZqog4Q0)H^nN<{E;r^2X^=}3L^HVhc+5Imq CH`^5e literal 0 HcmV?d00001 diff --git a/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json b/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json index bc7d892952f..623474fc0ab 100644 --- a/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json +++ b/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/KasperskySecurityCenter/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\r\n1. **KasperskySecurityCenter via AMA** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **KasperskySecurityCenter via Legacy Agent** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of KasperskySecurityCenter via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/KasperskySecurityCenter/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\r\n1. **KasperskySecurityCenter via AMA** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **KasperskySecurityCenter via Legacy Agent** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,7 +63,13 @@ "text": "This Solution installs the data connector for KasperskySecurityCenter. You can get KasperskySecurityCenter CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, - + { + "name": "dataconnectors2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for KasperskySecurityCenter. You can get KasperskySecurityCenter CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/KasperskySecurityCenter/Package/mainTemplate.json b/Solutions/KasperskySecurityCenter/Package/mainTemplate.json index 6ae5ef4e134..f690e2d8af1 100644 --- a/Solutions/KasperskySecurityCenter/Package/mainTemplate.json +++ b/Solutions/KasperskySecurityCenter/Package/mainTemplate.json @@ -33,7 +33,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "KasperskySecurityCenter", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-kasperskysc", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "KasperskySC", @@ -54,15 +54,13 @@ "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", - "parserName1": "KasperskySecurityCenter Data Parser", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", - "parserVersion1": "1.0.0", - "parserContentId1": "KasperskySCEvent-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','KasperskySecurityCenter Data Parser')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'KasperskySecurityCenter Data Parser')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('KasperskySCEvent-Parser')))]", + "parserVersion1": "1.0.0", + "parserContentId1": "KasperskySCEvent-Parser" + }, "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -75,7 +73,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KasperskySecurityCenter data connector with template version 3.0.0", + "description": "KasperskySecurityCenter data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -422,7 +420,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KasperskySecurityCenter data connector with template version 3.0.0", + "description": "KasperskySecurityCenter data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -438,7 +436,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId2')]", - "title": "[Recommended] Kaspersky Security Center via AMA", + "title": "[Deprecated] Kaspersky Security Center via AMA", "publisher": "KasperskyLab", "descriptionMarkdown": "The [Kaspersky Security Center](https://support.kaspersky.com/KSC/13/en-US/3396.htm) data connector provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.", "additionalRequirementBanner": "This data connector depends on a parser based on a Kusto Function to work as expected [**KasperskySCEvent**](https://aka.ms/sentinel-kasperskysc-parser) which is deployed with the Microsoft Sentinel Solution.", @@ -516,12 +514,10 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, { "title": "Step B. Configure Kaspersky Security Center to send logs using CEF", "description": "[Follow the instructions](https://support.kaspersky.com/KSC/13/en-US/89277.htm) to configure event export from Kaspersky Security Center." - }, { "title": "Step C. Validate connection", @@ -585,7 +581,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId2')]", "contentKind": "DataConnector", - "displayName": "[Recommended] Kaspersky Security Center via AMA", + "displayName": "[Deprecated] Kaspersky Security Center via AMA", "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" @@ -629,7 +625,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "[Recommended] Kaspersky Security Center via AMA", + "title": "[Deprecated] Kaspersky Security Center via AMA", "publisher": "KasperskyLab", "descriptionMarkdown": "The [Kaspersky Security Center](https://support.kaspersky.com/KSC/13/en-US/3396.htm) data connector provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.", "graphQueries": [ @@ -706,12 +702,10 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, { "title": "Step B. Configure Kaspersky Security Center to send logs using CEF", "description": "[Follow the instructions](https://support.kaspersky.com/KSC/13/en-US/89277.htm) to configure event export from Kaspersky Security Center." - }, { "title": "Step C. Validate connection", @@ -745,21 +739,21 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserTemplateSpecName1')]", + "name": "[variables('parserObject1').parserTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "KasperskySCEvent Data Parser with template version 3.0.0", + "description": "KasperskySCEvent Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('parserObject1').parserVersion1]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", + "name": "[variables('parserObject1')._parserName1]", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", @@ -782,15 +776,15 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'KasperskySecurityCenter Data Parser')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "name": "KasperskySecurityCenter", "kind": "Solution", @@ -815,18 +809,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_parserContentId1')]", + "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", "displayName": "KasperskySecurityCenter Data Parser", - "contentProductId": "[variables('_parsercontentProductId1')]", - "id": "[variables('_parsercontentProductId1')]", - "version": "[variables('parserVersion1')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "version": "[variables('parserObject1').parserVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "2022-10-01", - "name": "[variables('_parserName1')]", + "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", @@ -848,15 +842,15 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserId1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'KasperskySecurityCenter Data Parser')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "kind": "Solution", "name": "KasperskySecurityCenter", @@ -879,12 +873,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "KasperskySecurityCenter", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Kaspersky Security Center solution provides the capability to ingest Kaspersky Security Center logs into Microsoft Sentinel.

\n
    \n

  1. KasperskySecurityCenter via AMA - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. KasperskySecurityCenter via Legacy Agent - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of KasperskySecurityCenter via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Kaspersky Security Center solution provides the capability to ingest Kaspersky Security Center logs into Microsoft Sentinel.

\n
    \n

  1. KasperskySecurityCenter via AMA - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. KasperskySecurityCenter via Legacy Agent - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -907,7 +901,6 @@ "link": "https://support.microsoft.com" }, "dependencies": { - "operator": "AND", "criteria": [ { "kind": "DataConnector", @@ -921,8 +914,12 @@ }, { "kind": "Parser", - "contentId": "[variables('_parserContentId1')]", - "version": "[variables('parserVersion1')]" + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" } ] }, diff --git a/Solutions/KasperskySecurityCenter/Package/testParameters.json b/Solutions/KasperskySecurityCenter/Package/testParameters.json new file mode 100644 index 00000000000..e55ec41a9ac --- /dev/null +++ b/Solutions/KasperskySecurityCenter/Package/testParameters.json @@ -0,0 +1,24 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + } +} diff --git a/Solutions/KasperskySecurityCenter/ReleaseNotes.md b/Solutions/KasperskySecurityCenter/ReleaseNotes.md index 07660bf906d..ddde748516f 100644 --- a/Solutions/KasperskySecurityCenter/ReleaseNotes.md +++ b/Solutions/KasperskySecurityCenter/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| -| 3.0.0 | 05-09-2023 | Addition of new KasperskySecurityCenter AMA **Data Connector** | | +| 3.0.1 | 10-07-2024 | Deprecated **Data Connector** | +| 3.0.0 | 05-09-2023 | Addition of new KasperskySecurityCenter AMA **Data Connector** | | From 6619cb8b993daec9d6d75b3e7ecbd48fa20692cb Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 10 Jul 2024 16:05:30 +0530 Subject: [PATCH 04/11] Netwrix packaged --- .../template_NetwrixAuditorAMA.json | 2 +- .../Data/Solution_Netwrix.json | 7 +- Solutions/Netwrix Auditor/Package/3.0.1.zip | Bin 0 -> 9409 bytes .../Package/createUiDefinition.json | 8 +- .../Netwrix Auditor/Package/mainTemplate.json | 83 +++++++++--------- .../Package/testParameters.json | 24 +++++ Solutions/Netwrix Auditor/ReleaseNotes.md | 3 +- 7 files changed, 76 insertions(+), 51 deletions(-) create mode 100644 Solutions/Netwrix Auditor/Package/3.0.1.zip create mode 100644 Solutions/Netwrix Auditor/Package/testParameters.json diff --git a/Solutions/Netwrix Auditor/Data Connectors/template_NetwrixAuditorAMA.json b/Solutions/Netwrix Auditor/Data Connectors/template_NetwrixAuditorAMA.json index 235ea53afd5..aa112d9863a 100644 --- a/Solutions/Netwrix Auditor/Data Connectors/template_NetwrixAuditorAMA.json +++ b/Solutions/Netwrix Auditor/Data Connectors/template_NetwrixAuditorAMA.json @@ -1,6 +1,6 @@ { "id": "NetwrixAma", - "title": "[Recommended] Netwrix Auditor via AMA", + "title": "[Deprecated] Netwrix Auditor via AMA", "publisher": "Netwrix", "descriptionMarkdown": "Netwrix Auditor data connector provides the capability to ingest [Netwrix Auditor (formerly Stealthbits Privileged Activity Manager)](https://www.netwrix.com/auditor.html) events into Microsoft Sentinel. Refer to [Netwrix documentation](https://helpcenter.netwrix.com/) for more information.", "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected. Follow the steps to use this Kusto Function alias **NetwrixAuditor** in queries and workbooks. [Follow steps to get this Kusto Function>](https://aka.ms/sentinel-netwrixauditor-parser)", diff --git a/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json b/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json index 930aa652f9f..69c467e1cc1 100644 --- a/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json +++ b/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json @@ -2,7 +2,7 @@ "Name": "Netwrix Auditor", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\r\n1. **Netwrix Auditor via AMA** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Netwrix Auditor via Legacy Agent** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Netwrix Auditor via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Description": "The Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\r\n1. **Netwrix Auditor via AMA** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Netwrix Auditor via Legacy Agent** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Parsers": [ "Parsers/NetwrixAuditor.yaml" ], @@ -10,8 +10,11 @@ "Data Connectors/Connector_NetwrixAuditor.json", "Data Connectors/template_NetwrixAuditorAMA.json" ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-commoneventformat" + ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Netwrix Auditor", - "Version": "3.0.0", + "Version": "3.0.1", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Netwrix Auditor/Package/3.0.1.zip b/Solutions/Netwrix Auditor/Package/3.0.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..f78f61ba7da0d7574d79dd93bf00e105ed3ced10 GIT binary patch literal 9409 zcmZ{~RZtvU&@GAtm*8#z26uONcelaaLU4!R1c%`6?h@RBOK=!uU?#YGu=D-*R^7T) z=bY~9-L-f1UXQ&V*3wXh|AYqv1A`2s6>?$_tve=BfCK}hP5=W#_}{CQrw!1{M%O{c z#@4~r!OOwTmCf<1n`@uJsVnJk{C9JzOZO&+FIom{fOc85FKR=ZN+c3W=*p^C$x@sk za<)m%eJwwmq3@0;ChzqR()ffJU#hx(wrn7Rk3uBghX-=^Y?wvA9GTG!!@BbKG0izxAGaAxoi_*_Et%#_-lV)e4#Ph zO}*2AxOsJkkm#F{aIl|0Y9qidGXhNNI_ThTj7iE`zJr!AlH=9}rb_>&q9jxtP-`QL zXbN}z?@;|Clz%5JLfN1n9L68p@|ZThV{v+mC^X_{1$CL7nH%`)>NdKyYm&!Wqaxt) zmp5Qul(B{J7_Mw)JF|2SAwcFH_*`^n7S_~p!aPKQmE`T}RGj!{RU2uaF&!ij^+eM; z$vrGps(}tIK8TYJ0hHl0eQJN#aN6yz=JBV;0_^xPGH)0ufGJ`D{fDbVp08cpRs*~A zOeX%(EfUGjre7*KByCV#Av7SNxw5T>@2yvxG5N_Nhr}#e(F2<6iR!A{2>sGY2I&d= zTj}8h7DPvzAh~jzilsQuoD|-CTVu9qyrgbo1_4=jVutWE1<{X$UTeJ*5!g?ECp3kJ zEIe8zs^&Oah{6*D5r5LfReGt1D}XnR@#;9ys&6;TF&L zn6_X{zGR9rf#sOzEmO3$hI#Ge5bigO^c(2!?94|}-8cLca2m_(PcxGW)ngDdZa1e4 zr}(+`ni!ueUnC9jf`{lufo zBzZSkzGV2ucBIl==MweGoL(Q|OA_>78JtjPkh^$h**EsvCoglOWvDiX%oG&M%jO(sNNr)a5SUs}#4eZ7X<4hP7lOa~$bNsY2mQMnt#7m?9Vx;IVGchq zzF#zE#azT$#xjkZX}+{+8c)^}e0>m!if@hIU71230xCAf6NO#p5TA*@zvMAwAxVg{ zAR>(|M|2Kd-~~rYv$=?VTpe_fS$Sm3c{Jv4I&NQ9_Nm2ZO~4dq-K-Ut{Zs2d)0PNP zdqSN4<1sUi}A_9{tHe zeVNt9+ah+-%@%p>=3P4ki>4^ghOmgg257kO&rz$#2G1&o@>4mTqiQ+ z@q@2Z1+U`6pBEs?$qEC6MjyElKO3_yQj9jx!m`ybCSO=JvsYR zVwk?c&xu?RDRksSZ68h7{`$h@VeM_qjt!*|p?ibKNK(hE`)^z|qukN!#Tkm$4GeC6 z;}d>4I6Hg&gfB+0tygZP2@0`>k!DsjBR1_HhIN-<-N;d<7XJ~YwLhsh&2sjoQ%r1d zk9d&=&zga=6n2H5SkYrm>49odI`WPG3ow5O^XN=cC20TZ%$SZ7A{L6kOb?r!mQ0bB z287E~Nh44Bt+AvE9y?S`Ysal@Oew9tJOdi3-S9WBPyhq%PCfgn94kd^S;@DrBY5 z(f!32M5bD*CqiYUoOvw_?&YH_8(q-e6*}@d2oE-Cz0E#w+m;;g;}gF~{x`plN`YB$ z#N{;`p(k~wAP4`nwOEDsP_WpgC_HT6ud)|l3Jxv{d?fx{C^=wUpoh3dOu{HCKSL;< zK!M3_8V+b$r?M^F@~}ewK$18R(I$2u!=eSAkvb%1^ls(dDp{+P^YE^2>GA{qG~~%h zi;LciN6+3ISPI@MS_gw;ZfIa_z7(o5m>NW;m#ebN2(e%Z6s^Jv_1J}%IGDxxC=h0j za==rPt$_#GrpOUESH`bg^X5ho*L00OPr$BHrWlBKdu6?|;4vzvc}0Jpp^~g{*qNg^LGj6h z_}Rq8K@Q?AZXffK;ZMO`Paz`_kz~J)vIZhniu6)FD=CwjE#?vWDDK}wusc7!c*OH~ z6!7N#PAH5*lD6}qJkJw##juw(#MpA-51sM1@@)elTWv$c&w65tCPNnetj?kYzVfpN zo;r_S3Qv|2oNqZ>jTDW^!B6KTO@@|{M#cP%X|wIP6&oA4nje7C`2Q&VHTc9}mzB{9 zKn4SIdf03BR)Y+T%(|0DMQhs@7SPd&HfGT#SuUocH)E;MFP%M|E^dD)C{ z6Z7Jkyz30qw0@;3g@qEtVk5i5XmF+ZIu_bcx)fT^AEPb6^n@YGZnUV*q|@L8i3VM~ zeY<@Oc_Wna|H$;`7V-&5Qgq9-iNCwH9~~f`+n&h(BbeAy{IbPWEX`gJ?{jS5!v7xM z`uM$-pW@jIdz_i&F=vjjICl}eyCm?hu5()GYM&v(M|_DEV;}j2`19jc$o^ZNZNsIl zK=|%8+S8P&ZL7dg2|FBn?9vkx4W?pNylkGe`7G2&fNBT%)b@w8Li4I385{Reg0-at zgh_4UGtV#8aDIrzF%mIP68`QDCktrwyT>3_hGt~*p>5#AKJycoF)M?2imf7+s?DW9 zB9*^dsRLg`=fS>Hp;`Ad$IAvrR^5(+)RJ$u@7)%y8Jjnv^u~1erd}d#N&T{N_;(`h z%V+_b>GXfUAfDMNFXx9s^O$ZH%zgIbx*hO zsrpBg9s|&j-i%Wnw?9Anb)~%N))+acy}Fh{WGfT+Er$iO%2G`sn`NW0-lY@x6T$-G zf(B1QWfbo#yR2QdmF&BZND;RW-B}eN4sPyFL)B-(4a!)HA{FF<-`bv7-C!oPUcA** zx^z4#Z#W!08JUh})8% zCfSr0PYFWZ1AC3`{#F_Cx^q+672@mXN&kKYNq&-qFE1?_q6sn4;*)<@6E}x~ zrx8?%T6@5n>4-~)nLlpK{%D?r>lAA6!|E13_{2JJlzGqwQvIRMW2ssLW{w%CS9Pj{ zJ7;`u8`#p@GNe@t@gYX|FwkNX5Y9*u`t9saRh#n#jez7Zvqo<}*_cPt+GVLP4#Ey! z<%O>@{S7sEhcW2bgD*_IF2|VLv?{)1IOW^#-j6^!2FEU zgfoVSCJ8=Ysmc`3^SgvD&!%6t!jeqdI2#HOr7=C<|ab zw|lLP2TND@BDg!62I<@1fS?B?Fs=X?7t4jHwzXz{x%o=3j&AOSo3$}7@Vmr!GBurM zq%}jDG2B)>_0972bxG-KZ%IBMmfR;S1iwEF6SHLwC5pPq^q>DLf^d;zritdow$wINiZnVyg;6lqflGy&_B?Id8$+vXZI7< zNjZ%q8zWKmK4Evf#C0!yK$^S=KTHErAIed^77tECFH<@Isau?gBv5`uUpxHwPPJZ9 z9yP5tv($_{jd&0-{xWcPAOuRkv3TFG%~)pn(yaN zGg8tb@YaF4iby&wu;nBiL_&#ay0Pf81=2E3JvsW*F;G9u;Xzf_0C?QNUqT6ow*slu z?;-^SvLP|f)7%R&6mP`oSjf9em40~Jzo}JFo*}2C<7>S!-H}ZuO4!-N)%c=7Ejl73 zrZWus73%0~uHlaHCpZFB;y;QE%H-ACv2q1du}$iBni)jDN)DhZBDEXoB+yfq6(Ju?%@?w#iq+!y7y?pzoqtq7myM+h?i`!F(^_mT)5 z@_riqL>MM{*HA4U1qPc78?y9nojj>OHtF7;UO!t58ox)BO+S;h9l52O^l01rVNz@% zymr$FMTEnT?+cjm*j-&%5;wyR7DnVmTDzw9VG>RDts`uoX-g6Z&iORT zSNgu`M}F%wK44)m{?O_SwbLvW6VYR}Q8&J$>r}_xKAp*TtOJDb@WB>>JZt(BDqQp) z=;q5#QG4q{{LJ2JwEnu3SM~reogL6Rh18+O+5T76-(0_$0UkLvEmdn3+UL({qNs{O zTgjXHB^ety1=!`^iN3CscPSH>4I$0%8h6PrjQF|u&7YdK3z035#nTZlu3kU#r?KnH zK_+23XSM5WOYdh*k+7YrhgKLND<$F)NUS;gcS}n~K=lzhwemKy9`p>1F-VT?Z}Yh9 z6OdMx)2dPbGe{&NPZT}k&xN}w#MmS=0(;B;q4Z0%2OKX5(R1T`QI{#~6M%0CGvcVH zQZBeR3E2I4_H0Y1>7VA}8qzD?KUta^>OSN_eOp?^)z=9 zlV5+IBu(XNkuDLnWM3wtj)=Xdx@-eFI}}#u>aUB}xSU)dd)xPhC2i*IrhR)>KSy(F z%sMnAc|czp?G<#O zk+O8d$zcn&6ih$bRV#*)ff|9!AnEPAA?GO~uL-<5H&{wf$D!VOyA{jMw>G3SuJ!Z- zH#O|KQ}!CwBW*a=p+3`!qJSgwIKunlVB;7!%FQex?#LTcsVBAK0ON@rL7n-Pt)Qc} z7kEORk=rRISC{QBS$rKxI@QKdESA?tRWbr%+g?Bv9%z=SRt1QdU#k<3woEo9^v#g?gVw43lbXqpMA|1Ls%jr9hwKaB?LQ28tr_SYgAN$E*y2= zP<;BRGF8Ipu4W&n@uJ=nV^Z8nCZ0!CznsC>A~|!>?v4V9c3Z|2xO)_u@x<>C@^wkv zIj3dBK6=k$gWm;b5-q$@B15~dR4v)FJOcAEC#&tn-2#-jO}AbU7`L4?_V{`y%YFy!eR>vynN#ntLo;^gu|1thfU-NekEn5S)Re`Qb~O*Cnt5 z3P-dCEhjUYsB300nWUrqS27=Bg%f=!&Y$T#ov;9}$1Ru_7^D8fYB{|~cs?9T$|i-) zVRd~}q67u&R-Vu(#+8hvbFoq@i8R0D7Fv@LqOuWx7EoISKFJcr6`3|tQ=~4P)9JugZR7PYy#882Y?VG|0eHJSK2Z}X@kH!m>(%tcsOMt; zY+BVj&vlx-ggZ6Am<5t|29&wtczj;$OUTOp^Qpt6OICxMmEKy8r62ksWRazT@`EE) zR{krbB<&I;g^asfQ8<=G9J!>1{rssPUgT1OGNN7JSH{oF&}vh4U%FGzqWAB5R-|pz zJ88)*8v<$zW2V1_^m^-p+?&k%-~Vwwt*}yrK%eAR-hAreU{<56NXpLkk@(Sz5%?2I z8Ru6gK*@p3B}8utDxNN?p)@-vOOq66Az?$$?KqNcfzm{F2i77ntP66DgAlBXT#rJ$ z5)$X^I%S?v`}}E zYNY0x{4BybmFc`lJ=L7lsit~Y+F0{*THriAnZ723+=H8whpv-*-5Vtfo?=YtuC4#> zXn6Kc*?Od_>#EsgQxm&m>a%==7G4=q{T#Mx+51M8;!lvT5(OD3S`n;L+2Lt=!HAd8 z{WXxr_U5Z`-nbZ^SuYdsb+9yH^JLG?=ve2DK>egV=t}E&Y@#!f_@F60UaE5-fIo%J%Vf2>|7M{Y)Zn}-u_zsgUURDgN@uK)--O zFD|+fn?VMe-r@chplf^NdkF7d{|}uF7P~}DGA5=3cu2zz!i!_K(m#sz0Xtv5nHJo{sIu|Z!T;@*& z2WER91$J)C3@w>W(XM2E(J{Dr!#Zgu>@#vnv1HL}EFHjWpq~($wEI2GItVl-!sp-Dk=eZQcw&hyY&en%aApJ9F0)`5 z!B2N?G$WE`0p(wji}^=mR(DM7rgFjAH5~(@=KbGljal9c~r=D8N|X{yC!$anqxYm7-C1 zHAEdhe9%EGW<>LrvhCAAJoj%?G7fhI&6M-;5F|ku&7Pwl*{}zXxT$X z%{P2_!$dla7rP1F%AX0{-2?=_4l6Hx+1Eo?L#cS#@$j|TOI=y9MI6O<7<|hyb`&Ff ztyAUC4juG15LlF(23t%Y^y^LR^?KPwHU)a+xC96o7(4uT)V~#zVRkIzuUHMq>1vAJ zcJXm&hWM@v+&CU@e&WHJcE#{o32HeBf`PhVei*<&D2r@5g+@vpl+cXL2@#$BP7X`m z=`R{cjJBiaN=jF^Dab6_#lj+_Nwt*q$V^hbUq;Y;7B_5wx|=4(%DiM+98MhSm_uF+ zK$>V&7ED~{&)CjKSdwTreFc^V@W(r_;2qcvGw%&%5ST=B>z??Vgo8Mbmp3kkhz(K^ z>~|M6>h{ux+=bOuJU@1Z)2{(S9eGhzOKw(`lzd-LiXB{Mkv+J%dWo^k)OdMl2J4e| zH$fnh&>f-J>5(m};Q&_aPQX(;+EF|C&~_ZiRoZ#&D|5RoUwbHP%vneKYgzKTDfar~ zP#~+qX-A!jqOyLQl5lvBE_X;(%<)4|kvcK)c3jMA>j@&(LLt$OVQ1-r($*|hUgyN$ zmrt(Slr0-Lo#jyKz`ARrRRh+5(H3&8Zj>1t6i5#<*Rz!*Z7!!t{*|%+MDllTE%T{g zRPn;3=SlFAy_yhrI}%sy;X)Fr_2J>8AUx7(OB-F5Wb;1VrVix% zwqAVC&Q>k|b>!`a2~fqI$jF1MPe?G!ld+21q|fcr)dg!{4Xtcfc1x#)M%sZ-naY zt9q?TnV8tS`sQz}X;qq}6Z1*j!(v$8Y^%PI45cRqG=K=icC0WSf<*q!&B?yTdb2z_>< z8i+uD`6NnY0oe8WkUekrWOuO0=W`+D9W_*TCf58RQ~E=`k?cxC44yNV%)p-h5~E~>(Pn@0TKla25`f{wQdGEPaFL z(nXJ-FH||kSYchX)HvsV9GqpPu)o&Y*{}_un-=0k>HORqr+)V&za{)vUv{JqK)lDR zLBp}G8!AUD+ecr^m>56nAK48lh=)Z+~ND4#rth9%BIIo8{ z>M>ssr{hUe0*Mn@P6SZ4R%u`Tm*svE?|9uik@V$0CqzEJvOID8->fzZ7Z~6C$++mG z1Qq+ZGu3ZK5ZyA7 zN_qSF{DO13sWx|Y80<^A=+w$yFgfqkh602^S~h1c0o~;cc0tn_fo%~RX0FvQRb94B zD;-(J4b{vSm!8w8B6mN0j8@0D@71P_;7xT4>ij7y@x-EpS?>{p>V;XA@AT%->*9yr zV=mk3{IGr2kn7E)?G`mpT`$|L+dF)WHfsRPm^(WT-Lb-~PV_=7YM##O?#@S_en<3A z-2h9%h4Y}Y!@XO~yp(j4JNP{P4y+94aoeMZe7+CtBHeD^b1l|vI)pZ#8aSgFcShB3 zO`cW4t2cUDMg%!U({%nrrsM#D;3CV{F!*3x{37#-rzdMJBp|_l>)r2-sYs z#y8@Rqkv#aUa~;ky9>;ho#DPtcegp@a|*d@9(P(XJ+o-7SMtGbaY-T{(!c{!NsKpjx(dI6&dUD+|>y%aHRIva80gf206RWmKo|QRI4f6^E?3Lvo8KHMQG1= zZk}5#?sUmZ`k03AEdNF@OP4N(v|xmwv=z*oea{mVbOqxO?4;!I=>NB{KSnV+JD zXX3Cy2+i+eXpRL5qx7EWDGG6B$?LDIxxLE%V~<}An`rvrvl&Be30~~5dEP@lZU-Rv z#vNL)H=_V<`+vvTyg$eT0Zg-*CZRh2#y-S0a3Q39CC+;Sxn2T~^ZqaUq{IFGT%M20 zr2(`1RCge@YFh*R>dDVqCh~jbU!6t0hQzSnu>&N;krZtB2Ld6}1C z1^)=Gjvhrt&f09dT0h6nA8b{PrUC5;&gSI4b4Y>7eg$lWSV_);0V5!bncyGG!$Ic} z&~y=!ODO@-=Mu4AuEz2y1^QotBNW_+azTP@BwWXVbVOQg5}1xH25Sx~pWlFdH05+( zjp1rk)&gCjsJZ300wj_je`dLc=b%(I2&^!NtGc2WD55BTwNvQ|q%!YI^pbxIKrh)m zolOKRYFoa)wir>0K|0Tr2!Fdc zY2SRRskLi}p0&Gk0 zrP-&l0UDpbHGG^PJ5|6_g_wwkKfG6ziYu?%2&Mf}k#F=fNcp3pBp3gI6`5v-T~^{D z@^_6Rt1w_U5rsU$z!X6-hy1qak@%w?bp}QyukXWaJcP~3GFz!i$q;jytzYL>Ui6N+ z!lMM&M0}ibYQZ`ad$$Q0p8sYlK=VWdQaBdL_YJY=ty9+EFfdcpot$7gK^3z<>f=LP zLm3th59a@F6#7qCgn@;j`k(e+{9kNC|9_DGlQj81U;kf_rT;ug|C>;$p^Sj|KO=De NW#oUIp7wuk{|l76DeV9N literal 0 HcmV?d00001 diff --git a/Solutions/Netwrix Auditor/Package/createUiDefinition.json b/Solutions/Netwrix Auditor/Package/createUiDefinition.json index 73631c68e75..5661eae8397 100644 --- a/Solutions/Netwrix Auditor/Package/createUiDefinition.json +++ b/Solutions/Netwrix Auditor/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \r \n • Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Netwrix%20Auditor/ReleaseNotes.md)\r \n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\r\n1. **Netwrix Auditor via AMA** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Netwrix Auditor via Legacy Agent** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of Netwrix Auditor via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Netwrix%20Auditor/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\r\n1. **Netwrix Auditor via AMA** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Netwrix Auditor via Legacy Agent** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -60,14 +60,14 @@ "name": "dataconnectors1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the data connector that allows to ingest CEF formatted Netwrix Auditor events into Microsoft Sentinel. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Netwrix Auditor. You can get Netwrix Auditor CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, - { + { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The solution installs a parser that transforms ingested data. The transformed logs can be accessed using the NetwrixAuditor Kusto Function alias." + "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." } }, { diff --git a/Solutions/Netwrix Auditor/Package/mainTemplate.json b/Solutions/Netwrix Auditor/Package/mainTemplate.json index 0a2f9e5ae4f..1e0ff968de8 100644 --- a/Solutions/Netwrix Auditor/Package/mainTemplate.json +++ b/Solutions/Netwrix Auditor/Package/mainTemplate.json @@ -33,18 +33,16 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Netwrix Auditor", - "_solutionVersion": "3.0.0", + "_solutionVersion": "3.0.1", "solutionId": "azuresentinel.azure-sentinel-solution-netwrixauditor", "_solutionId": "[variables('solutionId')]", - "parserName1": "NetwrixAuditor", - "_parserName1": "[concat(parameters('workspace'),'/',variables('parserName1'))]", - "parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "_parserId1": "[variables('parserId1')]", - "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring(variables('_parserContentId1'))))]", - "parserVersion1": "1.0.0", - "parserContentId1": "NetwrixAuditor-Parser", - "_parserContentId1": "[variables('parserContentId1')]", - "_parsercontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('_parserContentId1'),'-', variables('parserVersion1'))))]", + "parserObject1": { + "_parserName1": "[concat(parameters('workspace'),'/','NetwrixAuditor')]", + "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'NetwrixAuditor')]", + "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('NetwrixAuditor-Parser')))]", + "parserVersion1": "1.0.0", + "parserContentId1": "NetwrixAuditor-Parser" + }, "uiConfigId1": "Netwrix", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "Netwrix", @@ -69,21 +67,21 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('parserTemplateSpecName1')]", + "name": "[variables('parserObject1').parserTemplateSpecName1]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NetwrixAuditor Data Parser with template version 3.0.0", + "description": "NetwrixAuditor Data Parser with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('parserVersion1')]", + "contentVersion": "[variables('parserObject1').parserVersion1]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[variables('_parserName1')]", + "name": "[variables('parserObject1')._parserName1]", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", @@ -106,15 +104,15 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserName1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'NetwrixAuditor')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "name": "Netwrix Auditor", "kind": "Solution", @@ -139,18 +137,18 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_parserContentId1')]", + "contentId": "[variables('parserObject1').parserContentId1]", "contentKind": "Parser", "displayName": "NetwrixAuditor", - "contentProductId": "[variables('_parsercontentProductId1')]", - "id": "[variables('_parsercontentProductId1')]", - "version": "[variables('parserVersion1')]" + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]", + "version": "[variables('parserObject1').parserVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "apiVersion": "2022-10-01", - "name": "[variables('_parserName1')]", + "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", @@ -172,15 +170,15 @@ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2022-01-01-preview", "location": "[parameters('workspace-location')]", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('_parserId1'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]", "dependsOn": [ - "[variables('_parserId1')]" + "[variables('parserObject1')._parserId1]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), variables('parserName1'))]", - "contentId": "[variables('_parserContentId1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'NetwrixAuditor')]", + "contentId": "[variables('parserObject1').parserContentId1]", "kind": "Parser", - "version": "[variables('parserVersion1')]", + "version": "[variables('parserObject1').parserVersion1]", "source": { "kind": "Solution", "name": "Netwrix Auditor", @@ -207,7 +205,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Netwrix Auditor data connector with template version 3.0.0", + "description": "Netwrix Auditor data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -564,7 +562,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Netwrix Auditor data connector with template version 3.0.0", + "description": "Netwrix Auditor data connector with template version 3.0.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -580,7 +578,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId2')]", - "title": "[Recommended] Netwrix Auditor via AMA", + "title": "[Deprecated] Netwrix Auditor via AMA", "publisher": "Netwrix", "descriptionMarkdown": "Netwrix Auditor data connector provides the capability to ingest [Netwrix Auditor (formerly Stealthbits Privileged Activity Manager)](https://www.netwrix.com/auditor.html) events into Microsoft Sentinel. Refer to [Netwrix documentation](https://helpcenter.netwrix.com/) for more information.", "additionalRequirementBanner": "This data connector depends on a parser based on Kusto Function to work as expected. Follow the steps to use this Kusto Function alias **NetwrixAuditor** in queries and workbooks. [Follow steps to get this Kusto Function>](https://aka.ms/sentinel-netwrixauditor-parser)", @@ -658,12 +656,10 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, { "title": "Step B. Configure Netwrix Auditor to send logs using CEF", "description": "[Follow the instructions](https://www.netwrix.com/download/QuickStart/Netwrix_Auditor_Add-on_for_HPE_ArcSight_Quick_Start_Guide.pdf) to configure event export from Netwrix Auditor." - }, { "title": "Step C. Validate connection", @@ -743,7 +739,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId2')]", "contentKind": "DataConnector", - "displayName": "[Recommended] Netwrix Auditor via AMA", + "displayName": "[Deprecated] Netwrix Auditor via AMA", "contentProductId": "[variables('_dataConnectorcontentProductId2')]", "id": "[variables('_dataConnectorcontentProductId2')]", "version": "[variables('dataConnectorVersion2')]" @@ -787,7 +783,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "[Recommended] Netwrix Auditor via AMA", + "title": "[Deprecated] Netwrix Auditor via AMA", "publisher": "Netwrix", "descriptionMarkdown": "Netwrix Auditor data connector provides the capability to ingest [Netwrix Auditor (formerly Stealthbits Privileged Activity Manager)](https://www.netwrix.com/auditor.html) events into Microsoft Sentinel. Refer to [Netwrix documentation](https://helpcenter.netwrix.com/) for more information.", "graphQueries": [ @@ -864,12 +860,10 @@ { "title": "Step A. Configure the Common Event Format (CEF) via AMA data connector", "description": "_Note:- CEF logs are collected only from Linux Agents_\n\n1. Navigate to Microsoft Sentinel workspace ---> configuration ---> Data connector blade .\n\n2. Search for 'Common Event Format (CEF) via AMA' data connector and open it.\n\n3. Check If there is no existing DCR configured to collect required facility of logs, Create a new DCR (Data Collection Rule)\n\n\t_Note:- It is recommended to install minimum 1.27 version of AMA agent [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-manage?tabs=azure-portal ) and ensure there is no duplicate DCR as it can cause log duplicacy_\n\n4. Run the command provided in the CEF via AMA data connector page to configure the CEF collector on the machine" - }, { "title": "Step B. Configure Netwrix Auditor to send logs using CEF", "description": "[Follow the instructions](https://www.netwrix.com/download/QuickStart/Netwrix_Auditor_Add-on_for_HPE_ArcSight_Quick_Start_Guide.pdf) to configure event export from Netwrix Auditor." - }, { "title": "Step C. Validate connection", @@ -905,12 +899,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.0", + "version": "3.0.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Netwrix Auditor", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Netwrix Auditor solution provides the capability to ingest Netwrix Auditor (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix documentation for more information.

\n
    \n

  1. Netwrix Auditor via AMA - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Netwrix Auditor via Legacy Agent - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of Netwrix Auditor via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Netwrix Auditor solution provides the capability to ingest Netwrix Auditor (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix documentation for more information.

\n
    \n

  1. Netwrix Auditor via AMA - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Netwrix Auditor via Legacy Agent - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -933,12 +927,11 @@ "link": "https://support.microsoft.com" }, "dependencies": { - "operator": "AND", "criteria": [ { "kind": "Parser", - "contentId": "[variables('_parserContentId1')]", - "version": "[variables('parserVersion1')]" + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" }, { "kind": "DataConnector", @@ -949,6 +942,10 @@ "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId2')]", "version": "[variables('dataConnectorVersion2')]" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" } ] }, diff --git a/Solutions/Netwrix Auditor/Package/testParameters.json b/Solutions/Netwrix Auditor/Package/testParameters.json new file mode 100644 index 00000000000..e55ec41a9ac --- /dev/null +++ b/Solutions/Netwrix Auditor/Package/testParameters.json @@ -0,0 +1,24 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + } +} diff --git a/Solutions/Netwrix Auditor/ReleaseNotes.md b/Solutions/Netwrix Auditor/ReleaseNotes.md index 6cbf46b2261..7774c8f2e99 100644 --- a/Solutions/Netwrix Auditor/ReleaseNotes.md +++ b/Solutions/Netwrix Auditor/ReleaseNotes.md @@ -1,3 +1,4 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------| -| 3.0.0 | 29-08-2023 | Addition of new Netwrix Auditor AMA **Data Connector** | \ No newline at end of file +| 3.0.1 | 10-07-2024 | Deprecated **Data Connector** | +| 3.0.0 | 29-08-2023 | Addition of new Netwrix Auditor AMA **Data Connector** | \ No newline at end of file From f698e7b8d93b2401bbef4d7382e95c5d010f4aa0 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 10 Jul 2024 16:47:40 +0530 Subject: [PATCH 05/11] Crowdstrike packaged --- ...riticalOrHighSeverityDetectionsByUser.yaml | 5 +- .../CriticalSeverityDetection.yaml | 5 +- ...rowdStrikeFalconEndpointProtectionAma.json | 2 +- .../Data/Solution_CrowdStrike.json | 7 +- .../Package/3.0.8.zip | Bin 0 -> 61080 bytes .../Package/createUiDefinition.json | 2 +- .../Package/mainTemplate.json | 65 +++++++++++------- .../ReleaseNotes.md | 1 + 8 files changed, 56 insertions(+), 31 deletions(-) create mode 100644 Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.0.8.zip diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml index 2b16f38b9de..9dc6caffe95 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalOrHighSeverityDetectionsByUser.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: CrowdStrikeFalconEndpointProtectionAma dataTypes: - CommonSecurityLog + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -52,5 +55,5 @@ entityMappings: columnName: FileHashAlgo - identifier: Value columnName: FileHashCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml index a75c88e6fd2..6a9d25bea3c 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Analytic Rules/CriticalSeverityDetection.yaml @@ -11,6 +11,9 @@ requiredDataConnectors: - connectorId: CrowdStrikeFalconEndpointProtectionAma dataTypes: - CommonSecurityLog + - connectorId: CefAma + dataTypes: + - CommonSecurityLog queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -44,5 +47,5 @@ entityMappings: columnName: FileHashAlgo - identifier: Value columnName: FileHashCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/template_CrowdStrikeFalconEndpointProtectionAma.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/template_CrowdStrikeFalconEndpointProtectionAma.json index 0d11504b0c5..022416621a6 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/template_CrowdStrikeFalconEndpointProtectionAma.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Data Connectors/template_CrowdStrikeFalconEndpointProtectionAma.json @@ -1,6 +1,6 @@ { "id": "CrowdStrikeFalconEndpointProtectionAma", - "title": "[Recommended] CrowdStrike Falcon Endpoint Protection via AMA", + "title": "[Deprecated] CrowdStrike Falcon Endpoint Protection via AMA", "publisher": "CrowdStrike", "descriptionMarkdown": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/endpoint-security-products/) connector allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.", "additionalRequirementBanner":"These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json index 95b8a2fbace..f43265a127f 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json @@ -2,7 +2,7 @@ "Name": "CrowdStrike Falcon Endpoint Protection", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\r\n1. **CrowdStrike Falcon Endpoint Protection via AMA** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CrowdStrike Falcon Endpoint Protection via Legacy Agent** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of CrowdStrike Falcon Endpoint Protection via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).", + "Description": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\r\n1. **CrowdStrike Falcon Endpoint Protection via AMA** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CrowdStrike Falcon Endpoint Protection via Legacy Agent** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Data Connectors": [ "Data Connectors/CrowdstrikeReplicator/CrowdstrikeReplicator_API_FunctionApp.json", "Data Connectors/Connector_Syslog_CrowdStrikeFalconEndpointProtection.json", @@ -27,8 +27,11 @@ "Playbooks/CrowdStrike_Enrichment_GetDeviceInformation/azuredeploy.json", "Playbooks/CrowdStrike_ContainHost/azuredeploy.json" ], + "dependentDomainSolutionIds": [ + "azuresentinel.azure-sentinel-solution-commoneventformat" + ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\CrowdStrike Falcon Endpoint Protection", - "Version": "4.0.0", + "Version": "3.0.8", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1Pconnector": false diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.0.8.zip b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.0.8.zip new file mode 100644 index 0000000000000000000000000000000000000000..4a5d0487d817866fda4d39f3650bfb6b63c2b3f0 GIT binary patch literal 61080 zcmV)eK&HP?O9KQH000080CIxrSc*bin0X2S01qqx02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH!l2|GHPL`hYoiGLjk-J+5iy&w}=(5Gp>0eEPw#kQ(Spt;18R<(2r;!QOKo0|h=jOT$db z)Z*i7t*i(LdUnJu$I4TcrdUzh%#Ky0W&ztgyUSk3f*ZlKSP0FmVsSVG-NUXXDgC>C5)93cNqbO zfW{(;HOF33sD?Zh|AF1Hr*yjZF-#OnF-^?IgBlU!TH0%-U>di91w7+(86yY5 z3!rR$k?v2~?(SylW-H0r;mbqB$i%Z7A^=PEDUG;_GXrMv8F4p0&>4jjQJuls{ zAuYuqGBpLW;|L;9V0rKg)mp|eWxFErh>&r^P%**C!ds|j(}VaBEy~2Jvu9K$dac}q zCu~hND~o%U#5?KjQLztgRbC58z#&uwkyp9^N%u4IU>uf}kr z*Ic9gy5~pqO!k^9b>&v}X{9s~JIQ0=mJi&5C!)I9uTv^ql$1d-V*h4c zEL9=<^yaGAgen*f#*Jpg-E180EW_v#No-Pat#YF+WBzdb$&5;d@p*XW z7c!#pf~GQ&a`=*OEN=*hgkPU5M7a!k8c<)#d>c~tp>&oo9kkW?vH94pshgSn;J0aV zFU@H&9UuP|EkAKtR{zBI7d__ZKH+O$+fb!a1M?@|FZ|4k;ioVVhN2$pq%IM%|L_%3fN@Ji*0r|vOSk5$n4u{x)N&>09A;wG z1pgRj8;pZ^X#`I|&Y*+%E& zd8a>4@2VkK*0yo3RxDd+NdQl#Gr)p{4=+lBU4>fGO4 zlc&Bp>1?PJvRQM}*?(II(odfOIwJIjq66LDE8MnEc!oz?gypHQz6-E2K{W?ot}%3n zOGb7xa>sC;h0EsS_DQ-r*6L5vhrO>qH%a#ryJwQ_=WyF3U2*nHNYd@Q*^)J;b85Rq zlA*m5=FW^;+}kx;_7*1d1v780&0l@y4Fx5siCvPm&BRaM-@G}SCc#@7K6$M)tTU-3 zed{jh-ZsDba7TRKL;Vk%sU)F*xfe?%qC7KWx|- zWaXV{e`D~v_x0yC2ED}C{ThRQ4!3O#D$af>jX^0^-3e5KoWz2Y&Y$^}hk@*s4wiy0 zOMGK+h}xCZM=>YmQOxl4)#1sg{$kDDEe4*jul(jgD6&{x!-?}W#IB0bvx?E;dZ)pF zGudq;<=IkPyK_(=ug)Mt$F%>VVpw0%_H{CZ_o@G~9($3`AE2?Rz2R5i*!UB=u2>=%n#QfWi4fYGa3=dG7}o8{XsYZ!CVyd2GrZ?((iA zzpg3YxFmEJeWeVoOTIx%vhrcr0;#WK38sfydAsa%ia+@MKTt~p1QY-O00;mog6ddv zF%DHB;{X6~dj|j!0001OVQFquWo>Y5VRU6KYIARH>^*C9+eVV#uj>B8oN`qXRRkrG zQtbF{Q>WO9R~6Y-MA^PAS!EA_A&C_TAQ*tMl5^F5-+y_(?IOI=ucI1`8g8FpE7R-+a^!FrU13Or#dwgfO zyZ3{&yKn98?Kmv-f*Txn&K99ZV>b9Z5B%>o`eFe)@MF05hDF>Bd|YR5u#5kw`wJFR zhsKD(A9w*S(IlP+5e|Lf+EKuRX-q7_lQ0aT_`eqV8X_cth-DUt0>@e7z)NCSjKm5d zG7Tc~GzzYraU8i6IDP8hg;OirU9W;V{*KzN@dY9Wm%pa+;6$a#THV@Zj+ z1Q+9*km1T4!22_e6jJBNzK-#zQ5V)UAEJnBe{XHdTHxK@>{(g@c~hx8z;ex9QxF| ziCvq+Ub2XhO!vm1Sgy}J++NP&By1#Q5(HO!7J^=H3p?s*tB!SJ#!Jlt6jhCWi9W+9 zENSG@iN{Qv04CA(1aXZv>U}!yB89TGDK2jIF0)};@?J_FuE>#WzF~7mU~wO(BlLh{ z2k!~%&ea}ETW{$|qARF0jkDEoCY zRl32ekVV3FQ12LK%;quQNi7B6>=V<@q&L9O^oapw%5LHLKuwK<1 zYGX|kPjt924w;RjzGvFw8tVF+I}OBb_SdLg_@f zT(53>HSq-oWm-8b*e_|mwDqboUWK{U%06sY_SIKzfYYw}^%!Xo-=gXd8&$uVHBCGz zs{Zh6RsCTH)gP{^`Z;R9Qq>=JRQ)1@G94Y&dfVl&O5I2G>ON{$_in2-%xzckdMq@E zZ&AfZjVj*EnkJqURebcds`#jbijTC4?{!r19JODmijO*~c#%PwUha4Fv4;y~gL1Utym@UzKMcjT&ts3R}# zM~KD+>@mA0^T4zqgvrf*C>h)qKpsx>Wlb#M1_HCPCMVKi6uzQ4l5@hIJ^+UmGQ|%Z~FEZ zaXHtMrr4_z^IYUv&FhO6>hr`4Y_j0H#OXz&R=({LfLCB#4F1-6xN|*OJNVPGR*w6s z7*-1TidsIkS52lYS>g+zY z9yyQq9`8QdrF(m}0m%f^tWG5{KJ-`=<20_g+G3oZKtWt2lx{T11viDjNdgOYzAVDSHW40n7hy4U`p6mn@OUz`9u2>@t^FZA zuqG2~Tf5Gq=?^~~>`o7ck7`A@DeUYh!d=$yF2bKBx~vf4Zd9xw!s|S1yJHdVL{qB> z8zIO0pC~UL43gJU$5b`ibfm@mrW>7j)W70NB0(x_wzWAyk#O^-B77>{uMM6G zSXYlX@h*?3!l&6MoCGu17V*{83$6?CRn-C&D|``?A9_vkRVC)RXhn~>3o{>jYwO6V zLZck5RFP1MR*FJbpwg7CBR_KOIi3rC|D46o*wO`A@TWnv&__&H8eXYgZIc=luVtz! z*;?L?7GZpI7)A6(0LFvXTbmb`4N9r~SiMpflkPUW8uYbvBBVT`T3?$S;A;9h?4+-s z#lNknuf?Mjwfee_Py0OjT6JoqD31;Lig2jw|25!oQ6|k>m3mm1Tc>lzum+_WwJJ@q z*iemN^|VF>8C5GtQ+;VQ1sQcxkk3;iT1`QU2N7x&WS!F&pGQHe&Ri5_uSlg{ut?<^ zMDq2C9IGp3B1>aQ)m=rMA`WR&2kO)I3ZUmg(p>Hu=v+(GLC!nQBFrQ=@?JOG?m6~8>O(Nz*hlR{{_$xnSi@5&f zA2Dk=r1lk^vEnmkQyO|%)5~Q>8Eg?C7Q1E(g(5lEnqgSihPDTSyFqNd9pu`L=UL;| zQf@QJ^*@Nk7GSLP-sSNi_umzlE~I#ANMo&_W%2H10Z6uuNXV!B%@kb4y$aRSKY!%^ zG&P~ktT#IaQ&y^mR8y8>+6A?-4LqUt3y4r zAW8h9#FxvquHn(g5 z#iAWBY*Apvfh8NPECg;vDT;u*Sd;@AfJ-XVX@A~;ATKHiF({a^SVIwLD~u0k;*#v* zoHH-vIGBB;3jj>Q05#L49^p!%N#yb?-Y25;_B$gtU`N2}(#0kheWJk>@bEl338c35 ziR03lA8>&mh+HDCBaR@93&7EL$RYrPTC@Aqaa^glXY9Acjf4&Ui2|*Wk^+DYF-_z$ z2~0oLz^+$Dq&vkegGDKkj}FO%a^~QbUlI=V!oN6+P!6PnKaZI+ApiT1fBp=l1lMAV zdCVklWH+qK)zqmLc0xTD=5KEsBAJQV_BL!@4Vo8fnRE%~R9Y4M!A?uCU%FfIJcvP1gknU@X4ni|y{?$+F_1i` zU;r|HL2AR_KRsyxfLn;T-?YN02Jxxt@?|xnI0aYEZo#QSgj2LZ7CH1hatOP;bcM~Y zC;PWXlHd8{e+Unvm`rZSxw~M($3PI`5Jce)Sb_U{4&HSwHt0}d%`NvRkCAm}O1wI4 zKd{930q!J=1-L@6UC1Bu7qXxqw{ooN6{pC)XqWo|#+UJp7~Z=BW-617yMFT&%qz$j zU5l|g-Z|zfbkWSIXXaA%UDvE7#;nKJ6WAsgq<5(ki@_b>(>Y=g0P~8Fek61jY>k{c z-UFj=zbSM{T~B$=x}XYeLQLZXH*2qk#~Us`RRQV~0-l|-s&SvHk$~WD;c|?5YXU$q zO2_f1Dtc|&&RXG-(Wai?Ib^OEtvveAT#ki~b4Xtie1vb55dIJ4ofrer9qVR%v4rs7 zk#zb_jSti7DFW1D+9jpOIvOW)I|x@8t}#08vPEi+AQnc&QNkKv6Um=W10CkE6lVR% zO34>DYQf*Nr0noH?4HzY;)*|p-4An!G0qjr=tgUNE^@3~uT`<8K zv6W?ru491`Sg=N2bf%e7E!nNi{0u@(Z57X~D}mKFs?9QbON@pW4gRrNban8NiS1i9 z+2Np=+?1_GHWlKyvwC9&vQ@~2@sbUa3gd-SP1@43GVL}cQGx(tTq7@CEQ-R*9cFU zMXU|kbBaY2WG(VLUAI93YwSbS<(e?c^td6#!5m~6_Ii&3sfk&cEDpkAW!Ga zzLLeMB1$17?YJW$Y_CyK5LNBG(NH6I90u+SRMs#YVtdu~x-G0TA*=9u>s6@e#0~5L z*F|lac{f5rb3PyK&FL|buaR?qm#Pddc8m82MhL+b^YM4!pX3R6QSt^~LNzE}FluPB z_654cP=sB+5YdNN8&{052*Q>kULYc=0`6aAl_M@+q^6{>laUTXOKFq&I|d8Z5|IPb zF@=oO2QBXDl2j3Y@i>I~1$jhwbDz7F(~QCc8uehSx(-KGtt&;evLu&htEiW)SrRjx zG3rQVEw5i+%)2)pZf}pzk50)RvB=YUKY-ZFkW$vFGp{N{@>gMy!QBnEx8M2qjOq|k zod;Oqef9DvtBFs=R-v7Vul2k27NQOtrj}8?aWBqQuaN@0LOBm?SJbZZLX1Sc^Fi8< zU!1-=J3oARjw1IHn+CGp3n0a^0HedBi*(^WnbV~dhcsp;$Ik>l*@e@{UC`)8Xxf$y z3N}I9L)U!sVM=;aY;XFe#+bG-;3CDRfK5YT@DxIYx2||)Uc-WFa7y*DQ|qMVPhHHe ze>OZiVO}mB0oFDGt&czPC#`rr4Z<6ItaTz5sGrgV?o07k$r6atow3&t&(F%;x?6Si zxZ4_^*ZL_8?94oHL^J|^KUk<*cV=y-D;okLA7-NSJbOX#F+M)UN1L+;aTN@gan<(r zGiAP1ss~1BlEiUt_~PF#)WCB!u;jBOzHuP@zl71NcWjkD$r5uVpx!%w zIDk0G6HzCi8j64c%O$tWo{**=N#^HK)RhzBpd{%lQ^^e9XWPeIg@BRVj3I#i2%|+c zL|D`l*H1nY2yZa*H38t;SX1QLM;D@6*o-`25#3-;mO@l;+!zBr<=B08U6==(I2w>6 z%*oUi-ijN75Xo|6%>IDj^J(eMF#MhbABoUR!FUKvXAx$bG7Z2aOR@q4PX_ZGQ$Uno zNH~{Fa{EAw-1hb<5Hg2=2^LO$XOn|TAK=RnS_Bo+lj;*hfG_5U5#)krFM1?B7IUvk zYla3G!da6W3;&-BlMB(oO6m(qZ$drqM#jL!>}Ts)W*n9-C2w4wi0mS9+yH_uhc$Zb zB2zK^c_9`g24Ju{g>~(*ag^1Dfi82MdX+izv6roKqeAL9svY;3}ImqIy3eFabOcqUH3pGBB}(hj6?#aa!r z4FzVP1K^(lrZ#7I&J4Vhp9me7?};X_AO#|j#5e-ZC}*VOAS50xi24BoWIV|vf*4)` za6S-bMlFZ4Bv)M22(_?!jC=#h6~we~CA|Zd3`al7q!MiyY+E1fRSMDcYw7M#lqcoh z0EgqLFzqlGZ9Da_Ko1GIJM#fi*U!PbTMQxVfK|l!)a`0~HZdhH<1!1h&Gmts!sZNw zVO5XK3O32jIvxns{u4Go=1-(Urvt=7Zk*gIR4%nAG`D*~ma+;3Nc{vPlM6Wud|a8v zvfu~CPmVTOK9CDej0MNZB-MXoS>Zs9TdFLe0NAOZVMd!e$9xgmPotQvX8~@jxrfe@ z`ZlKO0(wt^br3Jv#2CQ?h~$=#bUUK9g{don zpldD`Di>7b#gPUS<4Gimf?F(q@B!IkgV}&o+K2zfpPphFGk8u( zlz?GbFoWTz!mg3g;IW!8O?gbS*TWMBaGo+BSYVSF-0^h@H3 zgQOR5(k$Kx#Y1^;7)QZi&lM;<8j$Bf_O#?Qi0~AVmYbY}<_?hEV+97x`%|?PD`6qM zDmbTOzjUv!&3p-Ud~9d>0Z>De7zp)*S2<3tU?_zW=W`GiuuEtOV>;<)AjnIQELt8Z zpn-2WbR5E{J=Zx~AB&mKW2YTK<_89-b90Kwc}ac)={~xqThEWGhg0;vU94 z7QtAvI0lXG67nEz^Wi?xJ;Yp;j+s7ZF00#)D>Q}JUXVCab@6Cq=&`;SAr7+I@^&Ae z7^(V^;13aJh5o~cb)E;y*JC*vR$97I;G<%|mI8m>>5Va0`NM3>q)&Q6K4|^_&!^&X zD87T{$3fumK@hs?*}FQSp70McTzDl63_iN4+ILa)nlNy};$anjLBv)W$C!#VWTlf% z<%^|pg$qTMEvf2lj&m>c*C0xEVTEpxbjlr_g;%rlFK@#J8a&~)1y_W)j2&DLj{DyQPjnt81xZc51HM z;#S|{`TsBExV@cd4KY?$9dmAVNYN5X+$w}vJ#@(Vo9a-ZEkx)Z8srwM2?bUO0akMT zZ7zRhSD(7@S~Gb^)~b_W=Zrx2e%;%c^1KckFxNI-4Sl)whRxO})b-)seIISd{@I7V z**|07Y)eyTxwf)K6X)8^n`<|1<`b5JnA6&h#4@$(bs&D-org`#QNrEUVOU>sYwsv* z>Lgr~KVPDQ@UlBoTiSuk%)E8`@13^&Hj&oc{8-=g*xc-xuf{YtH+E`jtgLFT(VAA~ zbRNC?Y+hWeX|ZEp*DC#7?ahg;O^I#Ih~;`z3CvyXXiKwU+vfhMnhaNMF1!!nYiS~E zt7H~W#x^wxR*Bdxngag}&4AtX^zNGe9-96BY|VZ}eK!9rgbnS@e65k!L-Ss1^IrSY z_=hIF&)=lC&aV7foAFlW)%`c!t&7q_a~)Z!xvoP~U3D1RrOB&Pb61C^xw>wy6`JI# zPdRpO+p3y=-+XCpc57!#TXWlOxl+7TED5cu#1Bns4^3(hO=^`*YIoM0wx&{klTB!M z)qJ)x&mNl0x|=w?)c`^0`B5d0U1ZzkC@)#_@@13zS1(vlF?ZzCo`j7!o{ zIkEI~!e-RIkq4S<)+nDhA6J|=PlvajJ8wm-`NV~et1NxE8bnMqpJ7g7JnBME$z@I# zKL7K z0$bt}{+Y}wY(wa}%=4=hI{6fmWdGAU;Uv z-F#cAJwz%!IF@!6Gc}Hb(I;8IrnuOY%dr?mHAo+dLK}HcM8|tmw;= ztV)tODppljR#B#VJiq-S07M}0&Lk;WlB>FBT0}+!fIuMdipO`wDX;N#NshCE(cYB` zNVNqL&YmuH3e6Da^+P8&dOe;L+grtt@`gc9q5VqF>-LF_B3v(|rL*FmES7gXk}Fh6 zPnwb6%Flv{z;0t%F0GYTR>4ksznMWB>$meyz+arl?fn%9CE>R~FdumOD#QJ*eh>F|cEDdOJZpy$Ot|0RFFtDIj^nX; zB_-vN#FCO^+*RkJ4rR*4r=?#H{<@6DB6(G-lSEv8?B=)k|H!&~81i>;`yk|Y7Wf3- z!4jY0w9G)2^&26`MXstZ*^R_7rJFkm;e7<5{!qE9I%vhb`8xhu?<7C4jjwiZ2Fkf} z9GH#4YGFUbg1HA=X2W7jk0)zzNOj6K{ZlpoG{yO_98~y*VC-kq>lfHl(0o#N>T=mG zvKI{cB~)8|*zE-~9$DR6SfpFsqbpAjJfKgg8oX6sL-#;&P9HbXP~ zT#4-j?2Dv9{DpT@p*uB@yAgnau9PEj^cToedX<*8$rm*oF_1&xsUWvc>cyLSJ#Uny z(yV+Zj``bL>)TI@>v}YwDF+UiIychWL_WykkV{J`fhX0|=6nKg zsy5LB4JNN;#>1hx-;p~$eW&xieDf0f%7gD$i{5Pm?{(Kz)4(OUq$}9;zMM*lklq6U zcMfIi^l~gjR$Br{MNKgcpo#i<9G|(B6T*P(2jzQfH88q6v6ZdiA||6N;Fnf?bVInk zv5nRP#{RI>9K0_3SE7$8#p@4Cj+)|8U~Wt1!1GwCqDF`*^Xn~GEWC%OL;FgL1P%r% zKucNJ>I${d_*fHxDL56wX+4mt_fyemHDlxxYBYxx{Nme>4!qwfP>7+!LJCn1`ohBKW+a$%OZpp>ap4 zS1QQng8o+{i;0@3SXT9P`$_S7?^w^lZ7^fCY;xctRlYuJqZ#Zfc177s+wb6FXLK#P z@T^bo$B!FbiJFS%1H+BhokUsB58*UC`e zLTF>OZy|8UhGgFeBWv={e=+la{xhxsCv(@PL60R!U(Hqvuu{17r`)qPU7#DHB^cu3 zJv_Frzbg9G#hI?6nr=*P3)~@0%l8|Xf~E6wq1rGop4@&*m81UuI!=bo>#_lV(S7SF zYg06H)2-oO{zW!GOQ~1?Kev7_{<-~omdPnSrhct`CHOD8X@+0qh6#RAytpWEg{qa9 zUdq)DpwA7VKGbFeEmyCq&(#jiuVulDU|*xkHH`;GSV0UereFbZn@%%H6Uf&97urb8mpsy%%=D7SBJFXfZ1y z*AW5jQI(YNdvj?q{K`91$?dRoB(5)L|F16_^aZh56aC9kZBZdt!o!(Z*3 z(Gg)Tq*QG@uu+1C>Y$;Iq$t{E^#`hlPOC=a8MSN;jA1{6Hgo_4Th(-W-|-7`v2gO%>Gv?W`V#Xf?EKmDC`4@eitfRU zV-{-pAjbsRA=q)WwnZKVEgq3ZwGNhyzhGk)c@#o_GL6l-w#cJ!M-_7CJPHqO3470s z3SPguW>oM9bk&rI`XT%{zJ!bl;eEiJGAda7W?mI{HAnw~Gb(tSkNazk>}I3$)Zw^` zj0%g43J;;JS_$?dqe6>}3J<-~7j1oA7CtVYx{u2rkq04StsFr716@Q?4%dUYEw|6G zhqK-Of^4=^-0idL>pvtH!$)Q2NAqQHqx2<4;J%3)y16#}As#!OT$=JX#`khv`a>Ad z$z>@eEQ?eaSu^)Lxsi6=2~4 z@QIuH#e$o(v-1l|5&T-)_qDd|Yj4`$&ZIwO{MXX(@4hDdUyA8|+~%*7z2BWp%>1Fe zj|qO~MSEdtuiEgrnA(3h6Z_7hvoNLq^O@4OSX#rIvo=d=tL3zXiF|BzY`HSt!6g36 zF@+B=hpm^wPRm;>6Zg()>C-l4?`p!Hxm5Uaf4|trzElw&EmnKxq!r7|^=7A7QTtOT zTT8^DD_{uL1Ps9lJZli9u+t~R)qGyD38uW2rv$Wrx>a{3Lg$H%fBC+s;p3rqf!hN|U*et58Q+4`5@esmNyQ7R!svMn4%{RYR5f0Fr0GmSi%9$yt{} zvl*J!%{ytGCeCla=^e~W9HJm=Pa~g4;1)?7ztn_VD+YCWIf7I;eSUiZZ4~mTGvL8? z>R|#Yj~1CHLYXJRto`IdK^uO(*-7BqCVmn0Fn0L1F3g^Xj^6BQp7mmPIK*UXbt-aZ z(AtOhR$1gUaFc(2TUeH01+?M;xREem#9y2f0ZaX}U7FZu^3JL`+k24`n5ZFRhNfT* z`?WPnv`|{vC*m)5ubk)3Zm+(6SDvkq)8N zU^`Q!H9;d+Z3Cei?5ToGMkOvM+4>^T{;== zo4d)XQ$cHCrF+-S)sTI%`rS=GAd`E4>q*A!{=HZ99!r~qIT-qhE~<<7X7i3bfAq*C z^nUbctx$ingx;p`r-T1ce^7RBxUJ^Q?!s+(0X&%xhxO?4q2EEI!;0J&t-*7`OiV4y z1P&TK;ViVPbcFB?)IDFeFf&V4OrcY@m*y&ngf?YlU~PG&^?z^La=WW zcp%C^q?8$6;uQ>h5o8zyvE`c&!Q8Si??*~B)l(iwZy$V(H;O%JeJG#t+*VDdbsq+0 zB1V|Ky+{)PTW@H{%|RtrFfnVH?vNv_%av)~qem;RCb~_)?^VGhWf3&IRURoa$-Rm( zqYaW^ot3^tV2t~&8o|Fs?^KJ$GFQAQMTa-s0`?ZD-tdI5S0H0`Bi(3JZJ>gt@R(EG z$OT;`w{P0n%Z_s72n?(TA1ouv zwvY+39{Ya(M4C7=ZLx0bDp3i|uAJZ`S`*2qQNt=-3jbFQ15ecO^g4ofdfTvf{{-Y_ zCMtdD9Fdpu&skvMUgc#YWStpPpz4Atb>Sc<%&u^Knx2wIN3*-@H6kyo5S6bB zI;+L$O#TP7v%XN1T*K1>Zgs>G*uR2ZaKIIa4%=(iG6mY7tt#j%s?-b3Tci)N%{Oz* zx~M6@0mAG+!LM)~OgU&u?@YPRu%5b;mp&ZORL&gH*g{Y zs^a{2Q>g{z3C^cSkB&t}S7if}h_qBIZL4%mu?==IQVyug>TPB!j%FuEs|DHfeo&>v zl`t&9>*u%Y@V}l16w||<)RQ=aDu;f#<8@CWD@+N4``nuv-2cVtVLqtEu53K0QWs<% zQ+EVYk7R|#z9ltIy&sCFj~)q)tJT>4-ocvO$AMJs$;+$awKP^$Qf(dD9zD|Pnz=8M z=8=?u6b4w3gJ4lSzh$meZ{=uc=RaTzNf@jTXik1Vm8tJA6x~&|sohl}8Rl{ebuk}0 zGgov&wqA8)O`8K&YVi@QP_CA8YLDP%7laU8yhelDV#TQ8`7~gXE46{CZWRv}P$z7X zjY5SDVR-+mUw*_XrJTX3M`|TGOnt*j46E@GHp-I4rs{R9T5Oi#bX`2AULIaw&u6mb zhY(@qq8N{4C<1wXCD<+ISxNg`0k+zn3p%m|A067h3CbUo4XW;SR`)v8y)NorAM~e^ z50k3ciC$wqzMOreRKXM*jMxtN9R*xuSg z!EWZ)6Iye(pQ`fXX?0!CuMM@{-pS$d>$8J@KiE5aeRw1YAHMwg^+6Aal>?>wB!6Mp zwzuR}lIGn1{aN(l^});Cm#@zb_j%#oi^GFhA!oi=!_N+1ie5;@9K75=es%a#e|!1r zsx z8RXU&%mwh~CZMaK5KI2@R`FKsF&om1l<89O3>ht@Sl#HSh?qFYb1F(5w4*bm+M zn2Yg{bLjsgVmox}VJ3#dCm6e-TmM?eXvhs^kj$sq=X?x?Pc!yHw_di0vG9q;R_NBx zE-@57_1FpRd(Kz?7BLdqZ6p4$*a)eOmfjxcVj#qy?(#7Y()lqzVvK`d+Oy@pNh{ss zR6e5HLq~E;^=^@6G3zYuJ@8%ferZmXi}M!*-8$ zBcy$IIz=%8o^`9swkK^#f;SiI=sPAPOS;#?b3J=?fd#UWx6ZJ!DVutDOJ)l492{zl zbixy5Re7y+lz*|l#;%E#8I@3O&6Ru!0}r;LkOb+;CU$DqAgORCas#&!m-_8enmSyH z^Mz`jyjZD~n5&mi*}U=evK(mxg5`$piW*M2QJ~~SH^zBm{0xOqK1}}a{LZM1{H5aWkOoN z`|o0z)wk?|=?D@MPBrGoaWj)(a;E|3@X_q-{PwK8E{pHrl5u`LI;$__tBKGe`tEH! z1w0u#WNmqQ)l|bQ;2EWdND}zaxxQbICvb{{el%*1?pIoIq|#D`ti!!wRVLz!BeED= zD2wmDD^8cFlAd%jP;MuuO9F%Y9Y`~;l~uSx-*0BfYejaZ8h(DOpw42vjr5@_gTP(n zQ)dvgu{(o02w%UQcLx6AJZ|r;K`05Y4TAaH^@DP$pwWF%HsFedUOX`moS55*i~iR_ z`mSsZVtVL7(rv=Z5OI~pUtBK8;mIAyVkI??R#Pib)EDZ@5|)&YR!he${B;@bMRwIz zhpf1O7FqX@uz7#h)yI&(gUb&gxAVRr@D5%W45wv^)U3}CK`xT1e#tIGhAG`#i3sl_ z2=!-{Ox4@;qG1J#p)(qf*40z!n2E?ieqq-*Feid(#BoBMH4Oq%xk$wBys6jZd7~_My4w-={ zX5%ZyrY5@HuP)Zb9^)@!nvA4P2i3L?ro(c2YEu}r_=xiEzWZAXK>a&%ja1@g3*kLrKGtG_hn zy{O^5j~oIkD0$LQLAe#kl<{c`qFNbA=!btY9oA>9Uczyh3R|8kZU%dTpKIU}`DJ(C0zYT06-4I(k-2V{HY8GeY}}KC461> zuY?Fj*LwWL_eS{ZK8>G)E#>rmIUQu*n&gB7{fj#%IS_Z5#?0nBP-*Y*;HaSM8>sO@ zw@}x6T{R8Z3rK%T!BAx_OSYrQxecQQ_3|!kNcGUh6}7F`cy$T4MC)*|y$)?!Z|X|> zWine&r=uWX*waQfPbwC4OE^3ROSLID%L!mylxZ~X6NK`&+lL3g zky3DmdOX!U{yu~p?rjur#ExkoUo7>7c*yH4K*$lUn4P!a{SDS2<%Hk6KZ6PX%G(CY z2`u%nHfWVWW8gM zCQY=q+qR9TZQHhOP1~5ZZQHhO+cu_cPEXr7{qB9@oQUs>s2`bCmA@)7^Uix+YZb`~ zMolXgq`RE5AwLZ{jJaMNyk`SxpSe^UjylJpL-=l6_5TJXs#64;cQ-QhVIxBH%eHf0 z>7)dx<7bol^UGVv=<;m2YkeO|o4^3HJ3$-UZ#0V`=0-K#S#o1e^;_*Yapt&5n;?&y z&E9u^TZ3Yg zuw1;h@kJUkCzu}BOnq=Mq`sX|C(!d;ppvKkqL4*$kv)21nG0{F{^wY3am8hCj>b0P zgzOW}ge$V^cfo`d#tlJTDLm`Qo1PfG2^BEmz+HF4L8p?lheh+>lw0rpkJLNkVRP0rw9{oylR>-js2`E>I4?~KaOnz;gupCoZSgLN~1F3kkP-?5ioExFFu+D{^S ztsL*wJGZmvJGuA&%ySC5AM>1)NsGdthdXj>La4X|-UoB@wVFh72blEqWq-Hgf6a3) z!#_OE&Mrqk=J_+^X|NWjL9=VW1&8@JZ!AVFDfwz!_kfG*T!VeKCa1jjK`biW^u?gH zAZ}6z;yKoWk#DAcvCqwWIsy{xSXjv6(BSR9-E2O=!hqra`i&STJ8y8di<^NaCp|3y zGnw$nP5mS-Uh<{ok1f+p++O+(g|p;17xC5rFws6Mk_(o*KOwLl9!xj&c3M3Gth=dSpQw(5}8rz9A)p=8$1+=`FEG z7jv^XwybtFuy2u%B03&zaG*%SN$+~hJ41DnuRbODm;| z`5QFsZcW2}ySV<(DQuBO^ea@cD?}U`i&Y=DLknM@kn<4R{U%?c1E#PuHuiFzBvVB>iHpz>R+XH}@_)RScWOqndqQMF6 z0%Vif{1_n2+sHnXd-kDZJ2SiBXXM~FmMD!Yj~CmI9`0QmEBA~23-%Fmb5t)B4YQ_( zw7;t_v>Q?p9+C6%jTfr(+L}~c`=x2t8z0xD1j2U3_RU+ktM+VO?F<_w-xq3u1Ub3+ z1blyZJRYAvcP^8L@-!nCCE`{i_b5`zm%l%}+bEod_&u8qdrY5+NIE$yB3Ckdf*U|5 zU<6nX3tHmeq-NW}1V|R~sbg(m{$#y1^M~?zE_?ad>)J$-tm|y$pkMDX)jE5t_Eno* zQnOujGV|*&P_TvL70blhj+5NYcPgAHnR0PBPFXDvGjfbDM;|oKhUmict6s8>x%nSb zteC?8_B2vPgDl!;ZdQpKV^E_8+EHC~+VhF1id7{3bTcyN&Z$vg`|FYsue-zkywYra z)cl?=lFw1B9H%rkOx}n8cqzrDI-`ZK^;13MqM1KT^=@j!8P4M}M7Rf_cNvC9IG!jW zV~oTM%Q$y4vPm$oZcyDoM%FQqOx*+@meLFM6RZjiHiE<4FI4qmvbAo`QC2P3$tuyd z!yhu8SaIJ{9jQu#JYk;ewwc>0>WDP@6Rb{PHf&@Ee@ya{a&+IWKNSV%rKglJ^Zj@9+ZDB50YvF6{-`Samk}=U2Q~}jZ2yCo*PG44Bd|c{NEF`K zKOSt~(coDlo7&Mupeo9c#r9Q92k|!sqd;sA6h_pc51AemD2FXRF6zCE>TD{Ryua}4 zlMlNS-1vOLpj0Qn&DUC1+WZVs;bWAIU*2>96POE@4aDLOE%_8H zh|~qy4F)GYzP?=u-WjTqf~b5JvSuJ3H7SpU z9=64vrjO}t^kV<>@Yt5JJq6IL3HVU%oj;D)a(|YTEMB-^%cU0#O~<$cjAEyTPF0XL!pf^ zVLs$H$fOpaZe+W#nHG}pt+2vkaVLLJ#kCt{yk`H64Fwe6W6?&La1r`9{X?P-_8@q7D~K! z%&JQUm9Bn{yEu(%!${P-(rB=Q6pPpfZUa?9)*<%KP=~TLu)d;3!lq*2iFW9(|8D9O zQ$NUS!d~gJSRt%}anw(S=ITb{rj>=kA$tbf+%mDcogmF}e?>vyM(J2_v-n(VJUGpn z6H#SMa?`D(PSaqkHdGWs>7Z6`0X45V`qRm2F_LD>{A8$4Ak2we3G{>1{Et_PkGjWT zs6QNSar|q8V5t6%39yxH1OfjLtNpG5m#+u8NK;8mA9m8;b~V>NUvj-z)43Um0NQ7{Q*!^ePi<3=(Kyn!qe zc#eEURT_uZd~)Nj54a8k)Lg&&uHf_TU_xpbxpJsn>!dm(QkZ0qJ@{;TpjV^IieT$| z6?|{>#K?gz61FW`mqDkV{&FY9o z?cJgL@hV}5jE`>ujf|l!^12v&`io9tFTalK8jTvb0Uo=nic?;4X~=l%%!Fn{|E7y1 ztdzJ&$vBmK`TTdG43Vv%(e|r(^;t+G(}WwP36zylWu~qT6je>XVdj9vhrr|eSxgC& z?*#2iR>$#*a_?v$+pkex?zmb5RIF5LI1J99^fmGZ$o*WoVSlNJ3shK3f3y5jsbr`_ z{B_OD9mepC`0T3R$9-PWXIb^B;!-8;>h`=nsg+Qv+V(tBr6CY;@#M?Bx%(NHOaJj+ zm6Yc>*5w5W(nEPv`7SN5$|M%}kwo!&FI{bV_lCHImmF6)PjZlil_DQ^<7+ru!vEXf z2T`VrfvNaqNx)0;HXPY}fp6M;nw5#*I*E`c_%nL76^g2Mgk-UN)llRX(`K5u*!@hQ zw1I04gJ|Smx$reWx%(4O85Z@-3j*VrdxfpO{YU;~{wM!>?#aL~5PySQqiJp(aNL)4 zRG|)H0yMWaJ+}1qOx$pC$`Ho%z%cZ|F#MowSETDP14eXy+ViHp7MJ_YH#VL?bEN{r zAnxYhnF^!ERL5GmH)*#W>nj2$bElX|MlO9h-!dPobpQS(M%Qm=o+8fP3jFCCfoDy? zD)tH+_l274R#+ur80iq}KC4C@74f*}1W+q^!6acK2}PGsK~A56Te z+-(OcPon2r86jg6Ia+Nuw3ho?i-Sd^-J@-{gqFu#i-X3bCsd0ABBVCFtA9v_Hyhg_ z*J=klZXV9;4nN5}J$ci^#_-5)oSu%{DG_65t99J1wu~_tc-b6%k!tCGxm%6L!79Xr zl#LFm9I8Amw+{(--i&Lyn|Q;;MK8Z=@-x=~&*`9U4=I;@4+xhkn5@5OoZe`5^>lX@ ze7PEz{bnF8TSEkJ>CxHnRxoPnp^Z^Tf2X0*^3fXMxW8kDrTX|B=@toiPd|wA%&7*@ ze2WfcdGK6r>I7OB+*__X|WDR!(2|66s-4H6~1JX7tVXE>Gy_;xq!BDE|Jj{0XP zxD(@(f^X(bH8kcx*+ih76aIuaUBf1+%`2R?$v4~bCh_Umu2i4m53^*ah@JjJT6}0=JU>r81nZovt|Rm^CwmKs{BVbF}p2t7r@f0bM#<%3YyLq|p?; z+EYI00GYVNXdS=ox?QW@%J&}R$d1JQQ@uU(9*G;7Fn2<2)#Xls(IqTTDKRweS8hE7 z_C4N}7eeaO@p%9Kykz*EyO=yb@B3Q&{)NtFSBGsCn!Yliai5`>htSYK-Hkf1ruHq3 zmq42+92s)mgF14E63a^B{z|}svP|By#^dR80J>dK`-^OM;21r+br}`1SARd)we+r< z{U<;OKq{~>g@CxFsiunw+MS-fl)6l<4*lcEh_h8hhSO!uLkyCJ0iB98|sa9b1Zbgoe>qSP^u7~E0g0~}p$?Yo#+ZAPp; zT^tAlqzYSj%~~iG743jIyCC)o*sFCJcGKF35F{rJcZNN2uXUC^YwwvTE>WD<3xq5`*-s`l3eknuRX|b!XTIgPINfmIYlIgsM$(pY)$# zVuX70IAnN(!`VLz9?gHZ4_f89i@Bm$_NS4R&i(C2CK?&1dRgV}_t5(;`x4=XPS; ztIF5u4~`6ab0%T>^NXMnW8%V&sLkN$Ru4Hsn;7S>geU@TmXoVv5dGsYY8@#Qk9SWF zZYbiU{Wsqo+)mFmYN+9fTI*IB&kUTQGmtk`&xu>=5X|e+XLC4l`>pjWe&&XoH+s#z zgEK2Io$m3Ww}8$X_J0rPpldE47XD~hk_zqSi&}f5BooA-*WO6w5AvmaK8Z=I<~3Gg zdABE)1xQaP=w~M3q;qt42(Rt)EGZa-HeHs+~Al6U)6znCg>ILml@h3`RWQuh6Wbl?bVp;3IvIUES^Z6}xcc#U#9+fir4XlCb6 zm1=u1^|FfXqW@GtvY5u4Bmxw{cfLE#AEP`Pee|Lxs`g5(A{oFwz$wgZBk8kc3}IFJ=A#~- zDnea01JZ`$uvg{up2tKwMDZ;VAU7-O?Gn-?-gXYKC71Ugr|$m7-6PVV;*TBE*JVE) zDt^p3%{Wra^>U0FRXrL5YY+bR^n$|oWT26C4X9r@Ip{t4zhuLQ*r~Poz9}Rz& zp2jG9VUX~M-<86x^)+0F0^F7t-vlNF&zAezZmOYv|LoW8V5qU-P(rn};m}V%-pSE$ z2)V}8a7c;HhVxIeq2Z9>hB56=lg<2pUeH{(|LJL~b^eTHA_)wE56eYtSkV8UyBO>M zSln2k)u46z=KAgMbsI2Sw(PVK_Ev1g$=ACHP0N* z5j)?tB!%7agMuB=LveIBAErZ63@-bxBQE>v00tSd9kbEco`CWY)V?Xs|yXvwmj#)V}xu?#x3FP!wpI zRmI^f34Tp?;9p7Iic`X}=l0WT5U25vOpJ%tJ`_T)vfq@l$4 zZ*Ov~1;;bLetZ75~9GLgJzCl6wq$Kk#Du|CA6yD^Qnj?*t=ATbSStcww zS_B{mc93mPo1a_d@`g-S3D~SSq!JHOn6C%o0(U_#{nt}?1|hxwM?mbnxD&(6$EV1} zJ)8K{|L*DP+(h?q!Iy6ZQwdrc*k1mx3s+CI*%cYF^mu6VSi3$#MUBEDiEV%*b(qm_ z=cf6C6h22vAnuZB%L?X^kKh6Zq25k@&?;J_W>&Ka5FYCnBMw?2W~I5WB< zVcH2-_j;G*4(%7dw<_}I_2uK--f3b_K zM)zrlRzTS;M_x)_zp6(m?hO-R!kRQUyQeq=2RJPt`_z3t?NW!#@^|X3#L`avA&x+) z6vS*F8sROeQe<3cCza}fY(W-53c&dXCbomFh1tL>ey>3wuG>k_&D%YC*;V3!jV(+) z*F3<58J}5+a4bOEDTCQa)-u#kYz`~S8R$-UkcT?pnFo1_YPSx7K0#6Kb=$nnM=v9) z2=(IjKt;AC3J0HjFvBRqJ;G~-t4ph$x@OZ?OOUUjf{q-El8>%0F?~3ZdRur|PBX|9 zfLFNumG3EU3|m=nj~_lVZ-p1lZ;CRpL}Z>uXjz~mF)et@mprQXbq6g8^o4|Kbf8`Xt(7f(u*e-}cvhL3Sr~Q_hJSYeLNdVUQky5IHh-kVMbV{K$_e z?DAjsvQf?rM#Lc^{yPS_B6!ticE9>yLrc1yr9kaaOVDg-0F;{3CzpKh_ z%@C4I)XkGM0cNb$-J&JyrHvJyS5oq}FG%VCRyZr4$Z1rHSc_q?%wkfXl@FJ^wN zIi3+2JEWH|8E?7iE9A1hP1o~OQ2-hnfhx%RW_HlO0J+Ze(LE#*wsJ231&`Dc4)xW4C`QL`s?>c^eNtkVs2;G+1Or6Y+sXg_u1n@V>0 zBLpN>`hlJVC27$xBeXloo#y80MhIao`Z=`ta5BRCAfASFbnC3FrgXH5Ge%>nbrl8d z@RwP><|BYUhaQrP3vD$ly80Dy_eWe`;wA*PO=PYVn z{=INTW*79s$g(Kx-PbBoz0C0N!dpA7(bM^y3D%|MRq076*KvnNH zBLY7>vDN`3t={gn&sA3kalsc5%m50S7|D$gfT!==OcB{ytXOfH4+} zhV1#XzFSsT*(*Pkpy>i-{jo6cW5_|>o^g@jE`_ykkjH-Cqdmu(Z;aIlh)*u&uQhvSw2DMfnJpG| zKj3JmPL9SCG=Xb*=_tF0|BjIgP|#P&TPP-y)`ydSt@XVylH@Dj6I@e71KzWB|{o0u)l1 zFmh{(HR-necBh<96f)NN>^3Q>QXsc9_XR3A^VRYBj4*680O|I(L28Z%unD8?!qi&M z&_ezjTg4eX7L%k+G2^ssG8e?CY;Xl9qVXE)Qa}*V-Q3cCulcL_J~CKg`9Q#_CX=%L zzfAWb*nS*lYA^+9G%UDFIxShU;<=wCP-BsVoWJmmCy-#J=r$QeaV(yevNlJ%+u@Ia zc;q-A7m+ZSNaV3Jr7Ru+Wu-bC-0z=?a?F{QyzNa0$;r~ z>cHSemnteN(!MG_k|(o*#5>w9R0<}!dq<9Mi9+G9F)u1Sj|CKAL+-QdW^s765(Te} zlfnoQ!eoDseL8#`g#f8HB}NlM6*WJidkC9aLy0o2Eg6CxJS1C>W884K*@yR1q;= z95M((M!noUpu9-{EAe0(wD46@Vqzpsbh($$2~Rdug(bt65Gvd=<;hK5+Pt!y3?gMC z|KdMW28lMTlY`YCuZ-O(wp49EM&Zd zlSSyxS2P`(H^8We2tkCf2RZ@WN~1-!D>Ve-=Ex~L3Z72%Q;Iu)4yCh z4B?c(GF1d`hEvOczj(;IXp9oR%!btW!j&$+Qkk&+$bzLzXWEBf zdIgT`e_2=zQFuK&7v}O^cERotCPElqOu)5b?29%RNDN_dX&`iMZa*YfKM-={6C^_v zkdS?W0H}~arzPit#f}b2Me~LTvhdow@B?mQYCvUT40mNdr&;s=z}SHlBktKumI)Op_Do3wEut<=z`+|RfHNAzdq5l!mA!S-gNiyVA0;>}T1=%~WN zCHP4$-vw0^J(Gh|_9Yg|05z)T6+`7RdQwmYQbZq2RrYps6DSOva76Y8SQz5;5x|cf z6E+oZ7|=IfZlH^T6CyHsoEZwTmW}SEBTi*)HIdr#0VGKs)+K|$*7@KQI~T!4K`u;z znw_ouehU#@+~4Z{0_!cWyPSS+L%bOOxWB0Et{78k$m#}4&c5loVZ~6pw_}g}jq>PL zsdsE9$**MrRrK;c#5Mg;Ox=*rtNKWsAfax*+-B(m>J{l2uO5g1NNaUG>KO2JEH$*~ zncuWR%2aZ!aR7Q{PU8_^#!^<*IDEFvZ3S?OYG4xa-P9wv_iCegD`x7g%COJJ%`qS* zFH>TfO)a*wlOb94I*+KCW}yB^AL2yrR!sw7h?80&Z$%u@r-xN5S|cbk(JM{jh5-Xb zd@Fe@Jwfe0`=G?*a!5<@Vvpy4YqvTypE*JQCigs~;J^nnU#;#O@%zk$fPTTIr(DT1 zoLcgjBPOoAHU`djrdfJHLB^tyWTXAE$ZBcVK2pTEh?vez6jx;wzr8G)(@>bz&aMQS ztYj)1fREN7*#f}l&N0weT4q(!*;m0^hS3Ex(vaw49h>Y1HY$NO1cH?BjL5uq)r`la zUb0cn-bz*VL3K|-j`O72!Ut}QOB`F!KMdLM&v5fNDrSu{nX$;ps9(@_gTUTE**`%&`;uUg7Sy@Eq)Mp#2-zF zWa_4zr)tD0ZmFSz8=cB>oYeeVcx?oe8F87><|qWj!Mzx$Jk5%I@ZG*U4$lP8MCJt$TvZzd(Nd6I z5Yv&a4jnM+hty^wDwu>+RvHqRL_&=$`%EBlhkw1sTPra=He5JFXU5MVY2cL51EGFk zdfXB+i2S*BPiV1_1Egt9$V-|DtQJr*IIVm~m;grWcIaVbUERxbm&GKVg#T zC3Y$pPN}f71)@26)i%!wRfvc0m%`G>{4-VI6ML=9+a6ME+a8`TwKMg_7LfdjB&|WA z)H0XL=n1pd9dRmYWGeVnoEYKo$x>Gf4R0tLo}48Oia}?r(}B+II{Zcb55S8}XF*sF zJaat&gix8$Ye`ZS@(W$3hn6S8R8V+?k3LjpzN3@8aQK9&IxXJwK*$~pB$bxi`Z}hdNUTgivT$S8wDC-FGwVqeMJ?cxhNf zOazIGwqktP#r==&9qW0jxn<#CiCAaIeH{J-a%3UE-Ny@~aOG~fqBy_?Pz|K*eW^V+ zb+IFaopDoRY=!ie?;&tV_Xjmg8Gr>G;T#6t$&LQv!igjFkZ}wWQVgfgi&NQjd&C>a z=+dD#fC@9NYGbWO-;9fTsHy@#Eu@Lsq-_O(C27NX;)J0SUOQdnWcQIb77TY^zmhwd zltx)h>%;jgY!hmE@RMpJWSg;kdW=Tcn^#)hK+7n~-(J3ZMtJ{z+D9GNd4w(r2Mmq> zY)uBHxO6{7?yGSo1R-^$aL_abPHK4!cd4gP#+QOga@>z3cDwOm?6mNEzzhhsUW!)uPQ?mU)!C9+~{foWzpYf*PDC&=EkuxKr^E6?Qx?F|Jff9tE%ym|9gPG1b z{*w{`IQ)e_bZMHvSXe!Im9azSMDs5(r|W;N?j?ZOn`Kwiicoggo&RmJ&Ws2(N~}F< zI_3-P?8t;*HtY{>U6i`ff{{`_rLFxNXt7d72pJxLU|>L@B5f<`xqKtspBXN2oMhas zr!_O6HVq*K!nHY9V%g4F{%pn+0V8VnJ7@0(?5vrNL96J(PD=RrCagdIF(~ldw3s(G zp2yv?cRdt^Vpwiur-|`r_DrgX>ZT1H2=crii!xg!#h>t5PY3eVmns2$qFM^xRK%fM zA5FUG%!V7NuhHXy_jWg}4s#(8?)zEj{w0FiX%dAze+Ze?qA zG+H{np(qk9v!C`FAA;`7DE%rSvkwFy-U?<5zolBt2S3&K zSh43h3+zD7D-ZJ|z_~T!a~SDo+|a@cK}tM2QB@o_S|K@@P~{b{RwfGUd*A0 z2Vz0Q(;aKb~eeS};o z)!N}kTcOF+Ft2(k#n7Y1g3%LF0MSYJsd7-E==vM9=vYwQ(m$mbnh;)xg+SOMym9`xGjrI23Ptq8;F|7Z zk1;dK>q)t?V2N(_R8tPvp~ZoQq=P0XX){3rMf7*)s!inJ3SlKXosZ{8br}UA2Q`Cw zOx6SmB1tVu@&7{&R&o#qaReL-&O(t}8#AgBFtX_ofC`JgZXv1NKy;gCGg?Q1&elx-jDY6|i;)*lI3Iozs z|JKoSBgGWOua^f$;8}<>N#4D;tdFOBR(adN5uin^NAMgPO5$-2(a_{s0(QY!!RYg* zI2W{rz#vX6RGJkOpwkd9kOtCoxL}}8^QR1^q}(Jh=W7UfogK$f#)V|FlCiNM;cY}u zkp9BBCvaMa<>M*;Stj>sK=CJIZd*GwZt$DYcIxsc0+|G@LWc&A6djiWVs6-#mg#p^ z4Q1?>v(td+R6j+*TP#s~YNGsA*doPI3)L-meR`sM1@a~pWsR7)oDf}dclgmgg24)8 z-DVO8LTqY7FtqopZBhM*J$Rc@W0m?KeWYfG0 zq2+f@*lCQZ9l<^bG4Sy`bQ%cPoD||Bc>=Eq7LsV7y_nZfW%f06pae%mlpJE>8$X~G z9`q=P7`aA;{QkjX9ik|AigIgFo@K`cG{|D^a$m8(WDW!ZVqw~Qr;0)&LhBHO8*DM) z4lY{%w=2R+K7WF)s1L*mJ8uTcP=D~{)lBI*Zqm;gPGssY2A7EU{5q1WMN-TjD(_2+ zpIR(^6#}VVGUo!quth;SObqCRuXeN^&}zNUy2gHiRmRtYndZ!qD;597A*E0uQlbHG zW#S<=h(e2^om5wgVnJ{Oc^nfzC5qC9z|&7b#1!s85hChQ?fH?6u2I6~?MNJ6=BBSe zU`?+>B1D*tu6`ie#004n3OtJuq(E8u-^+TEENYBTZs>A4f2Y$JL9+T4e~K`A=4B4? zH!rb|h9JPh853Ea+b|`~YEz_mPDxuu{Cpk+kOr6hlfcbk#ae}nlbnvUa)~A+Dn$23 z=Lh`}6K)7dFgdklLKR4%e1>Tuco1-o&-SW{X61a*xi`>K2Q$Ax>YDH9Bi&W~zq*s0 z&GMlpq*tbV2!8cTn1?nuEGW1c-B3q4DH@oTNcW894dX!VmcC0z1}CP3?z7vhlnPna zXn}c<8h%4R1e`q2X!x&nKAw^q`p2bZl&LJqNiE!aF7m{dsGQ+?-JtU9I?gxH!6;J8 z68_EzjlVE*>}spPOk$qN#ORxQr2H!*3B08*YWA_vy^)Tz?KG?$v)~w`8`pFpsq-VZ z&L!-*G6=t2D4Qr#!<0jes+73|9H6pgb2~X_!&Nio%oT;9S=homk?)F^XIVmMVJW(X z7Yr3tp&t!&WUr3k^IYvMMqywCuEQ`6#Cam89JyDRwy*Q^SQd?5pkky?0(3{G_9k#PjG%%LKQ9K<2HLW5aMU;wynyf8_9pOCBplYunXq3UPA&yW--#3 zVb1$Oqoh!mtLC&d!7<Va=t$FEv(U+o%u7)8RgzHPv=bqO^qS$s4FV~6i!4M7k97KrI6<_1nz-dN+3vaSOS z>$~pAQv*SwD=221k{uKey9uf&p|P4ss);{w{H)gjkQOH{PSttOQL@?9EMuAy5Ou9@ z@uWXTBK@@zPPqBy9ni4$%T~GJ{tIpFe>-{89R&Sg&5;B}8EAmmWyC+r?3(PqI%RV) zvbG1yEeEF!91ardQ z;1)$E-C$~74GK5Az&Gs%jBOgVmNX?j0N!|vxf39Z1@`|s`y&ry!M69Vq7kAxVnK`s zD>lih*SyG~xDj$N*LD4F3R5l}@xuT@G(4T07$PtBR}8-{ChGS(Zy?`jMZ6Bj=lkSk z_amr|8(Lfv@K`pfz?P8O#>+Vw+*|0~M3gU$XjYr)?++z5b6kgnjEz;B&4Wi2XIY2a-Qry(jrA@dN5uF&3&I@I_Z!79h@lx& z?e~Hf+J0&3+vt-@GPH~djCYONQ##q@>srM{2Tgq`GudeYA7Vl@o9fq4w#awvP~)25 zCt@7?k7XX4PFls1MvjCXE2cgKi*z{JyPishf*X8TvX3?{pX5+GrB#goIp3MM$S+6m zI3BV@cPxrkM0LR)#WPJb|N1kQUhwwM07-FpnTY=}53Mh06bURP_Ffk1Dm#-BVR`d#bH_%PBaVnDJC*Pr##AC zR#?yE0R94mCpMpcm@?o*!Na6~-7nNIK-0G&Znl1tpaD@Hi;uQ-@KDKbu7*#RF+Jxy z2E6QE;Eyr}EWxQ?Yv90Z9;nc^H=zKxPX29uf%4xYB=T_W_Tvhxy!#h3VD-*~NsydV zhp}kYh1cz9t~iDgnVxz>buL73GamzR^?3%pQe)5azV#8(E>A~dd#;j;S|UxXGw?XS z5MyGO>d&2O0kK0}A~qV|6#8a>g%&II=f+c6mrbq6@jEIvvP6)ehpqpfyf1Dvs&_eY zWG~tqB?&dS*D+t<8&jNjH{YwYEe{6-mX;nrLMlIWsvV?^TVRP!sT@6~7K?{w?mVF= z$Yn5=P=I6LR!YO~?$F72_5yW}#3QiW2x!^-gn)cT(%S+;2E+aKCml<0qXDzG1~m}n zi}q71D2g|!dg0&A%1TmzPUbC1vv|ENL9BQraExUV)({kxJ@<QbZfHX$&!NTLttoUGLPT{v!RrcE z< z{qcn9H=IYvs3ilA&?Dp^ejQHflG9LA!z(U3HTsSoBsy0eyk|=o5HLWJF6X5W!(Wag z_SIaF+^9IUYu;KdelE$i`=$i~n{RAVYh7b!=zGrvve3;*;6Zu>5N-ey!TJu!?aWdX zd?-EgThYG-WXs$jbN;Sg3?-msz%E(f9~7tGP{8qB!XP@c&xEayt&=lrE?V<9yMb*s zuQghRT1%G2ybK#-&L`zjT1#6jGdpk z-D<&Es>o@`OAL?w!;(;t$V}Qj|K`Jk&ZV#UocmVd>??uoSzdybZF;EIB-WmTFnW`e zeu+z2@aELjTM9Pb4RYD0RHLI_hxW-$NmG2)`BqW-U{R&C-;>72;bnvsEw_U90_}na z`UM00agF(PfWgJs$HV3kqnjCl4Z()L@_F8ltv}6fq4F!zM<29~cZOW^CnM?E%n5{@ z2y~!KjtQ$|&+^>Oydrz~cX)~nj}8ydrOxKfE_C_Ug%1$;>w~(5IFU3BD$aF^X{E1+ zi>=2JE4rKR^6W8NOpiD1$ZsEy8YG>N4QUcE=T^s}IrG3`6oto^rl#&rhf){>NS?yb zW3}6NviWf#He@3*jFWma+8$fAA%>lsuLBJ>rOl{LkO)|)wM6xO&@@ zu|NpcR)7+0Iaj0bN_MXR*$)bGYE)y5a@woF=n}UL# zPJKKom<{@c{0IeuV^F`;#kpeD5%~)IYh_k<#&C6Tb%@5js8LAoRaE0>;iEHv1wUxp zQebM4%7zNj-e>xw(>mkNM>#e_)+aH3yDsxrLbn9MiN17l(Cn(wFkRR1ZKKfSYp$eH zESbK>8PVh2d;WP>Uicprr{M?1!K(N{aRLgoT-U}*-ek^(@zxNE^C=i-HI&V_IkZ+M zZ8EX`XxRRa@IeQ~20yVip#fo@Jsn$A+zpca*t0Xh6ROStZ2$b-ux?5w|LN>-j;Ud@ z51{Zn2c4Vo@YcV9r+R7>n4?9D@*C(94JgE^!l;x};dW@YiP)8%$vlrTniK95^+M@% z=fab@E5(<$5MkYZ%CGJ$h$0(!Vs}GPbk6)()Q23NI;+XrrJmP17kyG6cVKHM_q7&y zIAMMSSwf6f+vh#XPtu&?`V3lcO`dP~-qxb;)yR7z`)`jw$>n>Ml{Pw!3+NSd+0%-! zWXOLI%EvUl4jpMJ{J}Rg{!@oS=UE`&t?Aolv?v9ti0kf`Lj6$(D>~W7R~HM>Uz!A1 za3^FzgeQaqc(&5(_Pi*iq#WlzU?GVoNNDvKJ6(*~LI+mE+d=}2G zVAN36sVPY%?0-B=&bqoFfvNe~iI(0lN&cLrP6H`}Zh~CsQ(OFELm)?J$pvI^rZC%r zRJ!kFlw5JRRE`LgzvDXi$^NCFl>l*;nRVfmKyAc7VcnNyQ=BKX{tTV#AQc+}O--JT zw_c0i^0#ITm6a#)@Tg(K#41b-q^$%o9#18ahV4-Fx66avxJJN&*=kK2vRYPfT@hqb z{X8ox(^Y<>l@uRzsGozy575@D?>SwEc69Miw+v)#c^DRTgF`# zbRS@ZWF;h!oLVI1ipMA}QB7y^(XL<=%mUKtH@|_Fzs7gQT=vrLVt4O%<*^EIy%b-8 zZw}hy(HV|?2!A2lBW>^6mP0_UkpO(7d#9by?Y{bK_myiTL zHC+lbD<=NZrt(Ba`%UHo+7gk$Agx@70rkib0CM zxrg;6tz`@u=+0{V^$YC+9>W`0NuwG9|4Pp=GHqHkIBp57t z)c&Q4P-Vz3*WYu#V0nqB7Cg!QX6s1G=bq$ z(9Pk0NRG(ZD9jOYphRFE@n7EKww$8RLFZyrFFydsD9ArDGZVNG%MB;E)ii5NU~aJN zdS9;pli08Y=@dVNBL9Okz-V+7iZ2V5412*iA51lUJ1giofu!?{FUBeh6AUhu?G{Kd zy73Q)I6yLem@)^7HvzSYvZIm&hwxp0Vz-{{I3PWaz%kR1#D_@I@$yhMBnyR75HU&)F|; z%Z7c)>mg*uLt%nYij+}dv(Xf6P~xv*R~l~}l<2yQbPQk%Ke6c0Lz@OxaR(__QsvI8 zj0d`YWqdux$U~4fWgE?xTU6IZ0x8% z4HtTheJ`9=gPhKI4EUUOQD8yop8`UZ=&M07(tBQHUA7+>M^tYxzWSD)2rL3y)HWsx z-P;9g)heO|C_#|=!#Y_LCPJN*#=^#1sIlLIuQ_mPR72z^6i6auQKU+IQ@m89WPOOk zA1QoaN)Y3Wo5$k-_){1>csSZdPGpfti!Z-0pHTPJYU1H9IXJu>!#?2e&b=Bjlcmvw z0Fp(FNt^lGD%76y4-u!K-=PjDwGbmuIWvr2JGx2BatL#4v$Lt&*a4u{1GYC>6g2cARv> z-v56zf;Qbb86?PII9)7zc7h3%?PG7D0=0V2pjhCFa@C>6a46(--?jD;D(nmmlP6LV zNj`?#+0|sFK0tB<0>owv-3}=IC#k1=)4`Pp?2(nNwQj?LSso8Qx7Dy5$SIzw+YJGC zpBI9P;n4kASI`Tm_|lB=n$;ptjxt_YlF#o44#EONgy8GZIfK=oDm~>J2XTE0vwIu@+5yKJ^j2QoL4q24USF5-zs*P8AVqeo{KbpfCim_*CI&_v^9CU9Zp+D60ukB_JHX& zT5Lhx8Z4|GRnzWdn^KT{N%AT|lm&k!k)`{|3}tQ}p`RZt`isY$GK9zBgcV|sF9C*6 z3B#BRN1BL8Nuz@jG9xJ@!>wz6=!F?GwQ!ZW!qPuG6$_%_yCkG5fj_Qzwko31k4sT- znT_PY3vaNNwynHwz#5VmXf!bvAkUv*iM6yqr;Toba$FxiCl{Qr)U>2KJT@I#gdO(E zc+dn-R4q=f^b?JYb;^iG?zd7;L*)r0Va1mj@o>>OFqP*GEhNy%v8qSMnS%dbzA*GRB2 z(LqIsv1h_i(iSLTP#zu2MJ+wzi$|?;?Z|59Xc@JuM9wu1tX-ipG4>2vQ(uGuU}dfz z8+r#ZcY+Ze%&4;2MR!dJe5q9AM4oUkN^)=Ml)1n{q!u>X#;9O*=E)m3ELf#7B6ifZ z>|$7=ux5o3C{V(vzyFf5Ib8p-&sHPPl1tQwm=>F*jbl%@|FK-ZPI>xdKH1nb=1f4`?(QN$Te8Q8k#@Gm3r@DNP}kB4m(JF90Ai ztvIY7r6TvBi`){4-3KY}u2hx45JX{o((9m>8O4L_IkWHXN+l zL|4fM7DnkaTTjWGU^&5qqfbNrMb8}vHU){6AMS!@B^G<=;E^a;>4UaHQ}~>P5>c&3 z@+biv@Hiu{jPb7seyl{!oJD3bBedXgP|5>CpA{h3JAFJG2N#N#l0!mQ+i3H%za*vo zx4*DUFOH?d(DV=Jutp+ChG0sRr035> z24f+1rA=5jV5CH3qll&_tkJil?|Lyh5za(Tu>6N2Le%GEpMuE{Q6Q+vV%pfPdPxdY zHzHk@Ry`eP;&KP@s;J}wP>JV8Gt^>mC5LztlMIz1qem-!yq$qYe4 zS~Vwvom92<*RU7kwIU5xN81}FC;7lmio*}Xz~p;kGW`A5O3a~MyOuv|lU{H*(B-Y@ zVbd6`Xu!@Khn+{%FJwzRhIYvnQdfY4-oz;0faK4>Pv!pquy;>EvV7sYpxd@>+qQPw zw$0tPZQHhO+s1C&Hm3jQM9j?1nTxspMdU?R<%)HaRZ+Fp^XB(`WoLwh;~Y#2L5M&e zdqfq0=l^!bW;O0=#sWa3a5qK?BtRIRA;KJP>^J9pXpkBCKdOCx-OXJFM9^BG1j9j= zAVfm?-xLO+L_LdidqvZcRY>r-q_T}K;lI;u$1Dt0+c`nf@Ex!tagH|4ATUbqWSr*d zF*k-Svm_BF8V!?;zGU+d5r+Y!kkL|Lzy2Ht6fF&L^c zOZm(3bCS24A$h?F1Q_CwTOrl}v;tdlq+1~^v8Y&9ZsZDGb~0NEwH@Zp) z78Ev5vZnAGQM8OqX6N3<`u&ABdTTB;HiQtLn;gR}KKy?ndUVNK474rEuo-g^*#E}! z^&%A8K_g(?LpT#0yHR2wc%($kiA}_WJOfNiL^zrd1ncA}-|ZR|B$l}f-f#o6S)0W+ z1YPqLl~e~|j9(!CE+TzTWbpWm82SbD(W_vbHimaqsYhBirZ>oOe<0zBhly59NjQ9E zzSrLZ0$BPrT<6h~kfOoj*hl^{j$HFK>zk;$a7F?}jvDlMA`!r!;F=fF#XlO6we& zFv8$1W%BE?G?Lx@{!ttOx&4r&%H~Z*>2Ai@Fz;u}QC>YVh6u5_+OXIiq&DKM`apPp z^73&{6&t;4gm(CVJU0aW4ZjQF_(fl|UweYW)0Rne&{pDX=d$n9q_^F)^z8>YO<^Ev%0ocqVByJ84dgm-wHrkA;8aGO z-4BDpKhJzybN`h6PbPkVz#>%&?(XeQ_bwM8LK1P{8XBGhb+D0g>T%oOSY79DTc^XK zjQ=$J|5L-O{?qXPH2gme|4+mJ)A0W^{67uLFT3&FbkXGg^v z9;!5m(PqGmHYA{*qZ8(QI5jmE0rfYkxa^Xw&;#6EZmPOMCU!Ck3ZIETg!;P`xL7O< z5xI#e4D5BD0C}X}d#(?o^sjO{&z&U#$+Xi$FaS`0oPD`$N6;H#H&{{)^;Y_*r5hp9 zFz!9N*0cPkM+6?Nlo+Z}yy;~cQzj(7LOQyd8k-v%dzxW?vi+#4wwdShb&&yYuYyMO zP14Ub|HK_F>tPTv9aqac?0-lixc)C0e}rt6UCRI8GJa(KKQeChZC#9*z^2tc4^Atn zIG*k?ysn}9k3$JGG!R!|@V?^pZUnX>JPy9TVPmlKu?2Nl&m6~>k%Zh5UtW!XNm??c zDF#>EG%Q&+=Lim*da`=7fzqx*P|h0gT}_3U1Hs6oerhQ?J?fsaQXZyhM4Y9jmZi~F zr{LxMh8JX~e!S~f#RDoxm|8XGRu#|W)o2>mC#bHXLmhp$;{ljJi`BOF1!!39Cxn4@ z@iG65+dOL&Qgh<~P{YpLboCc|?LK2g(H8i-QdQRsZ;w_gq>xcrEzyegu+?iz_n%VD z=~QSSf3#X9On<*_0HQJR$v6vJQ}6V@RIXbu@N8}^v9McbRI%eLepmpGUIdU8gW}iP z@j_Y&Dw-lf`bZ;1p+1qR;HONEYF}+>q>DYN1lxI#i`8$5jt(_Ll_dv-tb8tymWo7t8ep0FI7lvi)=-YCd-~fvBfg zhsl(m5@}OdC-sI4lZ4fOuUKDO+xS)vnJK}n*n4?S7ug>0XWpIC&#=t@hO$> zU(rKXg6v|x-#WkI%fNc_tK2?t>`E8^qMfQNpn4Y|u6bD7LDql@aL;;JWy2tJT|5#4 zF&dEiojbcjF5$n85iE>2f%^HR{6VGdL^sT)8^$E7)099on{3~T2Y&}=A`QAy#Cgod zJfNQp^54ApXQ0Ct9*!pR4X$nmfRr`4)ED_M6v1V2*n0Xtm9$1pf?h=bFen+n663zVA-TY-Y+#rLnDw|aPI(oq=CZvKgU12nDlc{l}6vU=`#}7 zdn#d3HAJ150t(4_iS5jB3sX4u`WUm%x?UB;kXPC;#k@(cQm|)+JbN$hQKif=?|iq3 z_>%u-hRt2DrsdRE>A;$%{Wkc-azAN;kLko7>4@JUXP1WaOu;jKn2lgt>QQ~{G2Zy#+^7hxfge3S z!+?D2UXm&55w)^1<9c#X6h5!BIowLDhC7Gi_xCjZMD_Z5pP;*^xV(PIqq$nS7zM(+ z`7jIX_p655yq-FarNI08r)s}8*IyB@)kWif`@BH=Iz-~6?POm z*kOxP_~w=G7}=)1aOj`^iH=H}n|nbMgDnWr>)QJouBEafV|ZI5^S2mG&#M=nU*Nc{ zx5L3;`lL`43jkRdP-n1$DU=9~20MH3t^y7h-vEm5qbfvjn+ zC;SeG4#&V>c!3iO3tAk;h>v3u3kO+U=0Nn#0drmcO{|=`Oe#ATR2}+AhQSVqObv(| zKf12ws2LT8Dfm&ji$2qxhB(dqmDDj})ASJO8~ni8UJ> zy`RdI0F6C7>nnbjioG%1wtw@0vHJUVuKEA{;czx6baQ>Cw?^Sd`@Qx2&cCB4*&Gnn zZYLwC(^%Oqanu-0wb#f5Rt^){h`cB=b3a7UrZAxCi2mo;*7$kiS2q?cyY}MoIT=CP zYGK{WRyifgAjoXD+~4nFU2J*n#0#dUsv?L;`R=+hzuGqnMtVHSCKa0-k_YKsvd%{x zx=9-9zHlN0YNKL_GqOPdxGm{k`|v`Ju@TQKtqb%cuIaX1L20a%4B1vKC9-g2SA=Be zaWvUc=DtbX#dvkc0YbB@jrH0zC?HT>@4yk#UGiRTEcVUWC-UxiymUG%PSX-Fb@ViX zCd#H?HdJNZU(^DGKqCBptEN~XqWS&{@%b1_X!8jVN{7f4y}WepFXHBLr{a9~nrXLE z`EZ~4L@w8hRh7CE_T$>4!i#Io|NVY;AgG6At^)0(E7Z4s0m1|^wr}9B3tQgBfbW!= zBOo`OZhD5fb}g7)=dG5FGnLH78}RJ=^|Y#IGrn_^5r*L#cD+NfTY?3J3cBzEMxmcd zixtb-qxEf59#sdqD^S@-a`iP2r#k~37-;@Z*^ z&FXzJ?vg~ZjQ0BM^pQzkZ)ZK{gIK5v7kcnQ#h8L;&zT~`_pChi-PeZfN)l}9!mYfZ zniFf6Bp{)+vMO28GPG0n*LnUdVI3lR8c62@`tfYxMmuNvk#Z%H_SKy1@Y%&uOo$27 zDkjYo8q#Lz6M z|7)|l|KN#y2hL?>^8Re`>7n6gdBw%|W3#sR{drH*W|Id*6A#E<>nD;MnIJ+EVHU>-CsK>4fl2 z30Kb-;_|iZnhl8v(fFhxNKs31s+dx_iWxgj{;ThV$Y69qBoaXRd1BhjOFXFoBLjo( zIyApwAMtsY5v-lN8(MPbx1dPNzP)Qb)9S>bIycTT7xzyL$by${_^W}FGUcOClAPX| z^2UNkRjP=;`|eI2kGuVai}SnlZ-eu@k8V+I7ya?<98cK?^B@vnW{-1zZV;=Vvh?yv z&1~QEL=I7QVJ*5vZ&6Z*q@Rzed3CIm$`A`=cjPabqF(+sDUnho`=) zwO)GGbc#$h8pcnG>__;VdNe1FK|j79XtMF9yv^EUJTCTfNy9JI4hXm?`*bhW{G9WA zIb^bZd&K7$PvVr+*~6_If<(ralSg7`#z_?8eIzsxh4+|RVd@fXp>-C-iOJ8ufebc+ zbpo9M)wl)9TO1-xbepWkX@`i&={tTPcv;f|t`jp+QhxpIn>b-coeKrDF=FQ@t&`g zGI@8aHs?q3wj(yVQ24Dx#~*)BJ`PTPF5E1x*e!oYuR}PoLdTaiZf^#$O&MaYu4m#V z5;fg$gz?ptzKUCk{xtjAegyZtO!Jl^}b=94JdI2tb}E{yCbF{7QA zS$vroSPO*Z(UgZ)5i2KIR88WY8;k1rl~3f8y>wqbJn0!PJA04){OsZJ!qC8Q&&#No zk%Ptg!_UpTu(0h9FgtO|B8T3l}|DY^5g<7?sJ}rfH^Z{2&n+v*;hs5Xo;+;>?i>b7-q;X z3DvT_k-fioU+2cxRd{N_wql==+BW(c2t@j0IE5Vdl+5%eM*MGpYUEETh+CXqUS2Ui z(Zg_m5ij3t8A1y`%O;qfe5Ln~fTr(xm-$XN+aEa7=uh}b;6m<28DN=CO_P3HaHR|N zk=kUF?sDaNyxxQ$k3Tr>ZoR^UHiPo0x%Xrx(PY*k)jo5(dh0^lCg&bY2T$qfJY!}^K3?rQ5 z`&8irPY3adfR~2k?>gwUkNJj#6<_C!8ka`mD1xH*(8r@*{#kwrIOn zzqsjXBY6?M+(w^?*do{q&K2*m`#LWzXRaPXg8rvvf0(<3K>AZ3acG7-X%;1MR+-TT zurxVq|8Y*{^R_*Wplh{Xn4q{u&q>^X4!Pm88xn2;{mAh{(%Kf>~ z&C_7SPW=6J_^GSu!@ba;0LH|UZ};0=S?A}x*?G@BtUY}3p39*Y?RJ;#_UcFVLt1c$CZtu4p0ya;C5P&Oa;Z1Z_ zcf1kZzm4a%Otil{+l22EWE82O?}~ZHL!Y`N*45$^9#8AzMbVRx$rnI{jiws)=$P+B zfsap?>G{t4%zX~nO5`%ve(tO2bkF@228~6#)#Vtpw~q6c7WONr6P5T`1drX_cBb@& zJsDA4e2R`6Hzvzs#;8u3NrKeup-@60(e3DLo(7E`297PMtXecyR4p>y7L9+?6Jxtl zc|6A(Eyf#3fy{5}w!;R03;1cd8be`weT*f=6PQ2zTM;XH{`^)uc4d=zcV?pq6D-Yux$z*_y(K9{XX!gOo>6;uKlQh{&W_QERb+LUK2TIkOEAK7j zH$PlVp*Uf_TckcRwCdx~uVGrx2A7!=X(70&y6NBi2mZEZ1#*y4(e4tkjT(OO@nf4o zC&s;}*vaiuE@q_X05&EjmMn1bPYgdsXJTUi-I+O$3w};^thU{ln?00BD%_x3#>pKP zi4vn+36Ue5j-4N}UvXI^!M*S|vU`GU00_k7Cupr~fkk6RV8waGA@d+ap~jfKQA!9* z^_4Z}h{mWJTg~2ZfU&y>EI1AG>Mnc+7!_{Jpc_vXH>IX&MnzQV6&DG6PcK2e*0_4a zqKJYC%v*jOT#8vj!3D9@Q!rx!y@Aeek)Tfg=tSks@ItNb6Xa;OmL z{qL^Oj5<@F0CGC!>H8_6XQgL5v<6wFw2({kCQVFvvWw^(>;?Gk=0I|_HweMA@DgrW>^iE+%O^L+?KD3KGTx0{l@ce}I)PBrm8g9q)A%HM20ZIE`y-q#nrMmUpmGz$TZxVf!y zDqwa;S@zOJ)A+N6w!MLR$Puxi7`7ry>5?t^^IKo{)Isx zgp-mYsOOS?{rucL+y{_bJKp9PGhbi)J$kdS05gZv{!}yH)(~N<_FDmz!(M&69M+M3 z$1%fH>Fh9%><`Mz7;*^6_=`k5LUs;-=LBsccdCL$tmr+3V4<>E4^z&?S3hB|S~^1| zS;KQt);Fa1L ze`9hkrX-ls`fo6C6f#o>o5Z;bvg_pg-?YmK{y2PtMc;y`>@E4;)osbia&_8$N$wm9 z3m7in7zoKRoAvmOT7j7F$#UYw7d`l3n)p>N$ovH;c=v?cSiV@O1*(E6Q;fz@eO?vi zh^AFv(9_H62an{h=AVt3@^T z*2wlDd|A)U_p`S|nLxd-`@pEb-ZY9n&S(g@%O&ay?;%+E%4jRHo=C6xt86GqnriSP zEFyo>$B7Ypod*wA*4&`UmJ(kEnP42`oN0^Ta+49H5gqejR>E5vBsWB}bh>rPMgNd8^7w%^C7VOFR{ZYS%Qj4E0+&^cAGP)^5Ls*%Sge^^6F5m##*blB#qMJGnP zbjA)|AJipyj5w^Z?NR$|{kcIYbUh9z!C9_MX0E&sZ2@~yMEybX$w@F*vn% zt4^e*rFhUPd!pi;-Q<1}x05ndYX8K;)65H4^7+0elk+6;EHcRVtz6y_%YStsC$G8- zvz)tG0?d(J(i+PzVd)DB|HAi8g5uotd$p*{$Qs{wUliBk<5j7gBJ%uR?e}E$RcW2v z?|CpYmOr{^rO4w`f~kDwj+_@f;7Mg)E&>i`36d8-zhe6eHBqz{vF6o_izN- zE8(7YMJ~W756E#8^DDkb?UIS`Be zq50H=6iM0_7Nwp0INkC7n_^(9kGsiR}C`A-Oe5Dk;<}L(w-m# z<=0QK z5OFueo6T9Gsnbl25ETr`H>tS>6y#+H;VlM}>Xnp_#Yz)XKa!8-Wiq-BtFk!X#+EYP zJ^Xl~YhL?Zm?gEyE%x@fq{;v4uYBS13Gkjk?ievra#bD0-UR^^1@c7eL#04?4>b2H8B<%rIpX-MG%E$byb-~w_zswZ0mTl%8**H^2 znz2tcez7 zVJ530ZeDojeimc5)*gI)9i1^}(H(*y1Rv{|h4CbI=?CSe`{Ul5 zE7IBoEoIgN{gx)WX*A!Q*oj$5f^ra-7twvl`&sy%7DSMT+I$tP^dVKCD+=Oi{{~nK z@YkTxGi%qDYtsI(%!yCKJ695+GCpY$Z%ZpoEkV_F+gp@x%=-hCI+c-`M$B44$Z=Gq1^BQs|7- zhsJ6l>BZr?{qFul?%+NiH8lI);NQHb`M>`*>qWN_tzd02z9et5J-ko9af>ctuXdGa z!2xz*8Xn(i#Ph-1+TMoS)p+V>f((y~vuzCe#%VH+tlC1h_P|0@P-y7(arR#1I5R=g zZ~rVM=!TdFoPLTwjUbHR#xhNtf))Qm)~`(t6Appwt)~$sg3ZYo?d!-8s9}8A&2V61 zGEn6+xzs>vv`=ueOKY>E!Vy-}E@oY+iSq>ap%}>KYhM0Ne*EI4W>0;z31w7Rtjkwx z?XG49*BUox+PpjyXQmTWykwqCGSPJ4l3=lXeI{KVy*a>}Jpo<1xJ718%I!#nYK=fx zaIa#nJge(};ane_n*%Z!gjWe{tuBzA0rImUp}6yXbD`EtD2d{V_>9djnmMkFRd+Cr zde-ez+Mr=L+W2$R)R`L4@tr?=VvH`&eDvKdhMWe@%mUNT)mG=-$g*n3 z^qv3sIU7lEr^G#n%_9Jj{q9`5+PJ{QmD4Q4t%9#(a~_?L=UzAr7Li%NDt``ZZBkz^ z?!^IS)6X_TWYJ=;nO2^Q`pl|2pzf2(#v#+ZQtzNqoTZ#Fl8Ksbw_#C)Fm^$qULIJI zZVgeACVA$4Lu@HWa~x~&hw6DU%&=jY*9g@*PAoOJd^2b(r8|mO;QjP;On=yT1UL=W zVmRM`GalSEpg%6H83U=ImQ-(IR}sREI;68bUv<`D>tRb;?~&y$1<#Dqk1B)^V(uQe z5g-F&nxaqDwMg9MywvpZ(>PwSx8h%qYKz6K4xF(KXidO-KkVzeRe*=(oZg<4`FeJ_ zXl=ESvU};LN^<)B;8yTeliQr^H=6hp3K!?sKupINo)l%)w@<0qX+ymgT;Riwn%vxx zAfGtGzVt;5#WWDS!q_fW8Ogn{3lCQ>QvbiI8hW zL>moK5L5=!xPt(Ep<#>uqqQ84 ztW`(S5M^M!$kKvG=>}jHf`!2(EU5QhR)gWrVbNez;2J2Rpe|76h zbU$rf&_?~Ue+W3tJpmE>?LSjnOH(@EQ}K`(*)0%I^4aq5ipJhd-UQMjb4cIUL@#T8 z#(o;W`@~d=oCXg~ADtPVmWRbi(u0f27bcdc0R62M?NzKQC@VZnICP)77 zkQ7GhunJ=ziBs}+Y2#R}f=2&P#QxMhKRD&UQ0JU0l0D;=4~ISq_~CKT0OZ#XK{kYD zK>CDm5p_u0za3e+Z?<>9FR83e;e<6@q(}t=n16XYw@Y(B`!(R^ve%<1+nLz6M?(Aw zhu5dEpRS**_*s+=kEHL8em{6|YybQNCPE0%Deqtb!xMYig~pzFAdzSzMBl>+kSS>O zP(4=Q)f}@$!K}n$SBsNU`uiuf>e_CL)Ym5KRdR2!kEX$IHs~F^ROzYZbNt`_WbA{7X zuJYTp5F3fy@g@hnRymBY@^j}ClM19M`dF!s4FWn)x@rsJL7Pl~}j z>WpqIoeXG;y(}2$Tg+(da-vzVLxp#r;6wdM_erKW|NSpQ@}`>2;msQ=T|(PCqu{&2 z?7|ZTr|7R}GSBFQ4QrI^N(2%rF~y9i4x88Y#!fuNcEeULu^{1WaM?CD($eNw)A}TZ zUX{D3M<@`%eAU49<4@B>hVxBReA5K$0p>QkyynK)2P^S3U;hkVA)}x%{Ww zQ}bX@u*L*k_)Ts1?_qbo;rStI)pR2Y!UdjoNz7vkHQxPhnsQ%{>2(7;-l`vC z3P+qLgMu|I_BZLbCPud+x!%X_l%$;~6>g+~Qm^=Nkb91j+R}?X9oS4)+@jeR{OK$} z4cm%P@JD81>t}u`d8FCwPm$UmxOb}8o1Kq)5Jny2;&q)1O(DPu?iUUS!uaT>(c^D1=gyMmh*xm1Q#Ejr-%hXt|IZ;VCfft9H=K& zNz9S_CSug>OJ2xhC2ARMkum9Sy7=J>x3jbSOpdjkfga3&!qM>SI8uh_Q21G~T>e4d z*gu01ryNbOv9qzGC-8W``|$X02Y*UKf3&4{UTDatJ5;hFJS zaK0X^0QF4(vE0??HvRaE5VvAo80vYaY+ZKO!*gj9DVixmZKTsA>2Kprq@d~CrD1mE z3Oz#G=Q#w;k<-~iHXyGp7wVk8%~DzmP3~|msVuZ(RV9#HBj~hee^wVDwbXJ|eRMf} zAVc>=qaaJ^+mk^jPRm4*>j4W)Fj}(aZFzuUir)}kEX!M$6$hHLe5y<#X~%o+m8aQhjDOC+DqN>96prTAK%(mG z%SV1KPS^IXVTy&|Ku-U$&3wve=o(T{AynK$BXx%?j!)A%R!ztbf>NBU%+o>1jCz)? zF3`3$v=~=Z*^u4egf?u`@A7X@ZOBtLCa)=@;&(6s#e^zW5vrI})K>eGBNRWjwB(B9 zN>rbZFXq?#{;UZIxI-e%gpbu_k&*xEKrM}+R0N9E#RA~PSk39+9_ zs@j$yxogEQ(mUxePv)G@Qj3fNdlp&AE?6|7G?9QVNnK7orC{36rH%4{6EU)YA&HIg z%6IIiZlpum`IZ1*TO&GpZWnS(_IZV1N{8~bqK*cI?#SnbnNVITyv7wcXe;hWQ_$<< z<<9&`GHs@Zsdkr-ru$Ry?T;F~mj~>z;#3ixMvco?iwHeVE5E!F5mo|kZX@|Ho&@bj$ zH8omw`mYHsk_sy?ZmH4*ZEP@GCKwol_T*s2^VD!2h(QYH5|$B64&S#zW%(rECsT)} z;tQR~enR{lG@XCda^4?NApMQ`L@AFFT$~XwISCFRaUpPUSZSy~k>F89Pa+Q0(Zg6Y z8E0sq-nLJ$${OOY>-9XuhpZs%4WFBjvTt%xwK?A{A$3WdnFP+p;*iFaORRR=rq}8& znHlR<+3`@k&JkbK1d@-0S4<|cQ6 zayqa=6q}5NPRCI*c-H+q(i!P8+fxq&Xo(Jc%Gf+827%7lrP1Whn-e9^!U>etp>;T; z4lUYi<;-`bQsj5mxj9K}*S|X^=RA+N$q*q`X#`l3v&HL)?Q??aJ8u$*t)FzW`UxA1 zo$UItgKJ-Ho77B>MD&lrobGovL64cOn~P9H@bekGt_!i;e6V2!EBvYjifp{$v4UYm z7%l8BzE~m{H=jHUN3Ymv6YQknr9etT()x(P( zWLIzDIEy2%+EEe*6O0mxvg)6!MYQZNGFT^!UWqG9+YEM=9b4_!S4$gCuLJX}iEwQy z)(h$!78VOxxfhH!(z2^*EhT38(wULq{nGDaD*g^u!Ug3x%&ccc;|UCBv9^xV83PLN zi7v$l?4~-(ftS?hp@YSn|G;ekIyjM>u7LS6W`>CrA44W?xEYXG@0Ok0-sZ+t7c(!o z=FcWFRvNRsJ`Py!qb z)QvMVLGRZE+oLPM)?E&{xa9`+80EIc_QTLkl_M%L1Ony;p8(U(0g=d9FRx9x?ABxh zxJSWDVr%A&YDJLmkX~xFTArN0$z;rGuit2Ji-VrMg={SnA%erRO!> zze$*$GT5f{G!p#l>f8q1YmnzKWoI26(L#0di^EaY=C*)xj=K z<^k(eI?>Mz0ec=TnjpSeK3`1>S2Dh5Bf}B?5HO6!-Dg?1pOH6^g0)@90?=SJ2bOzO z-%TK>jQra+>QBICzL6V%r(G0f(ze)3*6&*WSU#~N2%iuM-6#*i{6@tG<-|gDR>DjG^@DK6h}(~DXZE$m)|+9t`r5%h zhMdsn!c~{4FQ!Ib2{>b9tzeADWns^n>9Y>zZ6f4WPFW}LAC|4i)7Cv;rCe%t4+);Zrk`#U=xG?}_7AiZVI#5De{4aIXb<6MRc-ppuOVBPVe(Fit2?4&4` zB3xxLiwa%vt}Kej{AdX0JXygd9Rp$|@sd>A>ZTxBbzi7*o341lQ-Nj}X}$~CT2y$b zlux01M&2UaVW0TczjaRIB%BsVYx1^o5pGih$Ed1kAEHX4{5Dx1sHh5*mtuc$Y8-or# z*_rw8Xjv4fBOLE#Xt`{v?wQ0%M29Bxfqa`A<&yoG7_oJZeP@CW9m`RrCFcOUtPM86 ztm5r-*5oo!u$Wkk;*M?=qu$YExiojY7w5Pr^|8yt7B6JD-KmgG3)|&G=GIhC~N`$G*p_TSwIK#kDd%2E8WjocM}nr7$`QpO%Ew}xBHw2D>X;E&^p%oK>Hd4 zzvsvZ9cz6cuYl_-K1Xwn&)5Ju9Jl{A8gX8`LSg-Kb02N4)Zut<^pX1-c?GO`S?en8 z5LID4&M0iGZkn~J9~=BFAk4_LJX7QdZv;U?NqS>rh;k4UIu zeIVc~TMzn+=^n{)Cinj3JF00<>a>nzIUHxzRO*305#*ZUgr2J*Z#mhb#JtLkBOi+2 zPer0BMcexGL^GBb(?jkRm!LdpX_0~|BJGb2g18m(fSb(3AV+A#^#K%~-Y1pof{a!T za3cytrz0XHWqIH5u7lY~u}N(yU6>Z6o$YuyK6N1rg1#4F1H+M_}JxD8(&nl;vK4f0HB4Je38UnReC%e6**5ye?liP!<1yvL`{_qoDtUznc;$UF1z3xjDp_7 zNHA=z*Lk2@+>+KazKO5wg~$SzfqZhVRf&HSC+7+4RMsKd&|jWbZW`5+T9ScV<@XHZw=K2kEYy`+VnZ7-3~+9OB4TkIM95PjVux)F z;noe-;doU9wM2d4X9AV*j&UrJE3Kvk%(i$aYXty%a|Dawu9Ii60bzO#x;TC+{RcyI zHad?l$e@Q}aoq~QG!5MnHxBd2R})x@#PIMaczwAs%rtJMN`&O*DNuy`=0+$;!` zq9o0)p;J{P^iZP&V$r|GD4~kguWi^B)hSW;tJwzffJC(fg2CU0IyzevMy{6J1?$rj z+n&v3XILDeNVbN zLGh;a(}`sjv&1}ZO=n^gb^wdC{l9U{(maa#(3Lz;#=Omha-@GQ!>mg-Iw*}B)uP!2 zo9c&F*(LZ*U`+pF&k(Z+H!I-h2_wrWW3hnD;%J?C5qzNZN6j)1*EN9s#Fc4vh9nbB zf(rR$AfmIbn;_LIk~&xNnHKFN@iP}~ zDj&4#DU!%Nn76QED0eS6HX_MB{rCd$~I!F8pe? zJhxkH(XR!Z{H6LE`lQD9M(SXqI%Z)58EKWw`JW_{2w3cJiN1qo|06_`VYa#eb=+EN zk%%J6Y)9_7zmj&4u2n}Kn>4jSJK7*DvbmgZb;f&#|AcynRhFa#{VJ=Oc_Yv2#Fh=_ zVe4-~GWw)Ejjcn*T>=>^`9Tdi=!B<#K^<8@*-@SSloxs1d{RT^6Wkr>7Qg}}D+-#t zss(}hj{|O>^WgKuTV;l-Zn9@>0ReOt!)vP^Vixv+)(D#K(DJlx!AA<<+C%`a^~TF~w=l^r*Ser@8r^7C(1O8F52=rX{mt)o z%@JWWm$A!TEXON=4Af2@Ti?;j*EfRa9pU=M?P{OQK1+^qXz$QsA1+gvgQM|v9$1`e zZ3gzV4=$JM0mrvFu-N;{HS3A04zMSv`dPay#=esof_}458j3i~D`Yz1D>}HDlkkq$ zBk^Q-7tqPq_c6Loi>JiHk-{ul(V|rmhhPqb+RtrG z?vKxM%4B!=c}7WwnWlDMQDy~Q77U!t%Y9WihFmjCwS*Q@ta~B6-=eDHz65K6qAbTc z;kt3oLdr=-5v7fWHvg<5wGqn}>l^e*dQonj{QGV3j`X}GCV6zDjL)!iqE3T!286b# zm7t-&^@vCuB}595s&vSi#sPO^F2TI4*=u{1%zUQ`XI_O+H_EqaA zLezk$N9mnD4UlS~d;|y{E*>r}ZZ2LvPChFu@}YB&7)L%IH!e=>tXKG0@X}a3JXoBY zdE;HY+!%Z}c%75W&#pvb?XX~0DBwKJS#Kww>#W$U(Cf3p#`(d!*FE$5+xU|=V%I}{ z%b>#kz%SIR@ryr1Albl|zLJm~U}&oYQNO1)p*NVv^md|5ildhJ^yu|_WjT-PFBP*fz zz7DzZO*Kq75rRpUPk)rPH^z_xsKIj`)szNNwP?U1qkf51m z!)Qn${~7E({t3CRIKIZl=N@{C@Lr(0_nHSBZT5^&f<2j8Y(cl>t-OgLWNiqO>b~OG-jn$05CuWEy zR;fXHQePEKQs|A;O_}1SfA>@n`>0a(-0Hr6lwg4RTNTW5lkg-5y(nz=TD8dMugnh` z3hTp=UeN2c5t>&5GoUr^1x#R`^Kf66?Qa2cz-Ww{ZVFFbj4qVjr+a$h%0Ez_YK!n$b@K|nQw1X2nIl20UpQ~ zcKEq>@O6K`ZP03mqiFlqF!Ev-X>NypQ-+B$feLIvS@EUgs+MMr11Z(Q7WffN>xl)) zx5!LIgfq+K7{MSt+9xK2ngjdrbRAoRhczKQng((EIYX{tkL=zq`rqoadr%{aTy5It zt815Va7)XwQG!zzHDDCJ*B}O;{_o??~rjgC1|gw`a)&m5d4`-%2}V| zH7w_WLt?4(`U2Ni(|hAQp5wBOzjn>8r|3hN9}X&4NWxEK97VIE;AjoIP=zE`Y~rSq zJZM~A^LcDDtb4x^mW4i3Bl@)=s3F~JDn_4Kod zVB-j+cSWgpN3z0(}O5v(J&8czK-d_={5#4T54HQuDEn zMaiEaU-3UNy~lxt?Yrf9^z*sEpDzT%$YkFLd>~AEgRj>JTk#2Fz*Wz|ClYby3N#CH zAn6GDQ)9L zFSmO&j2ED=_2NMG?ITIw8at{yly|#KLM~7>$pd%n4i~W}O7Gd}uV_69z7+mX%BZT~ zR~kHM<;A5lW1B%Bl0q+bj3FjPXT!FdC?A9KGR+VDrlY-Xbv7mzbxiJYZp0gpwgd_@te&6MVm`o_#ax&A=Cr%1w0a~+qs>98jw5f8> zK|6a^Z$^7HEaCs^>nwxn_?C8$1b26Lch`+ea0wfCx4^~;?vmiH8+YBfyG!su@C0`a zK`#Gu&RcbE-M8+{hgCB*-5+PIdVc+MW34Czh+2pliZo8+6?nx}ZWFkq4UsDazdd#p z3(AeP#e87p{6v<7uIi0o44DfVld&&p@+R`_`@v2Yx}9t9y;x8zn@suQE$?B61_P9r zQDAM#us7fa&-nl=PJmerF46{~Vqz?*X-Aa-;|o3(&05 zj$TjwI5KcC;6mMWzs-edbNseZZ)E1NIU(@TKOGRr;gq50aBiExm+FnL*SYKzzZyYI zw(=+#40WOCgVyQD16=7It!z?X{_AiZp$HrFD+W(66y1r>bF>5imKbA9fjQi}R^KD{$`%wE>V_b|WDYL$|j-Usn%0shHW**3J*XL?u)L<453wc1_ zgpGwd-C*#ed??|!r~okmE)fBXCH-_m%Xycd#$^pm+08z?SLmO-FkKMJW+7NhWeakK zvyO1cu(@VuXy(9mJ=IIb*1uRxYV*7JzKzeK|MGKwo~DWxfeu6xA-*;cCM6@2puXjv zQbFcN+!T0zALptZQivA!S#y`6N(g_#3Ne*H2W94l!F0dJN?_VPfkmTQlw4}&Mu%mw z6XSBWLSs~67Uo_?Ml^aBdc;}8>PBNU|b=)y4hl2twqeWK|~ ziZ8b3=?>Av4L|1i34U1`gGKWNCT=8TeAs3EX=A^pjy3Nb8l(p5cRyU(l0Y1wiI18h z`of_z%I~;5jphvlanvw>@CuGvtO*fv7fu80x;r;IFGT}T#A9z@fe0>Ys9*KQ`}^)v zXLMh}zw+A|a%u^G9??Cg&cyL_?0_Tmo)&oF^tX$N!t?cQ^uB+d_0H^vA;0C=6AD>v z4HbGKvK;}?;>z%UkIV6Ydgu`aIFbVGJPDrEwjSseK4ENQ4UaBgg$^G)bla#U;D0MR z;?anY{*CQbMyGrlELq9%<=Ilfpin~nVKy%=+2(@gdg~w%*)7aiA6hUX)~1x6jpbyF3`W`%&F1g)jux4HNKBp+7Z;Zx z&zJB9dAbGcf1}7He|6{jveh)F+Ba!!8r-i9Hd=ZG&V>KqaHy)9u&#A zN_3pk4S>#|ZOwN|=xJeTb7_g5Fl_XuT@4RzwncU0J50cU# z%x=CxxdLxy+S!AKPBp#Z=ixM*^JE5+BclifdnVDuO?T<2ZIu+Y%iZ^C7de8&hY>GL zYQEkFnkaDB*99naFc9{{H#kU)G<^#)AR9pEG=Ux- zm+7)2Vx;9Ub#Ymw>2V(ET$XCqhA}$yV4fS*0NARL+v<8R*Zd_i9Y$vw=EY`X@eDQ~ z18_AC{~EN8@}#Z*t2(_;_nTSl^d@_-wEVrAK<}%$4WXD@bM-~EyiSz%qr76ClwFH% z_JM9vO&EJMkRO8$hV=spEyHDVtB^WzE-7)jR?$_qP7<#=Rm(Utwn~zCfoe5`8|DaR z1e&*5*K5yJ=#yV*i%z}4DHb)M5lc<_We;D>E(&2u85@7a+3lyl^-;jIzhMXU&N7tH@=(a0V1*$F){1I8isTX<&VY%R13BgFl(4^m0;y0WOWqa8br&q zRX*i2ObuVo;!&JtcL>11{-nb{nX(l=1exB7xLr%m8rVw+P8YW_B06*JZHB3SWTmZj zc;cnCdtSN0w zA!@ydC1y5ir_w3Xlo{=nnhA0bj9NTCYr_0xg$9iJ7`66ZYO-wW*kNcdNK=wUjk`!;%rapJizyKs5eHyWUBg_KHciDMEdlhk5}P^z|| z3zu{uEH#Rcc?WolJx(o(;PP{x(kJPO4BM796ei>r*R@ktUxpKnem)d&TA#DmFrm^V z>}z3YS1I|A+<3&}+zH3$<0qMI1Y9E>0&T1GRj){T#XOM|bREXS1(UulBRx=8Ku%@9 zKNW1o7JKx?QCz6LIJ$c;I~0fv^To{D5q`^^qc=eKVtM|*sExeR(k1`5+PLF{i%54O zOjCF&`;RzDDf%u>g8wB>G7eia1x(IIg|eNs88v`%8^&|OHFTt}hQSj1#uj||-3`9c z65n`C{&XopPM6aDQ8vZjgY6yuQ8s`4m|Q3Y3*bvxr;J3ap#MImapzFs6VZb{BZBHq zFFgtK=1^JJ$Bl(voMeppK7}Ohmnb3CL$v)an$AFynbqs6VbhotjxBI&Kibz+9@*RX z(Qk~c^UqxxZw4iA9^MB(s5MKhEz>Lre{xkgs<${MGJ}p`qAxhD#pA*NJJIK^qR`i;hQ*SP zrRBQhum0HWM849*Dei4%>z`S1a4A*6GKE>!B^D9ni_KrXl)J%)u>o~$#^Fufr7exm zuFOxCeO1*I_Iv!el8gJrwe#tI8P$cMZqwS7@9v<6=*QO`f1Uj*(JSq*Nljv z7lWO^2fK{zj^vYup<=P{2g{g}K63p~{GlLcz3y$@)P{hrgGgvI3%6hxI%HZR&r;RGFEbOYt zw$l&I;N;DcG0x3%8(GG#a@~t@)$K-%KotOF?F~AlEHUS zJWN>_6v^O+4NfNgy5}VG%MNy?64O$-PAOXD?%cx%0o#&x%MG%c&Eo#7PZ!0{t8u={ z9aYPY1xElzXT|BP#A&eZ`Yyj}x83Iz@KSA8KBrS0+n2kMaKd|=Bl~DaMUDQRv=Q^+oErl^ zVwQ=l_|!DZz+y&onGrfBW%9n#2{#p8O$0)#ZPSvU%XYPM{DVpC{SI&rNSg}bcN`9> zQh#;#1NdH~ic=&VJ8lN{zThCshXmz*5*x^2Z7DyqsO&4L^VbEK`ay0WORCwDt0#qN zjqGB$@X1ptWo_J*XT^Ba4s!}d)=>yA^o!p)`1Dqle#$KDP`~bc9BJBAotQvc_NwAt zoIrH0D_t%tCB}EEtJ0t70O{b~&}rWAxx(QE?{PYo*{FDch-irWUlq=o(b~c%tYmYb z_U(<3Hv;+WA_)W-+tgA=f}-X0&!L8$->Y=r&nlctM`TJDK3!9izE^SHiyk&28K3?> zWEebf-#_!OIJd`rl{;QaUBy;n*+~X3nvmcmfaMF+d5a4VSsF*Z_*ZTxLTkqKL%=nY z1sVD(>K#4_E(v3nk1$Lq6Ck39kj^xhYCKwICVN`wlF#lY>QGi9%v(Qc5J$aymve=q zo^)|*ike=3N8qG5e^?n03Ng2q0caS((pVr**vmxa@z3#<6flkh8How2_^OCim?^C} zi-R(1ya$foYx@*y%BTBHhy66~s+xj+#FjO?#^Bsb=N@R@-BqxQ;Ku1{)pSU8+cO?^ z94-5vJsITuLbiP*X<1mpI~zihq7Xs0rFc@(O|4hZ*sxY?cBEBZlw3IOTdQ^YZ2lRr z{@zPk>y7AW{XA?Hco1Xx2X;8f*WvDtGik86T6L8%)ELku&5$lg8ei!9rthQ-7;1!QS}NoyzSdx ztnglP7k5=BBoGbtCM#^o?1R80SetZ7?iCsCfQz{zD+xiW0lxC;*GLZO%J7J&6Buu* zurFK%xhZOs2{^xg0M)X!u);)WFqDK}1;sqWieZC3nE9~MF0?#&;9zn0>(VQ6{ z-aHA{_^5xuB>zx}1Mv*RjBrXyBYK6BctSx?8}!wfEm2Ak+~=g|jk>~<3w}+GY1)pd z{0c5`265s3cdzlY4v&J{k9Z}M`Yj|E^0R3qnhTJSkPHyR1(xEBCTj_M;oZ8 z_M(}OtmQ1yrCb;Nr6M7qraB0tQ7=UQnOZ2VN=kCVa~S#C$33{A37+uj4;ja|^}J#; zhFd_kkrOKQAy8ea%a6H=unB!${*MJ;FlstnbSdd9d*ryXyWfP=x!8rzBltd|z8Jam zlt>yZ4Kesh$hlxv^pgyZb!exNI%!s|{XL-pgbR%MD`$o7`AfA>x8(8308uWO&cxO= zTpHVXfu9CdifcPtJkXZH;AJwPuO>QO?jon) zU$C|!!|B6a)JYPM|6vX$tl{0Omn%>;M#O53gYO>5ZFHicHlH4ia_7|3mBk11f3b!y zdJOTE(aD=SVf>A%gwN}rlGd`h9UNT|ik@4NLS2v$aVJqP*r6d-nko9P5-Wl%cJZgtsutKi~+Ez*Im zs)Um*3z})NKtt{iL&S}4kqdOe*Z~Jlri48$u&R1Tz4r%bua>Q&e~mSwHl?{3y-#*; zI$Tq#%p0Z>qSlY!k5Tj09)>g_vi^==D)z?10EuMo8NYVUW2+ZArysgI(qfVTte@^K z_=tHcL~ahwvbiJ_%^mM=H$RsOA8tLmd*e+73Yl1X5nPJCPiNOh^<(qYfvd zt09NKf#Uq^4_X|EFLx8oEEcc*X)F-S!w^eZ-Wp-s!>!%0O1OMkskQ=|?6$LqlDutLRvEXLWc%PU!nZzY| z$IRLv9|8(~4BZw*l>a~6(0|$NYVxjL({Ktmw45aghBoouEVqTYA?eUuzw?dYLp<;c zpY2JsUjSXjW93mH3)$siZ8uVzgmr+WNf5z6PpLCvHV`moe|40tc-i+_ll-Guey9tf zE_oX#$?N{)gV}N~WRJ0{vy8VlWbZddplGO;H5p!?$yi{K8*j;h@H^uugGpD6vbnM$ zEMB8~xqqM)ZCe3-1!F;-H=BiVn}&hU+U6;(D|ff9K@Qz}gEWs4;{}cExEVT$IzCW! zd5b8Zd8rQSanq_@vIVM7n*a$6YD!h2n0>D;>?w??fw)lj^WCe^(mN2!5)xvik-$S& zNM9^#4opUnyqymROf#mXB7wpdhF&}XGaT{uRqW9DTtct1hoe zrV`=qf?40iQ07&suZ#X$fU(c2*pKIJum-Nee*=yXvwr{w+y4VNxTbe){ujW34K3m1 z3((qs2OJ>+v!jum#!ESIPr{mD(HVqs-(_*lt!%h4*Le8qz!n;Fsb9?TSMW^Nm+sB5 zSGchsjaNXQw4s>U-b|Gz_NyG*w_F|X>7p1le0{o^R}&Jx*qLdMz5a`BtX0*XuULkB zgYLoJ^kadAu(6oWqG+}`)KmXVuKLqjP?8z?Mm^-xZqv^o)X;z5G{cNoX=!o5B1AZj zC`V7)xiH5Prr1TQ>WxPQSXo#`L=!=Vf zuloXcZ4BMML)sMXdzDq{<0!9-@rZsdUKi7@(R&oDyyoA(oJiiB54Jq*^XE^G#meiQ@)69*VU73p>?$h_fGR5vE;!^sD8lKKYOY3;?=kNlTT(D{)Ymc zP)9{$bdoFKJLZY~wTZJY+NhbRTsFJq3%xXb@b^MW%U6D3YIFFP{tswRJOq5w^dczJ zt0mls0_dSaKUhl!S$?;I=g8T?M-tcv_jYNlFMih*xzu5ipN|RVQ@4_<0{x2|Nkac( zF-V1k*+6JR<}F@Mx2T%@iFQk@){^V1u&GlpMI!;j9_^^GbG#g!{nS6RD7kyo>^7b< zyaf7FLe$Pmm;Z6$6cn%f_e;VH?oe(1-L?9Q@jberBeO(I2H8Jq{pDZ6MQAVgk$)%^O+ZG=jW)zZSp*EP?QN z0f=Gvxbe{+u~`~{f~l=>iOg2!zfQ`J5LgALrq17Mac zpP{azkWT+MP`QH5PQ&oqr)IwXf`L#rT1~(^M2*y!Os2In@Dw3EEeqWmmjI_Q5bR2= zb6dXsCndn9Qvrp+S*Y3!i%yTM`Q%!UF*mP-7U+nS5_Z02jykEZ5c{*aJTEHNdJM@- z@Q%h3I#N2x(euA?N=8oaUi}+dG_3~Bqd%u`r;xC3+}n$q?9<=doX~fiqM3jJIxuv4 z9?Ab}OzB>r`&8a~cRl7?lUwGnmwFo@yICmII~Hxo-*nN_L^>34OG=Q_wf)!Rr1OFn zvnOT)#$!()LUPaY^~(vnaZ)Ep5+v!4ezEF>srrdNb=rCO%}O zy8v&pI(FrgR41|c=#minKB{MY`C5|E!&z8Vh@5o5IpLP~_D#|*5!D_u zc70!0fr6Ca4w)dUG)jngMe5A1)giQBCkQpf&t9q!o{ohE>H9aY#pQB{tAf0Y`a4b0 zr?HeNya};%*oz;M=cc<0jCEM7bM$*0=a9oGCSjFcz-x^^F6i(5K1h!bTclrsjn4+$ z3*QRgl5su*%rII~y=>IuSiaMg2e3b^d?3e}EYRV6Fp)1+(CM9~kQJ>)=)cpH=7@i2 z3Uue`_CGX*|I%tURT2fZUo_R@Z`OXBeNeSw1B~fhVNJwnFa+E@d>F%{MZkdD4BW;gU!6x7u zysD!E`AP8MOT3oUhV@&@bc5FJ`0g5x%=Ej32cG-xDw*oVvU?;1zhXRkR^_`QDR`Pk zuiqjNdoS5$tOG;Znt&%j?k8(r_c!%}x2?B7y~`wBS>edbIHOsGwfQ|470%pELk}X( z+*^nfd#>l*7h*+QdXH5M(g#3jS2uvy`9`pHwbZFU2>swFp+bkh_0|G+OAe65{(_4Z zECJl7iG#{ROduw-;hGO{6n{u0uQvT+EPGFdfRoo*Ddp+s=Xdx!1eqq)dP6x9k)BU! zXzm)%-SkMyF`udpGX>hG8~c>{k-x#RJ7A!bquFyNM-QEQBK&03GWmpke$(68M^%_) zRCTxTtPY3TzyA&Fq{4~N4wLb?Uk2nHrVX%7EINUHLJt)v8-pnfdnLI0+8>)-fioWq z|B`a@pnWPtr=xYe(qc~k%QW&ZE)??uo$zT7^OXdC_5-`7bj=-;Yjvy%hnpu!0x-xT z-VDzP&L*I(FO6Iul)(ii8ipS5&O%Opqs!ALSUgo`BWG<&W7;#iY{42GuH$Odo7*Nx z*ngaRf^*sB)Xe?dHT6MH-$2wWxOv_B+4`xE0`36E#e^OD|SBV z&pSBJ=?Tg zFO#g=BYDV4y-jT~e@zJ0FFQdlv%@sewUpNBvS7RJJz26TRIZioUQP9w#S5&h%0_*n z|68*uY$KV%!c2HDp<-mtBmQrj7&IGX^HV!;ahe)NUuJ86QBVd(==>z`}udM+pqk5rt`7m2R{$0jR<--0iZIY_KKLUV>Q_m>*?ID!kHG#GGE&! zPCXSyErzfPypH#s-9C~TrO8ZbJe3sYuuu$bLoO`HavWC6qk#JuYT!WI#N(KEuAZT# z%W~=KuSjeA`|WV?L;UMD;xcCmv1>>v&#@@kcyQ*lihMw|l#MXMI&bd6%!1I*(xV)Y zycuBn5vG>14LQn2$i}v$qo0EKL8GJv|8;GK!s=qN+>&BEDgz(0ntgMHVy-rWhq+)y z@^!K56vJ?wPp;isYja}ZtJ(CYLf=Pm98VJAWK#`B+jO2Fwt%y&`jjq{tM&6!$bjNE zdxn}px9b49onBgDT_GFDZ&Ax0JSgUHuyAGtU0p(ww*uVJ?8IYTEs+Jiey zSPeA{5zWFQQ-%Sj;&t2pGd7$Hw9q!MDFuQf0l#a*IOlj-8B^wVksa z$j-%?-QL~B`M;AezbA3$Lf4_%gMxDPLx95iPw2ms)V`;7GP85mwsLZHd{6bCa5(sX QzJhtb!`|1|vwxoc4@=b69smFU literal 0 HcmV?d00001 diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json index 4a853c6ae60..80cc65875b5 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\r\n1. **CrowdStrike Falcon Endpoint Protection via AMA** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CrowdStrike Falcon Endpoint Protection via Legacy Agent** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\n**NOTE:** Microsoft recommends installation of CrowdStrike Falcon Endpoint Protection via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by **Aug 31, 2024,** and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost [more details](https://learn.microsoft.com/en-us/azure/sentinel/ama-migrate).\n\n**Data Connectors:** 5, **Parsers:** 3, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\r\n1. **CrowdStrike Falcon Endpoint Protection via AMA** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CrowdStrike Falcon Endpoint Protection via Legacy Agent** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 5, **Parsers:** 3, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json index 13b2065808b..30f4126caaa 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json @@ -41,7 +41,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "CrowdStrike Falcon Endpoint Protection", - "_solutionVersion": "3.0.7", + "_solutionVersion": "3.0.8", "solutionId": "azuresentinel.azure-sentinel-solution-crowdstrikefalconep", "_solutionId": "[variables('solutionId')]", "uiConfigId1": "CrowdstrikeReplicator", @@ -118,18 +118,18 @@ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.2", + "analyticRuleVersion1": "1.0.3", "_analyticRulecontentId1": "4465ebde-b381-45f7-ad08-7d818070a11c", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4465ebde-b381-45f7-ad08-7d818070a11c')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4465ebde-b381-45f7-ad08-7d818070a11c')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4465ebde-b381-45f7-ad08-7d818070a11c','-', '1.0.2')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4465ebde-b381-45f7-ad08-7d818070a11c','-', '1.0.3')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.2", + "analyticRuleVersion2": "1.0.3", "_analyticRulecontentId2": "f7d298b2-726c-42a5-bbac-0d7f9950f527", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f7d298b2-726c-42a5-bbac-0d7f9950f527')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f7d298b2-726c-42a5-bbac-0d7f9950f527')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f7d298b2-726c-42a5-bbac-0d7f9950f527','-', '1.0.2')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f7d298b2-726c-42a5-bbac-0d7f9950f527','-', '1.0.3')))]" }, "CrowdStrike_Base": "CrowdStrike_Base", "_CrowdStrike_Base": "[variables('CrowdStrike_Base')]", @@ -169,7 +169,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.7", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -520,7 +520,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.7", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -869,7 +869,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.7", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion3')]", @@ -1253,7 +1253,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.7", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion4')]", @@ -1269,7 +1269,7 @@ "properties": { "connectorUiConfig": { "id": "[variables('_uiConfigId4')]", - "title": "[Recommended] CrowdStrike Falcon Endpoint Protection via AMA", + "title": "[Deprecated] CrowdStrike Falcon Endpoint Protection via AMA", "publisher": "CrowdStrike", "descriptionMarkdown": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/endpoint-security-products/) connector allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.", "additionalRequirementBanner": "These queries are dependent on a parser based on a Kusto Function deployed as part of the solution.", @@ -1418,7 +1418,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('_dataConnectorContentId4')]", "contentKind": "DataConnector", - "displayName": "[Recommended] CrowdStrike Falcon Endpoint Protection via AMA", + "displayName": "[Deprecated] CrowdStrike Falcon Endpoint Protection via AMA", "contentProductId": "[variables('_dataConnectorcontentProductId4')]", "id": "[variables('_dataConnectorcontentProductId4')]", "version": "[variables('dataConnectorVersion4')]" @@ -1462,7 +1462,7 @@ "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "[Recommended] CrowdStrike Falcon Endpoint Protection via AMA", + "title": "[Deprecated] CrowdStrike Falcon Endpoint Protection via AMA", "publisher": "CrowdStrike", "descriptionMarkdown": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/endpoint-security-products/) connector allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.", "graphQueries": [ @@ -1586,7 +1586,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.7", + "description": "CrowdStrike Falcon Endpoint Protection data connector with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion5')]", @@ -1917,7 +1917,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeFalconEventStream Data Parser with template version 3.0.7", + "description": "CrowdStrikeFalconEventStream Data Parser with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -2049,7 +2049,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdstrikeReplicator Data Parser with template version 3.0.7", + "description": "CrowdstrikeReplicator Data Parser with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -2181,7 +2181,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeReplicatorV2 Data Parser with template version 3.0.7", + "description": "CrowdStrikeReplicatorV2 Data Parser with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -2313,7 +2313,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrikeFalconEndpointProtection Workbook with template version 3.0.7", + "description": "CrowdStrikeFalconEndpointProtection Workbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -2401,7 +2401,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalOrHighSeverityDetectionsByUser_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "CriticalOrHighSeverityDetectionsByUser_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -2439,6 +2439,12 @@ "dataTypes": [ "CommonSecurityLog" ] + }, + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] } ], "entityMappings": [ @@ -2536,7 +2542,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CriticalSeverityDetection_AnalyticalRules Analytics Rule with template version 3.0.7", + "description": "CriticalSeverityDetection_AnalyticalRules Analytics Rule with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -2574,6 +2580,12 @@ "dataTypes": [ "CommonSecurityLog" ] + }, + { + "connectorId": "CefAma", + "dataTypes": [ + "CommonSecurityLog" + ] } ], "entityMappings": [ @@ -2671,7 +2683,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "CrowdStrike_Base Playbook with template version 3.0.7", + "description": "CrowdStrike_Base Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3048,7 +3060,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Crowdstrike-EndpointEnrichment Playbook with template version 3.0.7", + "description": "Crowdstrike-EndpointEnrichment Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion2')]", @@ -4503,7 +4515,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Crowdstrike-ContainHost Playbook with template version 3.0.7", + "description": "Crowdstrike-ContainHost Playbook with template version 3.0.8", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion3')]", @@ -5618,12 +5630,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.7", + "version": "3.0.8", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "CrowdStrike Falcon Endpoint Protection", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n
    \n

  1. CrowdStrike Falcon Endpoint Protection via AMA - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. CrowdStrike Falcon Endpoint Protection via Legacy Agent - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

NOTE: Microsoft recommends installation of CrowdStrike Falcon Endpoint Protection via AMA Connector. Legacy connector uses the Log Analytics agent which is about to be deprecated by Aug 31, 2024, and thus should only be installed where AMA is not supported. Using MMA and AMA on same machine can cause log duplication and extra ingestion cost more details.

\n

Data Connectors: 5, Parsers: 3, Workbooks: 1, Analytic Rules: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n
    \n

  1. CrowdStrike Falcon Endpoint Protection via AMA - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. CrowdStrike Falcon Endpoint Protection via Legacy Agent - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 5, Parsers: 3, Workbooks: 1, Analytic Rules: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -5646,7 +5658,6 @@ "link": "https://support.microsoft.com" }, "dependencies": { - "operator": "AND", "criteria": [ { "kind": "DataConnector", @@ -5717,6 +5728,10 @@ "kind": "Playbook", "contentId": "[variables('_CrowdStrike_ContainHost')]", "version": "[variables('playbookVersion3')]" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-commoneventformat" } ] }, diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md b/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md index ea9a0c5e7ff..52f0b05f19c 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------------------| +| 3.0.8 | 10-07-2024 | Deprecated **Data Connector** | | 3.0.7 | 20-06-2024 | Shortlinks updated for **Data Connector** CrowdStrike Falcon Indicators of Compromise | | 3.0.6 | 06-06-2024 | Renamed **Data Connector** *CrowdStrike Falcon Indicators of Compromise* to *CrowdStrike Falcon Adversary Intelligence* | | 3.0.5 | 30-05-2024 | Added new Function App **Data Connector** CrowdStrike Falcon Indicators of Compromise | From 7eeddaf17ee007fb33d574104d10147f3a18a2f4 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 10 Jul 2024 17:08:30 +0530 Subject: [PATCH 06/11] updated data file --- Solutions/Claroty/Data/Solution_Claroty.json | 2 +- .../Data/Solution_FireEye Network Security.json | 2 +- .../Data/Solution_Kaspersky Security Center.json | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/Claroty/Data/Solution_Claroty.json b/Solutions/Claroty/Data/Solution_Claroty.json index 2afbe791bf9..b550b1be2ce 100644 --- a/Solutions/Claroty/Data/Solution_Claroty.json +++ b/Solutions/Claroty/Data/Solution_Claroty.json @@ -38,7 +38,7 @@ "Analytic Rules/ClarotyTreat.yaml" ], "dependentDomainSolutionIds": [ - "azuresentinel.azure-sentinel-solution-commoneventformat", + "azuresentinel.azure-sentinel-solution-commoneventformat" ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Claroty", diff --git a/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json b/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json index b408a455715..19d4bc54850 100644 --- a/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json +++ b/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json @@ -12,7 +12,7 @@ "Parsers/FireEyeNXEvent.yaml" ], "dependentDomainSolutionIds": [ - "azuresentinel.azure-sentinel-solution-commoneventformat", + "azuresentinel.azure-sentinel-solution-commoneventformat" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\FireEye Network Security", "Version": "3.0.1", diff --git a/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json b/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json index 6b5ce0f578b..20ef9fb2779 100644 --- a/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json +++ b/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json @@ -11,7 +11,7 @@ "Parsers/KasperskySCEvent.yaml" ], "dependentDomainSolutionIds": [ - "azuresentinel.azure-sentinel-solution-commoneventformat", + "azuresentinel.azure-sentinel-solution-commoneventformat" ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\KasperskySecurityCenter", From 21f0be17c08199b94dca36beb639e2f948facba1 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 11 Jul 2024 12:35:27 +0530 Subject: [PATCH 07/11] claroty sol updated --- Solutions/Claroty/Data/Solution_Claroty.json | 2 +- Solutions/Claroty/Package/3.0.2.zip | Bin 19771 -> 19500 bytes .../Claroty/Package/createUiDefinition.json | 9 +-------- Solutions/Claroty/Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 10 deletions(-) diff --git a/Solutions/Claroty/Data/Solution_Claroty.json b/Solutions/Claroty/Data/Solution_Claroty.json index b550b1be2ce..48057d71190 100644 --- a/Solutions/Claroty/Data/Solution_Claroty.json +++ b/Solutions/Claroty/Data/Solution_Claroty.json @@ -2,7 +2,7 @@ "Name": "Claroty", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.\n\r\n1. **Claroty via AMA** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Claroty via Legacy Agent** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", + "Description": "The [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", "Workbooks": [ "Workbooks/ClarotyOverview.json" ], diff --git a/Solutions/Claroty/Package/3.0.2.zip b/Solutions/Claroty/Package/3.0.2.zip index bdd1d766b89ba6acabeb8859e9762de17b088240..d4eee7cacd8b7e48f9240a8b5402feb25b0adea3 100644 GIT binary patch delta 13451 zcmZ8|V{jlr+ijd|tc}f$ZQJH18+&6r6Wg}2u{XADZfx7yoBh7`ty}lbkD01I-BqW1 zo<2QKpXs)A(27)0Ttyjh2y_q-5Ezg-qf<@n7)Os6I1rEzX%G<1gmGCM;2iJV<`3u1 zU(iRyz)Rm{KY{p$^$Uz89k+xt=-7*cbf*XrRP+YXKWmct(#kIDy1w4Yo_?Ms-tig4 zr3^CiCluik2jTf)!!vfBW}JmD+tmPZ;l1m=+;>UsDM`yR=Zb6uD3?OQ*-&}SVUqQd zOSF-fY?$>-oU=RESI-Vjpbp#Ywx`orwO&Jju!bq7`GDl4OA>4XfP3wtL3yuSV6&97 z*n^hc(PC((3_>+pC&XEUghzB6ECdsU`Jpu~H>5fnYXJflio^*KkR3Yc6_3=7tWo{! zN$rh=Hz!zY!_JZ)?pX!{AHc7Yy;ti(^EV&_Ex+*bjW;2>@b)7RIJIDwMo*~87ypuH z1yA{~x$y=5CKM7J83UP%6BRA*Y%Rm7s@gQ+79-73Pr<;iL}ADEiqpi4d12+Y>2Suq zq2oPb`fTNaoeL35EmD%*G~Qh3E-|ha28`)&CNOeYQ&QZmkQD(8ug9I-9|GG$9C;}R zcnfJ~ji;51uTL2Vb_R>)#d!9YZd%iY=&)s4cn1zEY;BKvtsev}qAvvxqxsDke&OG~Lit%A8qju#f|I}g*22GGRE&yd@z{V-6I z_AZ2lAu)?S%Y>Lh#CqUqsR02UkxebEBcjbO@TC&uGZ+N{!mmI1U|zunN{Z(D+Os-4 zfc!osmVDQWr;3w|DfLreQ&Smiz;VM)&Suy2@Ch#x>24Zc`Eo1BmAi=yAsU17ljOM4Jv!*Hr)L=J^N32?S>xg_4>InHieX!{x;4)G$81Jz&*_uJAE4;?=MvtyvbkL)V*T}dKZ`eUy+jEn7PYW ztDXu*ph{I-hP$M`%3#1$0bIA{dTv?jO~@f?%+ydj!lA(<^IXwIsrH-2zV##!R1~Rt z#KKs>dnx93aa>~>ObwlT5(J-Uba4~5)PQj{*%_u?r+d(#!s4jm>K=7rgLxMO#zMFY z>|v%rmj!At-901?u{g-yg2o+xRw<@%S_OUa1Ab0g)7G5k7>sz5<9IGowBj#I#9m8;Du1Jr&7PC`vEoujFEx zhmYf|;bHv#C!o(z1Tn$YEb8H^$7187jnbxz?|JYcOhYyFVv0U8p<9Whm~?2wL%iM8 zknemP1jv;A!e~rH{aD+bPRvB&FrrM69^(w#!NWVZ4eVSQsp(R`!7=3S8gx(%+vX$y zM4t7mNwIR;lcrd9=d3tcNOh@7LL`N;TI{x=FL*P)<0 zcF@`~*7}s-ys{45%K3!_;t~~liFm3@&av^Qr9A{zQ3m*gYbzOkd1DtMNJEQhUJsfP zlqC<%>WiI?iO+_I%f{*nDg=wI^T?umx#tFR;{24ZHRwqMIgi+%gZSqKETu$EfFM3x zaB`Y{_6YRe%FF1g`&YWztB0l5=mB}IlAyQCXk*@imZT!zL8WxDHsaBJ;`sxsX9>-- zX%UbKcJ~+yOHWfBx@zuFZ|>qH&$R z?uC`h5z}bFZxO=PG`6DhI{xCv2BLe!HLQbM`)x34e+`7BTny{oT+aAY#3dfiYwr~+BLQq3?B7ua3uQWYRhCb0M z$z6>C53@rD^$@AIELZ2_Z1ql2JWMa8c$ocV)}=(@8p7SRmv3q4h|MXcV9bm zaAWP$+31fC5{DpWgj(^Ja_jcp>kYg~N0`sT{j&VHuRC|(7cnn~-ltRy*0sJIC>JPqrbL9C zu&T;RAm(T08}Ps!V+%`bEu5Pved+i)pquv z)%rAzwA9tI03Uu6p~x@(vbp9$-&8zSa|4wZg1^&YS~!C4$amyyBmyG(nm^-zIZ==o z_MFASZ8RJ8`Rh&XUk;W!`!l6L@nQOSrk+McR3ENdhB-d&lDivf+azH!`!$~wfz^x- zT`6P*(y%VRq=V|{ogXw>s@l$Qckvjk7Q0V~NG=Jcl&;IN2wwjjt~4)Zwo~%@ApmP; z9s2T(w<7Cf{@ahXWjdh1jxXp`d^@skiWoL!ibQ!fRJNwdl-Mfw8hNWY_9U%Jyq1E& zKp7!;@khFzmw6*J^aYmCeY>ayiqGRq1EGg)^WQg3$!U3p-Mc8h7V7NT^{ve&WB@!b z^=?>^YFU%s)f@h@-5~KJP<} z^kgL>EyH?(CCDDZyK~@Ty9SRkuAiM4)Mmqi^0p9%0xh^(|)})a||Uzc{-2B*dJjc zP)v5VJ9GRA53U%y4?HIp%8`17&+<8=xRLi@nU2ZK5vLp-{l2bS&Ynr_## z2)mDW{W5^R-r3kh7_oL(rrk>N9gN!5raIt96QEsuc5AuA{Sr!gHF!`dJ3c`^ki5w{ z~Z4$Ub^3wR@u;3b87+h*iQy) ztong@UCpx{8vH}^EdMI|2pR$*xO!7WC`+?(cEK{hvK`E2 zUn;I*`ITq@c|Ecg9#l zTp@HKbGbeI%5kV$az(W^3TyEo+VUs-7;qzX@I#?znE4^8nA^Q(abfy;#&TaVKF!ag*~-zCXudvYpt=j5*N7ua2T7^>1pT-6s zk4H-Dqs|H%B@YQo?^MP1v;@AdWl?`9aS!E zbbh#?Qcuvz%*mc98q`+&`f}{t8mqefU5ct;gVNYkev+_dlFx8&`vbOV@7ZkD^9Tof z8*M|UlquH19$Z1fXO9QmBmGAL!qpnji;Cw9d!}n!2oL*n)kQBQ8z}#mF~VC(!5>2A zhgs!!L)Y;@-k+mV!8HNXL#Hq!i6l&=sAC;wf$GGo9pjF>+a*r101B*rG}#J1!y%{R zL57S@jXOWN&GPt8jrF+D7B6Z6WwxKzB#oCB)k*a`vnP8FyVCbsa4SBJxf(wgiO97i z&pinY=jMbEnVva2#sd65f}(sWGa_TLq@%)|+6gIHU}gwxZ4S@}%1mNLK! z|y91`94zO{{BS-HaEiS0PeIB`nHZ8UO8 z`(0VsqxZFBhc)62IG~Ry^?PXH$}L$06{G^(@lc%M-1(Ud(aO^%juT4Mr;RmuCJKE@ z53~~3xO?BsE@MV)nHboFQLLlY*4ohb=*fjw66Sw#Ul@X}28oLWf*p+eBxw_z3&8P> z>@{uO9uC{iRKpg0Rbd5(hE+QO2F@3a9k zPLi^p9HnGGImTi2#rlOck`2aV$r%2ZV}B}l{0o^lLFy!CAk|T2OE6>7y_P0SeYGFs zD@N}Vf^h0oPV`0(?cP0II0{{i+FI8?j^QgQpB!I4IVOpVp$AMQh;j5+m?4e8)If@X z`U`y%W8RE4+=fU7{_1X?mL%x$$LLg$`|hRFIFMSNG(Z;@XYN(B>`q)H=&4BTvSq(d8pxWfi2z};X$k;+y8LA)3@n!}`vbF1d9@-(qS z^KtVbyaU9SUOn0Vx*3+sD&MPvg7_F%YYsmjJ_$8L&f+;#{+g!Kq+0mpPdm!7ZHc*u zL51QAahPz^RqWLM1P>X!-yr(L+ow!Wv!U-pOU8b16;L+(9@UNtA$@o`95TD^0{9L7 z>P}^GtCRsQLa+*NG$LYDyrshFL9z-D_m2MfrqJJ-g$feAHJcL{jJ79b`?4@ceXj@5 zx1x!kANxs~K@ z9^hQ6E?OE~Px?V!;%T<;azwh4n0dAB9YRH@4^aaIKVThFP%rT$f2!iU*MgjT6nts# zqtzz(&~C41wKZqrsc{?H$>JK~f&OHm59=nujFx-6l||BFxtj&HJ=e<<3<`s0c^y5# zgK-&p-@u+;H3z%F+S`_8x zT*6H3l40p=Y7LHN6|EAy3zG8qbBAv%It{8)68>l$L9^ZC0yivDu&bTc3-0-ZPN% zX3WNtEJ4OV9(sHsS*D5~^7&GC3P{3;527-a2$^stgsk>%*m@fBWbO0e=zxTGFz;KO zN}rp|AV}sB()=olzsScv@n*-eosmT>EOKVUXCyJttvo7QEXPVIl;v!5byao@Ll!s05~6Cp?69RK6jmO+Uk83CdKI~^y;GlSr7{;gGxmp@*?BY}L7p0&Lo6d3p`UbZh3#N1uD zp7Me6TU4!22R9l0BEeWN=6g&j5=BlVBt>(F%8OD*H@Mg^oSx=bz8d*=-V$34UZG=99@dws~|CBkoXos+v){>Ep84L!<_)Tio8{G$@4 zb1eb%*XRib7_X85O0YK`q$T;I`(sL=hZCVABQi9;S)z7vDs5?c0u+5Z3((aD{a%O-hhg-q3~5^XQtXOr4t* zFR-1~8!)teGknJznhAPNhXtRFB;)n$Ew%0k9gttm=An$?da1yyPfh+^IXNj?a&Afb zsGDqW;RwRuh7ajN$rTz(24+eSA@aKkB$PPnC~m-t^AiF6z|=s|6CHY(x#gCl@?M!A zVjmI~KnbdTQjy9D(PzN8ld$!=g;7~cpvh2&O&KY_^^lY5E@kcifY>$L5tzsA5fwbS z)CjMqhgrV&LV&4fn|qmxc}*yIY}D=rZmV8O_m|c;HcTz2Q#eCNn`vmQb`&8&Lm|vZLSki!jLwEf$NSw2pTsI+*=evWq zsG-R_e&fyDD1gczM;(fXrDnuE_3+gZ6?1CUGd_s0>t^t)I^z0Pr>Ol#K1%{+?+Nlc zkgLj??FLzga*kNw?`^v^z`Q_S6fEDV7;d}D_`8qCE&jdBO`*|>%o-b+LMiVEPO@kS zR#+Bolf{yo^XHwUpU;-O-SEMczU3CzE(#8m;#vzLg_1Nxa;B)3BFnhpoOPX5(ckm# zvptc9rYOu`(>PD4LswZ6Fv0;tS4ch107Utod|mGKD}K#0;+j!Myon``Bdqv&Gi_+; zPrn<6LIUmWukR?LPiV8zQ*o|(7B=W$bsV_3ga9w_`qK!UPL`8lNoOB4vJG~SJMap8 zr$eXiV?c&wE&Z`3^fi1KtJ`}EDgZQlB1hjrm^Hb;HZ0ebQC+{X+2!qFo%`htKu08M zz@5$EL=5|ZB^xu@98-iC=T+&#)QZ(1L>Msadc7`$hkf$YvK|>g+$)FY*~Gto6e3W? z2chuA6Y1@CLXrIr>TZSi1R8D`4}uQIvQOiBE6hO9wH&T2_5$?Q;W{7F3+1#YZ+F8l zT1jT}{glU<0~&d;i6Q#^bIX#oNsbC5qFB3`vTFrq?KB6FDaW zDvN-TxCbVonD|B<>4Ou?Af!Dkx`uEd3UO<3`c8=PmGr|E^xDf<-ip*q$JPbL62LHpeGar*fh8#iE`?ylz3!mRkei19T`pxBj+qf5 zhN%Lw5IQ`)&q#{s3f$t#62VIE2P^hS4mo+yh}HJmCQ|l|$VE~Ztdt9?Pyf;NVua$M z#GVI-#u>(j+v&%bYbob5UYm8{6#1&2#;6s3&@Wq|V|jniuX<|ufIzlljt%}1#ZznZ zgWql;0v~a#zTYh_K7h?<$`{YaoK<=H8>74Ml*^%>cQoC*_Lp>!OMh z_Miq46ZuHFeO9n7-ALt+WdFF`Wwjk#md6me*j6kz-|Cvbz8F4E1aI2B4E{=nXlu*4 zl|i8lg%#L2a`KTZz`C8CPr;XKp)J27bXO;5?nheItW`wwNK(tY)iGA#r)=8YYvpzUTq(&b08xJuRq%fntV5z{c+Zzj}X82vM6M$jj1fW1Na3b|mMJ;E%1XUPCXf(b*nH_Ut~6|RZk=f(RF2(0RQqk z)9|Mt^bKU+&(w-PcuNRJ?ZfNxjGfNnADc%X9%Xyp0OQqq2^@17;F)7r$HAp5^k{sI zx?xPR(pOKp(m%nOuKb7m8L1IFLU_z!U7K0L?GMQZlgiS*C!2e`m z_NM@)AMOhb)28+@Nq^ww?1;&Ym#s;}z-&vf%83hqoDnU2t67Cn${x1e|}o*d27M%$THBN zYs$^Q7Ij*DIXmaVi%;{eFLE(F?7&j6#=8x)M^{fG&L)nJZj=(${y1;>u>qk*;$A6g z7XV?G@wBeF(?qe)g@i&~$eB^dj$6WNX5`RAi)TV%qZ=ok)>NNluRV`x6P}D=yjVsR z$Di=~TfkzCKsLGK!)!Yy+sM`PMtS_($C}io7`|dAPKEpzdU?o6!;qbMy@EtNs+@8l zb|ekpTsdG%UDc*4T4Fq{mHl17@2rtgS1z+K;h3D6T1=2j@m1rIHia6p$?C)!cd$gN zb^)a|k_NLqoZngfv=dW6O})#qVVtUVRaLV^i6i!<)tIWf&Kt&hlRaVer;65}@l*?j zq6J0+@t`soblQqvpqE<|-m7bZqnb!3jf>6f7At6{fK_rRjz6l)qr9vLg~!sdADc%?g$4 zBb7!?ElODbl%|=eFh>ZQkFdlg9}s1UTD(74MO7+1x=(JMuCP3vVS9~4t<9PNSNAvB z#5_E3(+(g1i|jD3W?nB}oo4lsCZSlv)sJB>8qyTI;EcNCp}gsH9jd zvgV|tcQn#UQV)<=-0`+6_-A0bbP&iKu4RO`uGJ1k{*WR^kzDk4`=Oko@D;N`f{5PXLv5C7|E6ZgLxu6=ceJ1?(4vs?_N2QFiX~Q@ z0mrk;T1dubjvmR)%Cw(?v`xXDRx%%r@P1%^cGKY)<3Vp5n6kY*iHfJQ>JZu!xPrtp zAHKZa8IgHvlJobJ^ab&+>d&J->02BUr!@vzc>qnE>=+o{ZF|#|&FD zmfy5t*%NsW|5kqnBvuBjBnf*PQ%>A0^b)pd&#gLD*G+|as$A#%VD^z1WyNcb9=WgA z^}l+a#%)X8mJT<0yZ)F~fR&+V>N;gXeKu*Y(dvg6bB?UoMBdk^)nHj6ih?UaW4js~ z4WRs;B*psWI$-?L$0SE2PMhM9u_QAkzQ$x}ypf36QAtKnCi*J|@60YL~ z#xhs~Ki&!5_K2lg_6+%v@?nhiOYl?2m2`Zxaw0?sch+Qv)g=7;5g89b6}0@Oh*Uo8 zM~@il_llowhH7})%LN8Q{%@fr&3Fl!u<0Fwi!zKWM0Ksb8QGLWIjA(pC630=omPekbu^ z$1J*DxgpfP3-(B=o4!Yo>L3U7@s?+~qfE0Uz!y&n8Jj(vWRssz;OIQ3a|em9uob^|SRmb#neq42;qE7@lt zCzGTHAV=irqau4>2B;~uB&QPWnM2VbY#{!X~qQ7@@4M2Nq9QsWxZ zeG<$W(hqkDA^4VR@*{m>^>^NIfOEoe3l3y4m1tv@7ACrIpPurNAv53LhW zq32q+eBkX5=g)t>MGg|}N*^LRSk->O>d*8A>gc02tVz4PP@;tr6}FP1g~sn(ssFV7 z#5e~d3`mW@Iq?LuPE_>tL>?wF`wWOxR6b9s&uFbem9Mp5hZ^;<+(gnCYVT<^JlvB90nc7;F0rf_M z9gDO;74L@zc1x`kx~vjyE+#oX!OvRm7)~o^hwPEn7gUM)f2f8HlhaZswAd%L*m3K} z60&Hu413;+rl>8wrBaCx`)lpB!r=EiY;uk^BOFPp+?ctV#X zRp@6R@CI3JQDnP5SLkJ&Th@C6rNl?1nS0bVl3v(ie5E@o!v{LOw7NPEHbE8Z{<7L8 z$=2YPlF1Xj6YHNTTd#G4W#-Cc6MttSnPXLa`?I!JiDLzfclilh_D%!fWLPZI=LXdJy#NC+f1Tn{zAG^P z!b@p*5b|?UHX7LT`f%h@k%p6VT|@yC7rp!^99;@If_dEGK7Igc>p=*qX!( z0D;9XSH5<|V1Y}-T5=aaTR6}VoEYyDL4J*}HNJ6W>M?ao7<&FACmTNj!LNyN!Pmcf zE~pSE{-CQba|pLZG^YOc0_h~*Y-1VeC1_t5sU2>eU*{RLLPyu!0qH?}@hjz92_V6Qkt5W(V?^u~gYYMh)VCeCNnPP5?)G!`P6`wB>$74xA3tK(zGWPyn3+ z{JIf!8(&;wB{pe}_{s45&`6Q{#rkkaTs4N<#`-0G`si(_-pkh7W}k5Joq2BK)N|{( z>@%;8m+kb@I;0*Th8%hDe#J$4`aL2|f{^1bn0(jp5H4Cq?&v3u-&35Tco%hLZOyk^ z2a+(R;%5g#JdoW~$#6lfwoP))!JccJu-EzJ0jBPCKPQSM-T9@nRn3spJ9EPcn$>E66>|OHH zgIksW+1 zRVtjw4jH+Uu%h}UlFGu_I`TWcjaa3=Y@ahYn&rQ$7)Ig$*#sSAy(dHXM92*wt4ftg zxCAPBmuP9~LAyqZCU}x@K*r@>deOAZ~=n(hwcTby*ORg%+D3dpZX#q?5r(!+nk>Sc;mIrhbT^LW-01j zp~8Ocf#8`jHv7|4NI-jE3o~d%fO+Yz93^k0;zcF2nv@aimmbJ12rk!bYh*x%2vEuEqpTvNTp#5N_h)5a0+t>r zXYYfHW>?10qqV5tWh?dYsQLWaGFWoWq|Nk?)nGeRbW=~efTh~S*8ha}cG=gO-Ocs;BYXhcq|JnKTmqGuF2bM5ZHnCc1vnHnQIzxrw1cQYJ}a zODNEKM{KLr!hp`eotE+muCnZ;(F6$fg63G73Up-&gl)bh&_H4QDK#pADcPOT8)Ppf z>27=R)j^`0@Ri9A-Ut;xRlMm`#Y{3bK+?UE7qx$J$0#Pbi|spF`c+8d)t)>Qx+K@4 zQkBhO)Z9?lgJ}*7W9JW2fh_VJ2O1%2l2=wCXpRlc0KdL=|7?ynFr?FO^j!c`|BqD$ zT2Y)`2-^L#Q@s-8yP8Ko352sOk>&R^gl2hq>kZ=5PN=#I?ctLqxbJ;a(`N~cS~knn ztHkBa0M)RL=yGed(|P`j=uv#P`kOXkD(!=c!0j@;Q<79NY?X+98;^=m%~U+9w%<{2 z6!0^DZ3@7kq8~|2;^&O8tyiP%B-elgncvZlunj7A_8NOl{|F8}Ic@~8ucy~^HdAIA zvsE~X>6Uv#-a&$MJcK<6kK+<8Qt@qhojo4HJCN4W!97Thm{X!*T(ZmR@7GGTG^h${ zG32X^Dn4xhbClzg@?_L#f~pd9QIj4Z0U*|8hiyJP_N4ULv5^ZngcWatk*ZCimG>jQ zc$T~r+}&{TA?nWNPg9Fz&^yoRxM@f?@C&at4$27+|Rd>UhgP>tuRn| z7C-}dk)d(Yed_zh!2nHKB(p^$bMtTC@q?-IC|eqyV)o~{BdZmR&E2N{SpZc=_4hG? zU6+|f2YK?XByGtnMi-xti^WzUmaT9F8zkqmF!x+)pOjR&W#5Ry4CPNqc^vV-vK2uI z81h=2RR0NHyV=j+1)(fDZGk;fTG-PJoOVFF(^NMF*NvCSaJ_TO6^enz;Cn&HAF9{i zYE$TX>hV3QTZ2$;0Ql6ew?0j*P>37B;})^|uxT;kSl+n1>`3stZfM~Zrx}*K&IT9D z*tm5*f{o?&kG|m2rrngsVUJL`B_Z@CwOb+FC$K^{88LxlQ0C+Q$x3c;;^VkpfG1`409%fUsDdBh8`i5~-;xStC z6qDrk(F#TxCis+C9maUPouOEU>oi z*A4|TGZ5bg`aZoelKe4|A{xvEN?}YaosDicK@?o%Yhx9BMbka0BG~}t9i`|e#--d* ztM6kpj{9`giO^@msTq85*Y)kQH`0N$)rminH9nP~mu5g89jun>YEDPJiloRfr%QErgNP`Z&0lgM}<13%-ccF6df zP(18_S~DRJ3`s4buvp0W_%Sf4&k*x9roZS%SwfFB*6_%*{6axx?Pg8=ogG=M(oSl3 z00hlyq>wxzS@yrnavJL+1wxI~{c06hoa%30Aes2{JCtlp#=76c!JW=QN`5qcFr_D6 ztu`RNp3j($Q)W2)AOICy$R=zhjl=RpECw0_N&Zk5u?jNT+#Jf zpPA*`-yz6J?z`3-*W2u;4d)637W9k6Yd8-K>Kio*$j?WAtPkaix$pzpIqQIMSQ^P*OfJ@&RI>4qu1hh+m9D?{Kzc_1ydy63rG5m#?w=2H zRM}p{4>eQD6UDAC!uAC_wliGM7+F`gQX)(tG@VrNjGBUeZ8%PAC6-vCv<{nyz!2h^ zFT@Q2)*>@GQkgF=Qug26nuKV+n!V+tI+P)ZGPdzk&T z{NxA8xjfH4S&`}x0)VrCi*I9S|n0`TG*mp3!5SG zK8~lX?~Up8)aya_U=A#KeNaXe$);r$P9r6tD4mpqaXbVmOC_jH`kgu00Z5?Y&l`?| zq^$5eHY2!1wVx~UyPUZ3nbV6O4H_X&Pk+l-F;TIEB<7khaQ@m{tdIQy%-b^hETXRa zkfv{VZKXEYJTcl%x~ab8j6x?={u79o0e^@JH+2R?1iYF%H2tm@VlK9zpkE*Lwx@WI zBq**oZO3=!{l958zR~|80rWh7E@lo`PTW|IkN1jp7SC6bPb|fzWl$|fnk z8XU73h~x6xH>0-KgVkcDmc(!f}kjmdTFq)9xCjw>ETHuKV1Vlm3&Q(pir`kJ~Ai+-)(OHZ)FXU+G*N zvmQUeDgQ}^L~a>idtUPp(;-W5+TkO|6rO=nEoFORH4vw{AxI6pkf{wls*N7Vs)qT8;-dyWb0~Y zUjoLC?`fqo2p|T?aA_(99zy>I{A2t-;8O9?KajGFab@sl#-7Ra*bjSW0&VrfaTj#& z@{+#4XIGVh(J~L>Ba^2HE7)KEBz>qP!8`B9^c_W-@?=h9#@LNY08Ml2$9FDs2s&Yo z66z4q1h&Csgu2BvI~^l`^l3$I-$A3@TpcU&;Rgc6M6( delta 13724 zcmZX*V{|4_(=HriV%yfl$;6!46Wg|Z$F^-7lVt8-V%xTD>tvqydDpkTbNW}WzILxw zSJkd-_pa()l?K|D0g9&}4Gw`00s;a9^6q@1zS!a3=nD@5QX~fgf|b}IjSD!(x3OF0 zczFeVB!bxltq0eVn{i!_IE7*y*7b8fWj~G(K}G*9x~fgCNI}zPQQPG^`tJWK|4Q-5 zOMY)UEV(Y~V5gz@8|6OEdt*~#|6T7>SmN+bD{dd_) zY?s&=_0e;{hbAe_+|GF6d-ayzp$x4$j6Yo_a1l0{%@EfQWQPy2JCAV(HWw3|sc)X{ zBW45yii%CSDz_8oSHF)6R7kfUjoyuDTlQynA&ue;z%#{3d?uK4-xH7$^Q)iytSnw+ z2u~#Z-OV08kk@n@ISo<*F}6>c`t`!)VdB^Au|_Dpd!AWc_pbP`mU|X6fA;a)^J(J~ z{l>6ebk6iOB(J)sPZ=-F6YP$_73VJ5-148 zAL-0pYz3))Y+M~-{iKxI<-gn6J3tteMfRIV6jY#Az#b)fic0caBa#N%F)C8D%GB_W{m%H!CxmPdz`@V_-okc}(vV3shs_)Pg>p!e`VdxwWY zA(d~TcoCI~DN47yI`IQ>wq+1eeV!FNVVLJUuuTOl%F)4t*Kv$fCZ=j#U zL-6LnnF@P|BZ6!p52V@R2T!&`wB{0QJ~OlavZsAb>j1EilBx7LQ{YM^gK!?AB53(! zIS$@Dc~7Kh06P^D6=Gygnv{@^IBAV z@Q(eIZ7#q|SGD$~A8Hq}Iz*(1Hrx=lXu8~R;5z^E>ay2STsdu^aQnkc9?T@oQlZaA zzgg0vdRU|(IU0&bd_XUAFVBw;5nQ~gk93ydMyx-}7ULWzt~$5vVwEmZ8~FAk_q$S`%JCn3N9k^CT~pgDAi5Lbl0E>S8A80TykiyyDdu{jk<$i$n?2fA zlOfSdWE6a@hJckGU1pGQ&R-Pw*SzHyMFRk`j}fuw@< zFajWQHF{HpQDz4At{cHtzAeuj&*hu~Y1bq(3TGnFO4JY>Df3+|+EEHiBqz)nJX*YP z?N-HEL65R3Bl*DcJldE|>IalPP0tBENe^0#vU8MM))n%t;_rK555Md!=;#(f@#rz1 zZFfORcOkx3lii?b_o+=IpVNl~pjH9?1jj*lpmAD`#7BmBW>0~1^BH`hP>eS!FegpvU zF;m&BZ;BVBh|;u*GcZjhQi45DLdumHGSS<0TUfXOL(w2)8P3(huGJpSEfr98^S1{u z8&rrj;yJ$A{TB1{J20wA7X%W27pa!j3qS5b@S|^Ssvpf#4$ZQu%(AQb zg_u|?<(ntC-y37Pi=NLz8Ps3ACFKE%EkI+Tb@3!F)jvfnald}wj(G|0CupDYPE}&Y z|JBG$De! zz)}3czlf)KyH;v0juK-usZeJE&drg1qS9PjSQp5p)M|Ri=wJkBlxcvT_3i;`5&Bha z6$o);1;y2pJA4dR!P2gc;*BHOGHJdWz~;13mz2^VnV%UINLuqNlBcNidu7w=@h1^g zc3*}feb||BG9k)u)I(?lf|TEP%!J^;VAq3zim5g<%LRG%!IssxQ!!)OkpQ6W z(S8jsCzNtzJ@O356e9bOP|yJ?O8w+16_iBS!{8N6VOrQVOs{96fVR+>a{hZxWwkr{ zdHowLBfDHF1HU3MX;Fe| zA>83;x4}UZ;Lt+wR`6SD$n!R_ylg6=ZD;NZ@GC4$vP4jAO6g=msQJz=8~$OVKb0x8%1dCzv1>B%_tMtujV#T3%Ccm2=0$i04=|u$Sc*#mO-7+k zlj15@kSq617SO>uXRQIHi~Y#hDXnuSBghua+~`r92TLrwi>%M9%$C^&lf~Ozz)jEr zPotgF^astewRd+p!qowH8{rA$)Q&k2)n)7tiyeD}K`|}Xywk{anKt1&R}C|_L77#i zS`UbA+$$Dfro|q$t{aejcn)e}H1^bMyFGaBELc3cR$v~E(-z<=!nhW--KzUz@XYC| zXCAE=o}Kj9Sfxgi;K#sR)AxB!f^tVWT@A^mBTYElk8Pbwz73~PAIq&$smP;DH7eb` z&V%mRL*W2tD6Zn#^Jm9r`gh#dzo4&L_Wj0!Vp2i|z_ohTsoaxPry$OQRC)4Txq4O^ z1Q+!-F#pjKKLB9icF=0rD!SDO!Q)&6a=-^SfmsFK8WO4FAd5q;vm7Mzl?>{)3Fu0% z=a9Y`J=Ef%!~{(fhRp=%wunK+g?c-ZCJJMYTz^_sX}w*n+ihd%YRW}mv^3V`?bh(( zw}?yiJR~iYGGI!w;GZ0Y81cgpZ71X4xy@DuB3tdUX(>Pe#=)S(JptUqw9Yq7^yMj> zv{RA?`?rPSw9SP}sz9t<-%iyhM{6igaq}aXyAjrg7@#GzTUa z8MGmnFm>KTrM`oRlXaWN92iq>r7?};5I%{rX)6q0sE_D1 zG3>(*+J-1oH(Jn1kY)Ad@*d}sg}6w)9!E9Njb5>W8E!rTw7oML;QF?4ckK1 z@Q~5bC>d~%&~H_{)PH*p$qDw%v@zET^o|VmegmAC*7LOb7}?dNlrxI9ICnIGDW9+D zLIQ0+n==i94C)!x48-Yf~hMWO~efJ5rDN!>-TNuuUp~&P2l0Z}6m@$R?je zKLJT+jj$gr&Kl*X#Ak!3^UxyN&n(IBxPD!~(ReM6*O%C9t2G(!V}A1bTMDkyUOud# zVvGq;b=(kiA8d_JdFx?RWZSy>YAtx_6PM*K&@%5TOL{$6li6PSZLwA9!yZ^m@t%B=_q8KsQ0`B~55rVW_Q zQ%{j=*z$yuN=d9`n?LTDuStoC)ddZHK)l=5%ER)-e74Io|2fOyo;R0g30beYesWe< z6aB7uSK~f3xV{85vJo%hmaHT?!s=|$N5<^@Q|QFKt#o`r~ zYG0RY(@E{B`%<>)ot8VT@J!wLE1!|x>qu2FLNC{k38BrT6QSn{{lmZW6a4?%wg|eM zsF$A*d2|YZfJC1+io@4o0n)z@Mw7uleTtp&|ysR(}7XgyhgDCStodbF;jjTb2LXP$IfakbPz#JZviWL7kgA z1VrG3f_BS1CV+es0mR}`HKeF+Bx`6L=H?i%r}sZ+Ii&Nc-y005Cpk@uWq5jD6@yWcG1{zwX$}W#;jO2bDQheqa1V ztlFmNVg0?>RaILxTi8~+SoM^6)eiJ-WDIvN22trXCu9kpt4$!2%oyb%AbnFGJm)C(SZGC_Ze1c zm8e56t|1!JPzyi#VAiEbE{8Q9QkZnSo>rIylZzqFoOPP6KB`DBUXTBizO-rDI$iEZ z1fZPE!oRSLY@~mOnnJdD3ct8nS9(+tkqv*p%MrcvXN=>=L(&`OtrQvh^nrSJptR71 z6loH;Kg)|?GIq0sBW4Ovs0wZE5HiOmgvi~QJ`dT!Ld2S!HXIa z@JS7ngJb&MNY(zpf$BT(=N2!}i#;;K|LnAsoGO)2(vHxW&NchDT|0XH4JrdGOO4BCaK;EV!1@nP- zwkyXB^Wn*+hj0-GPy}O`EEH?*Qnl6iFCYOqX8*|Qevw@%gY{gpyUBxr$Ghf8m2}6Q zBg^^jv>!z@J-}VdP8hRvs+W~R_4)A}_3qVZeF1|9houM~|YN*Xc zJ!9e#+(y7PJL~Pq-r>W%7-L`aD1pb$9S6CPFa=}7`}3>B&FIfBQg2oJK_(CbLx#0_ z`@tT9`m6=9MiXv-o|2d%uC?i4U}UhH)QV01wcI}rm-rS}6Y>2#zN79`u9PiwzP5Gd zE`X}7>3`{WJrQ3dx*nejGgZU6(#12@u)p2e&qH?`g4qZj=|;byVc+gl1dknS>gPtz z3Yvki@z0GL|J>Magzd*vk9n!yZgd^fpCcEPit)}Xm1&F-o!_{Zr z{qKTwx2899{2d`o0o$ww+L>-3u;|W&)-~0~X=ElfxQKBw`FiaZX9_DkR;)3f@k1fd|+2*H!9`KaFx zqeK53EJ}CCAg?k?_n(omjF3ROaNQURiW9_6Q9svyMZ6CCN>j77k-|?ZA;y)!NP#O* z9A@rb7mbD7umT;?>`}IJAhqjGc|T*n7rk$~)th5g)NzcNpB}j{?l=^n^GhJGJO2rU zFEcz+ntG%jy>I=~{|dxa{G)CJ!({q8U>-rHGT)l7}5%N=D2PgocBh?-WvolN>~6T_ZE&i5nR1-LQ98 z<;!>!zyUg_J|SNYAT>X?xTN8XXTBHIlq`ii3k)|pm$=6kvpUI|4V{t3KEHUeZn3gF zMw^10kEqy1nM?Igew)FDMv|%PXTzLTmmy1;T`_N#p-LNAOJ{>-FJV40WX_zy)Hb)A z6>Ox~=J=7rgD_}h9%ZjY%;qtp6{J58wVg6S1*- z(|YzfZjZP5q@fd8(Z&tf<+$7RbA3yPW{5_axU74c05bY64SRG$7 za8NU(XyGd<^q3(c5HaRxeNWeboL6@QC_sP6lr5VB$Fi2Zg3lBQ!lHoZ)3a_}p}CUT zkGt}5z|{xKJyjpT=TeYI)_nFQe#zC^S7?iefEQ(J)8mgTshxztGwXoG(Y>=wQXfM^ zH6a(u&EFoGP=^gWEiH|cmZs#BQ*S8oZ>L78=Y+GJ;<=6CgcshAh}%*qjNf|7)BvHj z^t93LK{YcUt~+a+4pQZQu2LUCX5Wxnd-vmye`521+Av_l=O9UYKRZb-cLfSD&*Aa` zu{bZ~S@dZsG?Y@3vn3iAHTSy6_t?!L3~oALE)@YtP|^@Sc~ApYbztCRu=}!IXO!MZ zsXK=|EN_^$;TASqPL880a0nqh*Z?Zf1M)n+8*!*2CbzDM z(mW(>0-6y!8>)lyxjp^GCKjXd^)}HX(N_pJ|1Jx!GBfS~K#S$CZxGrws$KVHA2Y+o z``Vf3q6cy6b~N?~8(qEO)OIpO?+kzlm@uqOKn;ZQ@nnYJn9We|@xLWiiGO z)zQdfpzBWxqH=AA{4G#id^^g5RNpMXqYC3)_Hiuhgz6q0iY474nseDoJmHG`JMtoL z!N8`uvmY(O|FxB>1c-t5Lsr$+xu@-i8e0O0y-A(O9QBoDk9c{M$0W6RD=#$&ecwjt z)HHuM_P%~=xy8-Syn~?=aRvmo?F`S+#YdYvVXyzV17nOY|NG1GXb-OVsTskDvo$aW z|6|$9+L%mZ)Q>6r+s|AfT0T`|!;HOjkJ)a;LUCK{kPGxsYeb}Gu*vkOY3iWW>{EMO zGg19viy}yhLSBw_ic!^*0hTw4Rd@XEhJTESNXrrfx5e*hawrj8GhB})Z3jT3-{tcQOf`mp`$n28 zp`IvN43Q+2q;bFd*%kDT({$dn2qihb(F~jL##5vK?BEiKT_M_;xI?jsJDV~eOsUAv z9mtM3H1*(SB4XP{zyWhp_3xT-}AJ*5I8HELq61od1pxkLMMt7JRnW=A9LXa zz7yO{Jj3sXFD#Le5w3IT@j8ECZwBv*s??0I^^E(u{P8~wLV99M(-P0?X*tSCIc9zs zBV<_;`h-*x-?At-XL@8Lzofw*_(Q{A>s&KFNtFSZj;>Xr>rDkoa%mCq$HNZj z43J+G$ik2)dE}(HBUjt;-s$Z*Lm>@I=TX)O_z70R{kNpp6dc{v44PVDPoyIm*UNi-KNvZugHcgOaQOy?hjq zTJ$v3xpgNoYlm*L183X;rA?S7+)xLlMjHTIy!(o>$p-G8Vi9O(c0Yt{&a|=T_vltx zvxA$Z+L0)23yz8LzJ1P9N|j#NroKIwTk~OjT=^cFjd=(vR5y<3Z%8x~MTQJl)|x97 z`;F%NIKQXqVbHo6+wEqAHj{si!5=C7)mM+5amn0mCCSDDuEJ8aOe}rUt?Ny$c@P1h z{=PniN1beLlw_Tm_^VCvX|xA%rb{4Rok?;yIK`CAxJq7&*bEdXGz#BxNIH}yc-P4I zOGW%nBI=Qx&Q7Wf3naoRokZ&rw>ATX#lDt$l z4$0hSXU5@xU8D40CAa^dPvx}(faF#Pzwp?jYAX!$cAKMPI`5{IhSBwfa6iSd!#srY zy-T|}*6?_LdPh$b{~{}p`x>a7#5VuO_FE~pxW{u(=)rd(yzk0{+{+C&SAuAmNul8L zy?$$JB)JbRvmMWDxn608nzbz1Y8eAAvu^tqJn1pXzI7CC#>POPqHT^nV53j%5ZXe_ z)aFt-LA~Zd`+IEwZG5{T=^r7mKeBJO4A)wTH`+lk>`Ga(N}18WGH#iH`j{~+Xf0(D z)nlvABYzmI;5bF3rCF@zlO%E_wNiwvmI&n&xV$VjA~KAh3{U4JeE}y$j}1`N@(8M> z5UHhLhxH;JC$)+rwMmonfT2BlSGm8Q3?&Z>QpfCLo>d9wW%BFuC1)o}E|FQq#3j{; zb45ERFOJ1Z_LU_Yt_I#2=voB%qd>>*%A;RqO&4CzzfA7i#458;D`kU|@m%1_Yw1#M zXjen0nr(Q>t2v6BMx)X%lr$00Op8>574dA5q40$`F7aZ;9`41v}F?|q46|#8-|F=MeV*joji|SGi-Q+$U zYq**Nys#QRsz_3e!Z6ONGfn(5T-vC8UGDL0vTGQ)!AOkt0{i(vht?7Ec>X!zYYowI zK7YTP%<4D=7qwSXc%2N`^|>#^7JH*Ha~23vlwoOaSp+O{&YBtDfUzX3{74-q1PiNR zSC>3N>70vJp~Ik|sg{$>kUq^)`6>le+!>|_jO{xF-L4d}JGN>{?Cqomb?sJ4O|Ft5 zN0VO6bQIX$6e(S^-xMeGn3mHGpJOPgC$OyWR_w{?@T)i$@_{*|-`38Em8XOzCuRC8 zy176Ui~xLE_XZ!Okh-W@*M*nTi%5#gg?8=N3d3nS+asInhj~q1t&cdV&{8k6z2=-e zjN0J`T~l_BMp8uJDMtWHg{ply51~uI7~L#ycku?9iC$>Co9hX;im0l)~ODcK6_qHf7{v5jm<7;<}_H4-GxA=dET^VlVZ&#}bDXeV)0& zS0qVqUw7O%kPXO{S>~^&ib%MuN;ys5L!hztKJqA%u0=V?)Dm?!Gl!>Vv0kt2+>kh| z3Xo`d7!9#u=Nn>$gzNA`vI?>DB0r{Ho-)%-Um~%UKTEYhg}?TiP9`TPriVqm_v}c0 z&cb<_*6`)khMt%bu_*ZV(ft!uqsl7NPzPUYsnB3B;4Q86PgX+Kw~P+K1!<;b;)d3q z%p9{)A|*N;Qzzr+F?c$t)S1bv5Vi#lZovL=j?tyR#1b)WeKGFBZ7zD1CQnz+;5o)!0hQ#JSgZMKtpJo9 zvtJvHaM>z$)&F5xyolR&tuG5 zN$8C@#%WEN`jpHtw=i@a@bs8^$ptlcC*R|%+-a0X-P;`?oy1zWOy_dXQuvs1?Nl|J z2z5a$bWl6)V#0L?mM!|FVPR*ag#eDT(qx6dy@3%ljaY`)0z#D=snlgv3E!mYDh%2W zGB1nTiWZjXEduv=eCH?XvG}JBSvVv(H3n{xp(}j}3rG`TRRoqKl5-0Mwy1%PJwoCm zrOUU-vPe=pslQnsctw|UaZ$v^m>hu;qI$F;SGfZRRCCnk*@K2 zf8hs-N2sne2Z;|>coNTbI3r!dV}4Yg$`F}wFiYBXnM(P4wG1FOuNq+C$eVva|~-oEs0 zPGhOU$}eh{^hWl^N-Gl;03KzIs^pJ(GkL4V5|`zfpRFp$v#QWvL&h8PDoq9447_FK z^U>GkBrzMu`m7fk92Odu({!@WjHgkh4>)~d$~ofH!>x@1@v(te%)@raESXDrp|jG8 z0^Z{+R!gREtJVgY4BD3jS#k{lHXK**4gRY~mnRyX9IK0_uSz0-De)i2Du(e-ED@e8 zEtABVZjg=cF3WA~4X)BGHpv>z4DDnZ>~Jkt67iMaVy9~y4tUy{EmduBRI1(kmPYUu zl4+|qE$!-}&s|-MihE5>@J~P8qg!ZRPBVFy<@=q!zdj^MclQ7KE?+PdIoT6>je!)W zKPK2Hp6&xr05~V}tcQ_b|l;0!U($Yc;&W;E93; zV}IiZu2@-1%ezJzGA7!YBnSY4Dqg09e*6OMIfbb%ozxiw2xy92B=|;BTqA6)ZCts! zPTpRIoojb;2~gmH)#_J(Lh2dYC0I&SeBwG0+MS{DO)$O)l-cn;Qu_X&?_j*?YMVNr zZ6fMg+2@qK?A{n^-HH0V6D^;*`%rt43oo}(z>>dtU-%GppWoY=i06c$3t){UCPb`z z;mVnfbW&ST!tnP9{?V#AFE5tB znXVr0QPbfzD?I)aTe1A5AE|#_(7U?dJ#<<{)%biI#=E|1dvAvK(e|u&NDZ$2hzK!8 zcHg6qvBT-&(tzZb2iw#PmiM}A%~>qoCR|8s=~g8?AYi(kh~I3F&x-37dnaO}&RF}* zyW620R!4*kSpfB7x>gF0p1z_zOTsWp<8M|PMAr{WrOwqnBubJv%e&Ts9dAz(!At4V z_%&%b6)T-TlOSpKh0mPq76aR5Q&Z9tOW%eAPlzxf-h-JOOG*(s8OLXb%?fl49_=j|k1!|V0^aNc3d&DC zH>U7v%p}NNkrG(__^Y=wv<=8!0l%ByEzV~(4@lB?t?aMItNw()vi|1!4z0A^8@@Y$ z2hbiQ@_j+KIkSE@K>I+_afG{H5_`ANG|YEN&7*y;S_fgrdt_uk%plqd;;&X4Y^01SEA}W#lT;VXC`W%xRO;k}d*^X6J zR?8?*jjh<54E1T6+N3v`02U0ns-sOuoqMWe`6S`SR-!=W1Q%!tP*DPCDTi7s#xU0? zQ=5;5UIYWHkmws8v_uy!ON7ogp*O6qb~fVR8|K9p3f}7jpud_PCZY?_Qf}WX9C2#P`m}I;ul-0btBp4eM;it?uzI zz~?DNH)U}-O?ir4akM@R;t6wHZc~f6A0M9{nN$EuBB;JUYf9XWPg`27a&}d4%r6S7 zC^wxj{Susl-wh-$o@%D6ZRp(lN3y`l&=^kyvJd>hs0P z{W$PbQ92#)YtqDz25^H`g`8qjE`X`RsWa$f{I^rqWqBg02~u@nHIEyoQY=m?tS|`C zpqjiKaJn~xNzg!ONqm|gT;Ed!8@ygyOJ??CqNDe zrAmpM(&)ajGEIv?PCUCyyVnI3&B~xA7>IfBzgaoPeowyMt-X%>2WnY`COHfl;LJ+W zrt&2=;{U{^ZIaFSF`c5#H`4gA<56%TNY^Hc4wr!L>Flcy7=`_qK2siff|frT;Eun=r8l z=`kM;^bs5pjLPiK$>5urnQS4khdX2JQFWtjLi+oSkG(BGzy&*QB{tX4fiA#{#*!LW7~n zKFu?Ld3|Aj%ztw*fZ$&aF4bG-s|E5`SmuNwqci2l{)-O%S9D5aC)w|=fyJ@Dk$2a- zY^{$v0$E~Ib-$m$*fnfGXflZCp5Fe23FHPi6Z#)2P{f7C)Ol8y6aLR80XsZYV!lDP zu<39C;t;q`Pse(^=o@)}cr;!?2t5>)l0ZZ*>p4kCXE8cfjICZ>D0-6?4O5Ljn=H~E zQ!!D?%ZUmCqx1}oqC+gw!zSqzUpY0V6eUeUnF-qH{XJW9EWNmBAv)cpi5kPDhaN!< zR;J1%B}GHil;*#kk+GS%#NS=?>~w!|my}eVMT7DJVVkP}UrPeu-;&VGyP!X66v^-| zSGR9PgzL2vRfuQTuyUltCZu}x^pDrkjr#G(&-?Hx3b9m9CPIZVC{dQ>Ip`!V4<(w$ zyd?J|GX634G8RDXesb_DLv0fD*-%<0AMABw`^=405PfZuc8b~!>1_{PzdkxxJ&{qK$cPOa_auc@V@TdobV;Fm&+@TH5Slv52~ zx|sD(7pEFJOY>9S`M&JNtlx*!6{+PYreDIROJ`*#^}ykxnAW}Mg+mbR`;J%6ivT`_ z1BjTV5{T^$WtJ}x)eqCp>IJ}b1CVV~C9(5{GPg(+Q1lc0LqhiQ8=wRU45e?ZaSDs{ z)QP{M04C`n8WYvMlt|16N6ru@Is_&;Y~oM;6$QZtWVf9#D=3KuM!tzAu*4+QcIMLsHc;hL@K{6R$iI_`8o;GTM60}x1fFWcICWD0e;^rL| zU^^m^oXW&vzfym=bxCM^`R^XX5BZ^ygTQa#Lbl=0@jp5cuO`XlCT<=}2=B-ci3WA+ zqJQhM<7vDh$A+oBUwrJlDe}S&wlHpn)<2%RwVg3K6S~Xo<%hfN$|Ao;$7C|W^gxFt zPB*!s?dTy8_R?~~0IsN>yetTFZYCNR+!?C35yIo||rUif<02Q&dbc_JyxWCp|EOPA$ zM=K-8QQ1-qk0g73L_!8o*p?gvt^-xXQ978&EB+>6vwtlh`xctV=8Rb{HOI5 z820m`Z5q($4;?4C0p5!%bV&MQ1uNPRy7+?fu9$8Jch!sl{TqDNGLry>SO@syZQUrX;A42$CexjBx_+01Vr$7O zXFq#EyrE>#CdV74dW|WgL}X4gR<8iokPxyL-3fQDyYgb!p*84Jq&e1r2lle|7L9lu z?mh2T{=S9sja^ENpoU;MuBRFaV3dx&r=TCH8=8m`6DD7vP#<)zngu#h^9d~&JO zEDNB6)jZd~{AnvM%J(GX$A@!Ewt>urve6pBj1YS}U(^z}Oya^ZOn$Z7UpYoje12L5 zK`)?nU9@RIG0Zq=1c?@$CyC|+wO(@_i_jBvVW<=hK>INEjC^=qg*kW)G`zoQ#xSwu zUXp{qTLT5ezc%FhhI@T*!wb;;J>ZkaTm}HW9%eFq(_+Gv1Y|qH8P}3kHQ3AJNCw66 zqw0F78M(jjtbWwwlsb|o4qIZkvRn`ErOQQ_#5-%m6~c!l1_!to{;{SO>p1wSgRAay z7;CG@=D<46;y~zX&dUrbtsgL#4;e|TzZZ(~enFegQoz`fyP)rlu*>7#HNE|=_5`?{ z=tZ%)d6aIvmmNNl47QPq7)lQgQAuKrII$*e$xCj8AqZqLLjs1D1Ozev@4>{2znYY8>A$pC+=sx8N^b9;{Ln+jx8 zWkXA4Lq|Ik4!IDH1x~z5Wk2E_w=*t!00^D=6;8aTBo4uW6VSJLxA{tky<*%%BQE?| z(Al{(E-4=@HT4sdd)xw<(Alv`+|q!^UiCvV;Dq?sV5j1VncdGQ7vJxTfaho4Bk!s? zjR)Hx;KZO~cI=^$St}Qbie^rrc@=v+y&_K=rx2r4htsmE3VJ85sq_MTvJ=ZnSn8^( z*_3*=5Sj}c5G45ld0s0FgDq(^`8;(zcm}+9M#azss2x6oV7QN&yrD*`L!q8BnoPY; ztZu7#{0}bp9~e;Zh4U+a;oAR$YuhSX%<63!CqySNeBO|EP+Z#4S&vOhP=BEO8PTmIFCxGYFFC6NzpUb;i zuzaa!(Fp{vcnz$y3v{ogwBZ+kfn3pRuJHt}LdL3X<$T}T&PBX4GrHE4J^X4|e7) z&i^_d|4io))Y6!GX+azAwWzELo_+Ggo#ov7c;C#+{2)@01_eV0`8rI6^8cKsO01IR fB>MmVsR;Hp?0+s$5aO?!#zZg~a;SWnf6x985Sr4T diff --git a/Solutions/Claroty/Package/createUiDefinition.json b/Solutions/Claroty/Package/createUiDefinition.json index bbda3acb34a..e680d7d0720 100644 --- a/Solutions/Claroty/Package/createUiDefinition.json +++ b/Solutions/Claroty/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel.\n\r\n1. **Claroty via AMA** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Claroty via Legacy Agent** - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Claroty/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Claroty](https://claroty.com/) solution for Microsoft Sentinel enables ingestion of  [Continuous Threat Detection](https://claroty.com/resources/datasheets/continuous-threat-detection) and [Secure Remote Access](https://claroty.com/industrial-cybersecurity/sra) events into Microsoft Sentinel. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Parsers:** 1, **Workbooks:** 1, **Analytic Rules:** 10, **Hunting Queries:** 10\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,13 +63,6 @@ "text": "This Solution installs the data connector for Claroty. You can get Claroty CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, - { - "name": "dataconnectors2-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for Claroty. You can get Claroty CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/Claroty/Package/mainTemplate.json b/Solutions/Claroty/Package/mainTemplate.json index e82b4e64b03..e5ff003865c 100644 --- a/Solutions/Claroty/Package/mainTemplate.json +++ b/Solutions/Claroty/Package/mainTemplate.json @@ -3113,7 +3113,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Claroty", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Claroty solution for Microsoft Sentinel enables ingestion of  Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel.

\n
    \n

  1. Claroty via AMA - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Claroty via Legacy Agent - This data connector helps in ingesting Claroty logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Claroty solution for Microsoft Sentinel enables ingestion of  Continuous Threat Detection and Secure Remote Access events into Microsoft Sentinel.

\n\n\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1, Workbooks: 1, Analytic Rules: 10, Hunting Queries: 10

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From c9c9fc09c96dee890e7cae7265e89dd439b4a3dc Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 11 Jul 2024 12:48:20 +0530 Subject: [PATCH 08/11] crowdstrike updated --- .../Data/Solution_CrowdStrike.json | 2 +- .../Package/3.0.8.zip | Bin 61080 -> 60807 bytes .../Package/createUiDefinition.json | 2 +- .../Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json index f43265a127f..b5094eeb4e3 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Data/Solution_CrowdStrike.json @@ -2,7 +2,7 @@ "Name": "CrowdStrike Falcon Endpoint Protection", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\r\n1. **CrowdStrike Falcon Endpoint Protection via AMA** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CrowdStrike Falcon Endpoint Protection via Legacy Agent** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", + "Description": "The [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities. \n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", "Data Connectors": [ "Data Connectors/CrowdstrikeReplicator/CrowdstrikeReplicator_API_FunctionApp.json", "Data Connectors/Connector_Syslog_CrowdStrikeFalconEndpointProtection.json", diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.0.8.zip b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/3.0.8.zip index 4a5d0487d817866fda4d39f3650bfb6b63c2b3f0..85dd6e8fb51b6a700c24cc07b4fc8029d43cfa5a 100644 GIT binary patch delta 23474 zcmY(KQ*fYN6Rl%Anb@4z*2K0snb@}8*tTt(6Wg{Xw(ax%=jPO@+IPFFZ+2Dh)$8d_ z+X4^W0LNC80f)c<0Re#lxivo5#A%$h2ZsXzDWi_ZCIUWf@!CgOP@ii^8KQh(p6Jt4)?lBCk=@B=An9IpB}kExbMsgy=CC?Eytzp7tCfaV ziH7OWm_ZAXiesc_9xAX9HU^PUZLwqZr%Kl`71aR7+?tyCXix@jDXw%6eKXr#8esH@ zh%0t;ML-W$mQ8HDEfNoEPjQ{VkloieAenj59Uc|B0jss9)3$)#A&d8?y2P3}_^Y6n zpvvQ3aV3jjilMnJ05#66p!)>u;wHjA(hesjXy7?J%+L6#HF)m#^rI zT~c=zt;?zSlZA20ox7FEXw1E4+b;OC;biNNT{7*13rYKIPl?+*m#qf$0iZ@b*`Lqw z+fa7@Y_B=W+n>iuxz6;}ORb~ELu+Zn zqS?`D>0JNd)=eO6(ivPYGb*%S(e|cNLC=^+4G7SQ3~ubF3R4O+KKY52WDOgTpuP$%hMN5$4u1(-1MPCNTlmo>XKOYiG>NX5t)Zwe6Xx7YQ4w1a^X%LysUV?z0tQ<-*WS;K z?Eq-7XRTJW@|lQC9RPP$qu`%n1~$!YK}3nmFc#@C|90vjy# z4&S>@rGMC=P8kt~t5{^SCNM!2=8*wsYGswjRF6#r|uj~Mq} zx=2DZl(0%d0su!y3!LLQa&_=!(9Y+8Lk3yoRY6d5k(`bK=T0|i6giU#`lvd`vX)4P zGcJTxYtWVM8g4w+9nfP47m!r3@m(20UHvtDG~cZ|dMBJ)HgfB6K7{i6pX?redDYXg zQzNc&UD;#EzL}KIo!r#xDTO-)hg1v`XSu6i1tTAuRDk!T6<&p^rNP(WJESu>egIS% z6AEr2;d#*_{qPM ziyPI_6oA_5rx3ROC39#AXdokBliyrV1TtO{Hc9S?HVU|UjtEOeWS8*QFkH0#Iu9If zr&*UoCr`d`4%mO2I$O2SX39l5mKuAd*^j;SZ)rFWtw8O>$#i||;#j|s2R9`8fng(? zY5~d@nxxzUs!&-as^lW)#66l+fBB50wtlgx4WN`q%e+zir6nyVe-B4jnJJGgUu0t= zi?~k?V|6oZff%P(n2b`8E>b(^uzGCa3l`o!ja|sJgb8UjX{R=m7V0)|Df@BVe+y6h zWlQqSBxK_>-p-eUaq1@AydC_qCHyXbw%OA~sldl|`d5+q!1Z6r{g(@g(<|8P5k4fBr&X_W-1I%U~W+ytnITbr>lCz%_<3Qn83z&5{>#)$T(l;<+< zXS-B~TfGWj{0c3QT(~NG_G;osPN}Vo{;+;s$BVFqIkz=!L^C(koMacKno8s@h_fAr zLzK(*lr7K6L4#&wQ8ZGeMX~_Fn4sujc4LORiS-j7oks?}(!;nqU~@Z(w!LQ41I#?^ ziB1Kd9f|~VV>kO>Y&JUa9H)6AI$Mz!ky|04v^>n#krDKt*t!$k46BG7%$^lsX(eVlhq?Utvde%dS1wwdY{(pI97(6o~4BBz$Ie z3ppPW(lq=r2-ig@hK*U(Ey4G;qjIW3TNxDo)tAXKj}$^=YM^E6NNhZ@=g#{qgLjOy zny=*E>vR`mN2gD<>iKld|H+i_sxec?i1`TZyX*NDWG0UM87Y}Wz+ zZPc{IRxn^CC@kZ6m<$u|ZKK!ql42e|(<~Z!@qSr6beSjgy?IMHz4mX83|Y%-`UGOE zU!pW{Zp@tR$>;lH?qD?zO3BBX8<1%dKUU3Wzx&Kt#Ks-n0$sRr6OF{ z%Hs3nN^2XLJ~8JLAds8xA&3n->9PZELXw1WpJjB~frdZU8{15qzc@i0#>9GjzvXBL z9KYdrEdOA^?*ydiGWI{y6XJI-{d^?$-Z>C1c=|JRFVaKLaR`T?VVEmzb6-0VT`pSC zJX$Jk^yIR%_E4knSAd)SK@h`7!CUL5Um2J`^)UgIsXLkrrwi#|d^r5;$X9{eC`Pg6 zw862>F_@wero`D?<6vA{e1_w>TKS{tGY7R3)4`t6C8!ig60nd-<_NM}mU~Bmr$i!q z7iBw~zU+aKk>isU%?o0zzMN|)C$90>3ObeV5psQoS-KsS%fRkz-rT@f$1jmRgP*@4 z7Kj6F#b51K`q!_D4d_=z#&b#8_Cwzn!F#QY z80pa4WQK9k3rhH3As+J)RL-tm9;=kdJt-)BZ@4TsCwOR%URuwoi7o*{8msf?l3d;T z$@;FU&uH}UEVKPIzjmnnuvatff@gWu(6xEnnz!Ls?R0xn za8IYD;j31(RKIa;Oa@iIXDVitS0c77rAwOSZ z)yM@iH3f`hrGGCCLgoSbz9AbLoVOD*3`oBAxpyl|@GmF4Up5&K`bt#xUdiQP>w zUd?`t%MP*(RQgc+tq#(*IK}Dvz7JjXiPpo~G&=ssXH~sje5=3&IE6=V$JAc1i+2zr z(Ps7LKP3#XHd<^SyMv2pe5cdpmXWQdxc4WdISme>cDmVAFm|e=XVO1bV#0HkGxC%+ zy7FbZSlHR@6A@jbvsgGqwHgx$)#$mPF&k+-7LL%9o!$2J$m)oh6p(guL+1Xuk?Jym zjp7>mpZ_58uP*@~Rxg~#CF8~0_>2W##!3#-%DjaF1nqWiRTLKM$*#IJ_{=5v%*L*& zHA5|xdYd!3%;bqI?}M&`HJKbanH+l5UtXb);`qzKh&vr*Dy#oCBub(ngfg#NI9QsG zpL@)0dw=k3~UslMkaz95DuXzrj3IwXkaQC<6uT_7Kk@V&L|rHK)p zb`By`SdKbWP-jsE|J`suXrw@SEPh)_gQtgv8lLDR!EW^4*vRMbZ(Of^Ra!e2>3*?$ zc=gO_Jpqu4no_=o4 z^4Kx)o<_*MdLC&dJI^7fj+6KF#REowBij>!oxQU+8%~yh<450Wb{0a6g2aCP`^|;- zfv3oDpbBw^GxqQTU+fBTdV~kdk94OKPw*@dIzUVhBA)0jcQnx%o&1;P5u>{cnq1}* zzN(rAMJ|pw_LOi4UL%{axsBNb^EA(JqXQx%Ciw)JC6_^ZI}|X>rg&RPTT*sG)p+}@u!59_q4SSxTM6&v6k+r!Sq=zB5 z1n_AMF?J{MC`;))(fn4CBKe+%v8ntotfIhhOlJaJnYGFJeO|-i(CHF+xdONG zW%zJJ`&7>NSjX2|k5|R7QH13lov>5GBWU+C;R%dZK3PGzZ(G=XJ{zgL5SqedP?wDE z-geZ_Q89FPPoL1A-oBEK;oa}QDoD5q^MP20dF51w?InB`92O>u$De|HVw3jn4{q?4 zxTwg8RVw%~lj@-lP zxnKJ719CdwN2=(hcO^GQa-HfHWG(qt&e4d%p!$-@UgVV)q@P+Fxp+Z69xN)$ylBJQ z^EP00y7gdYv-#B_^M=)~v_s7zK8$uL`3kZmZ0RDm8<~!G=RRlW2JGdvV}OxREt)%K zH23Bm;`6iHKc1#^r%Bj9%*v6x6Lc>ha)*PqrDDT&8ws?X!hBdH+Me-Ns)=S3$F`Bb zowW3F1g=ymp~a`XG;CQ5A0K8x8dTRy5ToJ3`cP%dL0O~kk(PC zRGKUfkVjdNaKXT}sPC<0tbuoo_x?Hgr1u2yCPcY_(?tbuWc-PkWT-g|=0!B-Y-ey~ zWs{F;#zjWL-1ntQs@USsS5!KFIuHk2=?VioTm;NFoNZz(eqUht2BG`e{0qdVHo{l7_=gX#o9{FA{Y1iJ9qS5)d|y z11|{8+zDU_+-qn}qSt$g=s_S6O+7)Ti`3Sn6mVHd8QFAcq(#Mbi8iiFOP5w&n`T@URY3e$HQ_ls{o!6;>oJ zFI7PX5ozEib@ENgYV!Hg>!dAJSw2okcloeoh!?ik!fqlzlAOBsOaaMmf5#P@wI6COXn0e!6J7FE zilr<Kv#U5P@I7g=KlT3~LrVFb*1hfdmMXuj(1r*g z6(cZue?ezFliV1|l@`-dP3>79$?X`<9Txy?0*JP~KPJ z1=J1O9r9ODa^pkUS{gZ!$T!Y8WP7cHskmIPeEt+ZQ)~0S8eIDr&#NxWE53Ks_CA^E zt@G)rr9nZ@`LutJNt+kAx@*pvia7z7Cf;Xs*%500wYzkwm=hh4kvqXcq%kbXS)Yeg zDHvkkIdLR(kE2a~a4i33x#C8mOMAc`IN1+x`RmBdMm< zWM~Kb8X!VWj|P#4QQA_k4iiGjr-y!FQFIec^uUS);k;-pmnqod?}RI7ihC)na-k<~ zqY4>yn^f#${Lk557zfdL$Z!8`8?>ZJk7(m06Fw=!mUmot# zp{AP~=C=6!tvhtJpgUs`6sdT-a7F`sY+kpNtx5`oK1GXcD_@#5tc_ir+B~kMLcLqf zhe28@9{ufk`_S^=0IyJ8AwlLOVrpuJJ=j+{CMqTew&?-Lh^na{96J_Li;Aa+ucLKLZAnaquscH)$i zkUT_{<#gZh!j`<|CsJk*4}V5#gUgg@EB=VKjz>2Je{*PdPv7;FTe5sD^%uAFEz|i? z9#+1CdutkDSfcKC87w1m*i&RrBKrIT5&=hiQ}#MI@^6)F+lMpYbdSp{An6Z3IA>wG zGf4C)eo!urnGPxf=FXAjRu2I8GI#<#9cg{8h7zYNG5p?}2`>Q`y6h?yiE@Y`Q-Xm6QT^3z34TsouiPZ96IgdB@|DK*)L1rqD zQ=}w=f}Arc9*%)L3LWFa9D{|0y0D0Z%g4&|%wZ|UM39L?LC90FFeLMuSWyiGrOi2} z0b|==JS?zBJbxrb(@x&U4awI>!!15C192uv$*zNO7-`W>A9YGn=yA}YJ)rF@-fQ}W zoTu0gb(Z$Z+*VU@n_fj^mIRr5jynT%sCU${@#r7#JWPOzP9CSW;2@65YS$3Hb5gou z@k(-~5`xx5*-BRhGijSm%&SvXeXi^y4k6mLbd_?0Kp52ITH!*^Cpg{ONcxWla%{>6 zO#*`fu(L(-mlgShw?1(c=?7#`KVP$F^zxV%*H3l#A%YIhX z)z+g8-*q^7>V>(IF$y0Y#ns6Ta*Va7bX{=^AZvgP_&e+guT|1v`B~(;e2iA2qA-2Lve9F z^smZLslvTF%$rk)&7Lv)Imf1N1*PGw4_q>!s>}#Neknw0kh6p4;-D=ZWMT~}g6xII zR6u0Xo7&}5bAw#qwIi_=t^JQhWZT{uee^|@z%RJp!V_1r^qw|93dVU4Ybz#`h>jSn zONRno?^=IVl+KQwV!1AgJ!wksK0NcX3#UfwIbmmgcY6jfAm0fEpqOd9iCSQ~hY3Ti z{Gx~_YS^E9O@_H*Ak@X6R;K*0^rX$fR0b@@6r7luiFM*X>e8$yXh_QZm;>>#K2T`n z&)won`q(PCo0=v6Eu{sctJ?ulB2;f_%cDVr>q6WO=L{aS!5&GBqICnh#Vv;^$=otr zkS9!~EI6f$NZW(G(t~vSrE0e(8@6aAYL#_?G^m)<29}!Mlv7D;Ix*q$B+XGOa@gEGfBF$>+cCB?u{I59UWl|w5r9Ut!W@`g9Bv5RS`XVq$# z)F5~=bA6~5t$mpz={b#0i=uT_vk7cahBN>&L6>N9nWbV|}|n7a^HgIAKW`w7jN}G6)I06_UX*Ky71RkYrw-4b+d7cW zG!OILd>obe1*KOb_XE_f(VpgBPD6?VS+<9(J&l&X{b5FeVI?o#0SYr#!!Yntf3&U3 z9_j)x$SZDjv@PPsJ}pN7H8K1%{`<(<`3y180Nqv>%QR(p6O=%v-`_@869Iry=2t!l zWQ+MmkHb-_W0<9Ub4#L9ZU=WK`bF+O4S*JM5pz;u$e(;epNh_+O{x-->M;*qez`i{ zw$34+{NCFnOc=b1(~N>MI)VBODGm9G>?F+NZYNT4x3ld{h5wXH=qwbx+qqrwwl5i+ zOFfwZ{qp){=mri(jTfL>Gzf4)kjsBst3RVN^x))eV?-- z+BD*6Ye0`)vFQ;T;;wXB1<>F`QMd`i&mC|AV1#Z~==YfHuUFNYa;Y7pxhEpGntqOk zrpbq9#e|BU1&csmA43^Of#Mkb;=0%0$e<9w<$WZP%5Z)(fl4))#9z^iV^)J|vr&ac z{7N2fTg$cz_pNjvl>y$WZ#r)>CB@#|Xlc4y*9Q-usf{Te9xWo?CUUB;mF(ljf2iHz z)3z=#ZEMj=t48Hzu>Q3_R zo~Qqva;xi0tm?ULEYuTxgNDXcQz^)cz*ef~vrMh=5!0J4PV$`q?hNiIKMo~x47@QV z0Zo@j>1=P{GLV(F>qogWU5MN#X*&9mhrFKB&Okdh*S)ZO?xSFyAb8ulCj5^pJNfOq z(3~8)9RBY_eFE;2%6~n;^#uB$b9}O?TmJWhk6nQ3H?i3J(a7@c>E8YOb|aPK-nhQt919yW(}W|So4bS=qYvVbqZQpBGxI2$*U6P0LoO?KB4T*#9e z^b?dr*`&?g)YH&R1WPTl;?GvA8Ww$M-TirmMiSCIiI^w7aR>B`YFVw)I1^GaLHUj8 zwG>mXw#6Q)u<4y!IGz58i~{o3VBZ(!(-aCmzr1rOoxcU2w>!t%2hP{CJ6n`rjL7@T z%ZEGQ{q^rZ-~KgT(AU}XWoGEXXU4G~!R0%W^>-d}tAFa$>_{T&8`Hhez?{MiE{Hm2 zUVJEI7vhTuZr`UlH2TKCg(-AS_RAVexN@fB>Tpo`0~nE3OVhuEkwK6zwhFg2ylC_w zj(7{Bvh05~l!!9NfT;(sHs(xUO~UY_c`_T|P+Ip{LM=zkK}|1!o~EoxRVLoD2~@i`{2l z3AUmAsY%MzD<|t}ZD(;!KmL1&uJ1=XR!+ogO7i6OCd#2LEUPENS%%^q1yb{>;MNE5 z7McCWcr#R7KqIb`x8QHK{V<=D%?3V)bL@GmA9ihmrNvzLA}a3CHPqws6}2gfI_QR6Tn?x)!e!-rs2t2lEj!26 zenvF>kdE{Yp8sj|gT^`ElOjFRYI#Brh|wi*hu&Qz7p>qcrt`>eO6cgvH^HnL5M!RnH>ZovZ}RuQHbM$x zUruhwWPH6j({`@Ap1ui#XQUu-fJA8`x%~ZS;oqieE?TaWGRWw$s{9AcTY7x!rjc>) z$%t(^tNOA6P&lbBOEZ7I%{5gnzd1(%+pbUsOnQ*U!M<%2qnn4@Qf)OK!n4-3p@MaQ z1gtcwNI&k?sTz|28#F0h&`AI?!_f}|T~X>3go&D;OP5a!pAS~}_hT{ypv7D&p{_b6 zM2CM4g+DkRLhN=-7+rUbv3PS8cr5X#A+;WH1Wwdo2ZLU=Csa!l3BajoQw$89q38aYwH7ERBjD()$Z0} zgo2(($RK--xp^SZ_=1!L5VJMKR9``HU_i-8BqB?@84EKD{lwsiM^Z&F;idFf#}s^7 zTp|u?AYhd?n?AYd!<-x_N?$ve;zKrM#=(+r?h`@f&}?;BcUNw$wzd=`Pw#hynQ*{2 zn+VS4K?gdV(Po}br7ZRtAju1-MRt_J4Mrni3-TXyGx*ct34$Jh>|6|oiR(KA%5s86 zFYqU>sIAz}E>c#iJK^7HiC8=0l06=s{ME#FDAj9DRG)483w}Q>KaD78OcoMfu!AHc z{&*QZmkI^lPS23(#q{`>d#fa*@#Wvhm3f#pc!O8oF&ZoIyp$lsxcQK&r1M@`tJwx4 zPEp>Lg04Gm`{*12ngOmXb&=b<)J48Y!{G!H`A@LO^;MR*lv9&O-6SKzX9ZifXoDrA zS698v;2YluRL!v?Eva(cLLDBH96=WdF-@Jku+Gq&=OzE1wzM!ltd7Ct@UI9&J(!*s zCes;R|9hu)Lfe=snwGl!^j@6^Ubx2)Wa|@-xm@#D{<~E`?KyKY}V7ADCaDdZ7?h^67q+}xdd|SR+E|d{pkM-0~ zXNWR7I5CBC>b0G4Vfer~+QP~cbG)hD9c8j8R`&;XD+hVTII~KkdXoyxZ9&Qf3poFzqJ(rfm~i z4<^17NNROg)C&`oE7Fc#HJdi19@ad!zXL6xVY@D`waL>|DG}gh~75u_wdP-}NE}->mYk({S0)a}2@+UVY>zM+JTjptElFrD%+ZLR*!W zPxD5UUkq!L_($0doS5Wp8ljyxcu=?_lde#Xqf#9@5MbdtDIs81=>N8hC3~+*CSv-h z%e(@O3s!!)Rp9dl&gN}vl7}~C<8H0*8D!uC+si?TT#TC5_25-dv^B6a*5$kW(%{6M zP&PMOgd6Z^qU;WiW?tlN1UwJ((%K(o!&x*DdfqmUE!Pnw2*rCcn=>A&}L6K<8f7)R?DelY*;at%nYUa2#F zK4WL7Q0;1=peWs0y@+$_!ks-AkHgDAge5y?-=pl&XANiKxbmwc>LN5QWnbcb$zx6{ zr!Hsch@t~1NGhNLzYuhw?T9ovIpqPX5G;!Lp3@7i$idLSgK|g<3AzkmS$HAtc+MQO z!RDhSNVwYlI7x`d@^~&sJpy4A4XjJUDUXfnrR+e+A{c%mOL5<&_D*VJ+sU5#AO64| zqot9~P@!;e_dlzw+O!qL>%_~QV5D?WD!o0p@lRM#fIFqCEY#sRFAjI02 z0UKJ9n<+Hc+ZlHMHYi5(qCV`Bdf?$(=2)P@Kax|Nu*H_Ps-&Apt84-zgp^sbwU9KK zqIAYDBiZf7dXK&%jNV+pMYXe7urN%+7$~YN`WK((MuYcV73U{<;eRA#qZRQR~XiCCQo))F7V)wSJ}SjzH;BLm(9 zCfX*L@Dywql&wkKZQq`Iq@X~ppPGqKt_Ql%YRhT{r?#psTxf1tgxBsAlre|Z_EHL_6HW+-Tnt#H7#%mSi+l$RPa-}0nC(Jah}mlk4g+R$wFig8D%+G|%cJG9ENA;xy%_=BP| z#YQw+1DXyB9#4L;RApM!&N9vad4fe^(#w^P3W2bmLx+&*FydFk8LZdeatd}?3nK1a(wAJv%vgtHT`erRf`=BgA^Eule-Hb4la&xUJ9i5mPKgQcXA zF)j`E?}G*BpER;9JyZc7AsSoR~pjpE^{Vkwwc5SW@SKo{S00piT`4KD>{OQ@dKV{#O_)KgCP` z@VN>*{vIc;-qBC7bgcthX9e+Olv#njl^;_k7bht+vz*CtZXqdq#66LBjGlLnf5|0I zsydGfY5=f`GYG2uZV>#oBj;U&|Ed&VWEQ`N<~B!s#d$?9X+8{}QGD@DdmrA@EH!B8 z{4e(Hzu3y^|HWEbF)Cz6Y-_@#E8$W-IsO?o_p+#1>w`0&0XgYn)1w;nvRGd(&_u}7 z7Z*x0mB;Qkl749E3-MdA%Hv&;ulUu~fP|)5LR=pEC+A_znVsE$Rqm<@DiL`F7r;J> zWXbM=G6?a=Uj|KA`YL4yG0i%*;IG3ucG8A-ANI&x2F)J+fv?PSk>)9`>1P-L`?J$Z z%vmzWB!Y?HgokoW8$3+MTSJKRbm{j-3X{B{NdyS`YRmkp*5J*9r(tPdPb(@{;r^p( zl|fBwmAr3vjJ|-2bHe=EfLX^?5pWW?vDDgX>dx!&$N^qiE@(G3>xyuk84ju3F{KLB z4D%#nZ0&aNN_CP*4nVAAXF0${pm~`iYNLR6(5KVP*=XpBY%Pm1S8i!9Qg=j)buU}I z30V;@e5Mih;WSjgp%65LW!#mK*h8%euYm8Cg1CCONabX+gM^7L&5KpB!D@+fo$Uw3 zbweadtP%lpbdgs)#PIt%8`<1*7>EYfeytWVkn+cD-RFUGe0tZo29uLSn{#ZKi!>Dh zw#FpqUBU7Z`pT_mM&fUBudE^+a_l+p6k>O5v8FnKBtys6i87jDA<*oe1k0{b`JLqkqYBUK;_sm1*VQ<*d{*O!+PghmnG%n!l+`Hc{2y zkHf()QJ$arWab+b*d+y z93BDFg~Pc&(QczUL`$~K{+zd8?#%zq*s|i39YtCV()~Vf=Fg&&>#76Twa!OVo)G@) zACS;;q_su{4cRc0^sy(whnl=Sc1M>K=xYN^)je;G6W(;-^)St1o)UHS{8Xwd1mOAU z`y(vB->G_&{nrISrzdc8KsbM8!5vU)msSJP?`@uyb?P#841o(VY5s$T=*shH+WzCO z9*dK|7PGY(bX`Q^4tu(kwkl!MSHH5})~whN&Asd$cg}k3uil=!*=jb=epd67IM^t! zRFjJs-)LIHVV3@ojr~Qt91ht87VaY@O)hp<^bI4wolAIO;ita7;K=Pj00M`JS(DF1zPMSQKs~rLyHKaRcl^?$hXW(d?k2 z?4d4!+pN3MEm=#0KpYhaa-4YISet#nB|Nhe#tNt|r*&;sPld&yTKh8%TthExAn^X9 zubsKu#QIhu%R4LR)`q{CrXD1QxEXMOZRic8UXT40$AQdhHg{X0>#)P|tEO8WDDk=8 z;uQs}NhEj({cjpY>LtOntHg@`HEcUU0uY|#y(CAhBb)-`fH7EwYq zB7nF_F2673`Xa-JxJeR-%_(t&WC>#NSkXRrv6An^8M7bDVNe8I>pR&lu>*A)e#trK zK_v2SP@w9xK~nyMez|ct0f2+OIOoHZgkVF~D6ReWwVm&rNoOkCZ^B1wVV*AW2=qZu zdmIT=pFeqIsDWNcnL0^|JyceU8){ zEPOHY@3$$8>J*20u8jkYNwzhLiK6gcwI)n*%u!QWi1YvhYQrJpG$4n)yYU4UP439L zC3@Y1&2GnbzS4ni=5;f~U2U$ajcE2ZjUC1$FtS6bCz z5F#Frfj^9YkLHAo<-qcpL%XQb+0!jGOk+!{`SC!<$jBCQ=_rZ#rO**eEs7df#Y+B9 z#zDoNh$WR)@J$7up*-n5fL=or&B;!$8MZA+?+Z%O{o(plZ;BvJRoL?&C+1N`S%tM6c#oXF6<}n zH@3J6SJfPI9q)&hCN}nkf8V&MUWL@|`eL>@VUjuKym;#|0VtH0-Rs@A@&gI6nu10zBxu;kbq z1HeIW$0br$V>*ZJa5x_-HV`BGph ztAd9#RWnv2G%Tlj>~Cm_t7$V_&2k?}8cBAWogwH815`rx&URWMI>8&6_WxydwjsA! z@NWsbfCX5tO!3$DdN4SJgH!&4g1#2>!^A&41*3igtz?ENK=I%1f!>GwO{^HBK{~&Q-nV2W}U8$;=`cLg9Yf>q%VGbr9`$Gpsr#pPT z44}a(rY9mSU+vB-sr7M7Cte%fz1T4e0YRSyA563d?m?=7I0Bdxy;)q1Z5X#mcV)|w zCUh)osKO|?q7Kx9AW@rXOPx&iZew=KcZ00H61wW7o;GU8_!{*~Y|)n`Wk&E_9;DQ? zwL?sfSo(uL(ntts`Vy6@mDh>)JNYzxpvHi%IB=raH+t&o-!Hw(LF~b-BTK)#V|f&H z;{F{=kVFQoNUrj&L$&;RhJA=;d)(O}lEQ4kT&E|8{S3Tae$k8Y@uv8;FPKMDtrkfl zmQ2dy41_n@nlV3KTh(K%ff6$J z3rP8#f7#`+u4p(x_Sk}b@rjFj(+J+H5U{9RMj6^hMCrwt{01*=U~qhCKH0DENpvgIR&p+w`Xzmy3D?LcQ%7pK80 z_0G+{k=A4B7{9SF-Ke|fnO!eIV6 z#T6vGW4+0PLHpPW;xidSO1t!n{FMUdA^7?a8YwbO$`g>Xv;P0kNFKF2W#8nCN;O7= z^MsR+{o(iKBgoX)XPT*e0wT-$?+D*4vg!k>lh_Zp4|aeEe+p6o(kJ{2|6dO@bq>>Q z=nYBSEAFsc=)agGQ9^@eMm~iA(MZF1U((Sa5TkAyNBqds5-hsi+Mq z_SG0MJ>h^3z?VCJJvrEVll&n9TUA<7$74RTS1(D=?;^fUNv??20Yoy>k;yT-E)<|p zbO(`81??`z#${t7jiCpCvyA#7un-sd)J7}xF})ESpLCGaBUx5tBa54HN=U@s_I#Ja z{LBp@FV6Z@c|=h)(d~Gw;_%&{@nMYfc%$)I)B(snWLuYU=bA;O*UL$-XS04Eh%#iZ zx$S5n8H#w)!GOJcr<(fwhp_rJ;&t+D71@~$e;T9hv|jB|pe_Fi3r8}aj(4FW`$O)I z+S*CPj4G|Fvz>Jxs9O-HKWk~SJakT*uZI}Bf9Cz=c+?@D6xAkvw~uqayB=>-1JY%r z3JLVMHpaxIFD_2J|q7jWHE`HPhw~)|)I7!uWa+hKYIvGv7 z$yWgm^DV7_riqYXSuDL-W6Xl-i{*=+-V8v;`g5s#ABSARRo<(2|JmzAc=NIt7}R!> z2&^g}Z0uccwzV4MSUhPP9)X2$R~WZiHOU-X|JtmZpzG9t(8gBH4sO`~oyaMR3qq$+ z)r;e7URlp;TKzMe`EJj8=|8t**I2#uUr(i{syviLsdB9Jl~nv>kc&^(jh^Ozjs!p% zG0jsB9m0DafoO$a*5!6Xs0m?kEU*UN&e)72Q!E1;AOTarfXG17@)Xn~&9DyU1RI$t zv!s2k;4$)Zo{tHAebArUnAw-a(tl$xX^-yTQYfT$&?S*hNrT72yMnLl&mE_IJ0z)1 z*cX}AxwxJA-IJ3S)cn*xw#s!vH{HOlV1%#^8iI{MR3e(7)>OSBgGkxmGHv@DK~S=1 z`c4b=K;3Y|!&?-`oLcStZ67~?p_=B`sH`i#dIJMyBuT3OA(HlHZL-SzP$%12849v? z>s}s2;!8b@!7je3#}w}0gESs@m==@={G=CkT@S5Q&9DF@@gZL~+NO=hN>%_>+)<|H z)A3we(p~|9f{$jX#$#^WT>bMz#HmMDW-)9jq^12Q)jitb>tCguZ<28*>OC?o=PJ<> zM2Ve>kA<`U7FIUO^x$VDbJ-yn5PC(cW9!c&j@~le17=J5xCtkw`{H12kfhJI4!47k zZ*^|8vWP}`+`SC#2c?mqYH9)JmNQ1@CaL{^^!aes7DueHtU99w`rclv?$gj+85Pm0 z*@eWR#$#Z30s-?T55Sp09qcBUoSXT@ibR@E+z@YiaInzxd~Ou^2^R3DVxL3f0MQpq|$lS z_hgv6$_m2bT$RLll~I+usQSDui^C($Q(CnyRd^7F zeq)H<3@0g@`hV)UtEf1-E)BrAyG!uK-5mnK-Jx+0?m+{MySp|7XxxHp2o525Bf%{= z1h)_vGT+EQvu5g|E^6&_Tc_%M&fZIF5iEFBl-@Suj@9zDzCS<_fg< zr5=LMvP$w+w-DX(CRa@`W}koxh2k_xf=5eng$IM*nA;B8%pkMiK)z)NU?~Q?cMDW) zLTS_FPH>YYyh723a;Lb3)w?iA*&Dol@f`Z!}a|uE@i?S*Mfn`vUf;c8W>F=IM{e|+zgY;c5m*e(M2RsdP4B<&si z2M4~OCM8fR63d_fP_|fc78x4Tq9;df@>M7}a^dK2qmaWCv=z-ePFxzH#1V3Xx2_+t znD7~r+bdRNp4gW73Ax*Ln342enwUI0*!Gh72SPZ902ge5m;uiL@Hb{~T~?AZ(#Q1y zq_2zLFc`wXJ`Jdw{95UX7UidcFe2M+K%9qGV$gs+>KrOTz>lwd*E|hlWyyC%a6z6C z9Nr0$6R#Gdn|{K;Ch&M0g@_auamrxZPJ{0p(-T?UIBn?3Q2E1V;+NER)i>Lm%dX`1 z)`yj3i2yBa-#0wxv*k6cB@|~_dclN+5rZF8U$?-7-sP+0_TS1^jI^KlT&G)>5Ji(l zO+Xcq<4VQEBgw#YNG#bLlNd?lF{@`{^`%=jjC+8W>;);eamy)=3Z%~r09lYgPciHX zBr5K%p+QeUAcP2MvKVlt3gI~G@v{gc5nT0=F!tn(TJGT`vxMJHi zv9jicWn*=tX8+9tH9_#{#66#>lXo^mwoCynnLP@IRM3EwW~}UsowdqBXRIlZKc-iC zyBxO&=FVsQW$WXjr0+d!^C#wr&F^8ZO*8B8w+m7s3h}mf6;QD7q0>8!WB%!aT`~xB z_bV4$o4g04_b~k}5C2=9{VkSTkHK zsKEwp=5%@d{g0euLq zsctjyKN_!2@r_=CNg7j!(Ce&L`lSc|(}`wgI2H31B`f4|+Y5a1b-Q)x&G^K{yw9N> z>y0804%vH zRkXaKj?Vz6k<^&@#y%e6nc2qXCv1rlgZBWQ82uS9!sPs&f1jx2%yQxEb~^}es$QBd#7ieJ8#(kh$;U` zDW$yMmrPvW)_NZ?hTyv#NBAR9bd(&oQ#qg5ta#w`di>s)og#K@dl?#H)6hQTcHzGS`Tx*|^V-P3BUqVh9NtlUmNKK;=tUm=7+_Kw|7 ztC`ZALH26PO6wX-&LDf7VWx#)x=0Tp_ztzxkG8IC!~gS)RLhqY-&Hc7$7gVLRFF=U zr|GKbGoOpeCyp}2UJ2xF1VTX$Mytb>g6wC8&C3~g_+_u}xBB&VoDxmfvLw*D15Qt5#uj=CXT^SExPT`yp{Cv?y_xwg&thSM>)u?3G%6sdcF| z-3)ZS#tdm>zfzu(&2&9B*62~z!N!eMPF<-S@^RniD(u!3&0>O7Znvz==_2B%QnD-D z1dpsW@$)Gf4vA_8lH?Jt0rYBi6>;6p`W#hY7Oaj_ReuM1NhLelOupu5I9Jp1KQ(JN zEHeiZpQ6p^-anud0<1yg*iE$RMe!G`yBb&w_ZeOW!f_frr3;?@gFfA&tY)LPxVlA0 zCUg%Y%ux*IO|bB6)uzcG5zd-Iicf_Ynb9b9Osb;E0x((*qK?D7H17= zvOR;U<*a0ZO`m5|Pm%~^<44;8He>KhI>5Ryr6ZUUj5jsSDiZXjLCm-)>jwEd`v0t19{Iv>~FFKo!FF>x?ND6sLOcFRjb= z_$UG5P^|?>RKIy@&Lx4qTuVW7u^%Q`J#CerinP&_G%RDlzWo78#c zgnZ@jLg{&IIt<>}TV~IinNjHJ#50n%r~jyx{^)202hzGmA&8CSBM6key`S96HT7#C z1S)GZe;_5$u0~Z7#JH=r2mV5%f+5hkheRj&&AK%^0Hkxr!M-XBzPWnA?|V%{bybjG1d zSHD6Z6VXI)&9L4C6xU=7iwPR=?(8fs5Ry8ul7~HgXEs)aN5mYv!WNU6Fc?E-XGkHm z(!#FB#$jjlw$$%Pk}hzi07vxLIE4*VM55tZ3;IGS=aHR0k4kQHp&HwY!zinmo>m;u zJAYuYCaX6)7&{LwGXhtP8)F!ZhQz^!qosLc5pz1-x?8HIGgiWB)e0BM3>(WlrQ5_J zv$R0q^1tK{ZB8Ea1bqlB5kPZjRe`g+dQ$h;Ji$}g%T*ZuMd9Ckg3Kt>j+8O~a&Dv0 z0-DBgH-X^{Z{S3N#*ze){Rw-Dnd*^%jF)1}eD@KPoXHj$MQ%PrH^BDzy*#wP6ZxXj zf;DZ%hKrQ8xq(I3C0A-}uGJNj;v#1-LxN<7vgP77fK`-9qj#(r;q>X+9LsRDG_K7J zulXY>5Dl}VQVfTnZkQyaLQpSNP(y;r5`@-1IhW5?j=NP_=9|9YC|3F)>(?1eCX34G zkWQy7&?ZHqx9b9UoF=q|qFLvacOUNWjoBMeqX~=v)BqzMx+n@i>I}A0?7M>v{K^_~ zV6+P;Gs{MDjzz17e8mxBv(H*CRmnv%G=Oo#k*LkTKIz^~pp}MyUu3dvx|2j^0S(KJ ztTjZ&eCj=(Xd|$z&b_z(HFAJS%kOJN0?hiBTB7Q}9{>sjRGcH_xGH+O<*SeC4K6fA zGC6LELweqe9;pgsF&sOz$3Qhoi572?5NTeV*N&-Wk}$896xW&>|{lEvhDGR zxMrogZ3D${4qN6+`GvWR=uQmJ4kFAk!DuOACmRg=xweS8!fLdw>ecVJpCt4kgu1ih z@2_W>1OAp-A7!4W_Gee{n}Hjsfqiei%Lb-ZD-c@}vKVlO^~2n5+-;hwY@FLH%4@0D zHOB1Cswjb^so!1gbMlWO$?e|_{~(1{U*`tZb{wREnEaWns73h|DM0_F6jOp|^R=me zavx2dzAC(|_h28FYVy0!cEwK1E&K%(C7uA@J%yMJ4hrj-u=wC8^coz!A!#_=^i}8- zThwSAMr(N{z8}$#0i&f~Prvib$b4aGFkL{V+dgQSs7>~HIN6V9JQrp{r@yR-&4`?F zhvL~+teHUKyfX?wOpi`*BOhc=`3U#ZA~Wn_0*@@$CS3SgbeRA!D%;~~YdHd|2@f2X z|NLqf%x{$4pL+nQ646f$FIy&(FMqxrziz|>+vpPYf8B!RCiEJt4f{v@WZ6Pl?QFY0 zsJn2E;W_*MQ`!Ti(fr<=Ku<(kpJPhTD(31}Az?;0c0lC8QivlBSBkNpm>#}0$&ps^hCR)RbF zUhLlPj6t#)EZopmX=h8`58qB4Z6W^iB}F@;amiH62Ekq7xS#5VSen=mZe?NuuWnC& zgCzNFZOxlm%ynCe4hW|GylbRrvT;IaXBG~AozfUzyXK^7fO3ak4~~^DGiJ3Myn5GX zWdx_)KTAO#E=1x+it|lE0C}0}6ypoUq^fprqL88P&$$Hk+aWHDo~z>^K|?qP=qX-c zVgiCC-Ka|MbB|mY!-x0J-GRJ&jEeCSAn>~Aqz>{Qau8O1=mY0|+{qanc;s-yF+fI! zT@a5awOp#Sp`>(vz?>3>Au%b@upL)7kueQA(z0@F>%JGR(b8dCedmI^@rWv64W|I8 z=6&0|#3J@}xrgo-_iF@zm6SM{sFtLjIJLZN6EmRl0^Z3_q5`W;A~8M>?DQRiN}}Z9 zM*{dr+egZGkk{WW3X4kq+8)^J`zBxyt8?6uG&xmpm2x#L9_S_DFGMN%MwL?HQVg`4 z_#|Jwk>^8{#4lP^n;duIN5{2^K1EJgtH<%lK?Z!{D2&r1-Q0`hEbcy44R%FZ`&Lr| zcaQ$ys*_lDZOn)l;)PhC>u)6+gWy{EW?LrIX*bJNIqhQezlkWF?>*e( z3|Hr-X`0C^rH?#N1E-edj{=%tNb6>TZ>GFuR4R-i-0Re`ltGE!)L_e$vE$scSTxXE z$WJOK#hi~B?04je6JHQ;>6JL^^%2SO8adhH(SAshyb-sf3z(n(ldE#h{Z+p|;4g>R z$e#E~q4{9yl?Hh5zYsO^d7hhv-?QJb-2)f}mVy?5h*B9&Cm-pN=}7xV!>xSC{3Ezx zvIbD=X#vW%K#^U?475%>F?33qOwdZD6Q48y>4j)8*|k`pYD89ZJWBqth4bLRG1`T$ z@82~<4<>CA9+1B&{s`avEagpIl(i<_ajE9krXZx4knO!4ifNIqIb2UJrKSMgtZDtJ zZ^Z#jSe77p-@vTQ`ja#qLOnZQMG-byYj|WsZ9KAt$J@2qz2_byhBO39l;nzWrWt2+ zL~FatMydTrLmU(O&NlDO{$CBT()+(O1cUfLH6*gjs0WzIK07i%L$T8!6dAILCrN}E zPDw0E$VSu9q`?QzR;W2&+v=%%Jy9WHnUh?Evl^VKMwc+BGPu+mQ|aoSmzzX65G(sjQ&P}QP%6{-R=?92Gh#$ zX3$_vGW8aaJ;wanK=QW_Xq3$?($^k%3pl9?N1;cUve0lh;TVA7n?P4-P-tU_j{l`i z)+VvHrpg7`)b6Uh;kYh9U^)~q<4T5A^Nqgy;``${%!{_d#nv7>1&(Ul8zkCszjAGU^IEF-e$|);}r}Y*D+U?z`f7rC+@MSqr zzTSs<5m&efkI9R{4)Ip7_~?VOZmMXEY;f5B-z_}RF#FZg!^-abi@>+E=-sp^#n8?I z*np6docjE>-MC=}N8IyW?jZBION%698QCwtwl=S`Z$cvt0I>VeOoLG#6wbEkrjR;;HA?*#VUllq1SAmCu6*9y_R^#P91sfsMPL*_g<#KQk6U%L z%aF7D>V%DZ&kb~IET|IIO)JQh5?J4I<>lO+x?Vpj%C}D}oHA~EyXKP_wv-Is2~8vZ z_~Q8A{_-@8W0(KE*L7`3*&_?Vgf}J#%}m18#}3K#+F%NH-@;mYgVF^o4P6!w8+{9AoX~WxJ=eUgmoB=5^F=G z?HC@<J?^V*SX!QNx^ro@4qx?X|BVn+h0uY z*!{OTX%ti|K1v$FR$55z9a=MK^kACqx_R&m(!=C95h&DHhF6a1xY%h$u%c1DLsqze zvnkHZX`V$P=J?xl0O`v~2cDe;b#{59i&@$meaz$xRy`ODk>>exp$5J5RuU6;+oNrW zr5heCj&ZRrfzDAWiwHLa%zQS;R`hAX2LQ4}wmY(b{h)eAfH|9$bMGC>M?jE-m}v z9M*HNuBTZzp{52GmN#ggt8H9w$=gnd?j(>N5&T7_Y8;ED&@ z7!Va|w16u|lpn`ldY2|xw2pE{>iZCO!|YZQXU0ha9^0FiHAYd0QnCNY3|Tc^ka4kB$?&`pL1Vfqf~RoJ z(OirQ8q~npy1UYB^#B{5`$y#ywnHM7zE#j^%6&b5f#&|90v45% zi^wHT%cPfDtG!5hLAhtA>YVVgSV0rV98Fo~q!>{-G1}KDUNjrSdIl3l_qDy{U>m7QM?&mYC^=iPH`<_G7zqwmST9-2N`dkc5-WSr~YBF)CHxjEMV=6Ar^Nx&hgx z#6Ex2Tfh`Uz6)T{NhvzyfLW7AdQU?>`8GC#^Rj5K@1{CVaOfQ>Ez44&u$tb7RXwqL zvn65A$G$Lpz{P$Mj?47o!Nv=+hB7Q10nERS*hcx!8QWD9z;zfOLBD_sPEjdYihj delta 23803 zcmV)6K*+y`+XI;00~kdl-R8JH$87DHhIEi+qC{+mo9W_0l6qSB7$>uDtIGN0#0Xn#<&q#@Fclf?g>oMKU? zBA!86U~+b<;+&8g=t`}_Q>*2b_|w7Oa~=Z)K0HgqOv%*Z<7=&~2nc$1#4X3lQSVG-NUXXDgC>C5)93cNqbOfW{(;HOF33sD?Zh|AF1H zr*ySim+ z+2PAW#K^?68zKNp^(l?GiZcUd@f(q7aD@#q$0{-nDG|o(Fy-;JMGj(bl)f?<4+P6i z8E`3L%S8!$sgP4a{4kUsr&Sh{$;-qJO&CuTv^ql$1d-V*h4cEL9=<^yaGAgen*f z#*Jpg9?s%UZdu_e@CC5@cNqHIBLVZAiy zw_4>{hksYspA`{>w^rv(MCHfgLy5Rjd6 zp-v7niQu$a#qC{6#b=VF7`Uvskbg0?>J;O(^FW=*e=bW<{wC#~6gpr|2`KQC=|tGV zjcgLi!p4L1$aN%o7>hKr%VA52!_kx^9F6xzmxH#de?&)T`5*315!%}pbj;@>Ch&f5$YQK4RUG;$?$p_badr#o8(t8CVo2?`t4}f6U8QluB^n-K zwsZ-!#hlv2{=gC84?Kp+odFY`4ZTASeRvFa+5xaLnyv_Z%nG;>d-8QzpUu#!V_?+9 zJ6L{1y|G{G^}i7ShSG|};eW}fat#YF+WBzdb$&5;d@p*XWYDJ|4;CFmSxV$}ry7-k!c zgLr8KPe9I~gu|}YX-wiz93b16Epw6qA7mOxHww27g`5+iW`AbTEnFgi09qUmbjD_aGvDFPinSGdmVcQtUMCag(sa0<8}k$M+Z`&1OeBgn3e8zKQr_d!eoD z`k@-c?(R)H^Ip5#?7l{eeOy4ad%8>u^m9llkshud}}6@O+%E&d8a>4 z@2VkK*0yo3RxDd+NdQl#Gr)p{4=+lBU4>fGO4lc&Bp z>1?PJvRQM}*?(II(odfOIwJIjq66LDE8MnEc!oz?gn#9!u)YhhGC?&5U#>B9hf79w zGjhjporTNh(ucjTKQ~GD61!)T?&omZBwca#OGwh~yV;U8rgLh$MUtVt z6Xwp0Tin|MVfX;z29T(d9Zw43G%b$Yi}sJ zh_0uZ^-^GnVKLVToitD8h(fv*D>O87>M^BydP*F;$Uu!@tvI9sKtvIyF?T73<{tqa z(?ulI+2wG%qOg_IY%v>c?lfIzd2k=;KlgEle#DbH~pZS%Cf$WtImVz!z zd}DBk+LhEtF(>6w%<%Np;mN4}V$Izx2A;65{N_O@vRGZiiSsnXu8PsKiqYbFr@??T z*?(;#<=IkPyK_(=ug)Mt$F%>VVpw0%_H{CZ_o@G~9($3`AE2?Rz2R5i*!UB=u2>=%n#QfWi4fYGa3=dG7}o8{XsYZ!CVyd2GrZ?((iA zzpg3YxFmEJeWeVoOTIx%vhrcr0;#WK2_&Y6T6w$dbc#Rt{XbAk0|XQR000O8DuU`* zb1@E8A>#l5aC@^*3jL9PuFY-Z*rMq7TXp{fkM^D|rz^5-*^ZM;l8M_%cYF6Eso0&a z+DVE^x(mx)6wA3`NPrR^mvT8>%oyXIQ5<5(F92bXY|m3cnH`0PA^cDwKo3IB5{mw zh_+s&`HV~CCH(Z4ps+P5R0t4IjJ*xgU>rbNI)Vx=Eq}{tGFJ;|%ZDliDJAG2efh7Y z6W+vx)VU@pOZ<9&C4PKd6!9nbn?-zqZPrAnq#>7dL1Z2L$))@k9OUSK*ROnEY%WqV zu32RDQa9xvIbSU2bAC}68^k{T?H1JM+ ze{ec_@L=G0?$N*QC3`k_q%F7%G@vfiGwhQDomU(RoL!rkV7$D>rocSOc`ad@4qq1(lMO&lvR-Z zRKlH%{n5zxj|QU$Cuoa5IzpEGWPFNtg=Y^YkH(JgKN=ZP;tk}ccFS}~zWtV{PW z4QUY7$CmTAL~C?T6;7`GPO$h2TY4P{$JeXU%Z^I9Mc~tjA<#bj zRXzuq1b&JSObI`{+;g|JC<`<-F7)PRPV%4StDl zOSQ*XG|1{+qGdq_T37|>`vedJd-JUjTBmA4YX`U1djb263)oU)if_(&0*V_&ap|ZB z>+im}B=<$^-WSe_+#unFpGdxM{pzQwGp)oD3*B3A8qN! z0MyIRaQo^ee)-wO!4K|J{I81DGF6~v+CIGBYT2TWyr1H1MLYc3 zy*#pGHzWS_GRP?_K}uwRPcnh`EW=@;Y&^7VyP7j>+Z3%V7LA zPRT8!G;`dKzBhJ~%~(riEAT;oofWv32YY#-BoA1(S-h~0kFeo`yOkR}ib4Q)1*7kc zoV}4_F5TMpxSJMo-`*km$|fk61^QB;=EVG7By6onD0=nT$)t_T36<*tqqAmNu@@Qo zB7^kxYMG&R;xoW;8&fAu?tppM7cTa}s$sLF;H{|`E%0;EYH4uR=*p{qADkfcy}fT{ zFQdMij5sJ7rQBax%0ZH5V$#50ubpgm-y*Q1dgWN#3WXkwHu&C2 z(ROb=R}1&jZ{5-lKny|xFJO8rq+y-0cYL-NfPZlT_%-)*QgQb!Zs_DfZtKKAol$gr zwl|0V%F-Z@`hQJnAoK8041J3-VH+5}&B?Q8`#sx#m5q*+%fBXnZ|^rc>)z;)1uDOv zP<=vx(Z!`GQp#xHq*%tp*M4!qS!S^|4x65fX+hgo+kv%55Ad$m3Bxf`Z|niMD-YB3 z``$2Jj(NVNba?Dfj>f*@4UUeFCWF&Qjz1W?las;m>1aH5AD*3$TyMyDa0*114#Rkw z=kXdOQ!!7bB6ALZU2lLBfTgI5Ao4^06M2$uf&>W5`~|O0qG_|5gR1JP2tf@FC_4F@bU*WeGD1}Ytn!+1QLJ1JUbnyQSa?K&hkzP})` zTgh08(?n5a4Edpu4wh$*xsZTkmEH(T|w4o#qDrF?z<+_d#?PBn2V zZwf!wv}=_%VjH?f*VrHw;DuDVN3xnG(x0{cxk31wCo^TeBVp_<-6jCb6)SKC9olLr zE!JwcQd~RK_wr^L`ot7MlQ|T>y(uTZ-lx8Q4px);nmiWtDuHLwn8PjKaDRUXu0xwS z$D9xrBel4*%!1F~R8H)6T4emTExEEQ#B&j%r5CwIHF>st?zZ?fm(}Iz<4$FAVAQ;K z{MVm(cfGp#nAuy1C zl`_A!#I{edFC6Vexi2|D+t4JKPW{C9z_ILDX%I~jLoE^0NjD%RRmR`?LjB_LxnI3{ z@>trRAHmYY0ubk>qzd+?!C;}E;T`h?@NYe}j%R;=AK@=&h=ONv=)sp~f47E1Yq{`1 z6y(2PZ=N;A!E?xBmrR|AdY$_z?2adY2nmtvlO7>AH~{vNTq1cYqO%%};ZcP`sLy(4 zIn(%nLwv6;Vp9{Z>D5Fl3Xe8g>^;eQt>Fpr{Ams`uJGMK^d85~iYm&3G3JEEPiP{H|JsUSyj{sxWk1XbaG)PM1? z+)qwAyKntU-{eC;V%6_qLQgYizJSMT1Zd$-IUbRu^L`m+fUD9?asZ(Z|R ztPH49jT~0?*F`vuEm+cDU!1`LO8FZz?+=NO{x@>G_jQgJ1pfgN$;0EK+`T77!iPrdZN{`i2^zR2J4w zdlLAe*ESTCT2~LoG(<<4$s-ZJb;IM<*mw&j)RXtaG7ND~buFY0pOp|y5p$pn)`_;V zO4>!7UA#)?W>17GyA^TyG|425+fO*Bq)P==}_kvEe$$w{g65t{&KxUO$u3$vP4 zt$talw~t2CXf*dVf%~CsKS^qT1rPT={v;H2wC&?hq^M(TAAjOS9clac zQ>iG6>hf3n_*2(^_*2;@fcC?ik3Ws1)}(s;NiwO<@h3e8g7sD6Pl^s4+U-96w2wbY z>h0rC+Z}&W6*S%BPtCqKgK$$F=)8;43{=8Rx_z!dn6ln>E8GN23^(m6x6q2wAyXIh zKCC3FKpS3Iv|dw`e^YTIMn^3CS_wpy;zLC((EI4$eR7t6VP;ctQ*VRAZRlt!F)}@W z0zHte1j9SIJB@mmG~lMWl1&PL!KEm8Tm$uIVQ?!7uVrh|y9@&m$}d(lMb=x_$=#qy zxwtdy%Cq1Bp3ZYb{FeAq11Fy+u%xd!TiWjmXPn|5yUzOBPd){%Z!_~&I`i_Bknlcq zh4);fb{fZj*L5AH^rnt>=YE3eI3+M!J~PP?eGA}N{%6!7`2q>LkNz?V0mLub$YCPS zoV({i^ot)&vl*&&tUxOzq1zd0BK!XmPXpJwSS*HYUabfbKQ@KNOL*gAk;Xv~Fib-7 z-^x>Cl*nya<}Bzl{ZLYwWy1jLyM--gTc`QFpU5|lMsm#4u;G$;-FMbB>dKu{P8!d z*(BnX{xhf9hH8QgB^#9*Z>rRnD)#`hz-|+82*pb$R08V_M9S+UGgj_f`Ux%L3cz>T zaMt_L&upUo?SW0q3tMiR@g~VKx|n2stsjYhR=WaffyYOEo3Wc+vWwo;HwPiUbY0)~ z5L?t&lRChm)O+;#Y9Lvf>y(By38KX^Yot3=X$BFu#wrC3(pJ^Vx2n%YDJgP7|K7V? z4SaYf2zIn%leyvYQWH+VKh+|_!Un^P9N?JB3{auw!ohY*Z%BwM9X|ilkKEYve}8j- zbs5hWafAp#^sqBS9!cOY!%xk@kovW%n7Bb|P1%Eh)XKdqTKRN0BQ+$1o)Oj47k($f zG(U9GL=(ige^F~-2~`WKqLD3ff^0xPt`;vdT(7BGE&nvoNX-v*t0EOK^;;v}Oi|3# z3b4I!X{h{{6fT75zM_C3!-$*dy>O9#mz4>ZpKfkmBgO|QaDg~FP3@cbqu+=;RmmbV zU`PPZhVw4=?{9u-!{=8QGuTe-C|$;}hmTtlUyvPmPoMt@-yQVjvbBHjAMg5@f%+f5 z{1?gEt%xeYoCVjem16gIQ$cy)fftWx}j}%ha+ZW8xt1;4N+6RXB*QxkhZOS{(Hb z`%;58e`u-tC+7EjS8yxk+X`cUqorOxuWWf&XAZZJ&}OyO&X8wagr(GIl_biv<93p1 z)$Zv`sg2vhJ)O!6r__h z{=G&MmJ4mVv9U;eI0kLOHqIhxws2aQsh<`0HCDn{ewQ{l zO|{msaapCDRFcM<6`5~;+G(T^$m=Lrse`7OYzU^9O6h&?BWh19=8tJdD)!5WVzR|O zV-;+WMwf-D+l1Vfy^K9T`snD$V8vv{1DFkI#i3z2kq38z!H}4>7!tCtC11+mQV4h} zhP%0;R?l(V^W02d^fd979%m_lDuy8l(DDPb0Gb%hD8N>Cq)2vu>ZfM({A7_*zpCB7 zR<>#IT@GYz1+Ien!43G?Yl3=e&|l$8XxW{qMX#+wRC%ZTRh60Y!`y}Kw0O`?{uW5} z6goNm!j8Jg9!n{l{(h%M=(4eE4ukXGS5MI8K|V+j;!Nv~D9r*7QOMvLs3h`3c04-2 z62aZYgNq_X%7kBkO>f21LMko!X)Y!PWGj*%7L#pRB?J{PW{~58A40`x{Vvipm_{{+ zwiXGz8nbZ1>g|tl=tLjW8kx{TJ19qX-6e0OFpu(u2zHpO)VAERGG_^=03GI3CgYUa z!J8OZiI`>lv?{)A+fBl>Y87@+CBniPOpRM{aGpW=kh59u{C1GY>61G-FD7 zIx2q*k36Cm`L`DMMy!OKiH6=?{K}SB7;)?e(G;Ig@acKY7-1nPOp6Vb9#)WoL^Xa( zD-ANaKMfh2)&-o5w|-{#o?uw^02lTVrdbT0P;$h7OBk2MRWZOMbd}zxv&gSeS;54L z;>_|t2PwkDyU=$Ma53C|IA9b9dod{ZjnaV??D~7n;-%c+6Hu?emOPt$7 zlGq&*i&0?=-Jsv_)X@Lpt_NsN?#C3~n;Y=uLO+t^?&y#Fcl&hlb6Eei4>rqdy(;~|lH z;n2bRxd9ntK*ksl&b-&QW{Ho+PJKv{CS84*!6g_o$8{HEOqBs{8`VLBf2A>QcIR4u zqTebW@{)cl{4V?^Qqlh1ic0UTHgWlV3YkeibvF*+r z-nq*!_p>oK5hlWvRveVLSR??wYwi7^7zxC2x>9IR{CM@X!-R!d$}WlTuf6ZDy>IH; zd;3LewC_a(ItQ5SEVfxv0sG+X$-Vk!mh!O~eD4j(w_uKD4kMsV6dJ`wa+D8$R$aYP zCtv&E%t~)XDjkbqQ@=>&gn6D*SJd}#E(XrLkke=V59rSTt~S;}h5MV6xBQ`}CyQs# z|D;z(4*Dwi@8A3K1TkG?rP*ERKYibuAk{xe(Z2byb$q(`{J!_>2~xdrG<_zhVLMm9 zaFp_ekK^_cIm8Br4c{gsQi1b-Ye;#ekDm-_Pv{Rc}=?wYEd<;`?l($v-wup_@3^-@?8bf}_WY?vN!gjfW4ANk`)r-%PsOyBn`C(Kayzc}*+`fwX~*$jO=8KDm|A2b~O^sE73WdRy_SkT*m zKco@dk9IJzJL1+`1Hip^> z?rPGobpB_Sx1(k89PBE8X7xk$d5(m~UCh{LT$g?v^m4$DpnW6cQ3&9A@M8AgU2 z3C%}toAsKqyu?*iAyVNMC3y*@k(gWNR+62B3R26fpj{N3jP^{eqFiobX~|Mm+D_uz z3u3rnyn(V-vY=FCC$6X}KXGLR849IULaNJBTvtb)LXpVS)OQkhCZe{hT!o@2TcNbb zS164#R-r-{s#lVKxwvM%+~vsC5x2O{E+Q9qpelB8WlhnG+X&*9C04kSO5kfhM8C^% z(I$1FG_MmB4e5)kH$kMzQ_7MTN-L==%u!~+I$RX<9E!%$7)l!$_&(-TibdCj9LXW-b){)>sw_7jr&*8Iq}|L)bcl!){1_b1b62etdZ|{3Ok1Ul~{N zp%z~MqW*yuh2fwBdfb4=(Hf^L+>C0y)5M3kY5#PeWMtiKx$E@hxv=)mh z8laHWt9BO1!<|iq0~jsmEXik zZoy4|?(~B1zzIS_>)7gUU_)WBbTs*(bVnu>6NExx6X`(3P_|OAxvl?aBcm>?QT&!yRaley4ASl{_c5x4v<&tQ_;F}pWlkHgsg zxZ5i-b0RPFg*kcgZG`ljx7*VSA`j7;J$KTNJ3bAFqSilFqEa?JiH|{uq!_k0c7GZ~ z81MW%(&hLYn94ULiOCZR--McHCd)UlD*roILiPS=>Wre~o{n~Mj*O!~-GfpKd?qNyA+HR+_uk}&CyZgWhU!ch-@lXj)! zH)dT_gX}Bnhr^}Y-3M&|x;YYb?E^lV&cz~9^oGjsJ1`P8@zr&>`OwK$)0^u$(dwF* z-CdBO3m-tMqTTO+i>&B5(PE3wKAKFl z;ZTjq^*&NI26+A;^lm^s4&u~*o;%TU0_iUj)h8OtWmAyv8oG_N0F+I@ic+m}RddE9#8-N&Imro+3Vgds@2g(Luo&-sn*{QFV?7dnx0P++b zls2_JjJFU_x=z+)y27aX+X*Q8L*mD2&0XVNv19-+q#)WYA||%z4hf2Xx#Pl9xry<) z!Og%7XPs;>hWr&f1ol7UWaq5Vc@XU))Ug*#f^IGfC>sEM2X`v*(h$_W+HNmBX5#OX z&CFrmDSKlkiU5W(kZo2F!?2NiMNG5s> zbf?O}GYAdpjYX13+o{oitt}3w$>D8HIEnLu#TGljYOvy(pu(0K-lH@CvTM)=pXIT= zAVE|UCwI0-g4>~EcmR8Ej471fM)#b04RmL>MoEMnJ3GPPbLX?&<-I!&s>!7W16a*3 zVQdOgCbi5o{2ECi^${U>DdYx#$4J9ZMu%P2h-Cp_gdE5tx#jSG&f;6h*|iKhz_|wd z#B>+XiB{Ds>&(XZAUTdsYYb$`P7Ud`FP!7iZHiCU=rzh8^VMr7nAv&_OLnhb0}#q1liyvR)%@^6NE|2xH?8xcbrSL3UbGy@L-LgPEF=>Y~fY z@>dd~YB1=}uyyc%_JMVC|;Wn6bjp67=uCpy)0>{%+=O@oOY#WlGiRfZ7cuxZ*oP04H-rQWlI zxuX>rFd(Dida-xlo4C*jDI~ zE?^u$Lu++64wrK*Dq1C+0^`y2doa4zz4n~(%8Hv96m31U^Ohd);yL5iuI1nhU2I?i z;#tDhuH_RDy4b)3_yO70e&x`!_8S0QIPl%tvmE$;yoU{dpP%$??N|;y?_d+avpqm- zzcsL{ZxL1vdg&-_YwxvOEA+B~X$WT~TYHvIA@4y2{N@T>jBT@BM1w9@QL<~)8G&us<+fORVq(ohBnS~rJuLZyUET)E?K`M5^naqZ)vnhD3X zA$bDR`|@`(OCzGi=~|g)5rmFvUSiIzUH$&$Z!rOO)YJ#-l4F8=^L=R%{z?^ zh3q6vj`~CCbc`N~`U6%(LSV9H&Cnr0-^Wmi@<2QeLZ6EN#F z(4C_G1}HCjV?l`6zjeaBNNO#6k+eRj_abQ>Fel5+W=uUBsVsskDV<#l{ zr3}*g?PaNE2P>dG1EBY^be$0Ilq^MJ6f%0I_RL9V8-iM|f$k*NC`}iM{|Q2W$-2%+ zD0@+=*})13&j9GXC|xJSJ0(i7S-OAtS*z#|xz|{YMQ^NL;?LvES3a*&Eqk@4*})2^ z&j9GX+FB>XJEgYv^0cYwjfIdIrEy{}7iNsMm!_H>tbq0mfZj{fbwa$Crfn^X#Q^GM z6hvv}gdsepL~k2x2zb2)x^wM+qzcq4>wsknlKL3tNuNwtQv){B(*M2F;ArU=u4u49s{HGsIqcNKJ#Uj4OyZ3*KfR;CCr zfo&^|oka{!uP1gI{CgXLGdf;x#tP*(cEM<*$rJ$$C?PKrLbU446NhPRVf zZ!@r(`t#NdZO3rFnOGpD+f4Q6YOFI!(H*Y4le8OxG)!>a$r-1hD6xmupan6Y+mfjg z-FC$_)NNf9v)Zjioub=+SmbM+rXREhGTo2q5u730st?g2i>N7&8UkmKEp$B)ehOg6 zXPe~NSp$GbR4rY^N|R-Tqdrau=}XXNdiz#8^^?E}xAj6jf{xtLb=;3O_Ofj`h~UlH zJ`l~a=&l2@Fut|jnG;RX0QL@eo3>QobWY>DJ{Zl@^{xTN%>2QB9Zh3Ft)eREMi#Q( zTj-?dC3UMlW~ASgKQpA;RO7i{QY26FXtp&NQhd%vy;&L#)T(J z)Z1x3cu$J%EAymiJ?&14=9B8A=sjdkiq`w#q?BTk8tn=JDfMfOv{%Sj$HlJ@+xR%r58^oslT<*WpUSsGOfi%?w1{ zspY~|Hw0OK{@WYXy_%4T?a!&7y++f3wg)Hot^Nz=u7B@KpTBm5*Zmpe%Sx;uAl#Y)t1Y>iRzlBnrB*Ez@(e1E}RSwZTIr5i5O3R zwKT0sTN00XqYr@7R&(M>HIh5DR~5~Q`vDz~S%Xl2Hd$#!%9O2@cwBXR$aEHm9wAb`rJ+OxMobX7 z;nIWHBd&rzB15irZ=*%JN~d>siFnnWRa;NKH8$o}P;E{Lf)A=vwi|pp zj4<;6@$u173zu0!!1lPkE(@O?H`i?SAr*p*^i1EtSp=;@p%4f>Iy^c$J32i+IX-J^ zC&cP{j&nYKcse;7ocIrq2d9r79t|At(PZErpN=1R4_)W%{JfJRT!@7=3Im{8&wX@$ z?wpUDhwka4v(dxx_~B^s@R8?#`6GAaKWc=d!Grx3?a7+$&sK=NYCNcDSaQ)+BkN>e z%SZ3!`{R0i^~8;{k~n+2mRa;j5uW|uKs;XusbjdGY-zVi~E3^*3&Ii zCm^VH-Q4pEoaZu^IA8*QZgB8k1Zcrgo-UB0AFvvOAPN!a{d>^e+=-m2?;#PC4vV~_ zjHK7fNA`No5~&{4zpH4raS{0|0rQ%ilE3n>6SMhTijgN@hb<*+R{pBWclnI!0vc7U z_mB}Nu=(id_VfGCdZ+%I0N`ec|$C2e%HD^D*j>IgFQ?g9UU{)4NLir_lR4D(!;OIdc<*QEW zYx2RzAi^vDRt9Q++ac$k7o>>b?pCCJa!vmh6gBh2UxfJXV-|dpGXZQp>kNaSO3rq^ zl7o?qkY)0*I}N=;n8eHBgjW#~C$lUa^0i6@bqQVt&&eDGDjSUuiNU`GvE`enjjD1{ z+VbI%itP((`r3Dw36hN*&i;L72rvOXKs*WeHxJPI2ibvtfZheIapjG0w}>aDc1$~Q z!DcYZs6eV4K~6~2=B&20S>sDqqqYym8EneZO8JYMQV{8C)s8`gUoG`A5U%5JiJ4t) zVe{BR9xSp*aL{5p#d@8;yf5#B$>9pdQaZR?>etxp4i41SPK-g!X|4t+f9?cf1tR>d z1~BPzv51p@+Ff218tXDnPz$F4T^usn`SUqvA2+VK5#B?@o~TS4iR+J0Z= z$2csGVIa4}j~@zS_qf=pUVCLP^$bkj<2OEOz*zJOd=<@$(k&j7{ww&V1FZIi=Sh%%Xi+TEPXw6|V9ZyAjF;kSuCstE%6LT( zM5%Q<0}_IRmVD*BC0{f)S&M)tk0$p{4z2Rpft-sX-}mt0t}*Kc4Y5c9aJj~m{#oBv zJSp+uGD3C=u9d>^H*xEa=TrKfnfMmIl7A?H^;8vB2klur7OADD&dA$@1WH2pZ!v~{ zWu)oFZdw$g#FsGSgfN`?5wg?5A$dY@Kn59*K?a1h@3rwM7)HP299=gg)0p-(>q?EINsvd%>j7ztk)y8l9x$gxsPhX{vdW$5F>DF2!x|T>uJ5}Tz zn)8dC$YnG8?mNptY)Fp7N1OnjF? ze=lvASZnTRkTsQf7FfI1ZH?G}h8i8$_&9+8?@4(LyKFOA+n*bDnPvBiKnsJavryLi zYx0Ik1Ayg<6*z+qZ8dhstQ93OMqZq)x_DG5oXqMJ{C8E4%E{p9RO(U5Jt>lzu&%Ec zz6+~$QouyfSts?taA#eyVT}W|_YU3zivaB0Cwn0Gr8Z-!bSXjb2tm|;rNJe{)}HWJ z$wgaWE@5$Vsaos(Deo9Xng?b=n>a9qEXFTHEpVHdQk(_6`mjKYu>E7pR5ovV|H;n| z<$G@Y%^`_90e=ZQ8uD8@9334$BJ?uMO$s&$-Z%V5QD{qop$&|2QsO78ITp%g2$dIA z3(oT=VC24KH_d90D^aX}JRU;M^HnRU72-kbRveUI5%1rC!+eAcV)&72S3c(HDJbNHt;923qB(9zY^ zlq&gA)Q5G99;#hAkKxSJ!M-r-{BJp%T|@b12yqEh5)u-UlsS@~;7_i8J71}?D4*PT zKCjnLsdbN8*#sxx-t%8d1EBBf-$?!67Ud83k-}+&Qc?PcF)xxFBz8!{rqVa%IL3B1 zvNbz5MvNNPdD1V21T@&7z|SCd-l?7{y0;TEC}jE*Wt8YhnYZ?z+>F$n?|tyIcoD{` zC+qj|H{eupCOdK1^`cjg07sU_<{(Vjy&+Ed0=QL4toTl9&jz>x;^LHlB%76NMoQ-w zfoSSv5ZIrEN88ugN=7dv-6_$ zchjgRuW7znGe-pNPV-_I=rw6(HM!i#H+&9Dfzz3Qd$e8wW{=_hQl-yFke>XP(eK~t z|Ex&q*8OT0HL=DSAggerF4*;CZcQxi+E8&Cp`a7~_D(@5TgJ9gH)B^fzA~7zLQepj z1CAYmjGpPNp-EVSG>e?HL_7aHLnoeJgQjtW6;Cx@B3G>f$_uv-Hweq$pzE>iBK*#$ zs8OfJ;0Tu%AU0yFOgZahZFh?1n0xpMi|E$wjv>AQ;*%KZCi)wi@+YW|Fj9kS15o#N zdg7(O{cwf>cla9eZd_6dz;x*J)|Exu^xK0l#t%L9UG7$@xh4X*rlrhuHufJzRLcdpWgOiE<3D$ z)g)aK7q!qUsA_<7(M#?`24tv<*C7--4q?}sO_ks5;Wji$b2Cf|>q7`%&S#7K7QR{L z7zUWKVm{HbKyUQIXAh3+aejWl)C+$TzVtG%GH>J1YG@}!SC~%YD+)XA4DUb$o^#kW zK;4{&sE@C7I(D~s*SU*x6S~bi^LWhRbh)#t2JVY6t*MJ)kzF{ z`gw}qjn9e_2yh=U#=jRGuqm$1i_I#iZULw(&O%6rKJJM+E>GEMn$YMHcQ-P%s22Wb zF1gR=)P@N1@{!6g(pw_$2XCl$S1d?*MBbC-w(rFt29Q6`qu$b%LXTd5zt3HZDsb

)lusmA^DZhmZw4yy^0J-%-wgD}kFl8|h~O(3tHi+wRjgkJbZ%U#AVBmz>@f*UM@rFQuqT)5 zvOYl+?CcnG`1f&CS)VvbnNE_8mwa^+n!u`2T>+oWqIh6IQ1!;HvTWbZuA6aXcv)cT z%y`W|ZUHg9D8}@cF?Uw)q^+jK(LX}4qzOmh zyln3#;8wjs5?Gq2n-O{EqPSmUaX?}Q8_B|$dsIcpgAH+H%vwZetVs%vq8v`na?V-& zvDJolu7zLF)xgm+xnS>Hq>5__x2#JlDg=tkSv-@!dZeNQg9KTMU8~L^{Jy!fh zO-sb*?#)6L!DpAY`zyMmXU?sl=?xh`u&|$ij=|2gbNx??waFvO|RS|oh;(2-P8T1NQc3a zMG7vV4&@REsVuR5lTtPr7bP?<0__O(G5^XhFN<57(52|hk~z%_M|gWRshBY8M9CbB znw$Zswj^q%iviax-QF;T(a@uf1=n(N5XxHSF+8rG>T-*lYTw=bCu=qS*YJy?8;(D; z0ut5=hq>2ItY0%nzv*yb5V!h;ePTn3ZbzsiEm#+OZOqPyDESd$+;))~=coNN9_yqX zqadslCpMA4G;gYSE=+c9Rj6PTO}e$K`$iwQ2-DyvCCX;jbT0nQ4q|C_mQH|N!|<`B zV^bwSZdbTj^s67@&CgmnSqe>ya4b$V~lX9an`yYmg!chvDnipW=4M6 zs9o7%n!n@hrg=x_CsJH8u9iM!F1H>?FG~ zPw6}BTEs!$V#OX~tvQ2wq`w=su?1WWr9q0rkJEhgKtnb+iTk*a)G!IwuXc~G>d8Ot zC_In~kC~KE(=2I z3G)Z!U=o|^T?g*ax#VCHI1ULbX@-l$z9RKDx}u*jDil7 z&uyx~E$_{Pz=Bgt^cVSqxuiurWwy-($gBw&ek?>GSA)MGZ;!2R$U|V^YBZ>FSU(U_ zIhLEMud31N73&;3Y{b4KjbC+1!ye&dd=W_oK>CiK5w1-7D)R)hKGNSSd9)(5uZ#%^Y+uRXKh% z|0ul-M?0bYOtQax61=Fl8)^9)e!$<`{`#6bzOSG{ZIL<3S*syLh(#HaNx<2>)b8B|lF{sW#=#x4*KZ=E8=yCBEwcRH2-K~jjO7gSR56vic677`kM z2>mE}+4Zmm-+>_J9j%T|d6`F(^!+f&2#JZJG(L(HWgtW@RDGeDcz| z7R=rnS`Rv4I;@I2Uzd7W?5C=vpt@QgoMw$M<40QICQ(N6a0u6VA(0plhN@ktii)6auN!9 zgYjtO+*v4PFxSuIBPs8UQ`$q;H{AL*ncPvUeCf|2Kqnm{IP9yE9<=Q%(@5Kx4U*GC zKV>->*QZ)g)z;{aITwsn=`gHQ*{i2n6#E^LYG7UQOWBN!%#0{yhHH<~ z9*-;E%7$#VD8koyiZi^8*rs&&$h?HYahjTv{j}3*(Rc~Z8G=74`d>;hQ;#=x^|lf4 z6-QVGA24-k4hH@Sa^$&PLP@A0+Sps2+sKE;S&=HaT#0+d;ffJmXbY{47 z^*r9DxcNTv@{}R&N_r>k5&QK1_vt(1^~__kS0-m(9H!q@bxMf}ZZpyLPR$mu3|w7_ zh;FtYGX>6v`mwXdZx_o1avJwJGBJ#!j(+;p4x&VJIx1D|3uHfOT?v=Pz5TLFWg^h} zO0*gO8G41^lOgl~e)y^c;Lz&(pm`$T`L0;6juK;fs6Lq!nQr3iic)o6k>%-vg-P2; zx*+zoQKIK;Wp5+$8VT+2GfK6sO!(O5$|(^k*7brPrUv0w7@|?!Idsz;rJI~kr^#r33L^R3+&e)p}U@S5Ceuf=T^9+A!C}^p8UCsCu zWkhRAcRF;F;8wr4q+FIgKqE}6AF~sw?)`QET93m1D`u|1lMov$nzn8H)HaQ$k?)kU z=jK3>0lf>C@-!DSO5gAR|VyLt698hj~Q zy)0PBfbJ&j{0W8E*YjF;uqPP&3GD6b>N`KrsX}gbe@njW`)~$!6%ab7qQq9C5*H&C zTFW2l7MGxqJfm!#T>9-rL?wW&+o**8-y8z`FAw>LL-Zfl+Uq?lmNXqh3@yKr1;Cnk zu9et8T~T%DE?z_=V2=>;2(meh@bP0Py(`<#W1~3RtLi{)mbCJ-H1Q|u?JROa$I(DZ!6{px&pUuE>ju6vL$`gWi#0ERzd&$dP8!UDc};^M$Ia8!R%Ki37hwC2 z?LN9Y$&uVTPJ&dOI2|vT>g-u`@U%=T?TBgl7R3zByESP^Y+7nHlE@v8b-Z!x@!sel zx09{&pd#QJj6R2oQf4H0+aA~*#hwY5>aSqy#Rb=ZW2r=>xQ_ikMj9ssY84iT`yOLe0|EQ?`$adq}<)k_|?zYYf=2i!v;i?K=I#6B+%?H ziE#WM5&?K7wygh`iTouIJXlFbZ)xqF7ZM2+{5BNEZ9JD5eJ`Q~5t~FF@t&8^TF*cn zc8Ni%02=AcWqz{8oFlPZoVhi?pA$sAFN4ZvhLz=!w}A_>Fw3Q zx)>Y#+1Bjs@Y6pUvILY@oh(=eeueGCTk~OqhjOr)e?!-5wy&XGO(_4}lv|h<^i13D z++y9sBwX8bQ$NXyQf6tf%O*@bf+EjI-ZnGE7Od1xuI5QdqsKe;oyMg6?Nri+-Whe> zirR;KTw0#HChAaMe5j^4XQaM_*!Sws(l31-U@}yBEbC{9dN?2zOi8_oa5_zudyQQO z58H8cGLqyG*!H?t$*#WvpU43vKbqHX6~$Esf@BTl=puFdXRBT)NL5dteA0&psy-BJj|aS0+bxk^(6GPn>&W&Y!EG2C=5A`>@hwe4?Wv4 z4O0K&e+Qo^33vq7z~MgW!l!~;-uEjVQ`V!!xRWrIgv|JJVv!s_{LZZZO15CxyhmfM z{bie9=~DO=xyilkti?x`6Lt)Q-X z@*!jv8WxRvh%D)5?Z>06f72zXFWxat`{o}`K4}N{y-#HYPA-}1xh;>vohsJnfzvCR*U6?p|V-A^#$!Bm{J~GNO z0s-Iis4braL}<;C9(xcl@A-&8vW%kW6N`nsD1ul)!avvx``CUpL8d4D0WP>b5KQK&ppePhz0@anbzWZJ*qNW#1ktB%w{3wLe=Q z{$PKP$Zbt46qiHu4PSmd-q~`_r<#%so{+8E8Jkrv2@Q6da`v>_13oUm^E2IAqzfwv z4BG%K_i?ds_jJz`zyz{_TaUK12}Bb4?o>LG>CMU;Uz7$}wCy(8vm50tk#1#xD4R(d z^14=064z1&LCA!V*Eq7gWfBfgZ-Y=8r*QrlV-cNv;@=JC96lo%+h>QC_2M%&a`8|F z5r01|YIg#K_Ga&WsO-dR*rw=MM8)0!7h0XGl8xVqe%5V@=uA$+6=t{$?DFL*L0S!VY2ZKpZ;B7QZu`@Yo0M9=r!r? ze7Qy1ghjlgpC8p<-~YMF40;h5typaEuA$?@V9p<7YPVe7`;w;Xi(&7|tYZ7^q$|JI zYk9(5!x4r8^{1WnvYirN99+?*zg@Oy?DHEDh@-V>{|MzTuk6#M=s%5MbyGOnKn|1p*dl!9gI&gB}?%} zx5rtvlvNZ<^Mo2=gYvR|C&cTX8<+80BsANscs1Saxr#DEn-oIqvgm;lrAd=pAAmhr zpEfW?ppTtQ9ufl^9qRY59<%c$P!~l7IgJ;9(WkSN%exG;wBL^DSKwv12BPd|s~vpq zM!4kh3&_}IX9$~O4sv_CzV|V{g3s44#e2n}w;i$`vM%RzEIr9=N%Oc;gKzl)Ft-q2 zcm;s#__dz>Nnac&Nyza9U?}o|#ZdhhfN2Q*3ox*4M;m_uM&Rtjw^p4185O67fy-yAnBMg71Bg1%S7mU_IQ5Eo()@=O@3)p55_P zWA}Oe`FGbmS$ld2+C2VHdR|pd=V_@EZ+-u*s1xrx%ILPsNyn*p{`&j7awgebJy;i4 zX^)eY0ILd_BVRBUu)7~ysw2>JWkIkmFP+Z$NPrn2skcKH4U>%$OG<3bGwtUfaT`Zj zVfxwl^$iU&es)`#%qJfopS@p!Xmm+dD=J|qj3DLysS83k(|v7+9GYgFL|Cs5yd&B> zfm+KBzuq>khEJ23@3DACLk@>56An42*F2rP)I`XJ)VA`DfognO-=1fPqbfIY3tZ~m zPO%>M0KK10T>c^KJywul@i1Io@DtJXm!7DEQvB&Cq{qa=+qXx;3_98e3ytQCKTX5- zqJwZwv54=tah}MKz9DdG$yQ#oxKu=$aJhaWi`DbDh%qB{M6~v6?oOuE2dDBtNCseg zJ=4(=o*A6%I=F`ec@Eqq9cbp@C|iy7yBXM6o+}Q}>9@TijY%AKS+f-s>Bv z*x;X{7K%y@DzXO(xIB(@r-_D}2H*yeV{?S=W`4oTAz!`L!orrJH*A5YOQeq9PUBd` zsnkz_{u#&-u^EeEYIz++j8_v$__6Nbdw*E)Cu#p~C}20Z10(iD$)Xy5X(uQ@rv3tZ zu{>4KB?7g-LyrqEE#RPrk>tV&rDo=iwb2c`%abUXZ0l|7xk#s`lly zul#$l4saHkn1&Xcy}G*-gRM&BCpH2ECk;(%ZSHPAST|nGlP%hzy35NvkFT?Si4D>( zK13_F#WB&fl+|gs;JD~IoU_hTsgmtjOmhE52vn74VB9nQsazAWmP%w}CEguXH8SUu z_}5MvEC+P$U5noA1TCDt-1^R}kQ{`LG7@N%y|=yZ3`?CEvqBlYtRJwx`uHoz^=D2F z%gOM;t&cm+N+_eNpq>iz+XZo5hYE^&_M@qvd6SJe#ojjc-0xMHwV8rT30q&j^mbva z==EmGBT3|NdwJrREAqkqmLu@m?zy}NFul8PP23Oor)roQ+b!q5{0y_QyV(el*n0(B zG?NxPNs3=Ui}()2C`JO(CR7#tDrBrhn3nmoW+rEZSBv&D-Loh4QucAQRjet|R{~cy zq#S${C3fqiECep9QWY0x3*_gNVlbFMtm<|RrAk?EncU5VN)s*$)W(?xqP?>(HSiA-Z`U2PuI$_VoR03=Z{-iEIw=wEyvZW!7{Mr*7Vc?sO!%cw z8+IS@5S?L#H~3AdkR6BwTx!Qgk-rk^\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\r\n1. **CrowdStrike Falcon Endpoint Protection via AMA** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **CrowdStrike Falcon Endpoint Protection via Legacy Agent** - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 5, **Parsers:** 3, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CrowdStrike%20Falcon%20Endpoint%20Protection/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [CrowdStrike Falcon Endpoint Protection](https://www.crowdstrike.com/products/) solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 5, **Parsers:** 3, **Workbooks:** 1, **Analytic Rules:** 2, **Playbooks:** 3\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json index 30f4126caaa..6dbaba8a153 100644 --- a/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json +++ b/Solutions/CrowdStrike Falcon Endpoint Protection/Package/mainTemplate.json @@ -5635,7 +5635,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "CrowdStrike Falcon Endpoint Protection", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n
    \n

  1. CrowdStrike Falcon Endpoint Protection via AMA - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. CrowdStrike Falcon Endpoint Protection via Legacy Agent - This data connector helps in ingesting CrowdStrike Falcon Endpoint Protection logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 5, Parsers: 3, Workbooks: 1, Analytic Rules: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The CrowdStrike Falcon Endpoint Protection solution allows you to easily connect your CrowdStrike Falcon Event Stream with Microsoft Sentinel, to create custom dashboards, alerts, and improve investigation. This gives you more insight into your organization's endpoints and improves your security operation capabilities.

\n\n\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 5, Parsers: 3, Workbooks: 1, Analytic Rules: 2, Playbooks: 3

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From 31f771c3115b20ef1d9654f21829e5434962a80d Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 11 Jul 2024 12:54:26 +0530 Subject: [PATCH 09/11] Fireeye sec updated --- .../Solution_FireEye Network Security.json | 2 +- .../Package/3.0.1.zip | Bin 9463 -> 9210 bytes .../Package/createUiDefinition.json | 9 +-------- .../Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 10 deletions(-) diff --git a/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json b/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json index 19d4bc54850..34c5dd62212 100644 --- a/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json +++ b/Solutions/FireEye Network Security/Data/Solution_FireEye Network Security.json @@ -2,7 +2,7 @@ "Name": "FireEye Network Security", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\r\n1. **FireEye Network Security via AMA** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **FireEye Network Security via Legacy Agent** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", + "Description": "The [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", "Data Connectors": [ "Data Connectors/Connector_FireEyeNX_CEF.json", "Data Connectors/template_FireEyeNX_CEFAMA.json" diff --git a/Solutions/FireEye Network Security/Package/3.0.1.zip b/Solutions/FireEye Network Security/Package/3.0.1.zip index 9c0ee9c666590bf9d4d4f93cecffaf97df33a856..6c10edbca505a04716cc59cd6f517507f8a77244 100644 GIT binary patch literal 9210 zcmZ{KV{|1zvu!5!Ol+UnwrxyoJ1003+csu`6Wg|Jb7ChGo0Hu6p4R(uZ`WE~Rb8v= zXYXFMw~9OzG$sTD1U!U|<(YOnUo`pyECj?m1_T7ozf&_83zHuf8a5IZmNr0}A2yCa zCR>mruuJ<4NXUu#5kJUJh?3i7?Z$;bsv;3BmYgOht4Em!V?l8MzPZfs7!JNzyJ(i! z)A8WQ4gsCFT^6NOU{adBJ?r;?oVWa*zldDdMdAop^sz!C*?~X;#BX343%ty`6e})M zN5rWD?V`hUJQ9iUxjC8@AKGWzcNvi7i@UP&i-LJSVyYxgXycv*{$F$TN7Zk9I!I}h zNp?xDWTsUy8EYqlH$Z2a$e;QI<`RQMCWp?`9P(|F`oB95+=3qybL3#sjk3*oMJR zVuRh{(N@BO29>d!wha3H8NbSD@`fyBNbSf$CY4^CoZ}kjwjI;%+K1O&K&JV?F1y9c zjT1aGz$z^Gh`qXxt`-TEow7(b(jN7@(D#hs(HIN0c~md~B@){SZp6w}&j;+!>142Y zYuiCKcO+ZO-*H37Ge4-Rqt5!Ij4DIjNTKEKRd+RX$$QZIg1UennwK6`s|{)@aI8eyHMM z?u`IC6Aa|c5QQagCZg=QD(7M_0g^Xof-Nusp7tyx2;XoEf}<-fWE)||GmR8sCj(kY z%_b_xO8&QZ<&SZDP~eWiOQQ7*@qii&Pa98OLClCIFU~N$s6G$*JZ-)T-)+W{oQ$jq zqu?ZlF)T~8YGQi4N$c6z4 z=qr=LeVlcQtfqmq7PpAqYS2~nO(?*~I8z>Md)2L9BAve{`mLD`Oj~@Rwn7)=5rM3p zXZF!AzJRrs$pzCW{|r*#KK22rKE*gQwlTVHOH$=nhW*LL!{}98J z-MTxU)&8P$ePS|Y7$tX0VQ0vuvc}lrihgUJD2!TDayOwcMSwKD3-HR8VOcNz=|hhW zX*dK3!3yVXA!V3sl&jeI@*_`Q&t6fbBfntNccj#qHs+U{;X{jHxz-ooe2qlM)0xu1 ztkkl=5=|TjsU@oyRaPLMHA<`-{Zy@R@}~9v%UH$llx9sg@ZBYc$^akV+^H-R%Rr@O zy|+BAC*x>TZ)!_=0tcK*J=cz?yD1syH145~_o@E=3lDX`u6n)4{BEoT8JfmZPkKk0 z#1rMrk=xuAPn~eYXuqfjODjry^#`7J!X`{oXg)8%!^Le=l1ho)Z5NR56C&LM&Z3b4 znAD`ATxE(FHR#8T^ZxmwSra_h_p=~)fS9h6zP(AVBfr&a2IAEX9c-JLV=8{BBF}Z0 zH0oYJ_OrD?h3$r7FE#or%PNHz6byo#g0-WeA0340t2I8#Y!LD_8bGC zeN8<7JRdCjy;4SbIZ|&OC+~Qm-;0s5xzmSi0pO_v7tEhdeZT5#19wttV;f}Z4JdvS z+sUbAmO}q_&=7Poo&0R{P|@XA)PgPQd5Ryzbg-=eulkw&)_%QQ%?i)Nl<`3JWLcR;?k2|L$5agBC7@gqxmh z%Ijh;UTM`e-M(jI30{sECfZj>c0tRU{5JGP3?O@k(-Zx!m7$Q}fk7j&&Q&^oU*m%{0t{mK}F*ab&9p z+sU30s_{+-0&nVBty8o;o#5%Od1sSB7}OhG3+AA<%~U2CKN`D_@LWM4q45TGq-%o$ z=;YC7jg7;IT9?5Yc_t}QgW?^EXL64;K0K@ea|o|;4R_^FT?o4)6$`Aj9(;6=eec)A zp?*PAiDrr9p^XYj(th&v0!K7-R{Y#hmm$BAyAvZgguS=Rlb$d*gf-V$rUvxcM?rRk(MA@(#_JSR;!YZ`+-_eHw`UaL~2JFdNl* z!nI=wz-xlN+kxHQ8Gih0n|5RJU+&vj2yd z{|h5849;9OT2nuA$~&Rt))eK-FVosBlfHY1+zYcgNePJo#k-swo~cyqhVMgUb6CylJ;G5WBugP0vd#OB z>51UA2W$X3{>Eij9tINt0gYVYR}ujycMP(~C5;>mB3hiXE4HEZ;)qd~9~0-g;6qnS z!(FxKc_`UR%p{{jRoHuhZT#S@YBdUT5&~~bmvwrmP;grzEoECXIEXHkHP*=sZwmWv zTm`wP?Qwp#Bc`;B-5Agx@zknm$NZzMC1czzzUTa+b0WGd-4kYWWM0XjdXeRP`inL= zktq+65bilvkB3T{@qAO{FRzLuoYpLZ!Ths$6OrgJq2$L9;W)W~++Kx~3t>!5VCSp1 zQk{A~z{ZEoCLf|V9QS}#Ha?`wb)kmVq4|*J$X+Wkmn0WZ{~oKJzi-Sx<^R~2fMPUb zGwwPR9hWz3o>3=Qg;%*kU2J&zHCNl$R7LfBjVz{DsCkTN8|+Ne(sUlx^5TsI@8AOO zgX$0I;=j%@)!XY8c=|Ql>fYa;gAM)B!iAYjS#Z`baBKJRL)FQ)UQ{pJ=(CctKLCnB zp*50nkKA`#3u4j=4=2J~BiT={UAc}GVPMXIWIhnp_>bfZUjmH^=oX_aN zE{cRWi|60OXrrm(H!}o)%Lf@$wsaiy4IMU;do87t`??m@R*FQ*D|)F{Z&1)MkR$a?Xc!yOT6BWnNJWLan(X!6VT| zU%4*KWmC=!m?(`EjJd>_y}TnEol<#0qO9xbhe@4z1Gjbx12H5CR%kZa2@g%_16}9| zm!6>225XBtE&7%6L9KE0b*(W1+HD>#yn-_X&rtwWuqo3(mCcD!60bOyR z=If`N?HgL&`}e1so)~rSArZ*suk-vpUu_%E8n}(=zVX2{?p}y&cA7@@0xo7y($eJ8EUPgyyck)D zc?arR`G4pBOEW{7O z9cDpp>+%x2AYpSe%YVz8#sAwC2wU+J2Sej+N``(>OKC8qE=a8za7IUg&K zKL#vw7tOHTd{_?QZHw5Ptz?fRgUm<=F){ic-8?rVf>vQeODl^x*zow@QChL-Q%*Q?{`DbV<hv$^fvU$1>AME^z6dv?lje2Kjtl^%!!1!Xi|%ibj35_-5Tj| zXCrJgE|WAxk4dr)Rv2-;?Gf4We3XB-B%yt0BQ-^r81v2@cc*4;oO8gI4DS>yGS%Xf zd54j5%#P|H|5L=8PN}ldp@5w(3Q2oRhO=ls&>wd|Y~&jCNfZ!|NOrwG@IZMFD`Z+L z*cuor=`!$VBT@M!P;v~eg{4Sn30&z-2ZSwUC z*><3qH{P1i>thFzOS^e(1b}@U*K&==VD_1S871LQ%<4+o@r~zuOs8D^?8tH;VT<%A zBPx0yQ!$}Izp>bEyu6%9%Ish$D>MBp1<&>rK1$S=M2%p%o$ocfe7h|8amF-Rf-Gf1 zt7cA1*#|q5cO@*td~a&tG%DL5Y3#_ONzs%<>g7*kQelQby)~35yc~g4!O=Nh9$9Q% zJh@8S*(XzTFY-tLt7U^_$nc6u#^4F(>%q5JK{vj@;=D7}diY=RE!WQ8Yp9(h7?guN z#tCAS6|0G>35Thc{e|GWlOiYU(sBXE!WXryqH@jC7pPBV&Zt>#D)Tlvfu(T&(khAUv$C8*5Tm1_TmHc zbj4)tuNo+l+6;sPSdGaWJ4W!tA!Gt%AXO{UyY>3Sn}m066>uQ`w?fg48t0<#@Mg_x zqt1%OB`W&>6qAS65S9|D zwna0e7OWgb?LJjh0`G>13lQyXcw5W$(Vex9MjN$5ST4@29?#H$r5HP#hoX;{D_Lgl zsZ%##{HkPY$_bLeKtIUlJO8P`_yLvl`;`doz!oxgKgTA$y=Q~q$&q1OsPIRkyNH}k z(O;uS;Ups|5`uJntC7Ki24v|mpGcbvoUGl4rK~zKp|~P`p=mFmDhoO7D&H26*?iW;3yhDf>Bb1)E;&61cQTSpUe&ab^QB^wvI)ss*E^uSZ+{w z;Lbp&G4`;rrwPCqPcY~B4jQdiPFnS(hq|Mqgab-7qjuBa=9Kg^M08w(=28B@{ejjZ z%c6XqqLicP8pgY^gFc@!1u6p8_hXmsg)~ZttLl;&-y=Mg`+90JB~z1S{=;9pz(&mGxl-FCTF z2h}0_{7hf7eilcL7zS`6K*c1r=CEJ{XF1e<#K~XlBU`^9hiGMylLTpFO&sW4E|v3Y zwhfK@t~tZTA)J#=XKPc$KOsb{l0)Gj9e;8+d4D>JqX(-y7#|y9q+7Vcs~1)$`iJPjqzY z<(%f0Plf@uDJ26s*gy4b3;zU7bct~5Pb_&ot* zPvH2RT+9cYHFEIF^4;uR=a}AY)9@{8J$2;r0%*y*q_qbLDr1^mRzJZ-Ei7>%oJ5gX>+bYAMDbC zcEtzVLwk$V*i_c~_GF%Qs7Hd9k zfT#Xmy1V4mwy9d9Mmam&I8|G~;un9&p|8@Yy3tt|+dVd%;g8St`v89x2DSUWTk5wu z9^8B_;-s%tMHN?2rN&J`fnh;RhHD`$&tXO2d|j)r-dJjE82Pnt^3*C~6oH9dP=DED zG%4_yXS|4hpibny9qq&xU1Mp!O|`1w3f`W+;^7v#j>`88MyuAf?bv*u78fc|@ zTa-&dvfU<@^e5OiSkw(Z8b2zBWxV3D=>8LgMC1>5@`zpf2p4SW*z2T)0ZVV(yl&FO zZ`>G7=5DhmK;7QT_X}%o@Cijyf8^`-Xu@)C=w^DJinUAtd}~18*TN_*zP>qX{1+(C5fG}p+e>y2%GGcoqhpd4@sjPNbFGy@T>pK9}wz@~Iw(&Cn<$L2aqONUF7Hv@G zZQ|=3!mFypZyF`8H?Za3ij1u{cfd-$;M6+urLs;G?B<4rEn`Dr;UiZA?Um`|p1wvQ z4h1`;73;6nzgq`2FKb~mmku{|y_&IV%ZyN|mM*7tJL;7#%dnOk8&uo3f6Z5G&$s^o zj${@SFKS4?^kzOqIM#js@y|X(9T^f_Pv!RJULoRhHmM zio5uAf+~XYpMUNE%<62T){=$dj*x-7b}F5LqlU=n?u0npkflHb)2oUTnOE=Ev4?fu zYl5!B+WL7(jzA)AcTIc&g`A?`sIHziUH>xBZ!(2eidU*bUF* zo%tkUX@S+mW%`>&7-`PNo;@q;W9uxvh_FSj8~!bA4s}Q^w%00uoI$pdJ}K2#gR+~- zyYK2Aj1NE3rP(u`NF04TTiDwnN9|EY*&ejfZ=Qdozf1`xSBV||W-RFF10Eh|^*Wu7 zU+i$Sd%$VORxdmWsfoAVWhDa5pXH2yg`fkYCS2mPnN`=rRiJ<61wK= zMe=dt(@Mh+$qIaXP9ZU@7mAvkU-d^bLj7*!koVoB%{u1HDy2c7Z9~VUwYPR}A~1n` z?YF=A7Nxh>^AROnW)^^(Ll8Vq^XFLDAM;kz7Ycky(#4~>eV23HcOjtFfVSjo2{$QE z1;g|8P^iUALw}Bq72)TiacAm^KDcU9vtmh5_Q%db#TN-0e+bSo6O?(D3>XeF- z0F9fPz?|jlF|skDcW-t%HNmPC4I?_+c_M0VN9XdAt@@_5+r?1DNm%0KxHK0~QoO_f zZPc62P+KYcRA=nte4;SQ-(l)2el^N)aj2jK$K{nWV2krLm%N(S4dOD2GAyBgVarL8 z#Zi64yTm%fHOt0h9n!`)lwZ$n^#DTgLlrIOK>AnMU@OVz7>|d}QjDL8I4W$IENJ8( zCS1e@_xL(<^k+D_oE%JmNuE9^7!@=R=x$5MaPenEq!!j3lCH5L0LyOuIR8L-AI{kD zK@@w1avbI@dog!bKNm@oe)TTTHUoM40Jkvv(Ahrnx>DK9XOY8;qXNA)F1ed!G#(zx zi2wXLY*a49}PV_-g zq9tEEk@B4qCtX@R9|9VYixi3h<%<+=qdd20kBWu`{jho;OU8ZQg~`%_L2M76n;1Ih zWAC4N?%6tJBqF|KRe`okBk3liB+~di z{`l65%QYmX+1Jc4H~wF$r|n=*&Xed%E>5J*VD|qGZ=V`w{yN3x5qPMKSzzw64&&T{ zG{2?XI_2>@ap&W^mM?s(l4nv^y1S5XHxJkQl~v_%`Geu7oo{rqS0#9D~dH zh0C3<+L}XX2^>e+xy@MPQW=wfrV)n)X~39Q?uBE0&%8?~-I3!?v2-TuQ0=16+S=OX zYmH3BR}rV<4oclWq8nK{|4y&ErGMD^Q9(#Q`WHLmFI@0qPYpNEma>R-xOmcN@{D`( z!C&+35;2*Tsc6T8Ug440v?n)9p|A5V25;%>8+mPQ;&)6=tMt1ydSdDwBHuHemt&v* zQ0cpJf;7k)su4Ce^45r%H?gRFar)iY`8g&mOJJ|;G3rpd+c>-1z|%s6gdiPsyLUZy z^d{D*f1~&V>|C4Cfwzl;=H^YL8(0t(_<>{yLD>^DYYTd226h zg^XtNrjJ1X8Wx8EI**rQJO@8=utcNP9P<;pbsH|?$)W$HI^e3R?||>7)s81>4XZ}a zrami?k#nI{q6ew298Li^vt%Dw7X=XtTcCipApOAWKLx7p%4UR2Kn zj%gg%ibZ_HR@SWr@&cB`Cn8(p;Y}9`^2;g2ot=K=d zRMfM>Z$KvgsJ;AMRqmQ0LJ^Xa?HM7p_PdE{O`c^TAE0NqGw+iWQ6&|PhUMZ|-wchv$LZK45uvaI$t zl45VntuunWRyd8E-*<8%%W6q^KlL{ucMGpui)XD`Cft+*v2mttb~g-HNh##aS!S@y z$V}qn%ks;zlCV7KWbm~Oe@#zAFa~`IO5cW$GO@qCp2rl_TDOB&^eocf)$us6`Y=%` zAx{}$W4_BcuL(io`+Q)OgT$>o99=Wo7&B3+fQy>vV&J$Lb?OLFsn22Itp+{a&RUs6 z*z?;mrhUV}HqzY413fI#&#ePfG|(81SFf=A3$*aVz?yv5WVxmg7V&-uD9h zPg^?1%>tn45e;E#9F$JNrz@ssOyGQnT#i~qRBxd$OlGy;I-;=EnrxD#SW)g5g<4Qg zgd-6aw8s#GkB=#%*Tq@>s`I-n9tcy?37yRdTWZ^eo;ENx9F#aSoLwxN7NF`=?zdVF zF79Sk3Vd=#QQZfb^NyToKhEDxWO;acsIx2l8rY!X&*0J_`>j>WC=IiOq`G<@(EO|q z_~!Y1uTtz26L0l>1FsL3VW;knky**ouyOHn=tMH7({kiS!?fyW?Kh#dimv;70tGy` zsweS-Auv7Bh!6wv{<)*gVl^<*VK;^ttWi+{;9y01eE>88i{Pf-mJ%-ieHLx$YFQfn@sIcfwXn7wL~IJ|1DtSFg32rR*_oy z$5)U}c(`(@M1YQ2GxxFq6nEe2%u>!zcQxvAdc}zTZC31o#|6)8*-}=R`|EU7k}7>M z<;F`>x1sz5XZx9Y`xW1l8rC0QCYiJfy^P7oZbY~+v41UmAN0-v z8ShynNfWapQ2a{K&Cj5W)1Aw2 zDJDkN6hyrl+>v~VJzNESTHW9b9DE<=nl8HwBUZ25bj{x&Qw7e9FUk4&Y3ZK=<7}&| zmGNOF?mhjdEcJW4vxVO>ENsw~vu}b&jjqOeMr9=g!{8ultmO{o=H44uD7*UinQsGJ zXub~9IzY4CSsk-}`|SCAF^Z6K{y>BoT_Fy9=v`U>F{bTpq`lQ@rm2-H*_WjodnZMI z3T^%L2{DRF_I9KpfkKTzvFdwSW`7C0)-t;CoIxZK+{cp@=<$$c6l4HvshXKw?H^E~ z;_0ctDqi&r%p7`fx_D}XC>ul+6^Azz?EGR2~WB+ zi|=tj$Q1G4(PAI|vW2kl?{l%y1;QT0Leq=9!1X$RgD*>}tQ|jG1cX=23HP;*<-&Ph zI$Nn+F{D&)y3ykE=x44Ed^OLDY5F;ta_FnHJqK*)e5EN3pIlpiB?PPH1gQF|Uu1V?iOjKi@m*qQ$PA($ji@S(7SX=T zM62N>@a=D8o!DzIw4VR{quC89TNNm}w?1meo@m!T<+cJ`(|tmBK$B@Rj^=OC(|QP1 ze&NefgqQaXW~=~v_$Df#Q*|3yhnlY>-!UelBic8Z#PJf)8`qYKPqwHzm0fMqC^I27^ca4m%LC6FjhrsYAv zj9p)MPQteyg?S5}{dMG$cKB47<%ZSNK~4RYYCf6{ggr^b0Xh$6=RHtvyfD2u`?Y6) zIBPeWd-`HFqI)S;NH7CG+C=#Ao=Uj_p|1uXe%aM$#ldvzMaZvt>+KMJy88e{=U`~% zL0!@oJw84{nq+<4Y+m9Ac9PZhdi5!|NY8!KM!j$HlQ`)-XRmMDeg2>SSi>)nm=OQ7 z!sZ`!2=N7i^gr(3`XBT*|9_MJj(q&j)&Jdu4(`99B30yJ{%Lw3ARzx)$UkpP@t^F! E0F~X$djJ3c literal 9463 zcmZ{Kbx<9!yCqT_3dJ3YySvlk?(XjHu0=2I4i_oz?(P(ai#xZtyKH~^-t6qm?n`F! z<;$FWlYf#klXH}0p}$~4KtRAl~Dx|kcgnX6linOj&p zSi4y}IxyL|Iy#(dojPo^VSN}DT#Ec=6fm8#vh$3=mS_ym=2?e1vqS6bWE7C-PyCIy zobo$qQ7)${SV)$nT5(B9WVR_X*w5g-+;~=Kcn5`Qqy$Y zsLd1QYH(FDCcbO(QOHK7;AXH50!jPf=gZ5IFRR#DFavfJ-X2ah$&$m}RB*1{OLE@0 z;y+2-k2DAh;q(A%*NI3(79nY?=f4ZU_Pq$MBW~f{j0H5 z)G#1YM2?#1*hRT}c?TQOfMx@0DLM{HHLxML_?X=o_UO)$v?Et-4GGHstn!OrNllnc zwcYN`!MWXgdIEUty**`gtB2_J$Bu;=E3mhsGc3sb1u&%9eP^@(k{s@?N6S~}Td6J% zo6Ej;zasn@-hG=#sMpZxNp?l0{1C9XN?<2wSHS**Lt|@k>g=qUWA8@!?cnSH;6z|g zeC0--G$HlKQ%UJ9>YNuR%_!lsS@UJ_&oeoLu_tQy7N(qz?*08PYEWq|NGAZ;d%qa$ zH6>$A2!}ZieL!KY4O|aP?G&2w)W=EIP>S4KYN=a8UtaB(a17wSz+AWEa)wp8##Jfd z;HyTrv=o1GusOZlOPyS5yA^<6LGQc0mhu|MQTgWk8&)vP{j301hM6%^1Vn{ty9)z7 z)x`qrtRW_v zkM)OB(Y+C?o8anW2ojB_@~BqkBE2w?9v`at!VNP?OX^ohzmog`ss#}R|3-=-GjQHo zCO`z#S~7-NG`BB^nW^U8vU*qDmVJBrV$RZB?ez2)>-n$we%b#1+PY=_{X?qO%>gU; zW!t$E5g!?${n4*a;Lf^Vx+4mGIobAF0oh=H#H&kh0c30Ma?yeMn~bYmvMIfmAmRQj zv;m<4+aN@O<$LMb;{jtOKrNb1G&hCJe1i=$fF>!N#?1y6{lZsKpRKpOyEv(xJIUW? zZ&|YuV5216mHr*7`sGR^MotR~WtWUa5>6HbRbQQUR#t}L;o(U_ag-Mlf*LO3#JzRCb(Qr1BLe&f(K-`;18(d?| zW=znZ230a!KLzd@Cm31BbkJv=y|6Y?Yf95#O0gO#gs$L*e4hYUY|P~^bUAC6!8qiW zzr<#Zz7!g7py)Ajyd-M|JI9^<0%+pcgYb=J1=CD;1X}9inB@YLWy~_zbx?Zebv9)h z$Zkp)lcPr@WEQ^)I8jGuD7w>i9&C6vqh@$QHHJ*2O2Kt0qpN_BV?1Srhq4mUhv%y$ zpsC|VShacba$+xmg_WOSiNoj6<1!1Y`2OzR{9;tU3|nu|zmr_y-X~*(nDOzRm=C&Q zfHk{P7JSYEg4f*H1fPfR4({L)FJl}k=X+=z^6>g*W%e{B(ra0IQGR0?!iyig&MDF5 zR5i&AN;vQD5AyJn`XIs3Qj~HSzEA;aE;^J1rS8y-KNY03EN3BeH>1iG2@?Y*v3^`Y zXWY7ALhvH~W#z-C>YL*+z<3T@ax;C{n=Bn)OI*<0u{z-w3lK1#1{u5oL|Kv)4)PSG z&n?w}VDP@clOJ*JA0QBcob7WdjA$A-E^w1|*6Ys)b^6MfgWkg0QryW|bXi|RaUW$< zu*tmyjU@35+7nf8wq1CgYg&qi6GIwSb*9fFkt%``IXi?tG%?xQ*aQb6B*

Us5I*2A2Wu34})P-=gl5Z9M<} z`Jvj-#9Ja!Q*VUzckwUnhpCo&UD575V&2ajaY+fiY(s^*xhHv&7Wvf*GJ-487_pao zHEdg*v~*EMsBbz(2-{HT2*@lduNpnatx18rQbCsyje*<(Qe!DQCdlnDS zSoruyTqYubEqQx&%Pa8ixc>v#|6#>ka7&|Y($3D8EomST@o6Oe7Evwa*r&LM-19D? zicQ7Z!j6Bj|9S9;H{I1YnGkAt1=Dqd4dRfl2T#r_Vx;Mrn~AKN2r15=30s~Ju~9@` zSy+rg4eFFhH;omrCQ1JqQ%_2|97qZ1EIz=Rc1XGts+ZhE8Ji!2{L6|*pH!G0cH`vM#p*W0Q-L16d<7D@L z4d=~Rx3};rG`2FE=o%86GV*`9jxQ`%QjjA_gbKCmnf<%>1(4(DY>&9)27Cl&AYU|? z$uUJ{GxE>{>xRe>NHrqApKyWq^L>g1Yl=UA1Qb)mYD;uOlqcEAj4RTxa6S6*DcOC9 zIg}O(Q+_9hlpnOUx}lS|=z5CzSwwF~+anxJLb4R3F5QyssGX2Ie2>k6j=yoyU5HUb zf$)t^E@Pg6lPeZk>uv9yL@!7uV_Cxt`vvoNTp0{tV|$hcYOGmxMtpcz@9=`kaHd+agRGRtC0F z7W1Li-JD>i=P3cgYU|(3rVI`Yr)n4mfD}E5)T8}l;IYcyV@z2}xug;5WGXrczerJ% zzgcnGeqOol$a=x!E3vZT+^q{NzoYD=AE-YFI4JyDYI_dJ0pwi6w7`Y7Yd?s8R(gI?}wE^7smVw)c3T=lhm{{ISn_ z=~`$X$=yo~&zrYsc;~7Ebr6vzb1{PRk)-!Qjg*YUOEL!nc8><_xZ_cG8H|M7Em(L< za>n=FVCV4(m5k4cj*rxur}DPqkG#Q`R1G4W^Y&kw?mZL*8|b4j?EGQnDZ@#l4zk4D zx-RkWnXBsN|+C$*Al=gDYS!WJbRZ!v`RkyQ__hwlaDltH`t;e5)8m!nCW4X~L zTNGfVcaK`=N3g81j7zcr;l;TjRHF^kCP?edSl-9#RT^nuYAX3+S64mQ9O^7R$!MFr z(wURr6TDI#gMGxI-@WNy^z?0;m;1c4^djocOnp`KWB?hg*joY|RNMRS*TGV_eOC*o z30t`0ro7djFNe`t*zO=LQHSp4lTA{?^h_+{UCI5R?l{-_tH*rdD_X(3x5urpH1hm% zlo7t$Tw?@ls95vDcDiJJCI%FJdfJd1>K=Ru7YvI9fqWN6*fh*EwHyJ4O%qO?;k5Bh z>TI{40hE6a)T;eL9&5ykGmu}j-n6vt(t5OGOr z@wawL(tA*o2$-H4X(=6Ty}etj8J>=gENC#uH*Ai{+#0&I7719i9eJiL<`h8nQcFex zu3%r+OSag$M27EZT&%W#56ESxkP$`4ZH{cf;5wWyg|iFXcgHYF5{5SbxQ*hX{ft=# z7n;y7kb%eFSO-bdiGjghx9=g4aNCR~c_?B%yy?W`chF(67WQ&t{1AI$oN4tyCfsIo=TMa=8ud zB=5uoTpHG4vAS-31MZ@N7Exmj4ORT`*jT2@g*HatlK7UD%QF`v;xA}ENTMlZf3?}D zf&OT{PVW~E?{=5--f{t{QL72V2qSBD?fzLWqql>kQl2~f0=?)h8Pk2BH;gJu?IF;^ z*LFR0{aDrUFZ5S=IPF@YO-^Bd`p#=9XtDO=l0XbmsqZF;KDv`eWeWBJX}i%^fJK%F z6?la5(Ue7P9^e6OrZ-8;H8m;<*vWH3o$h9IkKZ;S-;H{g)9nr32UX{|nnD)KH$D>? zC`0IQtv^WwBdOaZrz_nPR2USjN(Z3eNR5=JoLSf(jnpee6+vw zVL)mGS5r>%IKdkPHEMZ)cB(O^aPS63Xulzous;-9%M5BCWiaD8beR(NqU8h#Bqo=2 zd~-XA$vFG{Qf+DHU{BZZDPYEeWSH0QgD_s!W(yuhD^MDaQcmzP(kzE>4<_fJy-6~Z z))mL^j#Agnd>-%m={!6qo&7D*-D|r*Ese^BSkfiFmTx!^4h{Gt&DDJk0Sv2k>9o-? z|Lh`(*~Y^0vUd`xN>)!5{7hNG>f|d=t|ToM*+&NOdpti?ty8KKmKeX!k9hSQCgq{f zau5?3dh!FHJkYUF8+Sd4v=#1&JWGdNAvc7<%M3LoUtNFS4i@#r0|~u6bP~CAnAJs6 zuutGxfOz!lo(Pyx5>8@QSJIBJz29QHWEy5imxBo(C21JHqKjgy#xWVQ6kLr`QWnU7 z_XaZ3vB2L5FD+tV2ZJ)zL#20A9e4S5S@7cu==B6xehWRB!Y}2e>`dL3&5rVYst~17 z+5C{e1{@8DrX*4?f9{Y9Gl=SdP%7|91X2aZ=6HFeuyycks%&N-O)!1Pq9|A`8ZE*` zR*bWTa5-NN&~gRYazz&Ud{P*ojv5&KHk4aJ&ql>)Sv_!@l>XAOp%Zj;%}Zr8x#D$W zLZZm09s`>6qJe77bbqi-h370r2sVD8ShB_)M=m$)VNoopm4`4rk zT#>r%B4oz!L1%8K0b(N#dV^1p2ZBjaP67b*xdR*)*^D7(Wg7spRX=@$$x1Vd8B`82{IXHshaAY)Yq;@|G}=>p@{%=YY#ot zV?GZG=y=_FH&tbABy;J{B7qqROen;ktZ>7d9o z4kt@1W-`>StC3iK!B0HYMC+Z@vYPsa2`6CEF9YOcL?M(g+#{Gq7T7;Xf{=f}&jR_> zkwKb#(LX)~L7Rdlc)#bv&M%@B;hw2;iuJ-xdc^`X^HoN~OX&ndWK##VQ-?B-I#Z^G=g&wuw`BsK3$j$PqPy5{?8?FOTi} zL(#R2kq(8}gqxfcWcdB?4!3wr@%I?onMTNlk2H19m+in^K_sp z=CL(mzvpxA)@?6Uo6q5aaF{#b^*w9_$02%zk=z+D!40#MwUb>k4%MnxCY`jY{l>_t zg3@o!#Dcsc(=7Dn@wK}ZF&~XKK*=cw z^U^0(@=64u+cA;VN8jM_?LG>Zd*f-{f`xWsqfHZGZ;L*J4~2@LpSX_`fVF(tNZuO_ zpQ({x3D*>1MXGl17M-1xoA6@^^VgWp%?nonz4Xt>b*u*tcDnB;B78LGc6^L#6{RB` zWDR>!#4*O}9Yv_@Yn?@2i-@~M6Fy2OKk`#-#$yElOL+tt3Z+Vem5DB$K!Xw)BY<_b zgQW2r@uYQIffcaL+w{~wIiB;A!>@^!^9qU3@7W*FQqK0Z*cdD0bw)$i{)=|yo}^^A z1QF+{l%~^!CUl9Z^J_~IJwJ;0&MQ@ZJr*YS!19-H)pH!tjhTQHS?=9PQwg@?v(SHKC^CMSbzYwJ zZ&8A0eE^9rR297270hOkzj#Kyrd$$kx-WY0jc`7fX;kR3ygtyptn*wJE#Y%$ zdT4T5dAHKvVj(fPy%80x>lUn$AZK+$4(iL}Rt13^B9<T(cveia zW1_-+7+mR*8#yUkp*WiP1jHYfBh?KMfE(x|AebIdthmDvDYtQaWo8OuraOuebW58x z0|{nn8-3anQ%Wr)`$kGA{nK@lru7IE_sc~@@VosM!wFSdDr-+Jp0|?LmIQL`=D>0g z$lpjyf4xN#XtxqNzG>uqiC*vOskM<7L{y2ryMX_D0l#>G*mV7?u5QGhb<|EfW7>mk z|7=G;e{K*zy{UM`Pj3PSyW@iH{;q(4snd?Snq0WRP-}myjAiV?IiYqN40PS_L2NB` zO*dOSkVao=0B?qxFOMzJ1YdZWhStK2!ruT>nNAbw)A@EH$1EQuO`=00$1U=n;g8Bs z?;3tWoJTv&t+P!%Pw<96Bi=xIz~*k-2~+g<&XoA~bA3;q7Sker2u`XmNY>X6?fm{Ex^v#&`zz(4!L!C!@oXC2e~9PiQwCuDF~A)utL2se@y z10g0@bQC{J93L;fXY6Pa_e1O5TjHcoA~_xCtS~8Fy?^E1h(9Sk4~``Rlb#*<9}aR^6PaQUxZugem0=K?f^7?^2!u zCl~|j7in+l1KUtWf6`BE_LJ5E-2ILTCZG7+H22w07 z_~_r46j5#79vm?$+%NjJaOviC)J1{%Oy}oR929Qyta!wog)4cm-D@&i=M4C7%7PvJ zT(%PFcnR^*!u%S0X52dOLtC}y=VLVM9K6_ep2)k!nFZNb#8aqWEP^9;d*bzXG>FGu zQ$2|kSgIZ6%kldCSa1dC2P}swkHxdwV!MKp3WK81u2CDWLE^Q_nB5Kjg_=K)e+&Zf4FjW?@SK<35+R4?l)x8`@eHS+M8KkwlWg0)k zf4H3{E8_RNWmjzwnyEWad3iHjOZyyY3JL#iV%d_BIOp_6-K`IG?yNX%EJdX6c*;ZF zq9T@ovHdLzEN&+GOBD0YjHmZw?AXkpd%V zmynY0eZM0-&Z%&5DoX8!Gw5(7k_Fqyt9&}Luek>mq>3cIR(e9a4%2Pf%F?FOMxt{+ko~xv#eZg70?7IBIjbZoQ!8_Ho z1V_Ktr3wvvf}pmT&2TfUvc{r@&TN@8=pST#zoc`o z`0~fIgKvZd=zMV}*PgDWpSyL0yR{J%5o*e0Ya;JwD^bKXLq?3u)D8n4zK~vn(78bO z+%QSG9qlI(%11Zs>c?_)8Ya-YwxRa8KosukN7>fhxZ=Ys;TQ4>McUd42`A%F1l*KK zkY8JK>a#@$LTy|^5502j`f2t(E*rVzdTnqL4xdG@RC8$0jHP8+>yd6c5;|zU+3U-+ z>|>dsp0HJQ?N1Y&wXSwOT%HljeGghmZ|i0~IY%DeK15=b%syoqCOO<(Vtj~WYo5B}j9*SugvBk&IB|w#UCFRWiJhwSRrg8|D;?wdx*J$RGFZec~ z_(wntXm_rYd`6jJt(;uV>0~V=J){8~jza8iUG7TC`(Q!OUbfeHZHL7uc;K}4$Xn`Z zq;VN)e5u85l+B8J`e=kh++R4qk+|cnlK}RqocdLwo<@2#5HT0Qzr~k~DUjT<9c$k& zc$ILCPTR+A+7nkT9*MeU!>yL$mpO_~(Ps7Cz8n>7T)P(g_qg{oFZ@BzIO@N%=CAE- z427nTK0r>Zt!2f!Y;&lsZS;1FOTI{;&oEtwGux}ksVkje=dQ>(v3ez z|Egvum}JPO#Z-l4$kVTi3?&`^OQKs_eQ2jrAWrv<6{RRpY7;Y=u=5zzMP};$o`+&%WwMRGoaqFuH1kP| zqA_HE;;Q}?qW0{`C68I;?dd}seyfqIBbRs`Ol#>A=NK|ZY5%37NDB4NJs#GTBHiVp z=lZPrbJrvJoOTx+8IfxFX}e%@)okkOYHe*Qt?pn#i(TwJo6v@M3#6^FPnM7iq zuM+N(heX;;@7>~1P&&VfC7FKyS!4KneAM5r&So>*6vp4XykcwJF5#Ig^QeEkb;b)M zSKmmB|Ne}ZlVujNkE>Tkm`btaRNS+E&8=U3DE&55cDQININZal;#k@AZ&+TIoVa{W zd{L+Y`qlNE@UE5dotGV&dx@G2w8+A~kG`UnlHT1NS;v2p{_juMVLfx*c_)oyb(qs4 zA2{d8BOh{1r&_|HMTc$2P7L}NKXGG!U9Y&RfSBB{bvv!9F72JIu?B~)ZuKcO*^v5N zkX+-R@;8CWZ`%}~-2XjoP2K$OWLw7}`7N+u{1aO`P_kh=>wvkWW{u*WXxxt+sn}KI zR5xjv@|d6EP}9(K>zJX30Js)y!tDg^9-pbDZ$6qCsm)4cmA1Pm_I2`{-yCR9CEauv zngL`Of<}4mx9URaS~?X{`6(vOwcB;3|6E4XZ%!*uFWpN6O)^<8YeBK}t1GvbhK&sJ zd*kc@XwRpD&p5nMzeleicCh551o*P@A3BOPz23x$mA)SK^OyrfEI!TzVD~;Bg+GxR zl?i))K;AS<8VNex-|1DB@U$KZRi&1sRAA`ZP^{*q?DfV!mJsfyCmn1NOuPmWnGR|@ z_1w$#e1BV7@!e{K0$K`?M;+rZmxm9|dt)u(JP0W`>?PF0n9qLsjENMkhY>iB;BE-p zOHuxHY=`-YhF_tQrykC~Xa^O8J=3B804KL>KsMICOwQR0%!V*ePlEp>2>*jD?}nZd z(dSA@q*dFWF>e)zA`7d0!{~JYS06oU5~%hu#Pb#v@iJ`B%sedZ?fluFfLk^&G``Yx zKeCp_dL9su5KB+T@^w3bM*Apf#S@8T8Z}bEK%P{*jI#2VC8|W}`cqc{#vj9I2mj^Z z=r82MA#WO?D#s6DUyGa}V|1>E>)E?vAV(y(z8iJA{Lt)EDnRabvlZPk-$z7nFZGU$ zi@;eab{L?c+j8G$&5^M1I{m3(ri!_{CG?1~R=#h~`plx$++Q4YCqL3`0Z(;5jN9>Z zPpn1B3ruiD2!2(*u4o?|4kL_x`2zItL|bNRuQ@ZGYe%IRT8d-%>)tsk<;;x9B|#VZ88l)L+86&8!^+h1D%` z4>hb=+t!VSMLFW|;ntmwKVw_@C&(8D3k&821__s8QYXD!TAnXUa2EU;n5fZDojy5| z)!oFT9vbL<#je^)W4^T9v~iBDzh3jyo~dpQzE`haP ykPxK*3IE#vU^e={i~Rot&;M-wuOf~AoJ;?Y{HY`h1N$Ec)W06~FX~hLC;MO0pqiHe diff --git a/Solutions/FireEye Network Security/Package/createUiDefinition.json b/Solutions/FireEye Network Security/Package/createUiDefinition.json index 5f6ccbd1126..1368d44edbc 100644 --- a/Solutions/FireEye Network Security/Package/createUiDefinition.json +++ b/Solutions/FireEye Network Security/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/FireEye%20Network%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\r\n1. **FireEye Network Security via AMA** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **FireEye Network Security via Legacy Agent** - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/FireEye%20Network%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [FireEye Network Security (NX)](https://www.fireeye.com/products/network-security.html) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,13 +63,6 @@ "text": "This Solution installs the data connector for FireEye Network Security. You can get FireEye Network Security CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, - { - "name": "dataconnectors2-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for FireEye Network Security. You can get FireEye Network Security CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/FireEye Network Security/Package/mainTemplate.json b/Solutions/FireEye Network Security/Package/mainTemplate.json index fc2eb14e506..7022b4c8d14 100644 --- a/Solutions/FireEye Network Security/Package/mainTemplate.json +++ b/Solutions/FireEye Network Security/Package/mainTemplate.json @@ -878,7 +878,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "FireEye Network Security", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The FireEye Network Security (NX) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.

\n
    \n

  1. FireEye Network Security via AMA - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. FireEye Network Security via Legacy Agent - This data connector helps in ingesting FireEye Network Security logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The FireEye Network Security (NX) solution provides the capability to ingest FireEye Network Security logs into Microsoft Sentinel.

\n\n\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From aa2c6c626038e0a5c3eada5d3367dc1ff7bbe23e Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 11 Jul 2024 13:42:34 +0530 Subject: [PATCH 10/11] Kaspersky updated --- .../Solution_Kaspersky Security Center.json | 2 +- .../KasperskySecurityCenter/Package/3.0.1.zip | Bin 9830 -> 9563 bytes .../Package/createUiDefinition.json | 9 +-------- .../Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 10 deletions(-) diff --git a/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json b/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json index 20ef9fb2779..2af5a981c76 100644 --- a/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json +++ b/Solutions/KasperskySecurityCenter/Data/Solution_Kaspersky Security Center.json @@ -2,7 +2,7 @@ "Name": "KasperskySecurityCenter", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\r\n1. **KasperskySecurityCenter via AMA** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **KasperskySecurityCenter via Legacy Agent** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", + "Description": "The [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", "Data Connectors": [ "Data Connectors/Connector_KasperskySC_CEF.json", "Data Connectors/template_KasperskySCAMA.json" diff --git a/Solutions/KasperskySecurityCenter/Package/3.0.1.zip b/Solutions/KasperskySecurityCenter/Package/3.0.1.zip index 24450eca1ca7dfb270b37b5e52e4e13cbeea649b..c74f0066a55c8c8d577457a9edac868486d3c18b 100644 GIT binary patch delta 9477 zcmZvCQ*hl67;Ks}c7w*Y?WT=w+l_7h;+&{S&WY{Dwrw?TY&5o$`@fjEb7$_$_prOq zyEEVJf&8j0p0XUwXKW}aC;ybwpi}$UVO0|2-6;2h%^3Lz zNONk1rqdaLtnawK-}feu$VM>~8y zxPFQI4t*)iy&XI}AqeMaVsG;+qW_f&q|f%PF3$e1=3^Am7p!|lC!WQNZ6 z@tBy+p*TzQb4&-gk?}j29t+0DcS9LCc`yP(Rf{ZfOx> zh=t6-+I)Fdx=rI35dGo5_#!(7Dt3`SbP)jIOCUnL%?8_sxpi5?di>q%KXX0-f@|~3 ze>QwRTmk~mLfXqM5vMAWNfyc`EWD^$s>h&dOeOCxr9SyPc%;*sZujEHsehkg z`uvVf^1t~)Gxi$$u@{$zMriUMhJ)n%oW;%Meu#MN;gmPVgP{!{v!!}ajBN@i>V*K0 z#&mu}*M%bKsIN=*v<`TscN^9vh*@-p>3|Gy4+8n=CH=)GDYf8tMbb<-; zqvQD(OAv}ZXD;IE`H5ov_=NagD>hlN1uT*mCQy$(jwr9>ifc7n9xzolGF^+YKpNEM zf~tBoo)Rqs0q6li_ADCj-(H=Q_!0ml-|S5~fF^_I#HfH{hnhn<4ee>1Xuj%tgNr^_ zXUT|6HtS|mVnI4QX|H(RpOoW?iCrCK(y8)xwvcJ>XKM0n1d4BD=L8i1(u*EcFWna# z&@PfVqO;UiiCv=Vs5CmyV1Y203$BN)M@k@oCXsDIDf;XR;BK-&2wv1!q`)H4!CG() z+Z+RnEBs8@^^|FM@E8vB*}0yiH>1gb`gPs$nMxS)n;al%uwNmK+R-Rr%fUbz z9RYS;*JQNfda(^w$T*cGoE~;$P)pbS+n(4g6^gXjt3AA{ZXB*tY5u}kwAV<+D5SOV zQ*_qp$Ea=y{CZ^AM3LYkJaD)+-Uq*x2^Fq3x}y@!n;a&cNZC8N7R%7a=*`g_?Jyp> zZukTD{xxKya>?UvdO7QqC7uZzm3CvU{)C6ad7u`V7IU9csBLmjT!i9UFxKvI=JRuS zk*P9@R$Q$QF$!825mAgl$z|1%Cc|0O&NB>5YBOX@z5Eti&pleV4xmpF?;=Dk9e{*^ zRfKsBTOXl9zUA{OW8@8hBoUXas0IzF>pn%oQA`+xhSn0a=W^?@yGQmHEXkXW7(kgN zd$|7axVb&@SV5dQhGnF9$jd$H-K`#%v~APOqLeaNGuiVMPP7!fS`rJcsuA+=Q?>cN z4lR-O09iZ4y71a@2mHu59+J?rA`g{>evh87zM$20t@qHI=vk52FM*1O|AFVJ7y>=? zG|`DD=e{$OsB4^Pb`mNOR<=lRB{A(R^$FOM6b{U&ZLa)t%YgN7{#g*T?|7!!{WpVj zN&1bsDR_U8mSM8}K$DT&gR0>3>%ve=qEdFDrWsGa^VfTnBjD3(E=Q(1)>7C#2F|XD zH^_i9CGg2LLVJyUVjl5pkC!CV{VARBo}j)Yr^1&{N_fFEq_DgdJ!6KB!Z-5bOo-Ot zP``~5TB#Lx=<2iPmjl~&?*MH(c$U)J4@pE;COU$ z-m$=}X_%PT7t{)ZEz%wp++nW{uFOHYDdWMRmUNfzqDn|HpH>d~DJTgqMX2(e7-OV0 zt?E(_Z7@MK;>AaLq2eGot33VE&03<9YxVqm*(kzi$>LuU!@jY+THk4$*#LxrJ-vyi6xlN6it4LckwiS))*$8Yf{ z1ZJ(CoLDQ%=bNW}pxpECM+3qhQklKuton@1gVna9gv_gr>$BmS<9E8rNv!L*GT(?W zC(*3;D}Y14sP4-{^#2=?jQ>TXxK@ayIWZK}>kAYV=6}IyZ({ABZej0aXX0kTV&m%Q zaAt7gvdWkI{$1k+jc$5TdhDO+=;*Cm69m6G%guL}Z(~_zNi)-Bj*7`uKEVcDS8zNv zFFY>1B0QQMf{X};a!e*}ro12gf(Q^15oHnv#?4d%uQ23F3j8;#3JKdL_UjD$o#;=7k$eldpnX?f$(v8%Bv;v19Zqqp!W-h625x}wZ(#YCz@;^zuG_$B_G%lqJjCs zd~ib+^C1j*h$mMJ<>nN_rKoVn_KL2Sk0048M9y9hXZv8XfUIPrjX<>JM$Avq5clpzJt#@qZbB?6DxXaNnP!)UoH(_*3l`2%+ask&&Y)K{?7 z-;Ln6Ex4NP1mf-9<*QirUxHgOovn@xMIeVJY-WQG%`&PcV%KkJ0Px5(TrORg?ROJw z$5e%$8$V;*e3Pu0_Um(~En8&a%1CYG2-N(qe9c@mlMkwTr_}IcMA5=NZmBQM@l^0hy8)!G+=t-%(&JO=uaY zA7d-!(oMv<6M%P!!d}PR1)oQRKUoKiR0m9Oc&$KrTlsZg>HI%F$7!yPx*PsaMNNF8 z_$xeA>IAmgsg>TU_LD`iiRz_1R<66?fr~%6v_)_REa@C+d#FAxMyNij{kgOXr~-4V zzBV(Ebhxaq7@+U@+Zpx1k344@Ucvo1f=9=#h4>l{19rbiB#5~xm><3`o_ul1h_zOt6sXyznE9uC1*o}(M?fgYf^^pNN^=6I6a3NWP|Ba_~!F z>C?Y*rcO)4D?q~%HbT>EGI4ofRF@I+Few@<(E+R_AK9g-+Cy*oU)VS`roPQBr*{NQ z254w>kGUqltp8I^Ps5={!JcpvT3(w?w^rSUd#A{Fv$ksH-Vg05I^q2N26Jb9v~qFJ zWg$P5fGv&vku`F1x1U?6r_Ic_Fn#KJXUcp3*mI#8&vgqDAe~E6pcqa?@a=G6u2cG* z+zC*vsZr6@X0QUQJ$tU9>!-?!HPSlOPecB8QF=&)X>hN_C&75!;CSWG)HA$0yhX1K%fI}K(BcCG}I zaF=$slDQXjB1SmKU6&^!nY`Pg-@G|%gbO%~yv{%1-cs(>^%c$8ZHnuYZ&5P$&3$qC zDKWq8X~;~mwYA@8dGc%7Y~I0CA~YZv0lw^qu#iupk^#v#SzkMY;JHvDm71z5D^xGv zZ|(+PJ83ZX4PQmuf6%F+L$HhUxVs;#VV4u9YDeX4sl2wKX;TaI9|X}%$9Gj>_J0E{ zrxlJV3wLxS9T2%g*|CC>goPp&n6(+Lmx}f`71rpH;4LvnvKV~~VYCDD4jB)TV}qP0 zo>*IXh7Z$!eco% z%c#bvMDj~H<>2re1kE_r#F4u+d`SgRAcDPixR0}hTPvPg38K~V5fyYph=26*93m1drjqnsS|!tPg;(QHS}zE2Ec>^(c3I3vnlcn?Te-0@I!xeKz{9HAEy6a;cX zsjyzuO`It9wH$XAt?2!q`e~&KlC{ZAw?eb&`MG|KbsF zhg&Mt1)R-KS19S+d#)qQKJBwlw8#5_GLn0l#alX0&3PVr2Ws8}Cy8Z3@v z?q_5fr99XimGxcRv@ONOi5CH0I-Ce(UC|6D=Xr)B={ zH&HB(g_LDKe-I2tg5`3@c%;~uWL751(4L&cpNd6z%;>X`u_q`$ z4&i4ctCN0eA>E)QuGC4W&S}Ejp*N7MZsB0wVzA(mO0j1(N5!>%K6@&Vf_MC7B;Vh#)6&$VhFyr_(6W{X! z4_YyFt7cfjmWIR4sP2##Uw9SURS(AMRvx*Ro@g-VcvqlsvUetg8WSC<2a4rp?n@z# zQ2|64li=&uv7e#OS`K)Rcv8ahYo0v^F!PugwV< zNYgA5@(t|y$eM9@iP`xCFr?>hJ9SZUd_|}{*#@x1+xTD}Xgu$9&RZv4l6kO66txy@R#1pis zyc#JB+4)-Gt>rmli}|lCCH^vNu96AvLDO`DeQN(+qRSIab0FTYop@`!UdS;_egXV{ zsW_GE@u2@ePb9-@k7A1^nn?%zq=-lkVg+Jdq}^GElSl^;E&adP5b3N~(4#J5V{Of~ zgMf?tu2>$mC|=}!7v5`A z7SIC?8EDTSPV|8=uo%q1C>jr1(aEIQnQ+>zAe{Wh%R{LFd+U=JX2Kw^Nx>3m`%kW8 z{i~Fbg$YCBk1;quRGAs+!3WuiMBp}*s)3qQdo@o9j9v}O^UL(n#a`Btp-HDv?UajjC zXjnDfYf>A#*VEQhBhxrNNA>Qzi|pI7wc^Vge#&8CVQmPMTMCom4VJR3zg_dvlN5KX z6|2PTctCH}qruYC(P9=kN?(GMVYXUGufcIVQ6Q|v-BIg&s$-R{0Z>ccg#(YrLzU4u zdHSQrO$PslMY`ZQGe6dNNL0fzH1Pey%qn=*TL*)V%Iam ziD~*GT;AM@(__&s3Zzyza2Ba{l?U}#nbb5R!nA$Evs1v1*Nna_i+wMReJw?Itc15^ z4uM+;gl|0%9a$)#)yCF@M*2rXt$)N;YTcAIQm94pZf4hgV#nkD!oo)bKe zNYofCiJDqM4>y1N!EBs|4v$vm`P@hxKuK$eeDHUfe%+DJ5>Ugl{Hto!4@vH7GxMFD z(sG>NFvgmH=b(L8s3ZJc>8Za&`;H%oW3(CxK=Ox2B+u4d4lXVRx+6&v)}WXY)LVnP z*@9@ktk^5?lRM=ozB1Zqs8*xWnZ4XK1?eitOR5IMPHL0hKJ=hJGs;7pZ?Z17E`rVK zk9~7d&F)W)fU$(X#_YsvV;`}D0Q?f_&RqR|DR=z{r#`ga#H-pvW`Iipp1i+QRpc9< zID1IggJ727N<1`nq%P)EGt@{sN_E#aS;P>@~3xERYFK`)=!$-kvbrTe01mnAXX zwAlsxwNl_m=hc?Mdhj0ezykJ}YhnaV4hiiyW$axM{S` z#@Li6r7(h}I%bFF;zVX+Uoz+41Tuk|<0mMN#P30Ak1%*gBC`bYPQMe=Xr;JofBzy* z9vRIYMcwh`wo@@|{H=?QKV+qtTK=H8uW`N({5vh83DX$)-1TzGJXl2wf43co%R5%L zt8$R7LwLtc)yeQU#JEpf3O>t&c9&LxvN%|+Ag!3pEY2qBS=&Ai>;=G`z;;%eaK6x= z@2-4EH^3kIbIjll^a@7Ls0`Q@30~@4bhwa1om-^t#*D^j&S@7q6Q@wbbCMm_yjm2X zK#e|1abswvJ}-paVFJM+$PNEB7>0Pc12GuQq@HPwbbZ}B!zQwTLenBNJS}AMD@TYc zO@;8^ge|!oLrx@vMQV17{(vq6uZCd{4Kwl$*_2mB z1L@&#RQe1#lDvhezNC>|AyACUDz}tG_?*$;5k?hPgn7yONhN(tEvV>7&$xQv4Pnx7 zQE%9O3E3;#dE?pZERfPsZ&FX(eGBz{Gn_H>gu2&dUX&}qxZ_N{Ez7I*;vTaBW>4axX&76D^RoqNi2~@3%??b8iPy+$NBJ;So@=_eKcn1 zDvdS<-GYQtPTrwZvr^nlim9xO!xy=)c>^o^JnaSd9xEWl#{mKy6GLlgHDaV@o=GT+=H%d179z$E`dH@loq?opOjGt za@hr5aYbHQR(o~ZwMln3tj>kIZzS2QAq?-@z~kbfG??M&_L*q(e&$d!{xH2{hQ?~f z#>$ntuoY=cUmuz=US|QSYC53;UBv-Op$m1t{g@x@-K+-9zF4|UpsG)(sz3d+o8-vJ z5KC@HkNdKoBki#)7wF-J;_`7+g(q^&P~Ie<%rb;~zig9}z91ND55KO;>o_w^Y-Jod zzd$c*NAl*0*sIEGv87|t3jK#d(J9OIrCL`fO!XBlx5J<$izlojxzdnF$mOJ5aD@KM@9z8_74Z0VrYHEEfV?${?|>8| z*h&78{T;@oL-^CI!5Lz_zQU8;Sv=#Ln81TdwdVDMZ1?3=9JOEeHKBKwk`;D^JqMm+ z@VuL0OKGcAd>6l8c-5+uwY?`|knE|@w_X>%H#2S7_BMXU`XvtW- zV6THN2G|hjea>ROA#!@t*lWs%-FR#sCfyUM#OozkN?@`XGx&>>p9W_M!(5PkKS8>X zyfVQU(pSr-hl1^}E$P|*Y_r`dCiZ8Yk?;@MvU_8PI0(mek5*_)g zbis(Sx(Nbu28d(^um8_|CaYP#bRQYo53KA_bfC>fDz6gZ7SxY}QWshm>}aUSDv9@~ zUW#Hq@8GO!L4o`18IKh75=~j$2LUtaBx%^%)AP9b1u<^MbfDhkRLvOeJbzHEPocv* zJ}4P=eE08uxL^NsJkEQ8=AqQQ-F@+}dD`Jqi|mnw&F|ys*3w-605{h8^#0xGl;~!M z7?2K*CJN*=_9_TP%|==0CRDn%I~8^5&;Pb_a}I`d@A30D<&X1byJCl+PjK{cguV4Q z3;O=n1|=Qcx;wYV3A-Ui9jqASX43*csvSiGR3*CDQn{rGhhU>a>>CU2`IKT+ys+BT zQke0@ky*oon)O+InwT|j5@)@}bAna2f$I8Bw{Pji+Sc=G`qOHC`J0IPq@o{`asJg$ zN>z9AZph?1z zDE-tgXOqSxDw0H%wGJ1pVyh8+|19XPUk3W&-L0Kj(8O%oDP(w@Qxi+qz0a>W0IH|T zwu!4*Is()L9`G(VdgWt&D4DQ>WKHghPOt)(UP(R<&JeU?V}UA|_nIS~@47>!G$j(B z?QWo`zj;2yvLUsz*l#SKYR|%11MDL9dUtjB={;@ad+3LE`qSKQ783nLq`eQpEdAR& zj=?G98ZP&q?q&PxFxyYvZb;YWf7E1v*uT`Z`UsO|q|kfwY3Ek_~pL%s*D{ zC@Y!cgB;qG*kkiQhsp+&YcseCMm(8EB*TmIEfDKqf$e#yRkbB&)E6t@I62>ATE6~5 zWBI17+A>1k>H9XzG}?A_-~n$G>UfjyRLkipM*q9mb;nR2TZ6JtE_qyDW&ON>mJzK( z{ZfJf3(tk$ZIXuUjcn!dDcb67R82q-AceccoDI449|TJn_7nEU@?d{1jS7(}oLclz z<15v;X#o$h;*Q(;UrGZD(W5d&cfFK0XE5b0ok{A05f6J?36j~Az^n8h=QSriSzs9i z5<_4+N&h?t)FED>n5tWncr3%$U9KD9CejKUi1ce`Y2a+6_*;`vZs=Ras9x+9WPP@O z?GpUMfhLVqE@pz)WMOLuyJtAeCc{(n& zH=nGp-kqQMJa}~a{>K>nFIZt9<5c8-(+VXO|3{{0-&*bP&@@z4Y0|9OE|;-tSyInv zyBw>LdfA6iSU3QA3pSozw*s=J z{_ifuwbfg%`-FTQYlMjw0n@L+Hn!cCw=hxo*hYm+b9-=tS$7`F92($)1XuWB98cxv zLe=VdwnsA|v*)|@*C$UEBDnWkenIlX_Jl`CG;bt=S=WGg*?Ye*PM=?_nb8neeP`@2 zE=e*@AYcdP>fkZh53s~cCCUCSDANGWNi-HFAxEQ6vZNXb0!hM={~B0> zdcj7uoEjZ+b&jaf+l;L^#3zaS3x`R9>mtcLv2Tc)vJPT-`|r_MU?oCn73@#>%GeYr zWxFL4!~zt3A4*xFKEa@ig3iX-7m#26jLV&AAn9>_gl|0H6@#+NfFJ6;50owr-rEp) zLP(4ZhL8k*gk6~l?C9S5?X{jNZOQNl;z5KjwXVpG0(GwuDApr2WMCV#_-R_j;!gJ} zKJ9;I@Ln9pa1X^%k~V11PWi?%9mV!O>}92%X#x3a!jpz(ZR+E-rElX?$^;H6%SVAN ztmf#V#6Og$IkcfB-l1K%1Sp+y9ee5_M9aT^FF3Fkn=ygh+bchfIxO!rJj4JHDo zNsnj)QNboZlk&)E)g{y|xQkz!+6q4WyJ*(a)(Qm&`OD~P(pziD7F||Wo78;J2cpc| zk`N7FACp8}ND|z*0GNz@UhKIH*W~p?l6iBsa#!A%9WmkV<$c-#5NX4c2iueFBIWpB zy^S%|rBbKd{59%RIm_!8x80p{NKfS*J%5tBev7!Fo-4fjY9xg!+sCh~Me?{$oT`klnD6;=93q**9 L3a*#xeCIVmRoH-th;(q=p zxN_>pYcN+$IdWJZ{7b9)OPOfc5zmfJ%!F_xf&_?-%6~qss&}<4nqL~fOn1u9+4FCI zi^m2T2NKW7`S{wP&-LIf{|kluxinH+$Z7x<24JV)%AWh0Om77{2k!>f^Q<2UqgTuya zb(<*@v+)%Bz+_OVM#{!+q7T~}PI`M-voP{^GFN^KZq~A zlj-l+Y|kIsNWr{wwll;4ke#LFD=sI^sO5*()PX$mn^)w$tQxX2N0AU=va~4URxO`x zUb74r)a6R(Iv#mU41%b{K{&Q21)sAw^5S_lTjfU$`*TkVN53x(I{0$)25#(zGD#a)}X@rDv z!MIga2P_aU5IZOzG=EHZgm2(lhCI%oYG28?f&DqqzL(d()Ct6@rw1uu@Xx1q;OQ-_ zuggs@AWp4iyf1mHyZXTb%uMz6{+4MUmQ9T+m6x~H&x#zL+2u7p|EYczaqhZDLP5;D z>z;+tC=cbT993w^C5fIL-o^SAC{oYk_SiYk4{qK<)}YJ|pH1NO=|rV~WWmZxDuV``Rd#<@Jhe3>&_^3pR5o92+t?o% zZ`udp3pB}oE$w45i=qCJ8Yj`$gHk|oNF9jQML4lK>8na53>rx=I-!6%;$B$Q+PsUQ z2VXq}^yM%5;?4(l4%`xaBE1=`13%uU9AcF;gwO_!%DI-Bb{Kt?a99%|#aWN*{Xbll zUVBv_KQMRgLKTYy(HwA|?Q5%2`^N31F`r}Yij1p1BXYINX@tzPc zQj$0H!}LNRJLkj0g-1{<6kVzvta+-6(@sVxx+7ntt(RKwRQ2D+Y&%REM=vf+@oEBc z+yF*vqtV&;D1G2z5#<%F|G6ni12;7(d=vgs48BJvuxXjWw^*{4u{e9(GA9$b;P>aG zQlXD0s>J`9V1ra1{S!7WQE@tYeY;RLk(H>qGOo7bN$}!~@Ow?{JvPx8OwBa=Ek9{} zwnF;P#9Qdo3uT863>^hVrY|5QSqg&%s(fN^qa54(qaj#*ux(Cgtsc`q-kqjWMFaYx zu#&XHIfaagR710y$Dcq+u+~eoC536vb5Ot`uXK1$eP{j5tsC~E!Lm8>2y|i8$Dc*! zDf{7T4}11YTjR9**a$!Y_Mk3?e7~5fI80B;ZN%m+HgmOv0RwSaxI@px$HLU=L9Vh? zWyt|A2Vn~zCS?j82*(VKd`&Z9yDR=gPr8W^tOP-$@qvO`#uis;hc#G;0MjhWfm!0M zMOiy%9F&j8MKB4^Y<%>^i%R21U+l#&uHwg!I5rUs<72z_M+YP@v9bwUe`kEp4i@()X2O7Mx;wBKotd#pot6Z{#;c}w`DG548kh0NH{(@yI z6C@kfRwfyZ%AzgB(P$g=1zE??k+)a6$0Xwn*Udh<#Fa1S(sxkoKvBck1PP9y#B=1v z9SM6poUWE4AAAIB7lAOb*og{4T^!!~d6US#QAb=oynu;FsSoF*`j#$g16z|)1V6ma zkvt6M&cv=b*&RcU4}^;_PUMEX({C28jsKos7H(B~j6t*%)r1vm^4cr=0JNR*ksQwd z?&LIJh!vBuS%mVv?EYNp*&8j9es4?e;f(7{tZFo2Q-%dYPi2Mw2`C}R=9Q6Zd*2`++&&>7F#lt@gNco!hJ}NZy@{Izi>)ij@xsv8bwfJo z3tasusAyB4RuYe%*u+cx#+;PA5jp^ynWwHVI zNhko4EjXQCzcF%{2XXrTzc3>e;R1ggkRhzSwvXri>1=(-u>Za9h54N{_BnTN^R|{D zS6zfu@5>;}%^KeIhKWe2ZEOdvjSQ`Aj4GU^$2jyz`P6Sum;Ku(71Fzi!-Fog$L`qm zIWsC1?{#DDjT7+~_Us8)8wo%f?I(DI*l9{{w3&Rkh}BRKrD&If78;8gKbkz|OE~>0 zfkHWin^Ojlvc?_DYl?t~s?j*Y0FJ`jL<-q>-_~9H!s72}^>=!eA!h39#Ji>japdPf zAQG>Uu|B(%;bu_wjjdQ?B|VxUn6b0}vg4EDq5K9VFK%H2?N>{h(fjgkS`B!+J3)GY zqvaIcq`|<=S7L3_H&siFD@e;c{8Ie7#T{qZoKUS?g(Z#shQYl;Vn2YXhMrQ3k8Jn` zSC%qrVm7=eabSW;$7cqj3az(1n5=fL5xU~>E+HYG-uZ*REG<|=PN?|sB%8b^3NK9w zKIwP<#P8`=tKrxP35h47tR65*FhAgDhe8sPe$rL^`;ZL3kyO&dVK%oXKp$S3+pgQty&2t~mOa33EMd&iH__Nrra0+H zZ^>L?wOD{R#PSjy5^g0NVkC;Ttn_J0<=wRT16CE5Ql_H0s*tWK@q=fL0ENWWYp$By ziNHtII`kN++pEIPhlO0{?B8W<(b+|06WN#-XQE%oNmzeA`B1<)rMVR;yS#06)?t`S zlCSY?iFe9<2dm#61Fz9?uF(*PM*r3P>zza{2UZ{Sd|$YpoH>C>S>LC&vhHRpoY%P< zw*Q@MYscbHQX=0fmQ9>a{WBi!I|KJ$mp>^J)S$WKH`}>nBDn81wsV==+v>r2i(G$u z0z}_2QGXb|LnFn4IbEAwKPv*i;EYh4af19Q$6^YK%xwVkc5UnpYUTq5?;&~=OpEf< zs5Q0hzB%2qShIL0MjyD3PkDyWC(sivDnl*oel#>#M-wVp8vCY1If{qap}+Ozkf|bj zmZd3Ix~1OeQ)s%%#RUe58bGGD`Ai`NB3EAd(F!f=Rh|eL)jSX-4 zB8u|gTh0M?@^{X_B{&Q3SEI&IHi%JEZNuqE7Avh3+MU3Cy0#RNPUi#NE=1SgW2xp^ zrZECc&wl)1owcxutt(X;)V0uD#$wA-&cP>s$~ESa__grNQkToj(dEMjyT|IPSIxZU z%`2_&`ROWIlLF(igMr7mWyNI1_G|pLwfry-eRX97gHB=BbrIG4u)2?9QT0)C61hOh zo1F;nU%ezLZphuRC$Fjgbw=l-q-4+jNJ(L&YA62Su4cJI0&J7`l{zW3)5Rujb5Epp z6m$G32wehYBDOWWe2PBqx3;8 z<^w!PSz1tV=hK2O`s7!S0;W7>W3Kduo(_IpxWh1HpjTvfjwMe=a^@3aMSW*&o|EG$6hOAwMkv8Bm1QcV|in z2|t@Iyx}=aTI_)hpuC5cRtpKLFTXr1T7fCr zjGk>F4srQsk~GNGg4g_|7o>DblHJoH9fS{dbPD31^zU0BZxdqSR{a^ZG4tx7YZxCi zDcE^xAm@$4-PASz8>0PwN%)^*-^vta6Z!L;J^~efh)OUlAt>2j)n~=3SLuK#d9p9V z$KyD8XBe%4_yscT%xh^Yem{7m?jYp57upJlT5slLxBe5+5})a#V}lAGkc4BVVLAiG z+_aLKSs~{lIaiM$sfD2(Iy7R-hwr_I>v-DIESUo=PynKw#qRYgveiU7QVvVy&lYpl zZ$qYQ(GB0nDN$Z8jC$owP#U~Is2n(?qrXNYiDV&g=4@$H2nW$AF=IL8j!Ri2`m;PD!Izl7B$05-=1m3sBr}+x*5$a)w)S8 zp=3xq7aby1G!3ccoKZViYKHd+7QU-)BA(MIpEB_i-c{hfnv;q;pHb?JA|aOK%nTO% zH_#*zajUnfU*7{{j|T0XLXg3lyKtoY)BaA-fRtU@S9K@MAzSYR7JCCL2mz4*9-msS zZeT{fXeG10qV2kE!DryI8F3F~5a}Sz!2xwywAKwfubA)a?!cew1*>>6A@U!aZa-L| zlj(HQ$1UgHkmdb%AG3T4(hz`w?ms55ym~lEb_lz7i;SiA8w<>uj|9OwZ14jepSRE^ zWziB=@TB`v<4C5AdkboVqtQa}*zKnCTfUDyGRj(*HEI(%(wLV!>|MLijx}>)Rjx%p zg7RLhKGj`thU;Q$q4|#sRXtEzgP6ilF0lr#2h)+|MLXwCJB0yLdrW+gN4()bM_lF)DAf2|MFs^4dyZR4nVNn z4I!1_?i3`~Vi4i;P9BH6t~e4r6Ue+Gp&APX90&Td>IfunV~~L-hDeB5H?ri-lfP9K zSw9B9-~j#h#~E(4?EH=7MLtA7T-v? zba^tJI|)&<)&d$BW*SFoNDWrFX~wF(@Sf$gEwnq(hlCBp1qV=nN{CXq?Xl}#3qUve zvk+yXOn{-6_+h|^%0wEUL@Oeh6H2^#0%EK?MyFg9#7F=pl6oNXkOFcwQ>_!C<#X~B zTMBM$G}6TMVS%{>z4`&4n~73q(1c2)^MpcQ)|8QcLtQb-)T7Vo*;o<@yH(H9Q(O(KT?cix8|VRx*X`1iID8|NY%_Z8Q1f zd%`GN*3fN6Sn>3YFBcS#%nRP*xe z@VgUjhAx9wvwexQSUaq>I$vVB=-qO$m-3RPc)Y7$JH_;X;o)P%P~LfFLg-Tr<&wAu zRvNFjH^)Aizd{!!&>GQl3cAJ|iDHsn@#nEA8Z#LB2hmZ&Ke0G~NCfuGEA=8@Q_B>P zsD^>Ie=MK!vysOU`$L|t%^mv3%VL#Wza7pwM_^r#ljd|4VZFRYFQZ~=NCh8Cn%5;i za?tZkkw#sjX~Cpx;6Rl|)sa}0b3m77!Wv;xyNf-rxDQZXLC`{kneyUAC!a2z<^W$f zWDnNs$R*Fw>wQ!C300qB0F!4|Ka-)^C#dK-mxt%Up7EokL%t4Mj}*-tr%+dB;V)aM zSFy-mMSPnz6Ep7ACSHcf^Kr1_gbl>(8L887ELvv|dJ+plr~b zW*@4ftao_B-{W2ruMCJ>V&A`#028a>R}UUmlv9xv*XNKZVfI!61^Queb#y41u$o9a zQWF_N0|im}I3<|*7hxkUevJHCZLOo5(2sb{lf}dKXJae%A2}8B9;>9~G+j2zC(cj` zQypT&borIu;*#1=FeI?`Xz+zJb(H>XjYqFT=b?JPNV76f-}re9pJtMFieT=ils)*| z*U-T`tf)2$9rc0HU89ytXaG?k<#5}2V>#9Sf|EKBUz5dbY9f!K7BY@@W5%>1)_**m z#Z3yj(N4Ock~c-u7353%*tNa7Lw>w-rUQagPfwm7Oy3w3{oQfG3JP-erBmZCw6+(p zHT-}nGTooEADr_mN{D26jTBo7DFA;;k}qUXT=OD6$3ppQ27pLblLH*?qwQQ&TDkbm z9v;Nb+i$jXi#4s=9<^wU-J9u}X^?51Ub6;{+{KQF**XaojUe+`99dfe6jnmzc!OlD ztWG;`+F~NMO~du5yspSx+7)Trn(Fm}=D4ruG^t#s5;{=LZ*?&`uFe#ipupxoQjCdJ zKl~vU(h&427Ws;HhvhP<-}y{^Px7{m%$L}A4n!mT|+7IFLm%}-GKw!G$?;BjT^YtMD>^lt9f3_ zd2Y*vds<0rT2Y8Ju<_jV3C_}?esEI-5fujNL90edcoP%Y9`yUi@0EGNa5^v*q2}D% z1t%{fkiRm>=Ju-rtQP|!vrI*mzILGSUXS|49+dmqhCqkIb^}7hg5c6O)DwH81Evim zhYXw3YK4ttkKWgUN4)TY$CHU?-U-s2Heu&2^LI`NKyO4_uY^R=~nBIi>i*ClgE(1 zG;Kr~C?lB7J*kFQ(ta2$6_j4JHJSW&q0HJ%RAO$%3saEOs-G~H`{>36@N#wy{kcHP zJd&m1JOK|KO1fZL-iWKE1}X0)BU}FoHtD;N&ewAdu+h<4)w1{Z>%jW7&A%7Sns21&1n+eG zZ}{7pr&N>JADrREY+v}f2ZR*kZ{uAafFD>+_1uQP`)3o)o|N)~ho+YYbP# z%r&?)yhvL*O@u7b`C|EPIXbI*{{y7D8xUmR@yRI_+yxDP_(XH8Aa#&rB&2) zo^{_H<-~+1gOVf&tmD1y!k}#b{Ujx91SaCu%pPs+EKGWKc)xN zA6veET#zfIlHfW#f0B1rdG#TCU!AJqr846ld5P>9_2IXy&_Vdt;-8hOMZ9um+*cJg zg1xx2mP%H(OuC}dA&+PdUihC6yF-0%QpYQ52AJ-vQ(7TexEKww`l`NR_t`>^M5Q~k z=NW~4Tez<(P}A${i9Ut%cC34YmUUN~7o$=ryZ8Z3+`6LmMEsTJR4blgx4V0|M5L70 zt%eHdfgLX#_-UZ%jN2A2uEsREnC@F>mfvfaWuU0Rz7CKRToX>$uN z|CbjI^Mq~pg!z=YCTMn^Q%qr@q+GvEb;#!y5htrWA)&sonh5?$_*FB75qbj>&fDge zS^1((OpKg;cU1Y~|7Y!QDd7z%nq@PExo@d6D{Y&z8-VbJpp1K2RDVJze1X5yvi6Jx zOu>P8imZjLNJo5`MpQzjS%^vX*F?TZ7`|OSUHg%0+`PRGwNFsVRTV5`3ng6?&eoF8 za;p_8%@r)o9m~tQ;-++Vz-o~<*FkO`Cf1;ZiiwTZJ~@#kVw{|HBM1|KwfT=meVx z)-D@mbc38b7vItL5>s)9q*r_;x45OPJ4BSmBQH-60dCEwU@LV7QV10Spjp~#?&K_p z`ka_M+Mc%9gCl0V0zMe)ANirWxb#|j*kG84u9bWIDLrh$VkezeO-~C^s>1>(5}!bc z!=D79)4fpodR-#Kk4{3*JdkcQi0I9*TJu@bP2*LxDRsXTA2-*Yuso0`)i&1(*Z98M zto-mHeU?{BH2T56#VVZNV(SImx-Kc&%hf`?(%|h`P!Hdg0F&r-JCk(b+sD4ZkcFgu z^ZeRwEC%Jdg`UPyR-y{g|+wxZYYgkkDoGbU1@7tEbr4 zXt&LE*FSN{;7z8vk0PN|`@6%CNR$ikg!y=Iw))yIQG*P%rxZdW3YUp7I~Eyl^V%j` zbFV|N2IIM+P^56f8X6-1V#czQT(CUz&_+?C>_c$vfg|4wsy(pQqeNBs37fhwt!qS6<5<(jmngc9as|NDDe|0)ytN_ElWHK8y)P>TKveS z607Eg+ohiFKq#re8Wz}Y!0OWk@VHBv_nOKF2dVAVH-Gp1o~7J4Us2wXHx?q*$JwzR z`sqvhW^|ixaF+QOPrOMSgJJJZD@08dN!K}@P5V@RMVhELCIYuh#41HpN5O7-w5G93Ni{JsH6_@c)M_1drru*~BG z+&MOtaM=EjV@#pgnoDwBHf}|zZC@8r%x^QsSgf@fCfmAARSLiu1G{Z2Q)<3FKGi>* zI7^)BlbHdjpt338r}W)RI=Xo!MMXCyq=)HJ9_Sd+C;ZOW52n2(8~pOlc_|+g#0BbL zZ`=!&sJ|8hx>o6qP(?4)9*2hFzrR#~S7Q=a*VfP)_yR@Dp5HNcD%9y_mt$L#fU`5o zuhb89Yj2b9!e6q6)MxpKo;BbMLuV~~ld05yF3ChvjB=5cs_<(8e{+)<0v z4;9jhStXyq;)t{q#}Dta?-|NG{&7p+2bmrI+*=GqUOL+=#nNTcR$#NBHhgynldU+# zrI9k&&Q5ck7=?1yzhw!U2c011b9f@`z;N}c*{`;JcN(?mlt4K_pSU9;9-0$p7n2~B z(6_2~FYHy`Jg%YYHnbOh`3vYyInLEnzeL-(k81cC3|7HgamY))_a8}8G8!TtibcbL zsf-$?0$SPqV#ryn%B(B7i5|HHuTzs&`mpm?w#W$;EekhAjp@s2`gy5f#dF<~yxdbs zjX6)5G59xOVuoWFFLNW7eOVLl6Ao9*P@XrSo1b>~F)`#nyTPKGxoc^9{dg=5jPY{K zWtabz9PfeEa`Sd6ImJiLP=g+7!k1R-jN_M$eX?Bs%aSSR(d}vZc;TK4+`h(ed3@h? z%jD|n)6M^DD`(qL8N^%Op1rW~`}E@Y-s68|ZcLC1T<8Cmc?z5UZ(Hk8Z`Z;GQF&X~ zg5Cv#!(~q4Ol8d;m)2U73eWjUyQYpu*ZQtT>&JFJ&a}T!SZ(UgnquRcuXePre@|E4 z5ayk;EqLR?HFcQw%cZQbp8V^UnZ)Q4b&{jc>Ze$1>kj8DEAYR=T5$4=4;_6b zqnz!b!G6a+qI|x_zf>YPaLkEfU$4H<2TRmYf4;BJZ=`73O+ke^%Kcv08g2y}W=DUw$5dkQ{2Dit5^_J!HXK1Q6-C*`n8* zN60eXLHLSdHnv5b#`$}z{c7e{Y1o7oSVX_;tyVV_qGYT#w5Dl(0-S}Q8s*}MsW!*J z1E=cNMqez+dM20EvzUd_sG7WI01cw^;7LC(I#qBDxkG`8z4S}_fjp5LF+R}<3#2!W z`_CElOJVv_uoEX28uLrCP z(u$|UCFMC%eUoqi^3RYH7k4>&;x3WK;G^9bV*{et8H!xJ$Ec@&u4u_)FXMPEtFji| zJo~TVkMJb4ZA0p!0WD5$lK%jPWi2I8qll--E)#9@q=3v>^SDBaS6VG03iksaBOaw< z+`S&oQF9CDG$o^uk)Xv?Y8Eo=Z)L>=OR%X>^V)#v4!BdsUO&;>aWHDlp&O|m$3aax%f6sdK@RjC1<=*x)Cs-5XZ z3JDHG3}xf9aXLsQRLL$mDFy;XWZ8M8*gIIe_e-^lDxUmvzmu7AY9t3Kri&)B!0&LF zV2?bQpuavoZLoS*!<^Q;*)q}S;A?kj=d?^eupVej14?&_3HD5Lt;VmnAyvhrZF;M_ z7SakdAVd^4Ir7es`Xb2){*X=K1k{?H{>-tgncX(g`D0~09_okrTmOS)z|dXht2;rd zi?dV7Gs>5$sNd(&7^X38gV{l_^hvZvwoE^BcVyuc{VvCA@>GH_8qQw#^xxX;JU8#{t>xT0NC>WLx2EKZPh7kW#TtQ@GPdY};uQdmo@90!YPe~d|55%A9^}+) diff --git a/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json b/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json index 623474fc0ab..b1c8a741bab 100644 --- a/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json +++ b/Solutions/KasperskySecurityCenter/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/KasperskySecurityCenter/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\r\n1. **KasperskySecurityCenter via AMA** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **KasperskySecurityCenter via Legacy Agent** - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/KasperskySecurityCenter/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Kaspersky Security Center](https://ksc.kaspersky.com/) solution provides the capability to ingest [Kaspersky Security Center logs](https://support.kaspersky.com/KSC/13/en-US/151336.htm) into Microsoft Sentinel.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -63,13 +63,6 @@ "text": "This Solution installs the data connector for KasperskySecurityCenter. You can get KasperskySecurityCenter CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, - { - "name": "dataconnectors2-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for KasperskySecurityCenter. You can get KasperskySecurityCenter CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, { "name": "dataconnectors-parser-text", "type": "Microsoft.Common.TextBlock", diff --git a/Solutions/KasperskySecurityCenter/Package/mainTemplate.json b/Solutions/KasperskySecurityCenter/Package/mainTemplate.json index f690e2d8af1..c6ffcfca00d 100644 --- a/Solutions/KasperskySecurityCenter/Package/mainTemplate.json +++ b/Solutions/KasperskySecurityCenter/Package/mainTemplate.json @@ -878,7 +878,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "KasperskySecurityCenter", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Kaspersky Security Center solution provides the capability to ingest Kaspersky Security Center logs into Microsoft Sentinel.

\n
    \n

  1. KasperskySecurityCenter via AMA - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. KasperskySecurityCenter via Legacy Agent - This data connector helps in ingesting KasperskySecurityCenter logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Kaspersky Security Center solution provides the capability to ingest Kaspersky Security Center logs into Microsoft Sentinel.

\n\n\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From 4f671cd6a494003360205f630ad2add20fda8c31 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Thu, 11 Jul 2024 13:52:56 +0530 Subject: [PATCH 11/11] Netwrix updated --- .../Data/Solution_Netwrix.json | 2 +- Solutions/Netwrix Auditor/Package/3.0.1.zip | Bin 9409 -> 9181 bytes .../Package/createUiDefinition.json | 2 +- .../Netwrix Auditor/Package/mainTemplate.json | 2 +- 4 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json b/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json index 69c467e1cc1..ee695385286 100644 --- a/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json +++ b/Solutions/Netwrix Auditor/Data/Solution_Netwrix.json @@ -2,7 +2,7 @@ "Name": "Netwrix Auditor", "Author": "Microsoft - support@microsoft.com", "Logo": "", - "Description": "The Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\r\n1. **Netwrix Auditor via AMA** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Netwrix Auditor via Legacy Agent** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.", + "Description": "The Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.", "Parsers": [ "Parsers/NetwrixAuditor.yaml" ], diff --git a/Solutions/Netwrix Auditor/Package/3.0.1.zip b/Solutions/Netwrix Auditor/Package/3.0.1.zip index f78f61ba7da0d7574d79dd93bf00e105ed3ced10..be3e26e43c0722dbe5f3687dfed6e086a56754a9 100644 GIT binary patch delta 8986 zcmV+#Bjwz|N!>>nP)h>@6aWAK2mr=y>sX;R_tYo{002Z3kr*F;dvD{o5&yqHzr#Rn z5j&9OB-f%v(7nRl%{_q4-C~p8p@@Tmmc|wvO4N~*z1eMmewKc;`y@9*>S;UM?Gp$R zksQwRHxK5+&wmCG{nDm679zTYD0i;1m-BhpNeWSl4Hj6sM7*yJCaEr(Gdn*^&XbE- zWpFETH-BkRIQ-Lp*ROCbOX;L8lj~YJ`CXCx)#~yWQS4>qqRbQ;mUS&tqpe=MWZ`)a zI5fmtG?o}K@km&6TnQrzbVNiHA9#y4Q(dm*rr)3~X}_26g~@1hEtJK$J6Q=UQ#&N4 z%?xd7WaS#kzn8@ZtVv%iJMS2=OE%Kw^{TdLNTOp8v2VP8CE@q%hBjr1YEI4~CFig8 zM%!@qm-Z~N+s!h9oy=TL0)G3O>K!d}l$+dj>(7_vvOGQgMmxMbJ%u+4g+(y9MgvZR z%MsREDZP{B23EM%20@nA38i?4&#hK98*~ZG>&L(U1KxU1jt=4OEe75!%HB^}dxNdd z8|VyTYvoOU!_3aVLANvV-LEdr7Ih|_HuHwP=bjYVlyw1C<~B#txe$+}KHNQ&dRKz9 zwjL@W9te+iZX2Pk($-T4;we;UoFM$M+3XoduVAVt;z2ECerq_=`H z>)YEa&aB>j2FY~tQD#T<%x$RV%T~>x626nxu{oXk76kcCtaR zd);-Tc_(=&^|^~eeO+3vsCK^7=D}7XMLVxr>2pC1$-S)=evI3Q#Y*dkj}cR;m#L?J zTvJ)L(U9=IUpx(6rgSQfx{F$z$OsVo2i#3%M%l()>MNNs@LDD@><~8SKss0(U9`Ca zbV;3`?Is&vFTU?g8EWMoD;&>%86B*Xg(()5qzrRLtMM(Z)vaVJB46ItQt^br z$=ZX5+)0JZr#saL@7%YI55PMCEON=hY{Z+&LMGd};%?*T9Wzl_Zd^VYIdL*g*urUi zHocF=uKs}_oHY~L z3#wjcv$NmL&dyIr;bYP5R5}*L-6sYxw3FnO(bX&J`Xg#3R;ZZ#I2tNNJGoX_7(Q=& zd_cf6qW4gck;IIr65nVP$6c3d0Eq!2?7s*J>kM^4XAffP69=>Jgrbo902ZQ}1VBzg zdQ48n32-t^woD#FLpOyNpSO*F)=r#$O&m>gMv$1+;L-|US`Vc2E02D2FthI@l<0)N&u4aKGJKKmnd(C-G*+RzM3 zT{3W_e0e179T{Hw1WRDCCd@wfu!$i&{A!+I$_%g+1d=fN?P*PwyniljYMF^L<;k%b zsryNhA4o|w_S4gFIc}DJpBBrRPa^Ywjwl`ps0jINLg}I+R9YVIL!`q)hKAH8Kt~@J zQ1V2tbxh0e3 zCaA?AqLNsVZwV6gE)qs+U)qm6vi|EJA$&hv{IB7`LXI5_%iqD%piz=@XBdxt!JZ3w zJsSK|iCzix?C*5@6aWAK2mp9)>sT~XfxEXG005EYlj{c=fBSOVwwnKcXZ9U1 z>h6)%6(vh)_sq#8K6Rb6^)weZPTSeFJuXbb5|1fT<;9Mg=FC3JKH5IXez=h!36P*H zCr%=^(^?{~AHF+&fZqP=zaZ56x5S;31@1jWy?L50lZWFm|7NtnA)b*13DXh&Ba6w% zjTYivGM?^E{^sm{f932>#vWM)(TbLPO%}@lr)2bxBnrRi4Os_n6sGX*7ZN9a6w-bs zqh0!sc)uVi_Har^@Roi7U*RmBM=>q>+;`(Bi7r#*pd?!^qd5I$A-|&o;*GFw7IX*+ zt#up)Sqhz@R164RMlpIp(wo?SgZ4AePoa5Q@f{z-62}>}4D zK@PARp<4Cn?wU?Xl6*7LmF zN#4p%pMBXMoE637%DjN#GnTK2aIK)CWgdWzndBv8fkThJWBM!+ljYjYkslpd)CqZS z*wh(se@mS~@kX5n@JT}Amlyv4#+j6s{+z#})0?O~s&ZD&H2uM_Kkg6vf(U{JN=HS5 zhu);5Y!1Dhe!j}1mrD{eX2ro_nE11KnvC;al5v7Ts*eedLDeVyAu2~fWl|Xs_)k&{0f9E7vd(JXQtxvaB7U|xK*@?-~xe32Kk78gx zCw$KJ_{vt4$ICdn_94_u#)4c@FcQTt!b@NAyr;X<2Rt_bt{A!Y$&FGp6t27~lqCnb zKNuN&N7YwTg2R-l|BBvUIw%tt~mc^MYeVc&mv( zID&ztz8a8;DVOsGC5IJJ*+blGMK^vrFOnwLd`VF$l431FpccyIDR+kMKBJU(|F7z~+3@v20IBF`bBHC@fiEM$3} z{lLeGWp7{tcvlC}ViAQ>#Ggg8)9_D`ZFvG3(Ivlt5(43S{5X%I`?LsCLLPd0&G?!Z zF_#dQODQ5VBekN(Ov(h~K!x4Wv|8jK%0k-KguZ}%sFRI2c?1vp6#pO||gpsaw>kAc+kZ)4%-BuPLIJr@7h zl{=2zAEG3sbANoyF6BVu@BDxq;dHJmv`>APpMfnI ze)Q;ytoBZ@ z^T)pP-@DG=ob$8)7(AxmU(CMCOH>2SfZ{O`bI_)7S1}4Z`!63FF*gLmgy$OZs^4r&sT;y8WnGm^Uz z2Horu@Z^GQ5uW>(60NVSwbZPDx8K23G6 zQ#{jHOa5qV0)2AJsroXSwprQhJd>^~@UH&lS@o+*nRk_*>W00ur7hg*Je6-{>cOYh zxz%}<+{0*#HLW7mKDUoF1OWw{?tu06OL2|Cc{%hZG*?}Uf4h`H8hr5ly@h)OJ)G5+ z_pIJktHS}!v1pPJZ5@AqGx>65M6L{Q+dRc;Hd^1@l^?Q}8eE-1UM>1Fc+jFLPCq@Z z74|f2`Nsyfk!1`) zV?DcarmHOj5N%cZ(onCJN7Xt)50pH2TKz$JQ)*)xLpJlHQDNA}U$U*+e+rXWQ`O5BDu{+#t*slksDg@|B1(2}A_Uz(DP(~G zE%<>U1-G-xDpQyNqgHqX@H-wfZ&KVsPm~dYnzq*!;k*H9m%b+<1a0omhnh02y9znu z|15By`f@1GDyj6>Bfcy3Qa=s&!apHEX_`gwf6l6BoY1w8(K9l`E<|QCSVlu*%j_cX zlR38+75I3is3P{yaeU=PH#Xug7BFGwgj~GD7e2UqD|!eA!YX=3>7?4i&SexYNDMLM zaY}HI&M*8lK}Ru!vH_V9FArj$C2#WK7 z=N0)q^JAvPzQsT}wi>VJ^r%&tn!?)9uoffkdO<9i08QYVAF~98{+)=C=rkzjBb-3k z2UZW*WQ4wpf*`tKi;<*cnb1=F&=+)8e`x^IEED?j%d#i><(DuwM6*jE1PDVkNqf17 zqN`+tPDJ~8+cT2t+TJTjiLXG3gJUcfp>p=d;gcK~NH~k}a{dz^OI>Hm$FQ}G*l8+| zbeXGr9i=$nBnP=7^o*OnUsjj$B3Bsg_#jb*F4a#mFITChucX&~3_?!^_GT^quAeN#{(qtbTuyYcLNtNFR4!Fyh>l?cw4jSf6L)LT zL0Z;Y=Cp|$Ae5zm%2$GM49i^3dZ?Krk?vXGH#;SY460Rl>ef%fhoYNswdW^C!V`OlE^&|$T{+$EGj$9| zyzmp2gliasbXbpso7S{~MtQVJpr zaust^>@{dLWxP+yn?1kE!8KM++-TXMxE#@u&5DRRY;I60jWg2FHsa*4D(I1bf657&F^g~ce;u$(R0)o0BugF5F{Vzwa|0nvbd!7$U8E3B zJ4NKsax!_Q1h@ z`TFTY@T*%q{>t%V|TNB`r zcfxeC%feq^aDJ_XA7*b5<7_$^7h(%)qgP;Z5ckcvPYO{D4YknD!PD;s=y;U`(F`s4 zjw%mPKtyhE?9o;iNFV&2hNs~kdJ(0*OMAyD7ht*?>>da@#F$+mkpPw8!vzhYBB~Q0 z9%2C%yC8yi%3T;{e}~7XVO|Rl(WhA?@?5}VG=Zrw@&IeNpuoVkVL`zKcIPn1CV{Lk zOIvH4MjG4#BMyxzF%SAdqr6!GwbC0xLcVy3aH$JUql=_zi-nG|Ll=jX=#gk73TdKg zfk=4m$5BYt>=5l!?MMe5LDw+!Aj-VN#Jcn`o23r4pCZY`e{{mYg_2k4KthF=*IEg+ z?Se+nxdre+Xjy_Mr%QR2>Qa@jA6O$F0`*W15i|~!nRtchZa_(Ha$$l>tP|b3ORlF% zrb-3zSHix|TZ4{SS6@%QLaz^wgbYqb=sCUudEz6+OybcTUlVk+O6O6SPgPDOODGxW z94=Y@fqtUbe*(c29-<|$)zxwP(qL$7@h1_T#He@_XHI8B*!mSnf1r5R_AAO)xejtLr zAZ&~4RTk>kk|zxdYr%mhHIaL0GlgO&pDr=Fp@}Nzeae_ zbB3Abf5C$Yd*h!n-@RgxoU!oK&V{RXzVCTX6rO`NJ^$h8>G^)_9@C)ZoK-nzbIcw^`QANo-kxE{!DgTy}6x1C$$lI)D_GoxRaX~=rL?}~W)w`mx zfy8taAe27EEpc_LCZrxxwGDA!Sh>iG(rQlJe=Fo)vKHACcr+%GHidDh<@1o(L}Vu6 zFa`Y%>V%pe9-B>f(E|7|1xuBITyqO72SslLOTjZ*2$x-2#=;EJRu3zq3Zpb1*$~AV zO;=1=QiFBH2>9@Q7)aK~ZOmh%*K2DTn|-e?7O|5xELpuwiK& ze`R!2aUMnKotd#pCv{6!9R;;!jZ|&6Vx2A6t*p?45&A{0O(FDmr4$u`R<*z4u=kT9 zZo;k`#U7Jsp?0EphC}}kzP+uKTt|g~t^eDGp`Vj8ze|-P*;gbQo8z;9S}_qb%UPbgV`ZzzHm>T-`V93<4iUFva7r-U501kt1DC9>HZvfuPy_DQ+*0%5;3sXm$pi$p z!@`L+S`G(W9{06E2Ir+aBZTFn(`?(r!P-jO!@+9pkL7T%rLL$R3pT2X>Y2y2frOOQ99kuTE;1H|z85|tikXo|h;F7f4A6~eP&Mph9(&pM)s^O4=S%bN92&O{`8#z>9 zahPCxh+sp92wITu^%TPzNcRp1_YTPRvddoK4s1ki*JsoLrG4Mf*-bQXf0Z481{AhA ziPVm|ZbDmIQ{;o7tk3M}*m4@8PQQ(ve%Q>Zho-qTBgDm2=BF!-In0jE}++T1a~WPyA82j&#ly&+0+8IAhO%m^0Pu>cST^|1@pBa zt=qD4B`saiD(wjBR?YmeeaBvcMd+mE zt&qE&mD2r2=ypZsHl-Ik-b}T<$f(OjMg`^CcSmor^XPtenhx>uRQK>MME0kMCN=sUGCp0hy3jxrLrEAr$hq*A?Nsf%|l=Vx6nmI35`j|e{9<*E z7nuD9Liwi;`Uf(FCx3gRKkWAhMIQ>_LuqLfxAJXobvPpE8Q7AWAnhRbKBsF!f#CXK7NOE)5zMjrXoJv2MkWd|kkf3Mfz* zg$@Uz{PH{*QkGdMJ4F1=e(b6sD$racq>(!1vm*W7nR6J!B;_w1&PAfPzo+;jdA$GX zIYX5kMK>fqe}>RA7#4s2%K5GS4GemC@a#~&FaCrVX5+b@j;IjYjOP-`2u4G(p)J2E zN4g1LgbSh&UQ25x&RSy2h;l3%bzE}kfQRx0h)L+cLOXeH5M|B?6HktxVsAY+ZlIHa zlRMb=c3h!+tRtn52WM#ZeA~BG<`ynHYE{&(Rseg0y1D5uBoK;VM_as3Ei%zR|S<2T?;?-7uf<$M$^CMTP@HZ z)4dEq)KQsQTQ0s0!wnaIPeD95Km%bo1;C@Af1Q^t1D__Z+0;S7_$h;rx|k*=sfiFJ z+!bS)uSQ6M79>Vo@G zLciLkc^B((pa*EQ_EabN{X~j=EI_gMfD_v+OiaTN_8w00Sa2+TI(a?Cb9ZpC`eOiy z6-j%44m$g8kzzdV7&moTMvXNN&7qU-9wQNZpz5+=g2o}4lD&puSVvO#lOi7}4Y{|w z0&DuYUv6o@y`hs>A1yQPa?1)l^pShq&7F z-mc7tfw-U9uiW-B(d}iT-Qo3X!RjrM$6XM|?eO_l*nAsYzMjjfHM6M&++HSX4}XnyX|G7RkhOqW7o0R7Pf8;Tep+h&j+4f<-`X2)(%H*^$|W|xVe7?2urUUYyehw z2`9H$x8gC3k3R1cHok?6Z{gxwxVRY_XD_B3hJ}C9aPUpgyF2WA3-{i_y*VSadl<#j zz>)N^@;a2_?*Y#J8N#^R;M;4!wi}?CL$}{v_=m18(!TNR^61V z?0C7`_ENAemx2|PYu|t4zQz8rTfRWEY5&>`{aJgj*|?vqU_0u!Xf~lVI)K(HP_hP4 zN3j82$=ub0w4oBX888#7!uTOwFk|*;x%UY46~y{`EU0-j7N5`&L?Q|Gg2d);+2mc2 zOTM4Wf*t7{$V>q=v)nrkq4EFwpZ`U#*s_%hphpgUiTt*5EilO`*$ySBPpSzI0JEuf#%9zVe_#(R zkp0z1YJe2LAWMJQcQ!&T%0Lit9Qf>iQ6NbQD^eu3lKlKkDnn0QrXsIEgZCn%Cq3$%T8;JF{j z2bt$nlmso#cQ#;dFlH}D)X@FM{cMIFOokBlOuwoRPvn17WLwHer$ZzQ9Wf)MzMK>d znPijYIHZ6AXFRKJ!_;|?@ynlPaW6HQ%RI20uK8RW6}m-d85+Ua(i|G$!EzAQf)>DF z>#8odSdaV#1h%oOkY&B-0s`bH;qT6KsZXwFr#;|$FP%dNfBky-20qRSbrtf@dpg>* z0vk()Q$>Ha+Ev*?Gg+;VADUTqd5U9^wJEs*ebckprjcyGHIyd4F>)z)tY2PGn98I- z81c^sviL-I{>uO{);A@b%}MoaO?w2{iggy{%o3=Fq}G2Of;H0tI6bK!75Z?~(VzM1 zGM(vdrlZ$9tVn4lC8NbJ?052LPbwP6Wqu8F&A5M;)EIah#Ol(Ilk|uOCr|iq3eZSx z>g@ifGx=*-6U&gVDrGsKw)j$w^Lx~NcW+a5KV_}dCx$dhy1gc z(5A53?Y{xRI_I2;YN~D@9@E`DCU|^78w1H!TDBV%Xd?Xkc4FVV#!cLj2M85JrIuR69`x)^(w&;x_@*2e_qE)# zKt;QLq(@$S*qJjYnFYw+PxKoe8O**<4MBdxchm+Wf< z*bRNR#W4APkn)TsknAAB4W!e3g&e118>)6 z;a8pE?t{i$9A*DHP87sYBRTyhtXUC>JWDm{bZM(+6<}OQjsnI7wo@)2P6aX_VY(=ptH*e zhmg7sIJg^QlCqU;qoogLyR|~7(!Q!H3l{~{*vKK8!d?A4)OZgO*iH>sG3bMY3dA%& zq>gP{oZKJ^4+DNy2QD+yv;BWu-9|QdOmf+(RRvxC@CD3?F*P&&g)5!j$|#vd2#~!4 zJr&-Xg*LVyvkX#TC3?F$6(#&$`HZy3lm-@ze57fa;2DxG(L_He+K-h1=t}XKKeWAR zI_-2-@%l4h(QW%Nv8)>@LMUSB`VLnHJzqL`tonBtm;n?2sAkC|XVXs=oKiNZu234V z@NDU3{kN9Ojp)22(L-WZ?WlgOwFC_{9)v!bM1!>Wz0I^R0t=#}4X}KfP5EN1XLd4Q zo~<$a6kcK%F{7ZIJ27Kes-oC?e2=x>u_)|^KjT^=gBBhwl9jWZ%|v1GLWn=;V=KHg z!W1DJ#sFR|7h2WLMyY}+@xW5(H_Ph_gTdbmq5W^$e-YBp}I8BC1r1Z-ezyx^GN-3e8mxQIG7& z)gitVLEojpF@+|%i)W^NL!W)p5)WFsTGI+dVIEmcu`fxH!xUv+uNIa5Q|~+dED5MTB2NAE>FISqO7&yu;<)RI zQVlL+<;?Q~!&TziWY}2LC8j&flAAGGEWCb7oEFV!`P6RY+ zbZr~$FMmg0Xij39j`WWwTf6?ab->uJTD;_s-D?R5oZ!I5`|l=u=u^_EJZS?V;Id9) zF)x-8DCpVVs7_FBkOs#yP0SY6(3;^BRvR7Yu!*cROi$;CMB&9iz*TUp<1*3Z=13Xh z181Oq5Nij&ZGgkQ5dUKeoY-ee-8H%8&F#Ktot^Y;@zL3z62tTrepd9HNU=RTa_eZS z=I1AF4{L8@4(tOOQTkV?tQ2(|py9uM*@SY-pciW>R@*SDRv`oIljI0o z%VU?Wxw9jPtGY%X$6;3}lMN)gyfWWd@t9Ony&_4uF~Q6^LSn-JjDkMd`qghwy+Xk_ ze3E@fryfYe$%81+$`U*z4&b0EbAhn+Ek6BL&;fS*NN6yzY$?Djq< z74{h1`3MY$N09wI%IptcF4Rl$te{M6vY12YrMP z)o|gcJp5F4;zUR(X=L=D=vLeI8}ZTp%ej7-|10yC;A4XwHYO`NG8mY@hcGbM|5dyT z$iY>|#>L$k<**Jo$BjYU_(dCDDD5A z;m;%N6OgFnmSGcjdu2b;PdvLdp7&cQp}FXJle4e_<;awsVE{IB9Cz zA~;yg0ml)u_{dCysgxNfmuqc4bKoOLwT*mY`&~w{X+?>Qo#!at+ENnAtUmsc_orHz z0Mz0y5;1Qg{?0WQD|qCa#{gEkRz%aGZQ%GG%Okfj8>4r!trC`+&4pkBmA^Vr;=mu? zvA^e3VAeIo`Mi#iS-b5Zz37|ed%H<%#_o+Mvp&_ep_f2gT(_hW_KoQCMU)`TRNB9v zP|vL7XzhZ3v~d$dYM=M$zc5VIhr&6?2M4hWd#Kx9ao>_x9={|A?{vjnjB1{(e)`m} zi6iSEZ%S!Qw;rEj?zRsVHtnPUzCt+xx{j8CoMb9GakVhgqig1v!`jCi_!Rx436K5* zpeOxA$L;s`K3!>V`c)=QYOl^kK&~QQz;Z|^voysNx=}g;>s>OAKQ1CDA!P6w3UjN&|@f?0r{KF)R(&91x zfQ8zGrP4l2q0nl~55;hI{FjevL78Q<$xor{5}G(+?28$`uVb6qcA7m}6|jLRzo7>Q zJE0z9Wo7-l4etI{=?c2Q>||EC#M)Wnzn?);AEe;RN{R<*026I~g*SBx^8?5ff*Mgv zH$*E9anUg2`?c9`t>ZAA0!;x}-GY0c7zfT$586Pg-_*IRm8+nPQ3H+24%IN{^pCCm zn|hmuwCaElF~YlnHoKrmdb02@XLqWa>`!O}B!?N*dV5L6yi(SH%VKXVlmouf3tx5W zD{4k{kG`L>Ul}*PvP4gGNQLEVbnFW0WVIM^EO9`(+Pr`!j>CPmMaNgcxoM|yXADs- z5`6v=)k)r`H%VRI4ZkeKMcLGcq02sf8($GPbk!ElNy%^8LmeXOmcZWwR=TmAuGLmv zEM1ZF;I1edq_2N~fS`LM2(BOm7t4jHrloprsp(R$mVWk`hpizu@SEf}GIgCMq*X(j zQQQ_hjg7LkH7S`ZZz+Bs)|^Ky1i#;m<1?iW#Y(zK3?Kg!L73=Y=JB$1aZRaw160p+ zNx%1Hr3S7;UXy@XZpAu{4!w+{?b!902?#jCJYRu}vjF%ke&`=)!!lVShqLnm>$r?Y zik*q5YLBohPV%aUAs|&jQ~;))s2Am^PMa5}zK1!D4yj9mh$K*9S^sm`uk9+m!dzt7I(X~GX*U67J6WU&eWUk=1$U+ zQ^WDrK)OmuI?b?UB%DOT38}g<=yLfovQFLE`oL85fgk43fErr>Jnq0x;rPQF!4&E@ z(foWlAli9~XFi(Zl{gIxd1tZ04{z%iwJORJ^n`S5wI{kOqR~VdJBzpqUks#8PlUvL ziovi<9d*S$)IRnIM}SKFTZvJHylN{(K7TT%QNvCvo#JkU z6R6PsmdNI{czcx9MTk0y%J_<>$o9@p5G=KbcRT<2%G|Uob>x{{ohSEs5tn}F5&LO& zjrm7{%?~j;qyavG$n&l=_=J8GY5!AO9@8TDThm~;cIz}i+4o%nB`+k7r{4oSN^O!1 zPpOxqbRz(Z@rtKB97|uHY1#?uywL>?freii^?x1Tm%avzxW5I=J;i5~&Py_6 z(ED-Z17WDtZGDwQBm`nEV#wOFdHksH(5QQJa`j{}VEh(dI`u@>dgPX7(*4=q55T0@ zM0n|<5e^T7AKMc&BS_P=v_nDI@P*_4jqVgBiA40P|f_# zYcVrJw};)PpV^(uvnP(U*lrPgrysQpH)2TX7itkL$s&z#_!3o(hio&J0jU*OLpbBt zEL-mVsvq&S*La_m(fD1vBg9Ut1P~Y1W3$mPzNPQbz}-5T&U37#19LuV!=)oEw&EHHvL>XEc#i zg&{5EjeSx~^<07+3U5STmdiR-h)V~N=5~xb73PQiT>R!vOxuLX=E>sd0pf*~s|SHp z4t;s(1Wd=w=UUs6yBSj?Y^SQhWhUryu|zl$TlU`V;-V2qV_06jtd*=AJso2dnyvfG zJT~hXtexq!V$}Bp77fo8Ll6Ib?rsV-HpvLb-n73j`4r^=#|K9ATt8dTWe)v7$G?af ze$-tdAKa4&>iRfyx~bC${L@-kWnT72qYwsm2KbxfKiSvX>Cb*`vwmmVlSo|%;Ws9z(U2$c$?y6{&+sOsGyLD$++-lxt+PiD@ zVC&QK&AG+Xb$Ltsi<<`h}1Vr!WLBx~lo$QPTr=OnM$ z(uz06N666+C56u0QZRpSQ!5`#0%-;=fn~OG2c0L0yvFfr-C!v_9S3{r?3OJ%UR#k; zx!2P6-PEybPdKX8jy}V&4fdLr7X}=e#}eKZ1sg}ZQEp@k^F&;mN1sIQS3+c=) zZw4K;KEo684&O`y%&sn5opSg(&@`&`!5A#B_sS#$#Ma$_NIdWibB!tpG2RG*J#gW> z)T88qB&H>g?6_g3A8~_NYWgoj9;?+)g4|)U^_&?R|DHM!bUc+TT2uPlJn^x9X)25r ziuN84SH=~$TcAHDn4B{}H}`kxj*2^Hh?|7On3ZFgD$fH5&oBgp-|H>0{6ryA9FcXYdTQ8LLFgfzt>tE1k058@R4+gN(R)`pTNG@|zD6ut(@nVWWJ1VpscJgUgkt=NPo zaf^_rOXAKoB`f~ka~c!;CN!O3;f)dz(ut*J$pK_~1mS~ z?GnYwRp$13JklZ|;;7^La6Km{meundSgje+pYq}>c26(&e&-Q@(js*g`;MvYaMZ;0 zjN{9Th%4$0mi^QEbHLnoo6Z}s(!He~=wF2vnXny7!WQ}J#4d&@ge=1pKA#%eYZ&)F zuK^HPzDp>gvNLpGznnS8$Rq4Wpw4< zY4RvgZ}Ir-oTf2ySL#8kHmMRUZ>yW}S;W_1W+Jjd)puC7=z-9BISGe@L~T$bozOHi z)em3Byf&VVu3%Vuz;YtJk-B;slUXLxA6U+~j}b}mp*VY@_jJOdd->apd5$sSKct@B zgM{b9sjOmB&=gwROC?5-zh>om5XrQhzIY~HVkMdCm()yaGE7uD?9U2rEyw4*M)Rq$ z4szO=pH@47NbHkxH+-TR{(~!eI6Y0!EU1NwLkMMtl&`tXJ5Kr*qzeQDCx<)L0=fQI z#WEg3#a21^*k9Mcg*q9m4lvo zm;S`F@a>zP6=^H=c4`vqx}f^}sOc|Zy`I`2_eS%+w|`uZ%WM?D!K3{0t4|#q%t}-x zN$Kexk^p)Uf`iTHZ%p*f?SY2_x9_*?%JB1*C8kDs6oxU>z06ywFXD=ZAg& zR?x4E{&LO`o)4C$#odnxMWbujlcfHZxoU*cb`~bj(TRX8X>Sr5|gjH&7as zz`)%pVq)`RPO3IjcamzRdo%Iys)YB81*Snvw>u zl6u@5r1Br5P3fe|_DtG(q-p4?+hkD_yJPCJzK0ZC8d3civTEM_N|x+Tkf$06 z?Jryws#M+PZG6Uv10;2S_NTJH`f8pvEQDp$$;Nr@FOJ(h+H){D*1985KdKD4(mMV% z(HT#;*OD14(b*S7p#mF)n$J_2TrVIAA0Sa5sZ6$anz7Nm8eNxyKx~4SrSzVOF6El1 z(0!a#V^tj?ju?do_EI&~$TotHTM zyFdjE(VxnV;exjjM5@l#mG_GPw~34WjyhS_-&QXZ!`H*UO+)cFU*s?UILh0hQp(iE zB{t<};p=>3PW!=m0ESO8if4Gbm>?F?#VM^O%Hf&*f%MU8mGZR{y~hc0f*3{POuEyN z5UKBCWC6i`5s16^-rpyv*n^91#BPv|rgylvN!PhG{0-pS?fb5?&T5x{Nye=FCr0Pm zQ|+lEx3utl9JFoA*AfN6*b56;tI{kVsD6;Mf{*dQqe_F_%joRZ#nn#Ka*+WO>asUW z8_iVusD-htQ0KrUj>-Nm=frFaq`=OJo~9+UDcq6D0}B5_n%1oor$ayTH0r1%Ik|=& z6kf_VqKlSvxv!VmuufC8`|A+v;@Lfodn*+$c#Wpf@fqmHha~QN3$+dckBaj9_qJy= ztv?)FVv86Kr_edGgKd{sF^u4+I@X&INi*oKa0Kw}JaV^kh-$`!+FIjH$K24dDN7!$P)U*Uh}w zS-=nyt<5{)uaXWDyk6e87@{^vg|OdT)T!G_>T~8-R`C2d7*D)HtP<$$2PR1HuAx(Sg@;% z^XeCtHe3F-5Vq*k_O_SOq%~9QwTHn#HpP?nS`#G|{Z?g>ux?!*pfdXJeNdqWG4WPx z^h(PyBG!BX(Y0Ym$-MIB3>A>uG5+WIgX`Q%TkI1$pbM0lwlEvUO4i7WO{0g3e5(9ls39_f^& zjV^0aKRpe|foetaU$7{$d9Q9`J91uY558wdi?;t7@>cygxct`gR}N6sPDuQIWI5@yz*`J6ZJNHV_PO1*2AUqap7Zhf9#r52*#9yN_N zM(P4Ljmd8gVYiMSIoHojA(_xco3o|BUot(W*Ms#(B!x8?RCUmjiO&5+n}d!ALnEPs zgaDa`aBt>pbNIV7{dV|5=%@&c*0pe*ePxd|DKj%iXYbs#6(FyLFZ(yLeDb6hzPzvD znN{t0akvn)?R%k&d!qL;zKU>K83HHg0d=REoa6XyYMqtdEHko0Mw^dX3^yZ36Tg%^ z7kletHw!{f&FJ?MB#ha9%kIkjyBMy|K~xPD>?@lRfZ*_fIpEIbLe) zY}otJO$%@$b$;xQQNMYT-w^(*D?QSuL%hSQM#HhL9aNAsjhx;kLMA{6Mft>PJ5;x5 z7uA5u4qWM$*0gqDA^D0TkeG8>o~6j3Y{Vb2If0_ols;Gp&goAjVXj3w(K`gCfp$}_&_-LD>y_dH~{u_8aih@x&h zP00~iTxYA1fhFhc5xrv6KA0H>9z2zAJ2a^dHAl>a$><=>Oy+HXEl&*vwc({+`(tHVHVa_SBR8_$L36sqX$ zcORpbv8_AxDI<7O-TYdA$_hO3ND;O>#GpD6HkDhwS@hbt!MEs()>=PopHvA-W+1$8 z@)}eeCX#y~H`KGq!beFzv5n8$=fEavlXw_pa`t4Q|L0W_Ja?w=8jy8#&%JPd`LE65 zE@OP3J$m2!F_6W%4};x&&Sp7#eF@H$1Gg<|(C1tK4${rm9rr@@hC@ixiGeekaYtm` z=EP|QyhekkWq6QN6ivrJWJ*pj7=Vi?TgBjqsdAxqXz|D^Vs53Y#Q5!IZ1Q-7v^ zh#8(rzy={Sy@{ha=EsjPc%mmO#+oIqy|Cr4nc?3b7@4w!`Lq1Kw}? zq4>t_+OXFnbUgO|{$}xg2gn2Im}fFfLUjI(zKgHpLP>jzop%LuyaXTS{Gazohx+`v zJs(s`0%rE8Zo%wTwg&iB6Cbrr6n4wLIE#4=ietZF2S`dFrM61IxVL62=sZV$_N(E`F`NI5AYvbWBIe&x?un0YE5Z8t;g+Vl&1o~RA9kmd{qCKMD zBM18?Fa6OKKf!(HM~IRcQbM`j!_hakJQvR4=kYiQp_!{e;3t`7Sc^2(qi-;#M&5akrk z_1hGJVM-ZyI`$z49-vEPn9Qkm^TjYr)!~TS!ViI$TH8e@g>h6hJw78IBd&mUGAE^f zu&mU}uv}o6R!5JbJbQJfO}&rv$9MM12Gf8x1ZQ({-&v%?GWO0|9y>ZFWga$7X|72i1?S zAby%M`Y*kmM6ja}0#!+MAlqZ-&5s!h?@+avq9*eOADJr~vdXy8*n4`aG2Ko|DI z<8E3nz_u7)hGQ~|PV?i}`uAgGr*e2Iz(gYK{;j-3LS@ZHIQ6HhLW7?{@^4jT`M7ti zh*Uf5(qa$MKdYRX1pzw=DCFS=rU**e8QtVy; diff --git a/Solutions/Netwrix Auditor/Package/createUiDefinition.json b/Solutions/Netwrix Auditor/Package/createUiDefinition.json index 5661eae8397..5a24badfb78 100644 --- a/Solutions/Netwrix Auditor/Package/createUiDefinition.json +++ b/Solutions/Netwrix Auditor/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Netwrix%20Auditor/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\r\n1. **Netwrix Auditor via AMA** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent [here](https://learn.microsoft.com/azure/sentinel/connect-cef-ama). **Microsoft recommends using this Data Connector**.\n\r\n2. **Netwrix Auditor via Legacy Agent** - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Netwrix%20Auditor/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe Netwrix Auditor solution provides the capability to ingest [ Netwrix Auditor](https://www.netwrix.com/auditor.html) (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix [documentation](https://helpcenter.netwrix.com/) for more information.\n\nThis solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.\n\n**NOTE:** Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by **Aug 31, 2024**.\n\n**Data Connectors:** 2, **Parsers:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Netwrix Auditor/Package/mainTemplate.json b/Solutions/Netwrix Auditor/Package/mainTemplate.json index 1e0ff968de8..a9225e3bc59 100644 --- a/Solutions/Netwrix Auditor/Package/mainTemplate.json +++ b/Solutions/Netwrix Auditor/Package/mainTemplate.json @@ -904,7 +904,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Netwrix Auditor", "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Netwrix Auditor solution provides the capability to ingest Netwrix Auditor (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix documentation for more information.

\n
    \n

  1. Netwrix Auditor via AMA - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the new Azure Monitor Agent. Learn more about ingesting using the new Azure Monitor Agent here. Microsoft recommends using this Data Connector.

    \n
    2. \n

  2. Netwrix Auditor via Legacy Agent - This data connector helps in ingesting Netwrix Auditor logs into your Log Analytics Workspace using the legacy Log Analytics agent.

    \n
    3. \n
\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Netwrix Auditor solution provides the capability to ingest Netwrix Auditor (formerly Stealthbits Privileged Activity Manager) events into Microsoft Sentinel. Refer to Netwrix documentation for more information.

\n\n\n

This solution is dependent on the Common Event Format solution containing the CEF via AMA connector to collect the logs. The CEF solution will be installed as part of this solution installation.

\n

NOTE: Microsoft recommends installation of CEF via AMA Connector. The existing connectors are about to be deprecated by Aug 31, 2024.

\n

Data Connectors: 2, Parsers: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]",