From 6902f84bf841d75ced4453cc33cb88e22d38a75f Mon Sep 17 00:00:00 2001 From: Fenil Savani Date: Fri, 23 Oct 2026 12:59:09 +0530 Subject: [PATCH 1/3] adding audit log ccf data connector --- .../ArmisCCP_ConnectorDefinition.json | 104 +++ .../ArmisAuditLogs/ArmisCCP_DCR.json | 69 ++ .../ArmisAuditLogs/ArmisCCP_Poller.json | 96 +++ .../ArmisAuditLogs/ArmisCCP_Table.json | 50 ++ Solutions/Armis/Data/Solution_Armis.json | 45 +- Solutions/Armis/Package/3.3.0.zip | Bin 0 -> 20136 bytes .../Armis/Package/createUiDefinition.json | 8 +- Solutions/Armis/Package/mainTemplate.json | 670 +++++++++++++++++- Solutions/Armis/Package/testParameters.json | 14 + Solutions/Armis/ReleaseNotes.md | 1 + 10 files changed, 1014 insertions(+), 43 deletions(-) create mode 100644 Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json create mode 100644 Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_DCR.json create mode 100644 Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Poller.json create mode 100644 Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Table.json create mode 100644 Solutions/Armis/Package/3.3.0.zip diff --git a/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json new file mode 100644 index 00000000000..6c237e22410 --- /dev/null +++ b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json @@ -0,0 +1,104 @@ +{ + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "apiVersion": "2022-09-01-preview", + "name": "ArmisAuditLogCCPConnectorDefinition", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "ArmisAuditLogCCPConnectorDefinition", + "title": "Armis Audit Log CCP Connector", + "publisher": "Armis", + "descriptionMarkdown": "The [Armis](https://www.armis.com/) data connector provides the capability to ingest audit log data into Microsoft Sentinel using the Armis API.", + "graphQueriesTableName": "ArmisAuditLog_CL", + "graphQueries": [ + { + "metricName": "Total Audit Log Events Ingested", + "legend": "Armis Audit Log Events", + "baseQuery": "ArmisAuditLog_CL" + } + ], + "sampleQueries": [ + { + "description": "Get a sample of Armis Audit Log Events", + "query": "ArmisAuditLog_CL\n| take 10" + } + ], + "dataTypes": [ + { + "name": "ArmisAuditLog_CL", + "lastDataReceivedQuery": "ArmisAuditLog_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors", + "value": null + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Armis Secret Key", + "description": "A Armis Secret Key is required to generate the access token." + } + ] + }, + "instructionSteps": [ + { + "description": "Provide your Armis secret key and table name.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Armis Secret Key", + "placeholder": "Enter your Armis Secret Key", + "type": "password", + "name": "armisSecretKey", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Armis Base URL", + "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", + "type": "text", + "name": "armisBaseUrl", + "validations": { + "required": true + } + } + }, + { + "parameters": { + "label": "toggle", + "name": "toggle" + }, + "type": "ConnectionToggleButton" + } + ], + "title": "Connect to Armis Audit Log API to start collecting audit log data." + } + ] + } + } +} diff --git a/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_DCR.json b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_DCR.json new file mode 100644 index 00000000000..63495bd80c7 --- /dev/null +++ b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_DCR.json @@ -0,0 +1,69 @@ +[ + { + "name": "ArmisAuditLogDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-ArmisAuditLog_CL": { + "columns": [ + { + "name": "id", + "type": "real" + }, + { + "name": "time", + "type": "datetime" + }, + { + "name": "timeUtc", + "type": "datetime" + }, + { + "name": "action", + "type": "string" + }, + { + "name": "additionalInfo", + "type": "dynamic" + }, + { + "name": "trigger", + "type": "string" + }, + { + "name": "user", + "type": "string" + }, + { + "name": "userIp", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-ArmisAuditLog_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend TimeGenerated = now() | project-rename eventTime = ['time']", + "outputStream": "Custom-ArmisAuditLog_CL" + } + ] + } + } +] diff --git a/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Poller.json b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Poller.json new file mode 100644 index 00000000000..ebde7598438 --- /dev/null +++ b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Poller.json @@ -0,0 +1,96 @@ +[ + { + "name": "ArmisAuditLogPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "ArmisAuditLogCCPConnectorDefinition", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-ArmisAuditLog_CL" + }, + "dataType": "ArmisAuditLog_CL", + "auth": { + "type": "APIKey", + "apiKey": "[[parameters('armisSecretKey')]", + "apiKeyName": "secret_key" + }, + "request": { + "apiEndpoint": "[[concat(parameters('armisBaseUrl'), '/api/v1/access_token/')]", + "httpMethod": "POST", + "rateLimitQPS": 2, + "retryCount": 3, + "timeoutInSeconds": 120, + "queryWindowInMin": 15, + "headers": { + "Accept": "application/json", + "User-Agent": "Sentinel-ArmisAuditLog" + }, + "queryParameters": { + "secret_key": "[[parameters('armisSecretKey')]" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchArmisAuditLog", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project access_token = tostring(res.access_token)" + } + ] + }, + "stepCollectorConfigs": { + "fetchArmisAuditLog": { + "shouldJoinNestedData": false, + "auth": { + "AuthType": "APIKey", + "APIKey": "$access_token$", + "APIKeyName": "Authorization" + }, + "request": { + "apiEndpoint": "[[concat(parameters('armisBaseUrl'), '/api/v1/search/')]", + "httpMethod": "GET", + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss", + "queryParameters": { + "aql": "in:auditLog timeFrame:\"16 Minutes\"", + "orderBy": "time", + "includeTotal": "true" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Sentinel-ArmisAuditLog", + "Authorization": "$access_token$" + }, + "rateLimitQPS": 2, + "paginatedCallsPerSecond": 2, + "retryCount": 3, + "timeoutInSeconds": 60 + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.data.next", + "nextPageParaName": "from", + "pageSize": 10000, + "pageSizeParaName": "length" + }, + "response": { + "eventsJsonPaths": [ + "$.data.results" + ], + "format": "json" + } + } + }, + "isActive": true + } + } +] diff --git a/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Table.json b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Table.json new file mode 100644 index 00000000000..3f3895ca6f4 --- /dev/null +++ b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_Table.json @@ -0,0 +1,50 @@ +[ + { + "name": "ArmisAuditLog_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2021-03-01-privatepreview", + "properties": { + "schema": { + "name": "ArmisAuditLog_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "Datetime" + }, + { + "name": "id", + "type": "real" + }, + { + "name": "eventTime", + "type": "datetime" + }, + { + "name": "timeUtc", + "type": "datetime" + }, + { + "name": "action", + "type": "string" + }, + { + "name": "additionalInfo", + "type": "dynamic" + }, + { + "name": "trigger", + "type": "string" + }, + { + "name": "user", + "type": "string" + }, + { + "name": "userIp", + "type": "string" + } + ] + } + } + } +] diff --git a/Solutions/Armis/Data/Solution_Armis.json b/Solutions/Armis/Data/Solution_Armis.json index 68a4e4faed2..28f989db46f 100644 --- a/Solutions/Armis/Data/Solution_Armis.json +++ b/Solutions/Armis/Data/Solution_Armis.json @@ -1,23 +1,24 @@ { - "Name": "Armis", - "Author": "{Armis - support@armis.com}", - "Logo": "", - "Description": "The [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.", - "Parsers":[ - "Parsers/ArmisActivities.yaml", - "Parsers/ArmisDevice.yaml", - "Parsers/ArmisAlerts.yaml" - ], - "Data Connectors": [ - "Data Connectors/ArmisAlertsActivities/ArmisAlertsActivities_API_FunctionApp.json", - "Data Connectors/ArmisDevice/ArmisDevice_API_FunctionApp.json" - ], - "Playbooks":[ - "Playbooks/ArmisUpdateAlertStatus/azuredeploy.json" - ], - "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Armis", - "Version": "3.2.0", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false - } \ No newline at end of file + "Name": "Armis", + "Author": "{Armis - support@armis.com}", + "Logo": "", + "Description": "The [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.", + "Parsers": [ + "Parsers/ArmisActivities.yaml", + "Parsers/ArmisDevice.yaml", + "Parsers/ArmisAlerts.yaml" + ], + "Data Connectors": [ + "Data Connectors/ArmisAlertsActivities/ArmisAlertsActivities_API_FunctionApp.json", + "Data Connectors/ArmisDevice/ArmisDevice_API_FunctionApp.json", + "Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json" + ], + "Playbooks": [ + "Playbooks/ArmisUpdateAlertStatus/azuredeploy.json" + ], + "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Armis", + "Version": "3.3.0", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/Armis/Package/3.3.0.zip b/Solutions/Armis/Package/3.3.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..06fd51613e89fe9f1c5753fd3fce659eb16c8842 GIT binary patch literal 20136 zcmY(qQ*b6sxGoyowv#WmZQHhO+s4G^Boo`Vt%+^h$(etxeRkEZ>WlZftNMM|iZY;J zXh1+fP(a>l8hU?_Uf6aZfPl6!fq?!UAQNXZBUdvuD^W9ZD|;(fD+haeYZnLmE6p$a zjWOh(9R(&sSWQ;42`R-U#&e!O?v9v!R&Y9Uijv}Whw)?8>789$ztQ!q3uYH2E|Sq2 zKj)-NecL-*+KRqLF~-;4@^+>!Pe=n#SJ`RmOy{vh!(3ANvgNZmq{h)E>qU=Hp8f0? z$6eR_8y6Q3#qOPzv3-%+^7OGx5q=(zQ8a|10Zr1|D+^ICX7`wt%e6&JQPdgxDDY9< zG|a`-`t7F2T99x!>yWJKmSRmjMOn4zELEZrBjOgfZ%{x)6HVGtT>%i0pW zb;b+(Z6AruG!0iuKk>!Wv43=F9$$*4`m-*5*E)ym+hy^NgAObG%Wk99Ki>qWy)8Dj}rH#als0!Oq3UJ-|d^L#^YIt^nYGAcJ@X->`zE( z?d$gBiY~YQurxB=)#=R;xsPnMOlgCb(aFp*QF+PU2cczPS|Ule1fdx@)jnzm)wLji zH~OTdxLfN8KjWJ_-&VQ`a=DDt_fzb#2XTd^@9Vd$S#gIqju8}Tce z`fjp>>+%*nZBJ?rD-(xpAO#dUHzDxiwhcih72*%d7CB*L?Du`~WSGhGLILK273D?p zzvjHqb&XteG4&+}Z;qd?@XS{ox;g-W^eLvcIccNgrur1z+7U-*=jqttTdfAUil^>? zhu|6dnnY}Ha<8D@9qyp_`J(+AzL?Qi-!Ka8kNpAPj)W35jepY}bevk`2Y+p>kO-R2 zov)jE+C7Hs%H=YEfItx+>V<`SAv^etWjz~%CPmCJy@_j82=nOKxH!QLu)A4+M&&DJ@pcTYDneQ6LX}VVp+srbpxu79jLD){&(CCB7(F(1Yt`>Zo~Uvj8)y z6@b17C7E+CMQFnd`_akMS-M6c7IYYvR;HMk*PG^le1}|blRKhnQ96C#$jo$BkAkhv znRh-(TydtCe6y5SY()8$g;0`RoeYJQ0ZOJLNO?1xz2bV?5+W9rDMHXN)3o2Cg7P4C z{gIC?rP@v-&QpUs44sLYpm5Nc7}9@Z-DFP$fRW>4ct3vf1wa-@w-3ZjHce#UhM{vt zqxO%E3atcK75Yw7Gg*B+y-hBrmnARm$jKYvje5*4M#dwK+JBiDbpnBQ64wu_hhoulvt!R%E!3WdU3DCn=vB*+d zK+1r<`B2!DB+M6?F8`70S5kp1KG+Hsh);$jArz6p9DLIdEQUdyh|lR+uwlJw6}|O@ z+v@C3i8)}34INx~DF3q@yS~Zw-DUgP9XpdYe}@%0m5(!c$Be^3T04HbI(oplEp^PE z8z%G(1_$C`X9OU!a=xe$gTAPH2Tmj!ntGS#&Jgt3VlR;*Kj6fisl3A@mfnea)>$P` zM5K8#-oH)WxFLd!F^bRMBrKV^eo?SA*!U=4W+VmH^L{Co=b>O*L^uQMR<2tp&6GoV zZLA?Snc(uMKnp4(%Nl2MJ9CGv2QVOlGyzc^ONSzugVB3$gf zsYbU2rsAXzJEJPjLdc5R?|%N9ixc`|9V7es*A*=3)BR7o4I4or^$kY#~t+v%Ofmm#JBo^+FJ|iuuW6P5{#eyoq z6g3k~mB-eM<#2nzc4n1e7Hzh7-m-l9cPqmwZd0l{hLP)sy*p~iHODETD1=7AusMu8 zGN-z-L!wAEXI6F5gZ{ib8UosF|2@(jSRqOW<+^8+j1#QzCe7BS#QoI@HyG1UItJJM zSgYGR3$jHv1ObdcljZ}15UK``9au8zL1U1Du8_{3TvzpgFQdGaHHrS&+GZzNd2bPc zcb@))z3Qvkpu${W{neTZkCwtKb53Y_;i6$_tP61gCo1FUMd}9?%wi^g4Hm0TRR6}a zp_lW8w8loEH@ZKK#G8QwxOtZIe6hmOS6R|zpbhJ8*zzBSP zLkk!8IywlYc|L;0VMw9e0XjSH)7MZUJmu5KWX)gmtz^v!bSfNtUkn|792UE0OMN~% z`J+JG5s&nf&Cqs3r@s5OUe7Ec*IzU<5*gnzhjJQ_I@a>9`U4J6$ffEMP)~ne6p(~1 zLl;f^jVWJ0l)6grDR5Qb+p6Dd-{D3t~US82tI;^qNR zU&QY*jniv3Uhwmm2xH2dt9* zBSO^Hxucr1K*xjbk(p+~Qb81-yiAedcltz>T zIiz?DWm3)|CqEqAfRI6``114mT(fL{ zyes#M=INfP&1du!I4mRC8j902y0;W(mOL_`52}xZk%>=nNJ^0Rb;A>2ky2g%&A+|v zzrkqbQghA4)m}NR8!+!zh{Qmi+-vCKinhPYUq~R~0gHnANcvf4!B03l87@#x(eJyK(Rd__#<9;QMr@@XtN}m0D`1<`Vmc zX;Oe3&lMHW@eX;RqA!r-zDkDmV9P#ajkdn$tTRHCA3s z#4F$H0MKKr?Q$8_%Ql1I{H!8sOw8%%h~ms`K<3MFk#ytiEAz<`Y~mpF>IvBn5w4ve zjUZjQ*BI%EZ=Rp<5$kCsoBUxrcaU4UzDSuD@3D~horcn0)-q9?cMj~J5mEK`--?F( zI06}6h*f-SY2~H9^i5_!!1HyQi(|-3(m78u&*SuT;GJhA;Ss>&B@-A!Zru$FG1o^D ztEldH+nwu&jKDt<5!^2cv*q*+Xejg-b?4{wRct2`-wZ}X$bJ(?{ zB@soN1(zxfkq(n1H}z$1LZbXK!3ZCc$xzd5_pT_nd_Jc<#tE_y>XMO!QuR$`F(UML zbs?%VgpWWI2cO1rah~2{ESG+?B9Vm`BM_x}*Ux<0klP^=EL7BzGe1_Zr*k{zkIT&W z#^xxWr+5uV3pdhM`ETE=&*@fX3 zU?htR=KUJ9i^ zz6Q1)oExGyf$&rG%6E!;C*ja1@3dVqbaZ?J*2OlOEa4sf3D--o*YD{1>|gUL-?mIG zTOy4b%n@pIM%c>T8z>i6pv?PlMHw4%)3!8605G~f3t z2(h}pRLWLqE7{1xe#mUDH~riFg>Y2z#TlE*>o)NP=c%S@An}&r^G!te-IAg4V9~ zTaa2)6}$X*Qli57KWOHz$N~agW;N|dJ{+F(>rQvV1a02gK1#+INt&Ld=L6_$GZwBA z$zlW!-KjBAvNY07Z9}X}uqvlE55T8Y`PM`onVC&UV_rg?`LRUzgkcV08M1dOZa!xM z6hhh$o!C2+2y;E{{Q1{@Tw5EpX_sBCuruSnyAd!bWWz6J&21PLnkVlu-QtY~R}l?0vaNtQjHb)-!dfTbovI>GKD z=2j&?e^%Jv@%2I#Wl}m>VF-E?3BSWaS?|@jULUrqcVFf#?p866ko98SrO8w2Z73`J zdjcMg53%2Iyl5rU_sF{`ZYULASFmt*ehXQts%NdLE7;9Sr!HoYPniT&%a`=1QRgNl zvedKKF1NjUL;FlAJv{lTYM`>qHdDw&&h*!<{Dy9ydfisv;L`tNg@0vZT}w<-neI(R zk7`|=4fZ_Y)l62m2)@_DesAiSa9JJ$nTsmaBLJ~O7ST)sVz>T39wwd7IMks@XG{0{$?&p>QsZ##$=IRAU%n-i|$8aSs%$7=y1(JnJ2AYErJ*r_He- zm!VeXE&c*)zXvT#3-wlNTD=}l|Re1Ziw0|{=koAM03Y*OMQUg;rR3=;csmLNtv?j_oDm2eQwTtzr<7}+T{&*yC3~eroU*OW&WJpmN0@yOw|^h%xVT>X zVzJL^tPDDA6}CPZtzHiMx7m69vGd8O<{NV7?)t8$5_;kX% zFB*RlJk2(ofSy_SyDrlmxH`-E$Z*8E^ue}^yj9= z(fja&X>U`TL76aj*}(9{vj4go|1#lk<(Y4$U$qsHY;Apd2~*US+~Lkv9Am!b!MDuo zZdIvlsH4C8ENVlQmbW?GTFV{=9d|Z2d>3J6{yOMw()Vdi-iW`nexeSKU(sh{W0Xe9 z4kvEplZ3_7H#SD4g?1I-z_@t|_UnW#Pv->+?|v&4FZubmYEACrY|0`H&fE|+l0#$d z41})BblI8ghNbk*AB6);$rH-S4|6MhKuI-9oBYH|iHN7T4|J+O> zSM$%-L-R(vQQ3;E(CD}GWx@LNo}n)(@F-(Y_#y6_g=CM_JtR(90qT$8*Eq-Uv%t_{ zwznvZiD|WO#9KdSuW4KRP7dDE+lz_ac6bE|3_<=%4{rsVb zOvf2-L|)Mcs8olOk2;~)LY!H06=1J){dTtu?=vMN-}zQ0D*!^^_dClg6{Nt?Zdp}i zSi*_|*CC-l*jt3$_ejlK1j5fg>6C!&J!#E&Se^2s%;wOmkpNt zUM3uy)XZ&ovSRX$GkT2Tnq{lDypUMHLUx)F5Du0*O?Jv^_r09tG%*@InqOd2JRXr& zu;_)rC-wsQtKh(0fHxWpf09BAl|=sc-X5a>-f_g>r(=e}j*)+)aR8XoWvPhQDrL(7 z(l=D`U%7}YwzV}HvHAfdpnN-JS^ zbhvb72XuB^=~WQnwtRi4rtSLda@W}ftfbqt5n8k& zCAL)Ofn|wEYS7uaTka9wC>3BF;H!@mpUbqNqOU3z?5Y#tj7C-=SYO!X!mh+BsE8M+ zS*eU$>;@LJXTLil0D^wfjxr8x`4=4m@UQ|i1_0`lw{B&Q>(bB@DS;FZ^)w=s5pPI1 zwEq*_U)pgyUTY*-kv`8W!mrm@6oi@~1jwG?#grbuMa6@0@ zja_q9D(x(~YrcAq#)tg0uYSeGBMjS>O4Fw{bawPJm%cdgS@)rOrR1E!v4$h7m_(2{ zD9U)(Ond3{>g zphk8zq&zgITd(re&3d@l=yETTLb?oI2$=@7q|B#%rC{`xb806zFx`*{#Ic(*L$pJ! z#goi~eJexuvA!Sg_1APSTO%bo{ohZ{Qs^i%%OcVP%j}m>ng_MyK`FktD!Us=G^=Tm zK%%GM=_lbPk}_#>k&(#x)zq{+5?%|P2%nyixn+-*ccxv6v(%+ z15OZc`QC(X2f%scy^33@PjHP>-#CB{(;W?&hz$?rs;qRN@I@8>#TsLF7;x`fYSYSZ z#NGaf^U;DC=sl|oRQEzjwvItgB@uRv5{iN{zV2Oec9>`U#9Hb1vr~t z=zyHrfwUIM!|^!i*%|aF(r=+a%K@dnV|fK)&NE60nZ##G3SM{=$MmCksa^5~sn?&Nt#QgWR z>yJxQi4lx7o6!O~L&~V^$aJ&1)p89Zz@9qAP~9Xh6R12MqDq43^nCE}=&yPiLs+@ID!Qa( zu<)qN8q<^_;LpjYr0gFB|JFYW5`pSK|CAvw8-!A{Gf{mSUnV~GFP_lsk!R8S1MJ*M z`pj}?v)1-Gjlr>y?~T40NER}c5-_n6LFhj73|ZTzK5zp%4;;teJgh7R<;Y$eoh~z)Np<;g#OMDy8?wMc28Jf)qCu zL|{g!mgrsKAEDw`xTB(D}&Zk%O3xY|I(c*nxZyx)Og1-U~2hYxYf|$;uDNbKUuG7 znIat)0#KiLT* zPg+?1NSA{+-1f^>mDMl2^c3~AUoa(EE+)v?e#$v7e&BZbxnH5>>xVmwbLk=o<9d#@c1QPzVrmnp zP2jjdRa$PI9UYiEebeO6;oLzV1H$jN5ceaU^8}?8V)x0Pea<3=2oY=;Majt8!wz2Ku6L$c$T%%Qq~n|!vx^KuPpl5qb>EgY)B2~|dJ)9_ zMp0rHD)*TS)7Q9YbrAm`lSth6dw8;^guH`KnR9$NzzOy$7AqDDQUHZNT=n~gTEg3v8=FhC`9q}%S)un-R#)AUcN6WJwlT&RK zlgQ4c}|!_ zo;fr2NFhuNOMxQ$Fuxb%hZgGq?CbHqb8{x?IL)zY>#WNNi7`?Pd-jj5aS~yk*WZ*9 zaHk1g>Qk-95gB`5?#!G|&-ca3RS5LJ0r zNh~N%W-G@8)igOl^X#=mhc@m-TB!!Zh0p=3fi!9s=Ca*prb}Dl;Lc~ZUMbkCOp?0j z4|$69J#R4(cL4gbnDe*5j9UL{MFH|=M}H%^28T5YMN^cmNvCooP4CZ=AUb>M&c7Z7H0bc5WG7i85d^XPnCVsNrNE{Q0+}4oes<2>GBR@X7(i~8B#fq$8x}= zou{=~)_8q8B$eVZj2%p;@9BqV^mNJ5_c0B{x=Kff|x zN!Y67PGj#vGJ-ban3Ji$rLgxy!@ZR_OP?=EWeAN(AJdl&Rg!jaqBHAE>@LH!yI4jd zn){woXmXrF@C4Qkp1`<-pvio4+d!Ln>ep@If6|Eu&!KyYbx03yKAQ3{+{c(YB;1i?c0jDf~lA1yTi-qVMd29;0(4Ga$n zf~%`8$hDiE*}~UT7Ie!#khteu?pU88(Vb6Z{KW_BJ3nJ2bPJ#r4)QE{*G5ZJhf4wl zvw(nyY7-Wi?3h%*Sz<9Z*S6N*(-bvnV3^RlCp(c=Bx3648JpB$MR#uz#L|>LyIK?T zB*`&R!#;_WJ{Xz3ehcaS8T~Iv&N)Jsc zr>$8jIA+thYU5^cO~})b%YvWRed>> z{T0*gn52u1pG6TgU+oBkov&&gW!=Z32e^*}vsg8*$erN$$97j(ASSJA3IkxzH#OWJ zT5MM$oX(&Qc?~s$PqWIDuh!TB3d8L&*2u}V4NNU@AizSN@F z+&Nc-V=$|4$O@7%v~$2I(>3ZMo|NJmWWXe1WEfT8Jy@Bd&XDvbW3S9n(?&ffyBy|5 ze!=Oqpl7=G`qAVcVZ#16V1d3&^9)TrNX&AlAvDZodvN$dBcX5@&=O=EB81$hN~Q{w zrtgiSHAdUsq20K=m^2g!RmM;T=ZmennJU;ME56FRW5R8wD%X&lxRw57PnFuN9v2xq z%wq<#8rNOCjO ztP&|REUCNra(I$U+g1J-DC)xg#~#Z;pl*Z1qM^y_!3Pj?b?lbvKC7i{t@%LzSq}vY zIx@eA{qPnmrn;4+2+ctS3HY=?q6N9b26OMh_(n^*5ffw*>PdG^R-mxZ%qij4UAcg% z=}<{1st2JM{zZl*&qY_jr2ERM6~`80A|%KiBhks!5FJPe;#&k!-+}t8$&((KvOu8` z@U2eRN5e6MZm7GAR2+%Lye;GxB!4d0unE6xtcaOb28!lJbDF7+wd74^LEXQM;HB91 zWy4UU(IkwG`q~VlV$X&m&OE=#X3CebVAtR1O^XFDcN8*SkG}zO(9Spr5VCYYR1Ly!4glu-zPW0DeT7p zJYPQXUX;;H;oGEPW7^kjtk}BoZ1!liTElQ~@jUucU#!9dsZXy*AfQ+8uR+zK&v}d^ zwgoA8eMfc7{wFmpoYpb*LOkhvQ4547CYWNnH+X~)h*`iga0)W`&IWO(75Hz@HpnRa z;z^2_T%GSl|FX@%BCg{j1YURZ?&e_nGCPovlBDyYMA zp5gR+UuH9Cz&X(S5|qvgn8pf_in>$zwXHe!h0z$qYyEbe$;C;Vw`aXKp)a&}6$Jm( zfX3I}06$1Z9XqZIIAIFuhISq&BRsdM`X@pK&!v%yPmp=;!h%M8I-_0z^h-O(^be6$ED`@XYxvuthUH zR;514;b3s3Hmaz)?YZ}Z4n5J8;oS{00j@3$ihl6aGoSu=gHW)j)Ozwlj-7wG>L^B{Q zt9(Zrd1(MX3;gXzTOS_3u+AMAW}*C-SLst+dP%UYcP-JO=J}8Tx4WLzDZM@%L$BZpD@^=ToBvf zSF@HWeMB~W=aij)&hhs54p{)@kOyViN5)r3SyKQ(bj5WxE^FE2K)6Y~)@C5evJ8$o=P)=kQ9+>z zG~E)G*=S>Km-KNhw}7@}Juk-Et7mg-E7!@*R7W5x$>Ec$J1ocMmU&-tD--OBG+%;& zw`9-P37ZCpy zX8Fb2&~7QNIS`W_bf#g{CkkzD7&xaZjbRfiGsu}Z24w_f4{LgaDE}<@_UWk`u3>=TwkU*P zC*Haba_EwE>1XbS6UVaHz2rNhF`C+;sho#oUkY7|p_8}tn(+^=?yu^-d-YSSO#cji z8?3g`mD@!KTi>;1Rr$%gze0S^5~MQ?@VX)no8G4IfPwG|`w*``A#02k&5-`hg9SNwYGNQHyd*39oPRBcJ}8E7KJhcn}Wt}iBo7qc#Q zCVEMiiA(;gToSA{4K^PDeT}RT_y(tj_8tuFv}d(~`^H-7IsEm{uzI;1FQ?`3RPT=% z%MrRIVsVX38`9ZLy#K8jUF2}e6fVNrzC6n|Xu{h#1*_->)ECJ_YL)=+;ibyMx=lHwgtnBt&Va>9{PYmj zP~Z=)&L8=Ova`@mge+pgZO`pTot12rT>!R32ZSy>RgZ&_AtEmM+>;;KTw$Al2rg2z ze^Ub-ugM?)7l;B{Fa$*Dq_-In;Eopc6rG5OtT#|Umr4}Zc0zvbXeKV~z8iAF3+tt> zP%@x`xm)Po(rerB$GEuA^;ZTfRHZ$|KLDb@RnHE*=xIME4l<%hlBEc$9SF@=6i z+b||_>8;1kHz;qYV8_4v>@R$>8#j9JE=-w@p^m3=;n#AZ$otJd5#3d zdh?QKwj>9^I?Ke22uL3-3>eRxc{cblIKLPAC?-zif32kc(bD}u$0Q2Di5N1B1(Qii zIVejaq~={^VS#*T`pm)uaFd*Z8!IB+z`iucaacO3jA*{9u0H}|qC>QP|7il#f0_W; z70Ra%(g0t#l*l=7m%bDj_~+0<%cC7P-FqR3E{^Ic>o0n|$8P%Nq$!ECz_=H(Xn^c3 z!u>slT$uH?^6cZe?18A@mSau?`<^E`+@P?}1^%9?v-nAaZ|M!>W;AfCabNZ8A4i&% zQg%q*m~BstkW`1pdq~gdh|sb>-TI4n<^3(QPtR@V-DJ?=#nLgjC-i?K+;);Qnn#g- zrU!Z#?+}7{Y;|~HEE|rxBp9w;Z(==0H#Sy$9_3ypNbAUwQN64_`+>=#G4Etvk@apt zopZq1n$_X8Hs;e`U?)vzJUc;(Lac>1Sk2yuJRvZaE9Yf-_ zcKen*=I9Ksf_(6qwj4uQEMP{vv$;^ZWex6AUSup8-Om_CR>4krB2}LDPk!sx-G#n4 zU!safZDX*f0~^N$cSQadcdOvKp(p466|EA=OJWAg@5GkCbm~ho#VhQ=d{ft0c}cEf z+bizYCI!V&Te62B+(*F;;mf%~C)QWreD3&u2-g!(X79-J*7yszHET8XxnzT9-|p(Q zu{^P#T`DE#W7#g)q0BZw^rP&Q0kNYq|6_dqS zqYhkd4N`_9SPr3BApt6_mQbSV6!9n_e;%B%1Wq*`r*;kj>@1ALo^V+o^wn0jgRnGu zc54lGR}OsRby&dXprc$zpj-(p?!yLE%_d~g4$z3OrXkBfoKnbl1vxEk!Q^}0zhOLY{Y%8D}ax8gaE2CL1VRSnEPHW>YLYy z&{x5#2TBUZRggp(poBJwcfse@a<~oITC1t#sy@~Z1q|9x*666nlNdBu?88*mF(5EF zNA$S!r`WA9;K3fcO*j@?^flZ>eTWiFBLr9zQ0_X|QPU*s%T@d*M$=@@mKwAH!)r(@IR3sYu0*TQERBXFoeiOU*i8-6OS`M^e zZ$)$dxswWeR0GX}9;Y9y2n02d9EV%CtudTg;}%j7hdQ>yG*FZy*023NzjSC!)c(XqhKoco=| z#tUhX_Is}^w_)Ghj-j~5aam<6am7OXJ23rf8g@Gj_m8(@B4z&9Ypm{~V%@@?=Z4

nm$WC1Y*LbN9q~N7v8p>JeK-2rJ0M%h9yVE<0sVmQ7nO{oF?Si5;oth|>9@Xcvg5 zuW!}~(G&0i(Aex0xN-;UCni0k2#iMGFhk>~dl^cJ<8#{oPpcnjx-9=Mtu9JYF>wPb z=frLzqj3=r^g>JCX*{mTXWejXQ*Xc1xpeQT3sO}Zn(24FacG{?x#&2}L#*}=D5~um zJHMd0RSsGV0BP?ab!FR%X0S4=Zyj3k?mr$KElVr!5R8RMzsUBm_?UcZAq53;{#?<~+Q-~QUO*ucN>jarghL1l88cn_CkU_O| z1N3b1yr@?h zqajcS_Fn0VHww41!KktyheL+>c!=(<)T*2){9RfyC#FGmI)>1Y4CG@<3?iVYHzEqB z-RvMWE7yy^sjAOX$0%XOLFcW6oPyCHgtj`h*;IJJ?)Jq2Y5Y-a6z0GLKuXh2MSgS< zyQd>%&Yn%=R~0O`BH^8S+be=XQx^#Yb5+CC55n$_3P}i8@uu@1IChzA|0|@S)?u&R z{8_%LycU`gRx1{>6RlHq?XEZEY$^M|Tit;I+`b?s+7A_}V>@O7Je074dta0vx(IZX#r?LJuq}~6&E^b@1XYw|6{9ET-0#aBTBUq z+!bFiT{EA8r6$7y2)h7`lViSOZ3HBf3fS9OA#EI;m^FG6MFr+2!RFmpDr-X=1!w;b zNxcaeM|PpSw&!ozAjCwEzSblDT-AW>xh<6-Bp65^g>ws*H&3+0`BbGH_l z+s1|`LOpLpw8RP(%An%!<{MV%)!*hk(liRCtQ_d`qjIR~NL9Uq){EAE9T>~lrGvCttPl8BGZe1g^+%Dv zMEquE-cz!jy+k_Z(k9{CLil$!wy_odPaphGrJhCbicSTxg`ZOMu253-<5SH9annTQ zwts-ayW5KmU%W*QPWQnTssTsVZO1*X!V1{x_bl&|jOkT!U&pvcApxyXvqjN44gtP( ze&RYGa=7r&BRm>nRfy;dxjrjrd;HUk}B31DxLv%E|j`^!vMt;W4h z=;wEO<5rG?g0!QvZ_C)c5_hI zISnlOQ7N4t-GZ;kR{6L z0iru>ugkY*cNJxyi?aC+^_YP8A~NsY_u;AQNti}gN1uZ@y8Z8?r$DrRu$S~#ero=N zvtTjN!!A%UtYXLfwL(*2J5kX#BeLjc(vAUlm$_`g_Mp8C|I3YYNyT7mAPCI&Xfe@C6@;bQKKE}sQV zno;v|D}$xt#w-RBS*K8a{LV=+0@1F?qaZhsj3Kwa&8x}{fB}5A9JqLasT1Zd-e?2@ zsO1a8D9*}#bBeuwA|)&Hla{N(C+%>#cpms=>Sro#*;-Aq;^EV92K8D%xWYSav%4nM z)!W@*Cg}|9Kw2!#TR6GmVVTZU>QMK81&&?*i`HBs7P~`UKsZ|aW%O&I6yiy!&*s0J z(>J=VqbN0OY}qrCPr!vu;p18@p1I>?>f_SPH~gj5@VCZ!V6v>MS+4Y2$%w{_&GuW7 z{OOr(w)wdEoWMT}B_t18MSm5QUv&A=R$gRIYF-_|w>xlXLGd8xwT&c@Y9GSKATi15 z-=f8NIEi{Vym*)iekg-AdE_2ID!r0QVaPfTpD9?>UL6t1e+ScB-5Zoy6a!BClEf2- zUPfur2l<*tb54KNv2sDrLh<5(>Nx)x&T6ZcAbbgn4Ld*MAc5vFqu3!esL%i z33W)x*_k^Xg2*lUz`s#KtpemuW^_qmgElvN46Sy50L6v69E_iCFqtL>E0I2TUzBnf zwb{cxv^2c}LdCrqhaWO3aZ}uq$>1?(0>6<>%GynEo`M71_815ST%-MBPJi|~SFekN z{e@5tUe><5dwYBHzh4iQUJQP|ZWPic0bS7QO<|wOsOcXe;R>SCKy7qFHol0>`MR;s zy@CP@jB-%DSj&38X7vjD4mTURWMzezCH%;lUH9y=>t7fi#Te&hQR_CvS?^-<)y%#p z?JZ1@|L|;fPnqg2!3pVB1x2RYK&Nai)-e;s;L>e9%-GTXEhTlVd9w2mZFbzIKzo|c zxG_V$DEM4hXJ*&O#qKY?_ClYH!Zi+ZUNXzO0%dz|YisMO=A12eV$V$cLgk9@si|<} zKr|!Mo>gK>UWE-P=ZdL%J=Qw(;W9sDf*M(=9%;=;*c&Bax zIqpCP3|QY@6xP=5KTDP^^J`$ae2?yzdOP%ytNYxO14-MDFIplemyF{tXV(fz`g|-o zw7sN#Hdjs_TIRijS%Nv)5`Ik2GA290vZgUazM}cFowYQX?u~q9-u>Z zwdLuG1w$S&n(jJ_Au!rA^lfnEdFo%I7O`wz_vldj9MieEQcaMHu;%iMIwDU3JX7zkS;ZDHX(!tFre(2%+{v94}OM7G%R0RQ2PlC?jU>nm`o=@c`fY^yBtl0~{ zuG1F{900_lEu2~L{fpO!KX!>%`fARPp0mAiA?T5^S}eswtD*DAE%{7$(fnp0&wScq z*K)-E@fj1NSkH`?GDXg*t+Uv}OwB5jPS!DDlzHno{s@jl|C-S8S51;q^$8WOMhiuh z`t!NqG@Y(2xVQA%Qq26H3*C-is9A;2$vEVNiy>57$@X1^z7bOl;;57jWaR-_} z%SeGzpF3OzLNc1z4yw)UG;H!2C`zI|^9dX|JhaBDeD;jdHRzB@79m+L>a-rvAdM)q zy*qHOXNciO{tXMCrY!*Pu6vsB)BWT9R(Th(jr`=oZHT*+NT-Xc2W z=R@j)hAJGXBlOp0Ps{5@3-0;_9z7v#<&{l7W8Br7kRks9T%;Sa+;nFPiVBQ(s-DB? zAg1?pHDUasY%}?#`RF`ac~ojJ)TueIOswR zbE;yg*(seW1dMOO=59+T9!YQb_O#R(!&lr^@)`0-l6#9y~Y1DtMWV(kcbKdeA1nZy* z7D0N-a1d23_vo(vM>mVVS8FS1#(8;vGpb#Gpe5~=AV(JlEkQP!++;6fAsXz!#TA`wbk7_19rB8lSeUPkA=#v4qI9bnC)(LML zFaO;6U}oQ^W_2Ds{2h!Lf^igAnv_R>Xwzd>oJV*O520w|)TM^;UxoK|^2GgqP&VMW zZttYf+CRPggVh1g;s=w^*jml5=*xh+1#>a%;ME0Bf1|TdD_0kKl;aP_nbmR1g)(pbsd> zEeo^U95rnZN8_FHKl#o0F`JPT>p9g$mq}6(veg#BGJca>X-XJ7O_`JdJ34(`4Pfx) zalo#NIn_$@Y3{__b_cZ~^_i8|cfy5FHvDhttdvl-1GgP*g zB3G3gEZ*TEoN=lVV*3-GI~*Wo(|Hzu&OWRkWIn6WZ7I`aHsRB~(4=r0ANaw>a+=@+ zV1jU;=;f`D90gbrk$c4}9>dDo`Srdu%g(E>1Cmu1b$yDxItnJHv7WUI=rqP9L#bF` z_nQ;}EXbaE7pG<@}8BcmXv2VWu@RcYyiMVkst{>5!l|wzz0OzpOm=48P;E@eN~^9i*e?N zSwDx>iJ5bpRn7%U@-l{kYIVQHy{Mfy4nyqf#;hDyHd1sn-Lpcs%gI|F8K#AFQGP_y zj-Dv$ecYeSw!|Fe##c>J_i45rtdkDY`bs`oZ`)GdTT`j3V5KUarz627#A-R+mv@ER zlM&ZpOdb&v^H!zP{_7{}iG}w7#^**5=MYLHG%Nkih!0Vpr{s&Lr;d6eVXsG6`y|%c zD0@0dCyr>3L$}Y)J8QFW2jK$oQpkhq4f~P?=*__yf@kx|inm+4M$p;L143UA*Gk|< zQ$2OD&cQ*-TcPZ*n#-udZ~DdAa4$h zE*yrZ$}6Bf0WjGcJfsG;BRybx7v%u=_&o^y)g>a}W0%j?#yGb_SoEEA+$8@ld8C@v z@R2A@xI+%RsP}|=t%HU5uxp<2hoKdG=6-p4e0t0D?rDE|WhU31mW<&{L!BwZ)do(I z*ErLKovG%EL38&J>A7R4lg77Yw;^9&9J_;)0~d+(eKD9g+6;;>1tby4YDAzRqFy*f zbyy#CgX_oA8X$*A(dY)Bt{zFqA?^ialGxp?{h5mTAcsw%#QmZ_BIngzC9RG!ZYhjiYhC`jx4*v-Nf zB@qF-1xXqRe=sUBUCuvxO=$~Qdq^aV(SgPQ!?&B%#Gd}_lc!y1q<9ChF`_Ky8iiAQ zg8@0~sOr2!U#&4&txF(Qc7|Y;$T)aHBnyDQq z8zz$7xOw1e9AkA#3ShGXCdWOl45+4Kpw$sm^ z)d}&*DlmG`|LOa^%AAkv;b_Bqq`G@*>sSqljQdSeSOVV>1(W44Iv>I` zo!LJ71*DK}Ao}lGT$&5|`uee0V(zL+$Q{}D{7s59kY08%{ur_#^;DC_=`^~C5|Ko3 zx5%Y>sPtq*d=b`E;-_B8s!i8GuWZO>EdU9aI=43jt91}1UsG$6{Q`?ut?P4)RVT+e z?+Jf*Yh|L;p9u4S)5p0PFjoz8^U0ep$8wsf+}~m<$UAg>>^xXY7xHdiy191;*j!w2 zPMm;qT4L4AyF%wan?&@80w?;h9{q-BI0bGE&35GyXnxc*GY*!5)mSl!%@{NE*RI>wux2bYB3_}URY21} z{Vouf26D|CnY~Z&ucen7vQ*J&UsNCLJTsuN)@hr5Nl-#6RpzCcg)t?=j>M@+VC0W4 zqB|HQ&m^AGbbvbnMg~Fn3D?8J`x(y;+C6TlmMj$Nq6uoqHC4bTk5YfPqn zJ~;?78!&n%*2p9us3)O-qN5AHWPCkk*8_wcy!r7;D+6sA+gb7n=z3Q5PFLucz~7n4 z!@_{`XrVvvzvn0>FwOs1&Ur2!^-^|cy9~BNE%EC0)X?enrA_!w$!CGKHm1Nczr!7y zaNrFw#p7M%_Bh($sO2(fhsDqc+Dcu~<1>l1cYs0RS|*=PF6Ts<`jk^QwT$lza#Tk z{4ArHp;&sXQ%jugK&joE)eU4{7JX}5vr);sp2nMzp9%_9E|K=NZ8+D;&VDvUA1aRa zqbh!HLAGY1 literal 0 HcmV?d00001 diff --git a/Solutions/Armis/Package/createUiDefinition.json b/Solutions/Armis/Package/createUiDefinition.json index cd3cf342081..b97f31607c6 100644 --- a/Solutions/Armis/Package/createUiDefinition.json +++ b/Solutions/Armis/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Armis/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.\n\n**Data Connectors:** 2, **Parsers:** 3, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Armis/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.\n\n**Data Connectors:** 3, **Parsers:** 3, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -71,14 +71,14 @@ } }, { - "name": "dataconnectors-parser-text", + "name": "dataconnectors3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "This Solution installs the data connector for Armis Audit Log CCP Connector. You can get Armis Audit Log CCP Connector data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "dataconnectors-link2", + "name": "dataconnectors-link3", "type": "Microsoft.Common.TextBlock", "options": { "link": { diff --git a/Solutions/Armis/Package/mainTemplate.json b/Solutions/Armis/Package/mainTemplate.json index 53104dc61f9..9064b650751 100644 --- a/Solutions/Armis/Package/mainTemplate.json +++ b/Solutions/Armis/Package/mainTemplate.json @@ -27,13 +27,27 @@ "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } }, "variables": { "email": "support@armis.com}", "_email": "[variables('email')]", "_solutionName": "Armis", - "_solutionVersion": "3.2.0", + "_solutionVersion": "3.3.0", "solutionId": "armisinc1668090987837.armis-solution", "_solutionId": "[variables('solutionId')]", "parserObject1": { @@ -75,6 +89,14 @@ "dataConnectorTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId2'))))]", "dataConnectorVersion2": "1.0.0", "_dataConnectorcontentProductId2": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId2'),'-', variables('dataConnectorVersion2'))))]", + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "dataConnectorCCPVersion": "3.3.0", + "_dataConnectorContentIdConnectorDefinition3": "ArmisAuditLogCCPConnectorDefinition", + "dataConnectorTemplateNameConnectorDefinition3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition3')))]", + "_dataConnectorContentIdConnections3": "ArmisAuditLogCCPConnectorDefinitionConnections", + "dataConnectorTemplateNameConnections3": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections3')))]", + "dataCollectionEndpointId3": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", + "blanks": "[replace('b', 'b', '')]", "ArmisUpdateAlertStatus": "ArmisUpdateAlertStatus", "_ArmisUpdateAlertStatus": "[variables('ArmisUpdateAlertStatus')]", "playbookVersion1": "1.0", @@ -82,9 +104,7 @@ "_playbookContentId1": "[variables('playbookContentId1')]", "playbookId1": "[resourceId('Microsoft.Logic/workflows', variables('playbookContentId1'))]", "playbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pl-',uniquestring(variables('_playbookContentId1'))))]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", "_playbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','pl','-', uniqueString(concat(variables('_solutionId'),'-','Playbook','-',variables('_playbookContentId1'),'-', variables('playbookVersion1'))))]", - "blanks": "[replace('b', 'b', '')]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -97,7 +117,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ArmisActivities Data Parser with template version 3.2.0", + "description": "ArmisActivities Data Parser with template version 3.3.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -106,7 +126,7 @@ "resources": [ { "name": "[variables('parserObject1')._parserName1]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -171,7 +191,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { @@ -229,7 +249,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ArmisDevice Data Parser with template version 3.2.0", + "description": "ArmisDevice Data Parser with template version 3.3.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -238,7 +258,7 @@ "resources": [ { "name": "[variables('parserObject2')._parserName2]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -303,7 +323,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject2')._parserName2]", "location": "[parameters('workspace-location')]", "properties": { @@ -361,7 +381,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ArmisAlerts Data Parser with template version 3.2.0", + "description": "ArmisAlerts Data Parser with template version 3.3.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -370,7 +390,7 @@ "resources": [ { "name": "[variables('parserObject3')._parserName3]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -435,7 +455,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject3')._parserName3]", "location": "[parameters('workspace-location')]", "properties": { @@ -493,7 +513,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Armis data connector with template version 3.2.0", + "description": "Armis data connector with template version 3.3.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -878,7 +898,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Armis data connector with template version 3.2.0", + "description": "Armis data connector with template version 3.3.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion2')]", @@ -1216,6 +1236,617 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition3'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]", + "displayName": "Armis Audit Log CCP Connector", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "ArmisAuditLogCCPConnectorDefinition", + "title": "Armis Audit Log CCP Connector", + "publisher": "Armis", + "descriptionMarkdown": "The [Armis](https://www.armis.com/) data connector provides the capability to ingest audit log data into Microsoft Sentinel using the Armis API.", + "graphQueriesTableName": "ArmisAuditLog_CL", + "graphQueries": [ + { + "metricName": "Total Audit Log Events Ingested", + "legend": "Armis Audit Log Events", + "baseQuery": "ArmisAuditLog_CL" + } + ], + "sampleQueries": [ + { + "description": "Get a sample of Armis Audit Log Events", + "query": "ArmisAuditLog_CL\n| take 10" + } + ], + "dataTypes": [ + { + "name": "ArmisAuditLog_CL", + "lastDataReceivedQuery": "ArmisAuditLog_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors", + "value": null + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Armis Secret Key", + "description": "A Armis Secret Key is required to generate the access token." + } + ] + }, + "instructionSteps": [ + { + "description": "Provide your Armis secret key and table name.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Armis Secret Key", + "placeholder": "Enter your Armis Secret Key", + "type": "password", + "name": "armisSecretKey", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Armis Base URL", + "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", + "type": "text", + "name": "armisBaseUrl", + "validations": { + "required": true + } + } + }, + { + "parameters": { + "label": "toggle", + "name": "toggle" + }, + "type": "ConnectionToggleButton" + } + ], + "title": "Connect to Armis Audit Log API to start collecting audit log data." + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition3'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "{Armis", + "email": "[variables('_email')]" + }, + "support": { + "name": "Armis Corporation", + "email": "support@armis.com", + "tier": "Partner", + "link": "https://support.armis.com/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections3')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "ArmisAuditLogDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId3')]", + "streamDeclarations": { + "Custom-ArmisAuditLog_CL": { + "columns": [ + { + "name": "id", + "type": "real" + }, + { + "name": "time", + "type": "datetime" + }, + { + "name": "timeUtc", + "type": "datetime" + }, + { + "name": "action", + "type": "string" + }, + { + "name": "additionalInfo", + "type": "dynamic" + }, + { + "name": "trigger", + "type": "string" + }, + { + "name": "user", + "type": "string" + }, + { + "name": "userIp", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-ArmisAuditLog_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | extend TimeGenerated = now() | project-rename eventTime = ['time']", + "outputStream": "Custom-ArmisAuditLog_CL" + } + ] + } + }, + { + "name": "ArmisAuditLog_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "ArmisAuditLog_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "Datetime" + }, + { + "name": "id", + "type": "real" + }, + { + "name": "eventTime", + "type": "datetime" + }, + { + "name": "timeUtc", + "type": "datetime" + }, + { + "name": "action", + "type": "string" + }, + { + "name": "additionalInfo", + "type": "dynamic" + }, + { + "name": "trigger", + "type": "string" + }, + { + "name": "user", + "type": "string" + }, + { + "name": "userIp", + "type": "string" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition3'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition3'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "ArmisAuditLogCCPConnectorDefinition", + "title": "Armis Audit Log CCP Connector", + "publisher": "Armis", + "descriptionMarkdown": "The [Armis](https://www.armis.com/) data connector provides the capability to ingest audit log data into Microsoft Sentinel using the Armis API.", + "graphQueriesTableName": "ArmisAuditLog_CL", + "graphQueries": [ + { + "metricName": "Total Audit Log Events Ingested", + "legend": "Armis Audit Log Events", + "baseQuery": "ArmisAuditLog_CL" + } + ], + "sampleQueries": [ + { + "description": "Get a sample of Armis Audit Log Events", + "query": "ArmisAuditLog_CL\n| take 10" + } + ], + "dataTypes": [ + { + "name": "ArmisAuditLog_CL", + "lastDataReceivedQuery": "ArmisAuditLog_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors", + "value": null + } + ], + "availability": { + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Armis Secret Key", + "description": "A Armis Secret Key is required to generate the access token." + } + ] + }, + "instructionSteps": [ + { + "description": "Provide your Armis secret key and table name.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Armis Secret Key", + "placeholder": "Enter your Armis Secret Key", + "type": "password", + "name": "armisSecretKey", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Armis Base URL", + "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", + "type": "text", + "name": "armisBaseUrl", + "validations": { + "required": true + } + } + }, + { + "parameters": { + "label": "toggle", + "name": "toggle" + }, + "type": "ConnectionToggleButton" + } + ], + "title": "Connect to Armis Audit Log API to start collecting audit log data." + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition3')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition3'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "{Armis", + "email": "[variables('_email')]" + }, + "support": { + "name": "Armis Corporation", + "email": "support@armis.com", + "tier": "Partner", + "link": "https://support.armis.com/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections3')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections3'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections3')]", + "displayName": "Armis Audit Log CCP Connector", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "Armis Audit Log CCP Connector", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "armisSecretKey": { + "defaultValue": "armisSecretKey", + "type": "securestring", + "minLength": 1 + }, + "armisBaseUrl": { + "defaultValue": "armisBaseUrl", + "type": "securestring", + "minLength": 1 + } + }, + "variables": { + "_dataConnectorContentIdConnections3": "[variables('_dataConnectorContentIdConnections3')]" + }, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections3')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections3'))]", + "contentId": "[variables('_dataConnectorContentIdConnections3')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "{Armis", + "email": "[variables('_email')]" + }, + "support": { + "name": "Armis Corporation", + "email": "support@armis.com", + "tier": "Partner", + "link": "https://support.armis.com/" + } + } + }, + { + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'ArmisAuditLogPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "ArmisAuditLogCCPConnectorDefinition", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-ArmisAuditLog_CL" + }, + "dataType": "ArmisAuditLog_CL", + "auth": { + "type": "APIKey", + "apiKey": "[[parameters('armisSecretKey')]", + "apiKeyName": "secret_key" + }, + "request": { + "apiEndpoint": "[[concat(parameters('armisBaseUrl'), '/api/v1/access_token/')]", + "httpMethod": "POST", + "rateLimitQPS": 2, + "retryCount": 3, + "timeoutInSeconds": 120, + "queryWindowInMin": 15, + "headers": { + "Accept": "application/json", + "User-Agent": "Sentinel-ArmisAuditLog" + }, + "queryParameters": { + "secret_key": "[[parameters('armisSecretKey')]" + } + }, + "response": { + "eventsJsonPaths": [ + "$.data" + ], + "format": "json" + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchArmisAuditLog", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project access_token = tostring(res.access_token)" + } + ] + }, + "stepCollectorConfigs": { + "fetchArmisAuditLog": { + "shouldJoinNestedData": false, + "auth": { + "AuthType": "APIKey", + "APIKey": "$access_token$", + "APIKeyName": "Authorization" + }, + "request": { + "apiEndpoint": "[[concat(parameters('armisBaseUrl'), '/api/v1/search/')]", + "httpMethod": "GET", + "queryTimeFormat": "yyyy-MM-ddTHH:mm:ss", + "queryParameters": { + "aql": "in:auditLog timeFrame:\"16 Minutes\"", + "orderBy": "time", + "includeTotal": "true" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Sentinel-ArmisAuditLog", + "Authorization": "$access_token$" + }, + "rateLimitQPS": 2, + "paginatedCallsPerSecond": 2, + "retryCount": 3, + "timeoutInSeconds": 60 + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.data.next", + "nextPageParaName": "from", + "pageSize": 10000, + "pageSizeParaName": "length" + }, + "response": { + "eventsJsonPaths": [ + "$.data.results" + ], + "format": "json" + } + } + }, + "isActive": true + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections3'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -1225,7 +1856,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ArmisUpdateAlertStatus Playbook with template version 3.2.0", + "description": "ArmisUpdateAlertStatus Playbook with template version 3.3.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -1789,12 +2420,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.2.0", + "version": "3.3.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Armis", "publisherDisplayName": "Armis Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Armis Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.

\n

Data Connectors: 2, Parsers: 3, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Armis Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.

\n

Data Connectors: 3, Parsers: 3, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1844,6 +2475,11 @@ "contentId": "[variables('_dataConnectorContentId2')]", "version": "[variables('dataConnectorVersion2')]" }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections3')]", + "version": "[variables('dataConnectorCCPVersion')]" + }, { "kind": "Playbook", "contentId": "[variables('_ArmisUpdateAlertStatus')]", diff --git a/Solutions/Armis/Package/testParameters.json b/Solutions/Armis/Package/testParameters.json index e55ec41a9ac..554801e41b7 100644 --- a/Solutions/Armis/Package/testParameters.json +++ b/Solutions/Armis/Package/testParameters.json @@ -20,5 +20,19 @@ "metadata": { "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } } diff --git a/Solutions/Armis/ReleaseNotes.md b/Solutions/Armis/ReleaseNotes.md index 352fb9c5ea7..18baf189d59 100644 --- a/Solutions/Armis/ReleaseNotes.md +++ b/Solutions/Armis/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| +| 3.3.0 | 23-10-2026 | Adding AuditLogs Data connector.| | 3.2.0 | 05-12-2025 | Log Ingestion Support.| | 3.1.1 | 19-05-2025 | Updated Armis AlertActivity and Armis Device Data connectors to add keyvault for storing Armis Access Token and Severity parameter in AlertActivity.| | 3.1.0 | 11-09-2024 | Updated Armis Alerts Data connector to ingest Armis Activities associated with only Armis Alerts.| From dde47d7bc5e16784e049fc2f529fe732fdbc0469 Mon Sep 17 00:00:00 2001 From: Fenil Savani Date: Thu, 29 Oct 2026 18:19:22 +0530 Subject: [PATCH 2/3] change ui page of data connector --- .../ArmisCCP_ConnectorDefinition.json | 64 +++++-- Solutions/Armis/Data/Solution_Armis.json | 2 +- Solutions/Armis/Package/3.3.0.zip | Bin 20136 -> 19445 bytes .../Armis/Package/createUiDefinition.json | 2 +- Solutions/Armis/Package/mainTemplate.json | 176 ++++++++++++------ Solutions/Armis/ReleaseNotes.md | 2 +- 6 files changed, 165 insertions(+), 81 deletions(-) diff --git a/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json index 6c237e22410..2642ba58d79 100644 --- a/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json +++ b/Solutions/Armis/Data Connectors/ArmisAuditLogs/ArmisCCP_ConnectorDefinition.json @@ -7,20 +7,20 @@ "properties": { "connectorUiConfig": { "id": "ArmisAuditLogCCPConnectorDefinition", - "title": "Armis Audit Log CCP Connector", + "title": "Armis Audit Logs (via Codeless Connector Framework)", "publisher": "Armis", - "descriptionMarkdown": "The [Armis](https://www.armis.com/) data connector provides the capability to ingest audit log data into Microsoft Sentinel using the Armis API.", + "descriptionMarkdown": "The [Armis](https://www.armis.com/) Audit Logs data connector enables you to ingest audit logs from your Armis instance into Microsoft Sentinel through the Armis REST API using the Codeless Connector Framework (CCF). The connector polls for new audit logs every 15 minutes.", "graphQueriesTableName": "ArmisAuditLog_CL", "graphQueries": [ { - "metricName": "Total Audit Log Events Ingested", - "legend": "Armis Audit Log Events", + "metricName": "Total Audit Logs Ingested", + "legend": "Armis Audit Logs", "baseQuery": "ArmisAuditLog_CL" } ], "sampleQueries": [ { - "description": "Get a sample of Armis Audit Log Events", + "description": "Get a sample of Armis Audit Logs", "query": "ArmisAuditLog_CL\n| take 10" } ], @@ -37,7 +37,7 @@ } ], "availability": { - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [ @@ -54,23 +54,40 @@ } ], "customs": [ + { + "name": "Armis Base URL", + "description": "The URL of your Armis instance (for example, https://your-tenant.armis.com)." + }, { "name": "Armis Secret Key", - "description": "A Armis Secret Key is required to generate the access token." + "description": "An Armis API secret key, created in Armis under Settings -> API Management." } ] }, "instructionSteps": [ { - "description": "Provide your Armis secret key and table name.", + "title": "STEP 1 - Configuration steps for the Armis API", + "description": "Follow these instructions to create an Armis API secret key.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. Log into your Armis instance\n2. Navigate to **Settings -> API Management**\n3. If the secret key has not already been created, press the **Create** button to create the secret key\n4. To access the secret key, press the **Show** button\n5. The secret key can now be copied and used during the Armis Audit Logs connector configuration" + } + } + ] + }, + { + "title": "STEP 2 - Connect Armis Audit Logs to Microsoft Sentinel", + "description": "Provide the following details to start collecting Armis audit logs:\n\n1. **Armis Base URL** - The URL of your Armis instance, for example `https://your-tenant.armis.com`, without a trailing slash.\n2. **Armis Secret Key** - The API secret key created in STEP 1.", "instructions": [ { "type": "Textbox", "parameters": { - "label": "Armis Secret Key", - "placeholder": "Enter your Armis Secret Key", - "type": "password", - "name": "armisSecretKey", + "label": "Armis Base URL", + "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", + "type": "text", + "name": "armisBaseUrl", "validations": { "required": true } @@ -79,10 +96,10 @@ { "type": "Textbox", "parameters": { - "label": "Armis Base URL", - "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", - "type": "text", - "name": "armisBaseUrl", + "label": "Armis Secret Key", + "placeholder": "Enter your Armis Secret Key", + "type": "password", + "name": "armisSecretKey", "validations": { "required": true } @@ -95,8 +112,19 @@ }, "type": "ConnectionToggleButton" } - ], - "title": "Connect to Armis Audit Log API to start collecting audit log data." + ] + }, + { + "title": "STEP 3 - Validate data collection", + "description": "Confirm that Armis audit logs are flowing into Microsoft Sentinel.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. **Check the connection status**: Once connected, the connector shows as **Connected** on this page.\n2. **Validate the data**: Use the sample queries on this page to confirm that audit logs are being received. The connector polls every 15 minutes, so the first logs can take a few minutes to appear." + } + } + ] } ] } diff --git a/Solutions/Armis/Data/Solution_Armis.json b/Solutions/Armis/Data/Solution_Armis.json index 28f989db46f..e9c30897b2f 100644 --- a/Solutions/Armis/Data/Solution_Armis.json +++ b/Solutions/Armis/Data/Solution_Armis.json @@ -1,6 +1,6 @@ { "Name": "Armis", - "Author": "{Armis - support@armis.com}", + "Author": "Armis - support@armis.com", "Logo": "", "Description": "The [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.", "Parsers": [ diff --git a/Solutions/Armis/Package/3.3.0.zip b/Solutions/Armis/Package/3.3.0.zip index 06fd51613e89fe9f1c5753fd3fce659eb16c8842..e886c04eecf0a91b8cfc2431cb83f9fcd7f1619e 100644 GIT binary patch literal 19445 zcmZU(Q*bXn)bCx}wrv}`w)?AX+qP}nwr$%scirx~J^%N4X5MpgE|RR7WaVN_CZCm+ zuc8bn7#a`|5EM{Cl8$cfYq{qw1P~Am77!375FU`Rlc}MLDZo= z-VUG&4FsBTcWCwhHCGQTu2vCu|!cB}cC*f>5D`_7Fz(F21Zmhv#?!E_wAyaf#j>WA$5A=CMLZr1)57>qER z>l7O{j!3eWerC}_Cs!1EdNawKuO0cbafL4mpw`cN9DL#D!bQWT58X#VXgx>wd$tL! zAEBdB_;}$-UHirn-N#AuO9dsRI`t^(Bv+IdtwCFi!I8zaMi3n3Hrgu0A-atW=%vpv z!)})h2D85hn>R{j9BJ|$Lp9WkBFvP(w;3!sG<-6ei;0Mph%$%fY{Uqy4fSJaBFDlP z%xSe-w85tjm7Dgo>=1WM(-Dz(<5S9S2IN}GzIk-$)r2ma1GM(I3iTOgSTR zGR{nK5x$E}BHwfb8@XQ3_YZVF@1B$C;5$dRM=`B~h|Nrmbl)~*KaX|9WN+RYaGYIo zjA=5Fd<;a(D8qZ1*?<6qO<(KOIwOsx^clFtX0RHoz*?cP$90hq2oJWJMliFa_7KCd zNrx!zxT(2qOCVc@!VH$GcvTO0^~PnuqG1c#U=J(TbU5xsYYv_X!*mn>OvK>A#=++l z#2ecQXAq6m0)z3A-NI2cqSMO4nvgj4tQQgD)RQ>ZPMKbXsD91m>&O~9{iCY_avY)y zHcma~Ym>$u8Vg4H_d1^;&gM0rWP2v9+nxOB^7@#K-Y9Ty!PCfYH}p+5JUvUNt@KXe6LW#n77qDZBlrxO6bk)MDE1#u(KZzr+a zje3#Xb&a1i?4UvbkhLg0BFfg=C5ge82k?Upc=+?w6 zd=F^dj9H)PCk{&LE^8&haqQj!XbvK3yt>+ z8c4P9XGo&I^c-9!TS5kJaM)gr6gr3w56u5bAxUzW7y0g{m@-z2P};30Bp|>eh(Qp* z#oyT%v9*_A>)~~~c8A?=oMOpgly9MtZ(x2KNt*2>yV3(gLqSv~PqqTEY@7kCgFQelY(o8)gFry0v{Agg$wRwICu?P zjG7RsxD30$M_#B1LYWz;QaP!(cE`Figqqc4JPDIzLP|4_QxK{(Q#3Zeo2_|#rQ^y1 z_a;Wl>_#8jqk}RJTrT;&nI&lIy9!D^pkq_8LkFGL-flWhRNd&Rss@`QAH73^uF7!S zmhuK}S+@1f>NJ7Qhq+$yz$F&X=2^76-lAUlmfj`Q{Mov7OW;j5j2h852<_kNEsUyy zy!{7hBo2b((OxXiPXSm)xCE-QtuDKmf0D zUbk?g4w?l1>9O{MFU-1>!QpnuI^rHaP#4*cv(iXtS9xecgPu0ddN0U=YExmH9aLI) z7>#{hxpcZis~r9%ePN7T3HEm>F;G6@1LDHL!Kwj6PX(imVBWq0(O+7VVaEP9`qGQ_ z)h;Y3+*(igRa!_1&42Ev(%CAs3X{Z}Q(cA7)6K<2QHt?HiL+DcFlhHu=DSL-d-IR4 z&NDvZp~A3d`1Q;Vv%Nn%^u#t9erG0IlGYg1vT4vAY|cU%-A@67nG}S z(nT6eoA-_A>E4Hvv-$5W;P#uxy?S|HM_<<7*Afl{uS1bl<})%VWf}yGfNQv_r2l}q zXv*#&G)_fc#Ugb+8D%^8^9BVcd;?_lkg3CinVT@ks{Lla7Va(Nb!UWcd}G@){)6cM1!uhAu@yJ}@&5x(-)prK@wPL6!O*aOSzrj6e~x6_@!eyY zQ*5_f57AQiSyk!jlu49|QIg`3y&3{qhcKS1*__IZt|JCi{-`o7& zb~vv-oV#s1pC5ihn9luZ_Pj9rxyZM~`!=6{cGml68u|OZ|-;I zWf%7S3;PpBc}vnAg-X|vKNGZq&2woa5TE?l8}oNeDWR(52HP#$=rEZ}$7CTmxlxEK z-SH@aVy)mAa%p=o91AN9K!7j|}yv>J|;Uu63s+U+5|K|YF-wo9sMWl6KBJL^s z4ooTQy)L|#XEXKg%MX`w{c5 z?;&YG8x8jy0AElqeXrxfXY;5P>;Qf zBeRezF9)60stX}`j9|5})|ZDg7K94{{P=$@FAVC5{h_|enh)T;U&nE0NdE)$X^r{_ z=0pVje{*>V|D5uO+Ob ztV*qlc+$0?S6eRsxOh*W>*?fuv89CuUNObLgnR0EXT0EJO|9n}+K%^x#y`Nt%b9QV zFomIeB8ipFViTXGE> z;~I7vQs0<`xVq(k0|v7czFr2w@o+!%QLf3mKgRWsaSno zsW%%@yWBAyeRP$*rs~nB+Wai8q#qlq$k9Ytx_u9jz)(p%7>D25$d~{(>bxFUnDQ1p zVpD`>rbIniN-6`^}S$ zoe*BlorD3Kxrq?kTPJHs@wvVYWyhqmaOAu9vp_QMao%HouY9f?$^ygBcF)NO?m}2f zfZG=Whd9o8`H6bMZSmS%%DF+t{|L{(eGYJNwPYB0W(kpl;4P3hquXDzGrgrOW#L`9TsHA{Hs0~682+{=gU zQeRz*!?dQ6@W!dIPRL$$?n6J5rAQIn}`6vaU+v z3|fsxw`XnTrNk{x zu38wbmR63NZ1V>k*6LchMXL7#64opltiYyXq(aLYy`Ekb*5X&!Q)QnWV|@Xmv5i2f zAcU<8niJxNZD_|$wapD*RIko01JTO*JGoU9Q@QgDC3MP=H)}8tjnpA!S9Sfo2P;;k z@Tv)Xi>K--4h@K`#ye6w#oAy&e^H(w- zNv82&XP-K&G&je0Z;G+2cz=pa^Lk*AO<{|7k!qT*JN;@c)Qyv95hplFRSQ-ikh|q% zPk$mj0l({C9eeA$uKhjZA;98>XZbxtmBVK`cxl1R-l+PO!^^(-e>z&5XRmD?+vIAS zhav(iL+@(aTb*(5_1XdEjfH=0&eq6}5w^BBvx=Ne{-nrDKc z&@!}`HcP^nN!Zp@egkS!mT^t)=uhFlesD>f^cM0l3;1NdZb#`HWt7<~e zDzCuudWW7nPlo^%(_U`x%G#fu)p!mUYlzRGTr8ga$o4RZqEYgVtN{^JSJZcJU(&{N zT7DQ-pTgQP4JkJMP8lIZtTq9)v=-ZqA~9Q)@k21PcE#*}&OgffzKI^Nzn%WYdikC| zTH7PnM7?Vq3HRw+S2w<#qZnIn4x+F!?@lLbS)VR%h+x5wF$J;p^(C1t5}i$sOZ^a* z4#)wcRVERfN40IhyE;#nR`|k3UpV7Pzm@o+q3r+(MhhcGvpqv2*fCanzBzWvRR=Kka~bELm~au1wN%K%LoUk`c0 zJW_?#8I{uhkN=hqp3eO|R&beCA3cPh|4-QG|2OQ~uiH~Y&d+<{63BVQTx9r#hpITY zww~qfr{3Cq?Wd>XGMkUz_#C!>llzA2nkTdO46SYMB|O4)&8^)_%o$z7ZQCk8d2PfP zzwzDv8=oM#Vd<*-d)&74^msdF3LYC=e_ZV9*z-YsJ7}*@M=YBe52e4=5r{2dy~WGF zPsX;0nNqBR?Bg&)XrjJ8Ybu|VH-GHNlSc&X6txA&}$wq)9!PVuI|-7HG6n_(?UnU zk3u=yF~Qp%+`(yOb~vYlTbeh5qTZ{RZ9YNhFs+n|2SH6y=fG?NP#DY9OO&*JUz(Fu z%zxi3PI~?^euHgOGRDW_G3L=Fz#~O@9DU85-|zkg9ZOh&@|)SQJ>*L}gCy5@9J5C}A zwf-|0OClZB;8%H9kPZ2Y!#j=|lRp&PZ(yO?M8d*UlX$Jzy4dNUvOi4OPp7%;hX1zb~pt@iP+6dT7bum^k|0P?yJ5*Qp?*51xM7-!WdJBcmzhNV)8z^{#2l z%Z}aBwfPLgzN(_iSF4ki^iKuT1+4!ijkcAf>1TyBnMdR;IXN)vN>aq%qV3-HG3x2b+Ji{j!7vURLz3r``6=fyIi}2^4 zrxpKrJ#MV}Yo%4R_aIVqQFJtb)FSAjCTi7%mscef{BMKD`UkH4q$;NBOQ)};K#p;A zuOVPUv=B)Hs;|#9oFP_@dmhnuv8b&eYGKk@cN;%>+|3L8^Zfg0pI(HT#W%oIc-y6} zP{~LH=VFwb_rX`Wz@XlUw(yPuxm9o%mTmNrqTzIhM#9*Y4HcEbjLr+{!XMGx5iOv! zYxZW^)~FZWJ{U^&`9q)K4~fbj%Gaia_`IuBhnu_`wQRDDl<(A;{7wuV zBz7@V&ys10cD=_*>wC6;V~p-owTx={F-7%t-Kz~84B&)&SPb2T63{oIV(u>>0o#Qh zn8wpkrsyY_Z3jB)I)U^C;>?)n48$rd2np43<3`)lDK%S+N|?sr9I(O38GU`qroo7X zf=U^?tI}_cDJ?g!_Q)4ekq!mnoAmy4T6*|F*!61B8rmRFxPu%0V zLKHe01o;G>Q3#AxV#v4Z1tZZ?j_u^Vk>!GHcEK=>ud-q*q?_2mo6IHVzc!dE*h%4= zmm1El5CqLLbT+{6JXEHREH-6E-p)^mMT?Xrx+{v)aE>FbzvK}os9bii7 z4&vu=4%93SQv~&0*HHJo#QK(;MC0)D;xa5Wh_3&M{DX@T&j5wg^HdFc%}paX!CzRH zoP>~@DcI>$Oq7dUDETo)fci}J&M6whEt(!)D)`BaF#LvrDJT|RO(aaq!IF=tA}BOp z`emPDIE;(8!zA?DfLIPq0U8WERUMPBqu;3%Nt8%jXHyMxUgVNJ#(=ddubAE`G)jg3 zvjB0cc+OU4==zqjOdB&goa-=9;P@{v@3zSx$&Q<-PiDRiz3=1PgO5>o{i!`i3TvQo zY90keNcspj#OuUJ)!=>DecQ|z0OQ_{f zBh0j@&V%TMZqO*>T0jEc3aNyFH}mWLnFIM}U#F+j$KQ=j*D!=$6fMPXGLE6Hplu+MI2aDFg~Z)Hf_?VhlGN z<{vg#@1?(E5h&MEb3#-i&`RbTJF2y#5lerwq5h)N30rtNJJZ$!^rBZhuX;izC+019 z|D-N3?PYV*S>aR_zktTzL5j$yw?L3er%?7#c2)axok7RWC7G+vNkwKD=FAC#0b@l;2Z0Zv3EvocJgOHskUK#x1b zbC$BHn~mT3xVmG4*ck~qJcpN_lY)>fFBe?hS#F#ep^O;K{#+W-3um4 zNY+WJx;}krSjlfclZtTBP;ofMwV;%`Z)+$5<3_{`y9!Jw1NjAHEXnXd9`o7X9Qw!4 ziKrgVoGJ7aB`3-*qot7Bnp)KWF7gGw8)Qp=AQMzuzYX=G=YaCXkDl_h{0L>k!_>)8D@T_u7nc_L zPaKm?4l5&BOJ#H#?&4|zH(QatPuH?VR4j+7C8Jj30XHG?^gAq8ort?6rjz7(7Ys+q zm3e8+C9Q#+;9%b(kzopE1NiB&sfp}o2-Ad+1j6t&#@sE2jVph1#?-OF*C8c}MUgu7 ziHd>?NW-^^K7mh^G;sVAw66s)+XXo9i68_K?PNlrP~hm0%jx5Z6d)tEISvx2Rnv@5 zcPG*P;*7*RSo2^H;ur>U%pht^i?82UD?kH*=2R(JwlgRIOdKN^ zg9l^}sQI3MY`rq_;X{l7F>8bvjzmuAlC)6TUcE}#KUO&2MVuF+Ysg}p42U<7i=&2m zMtotxGLdB?TdK<;>F989PC=?CgLPCIgXwE(CesL5+_vYRKx-sZ3_6d?TKqqK8wY7p z)i7z@i3!;R;NwGWwjsFGNmZlUQ+$*yJBE!%^bz3l8VELyLtW9I&zQt@w_+|Ew zy;9+(td+y!>Qj&XLhX?2(|!+k5#Du?(ZN*CJx3EqCEvn5F^XKH--RurxU^08$)jRC zhLv{m4<1cOvO~I>JZz_318Q|og$udo^8C!xD-xxo$3ODV>?G08x(0_1!g2BU;HrNh z$rjY{q!_kRy9)YdUxS!aj4R?N~ky)EY3c2O;XxIlL%Zs7m%4XNx zAW5iPlu6>x7p06G3YWj{mWed%gyM!V2rWuMp`~}%M50YmWg=b_4^hBzaH>lQ`ip&Z zMi~=Dsx#)FdLaPXBaCm-#^L8B|J>;;z(rHc!3?g%ER*oYQUYtv7jfn(A1}|&7GsXr z>*e3}^NqHC4fe-a9x$MmuXS)IrIXd9;CrkwQp|v z^BRLIXbN3AU2oyfDyJzWkBVk3aB$FsDxbX)N;7=!_yoP+CtbDF!c*R{q){pjJQb@V-WombhKb; z?`R@kczVu+3N1j~Tz-^uK77btpT}>6+fT$jGA!t4-lI}2Bc3XkTzF)XPV7&8C28E( z6nth(+~sr38*d+NLw*hQnGO^Paa0*2dllix@f3;UTUFt(eurP3&g^uYz>Mt1X+&QD zFb9XSp!ZDmM(p!C*nB7ay+)>Th`e+5XSG?4(W4#YF2WohkY}x;)C&NJw!c{W)o^ge z2SU{SNi53KmX-_SvPhg0VKkYHMa+#VpuCEZ&v9i+<-kisZ|A`vWi@9r55sg9`Pz?? zO@C{iqg3u{7^%-lh~{)k)anz|7o5r5kUJpZ`VP`jV(cM;z&?KuvnZZYK7yZwUCMXX zFo-L)Qz!clSY`PKh{-WLl0td9Q0s^PgDbR+wf+Lf1z#4y+nB!INp}rY03lC58*cL^*+R5VSaSx zP6L@#JpJXzGgVza-~;D85k(s9wKhR3Oq*xICJ`k~7UHj32u>m&oOz&Kt8E@B16kx;)-FY4Y|f}&W;#Xir% zv}+QZ75f*)Et7Ym8VLgCW(S**VxfewVHB)GMorOf2q!VZ9p+jr8L0<0>`Q~2uN>L5E#4b`r(rZ*$ zMgtUe(^XiGtVK7v&@EAMehtxhN6izl7Z>fEU^$!9qIoaE8`p4anW>LRR=rKS(_A|b z4VqO*JyK>mfgLJhUVum~T1GXhGh25Nm;VqzhJc}$Bq@<`I@3E=N!df}^4m-dc8Y}4 z(7yJ)=o0cXP@Mc5*$>|)+Sf8xmrO^}6O(}PmeIh%wBR=0GGuCZ#Lc&xKEp}k-b&Ys zQy*@y{0)Z*4JRn9g$(Nf5+st&EbcQIoqOanzhI9iaR$Vw1u@)dp%+E+K`wcD;S(?W zoSjHl7QxpMAWouz5|dGoE;fRkIi*hcwNxybry=>zJW*q~$2Dw2f?;pLfL!D)O?%(P zJnj;mxjY#}45Lm)?bPqjcE-!Gdf1;*i`%utedux_(;d-%IxrA4IP;@fyl9SS^&RSH zSE13l-h?8MpJ1KE&eft4ZZ`!9Jnk8$Y3!^bl#e+6gF%ADL6S6oIHd)ooX;a0Jff*Er!2^Cp zeA+*F(0(Vg$3#;a4doIHL5pGpjC@lWU$100F3~AOmLI4eUNSoNEG!O^UEBWBQ@9zE z_VN~%+)v&zJ2z*pnJ)8ENzxkJm_GqJprj*<%SwMsi#-S$@SrgqnkD_qr{-yg1cnvm z)<^P%k9vL3WU=np4aJuuW#}p)CcRS4**B`h%%1;vtn&EaC>0yq)QDg+h#)2cz`lqM zP$7D*#JQFb<6Klk;i!Rk*?@VN4NWd_Sx6Ky+sc8FTG5~3tcPO$*g`Ve0)Om~D!xLk zjFRLFfVA#bG8!vfBlu$Lw)6MI<78{`-aB1BzM*r8#a?lm8tG58c=T(ezq~odD==&u zsL|jk4|KW45`RxpgUB=o@eKBd4BQD7hJ0W^fB>lhWzh0eoqj?+_xVn!*XBsI4IUP!eBqSo9nSA$Jn z4K)OG)u;_MZjcR-qgoJX)w@}*2kQB_ZvbANOQE_f1|3AR)nLsR=&O8)41hY3TCK*! zIJnv>vLwKmdNo+-#XyxG3xFv8zh*uv7Qk3&Gg$tmK!yKeoF zoF0+eSFT>zk=f6oI3nyjA4TwxknJ;ETxqU_W8kKDCBaJ%v9C}>^q@9>0ObG}A9HDRyDanCft>(vG6=Lzu~9RuDd7QI zm5Q(n&C~QuZIY%Ll_Q z!QJ1V*rjo|I_`S`@n6|NFFFFjHc1>b67+(x4yTZ(n?X&q;A1i4RdwOYW(9CP?%QFF zNK3Q$Um`1)cu?XjJ5NP1Uw#JBzGC(bS643Nq5>r>RVr%zUXqy+ViBMQ;Pi=e1Bgtd z(=?!L19xzEWQsQ%0d!gDsCk26QpbG*q`xd+B0$4z7)m1orVFFMc)3fo0z<4hIg`T6 zju~nTj1!o$NXyrQ-hQ@@(`L)TE4rc97VYY4Y^UGOuAtXtq zZUjj{_-xx+fd?7|{kIy#;i6CH-vWNC^f{a@;gtmuod}YD(Qimxm|yClMq~Nk2w09- zqSW{V!BhrArbxlcw5qMxyKWxvU*)7pxA(ZJBKpK}BBpQf_jsbZ)pXuUTLRm9s+Gf@ z30oXT{1HxOJCHvr$UL5P*4@UBOvl0}a<6YlTc>Tqkw~j*@{?v?P(RBkd5@h*uQ(6n zZ}WfZZyqQ_QS$|ELpIVe;0&SpV0K{y^>knw6|F$p(#~5u(7(*Bk)OFRIJhvzsBwS<=`3po5 zsTM({bui`+%i~BE>0#fo7RlLgcSWS16HsV_Q#{~iPLU5KU8Y04d?E?-jo4FGkL8~` zQ2B2~DLYVi31$f5jj;Km>|Tq;E8lh;Xu3-C3Hpnw!M{fw=ree~e+uZT@CAgQVfGSu z9&A@V?f;TlpzPn$I^Q$~DMbWtB2$T#`xNqPgeHC0f)omO``ska@M!fB3>JkM|LZ{K zw-bxkUOZNN?m*86vlBBnY94R4h&5ldey5@D4=?wS^ne+}RJ~+RH9u2;-}0+#7pr=m znb%OK?Bd{5w#b6DC9maN1$hhLl1wx!&UQN?L~JhvVQ#@qBjmJhkvO zz!AtC4+fP)Lw%5WLzcS-b;=1Xwi4)RBR1vb^XzZnuL|OnA>wJExKO@U{(P5|$4Us} zfo)Hqtz;N-Z)sv-5gqTodRLqHV#nF9!EG8f@M%~dnv$GQxfUvk=GL3khy`hh1B2=Q zKu04rn)PD@D?;E6q!7msHjTPGniBR9Qy;)6w3QiBV+OFMr~FKD*R=3i%OZY>DRA~g zK*Wk7fqCnbY3pT{Q&L+W$+)&^eI!>k4EqTGQ7;+1jdhEHVwB1A()&%%66rrfXKl_Z zGQ0O1K>CM~ymgo+lP*yU^lhQqPksF%TsD9plu5JH36HgWoIIvALg6d|6I0Tbpu}TS zsv!TxI16+&@{MAoN53~~v`Zv}8||pcMm5@2$*Rpv?_Pv4op!XL28TOpPugfbmgP+( zO6N^hgHB}7ddBHBLQ79uCDNew&AD|rE1PFX`{})hx^0^=j$EOkm-CnNj^n=Quwol&`X?d9XO z=MHvwN9!%-Y=Zo<@p8?$ATPWug7C8O!b`C5vR&Z64`ykD*_Q2R{B<+uVYJI}@?KvV zWw7hVBhOsS`IZou#{-dTf#({Jb}w>suWn%oF>NAU%HYqj3L^gEm}OO9HpuF_wAJupl&b} zEmRk+S{!7sh}Jq~4+h;wIE!FAsKs#(e=Ehug!e~=JzUAI-Y<(QIg)OhtdJ}7YX-5k zW2=aiT~;~Y;OqXd5#q66Kin_$lQr@=wm`~RUlZWr!M4C~legN^R5Q5$4mO{1SAYUQ zrY;|y5ISI_1`@)ysr>bN`9oXW$<@XLGTyMq#Dg?MmkDQk65eAn?+zq%&~*^eoy6&d zA+y4Vn3bi;e^|)>kc5snJes7O`$#W3KL4+75SJfiyAxyV6YHB5{Ih%Fb3=puf<~)} z-fx;CYfG6Z@aDx1Kj}-iX9uy>(4sm=$iVIhgh2hSWJtK_~2vC zi+VXw(5XAC&~@#6EHX$ie@y~~JcoypV+PF1hi3d4F zu1Lx0CMMh^J(7i!x>KVKw`iAK@}i{$fa&3;O==2qy*U;qSt4$U(b(u(2C((}yjq)M zh(^n%mP)HB%n?y~`3Al^Nh_MFs8`W8M?RE`eW;R`$ap)6s_7=iG2l>@mdd2QxK>?W zKGLPOrbvcb^{^SQIo<@N$ePCdbHd*;Bak&`ofLFI^}+qdt=X~O-`v%7tNTFv-trWe zi-=iaD!)yqut=@5PcPc{(NwMcoK=sAuE^hgR*daXt{hVNC>FzF;D$8z>!cztPo`ZK zbJcI>G)<2d#?UsoDRq%cfnCNIA$h_!y4OM7vgkv!!GMno~G3I+fP31(S(%EaKAa(L}|4A@DTYxJk! zOX+A2CJo1QbUM|RX5rGUiE!dwN1ieaL#S-4o443P+q(?F(n)^A3s}nuvcAY`H)n5| z82l_d8`te}$iS^UT`iF?B=c0_>z@GVgYY?%oNdC(heFA{P(?G!~RDIwD)7sl}CiL3H2=CPg){EjZS zkX1mQ%&ec0wiMAMq$C$wN zUnMck4LNAeSnGF{i&6a4p&aJi zypl^_Q*Dclo)q{I-*gCi?JK3_4HS9z!|hJR!|3Rtp6)s9lcADnnae^7mz-J3Wy3@~ z*mVje0joBh1VJWN;wDE&v z0F^CltKt!%ORmgsTDnPPU|+UHEZdiBnMM^JAk}=@7u#%==)Tsz!=}E&P2F|0^!I*N z;wuvCvdS)V_VVPD`33W^=u%#gy11XqEH*=s#u%EU-eoXi+3fWYaTEq>=97j{ai-*V zZ3d>Fy%-Fsq){Ce-+sV&>4T*N_UJ6w!d)%V-eQi*I%Apo+-=l4JNy$Q>#^$Q{-8BC z;T<9*Cf0$PS+_2#PcJ0uI%Q6n^yIr6YWIQ%fKiXCJ<2R-Oq>ruSxjAKwqFSFb$7c^ z5awjwvZEU_*62i7)r$*k>(9Vuw}!3vH(*g4r5MH=0_<=bDE78LQL{v=)=m`rz!G<0yEA~BI-i1N zld+5^9As){<6i6Q9Kj4C;v|^b(NG$pDtIrFAIg5P?dnbuRjY-D3MU+XQ{&WxCoN|g z8kuMv66&qY`n+38v*cy1i>rH}b1X(fMe%zNwyI!zdD};51nyl5NBD_b*SW@hZzl>f zU^j}3h~L*VK;|_EHE9Fg^{X3=w&|OYpSY^!w``GIwD$Y@S4iRII`YNB+gpZpR+PD7E%mIAQ z&FIT-fUZ_*(B1Wm^)#Uu*L=4t0dCTO>z8_^al$QRU**;Vp~Bi0*SaNQ4e}sc zs&qT@d?LHs_5bpn3dqk}lUnB;0ZQ}IPA(b$6y;3s<)7}98z-Bt=~~UxaeBdhovbu& zHhiC+MGEyYsW{o>oeY4lXT9T`Oten=tst)@+b02yd+Fvm`L(%Cesa5s_# z8!vl)Y5blZb!uO;;8W;jJXZ3FWpsCAe9If#y3Ug>SikWB2$)_SU1CHxtBK3CM`hjT zQ`m{bfNLan+8RJ#F z@yzk{^)!rSYQ1Y5Ex=%-G>WW2UsiD@Dupfpa9Avw_U(e|(cjFCKMK1;2^@I;Y;A6y z=>LYcs;SOMjhGUWegZUdlRHEIMN9yGmkXPPVr$u(bf5qLLXh=uI=X=7RpUF9VQK=; z{n%#f3NGp#1={1yOnaq@z?tdeM|kGVW5@8P)LKaQDsPo(u;nG1H-kp@mE8b#bV9OU ze`r*!nvV>TXi-royq~hra_lg0O?*R(Slj50dOGfU0t=>GIq zc^Kkn1xU}XF;>FLM~K3iZ6n=~!yZ129L>vK0LY%C)CB<(a#J+pDxogmhQiAlJ4q} zltEVMrR3CCNm^lY)lZqr9f42Q77JEQ9>35d)wqIedL{7SsEMvlE;R6O=j|47GoBdw zpNnm7UlTC;2?|W8x9?Xcs=5fp68VtLM4$D?s8rl*U{|J-yFxug!@JA(mzji&O~p`Y z9C3VnN!`czrb;N;pSU>>Z~v&gkcqN4zP0$F_g`Y#eclT1xiv*Ds{z{=Hw(JAeNx{h z9fGFn!CxTFlFR?p`%GxYG1e1NfHf6Ms{CcTWX=l`EK>=SUebR+*UmR)>z*@{t@Tmd z3UMNE@bdgT;m*Y|_T?KVzPP0VmMyLB^PFSS|4R#M4%J1pjkuDD6HuKl&6BH1&?~4T zR(a+?*_4TZW|*ibd75R-zLN5v+&?ZGopo|ub+o8gHxm`uQf7>-28%SAllIx);R0U} zm=cj#g$iTO0CWj?TlGg`7vG?7xVxMypM}r=X;pBZ-BG(K?;eg{%3o~q(@O6OPtqSB zeKplZEFeX15PsMKD6E$dt+51iFIi>;Umj#8wAvJSsG5HA^D4OosiogA&7i-i=I-#n z!Wi}7`0t+2^YdrS6qdRaqBQOWc^th2f-WMbsV0Ofg?7>u_Udl@j(Z9gq3qXN_=Q;= zLCkL%zUoc)dc z7bW`kCIZ8S+_>HyYXtq~#MZ@DUsH8>ws2II+2T2pL>1xmqZK-)feowgtoZg#UAlY- zR!<#iv+~(L9bBzv@rX0*r7Mw|I@d_vA~8t zG}*d2G38d$U&H7L?tb7r0lqZ-h(1uD?4e=A&w@_-^=94Qu*&W_G|gtqi|9=l7fo+h z9t|r*b0Q$@*U-nD^vn0SfHNy5KPTY-#Ms8|&lo-jARl0g5Y`~E+EL~>xtR}k@g{sn z`knGzozvy5mlwT~^sB6(>)rF7i5}qWH2d)`d#ANCU2hRdXdN2FPHz$9Z1 ziiw8dIY{?)u74I{E6aBba*+C;pzb#XqWD8O*r)`1jC}1j=jrQ-C~KfgT%53=V;~EX zyB>1S5gbnE4iT#8ouv9fM0X_b=enk5W(0m1R?%u6lZ?;i=F>k^C=0)#+&;;{_c-`4 znFGRq1z_{+yRijiS?4X^y8lEcAQ*>w1+;o@%~13`J+mH~)u8;R3atYP zH`hRTmz#&k@wAeOJDj-$_9`$Y`H5;S=9XCEEP6}%YJM;yCj%rIV&mXS0acEKOqB+j z@M>sQE6XU20FQeb6eXNI3qMu zTmD_y6lGju<{rn!2MP12W9qW4h^>!{XQT)ov209mN?tSYOx>x5%b2@-B=mgh*Z45( zVnfjXa^Fw9yxPI>hhI&T@C!`gB6@J_mkSrkfEu;9olHhI0gQGtf##Gc)^0*!)StX> z-ojMq-7ggJnvu+Ul?IX+serQQo;&wDLnSP|PaPhmrRXv@Rz z!2|p+ku`NIjiF$vnWm#}?nud16sFF1sfaNeOE)Um>e$yI1)A4{q4}P>{Nk2o&YyHt zFNupu_u&JDU!B5;Kl=7Xv<3gCj{E*+L+j%JP8A_Sk22 zRkTLU+T&JHQnmM{trb-6>?sL!ghjY#^pFiMyzvsMkqV z)XL-0Tz8)_NPzRZnSZ@so-!&DlSS~Wm zc;6(~pcT(Yft0s22q263e;jzLifm-B9Wo`d%Rw8hoyV)@u``9ldY7h>C&!klH6p$H znMvvJ2Uax|kzdAWuU6C~1;l>d&$4ZjSmaoh#wTbfJqdi2A!4sipyWxn^C?<;AZ+mr zw`va*V*$t1*+9246DfgNmHxTUJy;D?AsujhP)9+)J4X#JAA-?Q7B=#j%2Ebf3t6!zS->_&tEsGK5)l)2 zcdAd08&5q1hQIOoTo$@00x1CAxNCvkalE}gdndOFzEWX}vzp2*=C@N2qk)w;h&QNp zuG+OmlCDjSDjvr=h^&j5h6!00B`oaJvWn`+#me|UZQLCMt4&?zvdo^LtACeYH}nbu z31A_?U*_7dp5>)cuMI(yeG--7V%?^pC{9q+RHxC!7XqsOMq=Q3AM2pMil!hYaw_{@$V_AMLs;dm%z5aVwQ7KE zOS05isS2GNc9_0}PnttXxz9}c;|lj>S@}^8aH)RZM}ZA$TM88^H?2sgdRV78!53(D z9+<0v?p@|2z?0iNTw#=Ki8Dy+!|C zD(<+-()%<6)mzL+6IaTwR<(}`s@`BF^|Q9%i_-B4gk5@6~=047VO)_qZj;F2a+lE z+^z3G2zH^am>j;hFkruIWI=*cT4!MHI)M)6ujdIQAbc|yVDfcI9=X<`!PfWFBT%p+14q( zKr?9~7|X@D_{+(n<>r2|Ty(f$4w{>mL!dy%p6POd)NO~yM;-AzAjyJG)^fHbvwBrt zG}i&l{ET38T)}pIB|M1AIr#{B0Givn{xqQl0APzm9Q5Qmm@;d2bfd#$`H&tzfOO@YTGRP(^k;R^$m@KzJ7Ib%nw%Rwaw=eXA)yAX z;XIg|f_uUJO~?6D@SKLMeAS(xKDzW-<=`FOH2pI_adi{^&Nsse;2PFJeo+_#9$h%< z3DSYVdk8G6&@ymiEzF$Yf+@%2ZqA@3&iv14K)5q#&TZ3_<_H>#55|SDx?zkj+U{s z?Id$T+2=ANg($K*#_#?+}hfPy}1Q$xP_~%s#VTm^Pp!?4t%S zQu^+m8%}9bLS23y^et)lX=+c#4Lyw5EbZ-NZM;wwoV(i=3%WWMQajv3@ z+Tl0zzjhzmw8aesUEDVm&e@vNQoHeehB|i3*L8`3)K0PG5R75@^By_fr*Q19bA!Rc zM&Ckd`4^jTPv30e^>!ii*oxDQq&f10zhj#b`GogKx>vZpZ^VwUgbW_>ICkD`9#1Vj zV~RzYErcy}(5{zBi|e%|m6V)_rEM9aqDSCID!S7{am#JpKD_M4D`gP6hy6Kh$a)i5 z+Spie9n~GEFe8fTvK22yE{j!tp_%mO=IHI1ycJWY2Zn9aF2Qo$;Z>n7=$J=otAuo) zEBL0KIuZIKs`up&s*Br&E;(G@x^#bJ7qUm)fx9y2<+X4$-d=wyy+ETb%(YB z2 z&VOx727H1%`=A7#zxw_CvBNDh-_3?MZk$g0;|KN}ot6_Sj29&6&bz;r#hafodRNSl zToWmLBwsHzWf(PaB>F77ERm65SA>FD&%Uzg9kO~FKinIHCy?T%zq;Dw3?1EAth2}- zvTG)-{jpRxfmVuO;g){$dNDP+&x58c@scq3ls-FV7O4N##iZ5$#k&l!vgs7sq|Zx3 zI_vd;NuM}x!#dH4gN`NzWZ#x=R7>gS(XD%k0&vw<-560AXlH(kuSIB27&QE}u=H-R zFyj0$VwJ*#n0zIevgrmI&BImKcVUd5t(w=i(R8$wvtNwhyrT6>xAJC_O$^ZZW literal 20136 zcmY(qQ*b6sxGoyowv#WmZQHhO+s4G^Boo`Vt%+^h$(etxeRkEZ>WlZftNMM|iZY;J zXh1+fP(a>l8hU?_Uf6aZfPl6!fq?!UAQNXZBUdvuD^W9ZD|;(fD+haeYZnLmE6p$a zjWOh(9R(&sSWQ;42`R-U#&e!O?v9v!R&Y9Uijv}Whw)?8>789$ztQ!q3uYH2E|Sq2 zKj)-NecL-*+KRqLF~-;4@^+>!Pe=n#SJ`RmOy{vh!(3ANvgNZmq{h)E>qU=Hp8f0? z$6eR_8y6Q3#qOPzv3-%+^7OGx5q=(zQ8a|10Zr1|D+^ICX7`wt%e6&JQPdgxDDY9< zG|a`-`t7F2T99x!>yWJKmSRmjMOn4zELEZrBjOgfZ%{x)6HVGtT>%i0pW zb;b+(Z6AruG!0iuKk>!Wv43=F9$$*4`m-*5*E)ym+hy^NgAObG%Wk99Ki>qWy)8Dj}rH#als0!Oq3UJ-|d^L#^YIt^nYGAcJ@X->`zE( z?d$gBiY~YQurxB=)#=R;xsPnMOlgCb(aFp*QF+PU2cczPS|Ule1fdx@)jnzm)wLji zH~OTdxLfN8KjWJ_-&VQ`a=DDt_fzb#2XTd^@9Vd$S#gIqju8}Tce z`fjp>>+%*nZBJ?rD-(xpAO#dUHzDxiwhcih72*%d7CB*L?Du`~WSGhGLILK273D?p zzvjHqb&XteG4&+}Z;qd?@XS{ox;g-W^eLvcIccNgrur1z+7U-*=jqttTdfAUil^>? zhu|6dnnY}Ha<8D@9qyp_`J(+AzL?Qi-!Ka8kNpAPj)W35jepY}bevk`2Y+p>kO-R2 zov)jE+C7Hs%H=YEfItx+>V<`SAv^etWjz~%CPmCJy@_j82=nOKxH!QLu)A4+M&&DJ@pcTYDneQ6LX}VVp+srbpxu79jLD){&(CCB7(F(1Yt`>Zo~Uvj8)y z6@b17C7E+CMQFnd`_akMS-M6c7IYYvR;HMk*PG^le1}|blRKhnQ96C#$jo$BkAkhv znRh-(TydtCe6y5SY()8$g;0`RoeYJQ0ZOJLNO?1xz2bV?5+W9rDMHXN)3o2Cg7P4C z{gIC?rP@v-&QpUs44sLYpm5Nc7}9@Z-DFP$fRW>4ct3vf1wa-@w-3ZjHce#UhM{vt zqxO%E3atcK75Yw7Gg*B+y-hBrmnARm$jKYvje5*4M#dwK+JBiDbpnBQ64wu_hhoulvt!R%E!3WdU3DCn=vB*+d zK+1r<`B2!DB+M6?F8`70S5kp1KG+Hsh);$jArz6p9DLIdEQUdyh|lR+uwlJw6}|O@ z+v@C3i8)}34INx~DF3q@yS~Zw-DUgP9XpdYe}@%0m5(!c$Be^3T04HbI(oplEp^PE z8z%G(1_$C`X9OU!a=xe$gTAPH2Tmj!ntGS#&Jgt3VlR;*Kj6fisl3A@mfnea)>$P` zM5K8#-oH)WxFLd!F^bRMBrKV^eo?SA*!U=4W+VmH^L{Co=b>O*L^uQMR<2tp&6GoV zZLA?Snc(uMKnp4(%Nl2MJ9CGv2QVOlGyzc^ONSzugVB3$gf zsYbU2rsAXzJEJPjLdc5R?|%N9ixc`|9V7es*A*=3)BR7o4I4or^$kY#~t+v%Ofmm#JBo^+FJ|iuuW6P5{#eyoq z6g3k~mB-eM<#2nzc4n1e7Hzh7-m-l9cPqmwZd0l{hLP)sy*p~iHODETD1=7AusMu8 zGN-z-L!wAEXI6F5gZ{ib8UosF|2@(jSRqOW<+^8+j1#QzCe7BS#QoI@HyG1UItJJM zSgYGR3$jHv1ObdcljZ}15UK``9au8zL1U1Du8_{3TvzpgFQdGaHHrS&+GZzNd2bPc zcb@))z3Qvkpu${W{neTZkCwtKb53Y_;i6$_tP61gCo1FUMd}9?%wi^g4Hm0TRR6}a zp_lW8w8loEH@ZKK#G8QwxOtZIe6hmOS6R|zpbhJ8*zzBSP zLkk!8IywlYc|L;0VMw9e0XjSH)7MZUJmu5KWX)gmtz^v!bSfNtUkn|792UE0OMN~% z`J+JG5s&nf&Cqs3r@s5OUe7Ec*IzU<5*gnzhjJQ_I@a>9`U4J6$ffEMP)~ne6p(~1 zLl;f^jVWJ0l)6grDR5Qb+p6Dd-{D3t~US82tI;^qNR zU&QY*jniv3Uhwmm2xH2dt9* zBSO^Hxucr1K*xjbk(p+~Qb81-yiAedcltz>T zIiz?DWm3)|CqEqAfRI6``114mT(fL{ zyes#M=INfP&1du!I4mRC8j902y0;W(mOL_`52}xZk%>=nNJ^0Rb;A>2ky2g%&A+|v zzrkqbQghA4)m}NR8!+!zh{Qmi+-vCKinhPYUq~R~0gHnANcvf4!B03l87@#x(eJyK(Rd__#<9;QMr@@XtN}m0D`1<`Vmc zX;Oe3&lMHW@eX;RqA!r-zDkDmV9P#ajkdn$tTRHCA3s z#4F$H0MKKr?Q$8_%Ql1I{H!8sOw8%%h~ms`K<3MFk#ytiEAz<`Y~mpF>IvBn5w4ve zjUZjQ*BI%EZ=Rp<5$kCsoBUxrcaU4UzDSuD@3D~horcn0)-q9?cMj~J5mEK`--?F( zI06}6h*f-SY2~H9^i5_!!1HyQi(|-3(m78u&*SuT;GJhA;Ss>&B@-A!Zru$FG1o^D ztEldH+nwu&jKDt<5!^2cv*q*+Xejg-b?4{wRct2`-wZ}X$bJ(?{ zB@soN1(zxfkq(n1H}z$1LZbXK!3ZCc$xzd5_pT_nd_Jc<#tE_y>XMO!QuR$`F(UML zbs?%VgpWWI2cO1rah~2{ESG+?B9Vm`BM_x}*Ux<0klP^=EL7BzGe1_Zr*k{zkIT&W z#^xxWr+5uV3pdhM`ETE=&*@fX3 zU?htR=KUJ9i^ zz6Q1)oExGyf$&rG%6E!;C*ja1@3dVqbaZ?J*2OlOEa4sf3D--o*YD{1>|gUL-?mIG zTOy4b%n@pIM%c>T8z>i6pv?PlMHw4%)3!8605G~f3t z2(h}pRLWLqE7{1xe#mUDH~riFg>Y2z#TlE*>o)NP=c%S@An}&r^G!te-IAg4V9~ zTaa2)6}$X*Qli57KWOHz$N~agW;N|dJ{+F(>rQvV1a02gK1#+INt&Ld=L6_$GZwBA z$zlW!-KjBAvNY07Z9}X}uqvlE55T8Y`PM`onVC&UV_rg?`LRUzgkcV08M1dOZa!xM z6hhh$o!C2+2y;E{{Q1{@Tw5EpX_sBCuruSnyAd!bWWz6J&21PLnkVlu-QtY~R}l?0vaNtQjHb)-!dfTbovI>GKD z=2j&?e^%Jv@%2I#Wl}m>VF-E?3BSWaS?|@jULUrqcVFf#?p866ko98SrO8w2Z73`J zdjcMg53%2Iyl5rU_sF{`ZYULASFmt*ehXQts%NdLE7;9Sr!HoYPniT&%a`=1QRgNl zvedKKF1NjUL;FlAJv{lTYM`>qHdDw&&h*!<{Dy9ydfisv;L`tNg@0vZT}w<-neI(R zk7`|=4fZ_Y)l62m2)@_DesAiSa9JJ$nTsmaBLJ~O7ST)sVz>T39wwd7IMks@XG{0{$?&p>QsZ##$=IRAU%n-i|$8aSs%$7=y1(JnJ2AYErJ*r_He- zm!VeXE&c*)zXvT#3-wlNTD=}l|Re1Ziw0|{=koAM03Y*OMQUg;rR3=;csmLNtv?j_oDm2eQwTtzr<7}+T{&*yC3~eroU*OW&WJpmN0@yOw|^h%xVT>X zVzJL^tPDDA6}CPZtzHiMx7m69vGd8O<{NV7?)t8$5_;kX% zFB*RlJk2(ofSy_SyDrlmxH`-E$Z*8E^ue}^yj9= z(fja&X>U`TL76aj*}(9{vj4go|1#lk<(Y4$U$qsHY;Apd2~*US+~Lkv9Am!b!MDuo zZdIvlsH4C8ENVlQmbW?GTFV{=9d|Z2d>3J6{yOMw()Vdi-iW`nexeSKU(sh{W0Xe9 z4kvEplZ3_7H#SD4g?1I-z_@t|_UnW#Pv->+?|v&4FZubmYEACrY|0`H&fE|+l0#$d z41})BblI8ghNbk*AB6);$rH-S4|6MhKuI-9oBYH|iHN7T4|J+O> zSM$%-L-R(vQQ3;E(CD}GWx@LNo}n)(@F-(Y_#y6_g=CM_JtR(90qT$8*Eq-Uv%t_{ zwznvZiD|WO#9KdSuW4KRP7dDE+lz_ac6bE|3_<=%4{rsVb zOvf2-L|)Mcs8olOk2;~)LY!H06=1J){dTtu?=vMN-}zQ0D*!^^_dClg6{Nt?Zdp}i zSi*_|*CC-l*jt3$_ejlK1j5fg>6C!&J!#E&Se^2s%;wOmkpNt zUM3uy)XZ&ovSRX$GkT2Tnq{lDypUMHLUx)F5Du0*O?Jv^_r09tG%*@InqOd2JRXr& zu;_)rC-wsQtKh(0fHxWpf09BAl|=sc-X5a>-f_g>r(=e}j*)+)aR8XoWvPhQDrL(7 z(l=D`U%7}YwzV}HvHAfdpnN-JS^ zbhvb72XuB^=~WQnwtRi4rtSLda@W}ftfbqt5n8k& zCAL)Ofn|wEYS7uaTka9wC>3BF;H!@mpUbqNqOU3z?5Y#tj7C-=SYO!X!mh+BsE8M+ zS*eU$>;@LJXTLil0D^wfjxr8x`4=4m@UQ|i1_0`lw{B&Q>(bB@DS;FZ^)w=s5pPI1 zwEq*_U)pgyUTY*-kv`8W!mrm@6oi@~1jwG?#grbuMa6@0@ zja_q9D(x(~YrcAq#)tg0uYSeGBMjS>O4Fw{bawPJm%cdgS@)rOrR1E!v4$h7m_(2{ zD9U)(Ond3{>g zphk8zq&zgITd(re&3d@l=yETTLb?oI2$=@7q|B#%rC{`xb806zFx`*{#Ic(*L$pJ! z#goi~eJexuvA!Sg_1APSTO%bo{ohZ{Qs^i%%OcVP%j}m>ng_MyK`FktD!Us=G^=Tm zK%%GM=_lbPk}_#>k&(#x)zq{+5?%|P2%nyixn+-*ccxv6v(%+ z15OZc`QC(X2f%scy^33@PjHP>-#CB{(;W?&hz$?rs;qRN@I@8>#TsLF7;x`fYSYSZ z#NGaf^U;DC=sl|oRQEzjwvItgB@uRv5{iN{zV2Oec9>`U#9Hb1vr~t z=zyHrfwUIM!|^!i*%|aF(r=+a%K@dnV|fK)&NE60nZ##G3SM{=$MmCksa^5~sn?&Nt#QgWR z>yJxQi4lx7o6!O~L&~V^$aJ&1)p89Zz@9qAP~9Xh6R12MqDq43^nCE}=&yPiLs+@ID!Qa( zu<)qN8q<^_;LpjYr0gFB|JFYW5`pSK|CAvw8-!A{Gf{mSUnV~GFP_lsk!R8S1MJ*M z`pj}?v)1-Gjlr>y?~T40NER}c5-_n6LFhj73|ZTzK5zp%4;;teJgh7R<;Y$eoh~z)Np<;g#OMDy8?wMc28Jf)qCu zL|{g!mgrsKAEDw`xTB(D}&Zk%O3xY|I(c*nxZyx)Og1-U~2hYxYf|$;uDNbKUuG7 znIat)0#KiLT* zPg+?1NSA{+-1f^>mDMl2^c3~AUoa(EE+)v?e#$v7e&BZbxnH5>>xVmwbLk=o<9d#@c1QPzVrmnp zP2jjdRa$PI9UYiEebeO6;oLzV1H$jN5ceaU^8}?8V)x0Pea<3=2oY=;Majt8!wz2Ku6L$c$T%%Qq~n|!vx^KuPpl5qb>EgY)B2~|dJ)9_ zMp0rHD)*TS)7Q9YbrAm`lSth6dw8;^guH`KnR9$NzzOy$7AqDDQUHZNT=n~gTEg3v8=FhC`9q}%S)un-R#)AUcN6WJwlT&RK zlgQ4c}|!_ zo;fr2NFhuNOMxQ$Fuxb%hZgGq?CbHqb8{x?IL)zY>#WNNi7`?Pd-jj5aS~yk*WZ*9 zaHk1g>Qk-95gB`5?#!G|&-ca3RS5LJ0r zNh~N%W-G@8)igOl^X#=mhc@m-TB!!Zh0p=3fi!9s=Ca*prb}Dl;Lc~ZUMbkCOp?0j z4|$69J#R4(cL4gbnDe*5j9UL{MFH|=M}H%^28T5YMN^cmNvCooP4CZ=AUb>M&c7Z7H0bc5WG7i85d^XPnCVsNrNE{Q0+}4oes<2>GBR@X7(i~8B#fq$8x}= zou{=~)_8q8B$eVZj2%p;@9BqV^mNJ5_c0B{x=Kff|x zN!Y67PGj#vGJ-ban3Ji$rLgxy!@ZR_OP?=EWeAN(AJdl&Rg!jaqBHAE>@LH!yI4jd zn){woXmXrF@C4Qkp1`<-pvio4+d!Ln>ep@If6|Eu&!KyYbx03yKAQ3{+{c(YB;1i?c0jDf~lA1yTi-qVMd29;0(4Ga$n zf~%`8$hDiE*}~UT7Ie!#khteu?pU88(Vb6Z{KW_BJ3nJ2bPJ#r4)QE{*G5ZJhf4wl zvw(nyY7-Wi?3h%*Sz<9Z*S6N*(-bvnV3^RlCp(c=Bx3648JpB$MR#uz#L|>LyIK?T zB*`&R!#;_WJ{Xz3ehcaS8T~Iv&N)Jsc zr>$8jIA+thYU5^cO~})b%YvWRed>> z{T0*gn52u1pG6TgU+oBkov&&gW!=Z32e^*}vsg8*$erN$$97j(ASSJA3IkxzH#OWJ zT5MM$oX(&Qc?~s$PqWIDuh!TB3d8L&*2u}V4NNU@AizSN@F z+&Nc-V=$|4$O@7%v~$2I(>3ZMo|NJmWWXe1WEfT8Jy@Bd&XDvbW3S9n(?&ffyBy|5 ze!=Oqpl7=G`qAVcVZ#16V1d3&^9)TrNX&AlAvDZodvN$dBcX5@&=O=EB81$hN~Q{w zrtgiSHAdUsq20K=m^2g!RmM;T=ZmennJU;ME56FRW5R8wD%X&lxRw57PnFuN9v2xq z%wq<#8rNOCjO ztP&|REUCNra(I$U+g1J-DC)xg#~#Z;pl*Z1qM^y_!3Pj?b?lbvKC7i{t@%LzSq}vY zIx@eA{qPnmrn;4+2+ctS3HY=?q6N9b26OMh_(n^*5ffw*>PdG^R-mxZ%qij4UAcg% z=}<{1st2JM{zZl*&qY_jr2ERM6~`80A|%KiBhks!5FJPe;#&k!-+}t8$&((KvOu8` z@U2eRN5e6MZm7GAR2+%Lye;GxB!4d0unE6xtcaOb28!lJbDF7+wd74^LEXQM;HB91 zWy4UU(IkwG`q~VlV$X&m&OE=#X3CebVAtR1O^XFDcN8*SkG}zO(9Spr5VCYYR1Ly!4glu-zPW0DeT7p zJYPQXUX;;H;oGEPW7^kjtk}BoZ1!liTElQ~@jUucU#!9dsZXy*AfQ+8uR+zK&v}d^ zwgoA8eMfc7{wFmpoYpb*LOkhvQ4547CYWNnH+X~)h*`iga0)W`&IWO(75Hz@HpnRa z;z^2_T%GSl|FX@%BCg{j1YURZ?&e_nGCPovlBDyYMA zp5gR+UuH9Cz&X(S5|qvgn8pf_in>$zwXHe!h0z$qYyEbe$;C;Vw`aXKp)a&}6$Jm( zfX3I}06$1Z9XqZIIAIFuhISq&BRsdM`X@pK&!v%yPmp=;!h%M8I-_0z^h-O(^be6$ED`@XYxvuthUH zR;514;b3s3Hmaz)?YZ}Z4n5J8;oS{00j@3$ihl6aGoSu=gHW)j)Ozwlj-7wG>L^B{Q zt9(Zrd1(MX3;gXzTOS_3u+AMAW}*C-SLst+dP%UYcP-JO=J}8Tx4WLzDZM@%L$BZpD@^=ToBvf zSF@HWeMB~W=aij)&hhs54p{)@kOyViN5)r3SyKQ(bj5WxE^FE2K)6Y~)@C5evJ8$o=P)=kQ9+>z zG~E)G*=S>Km-KNhw}7@}Juk-Et7mg-E7!@*R7W5x$>Ec$J1ocMmU&-tD--OBG+%;& zw`9-P37ZCpy zX8Fb2&~7QNIS`W_bf#g{CkkzD7&xaZjbRfiGsu}Z24w_f4{LgaDE}<@_UWk`u3>=TwkU*P zC*Haba_EwE>1XbS6UVaHz2rNhF`C+;sho#oUkY7|p_8}tn(+^=?yu^-d-YSSO#cji z8?3g`mD@!KTi>;1Rr$%gze0S^5~MQ?@VX)no8G4IfPwG|`w*``A#02k&5-`hg9SNwYGNQHyd*39oPRBcJ}8E7KJhcn}Wt}iBo7qc#Q zCVEMiiA(;gToSA{4K^PDeT}RT_y(tj_8tuFv}d(~`^H-7IsEm{uzI;1FQ?`3RPT=% z%MrRIVsVX38`9ZLy#K8jUF2}e6fVNrzC6n|Xu{h#1*_->)ECJ_YL)=+;ibyMx=lHwgtnBt&Va>9{PYmj zP~Z=)&L8=Ova`@mge+pgZO`pTot12rT>!R32ZSy>RgZ&_AtEmM+>;;KTw$Al2rg2z ze^Ub-ugM?)7l;B{Fa$*Dq_-In;Eopc6rG5OtT#|Umr4}Zc0zvbXeKV~z8iAF3+tt> zP%@x`xm)Po(rerB$GEuA^;ZTfRHZ$|KLDb@RnHE*=xIME4l<%hlBEc$9SF@=6i z+b||_>8;1kHz;qYV8_4v>@R$>8#j9JE=-w@p^m3=;n#AZ$otJd5#3d zdh?QKwj>9^I?Ke22uL3-3>eRxc{cblIKLPAC?-zif32kc(bD}u$0Q2Di5N1B1(Qii zIVejaq~={^VS#*T`pm)uaFd*Z8!IB+z`iucaacO3jA*{9u0H}|qC>QP|7il#f0_W; z70Ra%(g0t#l*l=7m%bDj_~+0<%cC7P-FqR3E{^Ic>o0n|$8P%Nq$!ECz_=H(Xn^c3 z!u>slT$uH?^6cZe?18A@mSau?`<^E`+@P?}1^%9?v-nAaZ|M!>W;AfCabNZ8A4i&% zQg%q*m~BstkW`1pdq~gdh|sb>-TI4n<^3(QPtR@V-DJ?=#nLgjC-i?K+;);Qnn#g- zrU!Z#?+}7{Y;|~HEE|rxBp9w;Z(==0H#Sy$9_3ypNbAUwQN64_`+>=#G4Etvk@apt zopZq1n$_X8Hs;e`U?)vzJUc;(Lac>1Sk2yuJRvZaE9Yf-_ zcKen*=I9Ksf_(6qwj4uQEMP{vv$;^ZWex6AUSup8-Om_CR>4krB2}LDPk!sx-G#n4 zU!safZDX*f0~^N$cSQadcdOvKp(p466|EA=OJWAg@5GkCbm~ho#VhQ=d{ft0c}cEf z+bizYCI!V&Te62B+(*F;;mf%~C)QWreD3&u2-g!(X79-J*7yszHET8XxnzT9-|p(Q zu{^P#T`DE#W7#g)q0BZw^rP&Q0kNYq|6_dqS zqYhkd4N`_9SPr3BApt6_mQbSV6!9n_e;%B%1Wq*`r*;kj>@1ALo^V+o^wn0jgRnGu zc54lGR}OsRby&dXprc$zpj-(p?!yLE%_d~g4$z3OrXkBfoKnbl1vxEk!Q^}0zhOLY{Y%8D}ax8gaE2CL1VRSnEPHW>YLYy z&{x5#2TBUZRggp(poBJwcfse@a<~oITC1t#sy@~Z1q|9x*666nlNdBu?88*mF(5EF zNA$S!r`WA9;K3fcO*j@?^flZ>eTWiFBLr9zQ0_X|QPU*s%T@d*M$=@@mKwAH!)r(@IR3sYu0*TQERBXFoeiOU*i8-6OS`M^e zZ$)$dxswWeR0GX}9;Y9y2n02d9EV%CtudTg;}%j7hdQ>yG*FZy*023NzjSC!)c(XqhKoco=| z#tUhX_Is}^w_)Ghj-j~5aam<6am7OXJ23rf8g@Gj_m8(@B4z&9Ypm{~V%@@?=Z4

nm$WC1Y*LbN9q~N7v8p>JeK-2rJ0M%h9yVE<0sVmQ7nO{oF?Si5;oth|>9@Xcvg5 zuW!}~(G&0i(Aex0xN-;UCni0k2#iMGFhk>~dl^cJ<8#{oPpcnjx-9=Mtu9JYF>wPb z=frLzqj3=r^g>JCX*{mTXWejXQ*Xc1xpeQT3sO}Zn(24FacG{?x#&2}L#*}=D5~um zJHMd0RSsGV0BP?ab!FR%X0S4=Zyj3k?mr$KElVr!5R8RMzsUBm_?UcZAq53;{#?<~+Q-~QUO*ucN>jarghL1l88cn_CkU_O| z1N3b1yr@?h zqajcS_Fn0VHww41!KktyheL+>c!=(<)T*2){9RfyC#FGmI)>1Y4CG@<3?iVYHzEqB z-RvMWE7yy^sjAOX$0%XOLFcW6oPyCHgtj`h*;IJJ?)Jq2Y5Y-a6z0GLKuXh2MSgS< zyQd>%&Yn%=R~0O`BH^8S+be=XQx^#Yb5+CC55n$_3P}i8@uu@1IChzA|0|@S)?u&R z{8_%LycU`gRx1{>6RlHq?XEZEY$^M|Tit;I+`b?s+7A_}V>@O7Je074dta0vx(IZX#r?LJuq}~6&E^b@1XYw|6{9ET-0#aBTBUq z+!bFiT{EA8r6$7y2)h7`lViSOZ3HBf3fS9OA#EI;m^FG6MFr+2!RFmpDr-X=1!w;b zNxcaeM|PpSw&!ozAjCwEzSblDT-AW>xh<6-Bp65^g>ws*H&3+0`BbGH_l z+s1|`LOpLpw8RP(%An%!<{MV%)!*hk(liRCtQ_d`qjIR~NL9Uq){EAE9T>~lrGvCttPl8BGZe1g^+%Dv zMEquE-cz!jy+k_Z(k9{CLil$!wy_odPaphGrJhCbicSTxg`ZOMu253-<5SH9annTQ zwts-ayW5KmU%W*QPWQnTssTsVZO1*X!V1{x_bl&|jOkT!U&pvcApxyXvqjN44gtP( ze&RYGa=7r&BRm>nRfy;dxjrjrd;HUk}B31DxLv%E|j`^!vMt;W4h z=;wEO<5rG?g0!QvZ_C)c5_hI zISnlOQ7N4t-GZ;kR{6L z0iru>ugkY*cNJxyi?aC+^_YP8A~NsY_u;AQNti}gN1uZ@y8Z8?r$DrRu$S~#ero=N zvtTjN!!A%UtYXLfwL(*2J5kX#BeLjc(vAUlm$_`g_Mp8C|I3YYNyT7mAPCI&Xfe@C6@;bQKKE}sQV zno;v|D}$xt#w-RBS*K8a{LV=+0@1F?qaZhsj3Kwa&8x}{fB}5A9JqLasT1Zd-e?2@ zsO1a8D9*}#bBeuwA|)&Hla{N(C+%>#cpms=>Sro#*;-Aq;^EV92K8D%xWYSav%4nM z)!W@*Cg}|9Kw2!#TR6GmVVTZU>QMK81&&?*i`HBs7P~`UKsZ|aW%O&I6yiy!&*s0J z(>J=VqbN0OY}qrCPr!vu;p18@p1I>?>f_SPH~gj5@VCZ!V6v>MS+4Y2$%w{_&GuW7 z{OOr(w)wdEoWMT}B_t18MSm5QUv&A=R$gRIYF-_|w>xlXLGd8xwT&c@Y9GSKATi15 z-=f8NIEi{Vym*)iekg-AdE_2ID!r0QVaPfTpD9?>UL6t1e+ScB-5Zoy6a!BClEf2- zUPfur2l<*tb54KNv2sDrLh<5(>Nx)x&T6ZcAbbgn4Ld*MAc5vFqu3!esL%i z33W)x*_k^Xg2*lUz`s#KtpemuW^_qmgElvN46Sy50L6v69E_iCFqtL>E0I2TUzBnf zwb{cxv^2c}LdCrqhaWO3aZ}uq$>1?(0>6<>%GynEo`M71_815ST%-MBPJi|~SFekN z{e@5tUe><5dwYBHzh4iQUJQP|ZWPic0bS7QO<|wOsOcXe;R>SCKy7qFHol0>`MR;s zy@CP@jB-%DSj&38X7vjD4mTURWMzezCH%;lUH9y=>t7fi#Te&hQR_CvS?^-<)y%#p z?JZ1@|L|;fPnqg2!3pVB1x2RYK&Nai)-e;s;L>e9%-GTXEhTlVd9w2mZFbzIKzo|c zxG_V$DEM4hXJ*&O#qKY?_ClYH!Zi+ZUNXzO0%dz|YisMO=A12eV$V$cLgk9@si|<} zKr|!Mo>gK>UWE-P=ZdL%J=Qw(;W9sDf*M(=9%;=;*c&Bax zIqpCP3|QY@6xP=5KTDP^^J`$ae2?yzdOP%ytNYxO14-MDFIplemyF{tXV(fz`g|-o zw7sN#Hdjs_TIRijS%Nv)5`Ik2GA290vZgUazM}cFowYQX?u~q9-u>Z zwdLuG1w$S&n(jJ_Au!rA^lfnEdFo%I7O`wz_vldj9MieEQcaMHu;%iMIwDU3JX7zkS;ZDHX(!tFre(2%+{v94}OM7G%R0RQ2PlC?jU>nm`o=@c`fY^yBtl0~{ zuG1F{900_lEu2~L{fpO!KX!>%`fARPp0mAiA?T5^S}eswtD*DAE%{7$(fnp0&wScq z*K)-E@fj1NSkH`?GDXg*t+Uv}OwB5jPS!DDlzHno{s@jl|C-S8S51;q^$8WOMhiuh z`t!NqG@Y(2xVQA%Qq26H3*C-is9A;2$vEVNiy>57$@X1^z7bOl;;57jWaR-_} z%SeGzpF3OzLNc1z4yw)UG;H!2C`zI|^9dX|JhaBDeD;jdHRzB@79m+L>a-rvAdM)q zy*qHOXNciO{tXMCrY!*Pu6vsB)BWT9R(Th(jr`=oZHT*+NT-Xc2W z=R@j)hAJGXBlOp0Ps{5@3-0;_9z7v#<&{l7W8Br7kRks9T%;Sa+;nFPiVBQ(s-DB? zAg1?pHDUasY%}?#`RF`ac~ojJ)TueIOswR zbE;yg*(seW1dMOO=59+T9!YQb_O#R(!&lr^@)`0-l6#9y~Y1DtMWV(kcbKdeA1nZy* z7D0N-a1d23_vo(vM>mVVS8FS1#(8;vGpb#Gpe5~=AV(JlEkQP!++;6fAsXz!#TA`wbk7_19rB8lSeUPkA=#v4qI9bnC)(LML zFaO;6U}oQ^W_2Ds{2h!Lf^igAnv_R>Xwzd>oJV*O520w|)TM^;UxoK|^2GgqP&VMW zZttYf+CRPggVh1g;s=w^*jml5=*xh+1#>a%;ME0Bf1|TdD_0kKl;aP_nbmR1g)(pbsd> zEeo^U95rnZN8_FHKl#o0F`JPT>p9g$mq}6(veg#BGJca>X-XJ7O_`JdJ34(`4Pfx) zalo#NIn_$@Y3{__b_cZ~^_i8|cfy5FHvDhttdvl-1GgP*g zB3G3gEZ*TEoN=lVV*3-GI~*Wo(|Hzu&OWRkWIn6WZ7I`aHsRB~(4=r0ANaw>a+=@+ zV1jU;=;f`D90gbrk$c4}9>dDo`Srdu%g(E>1Cmu1b$yDxItnJHv7WUI=rqP9L#bF` z_nQ;}EXbaE7pG<@}8BcmXv2VWu@RcYyiMVkst{>5!l|wzz0OzpOm=48P;E@eN~^9i*e?N zSwDx>iJ5bpRn7%U@-l{kYIVQHy{Mfy4nyqf#;hDyHd1sn-Lpcs%gI|F8K#AFQGP_y zj-Dv$ecYeSw!|Fe##c>J_i45rtdkDY`bs`oZ`)GdTT`j3V5KUarz627#A-R+mv@ER zlM&ZpOdb&v^H!zP{_7{}iG}w7#^**5=MYLHG%Nkih!0Vpr{s&Lr;d6eVXsG6`y|%c zD0@0dCyr>3L$}Y)J8QFW2jK$oQpkhq4f~P?=*__yf@kx|inm+4M$p;L143UA*Gk|< zQ$2OD&cQ*-TcPZ*n#-udZ~DdAa4$h zE*yrZ$}6Bf0WjGcJfsG;BRybx7v%u=_&o^y)g>a}W0%j?#yGb_SoEEA+$8@ld8C@v z@R2A@xI+%RsP}|=t%HU5uxp<2hoKdG=6-p4e0t0D?rDE|WhU31mW<&{L!BwZ)do(I z*ErLKovG%EL38&J>A7R4lg77Yw;^9&9J_;)0~d+(eKD9g+6;;>1tby4YDAzRqFy*f zbyy#CgX_oA8X$*A(dY)Bt{zFqA?^ialGxp?{h5mTAcsw%#QmZ_BIngzC9RG!ZYhjiYhC`jx4*v-Nf zB@qF-1xXqRe=sUBUCuvxO=$~Qdq^aV(SgPQ!?&B%#Gd}_lc!y1q<9ChF`_Ky8iiAQ zg8@0~sOr2!U#&4&txF(Qc7|Y;$T)aHBnyDQq z8zz$7xOw1e9AkA#3ShGXCdWOl45+4Kpw$sm^ z)d}&*DlmG`|LOa^%AAkv;b_Bqq`G@*>sSqljQdSeSOVV>1(W44Iv>I` zo!LJ71*DK}Ao}lGT$&5|`uee0V(zL+$Q{}D{7s59kY08%{ur_#^;DC_=`^~C5|Ko3 zx5%Y>sPtq*d=b`E;-_B8s!i8GuWZO>EdU9aI=43jt91}1UsG$6{Q`?ut?P4)RVT+e z?+Jf*Yh|L;p9u4S)5p0PFjoz8^U0ep$8wsf+}~m<$UAg>>^xXY7xHdiy191;*j!w2 zPMm;qT4L4AyF%wan?&@80w?;h9{q-BI0bGE&35GyXnxc*GY*!5)mSl!%@{NE*RI>wux2bYB3_}URY21} z{Vouf26D|CnY~Z&ucen7vQ*J&UsNCLJTsuN)@hr5Nl-#6RpzCcg)t?=j>M@+VC0W4 zqB|HQ&m^AGbbvbnMg~Fn3D?8J`x(y;+C6TlmMj$Nq6uoqHC4bTk5YfPqn zJ~;?78!&n%*2p9us3)O-qN5AHWPCkk*8_wcy!r7;D+6sA+gb7n=z3Q5PFLucz~7n4 z!@_{`XrVvvzvn0>FwOs1&Ur2!^-^|cy9~BNE%EC0)X?enrA_!w$!CGKHm1Nczr!7y zaNrFw#p7M%_Bh($sO2(fhsDqc+Dcu~<1>l1cYs0RS|*=PF6Ts<`jk^QwT$lza#Tk z{4ArHp;&sXQ%jugK&joE)eU4{7JX}5vr);sp2nMzp9%_9E|K=NZ8+D;&VDvUA1aRa zqbh!HLAGY1 diff --git a/Solutions/Armis/Package/createUiDefinition.json b/Solutions/Armis/Package/createUiDefinition.json index b97f31607c6..1c9a6ffcb49 100644 --- a/Solutions/Armis/Package/createUiDefinition.json +++ b/Solutions/Armis/Package/createUiDefinition.json @@ -74,7 +74,7 @@ "name": "dataconnectors3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This Solution installs the data connector for Armis Audit Log CCP Connector. You can get Armis Audit Log CCP Connector data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + "text": "This Solution installs the data connector for Armis Audit Logs (via Codeless Connector Framework). You can get Armis Audit Logs (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { diff --git a/Solutions/Armis/Package/mainTemplate.json b/Solutions/Armis/Package/mainTemplate.json index 9064b650751..7339ace064f 100644 --- a/Solutions/Armis/Package/mainTemplate.json +++ b/Solutions/Armis/Package/mainTemplate.json @@ -2,7 +2,7 @@ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "metadata": { - "author": "{Armis - support@armis.com}", + "author": "Armis - support@armis.com", "comments": "Solution template for Armis" }, "parameters": { @@ -44,7 +44,7 @@ } }, "variables": { - "email": "support@armis.com}", + "email": "support@armis.com", "_email": "[variables('email')]", "_solutionName": "Armis", "_solutionVersion": "3.3.0", @@ -163,7 +163,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -229,7 +229,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -295,7 +295,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -361,7 +361,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -427,7 +427,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -493,7 +493,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -684,7 +684,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -729,7 +729,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -1050,7 +1050,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -1095,7 +1095,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -1246,7 +1246,7 @@ ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnectorDefinition3')]", - "displayName": "Armis Audit Log CCP Connector", + "displayName": "Armis Audit Logs (via Codeless Connector Framework)", "contentKind": "DataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", @@ -1263,20 +1263,20 @@ "properties": { "connectorUiConfig": { "id": "ArmisAuditLogCCPConnectorDefinition", - "title": "Armis Audit Log CCP Connector", + "title": "Armis Audit Logs (via Codeless Connector Framework)", "publisher": "Armis", - "descriptionMarkdown": "The [Armis](https://www.armis.com/) data connector provides the capability to ingest audit log data into Microsoft Sentinel using the Armis API.", + "descriptionMarkdown": "The [Armis](https://www.armis.com/) Audit Logs data connector enables you to ingest audit logs from your Armis instance into Microsoft Sentinel through the Armis REST API using the Codeless Connector Framework (CCF). The connector polls for new audit logs every 15 minutes.", "graphQueriesTableName": "ArmisAuditLog_CL", "graphQueries": [ { - "metricName": "Total Audit Log Events Ingested", - "legend": "Armis Audit Log Events", + "metricName": "Total Audit Logs Ingested", + "legend": "Armis Audit Logs", "baseQuery": "ArmisAuditLog_CL" } ], "sampleQueries": [ { - "description": "Get a sample of Armis Audit Log Events", + "description": "Get a sample of Armis Audit Logs", "query": "ArmisAuditLog_CL\n| take 10" } ], @@ -1293,7 +1293,7 @@ } ], "availability": { - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [ @@ -1310,23 +1310,40 @@ } ], "customs": [ + { + "name": "Armis Base URL", + "description": "The URL of your Armis instance (for example, https://your-tenant.armis.com)." + }, { "name": "Armis Secret Key", - "description": "A Armis Secret Key is required to generate the access token." + "description": "An Armis API secret key, created in Armis under Settings -> API Management." } ] }, "instructionSteps": [ { - "description": "Provide your Armis secret key and table name.", + "title": "STEP 1 - Configuration steps for the Armis API", + "description": "Follow these instructions to create an Armis API secret key.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. Log into your Armis instance\n2. Navigate to **Settings -> API Management**\n3. If the secret key has not already been created, press the **Create** button to create the secret key\n4. To access the secret key, press the **Show** button\n5. The secret key can now be copied and used during the Armis Audit Logs connector configuration" + } + } + ] + }, + { + "title": "STEP 2 - Connect Armis Audit Logs to Microsoft Sentinel", + "description": "Provide the following details to start collecting Armis audit logs:\n\n1. **Armis Base URL** - The URL of your Armis instance, for example `https://your-tenant.armis.com`, without a trailing slash.\n2. **Armis Secret Key** - The API secret key created in STEP 1.", "instructions": [ { "type": "Textbox", "parameters": { - "label": "Armis Secret Key", - "placeholder": "Enter your Armis Secret Key", - "type": "password", - "name": "armisSecretKey", + "label": "Armis Base URL", + "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", + "type": "text", + "name": "armisBaseUrl", "validations": { "required": true } @@ -1335,10 +1352,10 @@ { "type": "Textbox", "parameters": { - "label": "Armis Base URL", - "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", - "type": "text", - "name": "armisBaseUrl", + "label": "Armis Secret Key", + "placeholder": "Enter your Armis Secret Key", + "type": "password", + "name": "armisSecretKey", "validations": { "required": true } @@ -1351,8 +1368,19 @@ }, "type": "ConnectionToggleButton" } - ], - "title": "Connect to Armis Audit Log API to start collecting audit log data." + ] + }, + { + "title": "STEP 3 - Validate data collection", + "description": "Confirm that Armis audit logs are flowing into Microsoft Sentinel.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. **Check the connection status**: Once connected, the connector shows as **Connected** on this page.\n2. **Validate the data**: Use the sample queries on this page to confirm that audit logs are being received. The connector polls every 15 minutes, so the first logs can take a few minutes to appear." + } + } + ] } ] } @@ -1373,7 +1401,7 @@ "kind": "Solution" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -1531,20 +1559,20 @@ "properties": { "connectorUiConfig": { "id": "ArmisAuditLogCCPConnectorDefinition", - "title": "Armis Audit Log CCP Connector", + "title": "Armis Audit Logs (via Codeless Connector Framework)", "publisher": "Armis", - "descriptionMarkdown": "The [Armis](https://www.armis.com/) data connector provides the capability to ingest audit log data into Microsoft Sentinel using the Armis API.", + "descriptionMarkdown": "The [Armis](https://www.armis.com/) Audit Logs data connector enables you to ingest audit logs from your Armis instance into Microsoft Sentinel through the Armis REST API using the Codeless Connector Framework (CCF). The connector polls for new audit logs every 15 minutes.", "graphQueriesTableName": "ArmisAuditLog_CL", "graphQueries": [ { - "metricName": "Total Audit Log Events Ingested", - "legend": "Armis Audit Log Events", + "metricName": "Total Audit Logs Ingested", + "legend": "Armis Audit Logs", "baseQuery": "ArmisAuditLog_CL" } ], "sampleQueries": [ { - "description": "Get a sample of Armis Audit Log Events", + "description": "Get a sample of Armis Audit Logs", "query": "ArmisAuditLog_CL\n| take 10" } ], @@ -1561,7 +1589,7 @@ } ], "availability": { - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [ @@ -1578,23 +1606,40 @@ } ], "customs": [ + { + "name": "Armis Base URL", + "description": "The URL of your Armis instance (for example, https://your-tenant.armis.com)." + }, { "name": "Armis Secret Key", - "description": "A Armis Secret Key is required to generate the access token." + "description": "An Armis API secret key, created in Armis under Settings -> API Management." } ] }, "instructionSteps": [ { - "description": "Provide your Armis secret key and table name.", + "title": "STEP 1 - Configuration steps for the Armis API", + "description": "Follow these instructions to create an Armis API secret key.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. Log into your Armis instance\n2. Navigate to **Settings -> API Management**\n3. If the secret key has not already been created, press the **Create** button to create the secret key\n4. To access the secret key, press the **Show** button\n5. The secret key can now be copied and used during the Armis Audit Logs connector configuration" + } + } + ] + }, + { + "title": "STEP 2 - Connect Armis Audit Logs to Microsoft Sentinel", + "description": "Provide the following details to start collecting Armis audit logs:\n\n1. **Armis Base URL** - The URL of your Armis instance, for example `https://your-tenant.armis.com`, without a trailing slash.\n2. **Armis Secret Key** - The API secret key created in STEP 1.", "instructions": [ { "type": "Textbox", "parameters": { - "label": "Armis Secret Key", - "placeholder": "Enter your Armis Secret Key", - "type": "password", - "name": "armisSecretKey", + "label": "Armis Base URL", + "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", + "type": "text", + "name": "armisBaseUrl", "validations": { "required": true } @@ -1603,10 +1648,10 @@ { "type": "Textbox", "parameters": { - "label": "Armis Base URL", - "placeholder": "Enter your Armis instance URL (e.g. https://your-tenant.armis.com)", - "type": "text", - "name": "armisBaseUrl", + "label": "Armis Secret Key", + "placeholder": "Enter your Armis Secret Key", + "type": "password", + "name": "armisSecretKey", "validations": { "required": true } @@ -1619,8 +1664,19 @@ }, "type": "ConnectionToggleButton" } - ], - "title": "Connect to Armis Audit Log API to start collecting audit log data." + ] + }, + { + "title": "STEP 3 - Validate data collection", + "description": "Confirm that Armis audit logs are flowing into Microsoft Sentinel.", + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "1. **Check the connection status**: Once connected, the connector shows as **Connected** on this page.\n2. **Validate the data**: Use the sample queries on this page to confirm that audit logs are being received. The connector polls every 15 minutes, so the first logs can take a few minutes to appear." + } + } + ] } ] } @@ -1641,7 +1697,7 @@ "kind": "Solution" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -1671,7 +1727,7 @@ ], "properties": { "contentId": "[variables('_dataConnectorContentIdConnections3')]", - "displayName": "Armis Audit Log CCP Connector", + "displayName": "Armis Audit Logs (via Codeless Connector Framework)", "contentKind": "ResourcesDataConnector", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", @@ -1686,7 +1742,7 @@ "type": "securestring" }, "connectorDefinitionName": { - "defaultValue": "Armis Audit Log CCP Connector", + "defaultValue": "Armis Audit Logs (via Codeless Connector Framework)", "type": "securestring", "minLength": 1 }, @@ -1701,13 +1757,13 @@ }, "type": "object" }, - "armisSecretKey": { - "defaultValue": "armisSecretKey", + "armisBaseUrl": { + "defaultValue": "armisBaseUrl", "type": "securestring", "minLength": 1 }, - "armisBaseUrl": { - "defaultValue": "armisBaseUrl", + "armisSecretKey": { + "defaultValue": "armisSecretKey", "type": "securestring", "minLength": 1 } @@ -1731,7 +1787,7 @@ "kind": "Solution" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -2358,7 +2414,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { @@ -2438,7 +2494,7 @@ "sourceId": "[variables('_solutionId')]" }, "author": { - "name": "{Armis", + "name": "Armis", "email": "[variables('_email')]" }, "support": { diff --git a/Solutions/Armis/ReleaseNotes.md b/Solutions/Armis/ReleaseNotes.md index 18baf189d59..a5e4395832f 100644 --- a/Solutions/Armis/ReleaseNotes.md +++ b/Solutions/Armis/ReleaseNotes.md @@ -1,6 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------| -| 3.3.0 | 23-10-2026 | Adding AuditLogs Data connector.| +| 3.3.0 | 23-10-2026 | Added Armis Audit Logs data connector (via Codeless Connector Framework) (Preview).| | 3.2.0 | 05-12-2025 | Log Ingestion Support.| | 3.1.1 | 19-05-2025 | Updated Armis AlertActivity and Armis Device Data connectors to add keyvault for storing Armis Access Token and Severity parameter in AlertActivity.| | 3.1.0 | 11-09-2024 | Updated Armis Alerts Data connector to ingest Armis Activities associated with only Armis Alerts.| From 011748e62a32e1e8c563329bc81717064c8142f4 Mon Sep 17 00:00:00 2001 From: Fenil Savani Date: Thu, 29 Oct 2026 18:33:59 +0530 Subject: [PATCH 3/3] adding parser, sample data and schema for audit logs --- .../CustomTables/ArmisAuditLog_CL.json | 41 +++++ .../Armis/ArmisAuditLog_IngestedLogs.csv | 6 + .../Custom/Armis/ArmisAuditLog_RawLogs.json | 71 +++++++++ .../Custom/Armis/ArmisAuditLog_Schema.csv | 13 ++ Solutions/Armis/Data/Solution_Armis.json | 3 +- Solutions/Armis/Package/3.3.0.zip | Bin 19445 -> 21057 bytes .../Armis/Package/createUiDefinition.json | 2 +- Solutions/Armis/Package/mainTemplate.json | 146 +++++++++++++++++- Solutions/Armis/Parsers/ArmisAuditLogs.yaml | 36 +++++ 9 files changed, 315 insertions(+), 3 deletions(-) create mode 100644 .script/tests/KqlvalidationsTests/CustomTables/ArmisAuditLog_CL.json create mode 100644 Sample Data/Custom/Armis/ArmisAuditLog_IngestedLogs.csv create mode 100644 Sample Data/Custom/Armis/ArmisAuditLog_RawLogs.json create mode 100644 Sample Data/Custom/Armis/ArmisAuditLog_Schema.csv create mode 100644 Solutions/Armis/Parsers/ArmisAuditLogs.yaml diff --git a/.script/tests/KqlvalidationsTests/CustomTables/ArmisAuditLog_CL.json b/.script/tests/KqlvalidationsTests/CustomTables/ArmisAuditLog_CL.json new file mode 100644 index 00000000000..24a7203022c --- /dev/null +++ b/.script/tests/KqlvalidationsTests/CustomTables/ArmisAuditLog_CL.json @@ -0,0 +1,41 @@ +{ + "Name": "ArmisAuditLog_CL", + "Properties": [ + { + "Name": "TimeGenerated", + "Type": "datetime" + }, + { + "Name": "id", + "Type": "real" + }, + { + "Name": "eventTime", + "Type": "datetime" + }, + { + "Name": "timeUtc", + "Type": "datetime" + }, + { + "Name": "action", + "Type": "string" + }, + { + "Name": "additionalInfo", + "Type": "dynamic" + }, + { + "Name": "trigger", + "Type": "string" + }, + { + "Name": "user", + "Type": "string" + }, + { + "Name": "userIp", + "Type": "string" + } + ] +} diff --git a/Sample Data/Custom/Armis/ArmisAuditLog_IngestedLogs.csv b/Sample Data/Custom/Armis/ArmisAuditLog_IngestedLogs.csv new file mode 100644 index 00000000000..5d3594e85ed --- /dev/null +++ b/Sample Data/Custom/Armis/ArmisAuditLog_IngestedLogs.csv @@ -0,0 +1,6 @@ +TimeGenerated [UTC],id,eventTime,timeUtc,action,additionalInfo,trigger,user,userIp,TenantId,Type,_ResourceId +"10/23/2026, 9:30:32.481 AM",1001,"10/23/2026, 9:15:32.481 AM","10/23/2026, 9:15:32.481 AM",User logged in,"{""authMethod"":""SAML""}",Web UI,admin@example.com,192.0.2.10,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL, +"10/23/2026, 9:33:05.220 AM",1002,"10/23/2026, 9:18:05.220 AM","10/23/2026, 9:18:05.220 AM",API secret key viewed,"{""keyName"":""sentinel-integration""}",Web UI,admin@example.com,192.0.2.10,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL, +"10/23/2026, 9:39:47.903 AM",1003,"10/23/2026, 9:24:47.903 AM","10/23/2026, 9:24:47.903 AM",Policy created,"{""policyName"":""Block Unmanaged Devices"",""policyId"":42}",Web UI,secops@example.com,198.51.100.23,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL, +"10/23/2026, 9:46:12.045 AM",1004,"10/23/2026, 9:31:12.045 AM","10/23/2026, 9:31:12.045 AM",User role changed,"{""targetUser"":""analyst@example.com"",""newRole"":""Read Only""}",API,secops@example.com,198.51.100.23,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL, +"10/23/2026, 9:55:59.667 AM",1005,"10/23/2026, 9:40:59.667 AM","10/23/2026, 9:40:59.667 AM",User logged out,{},Web UI,admin@example.com,192.0.2.10,00000000-0000-0000-0000-000000000000,ArmisAuditLog_CL, diff --git a/Sample Data/Custom/Armis/ArmisAuditLog_RawLogs.json b/Sample Data/Custom/Armis/ArmisAuditLog_RawLogs.json new file mode 100644 index 00000000000..231f0b16ee5 --- /dev/null +++ b/Sample Data/Custom/Armis/ArmisAuditLog_RawLogs.json @@ -0,0 +1,71 @@ +{ + "data": { + "count": 5, + "next": null, + "prev": null, + "results": [ + { + "id": 1001, + "time": "2026-10-23T09:15:32.481922+00:00", + "timeUtc": "2026-10-23T09:15:32.481922", + "action": "User logged in", + "additionalInfo": { + "authMethod": "SAML" + }, + "trigger": "Web UI", + "user": "admin@example.com", + "userIp": "192.0.2.10" + }, + { + "id": 1002, + "time": "2026-10-23T09:18:05.220117+00:00", + "timeUtc": "2026-10-23T09:18:05.220117", + "action": "API secret key viewed", + "additionalInfo": { + "keyName": "sentinel-integration" + }, + "trigger": "Web UI", + "user": "admin@example.com", + "userIp": "192.0.2.10" + }, + { + "id": 1003, + "time": "2026-10-23T09:24:47.903551+00:00", + "timeUtc": "2026-10-23T09:24:47.903551", + "action": "Policy created", + "additionalInfo": { + "policyName": "Block Unmanaged Devices", + "policyId": 42 + }, + "trigger": "Web UI", + "user": "secops@example.com", + "userIp": "198.51.100.23" + }, + { + "id": 1004, + "time": "2026-10-23T09:31:12.045880+00:00", + "timeUtc": "2026-10-23T09:31:12.045880", + "action": "User role changed", + "additionalInfo": { + "targetUser": "analyst@example.com", + "newRole": "Read Only" + }, + "trigger": "API", + "user": "secops@example.com", + "userIp": "198.51.100.23" + }, + { + "id": 1005, + "time": "2026-10-23T09:40:59.667204+00:00", + "timeUtc": "2026-10-23T09:40:59.667204", + "action": "User logged out", + "additionalInfo": {}, + "trigger": "Web UI", + "user": "admin@example.com", + "userIp": "192.0.2.10" + } + ], + "total": 5 + }, + "success": true +} diff --git a/Sample Data/Custom/Armis/ArmisAuditLog_Schema.csv b/Sample Data/Custom/Armis/ArmisAuditLog_Schema.csv new file mode 100644 index 00000000000..0063947b864 --- /dev/null +++ b/Sample Data/Custom/Armis/ArmisAuditLog_Schema.csv @@ -0,0 +1,13 @@ +ColumnName,ColumnOrdinal,DataType,ColumnType +TimeGenerated,0,System.DateTime,datetime +id,1,System.Double,real +eventTime,2,System.DateTime,datetime +timeUtc,3,System.DateTime,datetime +action,4,System.String,string +additionalInfo,5,System.Object,dynamic +trigger,6,System.String,string +user,7,System.String,string +userIp,8,System.String,string +TenantId,9,System.String,string +Type,10,System.String,string +_ResourceId,11,System.String,string diff --git a/Solutions/Armis/Data/Solution_Armis.json b/Solutions/Armis/Data/Solution_Armis.json index e9c30897b2f..990cea31ba8 100644 --- a/Solutions/Armis/Data/Solution_Armis.json +++ b/Solutions/Armis/Data/Solution_Armis.json @@ -6,7 +6,8 @@ "Parsers": [ "Parsers/ArmisActivities.yaml", "Parsers/ArmisDevice.yaml", - "Parsers/ArmisAlerts.yaml" + "Parsers/ArmisAlerts.yaml", + "Parsers/ArmisAuditLogs.yaml" ], "Data Connectors": [ "Data Connectors/ArmisAlertsActivities/ArmisAlertsActivities_API_FunctionApp.json", diff --git a/Solutions/Armis/Package/3.3.0.zip b/Solutions/Armis/Package/3.3.0.zip index e886c04eecf0a91b8cfc2431cb83f9fcd7f1619e..4cc4e30c1d64ad284ff9c6fdf2839f33244490b2 100644 GIT binary patch literal 21057 zcmY(KQ;;Yy)~(y8ZQHhO+qP}nwr$%sPTRI^yZb*gb6@V;uAQV(l}c)VSy_>n0tP__ z00007&`Q$LN$X8ey9EOPfJ6rXK>L?9ax^h;Hc_zkxwb+YvG|(*l_Nw|*HU#2AF?CVcDBF>PB%Qb7s$mHO4(Cvk|H zuQ}0z?HoW>Q zB5LSmC{QE8Htxd>+s0D(9JAmTSp;mQxa@I;CbT9=y1iRd8C9k-g=jTisT<~bcb!pXS8^aVf>GxerAyX`5G81c#~GiDr9hr3VHf= zV{yIFCb%U^OKvA=Y=Q7$y8MpvLumaRB}4E-Z&TzaucUaDMJ)ZJq#cTS-73Um0O8?b zEQ7IO$ch)835gas#a8GWR7!!%-g-Yrt#G6(I8wx44gE;q*IWHW&IUx;e9(gIP}uYm+z( zk*CVUH}EDLSY80QMcp&$;#_-*=M7Q7ZJF0kTKkkGic2S@fLMocP%>fQi;!i>Q z%GA^m_!V#rPI%ZG4ZLXfi>b%6EZJXvtTqas5mrc@A5tVGX-S9D z6ei6Z>;+9(PzpR52+LGK#l?UT(@SC?uoHlBRQQR{$4UmA?rVJo!;AQ^YNeX?+vH*I z)b}4VFhrG;hk@8jFbBbtk)gvk(j)!5EXbP6@d$0D*(hE=-tF;$a%0-p1H~G}6EFi% z*aP9aeS`RCJWcYv2F2)1U!RYsxAXh6H@u=lvaov@XTHLrFr&7g`ud#n!Z}I~wodL< zD-=YjR(^@49t?TORKr@5IUz91uoVo_ zxx@|BPsEH2Qkf+P;(eNd=!k;x( zaOIyVo{WxfGuLkMf1(T`Z@2o2W$j+&%=I=uD^!?>0Bt{H6VW)*2FXN5rL{#U;3fS`vp(H{? zpWCZ843VTqG)UN$D5kyTudKAJH>6tOqL&u=h@QD3mYQ~*i}e*9_V)zM zP{F7K@&^?PTeO@5{1#WFmXTgn_QV+8j8M+SAzePN&|r8Z&OGo~Q@pU0i|{*!x+-t_ zKcj-o6fqEV=k0SgiqD=(eU|BTwqLky-Q&XV%T2mRUvCW1@UG~H<78}2x}08K7Ho;O zwSH(Z19J+>nBOub1~y&DI4>Kc8f)bca~4*vak*A0)%9+0uXcMTe6&w*oIg_TM_vx3 ztl-(HCC9O^$uJ$0Nx}=OVXC5jFc&B0Wd2emoro)$>&zxioDcrKfck{AE=>?Z*XqgC z8qRIEeg}>1IX0`yO+kUgmMmc%$y3CdR-H8~HDhD}gL>C<3vUUP2h*mo;sT?!gA&}N z)ZWs*yAE9kp&v*|;dvZIS>7Wdm}PE>$Z zdgGJ-|7xTcLHdufBmjVF84v)%zZz*{U}39lVqb3z zA>yMG5A@0A|NZ@fBnTE|mpP#h4HUZ%bYvFbjv+)PpgkJfDfDan4@ zJY$rR7Y~>7PNqjTm_dj|OCs(Nh1iGq_%69HbYwNN*pt(3Fn%D)_<|Yj9rZr=5KDqM009RS2O%x}6Uhz{ z{>N`~Z3e=`Nyu+^ZR2B(-omN&hJ&M`YFgWG(Wd~OjyR#un8_LWV2`!{SFFtm5$Or) z+3@eWO5lum`dmCneL*&{g>jxxfT`X-=y{VJ%0w80Yl-JJSf&7xV*=F^lb{4qM39NDvB*r* zM;6w>XpA*w5tNTDGJ&|N_PZthbI^H!;d%Yl#b*Ru-Y~lP*|pE(w4Up4=jUpl_h(v= zUD?5E1g(aJrYg&5x*r1==6-t8+w-v>0^K^3+nbki?HDUo4q}vBWD(wH`!&vt-ZI< z7gL~-o$T9RR!11<7Tgr<C`X2*IpT6=02@RpsIRI!jCyM>Y7AljF%`4J{ZA)WWonb&mgF_82$a>iw3xvHPq6Zn*tO`m^oAGlz=xOWZ}l$)=0kz^c9V znT*?X7dZoYAQUf2E6n&^q`aogA1xOO2K2GR03~!lGDTUg&9kh`?B#;&6vN-f&r3=i z9O9j%q>pFloP;;02a|&=3ObGMi zwU)}*n*Dc5t|vNk$sEaB26Bj=<>I=|&0q^_6RWq4;3x3tZuaO-1#9M_@Pf&Sx-ms{ zG4;FSMRm5Po%`K_nhL0OsQZ?8>N6&6eOo~0{eBfNQ>iA9^T zMNj?hHp0B~Pe?Cf>VrU4rVme*QnRitltgaAx=2dL`l=dEoHU|lvo86W1PEIlRCB~l zBJamt-)i4l6MgW5UZHY*);T&12ETr$9+04<Z3R6bV4xST>-@ku4uIEwA@%V9}p<`SFI2x?Me+@R((sST0gX6+n4GZIWy zo4B$PmF-hevOrt|NA%`SWI49;z5NY*E|n|H&{1&2N(Zr%HzC0i^Mj?O6t=%fPlMh& zHsA4#ZG1Bkh%iEi0O9k)Ikh74^>vroQ7U+)bC_X1DgxCp`yga19-$#@Xb@BWsJzUM zJ4YjP(oyv-YD>!4LOy>0v?y;UT~PNdhHLz-Oaz}9A;A=ojoJ)45svp(bXT(%OXXXM zOZPph9l!Eq`_UQ++>BRSN7l6~>-t(r!j*R&XwtZ$J8P6mSC>QEbbCaTE3kPese-RN z5fEY(S5ml04PI;*K&AX*FK9~LOI0m;6RBbZl$iX- z4e$!C;5Omycbeu&?uj>8vv4a!;qI;E>yD1NJ)v%5An%kda7QR_WVeql?(EyVOIdNe zF|_dFw9D;QHuvAi(LiSe-8rgW%8H_$%l=LibIVGN6e;R59<2mh^02k z5++1PQrXZNOf)^Zy=V^0-kzun%fWz(m12nbeYTZOW&$*f?M+LrQ7D$0A|I)1mSDAS zLAwzV!5WvOeqD~bRFG89*p~4sld2*LrbrC>nuB&fQUZF613N8>6@eUB$?Aplkl<<% z!)>q8R?U~HW{l%!nwrheySU$b-sYU=*9}&E6RNV(evEZV%6TqM;m_1Mh+LJB*e|8y zI#5943!vptlT{7#q~oq=Rfb>hx5`>!0YgoYLqtz=)YL_4%2xr1ma~GCV~yz)YavL~ zxs@34BGY-lgWCYIh3*1$qh_m`^;6W!k%+#uikS5m7t~dR*b$pc1kiExA|=N%OmpK^ z@W-yAmKH0_$k46K!Rd#OGD`{CVwY(cNEV@1?4ac~39pJki4~Wg@_313VzeO7PuO+L zR??t#O*lc&krqr)PE&_rVjI@zF%&B`$~<|(!b~}b>|j+yK$y(X)exuzYc0{q2&;IL z%4hFqDy%=Osb2lC@#gb!!ix}TWp8m zsxB`sRCL;6eXA+P%|O6P$ggaL5~&)jbSyPdSGGdJ7sx}L@R;+n`mj75Z8Ve}eHPQc z-?qJXbOtJCHk?lD>DF#A!h*tHyt!fK$ zZU;}kCp=$kE~~F~RIP4>WvoBA zzo$6}&fmtwPVGVoGC7=r`Z|ttR2J@d-ZHmwRKBMgt(QlwJJVI7y+-=7^};N-rWzdw z?6glUYbkuIRmU$FRd*?ACBIL}FzIX^s$o)FS!*LjE;0|sF$ii!kHpNLk#<$%K5ih( z#Cq|NW@?@ZpXW8cNnGPlmv%M=egb9#dJW&%qn3xYsL|XCe!EAQE-?bQdb<*h7J82+T9STJ96cp~Gu1H;WL}on z{jF->nR5iNWCpOF1+ZZTuuXh-r=~B{n^S;S9o8{XH7D`0((|HfT28d4K`+;&cy7y$ zpjym&U)b5QmokaY*!5zOl)c!ogYANM(JANPJ&Asy3)o~%_zzK?4{qytpGwz$%FsQP z;zSIit5eSD`_NA*LNB4ZEILE0QbX&r2(JFVF$Hf|lUz86rC8M<7 zjbu`Uoek09f7Fj}t+9N}8R&Wk&xgsF4x?nir$%yDv!THzgpC|B3FFq%Kiu_Wc(~L5 z3qh_+fl9tTL~&1oivwEmbdCt1=Y=is2;nwOCm}F<;gYe;#888=6j~v+MNumSS}TOw z5mL0ma95Do?nT^@mSVWJ#Gdryeuo~Cnl75MS=NC=9pfe3kn$yR-nMWYoDaJG_=(zr zn>W7T)4WgXXz0^vR!LTinFTBJRKrwf;w+Y8Y>Ft^wY4NZuBS^xau)nS~gw^IaP-$d z_yqA>7j?WuJYN)fuRge*_l9V3^9I6t1o2*w%HTf7_l9&M;I#TeKi|6=oHQ3^!T31Y zSfS^=jXmv++IkKw8GGU6Ty^wPq3UUMql$~9o`n|1Kg@6EYij^+gu2);y4P7^kBD~5 zG}$^0SHK`ivSA_^y12WA{j_lsVVhrQ@2lx?9+J8&rOlYQf@KK#II4ONUpy)7%AFBA zDszP60P}?q<%t58Y`nFcVOyMTVjQRooJ^*rEcUNpc}?HV?ikp%&0siu5BM~C;yTuT z$j*&c$gD6{ACfLwUdKPQCuKg0EG_J5;A%|{XZJL9 zPYU-muGs>z#~IW8TZ2-HjuPn>?dvO7TUXMb`hTt_~iZfMCwroZW= zY5Xvx;DtuUv^avjlD303{!FB~b5+ncR#G+J3e=3z?H3mAbR{X66}gID+@3K&)tyZ} zr#CeQq(kLZQW`ecxa!{bt01BS@rO8K*cIB8W`{C4gZu&bF1Bs=p4`z))&)zRJy#pVc$RU6mTkpw(Zx9~J zG?+rA#pW-xYaJX4A(X1+%NVD@nH42!^366oyHi-Sm_*?zR4WdB9TitbHfE*^Y0WP` zOz@#IyWjO|Y(Z_A7tB3SAeM{iG>EX>vA%hqG3tj#8UY#wQMiv1g;rQX5g0OFRspU) zvy^@kO)Oq~6FGjKZPP^JjM5asfTpi{r=aW~@?fx|=60~FAgv*d^Z^G{#cvN(6?~(P zNrbpFmmU(xQdz1f+x`KbtDTR5sXLNR=0KSX?*HO5!Q(1qIPbfXAw6>vn9;;6;N%Uw zT+qE&4IbtOJ}aJnN70C+e3RfO^pm@wZhwvE0B+YRF?awHFc12I$r*;^J-)^w#!fm1 z2VuY-9s(YO4DvWfaxxsIr(2Benh~K1?j+1BIxH2=C(`D0F^vFD%AkBObP7HSVW?(U z(DIbE@rO6cf%!MjQD5~J{XeyC}eeQ_{#6+4~&@SBWTB{j89wR}z zGFW`C7HATPsJCgkQMIvKX4gmaUE`Xor8;D0k!q<~ZvMe)B!pt))Exn|_%&6lg|Ojg zfpl;l1P3$|`bt@iSwOXb{3nDx3dz|+4Z5Cx?$y$DjTdUVArfgEwQtCH3g(inVC55H z3ETsK=cUp9-O}l)9~qD#)(-i;E7oA%^qFpWaRg|ze_Vxq0myHQntDXFW8ym7ANha) z_?fc9fS6jVn#YiO%M|XQq#(ft-ML?2Ek=BBG=!pJ?Aa=QWt>S>@kpcz$A< zc!?EGSYZaa1?@3r>OrVURSK~uFd9Dll$4S~$ZePo(%Eg8d-s~1MA+k8t;50L9b~bV z8GZv>3y}~996Aa^S0tV zdhdl)m2%&C>cxd)oXEA*<$iYS8kUNPw6k+~B0I@Vs>tS=oze^$;JBtUYBNITo6o23 zm{HiQgY*~Lku8QK!#RLvq5KZtJ&E?n18M&8 zmnv-9@;PBvef!_Q5dNQA;{n0UdUvs1I=A6#8%HUjyzK|RhDne``$R2;a=w8Az7A41 zEuXOt3yM|QamK=KwtWr1wg+8#f<4Agdn%Zgr%IN(Y*jy^G_JcZA~uRjTMx;~Pb{`g zN%eJW5IzrmNqlg#zQQ8%KrClEAR3psOhK1wu-)~{Sk*E3Cm<^-1kTuqdZ#`A+b6C4 zdv)EonQ*iukRE)uLkEW*`LJhBp812~CXb6(1vVgCnpq3-8sX#+Gl+=PJ`_HjIK3X< z&o6s!QM=P6W&}v4lo(2rh^b66y5cgjJE3GSz(NQyz@u~y>Ja_nB5WG}&7$->X7PUQ zRIJkCb-_$R12^u!1Gz5TWIHWqkKNqWHk<2ZT5>0sWY`L+Zw zOSg+H+BNNLqubBmX~Nk?367x%kVSUqjG$3T9Epa}5j(l_ z3Lo>-;p?^3y{5rd8wzPQHf$6=st5raI^gK_t@=+l#vCf-6mAul5` zp&e|rRM^o->@pqcH)8VDGX$CxG_MM9rV7qzk|d1ps!G+481P(y{_XnzCqwOuQWKW! zx>C1#CIES2=;v7z(dF;7IHdZ6w}V@aEfGN*cvAk*bv0k7V_eHq=&#kqDr6otCdp?Hy^m)=2-1sbjt zi0y=#`$g*RV{rzBB8JY01H}TzlFErV^%=viz3wfEkVS?z>ds+1Av4;0`73&d(e9JD zb1?d0i5!@?l{-@Z@yZ~LDAs2AFm$>VdJ={wec{$&`n7CzV>N55Y;_d<5S-%ir^_^noQ<;5nkwDsWxU|9^QXy zfN13WAgvIyN6jofCe2cWjKVHg7`Jv6Bxxe-*dIOu0b2^TU%?Qrm^_4NwUcz7K+qx5 zZebmkh&y{G?K&=yQdeBK*Clb zScp;NcU*Be<%Cj|Xme18E}vMsbyzU61UGIs5k4$JTk{+q#bj=rNdf=Uy7Di+52V-_ zxc&H9rZ;i!(dgBL2Qg?PKPnZy2>-d<$OI)p91x~%kUr0QkZPB7EM(FjX`! z1fF^eQlHALy^^^TqB#E z53X;Es?ns6Oksx|!0|=#Beh8yC{F$(qgaV_*r1|@BY>rO%H6ssOIO>*DaLMng!MB z4QkM@y$tT-GGs;oIW9(!)Qh@^7q^Ui#)Zu^e0ED%BqnR8B~E710;r^QHV^)%kE&-i z9pJ^M89z!2acCUz(cg{f@8Q+akOjc9XY7ceAOP05oNDiwa`fXSh37~x{0dJug01|M zoh6AgUA?9v>T-&XB7MK7Y;b}Zp_+A}tGe&_YpC4BYB36Hr)ugiOgc}q?n~en#G^JE zQkeXS^N2-M5*RA4Li*5;xMpGuipHCU=Qz)^JOm}K97-TXdzGX@s&<-AK!^aG$W1rv zg-O#9NOG+3CfC3UICY}F9W2?=69{kg=pcZE(6Hc;aF;65Qro*Od8p$A(1k#lxtM=sGaje&aCvcpinK715o zro#L%Auo4RJ%udPRkDY2wb?u-UB&&myZ6K7`6ZiOoNiA@%U6PSfSmxVM)PR}8BbK} zvke7uWN%4PAly;NQ-D7~5}2E~$U2B|XD;x2Y!%mZAh8pv3VAlEbpavKBT6@8XpW4y z{Az9~TSWnn5>)k9?_mRLyKbWYwxqx_FUPOlY2}`l%ACEe&f$4rRdi-BgazT|S|#$q z#0?*V^vnD6`Pq{(VdZ3NtNf15N!m}w_L3Wq5gXOH52F#A*6mQX##j*C1Ey{CVFNsf zr4zrN1G&{W7L0LfUW8jv= zU*i`dR&5O-S?|p{%as$finOZBzf3*i8%y9d+!=&p`U%pY+8t?EM38qRfKkit-hp@2 zU`S=nY-Gf`;%$keg6HTb;6TUxa^1#k!nT*IAL=oqWfoV{3}_c6C;BW7a~hm+&SQ{q zaoLihatrV{MbkxWebxokRJK0Ue~oACb27AdWcGfk7`OLkX|u$~4LbS@oVy{!EZ6;d z->JH+PE?SW}iiVR2P6n!d zrGogkVhnUWMCS)^?}=g1Xu|ivTl<%<_>kfU(fLoFEf7JV*!v z>FL8twTmqT`v(Ju!jMv_bL6L0tnm022Gp|-#uIcXr>jp@?O5HZ{|*D`H9N`ce?dga z1KOra_a!j+T;meE6YI5<`flSswFp}ESTWw=t)$sJDHcwLNSCaqCR*`_%;G_5L#0-Z z1SfMkpP#Ib9PBTYf;>;BZ|+~Ee^zG$Iq_o&rdA~{Dy7&UUR+1M3LrE4h5GRiK|B$R zX8B7lD`YQ<4&_a$j=`CJb3F;E_KqTFA2l@(NR?Hh8stSTnnoNT5-CnC4rR^27=DB* z{TKe;gqAhzJvV4OJ>(fsw-GwnX}lX*>Io|3joBXH-LP=i+=IY9GyYGSvFH#5XJ9zQ zIW=OaxNRqI^J0;BuKZZDS%msf_p>&k!_-mr+ z!~Gj{RF-m>aZhc0+2%7jrj))SwRqru>LL*4P>5X8vN{7XDtj@LUo#d)75E!LKbhrR z5mx~xANzs~0z)x~^CIY3F)Y#Kwmc2Jvw;`qo={t0t_3J`jhJI8koI-_pO7m(FNB_= zloW=BV9NM?RT2YY;AtHpTL$#Te&+IM;jax(cssJ3?Iapg3i^&%d`FytLrApZgL&7$ zNDc%othA?ufH0P8EwuRhQE=Fkoh?^BvChb6_wIZhJWWIu zo@!&0`_zyGZ5VIkMbtWQQb(7&_?zcCP!XrVg5|(`6oKwb{@D%xoOSEVDnPa_GWjN6 zebejwJWhUImcUe&fD{)0WEJYl&CB(_p74!;-qmbpYZnx?xZ2e_AbLOuRe*3!b1HuI z^>hHl)zbsoK+soL#u_?nXna{#F< z{w6T`8dQLj7j6K5lA#t6fjMFA7xENJcT;S*MWQP>W|`g$F1y^LOvzRmpH?C6pBkaxS0mwl%H*IE-fDo3+WcMZq_sZ5kcxrv)D!obdJRsBIBgl>}u z+3mU&=0jDg;q?_({rAEFzp>N{cd5D;3$2jFRR>8{n9D%EfEaBm*xS7jr(IYp9%3^9 z469()c4R`Z{JNt&b#!ujX9u%_Nb5r&`fG3Y3}#q6Co%@OO z9s@Feas86S@vGlw?@;+$t6PPxmhXt@_@IH~pNy%FNf^QwHQ+K1>^w)(kH0jDd)I5) zukqqcmjK<#?w{25;Da^5BtK)UFsP0XU9^sVM5MFV+uNBWtNI4I<1}};sS5MvpOzE) zf%kzT25hwyyZCFbsc;;^nnFZ~tDNxMc*Kx0l+V~stReKEdWN3io62j2UOu{Vw+LqJ zy}m3gJ9)n(!1E$TG|>p7Erhq_X$(U)7+Pr?`$MjN5>s6bsG z-%z_+LF=@gGLSpls`TOcI${r;z)UNQ&|fs&%9`(vOzMLNkGq{#h0`o{xX=>XY7Xd- zfMU@X4j15*P;;5cB_B037d|=%nMQz>tW#h)b!Hp3IwwqAHDuRrh8<>dhuvwi{yNrb z7xOrWdRstpBZN~BwcBh`C{S>kdw%Rg1i?3qqo90~Q- z+{H`mY#>Ps^W!S@H$rC+izewSRs0(Q)@KZ+)`PZ^Np|>K!I8&TnCQQH+m5Dp1nScU zp4|b|V2*ky0d;`b{rSEkGrYZ($4t7g07N*-np?Lg#n8C zHTR~8&@88(Q0Um0VS6VtrUeO=mu358(ni6(phIk7KJJq5ct3aro?J5MGgkcr$CcV! z=*%!8gLCP3X;N7s2SzJ|AioJ9IhtYYGW{qvpZ_F_lY{Y6*jJ|+AKTdxw$k(vDweZr@J?_tr5brc)N4?2=V?|1+L%^FgKWnI?+8e zF}PfZ)L+_25=0&}O8$GYcdSwZa$)5PC{KmuhbDHfMK~glG%>&)#4HXGy7RzDnhn1| zRBGvyJ8_1w32RNUUb-aSIW{F`Ume)S>Qo4r zH$>pxVNY_a{v33BGO(?Pls(z%7kyZF_|G8GQ*Z9raiT4O94J6Z7362 zG#2A$n&j8y4r4!4w&$MdHJM#lGA7riXWl8g!w2^v7Z}>0!+Q(0$vwhk!`9Hp~ z8kjMogHK$zeaiEP4}ZPrL8-unab^jGz@gzx%Wn%LM<%e5MK989#lM-NfXR!)Qo5@{ z@^*VXA{t%ZWZlKcmab{GDV0^x*4yCSZO`v>8CP+s&_^l-C{!oVK7v%rW%T$2MAbgemm>Dl`z@n3!6=pGJGtgHuMK|&e-WE2VO;!#wEO!#>I ze#?R4;D1*PWk!)vr@!n1eDnP200Gnl<4`o>>5)v;)#Y_Wgx;yW=BN4njYy~k0Gz>0 zdqFj@i4_0%KRwEVzn}O0AOEu*D#~HjmoS#-B6SVlvwkJ|V8n@>4`rhUJdc9d5z*Pr zBbS?|dXlP@VUht|gkp7AA=Ro0GEg_SZ6L&snmLnBnmzdT*Pz=|fo(<7LADv17&`Sg zoyC|jn7^~q`1zN)i@Qf|JY~kp!L<6+wux1~1`?y!QqnNa=+whi%_OL`u=W3Db@-8C zZGt8AC z#l`8-SI^TL$R>r)Sx$PS*roXSEIxxAAIbyO7EfhCSLoK<$Ve(I7CNUu^(e;JyUuci z8bkmk9W)_6TvzjFU=jRFvPLu@Rs)*>g2$*lbNzY7>0B> zlr{8=ey5hOyT-%P+ z$zgIKWL;o2>JvYQL^~Q#`M4hVS%A$E-=x7my58&3tymG8n=#l%f>o{6URKwnvvM^= z9j6|&*Pz#;^yLiO@~mtD6BxFL4Qc`dsoMD-igr6T7Lo>6nc!Du=2w7;R{|zp%=0TQ zACjv?6MQ=)b?%Y43`jTVu~h1IG>j7!Es^4#2PMKMZGfx;U^( z@n42JIAx{)Fwu_Z)>QyF+9(%K9Ru)ZVvhGQ$6vj*eN0-Qa88frQpr3Bl`1Z*?yufedl;yhS+GGYbho%WY& z!Ulz5X9k9y_7`eG#Lo2nW8a^p0cKaan+ey>sE1iA&BuvxXVgi%<&VU)Hw?|r02hwb zMCqNbd-{XaAE1HoBW32%SjO}w#Q=&}v4I@_Pl3+Z$3r|AGRzTU2vCOVrvYR>z}*M_ zryeZWFm)6%$Tb2bozZ4A-N`9P2lMF#tBaG>X@@}b_WP^Or|ZtH*`U*3ZEj7|52@z% z0G^ukdmwxi?qMknyeU%~MAW70o2nO;Hi#tO2}PiXmBpLT0(ue?!(~&3^aMeX^AIL; z!T}gFbVje!)H9OW;*4Vh2g-xPHQZCihq43y_d1T$JbkA6CJ-YxQBsF_C(ZAAt_q6$ zW_XtH@EAAxPu~H4!$qnZ?F;b7z+;&INVQ%GbC95Bk2VGDLat_pIp0+xe0Go7HIS8T z|Gp&z6oE4t#*_z4mkmjc1D(*ph*Sii0!jF*Awe*P7>fFaS<1WD?XAF0moswc zf6BPmQH|W<(C_3S&W+}l8A!6utwQ02iX5YWd;TU0mI-wEfe;p72>~HR=s)%2&0{{r zs47GL)N0Ox!EOqpP}RL&7v{5 ztPHX6F*Alozq&JZOKY5eF(8od{c_0UC?X^v`3FnurgL<(3_~*{BXNT*WjUqmcW?ax zb4h>_@Yvad>CaXuv3yeKCWYTlFApAO17oaW9_bwzzF3z1bJ(PBzV+V;*E^(Y$m&s5 zykJ;=z-efr66FIvCqQCFacHzY>Bnrj5#4=J+P?pp*C&Vy=!*-oZ;U?lvP1kRA9z_* z|8zzsSxaFvlfk8nF%a`w)qY4I8HE{7ww$(ZR*ZmYs~CuWCT;hv3_8?Me)HgIvQ!n) zp^aZ$4!cvVob%~-bQZa?98aVfx3D`L^!FGy9Udx8D(j4ih9rOXnzi~6_Fj7e&TaE{ zp-92DEjuaDq*b-GwTWhqr*cdrG9(5EavrOsRb)d2i+CgqC1fE-&L(vJ!^Hns5RkxQ zDE&+p_pHQ zZkLnwCrfLUZ+}EvXb85~l8_oMQk|XEG&>d6b;>exZD$&J6bo?ZYFIDZ9RwuRj`Jjd z=#U~=AI0`Iq#tf;A$s9{LlEf~udZpi)Z8L{54neEg;xk&`j`h)&p)mepStLxXk7X} zAuSM|*`}a8rKWQ)lYi)80!dEgv-E6b$l6MyI(6IXCTVXIO?H|it0p<^5`1z?a(+}L zxNIa@^+?aVwJ7c5lJ{1|&uo$wv`EWV6>2`+sCZUS2;1-r389zc(vj$+R%z@a5`w0{ zggCnzFQBss2``HF9yi6UsN@|J!I{)*Ta=xGnx5BmT@5`t?ZPT>*7a<6XR7Cw(Zq%B zM%wkv+-9eG7i-pKj2P_~C6703+J^br>S$>U2}ByN_*T!)UqWguhhr6jQ zjyqqZ(d_bBNFKT9n0whkLqsWOQ;`UF9^FIi{(bEt5F}2|itV3-9k6|Hpd^~MkL6%j zZET|tj!{ae$fzyHaeAjxxj`OF#fU#-IN~>jflNC^l!y;a+@eHi#1V7xd#^{-|2?1x zREI8EQ8qK_5o+O;bv0|0Gze=I;Y5E>2Z&V^+wkug&WQ~1v_)&l@x?hj+qQjAhF6umPdpoDX*Wmk}e zqTERuQke_7)EIU>Dnn6&oUYou&`ZM82JYlLY1oHEFlMXy^spW;Shp>+W^Kyg%c-iG zQk$hp19*X>G8oZ#S7UxJM$jo1C+IGCa9>CHB)UmkLhpobZeyr;R(~%j`khRY-`=ci z;-Kz2oH;AdMP zYwnP1lL+4!e7()WFgk5p+^9H{Hd~0AqDhV49I=0deA80j^%)nM-3!wqLm*4 z`H3&8cBGmXyyJk3fXzi`L8U@%6IzMV2i;@~|F(l$+e%y8T-1-I)xC^w8=+iAjT zMshpK%r&_BSRB3Suyvu3k&6GIiX^>uy&uOp^+}0WKV|H0Wg25Qtqurca+Pv=0Anxh z$t9#Jur-;ZvWNAj1;&bVd8_uU)uSD4uDZ6>Y}9T8BEycf%gZKMD&pKy)eoheix1C08%|joe8wY-L-`K zh-S^0PB_|<)~J4B`iv=ThKn6l;=?F?V3Ikgk@+pZ6~(oO;E-o3YW=!Gcu-fcCl9u5 z2L2cwoQbV9g(6k{bD`(J^bgIhmL%ck3JBR-ng4bt>81XWqUaKXW10Qg(J!q{MpM(q zvI9%*F#Az_#p}WC0|se^=NBFEjlb`CLD22MbW2A{A1Fga#26LP-ArKQ8pkexY1jV7 zEP_-Lxy;P)#j!$S4QfT_D4uGafyORggSom_7Y$2w=%p8-kk@L7rGT`8Sq~*tj;*g{ z6T@7+#J&YI3)NhHmeg5@pDNW&7p9$-xi-yHO>d9sX=TTwCr#NcK;}|4i`#C#ZVO^z z&!=sfYKu~(XPsXVXUhsoxk}N>j#JFXQthpZ_B`M6sauWQEM*iMI|QqaYQN3X^Ucc3 zUt=S$p;y*nJ!RUD4E0Ny+0KpR+VG@YL?eRj+<#uZ_Sa8mIym6N6H(HvcUuT3cvdHf%NVN><9w3 zLKWNL#6NAcjXld9*Qt;8b{()bj@X??tj*BIb}0QnVtT*FJvYWiqyrBf;5JV1oyWM` zJ2e;0P%Rz6G>%|b6eT)NAgUC|oFhNGLQ}s)iyoosKP86mTvW^_A-yD|+hy=xySyj9 zB@HjKhYx8eT79tg9i{3YC4E^E=Q1EvdifJw42Qx^GcR}Ro=a+aeJxUTcrH(a`M8CUQUxg zvRF-1M2`C*NLtsj7hEia0SP!?jhit7f<&r~*>zP=6oyyXYgPQsHpH|kTJra$5N8tK z&)~0@XHH+{tE+EEWZ@Sd#5GUf%iDz>QDYkIV)<_kLl?&l6C&TV#%m{HMlAT@Sth)f z^$o^ULm|dKKUgTxw>7QhYZ7dao0S@wTX6C=SzErqWBir@h|$XC1uveEm1pL+_(&fg zRxMbn2ts^lR;_o;s8loRb(26gok!}I&>2^tCK-&Y>lloBs2#X8c9~u*59>s>n?^{S zir}AIAT0&858yHww-IlD^c%bU=-gkeq>p`t+#Qh>I&im@+P68~tP=HFoB9K;w0^le%4#LjA}MPNK>+-4oiVr-xT01u0k<{Sk9MHMJ8vh}0#% z$_(b3xd*2D3iuarog$QJb9;}h$ZoY4!vt9hB((W%E9Sy&i2uJj&MGVlep}9f3lll$_uPmipf5sFXL+%=kcb=kW1*6rxc0d+`6(4fe>XW7(6#@sKHNYpmQs)qz^110QS zQ{OnhD|We**UamL$J}_iMI0f?6pxtoITT&4O#}8)_F(+!g@}EA@_VeUSoR%J81~?a z)n=6J^v2Or7b+r~`=V{a!{&3&2F1+5)E*MkUaMNgOkDj8qekum<-{~bp9@XhOT(Ka zgP|V)M_4raZLk5nhfV8O_3!)jwY4>!2(;tYoj3Nnt$%PUT~eO!XAE{EaqL2||23r* z-qJdoc-%7b4C8Xjc$u7{8UljEw%Io6ZLyvrdIzVc0fr^ufoBG(CQU; zb%^SEA7s8XK5ww)32mKV#V$>^r6-5IR9c2j*`kKlUbG7a9R0+$F_K{?y5sJQMx0ZTtORY_42^pp zTVSa~TUoV!#fi|K<@AriIyRfZ;BT{CN->vb%5HVS34ZIe!?(ed1Sc$nT)LA4-C{Dv zT7v5_3W*jW6)xn=+7wC3DAa3GG0NI0LWFAyaC&TJ#MRn-o?*%kpx5kjp$s%2-o2j~ zlW>@E*X@rR-%%_M`Bg;&one`9VzitutHoD2F7^Zz?Mkzy&yy#zk&lG!ia$(+q;R|L zUFj9#>CTBMs$*4RSd11vf?cjHdN_$rAvu!X!Q;c%oq77#s%tJE63E%DF-Rx-=OEr< ztwT2;zrl0=$#oXSK3P_-Yg}Cg#W~I@(N?tw(hL79b&rE5*RUsJj9CD0w9MbQ9~+l| zOAeQgkqF{qM1JBJ4Ni-q_{Vgz?q+pHC6Gf^ZBI?har*-9U`^09LVf|NDeM`1A?x=T zPDZ;VwdhL(8sblV@P-J7K>8?P6HbWNW9h6sHQVj<9o;p?@uGTfN9e7Ya_HUvdh!Wdo>gkZG9PB5PZrIM=_ww;f!7T}hLkK4x0@xn zyCY4vS5{0OUKoRm3Y}DWw@Ek866lRb--Hm&2AHb8agvfKY$0AhP^hBeJv(e8InL?})Qmx44PD?G z5|9H{Pi8>KIF%6y#;MAOFzw@!r8goC^DOlv;L)?b5%8_#bRcYx{T))pxt5|RHIJTK zCsX+dq=QssQ>;ul%ivzUKWy6cS)ZG%s61bGB5p`i@kkc7@|x?he{@H7|NiSlIc;*# z_k4ao@5`B$?VkC3*leC=_nZ8Ie-b-FJUuWO(gSum=(I|)aH&ut64PDfAuvx1BRBhbb7}Vk5fQqbd)deb9mi5NceO zYrfQW5Z`g$?jhPRZOPQ^w%P3W`uMKgA|3~i-J1C06d~ZE_4_Km3u1}st)jT)RF=hb z7Vp#QGUyde%SnWc!hZA2NpBnVf`DGoF$5Fm+K8Cdi?O)T*YbN#J(u%rU-WV=|0`lP zdv$T&*HR-pF#9@B2(}QZsT?-JbJ%9tD2gU$SVEnt^`lg50DaQMwI^J`9xJ&JQfBc> zqdN(wt0i%RA{S(_E*F}YW!0<0Go|s&YO$!D=r9Y}UPf+!{8(A@HG}s$_;?ao_0pyX ziMfi)s`Ju4h-gdMtyrPg5ZliMK;d?PzoG-_Kne^yy3(S>rZ1DI>1#{s1+9 zT<2nUqb(maOhTADOO6UiFVkz%*EY zs5LCccUn-Jyl9=z$TLw?<)k&l&Oev<;p*^;A0~3FzT+>cD%iZssgD8ubCg@=EGuMW z%5S2g3aSB@vcmtu2{umrn~TgP)G`lMonFwnN3?R1Nz`7c%twj!y}mVGDg0dX$Xuqb z-I?BJ6f_;jkJ?MHmhp8K(s>oRNdYzpwY+x3MO69qgDtawa9u(s4Bt6e|1`li7@7WStBK&Bg0CBt5n$T6^4LTiGm> z#2{lq0V{;-kZb1RC560u1(O3GD)tXY7$S^$VD-Y+!2VN6mEuPLYIC9H33s>U_*$&8 z%h9){JL1X7ZM4%sQL4A9ua;5_jv-ad;y-JJSq`mWGxa{MPiHT2!u~8}koCe!iqzXR zBdU2A@9~fqg6mzO%iKilJ(zc%;>Zz`0ekMh1$-F=pv(Mb(8Mu`3XsX)1?(Dy6)swc z00sW~ZEFk7zBk?}qrb<*9_uT7Cy{A$1VfxTF7EY*@>XVzhlW3||DF{K0g+y#HJFmG z;qu2q#`3(O8Vp8m+hGSU{1qt%;um~pLNDWt*KV$azjNSHq`0drR;g*&h-*9U4(!hT zCZh6BH=6-Aai=!L8r!JSTz0huaILTRnxxXtA0umNrB?GB-9X+575U!%cyDH$H%7$i?yNcH7QkPWiJbSkW(uHx%JM! z6^@xFYEQF#zAopZova?E^9R3HiTgxH`?7}aL%K)SWQHxjnEsj&Bs3wAM05krtT(&` z_Ll+FnIyQ?IresTdH-J?c}%DTyz~8-gztuL-()iH^ZU{cKQ_&Nmxw{7?Wq*E$N%^t z-y1vYgUrwC9KY#ADOL^<=bCExJ%rU89UGSwmA0NFpYdw}nGAAUYk&!fh32XVx4o86 zU&0V$KZkV1tXg7#tzGvf=E-;9Qnmd`$!K=&W%Ra|!sgL&NBwWD9e_<@7}t zX)9I8ajCjd#w)y~jl95H!y4X7I~9@WN0PkNI6+p%J!9~5Ryt4ZNm(-=L2E^%_ftJ0O>A0HxH$`&exCenyMG(|xENmakFn0Iry z9o)g-gag9%*LaLiH>cHpi^9c}Ey&oVCbnWfM|~DNqhZD;Wma5r(J58anhu)Lgstz= zV8(4Z7>b_i6hq*?sG}(^f@S5P13YzOve&(9lPYq4=Ss*1~qt`Jv3HDA( z!#}hFWPbB%H=rlB7WHAI9abgo+$B4*S4O`~`ftUW_t6c4sIjI2K@u}kg) z-8v<$r-N;!qPe#0x6MR(n%b-8-L}tnY1Y5c@u(oeq9U%8mL%-FlXR8FzIt*pZT))e zkq{m7Bwv=ITy&a~%qWK?nonjFTlQk|JatFFfp$k;m3n7n*xwbXFv7$$E%QY<@QYsf zKm!-$I1TJBDP%BM@dBzcvS$H&NV^m4{RlnY9L}5a6E6vz{no;x_d>dY*`jRXSQ@IrQER%Fmmg48mzP*f2{w5h zJi$w&uwf_mX=MK9wAptkof6la5lCu6gMa{FTIFxk0dep@+Xp6WTQxuh`Lzt z{-(V8@F`cst=A)vK+3`KmjMESGiLDgq5he8v0w=I+GQy^aMbb_I>e3?2XZfWmO^3XQm?Ynctl zEBMBiPq8ZmVx$RbObuYq02rW91E`viRCK7&=@9Hgyj1K%`$A)fYJv9l?AUmOcz#Cw zl-%13`i#9DQ%+&Gzv2tAN9@@EiDqo8xco>-cX=}XR+BToMv8Yea=hxx0EGGG+?eME zSSS+cR(K7J~c~GFcc$XDHUp$uK;qdB5VDw{=kA=h+dHmz;N2on!oNf&+Bb z$;Mx-9`2i~k@h#*T_;>0ppp5%PYPv7^B@qy5(PLWHs-cmXa=ZJo&E7U6gS_3PIowE zkS_o5WrzsW?E`}=g-}7MDOa>COgh-16``DN)o8k-C*hDqT9C6&cwnyWSJ9|!=M@=# zHDroq)z`wsqrw00pvDId)xTdw^uOf4U>pC_Oqb>1z=_pdoQ^ O@E(5LgH{{-tNI_Ztm=mV literal 19445 zcmZU(Q*bXn)bCx}wrv}`w)?AX+qP}nwr$%scirx~J^%N4X5MpgE|RR7WaVN_CZCm+ zuc8bn7#a`|5EM{Cl8$cfYq{qw1P~Am77!375FU`Rlc}MLDZo= z-VUG&4FsBTcWCwhHCGQTu2vCu|!cB}cC*f>5D`_7Fz(F21Zmhv#?!E_wAyaf#j>WA$5A=CMLZr1)57>qER z>l7O{j!3eWerC}_Cs!1EdNawKuO0cbafL4mpw`cN9DL#D!bQWT58X#VXgx>wd$tL! zAEBdB_;}$-UHirn-N#AuO9dsRI`t^(Bv+IdtwCFi!I8zaMi3n3Hrgu0A-atW=%vpv z!)})h2D85hn>R{j9BJ|$Lp9WkBFvP(w;3!sG<-6ei;0Mph%$%fY{Uqy4fSJaBFDlP z%xSe-w85tjm7Dgo>=1WM(-Dz(<5S9S2IN}GzIk-$)r2ma1GM(I3iTOgSTR zGR{nK5x$E}BHwfb8@XQ3_YZVF@1B$C;5$dRM=`B~h|Nrmbl)~*KaX|9WN+RYaGYIo zjA=5Fd<;a(D8qZ1*?<6qO<(KOIwOsx^clFtX0RHoz*?cP$90hq2oJWJMliFa_7KCd zNrx!zxT(2qOCVc@!VH$GcvTO0^~PnuqG1c#U=J(TbU5xsYYv_X!*mn>OvK>A#=++l z#2ecQXAq6m0)z3A-NI2cqSMO4nvgj4tQQgD)RQ>ZPMKbXsD91m>&O~9{iCY_avY)y zHcma~Ym>$u8Vg4H_d1^;&gM0rWP2v9+nxOB^7@#K-Y9Ty!PCfYH}p+5JUvUNt@KXe6LW#n77qDZBlrxO6bk)MDE1#u(KZzr+a zje3#Xb&a1i?4UvbkhLg0BFfg=C5ge82k?Upc=+?w6 zd=F^dj9H)PCk{&LE^8&haqQj!XbvK3yt>+ z8c4P9XGo&I^c-9!TS5kJaM)gr6gr3w56u5bAxUzW7y0g{m@-z2P};30Bp|>eh(Qp* z#oyT%v9*_A>)~~~c8A?=oMOpgly9MtZ(x2KNt*2>yV3(gLqSv~PqqTEY@7kCgFQelY(o8)gFry0v{Agg$wRwICu?P zjG7RsxD30$M_#B1LYWz;QaP!(cE`Figqqc4JPDIzLP|4_QxK{(Q#3Zeo2_|#rQ^y1 z_a;Wl>_#8jqk}RJTrT;&nI&lIy9!D^pkq_8LkFGL-flWhRNd&Rss@`QAH73^uF7!S zmhuK}S+@1f>NJ7Qhq+$yz$F&X=2^76-lAUlmfj`Q{Mov7OW;j5j2h852<_kNEsUyy zy!{7hBo2b((OxXiPXSm)xCE-QtuDKmf0D zUbk?g4w?l1>9O{MFU-1>!QpnuI^rHaP#4*cv(iXtS9xecgPu0ddN0U=YExmH9aLI) z7>#{hxpcZis~r9%ePN7T3HEm>F;G6@1LDHL!Kwj6PX(imVBWq0(O+7VVaEP9`qGQ_ z)h;Y3+*(igRa!_1&42Ev(%CAs3X{Z}Q(cA7)6K<2QHt?HiL+DcFlhHu=DSL-d-IR4 z&NDvZp~A3d`1Q;Vv%Nn%^u#t9erG0IlGYg1vT4vAY|cU%-A@67nG}S z(nT6eoA-_A>E4Hvv-$5W;P#uxy?S|HM_<<7*Afl{uS1bl<})%VWf}yGfNQv_r2l}q zXv*#&G)_fc#Ugb+8D%^8^9BVcd;?_lkg3CinVT@ks{Lla7Va(Nb!UWcd}G@){)6cM1!uhAu@yJ}@&5x(-)prK@wPL6!O*aOSzrj6e~x6_@!eyY zQ*5_f57AQiSyk!jlu49|QIg`3y&3{qhcKS1*__IZt|JCi{-`o7& zb~vv-oV#s1pC5ihn9luZ_Pj9rxyZM~`!=6{cGml68u|OZ|-;I zWf%7S3;PpBc}vnAg-X|vKNGZq&2woa5TE?l8}oNeDWR(52HP#$=rEZ}$7CTmxlxEK z-SH@aVy)mAa%p=o91AN9K!7j|}yv>J|;Uu63s+U+5|K|YF-wo9sMWl6KBJL^s z4ooTQy)L|#XEXKg%MX`w{c5 z?;&YG8x8jy0AElqeXrxfXY;5P>;Qf zBeRezF9)60stX}`j9|5})|ZDg7K94{{P=$@FAVC5{h_|enh)T;U&nE0NdE)$X^r{_ z=0pVje{*>V|D5uO+Ob ztV*qlc+$0?S6eRsxOh*W>*?fuv89CuUNObLgnR0EXT0EJO|9n}+K%^x#y`Nt%b9QV zFomIeB8ipFViTXGE> z;~I7vQs0<`xVq(k0|v7czFr2w@o+!%QLf3mKgRWsaSno zsW%%@yWBAyeRP$*rs~nB+Wai8q#qlq$k9Ytx_u9jz)(p%7>D25$d~{(>bxFUnDQ1p zVpD`>rbIniN-6`^}S$ zoe*BlorD3Kxrq?kTPJHs@wvVYWyhqmaOAu9vp_QMao%HouY9f?$^ygBcF)NO?m}2f zfZG=Whd9o8`H6bMZSmS%%DF+t{|L{(eGYJNwPYB0W(kpl;4P3hquXDzGrgrOW#L`9TsHA{Hs0~682+{=gU zQeRz*!?dQ6@W!dIPRL$$?n6J5rAQIn}`6vaU+v z3|fsxw`XnTrNk{x zu38wbmR63NZ1V>k*6LchMXL7#64opltiYyXq(aLYy`Ekb*5X&!Q)QnWV|@Xmv5i2f zAcU<8niJxNZD_|$wapD*RIko01JTO*JGoU9Q@QgDC3MP=H)}8tjnpA!S9Sfo2P;;k z@Tv)Xi>K--4h@K`#ye6w#oAy&e^H(w- zNv82&XP-K&G&je0Z;G+2cz=pa^Lk*AO<{|7k!qT*JN;@c)Qyv95hplFRSQ-ikh|q% zPk$mj0l({C9eeA$uKhjZA;98>XZbxtmBVK`cxl1R-l+PO!^^(-e>z&5XRmD?+vIAS zhav(iL+@(aTb*(5_1XdEjfH=0&eq6}5w^BBvx=Ne{-nrDKc z&@!}`HcP^nN!Zp@egkS!mT^t)=uhFlesD>f^cM0l3;1NdZb#`HWt7<~e zDzCuudWW7nPlo^%(_U`x%G#fu)p!mUYlzRGTr8ga$o4RZqEYgVtN{^JSJZcJU(&{N zT7DQ-pTgQP4JkJMP8lIZtTq9)v=-ZqA~9Q)@k21PcE#*}&OgffzKI^Nzn%WYdikC| zTH7PnM7?Vq3HRw+S2w<#qZnIn4x+F!?@lLbS)VR%h+x5wF$J;p^(C1t5}i$sOZ^a* z4#)wcRVERfN40IhyE;#nR`|k3UpV7Pzm@o+q3r+(MhhcGvpqv2*fCanzBzWvRR=Kka~bELm~au1wN%K%LoUk`c0 zJW_?#8I{uhkN=hqp3eO|R&beCA3cPh|4-QG|2OQ~uiH~Y&d+<{63BVQTx9r#hpITY zww~qfr{3Cq?Wd>XGMkUz_#C!>llzA2nkTdO46SYMB|O4)&8^)_%o$z7ZQCk8d2PfP zzwzDv8=oM#Vd<*-d)&74^msdF3LYC=e_ZV9*z-YsJ7}*@M=YBe52e4=5r{2dy~WGF zPsX;0nNqBR?Bg&)XrjJ8Ybu|VH-GHNlSc&X6txA&}$wq)9!PVuI|-7HG6n_(?UnU zk3u=yF~Qp%+`(yOb~vYlTbeh5qTZ{RZ9YNhFs+n|2SH6y=fG?NP#DY9OO&*JUz(Fu z%zxi3PI~?^euHgOGRDW_G3L=Fz#~O@9DU85-|zkg9ZOh&@|)SQJ>*L}gCy5@9J5C}A zwf-|0OClZB;8%H9kPZ2Y!#j=|lRp&PZ(yO?M8d*UlX$Jzy4dNUvOi4OPp7%;hX1zb~pt@iP+6dT7bum^k|0P?yJ5*Qp?*51xM7-!WdJBcmzhNV)8z^{#2l z%Z}aBwfPLgzN(_iSF4ki^iKuT1+4!ijkcAf>1TyBnMdR;IXN)vN>aq%qV3-HG3x2b+Ji{j!7vURLz3r``6=fyIi}2^4 zrxpKrJ#MV}Yo%4R_aIVqQFJtb)FSAjCTi7%mscef{BMKD`UkH4q$;NBOQ)};K#p;A zuOVPUv=B)Hs;|#9oFP_@dmhnuv8b&eYGKk@cN;%>+|3L8^Zfg0pI(HT#W%oIc-y6} zP{~LH=VFwb_rX`Wz@XlUw(yPuxm9o%mTmNrqTzIhM#9*Y4HcEbjLr+{!XMGx5iOv! zYxZW^)~FZWJ{U^&`9q)K4~fbj%Gaia_`IuBhnu_`wQRDDl<(A;{7wuV zBz7@V&ys10cD=_*>wC6;V~p-owTx={F-7%t-Kz~84B&)&SPb2T63{oIV(u>>0o#Qh zn8wpkrsyY_Z3jB)I)U^C;>?)n48$rd2np43<3`)lDK%S+N|?sr9I(O38GU`qroo7X zf=U^?tI}_cDJ?g!_Q)4ekq!mnoAmy4T6*|F*!61B8rmRFxPu%0V zLKHe01o;G>Q3#AxV#v4Z1tZZ?j_u^Vk>!GHcEK=>ud-q*q?_2mo6IHVzc!dE*h%4= zmm1El5CqLLbT+{6JXEHREH-6E-p)^mMT?Xrx+{v)aE>FbzvK}os9bii7 z4&vu=4%93SQv~&0*HHJo#QK(;MC0)D;xa5Wh_3&M{DX@T&j5wg^HdFc%}paX!CzRH zoP>~@DcI>$Oq7dUDETo)fci}J&M6whEt(!)D)`BaF#LvrDJT|RO(aaq!IF=tA}BOp z`emPDIE;(8!zA?DfLIPq0U8WERUMPBqu;3%Nt8%jXHyMxUgVNJ#(=ddubAE`G)jg3 zvjB0cc+OU4==zqjOdB&goa-=9;P@{v@3zSx$&Q<-PiDRiz3=1PgO5>o{i!`i3TvQo zY90keNcspj#OuUJ)!=>DecQ|z0OQ_{f zBh0j@&V%TMZqO*>T0jEc3aNyFH}mWLnFIM}U#F+j$KQ=j*D!=$6fMPXGLE6Hplu+MI2aDFg~Z)Hf_?VhlGN z<{vg#@1?(E5h&MEb3#-i&`RbTJF2y#5lerwq5h)N30rtNJJZ$!^rBZhuX;izC+019 z|D-N3?PYV*S>aR_zktTzL5j$yw?L3er%?7#c2)axok7RWC7G+vNkwKD=FAC#0b@l;2Z0Zv3EvocJgOHskUK#x1b zbC$BHn~mT3xVmG4*ck~qJcpN_lY)>fFBe?hS#F#ep^O;K{#+W-3um4 zNY+WJx;}krSjlfclZtTBP;ofMwV;%`Z)+$5<3_{`y9!Jw1NjAHEXnXd9`o7X9Qw!4 ziKrgVoGJ7aB`3-*qot7Bnp)KWF7gGw8)Qp=AQMzuzYX=G=YaCXkDl_h{0L>k!_>)8D@T_u7nc_L zPaKm?4l5&BOJ#H#?&4|zH(QatPuH?VR4j+7C8Jj30XHG?^gAq8ort?6rjz7(7Ys+q zm3e8+C9Q#+;9%b(kzopE1NiB&sfp}o2-Ad+1j6t&#@sE2jVph1#?-OF*C8c}MUgu7 ziHd>?NW-^^K7mh^G;sVAw66s)+XXo9i68_K?PNlrP~hm0%jx5Z6d)tEISvx2Rnv@5 zcPG*P;*7*RSo2^H;ur>U%pht^i?82UD?kH*=2R(JwlgRIOdKN^ zg9l^}sQI3MY`rq_;X{l7F>8bvjzmuAlC)6TUcE}#KUO&2MVuF+Ysg}p42U<7i=&2m zMtotxGLdB?TdK<;>F989PC=?CgLPCIgXwE(CesL5+_vYRKx-sZ3_6d?TKqqK8wY7p z)i7z@i3!;R;NwGWwjsFGNmZlUQ+$*yJBE!%^bz3l8VELyLtW9I&zQt@w_+|Ew zy;9+(td+y!>Qj&XLhX?2(|!+k5#Du?(ZN*CJx3EqCEvn5F^XKH--RurxU^08$)jRC zhLv{m4<1cOvO~I>JZz_318Q|og$udo^8C!xD-xxo$3ODV>?G08x(0_1!g2BU;HrNh z$rjY{q!_kRy9)YdUxS!aj4R?N~ky)EY3c2O;XxIlL%Zs7m%4XNx zAW5iPlu6>x7p06G3YWj{mWed%gyM!V2rWuMp`~}%M50YmWg=b_4^hBzaH>lQ`ip&Z zMi~=Dsx#)FdLaPXBaCm-#^L8B|J>;;z(rHc!3?g%ER*oYQUYtv7jfn(A1}|&7GsXr z>*e3}^NqHC4fe-a9x$MmuXS)IrIXd9;CrkwQp|v z^BRLIXbN3AU2oyfDyJzWkBVk3aB$FsDxbX)N;7=!_yoP+CtbDF!c*R{q){pjJQb@V-WombhKb; z?`R@kczVu+3N1j~Tz-^uK77btpT}>6+fT$jGA!t4-lI}2Bc3XkTzF)XPV7&8C28E( z6nth(+~sr38*d+NLw*hQnGO^Paa0*2dllix@f3;UTUFt(eurP3&g^uYz>Mt1X+&QD zFb9XSp!ZDmM(p!C*nB7ay+)>Th`e+5XSG?4(W4#YF2WohkY}x;)C&NJw!c{W)o^ge z2SU{SNi53KmX-_SvPhg0VKkYHMa+#VpuCEZ&v9i+<-kisZ|A`vWi@9r55sg9`Pz?? zO@C{iqg3u{7^%-lh~{)k)anz|7o5r5kUJpZ`VP`jV(cM;z&?KuvnZZYK7yZwUCMXX zFo-L)Qz!clSY`PKh{-WLl0td9Q0s^PgDbR+wf+Lf1z#4y+nB!INp}rY03lC58*cL^*+R5VSaSx zP6L@#JpJXzGgVza-~;D85k(s9wKhR3Oq*xICJ`k~7UHj32u>m&oOz&Kt8E@B16kx;)-FY4Y|f}&W;#Xir% zv}+QZ75f*)Et7Ym8VLgCW(S**VxfewVHB)GMorOf2q!VZ9p+jr8L0<0>`Q~2uN>L5E#4b`r(rZ*$ zMgtUe(^XiGtVK7v&@EAMehtxhN6izl7Z>fEU^$!9qIoaE8`p4anW>LRR=rKS(_A|b z4VqO*JyK>mfgLJhUVum~T1GXhGh25Nm;VqzhJc}$Bq@<`I@3E=N!df}^4m-dc8Y}4 z(7yJ)=o0cXP@Mc5*$>|)+Sf8xmrO^}6O(}PmeIh%wBR=0GGuCZ#Lc&xKEp}k-b&Ys zQy*@y{0)Z*4JRn9g$(Nf5+st&EbcQIoqOanzhI9iaR$Vw1u@)dp%+E+K`wcD;S(?W zoSjHl7QxpMAWouz5|dGoE;fRkIi*hcwNxybry=>zJW*q~$2Dw2f?;pLfL!D)O?%(P zJnj;mxjY#}45Lm)?bPqjcE-!Gdf1;*i`%utedux_(;d-%IxrA4IP;@fyl9SS^&RSH zSE13l-h?8MpJ1KE&eft4ZZ`!9Jnk8$Y3!^bl#e+6gF%ADL6S6oIHd)ooX;a0Jff*Er!2^Cp zeA+*F(0(Vg$3#;a4doIHL5pGpjC@lWU$100F3~AOmLI4eUNSoNEG!O^UEBWBQ@9zE z_VN~%+)v&zJ2z*pnJ)8ENzxkJm_GqJprj*<%SwMsi#-S$@SrgqnkD_qr{-yg1cnvm z)<^P%k9vL3WU=np4aJuuW#}p)CcRS4**B`h%%1;vtn&EaC>0yq)QDg+h#)2cz`lqM zP$7D*#JQFb<6Klk;i!Rk*?@VN4NWd_Sx6Ky+sc8FTG5~3tcPO$*g`Ve0)Om~D!xLk zjFRLFfVA#bG8!vfBlu$Lw)6MI<78{`-aB1BzM*r8#a?lm8tG58c=T(ezq~odD==&u zsL|jk4|KW45`RxpgUB=o@eKBd4BQD7hJ0W^fB>lhWzh0eoqj?+_xVn!*XBsI4IUP!eBqSo9nSA$Jn z4K)OG)u;_MZjcR-qgoJX)w@}*2kQB_ZvbANOQE_f1|3AR)nLsR=&O8)41hY3TCK*! zIJnv>vLwKmdNo+-#XyxG3xFv8zh*uv7Qk3&Gg$tmK!yKeoF zoF0+eSFT>zk=f6oI3nyjA4TwxknJ;ETxqU_W8kKDCBaJ%v9C}>^q@9>0ObG}A9HDRyDanCft>(vG6=Lzu~9RuDd7QI zm5Q(n&C~QuZIY%Ll_Q z!QJ1V*rjo|I_`S`@n6|NFFFFjHc1>b67+(x4yTZ(n?X&q;A1i4RdwOYW(9CP?%QFF zNK3Q$Um`1)cu?XjJ5NP1Uw#JBzGC(bS643Nq5>r>RVr%zUXqy+ViBMQ;Pi=e1Bgtd z(=?!L19xzEWQsQ%0d!gDsCk26QpbG*q`xd+B0$4z7)m1orVFFMc)3fo0z<4hIg`T6 zju~nTj1!o$NXyrQ-hQ@@(`L)TE4rc97VYY4Y^UGOuAtXtq zZUjj{_-xx+fd?7|{kIy#;i6CH-vWNC^f{a@;gtmuod}YD(Qimxm|yClMq~Nk2w09- zqSW{V!BhrArbxlcw5qMxyKWxvU*)7pxA(ZJBKpK}BBpQf_jsbZ)pXuUTLRm9s+Gf@ z30oXT{1HxOJCHvr$UL5P*4@UBOvl0}a<6YlTc>Tqkw~j*@{?v?P(RBkd5@h*uQ(6n zZ}WfZZyqQ_QS$|ELpIVe;0&SpV0K{y^>knw6|F$p(#~5u(7(*Bk)OFRIJhvzsBwS<=`3po5 zsTM({bui`+%i~BE>0#fo7RlLgcSWS16HsV_Q#{~iPLU5KU8Y04d?E?-jo4FGkL8~` zQ2B2~DLYVi31$f5jj;Km>|Tq;E8lh;Xu3-C3Hpnw!M{fw=ree~e+uZT@CAgQVfGSu z9&A@V?f;TlpzPn$I^Q$~DMbWtB2$T#`xNqPgeHC0f)omO``ska@M!fB3>JkM|LZ{K zw-bxkUOZNN?m*86vlBBnY94R4h&5ldey5@D4=?wS^ne+}RJ~+RH9u2;-}0+#7pr=m znb%OK?Bd{5w#b6DC9maN1$hhLl1wx!&UQN?L~JhvVQ#@qBjmJhkvO zz!AtC4+fP)Lw%5WLzcS-b;=1Xwi4)RBR1vb^XzZnuL|OnA>wJExKO@U{(P5|$4Us} zfo)Hqtz;N-Z)sv-5gqTodRLqHV#nF9!EG8f@M%~dnv$GQxfUvk=GL3khy`hh1B2=Q zKu04rn)PD@D?;E6q!7msHjTPGniBR9Qy;)6w3QiBV+OFMr~FKD*R=3i%OZY>DRA~g zK*Wk7fqCnbY3pT{Q&L+W$+)&^eI!>k4EqTGQ7;+1jdhEHVwB1A()&%%66rrfXKl_Z zGQ0O1K>CM~ymgo+lP*yU^lhQqPksF%TsD9plu5JH36HgWoIIvALg6d|6I0Tbpu}TS zsv!TxI16+&@{MAoN53~~v`Zv}8||pcMm5@2$*Rpv?_Pv4op!XL28TOpPugfbmgP+( zO6N^hgHB}7ddBHBLQ79uCDNew&AD|rE1PFX`{})hx^0^=j$EOkm-CnNj^n=Quwol&`X?d9XO z=MHvwN9!%-Y=Zo<@p8?$ATPWug7C8O!b`C5vR&Z64`ykD*_Q2R{B<+uVYJI}@?KvV zWw7hVBhOsS`IZou#{-dTf#({Jb}w>suWn%oF>NAU%HYqj3L^gEm}OO9HpuF_wAJupl&b} zEmRk+S{!7sh}Jq~4+h;wIE!FAsKs#(e=Ehug!e~=JzUAI-Y<(QIg)OhtdJ}7YX-5k zW2=aiT~;~Y;OqXd5#q66Kin_$lQr@=wm`~RUlZWr!M4C~legN^R5Q5$4mO{1SAYUQ zrY;|y5ISI_1`@)ysr>bN`9oXW$<@XLGTyMq#Dg?MmkDQk65eAn?+zq%&~*^eoy6&d zA+y4Vn3bi;e^|)>kc5snJes7O`$#W3KL4+75SJfiyAxyV6YHB5{Ih%Fb3=puf<~)} z-fx;CYfG6Z@aDx1Kj}-iX9uy>(4sm=$iVIhgh2hSWJtK_~2vC zi+VXw(5XAC&~@#6EHX$ie@y~~JcoypV+PF1hi3d4F zu1Lx0CMMh^J(7i!x>KVKw`iAK@}i{$fa&3;O==2qy*U;qSt4$U(b(u(2C((}yjq)M zh(^n%mP)HB%n?y~`3Al^Nh_MFs8`W8M?RE`eW;R`$ap)6s_7=iG2l>@mdd2QxK>?W zKGLPOrbvcb^{^SQIo<@N$ePCdbHd*;Bak&`ofLFI^}+qdt=X~O-`v%7tNTFv-trWe zi-=iaD!)yqut=@5PcPc{(NwMcoK=sAuE^hgR*daXt{hVNC>FzF;D$8z>!cztPo`ZK zbJcI>G)<2d#?UsoDRq%cfnCNIA$h_!y4OM7vgkv!!GMno~G3I+fP31(S(%EaKAa(L}|4A@DTYxJk! zOX+A2CJo1QbUM|RX5rGUiE!dwN1ieaL#S-4o443P+q(?F(n)^A3s}nuvcAY`H)n5| z82l_d8`te}$iS^UT`iF?B=c0_>z@GVgYY?%oNdC(heFA{P(?G!~RDIwD)7sl}CiL3H2=CPg){EjZS zkX1mQ%&ec0wiMAMq$C$wN zUnMck4LNAeSnGF{i&6a4p&aJi zypl^_Q*Dclo)q{I-*gCi?JK3_4HS9z!|hJR!|3Rtp6)s9lcADnnae^7mz-J3Wy3@~ z*mVje0joBh1VJWN;wDE&v z0F^CltKt!%ORmgsTDnPPU|+UHEZdiBnMM^JAk}=@7u#%==)Tsz!=}E&P2F|0^!I*N z;wuvCvdS)V_VVPD`33W^=u%#gy11XqEH*=s#u%EU-eoXi+3fWYaTEq>=97j{ai-*V zZ3d>Fy%-Fsq){Ce-+sV&>4T*N_UJ6w!d)%V-eQi*I%Apo+-=l4JNy$Q>#^$Q{-8BC z;T<9*Cf0$PS+_2#PcJ0uI%Q6n^yIr6YWIQ%fKiXCJ<2R-Oq>ruSxjAKwqFSFb$7c^ z5awjwvZEU_*62i7)r$*k>(9Vuw}!3vH(*g4r5MH=0_<=bDE78LQL{v=)=m`rz!G<0yEA~BI-i1N zld+5^9As){<6i6Q9Kj4C;v|^b(NG$pDtIrFAIg5P?dnbuRjY-D3MU+XQ{&WxCoN|g z8kuMv66&qY`n+38v*cy1i>rH}b1X(fMe%zNwyI!zdD};51nyl5NBD_b*SW@hZzl>f zU^j}3h~L*VK;|_EHE9Fg^{X3=w&|OYpSY^!w``GIwD$Y@S4iRII`YNB+gpZpR+PD7E%mIAQ z&FIT-fUZ_*(B1Wm^)#Uu*L=4t0dCTO>z8_^al$QRU**;Vp~Bi0*SaNQ4e}sc zs&qT@d?LHs_5bpn3dqk}lUnB;0ZQ}IPA(b$6y;3s<)7}98z-Bt=~~UxaeBdhovbu& zHhiC+MGEyYsW{o>oeY4lXT9T`Oten=tst)@+b02yd+Fvm`L(%Cesa5s_# z8!vl)Y5blZb!uO;;8W;jJXZ3FWpsCAe9If#y3Ug>SikWB2$)_SU1CHxtBK3CM`hjT zQ`m{bfNLan+8RJ#F z@yzk{^)!rSYQ1Y5Ex=%-G>WW2UsiD@Dupfpa9Avw_U(e|(cjFCKMK1;2^@I;Y;A6y z=>LYcs;SOMjhGUWegZUdlRHEIMN9yGmkXPPVr$u(bf5qLLXh=uI=X=7RpUF9VQK=; z{n%#f3NGp#1={1yOnaq@z?tdeM|kGVW5@8P)LKaQDsPo(u;nG1H-kp@mE8b#bV9OU ze`r*!nvV>TXi-royq~hra_lg0O?*R(Slj50dOGfU0t=>GIq zc^Kkn1xU}XF;>FLM~K3iZ6n=~!yZ129L>vK0LY%C)CB<(a#J+pDxogmhQiAlJ4q} zltEVMrR3CCNm^lY)lZqr9f42Q77JEQ9>35d)wqIedL{7SsEMvlE;R6O=j|47GoBdw zpNnm7UlTC;2?|W8x9?Xcs=5fp68VtLM4$D?s8rl*U{|J-yFxug!@JA(mzji&O~p`Y z9C3VnN!`czrb;N;pSU>>Z~v&gkcqN4zP0$F_g`Y#eclT1xiv*Ds{z{=Hw(JAeNx{h z9fGFn!CxTFlFR?p`%GxYG1e1NfHf6Ms{CcTWX=l`EK>=SUebR+*UmR)>z*@{t@Tmd z3UMNE@bdgT;m*Y|_T?KVzPP0VmMyLB^PFSS|4R#M4%J1pjkuDD6HuKl&6BH1&?~4T zR(a+?*_4TZW|*ibd75R-zLN5v+&?ZGopo|ub+o8gHxm`uQf7>-28%SAllIx);R0U} zm=cj#g$iTO0CWj?TlGg`7vG?7xVxMypM}r=X;pBZ-BG(K?;eg{%3o~q(@O6OPtqSB zeKplZEFeX15PsMKD6E$dt+51iFIi>;Umj#8wAvJSsG5HA^D4OosiogA&7i-i=I-#n z!Wi}7`0t+2^YdrS6qdRaqBQOWc^th2f-WMbsV0Ofg?7>u_Udl@j(Z9gq3qXN_=Q;= zLCkL%zUoc)dc z7bW`kCIZ8S+_>HyYXtq~#MZ@DUsH8>ws2II+2T2pL>1xmqZK-)feowgtoZg#UAlY- zR!<#iv+~(L9bBzv@rX0*r7Mw|I@d_vA~8t zG}*d2G38d$U&H7L?tb7r0lqZ-h(1uD?4e=A&w@_-^=94Qu*&W_G|gtqi|9=l7fo+h z9t|r*b0Q$@*U-nD^vn0SfHNy5KPTY-#Ms8|&lo-jARl0g5Y`~E+EL~>xtR}k@g{sn z`knGzozvy5mlwT~^sB6(>)rF7i5}qWH2d)`d#ANCU2hRdXdN2FPHz$9Z1 ziiw8dIY{?)u74I{E6aBba*+C;pzb#XqWD8O*r)`1jC}1j=jrQ-C~KfgT%53=V;~EX zyB>1S5gbnE4iT#8ouv9fM0X_b=enk5W(0m1R?%u6lZ?;i=F>k^C=0)#+&;;{_c-`4 znFGRq1z_{+yRijiS?4X^y8lEcAQ*>w1+;o@%~13`J+mH~)u8;R3atYP zH`hRTmz#&k@wAeOJDj-$_9`$Y`H5;S=9XCEEP6}%YJM;yCj%rIV&mXS0acEKOqB+j z@M>sQE6XU20FQeb6eXNI3qMu zTmD_y6lGju<{rn!2MP12W9qW4h^>!{XQT)ov209mN?tSYOx>x5%b2@-B=mgh*Z45( zVnfjXa^Fw9yxPI>hhI&T@C!`gB6@J_mkSrkfEu;9olHhI0gQGtf##Gc)^0*!)StX> z-ojMq-7ggJnvu+Ul?IX+serQQo;&wDLnSP|PaPhmrRXv@Rz z!2|p+ku`NIjiF$vnWm#}?nud16sFF1sfaNeOE)Um>e$yI1)A4{q4}P>{Nk2o&YyHt zFNupu_u&JDU!B5;Kl=7Xv<3gCj{E*+L+j%JP8A_Sk22 zRkTLU+T&JHQnmM{trb-6>?sL!ghjY#^pFiMyzvsMkqV z)XL-0Tz8)_NPzRZnSZ@so-!&DlSS~Wm zc;6(~pcT(Yft0s22q263e;jzLifm-B9Wo`d%Rw8hoyV)@u``9ldY7h>C&!klH6p$H znMvvJ2Uax|kzdAWuU6C~1;l>d&$4ZjSmaoh#wTbfJqdi2A!4sipyWxn^C?<;AZ+mr zw`va*V*$t1*+9246DfgNmHxTUJy;D?AsujhP)9+)J4X#JAA-?Q7B=#j%2Ebf3t6!zS->_&tEsGK5)l)2 zcdAd08&5q1hQIOoTo$@00x1CAxNCvkalE}gdndOFzEWX}vzp2*=C@N2qk)w;h&QNp zuG+OmlCDjSDjvr=h^&j5h6!00B`oaJvWn`+#me|UZQLCMt4&?zvdo^LtACeYH}nbu z31A_?U*_7dp5>)cuMI(yeG--7V%?^pC{9q+RHxC!7XqsOMq=Q3AM2pMil!hYaw_{@$V_AMLs;dm%z5aVwQ7KE zOS05isS2GNc9_0}PnttXxz9}c;|lj>S@}^8aH)RZM}ZA$TM88^H?2sgdRV78!53(D z9+<0v?p@|2z?0iNTw#=Ki8Dy+!|C zD(<+-()%<6)mzL+6IaTwR<(}`s@`BF^|Q9%i_-B4gk5@6~=047VO)_qZj;F2a+lE z+^z3G2zH^am>j;hFkruIWI=*cT4!MHI)M)6ujdIQAbc|yVDfcI9=X<`!PfWFBT%p+14q( zKr?9~7|X@D_{+(n<>r2|Ty(f$4w{>mL!dy%p6POd)NO~yM;-AzAjyJG)^fHbvwBrt zG}i&l{ET38T)}pIB|M1AIr#{B0Givn{xqQl0APzm9Q5Qmm@;d2bfd#$`H&tzfOO@YTGRP(^k;R^$m@KzJ7Ib%nw%Rwaw=eXA)yAX z;XIg|f_uUJO~?6D@SKLMeAS(xKDzW-<=`FOH2pI_adi{^&Nsse;2PFJeo+_#9$h%< z3DSYVdk8G6&@ymiEzF$Yf+@%2ZqA@3&iv14K)5q#&TZ3_<_H>#55|SDx?zkj+U{s z?Id$T+2=ANg($K*#_#?+}hfPy}1Q$xP_~%s#VTm^Pp!?4t%S zQu^+m8%}9bLS23y^et)lX=+c#4Lyw5EbZ-NZM;wwoV(i=3%WWMQajv3@ z+Tl0zzjhzmw8aesUEDVm&e@vNQoHeehB|i3*L8`3)K0PG5R75@^By_fr*Q19bA!Rc zM&Ckd`4^jTPv30e^>!ii*oxDQq&f10zhj#b`GogKx>vZpZ^VwUgbW_>ICkD`9#1Vj zV~RzYErcy}(5{zBi|e%|m6V)_rEM9aqDSCID!S7{am#JpKD_M4D`gP6hy6Kh$a)i5 z+Spie9n~GEFe8fTvK22yE{j!tp_%mO=IHI1ycJWY2Zn9aF2Qo$;Z>n7=$J=otAuo) zEBL0KIuZIKs`up&s*Br&E;(G@x^#bJ7qUm)fx9y2<+X4$-d=wyy+ETb%(YB z2 z&VOx727H1%`=A7#zxw_CvBNDh-_3?MZk$g0;|KN}ot6_Sj29&6&bz;r#hafodRNSl zToWmLBwsHzWf(PaB>F77ERm65SA>FD&%Uzg9kO~FKinIHCy?T%zq;Dw3?1EAth2}- zvTG)-{jpRxfmVuO;g){$dNDP+&x58c@scq3ls-FV7O4N##iZ5$#k&l!vgs7sq|Zx3 zI_vd;NuM}x!#dH4gN`NzWZ#x=R7>gS(XD%k0&vw<-560AXlH(kuSIB27&QE}u=H-R zFyj0$VwJ*#n0zIevgrmI&BImKcVUd5t(w=i(R8$wvtNwhyrT6>xAJC_O$^ZZW diff --git a/Solutions/Armis/Package/createUiDefinition.json b/Solutions/Armis/Package/createUiDefinition.json index 1c9a6ffcb49..d80965d4f34 100644 --- a/Solutions/Armis/Package/createUiDefinition.json +++ b/Solutions/Armis/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Armis/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.\n\n**Data Connectors:** 3, **Parsers:** 3, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Armis/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Armis](https://www.armis.com/) Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.\n\n**Data Connectors:** 3, **Parsers:** 4, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", diff --git a/Solutions/Armis/Package/mainTemplate.json b/Solutions/Armis/Package/mainTemplate.json index 7339ace064f..2190f7db1f4 100644 --- a/Solutions/Armis/Package/mainTemplate.json +++ b/Solutions/Armis/Package/mainTemplate.json @@ -71,6 +71,13 @@ "parserVersion3": "1.0.1", "parserContentId3": "ArmisAlerts-Parser" }, + "parserObject4": { + "_parserName4": "[concat(parameters('workspace'),'/','ArmisAuditLogs')]", + "_parserId4": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ArmisAuditLogs')]", + "parserTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('ArmisAuditLogs-Parser')))]", + "parserVersion4": "1.0.0", + "parserContentId4": "ArmisAuditLogs-Parser" + }, "uiConfigId1": "ArmisAlertsActivities", "_uiConfigId1": "[variables('uiConfigId1')]", "dataConnectorContentId1": "ArmisAlertsActivities", @@ -504,6 +511,138 @@ } } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject4').parserTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "ArmisAuditLogs Data Parser with template version 3.3.0", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject4').parserVersion4]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[variables('parserObject4')._parserName4]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for ArmisAuditLogs", + "category": "Microsoft Sentinel Parser", + "functionAlias": "ArmisAuditLogs", + "query": "let ArmisAuditLogs_view = view () {\n ArmisAuditLog_CL\n | extend\n EventVendor=\"ArmisAuditLogs\",\n EventProduct=\"ArmisAuditLogs\",\n Action = column_ifexists('action', ''),\n AdditionalInfo = column_ifexists('additionalInfo', ''),\n EventTime = column_ifexists('eventTime', ''),\n Id = column_ifexists('id', ''),\n TimeUtc = column_ifexists('timeUtc', ''),\n Trigger = column_ifexists('trigger', ''),\n User = column_ifexists('user', ''),\n UserIp = column_ifexists('userIp', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Action,\n AdditionalInfo,\n EventTime,\n Id,\n TimeUtc,\n Trigger,\n User,\n UserIp\n};\nArmisAuditLogs_view\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", + "dependsOn": [ + "[variables('parserObject4')._parserId4]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ArmisAuditLogs')]", + "contentId": "[variables('parserObject4').parserContentId4]", + "kind": "Parser", + "version": "[variables('parserObject4').parserVersion4]", + "source": { + "name": "Armis", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Armis", + "email": "[variables('_email')]" + }, + "support": { + "name": "Armis Corporation", + "email": "support@armis.com", + "tier": "Partner", + "link": "https://support.armis.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject4').parserContentId4]", + "contentKind": "Parser", + "displayName": "Parser for ArmisAuditLogs", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject4').parserContentId4,'-', '1.0.0')))]", + "version": "[variables('parserObject4').parserVersion4]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject4')._parserName4]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for ArmisAuditLogs", + "category": "Microsoft Sentinel Parser", + "functionAlias": "ArmisAuditLogs", + "query": "let ArmisAuditLogs_view = view () {\n ArmisAuditLog_CL\n | extend\n EventVendor=\"ArmisAuditLogs\",\n EventProduct=\"ArmisAuditLogs\",\n Action = column_ifexists('action', ''),\n AdditionalInfo = column_ifexists('additionalInfo', ''),\n EventTime = column_ifexists('eventTime', ''),\n Id = column_ifexists('id', ''),\n TimeUtc = column_ifexists('timeUtc', ''),\n Trigger = column_ifexists('trigger', ''),\n User = column_ifexists('user', ''),\n UserIp = column_ifexists('userIp', '')\n | project\n TimeGenerated,\n EventVendor,\n EventProduct,\n Action,\n AdditionalInfo,\n EventTime,\n Id,\n TimeUtc,\n Trigger,\n User,\n UserIp\n};\nArmisAuditLogs_view\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject4')._parserId4,'/'))))]", + "dependsOn": [ + "[variables('parserObject4')._parserId4]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'ArmisAuditLogs')]", + "contentId": "[variables('parserObject4').parserContentId4]", + "kind": "Parser", + "version": "[variables('parserObject4').parserVersion4]", + "source": { + "kind": "Solution", + "name": "Armis", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Armis", + "email": "[variables('_email')]" + }, + "support": { + "name": "Armis Corporation", + "email": "support@armis.com", + "tier": "Partner", + "link": "https://support.armis.com/" + } + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -2481,7 +2620,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "Armis", "publisherDisplayName": "Armis Corporation", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Armis Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.

\n

Data Connectors: 3, Parsers: 3, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The Armis Solution gives the capability to ingest Armis Devices, Alerts and device Activities into Microsoft Sentinel through the Armis REST API.

\n

Data Connectors: 3, Parsers: 4, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -2521,6 +2660,11 @@ "contentId": "[variables('parserObject3').parserContentId3]", "version": "[variables('parserObject3').parserVersion3]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject4').parserContentId4]", + "version": "[variables('parserObject4').parserVersion4]" + }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", diff --git a/Solutions/Armis/Parsers/ArmisAuditLogs.yaml b/Solutions/Armis/Parsers/ArmisAuditLogs.yaml new file mode 100644 index 00000000000..36ab34c0451 --- /dev/null +++ b/Solutions/Armis/Parsers/ArmisAuditLogs.yaml @@ -0,0 +1,36 @@ +id: f9ed5836-f370-4656-a996-3df1f91d9b0f +Function: + Title: Parser for ArmisAuditLogs + Version: '1.0.0' + LastUpdated: '2026-10-29' +Category: Microsoft Sentinel Parser +FunctionName: ArmisAuditLogs +FunctionAlias: ArmisAuditLogs +FunctionQuery: | + let ArmisAuditLogs_view = view () { + ArmisAuditLog_CL + | extend + EventVendor="ArmisAuditLogs", + EventProduct="ArmisAuditLogs", + Action = column_ifexists('action', ''), + AdditionalInfo = column_ifexists('additionalInfo', ''), + EventTime = column_ifexists('eventTime', ''), + Id = column_ifexists('id', ''), + TimeUtc = column_ifexists('timeUtc', ''), + Trigger = column_ifexists('trigger', ''), + User = column_ifexists('user', ''), + UserIp = column_ifexists('userIp', '') + | project + TimeGenerated, + EventVendor, + EventProduct, + Action, + AdditionalInfo, + EventTime, + Id, + TimeUtc, + Trigger, + User, + UserIp + }; + ArmisAuditLogs_view