From 7b41ac06896a41b107c935bed188ac9f97b4db3f Mon Sep 17 00:00:00 2001 From: Anoop Kumar Sharma Date: Tue, 28 Jul 2026 15:57:58 +0530 Subject: [PATCH 1/3] feat(AbnormalSecurity): route CCF Push connector to *_V2_CL tables with native guid types (v3.2.0) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rename all nine CCF Push output tables to ABNORMAL_SECURITY_*_V2_CL so the connector always provisions fresh tables and never collides with the Classic tables created by the legacy Azure Functions (Data Collector API) connector — resolving the "Invalid output table schema" Deploy failure on workspaces that previously ran the legacy connector. - DCR input streams (Custom-ABNORMAL_SECURITY_*) unchanged; only output streams, table defs, Parsers, Hunting Queries, Analytic Rules, and the Workbook now target *_V2_CL. - GUID-shaped *_g columns declared as type guid with matching toguid() in the DCR transforms (fresh V2 tables carry no legacy Classic schema to conflict with). - Regenerated Package (mainTemplate/createUiDefinition/3.2.0.zip); bumped v3.2.0. Co-Authored-By: Claude Opus 4.8 --- ...bnormalSecurity_AbuseMailboxMalicious.yaml | 4 +- .../AbnormalSecurity_AccountTakeover.yaml | 4 +- .../AbnormalSecurity_HighRiskEmailAttack.yaml | 4 +- .../AbnormalSecurity_VendorCompromise.yaml | 4 +- .../AbnormalSecurity_DCR.json | 36 +- .../AbnormalSecurity_connectorDefinition.json | 86 ++-- ...alSecurity_table_AbnormalSecurityLogs.json | 10 +- .../AbnormalSecurity_table_AbuseMailbox.json | 12 +- .../AbnormalSecurity_table_AtoCase.json | 10 +- .../AbnormalSecurity_table_AuditLog.json | 10 +- .../AbnormalSecurity_table_Case.json | 10 +- .../AbnormalSecurity_table_PostureChange.json | 10 +- .../AbnormalSecurity_table_Remediation.json | 10 +- .../AbnormalSecurity_table_ThreatLog.json | 12 +- .../AbnormalSecurity_table_VendorCase.json | 12 +- ...BNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json} | 0 ... => ABNORMAL_SECURITY_ATO_CASE_V2_CL.json} | 0 ...=> ABNORMAL_SECURITY_AUDIT_LOG_V2_CL.json} | 0 ...json => ABNORMAL_SECURITY_CASE_V2_CL.json} | 0 ...NORMAL_SECURITY_POSTURE_CHANGE_V2_CL.json} | 0 ... ABNORMAL_SECURITY_REMEDIATION_V2_CL.json} | 0 ...> ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json} | 0 ... ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json} | 0 .../Data/Solution_AbnormalSecurity.json | 2 +- ...bnormalSecurity_AbuseMailboxCampaigns.yaml | 4 +- .../AbnormalSecurity_NewVendorDomains.yaml | 4 +- .../AbnormalSecurity_TopAttackTargets.yaml | 4 +- .../AbnormalSecurity_UnremediatedThreats.yaml | 4 +- Solutions/AbnormalSecurity/Package/3.2.0.zip | Bin 0 -> 30100 bytes .../Package/createUiDefinition.json | 8 +- .../Package/mainTemplate.json | 470 +++++++++--------- .../Parsers/AbnormalSecurityAbuseMailbox.yaml | 2 +- .../Parsers/AbnormalSecurityAtoCases.yaml | 2 +- .../Parsers/AbnormalSecurityThreatLog.yaml | 2 +- .../Parsers/AbnormalSecurityVendorCases.yaml | 2 +- Solutions/AbnormalSecurity/ReleaseNotes.md | 1 + .../Workbooks/AbnormalSecurityOverview.json | 12 +- Workbooks/WorkbooksMetadata.json | 8 +- 38 files changed, 380 insertions(+), 379 deletions(-) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_ABUSE_MAILBOX_CL.json => ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_ATO_CASE_CL.json => ABNORMAL_SECURITY_ATO_CASE_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_AUDIT_LOG_CL.json => ABNORMAL_SECURITY_AUDIT_LOG_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_CASE_CL.json => ABNORMAL_SECURITY_CASE_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_POSTURE_CHANGE_CL.json => ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_REMEDIATION_CL.json => ABNORMAL_SECURITY_REMEDIATION_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_THREAT_LOG_CL.json => ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json} (100%) rename Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/{ABNORMAL_SECURITY_VENDOR_CASE_CL.json => ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json} (100%) create mode 100644 Solutions/AbnormalSecurity/Package/3.2.0.zip diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml index 511f45a06c7..0a1e25852db 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml @@ -10,7 +10,7 @@ status: Available requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_ABUSE_MAILBOX_CL + - ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -20,7 +20,7 @@ tactics: relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_ABUSE_MAILBOX_CL + ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL | where abx_body_abx_body_reported_b == true | where tolower(abx_body_abx_body_judgement_s) == "malicious" | extend diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml index 47644662ce0..bd483548169 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml @@ -9,7 +9,7 @@ status: Available requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_ATO_CASE_CL + - ABNORMAL_SECURITY_ATO_CASE_V2_CL queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -21,7 +21,7 @@ relevantTechniques: - T1078 - T1110 query: | - ABNORMAL_SECURITY_ATO_CASE_CL + ABNORMAL_SECURITY_ATO_CASE_V2_CL | where isnotempty(abx_body_abx_body_ato_case_id_s) // Collapse to one row per ATO case (earliest event in the window) so repeated // events for the same case do not raise duplicate alerts. diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml index 88c73afdf49..2378095c4c6 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml @@ -11,7 +11,7 @@ status: Available requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_THREAT_LOG_CL + - ABNORMAL_SECURITY_THREAT_LOG_V2_CL queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -21,7 +21,7 @@ tactics: relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_THREAT_LOG_CL + ABNORMAL_SECURITY_THREAT_LOG_V2_CL | where abx_body_abx_body_attack_type_s in~ ( "Phishing: Credential", "Social Engineering (BEC)", diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml index 288a3dfa908..0c95d5d1d91 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml @@ -9,7 +9,7 @@ status: Available requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_VENDOR_CASE_CL + - ABNORMAL_SECURITY_VENDOR_CASE_V2_CL queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -19,7 +19,7 @@ tactics: relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_VENDOR_CASE_CL + ABNORMAL_SECURITY_VENDOR_CASE_V2_CL | where isnotempty(abx_body_abx_body_vendorCaseId_g) // Collapse to one row per vendor case (earliest event in the window) so repeated // events for the same case do not raise duplicate alerts. diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_DCR.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_DCR.json index cbdcb292844..cc74093a2e8 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_DCR.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_DCR.json @@ -167,8 +167,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_LOGS_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_LOGS_V2_CL" }, { "streams": [ @@ -177,8 +177,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_abx_message_id_d = toreal(abx_body.abx_body.abx_message_id)\n| extend abx_body_abx_body_abx_message_id_str_s = tostring(abx_body.abx_body.abx_message_id_str)\n| extend abx_body_abx_body_abx_portal_url_s = tostring(abx_body.abx_body.abx_portal_url)\n| extend abx_body_abx_body_threat_id_g = tostring(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_from_name_s = tostring(abx_body.abx_body.from_name)\n| extend abx_body_abx_body_from_address_s = tostring(abx_body.abx_body.from_address)\n| extend abx_body_abx_body_to_addresses_s = tostring(abx_body.abx_body.to_addresses)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_received_time_t = todatetime(abx_body.abx_body.received_time)\n| extend abx_body_abx_body_sent_time_t = todatetime(abx_body.abx_body.sent_time)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_auto_remediated_b = tobool(abx_body.abx_body.auto_remediated)\n| extend abx_body_abx_body_post_remediated_b = tobool(abx_body.abx_body.post_remediated)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_remediation_timestamp_t = todatetime(abx_body.abx_body.remediation_timestamp)\n| extend abx_body_abx_body_attack_type_s = tostring(abx_body.abx_body.attack_type)\n| extend abx_body_abx_body_attack_strategy_s = tostring(abx_body.abx_body.attack_strategy)\n| extend abx_body_abx_body_attack_vector_s = tostring(abx_body.abx_body.attack_vector)\n| extend abx_body_abx_body_attack_score_d = toreal(abx_body.abx_body.attack_score)\n| extend abx_body_abx_body_attacked_party_s = tostring(abx_body.abx_body.attacked_party)\n| extend abx_body_abx_body_return_path_s = tostring(abx_body.abx_body.return_path)\n| extend abx_body_abx_body_reply_to_emails_s = tostring(abx_body.abx_body.reply_to_emails)\n| extend abx_body_abx_body_cc_emails_s = tostring(abx_body.abx_body.cc_emails)\n| extend abx_body_abx_body_bcc_emails_s = tostring(abx_body.abx_body.bcc_emails)\n| extend abx_body_abx_body_sender_ip_address_s = tostring(abx_body.abx_body.sender_ip_address)\n| extend abx_body_abx_body_sender_domain_s = tostring(abx_body.abx_body.sender_domain)\n| extend abx_body_abx_body_sender_auth_results_spf_s = tostring(abx_body.abx_body.sender_auth_results.spf)\n| extend abx_body_abx_body_sender_auth_results_dkim_s = tostring(abx_body.abx_body.sender_auth_results.dkim)\n| extend abx_body_abx_body_sender_auth_results_dmarc_s = tostring(abx_body.abx_body.sender_auth_results.dmarc)\n| extend abx_body_abx_body_impersonated_party_s = tostring(abx_body.abx_body.impersonated_party)\n| extend abx_body_abx_body_attachment_names_s = tostring(abx_body.abx_body.attachment_names)\n| extend abx_body_abx_body_attachment_count_d = toreal(abx_body.abx_body.attachment_count)\n| extend abx_body_abx_body_attachment_analysis_s = tostring(abx_body.abx_body.attachment_analysis)\n| extend abx_body_abx_body_urls_s = tostring(abx_body.abx_body.urls)\n| extend abx_body_abx_body_url_count_d = toreal(abx_body.abx_body.url_count)\n| extend abx_body_abx_body_summary_insights_s = tostring(abx_body.abx_body.summary_insights)\n| extend abx_body_abx_body_is_read_b = tobool(abx_body.abx_body.is_read)\n| extend abx_body_abx_body_folder_locations_s = tostring(abx_body.abx_body.folder_locations)\n| extend abx_body_abx_body_message_sources_s = tostring(abx_body.abx_body.message_sources)\n| extend abx_body_abx_body_message_engagement_s = tostring(abx_body.abx_body.message_engagement)\n| extend abx_body_abx_body_source_s = tostring(abx_body.abx_body.source)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_THREAT_LOG_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_abx_message_id_d = toreal(abx_body.abx_body.abx_message_id)\n| extend abx_body_abx_body_abx_message_id_str_s = tostring(abx_body.abx_body.abx_message_id_str)\n| extend abx_body_abx_body_abx_portal_url_s = tostring(abx_body.abx_body.abx_portal_url)\n| extend abx_body_abx_body_threat_id_g = toguid(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_from_name_s = tostring(abx_body.abx_body.from_name)\n| extend abx_body_abx_body_from_address_s = tostring(abx_body.abx_body.from_address)\n| extend abx_body_abx_body_to_addresses_s = tostring(abx_body.abx_body.to_addresses)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_received_time_t = todatetime(abx_body.abx_body.received_time)\n| extend abx_body_abx_body_sent_time_t = todatetime(abx_body.abx_body.sent_time)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_auto_remediated_b = tobool(abx_body.abx_body.auto_remediated)\n| extend abx_body_abx_body_post_remediated_b = tobool(abx_body.abx_body.post_remediated)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_remediation_timestamp_t = todatetime(abx_body.abx_body.remediation_timestamp)\n| extend abx_body_abx_body_attack_type_s = tostring(abx_body.abx_body.attack_type)\n| extend abx_body_abx_body_attack_strategy_s = tostring(abx_body.abx_body.attack_strategy)\n| extend abx_body_abx_body_attack_vector_s = tostring(abx_body.abx_body.attack_vector)\n| extend abx_body_abx_body_attack_score_d = toreal(abx_body.abx_body.attack_score)\n| extend abx_body_abx_body_attacked_party_s = tostring(abx_body.abx_body.attacked_party)\n| extend abx_body_abx_body_return_path_s = tostring(abx_body.abx_body.return_path)\n| extend abx_body_abx_body_reply_to_emails_s = tostring(abx_body.abx_body.reply_to_emails)\n| extend abx_body_abx_body_cc_emails_s = tostring(abx_body.abx_body.cc_emails)\n| extend abx_body_abx_body_bcc_emails_s = tostring(abx_body.abx_body.bcc_emails)\n| extend abx_body_abx_body_sender_ip_address_s = tostring(abx_body.abx_body.sender_ip_address)\n| extend abx_body_abx_body_sender_domain_s = tostring(abx_body.abx_body.sender_domain)\n| extend abx_body_abx_body_sender_auth_results_spf_s = tostring(abx_body.abx_body.sender_auth_results.spf)\n| extend abx_body_abx_body_sender_auth_results_dkim_s = tostring(abx_body.abx_body.sender_auth_results.dkim)\n| extend abx_body_abx_body_sender_auth_results_dmarc_s = tostring(abx_body.abx_body.sender_auth_results.dmarc)\n| extend abx_body_abx_body_impersonated_party_s = tostring(abx_body.abx_body.impersonated_party)\n| extend abx_body_abx_body_attachment_names_s = tostring(abx_body.abx_body.attachment_names)\n| extend abx_body_abx_body_attachment_count_d = toreal(abx_body.abx_body.attachment_count)\n| extend abx_body_abx_body_attachment_analysis_s = tostring(abx_body.abx_body.attachment_analysis)\n| extend abx_body_abx_body_urls_s = tostring(abx_body.abx_body.urls)\n| extend abx_body_abx_body_url_count_d = toreal(abx_body.abx_body.url_count)\n| extend abx_body_abx_body_summary_insights_s = tostring(abx_body.abx_body.summary_insights)\n| extend abx_body_abx_body_is_read_b = tobool(abx_body.abx_body.is_read)\n| extend abx_body_abx_body_folder_locations_s = tostring(abx_body.abx_body.folder_locations)\n| extend abx_body_abx_body_message_sources_s = tostring(abx_body.abx_body.message_sources)\n| extend abx_body_abx_body_message_engagement_s = tostring(abx_body.abx_body.message_engagement)\n| extend abx_body_abx_body_source_s = tostring(abx_body.abx_body.source)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_THREAT_LOG_V2_CL" }, { "streams": [ @@ -187,8 +187,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_schema_version_s = tostring(abx_body.abx_body.schema_version)\n| extend abx_body_abx_body_case_id_d = toreal(abx_body.abx_body.case_id)\n| extend abx_body_abx_body_customer_d = toreal(abx_body.abx_body.customer)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_body_first_observed_t = todatetime(abx_body.abx_body.first_observed)\n| extend abx_body_abx_body_date_created_t = todatetime(abx_body.abx_body.date_created)\n| extend abx_body_abx_body_first_customer_visible_time_t = todatetime(abx_body.abx_body.first_customer_visible_time)\n| extend abx_body_abx_body_trigger_event_s = tostring(abx_body.abx_body.trigger_event)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_confidence_s = tostring(abx_body.abx_body.confidence)\n| extend abx_body_abx_body_case_status_s = tostring(abx_body.abx_body.case_status)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_entity_entity_type_s = tostring(abx_body.abx_body.entity.entity_type)\n| extend abx_body_abx_body_entity_identifier_s = tostring(abx_body.abx_body.entity.identifier)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_genai_summary_s = tostring(abx_body.abx_body.genai_summary)\n| extend abx_body_abx_body_event_timeline_s = tostring(abx_body.abx_body.event_timeline)\n| extend abx_body_abx_body_platforms_s = tostring(abx_body.abx_body.platforms)\n| extend abx_body_abx_body_event_type_s = tostring(abx_body.abx_body.event_type)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_CASE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_schema_version_s = tostring(abx_body.abx_body.schema_version)\n| extend abx_body_abx_body_case_id_d = toreal(abx_body.abx_body.case_id)\n| extend abx_body_abx_body_customer_d = toreal(abx_body.abx_body.customer)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_body_first_observed_t = todatetime(abx_body.abx_body.first_observed)\n| extend abx_body_abx_body_date_created_t = todatetime(abx_body.abx_body.date_created)\n| extend abx_body_abx_body_first_customer_visible_time_t = todatetime(abx_body.abx_body.first_customer_visible_time)\n| extend abx_body_abx_body_trigger_event_s = tostring(abx_body.abx_body.trigger_event)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_confidence_s = tostring(abx_body.abx_body.confidence)\n| extend abx_body_abx_body_case_status_s = tostring(abx_body.abx_body.case_status)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_entity_entity_type_s = tostring(abx_body.abx_body.entity.entity_type)\n| extend abx_body_abx_body_entity_identifier_s = tostring(abx_body.abx_body.entity.identifier)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_genai_summary_s = tostring(abx_body.abx_body.genai_summary)\n| extend abx_body_abx_body_event_timeline_s = tostring(abx_body.abx_body.event_timeline)\n| extend abx_body_abx_body_platforms_s = tostring(abx_body.abx_body.platforms)\n| extend abx_body_abx_body_event_type_s = tostring(abx_body.abx_body.event_type)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_CASE_V2_CL" }, { "streams": [ @@ -197,8 +197,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_audit_type_s = tostring(abx_body.abx_body.audit_type)\n| extend abx_body_abx_body_audit_subtype_s = tostring(abx_body.abx_body.audit_subtype)\n| extend abx_body_abx_body_category_s = tostring(abx_body.abx_body.category)\n| extend abx_body_abx_body_details_s = tostring(abx_body.abx_body.details)\n| extend abx_body_abx_body_source_ip_s = tostring(abx_body.abx_body.source_ip)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_tenant_name_s = tostring(abx_body.abx_body.tenant_name)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_user_email_s = tostring(abx_body.abx_body.user.email)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_AUDIT_LOG_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_audit_type_s = tostring(abx_body.abx_body.audit_type)\n| extend abx_body_abx_body_audit_subtype_s = tostring(abx_body.abx_body.audit_subtype)\n| extend abx_body_abx_body_category_s = tostring(abx_body.abx_body.category)\n| extend abx_body_abx_body_details_s = tostring(abx_body.abx_body.details)\n| extend abx_body_abx_body_source_ip_s = tostring(abx_body.abx_body.source_ip)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_tenant_name_s = tostring(abx_body.abx_body.tenant_name)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_user_email_s = tostring(abx_body.abx_body.user.email)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_AUDIT_LOG_V2_CL" }, { "streams": [ @@ -207,8 +207,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_not_analyzed_b = tobool(abx_body.abx_body.not_analyzed)\n| extend abx_body_abx_body_reason_for_no_analysis_s = tostring(abx_body.abx_body.reason_for_no_analysis)\n| extend abx_body_abx_body_campaign_id_g = tostring(abx_body.abx_body.campaign_id)\n| extend abx_body_abx_body_abnormal_message_id_d = toreal(abx_body.abx_body.abnormal_message_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_reported_b = tobool(abx_body.abx_body.reported)\n| extend abx_body_abx_body_message_reported_time_s = tostring(abx_body.abx_body.message_reported_time)\n| extend abx_body_abx_body_reporter_name_s = tostring(abx_body.abx_body.reporter_name)\n| extend abx_body_abx_body_reporter_address_s = tostring(abx_body.abx_body.reporter_address)\n| extend abx_body_abx_body_judgement_s = tostring(abx_body.abx_body.judgement)\n| extend abx_body_abx_body_recipient_name_s = tostring(abx_body.abx_body.recipient_name)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_email_label_or_location_s = tostring(abx_body.abx_body.email_label_or_location)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_ABUSE_MAILBOX_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_not_analyzed_b = tobool(abx_body.abx_body.not_analyzed)\n| extend abx_body_abx_body_reason_for_no_analysis_s = tostring(abx_body.abx_body.reason_for_no_analysis)\n| extend abx_body_abx_body_campaign_id_g = toguid(abx_body.abx_body.campaign_id)\n| extend abx_body_abx_body_abnormal_message_id_d = toreal(abx_body.abx_body.abnormal_message_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_reported_b = tobool(abx_body.abx_body.reported)\n| extend abx_body_abx_body_message_reported_time_s = tostring(abx_body.abx_body.message_reported_time)\n| extend abx_body_abx_body_reporter_name_s = tostring(abx_body.abx_body.reporter_name)\n| extend abx_body_abx_body_reporter_address_s = tostring(abx_body.abx_body.reporter_address)\n| extend abx_body_abx_body_judgement_s = tostring(abx_body.abx_body.judgement)\n| extend abx_body_abx_body_recipient_name_s = tostring(abx_body.abx_body.recipient_name)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_email_label_or_location_s = tostring(abx_body.abx_body.email_label_or_location)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL" }, { "streams": [ @@ -217,8 +217,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_type_s = tostring(abx_body.abx_body.type)\n| extend abx_body_abx_body_event_id_s = tostring(abx_body.abx_body.event_id)\n| extend abx_body_abx_body_tenant_id_d = toreal(abx_body.abx_body.tenant_id)\n| extend abx_body_abx_body_posture_id_s = tostring(abx_body.abx_body.posture_id)\n| extend abx_body_abx_body_posture_name_s = tostring(abx_body.abx_body.posture_name)\n| extend abx_body_abx_body_posture_category_s = tostring(abx_body.abx_body.posture_category)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_workflow_status_s = tostring(abx_body.abx_body.workflow_status)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_platform_type_s = tostring(abx_body.abx_body.platform_type)\n| extend abx_body_abx_body_posture_area_s = tostring(abx_body.abx_body.posture_area)\n| extend abx_body_abx_body_tags_s = tostring(abx_body.abx_body.tags)\n| extend abx_body_abx_body_benchmarks_s = tostring(abx_body.abx_body.benchmarks)\n| extend abx_body_abx_body_raw_event_s = tostring(abx_body.abx_body.raw_event)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_POSTURE_CHANGE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_type_s = tostring(abx_body.abx_body.type)\n| extend abx_body_abx_body_event_id_s = tostring(abx_body.abx_body.event_id)\n| extend abx_body_abx_body_tenant_id_d = toreal(abx_body.abx_body.tenant_id)\n| extend abx_body_abx_body_posture_id_s = tostring(abx_body.abx_body.posture_id)\n| extend abx_body_abx_body_posture_name_s = tostring(abx_body.abx_body.posture_name)\n| extend abx_body_abx_body_posture_category_s = tostring(abx_body.abx_body.posture_category)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_workflow_status_s = tostring(abx_body.abx_body.workflow_status)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_platform_type_s = tostring(abx_body.abx_body.platform_type)\n| extend abx_body_abx_body_posture_area_s = tostring(abx_body.abx_body.posture_area)\n| extend abx_body_abx_body_tags_s = tostring(abx_body.abx_body.tags)\n| extend abx_body_abx_body_benchmarks_s = tostring(abx_body.abx_body.benchmarks)\n| extend abx_body_abx_body_raw_event_s = tostring(abx_body.abx_body.raw_event)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL" }, { "streams": [ @@ -227,8 +227,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_ato_case_id_s = tostring(abx_body.abx_body.ato_case_id)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_compromised_account_s = tostring(abx_body.abx_body.compromised_account)\n| extend abx_body_abx_body_first_detected_t = todatetime(abx_body.abx_body.first_detected)\n| extend abx_body_abx_body_indicators_s = tostring(abx_body.abx_body.indicators)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_ATO_CASE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_ato_case_id_s = tostring(abx_body.abx_body.ato_case_id)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_compromised_account_s = tostring(abx_body.abx_body.compromised_account)\n| extend abx_body_abx_body_first_detected_t = todatetime(abx_body.abx_body.first_detected)\n| extend abx_body_abx_body_indicators_s = tostring(abx_body.abx_body.indicators)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_ATO_CASE_V2_CL" }, { "streams": [ @@ -237,8 +237,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_remediation_id_s = tostring(abx_body.abx_body.remediation_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_threat_id_s = tostring(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_recipient_s = tostring(abx_body.abx_body.recipient)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_initiated_by_s = tostring(abx_body.abx_body.initiated_by)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_REMEDIATION_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_remediation_id_s = tostring(abx_body.abx_body.remediation_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_threat_id_s = tostring(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_recipient_s = tostring(abx_body.abx_body.recipient)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_initiated_by_s = tostring(abx_body.abx_body.initiated_by)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_REMEDIATION_V2_CL" }, { "streams": [ @@ -247,8 +247,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_vendorCaseId_g = tostring(abx_body.abx_body.vendorCaseId)\n| extend abx_body_abx_body_firstObservedTime_t = todatetime(abx_body.abx_body.firstObservedTime)\n| extend abx_body_abx_body_lastModifiedTime_t = todatetime(abx_body.abx_body.lastModifiedTime)\n| extend abx_body_abx_body_vendorDomain_s = tostring(abx_body.abx_body.vendorDomain)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_timeline_s = tostring(abx_body.abx_body.timeline)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_VENDOR_CASE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_vendorCaseId_g = toguid(abx_body.abx_body.vendorCaseId)\n| extend abx_body_abx_body_firstObservedTime_t = todatetime(abx_body.abx_body.firstObservedTime)\n| extend abx_body_abx_body_lastModifiedTime_t = todatetime(abx_body.abx_body.lastModifiedTime)\n| extend abx_body_abx_body_vendorDomain_s = tostring(abx_body.abx_body.vendorDomain)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_timeline_s = tostring(abx_body.abx_body.timeline)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" } ] } diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json index 49b87d26e5e..c87b7305544 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json @@ -13,111 +13,111 @@ "graphQueries": [ { "metricName": "Threat Logs", - "legend": "ABNORMAL_SECURITY_THREAT_LOG_CL", - "baseQuery": "ABNORMAL_SECURITY_THREAT_LOG_CL" + "legend": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL" }, { "metricName": "Cases", - "legend": "ABNORMAL_SECURITY_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_CASE_CL" + "legend": "ABNORMAL_SECURITY_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_CASE_V2_CL" }, { "metricName": "Audit Logs", - "legend": "ABNORMAL_SECURITY_AUDIT_LOG_CL", - "baseQuery": "ABNORMAL_SECURITY_AUDIT_LOG_CL" + "legend": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL" }, { "metricName": "Abuse Mailbox", - "legend": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "baseQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL" + "legend": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL" }, { "metricName": "Posture Changes", - "legend": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", - "baseQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL" + "legend": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL" }, { "metricName": "ATO Cases", - "legend": "ABNORMAL_SECURITY_ATO_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_ATO_CASE_CL" + "legend": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_ATO_CASE_V2_CL" }, { "metricName": "Remediations", - "legend": "ABNORMAL_SECURITY_REMEDIATION_CL", - "baseQuery": "ABNORMAL_SECURITY_REMEDIATION_CL" + "legend": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_REMEDIATION_V2_CL" }, { "metricName": "Vendor Cases", - "legend": "ABNORMAL_SECURITY_VENDOR_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_VENDOR_CASE_CL" + "legend": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" }, { "metricName": "Other Events (Fallback)", - "legend": "ABNORMAL_SECURITY_LOGS_CL", - "baseQuery": "ABNORMAL_SECURITY_LOGS_CL" + "legend": "ABNORMAL_SECURITY_LOGS_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_LOGS_V2_CL" } ], "sampleQueries": [ { "description": "All Abnormal Security events across all tables", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n | sort by TimeGenerated desc\n | take 100" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | sort by TimeGenerated desc\n | take 100" }, { "description": "Threat logs by severity", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" }, { "description": "Cases by status (last 7 days)", - "query": "ABNORMAL_SECURITY_CASE_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" }, { "description": "Event volume by type (last 24h)", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" } ], "dataTypes": [ { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_AUDIT_LOG_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_ATO_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_REMEDIATION_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_REMEDIATION_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_LOGS_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_LOGS_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_LOGS_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "IsConnectedQuery", "value": [ - "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" ] } ], @@ -229,7 +229,7 @@ { "type": "Markdown", "parameters": { - "content": "#### Configure in Abnormal Security Portal\n1. Log in to [Abnormal Security Portal](https://portal.abnormalsecurity.com)\n2. Navigate to **Settings > Integrations > SIEM**\n3. Select **Microsoft Sentinel (Azure Monitor CCF)**\n4. Enter all 7 values from above\n5. Click **Verify Credentials** to test the connection\n6. Click **Save** and **Enable** the integration\n\n**Multi-table routing:** Events are automatically routed to per-event-type tables (e.g., threat logs \u2192 `ABNORMAL_SECURITY_THREAT_LOG_CL`, cases \u2192 `ABNORMAL_SECURITY_CASE_CL`). Unknown event types go to the fallback table `ABNORMAL_SECURITY_LOGS_CL`." + "content": "#### Configure in Abnormal Security Portal\n1. Log in to [Abnormal Security Portal](https://portal.abnormalsecurity.com)\n2. Navigate to **Settings > Integrations > SIEM**\n3. Select **Microsoft Sentinel (Azure Monitor CCF)**\n4. Enter all 7 values from above\n5. Click **Verify Credentials** to test the connection\n6. Click **Save** and **Enable** the integration\n\n**Multi-table routing:** Events are automatically routed to per-event-type tables (e.g., threat logs \u2192 `ABNORMAL_SECURITY_THREAT_LOG_V2_CL`, cases \u2192 `ABNORMAL_SECURITY_CASE_V2_CL`). Unknown event types go to the fallback table `ABNORMAL_SECURITY_LOGS_V2_CL`." } } ] @@ -241,7 +241,7 @@ { "type": "Markdown", "parameters": { - "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." + "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." } } ] diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbnormalSecurityLogs.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbnormalSecurityLogs.json index 4432e42f559..20861f1ded2 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbnormalSecurityLogs.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbnormalSecurityLogs.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_LOGS_CL", + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_LOGS_CL", + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -57,7 +57,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -65,4 +65,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbuseMailbox.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbuseMailbox.json index 55d6620d28b..27d193354b5 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbuseMailbox.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AbuseMailbox.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -53,7 +53,7 @@ }, { "name": "abx_body_abx_body_campaign_id_g", - "type": "string", + "type": "guid", "description": "Abuse campaign UUID" }, { @@ -127,7 +127,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -135,4 +135,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AtoCase.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AtoCase.json index 296eac07c61..67c0df7578f 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AtoCase.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AtoCase.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -87,7 +87,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -95,4 +95,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AuditLog.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AuditLog.json index 5db0d0c8ce7..cac7bb32f4c 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AuditLog.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_AuditLog.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -107,7 +107,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -115,4 +115,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Case.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Case.json index 5aae88755cf..287ce94ffb7 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Case.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Case.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_CASE_CL", + "name": "ABNORMAL_SECURITY_CASE_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_CASE_CL", + "name": "ABNORMAL_SECURITY_CASE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -157,7 +157,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -165,4 +165,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_PostureChange.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_PostureChange.json index 37de9202d31..156c8f5e0e6 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_PostureChange.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_PostureChange.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -132,7 +132,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -140,4 +140,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Remediation.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Remediation.json index f8f5cdc70ae..c3229232826 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Remediation.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_Remediation.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -87,7 +87,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -95,4 +95,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_ThreatLog.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_ThreatLog.json index 2a1c1820211..c3ae98acfd7 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_ThreatLog.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_ThreatLog.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,7 +38,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -58,7 +58,7 @@ }, { "name": "abx_body_abx_body_threat_id_g", - "type": "string", + "type": "guid", "description": "Threat group UUID" }, { @@ -272,7 +272,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -280,4 +280,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_VendorCase.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_VendorCase.json index 1ba9838811b..9e5939622bc 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_VendorCase.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_table_VendorCase.json @@ -1,10 +1,10 @@ { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", "type": "Microsoft.OperationalInsights/workspaces/tables", "apiVersion": "2022-10-01", "properties": { "schema": { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -38,12 +38,12 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { "name": "abx_body_abx_body_vendorCaseId_g", - "type": "string", + "type": "guid", "description": "Vendor case UUID" }, { @@ -87,7 +87,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -95,4 +95,4 @@ ] } } -} \ No newline at end of file +} diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ABUSE_MAILBOX_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ABUSE_MAILBOX_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ATO_CASE_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ATO_CASE_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ATO_CASE_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_ATO_CASE_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_AUDIT_LOG_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_AUDIT_LOG_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_AUDIT_LOG_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_AUDIT_LOG_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_CASE_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_CASE_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_CASE_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_CASE_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_POSTURE_CHANGE_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_POSTURE_CHANGE_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_REMEDIATION_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_REMEDIATION_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_REMEDIATION_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_REMEDIATION_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_THREAT_LOG_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_THREAT_LOG_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_VENDOR_CASE_CL.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json similarity index 100% rename from Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_VENDOR_CASE_CL.json rename to Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/Sample Data/ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json diff --git a/Solutions/AbnormalSecurity/Data/Solution_AbnormalSecurity.json b/Solutions/AbnormalSecurity/Data/Solution_AbnormalSecurity.json index 2751537cd05..b95afb26344 100644 --- a/Solutions/AbnormalSecurity/Data/Solution_AbnormalSecurity.json +++ b/Solutions/AbnormalSecurity/Data/Solution_AbnormalSecurity.json @@ -41,7 +41,7 @@ "HuntingQueryBladeDescription": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view.", "PlaybooksBladeDescription": "This solution installs the following Playbook templates. After installing the solution, playbooks can be managed in the Manage solution view.", "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\AbnormalSecurity", - "Version": "3.1.0", + "Version": "3.2.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_AbuseMailboxCampaigns.yaml b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_AbuseMailboxCampaigns.yaml index 395c6fb75f2..b72665b0f3f 100644 --- a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_AbuseMailboxCampaigns.yaml +++ b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_AbuseMailboxCampaigns.yaml @@ -7,13 +7,13 @@ description: | requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_ABUSE_MAILBOX_CL + - ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL tactics: - InitialAccess relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_ABUSE_MAILBOX_CL + ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL | where abx_body_abx_body_reported_b == true | extend CampaignId = abx_body_abx_body_campaign_id_g, diff --git a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_NewVendorDomains.yaml b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_NewVendorDomains.yaml index d423cd3bb74..1a4b8a1e74b 100644 --- a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_NewVendorDomains.yaml +++ b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_NewVendorDomains.yaml @@ -7,13 +7,13 @@ description: | requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_VENDOR_CASE_CL + - ABNORMAL_SECURITY_VENDOR_CASE_V2_CL tactics: - InitialAccess relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_VENDOR_CASE_CL + ABNORMAL_SECURITY_VENDOR_CASE_V2_CL | extend VendorDomain = abx_body_abx_body_vendorDomain_s, VendorCaseId = abx_body_abx_body_vendorCaseId_g, diff --git a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_TopAttackTargets.yaml b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_TopAttackTargets.yaml index 01c5303e800..bd324075d66 100644 --- a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_TopAttackTargets.yaml +++ b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_TopAttackTargets.yaml @@ -7,14 +7,14 @@ description: | requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_THREAT_LOG_CL + - ABNORMAL_SECURITY_THREAT_LOG_V2_CL tactics: - InitialAccess - Reconnaissance relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_THREAT_LOG_CL + ABNORMAL_SECURITY_THREAT_LOG_V2_CL | extend RecipientEmail = abx_body_abx_body_recipient_address_s | where isnotempty(RecipientEmail) | summarize diff --git a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_UnremediatedThreats.yaml b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_UnremediatedThreats.yaml index 4be1415fcdb..a54ce93b088 100644 --- a/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_UnremediatedThreats.yaml +++ b/Solutions/AbnormalSecurity/Hunting Queries/AbnormalSecurity_UnremediatedThreats.yaml @@ -7,13 +7,13 @@ description: | requiredDataConnectors: - connectorId: AbnormalSecurityPush dataTypes: - - ABNORMAL_SECURITY_THREAT_LOG_CL + - ABNORMAL_SECURITY_THREAT_LOG_V2_CL tactics: - InitialAccess relevantTechniques: - T1566 query: | - ABNORMAL_SECURITY_THREAT_LOG_CL + ABNORMAL_SECURITY_THREAT_LOG_V2_CL | where abx_body_abx_body_auto_remediated_b == false and abx_body_abx_body_post_remediated_b == false | extend diff --git a/Solutions/AbnormalSecurity/Package/3.2.0.zip b/Solutions/AbnormalSecurity/Package/3.2.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..4fc72b3fe2d77fd57148001bea1c2afeaadb47dc GIT binary patch literal 30100 zcmV)?K!U$eO9KQH0000803v_MtB zX>V>WYIARH?OW?^8#$K#pQkv`?7~u@OX6uP7Qto)ij(dHa5`DrNzWh(465p=iena8 z&BKzc?hUZdGLJS-vN&X2rE)GEE6McipTw$Sk%x!p@_mQouXg|j|3*=YnHW5PLF!yi z4`#FQWSR*r63kG$sraR^IE_qJzN6W_>HX>PB)7PhxS5?;6b@fKdyFforISWapBKu> z*V*)MWb_{fV;(9MI#y_TsOK`WhRn)M=f3M!2chj6ElH!fZD*+PHWyZ8=+M&O0sMLg z0ALUqy^=}&8(<*mC;5x8@!$chgd!YQFP4I2)O_ln#YmBrxhn_#FPSAkHhQ?I)ndhF znn;%x%Yx8GMmtswE5*+t{5v^E?W9IE%LF;JvvZ>g?v!Tpr8YJb>KvoOO1GUo7Eb*8 z@x2qHHAc=@nw^@&%tYCa%63y)CyN1WWbD$1i@|@~%dZy$NKq!KtAGD#p%?n@-5-s^ z2Y2tnOND|EEUwUkGvHE$l~KxUq)uRoD`OF)CMT5QC;XmDNgn|B^^gDkJDhoycV5Dq zGYoz6Q1o_KX(wprW_37=_z^lOd-t7Bvv|a!0LyZbqD9EW7M2KauC&=`kVHjW25}{( z8O^91vyz#7>(F=vIa(*A_OoWiNP;bj}c8g*=JcsGKAD$6}FF)Ad2+LhpY4iFn-ul!owz01DVye9UM<1yU5 z`%+lK@cTRd{gbg*OJlD5ll%N+u7%n<8Npehuxa?TV6`Xk-vwIPdj3+0ZPNh{{^k^g z)sV3biKQuA&*JUbu#dQvA&=mHV855zi{Afn?FF%kMm~I&5s!*xJLEO75MW@DOkpE@ z8LZgH**C2Q&<^1*aEdZvlP8O?afC>IgZtn?sDGojErul}1m z>-69k;O4fcCXtbExKd_AgI2q@_22JWs!}EreQL_kiC8$X^PF>?jAQhfg|61{2WyIaS8~C*;K{WlHsZkp zaJFdma;N=&*=LhAD??~yPc1SQW{{veo&QwJ-;#!-LpSr+_B);1Y@W*#qn$OX^N}&? zLbC9K3l7vPsW|Dwa@#10z@@?g@?1b_ug|k`>fq-NgbE{val7lt=-49_?)**S@rNBM z)QL-n9n}p-Q=Z;vd~fu&-GjxS3nbTL6RBa$G5F!hMaKpQxp1i;E;2e2ZrJv~;bz;nMSAX?`Bo|TWS$z#s>8>tj1UTdRO%M4mpK%Zs?n%rnKhM{zr`F?WFRm0MDj(%MPeJ=(N7K5WPa5Mka7>*W$@nYa5>3{p~Xf)~= zb7{`fV!Rg&TH0#DPOC|AAcy$}f&@p*24?gc&`!E;w^=F?e>m^{X*TJIJ|bd8RSN1xWH@oNSWwr_Y32Fd)Kr=XFNb<-c>BDKqdz@1eU3Vy;jEd zAkLu&c2oGPDIgNs=a!pVg&w7btto5|3~AhH3iFjidlN?(vsf#cFm7W=iJEa=K+`)? zFSjk`krXl(I$|&l0W36#nYqTao${KnwPS}Lxrh@b_0|1@E+UW6^So`!d$_F>kk#Q; z75sh|uJ}$0E8E08HW5v;T5jfA9_rPMXIAz-;f^O&$2BGkf4<3UbO z72wtb=<)vt(2ozGcXoN?hXD63Q|)5ty|+{>Ps;`!teRVVEtHHamO418V-LGfKPMh= z<)!=CW20NF^WBZGt5>*B16;LCUpR&I#E$)dR0}tSda6}P4+N|fUNaEpgt8XoGmZ}l zZMXJ>o+KB%bnKTQVwPD38Y`m|){+XLz+$M|ZKO*}>JsX5{8%U-$+qD62&W}qm=t*k zg+?P73z^W{ZdCFSt7oz-Ok}d9)ZRAAdSapFN@C1E(2B_UaCV(@ZA(W;pBYw~wf2DN zn?Yo^g1KD5D=yTeT>J?m2amvR7kO1m{CGrr&M?!oDSB5C`!wOj8g0GJ()#2E*WQ=5 zU*bL&|7}bEf#vVG`+1RN!pdK`UhQk?bx~SGktsOGiz_s1MggJR%o{tC;EfnVhD5?w zq}gZM#pec-)Fr%qT~O!L-8MmWpGmX*5DD=Uh444F_HVQ~z2?TihcPpC;U z8uNgn)xQU7TBs_QP3l}$&T_oa#sWnmqtO(6k+~x{tA&av1wnA0i);)(Sg~bcL%ush z&Raqf`D%o)xX?VP4jU0_3wRx=BF1CyZ=`l94n8-L6&s@f)*B zp{u|j?5S2pc_M0GYjZxDve3^QvP(Pmzl@cMeQy-=$z9ESfPJ(C)U6l{moNtKG zU&^AtJE%p!E-6^;`ys#{2DE(l&k|zW%oN)3bfH^Ol7p(ua_*IicKb@hGF?L z_)GKMsB7;F-TjPhu@+30XA|}eJRIEwUuQ?IKG{&tj=8q<1xayPX#Y7J+3ID+JIA_i z-gtgb!%yR?U7@})!deOkrF0)8sasKM>8<5!Vv1RzbXk7-jxn=u{AB z<6w!%F*P&mb^)>i&qHn^3TGxYnuvXz=I30MYds%L7y4=Cl@&Yo6pasBhxJ*qh$2dT z*=f0Lpp8EuEUDw^TZl179TS))V^tIP#n7Ft@8SH>k1x)i&rdJUpPalpdv@{H%ZsOH zPv#ewr!RiEe0_X*ath&$E+?=H7GiX0Fw?f4!xF~lyc{)CZZv!QUhtI&<2*?$Cf<~9 z_Jg)jah|ZaM!_WmgsiQgg=Q2_;8`TUtt@XNb!;|Mm;>dEn7uUv9}id9>YAZQDSih3{Yw|ut|Aqxca!^jRaz~Dr+F6YjlF~E5cQwxSK>2T!CX`mRl4t?>9HK z!xj?_XJ)fpnJw~`u@XrV3MvP%_4%V$=T9!5&!3$>dhwTUz}yeZRe!{d+BQ|E4sAMs zxql_Ldg_l`cPAIDY9%d4(mY4Oe4!`&cQ#a;qYn$cAJ+AIlnIW{EpT-{Fkp`IOD?AX z3ahq2GSNaUv{}Io9Jfo2`SRjn9N_hnA0NLsyF8hnKRJZ?e-ahWt7}TVEV#bJbPM~# zeItF={&25wpT@asnZ7Z)T}|y1wubAeRE8g}?Q)&lw>$vBZnXD%-WD!PRQ0}aHR}WI z4DWky=URm+TwZkUs5JL=CavpfgEv0#4u9iS6`^CkVDek9tBmpILMW=f@b^us;cIdE z?n&ofi@%#v&7plSrG4*i@TU4PY`17G4{?*8vC2zOtj%|K-re~>P)h>@6aWAK2mm5~ z{9G|54A9zU006}L0{{^K003=aX>L?yZE$R1bY(7Tb8l|!z1w!%NR}x0o?j88>{${u zBz3i&c2(vnrX**n)3(%-?Cdj^7c&S1Nt8eY3IRw~xjk#1&Ig=Nm{033nYH5r1c1PW z7f_OoJZE)TMBMg{9XodH>z5x8+W0qSP00*zyh0n(F!b50ogMK@e}+9gAv5BIef+N| zAbpF@;t5JDR`3a2!HhJ%qugBf-&i4_G-c#nFBMZQmi@NZatV)7HL zjSt9YoWWuk3~@=_D0HZYLb)_FrUA+hyzv7dL4qmeuoD)wUE$Ue~+}gY#6HW~j393a*5s2Cn zhI&232oM5L3jn4TiWqT;1^?RYCWNxJslIP^I-e?l)?qD%sgSzr!1{-p3wd}Z==}|y zpn-?o`_Qo%x|@=Kptp_{P)5fgx+Grcc*KPbWh9JzGYl!3eTQdck$uZiKCE$Gs#jy6 z2@E2@To5Q0jr5`ChsVV%++x1#gj@PpTb;gRchTk!r-}K%)5k%My(nlvb0bP`_IiMz zMSxRm62%Po?3M(#4!Nshc=ec>qVZ)i!;UKuR(&Z9pkDKuhZ44DVko29qf^rSDd+ngVFK;yKwo>(ne9>#Y3c41;bQt@V#@ET zF-k44#e7A3t6)!~$HxI9!P)2^#0vLxsbeU zTMWF&dD>z4me`jB2iCOgbahe9HHjrItH*)O1z{e|gd5Yi*e2s4w({zH(7aY<$>*?%NdqLy5PNcO9V#CYvy zrYNS7g8~{kSe!;i5hHK0cyNGwFZX^r>|yf!1-72;k>|EHkUmbiJd@j%flGoA z`l$^EBHFAoeTr!G6+DReg7c(P4~P`;n06$VzxNi9zj3gz{2l9FVJ%{mdLW4jH#xBh z_$p|3zk+u6Ytt@oY2*FFgVFe~ckt6bsG~+NdoM?acF!Wu$7Ax6ycm&D5$*0TPrG%d zuT8uA4@A55fT&Nq`wvgMwLqGib`L6O_n{)M2EW39&BD=kpyU!1M zdl-+cL;HaIWIr#W-Gk+6x6bsnY4_lPXty2^^=bFu;c2%PNORNfVFm3T)}~$FaeKGw z!_#gpkSb_*8iDn2@*fci?hW#;{<%!v)!U`z-O<6}9^SP_z1^4l&w7WuHtCIa4@hrJ zo{bKk?T!xd3!Dt3kMkhX=JcO=%BcZCEzIs$V0OPYW_in(_Gr9kk9T{!2f(_lXSg@Q z`}@7a@!sy}r+sX_+^vb({RhHq9SCY+_Mif@2emQFTfW${4{W?Y>g`+hVejxcA-$gt z51#i94}K!M_$AptJgAA;g9pNF9SCY+_OJr8hqW=wTaJISf7*LV#=RHT0qz~Xga^-0 zWZXMAcyaK;A}{gY;q!W!J$xX{)`7r)S>@1B#6;r;?lO|F$HB)G-Ii$W1HM(dU_aTXrms3)hdOYOso9<+}?Xt8=-G{IN1YkULgcBFq4( z=F0-P0E}#L7?sO&9>!eTliI4QB#E=tEp9G zOYjF6bQm1ttb=Fb$JdearqSEYu;VFWNx{*4m_>H2+R^z~hc-anqmjJVO1a<6@PEc41%4G{9z#v)|i&Y2r9>k0lsiYO%@ESbmZPSw-Cc zMw0DO#6miA{srjDw<#!*aj9txr zH2?FrIJmLt9Y^Zbl%S8fAwF%Xb82!c@1PhV$dA~RFcc8%_CjYykZOp?EyN+At&n>{ zu`aT}4BbUIvYimQbOQedhXw?G=p*_W1q3|VSr_?~g;79|HO1Zp`V6klRQG_)i0$wl zhXFhr-Et$h_}&pgD+-`ZhAfvxHsZeS$=ZN}jA<}Kju%o>bV0-%Z^C`^kEl&t!WfDP z7QF^C1Oh}`M@O$a2zCnjI1EYP_0frd8wUghGzw)*5(#=7Aw4)YDCEZ$&2VT<)kH3t zVC!B(t%qmu&7vN3bg0)w#KR*Oeq;pC_^M{kM4Y+4dD|xe_NSmya14w|{b!C=`^(>_3-<*f3TDP@hW0#51fNz*9bH44gd|K~GxwdbN&bQ` zH8ZhO<8UcPWNMK+yrxDuf;Tlv2;|yB|AiP0LNvNZSI&(5Mm%^M5*xwh@z0lt zt2sIunvkL@yfR=3jNFpKr%`(ItGAu6p6i_KcwqE13aQi$gWqgA&h??a!fUX9L_@d>>&;#hPEJ%8@)g_zGt0 z7{3OFe4{c{ro#05Ns|(4OB(SuG_XlfkK}6Kim;fgdw-D|Q7IIcd2$08gLe0VSOoH# z%<=rb_H?YlwxFNU41eBA?NA4riJfzpM1NKZShJPR-9WWygv$@kOU5%U(!-m&r>GtK??jrY~9L? zQs#+xllE1x{Hs8xt~Z!L>IFrgg@on@6uf?swwdVXT<`ehYNkMhJ}pU^_!c`Z9yu;( zD9n~+P@3`gE@T?}p(X>^@JTRp7#Q`J7T42@v-y@NxHw1&dwO8yx+0kO^Y(9CM(&`RSPr}!%C%Pi{GZ>^SdUSlg{ z7Y^6PD-;G1DIS@RjqN(^zgyggu0P9|dIMuu#w=ay*oo1)U!E(bc{0SlD&%6&&Rr7$K;l{ z;532)>Jmf)G<7CZ67-9BM8OR`Cpre;BegI(Fk{ZdLvN|)gcS53=q)!mFm$dQN+dWQ z0%ZiUs4H`Rq9Ae!+B!bE=opd27ltl=9UP&vJC6i_k@t)QXkc03rZBK)jwi5B#Uzbj zs-7>58CL_44T!;#kV;8;=Y&&)1yCX7jvJS!CvU-#gh)>e$V&-<9IO~b^O35}*C9`B z5b=$<42i#h!YFn;+UuiZkqkERZ&7ZPCAN~By4_)#=L&aI0jkL15?o=xTc+4w$aVr^ zg)VPuaLl=NFh{x|I7!Or6pY*)_k;7(V$QE4u8c*M(VFi0ru?W%xvwFsa$#HPzzBo? z_~Va1qCphW8P{$Kzq3eC*tK`$I@S%G;O%X(ecRjU&T(DI@?KqgJ@gU@W(-yk<#7ZV zM>D=i;H2bu6X*d#JvvGb{Y8A}1>L_yEDQ*qF;n9c&-SU~h0x)o!)J2Twm|zVyTuwi z<)fbsqHqcTKzxFOT|Uc&yg$+D;H_Xzf{XDa*J!JZmvyeaYmZZADLrxmB<{T+Oi6{p z|4XcBzrTwt*8$bPwz$H>U3Qn2aJQN?Cw5!Qg-L^7qcEf^BtjRD2u~I(8ABdx+~LjS z1#BEo+vtqEl^;1i=b0%M!}WafdUrtPhs9c-RX;I@>zt7Y7aQ(dluqDNYVB zc3k%lhbL|>hETQ@bDY{`L|8;rO|yfh@vF)xf|`X;xoP{MkDak|Q# z6fr$&8a2y$xAXYuB!=(%*i9~6pU!3x7tL49RMT53a^tLfLod?MJ;pnQS2ErW>|8$6=7LnouSfco05M`d#8%vc1i9y4%|){H+EZr-0HJ7I@5U zZ@-P)(CG=9k`LEc+uM4~4Hi#krJ$;az}X`GNxzFi&0X-n|JVOUe^&dv{3!#PirOcZ zi$6Pk^xnJi=$$8?m)viRp$SzQq_Onv6{|9hmRLIe>_6(q&_N$bGT{6!R?O6X2J!P0 z%wqrDfS|E_52Zr8Qg3)g#@~kO=MU_J=vi-X7tI_m3JF7a3}-No{>mH;pkD$iT6pw1 z4E_EeZxHu5dJL?|(tl^zSyKVos?b_0NIsit zVzH_@6`|UDO@(U5#jNHIn)Y#!WG{H|6b(fo=gVwPes3Dd+K>xoFUr9XH@sac0fHPv zY)(<6d#Z?5QML=yxcX@`^#k2-VNZntmF6YSe++_4QdH9jN!E5)9!77hq$cXC!K!Pm zN0w}>yP%4|{?HLGvU41S9x-dirJ*=Jx~O-dJn!x9)wxJA3|7}TG?>mq-$qer&Dgx^ zib}6psh{$d0ri#Y-T;vNNdK0r63Po!R3b}FT&J*LYW>0*drT}B3bvN`7Rmf4y(~%a z3;>0mVHN~BmA;m0xMYCLT;_$5smIxXQ-}&FtFsFG9aBI1@`*&<_DIKy2Cpg5f zq4Giju!WJQJm{lD4_K;SoGX4Xvu%YFmSU)A@G!t0gS@}L|C8Hr#GWMP`?P%@EciAK z34|$$5OjzcmQ8i)A0`I-A*+{W$UF|r#6mptONNQt6ps>MiwqrmIN^g#BFD}QAsb{z z043?LHeftUS4{}>BbR`hAGi=^!?*>&8wM@Gf@w)b_%7P1q8Nk?8ijroUh+f5J)Vj* zvE>ODjl6sL6I`YbZcp-4JIUGsVGK|BV1lzj1ZMhVXh%e~ooiec1|^5tFgo<8o%KjLQPqp^sWkE>dsY*s!NcsUM15U3h0ZdhYHY})~0tk#gS zZ3X_QYDX$Z)!UYj8W79zA+DqDf^!`z$LBdc`1u@$=_}qideXdt0ys;kHEP_nd_-{Y z3_KF14oo>V3|%VDR}|8rs;EHh;fRkvqSVM5(v8bUh7u07N6s{^+QT^U^-$zQsV0(a zkNPttjJyW57`j#9KMb*TQzc-De+=0vhg##?6slC!99uN5H7+<94gH)KQRk894Lck45MJpWww zjWb(hGU&I!Y%?5K3rzk63}vub6TY*aB4Cp-`+ zONWxJ*1!YBo#g~99MTaZ0atKTJ#N$O%g2Uch9VJJjgj@%b=Dl?^VVU`$R#zkE+w5S za2`052??Yvqzd(V<0=VTlzyoesN*U!WmE=X(-4kRdDkW_Yn*_33Kp&DL+frJ%r%Vv zr;cJpG?o8TL%$*$0t!QC?2w@51WAXA)04!*SBSuVXD&vgp)MGM9%Q_>nXjFet*|f{GO7>lk{qrWIq>H&)d&P(=)cS*j8)O!LTP8bgWC2b60v@vW_3^CShE zIwpfbzHn6l2}(ht#~N91E>%@+4&w9MafFrP3EPZn{p7gw@@u7M=M4ojHuy zLu?8E(n=?XT$eh&B{m6p72vw=B&vPYbJvDKIW(wYe^)JAe*U=mx#FJ>&&lDKGAMkfKYRq}GZkl93KSXZ~WuIq+pVHZJ*)j=p)+m>ZNZkDYv%7^FL zdcvZXYd=Y@eM>x>21l5Y(+bm}-m-=mdM3TBA?Hj@NmTDrK7)%{_?Ft>h+1=kY>zrv zIj$9HskdFH18ZFu(@N*k)^+nyaQ0k1CnIP7p(<(Cf@K!U^7hoJwXnBav(`dI(H>FK zuCbyEUgWxSS6C1sH{bum$AE2w-A&L6D7Aq z?Y}$BWF0MHLlHM>DCNDelA3(ADlla0FVuyPS6oE#T?=K!E?yrU92~raN?|h`t`-Kx zTUHJSrvb+@)I$^7<>PyoVjFG6H5#E1TI2=9q7%>g7qRu4j-Ay*U72EWQOI9Mt}E9b zb7;yPhM-Poh#e0~4JJZaH`(njuM(%Eq~>5wMMN}3!cb-}iOms3CPV7?Tyjg?)CJZc zpqgOY_)&cz2xFnU8bA=E>vLKd7@Z!Yt>50C9(UFYUb!T={8l>bn2d4chQ|)`U3|as z3W~)tQqtk?j%^dKvSF4Rh?2gV1iVh9t(5$~7o4r^Ks{cBt+QHMEuXSho?lF!uY*fI zL@U@Al4=gktzcimYX+l;5d_}6Bl;N$Pwli!-^%LC5@0KZ@p-t7h4bd|Md$qUwk0}YKBoOK$;8k2bq-JbTiYyJXS~*o; z@QKjf^gaWrN5i#2n+o(=@f%cJHfjd+{{883)8H7R%&NfxfAKlMl1ec-2Y+RI(F`sSx$d){N@jtimzK2`LOyuFp zL4=~wh>rP=s=3w%QylEq(20}duNyus?sDaTeISADSRtaq#G}YioW|xiE*${cC^ZWH z5>L54*w#*!Yl6@i1iNw=PvtD=t(c{EdW@z7+sz-l!T{Wc_EBWjMSMa;0~DLRTcv*y z;##GDtMqS`{$+mst-gOjeSbL`dGA)$U;lb-RsALR|3CzIp%C8?dP@QX(Qd7-zxB&8 z9jVqY=ezRD$p_1>{Q2?TbN(3-G`Knwj3;p>Yg|Pd2kfpKs7pDtdKN3_8V5;+ajhJn zqbLZ#wk9T6H(16H=JhBvw5gGtx@l;$!PL$BSHnJn9+=OJ)XdGRaFW38m2c*NSENJ9 z9BAv`FVEf~90d5jN$X4N%D4>DT35yeaMrpqHtfonN%`BVH5OEBRN#?!Z}l35B$`8U ztJf%#03ZWDa;c2MY5f+n|FwRL700WMG5Yp&88V|wL)=CTk9-n97-#cOD80x@Lm(yb znd<>2uCLN4JS-aZ)&WzJa3j`;LV1Ck^rZdB2y?~*uYO+%(vKU$Bn z7G^|uQ<_}B>XfyfOl8PyJ(*fhrq+|GsGeo3?psXV*LpCm?sjc8eI?fyqy}u2e67RM zLMN+L@_lnkK9M$Wcq=jmHu3P~6CgQ3>?#6msIlw_S-lc#BxY55W3AZ}%i^giNw9Ko zM9xbRpynfrr9z@HUBvo!L--$2nG<&%{zviYNt}?>^o?sYaY%+1yFj8 z0)lNwGmf;c>m=l)4nQ*(g&JS?wFdZv3Ac&-&T052#KX>zMY9=h#^iq5o2abkNKTW5 zRSelYtTIz>T#KQRd@(RI0L3SJux(X^P8;z%7>{|d1BxeESD=8ti|b6$y#;#tHUgp; zZLKx5wT8CV(CYfTtzC36yJ#(B@-f<2i28SHYauPU(&Dl#vba04rr4XbM$^`4+8RxZ zMfLA0%R@tNkn=RdQGWMmi}WXbp@f}8qAuIe4xDkgrYBdExh#Yi`}z!a()8GXIrt5k zVCx=<3D#glmDf`w>bufR`gV^h1ERX2XpH zt!b#Bgyq#E+&0zbaVo@PYsF}- z7_Ai}rFg$Md3$nvI=DJLd)JyUmMSn`jY&R0Yrm*}%eMB5n*M(>$4Z;jY2`v*TR7f` zqPB4SBR5^>F33&l^@BVYTAv!ZvCLHl-U_7vJf#mgxx5_wb~1c>_Tl7scy%_sx)@yk zz40ezIECPeX0~&XCvu5k8S-?TQJ7-NXS6ujb)oy=-kw=3WcH<)P0JIm)NZ?qVHN(cj zCc=-65Q;I@0w5GR$L=r+n#hfM&Id>DFW#Ur4fsn^=sDJ>v|0Jt6W8D*pplQ>zi-|X zl|?+bwJ|M?9KZ3@F9Dr3<#~EZJSZ7%JIr_S{aTVGb8wm~X)hrnx*o0ZGeZ?Xq?yba zQtPMSA!~LOiuIk%ZQFU^@JRf4u66BQKrG_$99d1KQj+ut38U16&1V#nxdqk%6in8< z>NX^SN5Yh3vHGMYau)Pf%+fnOMpJ_AHCTtDkj8c}P*7LHHloxe*qcK=O~NS=;zY7} zF!2nBj)h$pPM})BI{alH1YnrBw>~)6l3qy#A?Wr7G1)r7TcfxB`fW#;*CTDpk^RWU zj5%W{b*j1Qi#gX*yGMY>LdcCXX{4mG92$&YHgZHJMKSG~fV(A7t);nIwKj2`TN2zO zG10oV%%TBVy#_&mq$Szo^Q;FZVh?>BG?EYT9L7Z<4kjd2(G%+;!+?ZQ;0=8oP8)lc zia8L>u|6T%clk4j-?7cSfqeJA7t-{@Zp{xN%W4k5qoW4}ZPX-ezdkTCAi*FzWGVYqN67h&bK^=@YI+0GrN0eFTjf$=DcA zfyRzY_%v(15i}Sr8hPQ$h39wCY$WpHCR4FBLWMo--ZQ7+%~P{v%6+b952K(FVdeeB z8-~U-^5Pe&5M9;`TH|yHa5is&6KQ-KOj>*?Q~1g$RPNrjZkNM`ki2Dm3QU*{jmVfn zSbU-fYut24UAWy{DlXe5w(~Wg0>x9Tbsv>sLDUg$0z7F{Kw<{O?pa7?4+A9eCU`>l zWzig*$s}k-!oaZ@+8Wc~4hJ@|cR+36K&1^}b!=Vbp_{BoA*Oihb&AH3>o)BR&`_YF z!;Z-qM~~2Te5FWB>?|$LYU6BWPKA$`$PB-J`k|^-`tJ;(W(l;!t^UKwyW_Kqw(Rcm z0SeWaUWmx(B-6mx)qNq*E@W?|HZaG_kvQVe1 zcL&#b&N{roc?HcgS&|fPgLRb(6+~cN9qr%TZ zSVonjmYDKetp3(~o{;7WpmCto`0E0yRc$PTv{tpT0M1&~MlIFG4<@yUcIG#HY~A1q z`Q7nsZd{^n#92wc$p;cJ$z(p>;=qB-{cLM<$YdA!eY5k)(D|L*O=C~^nCWIwFC<=g z9#A{7!c)Gsj~4YT9Bx6Pr!CVsr}k#2i=ORvx|_Yt?xt;R@_(R+XTrMVjC4y5QrMq& zJ;otEqMpZnTE!@O2V4JqB$j$=$G;qtF;9s@y*)V~(t4*mADzc|>vW8$lfV}(*o3xA zu7%My?4ZBf-_;x5nm4m>ZJ*TbAt*{xkYaf8VO3k?;{eY{NCLLCd8g8m11@&nI#xg# z9fy6D5BgNzz&nfMSVO`F_8krI{oVcj-tNoZ?q1Ii$gM-}l9uX*O_p@#Lzz^Edf1Iu z6)&Id_yN6jY!a}Y)Z&t*B-ii7{srhrzWM?6Nf0`O zrBrON?_w?Qog-eICZmDdaBMw*SfTzrV$+mlu@O3Puqg?Q zUD9neLFFwDZftrdgJcQ%nCtp!YZ`_=d$qHJWVuC}jft-Ml z(ALq>>kfjQ0rzJJ$=362mEZzkNCm+eLD6-RnbD1Lo^c`|%EIDPZ$*?%qyiD8T-pi%Xojsz!~51x7zP%8j34zkSt zT%Dl>j>h2XY?AuAJwbY|?f>0xsdj%Bv5taZ%>LVA}iyC&%3PAEBECI+FcNmk` z-qvgEx+84ebmoKU&Dn343j(8cEq;BaE=PuEzDsJ~j#+&i<$ z56(XoD3J#)Jk_^g*U%=}I@8w-KQ}hXGfGo46Z=a~8#C5y^D7xNiLgvhh9Z z%!PtvU-?4srX(PleftIB3Eg^OcT(sP6C07kKb4_|H)sSgoadoi>P9od<2rdsFpi!5 z!^~r?J^BqC{bB+F{Oc5yc>QImNGUb@Ns|(4N*eJtGyw16Qj#jXg<#UFd%w;Nv_xvr z4IoEQs9nfBFmpV=u00(KJO#_oXof#;r7+%sW@0BC=FyPM{P3PP$rwEr_w*_gb>@Ii zXFrbwvdWj+9N=ZfdOR@JdDqPYXMVg#18coE-yFc227ENoR=o=6+0@ifj|RdTkH$HG z%#HSF;H>ecoCD6>XpaWYvUlbj0P1qcY9T8W7o=j?xpl((qreGC;NWV>L0MT&nbcn^ zuyWAfVmBhW0r{u)p}M@Zs#D1u%)&QxqUfxUVElkW!cU}a9{M@gJAN@`T}(dJq%3@k z9T$%r7hbek-|-EZ)aw=6`=Q_fZulgaISh<`X~P)*7!VPpbS}+z1`^AAZh)yxwXSU; zGLdIRUZLc9qQP>=#?C?FGuClljEwmg&>9i1Nc(bc^lryb;oX7NWf@O@XMbvOp!S1|UX zfVu?H08O3Almz|k8Ou3v)dF|$FQ}V6FSwAeZQ`M~)N?`#?^pCz#yFlUL$F+~hv0FE zEb6*4P*4=JK0dnW7?Hpigf4y^9HFy24+6FW^q!Fb4J-@Hj01b-cmlgrOtKUv%5BwV zTnymuBL>YYi$+Psd0xdEi$#Z&8&)q*Pu_x|mq<$~Vk8V9W;+i;n#2qFo#U}Eh&W;| zL*mzXz{iIDy*@f7zDw^ld-8?kkOp0GP7UcW%|gu0!LWNdoPfz0tkT7HdD{ty6}r5s z!2o{iV2(UN7?R}BDHy>x4hQF_dCsUK#>5KDK6;5Ki1JG?a;wCPqkthM4mdE_k3atS zBN~WIqr?VmkDW;*DB#*VavkdiPSEzY*pBUObmzFPWGSz%y&igr1XJUMG^E8Ia-(N# z`C#OCyb1IG;Sn7rhwdUibb>BlLbd>cXUx?2#It?scp-E+>F}8xg>Gn{WoKApSA6ud zK@?5_0A835yL^@ld7q%u!CS!`1Q+4?LC{tiFX>!+*B+<1Qaa;=McjKqaFV)&|Abi4 zet#EPF3+*7EiQNX_%X}hLf!djNbDwfWW?v|*C-6>5=76%nV%*XXSEWwsu1oKL91>*n%R3$$S{Yc7 z&a!1@6a(sc-GY^~q9f|x1I@qTd%ryC$Ut|9vN`6Amj?If^f+%KkR8X4>;B<{Q{&2I z8!_f-L2$#TMvm92@uJIITSuHpbkOPXGHB6;EW}O0@V<*JGUXXTwDZpST5{=z6irAd z$WdFpIiTqAVO$^?4p2bC72#P9)+nyi>wXfbF1+F2Uz{$3dEp+dhE=0Bi~i%IlX(44 z6Z>2kJDtrUF3K&*WYSvzLpRN9j*l+Vt8ZizRxg4lB81}=-rv{WULV{Z`8`h!4#~1z z;+HInA@z;!$=BX~AHBo3&IGgrAw}EUm-5MnenF>+SOI^+>u`Jf+B@i@O9K0ewzmz! z$X5Cx1b)BJ>#z^fI0?AJ&kMwLs7&}E;}N|j*WR-}urBKcZEt@dfiu2GM~M);z0Dt~ zgo!;?DqaxypC|n;@h#cj=DMow?GrAGL&qtgG=>F)_3iDqksCTaK_l{E@@jiq_esta zU#Rd<<`smys^m3yfBEnK^}o@d)wbh5rNeho`$Tj4XQz+edp91v^JFprSOG&5s$TG8 z=~E_FWg0EfwEo#&tB`!qM{-*^zlk5nmEti!7r`v{8w&^;OF22^!k&6-DRO+=Pwzjl z6QXCmyImpWV4G3aNp^o%@X7ng`h2id{Zo;A^dQjF;hdT;IZhY#w5kSK96y_!Lv4kSx|;^s6=rP`=I}WlK$cq+|5XdmOwY$6AH>wE z2@3-DLPxv|AT75?(ptq0*YR%PV_BHq4v-Mm>qY8|vxyJ6(>*JD(17-8yB91&G0PD; z9JUOBXNVy-tEB0DY398Ix0A45kr_lFY6hP?vpwkT9vYeLitdiWm}s>)IB02H*Nmh7 zw0sz@AWnAXr6}+buzeL6FJi;9++OEt2~+q~Cw_QEM_|LQvMl7{h}G=BmmeFg1Eir* zRFY*K{}!hpjCqszr9Z=-OwHTJAenI%CBCtp{oTEng5Y;-t_gv5YL5Ot81;TkGeEiM z4@>c%vWE>%F7-kBL>U4Bcs@?`edFUtkKFwhIrf%`BgM&NxT#F0lqq{}ZaAJtg2Yjz z&I$?$dL_$&o71!iH4+ttiMthxGc0sto5?DYB9Pk9jFawWm7171arXE{E0 zOGe2z{iNO465>+$t-Nq0Pgv!?)QaRU-j-aend7}7-h}VRUg@Im9u4`}R$$DFP?JV% zv%Xs-4oi8t#NSNrBzcvsQl|>qF}ln+TAM7%bSsWSp`?-aCW-l0o(I+7{|jCjg{x85 z=^Rlh5B`dkP^Di`^S)wpySR$iY&>Ye)&CS;w``HEb-iPZC{5I^J+^J`v2EM7ZQHhO z+qP}b?6Ivqw$427`{PT_m(!gzl1`G*bzrRw6dS4mrEf~9(OD!Dx#~8OW zg5Sr2H$d{2;GxL9ckFH}?x^u89e)Pe13{I$FwI+fjDMO~0_8y-8CgaufMv%ys}w~@ zle7kfD;!k&(1E2_{3XjU+alBmVn+RnFoO%bBU!2?-KpVKEoZ4B6k-?~Vy>Uv1NMdc z%0!IK^w-sput?<49XlhtyH)1jr5q{eaysE$Gl2%BOF+>{)!%cgQsHfq?xjonG+hpk z?QVdqI(|tGaTNO6Q7H-t8mD2Strp6-`YE&CFhqOy(xcaW-e8jPIdng zBImlSr2*FNiIRNsC#zw)5nNr)9LRT z+#NQS>85eHKYEk_n3QO6Q$6IGAv2k(>7<@EQCnm=KY4jMdT_j6A2pV1D@*)i9fF{e zh|>eT>p##HKZE*j{#^LE=M51cRxQdO_k{`A3aKT=SRuEs7D=k*e%%6dE^^@0EGFl; z;3kA(L$&Fqh2X%8hmPBF3N5hkITWoduo8qP?ZPm3Nh9ZOusQD?fh9?=xNBJ=xPhGF z=vKi;y{aKze!$b9PKLkqhyWTv>Dro*r7?6^=A_@SXBgvr=i$!;``V1zL^xs>(!CX0 z&_nj9SoqY&k#=UnaC}BF!RV;L>AeKOW&XFkQ;-x>=5*3}aip$l+PQH@G+Dg9p`<*w zkO@?>iDJQY8j?xCGI@(q@v=;cB9n#Kvf-Bo480%U0F%<^ z?v8Z((@nV~9G5##gOppW*%H??F>c7(o#zDcR)g1ClNZ}jZxaNET0x_OfO zYNmSjR2f*$N#ge74?z*`2|q^stcuipQo;#cvYsjE^!)=q9e)spsderYdBAnxq}Fz*`AqpD48K_onhS@ zZXa#qDcr2!HHYhslm=u_Te!of99m|{z z(6unl6g!ZUfZ`2#O$n?gm=T0Ir;TLyswVsKh3u3ieK$NtuHqyFrc z2^x~{SNifuou@rB?5hqypZ;k1u|0`&CfLaHXJe1g`}613f#vN#DEm7qOyD3SAxab5 z6s(S@(pS|z&fX2e80c!kw|#DVQ}%YTz9g?^69f1d{hnSSYvA@A+Ci9Y#MO`=nqmfV zU6zu72Reb2YHPJc)FF#)nj28>?X;Yd7XQ2l^h0Wy3c|*Qh45L9AHZ0g`EVlK?3C7w+GWGiwpUk!o-A2-Mm9|YKP(f#Kkr4r&yQk z(6Y7j87+3=DEf{?GH`Z?O7Fb(RC^i4xgi^cZ(%Ybf>kfVkEes&-fr&nE+f&{+PN(} zw>ruT{AYAK#6h(y9&z%*_Gg#pU<6qP+syQ}AL$PjO*{B{qOv3e7q^evzP4!x!7Nr!Xhf!>kgddL_*f(*=% zmZ~hjqIqeBnE$(XU_-{M88c4%cI85V_AL6s^SYZ{otB_P3A@B}CBpp%^&&kXIj1!S z*%a_68y^R4K;OWaD_O1RYC1qTzGvtD&3Hp$WSDV@_0JE7*=dr6+Vd4x52nRuGUAICPl ziMF`&oKr>XtXyt@1)M8YnINCOA$SM;9PiM`4Z^_y7SLW~MQ6DpfPl;JDmrit=MynP z$oD{nFm?z)A%1ip5|chx0(*&i7<(&0rUQ}BGsc0nIq!plRqhvMy*cmUIgY0UXk?&s zp$jaFv-UOv&j*EIVayR+u_7Ef;-9cWuU91ON`(s%o&aVQd12t z#m~;T9n%&TJsRknU8D`Po_Lz=8q5&2dJ#MVH!kNxT_&it%?}n4&1wfX(IU@)R6}kH zfJdHa;tRo|SaHDNf>3nftT6`9erL7GFS$T*BXA(cW5`++Xx_fi6`6x5ous*^4D#)h zDoDuVkt{Ewx;5`q3Tz{PKIdYEQ5WoE2$_(?v9Sv0I35JSzj}Dqjc|z3omvO>LHYql z8r<~odqTI#UxUs3;?5`U=RJJi>k z8U`H{&fO-RU!m0vdhK%1Y1ls(NXjz!Pn#ikOXY%&BPzu3w6g<7PxN+%&-c?^q>t&F zqg?oU6341u`0TvC;l@h}xo#F$@!OV%GJ9*V(9tHfN=(I%MKSbSLlg@fCaNPli35$` z5*Y{=W3Jts2>|S`UH$pX?ZLesV|&7-m?D3>5JjSgHiGb{b(>(R+fZ8g{|0^{l=057X65(wfkz+JS*)yGwWfSict_49V-UZ?%FbnSU z0;bt#ekgN}c6=?ePDUdvjuX?5L9g!HRB0r^}3W$sYbS;D6 zYwi~*4-`9*y(?|xl(5rML)+t~5`v3XLxqu9Pbtt#$9doKhfPO=o|q$qa@_FdRv6fP zip^gWaWV0_Vpw<>nlqc5V}Qx7lxgsnN{J9T#6tP>C7W8aj)J~I%`kWe3P=eB+{K9h zvUF)YU%yRbPzxECdu2ecOlUi;$7Iv_I#g35s6RlR-`jIFBi5+ zPZtxOQtRu$pa!e(y|x5ro(8;1IL11ui7m|Kp6lgj9EAmatK?_*XQx|9UK!@6phel} z(YCdUc-8cg9<^u39fhe;QxfRlO{%LFbwQ6}IL(}HI`0QP?#==g4=SZ*R+KV7<3UoV z)s)SO(cI7a3!TU3Q%$%S_mFfM+xo{Eu$8So6IY;AlbZ6~fF%pr2ps={L@&SBf8tqt7oEis-t>>DmmC~9~s znzh!mYspfDs<6&2?#UN!2sxUk`m|^v@7tnzrs8e4q}9>1HAr|H=8GIf5~nD$8|4dv zlzK2pHqK|BMMCJ*C|YG8);WXgDGGTa5)_tV9+^YWR$v5wYtnisos~tbR1J%WIGs3* zsY|BKi>Norr&uTN6NEKtDLWl!g?^d~$<bpyC|p9U@BSja~l_`{8li3oDn;om=b0imuiJ6i%L+ z`h#S9Q+EL}2(8gscG1`7Z?Z>9wXR-N>Vn=+sc|6x8Bh4)9=^rk^>@=}VRKtc;F>bj zF2YBGAO*o9UtdL~owQ?ckE*A^hWV%T3+7MGz5FYZpN`ShAGnENs5Y{oyhe=mWrc`A zU^R9Mv^)}}o9-%=YzD#i@E(p2n^yz9cU=i|j(v_a$Nr1S-B;tXJ@zoMyf9+RUHC&k zh`Fl*BY3jLH?2X8I3=dmFu!SG=(FKL{c&Tl+}l}VgExR*`=i+4GPz^$RQOVB13vO@ zVr%?m>{4$7$I&0GLBdIAj5Sw&461)YB0MGNqT`1-Ufm?o(REX3hORMb@0=^vy~+;jk_}Q>qfy`oji| z<4gY|=w%NY$-%8rG4=m7!ay?;w~BLHXLCZG(}!=uh&5hvm>7ttjh~obRCYS_A>6i6 z=Lfd0$hVtVqM-Nz5g8KZzNHuiSDHvGq(I=OQQATh8Fl97yG`?v+n>L-| zOq;8CnVtKV$YnnUr~^8k(S}(WCdb`0f6xuTH8=&r=%b$|G+o=%xcR7!-pM-Y1b>Cy z8|to@T-e#)SsP5R!$>;`NSt%b7L9g~UzrHQH#&{~ar;Nh=mefn4iy{+J-n~%Sy$o& z-s#ifvm?~q$MWWwkW!<){Ykl*|_I-f#Crmogb3zHic7g$_>!H?gpzs4n9BIksp4#4?I72ao z+X4g4c)MzaA*)4h<-L|9*^)|*&rs2z=3sfcqES;?Wu>xQ6IG?E&{9RYCbCjR!Do)L z(sCtPgTzEp#Dr+EN=42zMX6By{n5YTB2rllI!Ylbu`*uuF`HT$ zlctW+l4&lbc)2zMyGuExDIe-oq6_yLy%YDk%~p)cl?y8vWpT0IZugSBfHFn+VZj6U zx(xMC256?7#-)ogRU4jG9e5(AsuL#xZ0)T3K^e#IG?BE(w=f~DprrUV>{o}R*WWqe7CE`7d0k% zmA)e_u9<+KYkW*Yo-=|3Kc)q&@-$j}Oi>u_e_ew|*&io1%#bD%qgVnwNZ2z1nx=Eq z@$d^9=9PNL{C~w4pE6~bHX<@txgRb+rjqtI2hOwf=DwZauxAi+-_|nRK}E5oeE$v& zpGK^Fzl@`Wt*pJ{UsR!qLs7N^1@Oh=AGWJt+SPKRj?z{6Kez+njb&#vu@`E)LN6*D zS893Ww_a&roaiuCMBdF#cPe|o-Y2}14o$nJ$0H1iK->na(DH;qTf{2NQ~mG)N!XU{`w5vofgi)Ur%F zukfk&gx2!>EVDIOqOCQlwg!KDITLVFZKX_*ja}AUMm}B9*yS z51As+xfL;6EE@0BT5(~WNp8*WPwSbY-}rkthny@72|k<|SmEh3csv5%Sz~#VAzDKk z{KlS#2kG+6;C&%Qg8;vcyPd`)8&c+d9NBB!RqF`<>@)i}xXJ5{A=>_7!9T~vb*#(^aH zpTupZ;(O}+g`WK zyG4;c(dj#a@`yYR8f<-ZjvX2o>c&GO*^Sj5_Wp!z5vHr1eSc@fH=IR){4*j^?vvnI znsb3hOB-**)!<*{CfKuJ3WKoVde5`De|m^n^^%y~87`zEGFc0?Da`~x27{m0X5BSkWkOU7QMaN6Hck9+TsVjbu8Aymy7%>G54mTnB@IWv? zEa-(uh-&B{1)KsuJp$w)L~qR5X|F^`ria4`TVN=2G1mwQRG;w7r624CmT*<76vOqa-chloIusLfB86AEHh zj+7E-+VKdUuqeq^PpSyX&r=bF)YomsENPKz?FoD=IRve`;$9cKjg90&T7iR28CH)W z+M4dJJqv)&33G&ZSJD9a7zVw!d?k}^DC@sUmuU%Rjq|tdmUATwN*yNSz*mt)!V-#r&H7_;G3B+ zcT`i%Lsd^7dMh_sfY5cLDP}^Jsaq{&4yP7Q{u}?HA>pe1+wu(U zrM?_{#(h-uEWwoO#D?u!8IuDd835JM5}~aq0iY8;yb9w!g}AEgY7qpwu8;Pb*4$R% zMjRq8<(0Ogue(?Z_y{z1-!V{3%#g8bs2khEa|fhwy6ErWz)`CEz8zo;0882*7?RLv z3fDVhqf$CNB*QV9Y$;@eSMH5G(qikQVjPF+CO)hW z(n2Lh)Ssy>P2Io-gprZt*Emh`et*`8fF>;@kXRjcYK_*I6@WT}=lM_X=oSDBpSMJS z`==^T(LpN!pSQxhlsdirkdI@jOi!_toZA15ZA?0v2Lf%Ru863_#PUnQfPRraW zct>%jn$l+JEnk@3QQ^gtrf=d?<+@qZdKy`i8roiD^wm>sDS7ri*?rpa>dL!Bt8b#z zn*{ANbfavNNVR?omPZr%vEc2n&{ak@mKw(qRQjG06=r&vP2ZsZZYsQX2cTYMT(ZqE z7we8$#LYk@Oznz$pWgVyOP|8w7owj8LoiPV(L&pc|c-vt61QLTl-WFqHq{joL(Lj>?HfZCcD&u$om zwG4!z{^H)jI+7c!5P<7e?5L|A8pOc|>Jk{BFt+o7?$#y2pd{T11|oI~ZO4E_Dyf-FV2k%I@FqSt#=aeKL{qV6;8NKie(ZDw^> z(fW!Z!&)-#Td39_ znAgW@P9UVEj7GHG(<(0Y@`c6~cd7vKBi4pj1IfF-GQ_Io4F`qsA?Rl2B#7r&mY|xY z@)b9Z4J0bMV|l2hOwyAR<_^e*6+|QQVOcC~5D!=&LKqg)`Av`6o)iwGW8}_kuo+o) zqNNN9GEhM9s01Ffu^v1(&v)Y?iQty|%3!sFP+Zi0V464g$z3RPte7m-^*VwD!bm}& z{5bHr@Fl*Tcr>%$1dXt&4LjqK9Su~Plmu~Mj_*OueUY=67Np)b<*&{af8S*cM*d}t zcYnd!QKS1%C1n`&2qmk!spH-4fX9VN>gbV$I7{$Z#cLNvy)wCOV>o#Iem6-g^2`QA z*OP|BJ@tM?rlYE9@tbep6*KR`=o(Kf2G>CLY4}VcE|%5;GHkuqhG_4rWvE6X9~8CQ z#UPq%*K3`N=Jm1{0h)!Fev*_!dY#?^ZtTc6ot|NRuP@7q&v{W(_WaKz%4G{slTI?y z*pd~pzm3luQQXFAUCv+2Rn6;M&vaGQFeTk^&k@zGpyO)S&=xwYmMp1`rSO&7Tt%7K z4bAJ{KgcQ_s}`+>m0D6d^^z4^S)VWRsCi|(}SvQ zXQFzp;bq&+x_wG|V=jU^s)3;*o@$%5%w z%XM4JCE7@SP+rs)>ylcpb-d1P_1&V-OC_<6qCJ3qMPB^Stc~Uf2q#K&q`58jTdCF2 z3DhcJ)GR6W%j&fCqK~Sbc={f%sl7>Z6oFK*Mt_yt)$fMhD$R-|N&eC#sT)Qtt!4)+ zRj^FNQ?O`S*?v4DYo5gVSy_7}jEKAYhomI+Lo|C9!K@si<`PBkiOsk0}WiIv?gvdMU)t3E>YXq5Yg-!S89tg&Ko~A z2~x90=g^*|HB|p-bWP~knT=T!xj3gjDzDKIHYjX~YIaRP-4wCB4^-I@xwte#qmMut zK!$fdB~bd%$jg?r42#t#l z1NG@ZgFKBnVo(FqD*Jqrd`eX%h8DtHyHH$c-7Xe0dCCNXbBc!G>i;XU|jw^O|Jd_gtFpV6+sDQ2##jJ2JapgJ0tm(U=37 zm8WHc`I_#zv6F1vORN;OHs2x zZ0LL(1m@?kXq5>gq<$<(p2V5DQexI3yDzuSh4I&UG$}yhHBiX1Cp&Dbc@z_ zAb};65Am!LFPZmg-8{E_X6?#a^0WO<;yneCMySlOlW2tEdaC0BFhUSjs8Fr%1kVcj zk2>l3S_@dJ3&K6fjz6zWuVBtBG!F9d@OnofeXQ zD5G5n3tM|H*#NflVPq+?*MUzqF^GKSPA!ZfQ^1N51{AT5ue!9-17KAVhC5nsMx(>l zq2lfH5n1;oSmEX86IpkGvJ4OK)ficq*sxmkT1hrBp`bOAHYi;6YKf{xrRu$63`(W! zy%PVHm%3O55+bK@-a@Xvo4j_uaY{kHC_i&oH*TN&g_Iyom{nR z2&*oRn6=2|%;r*Uk=@8RK|F_m7iThJP?5W|J+P-AON<_xv1cwQTnWNQuqNspO@Cho zm&LgwJS9DsGvmLxmhoEmMD3Lg)fyxS`J?Xx)p}u_@LzbKTK@}= zeia%0q=FV`)^B+9tx&D0RO|mIJoPI+n%p!rT99~ojj1*Y^}PZ#n+74NH8Z&#jx?KG zj%8#XZ@#G38XI219ZdK^f!DX^6l*&PTrYSEDK~T}$&Ch}Sq$(;_vdg=)*391)U;X8 z^kouDYB_&Pj!6Sx5-N5%iG&O#2TF#BvuEA2q8Z_mx!$Kc1*v$h4^=IC90*n|GGRha z!VmEccFEZN`TeVaa;PI&@Rps@6itz z7OX%_Iux`!xn2Z+IDfRrd~i=)fnA;Iz`blXAay}`?dvZ;rIJnj8G5y;PJDarE-J7>Cf?1UK&moaMiecDcoT|4eAt39e?N1lf(X_v6}gJ&msZW8t&J z!7f1V1o4%Ue_@Q`#C_@eS>jQ{_QXom=mwu)orTB!j>e}QQ?)s%( z-qvj&_3`lX*JvEL1fARg0i5!6xeIT-x&?Hw(``C`m#G2Ausg>b+v5XV=kCuK&!k$#y3x+RonkurYDZ&RT%0|OPcCeg?Gmcx5wsS;IGlat@wlIz%-&D`AQ{7;V$%SJN~2#y|@ z>~B!q6T$$;#bc`*p{Fpk!2wQT&4PbX{UrV(%JG)(ocT@Z)v(H2%d8Ty#f9Ax)ffxYXncK4o@_3L%N`fUiRFM~iHv5STs3bkRk?*mz{KHZ?6Li2X zDE(%IAT5OnSi%Fp_YCUOE`E;oQ@v=4K$a~+TumM6EY1m_i;U%5zNF|;lsms$n;kDH z%E2@xge;DvQRQ?n+4%hkDaYXD3DC1ZA6R2CKqKH<_&W+dU>V9cP7&G4oZbqAft&K- z(-jhMFDvo%fG}HfMxHvCa~)HDZ7vUfABAAwIa@#4#jM}Zj_1L>uG&DJwRsKJqsC3V zT{)ki7Q{cFugpGv0uINEMz&Z4xyK04563*v6V-Iq4ETHzrV`$DIw*@yO;?OdPfKcIo%!~ONN0uOH-z0Xs>1GiOe z$(bGRO}GJ1O>1eI>X-o>d^jbO|JAl9r}u6y9I2nibvU{J5eVR98k@VDwQeRVJ0bZ4 z^yL+r%DN1Gj^(jn0AGo#e}8iS)FBo&R?-AbZ}+3ta{~?S&%CEG)pXjZ@BEVqEoQsu zB@KBmGqkG7D~pye@h+uZyq6)X2yQ-zHf%Mlo;whEU!K%CV10s}qCQ|;4%pGl<4PIl z7@DM#+^hLN)Am^x{18+xIh9B#4LXXT;`(}t*2Z|l?oR8WE25l{u35qzZk90owdBA1 zW;}3w{~s~6kf|1!JMHzy)!Pq6WaaTog5d-<1a5*1iUn3s!PMTzp_^?uD|jhJ&3w*Y zCgzvluvM+=6qNc{3&>6Y3$3mEA4he*|HTa@8C4Vgx(*4xf*Hu@uOkHumm*O73*;_! z3I6&t3z$mSY{t{|o)}>aY(5BwyB!_RBV3dy11W!1;3Ix3r_YxhMA^o2y3Qc}f5N_F zmJu-qi*Ccd%G|?_Sa3?b<_==>9lTe#&3)lIXPq~-vr&5ZaMpzHh4~J9+)i3cCb;yy ziooA?)-kdrdgMxmM!mcE3skmP7C@o$oy#UQ&Pg7_{wZ4sceYn8)h(iWUJlHXh1Vf6 zb-r}BeRMOMGPhKqf|qQJ+!*mFQr|s(=&N6L*V;%0{!TH?qP;nt6#TL6_Djod*> zs~Y^`c|fFOtwkNF(ElLsJ#rP7r-*V5^2+OJ87^O12L~`^B-c`nZp$N%&nJ{M%`$@b zCLt{28#A*|otV&#Jrvc$cn7ogPit=kYQgEaf#}*R^tUYgeH?I7b0_xo!f(~gsxe(i zD(ib6QJ5GUUorHf(y)|%vE`UuHrKDewP&P4@%b!+^eA~P*-Kf}Q-hSmy$u-~iP^Z! z0rg<;KMrv}ERzXq3%p?iZ{lelaAJfqmk#Xz4GWsx3SQ#|t$czF%xG8rCXL&uTkhSx z_>7CoO2*%tk^4D3ECtR|@5cS48AFYspV#}+`<@*1_e|1r#2V@QH%{lbedpKl{C)A` zNSm=o_1H%DlONlr(ij~a^}yF)<0KlcBR?ORr;S8@johYc>w7`uj^W(S^A}-Kt zj)u&d$*xP~8|epKtAEj=cLi12yff7qh}!X9Jes$(BKA~seSv&gcG>l=Z1H7s^LOR+ z!}Y1c=2o0SDAI;@(5!>}bhN)U0ZAfW<2;3B?Y3P@WP02{e6oEQ%+CtmASl0bq5q3A&LQf*Gv40O{87RIs54=j3WD1vG+0JtET*1NMykfh} zPU1|RJY0K_65g!cC0d|U)LGvR{YstXFNN>}MJ7mC%oBipTGsRy|P~=nDS$2~YN<706BSPA6 zx?m$DLZGOzG-2_K5uvLN30lSGKb2~j&zql@AE8V^c^3W%+eL(K762dr*S>}rM=}@) zg#b;cDQmK*q8#X$nHRI?r%}3l^kF|q3rYhAHEw3R&>KP>8()=Iuop9HF$%Kf_w^XD z8}2ZM+{Z)oZ*(NTK^TZLa4x(t=(HvbMXP^Ad~xdTQ;DmD^qbH90U&3<`$bwkf0n5;Qc&O5mnDqv>0XbS< z363Y1_Sz%ys*2vLYvF1FnX_4rFpx0;8xn6cDH<3v)BqJGfxbU!9th7jx}31Tdp3cP zR>M%^qugl1bufZG=+B8s4?rj4*OmwY_W)5fg)mbiEtYmpg)LwP;wEBdwe4g=M-Wjd z#Ao=%FiCX5nih5sST7I`$vVADVZUX3v+>6M#tqTR84h@KF)tn|{vo@_^@HxcM?MGv zLM2q__z^Z6o8qdvC0-CAp%b-YWY=Yk-VOqeyE#~Jv=}oKv^3~hpL`GD;i0M06tnj< zc%qSxqgvYS$-$;74dG_}dt=S!5>nfMUd}p5L;s>Y(q31ue$<{b-5AA5{K_;U#Qo3K zu8g?jDQwPsx2gZOY%SY7uCV2gch8;o>hCe26r}d@^+xZ)qZr+@3%z14(hEaR%Y@Bt zor-Ful3bCk39aZAX3_+2{n6yxR2EB}0J%(zi*q$l{A6*I4dn0lV7)m1GkU17wzZT0-UHlV zjhS8361pE5UBkP7x|rfzYM8$nAN<_6;q4#d3S3VJcewjo9BME*Mny$&`>$J^lYI_t zm|WxHKW3kTx8(b=zif4IbxA6)?L=bwWxrN5cBK=8C%rUoy{aI$K7<{P*=!GW;O-B2 zxEle&Zl`RChk7t~cs!h)Awl<3_NEg9*jrjpUnwhv=_EkEI{J|}oUv8z>Vn~s9igBu zJ&1oeWxuz8TVG*dZnd7hRppBx^?S1_>n5mAnrJ|6^g)x07Mf_`^0{{BA$Wv8Kgsr7 zIpGvgil2dIxd0dFfnDzd=xLz*U>!R7T4ep;71&s3SOqYdL8QJ6sF~+j80T1-MKJ9B zCusBU>F%cbMhRi;1ZEBf=WBzuU;;Otl!P*%f^di`5ag3#wKgJf2*m{cGG+Z_#O2N0 zk$a^U@iY22l*ehQ{i^<}jw_CU0P<3RKq$cf@7kxo)o}i2D-QVY^#7=Y`hPd_f7jFb k-zES6iUaO`%c}nWs_V#0fr9<_2+;2y{Cj?P{_pPp0KBe#2LJ#7 literal 0 HcmV?d00001 diff --git a/Solutions/AbnormalSecurity/Package/createUiDefinition.json b/Solutions/AbnormalSecurity/Package/createUiDefinition.json index 9a8878b7041..c3a766ce593 100644 --- a/Solutions/AbnormalSecurity/Package/createUiDefinition.json +++ b/Solutions/AbnormalSecurity/Package/createUiDefinition.json @@ -256,7 +256,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Surfaces Abnormal Security threats whose remediation status indicates the message\nhas not been removed from the mailbox (not auto-remediated and not post-remediated).\nHunt for attacks that may still be reachable by recipients. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_THREAT_LOG_CL Parser or Table)" + "text": "Surfaces Abnormal Security threats whose remediation status indicates the message\nhas not been removed from the mailbox (not auto-remediated and not post-remediated).\nHunt for attacks that may still be reachable by recipients. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_THREAT_LOG_V2_CL Parser or Table)" } } ] @@ -270,7 +270,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Aggregates Abnormal Security threats by recipient to reveal the most-targeted\nusers over the hunting window. A spike for a single recipient can indicate a\nfocused campaign against a high-value target. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_THREAT_LOG_CL Parser or Table)" + "text": "Aggregates Abnormal Security threats by recipient to reveal the most-targeted\nusers over the hunting window. A spike for a single recipient can indicate a\nfocused campaign against a high-value target. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_THREAT_LOG_V2_CL Parser or Table)" } } ] @@ -284,7 +284,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Groups user-reported Abuse Mailbox submissions by campaign to show which reported\ncampaigns affected the most recipients. Useful to gauge the spread of a phishing\ncampaign that employees flagged. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_ABUSE_MAILBOX_CL Parser or Table)" + "text": "Groups user-reported Abuse Mailbox submissions by campaign to show which reported\ncampaigns affected the most recipients. Useful to gauge the spread of a phishing\ncampaign that employees flagged. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL Parser or Table)" } } ] @@ -298,7 +298,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Lists vendor domains that first appear in Abnormal Security vendor cases within the\nhunting window. A newly observed vendor domain tied to a case can be an early signal\nof vendor email compromise or impersonation. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_VENDOR_CASE_CL Parser or Table)" + "text": "Lists vendor domains that first appear in Abnormal Security vendor cases within the\nhunting window. A newly observed vendor domain tied to a case can be an early signal\nof vendor email compromise or impersonation. This hunting query depends on AbnormalSecurityPush data connector (ABNORMAL_SECURITY_VENDOR_CASE_V2_CL Parser or Table)" } } ] diff --git a/Solutions/AbnormalSecurity/Package/mainTemplate.json b/Solutions/AbnormalSecurity/Package/mainTemplate.json index bac1d6fdf3e..a99c66d193a 100644 --- a/Solutions/AbnormalSecurity/Package/mainTemplate.json +++ b/Solutions/AbnormalSecurity/Package/mainTemplate.json @@ -55,11 +55,11 @@ "email": "support@abnormalsecurity.com", "_email": "[variables('email')]", "_solutionName": "AbnormalSecurity", - "_solutionVersion": "3.1.0", + "_solutionVersion": "3.2.0", "solutionId": "abnormalsecuritycorporation1593011233180.fe1b4806-215b-4610-bf95-965a7a65579c", "_solutionId": "[variables('solutionId')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.1.0", + "dataConnectorCCPVersion": "3.2.0", "_dataConnectorContentIdConnectorDefinition1": "AbnormalSecurityPush", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "AbnormalSecurityPushConnections", @@ -200,111 +200,111 @@ "graphQueries": [ { "metricName": "Threat Logs", - "legend": "ABNORMAL_SECURITY_THREAT_LOG_CL", - "baseQuery": "ABNORMAL_SECURITY_THREAT_LOG_CL" + "legend": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL" }, { "metricName": "Cases", - "legend": "ABNORMAL_SECURITY_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_CASE_CL" + "legend": "ABNORMAL_SECURITY_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_CASE_V2_CL" }, { "metricName": "Audit Logs", - "legend": "ABNORMAL_SECURITY_AUDIT_LOG_CL", - "baseQuery": "ABNORMAL_SECURITY_AUDIT_LOG_CL" + "legend": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL" }, { "metricName": "Abuse Mailbox", - "legend": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "baseQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL" + "legend": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL" }, { "metricName": "Posture Changes", - "legend": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", - "baseQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL" + "legend": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL" }, { "metricName": "ATO Cases", - "legend": "ABNORMAL_SECURITY_ATO_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_ATO_CASE_CL" + "legend": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_ATO_CASE_V2_CL" }, { "metricName": "Remediations", - "legend": "ABNORMAL_SECURITY_REMEDIATION_CL", - "baseQuery": "ABNORMAL_SECURITY_REMEDIATION_CL" + "legend": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_REMEDIATION_V2_CL" }, { "metricName": "Vendor Cases", - "legend": "ABNORMAL_SECURITY_VENDOR_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_VENDOR_CASE_CL" + "legend": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" }, { "metricName": "Other Events (Fallback)", - "legend": "ABNORMAL_SECURITY_LOGS_CL", - "baseQuery": "ABNORMAL_SECURITY_LOGS_CL" + "legend": "ABNORMAL_SECURITY_LOGS_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_LOGS_V2_CL" } ], "sampleQueries": [ { "description": "All Abnormal Security events across all tables", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n | sort by TimeGenerated desc\n | take 100" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | sort by TimeGenerated desc\n | take 100" }, { "description": "Threat logs by severity", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" }, { "description": "Cases by status (last 7 days)", - "query": "ABNORMAL_SECURITY_CASE_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" }, { "description": "Event volume by type (last 24h)", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" } ], "dataTypes": [ { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_AUDIT_LOG_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_ATO_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_REMEDIATION_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_REMEDIATION_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_LOGS_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_LOGS_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_LOGS_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "IsConnectedQuery", "value": [ - "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" ] } ], @@ -416,7 +416,7 @@ { "type": "Markdown", "parameters": { - "content": "#### Configure in Abnormal Security Portal\n1. Log in to [Abnormal Security Portal](https://portal.abnormalsecurity.com)\n2. Navigate to **Settings > Integrations > SIEM**\n3. Select **Microsoft Sentinel (Azure Monitor CCF)**\n4. Enter all 7 values from above\n5. Click **Verify Credentials** to test the connection\n6. Click **Save** and **Enable** the integration\n\n**Multi-table routing:** Events are automatically routed to per-event-type tables (e.g., threat logs → `ABNORMAL_SECURITY_THREAT_LOG_CL`, cases → `ABNORMAL_SECURITY_CASE_CL`). Unknown event types go to the fallback table `ABNORMAL_SECURITY_LOGS_CL`." + "content": "#### Configure in Abnormal Security Portal\n1. Log in to [Abnormal Security Portal](https://portal.abnormalsecurity.com)\n2. Navigate to **Settings > Integrations > SIEM**\n3. Select **Microsoft Sentinel (Azure Monitor CCF)**\n4. Enter all 7 values from above\n5. Click **Verify Credentials** to test the connection\n6. Click **Save** and **Enable** the integration\n\n**Multi-table routing:** Events are automatically routed to per-event-type tables (e.g., threat logs → `ABNORMAL_SECURITY_THREAT_LOG_V2_CL`, cases → `ABNORMAL_SECURITY_CASE_V2_CL`). Unknown event types go to the fallback table `ABNORMAL_SECURITY_LOGS_V2_CL`." } } ] @@ -428,7 +428,7 @@ { "type": "Markdown", "parameters": { - "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." + "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." } } ] @@ -641,8 +641,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_LOGS_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_LOGS_V2_CL" }, { "streams": [ @@ -651,8 +651,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_abx_message_id_d = toreal(abx_body.abx_body.abx_message_id)\n| extend abx_body_abx_body_abx_message_id_str_s = tostring(abx_body.abx_body.abx_message_id_str)\n| extend abx_body_abx_body_abx_portal_url_s = tostring(abx_body.abx_body.abx_portal_url)\n| extend abx_body_abx_body_threat_id_g = tostring(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_from_name_s = tostring(abx_body.abx_body.from_name)\n| extend abx_body_abx_body_from_address_s = tostring(abx_body.abx_body.from_address)\n| extend abx_body_abx_body_to_addresses_s = tostring(abx_body.abx_body.to_addresses)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_received_time_t = todatetime(abx_body.abx_body.received_time)\n| extend abx_body_abx_body_sent_time_t = todatetime(abx_body.abx_body.sent_time)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_auto_remediated_b = tobool(abx_body.abx_body.auto_remediated)\n| extend abx_body_abx_body_post_remediated_b = tobool(abx_body.abx_body.post_remediated)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_remediation_timestamp_t = todatetime(abx_body.abx_body.remediation_timestamp)\n| extend abx_body_abx_body_attack_type_s = tostring(abx_body.abx_body.attack_type)\n| extend abx_body_abx_body_attack_strategy_s = tostring(abx_body.abx_body.attack_strategy)\n| extend abx_body_abx_body_attack_vector_s = tostring(abx_body.abx_body.attack_vector)\n| extend abx_body_abx_body_attack_score_d = toreal(abx_body.abx_body.attack_score)\n| extend abx_body_abx_body_attacked_party_s = tostring(abx_body.abx_body.attacked_party)\n| extend abx_body_abx_body_return_path_s = tostring(abx_body.abx_body.return_path)\n| extend abx_body_abx_body_reply_to_emails_s = tostring(abx_body.abx_body.reply_to_emails)\n| extend abx_body_abx_body_cc_emails_s = tostring(abx_body.abx_body.cc_emails)\n| extend abx_body_abx_body_bcc_emails_s = tostring(abx_body.abx_body.bcc_emails)\n| extend abx_body_abx_body_sender_ip_address_s = tostring(abx_body.abx_body.sender_ip_address)\n| extend abx_body_abx_body_sender_domain_s = tostring(abx_body.abx_body.sender_domain)\n| extend abx_body_abx_body_sender_auth_results_spf_s = tostring(abx_body.abx_body.sender_auth_results.spf)\n| extend abx_body_abx_body_sender_auth_results_dkim_s = tostring(abx_body.abx_body.sender_auth_results.dkim)\n| extend abx_body_abx_body_sender_auth_results_dmarc_s = tostring(abx_body.abx_body.sender_auth_results.dmarc)\n| extend abx_body_abx_body_impersonated_party_s = tostring(abx_body.abx_body.impersonated_party)\n| extend abx_body_abx_body_attachment_names_s = tostring(abx_body.abx_body.attachment_names)\n| extend abx_body_abx_body_attachment_count_d = toreal(abx_body.abx_body.attachment_count)\n| extend abx_body_abx_body_attachment_analysis_s = tostring(abx_body.abx_body.attachment_analysis)\n| extend abx_body_abx_body_urls_s = tostring(abx_body.abx_body.urls)\n| extend abx_body_abx_body_url_count_d = toreal(abx_body.abx_body.url_count)\n| extend abx_body_abx_body_summary_insights_s = tostring(abx_body.abx_body.summary_insights)\n| extend abx_body_abx_body_is_read_b = tobool(abx_body.abx_body.is_read)\n| extend abx_body_abx_body_folder_locations_s = tostring(abx_body.abx_body.folder_locations)\n| extend abx_body_abx_body_message_sources_s = tostring(abx_body.abx_body.message_sources)\n| extend abx_body_abx_body_message_engagement_s = tostring(abx_body.abx_body.message_engagement)\n| extend abx_body_abx_body_source_s = tostring(abx_body.abx_body.source)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_THREAT_LOG_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_abx_message_id_d = toreal(abx_body.abx_body.abx_message_id)\n| extend abx_body_abx_body_abx_message_id_str_s = tostring(abx_body.abx_body.abx_message_id_str)\n| extend abx_body_abx_body_abx_portal_url_s = tostring(abx_body.abx_body.abx_portal_url)\n| extend abx_body_abx_body_threat_id_g = toguid(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_from_name_s = tostring(abx_body.abx_body.from_name)\n| extend abx_body_abx_body_from_address_s = tostring(abx_body.abx_body.from_address)\n| extend abx_body_abx_body_to_addresses_s = tostring(abx_body.abx_body.to_addresses)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_received_time_t = todatetime(abx_body.abx_body.received_time)\n| extend abx_body_abx_body_sent_time_t = todatetime(abx_body.abx_body.sent_time)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_auto_remediated_b = tobool(abx_body.abx_body.auto_remediated)\n| extend abx_body_abx_body_post_remediated_b = tobool(abx_body.abx_body.post_remediated)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_remediation_timestamp_t = todatetime(abx_body.abx_body.remediation_timestamp)\n| extend abx_body_abx_body_attack_type_s = tostring(abx_body.abx_body.attack_type)\n| extend abx_body_abx_body_attack_strategy_s = tostring(abx_body.abx_body.attack_strategy)\n| extend abx_body_abx_body_attack_vector_s = tostring(abx_body.abx_body.attack_vector)\n| extend abx_body_abx_body_attack_score_d = toreal(abx_body.abx_body.attack_score)\n| extend abx_body_abx_body_attacked_party_s = tostring(abx_body.abx_body.attacked_party)\n| extend abx_body_abx_body_return_path_s = tostring(abx_body.abx_body.return_path)\n| extend abx_body_abx_body_reply_to_emails_s = tostring(abx_body.abx_body.reply_to_emails)\n| extend abx_body_abx_body_cc_emails_s = tostring(abx_body.abx_body.cc_emails)\n| extend abx_body_abx_body_bcc_emails_s = tostring(abx_body.abx_body.bcc_emails)\n| extend abx_body_abx_body_sender_ip_address_s = tostring(abx_body.abx_body.sender_ip_address)\n| extend abx_body_abx_body_sender_domain_s = tostring(abx_body.abx_body.sender_domain)\n| extend abx_body_abx_body_sender_auth_results_spf_s = tostring(abx_body.abx_body.sender_auth_results.spf)\n| extend abx_body_abx_body_sender_auth_results_dkim_s = tostring(abx_body.abx_body.sender_auth_results.dkim)\n| extend abx_body_abx_body_sender_auth_results_dmarc_s = tostring(abx_body.abx_body.sender_auth_results.dmarc)\n| extend abx_body_abx_body_impersonated_party_s = tostring(abx_body.abx_body.impersonated_party)\n| extend abx_body_abx_body_attachment_names_s = tostring(abx_body.abx_body.attachment_names)\n| extend abx_body_abx_body_attachment_count_d = toreal(abx_body.abx_body.attachment_count)\n| extend abx_body_abx_body_attachment_analysis_s = tostring(abx_body.abx_body.attachment_analysis)\n| extend abx_body_abx_body_urls_s = tostring(abx_body.abx_body.urls)\n| extend abx_body_abx_body_url_count_d = toreal(abx_body.abx_body.url_count)\n| extend abx_body_abx_body_summary_insights_s = tostring(abx_body.abx_body.summary_insights)\n| extend abx_body_abx_body_is_read_b = tobool(abx_body.abx_body.is_read)\n| extend abx_body_abx_body_folder_locations_s = tostring(abx_body.abx_body.folder_locations)\n| extend abx_body_abx_body_message_sources_s = tostring(abx_body.abx_body.message_sources)\n| extend abx_body_abx_body_message_engagement_s = tostring(abx_body.abx_body.message_engagement)\n| extend abx_body_abx_body_source_s = tostring(abx_body.abx_body.source)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_THREAT_LOG_V2_CL" }, { "streams": [ @@ -661,8 +661,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_schema_version_s = tostring(abx_body.abx_body.schema_version)\n| extend abx_body_abx_body_case_id_d = toreal(abx_body.abx_body.case_id)\n| extend abx_body_abx_body_customer_d = toreal(abx_body.abx_body.customer)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_body_first_observed_t = todatetime(abx_body.abx_body.first_observed)\n| extend abx_body_abx_body_date_created_t = todatetime(abx_body.abx_body.date_created)\n| extend abx_body_abx_body_first_customer_visible_time_t = todatetime(abx_body.abx_body.first_customer_visible_time)\n| extend abx_body_abx_body_trigger_event_s = tostring(abx_body.abx_body.trigger_event)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_confidence_s = tostring(abx_body.abx_body.confidence)\n| extend abx_body_abx_body_case_status_s = tostring(abx_body.abx_body.case_status)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_entity_entity_type_s = tostring(abx_body.abx_body.entity.entity_type)\n| extend abx_body_abx_body_entity_identifier_s = tostring(abx_body.abx_body.entity.identifier)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_genai_summary_s = tostring(abx_body.abx_body.genai_summary)\n| extend abx_body_abx_body_event_timeline_s = tostring(abx_body.abx_body.event_timeline)\n| extend abx_body_abx_body_platforms_s = tostring(abx_body.abx_body.platforms)\n| extend abx_body_abx_body_event_type_s = tostring(abx_body.abx_body.event_type)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_CASE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_schema_version_s = tostring(abx_body.abx_body.schema_version)\n| extend abx_body_abx_body_case_id_d = toreal(abx_body.abx_body.case_id)\n| extend abx_body_abx_body_customer_d = toreal(abx_body.abx_body.customer)\n| extend abx_body_abx_body_tenant_s = tostring(abx_body.abx_body.tenant)\n| extend abx_body_abx_body_first_observed_t = todatetime(abx_body.abx_body.first_observed)\n| extend abx_body_abx_body_date_created_t = todatetime(abx_body.abx_body.date_created)\n| extend abx_body_abx_body_first_customer_visible_time_t = todatetime(abx_body.abx_body.first_customer_visible_time)\n| extend abx_body_abx_body_trigger_event_s = tostring(abx_body.abx_body.trigger_event)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_confidence_s = tostring(abx_body.abx_body.confidence)\n| extend abx_body_abx_body_case_status_s = tostring(abx_body.abx_body.case_status)\n| extend abx_body_abx_body_remediation_status_s = tostring(abx_body.abx_body.remediation_status)\n| extend abx_body_abx_body_entity_entity_type_s = tostring(abx_body.abx_body.entity.entity_type)\n| extend abx_body_abx_body_entity_identifier_s = tostring(abx_body.abx_body.entity.identifier)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_genai_summary_s = tostring(abx_body.abx_body.genai_summary)\n| extend abx_body_abx_body_event_timeline_s = tostring(abx_body.abx_body.event_timeline)\n| extend abx_body_abx_body_platforms_s = tostring(abx_body.abx_body.platforms)\n| extend abx_body_abx_body_event_type_s = tostring(abx_body.abx_body.event_type)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_CASE_V2_CL" }, { "streams": [ @@ -671,8 +671,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_audit_type_s = tostring(abx_body.abx_body.audit_type)\n| extend abx_body_abx_body_audit_subtype_s = tostring(abx_body.abx_body.audit_subtype)\n| extend abx_body_abx_body_category_s = tostring(abx_body.abx_body.category)\n| extend abx_body_abx_body_details_s = tostring(abx_body.abx_body.details)\n| extend abx_body_abx_body_source_ip_s = tostring(abx_body.abx_body.source_ip)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_tenant_name_s = tostring(abx_body.abx_body.tenant_name)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_user_email_s = tostring(abx_body.abx_body.user.email)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_AUDIT_LOG_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_audit_type_s = tostring(abx_body.abx_body.audit_type)\n| extend abx_body_abx_body_audit_subtype_s = tostring(abx_body.abx_body.audit_subtype)\n| extend abx_body_abx_body_category_s = tostring(abx_body.abx_body.category)\n| extend abx_body_abx_body_details_s = tostring(abx_body.abx_body.details)\n| extend abx_body_abx_body_source_ip_s = tostring(abx_body.abx_body.source_ip)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_tenant_name_s = tostring(abx_body.abx_body.tenant_name)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_user_email_s = tostring(abx_body.abx_body.user.email)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_AUDIT_LOG_V2_CL" }, { "streams": [ @@ -681,8 +681,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_not_analyzed_b = tobool(abx_body.abx_body.not_analyzed)\n| extend abx_body_abx_body_reason_for_no_analysis_s = tostring(abx_body.abx_body.reason_for_no_analysis)\n| extend abx_body_abx_body_campaign_id_g = tostring(abx_body.abx_body.campaign_id)\n| extend abx_body_abx_body_abnormal_message_id_d = toreal(abx_body.abx_body.abnormal_message_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_reported_b = tobool(abx_body.abx_body.reported)\n| extend abx_body_abx_body_message_reported_time_s = tostring(abx_body.abx_body.message_reported_time)\n| extend abx_body_abx_body_reporter_name_s = tostring(abx_body.abx_body.reporter_name)\n| extend abx_body_abx_body_reporter_address_s = tostring(abx_body.abx_body.reporter_address)\n| extend abx_body_abx_body_judgement_s = tostring(abx_body.abx_body.judgement)\n| extend abx_body_abx_body_recipient_name_s = tostring(abx_body.abx_body.recipient_name)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_email_label_or_location_s = tostring(abx_body.abx_body.email_label_or_location)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_ABUSE_MAILBOX_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_not_analyzed_b = tobool(abx_body.abx_body.not_analyzed)\n| extend abx_body_abx_body_reason_for_no_analysis_s = tostring(abx_body.abx_body.reason_for_no_analysis)\n| extend abx_body_abx_body_campaign_id_g = toguid(abx_body.abx_body.campaign_id)\n| extend abx_body_abx_body_abnormal_message_id_d = toreal(abx_body.abx_body.abnormal_message_id)\n| extend abx_body_abx_body_subject_s = tostring(abx_body.abx_body.subject)\n| extend abx_body_abx_body_reported_b = tobool(abx_body.abx_body.reported)\n| extend abx_body_abx_body_message_reported_time_s = tostring(abx_body.abx_body.message_reported_time)\n| extend abx_body_abx_body_reporter_name_s = tostring(abx_body.abx_body.reporter_name)\n| extend abx_body_abx_body_reporter_address_s = tostring(abx_body.abx_body.reporter_address)\n| extend abx_body_abx_body_judgement_s = tostring(abx_body.abx_body.judgement)\n| extend abx_body_abx_body_recipient_name_s = tostring(abx_body.abx_body.recipient_name)\n| extend abx_body_abx_body_recipient_address_s = tostring(abx_body.abx_body.recipient_address)\n| extend abx_body_abx_body_internet_message_id_s = tostring(abx_body.abx_body.internet_message_id)\n| extend abx_body_abx_body_email_label_or_location_s = tostring(abx_body.abx_body.email_label_or_location)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL" }, { "streams": [ @@ -691,8 +691,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_type_s = tostring(abx_body.abx_body.type)\n| extend abx_body_abx_body_event_id_s = tostring(abx_body.abx_body.event_id)\n| extend abx_body_abx_body_tenant_id_d = toreal(abx_body.abx_body.tenant_id)\n| extend abx_body_abx_body_posture_id_s = tostring(abx_body.abx_body.posture_id)\n| extend abx_body_abx_body_posture_name_s = tostring(abx_body.abx_body.posture_name)\n| extend abx_body_abx_body_posture_category_s = tostring(abx_body.abx_body.posture_category)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_workflow_status_s = tostring(abx_body.abx_body.workflow_status)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_platform_type_s = tostring(abx_body.abx_body.platform_type)\n| extend abx_body_abx_body_posture_area_s = tostring(abx_body.abx_body.posture_area)\n| extend abx_body_abx_body_tags_s = tostring(abx_body.abx_body.tags)\n| extend abx_body_abx_body_benchmarks_s = tostring(abx_body.abx_body.benchmarks)\n| extend abx_body_abx_body_raw_event_s = tostring(abx_body.abx_body.raw_event)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_POSTURE_CHANGE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_type_s = tostring(abx_body.abx_body.type)\n| extend abx_body_abx_body_event_id_s = tostring(abx_body.abx_body.event_id)\n| extend abx_body_abx_body_tenant_id_d = toreal(abx_body.abx_body.tenant_id)\n| extend abx_body_abx_body_posture_id_s = tostring(abx_body.abx_body.posture_id)\n| extend abx_body_abx_body_posture_name_s = tostring(abx_body.abx_body.posture_name)\n| extend abx_body_abx_body_posture_category_s = tostring(abx_body.abx_body.posture_category)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_workflow_status_s = tostring(abx_body.abx_body.workflow_status)\n| extend abx_body_abx_body_timestamp_t = todatetime(abx_body.abx_body.timestamp)\n| extend abx_body_abx_body_description_s = tostring(abx_body.abx_body.description)\n| extend abx_body_abx_body_platform_type_s = tostring(abx_body.abx_body.platform_type)\n| extend abx_body_abx_body_posture_area_s = tostring(abx_body.abx_body.posture_area)\n| extend abx_body_abx_body_tags_s = tostring(abx_body.abx_body.tags)\n| extend abx_body_abx_body_benchmarks_s = tostring(abx_body.abx_body.benchmarks)\n| extend abx_body_abx_body_raw_event_s = tostring(abx_body.abx_body.raw_event)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL" }, { "streams": [ @@ -701,8 +701,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_ato_case_id_s = tostring(abx_body.abx_body.ato_case_id)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_compromised_account_s = tostring(abx_body.abx_body.compromised_account)\n| extend abx_body_abx_body_first_detected_t = todatetime(abx_body.abx_body.first_detected)\n| extend abx_body_abx_body_indicators_s = tostring(abx_body.abx_body.indicators)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_ATO_CASE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_ato_case_id_s = tostring(abx_body.abx_body.ato_case_id)\n| extend abx_body_abx_body_severity_s = tostring(abx_body.abx_body.severity)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_compromised_account_s = tostring(abx_body.abx_body.compromised_account)\n| extend abx_body_abx_body_first_detected_t = todatetime(abx_body.abx_body.first_detected)\n| extend abx_body_abx_body_indicators_s = tostring(abx_body.abx_body.indicators)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_ATO_CASE_V2_CL" }, { "streams": [ @@ -711,8 +711,8 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_remediation_id_s = tostring(abx_body.abx_body.remediation_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_threat_id_s = tostring(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_recipient_s = tostring(abx_body.abx_body.recipient)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_initiated_by_s = tostring(abx_body.abx_body.initiated_by)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_REMEDIATION_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_remediation_id_s = tostring(abx_body.abx_body.remediation_id)\n| extend abx_body_abx_body_action_s = tostring(abx_body.abx_body.action)\n| extend abx_body_abx_body_threat_id_s = tostring(abx_body.abx_body.threat_id)\n| extend abx_body_abx_body_recipient_s = tostring(abx_body.abx_body.recipient)\n| extend abx_body_abx_body_status_s = tostring(abx_body.abx_body.status)\n| extend abx_body_abx_body_initiated_by_s = tostring(abx_body.abx_body.initiated_by)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_REMEDIATION_V2_CL" }, { "streams": [ @@ -721,21 +721,21 @@ "destinations": [ "clv2ws1" ], - "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = tostring(abx_metadata.trace_id)\n| extend abx_body_abx_body_vendorCaseId_g = tostring(abx_body.abx_body.vendorCaseId)\n| extend abx_body_abx_body_firstObservedTime_t = todatetime(abx_body.abx_body.firstObservedTime)\n| extend abx_body_abx_body_lastModifiedTime_t = todatetime(abx_body.abx_body.lastModifiedTime)\n| extend abx_body_abx_body_vendorDomain_s = tostring(abx_body.abx_body.vendorDomain)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_timeline_s = tostring(abx_body.abx_body.timeline)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = tostring(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", - "outputStream": "Custom-ABNORMAL_SECURITY_VENDOR_CASE_CL" + "transformKql": "source | extend TimeGenerated = todatetime(Time)\n| extend abx_metadata_event_type_s = tostring(abx_metadata.event_type)\n| extend abx_metadata_timestamp_s = tostring(abx_metadata.timestamp)\n| extend abx_metadata_trace_id_g = toguid(abx_metadata.trace_id)\n| extend abx_body_abx_body_vendorCaseId_g = toguid(abx_body.abx_body.vendorCaseId)\n| extend abx_body_abx_body_firstObservedTime_t = todatetime(abx_body.abx_body.firstObservedTime)\n| extend abx_body_abx_body_lastModifiedTime_t = todatetime(abx_body.abx_body.lastModifiedTime)\n| extend abx_body_abx_body_vendorDomain_s = tostring(abx_body.abx_body.vendorDomain)\n| extend abx_body_abx_body_insights_s = tostring(abx_body.abx_body.insights)\n| extend abx_body_abx_body_timeline_s = tostring(abx_body.abx_body.timeline)\n| extend abx_body_abx_metadata_event_type_s = tostring(abx_body.abx_metadata.event_type)\n| extend abx_body_abx_metadata_timestamp_s = tostring(abx_body.abx_metadata.timestamp)\n| extend abx_body_abx_metadata_trace_id_g = toguid(abx_body.abx_metadata.trace_id)\n| extend abx_body = tostring(abx_body)\n| extend abx_metadata = tostring(abx_metadata)", + "outputStream": "Custom-ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" } ] } }, { - "name": "ABNORMAL_SECURITY_LOGS_CL", + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_LOGS_CL", + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -769,7 +769,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -788,7 +788,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -798,14 +798,14 @@ } }, { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -839,7 +839,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -854,7 +854,7 @@ }, { "name": "abx_body_abx_body_campaign_id_g", - "type": "string", + "type": "guid", "description": "Abuse campaign UUID" }, { @@ -928,7 +928,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -938,14 +938,14 @@ } }, { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -979,7 +979,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -1028,7 +1028,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1038,14 +1038,14 @@ } }, { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -1079,7 +1079,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -1148,7 +1148,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1158,14 +1158,14 @@ } }, { - "name": "ABNORMAL_SECURITY_CASE_CL", + "name": "ABNORMAL_SECURITY_CASE_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_CASE_CL", + "name": "ABNORMAL_SECURITY_CASE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -1199,7 +1199,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -1318,7 +1318,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1328,14 +1328,14 @@ } }, { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -1369,7 +1369,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -1463,7 +1463,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1473,14 +1473,14 @@ } }, { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -1514,7 +1514,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -1563,7 +1563,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1573,14 +1573,14 @@ } }, { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -1614,7 +1614,7 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { @@ -1634,7 +1634,7 @@ }, { "name": "abx_body_abx_body_threat_id_g", - "type": "string", + "type": "guid", "description": "Threat group UUID" }, { @@ -1848,7 +1848,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1858,14 +1858,14 @@ } }, { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", "apiVersion": "2022-10-01", "type": "Microsoft.OperationalInsights/workspaces/tables", "location": "[parameters('workspace-location')]", "kind": null, "properties": { "schema": { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", "columns": [ { "name": "TimeGenerated", @@ -1899,12 +1899,12 @@ }, { "name": "abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "description": "Trace ID (GUID) from top-level abx_metadata" }, { "name": "abx_body_abx_body_vendorCaseId_g", - "type": "string", + "type": "guid", "description": "Vendor case UUID" }, { @@ -1948,7 +1948,7 @@ }, { "name": "abx_body_abx_metadata_trace_id_g", - "type": "string", + "type": "guid", "isDefaultDisplay": false, "isHidden": false, "description": "From abx_body.abx_metadata" @@ -1983,111 +1983,111 @@ "graphQueries": [ { "metricName": "Threat Logs", - "legend": "ABNORMAL_SECURITY_THREAT_LOG_CL", - "baseQuery": "ABNORMAL_SECURITY_THREAT_LOG_CL" + "legend": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL" }, { "metricName": "Cases", - "legend": "ABNORMAL_SECURITY_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_CASE_CL" + "legend": "ABNORMAL_SECURITY_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_CASE_V2_CL" }, { "metricName": "Audit Logs", - "legend": "ABNORMAL_SECURITY_AUDIT_LOG_CL", - "baseQuery": "ABNORMAL_SECURITY_AUDIT_LOG_CL" + "legend": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL" }, { "metricName": "Abuse Mailbox", - "legend": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "baseQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL" + "legend": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL" }, { "metricName": "Posture Changes", - "legend": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", - "baseQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL" + "legend": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL" }, { "metricName": "ATO Cases", - "legend": "ABNORMAL_SECURITY_ATO_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_ATO_CASE_CL" + "legend": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_ATO_CASE_V2_CL" }, { "metricName": "Remediations", - "legend": "ABNORMAL_SECURITY_REMEDIATION_CL", - "baseQuery": "ABNORMAL_SECURITY_REMEDIATION_CL" + "legend": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_REMEDIATION_V2_CL" }, { "metricName": "Vendor Cases", - "legend": "ABNORMAL_SECURITY_VENDOR_CASE_CL", - "baseQuery": "ABNORMAL_SECURITY_VENDOR_CASE_CL" + "legend": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" }, { "metricName": "Other Events (Fallback)", - "legend": "ABNORMAL_SECURITY_LOGS_CL", - "baseQuery": "ABNORMAL_SECURITY_LOGS_CL" + "legend": "ABNORMAL_SECURITY_LOGS_V2_CL", + "baseQuery": "ABNORMAL_SECURITY_LOGS_V2_CL" } ], "sampleQueries": [ { "description": "All Abnormal Security events across all tables", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n | sort by TimeGenerated desc\n | take 100" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | sort by TimeGenerated desc\n | take 100" }, { "description": "Threat logs by severity", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" }, { "description": "Cases by status (last 7 days)", - "query": "ABNORMAL_SECURITY_CASE_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" }, { "description": "Event volume by type (last 24h)", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" } ], "dataTypes": [ { - "name": "ABNORMAL_SECURITY_THREAT_LOG_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_AUDIT_LOG_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_AUDIT_LOG_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_AUDIT_LOG_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_ATO_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_ATO_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_REMEDIATION_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_REMEDIATION_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_REMEDIATION_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_REMEDIATION_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_VENDOR_CASE_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "ABNORMAL_SECURITY_LOGS_CL", - "lastDataReceivedQuery": "ABNORMAL_SECURITY_LOGS_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "ABNORMAL_SECURITY_LOGS_V2_CL", + "lastDataReceivedQuery": "ABNORMAL_SECURITY_LOGS_V2_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ { "type": "IsConnectedQuery", "value": [ - "union ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" + "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(7d)" ] } ], @@ -2199,7 +2199,7 @@ { "type": "Markdown", "parameters": { - "content": "#### Configure in Abnormal Security Portal\n1. Log in to [Abnormal Security Portal](https://portal.abnormalsecurity.com)\n2. Navigate to **Settings > Integrations > SIEM**\n3. Select **Microsoft Sentinel (Azure Monitor CCF)**\n4. Enter all 7 values from above\n5. Click **Verify Credentials** to test the connection\n6. Click **Save** and **Enable** the integration\n\n**Multi-table routing:** Events are automatically routed to per-event-type tables (e.g., threat logs → `ABNORMAL_SECURITY_THREAT_LOG_CL`, cases → `ABNORMAL_SECURITY_CASE_CL`). Unknown event types go to the fallback table `ABNORMAL_SECURITY_LOGS_CL`." + "content": "#### Configure in Abnormal Security Portal\n1. Log in to [Abnormal Security Portal](https://portal.abnormalsecurity.com)\n2. Navigate to **Settings > Integrations > SIEM**\n3. Select **Microsoft Sentinel (Azure Monitor CCF)**\n4. Enter all 7 values from above\n5. Click **Verify Credentials** to test the connection\n6. Click **Save** and **Enable** the integration\n\n**Multi-table routing:** Events are automatically routed to per-event-type tables (e.g., threat logs → `ABNORMAL_SECURITY_THREAT_LOG_V2_CL`, cases → `ABNORMAL_SECURITY_CASE_V2_CL`). Unknown event types go to the fallback table `ABNORMAL_SECURITY_LOGS_V2_CL`." } } ] @@ -2211,7 +2211,7 @@ { "type": "Markdown", "parameters": { - "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_CL, ABNORMAL_SECURITY_CASE_CL, ABNORMAL_SECURITY_AUDIT_LOG_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_CL, ABNORMAL_SECURITY_ATO_CASE_CL, ABNORMAL_SECURITY_REMEDIATION_CL, ABNORMAL_SECURITY_VENDOR_CASE_CL, ABNORMAL_SECURITY_LOGS_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." + "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." } } ] @@ -2379,7 +2379,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity data connector with template version 3.1.0", + "description": "AbnormalSecurity data connector with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -2769,7 +2769,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurityThreatLog Data Parser with template version 3.1.0", + "description": "AbnormalSecurityThreatLog Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -2786,7 +2786,7 @@ "displayName": "Parser for Abnormal Security Threat Log", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityThreatLog", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| project\n TimeGenerated,\n ThreatId = abx_body_abx_body_threat_id_g,\n MessageId = abx_body_abx_body_abx_message_id_str_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n Subject = abx_body_abx_body_subject_s,\n SenderName = abx_body_abx_body_from_name_s,\n SenderAddress = abx_body_abx_body_from_address_s,\n SenderDomain = abx_body_abx_body_sender_domain_s,\n SenderIpAddress = abx_body_abx_body_sender_ip_address_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n ToAddresses = abx_body_abx_body_to_addresses_s,\n ReceivedTime = abx_body_abx_body_received_time_t,\n AttackType = abx_body_abx_body_attack_type_s,\n AttackStrategy = abx_body_abx_body_attack_strategy_s,\n AttackVector = abx_body_abx_body_attack_vector_s,\n AttackScore = abx_body_abx_body_attack_score_d,\n AttackedParty = abx_body_abx_body_attacked_party_s,\n ImpersonatedParty = abx_body_abx_body_impersonated_party_s,\n AutoRemediated = abx_body_abx_body_auto_remediated_b,\n PostRemediated = abx_body_abx_body_post_remediated_b,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n RemediationTimestamp = abx_body_abx_body_remediation_timestamp_t,\n SpfResult = abx_body_abx_body_sender_auth_results_spf_s,\n DkimResult = abx_body_abx_body_sender_auth_results_dkim_s,\n DmarcResult = abx_body_abx_body_sender_auth_results_dmarc_s,\n Urls = abx_body_abx_body_urls_s,\n UrlCount = abx_body_abx_body_url_count_d,\n AttachmentNames = abx_body_abx_body_attachment_names_s,\n AttachmentCount = abx_body_abx_body_attachment_count_d,\n SummaryInsights = abx_body_abx_body_summary_insights_s,\n PortalUrl = abx_body_abx_body_abx_portal_url_s\n", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| project\n TimeGenerated,\n ThreatId = abx_body_abx_body_threat_id_g,\n MessageId = abx_body_abx_body_abx_message_id_str_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n Subject = abx_body_abx_body_subject_s,\n SenderName = abx_body_abx_body_from_name_s,\n SenderAddress = abx_body_abx_body_from_address_s,\n SenderDomain = abx_body_abx_body_sender_domain_s,\n SenderIpAddress = abx_body_abx_body_sender_ip_address_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n ToAddresses = abx_body_abx_body_to_addresses_s,\n ReceivedTime = abx_body_abx_body_received_time_t,\n AttackType = abx_body_abx_body_attack_type_s,\n AttackStrategy = abx_body_abx_body_attack_strategy_s,\n AttackVector = abx_body_abx_body_attack_vector_s,\n AttackScore = abx_body_abx_body_attack_score_d,\n AttackedParty = abx_body_abx_body_attacked_party_s,\n ImpersonatedParty = abx_body_abx_body_impersonated_party_s,\n AutoRemediated = abx_body_abx_body_auto_remediated_b,\n PostRemediated = abx_body_abx_body_post_remediated_b,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n RemediationTimestamp = abx_body_abx_body_remediation_timestamp_t,\n SpfResult = abx_body_abx_body_sender_auth_results_spf_s,\n DkimResult = abx_body_abx_body_sender_auth_results_dkim_s,\n DmarcResult = abx_body_abx_body_sender_auth_results_dmarc_s,\n Urls = abx_body_abx_body_urls_s,\n UrlCount = abx_body_abx_body_url_count_d,\n AttachmentNames = abx_body_abx_body_attachment_names_s,\n AttachmentCount = abx_body_abx_body_attachment_count_d,\n SummaryInsights = abx_body_abx_body_summary_insights_s,\n PortalUrl = abx_body_abx_body_abx_portal_url_s\n", "functionParameters": "", "version": 2, "tags": [ @@ -2850,7 +2850,7 @@ "displayName": "Parser for Abnormal Security Threat Log", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityThreatLog", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| project\n TimeGenerated,\n ThreatId = abx_body_abx_body_threat_id_g,\n MessageId = abx_body_abx_body_abx_message_id_str_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n Subject = abx_body_abx_body_subject_s,\n SenderName = abx_body_abx_body_from_name_s,\n SenderAddress = abx_body_abx_body_from_address_s,\n SenderDomain = abx_body_abx_body_sender_domain_s,\n SenderIpAddress = abx_body_abx_body_sender_ip_address_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n ToAddresses = abx_body_abx_body_to_addresses_s,\n ReceivedTime = abx_body_abx_body_received_time_t,\n AttackType = abx_body_abx_body_attack_type_s,\n AttackStrategy = abx_body_abx_body_attack_strategy_s,\n AttackVector = abx_body_abx_body_attack_vector_s,\n AttackScore = abx_body_abx_body_attack_score_d,\n AttackedParty = abx_body_abx_body_attacked_party_s,\n ImpersonatedParty = abx_body_abx_body_impersonated_party_s,\n AutoRemediated = abx_body_abx_body_auto_remediated_b,\n PostRemediated = abx_body_abx_body_post_remediated_b,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n RemediationTimestamp = abx_body_abx_body_remediation_timestamp_t,\n SpfResult = abx_body_abx_body_sender_auth_results_spf_s,\n DkimResult = abx_body_abx_body_sender_auth_results_dkim_s,\n DmarcResult = abx_body_abx_body_sender_auth_results_dmarc_s,\n Urls = abx_body_abx_body_urls_s,\n UrlCount = abx_body_abx_body_url_count_d,\n AttachmentNames = abx_body_abx_body_attachment_names_s,\n AttachmentCount = abx_body_abx_body_attachment_count_d,\n SummaryInsights = abx_body_abx_body_summary_insights_s,\n PortalUrl = abx_body_abx_body_abx_portal_url_s\n", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| project\n TimeGenerated,\n ThreatId = abx_body_abx_body_threat_id_g,\n MessageId = abx_body_abx_body_abx_message_id_str_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n Subject = abx_body_abx_body_subject_s,\n SenderName = abx_body_abx_body_from_name_s,\n SenderAddress = abx_body_abx_body_from_address_s,\n SenderDomain = abx_body_abx_body_sender_domain_s,\n SenderIpAddress = abx_body_abx_body_sender_ip_address_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n ToAddresses = abx_body_abx_body_to_addresses_s,\n ReceivedTime = abx_body_abx_body_received_time_t,\n AttackType = abx_body_abx_body_attack_type_s,\n AttackStrategy = abx_body_abx_body_attack_strategy_s,\n AttackVector = abx_body_abx_body_attack_vector_s,\n AttackScore = abx_body_abx_body_attack_score_d,\n AttackedParty = abx_body_abx_body_attacked_party_s,\n ImpersonatedParty = abx_body_abx_body_impersonated_party_s,\n AutoRemediated = abx_body_abx_body_auto_remediated_b,\n PostRemediated = abx_body_abx_body_post_remediated_b,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n RemediationTimestamp = abx_body_abx_body_remediation_timestamp_t,\n SpfResult = abx_body_abx_body_sender_auth_results_spf_s,\n DkimResult = abx_body_abx_body_sender_auth_results_dkim_s,\n DmarcResult = abx_body_abx_body_sender_auth_results_dmarc_s,\n Urls = abx_body_abx_body_urls_s,\n UrlCount = abx_body_abx_body_url_count_d,\n AttachmentNames = abx_body_abx_body_attachment_names_s,\n AttachmentCount = abx_body_abx_body_attachment_count_d,\n SummaryInsights = abx_body_abx_body_summary_insights_s,\n PortalUrl = abx_body_abx_body_abx_portal_url_s\n", "functionParameters": "", "version": 2, "tags": [ @@ -2899,7 +2899,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurityAtoCases Data Parser with template version 3.1.0", + "description": "AbnormalSecurityAtoCases Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -2916,7 +2916,7 @@ "displayName": "Parser for Abnormal Security Account Takeover Cases", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityAtoCases", - "query": "ABNORMAL_SECURITY_ATO_CASE_CL\n| project\n TimeGenerated,\n AtoCaseId = abx_body_abx_body_ato_case_id_s,\n CompromisedAccount = abx_body_abx_body_compromised_account_s,\n Severity = abx_body_abx_body_severity_s,\n Status = abx_body_abx_body_status_s,\n Indicators = abx_body_abx_body_indicators_s,\n FirstDetected = abx_body_abx_body_first_detected_t\n", + "query": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| project\n TimeGenerated,\n AtoCaseId = abx_body_abx_body_ato_case_id_s,\n CompromisedAccount = abx_body_abx_body_compromised_account_s,\n Severity = abx_body_abx_body_severity_s,\n Status = abx_body_abx_body_status_s,\n Indicators = abx_body_abx_body_indicators_s,\n FirstDetected = abx_body_abx_body_first_detected_t\n", "functionParameters": "", "version": 2, "tags": [ @@ -2980,7 +2980,7 @@ "displayName": "Parser for Abnormal Security Account Takeover Cases", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityAtoCases", - "query": "ABNORMAL_SECURITY_ATO_CASE_CL\n| project\n TimeGenerated,\n AtoCaseId = abx_body_abx_body_ato_case_id_s,\n CompromisedAccount = abx_body_abx_body_compromised_account_s,\n Severity = abx_body_abx_body_severity_s,\n Status = abx_body_abx_body_status_s,\n Indicators = abx_body_abx_body_indicators_s,\n FirstDetected = abx_body_abx_body_first_detected_t\n", + "query": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| project\n TimeGenerated,\n AtoCaseId = abx_body_abx_body_ato_case_id_s,\n CompromisedAccount = abx_body_abx_body_compromised_account_s,\n Severity = abx_body_abx_body_severity_s,\n Status = abx_body_abx_body_status_s,\n Indicators = abx_body_abx_body_indicators_s,\n FirstDetected = abx_body_abx_body_first_detected_t\n", "functionParameters": "", "version": 2, "tags": [ @@ -3029,7 +3029,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurityAbuseMailbox Data Parser with template version 3.1.0", + "description": "AbnormalSecurityAbuseMailbox Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -3046,7 +3046,7 @@ "displayName": "Parser for Abnormal Security Abuse Mailbox", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityAbuseMailbox", - "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| project\n TimeGenerated,\n CampaignId = abx_body_abx_body_campaign_id_g,\n Subject = abx_body_abx_body_subject_s,\n Judgement = abx_body_abx_body_judgement_s,\n Reported = abx_body_abx_body_reported_b,\n MessageReportedTime = abx_body_abx_body_message_reported_time_s,\n ReporterName = abx_body_abx_body_reporter_name_s,\n ReporterAddress = abx_body_abx_body_reporter_address_s,\n RecipientName = abx_body_abx_body_recipient_name_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n EmailLabelOrLocation = abx_body_abx_body_email_label_or_location_s,\n NotAnalyzed = abx_body_abx_body_not_analyzed_b,\n ReasonForNoAnalysis = abx_body_abx_body_reason_for_no_analysis_s\n", + "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| project\n TimeGenerated,\n CampaignId = abx_body_abx_body_campaign_id_g,\n Subject = abx_body_abx_body_subject_s,\n Judgement = abx_body_abx_body_judgement_s,\n Reported = abx_body_abx_body_reported_b,\n MessageReportedTime = abx_body_abx_body_message_reported_time_s,\n ReporterName = abx_body_abx_body_reporter_name_s,\n ReporterAddress = abx_body_abx_body_reporter_address_s,\n RecipientName = abx_body_abx_body_recipient_name_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n EmailLabelOrLocation = abx_body_abx_body_email_label_or_location_s,\n NotAnalyzed = abx_body_abx_body_not_analyzed_b,\n ReasonForNoAnalysis = abx_body_abx_body_reason_for_no_analysis_s\n", "functionParameters": "", "version": 2, "tags": [ @@ -3110,7 +3110,7 @@ "displayName": "Parser for Abnormal Security Abuse Mailbox", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityAbuseMailbox", - "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| project\n TimeGenerated,\n CampaignId = abx_body_abx_body_campaign_id_g,\n Subject = abx_body_abx_body_subject_s,\n Judgement = abx_body_abx_body_judgement_s,\n Reported = abx_body_abx_body_reported_b,\n MessageReportedTime = abx_body_abx_body_message_reported_time_s,\n ReporterName = abx_body_abx_body_reporter_name_s,\n ReporterAddress = abx_body_abx_body_reporter_address_s,\n RecipientName = abx_body_abx_body_recipient_name_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n EmailLabelOrLocation = abx_body_abx_body_email_label_or_location_s,\n NotAnalyzed = abx_body_abx_body_not_analyzed_b,\n ReasonForNoAnalysis = abx_body_abx_body_reason_for_no_analysis_s\n", + "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| project\n TimeGenerated,\n CampaignId = abx_body_abx_body_campaign_id_g,\n Subject = abx_body_abx_body_subject_s,\n Judgement = abx_body_abx_body_judgement_s,\n Reported = abx_body_abx_body_reported_b,\n MessageReportedTime = abx_body_abx_body_message_reported_time_s,\n ReporterName = abx_body_abx_body_reporter_name_s,\n ReporterAddress = abx_body_abx_body_reporter_address_s,\n RecipientName = abx_body_abx_body_recipient_name_s,\n RecipientAddress = abx_body_abx_body_recipient_address_s,\n InternetMessageId = abx_body_abx_body_internet_message_id_s,\n EmailLabelOrLocation = abx_body_abx_body_email_label_or_location_s,\n NotAnalyzed = abx_body_abx_body_not_analyzed_b,\n ReasonForNoAnalysis = abx_body_abx_body_reason_for_no_analysis_s\n", "functionParameters": "", "version": 2, "tags": [ @@ -3159,7 +3159,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurityVendorCases Data Parser with template version 3.1.0", + "description": "AbnormalSecurityVendorCases Data Parser with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -3176,7 +3176,7 @@ "displayName": "Parser for Abnormal Security Vendor Cases", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityVendorCases", - "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| project\n TimeGenerated,\n VendorCaseId = abx_body_abx_body_vendorCaseId_g,\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n FirstObservedTime = abx_body_abx_body_firstObservedTime_t,\n LastModifiedTime = abx_body_abx_body_lastModifiedTime_t,\n Insights = abx_body_abx_body_insights_s,\n Timeline = abx_body_abx_body_timeline_s\n", + "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| project\n TimeGenerated,\n VendorCaseId = abx_body_abx_body_vendorCaseId_g,\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n FirstObservedTime = abx_body_abx_body_firstObservedTime_t,\n LastModifiedTime = abx_body_abx_body_lastModifiedTime_t,\n Insights = abx_body_abx_body_insights_s,\n Timeline = abx_body_abx_body_timeline_s\n", "functionParameters": "", "version": 2, "tags": [ @@ -3240,7 +3240,7 @@ "displayName": "Parser for Abnormal Security Vendor Cases", "category": "Microsoft Sentinel Parser", "functionAlias": "AbnormalSecurityVendorCases", - "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| project\n TimeGenerated,\n VendorCaseId = abx_body_abx_body_vendorCaseId_g,\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n FirstObservedTime = abx_body_abx_body_firstObservedTime_t,\n LastModifiedTime = abx_body_abx_body_lastModifiedTime_t,\n Insights = abx_body_abx_body_insights_s,\n Timeline = abx_body_abx_body_timeline_s\n", + "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| project\n TimeGenerated,\n VendorCaseId = abx_body_abx_body_vendorCaseId_g,\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n FirstObservedTime = abx_body_abx_body_firstObservedTime_t,\n LastModifiedTime = abx_body_abx_body_lastModifiedTime_t,\n Insights = abx_body_abx_body_insights_s,\n Timeline = abx_body_abx_body_timeline_s\n", "functionParameters": "", "version": 2, "tags": [ @@ -3289,7 +3289,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_HighRiskEmailAttack_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "AbnormalSecurity_HighRiskEmailAttack_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -3306,7 +3306,7 @@ "description": "Identifies email attacks detected by Abnormal Security whose attack type maps to a\nhigh-risk category (credential phishing, Business Email Compromise, invoice/payment\nfraud, malware, extortion, sensitive-data phishing, internal account-takeover attacks,\nor scams). Lower-risk categories such as Spam, Graymail, and Reconnaissance are\nintentionally excluded. Use this to triage targeted email threats that reached a mailbox.", "displayName": "Abnormal Security - High-risk email attack detected", "enabled": false, - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| where abx_body_abx_body_attack_type_s in~ (\n \"Phishing: Credential\",\n \"Social Engineering (BEC)\",\n \"Invoice/Payment Fraud (BEC)\",\n \"Malware\",\n \"Extortion\",\n \"Phishing: Sensitive Data\",\n \"Internal-to-Internal Attacks (Email Account Takeover)\",\n \"Scam\")\n| extend\n RecipientEmail = abx_body_abx_body_recipient_address_s,\n SenderEmail = abx_body_abx_body_from_address_s,\n SenderName = abx_body_abx_body_from_name_s,\n SenderIP = abx_body_abx_body_sender_ip_address_s,\n Subject = abx_body_abx_body_subject_s,\n MessageId = abx_body_abx_body_internet_message_id_s,\n AttackType = abx_body_abx_body_attack_type_s,\n AttackScore = abx_body_abx_body_attack_score_d,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n PortalUrl = abx_body_abx_body_abx_portal_url_s\n| project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl\n", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| where abx_body_abx_body_attack_type_s in~ (\n \"Phishing: Credential\",\n \"Social Engineering (BEC)\",\n \"Invoice/Payment Fraud (BEC)\",\n \"Malware\",\n \"Extortion\",\n \"Phishing: Sensitive Data\",\n \"Internal-to-Internal Attacks (Email Account Takeover)\",\n \"Scam\")\n| extend\n RecipientEmail = abx_body_abx_body_recipient_address_s,\n SenderEmail = abx_body_abx_body_from_address_s,\n SenderName = abx_body_abx_body_from_name_s,\n SenderIP = abx_body_abx_body_sender_ip_address_s,\n Subject = abx_body_abx_body_subject_s,\n MessageId = abx_body_abx_body_internet_message_id_s,\n AttackType = abx_body_abx_body_attack_type_s,\n AttackScore = abx_body_abx_body_attack_score_d,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n PortalUrl = abx_body_abx_body_abx_portal_url_s\n| project TimeGenerated, RecipientEmail, SenderEmail, SenderName, SenderIP, Subject, MessageId, AttackType, AttackScore, RemediationStatus, PortalUrl\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -3318,7 +3318,7 @@ "requiredDataConnectors": [ { "dataTypes": [ - "ABNORMAL_SECURITY_THREAT_LOG_CL" + "ABNORMAL_SECURITY_THREAT_LOG_V2_CL" ], "connectorId": "AbnormalSecurityPush" } @@ -3331,49 +3331,49 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "RecipientEmail", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "RecipientEmail" } - ] + ], + "entityType": "Account" }, { - "entityType": "MailMessage", "fieldMappings": [ { - "columnName": "RecipientEmail", - "identifier": "Recipient" + "identifier": "Recipient", + "columnName": "RecipientEmail" }, { - "columnName": "SenderEmail", - "identifier": "Sender" + "identifier": "Sender", + "columnName": "SenderEmail" }, { - "columnName": "MessageId", - "identifier": "NetworkMessageId" + "identifier": "NetworkMessageId", + "columnName": "MessageId" } - ] + ], + "entityType": "MailMessage" }, { - "entityType": "IP", "fieldMappings": [ { - "columnName": "SenderIP", - "identifier": "Address" + "identifier": "Address", + "columnName": "SenderIP" } - ] + ], + "entityType": "IP" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "AttackScore": "AttackScore", "RemediationStatus": "RemediationStatus", - "AbnormalPortalUrl": "PortalUrl", "AttackType": "AttackType", - "AttackScore": "AttackScore" + "AbnormalPortalUrl": "PortalUrl" }, "alertDetailsOverride": { "alertDescriptionFormat": "Abnormal Security detected a {{AttackType}} attack from {{SenderEmail}} to {{RecipientEmail}}. See attack score and remediation status in the custom details.", @@ -3381,9 +3381,9 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", - "reopenClosedIncident": false, "matchingMethod": "AllEntities", + "reopenClosedIncident": false, + "lookbackDuration": "PT5H", "enabled": false }, "createIncident": true @@ -3440,7 +3440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_AccountTakeover_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "AbnormalSecurity_AccountTakeover_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -3457,7 +3457,7 @@ "description": "Creates an incident when Abnormal Security opens an Account Takeover (ATO) case,\nindicating a mailbox or user account is suspected to be compromised. The ATO case\nseverity, status, and observed indicators are surfaced for triage.", "displayName": "Abnormal Security - Account Takeover case opened", "enabled": false, - "query": "ABNORMAL_SECURITY_ATO_CASE_CL\n| where isnotempty(abx_body_abx_body_ato_case_id_s)\n// Collapse to one row per ATO case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_ato_case_id_s\n| extend\n CompromisedAccount = abx_body_abx_body_compromised_account_s,\n CaseSeverity = abx_body_abx_body_severity_s,\n CaseStatus = abx_body_abx_body_status_s,\n Indicators = abx_body_abx_body_indicators_s,\n FirstDetected = abx_body_abx_body_first_detected_t\n| project TimeGenerated, CompromisedAccount, CaseId, CaseSeverity, CaseStatus, Indicators, FirstDetected\n", + "query": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| where isnotempty(abx_body_abx_body_ato_case_id_s)\n// Collapse to one row per ATO case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_ato_case_id_s\n| extend\n CompromisedAccount = abx_body_abx_body_compromised_account_s,\n CaseSeverity = abx_body_abx_body_severity_s,\n CaseStatus = abx_body_abx_body_status_s,\n Indicators = abx_body_abx_body_indicators_s,\n FirstDetected = abx_body_abx_body_first_detected_t\n| project TimeGenerated, CompromisedAccount, CaseId, CaseSeverity, CaseStatus, Indicators, FirstDetected\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "High", @@ -3469,7 +3469,7 @@ "requiredDataConnectors": [ { "dataTypes": [ - "ABNORMAL_SECURITY_ATO_CASE_CL" + "ABNORMAL_SECURITY_ATO_CASE_V2_CL" ], "connectorId": "AbnormalSecurityPush" } @@ -3484,21 +3484,21 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "CompromisedAccount", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "CompromisedAccount" } - ] + ], + "entityType": "Account" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "AtoCaseId": "CaseId", "CaseStatus": "CaseStatus", + "AtoCaseId": "CaseId", "CaseSeverity": "CaseSeverity" }, "alertDetailsOverride": { @@ -3507,9 +3507,9 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", - "reopenClosedIncident": false, "matchingMethod": "AllEntities", + "reopenClosedIncident": false, + "lookbackDuration": "PT5H", "enabled": true }, "createIncident": true @@ -3566,7 +3566,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_AbuseMailboxMalicious_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "AbnormalSecurity_AbuseMailboxMalicious_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -3583,7 +3583,7 @@ "description": "Creates an incident when an email a user reported to the Abnormal Security Abuse\nMailbox is judged malicious. Surfaces the reporter, the original recipient, and the\ncampaign so analysts can scope and remediate look-alike messages. Spam- and safe-judged\nreports are intentionally excluded.", "displayName": "Abnormal Security - User-reported email judged malicious", "enabled": false, - "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| where abx_body_abx_body_reported_b == true\n| where tolower(abx_body_abx_body_judgement_s) == \"malicious\"\n| extend\n ReporterEmail = abx_body_abx_body_reporter_address_s,\n RecipientEmail = abx_body_abx_body_recipient_address_s,\n Subject = abx_body_abx_body_subject_s,\n Judgement = abx_body_abx_body_judgement_s,\n MessageId = abx_body_abx_body_internet_message_id_s,\n CampaignId = abx_body_abx_body_campaign_id_g\n| project TimeGenerated, ReporterEmail, RecipientEmail, Subject, Judgement, MessageId, CampaignId\n", + "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| where abx_body_abx_body_reported_b == true\n| where tolower(abx_body_abx_body_judgement_s) == \"malicious\"\n| extend\n ReporterEmail = abx_body_abx_body_reporter_address_s,\n RecipientEmail = abx_body_abx_body_recipient_address_s,\n Subject = abx_body_abx_body_subject_s,\n Judgement = abx_body_abx_body_judgement_s,\n MessageId = abx_body_abx_body_internet_message_id_s,\n CampaignId = abx_body_abx_body_campaign_id_g\n| project TimeGenerated, ReporterEmail, RecipientEmail, Subject, Judgement, MessageId, CampaignId\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -3595,7 +3595,7 @@ "requiredDataConnectors": [ { "dataTypes": [ - "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL" + "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL" ], "connectorId": "AbnormalSecurityPush" } @@ -3608,38 +3608,38 @@ ], "entityMappings": [ { - "entityType": "Account", "fieldMappings": [ { - "columnName": "ReporterEmail", - "identifier": "FullName" + "identifier": "FullName", + "columnName": "ReporterEmail" } - ] + ], + "entityType": "Account" }, { - "entityType": "MailMessage", "fieldMappings": [ { - "columnName": "RecipientEmail", - "identifier": "Recipient" + "identifier": "Recipient", + "columnName": "RecipientEmail" }, { - "columnName": "Subject", - "identifier": "Subject" + "identifier": "Subject", + "columnName": "Subject" }, { - "columnName": "MessageId", - "identifier": "NetworkMessageId" + "identifier": "NetworkMessageId", + "columnName": "MessageId" } - ] + ], + "entityType": "MailMessage" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "CampaignId": "CampaignId", - "Judgement": "Judgement" + "Judgement": "Judgement", + "CampaignId": "CampaignId" }, "alertDetailsOverride": { "alertDescriptionFormat": "An email reported by {{ReporterEmail}} was judged {{Judgement}} by Abnormal Security. Original recipient: {{RecipientEmail}}.", @@ -3647,9 +3647,9 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", - "reopenClosedIncident": false, "matchingMethod": "AllEntities", + "reopenClosedIncident": false, + "lookbackDuration": "PT5H", "enabled": true }, "createIncident": true @@ -3706,7 +3706,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_VendorCompromise_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "AbnormalSecurity_VendorCompromise_AnalyticalRules Analytics Rule with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -3723,7 +3723,7 @@ "description": "Creates an incident when Abnormal Security opens a vendor case indicating a\ncompromised or impersonated vendor domain (vendor email compromise). Surfaces the\nvendor domain and Abnormal insights so analysts can review related correspondence.", "displayName": "Abnormal Security - Vendor compromise case detected", "enabled": false, - "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| where isnotempty(abx_body_abx_body_vendorCaseId_g)\n// Collapse to one row per vendor case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g\n| extend\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n Insights = abx_body_abx_body_insights_s,\n FirstObserved = abx_body_abx_body_firstObservedTime_t\n| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved\n", + "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| where isnotempty(abx_body_abx_body_vendorCaseId_g)\n// Collapse to one row per vendor case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g\n| extend\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n Insights = abx_body_abx_body_insights_s,\n FirstObserved = abx_body_abx_body_firstObservedTime_t\n| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -3735,7 +3735,7 @@ "requiredDataConnectors": [ { "dataTypes": [ - "ABNORMAL_SECURITY_VENDOR_CASE_CL" + "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" ], "connectorId": "AbnormalSecurityPush" } @@ -3748,13 +3748,13 @@ ], "entityMappings": [ { - "entityType": "DNS", "fieldMappings": [ { - "columnName": "VendorDomain", - "identifier": "DomainName" + "identifier": "DomainName", + "columnName": "VendorDomain" } - ] + ], + "entityType": "DNS" } ], "eventGroupingSettings": { @@ -3770,9 +3770,9 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", - "reopenClosedIncident": false, "matchingMethod": "AllEntities", + "reopenClosedIncident": false, + "lookbackDuration": "PT5H", "enabled": true }, "createIncident": true @@ -3829,7 +3829,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_UnremediatedThreats_HuntingQueries Hunting Query with template version 3.1.0", + "description": "AbnormalSecurity_UnremediatedThreats_HuntingQueries Hunting Query with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -3845,7 +3845,7 @@ "eTag": "*", "displayName": "Abnormal Security - Threats still in the mailbox", "category": "Hunting Queries", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| where abx_body_abx_body_auto_remediated_b == false\n and abx_body_abx_body_post_remediated_b == false\n| extend\n RecipientEmail = abx_body_abx_body_recipient_address_s,\n SenderEmail = abx_body_abx_body_from_address_s,\n Subject = abx_body_abx_body_subject_s,\n AttackType = abx_body_abx_body_attack_type_s,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n MessageId = abx_body_abx_body_internet_message_id_s\n| project TimeGenerated, RecipientEmail, SenderEmail, Subject, AttackType, RemediationStatus, MessageId\n| sort by TimeGenerated desc\n", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| where abx_body_abx_body_auto_remediated_b == false\n and abx_body_abx_body_post_remediated_b == false\n| extend\n RecipientEmail = abx_body_abx_body_recipient_address_s,\n SenderEmail = abx_body_abx_body_from_address_s,\n Subject = abx_body_abx_body_subject_s,\n AttackType = abx_body_abx_body_attack_type_s,\n RemediationStatus = abx_body_abx_body_remediation_status_s,\n MessageId = abx_body_abx_body_internet_message_id_s\n| project TimeGenerated, RecipientEmail, SenderEmail, Subject, AttackType, RemediationStatus, MessageId\n| sort by TimeGenerated desc\n", "version": 2, "tags": [ { @@ -3913,7 +3913,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_TopAttackTargets_HuntingQueries Hunting Query with template version 3.1.0", + "description": "AbnormalSecurity_TopAttackTargets_HuntingQueries Hunting Query with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -3929,7 +3929,7 @@ "eTag": "*", "displayName": "Abnormal Security - Most-targeted recipients", "category": "Hunting Queries", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| extend RecipientEmail = abx_body_abx_body_recipient_address_s\n| where isnotempty(RecipientEmail)\n| summarize\n ThreatCount = count(),\n DistinctAttackTypes = dcount(abx_body_abx_body_attack_type_s),\n AttackTypes = make_set(abx_body_abx_body_attack_type_s, 10),\n LastSeen = max(TimeGenerated)\n by RecipientEmail\n| where ThreatCount > 1\n| sort by ThreatCount desc\n", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| extend RecipientEmail = abx_body_abx_body_recipient_address_s\n| where isnotempty(RecipientEmail)\n| summarize\n ThreatCount = count(),\n DistinctAttackTypes = dcount(abx_body_abx_body_attack_type_s),\n AttackTypes = make_set(abx_body_abx_body_attack_type_s, 10),\n LastSeen = max(TimeGenerated)\n by RecipientEmail\n| where ThreatCount > 1\n| sort by ThreatCount desc\n", "version": 2, "tags": [ { @@ -3997,7 +3997,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_AbuseMailboxCampaigns_HuntingQueries Hunting Query with template version 3.1.0", + "description": "AbnormalSecurity_AbuseMailboxCampaigns_HuntingQueries Hunting Query with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -4013,7 +4013,7 @@ "eTag": "*", "displayName": "Abnormal Security - User-reported email campaigns", "category": "Hunting Queries", - "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| where abx_body_abx_body_reported_b == true\n| extend\n CampaignId = abx_body_abx_body_campaign_id_g,\n Judgement = abx_body_abx_body_judgement_s,\n Subject = abx_body_abx_body_subject_s\n| where isnotempty(CampaignId)\n| summarize\n ReportCount = count(),\n Recipients = dcount(abx_body_abx_body_recipient_address_s),\n Judgements = make_set(Judgement, 5),\n Subjects = make_set(Subject, 5),\n LastReported = max(TimeGenerated)\n by CampaignId\n| sort by ReportCount desc\n", + "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| where abx_body_abx_body_reported_b == true\n| extend\n CampaignId = abx_body_abx_body_campaign_id_g,\n Judgement = abx_body_abx_body_judgement_s,\n Subject = abx_body_abx_body_subject_s\n| where isnotempty(CampaignId)\n| summarize\n ReportCount = count(),\n Recipients = dcount(abx_body_abx_body_recipient_address_s),\n Judgements = make_set(Judgement, 5),\n Subjects = make_set(Subject, 5),\n LastReported = max(TimeGenerated)\n by CampaignId\n| sort by ReportCount desc\n", "version": 2, "tags": [ { @@ -4081,7 +4081,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity_NewVendorDomains_HuntingQueries Hunting Query with template version 3.1.0", + "description": "AbnormalSecurity_NewVendorDomains_HuntingQueries Hunting Query with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -4097,7 +4097,7 @@ "eTag": "*", "displayName": "Abnormal Security - Newly observed vendor domains", "category": "Hunting Queries", - "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| extend\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n VendorCaseId = abx_body_abx_body_vendorCaseId_g,\n FirstObserved = abx_body_abx_body_firstObservedTime_t\n| where isnotempty(VendorDomain)\n| summarize FirstObserved = min(FirstObserved), Cases = make_set(VendorCaseId, 10), CaseCount = count() by VendorDomain\n| sort by FirstObserved desc\n", + "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| extend\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n VendorCaseId = abx_body_abx_body_vendorCaseId_g,\n FirstObserved = abx_body_abx_body_firstObservedTime_t\n| where isnotempty(VendorDomain)\n| summarize FirstObserved = min(FirstObserved), Cases = make_set(VendorCaseId, 10), CaseCount = count() by VendorDomain\n| sort by FirstObserved desc\n", "version": 2, "tags": [ { @@ -4165,7 +4165,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurityOverview Workbook with template version 3.1.0", + "description": "AbnormalSecurityOverview Workbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -4183,7 +4183,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Abnormal Security Overview\\n\\nThis workbook summarizes email threats, account takeover cases, user-reported messages, and vendor cases ingested from the Abnormal Security CCF Push connector. Use the time range selector to adjust the reporting window.\"},\"name\":\"title\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1f1c0d2-0000-4a00-9000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_THREAT_LOG_CL\\n| summarize Threats = count() by bin(TimeGenerated, 1d)\\n| render timechart\",\"size\":0,\"title\":\"Threats detected over time\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"threats-over-time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_THREAT_LOG_CL\\n| summarize Count = count() by AttackType = tostring(abx_body_abx_body_attack_type_s)\\n| where isnotempty(AttackType)\\n| sort by Count desc\\n| render piechart\",\"size\":0,\"title\":\"Attacks by type\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"attacks-by-type\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_THREAT_LOG_CL\\n| summarize Threats = count() by Recipient = tostring(abx_body_abx_body_recipient_address_s)\\n| where isnotempty(Recipient)\\n| sort by Threats desc\\n| take 10\",\"size\":0,\"title\":\"Top targeted recipients\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"top-recipients\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_ATO_CASE_CL\\n| summarize Cases = count() by Severity = tostring(abx_body_abx_body_severity_s)\\n| sort by Cases desc\",\"size\":0,\"title\":\"Account Takeover cases by severity\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"ato-by-severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\\n| where abx_body_abx_body_reported_b == true\\n| summarize Reports = count() by Judgement = tostring(abx_body_abx_body_judgement_s)\\n| sort by Reports desc\",\"size\":0,\"title\":\"User-reported messages by judgement\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"abuse-by-judgement\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_VENDOR_CASE_CL\\n| summarize Cases = count() by VendorDomain = tostring(abx_body_abx_body_vendorDomain_s)\\n| where isnotempty(VendorDomain)\\n| sort by Cases desc\\n| take 10\",\"size\":0,\"title\":\"Vendor cases by domain\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"vendor-cases\"}],\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Abnormal Security Overview\\n\\nThis workbook summarizes email threats, account takeover cases, user-reported messages, and vendor cases ingested from the Abnormal Security CCF Push connector. Use the time range selector to adjust the reporting window.\"},\"name\":\"title\"},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1f1c0d2-0000-4a00-9000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":86400000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000}],\"allowCustom\":true},\"value\":{\"durationMs\":604800000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_THREAT_LOG_V2_CL\\n| summarize Threats = count() by bin(TimeGenerated, 1d)\\n| render timechart\",\"size\":0,\"title\":\"Threats detected over time\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"threats-over-time\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_THREAT_LOG_V2_CL\\n| summarize Count = count() by AttackType = tostring(abx_body_abx_body_attack_type_s)\\n| where isnotempty(AttackType)\\n| sort by Count desc\\n| render piechart\",\"size\":0,\"title\":\"Attacks by type\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"customWidth\":\"50\",\"name\":\"attacks-by-type\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_THREAT_LOG_V2_CL\\n| summarize Threats = count() by Recipient = tostring(abx_body_abx_body_recipient_address_s)\\n| where isnotempty(Recipient)\\n| sort by Threats desc\\n| take 10\",\"size\":0,\"title\":\"Top targeted recipients\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"top-recipients\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_ATO_CASE_V2_CL\\n| summarize Cases = count() by Severity = tostring(abx_body_abx_body_severity_s)\\n| sort by Cases desc\",\"size\":0,\"title\":\"Account Takeover cases by severity\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"ato-by-severity\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\\n| where abx_body_abx_body_reported_b == true\\n| summarize Reports = count() by Judgement = tostring(abx_body_abx_body_judgement_s)\\n| sort by Reports desc\",\"size\":0,\"title\":\"User-reported messages by judgement\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"customWidth\":\"50\",\"name\":\"abuse-by-judgement\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\\n| summarize Cases = count() by VendorDomain = tostring(abx_body_abx_body_vendorDomain_s)\\n| where isnotempty(VendorDomain)\\n| sort by Cases desc\\n| take 10\",\"size\":0,\"title\":\"Vendor cases by domain\",\"timeContext\":{\"durationMs\":604800000},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\"},\"name\":\"vendor-cases\"}],\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -4217,19 +4217,19 @@ "operator": "AND", "criteria": [ { - "contentId": "ABNORMAL_SECURITY_THREAT_LOG_CL", + "contentId": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", "kind": "DataType" }, { - "contentId": "ABNORMAL_SECURITY_ATO_CASE_CL", + "contentId": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", "kind": "DataType" }, { - "contentId": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", + "contentId": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", "kind": "DataType" }, { - "contentId": "ABNORMAL_SECURITY_VENDOR_CASE_CL", + "contentId": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", "kind": "DataType" }, { @@ -4265,7 +4265,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "AbnormalSecurity-AddIncidentComment Playbook with template version 3.1.0", + "description": "AbnormalSecurity-AddIncidentComment Playbook with template version 3.2.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -4454,7 +4454,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.0", + "version": "3.2.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "AbnormalSecurity", diff --git a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAbuseMailbox.yaml b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAbuseMailbox.yaml index 910ed292146..6267ebc9a2b 100644 --- a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAbuseMailbox.yaml +++ b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAbuseMailbox.yaml @@ -7,7 +7,7 @@ Category: Microsoft Sentinel Parser FunctionName: AbnormalSecurityAbuseMailbox FunctionAlias: AbnormalSecurityAbuseMailbox FunctionQuery: | - ABNORMAL_SECURITY_ABUSE_MAILBOX_CL + ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL | project TimeGenerated, CampaignId = abx_body_abx_body_campaign_id_g, diff --git a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAtoCases.yaml b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAtoCases.yaml index f8ac71c48eb..e39ed5ce1d0 100644 --- a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAtoCases.yaml +++ b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityAtoCases.yaml @@ -7,7 +7,7 @@ Category: Microsoft Sentinel Parser FunctionName: AbnormalSecurityAtoCases FunctionAlias: AbnormalSecurityAtoCases FunctionQuery: | - ABNORMAL_SECURITY_ATO_CASE_CL + ABNORMAL_SECURITY_ATO_CASE_V2_CL | project TimeGenerated, AtoCaseId = abx_body_abx_body_ato_case_id_s, diff --git a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityThreatLog.yaml b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityThreatLog.yaml index 326e5e90d42..99fd4d186d2 100644 --- a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityThreatLog.yaml +++ b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityThreatLog.yaml @@ -7,7 +7,7 @@ Category: Microsoft Sentinel Parser FunctionName: AbnormalSecurityThreatLog FunctionAlias: AbnormalSecurityThreatLog FunctionQuery: | - ABNORMAL_SECURITY_THREAT_LOG_CL + ABNORMAL_SECURITY_THREAT_LOG_V2_CL | project TimeGenerated, ThreatId = abx_body_abx_body_threat_id_g, diff --git a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityVendorCases.yaml b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityVendorCases.yaml index 3abbe9e11cb..4b071a4b7c8 100644 --- a/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityVendorCases.yaml +++ b/Solutions/AbnormalSecurity/Parsers/AbnormalSecurityVendorCases.yaml @@ -7,7 +7,7 @@ Category: Microsoft Sentinel Parser FunctionName: AbnormalSecurityVendorCases FunctionAlias: AbnormalSecurityVendorCases FunctionQuery: | - ABNORMAL_SECURITY_VENDOR_CASE_CL + ABNORMAL_SECURITY_VENDOR_CASE_V2_CL | project TimeGenerated, VendorCaseId = abx_body_abx_body_vendorCaseId_g, diff --git a/Solutions/AbnormalSecurity/ReleaseNotes.md b/Solutions/AbnormalSecurity/ReleaseNotes.md index 956f2234660..b9af3069930 100644 --- a/Solutions/AbnormalSecurity/ReleaseNotes.md +++ b/Solutions/AbnormalSecurity/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|--------------------------------------------------------------------------------| +| 3.2.0 | 28-07-2026 | Renamed the nine CCF Push output tables to `ABNORMAL_SECURITY_*_V2_CL` so the connector always provisions fresh, correctly-typed tables and never collides with Classic tables created by the legacy Azure Functions (Data Collector API) connector — resolving the `Invalid output table schema` Deploy failure on workspaces that previously ran the legacy connector. DCR input streams (`Custom-ABNORMAL_SECURITY_*`) are unchanged; only DCR **output** streams, table definitions, Parsers, Hunting Queries, Analytic Rules, and the Workbook now target the `*_V2_CL` tables. GUID-shaped columns (`*_trace_id_g`, `*_threat_id_g`, `*_campaign_id_g`, `*_vendorCaseId_g`) are now declared as type `guid` with matching `toguid()` conversions in the DCR transforms (fresh V2 tables have no legacy Classic schema to conflict with); all other column names and datatypes are unchanged from 3.1.0. | | 3.1.0 | 05-06-2026 | Added Microsoft Sentinel content for the CCF Push connector to meet MISA integration criteria: four scheduled **Analytic Rules** (high-risk email attack, account takeover, user-reported malicious email, vendor compromise) with entity mappings and MITRE ATT&CK techniques; four **Hunting Queries**; four **Parsers** normalizing the per-event-type tables to friendly column names; an **Abnormal Security Overview Workbook**; and an incident-comment **Playbook**. | | 3.0.0 | 08-05-2026 | Added CCF Push connector with multi-table routing (9 tables), DeployPushConnectorButton, and OAuth 2.0 authentication. Legacy Azure Functions connector retained for backward compatibility.
Full MLA column parity: renamed abx_body_* columns to abx_body_abx_body_*, added abx_body_abx_metadata_* columns across all 9 streams. Fixed DCR transforms with explicit tostring(abx_body) and tostring(abx_metadata) conversions. Fixed fallback stream to Custom-ABNORMAL_SECURITY_LOGS_CL. Added top-level workspace/tables resources in mainTemplate for direct ARM deployment. | | 2.0.1 | 29-06-2023 | Renaming Azure Function to Azure Functions in **Data Connector** Description and Updated the python runtime version to 3.11 | diff --git a/Solutions/AbnormalSecurity/Workbooks/AbnormalSecurityOverview.json b/Solutions/AbnormalSecurity/Workbooks/AbnormalSecurityOverview.json index 3af6bda9fb4..bed34f64483 100644 --- a/Solutions/AbnormalSecurity/Workbooks/AbnormalSecurityOverview.json +++ b/Solutions/AbnormalSecurity/Workbooks/AbnormalSecurityOverview.json @@ -42,7 +42,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| summarize Threats = count() by bin(TimeGenerated, 1d)\n| render timechart", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| summarize Threats = count() by bin(TimeGenerated, 1d)\n| render timechart", "size": 0, "title": "Threats detected over time", "timeContext": { "durationMs": 604800000 }, @@ -56,7 +56,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| summarize Count = count() by AttackType = tostring(abx_body_abx_body_attack_type_s)\n| where isnotempty(AttackType)\n| sort by Count desc\n| render piechart", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| summarize Count = count() by AttackType = tostring(abx_body_abx_body_attack_type_s)\n| where isnotempty(AttackType)\n| sort by Count desc\n| render piechart", "size": 0, "title": "Attacks by type", "timeContext": { "durationMs": 604800000 }, @@ -71,7 +71,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ABNORMAL_SECURITY_THREAT_LOG_CL\n| summarize Threats = count() by Recipient = tostring(abx_body_abx_body_recipient_address_s)\n| where isnotempty(Recipient)\n| sort by Threats desc\n| take 10", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n| summarize Threats = count() by Recipient = tostring(abx_body_abx_body_recipient_address_s)\n| where isnotempty(Recipient)\n| sort by Threats desc\n| take 10", "size": 0, "title": "Top targeted recipients", "timeContext": { "durationMs": 604800000 }, @@ -87,7 +87,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ABNORMAL_SECURITY_ATO_CASE_CL\n| summarize Cases = count() by Severity = tostring(abx_body_abx_body_severity_s)\n| sort by Cases desc", + "query": "ABNORMAL_SECURITY_ATO_CASE_V2_CL\n| summarize Cases = count() by Severity = tostring(abx_body_abx_body_severity_s)\n| sort by Cases desc", "size": 0, "title": "Account Takeover cases by severity", "timeContext": { "durationMs": 604800000 }, @@ -103,7 +103,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL\n| where abx_body_abx_body_reported_b == true\n| summarize Reports = count() by Judgement = tostring(abx_body_abx_body_judgement_s)\n| sort by Reports desc", + "query": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL\n| where abx_body_abx_body_reported_b == true\n| summarize Reports = count() by Judgement = tostring(abx_body_abx_body_judgement_s)\n| sort by Reports desc", "size": 0, "title": "User-reported messages by judgement", "timeContext": { "durationMs": 604800000 }, @@ -119,7 +119,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "ABNORMAL_SECURITY_VENDOR_CASE_CL\n| summarize Cases = count() by VendorDomain = tostring(abx_body_abx_body_vendorDomain_s)\n| where isnotempty(VendorDomain)\n| sort by Cases desc\n| take 10", + "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| summarize Cases = count() by VendorDomain = tostring(abx_body_abx_body_vendorDomain_s)\n| where isnotempty(VendorDomain)\n| sort by Cases desc\n| take 10", "size": 0, "title": "Vendor cases by domain", "timeContext": { "durationMs": 604800000 }, diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index fcc30fd4fd2..30b6147135f 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -10716,10 +10716,10 @@ "logoFileName": "abnormalsecurity.svg", "description": "Summarizes email threats, account takeover cases, user-reported messages, and vendor cases ingested from the Abnormal Security CCF Push connector.", "dataTypesDependencies": [ - "ABNORMAL_SECURITY_THREAT_LOG_CL", - "ABNORMAL_SECURITY_ATO_CASE_CL", - "ABNORMAL_SECURITY_ABUSE_MAILBOX_CL", - "ABNORMAL_SECURITY_VENDOR_CASE_CL" + "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL" ], "dataConnectorsDependencies": [ "AbnormalSecurityPush" From cbb90fdf0faeabd96a48daf6f00ab2175d491553 Mon Sep 17 00:00:00 2001 From: Anoop Kumar Sharma Date: Wed, 29 Jul 2026 12:54:13 +0530 Subject: [PATCH 2/3] =?UTF-8?q?fix(AbnormalSecurity):=20address=20PR=20rev?= =?UTF-8?q?iew=20=E2=80=94=20guid-safe=20operator=20+=20query=20flattened?= =?UTF-8?q?=20columns?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - VendorCompromise analytic rule: use isnotnull() instead of isnotempty() on the now-guid-typed abx_body_abx_body_vendorCaseId_g column. - connectorDefinition sample + verification queries: abx_body/abx_metadata are stored as JSON strings by the DCR (tostring(...)), so dot-access (abx_body.severity, abx_body.status, abx_metadata.event_type) doesn't work. Switched to the DCR-flattened columns (abx_body_abx_body_case_status_s, abx_metadata_event_type_s) and, for threat logs which have no severity field, to abx_body_abx_body_attack_type_s. - Regenerated Package (mainTemplate/createUiDefinition/3.2.0.zip). Co-Authored-By: Claude Opus 4.8 --- .../AbnormalSecurity_VendorCompromise.yaml | 2 +- .../AbnormalSecurity_connectorDefinition.json | 10 ++-- Solutions/AbnormalSecurity/Package/3.2.0.zip | Bin 30100 -> 30071 bytes .../Package/mainTemplate.json | 52 +++++++++--------- 4 files changed, 32 insertions(+), 32 deletions(-) diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml index 0c95d5d1d91..9c4d2b4fff5 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml @@ -20,7 +20,7 @@ relevantTechniques: - T1566 query: | ABNORMAL_SECURITY_VENDOR_CASE_V2_CL - | where isnotempty(abx_body_abx_body_vendorCaseId_g) + | where isnotnull(abx_body_abx_body_vendorCaseId_g) // Collapse to one row per vendor case (earliest event in the window) so repeated // events for the same case do not raise duplicate alerts. | summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g diff --git a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json index c87b7305544..03198892065 100644 --- a/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json +++ b/Solutions/AbnormalSecurity/Data Connectors/AbnormalSecurity_CCF/AbnormalSecurity_connectorDefinition.json @@ -63,16 +63,16 @@ "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | sort by TimeGenerated desc\n | take 100" }, { - "description": "Threat logs by severity", - "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" + "description": "Threat logs by attack type", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | summarize count() by AttackType = abx_body_abx_body_attack_type_s\n | sort by count_ desc" }, { "description": "Cases by status (last 7 days)", - "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | summarize count() by CaseStatus = abx_body_abx_body_case_status_s\n | sort by count_ desc" }, { "description": "Event volume by type (last 24h)", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | summarize count() by event_type = abx_metadata_event_type_s\n | order by count_ desc" } ], "dataTypes": [ @@ -241,7 +241,7 @@ { "type": "Markdown", "parameters": { - "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." + "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | summarize count() by event_type = abx_metadata_event_type_s | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." } } ] diff --git a/Solutions/AbnormalSecurity/Package/3.2.0.zip b/Solutions/AbnormalSecurity/Package/3.2.0.zip index 4fc72b3fe2d77fd57148001bea1c2afeaadb47dc..6399902430f01fa4338d1f734941b6ed7ad19524 100644 GIT binary patch delta 23482 zcmV)kK%l>r>jC%b0S!<~0|XQR000O8s%HJM4ekvMs%HIMC#S4oy=DLaDYFO;{R@9M z46${C_>;AI|EqUiz!%MCIB@<&kVPXe-0Hwg13uFg2>CxFJo-EwQTu+F{DXfU!a{~D zg(W`5kfWy&jBvgQ6R{A75kp%Lyp3KU8{f0eLP$x7fde8UwbPsZ3&In+^}_BHBMjDc zDVAhH7`*C+V##Yp7-zibmb%f5zkm!vX+mmgpU*x7VJYYW$_z;A2mr? zDlmVTe33Lo1Dgc(h^qD_2QvX5Sm1(F`oU#h&_Jl5ti2!>fixv^yr!=`9ixDF^fQ{_ z&s(WI=s+{EHxBbCPT>Nz^^m1M-F-IhxZ)dXU2T|IGBIuIX({_ z^5Z^wT+H`Gp92}Dfge3K>OS7*A&S(Hj~)Yayy@paLT=PYkB2#)`g7nRH|nFuL!D>; z90<@Qvt}T#EnZ1GiF50O_eX&flEA_9OIpf^dCH`DM}c36ty`HO$~+No(#rkI%l$fa zy}=AJDJc3ZBs4#u;KYlx%|w4c=X%F)QZof2^l3@T#JAXS@yKz(7Hc*XgARcLUhEIZ-!@x#wwo|9v5YDBwy@XVYPKB_DtKPK@{Do&Gz4T+@gK|YabFat%5-x%n z_YMv*(i#dAD*0#R1jII*H#4i1Ln{SpoUyB{FSDp$zqMM{pRm;}vWM7KbvM-cW9 z_I(tPiNiuckI3;*W)^gM+(%dUzGGq6y;pR^;*V(H`>rE%TON~J;(`wd3aCpE4baq? zOi9o$;t>Tm^qlAzfXjc=!sx(^ITH`PrJfT~aFIlBx&45lbLAf*!SN6%BalU1nZgqV zkxS6l@zF)ch$Ox+bn)xp2%X(|Bmj)OXCy!a%L1>1fjx6Pfqg0_X#`XCTwBbz8h~s- z42FSJhRHi8oFXiM3Mu!)xI8_13w|L)I#xiMNr=l}#UPrGRBeC04rynDh;PhgNc;s9 zMzJ5!ULPHc+^&hcit>sqF@5B;=MK{xQMlI$P(==x;MoGsFU9UZwi6I5ba_*QpUtg< zIno8eNm53qV6*19ADo{SbABChWh|TSuDyRF*RgKk1aEJP?c3f)caG~ymiOw~>!FuOFk>)kCd{eh=r7_!FX;XyVqrk=jF}prc(zX+FN6*!9X^wzwguW}*)7)CDIfi85QS3! z0KyF%?DAPIx4 z4|6euvaOio)Gi~!BBE-V9W;$!UFO|7;!LoEPLEfKUTum>99K-sv*u2zE8n4#e{sH^ z2qz&$6B3H!p+R?gyzx!$px88E00B|ad#m0zIrx8C_bv_BH@S6%64v{R(^c-I2+>i~ zs9Dy#oySKfF?`?0ZgS!JbT*5)Xue{mn%+{8>So;=dXa|iK{mDdCt4!b?xo- zd0i2Z%cvoKMz%}BXdti!yM1Fc&9%4RNAK{hGXd>ZNYVE8rBpefU(jhH2Ew19o!H*K z_6~pg=#m#?LEGB~;c+YdpoTCN=ylkK*BS}9KjaIM=jBfspH$R7v0VJw z>7)1FjYsc1@x0`oVGK>E(jbkctFBm;X|%-B@n`>0KZXwaNRk2Pcd=ro_A`i|r(hPl z;|2tc<$EXD8zR6l=UCq&PBd%I}ncu`0g!ecmtaWGfrXaM~ZP|?Dp&tZS) z_y2fC;K8#h6h(iDFS9xMy=f%TLN5NiC~ZRA@OG)31#%FvIYq(g zsk&E12`WtE>Zi@r5A?rnJ9?{tFE;kS!J#6 zf+}M1Lr1*2&T$ZW#H?}Oa2@YP&zNC)JMhdS*b3_bA@ZjX&njX7a26JJrCNUl1uu6X zWf88DffX^vCeie{eDKT6lsV$~=%U_*^1QdZSLY(hFj!ry&|n4*eH%q>G-LCsD=NKa zrDDn#^V3(VTl^tkk^U`L*pt_os6>{UxK1s=)cS?R^_W;L)L1R?ACf6cdRda-LHmW? zUlxQbmA;5-xLtr;T;^$!DWPTAfa8Y>|EjYJ`yLWySWPXXP?}m`DNFi^D2gaiX0(*i zQbty7)zU;u6UKP2mM~hvC=7sWiK8Ws;()-GI$G*5g-Nz_(b7dh(vq;>ho!mG24QSg7n&B{k(5wG}G zwLsadd@S%}9D*QFHCo)Tf5v#&wgbXgts!OG3j9&kj#Q4Sw=EwvAeQ4p>_*)M=Q>o5 z&+~Th^EnLDSG;lbqTI6D5OJG1cBJY5g&g< zsgX6L8<&p^RTpZHoM~LOhjFgzIG1M?kz{++pCMu7HK@hVtpfjge+JhI=9VA0ugmvy9cqnlQz$G|b8OML z*0|tcI1C7j+>i~Ke?P7{gWj#r{PFyA**DH?k;$On0<+C%``J)ZhnG$PK}Trb-gawy!<9aMZ8nVp{9kWAn1=%$aBLs!RDCQBZxFp-tr|b-<6C zRY}zlI02H7aGR?ZuhZ=-D2@#wNmjXJA{$jm*gW!as5}>|f2Hh9`|{D1EGL~zs|L?B zuQxXFCbDu~-QklS6?@2+QMq%xRmF>gr&_3dYw%XBX6tclw(6AJT9L#XO|1Qa{66RT*b&ryi3@TGknnMWgzI z%EncqLP#dG`YurIsxH8=j&4~ttEGN${CXOQp;KY7sVB755mcloU&qj^HLV!4zOkyN zfhuAkf6Rggzfw8KNYLjk+l%gTD_?5V$zI!SmkJVUZ@edY<9SpX8U9se=hs_SJrpsc z-f&EVp+{?5Jrns> ze+aI-`_Q%mr+8BBy^beU{*c78rZXJeRQp55Eh_{td{@uj7&mMMl*cWg7;9@kq~=BC zSZHOFCn=lYkj6eLmA;^H({*|ztnOB|=*$o3%wfbHVoUg!RysN4y43M4u}R1){nm9S zQSGaqyEYWVp+OD%yK33;^T*B475{vAe@?DvMQNG&lVs+)lT$T6Pq$u|H985Ht&*4P zh0G=@!@9b~bzL_+3%dwftPVoa+O{nFakFfVQ9eA^))N-BT>D9K?OWp6G&sVHoK~0) z^_Dfn&@<^}4LN6ON}_s~@)=yr!nf20N7R}VWP8-X%5kkoOTFzn9a!tSm{vNMf3~ih zkAk!3YBm`;`wvw~vlc9~P?oo+POXK#-I}!)DvI`qvUQCWUGO5;ox8$<2)U`ObTSVL zYn3J_OxmWGC5Tgf6(?kilh;Z1Si4l+mAZwXJeVlCCF=X#VJ7Qn5gQ7%QA4@zjg{2h zt5ty^TYsT0e7ve6itkz|D|Yevf9T-g;3ZTFo8fS^Feu)#ayU2*IF_Lvn%FKM-@6ps zXe+M62!+rhFCZ43c+S6wt=DbrtRCvh6pM>O{yK79x%QYtQ|>SXwKzlUcu-C-5z4yB zZg+W=I3*=D2XiVSqA3!F5`0N)jwmDH|R-e+%8!0D>4@ zpVPv?==2zE{r3L!xU*jH$|b?&x6)z9WQ-#>Ja(Ax;`@zPP!N`pk`8}&Y@2wM4YS-p zlhU6Moz>E6`INQt{9^Ka9bEDuTEV`MRC8!<1^W_SGZ;mT zAn@iL(a%VDYNuuTR#sn@e*jxq{Q+flv?azyc0{1gy@x%@h($dc`Cv2SIZj%Eeok^O z3vH_2ZHS&B*sHzWe@sa@C4o>60k7ifAvI%zQe*f=`6*ruP|0JsPeJ+Ek#| zir=8(vQaaj_wP@Sn+C@iWmXLq_>0d0mQ;$#IruBvi)NrPYk;*Be+0R$p2>3hljApk z$W(mYy4c4Idl7csdnxoZf3ga~{#L$k8J)T!N`QG?pk^WuR}LZ+jYf3LcT~-_HkjgI zzlKhn9Dm*LX>pe;2kZk0Y{v=_6($}SV7k~NHUCTf8_ujML__zH8H`u!7_$0 zuScPwO^xK#O+%Xvrf%N98uk(Nz$jNwuk~B3e>h%kjM2BJ%a9pe8sau$c;u4+!Z@3MLg__L8UiVa&s+~Maeb9W;bGCJ zw+@(+l&g(`qo!#ZoVd75qtM7%Je`^{tz53C5l(jG;x|`DE0#>K2 z^<*kTX6wn+dNQ@1Ohxr9TXo-J>b};4X?3@2tLZDbz92PVtK@4PmKHi$t&;DXQ}T(l zdBa~do>&%7O-X{4gClZYk^nUyQ7jb_ zjp-uRf43XL|A@+*xa;sgice4Cgruf#T%(CYGPEG)`U8L}=UvZ+#)s_IVa~`UBF=aX zAaig>#DZ{0IX7h7Q0r;@Uh&}l1Mec43B3nqjXO5Nt!5aio1+ zCm|wm ze_9NUUx&j6CU0i31?k&*Ew-FGzcHoS|e>FY1n#^S(yx7-gu#=|82F$^4$OK#WNKCK> zBdWZfn%Nyiib3SA)3~i*YRFYRqgjMmluFUp0A3fA4F3Gyg%d&4+GztV=GL;_0u+69Ovy6Yh@}@C)=2CBF9IXNb>gJ`Lizijnaurf6yPQ z#%pI?{1XQRH=*VZ2+YO0(!e8=ausWy*OAs$;RMr*}rtr#iA z`^CxIljGCD)#=&0)`YQCf%$4ofARrZ`$hd*wzXf>^#7ANR@$UaD;M(G!tq8FwT0s! zx#>c8L2gp7ALO~v`qapcWv(*tRwxDFDSgPv<>lbFli}O54=2aNtFz(N#o+SqjXyEN zDFjb6vz>!PQ6Q#S<2ELhxz>~u1uF-~wUy>tQ@)}6X>8to+6g(?3`b4ae>eV^QWQ^- z15unt9EG&Y^W3x^oW+=Ibsw$nqt$(+UhG$Yzc?ARNvxMweN-Zn_ir^H^)K31^HFk@ zT?qlTO=CT5oi$r$%>oYc-8pNDx#Ggdt9JVvj6535up1YN2cW%ZMgqs`tQj^IHW7Yo zgiwsJ7675pId+Fp&_r(3e{()KdVlc-jcLGNl0wh1KBdjd&z`sjCjpIo^!|PGo~SJ1 z!L5yHY2^5gr+x|OtSQgaOX5MvaNA+Ni|^NxESZDTTuFNg5z+N%jh`8+03yv~&X8I^ z1rJ%Xt5B@(Y;N1m1BXZA$8)V~?*d{Ghv&#@GL@2~M@Sf@CTu>Ve~`>AunwSLvgTE{ zAqhMZrX-8iCpD3?ptoX{-sv%#5^S%*IuwO8wu6C!x*E0-r7pqV9O`KjPKgjFlFfsO zXE<~$?7DCQ)e6?(FZ&<>!^FMy!MT?7N-79Jw>OB%)(PGkz4g~`JHoskX;Y5uM=oZ} z8AGX4%~fB_xt`iRe*!!fLT;Q%BPEsP&|v(sks~rGifPvb+%17>EzQ-cwTbK8lHeYR ziPp7c77fViH3$MEEy*6AXFV_xd+6h!k$i~fFfIylFd?Ceo>&(d1|*CEZ|LK2+Ss#H z%zR&xLz9X%*$f1@U0`}Ki=V_YWyb-^0f zJ0$hN)&!JIXV~!?R1NX**8~iX!s##|EOH^ip+9Z{tn=6K;F*H6m=v|dgbx9tedElU z2>JZ|^z9=8a)tw|2`JwVE{+}sOlRhkfKiV>Tbq?rM#S+ZNS|;m0@!p0>LX~>NXEu^ z3N&_H!lzm5e~qBQXwk?ES1vrii)JH{7dM%Ttr05hVfUUn4R4;BB~$KmJ$o1hjR-66 zFWxXTrjZxFP=)BSX3!d^OMtU^3!F&f+hEe-OPRt~PN8!5u64T{HiYCY>r-IDY-mKr z6vE;YJy_$WJLXW{mnac3WJL-w#Z#|SG>%-iX#0OvX5Rgs$T&MOtEKX>nE?XDf3me7r{y zg*simJGjns*5M7#D`=j{lB94OtgBS0z~Vy{M|Cj^-%=YABRnY7unshn3t1209yetg z6@C`NGO8T4#FXD+^|$8pgfv$GjRU2|Ul&lVe`;eHq_wJz1#s4?HfpIhelV#;v@^fq zW9tS_$nTD4bK??qBhE_lO+Ju-Nhb6076%Sw?q^$@Lngb(@0*=ZhR*NgZW?>S$4obi zdLi+`^MKls6`u07eYB`&;cyEQJ#CrBIkh)CUG!|X)7|WCb~kNnlm7!nJQLO>XQW$l ze~`ldyz4Oz@e%br?$atp(L31s=OeMyQ#=0Un2dQ!9O~`K0g=`_-TCM|##^UjM4be_ zXu&45U2-jqwqXbT-TtoL@YcMUg=_nyZVy3Gl7bY&iw~>XA|D5MMnV#>t<5`?jvR2Y z^VYEf%IG-kt9;O>@&?{n9LE|GHn8t#e}M1r?(g?@U-owQdVWA|9dehnR5xt0q%$AN zq&n2YZoH~^`E17z=&fUufbFCfmn<|PVuO7bYkBV+@#-`g4cvxf>jA_H_2&_rrX-7v& z^D_+K*}CM<^gN_dMx`=pqK^h7W#phgqiT=B46 zV}8UB-XEVXgZFIzWkBFZ`mH$9b3*a!`^%Hz+rjCZU(fz?QAiA9ECG$G|8yic(R}dK ztAJVoka3V@_UGyhEpRjje^+PA9FI)*CDyN{9-R|}8mZhXpvaG~1Rzo$xxil3uzOYj zk{@9SK+d?sn7sD3USroCVe6(dA53q~e!E-{7_DpZ>nn9RGCcELQu}ty`lGro%FAa` z+`%A9Foa!KUh;Wx{;5ETJaFNuz6HC6Hp$kRzGnEju}Pj$nwpu|e~)pv)B!iO$Q>S2 zqa0zH8YLTk?VrnTN{^B)-rwq- z73=37rOv;I@Jrk3zziZ7@(P5-pHW3B(IWHz0z<)92Bo2R)a*X4bBfo1~N4)bV8W`20jn`CSle~UYAl}Rphz^5~oM*>;p zLu?N4GGjd+80$RK=7BRm-lKuF-V<&PU`+!)8fdE?dGl;)YN$s8VU0K796;tqdo*y? zcp}aLXKu7d183Q@aSi}=Nn^E;6^aW|&+FVe;r&tIgd}iqwdA0TCZ|lQqZL>==x?zb zk=%g%Q~T~*e_kHdspJi2;Tt+pbXG_(en26AC(!qA^(h=fY@m>NoI9&e@La+iYqyr`Y?<7)veUD=OrkW zP5HVvUZF6EjPV*A!m{sRr;10I(^DZuLBO53{gc((T*aOfJKBjC2H1p;Y|4QcEnp1?LF#R)#E|E4!{-u7}`pi7e{6 zGVV{*ranHp=opc}7lbZ;9UP&vI}hTo1N5Ge01Ye)tcC-7=6C|TR7|oICdy6EW?T&5 z?jr_8DvL%*0eN1O8;eDUl-o%!Pfy;0-Ihqhe#63;CVnu`q}@VlPAD z*Lc9kcKW?OIwrnL?=|!Ah2)S1)o)I#=rGOT%dNYxdpVqd1sROY#b$Qf35XTCys5#S zed}P3JV6+e}~rvL!2GlyM1%Z0p8(COfUo6MgQ^9Nxc52iG41Noz7+ve;4JJWHRY3fT5e_HOEI6>D4!~39A>u z6A{Ak3h(c0Z?6wtjQpOb2LEE&E^#v!wT=2lZ{urkzmMMGTW12=fsmr@?MwOOL%*QY zM67^6;dQvZeeE6e(ItWXMBCd2VPq@)5CS(|=yli!X`BSyf9D0_I#ecHit&ivl56i- ze;-(vb%VCIKaju~-=m{M2;Sc2k5t0M9xD|u2>j2JewX-`Y;SX2)%NxYm&Kvu6i^z& z0>b+C_S?t}ot~f(`7n94y{)?#XKE=_I2`kWz+F|rntQYS_y79e=+A1~@t@LvyQqDl zIsLQKNAJBGkKTDQwjWl&(1fZN{8+k(e~DF@MoToUfA-fZBp>vV+*ZzS;s)L z^i`Y^Ng7qQpKaC$Yr@mLanpRe;$|#R#RJ2JMK|G9rXfCHOS(S*W?^(D}-#@G{~+n zYj-e5yz!W?+@koeT0~`fJ{I{PidIcn5MviQLi&eH+8#-34mVuKyMd2ok###jLRc^H zs4vbYKBPPMtn5Jp+NhS+qHruU_p_Y&Mr!g@t!e-JdN8Fli^ z_Mo?WXk@l4x;qNPnAPIoprvtLGxYh>@{zNGIN6z(qQFPM_Ejvq2d=1KP<(6${sH~AJhlw_hfMA=P5MR_l=JqJ#zP3 z z1prLA+3EAIpYkBU#MV)3s!4O0yfh&K@4e{sGU?p@f+j&4lmQXwOye?{VW9h;rLxlaLisT7~; z&Xeg{lPwgyKvHy9fP3MOQu)d-_q<%{nNbfm@U$kZkmX&FFt|Sg>q$=JFCLNk)MJGg zlrSv*JEPt?4yR_DAaD3@8>=YFU{ z;TdoCQ(Dhfe_L8hTbhmi$lQ@CyhZs*asT&FA|5QtJY?pezn`YWC#KYtZBhheP-&KE z8Xo%DU(LYwYYL`&z1@SSE|_xH3&(nYx`cFEkT5ipI5fqxZL#_YLnPB2>jd@IQ_n%Apl&b{12CcNjce=mbr!BtB5fhf;4?lA(X*0~E? zbrMg52jT?`2VqZIu2bLdvpYPQkYE~(IA6fN!{WzfPrWX8@aXeS0m@1fZ&s!%&*oCh zuDUEWXIY*#>CX4|ES7|4#0gp%k4yAeNtxiEhZfNOe#`FX-bX5uw{QwIa}Zh&b4g zea`Jw%sm1!U7-0T>f@h}qzrC4o>)%nu7k2Oj;*;(i&!%_m zM>-0zY6tk_6W_1sG>Yw;m2*ySZe_M<|GZWON(6Q>V(=o=GEXoiHE#RPlKv(pJ zcyl0kU<$m92U;9yrZE>*j`Y#?_B$F92v;;N7|VCPw%m>RjzVq8pfbNt)fQ%V;Fs;~ zcV|~809z)7PXr;7Ci)gFIQ3^yvB}WI$>kN_LZ0ZybxZYHeKF|_t`HOu7P%pWe^_DL z=4Ni}3bk4iIb~56vOYTEAyz^imRX@6IF?B1F(KNPbM<)oxX6|}HVLugvK{Tn@GD0C z-fu)nu)TeGb#jjOP%oVT2r<~!_=+=9GKBYDd+6h9p1%aziSmFWcLvZ_m#zt_JU}02jZKF)%1Gq*CTqsgb*Aif;w3MC*8{j)ndW5)bjJ=}l2o+*VKC6SiL1jZ0-nu0@Cw^F9um?e_ zB*ov!{fe-v(f0a~+Nh4klsIoj!YQ>AqY>ndj1$D^ylGr;V)bhqm<#sM;NmTc&Aq^p z_Eg>m7(!*2i-p+jZ8YNPf5^~?xb&`%pv!gm@&EWJ8(ztV+U0VC`!go3%OT}=tQez{ zYsBP@-^;o;_INijhRBa0lU=|n{eX-~01vX^1C<9uKy9$C=?7N~Y-n^T-k-md`*ch)bj+`YJ~|a7z%wU0av zUF671)}pf+L|gJ~8ln&(A0zcZft3a5DsVtn;Fok@JKn^-M_V%JUCBq>cL0qYmx%I) z8i95=B!S440VXaNfBQbrV_J*@%pCR+7*)mP3gR4;P2|U(@AfIelK=#Mk!K?$!3>Ut z4U{f~L&nRw5L=`(5u2^0G&zp~Yl<1qN1|@>lG`daGoOiUogkRW)T4^Z-g0k?0BsE} z-ge@n)rjnp&rk3lF>B%7?%PXN}fLdlSU%RCLAQ5=f@8S1Vx|^ zm&l?vS>W9*^Z>oF6R?mT_tD8`D1sd#99UD}J0V5)Gzt*7j=1`AkVR*H6q2AX7_&3BBo(YMo`;KV&@f%{AOakh_X+oY*QjM{-YaYWFxTC5l!Wpiw~Y z05KF%e-CEHKv^E>Oqpn{qnw|C>u{t^sEY#Hw6Mxl%H@!P7DEnTX=${MgpST5cNs06 z7YjpM#}u|z-$VNrdls?f3y~+Gy$)?ym&~+v>1(iP z!*Sp+NYmxOh9QjJU%Y`zyi?GT$dQ2Dc+wlyf0EySAw@GN49CQ?90m$EnOcGZDWRsm z$ek5m73!w=&;RU5R1po=7_uLMw4ovToHH+U(BIpWJ;pI|F=rbbP5>NG9DDcm(QDX! z0_BB4lgeq#1O2^cBbVNhKqz>0tTO=oBVnHw{eSU0-_ac%DP(W#gF)>X_sw{Eau=-hvMJEia9 zV)A}G=JvLpxm2Y?2N@2J;yJdr|1b28f83?=Ov|QxxPv|#*ft{AnyMF5!r2U+Ks{+Y zw~oyPqptMXof0Pi()GD#1AzqD&|fCf+XA1x9)mzh_}X~|@1^iMygYe#b^7k)&G3)2 zi{CHL2S+Ev)8ovi%fAmUPL7AapZrhp!Bmas@@hCZKOJ73{eJRJv~uZW;9>VZe{?MN zK5)>MU_;pLTzgyC2BN!1lov3K;Zh1VUgR&cGo5SiQf6@cGYXtP1!O3suh5@=h4G@m z5x@QNC%X22;YvMte&}A8pmO@a-!_b=KNXrwz7m0Wi7qaqcYzzjuYdk6vCsTY?)d;) zB7f@p!1?)0EW4ia#9L#B1YbLUe+tKDU}!u;rJ5nNFMV_YFGi87F|$JcmL#4MOS9?L?-qNeQX42ewukJQk zub!;8l$||L5O)3Gf9nQEAqbwgul;x_TE9X4)Pb-RYMbVRU%Rz0FWE&;fMoG3&l5Lb^8zuQo zM@i0oGq%x?Z8T&X4cSIRKD}tjVrzPJ6_%PVppUTFf0d5|MuIb5{&;V*(-(hdt6uH3 zHLt+&d4)BvggeU{IziwvhR!+Kzn#igX0novHELRS0j!cG4#f`{a*v0|9kXY>-50&x zy%p51V)&NWmjqG?kp>D@RfTJkD-6EU8{0rKg55Tk8c_d7YB1gE4 zIBgsIG4U;F3%Tw%?HijzPNE?kqD+T@Z3l$0f8st^G{|&2raZ}&abdi{(B>^N-A?_o z`D9PW&rNzkEXQ|<7nXGoRHIz?D=PaDbI*{fE+jQ4_okE%y~g=?gCXPz8iumlAPli} z!?PS2>4kqD0*8rb5?wAsAkxWwSvMxzWV(J3>e-Txx4cDmMho0G%BF(`Lp#-p*ihHI ze{7Y+21Xnvi#(nABw*BoGg#c&(OP8&7(^kxATwf%#KXp^qmT}RxXo}RyPi`PR&<4I zj;5}v8}|zVf6D?Yh+7SXTc$=q@h2c67UG#-IYy{j#uRnwk1s@$@RCCV$tZ>*mpB_T ze;hC3_{N#d+16tIN19u$IRluBio1uF6#4`&m&ilYEyi6d|2X;Bc?Aj~4 zP0w|qYok2(z`o&Yh$lrUstc^^N(j>>1zrPqH;;fBq2i zRB^y@f%toB@0Dc!FvlOqpKFNMr}kbh^TVg*GK?$|TAY@-ivx|jXtPk-EXcP}7&vTx z6UAYhhDV1M2w5y1-!A_GtCcBaz8oO+@`|*XLTV;bic>U!1mqPYXlgTsJeo`)^PKf; zzL4BeU;YtpP7@-piV)wBts=a1f1mAkx|_Yt?xr7X@_)!Ash2#3;FcVtusiQ67A(5Y zfg~~ACeH!~HEeLpSTrValB=W z;K>!86YRjI5VcsQ^su=IgtV_j*e=i@Ye*!vHp3?U$cq88f z#zDC9b;xs(4rwq{Z-;oGcQhP$*uDQ(!ESpr9Aeo(i&Vypdar5lj`GgTDZ&7>8;)r( z^r#qyIjoH{RsXdXwyL+KcA1{q2dlTRrN@8j7B=nTTE@zDkbjRJG-qY266xeft(8q- zqP4QMMd?>&e`TvW>npah6-f1u-?(PN(^E69%?-nX-1~_b*NPwNkI=YQcyLy4Q!_t* z+h=e4>}{XDt9$mgrqS=fG+On1o!2y4@LYZ5rqRM@>54?urOcz{&(GF8DzMO+M^|Vb zJuEbj9=7Ju6`Myt5YMK;cM`#t5SDDL(bFTbjvl5Te_fdc@*!I5XytQIQ1wH^t!d|J zPTS~*lXu5w7xPB1CG!N=izj!=GVEp6(**3wq>RM8moseQP5OIv#UCvIuexZpB| zw!{3(f99|`LtB+}AV+EqZ3+{up{+Hvt<2C?b=FsFXe$s9AHSW=gr=uvXPX;_1)28~ zv9lFF`5vF0t?=Be+{|WvNVN~B$NYe5Z8qP5&8F%hG_TF3;NkPQZ8n7uoD~T>OPOrS zA2O}UMqr^e*(_TibN?{CMnQ%!&mRvtC~y2#zW1D6D$eo735O6woHq5gAx2h}ROdeGb5FRh~$ zS01va#Ex8IufL*d<`|sX@Uj>?gdwhkLL%8cLn_Y#8r>USFLzVQh-`~si_i@F422Zo ze`{~*Os2iSVK+!UX3&-u5Iz%jkw10V)bS==^lQW%4}zNbnbWcXc9G-VQpX}YKIWu- z?TrH**dI(+Ohhg|w&sEh~#Mv?VA!o4H0`$fbp6*Bc!`7x^3#&&~t@iV@}u{}Z)o zi+h&T!JWI_?&`M#Qr?+c>}4`+H%_a}qezE^DUpxf5@)SrqqSO zcTKC{2<43R7CSDi!!#P8(g}zSEa-@O9NqU@IUq`OXrG{>C4~x3djAv|w9%;5>-geVYm63x$ z2~Z)Y25~zY384FcxQZcPIkLLTE={oT`s>o}g60f$Wdwx#T4n3sGE5iT|jD z0t^9L8>HlDlNdO=B|+fWg~gI(+gJ_o8fFj8&&OB`fYFyP3DUlPRnJIx4WKVyG`{ln zE4*;Od`YvwuV4Gw)YM#0*b;IJ4vVYb+45EDREW1hn z{e5~_#_DHKO%~f2tF^ht@@9*w5VJyjR!g2ZaOiXBCdYZ#KA#`tl4@Q}ZJWaX9KMl@ zs@H4zN!F`opUq}pp3GiZfGaYx*SngcaLS*^UzT52>nGXzNiO9lxiBxtI!zX_g4Jr| z&0drX!4nU$XL4#><$sVXV1iGrWMCe){R#tqTRw2*27IYLQnr=v*m$2Mz6Yx^xK`u+ zejz8{|3;1XNBkwl5cZIIfP$&jGZ^gQ-NqZ{if3#MuFg6LD)V*0c+CqlfH^fbJR=&Q z2ppNE6&*QX6lcCr41^So2+}I__0iRopuyD{AM@H%wwkVd-hT_rIhA3JC@BR2=5xfN zV2mwdbFXP(CSTO>or4tC!x7Pd)jMAki z9zg-ULp}*&e4;Ia1J@xeL|oOTlqGkLXVbe5ViX0$2ePpFc)Sr4*qjo?z^co~u_^Ls zhyv`uACd3EE`Jcj^(m|m0Ejy3&cDE~VKSUK-d4uYxZMHgkh&!wvxe;z)P97i=d1t7 zdpxolkcEcaJchaw+uaoC@-KP1l0|pZ%V}-1-@0u!&4iw+W!CuePn>{OZNJ@p@soMV ztG&Iw-S5J*n`boZHt#-d+mgRI+MbV1FeQL&c0o`|Cl?LPCg2gpw~` z1PoulqAhjj${!UTzJBe*Qiyh^$3o?oFL^5b`gIjnAF~_?YcbFHlr27BN@)!~t-&X& z0VppTy<&sU{&EH%!`hcM_{^mmXvE-CPbDKqZ4Ev#XKU*`=S<()U!Q(3Tv4i^^6$ll zLDi%{qkkBi`Q-N}T<3XVUa(4oPfbnK0@j`)VB#V6=eG9DIphjB;M2GE98_3)+G2#O zxAthce&1r(u^bw)@7U&(CBX-)TDVr5&p{zGKlt8kKG;+41j1UQir?{gL$Ju0OFdkB zs-&mG5HHYYLy)C7PknSL>@g6ONYs!)m;XfrXMf^AkXsyoCQLiwlw5nNkRTW&L|*!k zAq#up`RS)UKM8{OZV$W84M8%33ugB5tj8NNJSIJ{v};eSK^Th)LM<1x7rlqX9WmAf zF0%+(z1_%M$FV42GAW6Oe*T%i_LJ5jbs>OttF-Q72l`!a!~k7yjgZ1^RF@Nt%AD!id{#T}0uN9c>qLetEUYh`H>&q8; z)V_Z0v{t(W&uy62(+tzf>Tt>nQLor)cd(q*&an1nt#)%McN($U)l;g;QCq8>!bEGe zYpr%Gw%XO?1*^2$&8ZJuz9*vb;{Hndb<(!IYcJgm>~8VGR7r!JF;8G01q5ipMivbM!hGu4#IqKT+me+rlBLRk zrKS>=8p{Q0(OX{Rx?5G{0L!Dd^nZ zi%1bX@eqe|TSVp@as^EAsaZs(5fqo5{0FGWlFWSiuWk9c#>>yW_u_a68?-7oWW&EF zTL6`)snVP!&QVZ2bmDtA54r6DOA zvCwhBp1>d1GQXTr9M-B}>tt`vO}?^nWKl@t5=|<|hFcVbG8&8``CdL{VNtIKujMsI zP|X6BvX(A-wLoCb!j-R7jE!E{%23NHUJ^H<&>#dGNopblyxeRXNPnbm@mMWZ9gtaUBa*TSqItNkkA z1S@>Um^EM05CTQ0w~AB>-DkUc~{hz4^3X={rgqsWohpb6{C0z z%Dnxjr_6f`Px+9OHLpfAw5(lj(w7089c!ODZ37Q({{yFXR+YwDh_Zg%m z$k5^Y1?{D@VA`k0tpgiKf4EXDn66R+kL`fm66^|*PABne4`R_7;;9?qt7K==XS1tN2owXcb?r z;%mi5!qvOuQPZ(3sJXPq>7sdllK*)v@mCzCGP4*>_Iea-^#n#aYO7#Vm}nJjt%7aE3bvZ8V1){{x=)LzrDZF@<5SkM zEq@BuH>hPhtkANx$un23WqU{N^dv9euYxU0dygn}=3`K>9X>q;+dFdS-Xp5={iSkJ zHmqPXrh!~O-JzZ>t45B+Wz!z!G->*()4H_WB#WcSIOUYG&$EU31T7ML* zC$Hp!$wrjk9Rf>#Meu%6>eHh&`_hLQla9s-w2C&J|8S%!#p5w^HS0|9sD@n8Ho z-_1C=$V5rd-b>{ahm1-S!a_Y=QvPB*I(m(uDmRKNcjsQ{U*~`8q_5-LZoqEt^X=+_y!vvz0mq2<{_#fxCKNlkzV@!Ky{oCikXmb^xOz031V%gFI&@|P1=yPq z#E8p3a*d7skBEi5g;<5A^|{{o+P&sSjbkHpLYKgA3F=;EQK#en_kX(QYC}&$GK=>h z*=D&Bj?FvZz44y4Yw!1VcYk+xdxv;;xAzkMwVV96#|Nl2OT2E-JYE3c{AU-Bh#UVd zFv34bkPd-J*oCb2alP>h924bdRpLOvD$oeb=L6{C6fkxqZoaqh!%xo-`MNpMQeU3$ z9{yDDY5&>F{oR6ZFJ8QOF28;1UT<;f4@VtEd)L2s-gnWJm?wtZJ@-P4y$&podVHtz#0N}jgjPM)j zvjnh+3Q|p92Xq#bwSR$%o7yJHuX+GOPr&dHyJb+-r&2$Ll!-@0RlxeS(cqAbB^oHT zzvjWJ(SYw%k$@PFyNe1$J(YbI#Z>-q>~P9^Kg+OAnf0(Yy6*|V9?j8>eW=T+!Q@13 zripmKG)W|Jdyx{hkhUBlI%3 zI@4{S8P*}Kff}t`l3T*%qf$~~vX!Ecm?`i9`TiF(04d#FrKCIPtw#MmwjYNSctrwq zGy89dGnq5cBuz6Sej!6OdL&5+*=QjpX}VE^mQ&7qqx=v3)) z29Uj5PlxZ@)4}8~s~zzoNQ59j`SJ$uj?GK60w)Azeqo*6qAI)Tqf@P1DDbD$4iK0U zczIl7Lt`?z#g~_U%RaWno2qYi`hz z-ZcORq+x-J>J6PZ78>~ej)Jm6>!STt;vtnrV9Z)BrDjJ;0P;TJo2B$4o4LlI>d-l} zz8(B1q_F{%AP4X5rH9^O(J00QXjPE@!+%z%um1_*RGS*JOZej-WVEBaruZl(jaTef z)pI=8@j%6cHg^Qg+XLTWJDlj1t}Fiv-5BNp(I(PA8afxQL)S%Z#sL#NRnS(aFB^k1 zsrRXL*qCn@D71>ZCb~cYlQOF1hg zXk|}O^%G-B{WIsaT#_2Q^sWx|yr_ye{`j$&Gd4#nGS<^T2~)?miPuwmtuE|r48lBj zTk)tLvX1T5U1JWSm`}B_qVk=|SAP$>DkDY|83VlL#6p- zT64kdYz3ha3+(|b;YFca6x-{evImD=}Po&WK1 zlkx++`RRXr+;m_Qi?@Tn<+!2|2KuZ2%U@X-P;c@}PNVqO9r@+2JN_@%-e3J+&LtCk zh5q*CAJp--N|upuasDT^ZO#a>3kq8ClS=}ned5;2%}-qf4};FvzkiN`U#>mnX$I5P zpGmn(ZGMu&T!ATazA?D<5(ZF^{}rQYK*m2`Z_G1{+PC+CyZPzs^~NtBAn-~33P~hl zh6tt0`HB4N4o(n$!F5^u9nG=DxN4Y71CaNJLVgK{B_l#TqLg-6xKV>n#U>$kT-JxN zTW(c+9%m$+QhvywfPeW$9loXnOtzy$%;ou7{;g2?ehMFLh^>^E3T6 z$v?kWC`Xp;Ofv53UW~by-jme%6rkz6T;$d%AquB3di>0*5J}=ks#xPC_=x~1$QR9G z!bTIvYsF9TZ^0Ezz4nV;!Iai}Sy!+kSD)1QbGrJdzO`L_Vt@T~eOI3gWP4())!JPlE$r-Z#aa;nmrk~sEf7~kL<=_A6@y$7mo%6TP@usFoHeG zPS!z;BJ5%J9)GgBP4TTZ9p@aMK?;YPl&?GjUkmEFP%)I4K#pB2_?&?VYh}oTS)IV{ z`8Wvg0U7*$!!GM*5$^|tcViBiv-6s_jlDj4M`1nbJ>g5MTopH`V#K&Au!p5C5J>?6 zDMez&F(jjc+W=nw-nVf`z+GKlK0>$k>}q%S761SLcYhYLg8Y0N??cDs&z15?3wdN> z{mi?gRHVnu_`hVgg0k>9HvJath0v!KVg7fxcse0y}YA-6a#09*l>UNz&a%|X(O6B=k#EELr+($(|LmF0c z&OSFK?uWJg`YH$~2K!5!`oVgiYDsaYEvHldDb9RXWGKO3R z;*uCsNHzgN(1?sFgtU1q#ICEvB6Zunij{%?{r~=dNK*)^1}M=@8iKb5pbrrLH?~pk zgaIKcP)lK%?PPJZbD^>M{>;AK_(lGL_)jTKB`ofWhvv=jJ*2D6uL|Gb{*3J?<%C*4 zyMOWMo#!ydlYacd|3czVm;nL(V8`Ql;c^y3YRz5b=P^6WBeWkc^U8Sn#i*2LhM|C9 zmuGB1O2kLxR_JWO6BpWYS6nsLCPS7>BUQ&C?gVD!F%4$O@j_~lAo}Q1yk;00(Qu0V zh)sJV48`KNltXWa3!8rAy6OwxPV_qRgn#a=lSqIJpHHBzK)Gu161Gh#bJ zlhsW*GIvnK6oDU6o4ABA6nkr<*T7eRqa+)qP83)Tl9o(6T>D+58lB^Sk<`b-K42OFj>j00cr+!4R2zV+o~mG8&+Sob$eRkHu$SEn;;fg8cG6u*B5LNobKf~ z#T>GlIRZicpZmKBN$$L%6Pniyuz%ah^#;0wNbR4mH=ghMpRYI2l)!Zz|NTonkMu%s z_agOKaS!8btL)}2du63s6-DZ1)?yT&LAlH$o4(9HZ(YrjKA%~WR8xagsySLvW27&x zBp9qT2&_2xEBCTC$IRrOpT!iJicpQ^{KTBX%t-?aWa9K_N9S4)$z0m_hJV1?UlL9w5PaT2xb^I9cKYJ)MHB1!qz*1r-kg!xn_4C4I=R(PSEJG)FBK5u9-hX~dX%2?pe8c~L zX1WGOx`yT`0}imc1++dUo*CF!K)(7UcmNK=83Lqrt<>GuXRI`K2YW72vg8wOjyDO928D0~7!N00;o8X8l}s>Y^UJ t4FCZ2J^%n0000000FxYbFAb_@{ah!ftYN)o001eISamiA-E;r|007FUzd!&0 delta 23526 zcmV)mK%T$%>H(DN0S!<~0|XQR000O8B7gj`4ekvMB7gi`F(nMp+GYR%#Ipzv{R@AL z+>*klQF`;Mx1Fz^>zwR(VDvKzsniYQ(dXfa+V_3+u_MqC&1N`o{zZ^QBQM7{3OFe4{c{ro#05 zNs|(4OB(SuG_XlfkK}6Kim;fgdw-D|Q7IIcd2$08gLe0VSOoH#%<=rb_H?YlwxFNU z41eBA?NA4riJfzpM7k) zr>-}cLFxrXpM`|x2Nb-1k+y%C=;vJT_~mM*K!iRmNtyT-J1!nME@&vsmSs?y@%Jud z8vCIp1K99MFmo6f_05Lul;6U+G|!iiYSF0>CUn)iwnsqWnMp7GSU9a*kep|rmUCWXD`bBc4%fyj6b2C~ z9+{7g?KBegI(Fk{ZdLvN|)gcS53=q)!mFm$dQN+dWQ0%ZiUs4H`R zq9Ae!+B!bE=opd27ltl=9UP&vJC6i_k@t)QXkc03rZBK)jwi5B#Uzbjs-7>58CL_4 z4T!;#kV;8;=Y&&)1yCX7jvJS!CvU-#gh)>e$V&-<9IO~b^O1k5&DSAMZ4mK|xeSTF zfWjztJlgA{W04Ft@o!OXlqI&3oVwj%n&%34Qvs^T;SyY7z+0x+U&wX>VudbmYH-ZC zbudS|AUH|N=oF0H9QT9s(_+rABd&}^mC>5+`KJ7+O1ZBgt8!sm>A(ns|M=sNKcYbt z(izuo3cs^RP}qO9cjP+O4V>WZZLxjZ+vv`5UCHuZU3)$B5(#DuRuJWJ1Q|y&zDVGt zPhs9c-RX;I@>zt7Y7aQ(dluqDNYVBc3k%l zhbL|>hETQ@bDY{`L|8;rO|yfh@vF6SNcC z+t+{IK_6Z63NC1S+aNq{r61G~*8;r``|w&L0e7H$fw(P$i5MF^qPOJQd)5b5Y~7&k z?GGey#`owbc_eLbb0rDX-~pOYCKz}SK2Q2x;#;!4&2_rl+b8_31|6q>(ij$a%x!PK zjoi@b37V1**H_!yddv+LPiCc{s))eZBK?0!zl%c6UGTsE*Z)R;R{OmCDFd2{+9#Ha zKRbQ&-n;SWohP1`+;5Db2~`@TvGnZ~t1^w2SUUdfKkCQOK_5vn;QTID%+!7c@$(eS zV*lNMps{=pr9!(>Z+Jz<--hbv5A1~KS#NI_%^WWZ2}5`cXE2Wb${Y=#Ujiyxc=Ufc z4E_EeZxHu5dJL?|(tl^zSyKVos?b_0NIsit zVzH_@6`|UDO@(U5#jNHIn)Y#!WG{bs@DvS2A?M3%PJVA1$=Z+$W-rRY5I4MCDglBV zL~Kq`ql7yy5qg@xU$ zRzbnb9Y|Txt7KqBjIp^ieJ&sTGBc&2I6k_lccDD*?e5jNNHPpo*Elqo&O_fuQE1KB zyy}WduUV;|@|6MgmFnIAko-vhma7uV3szJjOHEv-uwZKa!Ww%_EEfv4miQLQ{3pFE zN$?B+g`Qy+1Ui+zmTI_UfXshf=7o`|$Ju~WhzcpIvkLnjvTj&SEu&DHT3{(l`j9A! zC{c8@l+jW~R;AU_L`xIKSg@8bTEZv{j%$gdC63}?!InB&>M(^+wsg_bML|?)OByX{ z6j=0H()iX%qo#hEg^pLQ6?5q%t~52jjyhJ)B{r?BZqm@CRHdwNYq^tdA`XA@LIJRa zk*7T9qeKr_s$ZNdelW9bg%g%ysA%voz#fCVzrX*J+i=95B996n zJWE$i2=gPCfSMn;5N5-;1;BqB1}(vYX-P%+F50Q07=#TPg?V3|%VDR}|8rs;EHh;fRkvqSVM5(v8bUh7u07N6s{^+QT^U^-$zQsV0(akNPtt zjJyW57`j#9KMb*TQzd_3iGL(bYmLcsEs)85&2d%pT4UdG50{!Fi^lcVY|(&J+)rA| zI%5)h=;I))i3ZiWiax?9@P*O99RoY2OTSJyO~b{Mm>I6)H<>G9yR#E6!J!Jp{bI@vh8b+E*$l%xtP|v z_Sn2eJ9Fk)yy{XuM-)__W@uA6N*(ayW>r!(1V?}*B;4kz#p`tY3W{SxNT5|NnaD;J z5;l*D94gPnYAJs^)4qIkCCf=C)2hKU&FhU#yooHsS9kcNN5vlUWmN7QZ&mT);At2t z-x|DCtJ!+onyotZyVj-O;x?mJv-Ko3TcT3vP(}+>a+y@?3Yi(RYGs*hR521KJP;^L zhmx(nHuZ#-I)aK6`adGO zo{fJcZdlh@sva8j)(`83wGP)NA++%9t3#R?+bZAd=5DP_^T=fyLy6A^lxs5at*v15 zBn6u~ujCr~Vh(jRhg0opJsYb;inv*|mu3{y;lD}CdL!1klJvIqMy;!8$hKeCqaNbD zAX{zCAv4X_{kU(!(x4RRwGL0JaXkva0l|NDcOTkT;1o})z1Q)i${&(=)^vu0n`(c^ zxMhU^hVSax8{>wpfbzHn6l2}(ht#~N91E>%@+4&w9MafFrP3EPZn{p7gw@@u7M=M4 zojHuyLu?8E(n=?XT$eh&B{m6p72vw=B&vPYbJvDKIW(wYe^)JAe*U=mx#FJ>&&hxF ztSBurf0E2xcXF!c=jqn#vPLHXvsLnPy^z^NWms3YxUTDlXJHpXi`79WTHBUoKW>(- zG0KPM+IqsGmTNyru6;{9n+8Xik<$v(q298F71T($;@<^HFg2Tse7RvJW)TyFJ9&4AeyHd9h zlnxUmw?yr~JIrJqEn-6vH)<&5y|I#-e6=btWa}@~g^yQUMDbkvLKd7@Z!Yt>50C9(UFYUb!T={8l>bn2d4c zhQ|)`U3|as3W~)tQqtk?j%^dKvSF4Rh?2gV1iVh9t(5$~7o4r^Ks{cBt+QHMEuXSh zo?lF!uY*fIL@U@Al4=gktzcimYX+l;5d_}6Bl;N$Pwli!-^%LC5@3HTt3RNuj<&?u z$c_jKDe|yK8L_BmBOh#LJjY2Z(9cQEWuZ;gyA9DZ1bel&`;RFJrz8;SA>dV9J)~xA zP>L)KvRXM+U+{_0-Sj>KsYk=LL7NKnTJalHTsCS3^#1+nans-!qs*$o0)O#2z>-Qa zIR}4bd(jLuW(}~Gf*^ml)iYU6e{%fh51ERuTNnG7VK2h2doP8a=1*2Z*x$H;mSdTqS1(s`Hrf&)&^4??AOqVljE-&J}vHY<$!%4f$dl!qQb@}au`qLEaoa??^e}c|9Wjz{U!JRKm>T95Z@4b zO9BMZZmq7r^~*6Gsn##&yYkD)2g|Pf`SIR!{uvQ8xH=PzCvhfgTtylO?5-TBOF6W9 z7Axo)2T6u;tsH-#qbLZ#wk9T6H(16H=JhBvw5gGtx@l;$!PL$BSHnJn9+=OJ)XdGR zaFW38m2c*NSENJ99BAv`FVEf~90d5jN$X4N%D4>DT35yeaMrpqHtfonN%`BVH5OEB zRN#?!Z}l35B$`8UtJf%#03ZWDa;c2MY5f+n|FwRL6~}+8jWPQ6bQvt5*l|vC-*yR=b3)kOogyDR`Mu2J+*}wPX$ZjpPdet=?CXkB<2CO#_l7CT>*G zr|*(DXH9=YrdK~&kFpkKM0Zn~T)^s-wVq66$ZS2CT2H3dlc}hlWvlL6Ox@RdFs<%( zZ8d!**B7J)Y?XYi!_q=0t5x!Sb4osuHg9+OA?^wBZ{R$qA^{>`gVUq_#aW36L%f{NAc-NoRHM?jcYV< zNQM^VTz>#i<-F_J(D;zuI?NflM8p}d0b~yDh*%H~Dd&ca8)`j`AI!j+Oh6MQDnd1t zbYzM{B&Q;_fSGUa8g!uzIXEmYNJ?6fRaA_ygtO+c*vDfUM zyAFTfT)mz~W8hsRlRN;3aPfxm|1@Nsyn;-sDq5V+gfL^&;`K4mofA&i4R0cGG!a>y zFj80)lNwGmf;c>m=l)4nQ*(g&JS?wFdZv3Ac&-&T052#KX>z zMY9=h#^iq5o2abkNKTW5RSelYtTIz>T#J99k$f>QGyugXd$4U)g-#psI~b37umg%G zSy!NdzKiQj(Y*zF`8EQg7;UXJw6%t|*3jzuyRBVxF}r9jWb!fEScv*}Yil7bxzggY zEV8&evZmOZv_{j`XxbW0i$(SCD$7GdZ;n&xTb$6 zSChFcgctkz40h7=*nm0s4Vhr;9*GIoU__PIQ!~4xNHK`qbsD!7ObxlJXEcj2i&822 z8o=vSP-ePUQGV6G`44Jb%_jzfn4I3HpCS)p+f!i+|#P;3m}E0m0llp&o)3r1~Q^8bMJB zhpp{I;z<*1<_b@k(Q>F$>sl52BjQ=p84hk53A|Ign9Q(1*P1YvDllJ-Nj`r-Yrm*} z%eMB5n*M(>$4Z;jY2`v*TR7f`qPB4SBR5^>F33&l^@BVYTAv!ZvCLHl-U_7vJf#mg zxx5_wb~1c>_Tl7scy%_sx)@ykz40ezIECPeX0~&XCZut?r}MeYCod)QkP< z?-wV7Hi`A}s*g%U^8T&nqy9zPYCcM?vMV8=wrQ+~t+Qt9tXaT8zB^}4F;`spc-3xy zgONvr8Fu3$@c^_J%}C%_oi)S8!Y0CxjSz}4)&d|DI>+uX3Yy4`dd`0bNAEA*pfL^j zOH$}L)~B>t`PmcK;3S}tkKVs;-V>EYJh-(nEsY$%@zgH?oi*iodPzJe8E!kwck%sN zk|lF+nk#89AtJgSt?@HM6+on!%o$Sar{E!Lb`^^Coy~3AdEoF!{CKW)?Oi}D;_w_< zO{P+k^au%~)P&7v6q0|r1=ax+OxC>WHY9;Z!jxpO`lKdu7W7uk(mOpyQ-bX^ScjsJ z#&$4JP*=k?qSPhWn?pTK!YL8rM6!7>@eGHKgBG?EYT z9L7Z<4kjd2(G%+;!+?ZQ;0=8oP8)lcia8L>u|6T%clk4j-?7cSfqeJA7t-{@Zp{xN z%W4k5qoW4}ZPb4xY`;D*aE$8&pe|VBdWWPw*qVT{=?ptwgQ_7u{+fWnQ8*n2ghehS zIP}L&fOY;F9z0WU7L%funD8M$v~QeQ6Ct0!pT2!WK+bSrH38+@!Nt+Tfa%P95-{rV zXKS-^%7{4L1nCp5MF5-5Kz#&_8p+rgPl3jcOZYTvy%B#j7%duk;mU>QchPJl^5P~_ zu{A=4J?!2yr{T?0vt-JBu4fOUpb=r^{ly!G#x(Nc7pf3l)(l$XbO~@aZ-EnOd>c$! zd?{1-$|+Rt-nDL*!-kN&Wqk@vm<^4{m_k^5q6cf-bVpsd-CZg!+a|X2HJ<{-Q>=9# zm0>~D5pI71JZV%wVg|(SSx9CN10?Y#ctZGP(Hxw~Bxpv$z_A$G8q?qo2R5;HKyBba zr43+pY+dD{o2*D7rg-XgipG)aHth@0P@tm2j>#BDkI;2|rASNcEG^Dz<7{P4g^!oW z48MN*p{iB-?+l@43ADtm{=><;UWmx(B-6mx)qNq*E@W?|HZaG_kvQVe1cL&#b&N{roc?HcgS&|fPgLRb(6+~cN9qr%TZSVonjmYDKetp3(~o{;7WpmCto`0E0y zRc(JPgS1w)u>j6m)kZDV#t$a7h<4^Td~Ds|3HjaeY;IhlZp2whzR3p?Fv(;--r~T4 z%>8U@bI4>D`F*qV$IH&ez zr;DELcDkFr&F-dcZSsGhh-bpO$9-DGD0&B5|9m8tdTPhN z9Fs9mi9@|TIUv${r#l~=$9U^>jHr{q7cJO?wo9&s(KhU$zuVu{8{V2Xvv6&n)a@ZC zN>Y$wc=2IXTjb*a&qzoDwzYYu(vbr$cHTNxKp7o}eU%UTRNlZli{n^B!Upyo4e)>c z-TnRE?#tfpUe6E6twZjTmg60n`r;*zB#*ZGFB z=W(nU(a}>)^gZ0Tkq7aJ7n*ne1?Wh=`T_Mx5ITgVRBW*CVlD5TBVL^*qk-FSY(0Qj zq5eE#)0AYf5jvquQnAKy+U_lA-AR8p_oI>Puqg?QUD9neLFFwDZftrdgJcQ%nCtp! zYZ`_=d$qHJQuzYGZcNWT?FdQK>QeSdi} zd^G=Rp#_e{;Oc*Dnd6b^zQp>q z)T48PP$QLl1r+%amH9H% z0;6>;eto4bM}}vkq0h3)wf{R&?ebB z)7K0?H#W&LN>eiv`!RnGmpb647P-S?YLp{PQ=??VuRZi%h|wT~s5(#z|3*A`Ll7Im zrt#14UPXJmyYrEFVM;XyQ!#Q&aw2wmbE~(Nua0~UiD$=a~8#C5y^D7xNiLgvhh9Z%!Pk~WMBD0@1`UmnSJ{O z;R)S(VRusK5fdAc!#|awhBs&gF`Vb2Tk1wL!s9x5NidF`{lm;-tv&h;9Q|Sf0{rU~ zlz9DRsYod``$>}$YDyaMHZ%b5;Zl++yoF%Wt9!rB4YWjR(G4I+P^ewVJTP-SzpgzU z3p@qO&uE4}Z>4`Q-hpOfCmiO{kj(t>o;S%DJr?)$Did|)fKO*Xj|8&Hm)jiRWyX3u zFxGk3%>!qCyhj6Ty*J++z?uepG|*PP3g_9>)KHHG!WxgpIe^TK_GsX&@ur*u&fI8^ z2F|i~<{SX(a>!~SD-;)`V%WKL!uzAZ2}$7KYRN%aSx$eM)L$#Ga?symHzK(K`KR`w zy1cZiQ^_05!Z&oH=&X=n{D4BjPo!-g`Z?D-elcZTOg`15EPRU{7mpklUbI=?@eP^O z>lNDjq2K^+_#~J)42*th!x;Y<5D}zwF3ooa63csTfT>Nju5BSScLdIRUZLc9qQP>=#? zC?FGuClljEwmg&>9i1Nc(bc^lryb;oX7NWf@O^(*rFA$4-&Zj9qJX*t(Ev@I$&>{B z>>0~BaMc2L@Gq#FJukSBuWjO?x72e&3h!6+R>nA#63;CVnu`q}@VlPAD*Lc9khW))h zIwrnL?=^e!h2)S1U2#qg=`hVg%+0~DdpVqd$r-HD#ddky35XTCys5zee(PY4JV6+e zIO ze}y!p#U65_XKeXk52bU5konH+^~ zXrE?U|*#OLeRC=BTmMCIZUag(tP zSl|vI@q7i&!W-I#W#oqZi19hh3|$Xr<#J%RCac=-$EU`?b}M<+d+>yw5;Uf+OYeXj z5@hqsJ02Ta8Ca0cvSnrz1L}F*f|awPBkJD+&A;J$zdY&4KzE3;Ip&O)2KVUne>iU< zkR8X4>;B<{Q{&2I8!_f-L2$#TMvm92@uJIITSuHpbkOPXGHB6;EW}O0@V<*JGUXXT zwDZpST5{=z6irAd$WdFpIiTqAVO$^?4p2bC72#P9)+nyi>wXfbF1+F2Uz{$3dEp+d zhE=0Bi~i%IlX(446Z>2kJDtrUe=f=`$z;-707Ey;YmSdD(yMP|6IL&RCnAL772e<1 z-d-Qv9{D{_4Gzh&UE-H4iXrul?#b8QejmNVx6TB#10hA*+n4gmhkik)iC6)D!s~E* z``SC`qe}w&iMF>5!pK(oAq0NE(Ce@d(l`mY!_N!Eb*N1EAmb6eCD-1we?G7->jrIa ze;|P~zDGxi5WKz3AE|_iJyt4S5cr=b{Vwq>+1}>5s_pF)E{j9QDWEil1%&nO?YEH| zIz2%n@?r97dt3KO&J`gn1ddXD#$P{?Uz_y-_kw=A^68k>EfufSVe`ktpx(J-w#`n6~ zpz0;axui8E)=frrmC~mm5(G4;t%ImImpWV4G3aNp^o%@X7ng`h2id{Zo;A^dQj zF;hdT;Id(eRPYP%OKLov${IvlnPfoF&zHmjuReQD;s1h4E|wKzCvX+O{0c?7x>E8?6JRp;1(lWgY((ryz`ZllY}S!=6md+s7c8aTX=Mv7P#8ITq3JM5%CCh=E)3gXR5*3AsyA_Kxcm!bImt>y;04Ch* z^!e9Mc@W@oCBdx&UPX>)IX-qvM#(q*q}|vO;!^mnf4p!dPgv!?)QaRU-j-aend7}7 z-h}VRUg@Im9u4`}R$$DFP?JV%v%Xs-4oi8t#NSNrBzcvsQl|>qF}ln+TAM7%bSsWS zp`?-aCW-l0o(I+7{|jCjg{x85=^Rlh5B`dkP^Di`^S)wpySR$iY&>Ye)&CS;w``HE zF!JnGe~bFn!oH!$@=unc$L=zZ-o+okH6Fnw)*$nvc)rK++>hk4^_U;c3waP$JffF; zOvgaXBS{qVP!khPOMx}sbepCWLs}-S6g!9oT;p*yzDW0*Vw`D)V+hSy>>-&u8@ZHA zwU~3U_*b3NsfGx|8wk(9IC%~CJnUshH)e*Ze~^*VB5}Nq%}(Fkr+~XuicfXt$#kvB z77AVUM}^_s0SN(VG~x!@-9di+#iAUBq#D0kH~!LvBC>V7#;te zQSTgwQ?tF0H~hDaRaAH|E7`t}G>E|xc@WJ)&727lmGbU;NQC%URI^pO)k~l7^f~(} zf30V$Ev=<3&Bldf?no8-qI{^hZ+s{b4;Ez}PIJ)TPgCL(Q)s2%7UhW|if1Y*NmjSNeMkV|}lvf+~7=gU)+`X+jBdEbU z@dAc}kSHy2s_*yN9iB``FpWl>FJRwc@#C_mUY9#~^m(TMWu;j>EAyUb6EkL4U6$vw zENPo`^?Q4Ac{%v)E81s$vD`}XUT{Wf4dU$YZim^oW@6p%i82znvukinWP}b#$o63Ng(T> z{!nv+OEa3xli8$-URIasWVwtdkYHj;P&`9r3Y2A1q0E;OWr5TvwNs?jO_fqJWl9;L z^WVGcA&(t4#R0K@C-=)xicTL8=g-GPH{@QVK`5aY^zo92ux^`L5okR`e~fHMkxOvk zp&5lpq!EomZ3q}Sc|Y0IV*ObRFn>S6GgJKE-b}dl@2E-+J9q-IOLvZE(>wMf9fjEO zddVZ)v3uCFdpG31vj{m?p|WvG#{6l$FyYM=npm96rv|;|lHK(GAfp}TKp2qDRZGy5 zk>)Ro*;Yuix(7WiQ2Z+de`+I#Ek>Z332Ia5SoPTH7~@P9We9~9a8N*?D|$n`IgmRr z1!cwqEsiwPmH`m?CmWa#4L@``UEPXgq+rFyNtm~;kL2nq;`f7}p4tgvl!GdFgH zS}lp3vM38#A06=!E1?d{tk4e}OQidl5N*r3dOUqxWXm0!gxGP}j&@}D6(fJ|H=-oi z-oCs#IY)b_mrf3Z7;I~N#Th9XLVvG4^zk*%Z368?Ez39pb3sz?D6ORpdIn<%XgY05 zyw_Sd!se#;E0R zB}|$I#rFKNy?y%j{Osat@a_t5@hcevgAzk3Wp0%kxr?UwR^U3m+98b#tReZ~JaA?> zxJSQ}d$eU?4~<~GzC&ySxScM-4BZjeh5s$2F-TrDrGfJ=e?gU;A4B;oY&-5fk}o94 z!&dmRtPBaR+R(bezw@L{h}*{4E6SWuA*SRrKIj`%He}(gTau6BhXn?E5VT5C{GHsd z2&)=xuMeq>>S#fpCUX7K;RcSI6@N4;8@r|=|VVU zytWFlMXD3A*;=}j^C+;UnDJaC>LxF_tzt9tnaJb`f|*Q9s;KNO_qGVo*5Kl8Cq7z@ z$S(Qpbs!e@M)y7V-;}JEky9!S(=+TvJoyUue@w|r&s)a{vw9~>6JU}0oClvktd z%z;FZz25TqWZF^1#4^)1B>yGZPScNZDWIX`>GMBnBoc7KLE<@p{D44E1p07^ENYVl z-rYhE&>K4e3*(=Ax2y-__5AyANt1kyxbmm7P3HpLjhd2lULqHdOC1t;M zAaF^r3~*~gGvY=3=rY0B&wS#c*F5)BU(bBR&pGvx3ljqAL+TDLz!I@QkY^p2us+Xx zB&SQ##5$Iis!>{_&Ih=@j$I9WPhygVmk9f#6c>f(h+B_!rK;#=mJ)S@Sy|6^(~O128%Wv2M&W2 zUJh&+!sz|Q8z}2L1s#bT3CN8nf3{IA`TZACG=nO0OgzhBpm39^B`A;*YU+!;TJcq( zZi@f>&yGYD(Qu6+GZIJ}8lulR^Fjyxy*=4u93vNVw!z^9zyZavcV8d9hTSJns~9w? zoW?xR-+MN4=^Y7#f=9vKdK(B23uw<)PB6RRUOU-xr$e?f5O#xH;o znK)h_4Uk7eXROj|I*_rNtK>o6;E95AbPA0G&lmb)uBuE%mwwF9il^e`OL);ozwv`9 zwn!!sQUsGCO{IB}<(8YdF;hu*vr7=y=3XD2dbw|1#oTl21{;RX{kOMM`YtXe@5f_q zZ|hl2RjPE5;qWM)V|)Ame?srbT`C8)Y|4i_=%aycBZ94|dNC!O&Cm(dleTl~*jzB` zN}t^+aRMM+pL;eCNS+P-Ws-X!1+@^hC=!Z{rOiIFA5y-+b@5j zYws7X)Pv`T?sW+&rw{yX!+2^`p}FKM5r~)Q;xc*{xH0_t=id_h%nTsXHFikwf3@?caBK#K#lJKyig z02}?^V9@K`!r;ARa3Rx;qkwOPQX=!WAc*zZZG=nkmIQ&igCX5JRt@-LlBmS3LMd$n z^%7f@mKPkAeC95BU6CLj99=E(xeK-tsX!Fl%e{X7qKTcqf6?3bm#R*^ck2X{XJ_vs zAbd!Fmh@Hc!1yc)8Q~TBQz7uLB65rbr}i&>YO_A|9cdtz9_kV612rA?(HUp_poTP^ zNUrxB5#k{NcPl(+tyDtFA{JQN%Oj4KF7&Vv9?N60H#+=j_jzxB@7bt#_I_F;ul+CgzY@{OL-J; zMd0jQ6P1VOrebd8v!x*FwqjAm&U#A)>vGV3sPo%$VZDvy5U3r9w6+Wlpefs8zU!nT z*;0pyhZb}?8==b`_Id+nhFih=crwK zw#FuI;KD46-7Gy4QTQ7bNa2y~=AQ&7Jq^Zj<%u$$CrK z*#iY(f7cJbZXoD-VLnqFWL=h$wKS-D*{J9_qM^UnDCqL&=iHNfnP}$)qnsCvZmv=u ztT2jsuIS~tqLz!xNf!sRR@Z5-gY-unv^sZP`r^HKbU~@}Ri;)^ze_Bwy0j1Hng;BVr(YNX3LuJvnb)sxd zTI1D3)vhU;c9AIBdNGG{#2Qvc%T`6nRz%0`pkwugVrL<{J|!eGc`N1pJ`BVqXfJe!?I!qg~ogv*H2wy_@* z-;%bF>yFdDu{q=<8p0vUbQsune?S;3?t?{xOt)jolUx}W#v2T6-XhcO)GwP)_H_K* zq!+|;e1~{pS@%FS%5}e@vL7+`45{iuQgd=|O6kyRoR2pcLY|;uD7y{95L-7q%aM^@ z_~#*Tn0O}9j$BpE$Mj6TV!XnzZ-bN zzYy@ZETDq8)lj%)Y7`WI0wQ7|p81tygsNpsQJ4PsLL><_3_r%qAN%kme_Lbb4n?(71~>3#HA1d>e&$rLirS0!1+1u=H`oSjuhfI=s$x{e!$uSDM^R8mSqWc_364Pz+ zEO2lmnNpQJX&4q{-K*6xo3&5X`mQCEYAa7aVp3tP;?&HkvRX`4)vBmk6;-REYE@LN zimFvnea|YYYSolkC1p}YWg^n6RZnJ>Q=&-v^nj`Aid07ne~VF%Sk+V~#a#{6Qnh{l z5vq_@^qeeI87;3WYBSH3q|~mN8@p7Mv!Dv+NxL2G7rGtow{Ax(b~_q`6w=bLZ{O=E zp(>R`^U--7?WYwanFX3pS?hIFE4Ln7uLqJkR&zQa4X)03;-@*>kK{~6{zM@iLP|*8 z4d{r@pbVMAe~7J6W$J1r&4w~PhUR{AOE|90CVcTRX|?x8kk!<@#nb5 zYp4u(OhT2r%;0teErzyiG7MWQxcINNf>%9FG&r|603zM|ts~Ijae^e@5`9RW4(mv%Xp*c%@AE_zmJF zggrHb_}nlo$i|BuW`*{dgF^evL2I8`wS8t3G4d8WF65m1=4~_yWy!`G zK|K;1f6YN!X3s2;57F9as$Ua8)=1LznoTp>iJI3u^XvP|li}OJ>6>5A{&Nl+%@LmY z*qL|*MjA_g*2Bc-iPir1$QFmy*!myps}@KKD!2lHKad~exK$Z%t~wRQFROs_cmN*9 zoSCyYqFi{%G*T{5YP@y^V;e^h+<@{#%{pi|{3eb0h7@;zW2gezZ% zJQwMZ21E6BhzEK{!-0q0`+pVewnxJumJPH>Wz4Aeng;JE@64Pc3_!c#m8X9NdJ9{6{HJbV(=M)MtZWDQ_vk@$R<UtdX3xlF&48}1Qeu;e=U02wE1TEcV{xaaM%qGcn}rghTQogbS&(`CNQM_ zW(fZNc1%0f1o&X(QS+~h-0eGXNf7F%#89ZT{;?bCKgV}at+J~Jz1{uNI$Ck%A!|zP z$R+mrE2?IW!Kn=|i?Kr(;z}qalHD_;@+_dyz2Wt8H>Hfowg|Qe&9KiUGEVAQcPTJSrIKYwJ zMKkQ);ed1z`5e*!py(n-Jm!SXE$KnBYHfTG*MwaplLq!el`%v@*}e8?fS846tkXwt z=p6}C3kS5Y$eJR|(4~)Oe_ixjfbU_kU4%Uw+|;P&VTUoy>wO30+Ji|wAt|}{h6ly=Mf4Q->od3>-WmD8#{p0FDLfMTJ&|!YK|>Krj#q!U(>N=;yvkg_?PB<~OQ` zfUgOl^bL;p*EA~e;Di9Bjv>46@|A1vrX(O$HA9i({Xb|+yqT^yf6nDDzCuSa>0EEf zC)M@FCAEN-PP~cZ5dumTwDs%BQAcZXDoN;EkPvze6qIZARuGi-%ZZ{a?YCq#mx|c9 zkv}z^Ahuped+Oh^vM57ag2Jf5qb$7q417Uk%x%YpTv$ogg-8XRO&7is|Y^(A73q{rmL1tG1$> z;JK?IuB&6Dn}@WUtlgZ^lyi&M0r_V{Jd3l9^Q*nT7q&bnfkW-GW-6~Mv;qERY!mrD z(3?ZO<4C++ONUIFpH#BHFmNUl5{O4J@42 zx1*5&x(|q}81j`PtGn#d1PiafF6}O8Zc*<@2#=NcE~&q~q)P+j1&-lzf=5SUGP}dP z8+m%(1ftBN*5kqCmU!WB0gV7Pmm~}&hKwn8@njN^e+j>ul`)#X<ay2MWpB zz<@T1fwNl@1dd%;ELpaV)c~(y_R#!%jI{t5efg3A^7X5FM#5_VefgsCm9Jmnh5O}8 zngxFS+DDfpR(~0A*_l6~HHjDr=?6I;3a12#ZG|NORHo-|3{3J0E&=9M76kDgwu$T9 zl7QIeW!J;M<5~PbA5m}YOcHU^xB(M+JnA&&>ch~2x93|DPK8)JaNQF)v7qEBIMD&2 zKJkuR%7}d`7gsFM@-8l=HzRD_q^0F&CTZEEC8*0%H-9WHDQk-ggDBrS%Wl$tf1h5K zvHBTQlf^d1YHhBuyxF2E#Hh)TF zlJ%1JuGM(IU&zV# zzft4;5r0WBggvAlpkQkC3KeRMS?XmEAL$GrBGt$(H~pZCIYPGwjlN=iY1`5dt*7-Ngr z+-q8x$rm+z=OBgka6~j<_0E?|6gF>%c@&sTc)wLq60vjb?d+f<>blqmR{@HsM^HfT zkWYdbpJGS@q5wPa zM}OqIunPoneG2OX0HTh%^Dppgm<(r*x0Nw8Zg;>rq;AQ_tYLcvwI5;X`RYIN9*?XB zWT7E9kD;!_b~gpO{7as$WYOL9a$4K$w{DwFGohzynKi!r6DOcm+i!PY{A8Z;YHx3E z_q#Cd<{8bp&AU(Awv@16j?Lt+0_%`0lYgul7g$KeK$@pZ>hA|N3ke}A5lX&%5paC{ zini39D}PiA{`$2OOCj2w9t)LUzT~O!>(^CSeavzoti?QMYw@YJ_!vz#t-nG-FK6&EtbJL7&s?g3MhrgnR5EhZ*5DI!oVLz$&h)MQ_2~!0?XLWmAPkw*Gb)FaI1*RVC^XaCLUscZfnn+L#}`WK7DJ?L4~!aEk?L{ zYmb)e_bqlE%b^kbj%_|!5`3_#g=@9>927G1gYV7egFWR=Agnd2_#KZo1dEKh)Wfx> zN_sjB@dAA|1X+sn)JK=X9s@y%M1Kt#bopO2a3&4}xyA8k!n6}k$+f2n34%dF|xirAxK7W!OT9M^>{;u$D}8gcI}BZ2xCz}sO5t8qW6%vBgUG* zWfmc;w;P%3I2Hv=CM6Nk&p-25c+xtgE(EY{mDXMCK)>sa7@+Hoe88dDTHW z3&konSY~qZ@WFZNWtPU|X-GAM=&AU-7_d|*Ub2V>u;IKVwiC_T2)p%Jaq=wTshV5WwF0wUloH3&YZHKNefc7f z+Sjk0)@s*U?Vfs=R#t~oUWj_dR=b1ctagUAFKe}%OS#jC)vlgWO^(`H?Gz?jt6gig zTd~!yCNEf})oxCG-~!gWBB0_S4(7Jr%{k->IN{T`-W^t0@7h{Us(>-WufSj360!BSBHmF{j(=-xdy>XBair%nx9QBF35&?_yUTCT5~5eit%_kvVYm|G4-mto-^^MV zle%uDIP~R+S)~0yMM@2w~J(-$mL~&S8NwK zT+S|HSo^Yek-6T^jo3x%=`7@^tzAT6qP2^(c99j^MQZYbRoX@B>t_})i4?&T4{5e}IlGNzJGK+SZ?Iy#CyKFAj*XL92p8HvD_C1yG7g{)zaO zd^3jA>` z6U-UKVXX|dPWI-M=PRp67KJpf(WIhmxJf}MqrobY@8we#7WI1YVqSAZ)htjdYw4<2 z3q44{+31z648^SCC2c>Ngr|FK{!X4EU31zxJk>abwen5U~2qC>UdS?Fa1~qb+CxXQ-E) z27YGXcQ_^5@16d&2M3!gtyIxTUiol_?St4O8LeYV@_ZuU02o6~=8@_(R+%LtbtRDU_%l4BHh=UsIG#UP8KQLJEd4>k$z zER*)_TLVkG2zY~UK%ci?q0ei}QLJ2_cSU{q(BxI#zh7lumi8V|HHyce%-er@%DlJm zln*&s6I*+guV0ZTlxqv>)r@|=>7hC)H(H^x5+cBntXRM^`)zfkI_ubBq2pO$qGAG# zn13xARjAa|80o$(9}Tp&uORMj%YHv&mb*9h7R8^XfLG& z(>^_J9oRtn!5Fh*&kNZ)x7{~sfQiLuxBk@ zH@Q`Oefx^9{X(gGe|?It>J-!u0R6IxuadFXqxh;P$;nY$#h1cFtN3aaUn^F8)no-L zRD9Kt`Ja~3s|1BlS?RSXSl^)1>!3pE)n?^xG%L4Cd-nZmzOn@Ph;nj22F=&O(|^-^ znR3FYSA4_jua#tqP8HysBen5@d6#Q>pBdF~$>K~ZIFZEAtb&WxTBVvdgF3L21u~_6 z(=szZ>!iU;wTr#Xp6S{+nRU@F*U0I4o)e{;4(#Jry76FDmdV`6uLPu$%(G}Ta~Q0Y ztKVV`SV$3@(mQlFb*yQevNFjd&wmgek7dPSsh-o_!QfzyBNv95;AlcbssukE*hX}W zF!HAkn>yY^%S_Lm&4Am}dqNl*yLd8z?D4H^wu3?m|6qLzw(4w=4*>nL z3bvB5*P~#oCosxUTLqiKM5|zH6>KY3u+?M*D^#%6eOf#%En5j5pR$&1QGc+$K`q;1 zg_f<&p1E=@+dFcnCwcjP6>M4BdqlZ2AA^GJ@aZYo-jO@^9#NI=FO`(CVFjBp59IRc z4)ttVHF7L2oAxlLNz+%I)}`epfeewU-#Q{gVoJfK!y}x|c$qJLmLc_kN2Hlp+< zm-S445-<9c-mr;JJe!?)sn^TKNB-1=C0`^$MSb}qLC|Iw6$A}*x@faR-cx4|TQ^XG zeLZ>4Af+?Ur2L0O`nRL6Qe>p^Lu3^y52BY!5e%%ZW(gP7{3wp0HtL6#)h{V&lTC48 zD%z4e*n7R*pNu-P8Gi{elmw{t5V%x25hfqcGDNJ4u*EeR2)Hwk|KiX2ZpO()CQ5?# zUMiU!fH4GE00v)A9f-soO$I3by_>y1|*zkghF(!1Vxwb#8?$K-nB z)tBoHI7Ynpk3SkPq1eIowRe5(T}>T^)LIk8)uY)YFxv6fp)(^Wz}|!)MqK`pYi#U) zL@eYj#40qc&-KRF?lnJZ92=n%x&(epQ1>#6Ivw}F|I-Q>SLK0vKm;&p@O@d5znKf8ED-1v8a5&l7fbO=Pk zE@ZWj>y207m?%H15(ffSfkt3HA3ztUfUzTS^Sy;1etLe$*UgcZ`tp4D@TY=L`_EqP z?-qP}@#4jE`R!BpdIP&Iy*uJ15#&-~%eZb(EV5uu-hY{e_pqU_t~Y$gbs5J3*FHmJ z@Aby3-R^bF$>mSi8?%^C)8vkK@^^fOc=SEjDd?brf>K+`7stQUh`mlLl2ulel=^p+ zuQ#-3cX-c$=jG$4#+u?FCEY=9HR|`V{Wzq+D-xia*?&Wv$((^E zX_^u73mK}>BS}igMhhuP(~TOmoO0e9<$vfO5B!~w4g_HU@n~>2LOppWib@8OajPhy zhJUnwMZr~*_ID`YHMQ;%-8=AZ z#k!=OfiH@VI@Ieay;4u<@z~DDrK6o0W+4friY-<;ab?=|#@8yx4^SW%n+5YWju-`r z4z)nJq5BOnsM_ZdH>Y#?p+p0-pbwZ)k$)ZQsvchg8MU3o^}5uaa+TofZ1aEnq6Yq* z-2YspHvS88>4d&^TmpKopRsJlWV1fIo%{u9BmeyPG<|xru4~Qx=fb89RI(*-r z4kmwD?T8maA_M`-mp6EKY+jlbI3XzW3+wC_RoP7+ooeMmfj^~ofWVZ%%i|gw8k5N_ zzP$8X_OUH4|Im75E6kV1e$e%0E`J%gM(ZsozBCI~W%xB)L?hoSZ;*RpHbotv1Y8ZQ z4PSTyD8HXe=>f2jZ&F|ZkDUhO_w?1LI>#1DQ&0G4?q;~obsvQldrwu03Ry2HgQT#q zNw%_(V!XO+!|WoR#k9(FF>ibf?N$=_T}s?o??+y11*;uhJEI>%q<^h_4Ydy7#=d`+vMNW;C^_6$ho- z#qVQ1QY`WG`(Rk>ysm9af~2!!&KCI#23VsD^(VQW%hU<`PSLYm%2_EvD|>>fpBPK( zpEm^!viyq?-?bzx^?5azktibwsBb!@Nh z8gmfEe5#EVmG4ZxdVkPW88M>BK&W~L48lW+T|KJVEj|96W}Af^D$OS=&te|jSiY>y z44`r;hxo*UY4c9QLgsOxt^waXuiL9GntgGE5_YW5y;Syr?bv72Y$)V|;9{Ev^Dlpo;DPygfN zrURQ;ydC^4#}$n*&|m#u{>s9DdXryr8pXfv$S;50@qfAY{_6j7E}7sf^tUhnppLgy zvW$d_^FOg|b4G|=P|%8>ToNel6Sr1we(EB47<9h=b$=B6a_uQkGnlUaOv+tq^OGFr z3QUpnjlr##Fo1&muNX}OGXD8`W1eBuzP%6J%}-yiH-7m5flumJNFot4L?~U(Pvl>B zaDwm)uFK-@XpSw$Rl{5wfV@8x@=G`@84>CcrL@DsjT&?+HVLugvObL6a;xI=I3wYd z@bpXs+r{`tK^IkIGD zl5tn}V$8kto}|vF08QuRBDYQnQ8wl-~yZTgV{bldg)#v+m^{H*}NGU^# zZ7#xRxhUtxz_yVRNsw9Tl{MJ#xLZZc$YDszxWop3YY$I8Pr$3b`x$l&)I zc3D4*ct0S#8*{*%o!7i=?Df$*3hPPl313>}s<=57BgR#MJuG#BND2r@DH1b|AsH3i z2Jrg#zKufy?&|XL5xT8sSG&8f`2YXEvwx5kl!eE!>9=4ngg&(h^B08ql!rA2)Fq1g)TV8+9OlK74Wh#Zyl4V;G04{!-_Kc+ zL1<&YkB;~OgCu~1D5NtkTA+&vCWYjLLB!J(>J&qv2CaOUsPoBVD$QpO4oT=(D1V4t z!YT+PATGg-Kso@^mK!ekT#6V2UtgA~2~sFn6aOen-6}tWJg5Ft%Bl6Q$(PoFYC!=k z>p*3Yzlu^!)idu@dr_$+F5pE~x9c2|W5ZrlD$ma%PE?ELJ}UAV(y)?q_PHr>KdkN7 zS3x)__rhr8I&4aUVNOy%+2Uhfiu2}^{42Zvr80^G2}83m&BMtvI!7^ zMr2GOq|IX?c3mYFsoU;VtPK3`|M&kxnnF-DK#6YB5WF=2eSrACv5j&k3Fn^ z9C|xk*z_aURbTjaqSuipbbn`^L;_?WHxfRKCKd)X3c)KGAYgzdp9DSr7f(chc$^?Z zTd~8k^iRf-?Sv3;1^?z{y#Trq{oF+$Ji#KYDMT}}E*e~&scr$85!(@(tZvGYxq~96 z2>giJ#3hWO*jpRD2EGCuCD|}_qQGj9v}D@h+V3LO=o|-(q&^-dAAjRGMeXxm@_C>H zAP}kwhREa_H#bt(SZW@FAt7@tQi{9ljbGjn9C&C3gp5Zt3JXjH=)X|CA>-p_Q_D1b z%m>sbT7v#=8)CQ5eV}C z+}}+|a_0@5(7a}V-G5H5H_#nKYX5w_@qE|+e7%9D1g`7&?_cV9q!)U-7pc#Rdl+9^ zWjAlxD=XEiC{j1G7NhtK%4Hte^kx2e>uQ$t`OKQ6ni`~1&C!AyBYklt!C<99V8y{- zxtFy$W+wOiET+g*gla73C*~ApP8wJs6Q@TzI@f|o=F-MD1b^24!mvm{_7{dkTx@fI z;PVc`t!Hnu(-(gyFR}W7m`762mWP06KM&9TV(=s*sU3OKB5$`oR~M1waP5U7%Yhz<&p+8ye^up$wXXCVnv$n&}!C z=^C1&3^>5%7SQ^bcxGT@k%u@SXK`Wa*uriGLGQXMAx#BB4iQxdD9VSfZAA_cq#%Gz zr@$v8sI)wa;HGJi&0y~;<(HPgR)E)X)p7v ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | summarize count() by CaseStatus = abx_body_abx_body_case_status_s\n | sort by count_ desc" }, { "description": "Event volume by type (last 24h)", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | summarize count() by event_type = abx_metadata_event_type_s\n | order by count_ desc" } ], "dataTypes": [ @@ -428,7 +428,7 @@ { "type": "Markdown", "parameters": { - "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." + "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | summarize count() by event_type = abx_metadata_event_type_s | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." } } ] @@ -2033,16 +2033,16 @@ "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | sort by TimeGenerated desc\n | take 100" }, { - "description": "Threat logs by severity", - "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | extend severity = tostring(abx_body.severity)\n | summarize count() by severity\n | sort by count_ desc" + "description": "Threat logs by attack type", + "query": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL\n | summarize count() by AttackType = abx_body_abx_body_attack_type_s\n | sort by count_ desc" }, { "description": "Cases by status (last 7 days)", - "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | extend status = tostring(abx_body.status)\n | summarize count() by status\n | sort by count_ desc" + "query": "ABNORMAL_SECURITY_CASE_V2_CL\n | where TimeGenerated > ago(7d)\n | summarize count() by CaseStatus = abx_body_abx_body_case_status_s\n | sort by count_ desc" }, { "description": "Event volume by type (last 24h)", - "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | extend event_type = tostring(abx_metadata.event_type)\n | summarize count() by event_type\n | order by count_ desc" + "query": "union ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL\n | where TimeGenerated > ago(24h)\n | summarize count() by event_type = abx_metadata_event_type_s\n | order by count_ desc" } ], "dataTypes": [ @@ -2211,7 +2211,7 @@ { "type": "Markdown", "parameters": { - "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | extend event_type = tostring(abx_metadata.event_type) | summarize count() by event_type | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." + "content": "Wait 5-10 minutes after enabling the integration, then run this KQL query:\n\nunion ABNORMAL_SECURITY_THREAT_LOG_V2_CL, ABNORMAL_SECURITY_CASE_V2_CL, ABNORMAL_SECURITY_AUDIT_LOG_V2_CL, ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL, ABNORMAL_SECURITY_POSTURE_CHANGE_V2_CL, ABNORMAL_SECURITY_ATO_CASE_V2_CL, ABNORMAL_SECURITY_REMEDIATION_V2_CL, ABNORMAL_SECURITY_VENDOR_CASE_V2_CL, ABNORMAL_SECURITY_LOGS_V2_CL | where TimeGenerated > ago(1h) | summarize count() by event_type = abx_metadata_event_type_s | order by count_ desc\n\nIf no data appears after 15 minutes, verify credentials in the Abnormal Security Portal and check Azure Monitor for ingestion errors." } } ] @@ -3370,9 +3370,9 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { + "AttackType": "AttackType", "AttackScore": "AttackScore", "RemediationStatus": "RemediationStatus", - "AttackType": "AttackType", "AbnormalPortalUrl": "PortalUrl" }, "alertDetailsOverride": { @@ -3381,10 +3381,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "matchingMethod": "AllEntities", - "reopenClosedIncident": false, "lookbackDuration": "PT5H", - "enabled": false + "enabled": false, + "matchingMethod": "AllEntities", + "reopenClosedIncident": false }, "createIncident": true } @@ -3497,9 +3497,9 @@ "aggregationKind": "AlertPerResult" }, "customDetails": { - "CaseStatus": "CaseStatus", + "CaseSeverity": "CaseSeverity", "AtoCaseId": "CaseId", - "CaseSeverity": "CaseSeverity" + "CaseStatus": "CaseStatus" }, "alertDetailsOverride": { "alertDescriptionFormat": "Abnormal Security opened ATO case {{CaseId}} (severity {{CaseSeverity}}) for the compromised account {{CompromisedAccount}}.", @@ -3507,10 +3507,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "matchingMethod": "AllEntities", - "reopenClosedIncident": false, "lookbackDuration": "PT5H", - "enabled": true + "enabled": true, + "matchingMethod": "AllEntities", + "reopenClosedIncident": false }, "createIncident": true } @@ -3647,10 +3647,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "matchingMethod": "AllEntities", - "reopenClosedIncident": false, "lookbackDuration": "PT5H", - "enabled": true + "enabled": true, + "matchingMethod": "AllEntities", + "reopenClosedIncident": false }, "createIncident": true } @@ -3723,7 +3723,7 @@ "description": "Creates an incident when Abnormal Security opens a vendor case indicating a\ncompromised or impersonated vendor domain (vendor email compromise). Surfaces the\nvendor domain and Abnormal insights so analysts can review related correspondence.", "displayName": "Abnormal Security - Vendor compromise case detected", "enabled": false, - "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| where isnotempty(abx_body_abx_body_vendorCaseId_g)\n// Collapse to one row per vendor case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g\n| extend\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n Insights = abx_body_abx_body_insights_s,\n FirstObserved = abx_body_abx_body_firstObservedTime_t\n| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved\n", + "query": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL\n| where isnotnull(abx_body_abx_body_vendorCaseId_g)\n// Collapse to one row per vendor case (earliest event in the window) so repeated\n// events for the same case do not raise duplicate alerts.\n| summarize arg_min(TimeGenerated, *) by CaseId = abx_body_abx_body_vendorCaseId_g\n| extend\n VendorDomain = abx_body_abx_body_vendorDomain_s,\n Insights = abx_body_abx_body_insights_s,\n FirstObserved = abx_body_abx_body_firstObservedTime_t\n| project TimeGenerated, VendorDomain, CaseId, Insights, FirstObserved\n", "queryFrequency": "PT1H", "queryPeriod": "PT1H", "severity": "Medium", @@ -3770,10 +3770,10 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "matchingMethod": "AllEntities", - "reopenClosedIncident": false, "lookbackDuration": "PT5H", - "enabled": true + "enabled": true, + "matchingMethod": "AllEntities", + "reopenClosedIncident": false }, "createIncident": true } From c2487d72b6531be4ad1d63571deee36647ded683 Mon Sep 17 00:00:00 2001 From: Anoop Kumar Sharma Date: Fri, 31 Jul 2026 13:46:55 +0530 Subject: [PATCH 3/3] =?UTF-8?q?fix(AbnormalSecurity):=20unblock=20CI=20?= =?UTF-8?q?=E2=80=94=20register=20*=5FV2=5FCL=20custom=20tables=20for=20Kq?= =?UTF-8?q?lValidations=20+=20bump=20detection=20versions?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - KqlValidations: add custom-table schema files for the renamed tables (ABNORMAL_SECURITY_{THREAT_LOG,ATO_CASE,VENDOR_CASE,ABUSE_MAILBOX}_V2_CL) under .script/tests/KqlvalidationsTests/CustomTables so the validator can resolve the tables the analytic rules and hunting queries now reference. GUID-shaped *_g columns are typed `guid` to match the V2 table schema. - check-version-of-detection-was-updated: bump all four modified analytic rules 1.0.0 -> 1.0.1. - Regenerated Package (mainTemplate reflects rule version 1.0.1; solution stays 3.2.0). Co-Authored-By: Claude Opus 4.8 --- ...ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json | 105 +++++++++ .../ABNORMAL_SECURITY_ATO_CASE_V2_CL.json | 73 ++++++ .../ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json | 221 ++++++++++++++++++ .../ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json | 73 ++++++ ...bnormalSecurity_AbuseMailboxMalicious.yaml | 2 +- .../AbnormalSecurity_AccountTakeover.yaml | 2 +- .../AbnormalSecurity_HighRiskEmailAttack.yaml | 2 +- .../AbnormalSecurity_VendorCompromise.yaml | 2 +- Solutions/AbnormalSecurity/Package/3.2.0.zip | Bin 30071 -> 30070 bytes .../Package/mainTemplate.json | 96 ++++---- 10 files changed, 524 insertions(+), 52 deletions(-) create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ATO_CASE_V2_CL.json create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json new file mode 100644 index 00000000000..dee0e4a8cb2 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL.json @@ -0,0 +1,105 @@ +{ + "Name": "ABNORMAL_SECURITY_ABUSE_MAILBOX_V2_CL", + "Properties": [ + { + "Name": "TenantId", + "Type": "string" + }, + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "Time", + "Type": "string" + }, + { + "Name": "abx_body", + "Type": "string" + }, + { + "Name": "abx_metadata", + "Type": "string" + }, + { + "Name": "abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_metadata_trace_id_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_not_analyzed_b", + "Type": "bool" + }, + { + "Name": "abx_body_abx_body_reason_for_no_analysis_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_campaign_id_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_abnormal_message_id_d", + "Type": "real" + }, + { + "Name": "abx_body_abx_body_subject_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_reported_b", + "Type": "bool" + }, + { + "Name": "abx_body_abx_body_message_reported_time_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_reporter_name_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_reporter_address_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_judgement_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_recipient_name_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_recipient_address_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_internet_message_id_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_email_label_or_location_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_trace_id_g", + "Type": "guid" + } + ] +} diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ATO_CASE_V2_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ATO_CASE_V2_CL.json new file mode 100644 index 00000000000..670d85b8ef5 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_ATO_CASE_V2_CL.json @@ -0,0 +1,73 @@ +{ + "Name": "ABNORMAL_SECURITY_ATO_CASE_V2_CL", + "Properties": [ + { + "Name": "TenantId", + "Type": "string" + }, + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "Time", + "Type": "string" + }, + { + "Name": "abx_body", + "Type": "string" + }, + { + "Name": "abx_metadata", + "Type": "string" + }, + { + "Name": "abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_metadata_trace_id_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_ato_case_id_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_severity_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_status_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_compromised_account_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_first_detected_t", + "Type": "datetime" + }, + { + "Name": "abx_body_abx_body_indicators_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_trace_id_g", + "Type": "guid" + } + ] +} diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json new file mode 100644 index 00000000000..0c0547cb216 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_THREAT_LOG_V2_CL.json @@ -0,0 +1,221 @@ +{ + "Name": "ABNORMAL_SECURITY_THREAT_LOG_V2_CL", + "Properties": [ + { + "Name": "TenantId", + "Type": "string" + }, + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "Time", + "Type": "string" + }, + { + "Name": "abx_body", + "Type": "string" + }, + { + "Name": "abx_metadata", + "Type": "string" + }, + { + "Name": "abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_metadata_trace_id_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_abx_message_id_d", + "Type": "real" + }, + { + "Name": "abx_body_abx_body_abx_message_id_str_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_abx_portal_url_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_threat_id_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_subject_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_from_name_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_from_address_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_to_addresses_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_recipient_address_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_received_time_t", + "Type": "datetime" + }, + { + "Name": "abx_body_abx_body_sent_time_t", + "Type": "datetime" + }, + { + "Name": "abx_body_abx_body_internet_message_id_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_auto_remediated_b", + "Type": "bool" + }, + { + "Name": "abx_body_abx_body_post_remediated_b", + "Type": "bool" + }, + { + "Name": "abx_body_abx_body_remediation_status_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_remediation_timestamp_t", + "Type": "datetime" + }, + { + "Name": "abx_body_abx_body_attack_type_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_attack_strategy_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_attack_vector_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_attack_score_d", + "Type": "real" + }, + { + "Name": "abx_body_abx_body_attacked_party_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_return_path_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_reply_to_emails_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_cc_emails_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_bcc_emails_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_sender_ip_address_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_sender_domain_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_sender_auth_results_spf_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_sender_auth_results_dkim_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_sender_auth_results_dmarc_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_impersonated_party_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_attachment_names_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_attachment_count_d", + "Type": "real" + }, + { + "Name": "abx_body_abx_body_attachment_analysis_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_urls_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_url_count_d", + "Type": "real" + }, + { + "Name": "abx_body_abx_body_summary_insights_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_is_read_b", + "Type": "bool" + }, + { + "Name": "abx_body_abx_body_folder_locations_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_message_sources_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_message_engagement_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_source_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_tenant_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_trace_id_g", + "Type": "guid" + } + ] +} diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json new file mode 100644 index 00000000000..3dbd7cd4b02 --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/ABNORMAL_SECURITY_VENDOR_CASE_V2_CL.json @@ -0,0 +1,73 @@ +{ + "Name": "ABNORMAL_SECURITY_VENDOR_CASE_V2_CL", + "Properties": [ + { + "Name": "TenantId", + "Type": "string" + }, + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "Time", + "Type": "string" + }, + { + "Name": "abx_body", + "Type": "string" + }, + { + "Name": "abx_metadata", + "Type": "string" + }, + { + "Name": "abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_metadata_trace_id_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_vendorCaseId_g", + "Type": "guid" + }, + { + "Name": "abx_body_abx_body_firstObservedTime_t", + "Type": "datetime" + }, + { + "Name": "abx_body_abx_body_lastModifiedTime_t", + "Type": "datetime" + }, + { + "Name": "abx_body_abx_body_vendorDomain_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_insights_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_body_timeline_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_event_type_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_timestamp_s", + "Type": "string" + }, + { + "Name": "abx_body_abx_metadata_trace_id_g", + "Type": "guid" + } + ] +} diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml index 0a1e25852db..e6699df2b39 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AbuseMailboxMalicious.yaml @@ -61,5 +61,5 @@ eventGroupingSettings: aggregationKind: AlertPerResult suppressionDuration: PT5H suppressionEnabled: false -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml index bd483548169..0fcaf1c4cde 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_AccountTakeover.yaml @@ -56,5 +56,5 @@ eventGroupingSettings: aggregationKind: AlertPerResult suppressionDuration: PT5H suppressionEnabled: false -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml index 2378095c4c6..44821e3535e 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_HighRiskEmailAttack.yaml @@ -79,5 +79,5 @@ eventGroupingSettings: aggregationKind: AlertPerResult suppressionDuration: PT5H suppressionEnabled: false -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml index 9c4d2b4fff5..fc6ffaa1abc 100644 --- a/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml +++ b/Solutions/AbnormalSecurity/Analytic Rules/AbnormalSecurity_VendorCompromise.yaml @@ -51,5 +51,5 @@ eventGroupingSettings: aggregationKind: AlertPerResult suppressionDuration: PT5H suppressionEnabled: false -version: 1.0.0 +version: 1.0.1 kind: Scheduled diff --git a/Solutions/AbnormalSecurity/Package/3.2.0.zip b/Solutions/AbnormalSecurity/Package/3.2.0.zip index 6399902430f01fa4338d1f734941b6ed7ad19524..5e9749b6cfa3b691eb8e0c530dc2ede337ddb77f 100644 GIT binary patch delta 26582 zcmaf)V{j+HllNoWwr$(CZQK6E+}O6AY;1F5+fFt%ZvW3cb#?D<-po`@)pQN2tGhq* zeYpUBz5s?-k_81r0|Ekq0xGfpX@tLl2mI^xgpb+Lx-Ec!sNX?>kpIov8(TZ5ncF+r z8M~P?*tj}6T=iUP;7K-9z3wU|hP=>Om30*YOQ#8Jp4x&otz!hkOYK;OYVdZ^bnyyS z(N3kR6V=peKV0(ldxv`e{vvB8VRZk~`G}q{d0O)oRo5+U_OIy)0wU%{`vA_iB4u8O z=o=YeL1Tv3SL24As#gchnJAoR2YsUXZuA`LyRS1l4u8!pUkaKxHyfi)8+@%i#mn+S zKo`C+EpJ|M?Xh-E9E7&^`0u#Q8RQl(Zw7yo^UKNlIS`D#XLpH1=O7S5pdSj20cR|L z=v-NoFah`*Wyrg^hYZ3`R6w<&o_}yl6!6F|RV}y(Vunmqh?EX0C0S9@lj5s>++E^F zak{Y~fxM)^S3ZM;Av!oyu|A^T$XmW(qo+ZN+l^V+{e?HU2XP@2qqIvg0WA|y5el~i zyoF~^1C%*oz2X5++GqAHoj%d=QHf2F%B0Ry<#{?Yqq-Oc38-DM;Q-@6JrO&T;y_|V z*SH43Yp?-$7%0TKe8(lU+$m^S{H}*I@LWTwQ_ibRjOM5>OUyz+s3HbLs8(Y&G&!jE zhqyP+ts#u_Gx6`J8;YeYqRB*gKOb2;w)=H8Ho&5!GGsr^=ZpAfeLtfJ?%UnP9(&9H z_TA%vNnKb-?H^bc48T%>B`?Dr3g z>ZeAKGqRcyCUg}|e6623S7J;>@}53p(3oI434-CZ#zK^tGKdr+WwfZq3Q!KGyZb~ISJc@`sd;kIDgHenx0(@(d>Az!I zawz_TFO1q8l#U0f>}xO=coP0=`;jNGz&mi!4n-X9^(yVPEoDocx!Y%2HkpzMp=Se* z4%xJKL|{ZTg6x$g)8s-bRNW9Jq~a;Us-jl@?$F}5C@$z91T_ECx&pnS;hxsrZPhj$ zq_p<{lcDmfNdVo6?=+@d@ypfmw?lnfTi@=7aT_m5&;9^n*DSAZkLA$Jz{8G%C6~`z z&BOg0>nDgH;Q4AqmbMLoTN0)2RTiW@5?a6Fq4@p$(9OirUV%N;eU^^|Gcp%7eesTL zj~Cf?KifX#C~$rb+GQ6Agv+c>wkGf`BH~oM0;dF52H?Fv92dY%LVBSRM7x-l6X9o) zqasV%kS-o_9#aUE@oX{H%9DLPR|*Id%S*2X%d^yax1bHmx(`U{=tf!+%kET?Jgi02 zVU~rNEDYJkB@Xw$jXE`ov9m|u+?4vx2Qv?UOz0rx5ommoLDVnPPdY%&M*+>o)Dw`F z&OZtT2mFbqSS3wR1a{uX8jf(H^#)RuMcmWR1znSfQfBj-N2*jGU|PoQPUl-b=TMKN z9*Cq^l8x6As_|{1aw`Y>{pVTc47Z=r#5TJ8TKq2#Yt|C!*_Ne;mH1ML2JRkil8!`@ zZ(IKLU?=Bhc54guchJ#2|%Gq50Xmfyy*KK^5QFTzLXvclacWNDRsB2<~a;2Nxw74w6zDky! zLVmx)6S?)!EN0MsGSi`DndB%LqlvpUh2ptHRD^zLpPFk*N}fk?ZdM(*l)XRP&uQ}c$mMXJSw}|HU zB122oa)%G*uAso0FY!rZ>oF?D?1I8K0VL=ogewd-aY5@X<8rYHf@b~oC+ct_kI}>2ecvh^^N-6je-3JI=y|jC!j$P z58v$>umW{`v_%0gGP-7{j{HuKnG?fEyzs*M2Y>EB@Ax(!2$ zb@3+P-%6`x`t$eNvpxdDvw7|k!%e)9qD`CL9Uq?si$h*!_-h|WkRRU2*Efs`UG8P| z@?9T@VqH&x6^j1`id`*2S(yM2L>jA?0*>qGw4oi=V8ojATuZ^Vc2_5(pE>UiSp=Th z{GO|IMnr=IOtZd74@8XeZJx!|vh5JaqHQ0crSk2Ni1KY6qJKLg1H0UR6%;wx#XZ_S zIz{=KC0b{o|BLW~=;O6Y;Nf9-!+(i)wNb*lwN06e?9H(SXyxVWX9PI$DY@i8CUQ^$ zj;YHbz*?BPG=tWAHZsuZ4L63AX9=!7JYIs_wP&3yBVV3*Ad7cyZX@{ZdbVn#)_Wia z?eL*&j6M25nm<~YX?1$f);~CQa6O*sJ_=lKa}s6{AwOn$AwL8Y^golX@UK>fuf9Qz zTM_t%r042c-J z&Vz)-RE>`lonf_9pcj>Q*B%1?0S%O_H z{ZV2a>Gxx91$Ptfy88{NFh7cQFFQWHa??JLC8d@%&F!@Z)X1O1m1QWi|GLK>cEy-hqJ;GzUe=}ZUnDxeTwO8#W z#E$0x*F6dZV7`qxbc+yz^>YITH_{MhE!&nT1a_4xq7Cw+C`%<#5lnr%d_NYpyAR*U zu7fMKa54Eo!U7P~1I&z)sNLYAw{{ld3ZQpSV-ZKeC2!^{BUM$R6hwOlC%{7e94FUzXbb;5gS5`-ngO6Pd(KXr10u40FSVsmI=rjqNuK>A zwQHRe=5AuL!Z&0dUb%Z1W^pMjnF5cd>)3U(<>i|xXdplJDVzCX-3Q8_?*`WSRR^PH zl+bnnRy-%?7uMhk;cYaz&Mlm!K+A8WXnQ-Jx8 z!{0f}=Bp;_dc%rC2^)-4hLYwRm7~s43wIKev>`==wu0VjKb{)`a?fuBGEuUl@gsosaJOMd+dg-aglTaK zh2UHuYsPU&*SJ@pu*2Z?g)L@qSGadmHIv73WWVe+G&E&QH3L--C-z5_I zcq|n6(@y|zUk~RE0Bbv+fS;$c%ab6aW}iOZOFe|+OaOlOE-qd#HGz2~H*$1B7AW?Z z^xbJ@A-VzT!+`f%AD;oz;4l(xU@aqHX73Ys9pLHK^vi!bt{FxNJVseT)m7wUs%z?S z!20Lt52NKz2i0(RqXy7Z$3a0vQpgPC%iH?#a#zgZz`o;GTOWhW+~|Nt=R`4s6{}0*S_|dnP|E5vKW5g*0KyqrnQN8K?P#PdE#vqG zs>OH%**GI$F4sjrA~|osI6Hu1S|0K~6wICQVTlIs16C?fWk*j>Zb?c}R2j7}O$a(* zNZ?k71g|EIzksJ1+1J5yw2w!}U^0S#D-iB$wad1Dj{yO?Ui`f5K8Su)v5|RCs&V1xW#X7P^dA8q9-6 z`spsx6rlsv4n*nQ7NO9iF%Fri3eeM(1P&;+zL3d0RJO0nwS;;{;P9a^lN+!m$Wp2-L$>c5@+N3V@c|;L zpVqW3kn~m*FX1lf!f}AiJp(pt`cpm()516~PS8(jiRW?R`mftO;LqudctXf#zA?)I z(SR+<_?Y#)GghJ@w%g({iS4luI}vsxkAdT<`ChyiJ)PWA^Wce`U4@>loau%!PKNPS2ze`(#YKyq>onCg?B?sWS_h@B8z zc#vB71TO$b4k=9tT<+CaFApz2*bquN4n4sF<$%SDIr4;5J-c3XLt79H*A*Md5g|@5RxBsnl?Q5(|pbksb*tFreyS<9D?|Q0xGNAE#?VQPl>%VYyDP(4flvt}O^h0R$9^ zs|2`;)Mi-vic)wlPvVwlpm5PBu4OS;>GY`A7tSnwq=HJ|dP!nJN0;$r=qT#BVQ9jG znfw|)fI;+J*Vh@`wpqy8x)!sMJ^4X_0M;cz=JApeyU`rMy4OPewxuXHIP{8&of+4C zODuNH%QO+to2964J2flx-9B@}sf*v>dj#Z85(}8b4c!EO9>}8(%CSNIW+CTN&=X!t z)nn;%pGItG=D_eC@Al>Lbp(^A&ljtYjM)Y%X|5%8c4qn^$i+j)-CP19z2E{UB}Q~$ zi7ac(IGdy+8zU>%X5rW1^hsxWUMevSVDND3Q23y#svWeO=p?dx4&pr_sDH}dJ^{42 zps{e0g$Uxo+$be+4UZ8ffQe?IQggQYEl{Zba82)C`=;Z^T+0y z_iTE*dEpJb*k6?))hU)ODn*{iT2!6Wr&c z2kMQ&-LY2b<4J%9(XXB36kFGA_W&4tVjR!0e(M5@Zf>T_90vwSP&Q&g0fIeDd_Oj} z{}#zACxF{K;)agZK8D~7suipXV;a~FV}2(vCN!8kVY7rpT&3xC&35)j*W&)}`O15B zbBjkflw5djRZ0?)#xH=j4-SIde`wz&?d6e;iO@u%CdnR5oAiZu!v+X6g4Tc3gb zCbgE~*E6(tq!hJk@MEzBR~HxhgK-|$WsgSI{qy|+_;P%-Y?+E@VD!DZC)1t zyM>#+-Er?t%{Rn_!&)nhL#?UbL9=MpSb8{nQyc(y?U_gdI`EfdMDE%$flKk5&1LKf z8mIC_iAII?DSXxJ)4d|#yC1+NG|SVY&sOSyg%o!SHDiP}oyv_P)CZ>a`}V9D@9Ue; zG2xcl4?LobnSsGZkItR?N?s@C4Hd%+b#Nv3SHe^Y4S_GgKyO*-4y!zly&G-3t_ZvO z(>rF)N*2;3MX`kZ`4!Tg|H*9asm_+hyS{q$<1ThuOBI%lJ}y1_Y98PZ0<&RZcJ$fB zPE}EL@w+PP7`N|QJSqa8mqu6-)txv8WgjQ4^zVciK}MNuB=&B7D$5`oF$V=@C!eYt zb>(1~#rBCsiwns2-N8H@P##v(b!^sm5q{zmjva$}MWbTmO^?IwHo#>ojP!Mq!!8A*Hc^0|1R3pxiKI}d4aUds zCL+DcM{%{GYmlP@7R4Aj=s)OO0cW@MJk7aK7sWB; zwO(3MdlE7 z1k(RvKo7zv_vu&pI*?-y&a|h^X+RSd4}lc$;4ZoN`eHO5O7so>hJ}78$!*;K2?en@ z3>2bDf@6(nH(LI^W`?+}W*lKw?66hggqINo>2;9`huQ+5CKwsRz*h2Q!U*{#YGWC$ z1m8p|Hqm4Q3{l&~PCOm22VxVjCz1hwhymn?^&1Sfj2wNx%c?y30FFZo%gfk_8X@)8 zhGtEG*^1y7Y2-bMglcV05|d~I{FJxL%iMYXI9av2QIZ&#I}1(V}42D+wRK6tsmTVpT=fX!o&EEGzkC z!;ogB?`x;5k-MmkQQws^i~PP^j=iB4rveH1tk6zXgAYO_f|hRUu({*e?hQV81xhkY zm8Gas4hy9xA%xs;ZPb~Z`OQeEKjktx@!RHB?!m_t)w71?bQxdZM!7M<1Ur?NQb)a; zOROqvvMtjsra_wae_uwi0vD;Zf zmQH%o3_91#xtE-uIc%kff0J`+DExfpvP+$Vrm#5@4*Wh>s;B){(X5o3)P<6)1-mqzUwM7cb(^VIF^m& zS-0)FRuLBY6Z=Bu$d^t{I<%|q@ohF$6+v<`jsGuUb<(!4j_A-_-e!Md!tYA06N(B~ zSCCzR_JGK*){A)RzP%_ukb)~9p zVViFAiir3;fp)8dxj5$5oU=t;1Cgi$4Q=jp@Ssj9G)!_U`4oy+Wp6ZUlla6Xns1GM z)s4)qh!TNZ+ExFb6`)BSfOeAq@tq29}=%EircRewTlpAx2kvO2Q3Cw&TfmzRHg zU*8W3O_;oMgB})}qc#s-FhqrUMFd6L)X)pU5XVOJ1(OKz@42U_kx_=P?6rx`*xF-J z{Y(>QgK@)%xZ)K8XDbT4@B$3Wz)IL-Fw?>s{J$Q$YEg>-m4yo<1#z*O=+HtiL%eKK zSZRpqORl3du1Z+Dus{m1%~Zl=$Y3Uv&T3#V=1zg~u%P(~iSUy2OKA$0Ex=Ex&10&foUKZ{^Z|Le{1TiI4xA(t-QBvN9b!KnkGA4Pyga$xJ z8{dASF%ci7!u797y0Z!MsszE>v{+oSL_vOH&Xh=Yl_zeIC6tG);|n1wid-b)vS@#G zsE^cay9jj?+qliSnm;jxh-dN#TnPj03WPn)ob3d_QOSG#412E2lTxx8Vhqb%10Lfw zW)>(-CAyM(n06DsyntC3*p?c~MOPph{jq%1@QZly&i&GaQ1vSOUm}@0*ZiKWj`ZC2 z=s$I~#I6i7eF?&j>fP>!RA|L!LfTmDQ`a(p2L4fdHe7kP3U5eq<8mI@L)j}|3&d=F zFmDE+QarriWWWdNRIy3Y_sSp_R(hVnRP%B#?xtIR2NbqW1<5!HeoVZiOQ z89JZ~8Yn%2FRs@-Ipc3f+!qHkdVi z9;I{}t1r5hxmr9j^wAc#Km^fU$jz)AqirK>(TvsNIVri=rKRd{4qUk&pC6kw$vM!N z%)~tJCz>3t2H*4SbxibgB|gZF_m`>WHmDDQUc=I-QfG5LFzZ;_Lp&~9J#5XZ$qaz> z+hzs(iJGn2p0b_DpfKN5vZU`M)aWdCr0xRdq52OSalTh`@0)9P4QH8 zdn_J-_izN$%(7r%lDL8fm*^)A{?}dRxZpNs14MOD_G!)uJ@ft_Yk{@JMZs*l~09tO| z8nm=xpGzzS!gzmh&LtvHRhB0|E)IT^?&SF#G0Th>JQ1u@#Bi{a6g#Kc*4(A`+rZ=UM#-M~9}o(aHX2NmG)Roc)tP%+C% zGjW$2emA2%1Hp?c_h30=OOeMk_X)4kx~XB3SQD{&G6i?pL`%9C3kxR@C7FM%^+Kea z_Kp`TR;&RunnGK%K*$AiHM7VU_VHdGOpJL0$JWXe-oB=A`N&(w%US}N5l&ulz z>F>&@h>lCCxVg5PvnRkzzJb@_S6S@*Z{{qFn2TMtvcxMd$$;ZHmhOv`LIVV8RcD??GjA5!*PM2_v+mGu z63wSy7RVO!G~$fFx19xg#{E-;IPb*$y3P9%L9I3w1);~|#-4y`(7%Z6Lqq*-Cu=at zPG7(OU`TrNj_71YFHF?QaVZ}bhf2A0{(NfVeod~e5uYLIAGWkGd`I~QYZjh7Lu0H! zeTN}h8ml&9)%2QsZ(zhB&%c3H2JY05AyWEJk(x+$%+4~ zaiZWF^p|DC^tc#c1)`yP-Mz1@xK@_Mrx504SA!LcUfgI>g7z14tb9z8@~b+zxh)pj zv=HQBIRg!p?K$SX&Cay1;{2!FrG`y9H;v(lJ?t=+$_8dk&}C740o*&)$6s(ZY^7Yn zK>LIS)GcQGGX6bk4Fc0$zpdf z)yuS%=T>g;aMIJYu46yOoy;Fy?owP7O88^c4)ZZeh#Fo*?LsuU7&#Q!BA%B$8q$oF z9D7qd@6Xm5zZCOz(H3(UkUZ?;yevshBK{-sp!`#0&qheDxt@xql+CshGOFF|yh67} zw42jhmO~4m@$0s0>-(NF|3>3gPV@rWfG-~|*RcK5aA$fV}VVZ=_4ZVx35qPWxLBpm$fdzJP)enGBmD0s zL=Yx`+?Fqoo|2A$u75?Ncqs4B?$kP2~G9HbmYQmoQpN6P;t{{ zwW2MT4Rn3N;L05J43mywREIHS51RpOcdc9(`2kJnu9WwOuFoa>!U`Q3^Jz%UzR3V> z>l!*T?~1YFBXRq-Va1ikYm_9Y@;&j07tc9sT*EdL35id}k3#_>;^*A` zDy3qs>ELH<4(+TJ!s64%;raqT>#Ee>|H2hoK>r@D{rGa>^4@@jl1hD#eGd`Y}jtez=RnjiN2myIMn_wlOM zm;IBsh=wMRJW%PFA*NESjVW>odsQsA(@F)0O(jP!Yo$1fWx&wT3OqsbZlx{kA&RTW zfXu!84r)Fv#lt?v2O7)EL+u}6P5q^pKP!@=r)@TzvHbg{W!WQJfq?dbj@hd@7=_^t z0j=p4rv~t-yjHoxoVDy)4xiRd8%Gb0|Nn7BBoX>jg=vAFUCJ0R{{#j3n$S^qYn@t5 z#=AB#8{tw(>G3#)j2)H2HGN$PtX$;T`LORD+NLoT$ph{;A1rUxg{G4+9DeQT+0``> z-gfebPH$7v-xnYit%6p9ZQ!Q$gyFq5riy};?`Xes?sgOyldEd;_N!TWZuzZ1aS6Vg zRWJ@!YOS9@9;mmit8I1Ne|`PhoiBe&#Rao%iPNsTgcWhJMCHWfUm@VPU+>}DRocez zDR1S-h-_5-1HAn#supumad9@;i_@V5{;;UBRo*xJStOv(N8llnP-#$=hGWgMBhB+s zNv(XsYLBBL7mjG9LJ;wdj9l9ejLk`kW`#>;vj@CZ_x!|w%Z(}@X?Kl$n}fI_$K+?! z!jncStpKs3jbspCB%@f~?%0M%-vtZrp5x!T?%F2@Y)I4%Ma87^KjV%IGaw!o!c;o?VU7y&Ge#^bsD)`D4rlqOJ@XIcKE?w}8-H*5slH|J@ z0pJ|F@b!56_-^kv;Ql1N`6mYxWe5vasQ6M4Uq*oqm+y(DKm*7O&n)q)gGbaAFZO$R zon(x3(Ld;kQYC%{N+ee823_e$QVR&FG(N|a(PoXG7HA^A0f@+Q&{$62SGT_L5U$aE zF$=zo)3VQC23oGj_U@9_o!f=)2~Xw212Fww%!4pFWht{YKqTW7iZ7{u@9p%xP!P({ zeyg?{Y%iMabtz}a`nk16HcKV{NA7BjOYb5uTjvNNzEU}kNj~-fzRzPGKs@saRCFOk z{YmS*4=-#7mQ5irFH<)6BS0*Ddf$`VzX=d^XHeThOGcmwgmp(%n0w8J- z)bNU01qH8QEZlhqbBh_QbxV$=q;9;40`r79KKjzljyiW|5goQ8AF0Ta{lq$G+WIu; zfKCdwQk?Xbg#@wyK)dQi359})_z$p+f;vEZ>I2hwMqpuVKFO)y%fUoN*z3!1F^Lcq z=a%sAIGgozf?y!e8k7Z>2z}529ExZYsh&X~;hl{!sOh9*8>p^2poo$bPbykP3)+`D zZ3J7Otfq9)5vek^W6HB|{CdN0nuqz_F?(@NTxVv8j**HIC)ngA+QD@MUva@gkW4vUK<@32M0xXm*AGN=_Pe zA*MycOvy|CA5L4BhWC5^D3sRyHv}!@7rlo_60VY;%}#F2RIxOTcZm0Gcr1G^I?At8 z*74malG_VPQEY$|-QP&yG}i6T)`8hQw`9Gn=&*K@d=T_h8(7yld_0O2D=K;BqxyvR zVTEjImTFZ|n-LAQiS?xj-RWwF(sF)A;Yu5tm7Y5o@Bph{t4K&`{*b)tY=gh@V5nh0 zZpg0kyLV1(p7A#4WB>1xM=IqZd9D`M!-a=A5E-4F2R9oyyS60F9?-E9XkpS5 zt}BFbVu{xF?&8M6)F5zj?N%8#6QLd|(FQjSw|{81;EmJdFD4~EdK-c;t7PyU%YV4+ zaV${PVI!-3C<_3ik0OS3R%Pn`_i0s5 zEI5AH8`F=z*9|m$lq}&WL#u~d;Ox#=j|3YbK{1$oUmLzvMX!AIi%d!1YpCxZkp+8L z*wjX>mei+zk4K0veiD?wf;GM}?{ZcS#1o;kK z-G6>=>Dm=f2YW{S50Fi)eH4Y-@+$lXWJ{b6V1IHkrOuQ(+^9!IJ!I>)E%lA`SKv2x z0u=ptIwd0-k-B^62`WRU_*ZBQkY4l0z8LQ4*LN^F0ae%6ro=I#W6%X`!Qi1!*Vl`4 z&{mQQkvfUXMv8t$+EVX-u= zgc|+x8RwXvQXP>K|Dw1U_F90)Dh=6R&%_Ol0mmXpmr^gfnJ~fFt$x2?2^j?i?-D@y zj!qUH;mhI&q8#XB&ElrG>P0y4K2-ePFR__3>;>?5l7b=-;(V9K4?wr@ApaRUlDny& z*3zre1f7L;T3&48bZK?6XTD&6dFUR?EVhj^4TAhon}UlLO0Gh7;uU!b z{?vs`qJxj=`dZ5hN8UGvk4qWT8a2RQw@6(IG5glN>Z-Hqou=aYB0Hp1XJvwL6lR*> zI6s(3SlPw*c~oCn++>BT+CQDN>vqK;TWuRw&0ufh%BC?yyJ+8*kyttA(@P0F1oYwz zG2$o`Jk?i0nMUkAqfcfz}{RR7dOr5mD$Ot@bCDni(y;8KgU6)0zMW<%3l* zF>@aQ0w1Di4S6jjQ%oi5FHs8n^b+<6Tm*N=JyUJ7ZG;3Qg)}cYh8YTi5?;^RD`C)$ z>T8h(s1Z7eGp98cusq`Makr$hm$1wikS&D)AMr9IwhX3=qs;37%a{IfyL2~Cv~cFj zkpW@Z!%mB{hp`b-OLFIXR!)F;P<-I^rIrWwOz!csbRGt4SiHMPK)M?k#}&<`FvFwf z?6>b*qqJM#G;@|rQ_bOSQB4rCV^W`6`I`E=TNf4?>p;;FXK!=crY|*gz!=5`f>rtH z*>?=<%Lf~%T1-G6(hs$7cch=v-_+gYfn39qxusoB0Y9gS?Rw&tHaP$u_2du9v@s2= z+YIZ{^NEr zG2!NYY$cq{LZtnQ^%OwQkXkYAEPKM7tUhg-Mpc?uq75s{Dw#afW5k&%g>8X=6nS^@ zp#bL-Fhg7H#Qx5cOMHJcVAu##^$2UTqG{)VnSPfQ3qjxhoBhgbJ#XY+CF?>8h|$Y%$4_+sMkvHQ0&dXH~@&2d<>31hljy-PnF0*zPRMtM2U>My{%+R9w@JwN-EY%E!{v zzYOCUV`%tNOLSR(HKhD{R!4fF-wz9|yM;Gy6Qh{U#s}WhV@F(57G!OpP~McnIHo?O zX;h;H*C&zIX3hXCuW2Li7-Xp1bAK4Xk~FS14+4tY>=>wQ9Ic!?%Vp+V&*?0_ zMQ?N;5?s+~G!-Va_-aonx-$n6V;-KC3Rd+*vTq2@+J~q^-^n^`pnX^tKE;_gVYD<} z66C&6zhDN|BJbaz*jR<_Verohc~$lq~&y@pgZCb zB*QXQLoBq9el`;+1g1%AE`0DDVRyF{(JBlr(a)g{#qza2$-ZRY-{!`c z@Wwp^^KA{!%p*=-cQ0OKy0)T2!mypSDx^8z_7X?4gF(bra4e{u{cHZO3PCO>(u}Nl~4hg;OS3qu!uc@S4vg!CI z7R@?%&BDV(J2=1#91nd;V#L-Do!bwTidM0DcbR6A5Lr_UTfjr9*kQWfy6Ek^^X zptv~tlP{-#j|8&Dj3O6b3awUpJd`1WT9m-C3$E=8E5i5)zv(?%+xAh85+uYYWQx29 zQueWgMJ8%3YpE200k~1sg)s_b(2>(oYVe`|w0O>@@X~5j-LVy&X7n7nBEL(=%ZOo- zqnT9@(X=w->-=Dvg4;{{vpY>s3G6EiJn0FccY)c85E75!QNcD)5?)y}Au`(WuDpff zt(g&+T<64%)Kb%FBVCm^l<|BUHz}dw{gGbH^I`*ERk<)Y07{)`2pv?XB6gWGVh$c8 zr4!y~x~S9Q0x15;>026!nQw9ymtX^Or3A}r9yHzbe!rLdxa`FxZONNt1w`>9!*cii zA-_4vFU^lqWQHEmx(cNlNcdEn79LiVr|pR5PkbjuvFM=eC&hp#R^X(-)-Tnj%T;1* zDAF=L#P1Dr0P}2LSehU>(fI;D$zd!L6nJEbr(+M$VB!TY>Ek9GnTOl-Pe8fIPu@sh zTOG&vSoMe7kfDTu2@9J{?{d4}oo8!@vat879qeevd?y?@@2#LNJB8HxM&j)zIq6ad$DTa-x!|K!lyW+kiE^Qa^ z2T2@dZ+m8sBU2s<6;Lyqx3crOy*3N$R9q<9t?phf=wTd1J3yI<^W#p zAU7~hEEepDB5CI=?cf_0D@(+fiy{A*NvUDt3589Hncdy|rsk|_j&lU?Z7EwAP39B} zApSs>!i5&ghdl{Msm+LctJ7jIG)h^FD44jDL=n zh1R43o60wiOQNh4r%;%9^rm7+re{&$02CeVzXXPVAT#~77lB3VW%C6(-q zRU-E`4%2ET+gB(@E$f#>sGKjgwVA#S+eSlDEd;z}h_s_3?_Trmkb{S_sBE~|Ji>J${cHc3_ zBtv%Nf670NszzPC+0XLx;p%1r1OsSwx$U<8TN2y%K)sP<2gO@!>j}FleLp|spKW|;Q$6jyB|dh7r7rs3 zweFLARW9j8r%Daex52cCjje_r;W*rl0a|L zt#}Sow=i}5fF8=k-vf6arJKCB{;!eLd7L}wT?QEsceR?#rclpt+VUQ`Bzb9f^6?<(H3W{(cf5iWZmx)JKMZzoW zdkN}OSt1VkXZX8g3ShTmPM{89a$HDo&!Ds@jF}5PifALX7=`9DOH9l_;?y?ix*|iK zOJ@?)(!*C|buNMkd)~zNcZh_mt|TUC~_!b|oeMbWuW7%(g71^$|+Z6kv|nn|Js9z+WpENp>g zcK?*h@{&!Z2#HYiR*pAEAXB}m(@?%sG7(BhMar40j%8L|Mg2uOQHUe(_&+UZG+gg1bFni0Kgzw3Tdb8RziIqY+Os(vjE z8&`g@$MrgnrZXs}g*F}Gc*3gFPX94w#)W4uEx?$fA!VuOq`HU5+3{T6fYth@M$dtyIwKA`zbM;d8xFWW!B>v23nR)kpJmEJ z&OG3c`eX>X1oJFf51;Cii}S?Ufzir^&Xs$@cVvi$WgWj^H)cEom3!;OgP;8IDWSL1 z`LEQFwCKb!0y>>GFn{k>P*H(>@Mc^({%YanR>q7TBWZ2eXwCvQoHizyHnw+;T)zss zjaG$}T4~$voQe&0@x>Wbab3m}r*N&INh`p571et5*;>wj1vMwi*zT~snr$qPer=*& z=Zgb4Gny#NCd#sjvV0^_mdlE+obk{NPd5!0~yBHLs*Q%NsUE;4+5J1=_!!f67;8vQmu`)U@sbSS3pw$R9G~9u1K@ zX3sjiFFL!uCDg9s_?Fn01X2l+6%?$h3fCl87<{ESwvFcBw4Z^ZQxOVZ;;(Crox}kd zGwJqZ@Kcr}n>uPyxbH|O#p1JM>YaDBiZVthAF(%QzYgB-Dc>vQA}2lPQVv*c^_!UN ze*_%o@bJ@M$n5(;^bhHoJ)rhrteT$^&PAM>u|51_DqBD&9{2;UI*NpME(yv95ZUZp z5~M~^BV2}pwvGL`{1&%`Tz7)@jm;q^(EtunrbFMheZqNhA1oVWx*ai*wBr5E$MhGT4ZOmznGte}<~- zIpaY^SIFjQ>Z-d5zYy@ZETDp@)j+ysCMYQS1VqFGJoPHa2z1McqAtDBg-jA&a%dnK z#X#l~=L7DIqD36t(CLib?Hf9c`%kfN%{l<|iAH$mJ7&~{z7r$so$rWx%S9~*!rv!N zj1v%XfaURGaujU@=ZoixI~Pxxf9RZ^`BFG=M*&?0%vrP<=!Z`k;eq&!s|a9kk%p4h#T%pd0Xe&l_d32q!8RvV-$85 zUFCvh_Zg5Rr`r@+;NV6wf2AsU(lE@)x|geCHfx`%^<4`n)s~)q#H7Mn#;KW6Wi_9w zs!>rjDyl|B)u^Z%6;-36`j%Bx)v778O3I{)%0#4BtDej%r&y8n@c~oS6{(Kq7NZ`q zs;N$jyBeycYWw^nR3RBYut{O z>~_=-7^J1)U%%H;OjSCG=A-jE+Dj`)G7B`Hvc~JER&G7MUJoRFtY&mT>R+9S#7{H0 zAE}v&{D}fKfRvC)H=si{g)(H66I-Lo)YXcc4ODuJg!|1c5x6#+@a4z2b+Nlc#>L^p z6@^)tZ*EPa&ry%pe^43lhy*%!nZfM{S`2K}WDqn~aQRiYI6+G{e~ueoQO)b=5xt%o1I;&J zps9KV&1#@2c=bGP1C9B0vm{ApA^S}EE2go}NGvq=nI+n1_6zMZ`;C2O+4h-X$jK?D z4&TNVJWvRvqf_fx2n*FrQo>`z6qOs9bzb1gJk)rE0n`ROxYF6{iFYhjo2dDj$ zH@}?y=L|NQe?vU=Fde%EMjA_fPKJrk60801p)C)qvGu?7*F+#GsNf0&eqViz;#O6> zx$aaLzpMk!qX9%5b7s!sh;r4PT%-f$5A@q18t5$x`Yv|v|1Q{Vf0qRVtQsUDl`&`TYv#XYqBEyO z7=U(z5%UKwlf!Vzn>bVbUt?jbdRrzg(-V7t`4+bH_)p!!mbkbUv9j&w-=q7hv$9o* zbZVr=%BC^VSlODQ^h>j{Rh{)ETiFVv`p0ivGvVo}8P{fpVNUM-M2u_25A{cATq`^{ z%eSeSf1kh2v$uKnHqYMWJ$oC|=r>>*t$M!BY8owgu0C?pXyLPTNh0b(=F#%!XJa0f zSZK_nOEixj6q-j58uRFq&7<#$Ycu~FiC~KfOEpf=(<8Bt9;6>#nFWd=8tZ7~b5K(C zL&U8m&eM#x(f7x1kIpV;jb4lAE3lH?CK^P>e^J@1Bx&?*qCwi(@odP6UzUb>lx-Cy z&V7STYCH_ zZfQ$!!9@&h2lI) ze`XlwWZqB2&Q|>7dwh1b!gI59Gn@G#)jXgc^8>1}*?a>wo2rMmR#8^5^Ids#SJ% zzq7knT1P9YJY-FX9XiBbe?`^IF*vc|Wig_JBcX&sGTA*xI?nx8gpGtIme>jw@y9C(8+KVt3IyPEatRe*#H?Pw|+b0Q+MCIF_iF641(z9xZ6Zg8}}rcsFtCj=;U1lfHTuUvaKAwH?98H%X;|DY}TX1d-u zSG)KM9Y&;cy`i2|*Bh720$MtD$J8YRlqzWJm*c}$qRELOp>s(>=rvGKf3DT3B&ftM z$C|Pdzs0M$)Wjx?{Hf_Av2_C0(f?MJMLF7%6rRmolU&H9g{RjWEkGCf6cE?W1OUnr zW()t5wP}lcmej$Wx!&%{`HZD+XNfDFKYnrksa5iXB9nH;nw_DTc9IC% ziOtpjJ~?met!T%1ZYL1ee@xvr4GnPDsyApP{f2f;iRL$N^RZtB^ zRyCfb7b{=&St0y9WxUOiO|~@4tmvl_WXIh z!Qc)H?oYAjQFqq*w6ZU3mq44mMvRFlL3c=rV^_>mJeL@PYOzqz_Uq7bgox2D?qM+} zoQm|0&?C)*%rs)!e^yh)T+y;UFRs8HSaG$r;VXiE=?H5tx-`l2>#r+ud8}?xZ%F{J zo9ObXzr4811CrRu`PwK;Wr3J=|4z=AfS-Cy?v}X0uRaR_` zZHyLg`E%mSy6p85`C1_l*z|}5m^y`X>8mCZRfI4Q{b54re?}|&q82h-!(E_Mv3jSowgn3sA3Dc!Z$OpA+2a%NO%vy6BQbnhGJZilh!#J@|)aomynBu^KNAM{LCQ?4{JI*n%LeMtVWvLsMkdza127XBL zSpKf;?{Cw~GEzT-YO>hISgp-9mN%PMg_srMvs&`le}N-8N7Cdt>)L1YgIrL}n^4=P z@IQlZr3$jj= zMXX@C8hNu9?di z?18HQL(C<}XLraWeuPi7MX>Ks!UH5!ZCYz_M_rrUwGd~>CmxW6Eyfd#xWwj!AP!bt zF^E$%G*{|I;n`S~!)iP^*`NvK`%eLR{ zzWBjBdDvJ-8MjC@p zWAK^P;FHw=loyR&vcYF>F@uj`?TZ?GW>O8T#Nbm;C8I`d3_cMjZ0bDcOyA#`{B*wL z3o8F!Y#7u{3N(t5nNNLx!gZeK<^{_%_|()y&0*~+0wx+_Z)R)Hj6*Jg13rCgf6sn} zwWldYxO{6*BG>OJcBn;J$iHEmPnHB9tZLy}Z9e;j%zXb_v-x0GyAw!jjV^vC;tjzf zV=nb@?dp=Alp|4~&xRmNd7irHQrcr6D3RzP{kHgv`E*Pn$SsOLlct?uLatq1NDvGX zGB16=k%e7w!SvEDm;{0EVh20)e}*6x!38sWc-j#SIUbRYT-voO*C35W1)-L6+Kb*n z;*JPw5|>$oEZ=TquH#q~Fd3IbL_hr`v;%SLfH@Grx>Z_tu?79EHzI(pH}V08a+AyA z4Xdgg&K0Y;!ZMTdhY!wDFS9fzFM(7;h@OtWivUZ7;>C-202|IJv1vGMeWBj3t;#6Jz&yV(cV0pCL#~b@<8y?4EW2S#&kSEb$)&CO&;(ON(9f z*TY)v!jy#j`EvwC6xp@)`LiO%FJD?S8}0N9B${FfCb<-w`tk+c;pm}}UV`djnz(L zqOsaFR=Xuz?P~IZWm@fK)CbOCy()nh)E`bw1ee2yph4rqfmA7>3oyz(g zx!--mhPy2FJy=1#wHodY3iVY@I*r#%xn>vamXbw!KY>snS@YWcKjcpB8xNgC4X(o&#k=t+&edlhp<7bf&)JI zE#3mCM5X>jVoSarlSnoBJ)+`sro(EkXB`bvS=YKU8LlRTfxyO~w|-lOsoeD}mxiKf z!~^PpJwZHoe^q`tqd1(Xf}JFLSl|lFk%a+^N;K&p8(~q9%4jf(FH2SvReyq4Dt zK{az!%38SS)f|C2b6397F*eD1VhBsb)&%%CY(jK4OjQ|X zE8wE>s-sz|a9R=8GUw!R;7ir~1rabtr~1q#x7NVC23#=?bp20sT#G>erZfJ+OJ0YwUG8}ZdQ=h zeid+nCB9?KnlEJtfg;pfMJk2%v)xvEv$NUWocy&Z{((XvBU}bh9;%gcqm?QvDFPg-f(0V6-&RYh zvyLbasA~nWiU~Agwro_PQqyCk`%du<8E{hByN!CgdW1Ka2bZ9!f$pEuPQNYLWO$!J ze_D);Bz!-kUP=p=`1H7SV11Pspi~Q%R4IYSwoh&ecBDv`B=Kt(0_QmrsT<*|VrR-{ zyNmjWdyu?J=&}%}?${xTp}|vLE7rhyf5fa19QUIfS$K@8%L9bb1WJPmD3F}}VKrUt z3$T{Dm~xI?%TSB9QG7k_ilOUQeC-uVf8BfQQ+!otpnd@87gcYD16FFuX(}x3YA{_6-uurDfdc~a_g*T->&8> zOMs6kCHG^{eCMA51Gn=@oKo-^%oE$=g<8ZKU(Nd+e}e+rsa zaFJT8RP$y~2ez_6rqpkV#LUlHY4B3*A}_ONNo|};foPX&!5oDS z3^T^zn8;KKo=>oi*a%_dO(>sGe|MZnOfQ_xfZMZsLO2>Zcsz#W@r`Gh{IBsWdz=ck z{Xz+Ue|-wJ>SU1*0R5s0wvw^eqhPBiFse}-1)Ii1qhMLka+gdH^X)3wvb6VzQfEE}1>3>Xe^ao%C3ns} zVmjYnDktTN6>P>dkc+1~Oy<6-kz;Yuw1+uOT5{ECU0QAu$Pk(OttB%grW9OBc%;*r zXp>RKfpRA~b5fy|p7wF8wBArib($tasW}q(N7(ZS_8|};PtA#BUtDlu87^?`=H18K z60%1Dl|>w}Otb;sWJ9Q+e~2KF=sn_e>|*EIWuu}bVCf98l(~(POaIp>xgMvI>!47; zK3JcUt2*`913@ae~VbCs4ri{2-<9; zf}nv`8*P@zd-}{_>jo;YuP5&rq;wX!jsH+c|9bRQnv8UQh^#{8LG)57f`Qf5tl*-X zA4W0MM*YyD`Xw!G@(K1$HCu8AyVu$M!KfpPf^zCS1TM8sgsaE13K44~Yzd790`4s0 zzr=ICopEweiISkbf1Aqk4H=cjga^rVN%@QM@bEQ)s@y25+?{)&f0_NQlfI5~y8*k| z>%d-{c0v?^_bGPh-?A(NjPdzeGxzI_SJxYFSwLWvonCkMdZT^4K?5@7*Bh@se7+W> zcfIkd*S^-rd|Zx80|#sfKCbW zu{$P+6Gwa$8XNmxArC|gxr&6==X&Ey`&t||fsKF$4uRid)V<82E{Xf!|8mathMoju z8tp;6&1xg4Ejr-dsAuikd!60g-QCUs-reoIgn#YE|MkQGwPuOd4VuRb09^d+;309M z-z7%G2L;jre-H`3P}M%JH(r5bqWY|BJxf?68iDz|2VI;7#t!ApcM3oJ@cclmTOcj< z<@xTx4+Wq0p1s`LE%^50#f#_a+sF3x26h~FcPMH@tEIx03EiMvWWk)GGY{@zLtkBQ zc+_#Yz=F^|LuBvu#;e`-b;QZlPuCmMh)=Wlj;HxMe?CJz$vsa}(0&C4rM6ToPJF2m zd!1G!>#Qg#_3toWZ>VRtL{DGjzaF<@LiDyjn3uZ;$Wcr4jK ztNjxmf2;`_@MskY$nk``s6^CL*>_o0{ts#g6VdxwhIOi}hn?YlM*{X}j&9^bT}}-q zCu%cIL<6QtB0k-UDBuD|z1bO*ilsNcr+zuE63FQ7EUwq3_f)6^muH** z=Vv|e@8tfcBDL{9ki*98HFXH+xqiZ`e;HTJy8L$h50n`Br^l!1`v;0DmmUez0C6o! z_)nMjJRsAqw8eb*D4WH_QOnyZ@;I5oS~YqM?bK2GNf>JWfdupWsaP%dk4Q0p0i_7( zEjh=*q;Pk{G5-ey{mFr0U6SVWbA0KR`(+i@Tuag4Y~B%rdRpy-URocA89X4Wf6M@? zcjM{sZF@SH{ACkIya*C02r#j{{@Ww-(k!0_pv*5UpIcNsH+^)fl?w&_l!*fbrUX&- z*VxdQ*lzyirQfoTZE^XB)+1YCzBKlOt}k=Rz%^QLLD8jIuqwl^*&-VGR(XTm6SFBM z0gAy*fVJUCPXO)rbE!N4Hu6mhe=OjU(}4P(zWQ|M$Ut>tt_M%tuEUzyGS~J*BQi{r{?ejo62*< z|F6gQM^jWy-=7p?-q7e!e4*B9!(A?`SsY`j7}!!l>A|<)lL2h;Z&OmW*76vKge)LdrgT^Od7Aquc|{` zhq|ERL7O|0=Iy>m`HmoZf354vzd|<#c|Z~qB|jQE7p^0zi`t9=CPb>BtyWhx24_29JtaVn`wgo{-vSYy(#R~>lqXYFPg`UgQe+hfE=vl7htdyXY zJweq^j0N@2g4YU3YUHrHI@I%`D&qLVhhomSI$BY&o(4*oP}?SMNAI=1u(L4;v)paP zqrT5NwpVwJIEZFG)y9g-ccxf9=&Fnu(PSW1y?qYhp~S8p)$EoYeNMB@LJpPYla*&N z4{ju1)@BA!xl}-Wf9%4vd8c71^H8X3AU4l@#5$N#;Y(0lqG_t zAT}epl?#$FaLGHQs8xb?q>mVYJD-Iu0#bUMxHPp zRL&j&T+uSYwEvmp*-2X1Y<<{FONAdlBm}(^d(&`BC19BgN)L;N$;OV}>W&3^F@Wg1 zS>~xvh`56CH~O|cu;g_x2v|gegRS@bt(ggN^%SVr*Y~ILTKT6sYQHf1eyjCAK5Q~^ zfHyz>j}My^e>SmrJH%T~C>mj)AHAP{jHY z_&iQYFk#}5K>_oPI($tFn0!Zzn2YnZ{9B>y5mRU_tR)CU*-r}jUh2*$=V!^=B>((g zq8wSWe>3s8%X=~AUV2Yb=Tm^D^Ky|pNeN*vfzhL9UWG^!JyPWwFTqa)NI|`5<`Xtn zalDrN6#p7r!Srjt*cD7`y%%)_D{}QojX$HSkM3LB)hE(V*LU@)()z33jjPYM?dnt8 z;E_^>6x&>+&vH@DjlOLoEs`L!(kpAQ5plPgf0z;FNXfXw27hZ8VS}KWkYhO#FFIm( z(Mf=?ZF9(7rfhuy6C!EUTKk4WXsp?jL5R9&OY_Kf6!y_ppFH_!K(N)yT>>N6qwHiY z#2LaacJ3jo+XUYxrW2gw6G-83lZusx;A_EL2P%dV6UdQkg_zTqVXYjwFe~-#j)(o= ze;$w_?l?a{Wcn@G3#m^n!u$o{e;yNIjXraTrarxCn>>ek`DBCWa0xFOgIx^r z^+oq{mShmx*z2N0aljx6U_T7lREQSnB7{jHIiVklG=)iuVNiosJxuiZ6fu?NGY5wx zpce8&hwusl@rgq)Cy)-nwB?2iK9?fKz}FXLYLXNR)+9cvQn%XAAkV2kmU8Okf7kd+ z<3Kg10G4&2GRR*=DW>X~cdEUp^b+UrqN>|<2FY>7UQ{~I&pb|4^X5J(@)=5CCFksO zQ{sMD+pn*Ja8mAt;n1OcLj0qOd}gWfV*%>7VCrOaslXXuMfy{8F4!gV$p~^8$V+0x zAlU>6K|?ZP5Yp!I06UHri}Y>xe=1T2{`dd;|Dl9JP&YuaZqg9E)dzim{J)WnawqT! z(SceT%X}w`qn(Qco9|BT>y4k)FG&29(p19Yu0&|w6yHO-+We~U4en0)j#f_S_46B- z-MN%=k@Vwd@fVVR!VC!L2UAzzMaWqk={2{Jm&fchkI-(k%q!#N7ok#}e;JN^f*p~u z0cjB*kz1*=1y5XPD_n8)SeqPK4hwZ1ho}>nkw?s*BI*XrAVGA|rF_kBG-Sa9c_E*4 zh8T*)Z)u0#mJl|*&~fw^v7P93=t|vLE0zE`$c;n{lMoAi76#yz3=nWYlSllH_)8=r zKq5|%qpiqcS@|d9(53+de_X-8MOiO^Zpc2h5eQGP2x|h-jJ%EdS7*ALPo~7CQj^tA zIWo6U$TfiS__ozc$TqCLZ0q*4>Y znmGbN{-1lhF-h*cVPlrp4Dj3W^#;0wNbR4lH=gf$pRPC1gurzj{rz*39CIIkEFzme z&pvNm%~EncvnHvg2B}nYG^fTWxww*Gu+ku~;^42`%i0_>lY4#^Q)DVaHInmVa|$;n z4J?p})1w`pCxS?3(#Ed{ti8EmQGo2t4T-$iW&ptx9i&@NZ?n~vf5$Je`hb{6($AKM zfM+ic&)$6S#3Sh)dI)&-^YH9{&j(LDQd~%I{qP**;W?NOo_M43 zS}O+K;v+Cf{%p;0rp&`8e_il=Ef3zkLU?C5bLL?U@a{c0y!(al&TuBp!y4e-e{gsY z3gMmM%$kQaz&r2xEv-c{O9uR2VT$t^j<0!GLy3#tLxa0l2<{B0*F3C$0o=WZ26v`< zzRRf6`>^27RM}-2^;+fvw=jds!f9IOh)|ww>4hF4B}=biqL>Ai5<7u{r825t6fQfL zO70^SIw2CN_jWsbDWy3We)A2VcXt2(8R;6DqYOB}<`&TUn0RJjW08kAAZKx5>Da<< z20`z-Dj`h;LJkpC2q?-mhpuf!4iKaufK8{sCnKn|Jc{6^X^_oe?<(b&mcUkk*K*Zz t0RT`-0Rj{Q6aWAK2mqvQ|C8)=LJ6d8|6D=kH59y)H+4D&+;ji{003gYmd^kH delta 26602 zcmV)jK%u|(>H+ua0S!<~0|XQR000O8s%HJM4ekwps%HIMC#S4oy=DLaDf$Bd5dZ)H zZDDC{RAp^&Y+-a|E^2dcZtT6=cH2mnDEOXV5u@x`5;Y`swVifV<|(EmXQ|V+)ROG% zGnN-K2n0!#Km-Z_NLIN$Yo5*roKKif>o1wL;{pVLz=ao3l8roPby-B*_KqDpcI@ky z9}wDq_%~)v$qaA2LL1XC^x3PO9q~(lhCMtXGvbAP{I4h=eT&ZIH@36CyZ5rUd)V9E z+p&r7(tBukMP|N>L(=~Tqu!4jT^Qe@UP!#~0|}TzJ(y;%zYG6Qe4ddI+c<>zzx;p@ zLK`>=r!;_ugONvr8Fnv;6$MUsk9vqjzE6XH@NZatV)7HLjSt9YoWWuk3~@=_D0HZY zLb)_FrUA+hyzv7?hFu~A5oj~PQanDxT&28D!$=+8HDir(dvMy}m^N5kH)r1y6m*cP>k{bwJc zKL~O>77}d3s3@Eg^yeK7ZkUfP(o>846WvW6Yl<9(Y!W!P#75(Q&Uo`T0~B`vtipd^ z`TuhKBD9eouMS?b7@QMNA1&%xINaKQydV=!4HOBgMNAQh+7gC(J;VqQ0#FM8rWT4A zaft>0+UzETvbCwcZ+1GLDuC8uErzL(y6V9Chnfp{cqZum4V|EYhu!D)>^r7d6 z$Hgq%V!rEyTl!dAoxWpt(dG`PiTS|O$3c$0C}==)BT8@fdVrusfKzM|#SHlDmISvB zxvOG$^_Z6;PhcEswHa7q#(awd2ajB$@ntf@jw=vWeJKp%)*s`cwl?{XoAC~93>7<& z^qsqcat*b6?V!IeZ#5t+`Tf*?hELg*Sv2rzz?sJ0vzG_Edwcr_2YWy5_QzyzbokTm z^WOg6vr+Hx`QC1CG=BN4_wxBO`~p9J_Uy$=E4KzQhYnZrMFTEoLKpJ<$bRZLo!VQQ zGeu?nGoOeBV)xWz&SV<0otU+-%`Vb8U_7)&?i)Y=N7VC(71H47=)4GjRl{^cAupWT z@h`_@?062xm1#@PBQ`ZosiYCu%c8;5#ZUlDce7_(z0GdqIsc4^I4@fop66KlW=BI! zc|V7GtPoVKOV1`ErcH?!4=NvAz~DN-eO(d_{Y! zU{9mR#{nb3+2|j{3iouWV<^7BR@Y-jJDc6j>?ysP1_Xz1=p>=4Wav{{47|vB+F|&X z*p~zc*0k(&by3YVi6v!;d~Y2@?gv>SFJ5!+oUc>o+wtP%2JdBwJ8lruit)C}&asga zPjx!kFQAkCh3RB}5Yi*e2s4w({zH(7aY<$>*?%NdqLy5PNcO9V#CYvyrYNS7g8~{k zSe!;i5hHK02kCUSTa_lzJeE2{$>h3HT~#cfW#m z_iNKGZ)xLy{lkON_^@~I(>|!9MlX9WM~8OLBG1QT@{+t5kx>!t?k`Wfb*8UPyZaAB zyY+ymPrLgMPrJ21nwxeHDronhHtq73&-Se6BmC@HZ%iz^cQ_)uy_dVs4|{tUkF7)d zfc#`XFQVOpG+ok2*(ZS&!-nB=)-Ix2%dWX9<>5X;|NN-G@jSime zjt=pE3!Dt3kMkhX=JcO=%BcZCEzIs$V0OPYW_in(_Gr9kk9T{!2f(_lXSg@Q`}@7a z@!sy}r+sX_+^vb({RhHq9SCY+_Mif@2emQFTfW${4{W?Y>g`+hVejxcA-$gt51#i9 z4}K!M_$AptJgAA;g9pNF9SCY+_OJr8hqW<(%Uh0rvVYopNyfbw)&cGvzJv$QPh{LX zICydJ!Xhv6-r@6lm_2+T%+`UxfLZ0xP{c&z2IWfhjK@XXt6VpbQZGUCjG-?-w{GH7 zUmt`Y-;K&FbjF42)=4u~b^D}ghb*AO#>~vY;OCu>uW4(cY zZJ&CUV-qht63&w*QZzMFXsbD-z7I9JXdC0Z_`dWwsRrf8sSF152>O!qEetCxKbddn z#Ig9X9J}-`b1Y5c=O=g=o1$BGER74-kELp`ieu%w3m>a4P z?Mdl7n#0)s?*4&rH}ClYNxL9Q_r_(9K%t*Ql^+?HWC|UFVz;-nBdF&4yz$Yv;MhGn z_0YD7PduBQdGRjrpC8_>NYOmDZt#SUQ$%@*kMyU+kP}d!1fiq3ck zOYjF6bQm1ttb=Fb$JdearqSEYu;VFWNx{*4m_>H2+R^z~hc-anqmjJVO1a<6@PEc41%4G{9z#v)|i&Y2r9>k0lsiYO%@ESbmZPSw-Cc zMw0DO#6miA{srjDw<wZ4~*md0iXZ8&y?lWrD=PUzM>iTZk@k?XK235;FM zeKh~`w>Y@5=^aPv)s&!*xgkDnsdH*_EAOBfA;^!|lrR(!?Dj%uMv!WV$SuSnp{mqs??zV6A|fP;)_Fhh_SXie2b zE}3BKUPG;iXYkFU9&~hnsMkfr!y^}dWCYLns%FkaoVmVv+b03`r=U`B42((rXQE}^ zdq%>*;c~X171&7#sL7wyxQk0BM4Y+7ukX$--VWXjFHer%Uz}e3&*9bIFHQzm!#8KY z4L|G;kKPoIGQx~-MM%wojN_#E^W4yKuZhLrJQ`e{ED51DL<6vY4fq*cd?N?%k55;z zkJ)jW0F|>C=`^(>_3-<*f3TDP@hW0cC6`KGPKl z`9C8(`aB#_`+k`GgMS{vLWV4bB|gTGqo)y!aJ~r>u@Hw5Lt7BMjb0!d-?Pp_NJ)r+ z10o`|)0_Q&3&In+^}_BHBMjDcDVAhH7`*C+V##Yp7-zibmb%f5z_ahS@f(02HAz`2Fn^eQku*gEn*{ZUs`e!ZGXWo1;DS^7!DU|1K&YUs zy&x8WG$nJqrmsC6qkwqyGn(PgTd6(hKr^v74)Z8~PT>Nz^^m1 zM-F-IhxZ)dXU2T|IGE=-J`W!9<34&^%=bi}0~w})A3ZkeKHldciqw#g9s_f{>E}Q~ zZq!GQhdG}5bKoI2>Z8X)ooD|X2+$?7W+1OEUP(KNbL)inM}ZTPz`^rNTFQud%A|Qm zfnSJ!ty`HO$~+No(#rkI%l$fay}=AJDJc3ZBs4#u;KYlx%|t)vddF{4GX)~_X-Ue& zx7cy<$Z^3IYc>>v4vfEPA#vCbH5tH$PlB1lz(#MjQ>WYz&ZV`zgj9=8g|LXL-n9+< zg=Z$c^kdtM_2d0V`105S9HYUk7(e3 z`>rE%TON~J;(`wd3aCpE4baq?Oi9o$;t>Tm^qlAzfXmau=)jCQ6A!(mo)c1VkwkB~ z{eYo!qu(gnduQbwm>v*x%ToSznRejRaTEUJvwbVoLSTSuDv7Iv2Nf5Z*Pn3+ulZZj_XR6_v+f~ zp_fQ7V=!tc2O>xynsF@xpCiYcKo1b=(NS{fFXBTl=>8>QVLgl3b1{Unt(fD~E+fJsqH3BQG>uT@jGWs3CqvwoAfjAg~3yePc9#&9%4RNAK{hGXd>Z zNYVE8rBpefU(jhH2Ew19o!H*K_73{!k{4t_+uH`=aV!0xhARPTqxas8NAEoGyyTu?3{9xgAdRJ~u2_|6w8YZ!Xa7+@ zh7S5jk^$#;v0|q7Gl-w3U>3XM1_X`edngsDm3qS~GX6GyR6l=UCq&PBd%I}ncu`0g z!ecmtaWGfrXaM~ZP|?Dp&td5I|9FGAPvI*#G_7%QS>s}C;K8#h6h(rRBDoo?*r_Iz4^uL8Y6$VshmOTG42q#G$Od}*& z`(SzGyRrD0D2WEEuC*RnWv%XlDq`_NN4&buaS(cc#H?}Oa2@YP&zNC)JMhdS*b3_b zA@ZjX&njX7a26JJrCJ3AFLxki5w4Pf6*0yp(e$}|@XO4UIpX-}qTYq_ytlho=OW24 zSY4~oUH2M3$PkPA$OH`h~^y zm{=}<)L1R?ACf6cdRda-LHmW?UlxQbmA;5-xLtr;T;^$!DWTbbPWT{`$gwj+$OhRF;$&I10E5>3nh@qkE&(+^a3RcwaSMPq3|fK( z(~^qtU9?k0aRwVS3jHX&x@b4p^t;GCK^=hD*6bcz#IBFoK}-w+_Y*; z-{oADyOPx)=~VObu`R3SsBy!8^6^Hs2TWR4a!;ECL&vYn_j4U;jc-#ZELC%C(YV&Q z;9xim2#eg14Vgc#IfLG<&;0THbJ;h}Y>~;J-vYDEa9}Mo9dxX??Pfj+81?vNQR~F! zd(_|uQ^*a$g{Ddp%eJpQx^UF5=3-jw+GF#w>dcvE@v2Mt98pkxnxRd9DEY zLm4el$z@WlD`aLU6;Y*sER&5YM&g7A0%hq?veg=Rpt!S~fQ3UkVkF=Sj;hCPx_$ZB zFw9US8>=z0-n!13V|?B^%o(|)rq-pTa|O-=XEGsyw1rfmUT<6_VMBCgwVbQkRZtm( zMngDGad>v+}smTFz0jg%!?D-jSkthLfQ z)HR1qw6(TAq)b{~e{WsVXyQ-bilk3cB*i?WuTnq5TU8lnY^NTRNm|w!kwv5WgUZHL zqC!X}wE8Yk?W!(+z_5;PSvISsesKJH8i=7&VX&zuwA2w)q$pp<(5p4A7_+{ys-}S| zVj#?d2ES4{$VkxVE!&IkaVuYH)X84kZI=oXYHz$JdE-J1Ft~qXP@1u14^3neh+4XEJal^XKQuWZFw|-bRtaZ3H3895&SRK;D z*jD*oH+O4gnny0v7|M7)pj?xQZ*2veCn?y}c_r7-7jvkqIh<-&>)BW(QpC-wy)>hs z4*yMB)*G>Z&XuIMtv702MMJjzx*qiq?*$oYYYv%dzV63;6P5<0K(BRpQjP0T01gPQ zyZg|#0;hOV?Y)jCRsN8~v!*i~+*JER#w{xZFnm|f-WWG*1(e4vpcrdwKcwbG_?K2XIpn(3@h!1Q$SeKUbth5n ztDd_y6vLrG4g0%l+4A$p&CeD8e0WZ-XGLk5`IBVkx|35iKTo$_mo+*Gn5~kR>xIlF zD#N4*VYpjwOsp2a_w8<*)%x9jGR`O4)vBb z#LzQ;>17Q$XKG5KdYAGUT+G6^)CNb?niFJu)WOPetw>9~?K&M;>$;d$I+wPtn~#FC z=V~??Ir|S)NwXF#vrv||r%tVfz1^C%7AlJNh_ZE!6mnDc(eHABUi<8$$_E@`A-Icn9pgfp=D7hu-``uwC>u3=h3bj!~x$cdX)ZMF9 zfgxLep)P#9sv?T-S|}@a@%rfC;NT@x3Y+0@wJ<2&vT`^$4LFve9-7!LAK$wa+h{AU z!w7}YA}=5oop{c_h^^Oc?5rN@$`p%>LjF2(UAgv{LsRZB1hqIr?08U4FcHeS$!>Rl zd6hUNB{c_gDk7pO5{43dNoj{ z-ff7UA=s@>LE2_gHmK^kk!hm`hrh{?xyz{NIe>^4cb(Hpx27u zpyIMoGobhHPmh}h#~5W+4Ho!|&jFTHipe?nE8B}^pfPKJwG;%ot)9tp`jg`~f5=pP z-MZMv40{oF-FqqYG=H)R!v0piZyBAsB1(XHU7%(n4_6K%6pco7%y(4HwKkaIV84b= zoE(4M@M&?ED+lZY32es-5fvtX9z}-YG&a9+=>X71sZsEkc*^y`wsxvq6NJVf*pBh$ZvNO62H-Zdk0Prs;u9hopxEr)D*cNP*DC#6rGKmRFZ1hf_5BO# z`^(YDd$+3o`qyi#>Myzf2O_`=h4_ZhTM{6Mc58M0tzVAmNVR@B-<4l~PCi(6<r0wIAC|>KwZkA)w5VZ*EmQrjBDip9YsL^wly)qy1_DrFt10U zp-qkC)J;R14W@41zZ&)t^uT;(q-Jhjg_8t!uY5BHydoV+=0IEjetGr|;UK{GOv0+z##!SlJR;{t1TB8DwynCzHC?wGwid(%#nFIhC_>oIx6i(~6 znEkKyTdX)kr^}ETT^iyxVtC|}0Kzz%e?sX+P8tF!iO*aQFmZjAM&V)6sJ9N7 zl9a2Bf}^Hs8l1SeOry}qS>%gdMAbI$Fqzc4S-m=tkBv^xv)UzpY=tyXld{F{{!WYt5cm7Eet{f|Y|Ka$b@EH6Kwd6%vi< zBG$JX!vBcMoVe@oKZ;LJ;)JB8Z(O5^Lo&1==lTPHD(79#hQ^2N)?v=bB_hsv4Ip!H zN5q0~NI5rT+)(Rj{9p#oWCEHfQ4y-Cq$5)tA~_YY1=IZq{8UyblndAXLgo`(f|ED4A-kqlw7sBxmg706JC9apmCtJ(^*!7Z7YinsKCkT_+(Y zbpV>VDAf3Wy010BCrr3a?9I(*@kxDjKeiOxth#nA-vevXRwo|#|F&7Z^#5&_ee~z1|zDx zo|@SmMT$Y>uG6@!U~0%!J)>EKS(HlA*8pA@lnn;F9Lb>{0=zXFZX{?;Lj@%)$1c5V z4!l2qW+) zUHlUV1UI4P4hZJf3H1=PAk`nS(Flr4IBabv5>J|7Ggo-RjFv;4TGy)B9}&-*&Tw$k zNZ_5?#blPX0vF)B#@uNx@Li^Otaubn!D_01oHu;O=eDUfk5eHYTPsFu#b~VrtXx0B)9vkxc7!>hC5)y3fQ?~Ok(!zl!R zPc*ZggG5mvrdi`QCY8C?loJIj2gkLQ=2}y}q5NrV-hJ8$IoS+HP1ra7m{Jr^kpoej zMjVB-%k$i{9-PIPY;_;4?xWRxq+aY-f4?{xv`MU&SAA3>lJ{>lAN4QVR`XGEm0bw| zwM}C^Y@Ib*XUzf*^4&RWin-##$E$XK`x}fr8qBa87l{X;y=X=P$Lg#ZHWoG!er$wL zjIkB~q0l*Yhf&Z(Zq#!=IC_8a290UJUy?%4u|B2E%Fmv-1}6cHeDwZ(^PZ?I;=!$r zX=&v6ji-JI=&UKv(@Ww($#C0YzKieIk}R2n(_Be=2@%otXpNs4ssJL*WX_O(T0aF3 zS+lE9tnX}Y+s*@rN8-nGt!wWBViAYu$Z9f`lB7pS7^Nm`KBJJ#EwB!tV6x^_w;>5U z5~d`J)h9KPv!J(PmfqE5v4A{-W=*_5>AN_Cz8#BiDx); zEbO{)0@VuE;V=6j0K>$+^})G+mh?(02tl_uh{@Io-Wt92*Ka$*ydG&&j_gM+X3QBw zsZ-5WU(C6l+C2h17D8^ENh2kd<+oPiHX*= zWfl#{>NN-gBrVAvpJzQV5qs$4ppkrt=P)h`aWEmFik?^(83rVb0&nPl<8a#8vsBE1 zV273MAS`kr!J$8H0<81b@Zgz(vzQdM#Dot4qJ87cnh5#) z{q*f40&<1}s|hII4la&=9tKQj=97R?k3U|ytwISp@~nk7^2b3J<)1&s(R?=Rjk zG^UXkzfgtfvS!d4r%Qmdc?+CK!!pBTEi+UmP z!t;RIkrkeQ^0j@msAu7D3lcqTnZ`M_H#=SQY`4?h>}_^8ZEKVN14TR&)+J}8TXK-X z{=Dlk4)GE7JnqvfM$tRi`sX9D)KfeD<(Q0lN*wC#$pMkpJKg!{JjPq6V?><#8IIP9x@(5LbS-dP;S8WJ|J?`VMU@9yvSc3<{(_j-OnZXI%$v{W~2vZON~%A`8f z!*0B)c=>F{59qC9lYs4{7MCm~xz0C~J&$9>h>o6WqVM6xjXa1)ywJS!FF;4~)eopo zg3uv!G#L%thGXji#0vH25u2tYi;d6;U6P75j?;E;LF-PsxgU*O zhfPUf?2>M)2`X=KaAVUu86->4$6VJ>ThlP~*{hu$EI+9v@O_KUIw%Gh`4O8EZXkAh zaFZt4;#K`u5#Y^uRROfgkmb_ImZt1@ZK_BBa=ehDm;%uycy@WjMG*rpD3G&{s7+kRjTRFe zdJW_RgoL(^j$U^V>gFV<_3#Y7S=57$4)wZ-czEQ(kBs0MU)9W+h%?hqZ}%j?{`5a05(r}bSgvCiwo-LV z$iV40bdnd4H(W9y;*2bi=VoJs8G%*Z*BoFjOF-)=pli}OJ>6>5A{&P`C3}Y+-jjI22BskH0@YJh- zS^I^M#GzM2^%N&nP_a)Y^r5>FVgc_;bE1<}aumm7dAGyF@)UbP20FobJ z2|&)c!7{bnb?nUxYPkRwa6VFQ==SV zni?e=e(jMAd;(_&4Ig8-myfHjRIV_bS@k-JOrb3sb5wm`ab5E#BYiofYfn z9;ME|i116>>c9*l81f2)#h+1sMQCse3&M?;gTEBSoG-zEvI^T4SE#>0Hoj+_xqwbK zlP~mcN&=GEtX~kG(5)ACrx+oy9+}M7gb#$c+Z<;Y#56>Zk0(cbHJxFmPZ0vIQKi;E(wcZnM4q#0KJ{oAN9(nU@YHFxQ17VFf;2c2aMtd}H)_5Y$ z0cUQsM+0ZsvvCdpbxC7?wU8Bx3sTSP+&ba?QQ(9maB#Kcpo}J`Osb<5SUKo#u^W-x zfc#VY?p$6T)v4qSX5kw;QFK;FFn&NGe<#v55B;3$9lwRL9wVP>QWn0&j*CZ*3pSvv zEBJ=Y(e(=L{ZMcKH+&Mz90oSLw4IB842Xz1I+xZs1BvAwF~D+vrdroF_!*pT^rgvI zh%53rlu@ZRHwWFpVM1C%VTvLDjGTbjX){S?b#h3h*orGToBA+|`qiz}wC5!#l}-7& zH(sGIh>YlnA1}sMM1!wxc!sW+g!z-6Fb_87Y5jbk8H|;7%gBVvp~l} z5cUxEeH4(1!*hdw@tRp4%8ZUqkNfEA-jA~gazwNEBO3U=tFkm4gDWf8Zc#v8f@pxI z&SXl0e)f#z{IP0*JNOrr!JZdfNWV7m&|B&`AqD3M^j3x}o-4bqT&{=UafvMIx-#xh z)TTZ@y66~@z!!urejOa4vpWysuLJa+kpK-W3#^6%d**n50=ra9vJ@uDP0war4B+k~ z21P21Mo9sAUX&Y)MTeBzNiR=N-h$nhNW&*$Bn%-0I}bvd#0&YI5KDE_aDzhjKG8a;wBCqkthM{xmSyk3atSBN~Xr zp~MDkkDW;*DB#*VavkdiPSEzY*pBUObmzFPWGSz%y&igr1XJU6F{A+=Qk`c^^I)@g zyb1IG;Sn7rhwdUibb>BlLhwJqGiGXh;@LiRybwBnoOJk1jzTxI&$2VDu`53M*&qt1 z006Huhh09)g}hJD>ENwk4uXsDbRTG|jF)t-y=#wCTq&J#!XoayAUH`~!W}}aXurRU zESIND))tpLeEgW@Z=vpdG$eKt94zAV^=lM{bP1wz@rby|*aj?ce~x&*0^i>aZNoBh zLw>}6_#9@2u7|U7Ij~!kRqglVQ)6JemAvXbI5tlS8dKM$cR&saviap5j}5I1EJ$bB zGSP_v^}Gzh%30A7_3we^-|)R(o^)i~It0xebH+=9dvto7Hv-6xW5;#>aKfo^<+6KM7P9-tg})PM5*F@OD%A6CH7gsK<( zSh|RbRhdRhG_8O3*D53*^pV_F&Trxea;138&qXkc-M|8Z#!^mBd8DV_T8bQhANSMy z5A1~KS#NI_%^WWZ2}5`cXC!t;&yX(A7XcL&2>A{}zyHS@#NC5l0a3Tchh>cqrLHi0 z)6Q~!Fa=&PuyvzT_BbcBro_6*sHajo6GVc5 z2DSAJ^=&6VWPfcm#!B{1hqz^bLe%C9zN(78+FNz>Rh$i?GA_!;P$EV~(2>s}@nC66 zKYD6!DPz*9y|r0)C7WGTfcs7tZI&RvC~9mOTT(mjQ9m8^0!%f?;*i(m9BM0sY}+)*t}ttNFh{)cn6KQT_^(=jL}hwD7Wp8G zR!vwCV;4F?`iD%~9!YBsH(bZNfsbX8bvr;pSTFIYFU}@Dq&xSl>_G$CtL;Lt48<%* z=y2FF1fC&=*mRPn_obQl65LM0dPQasG^iPM^33+2w|i)0wkx_j3d5My;^3gAaa}X? z`P1@|vw}F;nU|u#N5J-fRV=#*=gx9_ou?&C;ZvQE-xVE!4ZF&EkPH1)v;SUxY_txL zIYv=QmUaAFoHa1!P2!jS40|%0ZXbhW##xm3#&-61_g)Hu-?6#21KO!M`u||m`!US` z<)S|<#ed2kFFYUA2kG}@aOdYKG}ZTwj~_j9_gm!HTPBVa=YQdU<}jHBrtD3*;dmYi z5@(P)D<~l7l`IEtPSYaPNL17k?p7?)VD-noFUdXy08F^q>GQ9j@*u$FN`hMlJck_5 za(wKTjFNBqNxQKn#HH|CdErW)u*!X@6?|X3ExA@R$9qG(3Ez*s(na4r8uGENz?jOQ zCXLu;owmsJmGWeNiNBd#M)GP|r7{(?V|0sgv^H6i=~f(vLP;a-F%t8wJP)eD{};S6 z3Rk19(>Wqf9{d$6p-R7?=6%KHc5xN2*?7=`tN$syZrLJRVdUAX7WJ!zeM67spDaa> z-DMuVi$8vAJc3IsKITX9e2?R~AIW9wF+Z9Y@)E3gL@)V&n2v#%N0KP!p(ZApmI7Rp#}Iz8*h4aRHgZ{#YBA?x@vk}!QwgKoxZtG0e7hspX$z&=~|O56udxEbXS0T;g3@J$}so5 zTs_Bv?i>OA~ zRTrAy)Jj~=<`ki%1RS&R;DV?=2FbAx-2zkS)MiN&iD4@@^bLo$z@T6 zr;>DQh7neh(Y^}efyKR$&=tNR^p=Q(dGjLxoU0ZAJML!&)+A~h$)Y^vTqTxjrJ&Q2 zlof;d&l)?+!`ln9s;y?`mk1GA)$ix!d{zzObI|1Ag0pb|vK3EC%N}jgJtQwaK|O>xd!yNI@Kp!_MWCK$b53q2>mcW-XZ~dr1|&tS*~> z$#PjuAc@43pm>JLG$+fXJDD%-$pYz5YNtV|n+~OBT9h(E=f8K?LmoS9iUVT*PVSeX z6rDaGmYIM|RPm*BudGYZj0BN~O;5HND`ezK{> z`m-2d{(gdIrue_TnQ-ghQNao)?#+fY25DG2epnyPE^oDqIAa`I2yo?809BHO87gmmc^wIYA zI~o!QS2Qjd%XhuD+>QB;LT$;QGQUsN7G`(gm+kF$XICcxTPB511R;_p`W7uX^=DDB z$1`=mOD0o39;j{9qq{QD@Oj_Z$wG3y?uFga*p;;FP#7gG1%7l ziZfC&g!f*1=;LdizXaNe@{@6t<$|Q%QCdrzr)@Wdd8SjN#CxrUOs?*pR3Y zfZORJ%+MWiUHIQZ8iNE?QyMt`5>(0gF;uL=w&UI-`9gwRYlSb%%CO(64XqpCJ5PFq zxNVHRqU;D2VoE-%gT6t3WkVL;x+OU$epq0z2SKYO#ox*OimzIB!P6 zDYX-$5#)`G6U6DfXhWh1l(FG~(&V(1^J7 zu8*M0b@=iB_$V7*$%fkHa)bLbCaudM<#((YqmygIogq7We;BlSRm zl?CW3a6nezmvmq|-o(8}TQcZf$w%CG0F51&i1LOSfp$0~fyk8sCN3BIKG0)Yj04OZ z_7NCW#pMd(9F$Gu$DZ%@DZ-Ng1b&fcBP78Lj)e`BE`&pW#>=@7Tck4)o2{iZIgbKs ziW$#GqHgk%+bT9QpNVXpAehP2ql(Jja&L-|4qqy z89AlWFg?Rw#1pJ=&y=k6ymg!~8%VVI!C?^$7Dl#1c>&4J97qJ&>n)#8rWRF9EHiCG z@?VnCH2oNVmjW6}o<9GRMk2{393-CS#}5buMW7Ft$f7n`;N30s0KKsjurU6)cguP( zUeCV|r_>V<4S@~S1lc0PFL&#aeEXQ*c`n7a>B$2S&B1QfG}!k${1Eri$!92n9U>f9 zQ{X!xMfWrc5V(%G`f`v(XMPltpf4D8h=UL?1a#4VS5o$C2LhJ_%K*0~G$UTbk1i98 z{mdsGdd>4o_4VvV{G3xCxiBG+KBVs80xS^=1bNnR3G4IhMsm6&6|7@v=@_Lo3XO0e zleow)+uOYLtAzT1p$7zak(G?7Uyt#|U?3fNOZIsVk$W0JUvD!+*ahME9zhCIVk5^( zjknr=6>e`|Lb_#?k!+d2p>97T;BreYp`g;ao{jW)8)X1A&lN%yn#x*Q_zvf zk$~KI(i_#1-+v)RGbjwl#Iqa*3OAWrf&wX_roPCX6<-zVrufhQ>_}7*4c8d5AAz)g zp&|O5GcR<|-`kTt#xZg+XB!+&031*pd-wIxYuJ4P<%L0$%4y64{k>-+m)?;;D0pja+?yjGO;>h^L0O07X)W+`~nz}iR1Or0C_ZY#wvxT16irL zN*?45o+v0sr_f07e4#Jqs>)<^>BkIzt$4a!zJwQj^cz2zVvA%FAw@7L(o~ukSs}TZ z8#9$yH@gIJZSM8ash9iKRm?rNZm?nK+<$vJrSIZm@_sz#_O_n6RHZ`)84i!)Ikva| zFZ7PwrSeS6rhK@AJ{s6IBG{U$7gNI744ptdX*;)$%>|>b^x2&fCjip*xn~1^fdtvm zUnbJq0-wDegFs36+Ia=J6j)%XW z{7>=0RE_8IYB)GQ9bTRNe)3MVa_MB?VfQ|CEcQNd(3W6B*zH_YEezgE1{X5j zI12byC?zs~3xZgm-A1?sZ%GiSI~Y>BW7U8^CW%VUDwNVTP%p7XHF&{M$!G48*A+?N z!O_(cpSxfikqShyz1-{PFPhl-8@+vhsY=Uxw@yHL2KFuj!iV%{NniC2jL(vg5niD` z6$1Y%BF9K@YX8!wHtSP=-;oAl>7gF6K2XzPADwZ=4{Au$iR60E5g{HTaJRy9)=DLv zEMkGRy*%P*=|T?+;jug>d!xgjcAxk5_nwVOn&O~d3`osn3i$)vCOcSrvV*4@=-Xt7>yoED zo1U#OD_cS4w|Rnpwafv}g-g!1&aT{9vj4p7s;SW6e2&_+XKQTY1}@C9SU!*;ui>JB z%TF-X?_yW}(oA3_se8>=dqLvf(yP2?(%gBk?lxJko~*Z&ojp(xcKzV%27;~^<}<}X z)@3PKOM|MHjf$Ql8v1*Uf-aAK&ON!8iFRHv%6Y-)<|^fX!3v|8=ZapQD{8s8WOQ*b zYjrL5I!J%SL927uo-f{uM;DYjU-fymrtEAqbwgu zl;x_TE9X4)Pb-RYMbVRU%Rz0FWE&;fMoG3&l5Lb^8zuQoM@i0oGq%x?Z8T&X4cSIR zKD}tjVrzPJ6_%PVppUTFm5&2Pf-_$JcyF`Q7k_7~UhTCtufXwng*C5)JIfn7LEtim z&N-50&xy%p51V)&NWmjqG?kp>D@ zRfTJkD-6EU8{0tE}v)_gv_NDKYbdeLDb14U`uKbNpb_$Mje|YqHIHLCbF#d<|%pN-Sa3Y(( zC5-VnHDi1D$4s<rKg55Tk8c_d7YB1gE4IBgsIG4U;F3%Tw%?Hijz zPNE?kqD+T@Z3l$0;yze3$aFiVJjs=DVZ6c6<}EVaPW`g^WKYM>O?p8r$9ISqmURzQ zqg?kZe=7SCbI*{fE+jQ4_okE%y~g=?gCXPz8iumlAPli}!?PS2>4kqD0*8rb5?wAs zAkxWwSvMxzWV(J3>e-Txx4cDmMho0G%BF(`Lp#-p*ihHIY?Z_YMjR%KJe~O@VAO*% zSlrpsT4e?pL?OK(Gh&Ox!^WwjkPd^m&2S{Uf1XnoR&<4Ij;5}v8}|zVf6D?Yh+7SX zTc$=q@h2c67UG#-IYy{j#uRnwk1s@$@RCCV$tZ>*mpB_Te;hC3_{N#d+1>1zrPqH;;{t)t1almnb_8pkj4TpboR+zZ1C6_Af3r~9EXcP}7&vTx6UAYhhDV1M2w5y1-!A_G ztCcBaz8oO+@`|*XLTV;bic>U!1mqPYXlgTsJeo`)^PKf;zL4BeU;YtpP7@-piV)wB zts=a1pY3+Ko4w8MrXOtbf5;@Mmpp~wmK>w7JMStMEV|EuBr)A4&jJTGk||Zmf0Kq` zLDs!m9kW^cRITq?LaDa$^dlw})+$cToGPouR8_5ts#Q_7DymjR)vBmk71j5wqN-L+ znN?CIRa7P-y;}8TRyie#q)!i+s;)?Nw6GZUh*eE>Qry*0Emhm+AE63qMbF7XmC^F5 zqBiqfNlNXSxv@)CISZ_1(rhTxV`%O-w}j)`Y{C~Glh(!V4jC7RQ;!#Bp@F%z6Mv3-yoSnvf5#+LxyuZ0 zN6=zu%O=CHwStTPS}SEeLpSTrValB=W;K>!8+9fkKZ6}LfBI?h|dkff^7VW z7{rU;dymf`UgHF<+&FG{e?_&gr$_X9Y7I2sfq|y#6*RAbrr_1{xD7Ps*UgF~ou%wE z<*%65J|nQu+Gkd1pE)SB&m6S&nN{0oMiC=#vExF{xo_S^lTemytP#{BvC$l)W%kSh z`4Fv*rusDjWQ`>_6wQ(H!BKe~+DsS74;E6YRjI5VcsQ^su=IgtV_j*FCVFY0y8;)r(^r#qyIjoH{RsXdXwyL+K zcA1{q2dlTRrN@8j7B=nTTE@zDkbjRJG-qY266xeft(8q-qP4QMMd?>&Wve>tE4H!~ zNcE53xMsrBQ!}p34a0)m`-vFWiXZBa(70B3a8_?qGe3XZe`jy|>}{XDt9$mgrqS=f zG+On1o!2y4@LYZ5rqRM@>54?urOcz{&(GF8DzMO+M^|VbJuEbj9=7Ju6`Myt5YMK; zcM`#t5SDDL(bFTbjvl5TU6}>)AzJHb<#SL_^+Uw1Y3FH9+vtarcgJTJ^G2^F^A%Xh zZnXxnaa8mwe@PmBt2IbFJD!ag3ChwikF%}f#JO)U3*S=P89OE2-AtpncWL&FT-FTe z>N=izj!=GVEp6(**3wq>RM8moseQP5OIv#UCvIuexZpB|w!{3(=CCmt2D-aMLzn#s5rl)3Sn;V7&f0_3av9lFF`5vF0t?=Be+{|Wv zNVN~B$NYe5Z8qP5&8F%hG_TF3;NkPQZ8n7uoD~T>OPOrSA2O}UMqr^e*(_?gdwhkLL%8cLn_Y#8r>USFLzVQh-`~si_i@F422ZoYj5gIroF&nH%L8Z(3TYt zJ`;A4KXusD@g`mLYs4H6f|~f5)3O0}k>lM`f5##_KIWu-?TrH**dIBO5j z9wDGqL0i9`9CfrNr;>!u1qq?oKtZ`ye{TgrX}_E(%F=#IR&%L{jT`w>(+Ohhg|w&s zEh~#Mv?VA!o4H0`$fbp6*Bc!`7x^3#&&~t@iV@}u{}Z)oi+h&T!JWI_?&`M#Qr?+c>}4`+H%_a}qezE^DUpx$ga<()P=!!O{?Gt<&5o}g605)j+Gf9!hrcRY(9=p*Wl zok=2Y8aH4fk4K%xTq8tpM%cPZOR>*PQf$4~J8w0^p#?A6weT_ zLVQ+Bo;YymbLb|=e|gtFpC9CsYFAaz zyPBeK%Ad$zmS0!vC)xT*F6Ae=FfYhDO%}0&)oSF;UX%;L6A!Uxa%x=VkSkzJx^L4>^%?mStIW;ysBO0Ix9GRsR9XVhWXTDGjgcOYk(kk@z z(bbfo!POZb^V(Ckny!4_3(Gl`VT~v$1p(%B#G+t~En;)8X<;T`)bO2y6xPEL(SX%E zUoKJDydCCIe_%4<{Z>Uu#Ll(1vxAPP>tY{V1t_8(K>@u(J_%xcqAh|0*C8xKT-BzO zC3lWz)4L906a~ZwvatDhyb%-FoD#&qs>{c*De`ED0_?yak?+DT5XAK zMR(K7X>GILx@|Vigr2Hp*7)*IoPbtszukTDlX=Rky}iBN@4~d3XEf_J?>=qYlFp1d zKJ~u~>`Ss#vT9ynB^5)(j7R(HLCr!!h)RT#FJA-%%vJ= z#Nbm;B_l^|4L&hvYwJAcOyAmHpMEf0QL3Qw@5P2e)uce97@PUz_a|KEd0}3#N`p^L zP1FL`o+4o4A@=9C_RKlt3OL}?xAq)VSbN%He}t>I_Gr0&-(uIX92&9j*yfWZ!3V2a zxK^9bK_N3g_}*+j*i-HV!djz>-|=`uu*jH8JzRULq^H9WFVJU0kfk_JeRL`8F%XnU z)Q~}!|3w35;y{pF9DgQEJK>aEd#aEi7$ihq`j8f!*Ef=&Gy@$jdG1dewvj|ze-N;+e`g6#)s(X`BhB{{WT)|oHpcF8#MlYuJV$Jn z?9kYXo@jvG(>C(OS2N6#{83=FQx~?d+QomZ(`u*Q1F=Xu0-Icl!+iaU?r<#jfB6!F z_4TVU?@J$@<%IrMrdY2PnC+sJIG$dc0Bq~a7kSjae(khYy9Cc|nAXz_)5_{_f65C{ zuh?pLu$w{PTdSSIL~FHct#&K6+STL*tF+q9sSjMhdRGKg zJjB7=*1I`}TmdJ1`qsO{3hP~4D{tl2JDK%4_P+a$4R=}Ud$59fYc<>*7V`7M@6B*m z7_5av?Kt5rqDN+3d%6cL4UjYQe@Vco2gU}~%N8~1w&b7U{!03F(zd;8FWn97Zt=oY zNrRj*PhcMf1ZcrV77YTzeCpZ6vlfoql9e%%rOJS%rV^GK%LQuDTVCY4TUF%%%cHmS zjeJT0Txl4ymcqqqAI?`iBULG}Zk5CmL!7?mB$`UCNk&Ym(OPTUx1Y~4e|P#@TicVg zwTUA=pS4YA22B`5j^AB=gN6{jP;OQDQVPSB7=M5eCjDmCqL|cmE2W_?U-X4TF1w2| z$%l6@kh@l48o4z~NFt;uz0%e!lHj;Ci#$!UNcM$XUNv~dW|70?%p!)hFKZT=>*?Hx zS)`uILXO&+MHD7lvq){;&=!fv?@4c!@nn60F|iZpNMbCw__5iCcj5ie9m-O z&GoF~K`QH7S0=+%gfQgT81Aj#mSHM)JtFOmM(g=Kw!?om9JEcjb7Nw zP|GS_5;vjHAOsspY9a)@+-w_2q=$WD?8LlkQpFMU+oM4Bc#GXgx}Qt4Uj87e3WK72 zqp|b?w=&9jKZ*8he{YHzH#Ut30i)lHf-#1de$dV_+JYu8%;N!3f@!4SgWed0{ysBuHDx6k?wJbP!68KUze?bI{ zQJ0+gr7fJWwW$eG_ZiJo{c`8o8t0WF%uxS1Nh{uIPx{VL!DD}2Y8HDA&Y0!65|ic|{SXS<#5 zW^c2*IsNA*{|Ab=jBpu3k>f2nMqzi}RR>TEvM3tG3O4s(li z$dHlB-d(h}t44T(S$GMW8tDEx?eyCbO-A<_q$SAEf8qND?WMF}+NZ~@0~<(xxKb^c zu2KSz?SR}8>#`7YyopP+p}|vLDb~Pw ze@v|i9QWfKS$KjSkA(=MDU=4|P#`h;!)m&^7ho;*u)`Sktfk8)w~DWCU-7kHD0T0z zPw`cqe}Vb|pkG$;RWkN^6kqiuIXP;p_)?f?6<@95YsHGMnyg@jimw_n|I<=>m7wq` zE4>y4>l;*h9aJd2+N9i#CgoOH&%R&HSC#-DQA+N|p!qs@dYUg&N*MKuZ&>}cl0?y| z`kQlPHeN98axL#OqZ%$*oJj>Iau}LbaIspee^m2kPzQFhK&I4hT4LsBoiuoj6P{?uVp$D3%0>AABR ze{g$xPY6R}7f&XTJihfT6aTfIWsg(Ac2FqcAFNNoR-G*J0ia)2!B#T%dK7H+1V%Y( zt6)=@XccU&f^EeLwwkP9g$lO1Pm8CeWh=qsQ`WLA3f4EMWjn0UvbD)GSFUAyNAC0_ zFW;|%ElYckD0SvzP_P|7Jq6o4a_8P7f2#8RrE*d>tY9;yfm}Y_p`IV66 zBkcPG2M`F5r)Dj+7~@=6gbQ4IdG|4|gzQo1h$4rrym6WZjct&&S& zqE&LWO0E?vxoWb46)L&viuX@T$yI{Kr>x{!6s#w&jo;YuP5&rq;%$)l>d-O z|913Mii}i#h^#{8LG)57f`Qf5tl*-WAH^}$M*YyT`Xwc8vMCNsHCu8Ad#|_qlTk-D zBO!*80JR9r}Mmyd*bY=tv*qacRx71r{n(jf4b*tLr+68i}xVeX1NiL%{$<|@t(D7@Ar0hcXxY- zcz3t=68^QD{I|yks5MKxZqPhl0O0&*7mtV=|1L1XKS+=cfk@bef2{U#z3~bh6Xj=B z;y}PE&%dk$F^{_X(?+L&j&C!j0sLQFr)GPpX^ZJ-&}A+3QLtz42@!sVk19cQ_g#%{15%(fxi>dfglVZ9u4kBs3-44QOQ6uZWSfekoK=AxN6e=4h6iX z)?K3tT_|oN)YRVw!NimyaN6TQUT^T1i`1U+&q{qZe{sTTG~(K_SeLXj@I}#4hk8Aw zSL!J}9@`nYbhIE@z`v9GpNrJSe?cyt(ASPj zK+p9vf0oUdY}RMDlfNKs&hadC5K+vBU7}h0d zK0n9Tez{*(Va>G^{mthcF|4Q6*7VZqILzSze^F%ykiA<^hwt0d!Q?Ni9q}Sagdjlq z@&@mY%}cWaCj@1FVV&KgD!b{UQ>|Pm@Tb%c5SS8pd0b;dV=}qLmzRFaKDNc>A6k!W zh56Fh54yh0B?H%Jy#>XWX2Gfqzh;YQIoms-3-^c?xV0`@2N^rA?qb&kQ5d+$yOFpj8~U!m|di^ zc-J|^o2TaR1Dn!1{H({}r#GA^Ak1 zra>sm46ZMZ_l9_raJumd?HR7AF^=4jf1A~7ZqSn6H2?>sVS$V44V^d^8ug0e#E zqWx9kA(cj8%vvs`W=Bc@@;>34rSv14xyGRC&^fcd9sDSyu>q7I2k-5rhu&e)D8>Y6 zRgnI}R;RE33E@{r!uJlF9+#e+6?1kKw6-(fqPf9RF2 zEB^}J80G=dCel9|Iv1`(*F|l{0TVn`&{n4}8-p{c_o;N)m~R&-w2HeXxG| zy@dYIohpq;7k72~Rk}iNJ=pmK@ik&b_n!B5pO?mrrZ%!2`DSDPmIV&Y-WlvD`6JtsJGv~Ejk{Y}8t`7CQ zsERoL__3HXHb*Nm*3&=V^p$Dh+|vyelj`DEo;%!3=tm$jJzR4(NZf1h|TZQf~E z$UF|zHQ<|PJg{?$jizf_95+p%l)N}TfypWi0%eI{$%)NKZsmex0-Sz_6t&W5N7x7I zYfFrJosBSXCX>>2#kdJ+mVuAZ2AG*kTX4&v z>yE$+E(*Ao`fp!chlNM-f7kbcyVdz>MqP;tjE_8}EUcV82DqZ7#}#O9G{R;?~N|PhA8LgU;8#j)GsVJ>_Wz)776zxl3(+lEYkqDRRCsxb+eSP>}x> zqiI0KKVNUmGmP4|fA@jA`RVKR#xEZr@Jam&NhD&12&K#UiTvvhP7r>YSrUXp3 zqeRT*`C9(1Q1*x^v=-J91mf%`g?uk{XO#0Z{Wi%zzgH+nf0pb_GVbbLjJcQIlhpYX zpy|9^ipVatsy85WTwOxH;{d9d-pDL}t?A^NheBZ7g#;uia zIE2QUJsG&Di?$Sx?8adqUHQouj|K!=E!`zBf<4Mk)|ysFvbs(2tu`I!9G^i7 zhntkIJOW<}>bX!cl$bz{T`TyUfe345$b(s(!0!1te+cgZ8T@|3F6(Cz?+1i;V-A?J z^P0Dfy*_$JVLjijW$K}tJ@<|JMWMciyyQ5U3$ISS@WVeE{@HjU87VL%4 zrxs!Ue}XWd^03B$x=S63v>~|q>!92h-=xo6g7us@HTs77v zLzYV;RmUOj1ZLzh4Q9ykLTZp8`sh-;W*8dLaEknhO?x8@#p1V=LvM!*n||cF>I>ga z^g8l{?yQqYfDGhD!iUks!hl90cqIb_4AA70pvV8>i3kvn6J%&Bc377F$vCo|e-Hw$ z;NQHg7eF_npSuWzCs>3vg=j|BMT4s|)h!@1Vmm^U)lE4vcTmI>fge$uxP&njduyZD zz*m5yBpaqq6j%+CmP|Wb`(30Oo#TL!)W^f*V;rZbecnqx50n4|LRG;KnSA5sM(P?% z&0{bmWR68jad*A(%Nv3N56ys(fANS$VS%Xt{THe?WPIFgYMF+Q`9N~4OYZ6t-dud! zswHF_R$sPtds^Z)_^UIUAQo5}N&7itpM#GJy+ zNdpUH;`C@o=UNcST-x}Cz}jCJ7757y!jOoIZ4MB8-a)wa>}_`X;_u`oRv!@aNb1@0 z5b*5h;n`mdo@6AoLk|JZK^~rif5qTQMoJ0^t{21dGu<|qRWu(<`aJ|>AG@W}`&Esr9&X&PiR*t<&kr6sTx;I&+} tTmVo@0Rj{Q6aWAK2mq>P{gdl-LJ6v7{ah!ftYN*AHg!4%-E;r|006rh@09=m diff --git a/Solutions/AbnormalSecurity/Package/mainTemplate.json b/Solutions/AbnormalSecurity/Package/mainTemplate.json index bf7b58f3dfb..327727ced74 100644 --- a/Solutions/AbnormalSecurity/Package/mainTemplate.json +++ b/Solutions/AbnormalSecurity/Package/mainTemplate.json @@ -103,32 +103,32 @@ "parserContentId4": "AbnormalSecurityVendorCases-Parser" }, "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.0", + "analyticRuleVersion1": "1.0.1", "_analyticRulecontentId1": "8effd19a-abab-433a-9184-ae67ac51e6d0", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '8effd19a-abab-433a-9184-ae67ac51e6d0')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('8effd19a-abab-433a-9184-ae67ac51e6d0')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8effd19a-abab-433a-9184-ae67ac51e6d0','-', '1.0.0')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','8effd19a-abab-433a-9184-ae67ac51e6d0','-', '1.0.1')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.0", + "analyticRuleVersion2": "1.0.1", "_analyticRulecontentId2": "da243bf4-382b-46b9-9b4d-ce6ffe9e7beb", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'da243bf4-382b-46b9-9b4d-ce6ffe9e7beb')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('da243bf4-382b-46b9-9b4d-ce6ffe9e7beb')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','da243bf4-382b-46b9-9b4d-ce6ffe9e7beb','-', '1.0.0')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','da243bf4-382b-46b9-9b4d-ce6ffe9e7beb','-', '1.0.1')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.0", + "analyticRuleVersion3": "1.0.1", "_analyticRulecontentId3": "51c6ba55-fecd-4be0-9064-1aafc4d3e8d6", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '51c6ba55-fecd-4be0-9064-1aafc4d3e8d6')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('51c6ba55-fecd-4be0-9064-1aafc4d3e8d6')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','51c6ba55-fecd-4be0-9064-1aafc4d3e8d6','-', '1.0.0')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','51c6ba55-fecd-4be0-9064-1aafc4d3e8d6','-', '1.0.1')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.0", + "analyticRuleVersion4": "1.0.1", "_analyticRulecontentId4": "b15ea4c9-58da-44d8-90e4-6591d947e7e3", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'b15ea4c9-58da-44d8-90e4-6591d947e7e3')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('b15ea4c9-58da-44d8-90e4-6591d947e7e3')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b15ea4c9-58da-44d8-90e4-6591d947e7e3','-', '1.0.0')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','b15ea4c9-58da-44d8-90e4-6591d947e7e3','-', '1.0.1')))]" }, "huntingQueryObject1": { "huntingQueryVersion1": "1.0.0", @@ -3331,15 +3331,16 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "RecipientEmail" } - ], - "entityType": "Account" + ] }, { + "entityType": "MailMessage", "fieldMappings": [ { "identifier": "Recipient", @@ -3353,38 +3354,37 @@ "identifier": "NetworkMessageId", "columnName": "MessageId" } - ], - "entityType": "MailMessage" + ] }, { + "entityType": "IP", "fieldMappings": [ { "identifier": "Address", "columnName": "SenderIP" } - ], - "entityType": "IP" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "AbnormalPortalUrl": "PortalUrl", "AttackType": "AttackType", - "AttackScore": "AttackScore", "RemediationStatus": "RemediationStatus", - "AbnormalPortalUrl": "PortalUrl" + "AttackScore": "AttackScore" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Abnormal Security detected a {{AttackType}} attack from {{SenderEmail}} to {{RecipientEmail}}. See attack score and remediation status in the custom details.", - "alertDisplayNameFormat": "Abnormal Security: {{AttackType}} email delivered to {{RecipientEmail}}" + "alertDisplayNameFormat": "Abnormal Security: {{AttackType}} email delivered to {{RecipientEmail}}", + "alertDescriptionFormat": "Abnormal Security detected a {{AttackType}} attack from {{SenderEmail}} to {{RecipientEmail}}. See attack score and remediation status in the custom details." }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", "enabled": false, - "matchingMethod": "AllEntities", - "reopenClosedIncident": false + "lookbackDuration": "PT5H", + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" }, "createIncident": true } @@ -3484,33 +3484,33 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "CompromisedAccount" } - ], - "entityType": "Account" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { + "CaseStatus": "CaseStatus", "CaseSeverity": "CaseSeverity", - "AtoCaseId": "CaseId", - "CaseStatus": "CaseStatus" + "AtoCaseId": "CaseId" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Abnormal Security opened ATO case {{CaseId}} (severity {{CaseSeverity}}) for the compromised account {{CompromisedAccount}}.", - "alertDisplayNameFormat": "Abnormal Security: Account Takeover case for {{CompromisedAccount}}" + "alertDisplayNameFormat": "Abnormal Security: Account Takeover case for {{CompromisedAccount}}", + "alertDescriptionFormat": "Abnormal Security opened ATO case {{CaseId}} (severity {{CaseSeverity}}) for the compromised account {{CompromisedAccount}}." }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", "enabled": true, - "matchingMethod": "AllEntities", - "reopenClosedIncident": false + "lookbackDuration": "PT5H", + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" }, "createIncident": true } @@ -3608,15 +3608,16 @@ ], "entityMappings": [ { + "entityType": "Account", "fieldMappings": [ { "identifier": "FullName", "columnName": "ReporterEmail" } - ], - "entityType": "Account" + ] }, { + "entityType": "MailMessage", "fieldMappings": [ { "identifier": "Recipient", @@ -3630,8 +3631,7 @@ "identifier": "NetworkMessageId", "columnName": "MessageId" } - ], - "entityType": "MailMessage" + ] } ], "eventGroupingSettings": { @@ -3642,15 +3642,15 @@ "CampaignId": "CampaignId" }, "alertDetailsOverride": { - "alertDescriptionFormat": "An email reported by {{ReporterEmail}} was judged {{Judgement}} by Abnormal Security. Original recipient: {{RecipientEmail}}.", - "alertDisplayNameFormat": "Abnormal Security: user-reported {{Judgement}} email ({{Subject}})" + "alertDisplayNameFormat": "Abnormal Security: user-reported {{Judgement}} email ({{Subject}})", + "alertDescriptionFormat": "An email reported by {{ReporterEmail}} was judged {{Judgement}} by Abnormal Security. Original recipient: {{RecipientEmail}}." }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", "enabled": true, - "matchingMethod": "AllEntities", - "reopenClosedIncident": false + "lookbackDuration": "PT5H", + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" }, "createIncident": true } @@ -3748,32 +3748,32 @@ ], "entityMappings": [ { + "entityType": "DNS", "fieldMappings": [ { "identifier": "DomainName", "columnName": "VendorDomain" } - ], - "entityType": "DNS" + ] } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "VendorCaseId": "CaseId", - "VendorDomain": "VendorDomain" + "VendorDomain": "VendorDomain", + "VendorCaseId": "CaseId" }, "alertDetailsOverride": { - "alertDescriptionFormat": "Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise.", - "alertDisplayNameFormat": "Abnormal Security: vendor compromise case for {{VendorDomain}}" + "alertDisplayNameFormat": "Abnormal Security: vendor compromise case for {{VendorDomain}}", + "alertDescriptionFormat": "Abnormal Security opened vendor case {{CaseId}} for the domain {{VendorDomain}}. Review related correspondence for vendor email compromise." }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "PT5H", "enabled": true, - "matchingMethod": "AllEntities", - "reopenClosedIncident": false + "lookbackDuration": "PT5H", + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" }, "createIncident": true }