From 0e896bab00388fc21d87c09d0699b5d15fefcccb Mon Sep 17 00:00:00 2001 From: v-shukore Date: Mon, 3 Jun 2024 19:53:03 +0530 Subject: [PATCH 1/3] NetworkSessionEssential packaged --- .../AnomalyFoundInNetworkSessionTraffic.yaml | 8 +- ...tectPortMisuseByAnomalyBasedDetection.yaml | 8 +- .../DetectPortMisuseByStaticThreshold.yaml | 8 +- .../ExcessiveHTTPFailuresFromSource.yaml | 8 +- .../NetworkPortSweepFromExternalNetwork.yaml | 8 +- .../Analytic Rules/PortScan.yaml | 8 +- .../PossibleBeaconingActivity.yaml | 8 +- .../Solution_NetworkSessionEssentials.json | 2 +- .../DetectPortMisuseByAnomalyHunting.yaml | 8 +- ...ectPortMisuseByStaticThresholdHunting.yaml | 8 +- ...ectsSeveralUsersWithTheSameMACAddress.yaml | 8 +- ...nDestinationAppNameAndDestinationPort.yaml | 8 +- .../Package/3.0.4.zip | Bin 0 -> 41596 bytes .../Package/createUiDefinition.json | 14 +- .../Package/mainTemplate.json | 749 +++++++++++------- .../ReleaseNotes.md | 9 +- 16 files changed, 539 insertions(+), 323 deletions(-) create mode 100644 Solutions/Network Session Essentials/Package/3.0.4.zip diff --git a/Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml b/Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml index 52e1d6a1655..00157bb97a5 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/AnomalyFoundInNetworkSessionTraffic.yaml @@ -17,6 +17,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -41,6 +44,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -184,5 +190,5 @@ customDetails: alertDetailsOverride: alertDisplayNameFormat: Anomaly was observed with {{anomalyFieldValue}} Traffic alertDescriptionFormat: 'Based on past data, anomaly was observed in {{anomalyFieldValue}} Traffic with a score of {{score}}.' -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml b/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml index cf658b11d02..a7f417f8dfe 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByAnomalyBasedDetection.yaml @@ -17,6 +17,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -41,6 +44,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -183,5 +189,5 @@ alertDetailsOverride: alertDescriptionFormat: '{{Description}}' alertTacticsColumnName: Tactic alertSeverityColumnName: Severity -version: 1.0.1 +version: 1.0.2 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByStaticThreshold.yaml b/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByStaticThreshold.yaml index f9268c9cbdf..2cb5da4bea3 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByStaticThreshold.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/DetectPortMisuseByStaticThreshold.yaml @@ -17,6 +17,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -41,6 +44,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -143,5 +149,5 @@ alertDetailsOverride: alertDescriptionFormat: '{{Description}}' alertTacticsColumnName: Tactic alertSeverityColumnName: Severity -version: 1.0.0 +version: 1.0.1 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Network Session Essentials/Analytic Rules/ExcessiveHTTPFailuresFromSource.yaml b/Solutions/Network Session Essentials/Analytic Rules/ExcessiveHTTPFailuresFromSource.yaml index 21f1f4898bd..c6f2d6342b4 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/ExcessiveHTTPFailuresFromSource.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/ExcessiveHTTPFailuresFromSource.yaml @@ -20,6 +20,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -44,6 +47,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -86,5 +92,5 @@ customDetails: alertDetailsOverride: alertDisplayNameFormat: Excessive number of failed connections from {{SrcIpAddr}} alertDescriptionFormat: 'The client at address {{SrcIpAddr}} generated more than {{threshold}} failures over a 5 minutes time window, which may indicate malicious activity.' -version: 1.2.6 +version: 1.2.7 kind: Scheduled diff --git a/Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml b/Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml index 48d19e45758..1d1efa68ad0 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/NetworkPortSweepFromExternalNetwork.yaml @@ -17,6 +17,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -41,6 +44,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -80,5 +86,5 @@ customDetails: alertDetailsOverride: alertDisplayNameFormat: Network Port Sweep detected on {{DstPortNumber}} alertDescriptionFormat: 'Network Port Sweep was detection by multiple IPs' -version: 1.0.2 +version: 1.0.3 kind: Scheduled \ No newline at end of file diff --git a/Solutions/Network Session Essentials/Analytic Rules/PortScan.yaml b/Solutions/Network Session Essentials/Analytic Rules/PortScan.yaml index ab55c49b26f..2208a39dc4f 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/PortScan.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/PortScan.yaml @@ -19,6 +19,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -43,6 +46,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -90,5 +96,5 @@ entityMappings: customDetails: AttemptedPortsCount: AttemptedPortsCount -version: 1.0.5 +version: 1.0.6 kind: Scheduled diff --git a/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml b/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml index e73539a73fa..b723485281c 100644 --- a/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml +++ b/Solutions/Network Session Essentials/Analytic Rules/PossibleBeaconingActivity.yaml @@ -16,6 +16,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -40,6 +43,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL @@ -155,5 +161,5 @@ customDetails: FrequencyTime: MostFrequentTimeDeltaCount TotalDstBytes: TotalDstBytes -version: 1.1.5 +version: 1.1.6 kind: Scheduled diff --git a/Solutions/Network Session Essentials/Data/Solution_NetworkSessionEssentials.json b/Solutions/Network Session Essentials/Data/Solution_NetworkSessionEssentials.json index a278a22c3d3..9bb15de18a5 100644 --- a/Solutions/Network Session Essentials/Data/Solution_NetworkSessionEssentials.json +++ b/Solutions/Network Session Essentials/Data/Solution_NetworkSessionEssentials.json @@ -35,7 +35,7 @@ ], "WatchlistDescription": "Monitor Network Session Essentials Solution's' configurable conditions here. Choose between Detection or Hunting for Type and set Threshold type to Static or Anomaly to tune monitoring as needed", "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\Network Session Essentials", - "Version": "3.0.3", + "Version": "3.0.4", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByAnomalyHunting.yaml b/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByAnomalyHunting.yaml index 9f709531834..b04401d841d 100644 --- a/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByAnomalyHunting.yaml +++ b/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByAnomalyHunting.yaml @@ -7,7 +7,7 @@ description-detailed: | tags: - Schema: ASimNetworkSessions - SchemaVersion: 0.2.4 + SchemaVersion: 0.2.5 requiredDataConnectors: - connectorId: AWSS3 dataTypes: @@ -18,6 +18,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -42,6 +45,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL diff --git a/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByStaticThresholdHunting.yaml b/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByStaticThresholdHunting.yaml index 93e35863cd9..8fab4fc7e7f 100644 --- a/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByStaticThresholdHunting.yaml +++ b/Solutions/Network Session Essentials/Hunting Queries/DetectPortMisuseByStaticThresholdHunting.yaml @@ -5,7 +5,7 @@ description: | tags: - Schema: ASimNetworkSessions - SchemaVersion: 0.2.4 + SchemaVersion: 0.2.5 requiredDataConnectors: - connectorId: AWSS3 dataTypes: @@ -16,6 +16,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -40,6 +43,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL diff --git a/Solutions/Network Session Essentials/Hunting Queries/DetectsSeveralUsersWithTheSameMACAddress.yaml b/Solutions/Network Session Essentials/Hunting Queries/DetectsSeveralUsersWithTheSameMACAddress.yaml index 0e092be2dcd..61976506b05 100644 --- a/Solutions/Network Session Essentials/Hunting Queries/DetectsSeveralUsersWithTheSameMACAddress.yaml +++ b/Solutions/Network Session Essentials/Hunting Queries/DetectsSeveralUsersWithTheSameMACAddress.yaml @@ -5,7 +5,7 @@ description: | tags: - Schema: ASimNetworkSessions - SchemaVersion: 0.2.4 + SchemaVersion: 0.2.5 requiredDataConnectors: - connectorId: AWSS3 dataTypes: @@ -16,6 +16,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -40,6 +43,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL diff --git a/Solutions/Network Session Essentials/Hunting Queries/MismatchBetweenDestinationAppNameAndDestinationPort.yaml b/Solutions/Network Session Essentials/Hunting Queries/MismatchBetweenDestinationAppNameAndDestinationPort.yaml index 6d037d6c523..91f0fce3b8a 100644 --- a/Solutions/Network Session Essentials/Hunting Queries/MismatchBetweenDestinationAppNameAndDestinationPort.yaml +++ b/Solutions/Network Session Essentials/Hunting Queries/MismatchBetweenDestinationAppNameAndDestinationPort.yaml @@ -5,7 +5,7 @@ description: | tags: - Schema: ASimNetworkSessions - SchemaVersion: 0.2.4 + SchemaVersion: 0.2.5 requiredDataConnectors: - connectorId: AWSS3 dataTypes: @@ -16,6 +16,9 @@ requiredDataConnectors: - connectorId: SecurityEvents dataTypes: - SecurityEvent + - connectorId: WindowsSecurityEvents + dataTypes: + - SecurityEvent - connectorId: WindowsForwardedEvents dataTypes: - WindowsEvent @@ -40,6 +43,9 @@ requiredDataConnectors: - connectorId: CiscoASA dataTypes: - CommonSecurityLog + - connectorId: CiscoAsaAma + dataTypes: + - CommonSecurityLog - connectorId: Corelight dataTypes: - Corelight_CL diff --git a/Solutions/Network Session Essentials/Package/3.0.4.zip b/Solutions/Network Session Essentials/Package/3.0.4.zip new file mode 100644 index 0000000000000000000000000000000000000000..eda2d46c728183c00a54341b0329bf3a13df491c GIT binary patch literal 41596 zcmV)aK&rn`O9KQH000080L+uaST+XgGJh2S0FY$>02crN0Aq4xVRU6xX+&jaX>MtB zX>V>WYIARH?LBLA+c=Wnuj>8-N_QFCDM^;!cIvXTik)OUXD6D-6W>mfNAmCcAC2s9e~?gsYHfBhH68vm|?v50x&0c(u& zJk<}@*G)@1<_RB(SR{Fyzb`V;4peO4>Ge)~qrKTmGjS=!Wc@G`JQu$nABmw%WG+?G zJ}shLzKq+yYnA+4qe*j(c@jnMo!4;hb`&Vq-p zJ$5oaX^&(+E(V1b8O)d?h7dQj67z4X4~;Sr(K;XtfLuROBc;u|x9(kAUyfck*hGf; z7$(@;N#DWaSjf>h_s@TOoxD!&-+!iZ@!h7%x9hc-+}-Yd#b(?S*cq8Q>)#Hc~|%DRn{U|FOuThxE<8 zt?s?eC-65^0pQQ`67+&b;#T;tLr~>s%Ok55a9E}q-P_zUaFwrq2;tSk&d$BP!_Ef$ zbHOjA9uN419?N^%o%(cphXb+6w-0tZ`}$_<2>C_DpJ4g=0Cj;CNCup^Ft;;6kLk%VP}njjANk^nk6a+VhW-n6wo+jI5Y!! zk-*lfOt+ENnUx>V(a@-8$4vZDNEnx?L@+fZUIn@ciy-%%G|((?K5H_r*+fJU{uifG z&^s&VV(^z{*Q&?@0gz=ekK}t1IuY`!+dn>?qv!4b$PeGFwT%?&WrE<+G8gPY>;8S> z+hfBq2GWeh$VC?7NP=7lOMsgMins)@Q#J)?SWxI(#SCX*AkzVl8i6X3NCg)(#wCvm zTKlC8VXVQljwt|*ZM0c8=I;S*=VAbynqA5OPzP@|;SI6_djiOuAe7L!?W(?p)Q-Ig@F)R)kB`n>) z-?!rl8Xk}w`8m^wPY0lDN>-Zyc4ov9z%Fxm0c4})D3L=M@Fa&BWsIMhX#f>N6fsHQ z1;IJ684liLUBJ*ZhdHw%f*tsQ{ZycC8nHhLk-?r=QR6<)NC_KF0NsE10zbs&18jDm z|6)GJ_C0JT`b7Ctj?l9!G%cjvPXx~rBeFP3yDI-!ojE5KNxwRcy2k#S&5z;@p{qak zGy!^itH zBx8kMV&m!KvpQvhubGc&MwlPSW3|ehFp&(KD-~||R0jHyr?O?e+=rW;%}%Sc-|B3v z0KkiO*MqcZ7bl;%frp?Kz+^hgRC)vkb**>A!J5SGi>U$BLmfOGVDfQHQCDRM)P%pAX)tO!wL-jW`<6!&k)Ybh$_ZPkyPzu3GI!O9$>ep z9~B-8MR}c&=3fK%oY)@q?MgENTO~s$#T$nd&Ot*RsbPuUXry3m)xSFePo&C2)!7FT z55<|x2?0wW1Uf?{Ij2@ycBi#B$SJAvejM=_IQiO$r#Tk9sFHkX3C<2p{lGzNR3feO z;TvNg`qK?xm=qD1? zEx*#YCO22jLw|oE$&1l75w9?6Yr8LU(O${LfX!eu;Oe zjD_JykmW!WLyYrsLJ}%K@Z~WojfhGtDzrs~Q;Faif)YR-fx%$-2o;(T32CJ!3nl2G z43joT0`m;48yLQJsO@DcS71$-El1#$Q74KNgU^p)_eM1k3MTAOwY2cRKT<>Mu92u0?rU zH%NIeM65ua9|?VttJD+QqpZl$T0kbeT{7JIR>-g-fL|Q-jDRxXbuW8MHzf3t;!=98 zhv>y5)?()}V%L5zQ#!9EfdxD4HDH6A(5fbX0g1+FL>5FuwmvD;|J7JA{#BWQx0yK){MPhs|<25K#1|gD5nW+T# zg$3R*@(!MnmHF7Mf2q-M2`-=P!-lht*&UB=t}CK*o$B7yB!8Ymz9P);#r ziH3S+m{MXXAeq|%2fLiA!@4#MNGC-+03Qf^ zqag?1Dy+FjMAw|5M2Un$((RJ<-rbV*TsUS186+&7*h8a^+(m<09;+hB7o)b#PE{y} zQ=+j_R|7c)AazGJ?k^H8b9srSnYJ1Y;dwy6FlQjL`u9dYM_97xz7M@egv=pa9>fB`JPnD`u;xTgq#98Qs~xK~5tr zfwIktL?DA(=Aiv=je}C9sgA=a0K`obeIFxy=NJr2BS}n~Qe4hJb&RTVtBh(IN}?kR zzz#5WE@J^gjGJI3yuflxmAJ*i>WIK_h6#KD4eADW{Y&?@qb@+VABH5SF#D&c=xMmxAsM$1jo7lauHNlSUI zz)H{C<+y`yi{nas*hqs_><%3+l10gGpF+s+Pyn&jkSY(cWZiw=X0MZe0o-L5w@vzRN1=Cy!j=xFrVHU zg2WLmfnj19w7|a(E?U5Tz-zcBn7!qV-(#0DUMdFx1b%Gatv zJbDSL(AIyKS{0a86{E3<{bA`DogimJdlGJrS@F;HEMa77{|HmHkXJp1Y)1U5LF9!iz>|x3BA9j0`~9u5Nc)VGP|qJ5_h(V$Fs6Fe7f>T@id zc6Buz%sg3ym{f1NttCHNj^#xTDp3^VSa!`EfyVb4^LPf zAD{5GgS14`GmcTL9+voLu!DHc8pZD!mLIO&zSO(P`ipNWfmd7P9g07^MT2}LE5<5e zRHrLV&{feD1B+4$2{}qtwYyL%Rb1qX81->go>cZA#QR~4M|oX|h|(5CcoxG5H2h4O z|GT*SE-wG7;_~Jzi!il8b*OX@!=EGp?-izJr`g{LcUJ}mRGpC#orG9Yi}%Bfxk)<$CT69VbPnqh;a4l;T{J+o1I{JQ^;v%YC9=?_ zKfcSu@AB}UNgm#09iBU^gz+#<@hV<`9SD=zN`3Ivf=GaK2$JCrMBp74XhXRHW_*YWLG|XVqV+_ik96)v-thz9++P|9s9Bq^Gjg7ZX&*f?N*cUemLf?jHzI$ zdJ%)YXa<=T3(wF3p-LLz>Xa*Yl^OyMR0ay&=p!Ggut&Z?KT#HD!St2HOq)H&DtvSF zK5WvBIA~6yAgw^@1~XSrG-v9ub<6ODPeENG-G1jjRxK`anEJ2 zk}*gZVS$;AJK3`Lo^qL)8#_$>4oEjs)`MGufn6gEs#h*jc`6uicpE_yOzqOa{*Ba> zl2lkMQBWb^u!u~xtF3}Sd%T3)6}9q9E+g7LdofpKbwt4+fv`Mp<#bwkwbGuKcweEg zVCFXH3S)jm;Cx0Qfgk)Ps|aQ)i>xcaYJu<@(`Mxg?o5@r15d z+y#K348hL9J9?GEgpYUT9lyc^uDA)gj!q=ax+ZImtg{o~agxA$<9| z^MG1eUIDq$={Xs9(ETUPRieT*upZH3TCjU;WJ6H-W_P&dkrf zfwL+80Ov@%FR-!crk|8E&s^0>*KN8r)UMiW)K=ymR%>1SxYTFCZ0?R%!YTX%fBzp) zO9KQH0000802P$OSQY36;{S^P0NF(b01*HH0BvDuZd7G$aBN|8WiD!SZ*J^e>u%df zmj1uMz5}5dz&0Q{yor}Ayx1h}?lC5vWaCWtk0@{#Sw)Kzid0C-ZYOPEUt?cypJY!} z@lw1=}P@JVyz- zBy*A!$LQ-aBga8HFU#_0hNgR}W~rL~43kBi-q3m<$b1o_f*k)dPm{ll#;k)NO$sRc zg=Be@CbS>@Sfl@y<#SRXj0(!ZH~Ih`p=B{kGg|fMD9F-04GTq8^5tTYX2pNat7nuU zPK0$cr!3^O)p;5(3+PNKN`{m$&6GE!xK6Xr$~nm?C&~|b4h~nJT`mrfj;mfiiL`p!DQV?F7A;DiMsLzWS>^gyMpc(DP(aj* z&EJ&kSrp8aC|5AaqATb!%+fil{`!SdHyBlX-|`Q))sXc`%IUYO$gS1&5ikiI9v-|W zmkcJU!a=O$6>_Sv$rTllM<^;NjHrASv+y`30sV9^ZcuZ0P?aAX9evs?drRaslC4IY zl*qqU{V54B%Ix8Fda1lfP<&HFK@MX{GNLs0c1~?0Au%1^oD|E&T2cHo{j95$^xcMV zjcsnUD>((csl=x6tXN(x6DopP9OZ?sMtCQYN{KFhPLrrevx`@05=NKHjN|<~3HOgA z`mzM0#f^lO06h`upVHS|p)5jvOhi`)-aU$$fNS0DMP2V>P37=_Jv=!2)Kses>J5j6 z#6UM~gpgrEz_98XRfRJ;G$R(A@)E8*RH@ZhwW_KnyyKkr+wY9i5`}3>M2RZsl+5X) zDxmdhyyAiH4C{S3R1vDzsH|PbhBJJ4P#fj(S&~PWvm$?1RnHH`iokNeYvzQyom6r9 zd_e*_FuLdzMORjPse_~O!Lx>sa}q4GsJN;5IT&whtzP@;!Fb7l%5CRRVEkf`bCLIf z8r=aKqR|$far3@bZBNq;*557&H&GPVLe@T%YJG*ELmZbG(7P^bFRUX#>(cb>8~XloWLff^IitDS^>T@E~tzk@0T%o>;Dr1 zqTceCVtLnQbiw~!h!um@7zfw}=c-}Vgx{)#CleJp#8g9sJUg&#AL)ibNhGx1oO&>R z5tFQ-?J5hQBYhy#zksw33y)%KDC-)Vq!dRjIfe#hCm5sb&M>Z170L^zA}15?@PGl1 z3)l(veFz(yAZ+y9{z?e5s;;9u#PVF#@h4cdh+(Q8aROk}@^lmXA$Gi#5H@y)uuT8* z5H=nO!g5k<0b%3uAuJ`60AWoM!saFjoAMB5Rec8suBH=JCyu9DuJ5a!PF&S63=g@) z#+K%kv9Fp|=m59KRZ-wss%yEn zY1_oJJZmL{o!ucU)4x1~okxPOoD^F?*m-;iOUYD27yu^;VRsXR-O3Bw8zIcAV&u6K zGgM7XAmbqj!i7U7s$n~(hLMRUrn3^l?(Ptl>0chg?ju21PKqrc>^?q(rDPJkuq_E; zZxe()4q;sa!mMf-_#Sp9ff|^Bu3DZBNxSViYN(sGACk~8ZF41rz1<-!)4x1~y+?wu zoD^F?*n4~kOUYD2SYH9*^W}UFU4JE~s6ZEQ&VQhS^&eK%F9z$28&tgt;{FtX;bvfC zu~+`8wKuYco#6%|Km8g*46WZod7WNH0o#uZMkn`5= zUR9$D|GR99EaE%E|6R!jC$LEb-pjxUt=Qf3W0ZW(%i)K*0XaPI*=j8PC8A}vq&x1H z|GgyH&CoueSiW-aoa$Aq7_^`}!2z;0%TW!B(4}(Uff+8$5lG;Kx*uAGZHN;`ksq~w(4qLpc2mr14k#CYig3}eUQzI z0rkp=AgNw!lX@+A^_FYZ4Swc4KZ1e1m|y)MkDO`NAf#JMA>c*ZypZMN7rlVVD-UGn9r;+ z+6saw_>3+|zGA2;5NZolluwOhFgn0k5s7E5OOe~h)LS;voQ_t0Emf~vN5!nU*mA{3 zQ)wNLW`yS`N~&>c_o>|ft)IH1Qf~t2hVazPK0kHZH={*mxNR5Klm^NMjH~+j*8VzZ zZ2gngZN^x$btdv^XiY_EdsiE&34D$c<_Pl{$_O5)(6e=2)m#|5fvWStTLyJ;2csWm zQC?r6p!Y+fB#4*v$`Q(`c@;_;uDNa1T(Ut4RxYC}k}F8b*+SM0ZORrGztS5_84ANF z7%MXpFY*%kvy7mE*U6!8N+U{uMiE^i8nuB^zKDV-UFOQ!y8~XMq*OOMUdP{g&0n0S zm2eQXB;+j&Dldqp$p`RGeNyl^JwTk{L<@%F{9@nL>W2tw<6O&h?zR zY$&CwS8{@~V0NthSl-|uVMuQmT@h#u7D*LT>3pnQ6J-YYguXMvZ@#hnUL>I?WX&s{ z_*Er=_Zih*MwBvM;7YAgGcd=aE(mV>m|5k~>Iyi@X}8tQj~>V=Km5+nAi#kFC=CV# z^omb8I7i>6qtfF|N6)A9-W#E0o2pnS$MIWIeHEQ^%!{gEm!8dqL-4tv6 zm%pq*!E~CastUiSqg$Xr*<_6h2t|sj81%7BCm&{mx2jH4>Yp2^i5C>hJ1TiKL^%vH ziq#^TvwL~WFTn>GZ$tqCVT$2tkrtfy(ne?<+zRz8TM%rEW%xrE?W{{=zw ze5_P4PAS9S;9ASbj9c!g^c$Mi2q11yF& z9kV5Mo04_PYI9BNzMaJX{m=gbn^D0Ho_E&w7z|)}aT9YOL`j$qW5eDC8`J5uS;S{J zr%!5wWfw8Q$x!DSr@(kAA8DY&<%Y4YOrFYDJEF$ZP@&){7%dDog!!Q5Q+Q3m6A=*k zte_z2dK!MWG+QQ|Ud1Uq1BT+t4f^!DX@C~UhiBAH(B29$bR2gydX2IKcpp}((^jh2 zRjTL~{{AI?S2>$A@CdbgXk1X~BO=TipwJC$Vp%E*VM=9rzNz}Q6{x;B33cono~D_M zfK)Fv>mR^k-=pM`u*Wg-NnAfynu1a!i~6tpJ^8YXAfUs8B3lyLC%sX~g~a77>1WEn zZfKsZ(VyFr$T=w}xN}~aUr(h0f!#^0L~hYA%l6&p-iqhCyQ09fSGBOL6(yEwtSE8q zRc&;~SjB-c@mA5ZHEUHXL5ZJ0i(qN#^{ZuGq;n_?!5vdD+zp@V<_c&n?h4 zYy)IC*TBH%j-kMq*}Cpv6_kxtYXZMq0~uQHUn(74JM72zxo;ET)mEMe+ zIJ&1JbMoCq;Q_XiWPp7hf;TcBc)sNl;9J9LQBO9LRyqb*w-fYk30Zthi*PQ0D0OCOx5n>ujN%K&;PU>Vq=na5~K(Nv7%gGT}*O zxcvI{=7a_>r75I8hwZQQr%XAy$E{CtTtthDSFiiE>CYeKn+kroqDv3J&qbm9=ZW&I zjT(G_fhUIo-J?}B*lHB+69C0P0!3)FxIh>m9?ZbY zAB^>JuV#nz(Rib#78zvxhdnU|cwEaLBXgk*wSpXxF247hb$D%m?P#>yA602zdI1Gk1JDd==s!2cEUqC83Ix^HoFc%B7kix(JY zM|^(Ql$_>8S<)uaXevmTFq%h-f1}i7#!B5zP>+C&L#1O|n;rLN<}dQq>_gc$0-Oj$ z1z}DEdV*lh$4ztx74rwLDn2M-U+z#b^gxnCF{L!1%IU+gl4h7>Zl3`9*8!`A`6()C=9_^lA?OvM~u-!O!c0s2L;Ry9%~!3-VF}hI-_kk6CKW- zJj?dz_y>Q<6SvhqGRz(_FrDHgY>M;L;jvZNdcat6Q53LGW3l|F zjI9OI$%C&QH(yrL7{`C{<5!2U#zXz}p`Nb8A;${hrFW*l`-?ZCr`fa&fC)wvf zZnmP+lCRyn>;(K3-Mw4-ag@)#TX(Gha^HP+?RQ0gVY3pxTX#1FWXkVJK-lYQ4}X4n zw5rPj#v0@FI{99`(yjl^JuVlr{hjjnjouadpKj?Qc1*%zt=Yd~Zn$Uk#<0;Z5abjE zmpVxkQf^l*=RV1PWYu{+aK!YJ?u@BW0)b|!9g`rMqnLFKnL{*R&VS5!a&Q`5Mg`mQ zYs$`}%OnB>p`@sbP1-q&c`z0{27jpZpaE;N7>4TlC3E1@dc!qOv*J}274-DUj}eJ+ zM-!!cpVIeKmq!3DGqjj>Tx#RVi*#`}-%3db(2Qhv8Kmu0zfO_s#^9FzjKy8=GM7}_ z9$MTR`JVd`_rE&4UlQ(h{;$3y{2=q6qp>nHNp586rS%LE=LD=JDsI+@ent-sC6F{g z|8$_rw43GKEgF#9M#*7I9b?6w38Y)|8>!h%*Ie#qCYz+MCoeMcLkZWx#RVSF!bykn zSZNz0)set`S3|>7otg)_N(%kg-?tbAA=*%H-s}Otno-5kIbubFZU-}>xst*Yg~E!5 z{--koK^Z~8491!V&42;t*9aFpj7_@7r|Ljb3CR^gbA)!R1(jb$ybrxP>4h;nOV&K< zh5FllNb0uUhopT-+Abv3OIBOBV=)}n?f+DvNLZ-bLhgPTs_C2v6dxe`Y}UF&=s6`< zQ9u+<=;=nCC6%16GWaMfdE0*Zt5(?XByHn7x>kR`y*J)Cmu@DSTTJM_^IW<=U9OME zu9^MbZWrhU9q+^ZKFsgK{8I_@WjCi$Ms|tzT{3^FpxwGaP~8vdu#LQoq6!S}e3vPF7OlDLoj zV2xSb&74-H3iX|qEfldLR~Wu4^HABsromX5F0j@)JB!Tknew>)v~mQ>%H8(NJ2LHK z);?zKW7cEEtVWihz2v{8c|lEh3s>CPL$4_OSwoT_!j2J1pmfrr`T+4rW*{WOQMs{R zk$P$&>CVTvhUD6ZrThZiVv)ksd>@qdLFuUkrM!5tSiIRGCe;M)BP6Y~n7diZS_SMH zk7`0EBF%@0Mw^E~Dj4O}eJ};c#SwogajrbIu+%>1wQXb?6mlP-N_)$eG1*6_eRO&v z(TV<3e_J?ZF)q=jyF{KrOW4i=+Uu8;AsCV%MKQ?(!eoQ+!2VpeS3GysLq9lmv~iax z(+5*t+;?M zZq)hgDl&^W^F^9R1$l|Gwgl|$#P#*q@^NR=7 zy}d@Xdi8AcI@;!iqO9uByY%nlox<3}*wv7&5)0eq%eRs5tEOg$7Scn4CM9@VuYmPY zPVn2Lrusqd<*zSkGbJ53tjJkj`T`-`Kk3Du_upfy86L5G;M(_fqFS2kt1dE4)pT?h z*+fH#nD-z=>k7tz0B8;O!*8+G9|(RT>Z-}c`k}e!_uAfn61~r#_xbaq(yj>+&k9Wp1(b6&0G3abo&ZbXyvHaC4|m(cDhrNOl` z?;o3=ML;kMW;dPeI3rc}dKDk|`S|ImtFh^b9)c&oFF*q@8F&o}p)rpoZR6?cqxFBi zB*_Iw0sF{0xhV6HEsp4KL5BvP|7Y)Qm)k~?MA82@;=V(z&dw1vK}n=Ot?p5uktMrZ zJ9b-ZsonQ%%b|csP{No5H~=VF-P;l8S?;6VC%KvRg#u6j3M5F8a$$QtB2XV$Sy`D` zS(#aQ43Zw~)5%vaVq;Tu_RmE*QqFQ|{+rQn=Y12zE6`~=eaG3{cMf}?we2{YM@RdE z&BH;*JsjK)c5aV!3J)LnC2A?Nr11A|VT#guqcR!%S&2%;?V#6xwR`x=*}UEF?``h& zIxZ+~JFhl7y*+1e^y+Y@bD+~c8yd%lNnACMfETHw#ARHHPxc5EpV4<4jOGqAjGBws$6>Fska34wXN8)Vrvd!tFgR6t1PbO znnq|w5v4U;REnp(L3)W~R4V8{e~6bqsS=}ot{A+XcIDCDR55s?8FIbq#rsz--m~Z^ z5c^#AzIWpg)}exKeEZJ5b8){bB=U3$g63$%Y6(_Luv)?@X$h2UnhNJ%WlcdD#*Dgx z(o#CQe@1;lMRXmFfz~5R#U)Z0(gFJU^A0Jjg~8KYw(sgi`-n=TPP+mB9cCMz##bpj zl`EmsEGDl&`?}zIfE@XYvm#MsCs`AKfXQ&keU!^|scfUqr%mOCXLTv7OIclNnRO|1 zB|+7f@_{1V*+O*|tvQ(wJFgq1*IG6tr#o{*jvl$j+S1Y{GD1+So@Di;=hBnXf}pmh zROFkJs6SVst9oF3wTMhBy7U|~ zT3s4SkTSb|ks0cY8b+qI<6P@iX;o&o;TX=HiN+z?VA981QgcpYjxrg{(Z*N8WKw1T zX;0-YQ^y;2Kau_yR7VgP*C-f=R>80tYpimy49Z0|O$!x_1{#OCcvLkC>|zdT#PVgk z(W0^OgCK^^d8-mdlSWcaH)!H`3kZ93hC?E=(JYbH0Y&F^h_t6y49X6X@K|V8Y5Zz6 zrE#$+Rt1ZR5cbBDdCVYxXBNJ*NZxy(Z;-oMv73^)g?K5Jwo`~&b2+OD*_kD*6t8;O zDx}F=q-yQ`dWrbB414F}lYT$k$c14^TF{>dIB+)C?5Zbkj2>JwhrAmfIrPyChl|n471~>SeQ)WxEwQ0&U z^|kA182UCEQ8H5dWxKaun!UY|B2u=MO>~h|IkUZf!tQ6-*=v?hy=60vx?zM8c|=f& z6hn1l#$CDw-9}q-1J!`L9GqWFrx@fM6BKz};*_A2YF0MaOBPlsw~P1l(@5*--8|DM zTZt2k#W;Ctb(fv}BHg8Hb(hqQN;kMdtrBCEnCDSq(z5pgXpwD{YMxY7N@-PfVQxeiAlOV)}ZW0T~^cTG)Z%F(`&Gcs7zl`V5rbpG9{N< zZ^?t3(HUy#2n*MB%3;5r`M!chDm}HsQ_^7PgH!%&m)$FlBfIw=+-O?V&=CiH_q?Bg zl%Em`z=zO-9t6qm@?k1(uY$WfdT~NBWc<+k8QQ;Oi?`e9v}HctA|%iOy%#Fleodus z$0~i+U_~FR>ph>YS67?MsX^)ynUPwfYJJK9i^NcERj(O?)$}H-aPJoUJ8zV^vm z2X}R>SCz0^>y@=$)lvKQnpXQLY4_?}J9<@e(~#i>q#oz(RTq$+C*=~VnA_z++PjbJ z?Lk&6wp#I&T5*xyD^?o*ZLbe9#>R}X>Z!J#=l-B9i={`uYAvLv+01r^xp49&=dA=M z7ZT}2esRuQi8Fi0Q04j*PrY@TuWf~!6>jqoZr{!&Lq=GbQJ_83EkimXHq$jjt0u{k zYm26qWDH;SE*vY(tTbC$X-4Vho4E|f5EC=XG^M4*--e@;Y_#H(*Ws+1U`t=GWAluS z8qYH}>jf~13X!8|t3g-|!fFsptwESeMpa8_Jd4=E^#${B=QV=#YHL2}S7o};3LRnU zOJG(_JHVk??O@*8f#FpsiXvd|LNU3=K|J+%UB0$e1*|I2gess(;x+SSC~286gMv`B zi0Un#DHMfLtjuUyNVRpGX?aE^q5$(oZjk$`vXSwER4wd@C!{L%U$DZ_*zGBK(CzIh zQund9r_8Q&*cc4{Sgm8Vw2sW?tA>14^^Qy{bI5x>kJyaqG?L6%XVghDt=aoi=AuX- zDAsZ@Ps@e9KV{x3hP^+9SoPvL)eEDGKV~!jt2%|fKxGz8<~0p_gUWO39aF@97V8G~ z29-MUxL6pgqQyiE+Z$90U3D+TP*-k_4^`en&5c^0T|`U;i0*s^!1 z*gI78t;+8ut$uD?bC^Oi&`n}iN0=tpL%WtC!QP=l8r|gEl$3UV|6KcfGgYK)JNxZi zqA~?e>@6y$s)4;l#av#uS9e`Ayb=W&sn#o&f z?_4ptDndNye#cjro>_%~B^Ui_siQ{YFd^dx;Azld8`W>ffq2su!7q05J)V0}PuoyhHf@aq897cwgY zSppFkZsbfYnUL(H=$DuM3ozUudO+|K6Fp|i8O z*YCdCe0AG(H{BzrbJ*Q+U@CSS1v(7I<5H-hfFA14sl`L-hV5?`vQ)%kRhNv0aGJfT z$&n7{{U;c?*K7TTS}yGu|M)ESH+D;Hx76Rlmby*)4?VUjj``xK*k$u>Gr2V?cZllt zIn%@v@0>G`iU=F!VhZB60M%KFLu7WIUER|#$u>w)^NhP_$Nh3?NgYJ=453G7% z)q|I(9;DLjn##qD*V`(n2WRQj(Q{G{QoSr|x@w(zkk3^8jp+zy3rsitGIfNV9jhZu zqa#?4d8->Nr*4qshA4G6JNN54RAtNy%i=X(kqV;1v8+BCwC07SNg7e9Gn`+fG=y`% z7r++bZdp}@6f;G5Lr7qabwAB)p zQ%guf%jX%pwL~%K6=CEH3e#Gec=Jl}o!L$U0`7v95Z*N!fUHES*6J;O%+O0CVDAd+DscN41iiX zMJNO5+#K;T{j7Az8E4^3s=G`badyzO#Gk7fU|9rOk(aD^>MhfJZ7a{LJey6P*?_Yq z1=))VI9qN>)|fB3jW?s8XYnOptuq3v99ZSRDhDRYfeklnQaN~e;bz~6hG3)3X4VjP zt%fj#hG6~UtY)yBnt=^Av%zN7-f>(%SRK#yy651l6-2!(VlA>!V(hW83G7zasshWY3fNFE8wyrqv%5Op>vaX& zo)v6U2sZ1}%pWV^mRQ1>Zg!{O?)lxW4Ft1+U>Z4^-RrK7ByE4IabWvRs{{**1MAc4 z(+a}C82LSC6j=TqwZ(*i;q`3SSf2kN=cn&4tP*9FD62$ODp8pjqjYIA?WizJY3UTB z45V{&nalLE+JRx5t1qcGGj(LxVbeOme9Zz&E8~h>T*Xsw<>qT!5obl*Y$DFaiZvF5*8GEeA zTVj!C>U~$A->YKJhMJj)!*4#+Y~`eD`&*4QTd}OHLQNn`rzhAQu~iS2Q$4WZXEyw- z&YoE7HNQAf{EbMkr4wM*Lz+KUk}a_$Gu`M;!Nv1CT^nX*!_1amUbes0(6Pqd#upVj zhAKc|=olj^_+B5HTPJe+AN)G7umO|=vORb`mz;=F^&7Aa{Yvmnf<->}o0C<7#){u~yw)hg8^>g#pf zXPRl@NM(l?VbGrd0WmG_j87)-mhhS$syt{yrNR%?0w~^PjTKTtvg3sDaJ6o-?$wbi%4AYPM|FiF&GD zz1N<*W1Om*LXY}>zIWmt(}wvx(iR6)3uotM-B}%#4&u@|q)RqGgFE^e94mgWe&D-Y z8&>vV*XsVOd)PMGfC0z#Mw8Lokm>(t-kpa?{B9@tcIn;u9%$H(AIs0X*g557Fcpjk zUI{#O&>gp}*;jGuKZR|Z8+uOS8k}H)^90zAOyYnI@h)`6_nGyPaEdq>Pq$F${spSJ z;WU#}5A|h;ESm$d7f$wLY=vzSCMBQJI~}{fP-@%##nSFC7Nj{6o$6R*H`S`tm9|jT zP@L6=Zau%1LPh)FekRLt!Gfu`P|U`EGecBSx~1c6!)=mYi-;x#^bC^p%5DNg-coEf z4T`Ku+jUucvl)KFnlZs)bb(c`4v$k$9L7}+gi=*ISx8=b$8m zM2+$11)gl@SZQ(Ig02$v=0Yyx%&=UNuH65%P|)ozr=TlvemxlugU4m?b+y47-<&u^ zO1pF8^D$E8f@EXb-L=HqRoxphAAb~;PUMO_xn+Tz?Ic>hoyWWKnE1-JG`(Y#C_U3P zJhpAywr$(CamF}fp0RD)wr$(C_04s^&-bT$t?ndiCE2yBQb|=37y|EyEo49auGmx& z`FWm6bfs{x6XsJ9g#pVek6BQX+7c%3s-qEA8Q|k<(XOASTcMsSurkrV6ZoBrUZwWa zu^~eCW;>h(RdPOjYQ$$0Edc>R@E_hlMftS7YgtgkwAbxm}zS zP$<*W$`f&%bIWzIqm@RbOUvbeqP^y7d3zd(NGX5Y{z{E&LK!Z4& zKe`X{cixh2Qx<&9v0MnXKphI53SolLF@McmnYg@En6jSZT!D+W7_MmczyGcj!RAUJ zBE+`5hO%WS5;isQRZ+zv+*R@tB+ex% z$&pO+Sz}1k&Rkxe|Ji-iuw`9u?;USf{5}+GHr9AH&#tzwdsozXVoDY1kpffbhOKWO zvhtiS;F4DEH$#mZqsQD1v5G)<44|-(b_$-MtdQG4<;dd#+h`Ek=fq$1kqy$mtkWdP z(^fD0jatv;SL5AdEZkjdSNcxm(;cYBKvl#=}T7IPS3!2-5h%Ec8|}1#oPivULNI+YN-1BzZ*<8(wikPzTqr| z9lG4Efhp{8RM1_iGqrXgg*V^LhilJxxa1FwZ%eBK96tQwfLk7h`wpk}9lXDvqge1Sr6 zZhPo+hyc>i#QQr$$fhCgqj${x2LD1-c?!!)*x{!KT8fskuR8$@Ef(>rm=y%cz9@a9 z%L@8_Oo;my5pA|XYi;>{|I47b^nfsMAHapN8_wgt?Zztsx|&~n_b?`&aZ8|qj0l>> zxQ)1BFYDeoT=7~_9}9O!+{ztSPHulZ^2G%={Pbmt>bjdP8uKc!Zc8xLH$*gHzXp~; zpoYaC16Y$Whb0Ex;e>5anV6CI-B~1(Kb1b!y2A;YUUko}%9l)Xw3`+Gj=lM*WT-X6 z^g)78>86!{?U3F{k%rEW8i}eiXVbjOl-pEOPONRzfqEF((E%!4-kbIvZ%o$0*NJTeVpsYoL#6#9r5A zaN_9+=`}z#L&tCjB`V?HKCGY1RZnMLG`LvP6p0(!^luW+lb>|CTTPu_HFf2ZHRNg5yJ`{NZuUEY&-!$VSV+?jNs15r%Ku zWs)q@&(ux5nYPHP}#5KQx`)^l(3SmghR#nnc@23$& z7uY#XvH+JXGn8zE3=PS&FXrz+i7$pB~w}EhC#4Shm1*96scK z?q{nxjc=3#60@eKr_D+te*h0WZa2kcQ45hGa0wJKtf=ou6>1y1=k(-{U8GaRNHZ^N z^}KW^FONMlU<|di5oP=~$8+(dGhaFy*PdYASxWV>rM+l-Qw9i76gqhvK>U7$S-#+3 z&NSpZb`lI7&^w<(=&G9!5_ZV*yqw3(U8y}=Ke8#R@btF^zGWICyjW*$V99-EA+y2& zij5YLJ>-MjM7Ko}WpHMRh_`8Z_u3u|t`I|+ugELUbLDq#W_2e2Nv|Jn#vdo_3l8JJ2FQBTke*ZAElMxF5h& zq0f&vDs%@x(_@d--dos;Zz_otHV2U>3+DkfDv&_9VVR_8&wV8R*<%z0VMF=W!iI%I z59$ha5@K5rM5gtW`s~!E7S_`w-SGYWeGn9+peO*K0jt=@1o`&X0LZe#7G6xDV9Kh3 zuqD5lFPOGpcaXCXUxfupV~O&{Y6Vw51CD~E20m7$UJNDixUxyj=o^M-Whw2{P%?li5Gl z43W}dK~L85-cUUu@d}Orj!}Z_34}X#K;35G5JwmGko@bs!`>eG>MZ!U8B|929x}Q4 z!x+4WfEqtRK$KQ-_m{7aAGaESA0Qz(UFeKgVNt`}w9FZMX%2K~u|+2OQ@TpgJHfBc zBVU*|Xh8=EOaIQmqL&(^bc863;+}X5#GNxdWDW|qXek*_?-n&OD)aH0r?$#Hvq9iz z)!sa(KsNvMyE_;|906SSV}g+naO`&cDqQ~Zv`%<$cuxx- zPx{FUY-x}!ZF(2{tUZTtf%mujkt6>QsLX_k1k%4^rw$W<(_?Qao|~D5TwQKn`gFJ7 zO-KIV?j(33G>|M2--{>$?JGGC^v*~1Bi85gMcrJxO?3+&`UmAcR(@#)LdRoD5|y=l{@-OKU; z>=y8Az`~WYTaT;<$5jsiTSx#6pw14S%!^fy8U$93p2&x!D>F1DtvGUykJT0gZ_1ln zQ`6bcDD0eFs$%=MB82$l!YNs-eFn{oE%^%*bsGa7msA*9*kG59dfaU;7#aBzP)(bg zxIVq#bdnBP(RSa*=TPR)^wn`3MU2|ko)NKcrg2*;ohTNi&a%qnZ=r=9>-aLi-jZ2o*fjU-{<) z1S(H~zBOgTjOt9Mj}n8xIGP)Av=ewOx*_W$mYu*!Im=2kyEw=5>h#a!=PpsKX!^0A znoJhg_7=okWeiF-lZ3;JP>_61b89G>ug;TU7oWyk+ubC?5~Jse>)3m91w*TmU9>T{ z8C`A)9_nUhWQl$4sBkdtejT;QJZmF=g-Kn69dvWDM_ZCcPZon4=Iu3xH_7eeapVOh zfHaJ2a|q#C(mf+3-2alp%+2k!BuqTKJu=!eMQ zJbF2m)c_T@nVLxA-E?j9?v+GLKH+1Jy;eJFvaze-CBO@;Ojnpext_<0~oJy zxeSR}vA$n<(kj+jCe1{f>82?sJr%4DgVGbhu@CA&`vke#2yw#a(H z%&xybhh$&{hW}d0n>a_6#YnN5kLpXXrDMq0LJ;DBt{dwaR|KIlih6_}4Pe=(-$n7S zJJ7LF(`~0u&aCxLyG0iB#hjBlfV)wrQwPrA%!TXrE(Z|oM`C_mz*5@Jb~Hw^r??Ey zaog=3d##n!^iedEVPs|T*F;wEEp6{O5ej7jlt^bF_EDLuIx)Yub>S{R+4Z&~EgHxy zqL!$}E$}E4^|Li0h}T!PM>KTdi@`*sjsiIe_E9#JB%L(K*+}H#Wc*BWj(x_FI7OQc zYuB*uSs>NcPRwOHmQ?IW&evlT{klrMoJpa)(nQiSLn<%u!LZDMWT=$|;V~~cuyT0Vk!}8>U=(u z8@pMkH0u7qa@#Vp_n=WhZhDD(7}|=Oox&dgF*0|DSs3pSPnQ^tJvKAS5MG6CxH3TL zFkS_<3Ry5(2DE5~?NCn7fRY6eo^fLbKw3VK#Sa7=76du(rr6F`Xms{!VOzUw9^+zT zxZQVEr4CZ$v1!*IX*H+6R!fUu!!8H2(bOf5u5+}NdUesS7j9ZcWeb4 z2j$%Z{4ZuziWtWHZTg|k0_U=s$v%uw?5!iBceJWU7+;p1yX(ysc7F! z0f8BC`)IhQVxWa5l9TUBB$fmfiCr@zil-&L6-^sJGuSZkSG&3g!YO1o#cPHh=Dde@ z6F34VIkEX)V}*Sba}fRZ33{m4ME*~kUh~Wgbk=}jNs7A>{Ut&P^lwqvT&C4}3K*wm z$MQbF^}J*K^K`w)EWD#{P~pOdgIw3@7`+Qa1qAoTKOwg~xy6m9t=3fw-+g&$b)=E6`*6Lf+bH0K#w^y~=pSCx-uN&2DCzxN&3sNGj5gIFp>$-OqZ&+`s4tvz9Hv9n63o?rWoLX{5tlW)n}ruD_GE__^wkaooE z-Uw|K-><~r8##VZ@G}8~PPv83cJnjVXPOrxjBX{aE+2ryabG)4#fqG5)UmiUhCT6_d+6$(!6G8MAoSKGkj0JxeCu!L#4tOO$ zPn8$)Xf+X}Rd}lddcn6VWhIj7&5`4mq$SjbOqO!kg60{5oIH=?VXJ5kX&+*4N}~o? z@J*3SHBoaoy)s~LwdU5#N1U%!2A!{0-Q{Zf+~ss!Q*QJllhoR0yRTlSX$I z|9r2{EQ+RdAlMt`Cfy~uyk02d%i4%=O$rll@gio7eH}u=ugI`RweH4M0%Fz?GpfOM z>&(KBkhEPHRdsl|bcM+2dwG4huYg+LigN|P$e<{t%WR&!9{ug3nR?Twlhhs%2odl|JjbmMfL^H-?i}&R2-WI*{c`Fs6lV# zlL=uSiNk0pAtUwsN~0|m{|jVG8z6eDi~SZur$@M;L& zotBz39)|KZARndx@cACS)SKuWOQHXKy0sJTBBd3a7}xYbjO~!NtyAFnk0r%z+#1ukNoct{PNtfmh|Ae7SYOh3=3q_?r(C`~8C!A92 zbM^cW1te1fW_(iREhFU4oKj4Ub+=|$ib~y?yi)bzl5L(zEal5-6N>Sa&S`HHmQuva zC?{f~!tt^uVrEWuDlJoB7!?+_OEb}bsHda+F;t^e;jr(8TS{BehB1lT2zTaI26wRA#jScu8rZ4bi zQxdvMWlvotj?LW(IgLbRxI?iBk&9ZHZ>*8K#9+mFkzbNGGZzr&X`;6^$E2SKFD^!& z7+Itj;8O?%MaRMa(+k3y=Vfs|#_>;vym((<(de_pReOE)yrQKKKVwANFl7iY($!*o zDxO>j%w-RsoyPj>aOY57Z)PyRzUAXOh{cB~2AJI{g3QJ~xjMQry&k*ZBM8dBdxR@9 zK{AK!o6TD?3ux-d%kBuwrR+=L&5lHdxRM~aRF36yujAy>0T@_ z$6uteg{^GV#I|7!!oEayYFZ=Aq%?pz{=Swf3Kg5Cbzt_3Crzya-4nE5DJu^|4-#Ze zLM)ANYc|Y)b<`T0&zJAIpe|msoBnypYK+X3X8opTxaqP$YOBe4?L&zc=R;QOwcmiq zCKc0jym2nxO0fXhp+5ZhZz-goh{z){pDc*tqHA(JmXFpi2{PEGlcEa90vJxt!{jdn zI>jrfJotp)$#5$^*?I)u$<6ZM$pM3SRhP{symR}h#a`0MF~IEMvcLT`8@W$=?~DMg z>kGB6t7u$)h?pGjIvgQ2*j6 z(XCszzXW3jOX6YX6pHE%lCkNMP21YP1ycD%BMyi?*Qs4Gj*W3vm+>dKeLL_$Rqkl6 zBXjM27(FFpqYQ$zyocsPf>rx?q0azNu+kcU2pP;cN6sgn5{>BE$5yxFf9rt7d9f>A zdr;?$_7hpXiK4cD)Vk4j07;Q8)#dctQd2PNrl;q|=nk$QtvXB<#4Vmu$zkSbk7De%d9Gc}OKp1A=zRNaNp zvaYh=^fr=&LHIOp8?#7yPrMXm_&$QWMhQzY zi#bMBH2wWdyKgJc7Or@ep7AK3G_wg;y$T1JHzd-#_xiSpi}*tRvsW*9l^)Ym*BPkH_ zI=qc7Vs?nFe6czkbp$!ZA-A8Ty<}^uE=47=I_#=~43;zEq9N}2M=F3@q|XG7j+~ga z)416JHvZAz{5fX&9+VJl%@MG)7ZYiYESo2$2<|=HUAM3FugT>>uqa#@9y%s}EVpBp z@MG`&Fr1Dn_f6zP`C6JAG}QVnpxSf@yh?!W0Qh_iEdD5OL-b$>eAq|`{H%GiAPX-f zo3}q-L$oPg_6wW008hv*dl!?FL_`G^u{9C1QZht9*9{y0g@|P}UZUMx zBBI@1F%WlI5suQsEr}ho}X1dgkhtNGrfa#^XB$U^JHr9f+ z`%!7EV+`R`PxvOocY5@s%>|QMx^u#*4}MQ5lHXh;v)lybJ-9Hte098b2VV=-lj+qG zfUAtmm9%NE`T-T^)0<>@FPgJ$G`rr{$?=^x@Cet+@$IMClE~usXp-YUG2)0UBp76Q zpE7S~9Pi;9XL%1AL-;LF4{*Je#@u04Ccqc@UK}R)WLrWkkA?Eea=v96^21y7GuSwo zm83|QGPsnm6F_CrC)RFJX#HO+2-lE_5g_kX;`{rPv~5EXkjxD7l>-Apu3=_~%z9_sODz{Mxo39*<{L1>qt0R&g!?sorNJ}p3*calO{@guSgv;)(LYIZv%aVET?go zVkNuOH6!j6^P2+;C&)!KQTCeH{3B=Flb9m@z<=Vrj2-+xasG$1j4k^A#JQ3^;y-cr zEcg}YZHoVibC=@kLL&S4n*|Ihi|(m5^B7`-n~TXhUi$og$qS9V^HtVmuXE^E`S>de zi~me|-bMRQm}!^Hfh7F}!oc8v}>4 zj~S9~!7`!jOgrgvBD6ei!4|%s#Gw4%L?EJDR~~pO8QkXx8ShrH6X_I$2)Y)~P>8v8r{)D+BE9)maAk)= zwH|47xvS@c13Hr_opJ~C(i~nf-+e}ZV5!A!efZ?7EKk^Z^BTYhYE@M`_*?}Pe7^c} z;HY(fV3=9L8RvJ)6;)ypo8H~hiA)Fmoa(76;mH4B*{>Ts3mc$SPExQN36DsFkBGuf@j?vnxNib=5Xh9Dbji?OL+02xqZdj)~V}x%T3oe$7a=Zz$c*HUxhHg4}!|y8*C2Aj`<@3?u6M1xzK%}%8k>mYe z1&@MPiSiYos1lt*x??QLbVqwNC^BXwpFP6_p{)c7E!Y3D{ z|HJY^`2VmhC-ht6|FB$=@INebDW3l}^gk@~W~~~ZpD7)ksc_%?i)&Cezv*q{UE$(B z%06-UGq2%8!NyYa@Z<_zL-|t@2{3h#%`9UxD9gc}MKQI-otlnA+hoV#k7SpFA7-VS zTdKc+?`OdPjGtzR8e`AH@93i?m(XBG)KF9Dyi_@@x;9Y#@Lh4@SnXNFN|ny7ZVATJ z;H=uUz`%rlLN%};v0dp}J)Y7qt-9PsrCt*+w#3!t!J(eUlv0*eVaD~9*>72HA@B>c zR+-G=|6r#5AIugO6@wQR<6P74(;d@|}0#0u74V8e9cVS>3StcGix?;x0mwoAbVHH1|5h*p11 zNZ#Nz#~Iz=${2Z;B~-Jo>h>SAXNph&j3jIjx*R_MQ#^L3!_;A2is5fkJYQQpBG@#P zRm_iK^7X?7^&;Wz>nbC@)9jJOw(5g#Gnjcta@aKBB2Lm?igrl`4fucAMq#{Nu}0CZ zamSR#KnuNZF4Q+7Jb<;=lm<%c8$H>)A6$07l4;+}L}%$jp8ePnva( z{h6LK`wb>~fqU7Mv;Q$LhV*G!Zt_aWd?zwvPg6nkFs&XLUB2*ioWs8#X6#I=oT;HI z(0|P`b`MT-kNH)**9?DDMr!QDy1w-MGa@ zzQ}h)^=h6rp0r+eEv(J`;FIRAuKS*}xE&!bY!0$n;s!FZFdDn6%EG@P>OH{RxAGO^AvYVd@c@3 zuSMSrX`eqK*ZLMwet-1*ofXXK_Sw%R;d7T;L>^MUEyFjtNlSqQxdeXP4>0J%22EPj zs|VuR zo)%8*^Jn^j!Wgk^t^T^Y(!c3i#q~ri9wR4EG7{-;j(3*rl*U>Fcn`FLq!LjP5`J4o zlhf^2PVhNA+Y^y|T}NtCrWZxNCw1)?QE9$6Uf)fC5z%2WSPmP8Z1C#IOCHS?{U`sS zG$dkISoI=^;+!(65g@%;EkJIXC^|g|ox%#>$#~r&Na~nnC~fH&_=%e3 zo6x;b^`$^CFsbXw+Z;xFtu7hEbzcpz4|MBXlx29q@VZ)8g%$OxtOXZcrok7(Sk6tBaGHt@ z>MhVeS_@%K&T54wMbNr~(iUEZ;iQd6M%WcyxQ=U;_a*-;Pj_pV`v>+Qx8i;;T@#zN z4z0Zc&##WgSys-ZWW zf=c@@A@7R@I)#(3f|I){{&_sq)Q@HBUp}<=;l-z9Lf`Qe#%JBGe5(5O0(CzvxA6V{ zeE7PY!IXmOeUafHm(f4gZDI1uhXAsfmlwZ$==aNq$qBqly|xJ6W9{>93w(DAT-#da z?@iKs*g@aW?EL!Ogy=XY^y9jE2uMGhQ*Zj_oBIn&MzXs>&IO%R+iu{~CK!HBA;{{H zYSHhMYC0$fV&ue~^+wnhpK?qSLJUl@#~+EFJ#qaXURxo{YueKGM$gCfR&0xw`J1u$zgO@C{{mJrI48Y<>DMn-l9d#gZzA~wQh zSN6rT>z#fOXLNg%CDV?oF5z#ul>&ru&HI;|Y?Y+=+|BPM^CH>%VxQRwz!Rm&nE?h5 znZfBJC8U&I&3U~*O2ECTXClqx4P;shigF?0#x@EL-`UJUSlToRv^u1oCIh*@GBxQ& z$u?D>JmIRCRy@rX!e*OX2|%Y-SDYwz0N0i=D84rE1sl_pb=9yplZ~b@Otd~{?_U|r%HE?^0b~M8QjND(yB4}L`0_@= zueX{VuKi{FD;0aYvL^?J0D4EVDIZa+GXDLp}pABFE-pZ|#4#+2zyh({h$HUm@ z9YAI|`>ZLx%h!RWxBdbz6jGj9RwQ+wU%E$^-AAvV8Tnj+Bos&>Zza8s zq#qauuwV`|`^Cdyf(us03?RU|; z6t!aWIHHwrJLT9!<=wivpU$d?fpJiH56R3U_fV>^>4y18MMzW@*U0u&>9tmOJZ%sS zmp$$H0m(SkSzldl{C7Q#u^!FK{BobzSW@l>06ilJYuK|)d0%17(?3reTvct~ZCfvR ziw$2d)9Q}{t&hHL@*%aFj)E-{$$4|qo&xDNIzM#XBWfE`m|Rdcp!~hclA@>; zMUT#$tcw~Vn)P$hi|&}1^m+3~%8YC;6=CZv7+JzI-&BC?dF$M0SC;cQv_CII>kNd> zLQt%0hh=6$4;i3+WYgfJ%DT&9f2Tba_o)dguqymPwJIdZ8{6ZyBdXFS%Q;sY8_V0$ zfn=!Z3a-Z;9xvCa8@M-f`9oEWtFX9jA`b>BxMlzDv+SA~Ddco5x z0Z@3O^Gt!jDQuT>hAm6{B>XlWs&FhvGxNw`*OWQ|!i>C&772o=(t8)j&x$^4ZR)}5Fg)@{By>eif$WFyem^xz@uCTb%sgp%(~*9RmFX2 zte|^dk2Jo5K|!8VKGA6$c&5>jKaEPGewLL;Sq%qwXK&6iaUkc|q^;bmNbxH15Pr?N zks_7TMmDJx_w29HtkU=i1-Q<$%zCb%P7@0!c`$S`>lqOCyl#IX-%90FSaG%L|Id;Ro!N(N#L-Gl&d0wLyp+M61BfISqy|D^s zQx!4NXcAiqJ0YBv-iJlk&L9JL3xiTqR&iPha}!OHo9uYEtd!guS`XqY(F1}-OhUEu zI)jj?>qOGW%4m9qOeD!raz;{FwxPsI?p1bS$;Ep-v)<{_%5$CSU1k5+R*c;G1fx`l z{)~bzh=mZ1ScsA&KHf1E4>b)3SygcYf$JTi`)y?q(+Vhy1@-$Md33H>i-7YFQknU` zd9M07vz=46w}D;q+0Un=T$7doJYd2JWe!>otZ!{;SMS9fTmOXwf1|9To6a z6HsP3(u!0^B{gxLMMX|t>8wv}tcrW~w^#+rZCSum)pW^*6o;l7%KpWH^i#!v4b&`-SRf+fXdWp- z4J=|+qal(JA?Bbe;7_%!?4wG6HglH7QaxDfg{x?NvS%o zL)do$N}Zto5;opO8NW2OFfJxVVqIa?J=t4CstP&}qo8G*mMH!=!CV=~7|LH23pPZ* zEOd^DjH6zv0L9yBOAQ(bx$k#eDWc3af5(+5)EX`#-@s*xIy~RBDu9Boy3xs^SuARK zgoSECiZaAZ>UUiAD0zMyxXin5i}Rt^{lo1j0ISnEm~$=1I{#Pz(N(p3W9`EZO*vbK z>&-T#=l9)GC(&ySf{3dr%hUij2UM5_hSLn1kGYB}>&anjH8!UT{N^)?tLySOi)y?> zYKrsK*PLRcey+SPO{P`EgIz@M*30}pmHa}aFV4w0*I44HvdU)>TUA<;N&71$T@F0~R;|hGL=lG4u#RZd z0!8qu9SgiqtfO2N)hJ(8C7MM$QD7Q|j63Y`Q_1JuzC5|9irWzok<~W>|z*q!85_qVLs+oQ)7vE1_6bKxOJ)A8bO$GnZuT z5hQk}H=Pjo)7%m@aF*(vYHSkQGv|}_?Id>lMNJ%3GwrUl)J5o_R&bbZFsjIFW6n8GGJy9r z(*%v=0%p<&OfSeyD*P_~7c8Uh&x@Vzib`{sT6!%snuSJtVMGyOm9_x1tM03=7+mCD zpBw{SNwQ%%=6zyN($S*sTk*~uZ=o3y#yM9O9#xA{>1Q_8NhEe^&}3?wQRcqnkzJFL zS*iuJ$PbFR%?h`s9{PCf)mlyHEba1Ma!Oao1%6&3{CjO7rvy9aKnqBj9~6XB#KL0| z(L`I0g?e_OcEE2<5X~12ucA`N?~;k7k@aM}C;7O+YOldgB@oV?!0r15Q|YjG^W-QM zYRRBTjz6rNcTNA-P{Yb^LmoMPYPcO*PK*2vx}SAWg{e4^C<)t8QwbRV&K7GIn#T9X z$~N&6T3?)RSJz)3*2ouUCB1!hOgSIsF^|#Mh!x_b-A{*u7SK4!9B18(*hBEEtO+0` zhpJrl%zO@JE}EimYJ4i$UGiTGHXb&?Tj;UFJf~+NB`?-Te98EFr8+Gb-o9Q+4mdJf zFM0W@4&~jU>LFiNb#^kliOcp6dn8#fqXBw%bb%h0JRf%78HF5??MVlU=-XBSoOXg>Wm;xM-GNjqfiNAFl-e$7K zt*v+�cb`nf1*E6YeWu@HPrM{++?I-H|6fU+{%JhBg!r>F#o`jeYnWt`pK_a?~=W ziBjUr_b7K-ZvoB4^&phe)5oXuHJ<&-GD->dSOS$?CtonQ*o36CA|b*HT zEX#UU%Jz*$%xdO$*&K0Igt%eMw?@!Y_4*w$#2zYC>C=8E_EV8VUZBlh$S*&f=%_B? zMm?Q067irDsFpcl&bY5b^4?Uhqx>y8=HyG5vlZ$$5rC7@fjXxqqK%kkZ=)&tNaWpK znW=}xi92@IJpaBCw_N@k2>i!yJ`#{#5$8EGRrZ1W6)))OqG{@)sadP~_Yjw~BIXY= z1aZ#wd{v@49`%tktQIAG&XB~LN5`lZWDg4xpIIARrOVH9A-DE{f1KVf0O<23+RWCh zeFJ}N8I`P89RA?71rGmR05%E4gS~v-Ne6*9l^Tdf8=GXx3~sYFwf}eByI{3o1^%dc z+8q13{)g3x=SQHG+GRJB8UryJ-C;)6X&pro;XmC}}u=Y-bq@FJ_ zvJV`QUauN-Fhz#27GGEUmZhb2vWO@?%3y*yT#PzfZ#rG(E)_?xg+-qvx1&2k;S`G_ z-5t5OQ#KeSpSkr_DP+rxO8dZ5uiJNqnGH)FSYQjq#(e)D3bcu0in_Bm;Tdp^x;8|Z zi|MPtVN~0c7?csVV7V02I%s0}q8UyE5y=Z`d7yFunv6%xHH~N0?65+FpDXqxXMLEg zk`01ar7*j;IEh1ROsLB|IH0JfaeDe{OG zW#qX=J8$W{g~f*Emz2hvXD;yU+_(Dbf#2QSV5}_f{-mrOtC$!ObuhEe{+OP0=B8`a zOuyIvaXB*=XwqWFvRF({jsChA1o(-436WWcOYO2)oAi3z`E-GETxx+Ua61fjN|kD! zx*(Ew7dlzM2c7eTPL5WtWtprqxIK@vPCBTC>7RnG%M~QL6sN?HJ0gGASH_z!!X?wU zo8W4G_~IK#cX9cH{u*xYTHz@L=~=i0n4k7I?eN(j8e+UUeM+d{YrGVE7ZLX^XU}Br zctm?T_Rvo0PHHO zyojlCB9MY@A(+sGm(e^WiiN?6a;p0IQa`B+^#J=#88T;+DlCQ5jP0t3H+96fMG&b7 zrWFSMT8I+*I%`C@hkB}(7|dMB?0@Wk**U%W=QaT4ZpIzJIwQ=ru=Wzm^_17lyB1<7_PqV3JV*G(=Z@z^j2?@#p!|P0Z-K29~yi( z@P9l_0}Q8(vpM1duf}NqNq3J!zd%;#d-m_VBSzpF#DtUdzKQ3{9UPb*HbysixXC5| zHspcH76X6*>=yA94C_A7PQ!f53?vNOXVz?j2t#gnK^T((i+_=Uh<9r}D5x0=aSA)~YX4LSIwZ(2 zBB~$&h@N#NdO0Cjo&Zc5uwr+HEGqxpM}s($E?m+7%=O0!<3S_IU$Ke1G!yzN`&7_G z8m-$#Kbig#hh#=Kd%pgQOLco~=Q_W@ z9EpJD`lCn`*pO~AuH*3VaD=TJxQX5fQf$+QW3dh6YF!GQk5)n@sOa=}GT+FFBe+Y% zaKi)D*{z|WM3oVFNeOf83j~(R?I*m18Q<^x9FQf-f zWSh8MqaA5QwoVH%fqS0jNwrahmVxpOn_t=8EA?b z?xSK*IZXCUCOf1eX@n72(V6J#ILnnvn_MU2Q$0?%)pvc@a%VLdnJ&1-=$F{V_XJ=Q7`r}dneuD~) znK3enBdBL`WEU9DQ*Tlc5a@&KU6{a5lR+e)L!uk}xa6|25PM05@<`hC#V8QV^+Z-M z`bAc6&aSy4x_oYN%j?+WX3dLzQ`&{OUtV4}DJ<%mEK4MuTr(^FNRS*PYseLyBfc~2 z_CrFj0n8Bb5EiWfA-Z93otmJAs`fe2x-5MxvL3K>R_7{juuC^y20B&>jF1Scrnb() z&7o*+LQEwpq-w1~rDfrGJ= zbd3egESK4|{!C=6p`BZ>Ofh(Ey2=CbA+~`I45$KAI<&G2iiyO2=(0P1+`g9Mm77)ZORb~ z5gqk>r|j?r59}H-4j`6Tqs3r)_n$QgMYs!eX8PX9U#9t%W^G%R)BpUGMN$)l>y!j- zjp}JSwWaf4K_;ft9xG>y?@kj-6H3BrM=T<8>#bcni2_TOS-MQX?Qe2Xd)Dut+GqEv z_R4S;2kDm(P6g2aOqCqy=+aK*{*tO(=_S!0Q&IppfL%6~(rW#+dh5T|-yDCLe{e5t z9kYY1gpw`a7$NG{&8fYL_gq8Nx=b&y(yprb23TR=AvJcRUL&RTc{b*Y1 zW@W_Dut=@*8oX(+X+frJ{1z9QWY^Y@`ftBC1|z9PD|%Fn1#ZYgJR{4<&B<)7Vt_B&*Tz<6;+soEpR?1z`VXcuZ)9lQ4!b@XK|05LQZy8X9O-fL?( zh@-m?d04lqqkW2>==sTHLN9&mJw!9G8U@;iHUSr5U+Ez{?>2M=_4z(9Yf50SY@6X8 znagN16I6oYrF&gKN34IG$Q?_1+6jY$H#7-u7nP!zh@Mz1^-$DYwrr8H7Jl5TYyIr0 zsxq;f?bA%9(bvsSnDqB_t)1t^GF;RALwE`CD?M^zjVhVJafS~!wvqTZ zr(8Fy@eWUo|GmViE|@7#SHw)cQjYaevZ=Al)G=c{wn>_TXe^Uwk8ttN?Xr|~5Io5?A-jnU8LD#8lz+?%VqI9yN_vd|Dp2*ma=HSm z042l^kOx&NK~kEM#eNJlO_yaaNb;teZGt%hldqUoSLSZ!ikN>c3r7=sqtH9y4JIz6 zxX08F<%mHOcVd>ZrCfOFMAs_87Nvco)ng7y8R^8&L&6`y*mOV)YoK9v%#&)8y@N); zVlt!LvEC1_1^laevnmPW!Wt_@>lDS}=xYsSG8I2`8~MPaX>u!{Raug0@**GT<;T{3RLW&rqEjub=P(0Ch-7YxDvGSd8gPBEgDrio%d~g|^ARZRdfR{U}^s`)E&<{f7 z!E0J4>;}|2MM7DYIy0vy_HU)3^(=o)Z}fznoJS$WzAiku4ww)MGg+nnQNM?}*f?sEX79daPC-WO$<6CZC%U?^^6R%9 z?-7&wkge?6X8$u;|5-oXVYzG10$ zgUd-;yZ1_>Z5FAjEz^!IQmjiAU2m)Q>`#Dxkn^w(MvTn5c*NW9oIhHv+AE2Kw}2OD z3}4(CTsX;3iDxfnYf4A7Mr{dTM50Y&7;eAwa+Dt5`l}yu_94Ib=XMN)xSKIXL&p_% zg=~{EWg!{E5UpaVMI7lZuDl|uw ztjQ^HgL##r5)rIW8@R)+ldM~BI96=`t)$ULSaJ1g+doVWK?$Oip-_gmU-XvMkTAE&W?fb+r5cWFZlG8O%;86BCYN zc~c#>jf)A?-wF(m3n}L!zSS<3IoB@Lmb{*qBGsF_hW41h#0gJ)JK#AIZ?(*^yJ&9sL$HJ#ala zhl+fg^sI!9(X--c#`OgTiC&tgnCjR-e7Db;11%U=e&V-p8+UEA__cAS*~?}RQQcRl zmU}@yxq8`{BtPI3^r;y$->Rs`MH2th&YCMvZa6P7DzC_!*nE^JO$)IIcA-v4G=?M+ zBsNUoYzxFD{$jW>@SIxfK>( z$K{Tx`E^_16HgH|QduZJVsOiRD&`M|%#Te*E|AvMaC&68G( znlXpHnKmb1(``-`cpWMld5^Vp{rjl$Z};&- ziD-kS2H+e4M#rM*q~ddO`Ez<=Uu^)%c@lKo^COIk1Dc!}envi`RX;<2&fznoLcs4`u}NUGOQo+no@MI0l*%_)j? zc&A?-Zd9O&Uxu&?=H)pXL+vm4QPL8vG4)#Q;&PaHOpX$*%YZ57*MDlMQ?3n6EQQr>GhZJ&l7sYOk1rE zNJXb~1w4TYMKWsUbD2#cgCE-WY+#%ZU)46swd=39ZyEYYU(xU)JXOwbq;a`?WJj9f zUOR-$BKV;;Qri@1VA%z|Q4{4GIbZEzF_rWCWM$ojn`!q_rL?d0S@l|IhiV&hip87f zdaE(kh+TQ$W)K;2OfpVjTgQz2OIYsvhgIA*6Zf(jDu%k6_9cc2k=vJ}RqV&+`cTgO zcF~8FAaMlr#EabtEd4=cB%@v%{jwm4KfWtSO23cyGWqDl(LR=XTCk(fh-)V*K>qJ% zuP`!tLv>?c*1ckmKmUt^0XnkHcew#Fre$2W7Jy?R=5EH`jjL;f5eG;YI}Em zb|83Ab5LovUFts((WqeJ?_E{FMdI+r7XAn$wF|s%{(`ill;!r@f=f4Z9SRELw<|Xg zciZ+^H?nvEjUSt6DDqjs*vRnA<^So-KtW zOmjMe^QeOI3?c;xY}IR{zY^Tnt(}@WJEmr@79p@JJ+ieEShz$JMUA6$cUkVi^lZZv zfucuOrn9tpacsx5nU`}TM&nyLWWS<&dvB-h#EW9|f;*X1F5Y{I5n=fC;})uC*bbyvDC*UTmFm5asb*SOMx1mz#CqM_D_db!`#oNAt7Nu zuX>6Yw5i`JO?#_OTT^>?q`iUjrcGpcXJ?#YWIu(}_0G#N?v<~YqilkHpI0C^Mv0lDb#aywCk$F=?nual|8<`MGDh z3dF*h*H2*=&OukG4ejc%exO_mTXXl0FnE}I-uHfMa;~@UNL4+G-sFuIjP9X)naS^^ zK-6ANu=1B|Zr&>8oRASiP~@z~V`e48h!geUmgqb13565$yX^tnCb3O3&iWi-tmf5X zz!&e|4(25XPGa*1ayT|xBWOkHsb!#v6j4OF^^JUw55K8W#5cOvUUQriU!CuI$z=Yj zmiQb+(-bN`cNY|LFGm*DB-M_C#4I8deVjJ099`oxmsdMEm$N+@3!L1QIo#v59Zu5( z-ZmcdZhK+P_Ze4ouGD!~f}LAupIKid6fqn=>>gjMNj|)0>I41|Wy7}V0vswrAsQzT zRSrZar>skth0PgjKlN(x!N)G>&>?Le__Qh0M0%&E7*gL_ssuW^Qkj zf}9^Vd#rX4-M^v=I@azZz2B%ZC$1^(dE-utc0c?258BB*m`@Sb3lL!HckMP{a##=T z-2?x?fnCbY-7&j8eAaNiTF>M0xy2|nrjd`9@|=_6#cgVh!?}#Ejp;{-zIs z`eB7)#VY^;w06RkZvhgYm+{Gn0Oz**)YzCna1w8e&k%u&1HCr8-7pws?alQyV0>b) z&THI4*7@$ami%m+nBooY85e^iKhj4IW|E&bm3ZUL7ypW2zGp9Ph#QGDMVK5RglnzF z;6f1B&=Fozk-F#bMErHQ!-(?1I6bHga+zxGQ!q_ZYc19ihJ4K~y^v@s9bqfjX=(jJ zfQk0Jzab%dJI3)`9r|*#DS>i3_Wt<-{Y5yycbr5wkghR1g8NHIteQlYmdYt3XXJz` z6Dma$vF7L5TvU{KC{!>R!l(0{`qzcQm#&_acc?*`OA6oCrb)0da989G?zb^Jg-Nh; z4lzFlv`pF?_AS2YbI!33F}e(16=)*69t?ihr6-m%2uD+;2uWwG0V>mqnfb$c?O}&t zraM?6vUyXth>{y6b-Xkes8vbhe)`c7`rgZxctbT!^U}0XHG>)tgGh;svP7)>9K)nfx$cs{EJ>3 z%3iTpl;nKs{5%N+QU}l5IXf1Fx^MWveRxm<05vsJ}Rwxu&=puK5Y_VOp zx*8Shxnlfm_mSIeUd#wsd^?7tZ8hYgHG^l`Aan$5!szJz{U#T35{jK*fYKbQfU$R( zhoK)Bq`|icwU5j_o7g4kJ-on4a!o2a4S#~EPGwlRtOvNpcrn@AFc>dMyBu?Klg0Hr zERSf&YVdLA9|5mP`+szG1kw3Klw59WBI>jJh=M)^qc%+}j3q@X3qaE{iPBd@*C~!t zY^wud8k^PXgV@-juVm_luMb!I^!=MgAC3@}Q1TmnJoUYT?XeSP z1M+c)c@axtg13yNCQ__62lFQ|ejMiz4|O9K5Kd}HrW2O?nLqUY&Xj8S$p+^aLtBeS zn)c@@Fh)Mte4gmbXTrqs)YEHszw*!uv37;1uLx!pB2g7B_+8_(9iR<;F=6ToM&ez? zN}gT@Ikn9JZsR9tU>~k}b~W`B^FlO_1ekJYr1VEAa9WCx-XnSz@?c%<90lr zwarB<`7^7tH|=%*c7%c9C{}frrPjrtJ~V+h3t#N+teI!e$(fjtdbhXL99+p%;eJR- zivMc7HQ7bMBvKF^-IT5_UCoY3nWH_jXVqQ0pj%v+b?=TDt!@s(G;gQ-9|D-5-g3Ebr?d zLea(y{V_cUvfoY*U&hz|bb~az`}YP<3JQ+k1oK_?ZYTUKjio*vxs&cj}IpIivMs`-nQR{ct=yb+d)8;>#_3V zu)u^^tF^Q2C7_c6ZAGHEd24`&9{#MBi*IIE4H78eL1X9nfN-GkUVb;WWko?;E$H*# zdCio-J~Ud^539KZb%m!#?jEnj!&Og;R-5xOrUO%;P9r2w&rLSP`ZQbVhw|a%jYS(TDZlVc+{!L?d5%Ty` z?SSFq7!C>~Z1zP`f4T?%_V<@Ft92PvpRCrXC28Q{SQrG*DUCYH zNJ>v4MNstPc%8XtnHIZf-584M0u&>oBY;)Ub9CgCQzE_#;&;Ok{o4wv%UmEeUQ52N z(3&sO`7a4UdKy9SNWfWA2GqwdMdGL0%R2$Q)tmJT7poV}(4q{E$BSN&-;B%Q_i$Ki z`_Z>aL(0sRCQ-=Bgw*Z~tcf#m~t8tZyOjYxRC#7xBO&p6l`y3*_huDjrT`<=QKs@I}$BVx{0{};a(OO~zr}pdCy=7aw)UEu*8)WQ}45G`H(vZp( z>Z*#_*lT7RG~V(=IYlq*U*531BK%^5)O%urDDL%sNsILbr}a3p}BR{8# zKN@)#@|?CuASsn7Dn@4S?WHCi*yI`~20tbqvrW1*Hf2xQciIE11!ZO^mqs5)$)Ise zN6gk}8U5^qe>ds(T5?RcGY*d{#R9{;n{ij`azmRB`Kix+zT;4k!(!UI#=u@(48AWW zgdv7_TNz4P04=#Jha8$=>Ek2xt7?{f>9Z?c{E{lhWGj`A-?U=sb5z}f^mK7cs@_jS z0%A#{Sf*WN5a8e79|CMUKRFhB-yxI24R9#*&zJk5cpaxLLO|biZ|?phPP&Y<#BEbX zFzX^$#4X0p`1A_(&MQMosAc12b$Owd0aFHW>r*MQ?me7ZSJ$}e*l#kIXAZ^h)YT;b zwEK)Im`%HJabqDP+SQzS(@amb744orZBZPPwC6#|XCExFoljeK_QEKT_@r{eiTM0; z6!FJ}(KEnOyIep@B%r@EkIwDJ8R}j?w_W3AbfzV*CIOpw8!l7SE>+5T_ zM_P&rsRs!dOhcV0NwcnhT!%A;E*n719FLrq_44dD%DQ8wKQCyPm)3qPPP{R4SS&5Y zP_pBxK&Aif!>9{vAN)PLR&_*Zn=@j2*0P0Vy)j<98kXyP&*HIK8`uMD*?Mf)UCK8ydAU-+BUKEzi%PHB=W zP6+{x$Jq3$1trtxhQUoG%OZkxZ-l#z5KOSKH$4> zN;7heSjxT_onhvNIrFD$mx~5e%^B{tm0*?cjrkeh9-!{+@yD%{R3ZHm>dNp4_;C1e zaB!$_Bk|oj0>}qEz65Y^u@-P}M6Xx>9q@3}|FLjzX08?hpv6}kSqn=WM;oAxlOu<% zo0H@J8-(Cjw+_J`(#A^!9NdB&G92#zy8bsv&1+}}fQ{o93kPTW*HHiKj)eU0E`--J L=+$oI{PX?~qQ*r% literal 0 HcmV?d00001 diff --git a/Solutions/Network Session Essentials/Package/createUiDefinition.json b/Solutions/Network Session Essentials/Package/createUiDefinition.json index 745faca26f9..2acf669d0ad 100644 --- a/Solutions/Network Session Essentials/Package/createUiDefinition.json +++ b/Solutions/Network Session Essentials/Package/createUiDefinition.json @@ -212,7 +212,7 @@ "name": "analytic7-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated.

\n This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema" + "text": "This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated.\n This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema" } } ] @@ -226,7 +226,7 @@ "name": "analytic8-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system.

\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema" + "text": "This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system.\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema" } } ] @@ -240,7 +240,7 @@ "name": "analytic9-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56).\\

\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema'" + "text": "This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. \nSuch potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56).\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema'" } } ] @@ -292,7 +292,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This hunting query detect anomalous pattern in port usage with ASIM normalization. To tune the query to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" + "text": "This hunting query detect anomalous pattern in port usage with ASIM normalization. To tune the query to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsSecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA CiscoAsaAma Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" } } ] @@ -306,7 +306,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "There is an normal amount of traffic that goes on a particular port in any organization. This hunting query identifies port usage higher than threshold defined in 'NetworkSession_Monitor_Configuration' watchlist to determine high port usage. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" + "text": "There is an normal amount of traffic that goes on a particular port in any organization. This hunting query identifies port usage higher than threshold defined in 'NetworkSession_Monitor_Configuration' watchlist to determine high port usage. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsSecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA CiscoAsaAma Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" } } ] @@ -320,7 +320,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Ideally one user should be associated with one MAC ID, this hunting query will identify if same MAC ID is associated with more than one user which can be a case of MAC spoofing attack. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" + "text": "Ideally one user should be associated with one MAC ID, this hunting query will identify if same MAC ID is associated with more than one user which can be a case of MAC spoofing attack. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsSecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA CiscoAsaAma Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" } } ] @@ -334,7 +334,7 @@ "name": "huntingquery5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Every standard app has a port associated with it. This query will identify if destination port associated with destination app is not standard which can be a case of network spoofing attack. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" + "text": "Every standard app has a port associated with it. This query will identify if destination port associated with destination app is not standard which can be a case of network spoofing attack. This hunting query depends on AWSS3 MicrosoftThreatProtection SecurityEvents WindowsSecurityEvents WindowsForwardedEvents Zscaler MicrosoftSysmonForLinux PaloAltoNetworks AzureMonitor(VMInsights) AzureFirewall AzureNSG CiscoASA CiscoAsaAma Corelight AIVectraStream CheckPoint Fortinet CiscoMeraki data connector (AWSVPCFlow DeviceNetworkEvents SecurityEvent SecurityEvent WindowsEvent CommonSecurityLog Syslog CommonSecurityLog VMConnection AzureDiagnostics AzureDiagnostics CommonSecurityLog CommonSecurityLog Corelight_CL VectraStream CommonSecurityLog CommonSecurityLog Syslog CiscoMerakiNativePoller Parser or Table)" } } ] diff --git a/Solutions/Network Session Essentials/Package/mainTemplate.json b/Solutions/Network Session Essentials/Package/mainTemplate.json index 7908f79b6de..df9133f422e 100644 --- a/Solutions/Network Session Essentials/Package/mainTemplate.json +++ b/Solutions/Network Session Essentials/Package/mainTemplate.json @@ -49,7 +49,7 @@ "email": "support@microsoft.com", "_email": "[variables('email')]", "_solutionName": "Network Session Essentials", - "_solutionVersion": "3.0.3", + "_solutionVersion": "3.0.4", "solutionId": "azuresentinel.azure-sentinel-solution-networksession", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -60,11 +60,11 @@ "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.0", + "analyticRuleVersion1": "1.0.1", "_analyticRulecontentId1": "cd6def0d-3ef0-4d55-a7e3-faa96c46ba12", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cd6def0d-3ef0-4d55-a7e3-faa96c46ba12')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cd6def0d-3ef0-4d55-a7e3-faa96c46ba12')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cd6def0d-3ef0-4d55-a7e3-faa96c46ba12','-', '1.0.0')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cd6def0d-3ef0-4d55-a7e3-faa96c46ba12','-', '1.0.1')))]" }, "analyticRuleObject2": { "analyticRuleVersion2": "1.0.0", @@ -81,46 +81,46 @@ "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b7dc801e-1e79-48bb-91e8-2229a8e6d40b','-', '1.0.0')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.1", + "analyticRuleVersion4": "1.0.2", "_analyticRulecontentId4": "cbf07406-fa2a-48b0-82b8-efad58db14ec", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cbf07406-fa2a-48b0-82b8-efad58db14ec')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cbf07406-fa2a-48b0-82b8-efad58db14ec')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cbf07406-fa2a-48b0-82b8-efad58db14ec','-', '1.0.1')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cbf07406-fa2a-48b0-82b8-efad58db14ec','-', '1.0.2')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.0", + "analyticRuleVersion5": "1.0.1", "_analyticRulecontentId5": "156997bd-da0f-4729-b47a-0a3e02dd50c8", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '156997bd-da0f-4729-b47a-0a3e02dd50c8')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('156997bd-da0f-4729-b47a-0a3e02dd50c8')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','156997bd-da0f-4729-b47a-0a3e02dd50c8','-', '1.0.0')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','156997bd-da0f-4729-b47a-0a3e02dd50c8','-', '1.0.1')))]" }, "analyticRuleObject6": { - "analyticRuleVersion6": "1.0.2", + "analyticRuleVersion6": "1.0.3", "_analyticRulecontentId6": "cd8faa84-4464-4b4e-96dc-b22f50c27541", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'cd8faa84-4464-4b4e-96dc-b22f50c27541')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('cd8faa84-4464-4b4e-96dc-b22f50c27541')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cd8faa84-4464-4b4e-96dc-b22f50c27541','-', '1.0.2')))]" + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','cd8faa84-4464-4b4e-96dc-b22f50c27541','-', '1.0.3')))]" }, "analyticRuleObject7": { - "analyticRuleVersion7": "1.2.5", + "analyticRuleVersion7": "1.2.7", "_analyticRulecontentId7": "4902eddb-34f7-44a8-ac94-8486366e9494", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '4902eddb-34f7-44a8-ac94-8486366e9494')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('4902eddb-34f7-44a8-ac94-8486366e9494')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4902eddb-34f7-44a8-ac94-8486366e9494','-', '1.2.5')))]" + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','4902eddb-34f7-44a8-ac94-8486366e9494','-', '1.2.7')))]" }, "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.4", + "analyticRuleVersion8": "1.0.6", "_analyticRulecontentId8": "1da9853f-3dea-4ea9-b7e5-26730da3d537", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '1da9853f-3dea-4ea9-b7e5-26730da3d537')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('1da9853f-3dea-4ea9-b7e5-26730da3d537')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1da9853f-3dea-4ea9-b7e5-26730da3d537','-', '1.0.4')))]" + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','1da9853f-3dea-4ea9-b7e5-26730da3d537','-', '1.0.6')))]" }, "analyticRuleObject9": { - "analyticRuleVersion9": "1.1.4", + "analyticRuleVersion9": "1.1.6", "_analyticRulecontentId9": "fcb9d75c-c3c1-4910-8697-f136bfef2363", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'fcb9d75c-c3c1-4910-8697-f136bfef2363')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('fcb9d75c-c3c1-4910-8697-f136bfef2363')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fcb9d75c-c3c1-4910-8697-f136bfef2363','-', '1.1.4')))]" + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','fcb9d75c-c3c1-4910-8697-f136bfef2363','-', '1.1.6')))]" }, "SummarizeData_NSE": "SummarizeData_NSE", "_SummarizeData_NSE": "[variables('SummarizeData_NSE')]", @@ -180,7 +180,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NetworkSessionEssentials Workbook with template version 3.0.3", + "description": "NetworkSessionEssentials Workbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -392,7 +392,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AnomalyFoundInNetworkSessionTraffic_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "AnomalyFoundInNetworkSessionTraffic_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -420,101 +420,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoASA" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -534,13 +546,13 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "AnomalyFieldValue": "anomalyFieldValue", "Score": "score", - "AnomalyFieldType": "anomalyFieldType" + "AnomalyFieldType": "anomalyFieldType", + "AnomalyFieldValue": "anomalyFieldValue" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Based on past data, anomaly was observed in {{anomalyFieldValue}} Traffic with a score of {{score}}.", - "alertDisplayNameFormat": "Anomaly was observed with {{anomalyFieldValue}} Traffic" + "alertDisplayNameFormat": "Anomaly was observed with {{anomalyFieldValue}} Traffic", + "alertDescriptionFormat": "Based on past data, anomaly was observed in {{anomalyFieldValue}} Traffic with a score of {{score}}." } } }, @@ -595,7 +607,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Anomaly in SMB Traffic(ASIM Network Session schema)_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "Anomaly in SMB Traffic(ASIM Network Session schema)_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -621,6 +633,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", + "requiredDataConnectors": [], "tactics": [ "LateralMovement" ], @@ -635,8 +648,8 @@ { "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } ], "entityType": "IP" @@ -698,7 +711,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Remote Desktop Network Brute force (ASIM Network Session schema)_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "Remote Desktop Network Brute force (ASIM Network Session schema)_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -724,6 +737,7 @@ "triggerOperator": "GreaterThan", "triggerThreshold": 0, "status": "Available", + "requiredDataConnectors": [], "tactics": [ "CredentialAccess" ], @@ -734,8 +748,8 @@ { "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } ], "entityType": "IP" @@ -797,7 +811,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectPortMisuseByAnomalyBasedDetection_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DetectPortMisuseByAnomalyBasedDetection_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -825,101 +839,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "SecurityEvents" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoASA" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -938,16 +964,16 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "AllNetworkProtocols": "NetworkProtocols", - "AllDvcAction": "DvcActions", "DstPortNumber": "DstPortNumber", - "AllNetworkDirections": "NetworkDirections" + "AllNetworkDirections": "NetworkDirections", + "AllNetworkProtocols": "NetworkProtocols", + "AllDvcAction": "DvcActions" }, "alertDetailsOverride": { - "alertTacticsColumnName": "Tactic", + "alertSeverityColumnName": "Severity", "alertDisplayNameFormat": "Detected {{Name}}", - "alertDescriptionFormat": "{{Description}}", - "alertSeverityColumnName": "Severity" + "alertTacticsColumnName": "Tactic", + "alertDescriptionFormat": "{{Description}}" } } }, @@ -1002,7 +1028,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectPortMisuseByStaticThreshold_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "DetectPortMisuseByStaticThreshold_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1030,101 +1056,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoASA" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -1142,16 +1180,16 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "AllNetworkProtocols": "NetworkProtocols", - "AllDvcAction": "DvcActions", "DstPortNumber": "DstPortNumber", - "AllNetworkDirections": "NetworkDirections" + "AllNetworkDirections": "NetworkDirections", + "AllNetworkProtocols": "NetworkProtocols", + "AllDvcAction": "DvcActions" }, "alertDetailsOverride": { - "alertTacticsColumnName": "Tactic", + "alertSeverityColumnName": "Severity", "alertDisplayNameFormat": "Detected {{Name}}", - "alertDescriptionFormat": "{{Description}}", - "alertSeverityColumnName": "Severity" + "alertTacticsColumnName": "Tactic", + "alertDescriptionFormat": "{{Description}}" } } }, @@ -1206,7 +1244,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "NetworkPortSweepFromExternalNetwork_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "NetworkPortSweepFromExternalNetwork_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1234,101 +1272,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoASA" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -1341,8 +1391,8 @@ "AllDstIpAddr": "set_DstIpAddr" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Network Port Sweep was detection by multiple IPs", - "alertDisplayNameFormat": "Network Port Sweep detected on {{DstPortNumber}}" + "alertDisplayNameFormat": "Network Port Sweep detected on {{DstPortNumber}}", + "alertDescriptionFormat": "Network Port Sweep was detection by multiple IPs" } } }, @@ -1397,7 +1447,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ExcessiveHTTPFailuresFromSource_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "ExcessiveHTTPFailuresFromSource_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1411,7 +1461,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated.

\n This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema", + "description": "This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated.\n This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema", "displayName": "Excessive number of failed connections from a single source (ASIM Network Session schema)", "enabled": false, "query": "let threshold = 5000;\n_Im_NetworkSession(eventresult='Failure')\n| summarize Count=count() by SrcIpAddr, bin(TimeGenerated,5m)\n| where Count > threshold\n| extend timestamp = TimeGenerated, threshold\n", @@ -1425,101 +1475,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoASA" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -1532,8 +1594,8 @@ { "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } ], "entityType": "IP" @@ -1543,8 +1605,8 @@ "NumberOfDenies": "Count" }, "alertDetailsOverride": { - "alertDescriptionFormat": "The client at address {{SrcIpAddr}} generated more than {{threshold}} failures over a 5 minutes time window, which may indicate malicious activity.", - "alertDisplayNameFormat": "Excessive number of failed connections from {{SrcIpAddr}}" + "alertDisplayNameFormat": "Excessive number of failed connections from {{SrcIpAddr}}", + "alertDescriptionFormat": "The client at address {{SrcIpAddr}} generated more than {{threshold}} failures over a 5 minutes time window, which may indicate malicious activity." } } }, @@ -1599,7 +1661,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PortScan_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "PortScan_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1613,7 +1675,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system.

\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema", + "description": "This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system.\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema", "displayName": "Port scan detected (ASIM Network Session schema)", "enabled": false, "query": "let PortScanThreshold = 50;\n_Im_NetworkSession\n| where ipv4_is_private(SrcIpAddr) == False\n| where SrcIpAddr !in (\"127.0.0.1\", \"::1\")\n| summarize AttemptedPortsCount=dcount(DstPortNumber), AttemptedPorts=make_set(DstPortNumber, 100), ReportedBy=make_set(strcat(EventVendor, \"/\", EventProduct), 20) by SrcIpAddr, bin(TimeGenerated, 5m)\n| where AttemptedPortsCount > PortScanThreshold\n", @@ -1627,101 +1689,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "SecurityEvents" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoASA" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -1734,8 +1808,8 @@ { "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } ], "entityType": "IP" @@ -1745,8 +1819,8 @@ "AttemptedPortsCount": "AttemptedPortsCount" }, "alertDetailsOverride": { - "alertDescriptionFormat": "A port scan has been performed from address {{SrcIpAddr}} over {{AttemptedPortsCount}} ports within 5 minutes. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system.", - "alertDisplayNameFormat": "Potential port scan from {{SrcIpAddr}}" + "alertDisplayNameFormat": "Potential port scan from {{SrcIpAddr}}", + "alertDescriptionFormat": "A port scan has been performed from address {{SrcIpAddr}} over {{AttemptedPortsCount}} ports within 5 minutes. This may indicate that a [port scanner](https://en.wikipedia.org/wiki/Port_scanner) is trying to identify open ports in order to penetrate a system." } } }, @@ -1801,7 +1875,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "PossibleBeaconingActivity_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "PossibleBeaconingActivity_AnalyticalRules Analytics Rule with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1815,7 +1889,7 @@ "kind": "Scheduled", "location": "[parameters('workspace-location')]", "properties": { - "description": "This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56).\\

\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema'", + "description": "This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. \nSuch potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56).\nThis analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM NetworkSession schema'", "displayName": "Potential beaconing activity (ASIM Network Session schema)", "enabled": false, "query": "let querystarttime = 2d;\nlet queryendtime = 1d;\nlet TimeDeltaThreshold = 10;\nlet TotalEventsThreshold = 15;\nlet PercentBeaconThreshold = 80;\nlet LocalNetworks=dynamic([\"169.254.0.0/16\",\"127.0.0.0/8\"]);\n_Im_NetworkSession(starttime=ago(querystarttime), endtime=ago(queryendtime))\n| where not(ipv4_is_private(DstIpAddr))\n| where not (ipv4_is_in_any_range(DstIpAddr, LocalNetworks))\n| project \n TimeGenerated\n , SrcIpAddr\n , SrcPortNumber\n , DstIpAddr\n , DstPortNumber\n , DstBytes\n , SrcBytes\n| sort by \n SrcIpAddr asc\n , TimeGenerated asc\n , DstIpAddr asc\n , DstPortNumber asc\n| serialize\n| extend \n nextTimeGenerated = next(TimeGenerated, 1)\n , nextSrcIpAddr = next(SrcIpAddr, 1)\n| extend \n TimeDeltainSeconds = datetime_diff('second', nextTimeGenerated, TimeGenerated)\n| where SrcIpAddr == nextSrcIpAddr\n//Whitelisting criteria/ threshold criteria\n| where TimeDeltainSeconds > TimeDeltaThreshold \n| project\n TimeGenerated\n , TimeDeltainSeconds\n , SrcIpAddr\n , SrcPortNumber\n , DstIpAddr\n , DstPortNumber\n , DstBytes\n , SrcBytes\n| summarize\n count()\n , sum(DstBytes)\n , sum(SrcBytes)\n , make_list(TimeDeltainSeconds) \n by TimeDeltainSeconds\n , bin(TimeGenerated, 1h)\n , SrcIpAddr\n , DstIpAddr\n , DstPortNumber\n| summarize\n (MostFrequentTimeDeltaCount, MostFrequentTimeDeltainSeconds) = arg_max(count_, TimeDeltainSeconds)\n , TotalEvents=sum(count_)\n , TotalSrcBytes = sum(sum_SrcBytes)\n , TotalDstBytes = sum(sum_DstBytes)\n by bin(TimeGenerated, 1h)\n , SrcIpAddr\n , DstIpAddr\n , DstPortNumber\n| where TotalEvents > TotalEventsThreshold \n| extend BeaconPercent = MostFrequentTimeDeltaCount/toreal(TotalEvents) * 100\n| where BeaconPercent > PercentBeaconThreshold\n", @@ -1829,101 +1903,113 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "AWSS3", "dataTypes": [ "AWSVPCFlow" - ] + ], + "connectorId": "AWSS3" }, { - "connectorId": "MicrosoftThreatProtection", "dataTypes": [ "DeviceNetworkEvents" - ] + ], + "connectorId": "MicrosoftThreatProtection" + }, + { + "dataTypes": [ + "SecurityEvent" + ], + "connectorId": "SecurityEvents" }, { - "connectorId": "SecurityEvents", "dataTypes": [ "SecurityEvent" - ] + ], + "connectorId": "WindowsSecurityEvents" }, { - "connectorId": "WindowsForwardedEvents", "dataTypes": [ "WindowsEvent" - ] + ], + "connectorId": "WindowsForwardedEvents" }, { - "connectorId": "Zscaler", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Zscaler" }, { - "connectorId": "MicrosoftSysmonForLinux", "dataTypes": [ "Syslog" - ] + ], + "connectorId": "MicrosoftSysmonForLinux" }, { - "connectorId": "PaloAltoNetworks", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "PaloAltoNetworks" }, { - "connectorId": "AzureMonitor(VMInsights)", "dataTypes": [ "VMConnection" - ] + ], + "connectorId": "AzureMonitor(VMInsights)" }, { - "connectorId": "AzureFirewall", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureFirewall" }, { - "connectorId": "AzureNSG", "dataTypes": [ "AzureDiagnostics" - ] + ], + "connectorId": "AzureNSG" + }, + { + "dataTypes": [ + "CommonSecurityLog" + ], + "connectorId": "CiscoASA" }, { - "connectorId": "CiscoASA", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CiscoAsaAma" }, { - "connectorId": "Corelight", "dataTypes": [ "Corelight_CL" - ] + ], + "connectorId": "Corelight" }, { - "connectorId": "AIVectraStream", "dataTypes": [ "VectraStream" - ] + ], + "connectorId": "AIVectraStream" }, { - "connectorId": "CheckPoint", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "CheckPoint" }, { - "connectorId": "Fortinet", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "Fortinet" }, { - "connectorId": "CiscoMeraki", "dataTypes": [ "Syslog", "CiscoMerakiNativePoller" - ] + ], + "connectorId": "CiscoMeraki" } ], "tactics": [ @@ -1937,8 +2023,8 @@ { "fieldMappings": [ { - "columnName": "SrcIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "SrcIpAddr" } ], "entityType": "IP" @@ -1946,8 +2032,8 @@ { "fieldMappings": [ { - "columnName": "DstIpAddr", - "identifier": "Address" + "identifier": "Address", + "columnName": "DstIpAddr" } ], "entityType": "IP" @@ -1955,13 +2041,13 @@ ], "customDetails": { "TotalDstBytes": "TotalDstBytes", - "DstPortNumber": "DstPortNumber", "FrequencyTime": "MostFrequentTimeDeltaCount", + "DstPortNumber": "DstPortNumber", "FrequencyCount": "TotalSrcBytes" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Potential beaconing pattern from a client at address {{SrcIpAddr}} to a server at address {{DstIpAddr}} over port {{DstPortNumber}} identified. Such potential outbound beaconing pattern to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](http://www.austintaylor.io/detect/beaconing/intrusion/detection/system/command/control/flare/elastic/stack/2017/06/10/detect-beaconing-with-flare-elasticsearch-and-intrusion-detection-systems/). The recurring frequency, reported as FrequencyTime in the custom details, and the total transferred volume reported as TotalDstBytes in the custom details, can help to determine the significance of this incident.", - "alertDisplayNameFormat": "Potential beaconing from {{SrcIpAddr}} to {{DstIpAddr}}" + "alertDisplayNameFormat": "Potential beaconing from {{SrcIpAddr}} to {{DstIpAddr}}", + "alertDescriptionFormat": "Potential beaconing pattern from a client at address {{SrcIpAddr}} to a server at address {{DstIpAddr}} over port {{DstPortNumber}} identified. Such potential outbound beaconing pattern to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this [Blog](http://www.austintaylor.io/detect/beaconing/intrusion/detection/system/command/control/flare/elastic/stack/2017/06/10/detect-beaconing-with-flare-elasticsearch-and-intrusion-detection-systems/). The recurring frequency, reported as FrequencyTime in the custom details, and the total transferred volume reported as TotalDstBytes in the custom details, can help to determine the significance of this incident." } } }, @@ -2016,7 +2102,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "SummarizeData_NSE Playbook with template version 3.0.3", + "description": "SummarizeData_NSE Playbook with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3473,7 +3559,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Detect Outbound LDAP Traffic(ASIM Network Session schema)_HuntingQueries Hunting Query with template version 3.0.3", + "description": "Detect Outbound LDAP Traffic(ASIM Network Session schema)_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -3558,7 +3644,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectPortMisuseByAnomalyHunting_HuntingQueries Hunting Query with template version 3.0.3", + "description": "DetectPortMisuseByAnomalyHunting_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -3643,7 +3729,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectPortMisuseByStaticThresholdHunting_HuntingQueries Hunting Query with template version 3.0.3", + "description": "DetectPortMisuseByStaticThresholdHunting_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -3728,7 +3814,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "DetectsSeveralUsersWithTheSameMACAddress_HuntingQueries Hunting Query with template version 3.0.3", + "description": "DetectsSeveralUsersWithTheSameMACAddress_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -3809,7 +3895,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MismatchBetweenDestinationAppNameAndDestinationPort_HuntingQueries Hunting Query with template version 3.0.3", + "description": "MismatchBetweenDestinationAppNameAndDestinationPort_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -3890,7 +3976,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Protocols passing authentication in cleartext (ASIM Network Session schema)_HuntingQueries Hunting Query with template version 3.0.3", + "description": "Protocols passing authentication in cleartext (ASIM Network Session schema)_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -3975,7 +4061,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Remote Desktop Network Traffic(ASIM Network Session schema)_HuntingQueries Hunting Query with template version 3.0.3", + "description": "Remote Desktop Network Traffic(ASIM Network Session schema)_HuntingQueries Hunting Query with template version 3.0.4", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -4073,7 +4159,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.3", + "version": "3.0.4", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Network Session Essentials", @@ -4101,7 +4187,6 @@ "link": "https://support.microsoft.com" }, "dependencies": { - "operator": "AND", "criteria": [ { "kind": "Workbook", @@ -4196,7 +4281,71 @@ { "kind": "Watchlist", "contentId": "[variables('_NetworkSession Monitor Configuration')]", - "version": "3.0.3" + "version": "3.0.4" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-amazonwebservices" + }, + { + "kind": "Solution", + "contentId": "sentinel4azurefirewall.sentinel4azurefirewall" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-networksecuritygroup" + }, + { + "kind": "Solution", + "contentId": "checkpoint.checkpoint-sentinel-solutions" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-ciscoasa" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-ciscomeraki" + }, + { + "kind": "Solution", + "contentId": "corelightinc1584998267292.corelight-for-azure-sentinel" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-fortinetfortigate" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-unifiedmicrosoftsocforot" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-microsoftdefenderforcloud" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-sysmonforlinux" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-windowsfirewall" + }, + { + "kind": "Solution", + "contentId": "azuresentinel.azure-sentinel-solution-paloaltopanos" + }, + { + "kind": "Solution", + "contentId": "vectraaiinc.vectra_sentinel_solution" + }, + { + "kind": "Solution", + "contentId": "watchguard-technologies.watchguard_firebox_mss" + }, + { + "kind": "Solution", + "contentId": "zscaler1579058425289.zscaler_internet_access_mss" } ] }, diff --git a/Solutions/Network Session Essentials/ReleaseNotes.md b/Solutions/Network Session Essentials/ReleaseNotes.md index 8c20d2b95f3..64f1424dc36 100644 --- a/Solutions/Network Session Essentials/ReleaseNotes.md +++ b/Solutions/Network Session Essentials/ReleaseNotes.md @@ -1,6 +1,7 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|-----------------------------------------------------------------------| -| 3.0.3 | 12-03-2024 |Added 3 new **Hunting Queries** and 2 new **Analytic Rules** | -| 3.0.2 | 07-02-2024 |Updated **Analytic Rule** (DetectPortMisuseByAnomalyBasedDetection)
Updated solution description | -| 3.0.1 | 02-01-2024 |Tagged for dependent solutions for deployment | -| 3.0.0 | 24-07-2023 |Updated ApiVersion for **Watchlist** | +| 3.0.4 | 03-06-2024 | Added missing AMA **Data Connector** reference in **Analytical rule** and **Hunting Query** | +| 3.0.3 | 12-03-2024 | Added 3 new **Hunting Queries** and 2 new **Analytic Rules** | +| 3.0.2 | 07-02-2024 | Updated **Analytic Rule** (DetectPortMisuseByAnomalyBasedDetection)
Updated solution description | +| 3.0.1 | 02-01-2024 | Tagged for dependent solutions for deployment | +| 3.0.0 | 24-07-2023 | Updated ApiVersion for **Watchlist** | From 1ff30b5ca5e81d023770f79888dd855f5a424b96 Mon Sep 17 00:00:00 2001 From: v-shukore Date: Mon, 3 Jun 2024 20:17:05 +0530 Subject: [PATCH 2/3] Update ValidConnectorIds.json --- .../detectionTemplateSchemaValidation/ValidConnectorIds.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 771a3fbf583..ba3754f15d1 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -239,5 +239,6 @@ "InfobloxSOCInsightsDataConnector_Legacy", "InfobloxSOCInsightsDataConnector_AMA", "NetskopeDataConnector", - "NetskopeWebTransactionsDataConnector" + "NetskopeWebTransactionsDataConnector", + "CiscoAsaAma" ] \ No newline at end of file From 300dc95fbae24569b74018480ed0e7cb92a9b25e Mon Sep 17 00:00:00 2001 From: v-shukore Date: Wed, 5 Jun 2024 14:20:23 +0530 Subject: [PATCH 3/3] Update readme.md --- .../Playbooks/SummarizeData_NSE/readme.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/Network Session Essentials/Playbooks/SummarizeData_NSE/readme.md b/Solutions/Network Session Essentials/Playbooks/SummarizeData_NSE/readme.md index 0dc2bac1e63..97307303f2d 100644 --- a/Solutions/Network Session Essentials/Playbooks/SummarizeData_NSE/readme.md +++ b/Solutions/Network Session Essentials/Playbooks/SummarizeData_NSE/readme.md @@ -7,8 +7,8 @@ This logic app helps to summarize Network session data into custom tables. This ### Deployment instructions 1. Deploy the playbook by clicking on "Deploy to Azure" button. This will take you to deploying an ARM Template wizard. -[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/deploySummarizationPublic) -[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/deploySummarizationGov) +[![Deploy to Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-NetworkSessionEssentials-SummarizeData) +[![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-NetworkSessionEssentials-SummarizeData-gov) 2. Fill in the required parameter: * Playbook Name: Enter the playbook name here (Ex: SummarizeData)