From e992ccadc8200789b6b102851e3c43701be0280f Mon Sep 17 00:00:00 2001 From: Devendra Chavda Date: Fri, 23 Oct 2026 12:53:10 +0530 Subject: [PATCH 1/3] Added Mimecast Human Risk Data Connector (CCF) with Parsers and Workbook. --- ...MimecastHumanRisk_ConnectorDefinition.json | 254 + .../MimecastHumanRisk_DCR.json | 241 + .../MimecastHumanRisk_PollerConfig.json | 203 + .../MimecastHumanRisk_Table.json | 275 + .../MimecastHumanRisk_ccf/README.md | 30 + .../Mimecast/Data/Solution_Mimecast.json | 116 +- Solutions/Mimecast/Package/3.1.1.zip | Bin 0 -> 66228 bytes .../Mimecast/Package/createUiDefinition.json | 22 +- Solutions/Mimecast/Package/mainTemplate.json | 4525 ++++++++++++----- .../Mimecast/Package/testParameters.json | 22 + .../Mimecast_HumanRisk_Attacks.yaml | 70 + .../Mimecast_HumanRisk_Behaviors.yaml | 75 + .../Mimecast_HumanRisk_Individuals.yaml | 148 + .../Mimecast_HumanRisk_Organization.yaml | 55 + .../Mimecast_HumanRisk_Workbook.json | 1490 ++++++ Workbooks/WorkbooksMetadata.json | 20 + 16 files changed, 6306 insertions(+), 1240 deletions(-) create mode 100644 Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json create mode 100644 Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json create mode 100644 Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json create mode 100644 Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json create mode 100644 Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md create mode 100644 Solutions/Mimecast/Package/3.1.1.zip create mode 100644 Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml create mode 100644 Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml create mode 100644 Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml create mode 100644 Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml create mode 100644 Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json new file mode 100644 index 00000000000..41da5337285 --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json @@ -0,0 +1,254 @@ +{ + "name": "MimecastHumanRiskCCFDefinition", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MimecastHumanRiskCCF", + "title": "Mimecast Human Risk (via Codeless Connector Framework)", + "publisher": "Mimecast", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Mimecast.svg", + "descriptionMarkdown": "The data connector for [Mimecast Human Risk](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with visibility into the human risk posture of their organization within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view risk trends, understand which behaviors and attacks drive risk, and identify the individuals, departments and locations with the highest human risk. \nThe Mimecast Human Risk data included within the connector are: \n- Organization risk trends \n- Behaviors \n- Attacks \n- Individuals\n", + "graphQueriesTableName": "MimecastHumanRisk_Organization_CL", + "graphQueries": [ + { + "metricName": "Total organization risk records", + "legend": "Organization", + "baseQuery": "MimecastHumanRisk_Organization_CL" + }, + { + "metricName": "Total behavior records", + "legend": "Behaviors", + "baseQuery": "MimecastHumanRisk_Behaviors_CL" + }, + { + "metricName": "Total attack records", + "legend": "Attacks", + "baseQuery": "MimecastHumanRisk_Attacks_CL" + }, + { + "metricName": "Total individual risk records", + "legend": "Individuals", + "baseQuery": "MimecastHumanRisk_Individuals_CL" + } + ], + "sampleQueries": [ + { + "description": "Organization risk score by month (latest snapshot per month)", + "query": "MimecastHumanRisk_Organization_CL\n| summarize arg_max(TimeGenerated, *) by Month\n| project Month, HumanRiskScore, HumanRiskFactor, HumanRiskScoreTrend, AttackScore, AttackFactor\n| sort by Month desc" + }, + { + "description": "Latest behavior scores", + "query": "MimecastHumanRisk_Behaviors_CL\n| summarize arg_max(TimeGenerated, *) by BehaviorType\n| project BehaviorType, Score, Factor, EventCount, Trend, Events" + }, + { + "description": "Latest attack summary by type", + "query": "MimecastHumanRisk_Attacks_CL\n| summarize arg_max(TimeGenerated, *)\n| mv-expand AttackTypes\n| project AttackType = tostring(AttackTypes.type), AttackScore = toint(AttackTypes.attackScore), AttackTotal = toint(AttackTypes.attackTotal), Events = AttackTypes.events" + }, + { + "description": "Highest-risk individuals (latest snapshot)", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize arg_max(TimeGenerated, *) by IndividualId\n| project DisplayName, EmailAddress, Department, Location, HumanRiskScore, HumanRiskFactor, AttackScore\n| top 50 by HumanRiskScore desc" + }, + { + "description": "Human risk score trend per individual", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize Score = max(HumanRiskScore) by IndividualId, bin(TimeGenerated, 1d)\n| render timechart" + } + ], + "dataTypes": [ + { + "name": "MimecastHumanRisk_Organization_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Organization_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Behaviors_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Attacks_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Individuals_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Individuals_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Mimecast API 2.0 application", + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission. Create it in the Mimecast Administration Console under Integrations > API and Platform Integrations." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create a Mimecast API 2.0 application", + "description": "1. Sign in to the Mimecast Administration Console.\n2. Go to **Integrations** > **API and Platform Integrations** and create (or open) an API 2.0 application.\n3. Grant the application the **Human Risk - Read** permission.\n4. Copy the **Client ID** and **Client Secret**.\n5. Identify your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` (UK) or `https://us-api.services.mimecast.com` (US)." + }, + { + "title": "2. Connect", + "description": "Enter the Mimecast API 2.0 credentials and base URL, choose how many months of data to request and how often to poll, then click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Mimecast API Base URL", + "placeholder": "https://api.services.mimecast.com", + "type": "text", + "name": "mimecastBaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Base URL of the Mimecast API 2.0 for your region, including https:// and without a trailing slash (for example https://api.services.mimecast.com, https://us-api.services.mimecast.com or https://uk-api.services.mimecast.com).", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client ID", + "placeholder": "Mimecast API 2.0 Client ID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client Secret", + "placeholder": "Mimecast API 2.0 Client Secret", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. The Client ID and Client Secret of a Mimecast API 2.0 application that has the Human Risk READ permission.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Months of data to request", + "placeholder": "3", + "type": "number", + "name": "monthsBack", + "defaultValue": "3", + "validations": { + "required": true + }, + "toolTip": "Minimum value is 1 (maximum accepted by the Mimecast API is 12)." + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Whole number of months, minimum 1 (the Mimecast API accepts 1 to 12; default 3), sent as monthsBack to the organization, behaviors and attacks endpoints. For behaviors and attacks it counts calendar months from the 1st of the starting month through today (1 = month-to-date). It does not apply to the individuals search.", + "visible": true, + "inline": false + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Polling interval", + "name": "pollingInterval", + "options": [ + { + "key": "60", + "text": "1 hour" + }, + { + "key": "240", + "text": "4 hours" + }, + { + "key": "480", + "text": "8 hours" + }, + { + "key": "720", + "text": "12 hours" + }, + { + "key": "1440", + "text": "24 hours" + }, + { + "key": "2880", + "text": "48 hours" + }, + { + "key": "10080", + "text": "7 days" + } + ], + "placeholder": "Select polling interval (recommended: 12 hours)", + "isMultiSelect": false, + "defaultAllSelected": false, + "required": true, + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Select how often Sentinel queries the Mimecast Human Risk API (12 hours is recommended). Each poll writes a new snapshot, so shorter intervals increase ingestion volume. The Mimecast rate limits are far above what this connector uses.", + "visible": true, + "inline": false + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json new file mode 100644 index 00000000000..8f6f56cd606 --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_DCR.json @@ -0,0 +1,241 @@ +{ + "name": "MimecastHumanRiskDCR", + "apiVersion": "2021-09-01-preview", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-MimecastHumanRisk_Organization_CL": { + "columns": [ + { + "name": "month", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "humanRiskScoreTrend", + "type": "int" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTrend", + "type": "int" + }, + { + "name": "attackTotal", + "type": "int" + }, + { + "name": "riskResponses", + "type": "int" + }, + { + "name": "totalActions", + "type": "int" + }, + { + "name": "notifications", + "type": "int" + }, + { + "name": "outboundActions", + "type": "int" + }, + { + "name": "groupChanges", + "type": "int" + } + ] + }, + "Custom-MimecastHumanRisk_Behaviors_CL": { + "columns": [ + { + "name": "type", + "type": "string" + }, + { + "name": "score", + "type": "int" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "eventCount", + "type": "int" + }, + { + "name": "trend", + "type": "int" + }, + { + "name": "events", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Attacks_CL": { + "columns": [ + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTypes", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Individuals_CL": { + "columns": [ + { + "name": "id", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "emailAddress", + "type": "string" + }, + { + "name": "firstName", + "type": "string" + }, + { + "name": "lastName", + "type": "string" + }, + { + "name": "managerName", + "type": "string" + }, + { + "name": "managerId", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "location", + "type": "string" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "tenureMonths", + "type": "int" + }, + { + "name": "tenureStatus", + "type": "string" + }, + { + "name": "startDateTime", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "behaviors", + "type": "dynamic" + }, + { + "name": "attacks", + "type": "dynamic" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MimecastHumanRisk_Organization_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), Month = month, HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, HumanRiskScoreTrend = humanRiskScoreTrend, AttackScore = attackScore, AttackFactor = attackFactor, AttackTrend = attackTrend, AttackTotal = attackTotal, RiskResponses = riskResponses, TotalActions = totalActions, Notifications = notifications, OutboundActions = outboundActions, GroupChanges = groupChanges", + "outputStream": "Custom-MimecastHumanRisk_Organization_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Behaviors_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), BehaviorType = type, Score = score, Factor = factor, EventCount = eventCount, Trend = trend, Events = events", + "outputStream": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Attacks_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), AttackScore = attackScore, AttackFactor = attackFactor, AttackTypes = attackTypes", + "outputStream": "Custom-MimecastHumanRisk_Attacks_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Individuals_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), IndividualId = id, DisplayName = displayName, EmailAddress = emailAddress, FirstName = firstName, LastName = lastName, ManagerName = managerName, ManagerId = managerId, Department = department, Location = location, JobTitle = jobTitle, TenureMonths = tenureMonths, TenureStatus = tenureStatus, StartDateTime = todatetime(startDateTime), HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, AttackScore = attackScore, AttackFactor = attackFactor, Behaviors = behaviors, Attacks = attacks", + "outputStream": "Custom-MimecastHumanRisk_Individuals_CL" + } + ] + } +} \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json new file mode 100644 index 00000000000..ca6710a4a5c --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_PollerConfig.json @@ -0,0 +1,203 @@ +[ + { + "name": "MimecastHumanRiskOrganizationPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Organization_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Organization_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTotal,riskResponses,totals.totalActions,totals.notifications,totals.outboundActions,totals.groupChanges" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.trends[*]", + "$.totals" + ], + "format": "json" + }, + "isActive": true + } + }, + { + "name": "MimecastHumanRiskBehaviorsPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Behaviors_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/behaviors')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "events" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.behaviors[*]" + ], + "format": "json" + }, + "isActive": true + } + }, + { + "name": "MimecastHumanRiskAttacksPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Attacks_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Attacks_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/attacks')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTypes" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$" + ], + "format": "json" + }, + "isActive": true + } + }, + { + "name": "MimecastHumanRiskIndividualsPoller", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.SecurityInsights/dataConnectors", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Individuals_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Individuals_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/individuals/search?pageSize=1000&fields=firstName,lastName,tenureMonths,tenureStatus,startDateTime,behaviors.eventCount,behaviors.events,attacks.eventCount,attacks.events')]", + "httpMethod": "POST", + "isPostPayloadJson": true, + "queryParametersTemplate": "{}", + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.individuals[*]" + ], + "format": "json" + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.meta.nextPage", + "nextPageParaName": "pageToken", + "pagingInfoPlacement": "QueryString" + }, + "isActive": true + } + } +] \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json new file mode 100644 index 00000000000..539bbf0f73c --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_Table.json @@ -0,0 +1,275 @@ +[ + { + "name": "MimecastHumanRisk_Organization_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Organization_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "Month", + "type": "string", + "description": "Reporting month (YYYY-MM)" + }, + { + "name": "HumanRiskScore", + "type": "int", + "description": "Organization human risk score (0-100)" + }, + { + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor (veryLow..veryHigh)" + }, + { + "name": "HumanRiskScoreTrend", + "type": "int", + "description": "Human risk score change from prior month" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Attack factor (veryLow..veryHigh, notScored)" + }, + { + "name": "AttackTrend", + "type": "int", + "description": "Attack score change from prior month" + }, + { + "name": "AttackTotal", + "type": "int", + "description": "Total attack events for the month" + }, + { + "name": "RiskResponses", + "type": "int", + "description": "Risk response events for the month" + }, + { + "name": "TotalActions", + "type": "int", + "description": "Total risk response actions" + }, + { + "name": "Notifications", + "type": "int", + "description": "Total notifications sent" + }, + { + "name": "OutboundActions", + "type": "int", + "description": "Total outbound actions" + }, + { + "name": "GroupChanges", + "type": "int", + "description": "Total group membership changes" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Behaviors_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "BehaviorType", + "type": "string", + "description": "Behavior type (training, simulatedPhishing, actualPhishing, malware, sensitiveDataHandling)" + }, + { + "name": "Score", + "type": "int", + "description": "Behavior score (0-100)" + }, + { + "name": "Factor", + "type": "string", + "description": "Behavior risk factor" + }, + { + "name": "EventCount", + "type": "int", + "description": "Total events for the behavior in the period" + }, + { + "name": "Trend", + "type": "int", + "description": "Score change from prior period" + }, + { + "name": "Events", + "type": "dynamic", + "description": "Behavior-specific event counts" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Attacks_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Organization attack factor" + }, + { + "name": "AttackTypes", + "type": "dynamic", + "description": "Per attack type (actualPhishing, malware, identity) scores and event counts" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Individuals_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "properties": { + "schema": { + "name": "MimecastHumanRisk_Individuals_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "IndividualId", + "type": "string", + "description": "Unique individual identifier" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "EmailAddress", + "type": "string", + "description": "Email address" + }, + { + "name": "FirstName", + "type": "string", + "description": "First name" + }, + { + "name": "LastName", + "type": "string", + "description": "Last name" + }, + { + "name": "ManagerName", + "type": "string", + "description": "Manager display name" + }, + { + "name": "ManagerId", + "type": "string", + "description": "Manager identifier" + }, + { + "name": "Department", + "type": "string", + "description": "Department" + }, + { + "name": "Location", + "type": "string", + "description": "Location" + }, + { + "name": "JobTitle", + "type": "string", + "description": "Job title" + }, + { + "name": "TenureMonths", + "type": "int", + "description": "Months with the organization" + }, + { + "name": "TenureStatus", + "type": "string", + "description": "newHire or veteran" + }, + { + "name": "StartDateTime", + "type": "datetime", + "description": "Start date with the organization" + }, + { + "name": "HumanRiskScore", + "type": "int", + "description": "Human risk score (0-100)" + }, + { + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Attack factor" + }, + { + "name": "Behaviors", + "type": "dynamic", + "description": "Behavior scores and event counts" + }, + { + "name": "Attacks", + "type": "dynamic", + "description": "Attack scores and event counts" + } + ] + } + } + } +] \ No newline at end of file diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md new file mode 100644 index 00000000000..f7382258fd8 --- /dev/null +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/README.md @@ -0,0 +1,30 @@ +# Mimecast Human Risk (CCF) + +Codeless Connector Framework (CCF) data connector for the [Mimecast Human Risk API](https://developer.services.mimecast.com/docs/human-risk/1/overview). +One Connect deploys four `RestApiPoller` rules that share a single OAuth 2.0 client-credentials configuration. + +| Poller | Endpoint | Table | Events path | +|---|---|---|---| +| Organization | `GET /human-risk/v1/organization` (`monthsBack` = user setting, `fields=attackTotal,riskResponses,totals.*`) | `MimecastHumanRisk_Organization_CL` | `$.trends[*]` and `$.totals` | +| Behaviors | `GET /human-risk/v1/organization/behaviors` (`monthsBack` = user setting, `fields=events`) | `MimecastHumanRisk_Behaviors_CL` | `$.behaviors[*]` | +| Attacks | `GET /human-risk/v1/organization/attacks` (`monthsBack` = user setting, `fields=attackTypes`) | `MimecastHumanRisk_Attacks_CL` | `$` | +| Individuals | `POST /human-risk/v1/individuals/search` (no filter: all individuals, `pageSize=1000`, all optional fields) | `MimecastHumanRisk_Individuals_CL` | `$.individuals[*]` | + +## Prerequisites +- A Mimecast API 2.0 application (Client ID / Client Secret) with the **Human Risk READ** permission. +- Your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` or `https://us-api.services.mimecast.com` (no trailing slash). + +## Configuration (connector page) +- **Mimecast API Base URL**, **Client ID**, **Client Secret**: required. +- **Months of data to request**: whole number 1-12 (default 3). Applied as `monthsBack` to the three organization endpoints. Not used by the individuals search. +- **Polling interval**: dropdown (1, 4, 8, 12, 24, 48 hours, 7 days; default 12 hours). Applied as `queryWindowInMin` to all pollers. + +## Behavior notes +- The API has no event timestamps or time-window parameters. Each poll writes a snapshot and `TimeGenerated` is the ingestion time. Use `arg_max(TimeGenerated, *)` to get the latest snapshot (see the connector sample queries and the workbook). +- The organization response holds the monthly rows under `trends` and one aggregate `totals` object. Both land in `MimecastHumanRisk_Organization_CL`; the totals row has an empty `Month`. +- Individuals are paged with `meta.nextPage` -> `pageToken`. The request body is an empty `{}` (no filters, default sort `humanRiskScore:desc`), so every individual is ingested. Add a `filters` object to `queryParametersTemplate` in `MimecastHumanRisk_PollerConfig.json` to narrow it. +- Rate limits (per tenant): organization endpoints 10 RPS / 120 req/min, individuals search 2 RPS / 30 req/min. Pollers use `rateLimitQPS: 1`. + +## Files +- `Data Connectors/MimecastHumanRisk_ccf/` - connector definition (UI), DCR, tables, pollers. +- Package with `Tools/Create-Azure-Sentinel-Solution/V3/createSolutionV3.ps1`. diff --git a/Solutions/Mimecast/Data/Solution_Mimecast.json b/Solutions/Mimecast/Data/Solution_Mimecast.json index 10a41410a18..c32940ffc44 100644 --- a/Solutions/Mimecast/Data/Solution_Mimecast.json +++ b/Solutions/Mimecast/Data/Solution_Mimecast.json @@ -1,56 +1,62 @@ { - "Name": "Mimecast", - "Author": "Mimecast - dlapi@mimecast.com", - "Logo": "", - "Description": "An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.", - "Analytic Rules": [ - "Analytic Rules/MimecastTTP/Mimecast_TTP_Attachment.yaml", - "Analytic Rules/MimecastTTP/Mimecast_TTP_Impersonation.yaml", - "Analytic Rules/MimecastTTP/Mimecast_TTP_Url.yaml", - "Analytic Rules/MimecastAudit/Mimecast_Audit.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Attachment.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_AV.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Impersonation.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Internal_Mail_Protect.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Spam_Event.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Url_Protect.yaml", - "Analytic Rules/MimecastSEG/MimecastCG_Virus.yaml", - "Analytic Rules/MimecastSEG/MimecastDLP_hold.yaml", - "Analytic Rules/MimecastSEG/MimecastDLP_Notifications.yaml" - ], - "Workbooks": [ - "Workbooks/Mimecast_Audit_Workbook.json", - "Workbooks/Mimecast_Awareness_Training_Workbook.json", - "Workbooks/Mimecast_Cloud_Integrated_Workbook.json", - "Workbooks/Mimecast_SEG_Workbook.json", - "Workbooks/Mimecast_TTP_Workbook.json" - ], - "Playbooks": [ - "Playbooks/Mimecast Data Connector Trigger Sync/azuredeploy.json" - ], - "Parsers": [ - "Parsers/MimecastAT/Mimecast_AT_Performane_Detail.yaml", - "Parsers/MimecastAT/Mimecast_AT_Safe_Score.yaml", - "Parsers/MimecastAT/Mimecast_AT_User_Data.yaml", - "Parsers/MimecastAT/Mimecast_AT_Watchlist.yaml", - "Parsers/MimecastAudit/Mimecast_Audit.yaml", - "Parsers/MimecastCI/Mimecast_Cloud_Integrated.yaml", - "Parsers/MimecastSEG/Mimecast_SEG_CG.yaml", - "Parsers/MimecastSEG/Mimecast_SEG_DLP.yaml", - "Parsers/MimecastTTP/Mimecast_TTP_Attachment.yaml", - "Parsers/MimecastTTP/Mimecast_TTP_Impersonation.yaml", - "Parsers/MimecastTTP/Mimecast_TTP_Url.yaml" - ], - "Data Connectors": [ - "Data Connectors/MimecastAT/Mimecast_AT_FunctionApp.json", - "Data Connectors/MimecastAudit/Mimecast_Audit_FunctionApp.json", - "Data Connectors/MimecastCloudIntegrated/Mimecast_Cloud_Integrated_FunctionApp.json", - "Data Connectors/MimecastSEG/Mimecast_SEG_FunctionApp.json", - "Data Connectors/MimecastTTP/Mimecast_TTP_FunctionApp.json" - ], - "BasePath": "C:\\Azure-Sentinel\\Solutions\\Mimecast", - "Version": "3.1.0", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": true, - "Is1PConnector": false -} \ No newline at end of file + "Name": "Mimecast", + "Author": "Mimecast - dlapi@mimecast.com", + "Logo": "", + "Description": "An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.", + "Analytic Rules": [ + "Analytic Rules/MimecastTTP/Mimecast_TTP_Attachment.yaml", + "Analytic Rules/MimecastTTP/Mimecast_TTP_Impersonation.yaml", + "Analytic Rules/MimecastTTP/Mimecast_TTP_Url.yaml", + "Analytic Rules/MimecastAudit/Mimecast_Audit.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Attachment.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_AV.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Impersonation.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Internal_Mail_Protect.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Spam_Event.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Url_Protect.yaml", + "Analytic Rules/MimecastSEG/MimecastCG_Virus.yaml", + "Analytic Rules/MimecastSEG/MimecastDLP_hold.yaml", + "Analytic Rules/MimecastSEG/MimecastDLP_Notifications.yaml" + ], + "Workbooks": [ + "Workbooks/Mimecast_Audit_Workbook.json", + "Workbooks/Mimecast_Awareness_Training_Workbook.json", + "Workbooks/Mimecast_Cloud_Integrated_Workbook.json", + "Workbooks/Mimecast_SEG_Workbook.json", + "Workbooks/Mimecast_TTP_Workbook.json", + "Workbooks/Mimecast_HumanRisk_Workbook.json" + ], + "Playbooks": [ + "Playbooks/Mimecast Data Connector Trigger Sync/azuredeploy.json" + ], + "Parsers": [ + "Parsers/MimecastAT/Mimecast_AT_Performane_Detail.yaml", + "Parsers/MimecastAT/Mimecast_AT_Safe_Score.yaml", + "Parsers/MimecastAT/Mimecast_AT_User_Data.yaml", + "Parsers/MimecastAT/Mimecast_AT_Watchlist.yaml", + "Parsers/MimecastAudit/Mimecast_Audit.yaml", + "Parsers/MimecastCI/Mimecast_Cloud_Integrated.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml", + "Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml", + "Parsers/MimecastSEG/Mimecast_SEG_CG.yaml", + "Parsers/MimecastSEG/Mimecast_SEG_DLP.yaml", + "Parsers/MimecastTTP/Mimecast_TTP_Attachment.yaml", + "Parsers/MimecastTTP/Mimecast_TTP_Impersonation.yaml", + "Parsers/MimecastTTP/Mimecast_TTP_Url.yaml" + ], + "Data Connectors": [ + "Data Connectors/MimecastAT/Mimecast_AT_FunctionApp.json", + "Data Connectors/MimecastAudit/Mimecast_Audit_FunctionApp.json", + "Data Connectors/MimecastCloudIntegrated/Mimecast_Cloud_Integrated_FunctionApp.json", + "Data Connectors/MimecastSEG/Mimecast_SEG_FunctionApp.json", + "Data Connectors/MimecastTTP/Mimecast_TTP_FunctionApp.json", + "Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json" + ], + "BasePath": "C:\\Azure-Sentinel\\Solutions\\Mimecast", + "Version": "3.1.1", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/Mimecast/Package/3.1.1.zip b/Solutions/Mimecast/Package/3.1.1.zip new file mode 100644 index 0000000000000000000000000000000000000000..2fdef70727d209c65f75b5479f47c0c808de324d GIT binary patch literal 66228 zcmY&Q;C4c_tc zE&Ro477`K}=Bs1;p|))o)$fZ*lTLnqACSH8>DeSrLh;6t+isrh8grSSoH)hb+SpkQJF>vTFXP5K{HFBJ1r=jm^B7Stxw&Wy^VSR4PS|9FLwPUBO(cW~ z(T618o4i66?IQEBY4v5FpO#fJzp$}$W+N|C!*5H0knq-TUrU}Hn7%yE1R{KJHus;W z%I;L^>b}Zot?KIg0tCzuSmI^QL1D6n zVfK!6%OXJRWR$bhGn({F-ig!6iXu1vk#sR+KEUXNW9Qi>?5JR*` z59feV)ryhZHPzK$&9`((Nk7yqgemO)8vK3svj{xD?I&aHQvdKOTY9gWlw)JXAp=^> z!M;)LFA<#ulyz!|m5~k$vtv^U4<2|S2z8XZnb~vNZ{62t;Ft1$o2Ew}1D&udZOKf} zkPI==rq(3%E1fSB`E<)$28CCm=BIr1Yk+shE;O}GVGmxsKxa-h>%I{s(~}lHG5bI+ zo|T>QV)^FC?Vbg(yfpS6G*2ePfns;wQ8&8j%puMv8=-dP$^34kiIkzpU5=m@nv{^P z_q>nCo+N#@t4w?lc<){3fA3>P*DDiSPnAYPRNcY2{+amsEgoVdr|U9u>yQ$v01Bts9(N8485Mw`mACK8sSG`X_1o@67`?+d_QQb zNY|UPJ~MqveoD7Vj&5AOxzB4eM9g?dfUhS<&@e(Z#N6n(g9p=4Q|5 zc$WfjRYjp(-&~~HQAXB0r(Ht;{ad>lqQQVKOd7x<&gu9DK%L$%tA${W3XU>KrUQWx z)R|CFghU$6(5eDy#Co`p;W601hl>okpnOa6$AMaPOwAInI=KR{s>u_5sT)|cmyPEa zlOoQUM5b4mLg;IGra zd3C&WndK3a@KKsdeeI&!$h>`m73hwyn6frSn#^qy;gaGBZ^Zah@JLX5flk<=msvA( zFIAdv0Ep*wS=L@p4u#%&LbRY@~W56ziETomL^TdPK>rebGNN zR?tJYe~kc2%;zGR4f7B+Qyiuafg>kv@x-wYn8;@m7FUAQ$dazqt4E5E;#8O2W{Jb@)p^dJaW5+lp2V&LX)T=vcs~J~RiUruov?-^t?0j{knqm&y+5`Eq!5i9YTWTzb*q`cp3%@~Ihnalo|l76XZQ z#7b`0s=%Q%WL2S~R~1#=(^_iW9^~x)4OE^put^sUHIeZuU^)YQJk%tU88Jo}k!FoQ z64j|!W1fH(Dp|3@X!VTZMY>?=*SN$felPlJK(ok3t(tnTmA5|&ay#WvF7sm>wLzw4 zF(bmRl%QSQc{Gw8zB|)oM>^BLD*X_)m0pq5T>(T{up)3DGzlHp(qmrl zJU1g*WSGT{=KoluAPG=gJX~*zf{hm9=pAjeuFyjj8^Y+*01*{CSBi5fI@IQuI&}~v ziyrFat!TV%Uy~>~s9{G3bZJyFD&gXVv!I8MV{WpTiXQ6b&1c9R)n zRoD!d3fQ|RI1qF$;K#VQ629GqZY4mQW7{@p&YhQgMn-3WmqbkdsLBbQB{lyS|?$) z=)F`w0bByGz)H7^VcS{%J@s|8d+fI_@DyB1o2&!06n{&z3;wvU)U`Kgc9`Fs!~JXk zu6-nqhTg8X5kQ&YuN|Q2te}mbU_=Y`1v6wgi*=BNhJ^cR!bbeVNXSEo4%cP0@DEpn zA~xw_Sv$qjYAV2U803vpG6o~)ku43jb&4fPl z_m>%gNK;A6=^^!aRjd#%MC!(Y&7_jcIzD*R9gkD#2#X6+wDUx=GnruSa|C0z6sql> zZs5{M;ic3*&9PTFa7~9)v{hY72RGYKdp}mDq(R$? z>VjF^PIA;#eXw)eqapd*<_H_RNymj%IduTUJ8lRVlL-hJy9ZH^x5!I&4rsabZHcrq z|4p07#(&G$)&VVvb`s5OX2n{*k)v{|kmH!HyM7OdxK-J$(tCqRzSh^ZOrgBMIa}Oh zLztyL0WAOTlgnuxY{i?%AUeCWO&Hjs_L6YXv}bYu|Rk9MDzc7NORLhPOKFe@YNUANJkaX;G;-%H+4xF5k&%?I`^(RZ(p z0G$pN{r0$9y5&5Km#EDlf5>E7PcxTHul#4#P9zI-m7jKr%jGTijQxV>|ej-EZzp?0@{cr zZO3j_JZ|Run8Y^gS)RXCa_)pk32h}3u#%jI>6xFzH$FQX9l!Rz1GHWDsCg3I(xxs} zIU)d9uyvjDXSUA2-~7Me0L{P0*hVb=&8>NCZ~^7NFHcE7j!gb=IQfu{0myHwQ^MpS z+=ezk7M0~M$t5)`%gV^IHm{(so#Kh*u)xj_w>_6%3RZEDFsqPp$X_u$yNs$c%9o>%pMb=|fN_*$ZXWotZBEyk z2JLVV7)%Cd9)5%6`-r>eL&|6UkWg`_qa`i6zz6&D@&HQ#sgwhC-+hf)h`DHoww$YD zn4pIn+IeF9ndT5?E_d8bX2x6S@b5QM%yaZP+?jZ|xp$g9BZej~{{0WIvl&cTmbqI1 zQ(neweFkU%;DpHO1or(XAAEj0B9H;(2n759zb?~ciZ>%SQ*6odws~JcN$_*bu&W{` zz1aYF@E|m!@CYo7DhN@CZ>@GUuSfFv{wOggz5aGalNi90;A9U~X2t>er*aanmre+9 z1f7w;UZuYI*sub$&<$%pCF~7PF5ZkfqkjF0-)PYgifw)g)OVcOcXo%sqJVq@D*oYM zwXwv|UdF`0ztuZoWhZ4bo0p@b`lq$L^+#FB1JErMa;Sg?hhu1J6l3= z_QaKu_F#>nL~f=>^TGe%V)|zgM7eQm$6)OM{n>qI+=|uxx(OO=#_sRI+YM|gS#uq$B0;irVOl0v>u^oUMwXd_LcV~t8Gp|QyaiLRv_6|@{cQZ-9# z*v$c%STksFt56#`cby5WYD_4lxJI3Mw>eD@j#+u{BuB3WfvY4SzQ1E zdAUixFJz_V7qs~((Wa{tPoUdb?Z1x80xNoJ6;c3isD0k=qkRs?t<}nWhA}88Ej4g` zEZH{pH7wcIO^QU<5`jdrwew#$7J(u}%a_Lw*soEqTlZp26?~#f2zW@6>+Iqc_=$cAEB{Xbi zo^4p9IoKt3^_LIahslUu!gbay3X)x&y0K?WCORO3NVTzNXcrv* znWQ+}HMh-;gQm4a6w0|RqCPAp_MWz#y|TPcVG6P-JJVHG2h(_F1fvzUYStD*hCK@E z0^-;G2Y~RiK}Q|;Trnw5au?6C6>LO7^@-4B979Y0{BH;E z@Kqrp3pdw7hc_o-ZJ)L}h(A(L7p<#qy-5<`5$@e8s@4)w5YMWixCaWU@xm%bMz(F| zu5#Ww3#zV_5U9&%#)9?Vc>#9tvfc9uNOw@aP9lgTf+HKw>j>IH7{Xh>)tb426C|eC zki?LeAYM8oMqZwi^Y|e^{u1Js0mXMfo_*KjZN}x{79ws}o(`HUV`@UKT`&u-NMB*X z6NfEO-UUEyB8>52WNX{O>glT|5}o~1$_I%$?xsP}ko*(3RZ?hF!>$N{0=vNAbpJ&x zPzJljbD99%W0c$vy7Ch>zz}m%%z)8&{s)c+o*VP(1a7V1w!-GXt@(^eT$D@BN_v5+ z>TJ@L6|XzY{CQ>F7yY{9p0bcO)^!IvCk5IXQ% zo-5`-Joc{#7~!uz?%xB|)KIKHtPxS+zW8!Ux8#d^$6Jqk(EeeG1USpRUeT`E8+W1x zwBt>YHl)KTG$Dxk1}&iwqh6Df&D;$z1JlBr-zf*C^B@73Eq`3nH{7>qhIsm?yGE&^ zFqAzFO}h-ujnfsIf?$|SAQ_t{{9&`n6XXvgLrd6L<`ljCVEvEyAuauLVtM8Vd&M_Y z4hH`Sld}745!ju1AfI8JA%V^{d>3V>3C@x$#m`e^E$~0@Gc(;HJViO=Kvn`q6pGew zz!{oduW*`Evx6))EoU6$vYk|<<4Nu_`Q|jObI7sLVy-t$Bu?Yv6mSnd#|3F=VHcx8 zvi%{lu*sAVvW}b+s|2u#<5RkGC&?d|5Tcex>U|#@1TPIDYKm40!oXw{G~XnHh_OcW zn1h-FJ|_;$5r^xD!g+c)x`W5SFxq?ohU7iNE(ZSx88Fu>i$K^SN+CoqfLIiZ;)N&K zWJ01iXRT-#L`cnPM-IOT>H}FE1~~*F8LbO3o58n{qjR)7V`- z7Xw1gxc}r5Y%f$5sUTYmupGzdR60(a-Vg_)#1m7$%FLHP$MQ`1R(j4Z^Buu`)T z;CfCDv}A&mpuNAjZJ1T1#wR|0QjDgGiG^gSo;K1l$dpit!dOuD%}uDU9beCqi5BY; z|MM<&mA!$!7tyL51%AAAHzk`T#4O)Ve@IA*+l27c$E)0-$=u89>Tq{=HxAe;3b|}@ z%z&6|0SH49;*YkA65&X&L}6HclFLLUajHZSneu{ChC~gS^3i)uqU)te9J@FV_l) zk1Pc9<-p&N6$(^4M;~7wCsa|sB9CEWsXwy!djMIjoG|K$qfJF8W0;7!@(Z$D?BM=C zFmZvd3?7e;O%Q}9U9N;pj#Ok=0TSUHnKZ8)}#{sEDr^CN7x9v0V4G8 zosA?-szH}&BLn+fsSY{~jNA*sW8p(OCGR-AW*J$6kLg-` zyx{e*GTRd-7hl!mn~BvR$ut8?=cy7z9k$6P7b|!S&1cCe_V-F9ayl?{H6%FM?jk5w z8ME{5PDfE`vojCvoMGO^X0)l8+dh%XQY|`n!Ctt zZQbnr678Q(HCAdYdil&`lbDTpg`~*O2wo8jU$(%`?C1uE zq4l7r)bZK@)79CMuyT+*f%R<{5uU8Slj0I8y&WE&eQydrmjb(<)Cv=2(HOasF~udTlwYp0psfVOYxeRE>dYvG(+O7DR*%%w^i)!OFJLwn&D$@RBUPrIfu4GmSMCZpDxP7$Lvp;m_H)jrd%qNest=kNe2 z-@h0oZ+D+RhzZaLKHfmze}#`^Anzt3%ODzk;^&^1i{EYa-Evw88bQWEs-r9Y#fB1)GSL1@>;cYk3qKiqybYEHWE?PsUP5I-KtJud|hXAYQR^G_M% z*F}nlT{46xpI9-X7x&sa!6C-I@s3DV{>`z5F+*sA{ z0EpoTR)_P&U2gA@kc}bS;`Oz}p?l6!OHvO+v~t)BZAc96%hBa6Z2l>+bR3KMpjYI8 z0zdOR4K=(&&?$Lw&ef$V--a=w4CW40%q{R6Zn|6H5r5D8;t zNk|^%3hf)^!Nlw&1$@<9safWF))7Qq{=^a`RnuZ1I{80$cwH6FZ=`QYj?CAo9{-wh9HCfv)0V`R)P=@0LJ_v z^8JOW#U>^S0dH4vOvvouiZF)tA>M}z0;N`eqhCTqha1iORnA10{o1pB*%Uc2 zNE#KG8f(whoTYev%h42PGlQK4><7T8N zrA3w8M~Bm)26Ah9lttTUWgUc4nXn}`4%x_N$Y#EdAAdWDs1>m|$Lt8?7}%IKj|&AP zW;>8w-akJkOibkIYw`i0_{TO*9G(o2u3)=XGe*!Qas!drfi7o-AmJ?{y1X0IpB-7! z0l>1zrRz8f3XqH{@{`4HMEOACTyLVs>53xtKtQCOTXZJ)`eQ6ApO)KuEDh2}*_yL3 zmI7lD_;IUc_b@hQIX_^R<5Bq{^l6l$pcSphLQVnT{$5#RpJcC{(T^4mb&MdvF>Sr43%cTIAnW@v;u@&^rxC+8)>}U1pW7HhhJP|K$C$i;%s+v zPsEl7Gia=q)V{x?=@OJ$IHdp6Vc^3^+TU2FFJ=+@3>5Bxq}zJZJwls=!+>pmTwf#j zJ~vFXpv7-3>i5y=DfZ2Dxn$|$(F#uXo)0NgY(?Ttl_lenWFUVDff|QBmFdt3!|L$z z2ZW3VD!c;j5|IGsr1tS>l&j{NHQ(Po|F5WE*7&iem0vp$>^SD+UKErS%-WAHj?^VPN(< z*fW4w5TADdF0wu~`qlgX)_RjDz$XOzEdYT{mtI1r;E>y0+uBvbn|~mOVmI7fJXot@ z*PHOo_Sf*N4SP-zh>)XXlQKg_fw{b{4`Gv`JUycu7Fz?+nEqL5Jc42R%ZsT|w^+(8@mVOv(K}I=K`yYBKDMjsP}s+u{1`c<({8XTU<{8qDy3gk4Y4NdCf}q$=GY z4;Tsnu7doyBmK$=?#I|Ae@n`ccrL`VOXS)omLEI>g3o@Kb1EQQQ zCwVacVOA-(M7uLJ|2&x{C~71!6VrG%%)W`D;Onig>pUC~9wNeU(Y7h`b@CPdPG=~~ z!ULUpCS`-vo&&$hWzS*t-8p8j+) z<0QsLEUuIK5N0cv`f%cq^j&Ceq*mSyde+ll@Sqp)w7B$cpWN`MdIhDQgt0d1uC01a ze)ch|dKCp7dsz8Q5Q_zcd2MJG2{xL*zL^}*@n7OW8T9sy+3(TCyivDo>wPPpV52AG z)yq6)UAx^>3jfC&;KuD?`HAF^H_hZ%lyNoW2n5Jh{FH~hu()Hp8Nv}W5!&W2G|U|P zTf@%KBYLk$ikG!Vo~cKH5+7Lq6QW$Ai#ry|=Z?ErOQfgxy62nSb1lH!D#X~~iD%Ak z>5?``vo6DYSCvt+xsUeBXQaNGafcZx;i^SjZl-&wz)OxQ#_#TLI826+bF-RnezJd4 zGdHg0CZKW8>4SMI(a&Jo8`b&uPU!0+v+ZfOQsx7a$}%9xrwS(&+^Aw)513y1wJZnJ zhBOxxh&lZ=1%)fMPHbV`UUim#H4bQUVV)z(Ra9YK8Gz=FVqKi7381ULwWy-z#luZN z1A{sNH~g^fT>2s1naWK-awoKp@3!HOMS>CVVUkOoZ9t4lPHC!dpWzQ5#(@mK$Rf}j zB+Z?*JB{mtr4C@P-Oy94B6%9U!S`-T`0oT}$4(Hg@WGC%;`*x1rG9L5_xcKzw);n< zYRf}~fHf+$oT!Ki5FZY*z1DCq6L%&9plb>XAoQHx28fQ_p?)l6+g@~}f3-|sGGrSQ z;B6FS+rLidLcYC{%Jwv%1`%)_%l4QU)(EKKMU1y{j~;DS%k)&Ty{iQq6fcdMbIUn{ zTYXUN#Mr_a(Q32F?D7#NVul5Nc=Y_0^J*=2E0J$erW<=ZOkI- zKxdP<9n3&yMZgBOz$Y%Mwh1)UfU}fV#nj+-pnG=;wu>Dc?7y`QinUu}vQnmkpNP9s zc$n(lHxkDzs15!O2izLkf90u;7bkr|TP#PgXpG%uLoE0pZPtoRHiV$b7$7GvO)eVL zC}pUeo@~<#BhxeO>JT1*k1)z4N)lBwiZ-?6(2%;7(<@)cXu5!w3Koj3C_S|>YqIzL z=Ul^t73t)LF;wezjA2~+7&W3gJ+)M#!pfY=s#97^pl)i19CEpn5MuSucwyH}ZcD5f zwb8i|8yip${xxZP-n)!o~1%w99W=*G*q9d(7 zs2SCbN`QmT%?-_+h*K=PT6iZ~9Il}#$|vgMe;zZ83e_zHZC@&IuxqEJyx56H_0#RG z*a{k8px37UsO?NJ;n$peYB=)bcX-C!-F%=g8gTqsTpB@T|B$*o3NN?>FiKzgpw)|j<*}2(98We=qpD& z8rTo1!a(;`&zYzunGk-;|HM#FI_fB?q#SR{q{O$=8_2pNx0tXR_G$LD(F}Q6JUXsp z4|%{$1=~5m*qi*Rk(o*kcQ=!n8V(-Yh?+{sd?m0y4RY3IsAWp+P62q1(f^p6?&M(a_)I#R0MKW|^zmc$(7T>j{rI<{X!_cOMp)IfUsk&t{U0v1Q!MvoP?^!<{2CE!yr}aw)>-GR3Yk%AR$P6(U7iCX zmD(-mt%N(ZtSz|Je=pKcPhdFCD^RPzZ{_@Th+YN$6Ki6}TzwCK4hwj!IUx9_Nfkdbuq*=wi1`nY0zkwScOnjkP%#a$u7VTrfyK zZ)nVni3_435D>lnsM0C@Pcl5Tp)um5g>}Q1crbt)*k=8zRKbptvE%sL z-(G}iooaa@G!q##vu@y46RO5ZJw1T+s!7+w9VV%0CLnJ%{VX_Re*4qY_%#Y0lBwDo zXiCG28fYGE%4jCvRGt=5K1%yB zBe$5U^d@9Oje4PFe$`DE-+FNU7XymCQR)UHp_*|3UUG8AkwZypWz2fUO2Gdw_{Q@S zXu|>V>nH(cBqx_e&$KdHogR!_6sSmJ33~EPFC)#4?o zWRF(QCIBc5wrN=9+^G*eTzZXHyW}{^ZbIx3-TBhr&{P zG1I#{R3;gSf(2TS=NwT3`RPp1ENJYO4Tm6;WlI|w#C8y@g$$Q|x!0t>=^yaX#lkdjwjRIaJ>lD(x4$e9myIQ;K9V%}G`=CAR8BtK-es_PW>NX*b;oOz{Q_(uxY1AO zmi)hAmFb882zD4FC-HKO&fSnOXLx04ZeQyLd?*jW_>|4-<`^g!Svl3HKX>U_-qx_n z=7j`#ouFp^lja_5m;|?G3)wH3oM=Cp8#X*kTO592gEGb%$mWUVdiML8fPBwBBZ^N0u%=5m`jcaU ziw+lqq9n*|i^n~A{`URP!F-bK(KDMZUAVt;uSp1wj@V)xELjF=d)gT*hfWM)c#wFb zYY6uOMKi2?-bVI!iW1s&bi#S=5KfiHQFsoddrRrwlh}ZXapnCCgxVqq2@B#d!+v}o zMX3UaVbEv9_R<-o8W>N7;U%TA2M)@!xLRx;B-+$i-oo4fEsaDN%=qrHIDltqu{l=6 zh*i5@SH7jVk`Hy-t0kpMXlFsYLj;mv^g!t4?QNmP`aDL~yoKWU?z1U`Ll;>tfUZrE z#<@D1OnO1sB3i~n_psUxj6eS1wBka4PP@?C%({o>ydHqQ9fWeUBn;}+FP=Cj7pKgke6 zz4FsA=YeOJkkZ={QnpIRJ%IdRhQ7_hH-pgDMlG1%A@jdWye$e#-SP7*MIf2DXBazX zDw&8zXBLWi`-UmzK_};rAEDOfm7(ZdQ(bJ~{B?N=;R>cY<`Okc;xcC&4y9f3u1`@% zJTHNN+W84nm=89oKJ|F`P)0mGX`VjWQ81fP_049XV!=^K>Ts8`xrQwsfn~cSkv07( zk9qn#|EH5Oe>k{S^!g;jg3;t>pG2}~t(hB(5ZTM+j((|%EqmkZ<3ZjmN#hZMZKao` zd1pEdj4Nv$199?R6hJ>Yp0fExR>|J(FG!a-nDPvf>rrH2W#)&v*bDRNxI?dKRQw-e zO7w9}&{vzG^UnB;HozVOi1=H~Uuugw8@eg={VQYE{U-1MBgEz?o=F*`x>KLd7P2M! zFk!qp;`xU22MmvvK3ehbICawvNX$puqSy2`;-HzEpiqD2E3aMFd3(~D#q38D`tv`! zGmBZR%AQxoXjuRxGnPQ5<1sB(dlQ0B82$YjJRB(tG&bD?l_fjevtgXyvxQeCOM}wh zO+gcP{zCAXFywJ9Pivj)Bq*EcHP;@JBDkv}N2e4pgkTGOv`k@9ICz$TvzX)7mHYg@ z_YyR?rutN3I#h#n7S8bJ*ZJk4UPmDH5~xTUA-dtasXgXLpGdAJdmS#~HHmPdAOGBu zOrWJ0oT=v2sDGb~xu~7GSd|P_i({MLzQA3JXq~P1%W`t{+)yn1$a;yS=-tfD7If&} zrot49Ll=btQ#$V;+=w8P&3y#`uZ_2IGfvQO)a1av?gruc{eFLHf8S==?RM(q!2=k9 zcINJWq6m4 zN&8!4weLdjw;*G^&9DY>PpHAyp-y#!>+%NzU&lx4);yW~z;|P-40y2PG(H)?zF9`p zpkl@01>Z}7H*vG%^6&{_LC-?_FGx`SZG_+bi6k*$yoQR2w~++~7B4MAD0_0|93J6> zk*#cLqCr9Bjn(5J0pz|C;vwjeEA(FsWKmA^2(H$S+*?x#G71FngNsuYk7#X#wvET>wHchJ?RYH^cCA zM?pO$9}meckqr(cFxQFZ&=eZ*?B401^*gNVEG2e}1P(nlbSNnUne8h6Q3SLu-Y%IV<4PPwmj`^$~{ z7wh)%W`hG)3XGTpvP)C9phwROyzv|T^S0|LheEcjOHXFx#U3RazHucs zm+tB{&hHO0%`0rR5#M&5Lf<}F*~VY#eQ|DYrEU@iq=zn9NUR_kNoR3}KCg7Bb~o$2 zYhN-*ZklS}^hVveRuQvZ0%?MG1ev_mH7BYNg3iIw#TMDn( zS#7S%qVTkzSN`OorF~vTX8A8I#s$CkN)Pd&;8h57Yfx^SkJE~Q+q-ak$r-dcgeK5!VsAiEb{xV#CnXuPaKbND1W}84Nq+VA zcFzV6__dtfnysMnxyxVSdGNuMg+)baOcrq6#%;ySZ68;E9`LowJ2!2rS;6FLgWCpF zFZmA_5J<{`CfMKvwILHZr?vUbK|rMr8(=CfEI8CPp^`sM8^GpiV>nom3S^WE*rmLz z`&*eFDad|(&%m>eV&c#2&xgroT5FbUp=1hu!Q9@I`&)p&eKqd?BF^@}xW=E9{Teb% zbZ0iO@RbOVT=cIUc+0GWYxfp;sT{5a;IPeh!n3!hC*?z*MS;5?So= z3cZF*tDrS10qN#ZJOJ5%lTRDp(0aw>v@g6Lwf=NNA#8;#$0>{g=!{D&zTPuZ$a`3` zyomtONCH)PE0dYV;0qi=rURc%t5YO&ipgCg)n-Rn09SgfH+ia1kPoJb@bZDJ6BAY5 zqZP~|T=6NJCk5GvO5(wVuH9j~IgTUc^hqxm18ImPn^-V_ouJ0+H^RJ!6Ek~ew#1)U zHRO++q&Ap6C01%wXq-fN6}@*S zlxW;A!EUZi+?~D~oiv=1|6MR9!mhN7D#2z-_ish>j7>>Eab|dtJf47o;$HbG&e2f% zwpv?m`s#Cx0x<3{234p4_Ul2kl}iB3v(QQccOSEP3OR*tbnWqmw)xB#lkp*Wzj5CZ zd>})C+%JT%tWC4ijNWvalq5*eWgQ@jIor?VO65gcB*D`(UZaiQ<*5%!e}@H>9JVXA zX9`{!yYCOSF+5gXi4tB@wvi#^a{aO!J6xS_!XmRh@nOE3A0DRkw!isY8G|g9*R||j z!gSf+9Q&aCQ%t0(r`I5NwIx{-`1Rx-K{U4nETUva<_k@2LU)HlO14lL$;?~na&*wu zj_l8l&W*%DgpoW%8Gb5#m}Iiw$UNT%lv)~;l4*L|4hK5U5w2|rIs@vmIWg7Vsuz-# zTJ7Wn4ejddT@$8CapXBY{y8?bf3KdCI+%ZXhZKR4F5A}Hr4yrhSh;O(Srnn~8l&&@ zv|Hen3H+z~i#q!)@14VU8I`~H;gQ{Yo!0B41ia?`N>rG@OlhV zBx^C`(!O^4HpLE>W)n)!ZGl&etiC~NADC<~TPEM^o>k-Llizf%$Mw7v*4rYWRaGdp zjcjw7@`dWa&<@|y5;^m%_ZH>A5_9PF&2Xu1*V;ab%zRI%E$(x&M{7nE&NSoB{i+IhdBK4yz^^Rm!4+l3-oHJ(^_A*ht3 z5;B}O2a5E9ye$IMqL3j(C&}2eI?)(+-Kt$nTuB<%1$D=c1@*U2YoP##^)u`;j=8R- za21F<=@>iJ7;E$5?bB4s!fl$cC_c;w6ibM%$=s5m@-=34i5RFn>6rT6z+d&pz0ijb zIJo)jeUGxbz;Eg745I&BCVX)B6R_JQLZLMo{CRSQ z2Cc@kNh2)jnWlq=685*FklOiw{+#qo80Jni1)8Yz#J`>~R6WZ7>LI4a+% zjQ+NeOSfIes?CPI?$^d^rqR5kU2QW>w?FPY>cl=-#*I-y_ZC?Dz0QP@?g7ExRUY~@ z#&Zg#Gc3CkRXEF7==`~7&-HxAYSamiIcl5=Sg1;?q9Qq&fFuad($+huN_j74A6Cc- zmYTdkZpV+Yr>rTnXAJU{_P|bgV5TYRz6uT{EZF9~qs5^D^(`Nj8>r%^UG8$E*ZRWX zlOU3(uPb=Ip7$u*ul^Vp0(m2_;Arpqr?BM$GSw-o3nL}tS-_7WIl+DjC^?&ZWD^>e zzJH`7IlI(qGeU^_z$FL9k8KhHT9Z+Y)hRi$4{e8?aRB*cgygF25|g%eP^I+3&yi^U zbn4_)G2k4aKh}g+px+ito6br$wQ2iDW=7+MA2;js**e4)ie+rfVYGbO6q^whopsEs zeweDOMw#NjcvP$eVs*o*DiW(MjfoYCIji2XZ1UGI0VE;UnjyP@B=OY$2KzNiI)qA zVl#+nOwJx!UZ3+eiT60f9_#8HhtZE8h^;1UlZ=xs-@6uIqIyDG6kHEWFw~mWuuqE$U=^V24<;(I?1i z$cnEccd1I=c!ReAE4n+EO`?4ziF1;dLIp5e96Hdiw!Bwqc~@Btw!0z2>gFCl^_&zk ztH!W(%yqA6(rG{M_C8`;7SPqEV%knLR1K>VmpY@U8dpm-hOYwpu0S%>aLC`Vx2Ic1 zgHIU7dN0niZkvy~lCUwY3!N?08HC5LG;=#^R|EA2Ij4asNrc}Qwa&DJ!{H%x=$~>t zl&+D@zXuTyTkY<3vM9d$ryq+LUJ7SN>Rz0e-PyQkd}*+xZh8+K0s>j|W_UP5ys@)t zJ%EhfEHwZTpLLGXPK0@@TP=neum!6PLEZW^Ap2^iNn0O$nSyg(d_3~dVlW*G$+51ECBPe0iq4{t#3L} z{M6^$_vCryfGGLdTvYy;90%c=TK5I|&2SGh=Wd$jw_#o8BhCKb>lcTKahF5zlH)U) zPp?8e2_zI`8*i?IRuXuE%?Js3(Tm}^s;NxiDSp>TDnW`-_sSeJv6@2ZX}U{FTM3-x z-;7UjlxK1K9{>3lO#`Gjs`CI2v~B9Cz0y6|2+a`?pCnI6etW`X^ZVlS!(*Zl0%BP$ zHb0=#HD>z+NOr#FOzA7;8qMwjLM&UN<$TLnHV0D*T0en7U0{k}GQSBeF+1|HvOy04 zCz2&wzqFr5rylGNHs`)_C}oAMruVK1P4wRWApMxgD(!dDSF+Gi3)YNZ#8&?2;A7R) zeHdfT@n5kSXDE{@_1$$W&*qhE=?kWguZ}mD{dm9G9|OnWXu`>D`{2vb|2_PA@!nb% z&zdYYlHwP_)@MCOA%z-4eFz&zBCL}f+~4$Y&Pv2Lw5kmd^{=RQ8DEXCD$i>qDBtmF z>-e;PK2JTiV13%MP11O;>XfOj96PCJ5j27#g?H$e=})}N>1}gZMUMI0kXjld%ZdNI(%U9WDic9PN2%EFPI~x zRQV9Fo?jzMkPH`b*>9u6Q59)RE0z62nG(S0!!;D0$y-_PBTQP!?lk(4BAX2@Ga zgBe;J0WevB@Uk}MdEzNhe3n*A_twv1yf6@Suzp|oV=?kT5Ik0nPsBMey=xu>zwaNY zznzHB+;aW|+DYj+zZrq9I|P(9)(UVbZQ@wHj|6@r7})Wk%p+J%b+m9q(cI#^kc4KS z^)ctce)P|=W3LYO2g{^BI2j?2zWcvl(7}l}URiLd#YO93KvVa*aeo}1{Z+K1vJzmA zDvS5G+FF7S5&PbqEwxDo*tU+K&hAhxhYTcMa}m7KU|$-d!1pstz$cB&|t=P(%80b+qP{rwr#7i?WAdJ zV>ZT4*Spu+`0{+1e_$Tt8s|A~TDOM{0j-?a<#mmm*t$I%o~2jg)6qK3YdKe;qud0@ zsT$|_@hiSgqsqkwF8r#0AN~1L?B~QPVWvlg6mFE`+|UJDkI-n*W;JEn!Z{|K$u=}4 zhm-k?K8oTU4d)>+06OCC6w*xQ8gh;bZy+F_Nrws*Fi*he+%pki?=jBBCc=o zz9`b>LR4@IXXRo`3HlI2ORus-Q2Qgj1C*=iYAuF6?Pz=4!;nOs(k&>7rx;OyiHqC- zFbErwNmX|(XO2?55@kBhr5~d!u?3wi5q4n!HbuQ3l61ITZbC?6YAAAhXcNB+H8(lk z|9bqKmzp>782bJMx%f5(O8~Ia|5djjp}{&;M*q?7${0XESk<4%&+(3bn1^*U{{t1f zli<2TfUadtEQPjcM95kRqrXBeo2}d%+a7B|su3!^oqPkUV^}beU%qu^a>XeWB;JK4y7+~Ql$Q+Sf#{wp2i9ICM>{G@W<1y|tp29D z%BS`kF9Xc#7Cn$D9*qOmbkM+=a4<}MqV6$s;XH=BK)7V8Z@b`3=Af=629LPbBO%Dqx8#; z8Gy0~TdlGiSe>W_6{hEpL8VVAx7~%J;i`#Hn+^fg$VimNwP2W&G0^q8ZG1H+0~6l1 zgE*qPi02BujJR!t)|zzG?zH5QVpdD9k*R@lYLJxWUSeUILyiK z1kZuyB*!rFo(Lb1thn8{A0>iFFfZH2FZ`$bR8Yay)UY9RF7z0!ra)+%kAsM4f!zrJ zxXGl~C`!>grP0APMqkn_uiVmp-e zJ_8$vmOIP$4RJnABLg6+t8DZRFVO0YMs+0UjapZrZ0z+oTdb8 ze6WV%8aK;oWhtC#N?%#{Ci=CZ9THDU-_}*cPa|DB4X)cqu ziXCr1$6A}}Ilb8k*+BeXThE7HQ~#Kbm_A9{PGDEJNI}t9>m0EvY$i>G)9!sl`yc;& z{Wy|ro+De^-gL(8=gjgco(K`EeU$nh-@Fn0cR8oL!uQYHeC1{I_l``M-UYijp<5rz zdTZ`t;l8!!{trb?J~yiD1c0o);FIrzVyP{$x51Sp&nh4eaB~r78VO6qfQoUR$$*rt zAx4|e=5_p1ozGv!$V5JV&ZI#We|}SVX?m=??CBegV6t1|ZA;;H;cWX>zvBK;Zx*Sr zh7(HVdbAFu_FTnEsTy}mJqoTi8D2UX^W!t2Kl zFUNq;vJ6(=x60+@()QFJhP^b(DpA?xoNY3^1EFWbhxLfq`HAN}2|;@{X^lTSllhC` z-La^uJ~$UfY8yA!sOTu-cs^OHCG_%ZJ*6!xpFYb72BSUT>b@o9_9Os zGMHz_0bud@#a!OT6n&s=+z&o%)?sj|2SF)5?oaR|`uVgg%U`(zetmQF)+?mKyh7?- z$obRr1e%%cLoPm&R@eOdKVFl)oc;r69XUsDa-G0jyyIAg*8-1aFSy7?o}?q>{0xK) z*CsI@)pLxU0V92VNr>q-s6Si2vY`ysdRXwUydnOqh~3gTVL8I1^#ljfZmCc^w+j-$ z6rB7~pGPAeb9S9&?g?taSh@li^iNKs#<&89;|-Q|wqcDl`kXDv zV)_5&S5uuqIts1DCkaNpX@Oz+vkklN{3IIOdFR+I>~o+4U{?1)>Wkn*K&PcI zGlT8!Y4Ml_bu(lbU{ve0zMyf0vISJ#XH^BQh1{u!C7m4C1tGJ`^GAHLu<`XCY+!ts zcL?#DMuqB@znH^v;;@#FB;orGAXq49S7f%Um57Wt+&+ps@nG`#;lmo~MNd5Ryr%DL z;xXO)R)MHLpj!5WfJZ>N{vtu(*R77T*#S}dReJxTmXS?lQ+T`)aAch3Am4OJA&lae z_!DZJ<_{I+%uWTw*d_UXDUOpaD(0Kj1$6E}fES8LC?GMv>V|$iP$lRkFQ<6(3*NxQ ziE(qG;n;gvq`5EGb4fen$SG8a{TJxs2&RAW9x@<^kLWbSzy8q5kTI33nkXQ5fBZ;O z@PuFH&!kSO3ebs!_@^9`Q=*Q-+{dTzMLi)h`Mu5S%aP9ol7z%kQ{2>Lgpb{d|9)Fk zQ@&KT;`}kcbM~L;Lr&POOL`RfX$WFl5 z*@0jpP-|(2<)UpF^uj`_%pM5?zvX2jzlx~jx6PRrdaJiqGhzD{H z>Hzkzk>9|G^~)yRRBK#vFz>#4g*$0NsOE}UFm{554YMzkIj20WS1QpTCMesb>oyE@ z%hE#Yuv*}kDLSte>^6#Rm1$UBC6YPRD+3N%>ylX!el?#LXd^NsphHNB$1^b$-jWL4L*_fv-$7y34$RW~d8!hr)DsOVe{+^|)h?|QFgw)mUR%qm;% z+Igmc->M#b@qE35k-ZIDe=#%MSY^$-W`%?ytO^~qMF9MnJ8w@-eFjY2!XLoA7ov|n zd~bmf_N5QY+z^sgWye^%%#7mepD@2V z&9jlv8(N5X#754nv_c3EW48E_Sl9+7aoQ%Udir+>(iLAfQaFsrAR*}@fJ7#m5p{BKxTgQ_bfN&4ACQ&7aSQBP z64pqsmFq2m2N-)Yj?Mfm*~7vovV%@7&W1a$-xd*f-b zQG50a?H7g}iPH%6A{v%kh6RpwIng>fn4C+I1p1*ueI~2{Xd5I?!3zn8i38k9L=+pw z8b*Z*jDOei7h}G^oJU!=DuR%w-eb>&pFuSjU`^_vqasB3VT8q?Hr}T9#^>Fd+=*=w zUqlSHCW~xn!!f~~P^=jc`GtLYrI3~lVPi56&9{XOl1!F0ITDT{j=sCOY{Gov17?dt zB=&E)H&QfjE7jmdd|a+~zhwtvPz16N?vdeD^rhmq2UOF}=iW zuFh&AEFNCV9w;bd$owVjIPwkj<`TLVU5YaP4)c1MF8GBmU#7xQ` zKok!U^NIs)nbH3aqYw8ZV;|HF9OKC_%!>U=P4Gm2GRNEDuaien3eu_Jh{-Fg6Cj{( z-drU@W~V~xaD;zDpz}WZCd;fSIUFk?x=zxzl8rrC12;Ng)DWSPy%5f3M0MNW;+Tke z(lv7>J>&`20F+`UK^SH^h7n4{U!;Xgs6;}TKbtc%;_~TEH(BcY4)PAr~yjQ*~vsD!kayS?U(Cw)A;^C2RGQ8 zK#X~S87GfgCF$IO#h6U7_#nU{U1AKYhLS3*sL>u_97bG7f~;Uun=NWN51yORODS^F z_`TJhyW6`o-VGNK9J5~3U*epkf^6h3>VT{gdU}v=HSr(P8p?!CQX$`xWz2J$P~9Ka z@LbmO-?d3hn*PPQX^4k$)J<_0-?@c`lLB)>&+MDQVfLJB4NJg^maS@6E<;_)#n|^L zOsT3(FVof>DKk}OYh7k*e7CmX6wSz3EdjG0ITls2PU`seyqhp2IuBi&T{GyAl};jU%BoQO zX%d6>NZTr)Pq;4)*7m>`Y4s8G`f9ibp|%D+Z9CJ%;`Urp;u_?=(ibw0d>4T5P7GAyS9i1T{99}vFvQ+voR@hvp^$R#GU;YszQR|0#Jl(O$i8)$@Ua_ zv@1;UA5F1DPV1q_39-kpJlU5VUL1y+gCzVnHV1gSRPp`40?dNl2Y=07i+y^_d{XEt zF#i9!w|GDR0TRf~j<7t%IaHfZ0ELFf11B<`Jda$^4E zjakbCD7!>KlZCeeHZjH>?WqsHq_@9Rke0%8l9it?3}maWx}vhtsyeH0hrNb zdayxa2oOlHy&`@FoCl=?K9IC?PwW77AIPp7KgJ=C@O>X+4z>9n$Rcm_Ye=)eu4naN z*p{N@tp)scgxTac6J-hROB5$|aG)n9LcO`QVt)cA*zXiDA3B2?%TzToM2^-s5+q?A znu>azsZW<9Stdi9)1KWA$*AIdl!-_hb1Ei95&yN)6NAa$$m9J9hwWnJYC*=3*D0$H zY9~9QFux2ER!FUz2=X@7ok7>r#KVaOma7JPJYC!MB%L(uQC_X%8?{!D(8H3!YQc7Y zB}$BV7*Iu;9_)r2#*0K)@@z6)pl0BPfFud2ZXO4pLkIZ8Wy9(@_)s88-wq43=VP`l z1kf8QW6;vr#S6_0T~@SfI+js}sDXt*ElQ<|&49SWT-_9)!#jU-#}XToS`nKh*}a$G zVJWr383^Gb`;89;CS6X9u$t^Q=>e>%7p8^40->7ke&ktAHb{&S%w2^RCz(AL-cytS zq$V2duI037d`D(tW$#ct1b6D{!o%r6_11X{Sj$otnz>zOQp87pb(5iW)36yK^i>EC z+obND+nwi588l`>uX(ak%)wp$TiB_0ansR&YCj~1kE@h6W>hw^)#FQVnT@4s5<>2E z3aa#nhZAx8$&e?+vJ`l`h8A@0JqiE2_;(9ABorjkq*oFv z%)>Vr?Pqz##`yZk4-~U!i4VP!$2AA9_~k!2LgGl|*VsKhQ8xI%M|dU3nC20;9jnfX z7y`u$T|J?AB^(~&ges{WRKZQFkGL5=zKj*5CRXdN-z;6=e-vWW#8rW6{^bbGd`bqZ zOEGNUTc_mASxPi-^^*^FNN{mX82m=_0*&oPqKmD7C3Yn5-uic48_BE|`0FsbY0W2E z(hCdcVHE}a14ph?P}yMy?5NDNGpB`2e$_bLEUXB8z<&H zO=3t0W(2(m(24;z4_ZT~bX7sA9x6gdn|7StYenf7yYd?6ACKCSM8Cy2EjT6sSFVPe zYjiWE^C*iM^jF97*Da}ljQ81>ia(~N)c4*1DSw?p5Hdl1xAxU zbMvBqCg+T1;2O^5_;|u%`FgIe-%L)DHTz|J)`VOEe)6GlHQ^??yT3&mU)1Crs2a~` zi;bg;%})+LGoUOY!_SWSiS+GVjUT{I&Xv%636FseMf;MPPqk|fZ>b_hoO|6~M*ch- zbDP0<&i5G4sbfyF7QV8u9V7l$$dKbR)tORel!G;->pq^EWE`1wCde;1)xkpNW?Ffm zMYfvy)0*aXr1n0phsltlo+H$*5)xuJ?stV$w1rtAB|`z0`r_l=M7LQ%%->E7f}by* zPiMz)p?^E8>BGx@`e~>f{6!X_l1)+Pp~o*Uj*A=M*M%sCaZ{FdaQtx`P|3qC4MP(^{_> zzFIW^%{#Cn)h(R3M4IeCk(Y@s_}b1GO|4I9MxQ~Q=>CK1`C3h-x?uO=>k?mu=SoJ@ z_2(UF-L^IJk6YKG8UjROp?hp9bAXlh{9nN@zUYT43vfE*LhHXWMXn=cRta@>g35NMq z=v3#F!b&KGY2%MMCWvkn#fEu4j=cldZh4^TKSY0)IiELxKvl@0&r=D9SWD1r`~pb} z*tpJhpnar=azdvoD4J*V!h>KeAvR%lk^*%FGtO#unBOzD%+Ci?JpFB{RP^$j={U=j zo)Pgq@*eWv5Bo4k|yZ%z)3_qs?AD=^+ zfNdDm)mv+Uk!77^bH6a zPa`z}8mJBvG+CL4=v(r}Z>Oo^>!LgX{;4H`5s=f&Qmd$~%NC5Db;X~8s}|IyTf&uF zI0*9rd@*%O-YONmNIWg#h8@ilO|N$^W%&s} zZ=^UR`N=Y2P`?FoxH($YLXhHh>wpFE2kPB$xY#@rba^jTB74!D9gl@ zFToTfo4)wTY)KE#*}V@7Dt=Wq;NTd)`#5&5ox*A?Ky3u@F1nmRBp!e$idK`fDW zF*=|?P8kq?GFx$2BIqju3URF|ZRjDB87bJ9-wku7?g%xX+A3>F&8pq-J^L_k^Gm*B z^lVS#Y%5b!?7*gzCB#+rOP>P<^C2gj{L)K)3yw6n4YHqWIYjHQiSY}exB!C?+1(-4 zTCr$8L(A$CmbpzD!7VOT^XD%=9ciK4H}$k4cBo(R*f|(_u--pd(oM=@Y%Q$RYJ&8(>e?=;)(d4+%aG7FBwsiR6UL@v{S!!9 z{6!b=KyL)3#(f>gQmf4vRPQ|{B_|=gY}bcVh>;(1$<(@w2>eHN<(FD3DD;4P=`};` zH;VR+p$C_d?lH<*g@QLD6jo-iAx6K3bbdKf{_F=jZhm0sxgp6%vaf`l${hixOZ3rBwoJr-hE8Fs5URa!?Vh zWb5#EB46PzJgk*zlv<*Htp9ysB_$Mv;ROWAK{^<_YypZt7FUR{H!TM0QtWjdX? z!ggubu*oH`MA#5K%;HFKGm&|as(84!sc`D(ZQ7VBxehU20-$*+KE*m%piT4h`@4lF z&@j+rnVtmJyKYw~)SIDKO;vfEbt?FMps`mIL?c@6!qldTqmq?KqdSmHFKytGE;g}qIb>hgPR;HK5CzAZo> z`Y-7S=nq%>1ogh>-Ee>($mhHM=j~T1mBk)oC=r@vZvj%O(FUW#C=$qY0;y23@6Keg)34 zh2~cuh;J~%1i#KTEH1+s<{QH{b`dQ3Uiij;*pz3DK2WjOOe>Ub_qli!;vOb~CPcR!&|>(@~Buj_F@ZyCsY&XxQLm@oqS*?}|Z zS#4wCmCISjY-%LWCq}sM{?jFG>kp2WHEvmiu4S8+l+vhAfVijjNtOXjDS9J!*!fN} zbLabrTZP|dx%f6PBq99&DHM>2`8f)&g_O19y>&9UK(+b#_%LmKZO;r(0UBdPtXI-i{}NFCDC)U(KW%aa=?$&Qi%2t${noy{GZ;zQeQm`A^34W zL>hE3M`8p5b0ABhD^PETP<~;uHJf5HIxifLG3(@jVQS+8os%${ej^4J;&h@SRi;<@ z@@=sMf_Jb9>_D^r0n-Q76$MY(NUck_Xf%3$f4Ie?5JFL(nTk@Q&Ssj7siV29D*&#n zv+MC!_O{M95ekeq=InoPS;7pDFX_kZ+S5~}wXy|IKkCa5alBhTCNg14V~@s&Vu6FA z+X^!LC|t7rBe<3)><7oI2sxZV^+EH(@?+vr7{IIb43!cKoxjy!n!~asB0TckH`*T3 zIeVVfY#dLRQf{-G=2UF$J>Y&3c8}v7oTdd%OWN-EHN9VmvD)QwN-4dHH;JoyJsQ%B zT@=Dw%SL2Q-wJq8`3(u0%eO5u&V&hv&!*&*?iPk2rI7hJJ0kH-Y^VRxN3CA}>7zim zk4q|lLk{MnDBsPx`3VzhFRdTQ%cHNaSqi=gu5vfia3cj<<1Om>Ipq{qL1+yfdH%&f z!!i5fTk!P%jQA4izyl#Ze%zyQ23ThKZ&+3OO3{^(XKq}sZ5QW7*Doq6+oZ8rq>Iq7l5I%IW}g^f*CmQ<7l%G$Oitmq-()HA@hV>zT~zgb-09~s26?)Z(bk|2?#90*{0ueV*{(B?-wZ1mID*Yr6uxl`aK`Mw{M3j0R#eNo)iTwL45P!YZ? zd-LC}4-HlBa0D2Ec0L#8;0uxkExcWNGD zl`H3H%P9|ALcGuj#*x2=oi)CwT9vLnS(&pzo-(Xj4|6#k zYxPI&x#okr%J@Y9UV_zBJn)T8FFF#lhy!;>Yz8|~p4UY_8Ios7iKc&Nt(5UCJhP(h zRY6tDtF7kbQcwS@m{AtQSG{)64A!$=)5rNB_8X@KC-0y`_N*zvspmeSvTfp3aQRjt zHEWXzcY%E*aNZJ5S6qYO*`by=v_0YAVFs&@ejrtDh5Pq+YK)qR(+{`?X&&nMg-m%u zxySt(iRpXhmtv6u9a7MF@i=fr%>A^)!9_S{muy6W3Nj?R2B6xq`T+7%n1nQ#!P(#s zP#(-Z2f1LUbA3>;=!0`4mZZr=m%~0uQ#5l>7x)`x+AIz>#CG9?oqFNjs=bb0QtjT` z1O2KRw00E9vZ6}=dxwyQ7%k4XZ%T(W6r%JQ?2>L&s@~^GE|5Yl=yxnGVjTwv)6ETJ3%_N*Y+i|Vt0R&ilyTH)jze!Mvw0SEkmTkF$Z`{#(f4f#us(m1 zcN`<$^5|m2&uiX+1F}@0nQu{)ih`}iK7%KIykc3R4`&2%Z{l1(!hjh#-KrC6*5G{X z{tl9vzn_?L{5Bilv-P9YxAzmMp()ZQ4L=}>qMrTHvu7PSM79|AiZZofn%<5#d8}L9 z;#($eKvTVFxRt2tV;NH-@@{~2`*`@;V}q@~QfhHMB8&ra2tpE1A~haRNTID>3Xap} zdd9bQfAVP~MdwJKLew zta?VbBbV-=A<~6+XXTL0E##=n5fasGojcqXS- z&6;x5eQKR{;KDv$PFOm+vdU&ZuI4Fff}M5pYv;U%$Y|JsFA|R2f5VsbdZ`<3gBrT} zz^6bJ6hz8iYExM_F4U>>(Y?DIk1Q?^dUDm9%rrX>LU69zl`3OEoZF^pNT)5(+2qr> z%UAD|NH{UZyQ)(#aTLzKDH*iq;gBTCEo;F?)N~ zF4_y9ML*YWU6@tUI$fZ=VqBskImm}?0!SE=eVWdH-7s!{GPBQQ{o(p3k*o>sB*Eg- zmwwVoP5f>38XQp5S6HX9N0y|IUox`VbBea<`6AwRqJ4;HQa@Db^&FDhU``F`?3IKi z(50wo>)DU$O^bm}I0gMEuVVM)5HZn9tvOnhgk2l{-fAKmFFw&z{zmOd*ck3MzBT|q z=YlbdHv-LoH$xjxe`aw+8NvBXNU8-q=O$qJ-Fq9%?25Wgi3pFE$67SlV;(CuCVa%R zYF_$U8Of%`lv=?&Z&MeiwfMW|^I8J)TYEL!NZ|q-uMY|GwO&)UtliVdX{)n?JXdPc z9mgO$jeH8tmht)ddk+UA*-`37}6pgbXHC6>)+{b;X!OB(n#+VebJi za#gJ4*3~{mtR;5NqFaNQXcdpE7{3^!4P<_}JXQ(EyX@|)JjV8NB(mDo!EsYsVvp>P zf;8pQCUj^r0-7*C8!_5X0JMjS)B}09QX`mlRs61=Ue`OwyCdpl>Vx*+@4bjG#;tz& zD!`$0wQ_8)#Xgr!8fw;V5xK;E4EdY^+v7N1q#BVog zGUXN3T&fInsV5zU+*sv{SgW4znOjlXR%Cn?2ka$QTUFdN?8iw-IT^a1{YxUQDoNiR z&>{4*_Z~+X6y{%!Ho=&Mu2Tqs%}A$Ht;c+0G%xTT8ahg;Xw%6GwG#I_9s2e}ax;2| zNzn$Sb)2hQegoBeLgx+&9fyYY5)(-rn#O|HvMX|_WIQG{%ppE3CoXNzb$`k6<8}H~=i49pI zD{@E-d75^#Rz)+Cz@SW4P;sAkyBq5zu5b^-yo2L~k#IjYx43wGBjIEL1SdcwaP=C+ zX7Sb=p#%0RetOr)*7+8R?Qq7UYH^!Dtgx9t$SwDyYy?WKVek#|xDU{zHGZvnK3Q{( zskK8WdNi7Zrlu$tj>(3u8k14hJ5{PwH+of)&|uF(75i9er~!dKTrG53%gVcCV!{d^ zr+seFW#}i+W5z$!2VaVcJI{nKUxObBX}th-Jk{jUY_oLkfJPA&Ep;`zMT2;M$wS3f z{T5Hi7Tm-0I?P%Zyi|HR1(24|NxW!kd~=%4@3qE#I}%D%?TY-${&JVDRHhO9sdcSt-An zX(){G2r{G5)9IDy!tGO)$#{=D9WQW}H>0AvAcS(OX=_7}j5PaLll?JSU{LJjuH4K~ zPs4^!`}c~(e<&wF!vCa=%!P>r!yCVBhe(5V^zrmQArEvb_BnXG14*x4FXdaU{r{ac zcD}L(?Z2!M3Hg;Zz$E^!tf2$RrA?jvi7GVPs8y<0rU(sruA_rGLe7J2+yU+VO;up^9;57^`@C=cAA{v&6;E^gb*P!B0L0{y%5qvf z{Ktx@uw#+QrcNX-V32PHU(xSNTX|Z;{L)rp_Wx-sdzf{!v;V)gGBiK+A8n;^j`@Xi zFj>Fl4Q903ua-(yw>(eWtHXc{5BLWI=gHa?jXMz02|{sKob-gcTiS_`*Whhd?oOlJ zm*@fei*C~8+7pZT-*giqVTV2*y8!QTQ2+l6H(k&t_6mn|UjCDy+fqL(;k@)o8l zB1>CegI;eXBhWsCm5QCW-g;1+NvR^oSwH%3z9)st(}j>)>_hCC|BNAi+=X~XF&5mq zRIM*oz&68b!N@W}lJH01HNotNtCDIeV?|dPung5dgV%MP)RBiJ1DBaVG~f*5CCSmX zhrl-jhsZtT59}N4-Ub2xuaRlgB1TwdA24*Q3G0OI`i?0lne%mK^SKAyJ`v>;$OB2z z(?0iU^K51@1Dn{9G335@eKt`CQuBHMy^5YnVI}_@EGDewuHV4JMtjybB2wJN;}X1 zz?K&|FJ(->7n(4t#oDhIG@@q~gyG+q&BK;g{&>SX_I2_!W>J2V02pmUfg|@*EWV3T zph-f>@K8_<-UBLmh{Kn2{L4=l`Gw;pDivgzXg+>@Ei9bgzrVKGZxvgFSTb>Jxx?`S zxZ|Pb#K}K))i10;1~Ud5QFeUyAg~FZZ{I!dONq|V?8=LIH&naTgOJqcSIM+LZEbLj zgc>@LY$y}wH{^k)Ond@tVHThrm>{BGdkpbu0nOFnR^sJif3$ix^$70v^(P&?X?WH%N1-VT;M6>mD>%aL-VgiS4C1 zd_DXhjT?}F74!$pTzb`KF@2xCi#Qmw4w|YrO%=|50?Pi2ws&4-?xB4bX<*$iBH8hd zPPlk@Y9w{L&c8o#XQ2s)r&GpllEaGRZ_07U&(hr58DQL*@Jl7Y^aM0|D2Qkc_X_xx zGaj&%c4;{X^x|(HW$FGRZJ2?iRj>7?rA`_!@3O+MEuJw5*iL|(rbmD;NwFgK$olY4 zm2C^YYEy=GI@CjW1#>xBeft}0Dv;&<=e?(=Mvh=SNl@)h^X>*Cc*tO{7_C1E_FYw2 z5rl;*pNvyutREh}yzx6fRfCDMA^Ez<3}l9ifT46S0>MuKs7KC+Dbg_&y2E@MkK?sf zNKMY;RwRia`gvTH%6JB6fB%rljqSSH0cpC~G8h!OyP&^N{aed^zc&PB=JI0lg)&6m zEv=z-#bA+4>REDy-Xo)&K#vr47pGWI zHNHtJSC7O~VJaB)2&;U7LM@(O#Kz-WpCxes|V$L%=r2u0s^-KneKPD2|}OMiJD7XKo#jsSXFF(kSd(G!up#TDvEq{ zW*y3txBye_P8v<0eo50PF>c@IP1ra_)E}&m5Ky|5B-yT#ghd-&4R}ec=#m)Zv&Ub( zhxn5}&Fpx{GDULs)c!9j?xFF#!1TVM$wpIdR@;E)0 z>tkgk{CH7*K9_iTI)0oV`DJ_rq{?^)NqV_}NB+P3J>vFrrc)%z(F}li{%)xp;>7dHc~kIsRf+DF!5rJpdREPn4PQ!=ACBfVwPTiX0P zv1s8IQE`dT-UJfKc}ZZUN9HWWW>W{;F7`2BuN<=6*u&3-Nxt|@iyGc~xE>$O?5olq zuI(>V9_*9MRB2xD?HxD;zKu<4azjOpu}b%h!vx`r28uW3iDI)7WiCKm8<(aGlBe!M zXza1u14F>RLlbh|hK%%%nxLV>{7i;LTOrHMknXLD<$wHmasFfgtu5D-l|*DmD```J ze8ZVl8;t?6^S;&Eaj0KLWf~0`K9_I=X^k@4d;dPjS?{5{E?wpOaa(Q2d)iawsJPwU zLKH{9_hcMbb70{yJ$B2|mW~bP{9GX~WcgHMv_t9X@7;-xJ{-lDLyU4lJ2Bj6d$9aOE*Q5yi@wX9b(r z7{*!!q-#t;RC-AHH?Aw%Q!sbPF18sXo=`&GoDWRN_X4jJH}~h`){0(D!U{4W0+Rw8 z-|~R4=*j)Z{IqchJh^--i3x3v$BJhVLaeG`I&b$+AI~??p7;05GHJUi<4von9Qi?X zOeJR7sY)>%V>?@E{lUlE*N&GJ(Tt`s0^5?f!N`m7XE$Y}%hmdgT zCBMf>)-hy1kFtscI1TL4^ji+6gjT@TVZb&&{>R(d@JDpf)ieR;1p%U+eOKLse)omZ z^-*Y>f77Sc=Six5j|7Uzpz%o$Wgg4#6OKI~i86BNikw3Xy#^C=CTPwUWyd1Um>0O{ zl;owUmEA7eGnLd7mef}2<{JU;Dm)m2W)CK#d^bOQ(VMz>OY(LB`w0|s-St?EofESu zOnhP}Zzqiy&je9*MuI@v=VQz^#g*IK_%Xu;9arQVBWj6X4|>Qi&nGtN>etKLx5HI9 zHR>1DEzCJv3=(1UKV$<$GWY{aL^4=n>C73;F0z#FUOnlfPg&fA=LF56!NA{(_&f2Y z2zEx`y86!bRO!C`)f2+@)mcm$&7CEs223l6d*qY|i##mV0W~jH2C0(D6C8L1Dve7F zcncE7j`Nn((#b41RSq9IQeC?o(t}`D^hUgFHKyjgZndH_En^*+oU6pgS_eAOxeG1j zbgBC?+nRCD=~Wq!`+JkFj06C@kGI9i;K9MG{{BnZ$CKl{hpsw5zK!b-pNPlXs(ynT zxIOmYv7?RG)`nba-@Ed6J+3I%`EOi*}eQ ziHm=qZUVKVJaubRwV4C5jdU!YQ^40y`F3?@gzvhQRSzFU8%lHl3mcfZ8d?G2K<)%e z2CA}@*2tD?|AH5;sM2Cp|7v?m1Gv)-)Hf?|cLf4l)N)rcG7o)`)z@`zNxj{ot6hW7 zR&No%fj{bP3`m^}x4CWnPmy?=cuu^Wwx)uD#(9v|oPaO(j1QPR4-9KaDU&Jb8cmiY zEcfY58thtY8PF83TtjhFj4=+nalR+uF zVsKM{I8J;|ES6UQI&;h(4#^W{bCu|X)q6Nkuq%G%{j8==sUH*lB7NB-Iny6moB`{b z7=X*;!|tcN5!gK8WW*x0B1hkNY2s&hQ_JG`QM0=s)Z&`FnI$(jH?h0;j7?ipFqllT zEEnvX$ztEc%*mQNS65C=4IN39*N@}2nb40s|B1p+K{NY<#vZxV%NCp8+lnZNMecrm zDzB`j@mt8BaVbLEZ!i~U{^qp59hCFSVvsXJ!1LzVu~;$_9Ix*YH#vI!_Q&N&KkY=d z8nR!Ec}P`|iivX83hW=ey?c6ok+}Vm7}a*&87n16y*tZ>z|N+abzr8>k|8Jih&us> zr6I-cbCXT~RhQSLD&^(tXM#m==uSkE?GQ%tmA~W55CYq#wRUx~Sk^NeW z*Mi1!KFTR(6}*$onouYX#nX~z&RXj!E%czbi}t(^O8yyEHclD!brD-92Lq*nM>P7y zW&xigw_~8MWh~>z zAuLT)%k0O&venp4BYatC39yOdt~9t2>IfZkW7jZ>E2s3Ce;^^M=1kkCKUN*Ff&sIk?P3JD=$lS!d44`v)o(r!2 zx-%#%cbAvlghP+7eUq|#3K#d7lX|cQ16kS+&PN}ALC)6c5}B*EYV%fa%@00uQ4_2X zJ@%hoe7n2*dxJ?`f z4xVSb{H08WFUX%_?#K@h`nSVP=ZTUi(}X$IA-aqorIT(Ql61t1wRE?d`bt9W;~6w( z%D7H4AvcuYk$Dbd+pZ*V>DQd}?70ZPyx*xXb z3F*3)@rJDmYM#QA(KZi|I76gV_FOg?jT=Z2W~`SX7~ittUa80h>_Ls}3;iMp#6Ao{ z%;s5VXo(bHzZa)Mgct|i@IHXA;m3CQG4)8|s&zc6aRzsUO)bCTvyQk!C{i-u?1r$k zl|#M~+))i+$Tm;xo`r#jpoav5$bxZzd`CVcgZ*EWeN%K~QQKy0+qRRA?R0FbVms+1 z9ox3i9owDm*iOZ^ZENcL*UYS0v;K>ji~Urcv+JVPKJVV=_2Uvp+%YCLkqwmeUhrv5 zlG6)0XCfIl6oHDSS{Pb+VL&x#&E{$QNx=?m3g1Ga!75qT$g0onqV{gWEWp0j6nY#k z8U7SmFxxU8#;G))N=zc;)g@)#?E12I^taF>$aO+nWZD_N85(qFBO9R1UxA}e=|nDq zJd`A9e~@_8ux#Pt6g>Lo$Dtl0EGZFCXbZ;r&xchEGLXCzxj3R4p9Z;55)&|_bmt>E zIBI-V-BJl|+)dLUvdHvoBW7>2d{x#y_iH7s{WUi4*Jwxm-$^YCt^OhHf*M7=x{TIY z)jAgrZX55~KQeePvv=jPb92Gz%hq$#hxztY29qpnKrCSK8$#{@Q_k|YH`Bhb3+N8 z>LT)P45AdgkD~(L^C@SAQLf*Am5K#0ezbn>*}2w{<64fNMB(HKUs)$5OQB zP6-pG38(T zl6Cx1QGiAl)Q;}>W1f0qDCtCg>vOfF$=R84@%Q@3R}ihgc9-F;_I>~5rvHfwp{Kzh z?c2Wnz})pSw+X7SMOC-2&kCuoc}^GwY9XQWv=iV@~`%R6M>B|3ITr~J9$w^E zV*B?A^xmY+i3SEB*^p3g~Gr|vmy)U}fx;RO6LIv+Y<{y8J?u6}I# zd3hZ}MAi$$L1Lg3-|{h~q$5*V7|FrR08xEj>%W^kWNj#!_yWwEIn`=RirIs;uR}K8 zLN+&9ws007xQ87X)5sC8gmonZk#`!sm=9`zwD~`-K6w66F#UZ2v#|pHR3K)V^X}0B z1M}C?z;c>}8ixNUD~RRZAzGV2VX@pjx?5OT)qB;epP27s465R^tyl`0)@UJhLf3g6 zYet1xyzs4R$AIhcwP}Uom{T}f3-G;Qt3uGnIPzWPA2&oRJ<*$$11h~dh=iQw>sBqk z+vS^GZE^Dt>D8X|EUe}@LQ6&LGt6=|?Xjry9MB50KG}FmES7JTBzJ6Ys?<3gx>#yq z(`CW>K*FjV7`ain>Xu~;IWuZyWf8;a6Kc1R+{~I8wp3EN$?I)HSV|;r)D&3l$bLGv zS&B{HvVL}2Hr$SSrNQnj-e4+5a7mQl7JIZ6yVfkZKsZ_;(l?Vqph;@wm{xW|Tc8y( zYC&JRfrIa&gZmY;`o45pCjfpny5g=Gqfl``HAtJb7F5ZmrDwYEsSYB5!P;7TF3R*R zcxEqJ@^2dZU?Z2nU^Vh_{b*(e>`iUq>hr6kS{R&hyp!)$2%}BYly#ZPGDlt+5ra= zl9u|S;`^Z9$fH=_MGhSdJO53uPlkjoeSt>+#nSneLitE@_h*%*n%1oZBb+|ua_45zAn*q{bn= zq9OK)-3txfw7BQK-wY4&8X_suuX5j@NnuSLn5?x(Xy$QDfp@ror>F_N_azAKUSnUs zdF2ddi(<~dQstzh2tr(C7-Zt`~soUSGP2CntGXqMB~F5~j);iqIBhMLn5=p&+3%6nWe zS#bAhvDYzb&EFMN7Ji6K68OgySA#21b`M6M-X{)`rE@BRMPU17@6+e#ZRBUtnKs%g|i@7SS9w=f{ zvawe7#R`AadR6T#el>FL$+nx9qK}b+7T;S+79>N^XQ|wqFi%$)@{H&GS)(jiPZb~w zQ)6ewIEgXCIYTXrI2oN1smA92*xzDvdc=jdnCUeK?B4+_%Bd2k$Vz@tMO)$eQ%Lx> z)kLKZJUM7oaDE*<#^uy=w0?SLpbXVN$3qerQq7pp4pkhQ{5S>$ZgakFY%P|!<%0DK zw;Z<4`wru_cD&a6Xl3C9dbX$txgGo|uVF|AjOlhza`QDrl}&di&6M*!Po_<_`+Fht zZ=9c*9ZP)8`SKN5V0g)5Rb7Km02t+O28kx83C;75iXJEAiE~<&`GU4@%5Vm2O0Um<~}dOHTDP>$l+?(uYkpXw84qj%Kiseq1>0L$2e!|3}QSH=(Hm#LhE1fri zVt=AoktWJ{vMy5sU5ZP}q_z0aaO!J65Dhq@;+zlX^Hp}asf_mAk*PslvWORR0O%xE zPF`Wpg&s6IsQPRg3a(PT&zp_bdP0TxcSRW06(b;x=C4=I4>G!_1y}NjWpNqW^gt%r zwwQH_5`@SKC!6q7r=OO+mEHJvDeVwV%wcJxpEWR)E|TzNofEmPtNP=K>#mLCLy}K! zvqmxJzI)44tIhDZ!BOktzwrF@{{@7CTvpNErOdG(d1d}us%hzZ)hWu5m(cW6b z^pD*kntSB!V(G3#hAD(p_;qfngy+)8*z_=xmy;Q`1Cvul#BrDyPCvxN6MzEJ#3rZi zVvh&=Nv~zK!Ws2gPE`IF6Mn$`mpJv;S1R!yst7zxatujVy1y2_liaSyMn%uE3dnTM3 zXC=YZTbbUYJCOIQkj#a@>-_S{0~Lk!3DxL|xJy{@n3$O4GaxJsCnXRdCoF~2t*tpk zxKL_OS|NT;)3Za&RTWxPKJKiZ%)>}!H%a@VHH4D?Q8YFh2T!uTL;fN&>OwI`_ZoH+ zi?-$Vk=$N#Xggu6GHuZ{CLudXiSmSq^QLNZWs-0A6P-)+@IxjFr+()J3n5$EIKv}% zFo}mamFrtUJy0(or~}y@FH4?@vwdV%s3~%jah3kT=|E0v-Us!ckBoFD&z$E%z9?|^ z`CC)lxo7LocPHJM!B8Xs%u|{wsI!K29$)9XO@GA(W9micO`5OrcR0h5TKOD?GrtY= zvvaZ-luR|U16bc-ko|R0s^CszUGw_W2>tsgW&&&7^mnAx6ke*OGOAwxK!6^SO-^#=g?<#u)T)!sRB?X4boRW2|{% z9w-^vXVwXiFRGR@*9F=o0F*gm#|gD_wn3YBTl>-Mxg>)jRZ~WP4n_8PMD?Ui&N}Oj zDhRLqqOYPn#heB4D%OOUoi`PAzM^GW*um0yTI1T9a=mb?9=W5x#hpBZvs8qtx#OFW z;=!u^J%ok2k#agFtfnQwk78f2WT9l>1`?J+GzK^YQ#|B{vV{!zAd|vbC+HuawSjcn#BVj+Ye$gnGbdbdmiI8d zUn}e40Y+ge51gUQmvd_;qyZC~R5z*DTRS2p@TMlFI`3s9bs?l z3qw4huv9UCAEoX?|8}Dce&hU_@et+Iy)|_V^phTY{ady!RrT}}JdKkSy7*DD28;Z7 zso-Ra*PX)3L{3>*_JU%l4@}w+^qX^Nzi5o4Aq@RQ3`o9QtZ%wh<{=|HqB& ze*t>QEl&1N^jX`y;3kfvrzP+TD<(6)+!yqtfj?karE10bi4$DTzr@huBbLnG{pK`| zQC4yIw!3q(To$yd8^#{g%`EV=yKc=eZfGMWcZ2D2?AH|1CsK*JK>@ze`9*O0`2NO- zojTCUEVyFJ{XvjNjrgWHxLnR=M3O1I=J<4706K*=`84u?k4#xz>JIb1O-anBL&N;?!fDrCieMA12qWPX&9=nzeNB*;KaHmL9UeE9U-cDnHAHIhQvFb2s)nKtT#Tzqa{y5_ zMvR&_JDL<9Q}kV=hfXT3Ym6NgnO3+I`xeC-su+9R@~W6hwx_AmPPZ0XDu$ctI5}PG zWV7Uc)C|;~0_)WM?*9a3v!5>8iB_;E70pGQFcHi4G&Rs5q#XZy%M=b@Q6I#s5ZNCp zh)%N)jE3iP&rB>a6W<=_wzN(>0)ro2O#fcZ0$NLPlm`KS&{{Gdk&$CR!p7%uzbe+j zp+j)#F&glbQEiNm4~Ljbfv9&6{f>Ehpr_!MH*3Or$VRB-#ZxA*i=_}~a8zd&wW!k@ z(KV8{&22*_!B~OwNSWxWwAWt2A12>tWVcZ-$NH*&%Sw&umGq&Mt5Q)_p?nXCmv|L5 z)x*z}{>@0wzOhJ3=|q4QZSHRAv%(QGLjG+YK3IL@n$t#h4p(9)Qdi>RoBSoXGOz%z zR}JbLeHg%JMMa$gnX2J(Vj2@8{Zc+3pvg<&r4f9>XeX9Eq$l@c6vRPrkpzw+uWi(- z=ru<3)-HBJAtOs|3OA0h52>TtcW-%4d$7x=s7_acx}Q>NADiZSvRwD>tp*8c5r3D0 z`-sDCq_41)(!q6LV@9s4zr6rT5rwEUcugHmo4wE@N0-}IybxOV(oc76h~7xq!m$7d zwQVSt6&E#9$;rgS*H$}+SAHa#jyiE1SI&99S{gu)Kpu)J39tFqT zJ=Si%=sISk4}^;{*(LmdP|zP*v?r+lebdQ%`UZZ0PgYQXHfpRbc1Q`MwJm0mUsh+6 zF5Tj%!GuilE_2_@cV5yc+S?@F#@Fvee56q&Z{O>|HiDE>tad1qYM7IB4Aq!Hv$Js* zFIw4cxpztBUU1)+UVpuOPhI-sP8-$y_dr0_T#BbS)R3Lho~Bc&xB}bjgG{|aGLN|V zshUosN%F2ZVP;Z62Bm7*^iJ>`Yp0p7GF*E7_n_rMASYqcM0ja!s+IUw3JSq-VbGmH z8FpCV6>$v&K{;s40DIi~nM08U88*8Uw4#u!=M|(>Q3#LggHQ;UA?yJqfjaoyK(7jG z5pEzSz%ByWelv>C;!Dp2QhoxPc^F3TaTcQ?=#XH2VaxDiW8n+m_+umGxyc8kuA`sF zAERw!MgNV;@m~(B{DINAV#hAZ<>tUf&NF6bRCj$>RJXI!uDm~H!Ozb-FQjRlG|;hA zf+G~(4Rp!?t;JKe50bWHm%U=$>&(BujnsxeTcV>`HwLvY*Y~)mVW*dFPY5_)x-Q@s zmPnntjU1fOUHEdA^JCbl0 zRy1)Hcudlbe{Z|XfN1VFt2%Ux@IGR9!7M1@ZoZDg?jq)a>A*?&$343QsLy5P@9(8e zb1Pz=Pp7PP0{YcmyK8?Jy&qH!iLdi^Z{-Rm=S1!wudsYNQ);aiJ^ahKr!iK8wv80D z%8H&|t*mA6p^esU_2HimcUylX99%Z|=Et-av)y;%R(UZk+39o-yE@b{-z$9sXSwENIH^$K`{p5B;%_s;Ch=achXPxXe6*PYS?{oc~4P{)AjO!1R* zf4=Vf#+uQee;@zWy8i=TzHI?dMxW=KMX=P}}7)=_VdIEhJC)cJr zv#Y#ZTDw$RyGYNV^A_|~FOr?++8J_$%8w2LKU-OhQO1o^9%PQ8+aFH_^ZG@BPzfHw z4Rv{YyNOZJ3DMN5{Vv6W$aZ7Y9qclGLYi*g53IU%Cnqd=cMo@ zUOH-bnY1HT9jm-b7=m~~Ud;{NJ4{l-cYOHInB7!PxioYNY$U53)LxnLn|v`40o#!M zn1b?{)7;_|Sqde%w>iowbdRvSqNL;yLG7`s+0oRqF@MO4V0o{<$y<(f9nqc6+B^08 zU`S%BW%DVf64uAir<@)pBBTZ|?VFTE#rY)pO|;y*VqxYwBXxMc&@xG}?MhsL_X|iP}|oo5@p3B6v#=m>t~{(_NMz{>Suaq zt;9D2mlgbO9D!N3!&7TYx+L;B3GC9jHW(;(!Ee5gm6KJFT%Gza`b`T9fh zCbq545h(+D>jg^GyEaU=zx1&oUA%S%I<1hGq|3?fvlJgw$GJ}3AWD`9Ii@D zl!;bHHmkS#Bams1tcIAZ%A58u^~nx;gn>Q04K7i$As`)gih-R?puh1O)Bg#s`p7<0 z_2(qq{!smm5)Z-x8cro)f7mOREYTeqE8Es@|1pJ3nLckKAlCIi@%vt3?)U^W?)n6{ zK5rg?K62t+ye{YdolW1MMSPM9l8m^CzF1Z%P-)?6$Eb9PoPE0oT8TQOEOva)iqhvE~u0U>KJ*oBdsW*6rydXwP|14E1K%>Yf-G)d~P`Qw6Yl`EnzwHbP9 zRapU+Ur?}VVWJdf6V`!C5slSSA}ygfzocAgx6;0Rzb3u z@<*^d$$@=)qv&<%(@Umcu)*lp%*P}LXycMU9c1@Ip&2mp1#Sx`pgdT7u zOW~?Uy^vAL9%6tdzI=LIgy380z;uiLXc1RR$HQ9-&8=>UONTA2=3M17%lo$Ye}bV; zoCiwa<2jghnpWEo7-vpeO$}Hx|6;R+VKQz=k*3Zh5z=HYFdr`bu?ZVALW*h-!XFv& zcYH*mPnvoPE#yJ6rmYpjW-W3?Qw)+dfoT&U(_xi+oCrTyO^0QKFk|eTYmt?1gVcJ~ zI}IE250%tx6<8_Fp2qXQY62A|Ot_dZECG|7lj<}}n~B0QSEvl)e}iKOrMONwyA2}s z^T@A_3MSx~qv+5xFzjDo?rgdpB zSM~?W=c7sFP(D^|?)H$bT?igTlBIqhesWO=e@bB_jt{y6rURWh>_ z^8CUJ9ySZaU@hp$+{kCm*tziJ$RwyF-}Pj^$+%{TCF%2BrT@~E|2dR;4j5{+Z+MRS z)E!?XRUZ5H_5$^g7*#p4Oh2aekU0w_r}`I53Gbl;7!Q^*z>a_u^2`<;Rm{eA{&ViK z)p57c!FD<9a6`*XUeh6M)(~K{R~lxoQ%8N)=)R%L^!M-UL45{_4_^YdPJ8oXXMuK5 z=e*rBczwpnkUpH(i`$I(`yE42Mw%9uYAU1=|8@zaQ7f32E52 zZps#|8#dt_65}kv_HIzf2+^9061lEwn&T`=|Dr^(wICgLKcI77J4aOcqw6T@x}YkS zhQ#Fu=c*e^0@cph1sg5K5hD3CJ%0Ve1F zXmU482#5xz503OW%YQ<&0-?AU_LxSdg3tdO=!k?~5&KaF52gN1GH~NVh|$zDU|Q^lHuTCxM1H`Pk2(>EkhivRLekd3qXq8I zxL)Nl8{!4$l_=~+3!Y9|+UN20M&;i;@I^MY@vxgpXxyTXm8CB2=sr!%Q@ZuJiFISW z;A9rucU+@{1R++M)b#X1n)w*7qhZbpd$DY}>38s@5k|}tT@el!6755+S$xEDymwAb z$Nf=Igp~;60J4B){6T-cWbBQZ)j)6YE83CegNp8|S>d-;C)ExoO{_sj?3J9X1#e>5fpo>*Q_C*F;oA|jq^mYP%Al#k<8e!gQ%sI!CEnUyb6 ziO$EwO;h0f(yAKb?G~9iPiG`7-$1}?1=dyFZ;s-RrmLTCF%MCwTpfsGLWpX05Fl;; zn|sLSac8V}vuxQOd;Et8+^dIs!e$|R7v&O<*B|eYh$XOtWgyhA!XTfZ9a$on^@hShZxpu@Am)SgMhU$n!c{2u@bIxi{9|@I?!?iJ&PyL{ z5ssNpXBlT2B&m8ak7${1?8c>OgbrC}ryd_AQOAgRXHQR05i8|{;WKBF%aAIi;`TOY znj%Z7wkUNSHA>dy&T1~-+pi4@ZLClUR~y?;^(q*9Y1!aP)arohMdC5$EVa|54$)KQ_F_!wY&~T9i2fg|pzZd!07?s7(Y^+3P ztF5$Ndd)?=&aD(i`AkJ<8K#0UR10{%j{9r)`Mk6KnB>Lv-qO;7xDZ~)?Oems*Q zEk8DM?%d5BPr9{8a!anu(qEnRJm(PJc^y3X=#oM({vRMHsYfh|D0Srjg0Sj+D4^5huAmZxDaT?J%|gOaHQD7Z01T6ma&0LK7LvIiR$g)_lH6iFYDJ^u zAp6a*f1nvvHvBi72;Oo6s{9zMWbbOTA5jq!yCoKD2#Pw5Old7OAN8`77PfYG!buU) z$>O(w$vo~uL~ASyff-zS@*)eFQi{$;SNs?vE}U4RuI6OR6y_#Pr8XTordkkH6O#0S zJn?Lld23oq@>3csF|}^dZ#M{ZOW{{{gT-PzHH#>O5+c+HcKqPRWf3XdR<(MCg{R6f zFA-z>BdAnbUI_BV=1v|8Y-J6#G1-01j6Te?)LB%gUt?-s#p3kzgTHG6Q(=}evuONB z_L3f^Y`ykbhwcS~{7Z}cRBVd?qYS$$75n2mOvXmlTx`r3gAjq;#M4!oUy)ar=a zqpP(KQP4Cf25b=bh7IV!Xr*8+NpdQlBSr@>ne)f|0xz0JjVKSW9T$|v%;H%B^b{j5 zBlZY}QS&gN_$Yn0B*wK@HabHt(%%h-(s&6r*irwNP5wAJ@sP}#dx=a2Y`%Jf2 z9S@WNXYs^tcX8|H(!ybMb&O+pO=pM@#pkNpi|RGJG4#lw?5-Ua^cPJ(u(sP?-V%dvwI~7m(q2Hb1s6*rH&+0B)Q2 zyomXEcfm}(*n$yNH;5d+H^91PlEM@u#t%!vPn)^glu+E0LXR{&-&62x5kse?w)~^w z!+qy%&Z|E6m0jem8iG$AQ1#3cEQFDv%`%6ljAbH9&!;hqHS|vVX>RT$ilLHKxEumc zl5q;-9z2ZG5_q7A60V*M5TRqFlV_TX7Vkw%48t6_x&9g3?UWr0E@170xG@ph-s8T2 zi_E#Pv!Hx>U@%U>x*0Zb+M@SSzLoA~ad8wdw&Awm^!{1-spcxCnSx!LqZg;y_MOY+ zhToc@(rZ**-NuuHpXaba%A;fmLO*M$L}jrg zcbva<)3pH?am3|v4MMwqG(HSxrwn|0-HFt3cNrOeh-hnf`-b#$WmwBc^_S)s4yrE_ z*Ijyf3|9#lW%zeccy=uc8_!jBls?koK3I9;RgoVI%rzmB9YKstLgQ!xnf;ss0;s|F zT|KIuz}i!uV!~q9ctmBNv)7K(-t(AUv!6vlv7Ta}atAcFcNBjQ*#<%Gp9pcD^|ALoD zUQ+ZU%3WVcwVIwF9nwMBfgl~i5S=;C>u+2r%i+-QE`^`D+a~0X+9(p4eW>#Qdp^MW zkPu2KQ&PAN)-n9^)fxlkyHG!{WWjp=ut>hBS@}* zLFFV!2s98i{=SQrl#x#5%lw`V2?nY!spn9nk?ez|y!^<1%8k*;hIMPS_z2n-aL2)P zUi)?&UWK6Z^L6K(og%#tC7;#&#D;CgEZvgDwoyiNJLmvO0#P1Mg$5@E1X;>$ zoiTc33{bI6@oiRRv6;s*1%Tz^#d7TzC_aSN;2YjVcMY4a5|s!4mN~74b6eF<>3`6q z0lj+q+okoE?<_R$!g@S51At=qi#nCvPT|aAxE1DyYZ6s68{TT*Z6ZZQza@LIlnEf6 zaG{XO8hlm)B@^){p4@;fpn{bCti2_xBj9$WMweSS&h>4 zvwB2z@-p6tLNq?*(Hhe9Yfg_2&LBR4LZAa0W7PqH{ zj_Z}|HggA2qqEmcRK!LF10_8iHZ)ztz=R?DI5uvIx!}m(ht?E^+?n9i7|O{ZDd%J` zv@<{|DZEiFy|A97)N#^Z1{LW<9)pr43Un){)IKY%$`@I1A<#3 z5$vc-VlKC+>woq<8Q+hlK>{$B*pOy_(Oka2>}~VLtYk`ACXI@sxs8U+g3oaa%SW-k zQzQQcw4ZL$!dClk(p{v>BS(pj)2Js}4mEc1?oE0}tI_U^O?}K)rk!MmHDjxXY)&Y5 zj~bb6lmdqrBPN^a3EpQ3v{a?4Bfq!r0y~MZ2MYc+u0r_;jOk|Fg6utESf6qIu4bvv z$dR_wpSbYJO(E}CZI;qCCpkWRJzO;thnCDD5wa3?U~+d0EIdOcX$Ou3^j3V~WHWm3MgVJFsWfcO#kNL{v3->v235#`itAdzYbc3autYT>(Tps;BN z#8;GR+hjAWVX7MK@mm8OEVP-|$DnP5ix6b8Drm|HoirA z%I2RV`}KNKudipb+O@%hpBC0(j~j~MQIDGg*t8~M)IrcuwR9v`&out9&BwKy8%VG2 z?KXOD=RmYtyLO`{w5dSj_Ys=XJFX7+D6wWA%&&iwT z9$M8)(^4R!&yB95Onj%a{@1k;FV^O*s+aNZwm0C)2rD%IZ~kg%r%zIo!U1R_x}o@F zv}OD8eO*UJ{$q8i|DMR_6WLBreWULs%n+XRFYeb3?%R=gYrb`w1~+E23804rsnjB+=m#bC#J|j7}?_5WiCLxdc6ttbCL)_vrcMk+=+&2$7Y8+P&*(NzZ+8+Tt`6;8EJEDJMz)?VI zPxRm;HA~woLLU`d6+<7*BI@e5TJtsb~zv$sZ?i>shW? z#pYUBnq?%30tFT7VqsYt-RzR!!lQd|-p3*TNa3v%-bbN-g@kWK3TAoJ(c%Dx@i9Ph zA*TidF#x=#jeJHd_;Ff}>{y|o`EmOh94RhTO@luhn8Hb~tjolK3RXwFmw{`I{rG-1 zyE~Xa5Q?~)K!q>WdLe>V;YIQ58{FDYD_$i!{z(Na?rF5|lNgLP8CNW-E{D!pJj0{? zw`rPQ93`@xH0-Y<3REQX(hDNMHMRyLHOYlWv?S!{KU1HR2-cf0i}yWckAzCH7jlPc zT#xyrj0!;uO2p5*s1msfd$XB9wY1KRgJamq8$Z2hX4mEl=3RjJ$2GScmll3U+Yfn3 zdXP_c@Nym`DV{-4pEs$t{!Z-^6ycU(-K)G1+H^Cm19xv4J)cpg~!6&1ea z>YA#&8cQYdV;n5^iE)flHe2ij}@$twz&kk?2E81a9hAw?Dh16Rqe&hw9F(l)MIAFTZ;yn1jc#BCp=qp z@BKNxHcat7Lk2xwOX&CHH4EdEr6*gq`I=X#8A`@yD5^ZVR~a@8`1N`{2qa~6UQK;V z#Sys~h*(e+3NQsZdk~)kU;?y|Z3`hpku2^`UDzz55I38nl@ngK+TNAhIr*jgLPK>J z1~`~ogy$RCl$3*VHGm|3PG5s^M5S&X)h+#;9lK2XG#`C|b-oR1JSVotNputKvI0Cd zM>HESplgttz;i;R_xO-22IK zXW2}6=5t#~nde+K(w zZ^&e_2S+EoFF!>?_C~VS$|k9c?~xR$y*aB4Rd+x5>r2aT_ATy%{D=Nfq!;(OeD@hE z0dDdTRnOo(CJ7b-Qnynoalc~Cd2%rQ+KSvi332JVl$uBXirc1FDm*XN(_Bptizn8N0F6v7}CQuejEto7EOe(~hA3kyzHZg&=4?GH! zvj=lRdX~010;mbsDNpO!*L#I!i&~mb*NeJRZn-hc?j2X#$HGr}UQ32ACt?T zfAa{exu)w4YB;b@Hsc`s6uPk|@ga*ENpx0Cb_};G>9AAXd>D;L76&XADL3gIWX6oX zy-xCAg^%i)Qx)=Rt%~mfm@LwMCDu-Qzac{#NPxRNXpeV}`Qx;1h^OSGw*t)xY!+;o@@v`3nBxBJ-@t{hR~51sRx#aUZVyynSry$%nL~ynir=Y+WsLu$-Kdk+)(` z+bk6Cxv%j}k3f%tzqP^ZUEs}X*w>fWrx={E`Qv048|O`0w>2`q{>CLOxg~VQgMoY? z6Nk>8_Iyk^CrTB?7#na!+mr%I6PYkXC5)l9IX+f5X-e!jBUQpb=~u&*|JH5(8fbG% zPB7M9$u&WdOQgmhw23A63cX{}?EUA+VMQR~5SNJA)~oYlqZo!~%|Bt*S^poRiCwmn zk#E9BAR((L(n|4_%41K*4Z+2l>E-jif)1PUFMT2vQ#mV~KZKYV34RFDsxe_I-|q9_ z?<`kZ+Ys;_<5OSk)->do;%DF0FOU3WyJ%H>73zo29xVk%Vtix|duM(q)9!hv78?KuF+O&(4yh zBjZJx!HZRUrpcy}LsxONbbBlYU(U8j=v|&5iGKe2F|2w_tJ;C6Ebd%*xl0b8av4JU za|ZH5-#rB&a&D;%*R?cQwA4x2RMW2Y;{YJsSA3XsgsT&Dh-%q@q=)^DE#p}AK%Pfa z!=w*5cwfq4n|+gQFfv)QH3JDn9Qz9lYs~$m7b9jAje=|lE&@)OCTN;8A@LCjYzCYC zw18tK@;~uVR;ItuAzm17JnC#wA%g)NK^8ZqA3MP4Ff&+w}z%PReY?*ugTp#?KDGtKOc87hzlOl z{*=3WPN_Pwky-h9@B0hUUhn@{lwohDW`}aCxmzt=Xt2{BvnT8f65fyCj4HFIV8P(f z4bOV`l2*sU=#r6nCc(+>DjR^nn%2it^_ZJ3rWY^|N0)q6pdf2tOxj;@J8Rb(uB`SR zoC-6A?IB5~i1OM!zOT4F9})mjAwQA1Fx0(nYI*@BGN=ZK+VM#qfwJ3(L{?s@pB`c` z?6S3exI*Mhyv2wQ%4bL_G?3Tk7NABXkB?>38BWGdPQTU>9CVdOtV zeT9k}1%yfz#Ai{Ao*pW1%ATkAl)jQ%$`lFRKNt?=FQ=dvT@&Sx73s;0n9r6_bv?nZ zc8gt|ZA$F@t>`JyH{HWtogPd$FaL>GYv0=1#>%plU*tD$al4y4is%nRhH%TH*`83v znSF6lbu~m< z8TshL)b)*#NzD_#jyuPECKidLb>Sbvj2NoR1T!JJj#MfX8EtEuq8Yd@iqEk;$X}hz zw!HHAsFcnqf`j!DESv;;!DBRqj#*czLxHYJit z*}k-pFg8%gg4j>zJHlZJ4`@sm#>*Jvn>XBVmPQ3W+SO+wDn#}G^Mb_7?S0!#5mdS_;SLCNKm1o8bl;Gwgl-Q z9Gdgz1(Ic$L_fq=x}rI%-}SI?PJRd_XMCTz7dS zMNwpawW>BjY#+VICu-=XT3Cv_owgxWrM@v7kF!xfv9fRn7RudNbG$%eUg}CVc|#Pie5YTj@k-P**z#&PbY$ z<%!eML`ipxbtm_Q}xKhKbUf{(z z_0Uo%p1lpr`ld9`995LKyF~DDP|Rf2{@K?H1BOv_=-9$D%F~d>9~UZgO!JP|8gUAE zf~zrUQsW=GF!?@+7T6^)6HhaK-WH%n%Tup^K^T(-2$c+E&#Hf;%oSQ&t5hYxg5wnq ztvL}|&Q>eI#|ronB{~t_&x)=>Kq$Q*frQbMzG%l@3ikwr-FXcBdybWAghnO`s^Sln zIED@u3dCu&+vEgz3f5hRg>F*af@>+u%y3=<^rc!EZnBa$AH8pCx0VO{2JWZuv4>SO{vGZlh8QZ{YHoSM&;QV2;G zJ~k#VO=n&l=+wwQC*fb%>bD2)5_(AQ$i1ChTyTHRPRzqcL+1jE#BbM>VlL|qy^46AmS~Zq9WU7r>Ca4e;1A$HBdcA3yMBj|%e}n`Z z^Ea*7FA^vG%U=pA5gL+3eOS?wF$(RY<0|hUd0&TsLA^1{ z!ceLRwmWY3EBeF8phAlc{4U@XT8@)zwt$f8UFrQe2+p!byB@uXmlA@iCfno;^v{Ea z8bCnTYVaX?CIM;0@hKueviLrh7h!O56`;z@;o23_pD%)oBBAEae+jKSUk*j;o8toF zH0zA98+Ul(&aiPGKvL!5l>?^$RR0{B&}bUP?cYTHf&Ww%sm{HxxdR~{-LRTO=+=dM zJ7cjICAy~)X^+wrnZr`Z#Xppy$Qi@P zT!orXzN+yG{^`v&c8ARm0P}DJ{X&mpiqR#{aD-=sc<+XKr7>O6_Kzv8i~V&W4&Y}f zJX=L|$`z^ia(t%x4XAM%Ao2DkqRheoIj8--cQD%rE5s#;_vs79QRs`SsstC;7lo&} z-j}ty=~*=5u8;C(j;onIG{S|={&az*fMycz$e!S!-=qRn2M4DV@9`kMBK?l7Jv$Pf zSRrmHIoUr))J}KSNa1fdQ6q&Wo=rJdg^uKB;i`eHEsG^j#z8dKJu;Mc7|EZLC$08dsH_JeH0JX92%vLqr^BEs44u?w_PI)D*PQKXD%#+1 zHDMv7{eh zOOrFD+=JAxNv-0sB;1T~J2S=U%ao=}aMXsGsWsH@oN=qM=`KpG=4 zB86BDZZC#$vPnnh@fyQUZ32$4gkgsfw290U&5xIR)+U2f)4hwfCw6RTkJlu?_@BKI~nS7FyiLLV6q z&?14FqsP>ftjeI@Q4%hd(x%5)MX|-~G_^75TwJ$<8#nVtWYW$+IOVU?*u{4y?|G5~ zeB5Nyq`}XXj4PI7^AYP~CU*Qv zW4IGw6JK7`LO?Qi3Tx$qJG)K1UCoWgMp6fnubyM-l*gXEy`8-!#4Iq7{;olr-mGh;f5`Cx5z!Ex+{lUNjAa ze8(4~g5!@HfUTUu9h{9=|5|Bv(p&{`Da(Rptg}wR=$b4w0d~5rfXVBco{m7&x@K2V zdq&jMPQ7`ae03BvarE2E@Zpo%{+tED|M0Dzva|g;4_LXZ2W^xZH(bthOmOPT>6LUd z^IhGkja3dkS`Xw5ltF^R1gQKbb>TvWJHiX<8|MqMEN2Sxn^C01${s#2+0>J#Kqn|M zr_K`gSQ3{rUX&AwH0JJ#a=c=C#V}W@ViL72=7qwGnY#L^m$StKUN7`~dMeV-bLC@b zcRv(_`1*@A(s&irl7dq1z6>;yz!R~CO+@NOh*AlvG01EC+mahtFElO*3L*g%h0-#R z5^wa1;YMYO;+0x7-A&~NMF;aQqd=8-f2y zYumNtdXwsQ%S!O=Y1Zpr+MI1#W9&L(EJvcnb4!)xYRlLX%~H=Tc5#j^Ti4&p1*xT< zfckz-7x;dc@AfdhBtMora%TwgxO1gMV0&fg_>Vj$k$Fp5&oe9-rcq;agCRuEaQktf zkV{z4J|=HCqMVMPW>P~3*Fk!CG$g}cv2j7Xf7R9Pw)F)-DgoZc@ELq4Ks#<=6Y)fE zov36YOdP;(Uq=bIaxJ#V&MoS26VFlZXcO@yUf^gGbV;-V%o2ZL$C9o%lQVidPG1&{ z94@XYLBq|PK)l`(WZ`v{yGdc(MF--4dFn+48=1@vVC8@$Id3=Ibqn8rm^Af6T$=>p z*C&IsyV5qqgS*pXXjZ0bqSZZmKXoBP)q4p_j)83@D&OpPvJ7b7eYrIJ!RMt$t!ZT+ z1EY!BZs9WNV>c{CH?@-~F0D0Bs~)3o|23s+Csp+}L*?%X(Yq3m+5kJnicwy)3@PI~ z=Yk!*jY8ls4MVs!1Lo7qOvFq)%o+z;XP~1-TwJs0EJoshPw?=KOLp|eU-Tk=U#pe(A-!C)^u}=+61Moyiyr+Mph0AHn|i!Gn;GjfU&U>)8_hu5xi*p#&ptE zWsMZl)k)1IXE?#!QrN&%?7OAGywzbLY8nvfx@$tVcwvF4Lp`WiP=&y5PpDs&kOGfI zkninh6jrBiXOXRVjp)Q0uhW^n$lRZbtNoYE4z}1z+Y9Dgo3s)+C%kw6{VKEJ^|R9-Xl1<-=?5S2$H2Sr zzz1W$uc1Ny&|d)gk~5Xfg4QEbF8;~)aCsoX|9t%;84-^;aZf@w98*$XK$wJiK7UWb z$IYPZq?T5&s1R&huzdgLHWs4R-ctf*)9!Xtl3R<5C==lzgoM1 zu|Dd}-B_jNEK_md%S}{Kichi9@QRZ)Vd9l0n5enLOSc35S6Z_?`n(U5=p}%?&_U_(O;w){IJPrOk@V(QIF1lt6OcN=F}OJms0Q%yAp0n{O(t! z$?R#N*2`4^U5Kc*h3k!fcs%XY@OLz0( z9K)8#JE>^K(k5PVEm7e%gS3cOloC%@C-Uz9xQp-5Ge#Q)+%b<_In|s zv~$q;q>{zg83Kol3QQhpd{Gsw&=Ny*D?So$xL*A@*b+a#;&Wpd;RB|Z&bU8ggBeWF z@WxCk)ihaTy3jbj5(fhE8~;7IUp^E+iDzjM)~O^UxuHZ7^OoW=CykQts=I_ccvZ)LD|9QBn5%gA_OlI6vYe-W+oCd=xw~YgFm?! z*cntOmOWukz@GR#=P>!>S<&%o>MyMtTm?7>cL`E z^W=6B#_>G2ZmLMNqM%A+o3z0;VUWnBqZgj`rY8?Vt$6m}p|N2lo_5$Genk4wympmG z%h7z*;XL(=x;|B2`h)y;(w~%!!Q_=?*v`rqCzbl6(k06k8#7!zt1a2O75|KNiQ|o` z_Tlu?yqooQypQy*hM&e{Z;@8;9}!FO(l!LXsP21tz3HfFa?+LT{XnzWJ+LTEO0X0! z`3PEoS`yI7#oqp8!otAJV_RafSyMzQ?1 zPR#zaG$8k~ZzE~o{#lq9dm%OjqnKGbE_+X+UxTgo)7jvDrA z9|>v!Y?~eRvpmZSC0yApimx?Nl+bC4F{o}*c&}|21i@W9Hw@taI41+XVZO1~_OXWl zwQ&YFI6$l=*u{@4@tuZVj#8xkG3XnD$6v6N?GOq&)Co2=uOIxs+b}31{`eB40F)vY z+tafvt5rP3%zsmJYQRwdt>_B*0GA_p7e$z^L%x$I`m z@+^5-n3I&OpbU!|w80oSN~E0rVFZq1$P(*#A?}W63?Y5dz4qDKn)W1~MxB=WeElR1 zju2P;+ex0RLp}ht)(wN%O3djX1F)mwbx(#1MhVnl9paV+#gH7O@g*+gi1LL}{;v~Z z-+r=3Dw1-0#ojwhCgHR~Jyxc^1Fd?3=v2PPehhT9|DK(Avm%qjv$_xJGm{wrgp0=e4qyVJ?c5=6|LZ$Y zwm6R3EB=o^RTOdX>Wi7?&HQNNcCx5Lzbkfg7JH==^@53sy;;3WE1Ci>Uf z1NJTZZzlST=-D0gmn?m@gsGzks-FaKFLB`6*6vO5*nOMs^pvxGa?23mZ?fz0q!O;= zmN3c1NAyS1(9gI>X5}k%H zM8CMYAt#}d98&9J7_OZVs#nBmxdpd#^`Vc>sIG&;!Y~pLeA=DWi|brQ?tBGmAmuA z-gUTgO7YX1KgRj&8yKzM$&+y^1IfRN+*q?8mH27FW%^m3JW67CW$oPW!Po)`XCap8ty4Cy8?Vc zGEiG^khZwSctia>_3ZxdXan#tb)=9H$n_s@9n}Qk4SBc>4Ur$!`oVs^Fi7Mv!N@n^ z=i^TVMy?ASjXz@nAKF7vwgCXi5^6UqErSQkjuKHZ5JJ9R6Yo8% zG-vf|5<%?uE%3br!8}+*Nkl(Q4vbx@l5^>lO$sPU`+AYFg7VfD)qavlnaX^Li?Q>v zOX$6-p(tv2ty$aAbV_Yuy_CtW4E)n&1>n`jWq%LFGv=lc@q69k!NoCjR4FsoG9UY4 z{ee>)q35db+J!mNSfQ}(Qjw{cF=_wnDgs9>AE(U>$xGBz6$)UTzf%5-?1e0SIWKSq z*H}RG6~nPCa1jAYpwcgz!c)?FOLp>Drt*OBJU7Rhn}bd#$}6brtVjASeQ?7`Zs#Pk zHXJR7;lUbm1EH&ym>BN~&$j449#a;lL4mrZrA3Uj?O8=}N#)CP0R3*S#mN04VMg?< ze!H*?Wjs7qjTGE>0a09g`$~a9|0&FD5eUN!&|xJBvo4HkAt( zmO`PTD5gW9hz7+QuZLh>BqVha$#p|)$ah}`{CG)g8MLJaW$gY6ynWhC@e>KE*bDr^ z8@WP+ndIGf*D~UJyoB>|M%Z9gcI=N;{I}FSS9BK%?wEr0y4=cITq_)CVutLyAO%zv z=F;sQZ?7R%-LmX;LFG|Nb>Kz{rT?H?dCW(9`_-I6YwP z@>uc5V|5enHt(p%<&VepVGoZs_pM%9`Bw0@heV9?9{LZU*i=6^{vvhU!>3F5kjHfx z^IMbD(bPqwP5Y=*>^kao+4hie^Y+;GP}}xckw2q3>2r|>%%1-#TY5v8c(UfsSaYGS z2gvH%U23H-dCFPbXUiYTSp1{Gop^r5)KJjC7dT{pLu}9LZW!_Jzkd4XC(1q2#Mf=; z8a`TRC-bsZw1A11R7~oux|Txf>?#@`KfZv>#Z4k1alDQ}A^{k_d z_2|kgo}2AVN3}6u5BT;-F#6CsOQdsz1T_>GxHlZ$p%F$@I>$G6UUiyno$YkD->p@1 z^kU-x;t3Z7h*ooU4sso1f#jjqnn0luJSP9%a{pwB6RLokrm{f!*r!YOdSAS@8)*&S zrm*}894O-Nz7>w`NQ?YMnpXC%%PnV|x>y3U3r3v-iimV(I|=^)WyB-R9*2`9LW68$jF_e<6M?#XGvsZU>hhhAv#QLYbc#sNlV}^8;h#EnjD#?l`Ym z-H^p`cdJ5E3jJ`t-^e%0c!cNW$zQepDpF?v)>XU zT@rBFh=t$>NQU=TM4dggf+UNB_x?iF0v*l=|L4yzs8WNvTRmyha@S%A5Bb-4tADv z$7_u-=|q^UF1T?g45oTPZo~XHN(q*)gpRPLBM>U#)-}YXyHPo)$4HJ&;6bCQ&^7xw z!=Z3E&Krrnu|yXo#R?!zPjQN8AeCRVvAvm5r`#Sgi*QS!f^yGp0KZk)kSVl*rzYU4l)r9wWq39kauiU)#ixq7upuQP$!x zVwV2wOHIwtt;%ulZ_duB84NPMZRsxp0@Q%=!AzLH)L|{G0QsIjyedK6VmNB}EX56# z)bR6;)DNvfkjvRQg{4V!*fw-ODVQ`kAq-AL)o@#59XOn$Y5?8$<=N7aatiMXVtsf8UXNr{D3d?pd=0l9@8(QkqFSgctQ^Wn*; zE)gS6M2i){sL}OwV^M6eNE7&})8dl0;CTeZa*|^I`Mbf~NuQHJo=u-gzJLDo(yZEE=LL_(7kkHYTh_-~=kXXB^40IJ z2Bdmp$ZcKCedrmd7<-3X$tK6sl~mF#RWD%$pa5T3LTIsn^tz3|-o>azHxPf1huk!z zImbT~K>q}^b91yI0LgQM{*e`+m5|bLnuN3Defcuqf1F1|t{^JJkS{EQ#Yji2~ zsC$fE8%HMK(eMUH-|C*{(e${KCWJ>O`wT|@1CzP0XE~mz0H$>W3hO69z6kJs(Rw|X zm>y*?dbS!*o#w)DTaX~Mge4Y)E?Xu%O8_CEM6;pLnzc+cNq(jEotS~c|MNq@Di@2d z@X&S7I(H;2z(Ms8^F(f@KMg=obK)KXkqY1?M~X-1erswroAYsYrszs~NQEZp&C?o+ zqq~_T%k!4^Rk$%{*x~I=u-l!}cWYqlM%yfcVRbKNQCMu(CTQuC8{-rO@b`%1yzpzb z^PwO~H*Ya|LxzA3HL?AExWW1`>auaUM`izxV-_&^C6wL%#?ZsG_3X%V&2+@h;_~3& z`eNwt4}Fh_fM#9?+l22cglr9cqg>h{4O{rIAzOeG|t+>EMP0PwJL2`dY~GpArt{ z(owEn7Cx!?d!GT_%&NOLSVK8WHxZUt3wl~=KNS!%WK;6sr=qPIA5zx~aN{&jn5HMl zil8l-wi`~zenm%crk3@M8F!n@Nf~nrdd#zi=A{K*jG~|7G7rA^qq(>tfMR{dlQ4t> z`6aqUe9dY$d~IQ077}`Y_uR_;_{Id&hVK9E?KZQw$C18$RXqz7xT;`okWZxB0$QDJ zcxR`0q(*Uhc-YVtX8K8Jo#c>lK$?y^^Qu1RUY2e$blC{VUV#WnuqUEUMMg=08@d-P zS#iGhiM&prywkA5hRSbDrLj1ErO)mfy@d7+jJ?!9fs}+@XhX4WR?UEEvSoC8k#FnLXG_6KpfsPlqS#FBfM0L}YVxg6|D!5cbTiD#LqL=y=5fwDbA} zGo{n$8RCMp#z&s3hWRGa#xdkKjHz8q_N|`Gk;)wWY0I^kO;QY^=f)9v%Qj)de@iSz zCAXBpF$@@UJ$N8cMng}~oC;N5lrD0I+=sObpz;<|t{`hI*tmjNj1Ar;?vAOjOtD=s zagF3mW8>)(KLQr~gMK8qu=wOvgB`ycQCq6p+>UYE{-|3Zf;tXtkEf3#{&UZWXcU@i#1RO(GXgFW(5T zgW=S)l%ArjZeKn`J|Ufflgl)81_L%pA8*RWInt5}E^)9Qu8sl>)}$@z>sDLo(=dPG zA-ix8uh0?^IyF>M4H(MQII3N?Z-~~k^9)X)(whVHQQ{03lmt}#8%XHEJhKLVMjrLn zh01UUc%|aFyL@mK%@hG3upn-+eDcP++!TSX)JpY*!S1Tn#S+iA6h9XgyZ)RpYT&)lL(H<&b*DxSsKxL!pqh0~Ny%V6dxPZ$KZwaeZqG1|7++0x|T5OIa2P9E1-0(H)b zRe)-jgDHfEqysXjE(is|G*0z`_NA`5e9Ez$=lQ6Nr#ZA5bLp=ikstuIc2dDL<>248 zqC3!#I3q5|+USyDQBpxBAI&tT_%aEg$4d{o$PVXY%~zg;%3joA9qMhGVCvXG*1*V( zj+0my^OayN*2slY&r_L0CAam9Y{E9MiF~M%%DgY}LSfYi$I(Wx&Chsr$?uolu>-K7 zYaf%}E2C&odr!0}eI4GPfb8XTDubW24f+&&FT2;vi+FvZ!60Koe zPdX1Kjr9!FL)>LSY^J&xgc4Q9qpmw$5iuLa9PeaScB0WZMKqnvPpRd{TPBcONRO(K%|IjJ#; zW?*{+6p@rmigQKz1_`g_8rOc zCdTq9a*{{~tkNyhok)`E4Y<*T88n>`UCuk0JH#ePn84c}-Op#Q^b}f3dh&c`i%R-k zX6Tu;4GKqtO>|1f*puyU}>db{R^u#Y>a)rD%FnJv!7N!|N8@rFr#V?4Tu21TVGe2S)&FOZBe}OPy zh{*7s`&L?6v z|JU9ZRT%aPqE3K|YAaz@CKL8JAWRr0w*)c0K1oaoY6jnbQc>p20*eqK5~~54j@RCw(|` zU(og8co|-mtmH!|r6N}|`mF+boyC(Qy4doP^5qR5AAWzI>f=`!X{$?7B? zwkDn5X+!@@dBltSi*e;<&g^onMGevQJaTlAIBsZF7-uO>y)PQ%NZipp58Ary-7`w@ zEFC5p00y5yBUJ~e_pLmwam!di-p;wwW5b?Ry@V@FC7ev+W0|Iw0ME+FH{YCsHFgO{jU(fF0@(u&~f`A5L|-jyXakZ!d}X+A*rE z{Y6~BHy>n_6G&!n2Qi!T;B{{FFWao0Vf*yZu}}4MfpuwpQ_GC+2za0w)AY*dWZz7W zi5XU~k8{5NMx6&@XSe?P;}>mfr+j=ixT$T*4o`yyWULi!bO{=7-P{(0c=&q_uA3;> zZnTtXXmu?(*(I|IHKT)_xnw9*9Tp0d!iV5`?t4u?X`i1a=lqc*7hfF)+V3jUOB*0q zy*rt%yS%4@*k3=Kj3b6)Rfy7l^=_B;_^=T+e$}%He&5O{^21qmnL>4|qMIp<^!_Wx zcJSBajt#0{Fc`H+FEJ;U`LB!%s z;VU98ClImqkVZtK-h4z!R;(edAg8AIt4f(#rcVu_;T>rre-*sF=z}lS5uho*Nr)EP zJy&pYflg$@FY9v|2ZtWOPr;O_YY1}V+!zzMap_oc=nJb|Sh&qWS3A%xyGw81usptk zbzl?ZU5!FZNnVC%evg+Ed7UROko_~Kk528v-f1%0sqT>7G>kX!dR&ce=6i$Dg*wTH zn%o1^qSz76Iu6|g9;eK8^Cd9+EhHX7=#Tj=RTVFs>PVMf4~b9md)K|)n|h)s8cEVz zOC*9hs-EvUdxM1X$i%w9l|a(9qKJ^WNjUuWuygluK0HYvt7@*H>m{__!17f*f@#_>$~VT-{Woz0_#Me~m(Xzm5#E@`t1(TGU0CHFx_^LP23GT`uE zxj_u$@L|vqxA+XpsXB(1F`+8?8?~RIm`HE1@*b6cre5qPXUMY8kUHh(rj4Qzl1!#7 zVXC>)_aD>Rw1Nue177BJ%mjoZBy*CzyO5H-?XlbkH9&Ib$BoMrzzdk2D+gbVv{(8n zhXlAqHxcGV0Ha)Zrm6QTeW{d3ccq^jA{M7YYPLm4PEgol-Hj|)>MT{GO_z++=#E%o zh8O$`i?)VZ>6&oZlXnc)odxIs`I)~GxHsuf5;Tr+r%meeKJixHgAeI;pQww@Bp05Oihc5|T)Cs3$6X zM1s59AKe)P1&C6-wp`Tq5!<#yOPvD}Mh@h~ujW827>M$Caz=xA%O5!$y zwmOgWXjE++cP8FJ>(5a{lMy2^84>zX`-s!cuoCbJqcitFc3oZVK%Ka{9T#n}LUgZU zWJ{IF)W{fZ{c+I{j@g?qCe^9tZh|hW%+?__SjK;G`XpKuwN5;emHjm*)5McAv^DLP z6blZ}Nkt8Hr562^?GD>Oj)ENfy`ec{M5jh;(YT4PAj?lg2A0a3ZY5q1=pVD&lm^Mg z^)r4YPWwY!_3Ux2YPB$INCOADNlIee-afgS!1YQn8(&iY-B{XL?F9$dLX|bdmv|DgI+=DhP7U0Yl`Y{ zhBpmdki)nKXG=dc=q^y|HTPXC?hP$&JEe4g=Gh2EFZiv)njiT_Xx|$E^W~2{D zY^cZFQM0mHmeTkqrVI2aUE1jOTA1FO=#PvLRL)y(zk$h^^tW!7~(T6 zj~1ZA*1D>!0v#YxGZZj0V8ua3c1W=A7YJhl#{)jP!Ut#JSmcBA+FgY=;=hLjcgWlo zR8;$h23ji`!J=PM$CaIws6acWzEXp}8T84%&FbO)U2vKC0#pB~s6ByTTG5EzfB$t1Xc!Hpy-4h5 z1T!K??4_l-A%bi^Cm#tKDmcS<=Jk$Y40U3m&+kV`E{I$ggiyv%2g77@EWh!zrouS| zyMagM^EvEf#@Z%_^?8b|AmR$vCm*GCCSs1@t<-9^2B zj^b1!Mz2ss4IJ(P!yQ!flvdjf$<;yE-@}$pF|{m)ow#SBt1osSmr>l`Uy zybfwDNMV6dXe)k7K245BuY-@jG>;3~oF24VQ#?8-o_@u>>Pkl|3W(XJU+h{2ccJO( zjKb5pod*%t(pW+h*gsfHNL)lIUKx{VhL#(9(BhqnPb}{@D`QsPdgiPQ>yiQgOtI}c z1|VJQI&w0vldgXggT2z9E>V_qDao8t-MuX3(g2MdAKqQe&mBECQ>yHE2Wk=**e!t% zvrbxGKaxwMZ+4uM$d`usA68l3e*wHM(+_}81ZTTQi=%umU~%!waGJ<9>@Zy>UGxu= zhchAYrVj*#lINQy##gxdDo_!<&P_XekA;Lq2Jsr5_>-EBlx-40?9Z8zh;7WtgggYy z?Lyg0ghD4$J`g5=Q?Q1X?ck7eyuK?wxA5#vKhf4c!eeD7s)s|wP5F&6=#TLl0vq5E zs1Law0nT zL>0>3>H7)4n1Z>yDA@_I7f{>?h_7cW!A9BDl}SHl+xV+_yV)?IyEuojcfvg4!;??n ziCaAT5{=R(b7V?&FPz?lP@;qkUTzmRXbP|v1-dmcl#7|~9LT>sF87$BCe}YN?=~&l z_&n#iuRr4%#L7?PR>`besV!H~YcAm;q>q5ZUQo$^OuDBZVRZ#?_K^hAtmsZkaL z<|@l!$m149wW49odq1EaWITa+(R@m~uv^#c1_iwnH*1$d!=eK?RWGTMih-bTQ5i4h z;EKNU#SFfUQOa4Njz(Q23h#Lss2?wv_5iSs8;mJ$k;usR>lX*OfC?`SH`oT{-^}Eb*KCKxRj*PM)Vm}ws z5>bgGtdAZ9|9%(F*ir%;}F572^GcccUAI+!E^9r7qG z476hfH(gC6?#P(Gi)!>hQs8nhzZ}}aRhqA;F)%^Z(O9ks8wQfQr5oU^yqq7Ma4u;a%H`t&qysxoiuR2tHJ>rF33`S>i7;tUOvQ}Vij)L@D(sKHr65?Ux1Ly1Byc6#rXog` zLk;)y;n)XQhP0^8jAKD9#=zI(76@LC6@+R>7Z*7vsO298w6uucr?oMAe54#eG zB@hIkz#k;t7z1SNWO&RG>ffBjwxSlg0}-VdJ}Wv{4csZPBm*4UnZsW;+;URiIKj#X zzVhZS2Ta+Nl`rqz9~;SCg|%ZiRuuywE7;}U6KBH)*^yQ$)06&>M{u1GIpOh~X-pXt zJ%ecB;k<99x}5qdG9>E8JxLY3@H>ca)zeo@Lv{68ROAl5us=ku%yRtL=i1Hw!$LAB0b)>UH$nS+u$mI(5yTIY(vJ z3cr1wKfDjPcYey~KsZ2~KB z^@K7;kSvn?vp!kP4;VgvY`CXw*u{*RJK7IEII)6) zptt#NLZw#`D0+5#DWzjSZv%7p`*4g%()9t4*<|Y?0AJW`Em?Z< zcvofkjY7dre1xHOqZq#v_yPHExr#-icO2Xy88?8-zvt&RL?!tzv3=wKS$vW+u|jM6Yw~`)7X=Zj?=U))F>O?W9nMhzpjdoT4lxEs8s}$D zUK7xJ0W~otftVGCWkffoVbQH9twF{V4q8`+<5N6>mV>XPq=Ep}pyl<`cpM5nnW-Lr zTXyt*h`!kN{q*~nrRG>5ixe$?XTONu{MTFE&VT;Fe~2{_tNGc>qnh1khuuL2LwK}M zuc$Vgt(;keF+Ya|NKGzaDX`+*W$G0s@K?d9A2L7Vl>VWKTv%7jm;$;6pk7F!3`WHM z{P9&PYD{wcfd36`@nG=)n8QM>5b*lWcmDgh5&s@0&zE#ZL8OtGrej{yU8Gosyhx*$ zO!F%M)T^;kwu3DBh${3q|5lbj-`!8W)PH;bJ{jJL%1Bp%_=YTT603(|=4td+_ggS` zkAaE1-peR#RfAjrpvZS1D7K6)^xShRsAL3uTLW_@f_X8*1T4N0^imM4uQ-V21wfPa zHXR$S3J!i5jo?O@d4NOAWPt zN`BgrUmJIS;yZkFNM*<3+MZ$Ft=ABmWh;ziZGca*}Q_>&m=% zu*=#5*~itHP!;8OHbWZ^tP{zothg|6pRKyRKHe2QoEd(<6@`?6xrg1oJS3kxUGW&w zTG#4g%82LizUk*~mzvh3iE(Y2)>|?Az+c^9k=zy-Pk)GxK1p}lu_{=4jSA+gO&AoH zvOj((fmIbnrzJB4JOZ;diKibb2C+_*!kA_OKsPHpJhI>x=qdBhCHL2>4a9#!_^*gR+7S1hKn-YL+lqRyK#SEF z{OlR8BPA+IK{HQ)E;MNetd%s0)Q3B|?`e^Qsa;YZ>47$Q(sbcPj_n08n>4AK82C6r zRj*VTf%4BSnJU}c4UrX&&Sep6fjCw42kB?UCpqe;L~cn^wGrQBK2^UIDZUbdvZN|w zf{FhuD&_3NS@f+dEc5tQ`9>lF88&QRT2$5wV=Ys;oAR`5%*7%iF#lEbe>M zr_fV|@R?-RBSO zcVV*uZr+!hFra{)8}c$#-f5uZ1V0qr-Yj=s%yXvl(LSsn`*qXOqh)W;Z;^2H%ar)L zOm}L&mh*f8_03vLVWuE#7R!aXP|=h5MC4fUmu3nw>B554ks@IaC0?v8leB4i0*t_> zcu(0CwaDQS$`*p&-CHm$*}u=JzOT28fR6x08DJ1JAT%H#ASj>^Lk+#H4O_iI7$6`m zX&@lXpRfP#W8!RP5?c!kn|1}~^HPrt23PmLWv^;x=V<$5>VKAlL;PnJ$j=-4)8l{u|Fr)HnRagP literal 0 HcmV?d00001 diff --git a/Solutions/Mimecast/Package/createUiDefinition.json b/Solutions/Mimecast/Package/createUiDefinition.json index ac858626656..df667a545bf 100644 --- a/Solutions/Mimecast/Package/createUiDefinition.json +++ b/Solutions/Mimecast/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Mimecast/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nAn Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.\n\n**Data Connectors:** 5, **Parsers:** 11, **Workbooks:** 5, **Analytic Rules:** 13, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Mimecast/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nAn Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.\n\n**Data Connectors:** 6, **Parsers:** 15, **Workbooks:** 6, **Analytic Rules:** 13, **Playbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -92,14 +92,14 @@ } }, { - "name": "dataconnectors-parser-text", + "name": "dataconnectors6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "The Solution installs a parser that transforms the ingested data into Microsoft Sentinel normalized format. The normalized format enables better correlation of different types of data from different data sources to drive end-to-end outcomes seamlessly in security monitoring, hunting, incident investigation and response scenarios in Microsoft Sentinel." + "text": "This Solution installs the data connector for Mimecast Human Risk (via Codeless Connector Framework). You can get Mimecast Human Risk (via Codeless Connector Framework) data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." } }, { - "name": "dataconnectors-link5", + "name": "dataconnectors-link6", "type": "Microsoft.Common.TextBlock", "options": { "link": { @@ -205,6 +205,20 @@ } } ] + }, + { + "name": "workbook6", + "type": "Microsoft.Common.Section", + "label": "Mimecast Human Risk Workbook", + "elements": [ + { + "name": "workbook6-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk." + } + } + ] } ] }, diff --git a/Solutions/Mimecast/Package/mainTemplate.json b/Solutions/Mimecast/Package/mainTemplate.json index 2a250682d12..8b8338aca28 100644 --- a/Solutions/Mimecast/Package/mainTemplate.json +++ b/Solutions/Mimecast/Package/mainTemplate.json @@ -67,13 +67,35 @@ "metadata": { "description": "Name for the workbook" } + }, + "workbook6-name": { + "type": "string", + "defaultValue": "Mimecast Human Risk Workbook", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } }, "variables": { "email": "dlapi@mimecast.com", "_email": "[variables('email')]", "_solutionName": "Mimecast", - "_solutionVersion": "3.1.0", + "_solutionVersion": "3.1.1", "solutionId": "mimecastnorthamerica1584469118674.azure-sentinel-solution-mimecast", "_solutionId": "[variables('solutionId')]", "analyticRuleObject1": { @@ -198,6 +220,12 @@ "workbookTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId5'))))]", "_workbookContentId5": "[variables('workbookContentId5')]", "_workbookcontentProductId5": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId5'),'-', variables('workbookVersion5'))))]", + "workbookVersion6": "1.0.0", + "workbookContentId6": "Mimecast_HumanRisk_Workbook", + "workbookId6": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId6'))]", + "workbookTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId6'))))]", + "_workbookContentId6": "[variables('workbookContentId6')]", + "_workbookcontentProductId6": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId6'),'-', variables('workbookVersion6'))))]", "Mimecast Data Connector Trigger Sync": "Mimecast Data Connector Trigger Sync", "_Mimecast Data Connector Trigger Sync": "[variables('Mimecast Data Connector Trigger Sync')]", "TemplateEmptyArray": "[json('[]')]", @@ -251,39 +279,67 @@ "parserContentId6": "MimecastCloudIntegrated-Parser" }, "parserObject7": { - "_parserName7": "[concat(parameters('workspace'),'/','MimecastCG')]", - "_parserId7": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", - "parserTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastCG-Parser')))]", - "parserVersion7": "1.0.1", - "parserContentId7": "MimecastCG-Parser" + "_parserName7": "[concat(parameters('workspace'),'/','MimecastHumanRiskOrganization')]", + "_parserId7": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskOrganization')]", + "parserTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskOrganization-Parser')))]", + "parserVersion7": "1.1.0", + "parserContentId7": "MimecastHumanRiskOrganization-Parser" }, "parserObject8": { - "_parserName8": "[concat(parameters('workspace'),'/','MimecastDLP')]", - "_parserId8": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", - "parserTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastDLP-Parser')))]", - "parserVersion8": "1.0.1", - "parserContentId8": "MimecastDLP-Parser" + "_parserName8": "[concat(parameters('workspace'),'/','MimecastHumanRiskBehaviors')]", + "_parserId8": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskBehaviors')]", + "parserTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskBehaviors-Parser')))]", + "parserVersion8": "1.1.0", + "parserContentId8": "MimecastHumanRiskBehaviors-Parser" }, "parserObject9": { - "_parserName9": "[concat(parameters('workspace'),'/','MimecastTTPAttachment')]", - "_parserId9": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", - "parserTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPAttachment-Parser')))]", - "parserVersion9": "1.0.1", - "parserContentId9": "MimecastTTPAttachment-Parser" + "_parserName9": "[concat(parameters('workspace'),'/','MimecastHumanRiskAttacks')]", + "_parserId9": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskAttacks')]", + "parserTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskAttacks-Parser')))]", + "parserVersion9": "1.1.0", + "parserContentId9": "MimecastHumanRiskAttacks-Parser" }, "parserObject10": { - "_parserName10": "[concat(parameters('workspace'),'/','MimecastTTPImpersonation')]", - "_parserId10": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", - "parserTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPImpersonation-Parser')))]", - "parserVersion10": "1.0.1", - "parserContentId10": "MimecastTTPImpersonation-Parser" + "_parserName10": "[concat(parameters('workspace'),'/','MimecastHumanRiskIndividuals')]", + "_parserId10": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskIndividuals')]", + "parserTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastHumanRiskIndividuals-Parser')))]", + "parserVersion10": "1.1.0", + "parserContentId10": "MimecastHumanRiskIndividuals-Parser" }, "parserObject11": { - "_parserName11": "[concat(parameters('workspace'),'/','MimecastTTPUrl')]", - "_parserId11": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", - "parserTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPUrl-Parser')))]", + "_parserName11": "[concat(parameters('workspace'),'/','MimecastCG')]", + "_parserId11": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", + "parserTemplateSpecName11": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastCG-Parser')))]", "parserVersion11": "1.0.1", - "parserContentId11": "MimecastTTPUrl-Parser" + "parserContentId11": "MimecastCG-Parser" + }, + "parserObject12": { + "_parserName12": "[concat(parameters('workspace'),'/','MimecastDLP')]", + "_parserId12": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "parserTemplateSpecName12": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastDLP-Parser')))]", + "parserVersion12": "1.0.1", + "parserContentId12": "MimecastDLP-Parser" + }, + "parserObject13": { + "_parserName13": "[concat(parameters('workspace'),'/','MimecastTTPAttachment')]", + "_parserId13": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "parserTemplateSpecName13": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPAttachment-Parser')))]", + "parserVersion13": "1.0.1", + "parserContentId13": "MimecastTTPAttachment-Parser" + }, + "parserObject14": { + "_parserName14": "[concat(parameters('workspace'),'/','MimecastTTPImpersonation')]", + "_parserId14": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "parserTemplateSpecName14": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPImpersonation-Parser')))]", + "parserVersion14": "1.0.1", + "parserContentId14": "MimecastTTPImpersonation-Parser" + }, + "parserObject15": { + "_parserName15": "[concat(parameters('workspace'),'/','MimecastTTPUrl')]", + "_parserId15": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "parserTemplateSpecName15": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('MimecastTTPUrl-Parser')))]", + "parserVersion15": "1.0.1", + "parserContentId15": "MimecastTTPUrl-Parser" }, "uiConfigId1": "MimecastATAPI", "_uiConfigId1": "[variables('uiConfigId1')]", @@ -330,6 +386,12 @@ "dataConnectorTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId5'))))]", "dataConnectorVersion5": "1.0.0", "_dataConnectorcontentProductId5": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId5'),'-', variables('dataConnectorVersion5'))))]", + "dataConnectorCCPVersion": "3.1.1", + "_dataConnectorContentIdConnectorDefinition6": "MimecastHumanRiskCCF", + "dataConnectorTemplateNameConnectorDefinition6": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition6')))]", + "_dataConnectorContentIdConnections6": "MimecastHumanRiskCCFConnections", + "dataConnectorTemplateNameConnections6": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections6')))]", + "dataCollectionEndpointId6": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]", "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ @@ -342,7 +404,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Attachment_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_TTP_Attachment_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -370,10 +432,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastTTPAPI", "dataTypes": [ "MimecastTTPAttachment" - ] + ], + "connectorId": "MimecastTTPAPI" } ], "tactics": [ @@ -406,13 +468,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -467,7 +529,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_TTP_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -495,10 +557,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastTTPAPI", "dataTypes": [ "MimecastTTPImpersonation" - ] + ], + "connectorId": "MimecastTTPAPI" } ], "tactics": [ @@ -532,13 +594,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -593,7 +655,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Url_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_TTP_Url_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -621,10 +683,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastTTPAPI", "dataTypes": [ "MimecastTTPUrl" - ] + ], + "connectorId": "MimecastTTPAPI" } ], "tactics": [ @@ -675,13 +737,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -736,7 +798,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Audit_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "Mimecast_Audit_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -764,10 +826,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastAuditAPI", "dataTypes": [ "MimecastAudit" - ] + ], + "connectorId": "MimecastAuditAPI" } ], "tactics": [ @@ -811,13 +873,13 @@ "aggregationKind": "SingleAlert" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -872,7 +934,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Attachment_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Attachment_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -900,10 +962,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -950,13 +1012,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1011,7 +1073,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_AV_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_AV_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1039,10 +1101,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1074,13 +1136,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1135,7 +1197,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Impersonation_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1163,10 +1225,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1200,13 +1262,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1261,7 +1323,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Internal_Mail_Protect_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Internal_Mail_Protect_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -1289,10 +1351,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1327,13 +1389,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1388,7 +1450,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Spam_Event_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Spam_Event_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -1416,10 +1478,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1451,13 +1513,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1512,7 +1574,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Url_Protect_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Url_Protect_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -1540,10 +1602,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1577,13 +1639,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1638,7 +1700,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastCG_Virus_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastCG_Virus_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject11').analyticRuleVersion11]", @@ -1666,10 +1728,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastCG" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1701,13 +1763,13 @@ "aggregationKind": "AlertPerResult" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1762,7 +1824,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastDLP_hold_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastDLP_hold_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject12').analyticRuleVersion12]", @@ -1790,10 +1852,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastDLP" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1825,13 +1887,13 @@ "aggregationKind": "SingleAlert" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -1886,7 +1948,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "MimecastDLP_Notifications_AnalyticalRules Analytics Rule with template version 3.1.0", + "description": "MimecastDLP_Notifications_AnalyticalRules Analytics Rule with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject13').analyticRuleVersion13]", @@ -1914,10 +1976,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "MimecastSEGAPI", "dataTypes": [ "MimecastDLP" - ] + ], + "connectorId": "MimecastSEGAPI" } ], "tactics": [ @@ -1949,13 +2011,13 @@ "aggregationKind": "SingleAlert" }, "incidentConfiguration": { + "createIncident": true, "groupingConfiguration": { - "enabled": true, - "matchingMethod": "AllEntities", "lookbackDuration": "P7D", - "reopenClosedIncident": false - }, - "createIncident": true + "enabled": true, + "reopenClosedIncident": false, + "matchingMethod": "AllEntities" + } } } }, @@ -2010,7 +2072,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Audit_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_Audit_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -2098,7 +2160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Awareness_Training_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_Awareness_Training_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion2')]", @@ -2198,7 +2260,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Cloud_Integrated_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_Cloud_Integrated_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion3')]", @@ -2286,7 +2348,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_SEG_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_SEG_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion4')]", @@ -2378,7 +2440,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Workbook Workbook with template version 3.1.0", + "description": "Mimecast_TTP_Workbook Workbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion5')]", @@ -2465,6 +2527,106 @@ "version": "[variables('workbookVersion5')]" } }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('workbookTemplateSpecName6')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast_HumanRisk_Workbook Workbook with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion6')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId6')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk." + }, + "properties": { + "displayName": "[parameters('workbook6-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Mimecast Human Risk\\n\\nMonitor your organization's human risk posture using data from the Mimecast Human Risk connector. This workbook includes:\\n\\n- **Risk Overview** - average human risk score, risk response activity and how individuals are spread across risk factors.\\n- **Risk Trends** - monthly human risk and attack scores.\\n- **Highest Human Risks** - top 10 individuals, departments or locations by human risk score.\\n- **Human Risk Behaviors and Organization Attacks** - scores and event breakdowns by behavior and attack type.\"},\"name\":\"q1\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\">**NOTE:** This workbook depends on parsers based on Kusto functions - **MimecastHumanRiskOrganization**, **MimecastHumanRiskBehaviors**, **MimecastHumanRiskAttacks** and **MimecastHumanRiskIndividuals** - which are deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"q1-note-parsers\",\"styleSettings\":{\"margin\":\"6px\"}},{\"type\":1,\"content\":{\"json\":\"Data is collected as snapshots at the polling interval chosen in the connector (default 12 hours). Each panel shows the latest snapshot inside the selected time range, so keep the time range at least as long as the polling interval.\",\"style\":\"upsell\"},\"name\":\"q1-note-snapshot\",\"styleSettings\":{\"margin\":\"6px\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":14400000},{\"durationMs\":28800000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000},{\"durationMs\":15552000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":43200000},\"value\":{\"durationMs\":43200000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-time\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-header\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Risk Overview\\nAverage human risk, risk-response activity and how individuals are distributed across risk factors.\"},\"name\":\"h-overview\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| summarize Value = round(avg(HumanRiskScore), 1) | extend Metric = 'Average Human Risk Score (0-100)'\",\"size\":3,\"title\":\"Human Risk Score\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"customWidth\":\"25\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":true}},\"name\":\"q2\",\"customWidth\":\"25\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let T = MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by Month;\\nT | summarize Notifications = avg(Notifications), GroupChanges = avg(GroupChanges), TotalActions = avg(TotalActions)\\n| project Metric = dynamic(['Notifications','Group Changes','Risk Activity']), Value = pack_array(Notifications, GroupChanges, TotalActions)\\n| mv-expand Metric to typeof(string), Value to typeof(real)\\n| project Metric, Value = round(Value, 1)\",\"size\":3,\"title\":\"Notifications, Group Changes and Risk Activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":true},\"customWidth\":\"75\"},\"name\":\"q7\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":true},\"customWidth\":\"75\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(HumanRiskFactor) or HumanRiskFactor == 'notScored', 'Not Scored', HumanRiskFactor == 'veryLow', 'Very Low', HumanRiskFactor == 'low', 'Low', HumanRiskFactor == 'medium', 'Medium', HumanRiskFactor == 'high', 'High', HumanRiskFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Human Risk Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"showMetrics\":false}},\"name\":\"q3\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Attack Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"showMetrics\":false}},\"name\":\"q4\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":false},\"name\":\"group-overview\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Risk Trends\\nMonthly organization human risk and attack scores.\"},\"name\":\"h-trends\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| project Month, ['Human Risk Score'] = HumanRiskScore\\n| sort by Month asc\",\"size\":1,\"title\":\"Human Risk Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"columnchart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"xAxis\":\"Month\"}},\"name\":\"q5\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"6px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\\n| sort by Month asc\",\"size\":1,\"title\":\"Human Risk Score Trends - Risk Responses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"columnchart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"xAxis\":\"Month\"}},\"name\":\"q6\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"6px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| where isnotnull(AttackScore)\\n| project Month, ['Attack Score'] = AttackScore\\n| sort by Month asc\",\"size\":1,\"title\":\"Attack Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true,\"xAxis\":\"Month\"}},\"name\":\"q12\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"6px\",\"showBorder\":true}}],\"exportParameters\":false},\"name\":\"group-trends\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Highest Human Risks\\nTop 10 individuals, departments or locations. Use the selector to switch views.\"},\"name\":\"h-highest\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"groupby\",\"label\":\"Highest Risks\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{\\\"value\\\":\\\"individuals\\\",\\\"label\\\":\\\"Individuals\\\"},{\\\"value\\\":\\\"department\\\",\\\"label\\\":\\\"Departments\\\"},{\\\"value\\\":\\\"locations\\\",\\\"label\\\":\\\"Locations\\\"}]\",\"value\":\"individuals\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-groupby\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":0,\"title\":\"Individuals Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000}},\"name\":\"q8\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"individuals\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"individuals\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":0,\"title\":\"Departments Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000}},\"name\":\"q9\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"department\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"department\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":0,\"title\":\"Locations Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000}},\"name\":\"q10\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"locations\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"locations\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-highest\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Human Risk Behaviors\"},\"name\":\"h-behaviors\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\"Click a row to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-behaviors-info\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":0,\"title\":\"Human Risk Behaviors (click a row to see event breakdown)\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"HUMAN RISK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"STAGE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_behavior\"},\"name\":\"q13\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"paragraph\",\"links\":[{\"id\":\"73895154-b0e3-4cff-9156-adb5d1b1914f\",\"cellValue\":\"selected_behavior\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Clear Selection\",\"subTarget\":\"none\",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected_behavior\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"name\":\"q14\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| where BehaviorName == '{selected_behavior}'\\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":0,\"title\":\"Event Breakdown for {selected_behavior}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000}},\"name\":\"q15\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_behavior\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_behavior\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-behaviors\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Organization Attacks\"},\"name\":\"h-attacks\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\"Click a row to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-attacks-info\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":0,\"title\":\"Organization Attacks (click a row to see event breakdown)\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"ATTACKTYPE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_attack\"},\"name\":\"q16\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"paragraph\",\"links\":[{\"id\":\"23876233-22fb-4871-9841-83a1a9ccc975\",\"cellValue\":\"selected_attack\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Clear Selection\",\"subTarget\":\"none\",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected_attack\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"name\":\"q17\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| where AttackTypeName == '{selected_attack}'\\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":0,\"title\":\"Event Breakdown for {selected_attack}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000}},\"name\":\"q18\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_attack\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_attack\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-attacks\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"_Refresh the page to load the latest collected snapshot._\"},\"name\":\"h-footer\",\"styleSettings\":{\"margin\":\"6px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-main\",\"styleSettings\":{\"margin\":\"6px\",\"padding\":\"12px\",\"showBorder\":true}}],\"fromTemplateId\":\"b8d6e9a4-3c1f-4e7a-9f52-6a0d1c7e2b35\",\"name\":\"MimecastHumanRisk\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId6'),'/'))))]", + "properties": { + "description": "@{workbookKey=Mimecast_HumanRisk_Workbook; logoFileName=Mimecast.svg; description=A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=Mimecast Human Risk Workbook; templateRelativePath=Mimecast_HumanRisk_Workbook.json; subtitle=; provider=Mimecast}.description", + "parentId": "[variables('workbookId6')]", + "contentId": "[variables('_workbookContentId6')]", + "kind": "Workbook", + "version": "[variables('workbookVersion6')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "MimecastHumanRisk_Organization_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRisk_Behaviors_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRisk_Attacks_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRisk_Individuals_CL", + "kind": "DataType" + }, + { + "contentId": "MimecastHumanRiskCCF", + "kind": "DataConnector" + } + ] + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId6')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook6-name')]", + "contentProductId": "[variables('_workbookcontentProductId6')]", + "id": "[variables('_workbookcontentProductId6')]", + "version": "[variables('workbookVersion6')]" + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", @@ -2474,7 +2636,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast-Data-Connector-Trigger-Sync Playbook with template version 3.1.0", + "description": "Mimecast-Data-Connector-Trigger-Sync Playbook with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('playbookVersion1')]", @@ -3174,7 +3336,7 @@ "Timer", "Trigger" ], - "lastUpdateTime": "2025-10-31T18:02:32.739Z", + "lastUpdateTime": "2026-10-23T12:03:32.433Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -3206,7 +3368,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_Performane_Detail Data Parser with template version 3.1.0", + "description": "Mimecast_AT_Performane_Detail Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -3215,7 +3377,7 @@ "resources": [ { "name": "[variables('parserObject1')._parserName1]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3280,7 +3442,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject1')._parserName1]", "location": "[parameters('workspace-location')]", "properties": { @@ -3338,7 +3500,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_Safe_Score Data Parser with template version 3.1.0", + "description": "Mimecast_AT_Safe_Score Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject2').parserVersion2]", @@ -3347,7 +3509,7 @@ "resources": [ { "name": "[variables('parserObject2')._parserName2]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3412,7 +3574,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject2')._parserName2]", "location": "[parameters('workspace-location')]", "properties": { @@ -3470,7 +3632,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_User_Data Data Parser with template version 3.1.0", + "description": "Mimecast_AT_User_Data Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject3').parserVersion3]", @@ -3479,7 +3641,7 @@ "resources": [ { "name": "[variables('parserObject3')._parserName3]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3544,7 +3706,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject3')._parserName3]", "location": "[parameters('workspace-location')]", "properties": { @@ -3602,7 +3764,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_AT_Watchlist Data Parser with template version 3.1.0", + "description": "Mimecast_AT_Watchlist Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject4').parserVersion4]", @@ -3611,7 +3773,7 @@ "resources": [ { "name": "[variables('parserObject4')._parserName4]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3676,7 +3838,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject4')._parserName4]", "location": "[parameters('workspace-location')]", "properties": { @@ -3734,7 +3896,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Audit Data Parser with template version 3.1.0", + "description": "Mimecast_Audit Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject5').parserVersion5]", @@ -3743,7 +3905,7 @@ "resources": [ { "name": "[variables('parserObject5')._parserName5]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3808,7 +3970,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject5')._parserName5]", "location": "[parameters('workspace-location')]", "properties": { @@ -3866,7 +4028,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_Cloud_Integrated Data Parser with template version 3.1.0", + "description": "Mimecast_Cloud_Integrated Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject6').parserVersion6]", @@ -3875,7 +4037,7 @@ "resources": [ { "name": "[variables('parserObject6')._parserName6]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { @@ -3940,7 +4102,7 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject6')._parserName6]", "location": "[parameters('workspace-location')]", "properties": { @@ -3998,7 +4160,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_SEG_CG Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Organization Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject7').parserVersion7]", @@ -4007,15 +4169,15 @@ "resources": [ { "name": "[variables('parserObject7')._parserName7]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Cloud Gateway", + "displayName": "Parser for Mimecast Human Risk Organization", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastCG", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", + "functionAlias": "MimecastHumanRiskOrganization", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskOrganization_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Organization_CL\n| extend\n Month = tostring(column_ifexists('Month', '')),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n HumanRiskScoreTrend = toint(column_ifexists('HumanRiskScoreTrend', int(null))),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTrend = toint(column_ifexists('AttackTrend', int(null))),\n AttackTotal = toint(column_ifexists('AttackTotal', int(null))),\n RiskResponses = toint(column_ifexists('RiskResponses', int(null))),\n TotalActions = toint(column_ifexists('TotalActions', int(null))),\n Notifications = toint(column_ifexists('Notifications', int(null))),\n OutboundActions = toint(column_ifexists('OutboundActions', int(null))),\n GroupChanges = toint(column_ifexists('GroupChanges', int(null)))\n| extend\n RecordType = iff(isempty(Month), 'Totals', 'Monthly'),\n MonthStart = todatetime(strcat(Month, '-01')),\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor)\n| project\n TimeGenerated,\n RecordType,\n Month,\n MonthStart,\n HumanRiskScore,\n HumanRiskFactor,\n HumanRiskScoreTrend,\n AttackScore,\n AttackFactor,\n AttackTrend,\n AttackTotal,\n RiskResponses,\n TotalActions,\n Notifications,\n OutboundActions,\n GroupChanges,\n HumanRiskFactorLabel,\n AttackFactorLabel\n};\nMimecastHumanRiskOrganization_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4034,7 +4196,7 @@ "[variables('parserObject7')._parserId7]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskOrganization')]", "contentId": "[variables('parserObject7').parserContentId7]", "kind": "Parser", "version": "[variables('parserObject7').parserVersion7]", @@ -4064,23 +4226,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject7').parserContentId7]", "contentKind": "Parser", - "displayName": "Parser for Mimecast SEG Cloud Gateway", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Organization", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject7').parserContentId7,'-', '1.1.0')))]", "version": "[variables('parserObject7').parserVersion7]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject7')._parserName7]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Cloud Gateway", + "displayName": "Parser for Mimecast Human Risk Organization", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastCG", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", + "functionAlias": "MimecastHumanRiskOrganization", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskOrganization_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Organization_CL\n| extend\n Month = tostring(column_ifexists('Month', '')),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n HumanRiskScoreTrend = toint(column_ifexists('HumanRiskScoreTrend', int(null))),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTrend = toint(column_ifexists('AttackTrend', int(null))),\n AttackTotal = toint(column_ifexists('AttackTotal', int(null))),\n RiskResponses = toint(column_ifexists('RiskResponses', int(null))),\n TotalActions = toint(column_ifexists('TotalActions', int(null))),\n Notifications = toint(column_ifexists('Notifications', int(null))),\n OutboundActions = toint(column_ifexists('OutboundActions', int(null))),\n GroupChanges = toint(column_ifexists('GroupChanges', int(null)))\n| extend\n RecordType = iff(isempty(Month), 'Totals', 'Monthly'),\n MonthStart = todatetime(strcat(Month, '-01')),\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor)\n| project\n TimeGenerated,\n RecordType,\n Month,\n MonthStart,\n HumanRiskScore,\n HumanRiskFactor,\n HumanRiskScoreTrend,\n AttackScore,\n AttackFactor,\n AttackTrend,\n AttackTotal,\n RiskResponses,\n TotalActions,\n Notifications,\n OutboundActions,\n GroupChanges,\n HumanRiskFactorLabel,\n AttackFactorLabel\n};\nMimecastHumanRiskOrganization_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4100,7 +4262,7 @@ "[variables('parserObject7')._parserId7]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskOrganization')]", "contentId": "[variables('parserObject7').parserContentId7]", "kind": "Parser", "version": "[variables('parserObject7').parserVersion7]", @@ -4130,7 +4292,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_SEG_DLP Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Behaviors Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject8').parserVersion8]", @@ -4139,15 +4301,15 @@ "resources": [ { "name": "[variables('parserObject8')._parserName8]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "displayName": "Parser for Mimecast Human Risk Behaviors", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastDLP", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionAlias": "MimecastHumanRiskBehaviors", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskBehaviors_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Behaviors_CL\n| extend\n BehaviorType = tostring(column_ifexists('BehaviorType', '')),\n Score = toint(column_ifexists('Score', int(null))),\n Factor = tostring(column_ifexists('Factor', '')),\n EventCount = toint(column_ifexists('EventCount', int(null))),\n Trend = toint(column_ifexists('Trend', int(null))),\n Events = todynamic(column_ifexists('Events', dynamic(null)))\n| extend\n BehaviorName = case(BehaviorType == 'training', 'Training', BehaviorType == 'simulatedPhishing', 'Simulated Phishing', BehaviorType == 'actualPhishing', 'Actual Phishing', BehaviorType == 'malware', 'Malware', BehaviorType == 'sensitiveDataHandling', 'Sensitive Data Handling', BehaviorType),\n FactorLabel = FactorLabel(Factor),\n EventAssigned = toint(Events.assigned),\n EventCompleted = toint(Events.completed),\n EventOverdue = toint(Events.overdue),\n EventDelivered = toint(Events.delivered),\n EventOpened = toint(Events.opened),\n EventClicked = toint(Events.clicked),\n EventReported = toint(Events.reported),\n EventSubmittedData = toint(Events.submittedData),\n EventAttachmentOpened = toint(Events.attachmentOpened),\n EventBlocked = toint(Events.blocked),\n EventRemediated = toint(Events.remediated),\n EventFalsePositiveRemediated = toint(Events.falsePositiveRemediated),\n EventAttachmentDownloaded = toint(Events.attachmentDownloaded),\n EventDownloadAttempted = toint(Events.downloadAttempted),\n EventDownloaded = toint(Events.downloaded),\n EventExecuted = toint(Events.executed),\n EventUnknown = toint(Events.unknown),\n EventProperlyHandled = toint(Events.properlyHandled),\n EventImproperlyHandled = toint(Events.improperlyHandled)\n| project\n TimeGenerated,\n BehaviorType,\n BehaviorName,\n Score,\n Factor,\n FactorLabel,\n EventCount,\n Trend,\n Events,\n EventAssigned,\n EventCompleted,\n EventOverdue,\n EventDelivered,\n EventOpened,\n EventClicked,\n EventReported,\n EventSubmittedData,\n EventAttachmentOpened,\n EventBlocked,\n EventRemediated,\n EventFalsePositiveRemediated,\n EventAttachmentDownloaded,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventProperlyHandled,\n EventImproperlyHandled\n};\nMimecastHumanRiskBehaviors_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4166,7 +4328,7 @@ "[variables('parserObject8')._parserId8]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskBehaviors')]", "contentId": "[variables('parserObject8').parserContentId8]", "kind": "Parser", "version": "[variables('parserObject8').parserVersion8]", @@ -4196,23 +4358,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject8').parserContentId8]", "contentKind": "Parser", - "displayName": "Parser for Mimecast SEG Data Leak Prevention", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Behaviors", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject8').parserContentId8,'-', '1.1.0')))]", "version": "[variables('parserObject8').parserVersion8]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject8')._parserName8]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "displayName": "Parser for Mimecast Human Risk Behaviors", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastDLP", - "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionAlias": "MimecastHumanRiskBehaviors", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskBehaviors_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Behaviors_CL\n| extend\n BehaviorType = tostring(column_ifexists('BehaviorType', '')),\n Score = toint(column_ifexists('Score', int(null))),\n Factor = tostring(column_ifexists('Factor', '')),\n EventCount = toint(column_ifexists('EventCount', int(null))),\n Trend = toint(column_ifexists('Trend', int(null))),\n Events = todynamic(column_ifexists('Events', dynamic(null)))\n| extend\n BehaviorName = case(BehaviorType == 'training', 'Training', BehaviorType == 'simulatedPhishing', 'Simulated Phishing', BehaviorType == 'actualPhishing', 'Actual Phishing', BehaviorType == 'malware', 'Malware', BehaviorType == 'sensitiveDataHandling', 'Sensitive Data Handling', BehaviorType),\n FactorLabel = FactorLabel(Factor),\n EventAssigned = toint(Events.assigned),\n EventCompleted = toint(Events.completed),\n EventOverdue = toint(Events.overdue),\n EventDelivered = toint(Events.delivered),\n EventOpened = toint(Events.opened),\n EventClicked = toint(Events.clicked),\n EventReported = toint(Events.reported),\n EventSubmittedData = toint(Events.submittedData),\n EventAttachmentOpened = toint(Events.attachmentOpened),\n EventBlocked = toint(Events.blocked),\n EventRemediated = toint(Events.remediated),\n EventFalsePositiveRemediated = toint(Events.falsePositiveRemediated),\n EventAttachmentDownloaded = toint(Events.attachmentDownloaded),\n EventDownloadAttempted = toint(Events.downloadAttempted),\n EventDownloaded = toint(Events.downloaded),\n EventExecuted = toint(Events.executed),\n EventUnknown = toint(Events.unknown),\n EventProperlyHandled = toint(Events.properlyHandled),\n EventImproperlyHandled = toint(Events.improperlyHandled)\n| project\n TimeGenerated,\n BehaviorType,\n BehaviorName,\n Score,\n Factor,\n FactorLabel,\n EventCount,\n Trend,\n Events,\n EventAssigned,\n EventCompleted,\n EventOverdue,\n EventDelivered,\n EventOpened,\n EventClicked,\n EventReported,\n EventSubmittedData,\n EventAttachmentOpened,\n EventBlocked,\n EventRemediated,\n EventFalsePositiveRemediated,\n EventAttachmentDownloaded,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventProperlyHandled,\n EventImproperlyHandled\n};\nMimecastHumanRiskBehaviors_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4232,7 +4394,7 @@ "[variables('parserObject8')._parserId8]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskBehaviors')]", "contentId": "[variables('parserObject8').parserContentId8]", "kind": "Parser", "version": "[variables('parserObject8').parserVersion8]", @@ -4262,7 +4424,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Attachment Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Attacks Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject9').parserVersion9]", @@ -4271,15 +4433,15 @@ "resources": [ { "name": "[variables('parserObject9')._parserName9]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP ATTACHMENT", + "displayName": "Parser for Mimecast Human Risk Attacks", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPAttachment", - "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionAlias": "MimecastHumanRiskAttacks", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskAttacks_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Attacks_CL\n| extend\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTypes = todynamic(column_ifexists('AttackTypes', dynamic(null)))\n| extend AttackTypesRaw = iff(gettype(AttackTypes) != 'array' or array_length(AttackTypes) == 0, dynamic([{}]), AttackTypes)\n| mv-expand AttackTypeItem = AttackTypesRaw\n| extend\n AttackFactorLabel = FactorLabel(AttackFactor),\n AttackType = tostring(AttackTypeItem.type),\n AttackTypeTotal = toint(AttackTypeItem.attackTotal),\n AttackTypeScore = toint(AttackTypeItem.attackScore),\n AttackTypeFactor = tostring(AttackTypeItem.attackFactor),\n AttackTypeTrend = toint(AttackTypeItem.trend),\n AttackTypeEvents = AttackTypeItem.events,\n EventDelivered = toint(AttackTypeItem.events.delivered),\n EventBlocked = toint(AttackTypeItem.events.blocked),\n EventRemediated = toint(AttackTypeItem.events.remediated),\n EventDownloadAttempted = toint(AttackTypeItem.events.downloadAttempted),\n EventDownloaded = toint(AttackTypeItem.events.downloaded),\n EventExecuted = toint(AttackTypeItem.events.executed),\n EventUnknown = toint(AttackTypeItem.events.unknown),\n EventAnomalous = toint(AttackTypeItem.events.anomalous),\n EventSuspicious = toint(AttackTypeItem.events.suspicious),\n EventMalicious = toint(AttackTypeItem.events.malicious),\n EventReported = toint(AttackTypeItem.events.reported)\n| extend\n AttackTypeName = case(AttackType == 'actualPhishing', 'Actual Phishing', AttackType == 'malware', 'Malware', AttackType == 'identity', 'Identity', AttackType),\n AttackTypeFactorLabel = FactorLabel(AttackTypeFactor)\n| project\n TimeGenerated,\n AttackScore,\n AttackFactor,\n AttackFactorLabel,\n AttackType,\n AttackTypeName,\n AttackTypeTotal,\n AttackTypeScore,\n AttackTypeFactor,\n AttackTypeFactorLabel,\n AttackTypeTrend,\n AttackTypeEvents,\n EventDelivered,\n EventBlocked,\n EventRemediated,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventAnomalous,\n EventSuspicious,\n EventMalicious,\n EventReported,\n AttackTypes\n};\nMimecastHumanRiskAttacks_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4298,7 +4460,7 @@ "[variables('parserObject9')._parserId9]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskAttacks')]", "contentId": "[variables('parserObject9').parserContentId9]", "kind": "Parser", "version": "[variables('parserObject9').parserVersion9]", @@ -4328,23 +4490,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject9').parserContentId9]", "contentKind": "Parser", - "displayName": "Parser for Mimecast TTP ATTACHMENT", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Attacks", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject9').parserContentId9,'-', '1.1.0')))]", "version": "[variables('parserObject9').parserVersion9]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject9')._parserName9]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP ATTACHMENT", + "displayName": "Parser for Mimecast Human Risk Attacks", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPAttachment", - "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionAlias": "MimecastHumanRiskAttacks", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskAttacks_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Attacks_CL\n| extend\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n AttackTypes = todynamic(column_ifexists('AttackTypes', dynamic(null)))\n| extend AttackTypesRaw = iff(gettype(AttackTypes) != 'array' or array_length(AttackTypes) == 0, dynamic([{}]), AttackTypes)\n| mv-expand AttackTypeItem = AttackTypesRaw\n| extend\n AttackFactorLabel = FactorLabel(AttackFactor),\n AttackType = tostring(AttackTypeItem.type),\n AttackTypeTotal = toint(AttackTypeItem.attackTotal),\n AttackTypeScore = toint(AttackTypeItem.attackScore),\n AttackTypeFactor = tostring(AttackTypeItem.attackFactor),\n AttackTypeTrend = toint(AttackTypeItem.trend),\n AttackTypeEvents = AttackTypeItem.events,\n EventDelivered = toint(AttackTypeItem.events.delivered),\n EventBlocked = toint(AttackTypeItem.events.blocked),\n EventRemediated = toint(AttackTypeItem.events.remediated),\n EventDownloadAttempted = toint(AttackTypeItem.events.downloadAttempted),\n EventDownloaded = toint(AttackTypeItem.events.downloaded),\n EventExecuted = toint(AttackTypeItem.events.executed),\n EventUnknown = toint(AttackTypeItem.events.unknown),\n EventAnomalous = toint(AttackTypeItem.events.anomalous),\n EventSuspicious = toint(AttackTypeItem.events.suspicious),\n EventMalicious = toint(AttackTypeItem.events.malicious),\n EventReported = toint(AttackTypeItem.events.reported)\n| extend\n AttackTypeName = case(AttackType == 'actualPhishing', 'Actual Phishing', AttackType == 'malware', 'Malware', AttackType == 'identity', 'Identity', AttackType),\n AttackTypeFactorLabel = FactorLabel(AttackTypeFactor)\n| project\n TimeGenerated,\n AttackScore,\n AttackFactor,\n AttackFactorLabel,\n AttackType,\n AttackTypeName,\n AttackTypeTotal,\n AttackTypeScore,\n AttackTypeFactor,\n AttackTypeFactorLabel,\n AttackTypeTrend,\n AttackTypeEvents,\n EventDelivered,\n EventBlocked,\n EventRemediated,\n EventDownloadAttempted,\n EventDownloaded,\n EventExecuted,\n EventUnknown,\n EventAnomalous,\n EventSuspicious,\n EventMalicious,\n EventReported,\n AttackTypes\n};\nMimecastHumanRiskAttacks_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4364,7 +4526,7 @@ "[variables('parserObject9')._parserId9]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskAttacks')]", "contentId": "[variables('parserObject9').parserContentId9]", "kind": "Parser", "version": "[variables('parserObject9').parserVersion9]", @@ -4394,7 +4556,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Impersonation Data Parser with template version 3.1.0", + "description": "Mimecast_HumanRisk_Individuals Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject10').parserVersion10]", @@ -4403,15 +4565,15 @@ "resources": [ { "name": "[variables('parserObject10')._parserName10]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP Impersonation", + "displayName": "Parser for Mimecast Human Risk Individuals", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPImpersonation", - "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionAlias": "MimecastHumanRiskIndividuals", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskIndividuals_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Individuals_CL\n| extend\n IndividualId = tostring(column_ifexists('IndividualId', '')),\n DisplayName = tostring(column_ifexists('DisplayName', '')),\n EmailAddress = tostring(column_ifexists('EmailAddress', '')),\n FirstName = tostring(column_ifexists('FirstName', '')),\n LastName = tostring(column_ifexists('LastName', '')),\n ManagerName = tostring(column_ifexists('ManagerName', '')),\n ManagerId = tostring(column_ifexists('ManagerId', '')),\n Department = tostring(column_ifexists('Department', '')),\n Location = tostring(column_ifexists('Location', '')),\n JobTitle = tostring(column_ifexists('JobTitle', '')),\n TenureMonths = toint(column_ifexists('TenureMonths', int(null))),\n TenureStatus = tostring(column_ifexists('TenureStatus', '')),\n StartDateTime = todatetime(column_ifexists('StartDateTime', datetime(null))),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n Behaviors = todynamic(column_ifexists('Behaviors', dynamic(null))),\n Attacks = todynamic(column_ifexists('Attacks', dynamic(null)))\n| extend\n BehaviorsSrc = iff(gettype(Behaviors) != 'array' or array_length(Behaviors) == 0, dynamic([{}]), Behaviors),\n AttacksSrc = iff(gettype(Attacks) != 'array' or array_length(Attacks) == 0, dynamic([{}]), Attacks)\n| mv-apply b = BehaviorsSrc on (summarize Bhv = make_bag(bag_pack(coalesce(tostring(b.type), 'none'), b)))\n| mv-apply a = AttacksSrc on (summarize Atk = make_bag(bag_pack(coalesce(tostring(a.type), 'none'), a)))\n| extend\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor),\n SimulatedPhishingScore = toint(Bhv.simulatedPhishing.score),\n SimulatedPhishingFactor = tostring(Bhv.simulatedPhishing.factor),\n SimulatedPhishingTrend = toint(Bhv.simulatedPhishing.trend),\n SimulatedPhishingEventCount = toint(Bhv.simulatedPhishing.eventCount),\n SimulatedPhishingEvents = Bhv.simulatedPhishing.events,\n ActualPhishingScore = toint(Bhv.actualPhishing.score),\n ActualPhishingFactor = tostring(Bhv.actualPhishing.factor),\n ActualPhishingTrend = toint(Bhv.actualPhishing.trend),\n ActualPhishingEventCount = toint(Bhv.actualPhishing.eventCount),\n ActualPhishingEvents = Bhv.actualPhishing.events,\n TrainingScore = toint(Bhv.training.score),\n TrainingFactor = tostring(Bhv.training.factor),\n TrainingTrend = toint(Bhv.training.trend),\n TrainingEventCount = toint(Bhv.training.eventCount),\n TrainingEvents = Bhv.training.events,\n MalwareScore = toint(Bhv.malware.score),\n MalwareFactor = tostring(Bhv.malware.factor),\n MalwareTrend = toint(Bhv.malware.trend),\n MalwareEventCount = toint(Bhv.malware.eventCount),\n MalwareEvents = Bhv.malware.events,\n SensitiveDataHandlingScore = toint(Bhv.sensitiveDataHandling.score),\n SensitiveDataHandlingFactor = tostring(Bhv.sensitiveDataHandling.factor),\n SensitiveDataHandlingTrend = toint(Bhv.sensitiveDataHandling.trend),\n SensitiveDataHandlingEventCount = toint(Bhv.sensitiveDataHandling.eventCount),\n SensitiveDataHandlingEvents = Bhv.sensitiveDataHandling.events,\n ActualPhishingAttackScore = toint(Atk.actualPhishing.score),\n ActualPhishingAttackFactor = tostring(Atk.actualPhishing.factor),\n ActualPhishingAttackTrend = toint(Atk.actualPhishing.trend),\n ActualPhishingAttackEventCount = toint(Atk.actualPhishing.eventCount),\n ActualPhishingAttackEvents = Atk.actualPhishing.events,\n MalwareAttackScore = toint(Atk.malware.score),\n MalwareAttackFactor = tostring(Atk.malware.factor),\n MalwareAttackTrend = toint(Atk.malware.trend),\n MalwareAttackEventCount = toint(Atk.malware.eventCount),\n MalwareAttackEvents = Atk.malware.events,\n IdentityAttackScore = toint(Atk.identity.score),\n IdentityAttackFactor = tostring(Atk.identity.factor),\n IdentityAttackTrend = toint(Atk.identity.trend),\n IdentityAttackEventCount = toint(Atk.identity.eventCount),\n IdentityAttackEvents = Atk.identity.events\n| project\n TimeGenerated,\n IndividualId,\n DisplayName,\n EmailAddress,\n FirstName,\n LastName,\n ManagerName,\n ManagerId,\n Department,\n Location,\n JobTitle,\n TenureMonths,\n TenureStatus,\n StartDateTime,\n HumanRiskScore,\n HumanRiskFactor,\n AttackScore,\n AttackFactor,\n HumanRiskFactorLabel,\n AttackFactorLabel,\n SimulatedPhishingScore,\n SimulatedPhishingFactor,\n SimulatedPhishingTrend,\n SimulatedPhishingEventCount,\n SimulatedPhishingEvents,\n ActualPhishingScore,\n ActualPhishingFactor,\n ActualPhishingTrend,\n ActualPhishingEventCount,\n ActualPhishingEvents,\n TrainingScore,\n TrainingFactor,\n TrainingTrend,\n TrainingEventCount,\n TrainingEvents,\n MalwareScore,\n MalwareFactor,\n MalwareTrend,\n MalwareEventCount,\n MalwareEvents,\n SensitiveDataHandlingScore,\n SensitiveDataHandlingFactor,\n SensitiveDataHandlingTrend,\n SensitiveDataHandlingEventCount,\n SensitiveDataHandlingEvents,\n ActualPhishingAttackScore,\n ActualPhishingAttackFactor,\n ActualPhishingAttackTrend,\n ActualPhishingAttackEventCount,\n ActualPhishingAttackEvents,\n MalwareAttackScore,\n MalwareAttackFactor,\n MalwareAttackTrend,\n MalwareAttackEventCount,\n MalwareAttackEvents,\n IdentityAttackScore,\n IdentityAttackFactor,\n IdentityAttackTrend,\n IdentityAttackEventCount,\n IdentityAttackEvents,\n Behaviors,\n Attacks\n};\nMimecastHumanRiskIndividuals_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4430,7 +4592,7 @@ "[variables('parserObject10')._parserId10]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskIndividuals')]", "contentId": "[variables('parserObject10').parserContentId10]", "kind": "Parser", "version": "[variables('parserObject10').parserVersion10]", @@ -4460,23 +4622,23 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject10').parserContentId10]", "contentKind": "Parser", - "displayName": "Parser for Mimecast TTP Impersonation", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.0.1')))]", - "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.0.1')))]", + "displayName": "Parser for Mimecast Human Risk Individuals", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.1.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject10').parserContentId10,'-', '1.1.0')))]", "version": "[variables('parserObject10').parserVersion10]" } }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject10')._parserName10]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP Impersonation", + "displayName": "Parser for Mimecast Human Risk Individuals", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPImpersonation", - "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionAlias": "MimecastHumanRiskIndividuals", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') };\nlet MimecastHumanRiskIndividuals_view = view() {\nunion isfuzzy=true\n dummy_table,\n MimecastHumanRisk_Individuals_CL\n| extend\n IndividualId = tostring(column_ifexists('IndividualId', '')),\n DisplayName = tostring(column_ifexists('DisplayName', '')),\n EmailAddress = tostring(column_ifexists('EmailAddress', '')),\n FirstName = tostring(column_ifexists('FirstName', '')),\n LastName = tostring(column_ifexists('LastName', '')),\n ManagerName = tostring(column_ifexists('ManagerName', '')),\n ManagerId = tostring(column_ifexists('ManagerId', '')),\n Department = tostring(column_ifexists('Department', '')),\n Location = tostring(column_ifexists('Location', '')),\n JobTitle = tostring(column_ifexists('JobTitle', '')),\n TenureMonths = toint(column_ifexists('TenureMonths', int(null))),\n TenureStatus = tostring(column_ifexists('TenureStatus', '')),\n StartDateTime = todatetime(column_ifexists('StartDateTime', datetime(null))),\n HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))),\n HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')),\n AttackScore = toint(column_ifexists('AttackScore', int(null))),\n AttackFactor = tostring(column_ifexists('AttackFactor', '')),\n Behaviors = todynamic(column_ifexists('Behaviors', dynamic(null))),\n Attacks = todynamic(column_ifexists('Attacks', dynamic(null)))\n| extend\n BehaviorsSrc = iff(gettype(Behaviors) != 'array' or array_length(Behaviors) == 0, dynamic([{}]), Behaviors),\n AttacksSrc = iff(gettype(Attacks) != 'array' or array_length(Attacks) == 0, dynamic([{}]), Attacks)\n| mv-apply b = BehaviorsSrc on (summarize Bhv = make_bag(bag_pack(coalesce(tostring(b.type), 'none'), b)))\n| mv-apply a = AttacksSrc on (summarize Atk = make_bag(bag_pack(coalesce(tostring(a.type), 'none'), a)))\n| extend\n HumanRiskFactorLabel = FactorLabel(HumanRiskFactor),\n AttackFactorLabel = FactorLabel(AttackFactor),\n SimulatedPhishingScore = toint(Bhv.simulatedPhishing.score),\n SimulatedPhishingFactor = tostring(Bhv.simulatedPhishing.factor),\n SimulatedPhishingTrend = toint(Bhv.simulatedPhishing.trend),\n SimulatedPhishingEventCount = toint(Bhv.simulatedPhishing.eventCount),\n SimulatedPhishingEvents = Bhv.simulatedPhishing.events,\n ActualPhishingScore = toint(Bhv.actualPhishing.score),\n ActualPhishingFactor = tostring(Bhv.actualPhishing.factor),\n ActualPhishingTrend = toint(Bhv.actualPhishing.trend),\n ActualPhishingEventCount = toint(Bhv.actualPhishing.eventCount),\n ActualPhishingEvents = Bhv.actualPhishing.events,\n TrainingScore = toint(Bhv.training.score),\n TrainingFactor = tostring(Bhv.training.factor),\n TrainingTrend = toint(Bhv.training.trend),\n TrainingEventCount = toint(Bhv.training.eventCount),\n TrainingEvents = Bhv.training.events,\n MalwareScore = toint(Bhv.malware.score),\n MalwareFactor = tostring(Bhv.malware.factor),\n MalwareTrend = toint(Bhv.malware.trend),\n MalwareEventCount = toint(Bhv.malware.eventCount),\n MalwareEvents = Bhv.malware.events,\n SensitiveDataHandlingScore = toint(Bhv.sensitiveDataHandling.score),\n SensitiveDataHandlingFactor = tostring(Bhv.sensitiveDataHandling.factor),\n SensitiveDataHandlingTrend = toint(Bhv.sensitiveDataHandling.trend),\n SensitiveDataHandlingEventCount = toint(Bhv.sensitiveDataHandling.eventCount),\n SensitiveDataHandlingEvents = Bhv.sensitiveDataHandling.events,\n ActualPhishingAttackScore = toint(Atk.actualPhishing.score),\n ActualPhishingAttackFactor = tostring(Atk.actualPhishing.factor),\n ActualPhishingAttackTrend = toint(Atk.actualPhishing.trend),\n ActualPhishingAttackEventCount = toint(Atk.actualPhishing.eventCount),\n ActualPhishingAttackEvents = Atk.actualPhishing.events,\n MalwareAttackScore = toint(Atk.malware.score),\n MalwareAttackFactor = tostring(Atk.malware.factor),\n MalwareAttackTrend = toint(Atk.malware.trend),\n MalwareAttackEventCount = toint(Atk.malware.eventCount),\n MalwareAttackEvents = Atk.malware.events,\n IdentityAttackScore = toint(Atk.identity.score),\n IdentityAttackFactor = tostring(Atk.identity.factor),\n IdentityAttackTrend = toint(Atk.identity.trend),\n IdentityAttackEventCount = toint(Atk.identity.eventCount),\n IdentityAttackEvents = Atk.identity.events\n| project\n TimeGenerated,\n IndividualId,\n DisplayName,\n EmailAddress,\n FirstName,\n LastName,\n ManagerName,\n ManagerId,\n Department,\n Location,\n JobTitle,\n TenureMonths,\n TenureStatus,\n StartDateTime,\n HumanRiskScore,\n HumanRiskFactor,\n AttackScore,\n AttackFactor,\n HumanRiskFactorLabel,\n AttackFactorLabel,\n SimulatedPhishingScore,\n SimulatedPhishingFactor,\n SimulatedPhishingTrend,\n SimulatedPhishingEventCount,\n SimulatedPhishingEvents,\n ActualPhishingScore,\n ActualPhishingFactor,\n ActualPhishingTrend,\n ActualPhishingEventCount,\n ActualPhishingEvents,\n TrainingScore,\n TrainingFactor,\n TrainingTrend,\n TrainingEventCount,\n TrainingEvents,\n MalwareScore,\n MalwareFactor,\n MalwareTrend,\n MalwareEventCount,\n MalwareEvents,\n SensitiveDataHandlingScore,\n SensitiveDataHandlingFactor,\n SensitiveDataHandlingTrend,\n SensitiveDataHandlingEventCount,\n SensitiveDataHandlingEvents,\n ActualPhishingAttackScore,\n ActualPhishingAttackFactor,\n ActualPhishingAttackTrend,\n ActualPhishingAttackEventCount,\n ActualPhishingAttackEvents,\n MalwareAttackScore,\n MalwareAttackFactor,\n MalwareAttackTrend,\n MalwareAttackEventCount,\n MalwareAttackEvents,\n IdentityAttackScore,\n IdentityAttackFactor,\n IdentityAttackTrend,\n IdentityAttackEventCount,\n IdentityAttackEvents,\n Behaviors,\n Attacks\n};\nMimecastHumanRiskIndividuals_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4496,7 +4658,7 @@ "[variables('parserObject10')._parserId10]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastHumanRiskIndividuals')]", "contentId": "[variables('parserObject10').parserContentId10]", "kind": "Parser", "version": "[variables('parserObject10').parserVersion10]", @@ -4526,7 +4688,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast_TTP_Url Data Parser with template version 3.1.0", + "description": "Mimecast_SEG_CG Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject11').parserVersion11]", @@ -4535,15 +4697,15 @@ "resources": [ { "name": "[variables('parserObject11')._parserName11]", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP URL", + "displayName": "Parser for Mimecast SEG Cloud Gateway", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPUrl", - "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionAlias": "MimecastCG", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4562,7 +4724,7 @@ "[variables('parserObject11')._parserId11]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", "contentId": "[variables('parserObject11').parserContentId11]", "kind": "Parser", "version": "[variables('parserObject11').parserVersion11]", @@ -4592,7 +4754,7 @@ "contentSchemaVersion": "3.0.0", "contentId": "[variables('parserObject11').parserContentId11]", "contentKind": "Parser", - "displayName": "Parser for Mimecast TTP URL", + "displayName": "Parser for Mimecast SEG Cloud Gateway", "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.0.1')))]", "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject11').parserContentId11,'-', '1.0.1')))]", "version": "[variables('parserObject11').parserVersion11]" @@ -4600,15 +4762,15 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-10-01", + "apiVersion": "2025-07-01", "name": "[variables('parserObject11')._parserName11]", "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "Parser for Mimecast TTP URL", + "displayName": "Parser for Mimecast SEG Cloud Gateway", "category": "Microsoft Sentinel Parser", - "functionAlias": "MimecastTTPUrl", - "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionAlias": "MimecastCG", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastCG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Cg_CL\n| extend \n [\"Time Generated\"] = column_ifexists(\"TimeGenerated\", \"\"),\n [\"Url Category\"] = column_ifexists(\"urlCategory\", \"\"),\n [\"Scan Results\"] = column_ifexists(\"scanResults\", \"\"),\n [\"File Name\"] = column_ifexists(\"fileName\", \"\"),\n [\"Sha256\"] = column_ifexists(\"sha256\", \"\"),\n [\"File Extension\"] = column_ifexists(\"fileExtension\", \"\"),\n [\"Virus Found\"] = column_ifexists(\"virusFound\", \"\"),\n [\"Sha1\"] = column_ifexists(\"sha1\", \"\"),\n [\"Sender Domain\"] = column_ifexists(\"senderDomain\", \"\"),\n [\"Md5\"] = column_ifexists(\"md5\", \"\"),\n [\"Custom Threat Dictionary\"] = column_ifexists(\"customThreatDictionary\", \"\"),\n [\"Items Detected\"] = column_ifexists(\"itemsDetected\", \"\"),\n [\"Similar Custom External Domain\"] = column_ifexists(\"similarCustomExternalDomain\", \"\"),\n [\"Tagged External\"] = column_ifexists(\"taggedExternal\", \"\"),\n [\"Similar Internal Domain\"] = column_ifexists(\"similarInternalDomain\", \"\"),\n [\"New Domain\"] = column_ifexists(\"newDomain\", \"\"),\n [\"Internal User Name\"] = column_ifexists(\"internalUserName\", \"\"),\n [\"Mimecast Threat Dictionary\"] = column_ifexists(\"mimecastThreatDictionary\", \"\"),\n [\"Similar Mimecast External Domain\"] = column_ifexists(\"similarMimecastExternalDomain\", \"\"),\n [\"Custom Name Match\"] = column_ifexists(\"customNameMatch\", \"\"),\n [\"Tagged Malicious\"] = column_ifexists(\"taggedMalicious\", \"\"),\n [\"Reply Mismatch\"] = column_ifexists(\"replyMismatch\", \"\"),\n [\"Aggregate ID S\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Aggregate ID G\"] = column_ifexists(\"aggregateId\", \"\"),\n [\"Rejection Type\"] = column_ifexists(\"rejectionType\", \"\"),\n [\"Rejection Code\"] = column_ifexists(\"rejectionCode\", \"\"),\n [\"Rejection Info\"] = column_ifexists(\"rejectionInfo\", \"\"),\n [\"Delivered\"] = column_ifexists(\"delivered\", \"\"),\n [\"Destination IP\"] = column_ifexists(\"destinationIp\", \"\"),\n [\"Host Name\"] = column_ifexists(\"Hostname\", \"\"),\n [\"Delivery Attempts\"] = column_ifexists(\"deliveryAttempts\", \"\"),\n [\"TLS Used\"] = column_ifexists(\"tlsUsed\", \"\"),\n [\"Delivery Errors\"] = column_ifexists(\"deliveryErrors\", \"\"),\n [\"Attachments\"] = column_ifexists(\"attachments\", \"\"),\n [\"Route\"] = column_ifexists(\"route\", \"\"),\n [\"Processing ID\"] = column_ifexists(\"processingId\", \"\"),\n [\"Account ID\"] = column_ifexists(\"accountId\", \"\"),\n [\"Action\"] = column_ifexists(\"action\", \"\"),\n [\"Event Time\"] = column_ifexists(\"timestamp\", \"\"),\n [\"Sender Envelope\"] = column_ifexists(\"senderEnvelope\", \"\"),\n [\"Message ID\"] = column_ifexists(\"messageId\", \"\"),\n [\"Subject\"] = column_ifexists(\"subject\", \"\"),\n [\"Total of Size Attachments\"] = column_ifexists(\"totalSizeAttachments\", \"\"),\n [\"Number of Attachments\"] = column_ifexists(\"numberAttachments\", \"\"),\n [\"Email Size\"] = column_ifexists(\"emailSize\", \"\"),\n [\"Type\"] = column_ifexists(\"Logtype\", \"\"),\n [\"Sub Type\"] = column_ifexists(\"subtype\", \"\"),\n [\"Monitored Domain Source\"] = column_ifexists(\"monitoredDomainSource\", \"\"),\n [\"Similar Domain\"] = column_ifexists(\"similarDomain\", \"\"),\n [\"Offset\"] = column_ifexists(\"offset\", \"\"),\n [\"Partition\"] = column_ifexists(\"partition\", \"\"),\n [\"Hold Reason\"] = column_ifexists(\"holdReason\", \"\"),\n [\"Recipients\"] = column_ifexists(\"recipients\", \"\"),\n [\"Sender IP\"] = column_ifexists(\"senderIp\", \"\"),\n [\"Direction\"] = column_ifexists(\"direction\", \"\"),\n [\"Sender Header\"] = column_ifexists(\"senderHeader\", \"\"),\n [\"TLS Version\"] = column_ifexists(\"tlsVersion\", \"\"),\n [\"TLS Cipher\"] = column_ifexists(\"tlsCipher\", \"\"),\n [\"Spam Info\"] = column_ifexists(\"spamInfo\", \"\"),\n [\"Spam Processing Detail\"] = column_ifexists(\"spamProcessingDetail\", \"\")\n| summarize arg_max([\"Time Generated\"], *) by \n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"],\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime(unixtime_milliseconds_todatetime( tolong([\"Event Time\"]) )) )\n| extend ['Message ID'] = trim(@\"[\\<\\>]\", ['Message ID'] )\n| project \n [\"Time Generated\"],\n [\"Url Category\"],\n [\"Scan Results\"],\n [\"File Name\"],\n [\"Sha256\"],\n [\"File Extension\"],\n [\"Virus Found\"],\n [\"Sha1\"],\n [\"Sender Domain\"],\n [\"Md5\"],\n [\"Custom Threat Dictionary\"],\n [\"Items Detected\"],\n [\"Similar Custom External Domain\"],\n [\"Tagged External\"],\n [\"Similar Internal Domain\"],\n [\"New Domain\"],\n [\"Internal User Name\"],\n [\"Mimecast Threat Dictionary\"],\n [\"Similar Mimecast External Domain\"],\n [\"Custom Name Match\"],\n [\"Tagged Malicious\"],\n [\"Reply Mismatch\"],\n [\"Aggregate ID\"] = coalesce([\"Aggregate ID S\"], [\"Aggregate ID G\"]),\n [\"Rejection Type\"],\n [\"Rejection Code\"],\n [\"Rejection Info\"],\n [\"Delivered\"],\n [\"Destination IP\"],\n [\"Host Name\"],\n [\"Delivery Attempts\"],\n [\"TLS Used\"],\n [\"Delivery Errors\"],\n [\"Attachments\"],\n [\"Route\"],\n [\"Processing ID\"],\n [\"Account ID\"],\n [\"Action\"],\n [\"Event Time\"] ,\n [\"Sender Envelope\"],\n [\"Message ID\"],\n [\"Subject\"],\n [\"Total of Size Attachments\"],\n [\"Number of Attachments\"],\n [\"Email Size\"],\n [\"Type\"],\n [\"Sub Type\"],\n [\"Monitored Domain Source\"],\n [\"Similar Domain\"],\n [\"Offset\"],\n [\"Partition\"],\n [\"Hold Reason\"],\n [\"Recipients\"],\n [\"Sender IP\"],\n [\"Direction\"],\n [\"Sender Header\"],\n [\"TLS Version\"],\n [\"TLS Cipher\"],\n [\"Spam Info\"],\n [\"Spam Processing Detail\"]\n};\nMimecastCG_view\n", "functionParameters": "", "version": 2, "tags": [ @@ -4628,7 +4790,7 @@ "[variables('parserObject11')._parserId11]" ], "properties": { - "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastCG')]", "contentId": "[variables('parserObject11').parserContentId11]", "kind": "Parser", "version": "[variables('parserObject11').parserVersion11]", @@ -4652,189 +4814,55 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName1')]", + "name": "[variables('parserObject12').parserTemplateSpecName12]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast_SEG_DLP Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion1')]", + "contentVersion": "[variables('parserObject12').parserVersion12]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[variables('parserObject12')._parserName12]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId1')]", - "title": "Mimecast Awareness Training", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", - "graphQueries": [ - { - "metricName": "Total Performance Details data received", - "legend": "Awareness_Performance_Details_CL", - "baseQuery": "Awareness_Performance_Details_CL" - }, - { - "metricName": "Total Safe Score Details data received", - "legend": "Awareness_SafeScore_Details_CL", - "baseQuery": "Awareness_SafeScore_Details_CL" - }, - { - "metricName": "Total User Data received", - "legend": "Awareness_User_Data_CL", - "baseQuery": "Awareness_User_Data_CL" - }, - { - "metricName": "Total Watchlist Details data received", - "legend": "Awareness_Watchlist_Details_CL", - "baseQuery": "Awareness_Watchlist_Details_CL" - } - ], - "sampleQueries": [ - { - "description": "Awareness_Performance_Details_CL", - "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_SafeScore_Details_CL", - "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_User_Data_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_Watchlist_Details_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - } - ], - "dataTypes": [ - { - "name": "Awareness_Performance_Details_CL", - "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_SafeScore_Details_CL", - "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_User_Data_CL", - "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_Watchlist_Details_CL", - "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ - { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", - "title": "Functions app" - }, - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" - }, - { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" - }, - { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" - }, - { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." - }, - { - "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" - } - ] - } + "eTag": "*", + "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastDLP", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject12')._parserId12,'/'))))]", + "dependsOn": [ + "[variables('parserObject12')._parserId12]" + ], "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "contentId": "[variables('parserObject12').parserContentId12]", + "kind": "Parser", + "version": "[variables('parserObject12').parserVersion12]", "source": { - "kind": "Solution", "name": "Mimecast", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -4856,27 +4884,48 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId1')]", - "contentKind": "DataConnector", - "displayName": "Mimecast Awareness Training", - "contentProductId": "[variables('_dataConnectorcontentProductId1')]", - "id": "[variables('_dataConnectorcontentProductId1')]", - "version": "[variables('dataConnectorVersion1')]" + "contentId": "[variables('parserObject12').parserContentId12]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject12').parserContentId12,'-', '1.0.1')))]", + "version": "[variables('parserObject12').parserVersion12]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject12')._parserName12]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast SEG Data Leak Prevention", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastDLP", + "query": "let dummy_table = datatable(TimeGenerated: datetime) [];\nlet MimecastSEG_view = view() {\nunion isfuzzy=true dummy_table,\nSeg_Dlp_CL\n| extend [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Policy\"] = column_ifexists('policy', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', '')\n| summarize arg_max(TimeGenerated, *) by [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n| extend ['Event Time'] = iff( isempty( ['Event Time']) ,now() , todatetime( tolong([\"Event Time\"]) ) )\n| project [\"Time Generated\"], [\"Sender Address\"], [\"Recipient Address\"], [\"Subject\"], [\"Route\"], [\"Policy\"], [\"Action\"], [\"Event Time\"], [\"Message ID\"]\n};\nMimecastSEG_view\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject12')._parserId12,'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId1')]" + "[variables('parserObject12')._parserId12]" ], - "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", - "contentId": "[variables('_dataConnectorContentId1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion1')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastDLP')]", + "contentId": "[variables('parserObject12').parserContentId12]", + "kind": "Parser", + "version": "[variables('parserObject12').parserVersion12]", "source": { "kind": "Solution", "name": "Mimecast", @@ -4895,303 +4944,189 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('parserObject13').parserTemplateSpecName13]", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "connectorUiConfig": { - "title": "Mimecast Awareness Training", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", - "graphQueries": [ - { - "metricName": "Total Performance Details data received", - "legend": "Awareness_Performance_Details_CL", - "baseQuery": "Awareness_Performance_Details_CL" - }, - { - "metricName": "Total Safe Score Details data received", - "legend": "Awareness_SafeScore_Details_CL", - "baseQuery": "Awareness_SafeScore_Details_CL" - }, + "description": "Mimecast_TTP_Attachment Data Parser with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('parserObject13').parserVersion13]", + "parameters": {}, + "variables": {}, + "resources": [ { - "metricName": "Total User Data received", - "legend": "Awareness_User_Data_CL", - "baseQuery": "Awareness_User_Data_CL" + "name": "[variables('parserObject13')._parserName13]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP ATTACHMENT", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPAttachment", + "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } }, { - "metricName": "Total Watchlist Details data received", - "legend": "Awareness_Watchlist_Details_CL", - "baseQuery": "Awareness_Watchlist_Details_CL" - } - ], - "dataTypes": [ - { - "name": "Awareness_Performance_Details_CL", - "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_SafeScore_Details_CL", - "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_User_Data_CL", - "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Awareness_Watchlist_Details_CL", - "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Awareness_Performance_Details_CL", - "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_SafeScore_Details_CL", - "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_User_Data_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Awareness_Watchlist_Details_CL", - "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject13')._parserId13,'/'))))]", + "dependsOn": [ + "[variables('parserObject13')._parserId13]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "contentId": "[variables('parserObject13').parserContentId13]", + "kind": "Parser", + "version": "[variables('parserObject13').parserVersion13]", + "source": { + "name": "Mimecast", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" } } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ - { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", - "title": "Functions app" - }, - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" - }, - { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" - }, - { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" - }, - { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." - }, - { - "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" } - ], - "id": "[variables('_uiConfigId1')]" + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject13').parserContentId13]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast TTP ATTACHMENT", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject13').parserContentId13,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject13').parserContentId13,'-', '1.0.1')))]", + "version": "[variables('parserObject13').parserVersion13]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject13')._parserName13]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP ATTACHMENT", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPAttachment", + "query": "let dummy_table = datatable(\n TimeGenerated: datetime,\n senderAddress: string,\n recipientAddress: string,\n messageId: string\n) [];\nlet MimecastTTPAttachment = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Attachment_CL\n | summarize arg_max(TimeGenerated, *) by senderAddress, recipientAddress, messageId\n | extend\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_attachment',\n [\"Mimecast Event Category\"] = 'ttp_attachment',\n [\"Action Triggered\"] = column_ifexists('actionTriggered', ''),\n [\"Event Time\"] = column_ifexists('Date', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Details\"] = column_ifexists('details', ''),\n [\"File Hash\"] = column_ifexists('fileHash', ''),\n [\"File Name\"] = column_ifexists('fileName', ''),\n [\"File Type\"] = column_ifexists('fileType', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Result\"] = column_ifexists('result', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Subject\"] = column_ifexists('subject', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"Type\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action Triggered\"],\n [\"Event Time\"],\n [\"Definition\"],\n [\"Details\"],\n [\"File Hash\"],\n [\"File Name\"],\n [\"File Type\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Result\"],\n [\"Route\"],\n [\"Sender Address\"],\n [\"Subject\"] \n};\nMimecastTTPAttachment\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject13')._parserId13,'/'))))]", + "dependsOn": [ + "[variables('parserObject13')._parserId13]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPAttachment')]", + "contentId": "[variables('parserObject13').parserContentId13]", + "kind": "Parser", + "version": "[variables('parserObject13').parserVersion13]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName2')]", + "name": "[variables('parserObject14').parserTemplateSpecName14]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast_TTP_Impersonation Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion2')]", + "contentVersion": "[variables('parserObject14').parserVersion14]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[variables('parserObject14')._parserName14]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId2')]", - "title": "Mimecast Audit", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", - "graphQueries": [ - { - "metricName": "Total Audit data received", - "legend": "Audit_CL", - "baseQuery": "Audit_CL" - } - ], - "sampleQueries": [ - { - "description": "Audit_CL", - "query": "Audit_CL\n| sort by TimeGenerated desc" - } - ], - "dataTypes": [ - { - "name": "Audit_CL", - "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", - "title": "Configuration:" - }, - { - "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." - }, - { - "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" - }, - { - "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" - }, - { - "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" - }, - { - "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Audit Data Connector:" - } - ] - } + "eTag": "*", + "displayName": "Parser for Mimecast TTP Impersonation", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPImpersonation", + "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject14')._parserId14,'/'))))]", + "dependsOn": [ + "[variables('parserObject14')._parserId14]" + ], "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "contentId": "[variables('parserObject14').parserContentId14]", + "kind": "Parser", + "version": "[variables('parserObject14').parserVersion14]", "source": { - "kind": "Solution", "name": "Mimecast", + "kind": "Solution", "sourceId": "[variables('_solutionId')]" }, "author": { @@ -5213,27 +5148,48 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId2')]", - "contentKind": "DataConnector", - "displayName": "Mimecast Audit", - "contentProductId": "[variables('_dataConnectorcontentProductId2')]", - "id": "[variables('_dataConnectorcontentProductId2')]", - "version": "[variables('dataConnectorVersion2')]" + "contentId": "[variables('parserObject14').parserContentId14]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast TTP Impersonation", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject14').parserContentId14,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject14').parserContentId14,'-', '1.0.1')))]", + "version": "[variables('parserObject14').parserVersion14]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject14')._parserName14]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP Impersonation", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPImpersonation", + "query": "let dummy_table = datatable(TimeGenerated: datetime, id: string) [];\nlet MimecastTTPImpersonation = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Impersonation_CL\n | summarize arg_max(TimeGenerated, *) by id\n | extend \n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Mimecast Event ID\"] = 'ttp_impersonation',\n [\"Mimecast Event Category\"] = 'ttp_impersonation',\n [\"Action\"] = column_ifexists('action', ''),\n [\"Definition\"] = column_ifexists('definition', ''),\n [\"Event Time\"] = column_ifexists('eventTime', ''),\n [\"Hits\"] = column_ifexists('hits', ''),\n [\"ID\"] = column_ifexists('id', ''),\n [\"Identifiers\"] = column_ifexists('identifiers', ''),\n [\"Impersonation Results\"] = column_ifexists('impersonationResults', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Recipient Address\"] = column_ifexists('recipientAddress', ''),\n [\"Sender Address\"] = column_ifexists('senderAddress', ''),\n [\"Sender IP Address\"] = column_ifexists('senderIpAddress', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Tagged External\"] = column_ifexists('taggedExternal', ''),\n [\"Tagged Malicious\"] = column_ifexists('taggedMalicious', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Time Generated\"],\n [\"ID\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"Action\"],\n [\"Definition\"],\n [\"Event Time\"],\n [\"Hits\"],\n [\"Identifiers\"],\n [\"Impersonation Results\"],\n [\"Message ID\"],\n [\"Recipient Address\"],\n [\"Sender Address\"],\n [\"Sender IP Address\"],\n [\"Subject\"],\n [\"Tagged External\"],\n [\"Tagged Malicious\"],\n [\"Type\"] \n};\nMimecastTTPImpersonation\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject14')._parserId14,'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId2')]" + "[variables('parserObject14')._parserId14]" ], - "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", - "contentId": "[variables('_dataConnectorContentId2')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion2')]", + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPImpersonation')]", + "contentId": "[variables('parserObject14').parserContentId14]", + "kind": "Parser", + "version": "[variables('parserObject14').parserVersion14]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5251,170 +5207,232 @@ } } }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "GenericUI", - "properties": { - "connectorUiConfig": { - "title": "Mimecast Audit", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", - "graphQueries": [ - { - "metricName": "Total Audit data received", - "legend": "Audit_CL", - "baseQuery": "Audit_CL" - } - ], - "dataTypes": [ - { - "name": "Audit_CL", - "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ - { - "description": "Audit_CL", - "query": "Audit_CL\n| sort by TimeGenerated desc" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ - { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, - { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, - { - "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", - "title": "Configuration:" - }, - { - "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." - }, - { - "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" - }, - { - "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" - }, - { - "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" - }, - { - "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Audit Data Connector:" - } - ], - "id": "[variables('_uiConfigId2')]" - } - } - }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName3')]", + "name": "[variables('parserObject15').parserTemplateSpecName15]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast_TTP_Url Data Parser with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion3')]", + "contentVersion": "[variables('parserObject15').parserVersion15]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[variables('parserObject15')._parserName15]", + "apiVersion": "2025-07-01", + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId3')]", - "title": "Mimecast Cloud Integrated", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", - "graphQueries": [ - { - "metricName": "Total Cloud Integrated data received", - "legend": "Cloud_Integrated_CL", - "baseQuery": "Cloud_Integrated_CL" - } - ], - "sampleQueries": [ - { - "description": "Cloud_Integrated_CL", - "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" - } - ], - "dataTypes": [ - { - "name": "Cloud_Integrated_CL", - "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } + "eTag": "*", + "displayName": "Parser for Mimecast TTP URL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPUrl", + "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject15')._parserId15,'/'))))]", + "dependsOn": [ + "[variables('parserObject15')._parserId15]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "contentId": "[variables('parserObject15').parserContentId15]", + "kind": "Parser", + "version": "[variables('parserObject15').parserVersion15]", + "source": { + "name": "Mimecast", + "kind": "Solution", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('parserObject15').parserContentId15]", + "contentKind": "Parser", + "displayName": "Parser for Mimecast TTP URL", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject15').parserContentId15,'-', '1.0.1')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject15').parserContentId15,'-', '1.0.1')))]", + "version": "[variables('parserObject15').parserVersion15]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2025-07-01", + "name": "[variables('parserObject15')._parserName15]", + "location": "[parameters('workspace-location')]", + "properties": { + "eTag": "*", + "displayName": "Parser for Mimecast TTP URL", + "category": "Microsoft Sentinel Parser", + "functionAlias": "MimecastTTPUrl", + "query": "let dummy_table = datatable(\nTimeGenerated: datetime,\nuserEmailAddress: string,\nfromUserEmailAddress: string,\nmessageId: string,\nsendingIp: string,\nurl: string\n) [];\nlet MimecastTTPUrl = view() {\n union isfuzzy=true\n dummy_table,\n Ttp_Url_CL\n | summarize arg_max(TimeGenerated, *) by userEmailAddress, fromUserEmailAddress, sendingIp, messageId, url\n | extend \n [\"Category\"] = column_ifexists('category', ''),\n [\"Time Generated\"] = column_ifexists('TimeGenerated', ''),\n [\"Type\"] = column_ifexists('Type', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftEvidence', ''),\n [\"Tag Map Advanced Phishing Credential Theft Tags\"] = column_ifexists('tagMap_AdvancedPhishing_CredentialTheftTags', ''),\n [\"Mimecast Event ID\"] = 'ttp_url',\n [\"Mimecast Event Category\"] = 'ttp_url',\n [\"Advanced Phishing Result Credential Theft Brands\"] = column_ifexists('advancedPhishingResult_CredentialTheftBrands', ''),\n [\"Advanced Phishing Result Credential Theft Evidence\"] = column_ifexists('advancedPhishingResult_CredentialTheftEvidence', ''),\n [\"Advanced Phishing Result Credential Theft Tags\"] = column_ifexists('advancedPhishingResult_CredentialTheftTags', ''),\n [\"Tag Map Url Reputation Scan Type\"] = column_ifexists('tagMap_UrlReputationScan_Type', ''),\n [\"Tag Map Url Reputation Scan Url\"] = column_ifexists('tagMap_UrlReputationScan_Url', ''),\n [\"Tag Map Dangerous File Ext Inspect File Exts\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_FileExts', ''),\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"] = column_ifexists('tagMap_DangerousFileExt_Inspect_MimeTypes', ''),\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"] = column_ifexists('tagMap_DangerousFileExt_ContentCheck_ContentScannersBlocked', ''),\n [\"User Email Address\"] = column_ifexists('userEmailAddress', ''),\n [\"From User Email Address\"] = column_ifexists('fromUserEmailAddress', ''),\n [\"Url\"] = column_ifexists('url', ''),\n [\"Ttp Definition\"] = column_ifexists('ttpDefinition', ''),\n [\"Subject\"] = column_ifexists('subject', ''),\n [\"Action\"] = column_ifexists('action', ''),\n [\"Admin Override\"] = column_ifexists('adminOverride', ''),\n [\"User Override\"] = column_ifexists('userOverride', ''),\n [\"Scan Result\"] = column_ifexists('scanResult', ''),\n [\"Sending IP\"] = column_ifexists('sendingIp', ''),\n [\"User Awareness Action\"] = column_ifexists('userAwarenessAction', ''),\n ['Event Time'] = column_ifexists('Date', ''),\n [\"Actions\"] = column_ifexists('actions', ''),\n [\"Route\"] = column_ifexists('route', ''),\n [\"Creation Method\"] = column_ifexists('creationMethod', ''),\n [\"Email Parts Description\"] = column_ifexists('emailPartsDescription', ''),\n [\"Message ID\"] = column_ifexists('messageId', ''),\n [\"Tag Map Url Reputation Scan Url Block\"] = column_ifexists('tagMap_UrlReputationScan_UrlBlock', ''),\n [\"Tag Map Customer Managed Urls Managed Url Entry\"] = column_ifexists('tagMap_CustomerManagedUrls_ManagedUrlEntry', ''),\n [\"Tag Map Customer Managed Urls Blocklisted\"] = column_ifexists('tagMap_CustomerManagedUrls_Blocklisted', ''),\n [\"Tag Map Av Scanning Content Check Av Signature Name\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureName', ''),\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"] = column_ifexists('tagMap_AvScanning_ScannerInfo_CategoryTrigger', ''),\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"] = column_ifexists('tagMap_AvScanning_ContentCheck_AvSignatureFileExts', ''),\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"] = column_ifexists('tagMap_AvScanning_ContentCheck_UrlFileDownloadFilename', ''),\n [\"Tag Map Dangerous File Ext Status\"] = column_ifexists('tagMap_DangerousFileExt_Status', ''),\n [\"Tag Map Url Reputation Scan Status\"] = column_ifexists('tagMap_UrlReputationScan_Status', ''),\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousMimetypesUrlFileDownload', ''),\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"] = column_ifexists('tagMap_ContentCheck_DangerousExtsUrlFileDownload', ''),\n [\"Mimecast Event Id\"] = column_ifexists('mimecastEventId', ''),\n [\"Mimecast Event Category_\"] = column_ifexists('mimecastEventCategory', ''),\n [\"Tag Map Customer Managed Urls Status\"] = column_ifexists('tagMap_CustomerManagedUrls_Status', '')\n | extend ['Event Time'] = iff(isempty(['Event Time']), now(), todatetime(([\"Event Time\"])))\n | project\n [\"Category\"],\n [\"Time Generated\"],\n [\"Mimecast Event ID\"],\n [\"Mimecast Event Category\"],\n [\"User Email Address\"],\n [\"From User Email Address\"],\n [\"Url\"],\n [\"Ttp Definition\"],\n [\"Subject\"],\n [\"Action\"],\n [\"Admin Override\"],\n [\"User Override\"],\n [\"Scan Result\"],\n [\"Sending IP\"],\n [\"User Awareness Action\"],\n ['Event Time'],\n [\"Actions\"],\n [\"Route\"],\n [\"Creation Method\"],\n [\"Email Parts Description\"],\n [\"Message ID\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Mimetypes Url File Download\"],\n [\"Tag Map Dangerous File Ext Content Check Dangerous Exts Url File Download\"],\n [\"Tag Map Advanced Phishing Credential Theft Evidence\"],\n [\"Tag Map Advanced Phishing Credential Theft Tags\"],\n [\"Advanced Phishing Result Credential Theft Brands\"],\n [\"Advanced Phishing Result Credential Theft Evidence\"],\n [\"Advanced Phishing Result Credential Theft Tags\"],\n [\"Tag Map Url Reputation Scan Type\"],\n [\"Tag Map Url Reputation Scan Url\"],\n [\"Tag Map Dangerous File Ext Inspect File Exts\"],\n [\"Tag Map Dangerous File Ext Inspect Mime Types\"],\n [\"Tag Map Dangerous File Ext Content Check Content Scanners Blocked\"],\n [\"Tag Map Url Reputation Scan Url Block\"],\n [\"Tag Map Customer Managed Urls Managed Url Entry\"],\n [\"Tag Map Customer Managed Urls Blocklisted\"],\n [\"Tag Map Av Scanning Content Check Av Signature Name\"],\n [\"Tag Map Av Scanning Scanner Info Category Trigger\"],\n [\"Tag Map Av Scanning Content Check Av Signature File Exts\"],\n [\"Tag Map Av Scanning Content Check Url File Download Filename\"],\n [\"Type\"],\n [\"Tag Map Dangerous File Ext Status\"],\n [\"Tag Map Url Reputation Scan Status\"],\n [\"Tag Map ContentCheck Dangerous Mimetypes Url File Download\"],\n [\"Tag Map ContentCheck Dangerous Exts Url File Download\"],\n [\"Mimecast Event Id\"],\n [\"Mimecast Event Category_\"],\n [\"Tag Map Customer Managed Urls Status\"]\n};\nMimecastTTPUrl\n", + "functionParameters": "", + "version": 2, + "tags": [ + { + "name": "description", + "value": "" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "location": "[parameters('workspace-location')]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject15')._parserId15,'/'))))]", + "dependsOn": [ + "[variables('parserObject15')._parserId15]" + ], + "properties": { + "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'MimecastTTPUrl')]", + "contentId": "[variables('parserObject15').parserContentId15]", + "kind": "Parser", + "version": "[variables('parserObject15').parserVersion15]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast data connector with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "Mimecast Awareness Training", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", + "graphQueries": [ + { + "metricName": "Total Performance Details data received", + "legend": "Awareness_Performance_Details_CL", + "baseQuery": "Awareness_Performance_Details_CL" + }, + { + "metricName": "Total Safe Score Details data received", + "legend": "Awareness_SafeScore_Details_CL", + "baseQuery": "Awareness_SafeScore_Details_CL" + }, + { + "metricName": "Total User Data received", + "legend": "Awareness_User_Data_CL", + "baseQuery": "Awareness_User_Data_CL" + }, + { + "metricName": "Total Watchlist Details data received", + "legend": "Awareness_Watchlist_Details_CL", + "baseQuery": "Awareness_Watchlist_Details_CL" + } + ], + "sampleQueries": [ + { + "description": "Awareness_Performance_Details_CL", + "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_SafeScore_Details_CL", + "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_User_Data_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_Watchlist_Details_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "Awareness_Performance_Details_CL", + "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_SafeScore_Details_CL", + "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_User_Data_CL", + "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_Watchlist_Details_CL", + "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], @@ -5466,7 +5484,7 @@ "title": "Resource group" }, { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", "title": "Functions app" }, { @@ -5476,23 +5494,19 @@ "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", - "title": "Configuration:" - }, - { - "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" }, { - "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" }, { - "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." }, { - "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", "title": "Azure Resource Manager (ARM) Template" } ] @@ -5502,12 +5516,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", - "contentId": "[variables('_dataConnectorContentId3')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion3')]", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5532,27 +5546,27 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId3')]", + "contentId": "[variables('_dataConnectorContentId1')]", "contentKind": "DataConnector", - "displayName": "Mimecast Cloud Integrated", - "contentProductId": "[variables('_dataConnectorcontentProductId3')]", - "id": "[variables('_dataConnectorcontentProductId3')]", - "version": "[variables('dataConnectorVersion3')]" + "displayName": "Mimecast Awareness Training", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId3')]" + "[variables('_dataConnectorId1')]" ], "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", - "contentId": "[variables('_dataConnectorContentId3')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion3')]", + "version": "[variables('dataConnectorVersion1')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5571,41 +5585,83 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Mimecast Cloud Integrated", + "title": "Mimecast Awareness Training", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", + "descriptionMarkdown": "The data connector for [Mimecast Awareness Training](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- Performance Details \n- Safe Score Details \n- User Data\n- Watchlist Details\n", "graphQueries": [ { - "metricName": "Total Cloud Integrated data received", - "legend": "Cloud_Integrated_CL", - "baseQuery": "Cloud_Integrated_CL" + "metricName": "Total Performance Details data received", + "legend": "Awareness_Performance_Details_CL", + "baseQuery": "Awareness_Performance_Details_CL" + }, + { + "metricName": "Total Safe Score Details data received", + "legend": "Awareness_SafeScore_Details_CL", + "baseQuery": "Awareness_SafeScore_Details_CL" + }, + { + "metricName": "Total User Data received", + "legend": "Awareness_User_Data_CL", + "baseQuery": "Awareness_User_Data_CL" + }, + { + "metricName": "Total Watchlist Details data received", + "legend": "Awareness_Watchlist_Details_CL", + "baseQuery": "Awareness_Watchlist_Details_CL" } ], "dataTypes": [ { - "name": "Cloud_Integrated_CL", - "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Awareness_Performance_Details_CL", + "lastDataReceivedQuery": "Awareness_Performance_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_SafeScore_Details_CL", + "lastDataReceivedQuery": "Awareness_SafeScore_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_User_Data_CL", + "lastDataReceivedQuery": "Awareness_User_Data_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Awareness_Watchlist_Details_CL", + "lastDataReceivedQuery": "Awareness_Watchlist_Details_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Awareness_Performance_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_SafeScore_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_User_Data_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Awareness_Watchlist_Details_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "sampleQueries": [ { - "description": "Cloud_Integrated_CL", - "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" + "description": "Awareness_Performance_Details_CL", + "query": "Awareness_Performance_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_SafeScore_Details_CL", + "query": "Awareness_SafeScore_Details_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_User_Data_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Awareness_Watchlist_Details_CL", + "query": "Awareness_User_Data_CL\n| sort by TimeGenerated desc" } ], "availability": { @@ -5656,7 +5712,7 @@ "title": "Resource group" }, { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret\n5. Entra Object ID", "title": "Functions app" }, { @@ -5666,96 +5722,78 @@ "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." }, { - "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", - "title": "Configuration:" - }, - { - "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" }, { - "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" }, { - "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." }, { - "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "description": "Use this method for automated deployment of the Mimecast Awareness Training Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAT-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAwarenessPerformanceDetailsTableName - Enter name of the table used to store Awareness Performance Details data. Default is 'Awareness_Performance_Details'\n\n\t k. MimecastAwarenessUserDataTableName - Enter name of the table used to store Awareness User Data data. Default is 'Awareness_User_Data'\n\n\t l. MimecastAwarenessWatchlistDetailsTableName - Enter name of the table used to store Awareness Watchlist Details data. Default is 'Awareness_Watchlist_Details'\n\n\t m. MimecastAwarenessSafeScoreDetailsTableName - Enter name of the table used to store Awareness SafeScore Details data. Default is 'Awareness_SafeScore_Details'\n\n\t n. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t o. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t p. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t q. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", "title": "Azure Resource Manager (ARM) Template" } ], - "id": "[variables('_uiConfigId3')]" + "id": "[variables('_uiConfigId1')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName4')]", + "name": "[variables('dataConnectorTemplateSpecName2')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion4')]", + "contentVersion": "[variables('dataConnectorVersion2')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "id": "[variables('_uiConfigId4')]", - "title": "Mimecast Secure Email Gateway", + "id": "[variables('_uiConfigId2')]", + "title": "Mimecast Audit", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", "graphQueries": [ { - "metricName": "Total Cloud Gateway data received", - "legend": "Seg_Cg_CL", - "baseQuery": "Seg_Cg_CL" - }, - { - "metricName": "Total Data Leak Prevention data received", - "legend": "Seg_Dlp_CL", - "baseQuery": "Seg_Dlp_CL" + "metricName": "Total Audit data received", + "legend": "Audit_CL", + "baseQuery": "Audit_CL" } ], "sampleQueries": [ { - "description": "Seg_Cg_CL", - "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Seg_Dlp_CL", - "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + "description": "Audit_CL", + "query": "Audit_CL\n| sort by TimeGenerated desc" } ], "dataTypes": [ { - "name": "Seg_Cg_CL", - "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Seg_Dlp_CL", - "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Audit_CL", + "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], @@ -5813,7 +5851,7 @@ "title": "Configuration:" }, { - "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." }, { "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" @@ -5825,8 +5863,8 @@ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Audit Data Connector:" } ] } @@ -5835,12 +5873,12 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", - "contentId": "[variables('_dataConnectorContentId4')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion4')]", + "version": "[variables('dataConnectorVersion2')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5865,27 +5903,27 @@ "packageName": "[variables('_solutionName')]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId4')]", + "contentId": "[variables('_dataConnectorContentId2')]", "contentKind": "DataConnector", - "displayName": "Mimecast Secure Email Gateway", - "contentProductId": "[variables('_dataConnectorcontentProductId4')]", - "id": "[variables('_dataConnectorcontentProductId4')]", - "version": "[variables('dataConnectorVersion4')]" + "displayName": "Mimecast Audit", + "contentProductId": "[variables('_dataConnectorcontentProductId2')]", + "id": "[variables('_dataConnectorcontentProductId2')]", + "version": "[variables('dataConnectorVersion2')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId2'),'/'))))]", "dependsOn": [ - "[variables('_dataConnectorId4')]" + "[variables('_dataConnectorId2')]" ], "location": "[parameters('workspace-location')]", "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", - "contentId": "[variables('_dataConnectorContentId4')]", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId2'))]", + "contentId": "[variables('_dataConnectorContentId2')]", "kind": "DataConnector", - "version": "[variables('dataConnectorVersion4')]", + "version": "[variables('dataConnectorVersion2')]", "source": { "kind": "Solution", "name": "Mimecast", @@ -5904,55 +5942,41 @@ } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId2'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", "kind": "GenericUI", "properties": { "connectorUiConfig": { - "title": "Mimecast Secure Email Gateway", + "title": "Mimecast Audit", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "descriptionMarkdown": "The data connector for [Mimecast Audit](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to audit and authentication events within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into user activity, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \nAudit\n ", "graphQueries": [ { - "metricName": "Total Cloud Gateway data received", - "legend": "Seg_Cg_CL", - "baseQuery": "Seg_Cg_CL" - }, - { - "metricName": "Total Data Leak Prevention data received", - "legend": "Seg_Dlp_CL", - "baseQuery": "Seg_Dlp_CL" + "metricName": "Total Audit data received", + "legend": "Audit_CL", + "baseQuery": "Audit_CL" } ], "dataTypes": [ { - "name": "Seg_Cg_CL", - "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "Seg_Dlp_CL", - "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "Audit_CL", + "lastDataReceivedQuery": "Audit_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" } ], "connectivityCriterias": [ { "type": "IsConnectedQuery", "value": [ - "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + "Audit_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" ] } ], "sampleQueries": [ { - "description": "Seg_Cg_CL", - "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" - }, - { - "description": "Seg_Dlp_CL", - "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + "description": "Audit_CL", + "query": "Audit_CL\n| sort by TimeGenerated desc" } ], "availability": { @@ -6009,7 +6033,7 @@ "title": "Configuration:" }, { - "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." }, { "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" @@ -6021,197 +6045,1883 @@ "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" }, { - "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + "description": "Use this method for automated deployment of the Mimecast Audit Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastAuditTableName - Enter name of the table used to store Audit data. Default is 'Audit'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Audit Data Connector:" } ], - "id": "[variables('_uiConfigId4')]" + "id": "[variables('_uiConfigId2')]" } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[variables('dataConnectorTemplateSpecName5')]", + "name": "[variables('dataConnectorTemplateSpecName3')]", "location": "[parameters('workspace-location')]", "dependsOn": [ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "Mimecast data connector with template version 3.1.0", + "description": "Mimecast data connector with template version 3.1.1", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorVersion5')]", + "contentVersion": "[variables('dataConnectorVersion3')]", "parameters": {}, "variables": {}, "resources": [ { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", "apiVersion": "2021-03-01-preview", "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId3')]", + "title": "Mimecast Cloud Integrated", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", + "graphQueries": [ + { + "metricName": "Total Cloud Integrated data received", + "legend": "Cloud_Integrated_CL", + "baseQuery": "Cloud_Integrated_CL" + } + ], + "sampleQueries": [ + { + "description": "Cloud_Integrated_CL", + "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "Cloud_Integrated_CL", + "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", + "contentId": "[variables('_dataConnectorContentId3')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion3')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId3')]", + "contentKind": "DataConnector", + "displayName": "Mimecast Cloud Integrated", + "contentProductId": "[variables('_dataConnectorcontentProductId3')]", + "id": "[variables('_dataConnectorcontentProductId3')]", + "version": "[variables('dataConnectorVersion3')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId3'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId3')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId3'))]", + "contentId": "[variables('_dataConnectorContentId3')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion3')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId3'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Mimecast Cloud Integrated", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Cloud Integrated](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Cloud Integrated inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities.", + "graphQueries": [ + { + "metricName": "Total Cloud Integrated data received", + "legend": "Cloud_Integrated_CL", + "baseQuery": "Cloud_Integrated_CL" + } + ], + "dataTypes": [ + { + "name": "Cloud_Integrated_CL", + "lastDataReceivedQuery": "Cloud_Integrated_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Cloud_Integrated_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Cloud_Integrated_CL", + "query": "Cloud_Integrated_CL\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "**STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "Use this method for automated deployment of the Mimecast Cloud Integrated Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastCI-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCITableName - Enter name of the table used to store Cloud Integrated data. Default is 'Cloud_Integrated'\n\n\t k. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t l. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t m. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t n. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" + } + ], + "id": "[variables('_uiConfigId3')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName4')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast data connector with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion4')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId4')]", + "title": "Mimecast Secure Email Gateway", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Cloud Gateway data received", + "legend": "Seg_Cg_CL", + "baseQuery": "Seg_Cg_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "Seg_Dlp_CL", + "baseQuery": "Seg_Dlp_CL" + } + ], + "sampleQueries": [ + { + "description": "Seg_Cg_CL", + "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Seg_Dlp_CL", + "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "Seg_Cg_CL", + "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Seg_Dlp_CL", + "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", + "contentId": "[variables('_dataConnectorContentId4')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion4')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId4')]", + "contentKind": "DataConnector", + "displayName": "Mimecast Secure Email Gateway", + "contentProductId": "[variables('_dataConnectorcontentProductId4')]", + "id": "[variables('_dataConnectorcontentProductId4')]", + "version": "[variables('dataConnectorVersion4')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId4'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId4')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId4'))]", + "contentId": "[variables('_dataConnectorContentId4')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion4')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId4'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Mimecast Secure Email Gateway", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Secure Email Gateway](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) allows easy log collection from the Secure Email Gateway to surface email insight and user activity within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. Mimecast products and features required: \n- Mimecast Cloud Gateway \n- Mimecast Data Leak Prevention\n ", + "graphQueries": [ + { + "metricName": "Total Cloud Gateway data received", + "legend": "Seg_Cg_CL", + "baseQuery": "Seg_Cg_CL" + }, + { + "metricName": "Total Data Leak Prevention data received", + "legend": "Seg_Dlp_CL", + "baseQuery": "Seg_Dlp_CL" + } + ], + "dataTypes": [ + { + "name": "Seg_Cg_CL", + "lastDataReceivedQuery": "Seg_Cg_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Seg_Dlp_CL", + "lastDataReceivedQuery": "Seg_Dlp_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Seg_Cg_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Seg_Dlp_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Seg_Cg_CL", + "query": "Seg_Cg_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Seg_Dlp_CL", + "query": "Seg_Dlp_CL\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - Configuration steps for the Mimecast API**\n\nGo to ***Azure portal ---> App registrations ---> [your_app] ---> Certificates & secrets ---> New client secret*** and create a new secret (save the Value somewhere safe right away because you will not be able to preview it later)", + "title": "Configuration:" + }, + { + "description": "****STEP 2 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "**STEP 3 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 4 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of TenableVM Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of TenableVM Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 5 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "Use this method for automated deployment of the Mimecast Secure Email Gateway Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastSEGAzureDeploy-azuredeploy-gov)\n2. SSelect the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. MimecastCGTableName - Enter name of the table used to store CG data. Default is 'Seg_Cg'\n\n\t k. MimecastDLPTableName - Enter name of the table used to store DLP data. Default is 'Seg_Dlp'\n\n\t l. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t m. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t n. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Deploy the Mimecast Secure Email Gateway Data Connector:" + } + ], + "id": "[variables('_uiConfigId4')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[variables('dataConnectorTemplateSpecName5')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "description": "Mimecast data connector with template version 3.1.1", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorVersion5')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId5')]", + "title": "Mimecast Targeted Threat Protection", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", + "graphQueries": [ + { + "metricName": "Total URL Protect data received", + "legend": "Ttp_Url_CL", + "baseQuery": "Ttp_Url_CL" + }, + { + "metricName": "Total Attachment Protect data received", + "legend": "Ttp_Attachment_CL", + "baseQuery": "Ttp_Attachment_CL" + }, + { + "metricName": "Total Impersonation Protect data received", + "legend": "Ttp_Impersonation_CL", + "baseQuery": "Ttp_Impersonation_CL" + } + ], + "sampleQueries": [ + { + "description": "Ttp_Url_CL", + "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Attachment_CL", + "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Impersonation_CL", + "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" + } + ], + "dataTypes": [ + { + "name": "Ttp_Url_CL", + "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Attachment_CL", + "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Impersonation_CL", + "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", + "contentId": "[variables('_dataConnectorContentId5')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion5')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId5')]", + "contentKind": "DataConnector", + "displayName": "Mimecast Targeted Threat Protection", + "contentProductId": "[variables('_dataConnectorcontentProductId5')]", + "id": "[variables('_dataConnectorcontentProductId5')]", + "version": "[variables('dataConnectorVersion5')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId5')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", + "contentId": "[variables('_dataConnectorContentId5')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion5')]", + "source": { + "kind": "Solution", + "name": "Mimecast", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "Mimecast Targeted Threat Protection", + "publisher": "Mimecast", + "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", + "graphQueries": [ + { + "metricName": "Total URL Protect data received", + "legend": "Ttp_Url_CL", + "baseQuery": "Ttp_Url_CL" + }, + { + "metricName": "Total Attachment Protect data received", + "legend": "Ttp_Attachment_CL", + "baseQuery": "Ttp_Attachment_CL" + }, + { + "metricName": "Total Impersonation Protect data received", + "legend": "Ttp_Impersonation_CL", + "baseQuery": "Ttp_Impersonation_CL" + } + ], + "dataTypes": [ + { + "name": "Ttp_Url_CL", + "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Attachment_CL", + "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + }, + { + "name": "Ttp_Impersonation_CL", + "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", + "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" + ] + } + ], + "sampleQueries": [ + { + "description": "Ttp_Url_CL", + "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Attachment_CL", + "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + }, + { + "description": "Ttp_Impersonation_CL", + "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions on the workspace are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "name": "Azure Subscription", + "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." + }, + { + "name": "Microsoft.Web/sites permissions", + "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." + }, + { + "name": "REST API Credentials/permissions", + "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + } + ] + }, + "instructionSteps": [ + { + "description": "You need to have a resource group created with a subscription you are going to use.", + "title": "Resource group" + }, + { + "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", + "title": "Functions app" + }, + { + "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + }, + { + "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + }, + { + "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + }, + { + "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + }, + { + "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + }, + { + "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + }, + { + "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", + "title": "Azure Resource Manager (ARM) Template" + } + ], + "id": "[variables('_uiConfigId5')]" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition6'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "displayName": "Mimecast Human Risk (via Codeless Connector Framework)", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": {}, + "variables": {}, + "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition6'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", + "location": "[parameters('workspace-location')]", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MimecastHumanRiskCCF", + "title": "Mimecast Human Risk (via Codeless Connector Framework)", + "publisher": "Mimecast", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Mimecast.svg", + "descriptionMarkdown": "The data connector for [Mimecast Human Risk](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with visibility into the human risk posture of their organization within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view risk trends, understand which behaviors and attacks drive risk, and identify the individuals, departments and locations with the highest human risk. \nThe Mimecast Human Risk data included within the connector are: \n- Organization risk trends \n- Behaviors \n- Attacks \n- Individuals\n", + "graphQueriesTableName": "MimecastHumanRisk_Organization_CL", + "graphQueries": [ + { + "metricName": "Total organization risk records", + "legend": "Organization", + "baseQuery": "MimecastHumanRisk_Organization_CL" + }, + { + "metricName": "Total behavior records", + "legend": "Behaviors", + "baseQuery": "MimecastHumanRisk_Behaviors_CL" + }, + { + "metricName": "Total attack records", + "legend": "Attacks", + "baseQuery": "MimecastHumanRisk_Attacks_CL" + }, + { + "metricName": "Total individual risk records", + "legend": "Individuals", + "baseQuery": "MimecastHumanRisk_Individuals_CL" + } + ], + "sampleQueries": [ + { + "description": "Organization risk score by month (latest snapshot per month)", + "query": "MimecastHumanRisk_Organization_CL\n| summarize arg_max(TimeGenerated, *) by Month\n| project Month, HumanRiskScore, HumanRiskFactor, HumanRiskScoreTrend, AttackScore, AttackFactor\n| sort by Month desc" + }, + { + "description": "Latest behavior scores", + "query": "MimecastHumanRisk_Behaviors_CL\n| summarize arg_max(TimeGenerated, *) by BehaviorType\n| project BehaviorType, Score, Factor, EventCount, Trend, Events" + }, + { + "description": "Latest attack summary by type", + "query": "MimecastHumanRisk_Attacks_CL\n| summarize arg_max(TimeGenerated, *)\n| mv-expand AttackTypes\n| project AttackType = tostring(AttackTypes.type), AttackScore = toint(AttackTypes.attackScore), AttackTotal = toint(AttackTypes.attackTotal), Events = AttackTypes.events" + }, + { + "description": "Highest-risk individuals (latest snapshot)", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize arg_max(TimeGenerated, *) by IndividualId\n| project DisplayName, EmailAddress, Department, Location, HumanRiskScore, HumanRiskFactor, AttackScore\n| top 50 by HumanRiskScore desc" + }, + { + "description": "Human risk score trend per individual", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize Score = max(HumanRiskScore) by IndividualId, bin(TimeGenerated, 1d)\n| render timechart" + } + ], + "dataTypes": [ + { + "name": "MimecastHumanRisk_Organization_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Organization_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Behaviors_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Attacks_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "MimecastHumanRisk_Individuals_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Individuals_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "status": 1, + "isPreview": true + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "name": "Mimecast API 2.0 application", + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission. Create it in the Mimecast Administration Console under Integrations > API and Platform Integrations." + } + ] + }, + "instructionSteps": [ + { + "title": "1. Create a Mimecast API 2.0 application", + "description": "1. Sign in to the Mimecast Administration Console.\n2. Go to **Integrations** > **API and Platform Integrations** and create (or open) an API 2.0 application.\n3. Grant the application the **Human Risk - Read** permission.\n4. Copy the **Client ID** and **Client Secret**.\n5. Identify your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` (UK) or `https://us-api.services.mimecast.com` (US)." + }, + { + "title": "2. Connect", + "description": "Enter the Mimecast API 2.0 credentials and base URL, choose how many months of data to request and how often to poll, then click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Mimecast API Base URL", + "placeholder": "https://api.services.mimecast.com", + "type": "text", + "name": "mimecastBaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Base URL of the Mimecast API 2.0 for your region, including https:// and without a trailing slash (for example https://api.services.mimecast.com, https://us-api.services.mimecast.com or https://uk-api.services.mimecast.com).", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client ID", + "placeholder": "Mimecast API 2.0 Client ID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client Secret", + "placeholder": "Mimecast API 2.0 Client Secret", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. The Client ID and Client Secret of a Mimecast API 2.0 application that has the Human Risk READ permission.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Months of data to request", + "placeholder": "3", + "type": "number", + "name": "monthsBack", + "defaultValue": "3", + "validations": { + "required": true + }, + "toolTip": "Minimum value is 1 (maximum accepted by the Mimecast API is 12)." + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Whole number of months, minimum 1 (the Mimecast API accepts 1 to 12; default 3), sent as monthsBack to the organization, behaviors and attacks endpoints. For behaviors and attacks it counts calendar months from the 1st of the starting month through today (1 = month-to-date). It does not apply to the individuals search.", + "visible": true, + "inline": false + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Polling interval", + "name": "pollingInterval", + "options": [ + { + "key": "60", + "text": "1 hour" + }, + { + "key": "240", + "text": "4 hours" + }, + { + "key": "480", + "text": "8 hours" + }, + { + "key": "720", + "text": "12 hours" + }, + { + "key": "1440", + "text": "24 hours" + }, + { + "key": "2880", + "text": "48 hours" + }, + { + "key": "10080", + "text": "7 days" + } + ], + "placeholder": "Select polling interval (recommended: 12 hours)", + "isMultiSelect": false, + "defaultAllSelected": false, + "required": true, + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Select how often Sentinel queries the Mimecast Human Risk API (12 hours is recommended). Each poll writes a new snapshot, so shorter intervals increase ingestion volume. The Mimecast rate limits are far above what this connector uses.", + "visible": true, + "inline": false + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition6'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + }, + "dependencies": { + "criteria": [ + { + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "name": "MimecastHumanRiskDCR", + "apiVersion": "2022-06-01", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "[parameters('workspace-location')]", + "kind": "[variables('blanks')]", + "properties": { + "dataCollectionEndpointId": "[variables('dataCollectionEndpointId6')]", + "streamDeclarations": { + "Custom-MimecastHumanRisk_Organization_CL": { + "columns": [ + { + "name": "month", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "humanRiskScoreTrend", + "type": "int" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTrend", + "type": "int" + }, + { + "name": "attackTotal", + "type": "int" + }, + { + "name": "riskResponses", + "type": "int" + }, + { + "name": "totalActions", + "type": "int" + }, + { + "name": "notifications", + "type": "int" + }, + { + "name": "outboundActions", + "type": "int" + }, + { + "name": "groupChanges", + "type": "int" + } + ] + }, + "Custom-MimecastHumanRisk_Behaviors_CL": { + "columns": [ + { + "name": "type", + "type": "string" + }, + { + "name": "score", + "type": "int" + }, + { + "name": "factor", + "type": "string" + }, + { + "name": "eventCount", + "type": "int" + }, + { + "name": "trend", + "type": "int" + }, + { + "name": "events", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Attacks_CL": { + "columns": [ + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "attackTypes", + "type": "dynamic" + } + ] + }, + "Custom-MimecastHumanRisk_Individuals_CL": { + "columns": [ + { + "name": "id", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "emailAddress", + "type": "string" + }, + { + "name": "firstName", + "type": "string" + }, + { + "name": "lastName", + "type": "string" + }, + { + "name": "managerName", + "type": "string" + }, + { + "name": "managerId", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "location", + "type": "string" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "tenureMonths", + "type": "int" + }, + { + "name": "tenureStatus", + "type": "string" + }, + { + "name": "startDateTime", + "type": "string" + }, + { + "name": "humanRiskScore", + "type": "int" + }, + { + "name": "humanRiskFactor", + "type": "string" + }, + { + "name": "attackScore", + "type": "int" + }, + { + "name": "attackFactor", + "type": "string" + }, + { + "name": "behaviors", + "type": "dynamic" + }, + { + "name": "attacks", + "type": "dynamic" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "[variables('workspaceResourceId')]", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-MimecastHumanRisk_Organization_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), Month = month, HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, HumanRiskScoreTrend = humanRiskScoreTrend, AttackScore = attackScore, AttackFactor = attackFactor, AttackTrend = attackTrend, AttackTotal = attackTotal, RiskResponses = riskResponses, TotalActions = totalActions, Notifications = notifications, OutboundActions = outboundActions, GroupChanges = groupChanges", + "outputStream": "Custom-MimecastHumanRisk_Organization_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Behaviors_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), BehaviorType = type, Score = score, Factor = factor, EventCount = eventCount, Trend = trend, Events = events", + "outputStream": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Attacks_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), AttackScore = attackScore, AttackFactor = attackFactor, AttackTypes = attackTypes", + "outputStream": "Custom-MimecastHumanRisk_Attacks_CL" + }, + { + "streams": [ + "Custom-MimecastHumanRisk_Individuals_CL" + ], + "destinations": [ + "clv2ws1" + ], + "transformKql": "source | project TimeGenerated = now(), IndividualId = id, DisplayName = displayName, EmailAddress = emailAddress, FirstName = firstName, LastName = lastName, ManagerName = managerName, ManagerId = managerId, Department = department, Location = location, JobTitle = jobTitle, TenureMonths = tenureMonths, TenureStatus = tenureStatus, StartDateTime = todatetime(startDateTime), HumanRiskScore = humanRiskScore, HumanRiskFactor = humanRiskFactor, AttackScore = attackScore, AttackFactor = attackFactor, Behaviors = behaviors, Attacks = attacks", + "outputStream": "Custom-MimecastHumanRisk_Individuals_CL" + } + ] + } + }, + { + "name": "MimecastHumanRisk_Organization_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, "properties": { - "connectorUiConfig": { - "id": "[variables('_uiConfigId5')]", - "title": "Mimecast Targeted Threat Protection", - "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", - "graphQueries": [ + "schema": { + "name": "MimecastHumanRisk_Organization_CL", + "columns": [ { - "metricName": "Total URL Protect data received", - "legend": "Ttp_Url_CL", - "baseQuery": "Ttp_Url_CL" + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" }, { - "metricName": "Total Attachment Protect data received", - "legend": "Ttp_Attachment_CL", - "baseQuery": "Ttp_Attachment_CL" + "name": "Month", + "type": "string", + "description": "Reporting month (YYYY-MM)" }, { - "metricName": "Total Impersonation Protect data received", - "legend": "Ttp_Impersonation_CL", - "baseQuery": "Ttp_Impersonation_CL" - } - ], - "sampleQueries": [ + "name": "HumanRiskScore", + "type": "int", + "description": "Organization human risk score (0-100)" + }, { - "description": "Ttp_Url_CL", - "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor (veryLow..veryHigh)" }, { - "description": "Ttp_Attachment_CL", - "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + "name": "HumanRiskScoreTrend", + "type": "int", + "description": "Human risk score change from prior month" }, { - "description": "Ttp_Impersonation_CL", - "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" - } - ], - "dataTypes": [ + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" + }, { - "name": "Ttp_Url_CL", - "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "AttackFactor", + "type": "string", + "description": "Attack factor (veryLow..veryHigh, notScored)" }, { - "name": "Ttp_Attachment_CL", - "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "name": "AttackTrend", + "type": "int", + "description": "Attack score change from prior month" }, { - "name": "Ttp_Impersonation_CL", - "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriterias": [ + "name": "AttackTotal", + "type": "int", + "description": "Total attack events for the month" + }, { - "type": "IsConnectedQuery", - "value": [ - "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] + "name": "RiskResponses", + "type": "int", + "description": "Risk response events for the month" + }, + { + "name": "TotalActions", + "type": "int", + "description": "Total risk response actions" + }, + { + "name": "Notifications", + "type": "int", + "description": "Total notifications sent" + }, + { + "name": "OutboundActions", + "type": "int", + "description": "Total outbound actions" + }, + { + "name": "GroupChanges", + "type": "int", + "description": "Total group membership changes" } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true - } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } - } - ], - "customs": [ - { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" - } - ] - }, - "instructionSteps": [ + ] + } + } + }, + { + "name": "MimecastHumanRisk_Behaviors_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "MimecastHumanRisk_Behaviors_CL", + "columns": [ { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" }, { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", - "title": "Functions app" + "name": "BehaviorType", + "type": "string", + "description": "Behavior type (training, simulatedPhishing, actualPhishing, malware, sensitiveDataHandling)" }, { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." + "name": "Score", + "type": "int", + "description": "Behavior score (0-100)" }, { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." + "name": "Factor", + "type": "string", + "description": "Behavior risk factor" }, { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "name": "EventCount", + "type": "int", + "description": "Total events for the behavior in the period" }, { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "name": "Trend", + "type": "int", + "description": "Score change from prior period" }, { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "name": "Events", + "type": "dynamic", + "description": "Behavior-specific event counts" + } + ] + } + } + }, + { + "name": "MimecastHumanRisk_Attacks_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, + "properties": { + "schema": { + "name": "MimecastHumanRisk_Attacks_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" }, { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "name": "AttackScore", + "type": "int", + "description": "Organization attack score (0-100)" }, { - "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" + "name": "AttackFactor", + "type": "string", + "description": "Organization attack factor" + }, + { + "name": "AttackTypes", + "type": "dynamic", + "description": "Per attack type (actualPhishing, malware, identity) scores and event counts" } ] } } }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", + "name": "MimecastHumanRisk_Individuals_CL", + "apiVersion": "2022-10-01", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "location": "[parameters('workspace-location')]", + "kind": null, "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", - "contentId": "[variables('_dataConnectorContentId5')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion5')]", - "source": { - "kind": "Solution", - "name": "Mimecast", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Mimecast", - "email": "[variables('_email')]" - }, - "support": { - "name": "Mimecast", - "email": "support@mimecast.com", - "tier": "Partner", - "link": "https://mimecastsupport.zendesk.com/" + "schema": { + "name": "MimecastHumanRisk_Individuals_CL", + "columns": [ + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time the record was ingested" + }, + { + "name": "IndividualId", + "type": "string", + "description": "Unique individual identifier" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "EmailAddress", + "type": "string", + "description": "Email address" + }, + { + "name": "FirstName", + "type": "string", + "description": "First name" + }, + { + "name": "LastName", + "type": "string", + "description": "Last name" + }, + { + "name": "ManagerName", + "type": "string", + "description": "Manager display name" + }, + { + "name": "ManagerId", + "type": "string", + "description": "Manager identifier" + }, + { + "name": "Department", + "type": "string", + "description": "Department" + }, + { + "name": "Location", + "type": "string", + "description": "Location" + }, + { + "name": "JobTitle", + "type": "string", + "description": "Job title" + }, + { + "name": "TenureMonths", + "type": "int", + "description": "Months with the organization" + }, + { + "name": "TenureStatus", + "type": "string", + "description": "newHire or veteran" + }, + { + "name": "StartDateTime", + "type": "datetime", + "description": "Start date with the organization" + }, + { + "name": "HumanRiskScore", + "type": "int", + "description": "Human risk score (0-100)" + }, + { + "name": "HumanRiskFactor", + "type": "string", + "description": "Human risk factor" + }, + { + "name": "AttackScore", + "type": "int", + "description": "Attack score (0-100)" + }, + { + "name": "AttackFactor", + "type": "string", + "description": "Attack factor" + }, + { + "name": "Behaviors", + "type": "dynamic", + "description": "Behavior scores and event counts" + }, + { + "name": "Attacks", + "type": "dynamic", + "description": "Attack scores and event counts" + } + ] } } } @@ -6220,188 +7930,611 @@ "packageKind": "Solution", "packageVersion": "[variables('_solutionVersion')]", "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition6'),'-', variables('dataConnectorCCPVersion'))))]", "packageId": "[variables('_solutionId')]", "contentSchemaVersion": "3.0.0", - "contentId": "[variables('_dataConnectorContentId5')]", - "contentKind": "DataConnector", - "displayName": "Mimecast Targeted Threat Protection", - "contentProductId": "[variables('_dataConnectorcontentProductId5')]", - "id": "[variables('_dataConnectorcontentProductId5')]", - "version": "[variables('dataConnectorVersion5')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId5'),'/'))))]", - "dependsOn": [ - "[variables('_dataConnectorId5')]" - ], - "location": "[parameters('workspace-location')]", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId5'))]", - "contentId": "[variables('_dataConnectorContentId5')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorVersion5')]", - "source": { - "kind": "Solution", - "name": "Mimecast", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Mimecast", - "email": "[variables('_email')]" - }, - "support": { - "name": "Mimecast", - "email": "support@mimecast.com", - "tier": "Partner", - "link": "https://mimecastsupport.zendesk.com/" - } + "version": "[variables('dataConnectorCCPVersion')]" } }, { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId5'))]", - "apiVersion": "2021-03-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition6'))]", + "apiVersion": "2022-09-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", "location": "[parameters('workspace-location')]", - "kind": "GenericUI", + "kind": "Customizable", "properties": { "connectorUiConfig": { - "title": "Mimecast Targeted Threat Protection", + "id": "MimecastHumanRiskCCF", + "title": "Mimecast Human Risk (via Codeless Connector Framework)", "publisher": "Mimecast", - "descriptionMarkdown": "The data connector for [Mimecast Targeted Threat Protection](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with the visibility into security events related to the Targeted Threat Protection inspection technologies within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view insight into email based threats, aid in incident correlation and reduce investigation response times coupled with custom alert capabilities. \nThe Mimecast products included within the connector are: \n- URL Protect \n- Impersonation Protect \n- Attachment Protect\n", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Mimecast.svg", + "descriptionMarkdown": "The data connector for [Mimecast Human Risk](https://integrations.mimecast.com/tech-partners/microsoft-sentinel/) provides customers with visibility into the human risk posture of their organization within Microsoft Sentinel. The data connector provides pre-created dashboards to allow analysts to view risk trends, understand which behaviors and attacks drive risk, and identify the individuals, departments and locations with the highest human risk. \nThe Mimecast Human Risk data included within the connector are: \n- Organization risk trends \n- Behaviors \n- Attacks \n- Individuals\n", + "graphQueriesTableName": "MimecastHumanRisk_Organization_CL", "graphQueries": [ { - "metricName": "Total URL Protect data received", - "legend": "Ttp_Url_CL", - "baseQuery": "Ttp_Url_CL" + "metricName": "Total organization risk records", + "legend": "Organization", + "baseQuery": "MimecastHumanRisk_Organization_CL" }, { - "metricName": "Total Attachment Protect data received", - "legend": "Ttp_Attachment_CL", - "baseQuery": "Ttp_Attachment_CL" + "metricName": "Total behavior records", + "legend": "Behaviors", + "baseQuery": "MimecastHumanRisk_Behaviors_CL" }, { - "metricName": "Total Impersonation Protect data received", - "legend": "Ttp_Impersonation_CL", - "baseQuery": "Ttp_Impersonation_CL" + "metricName": "Total attack records", + "legend": "Attacks", + "baseQuery": "MimecastHumanRisk_Attacks_CL" + }, + { + "metricName": "Total individual risk records", + "legend": "Individuals", + "baseQuery": "MimecastHumanRisk_Individuals_CL" } ], - "dataTypes": [ + "sampleQueries": [ { - "name": "Ttp_Url_CL", - "lastDataReceivedQuery": "Ttp_Url_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "description": "Organization risk score by month (latest snapshot per month)", + "query": "MimecastHumanRisk_Organization_CL\n| summarize arg_max(TimeGenerated, *) by Month\n| project Month, HumanRiskScore, HumanRiskFactor, HumanRiskScoreTrend, AttackScore, AttackFactor\n| sort by Month desc" }, { - "name": "Ttp_Attachment_CL", - "lastDataReceivedQuery": "Ttp_Attachment_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "description": "Latest behavior scores", + "query": "MimecastHumanRisk_Behaviors_CL\n| summarize arg_max(TimeGenerated, *) by BehaviorType\n| project BehaviorType, Score, Factor, EventCount, Trend, Events" + }, + { + "description": "Latest attack summary by type", + "query": "MimecastHumanRisk_Attacks_CL\n| summarize arg_max(TimeGenerated, *)\n| mv-expand AttackTypes\n| project AttackType = tostring(AttackTypes.type), AttackScore = toint(AttackTypes.attackScore), AttackTotal = toint(AttackTypes.attackTotal), Events = AttackTypes.events" + }, + { + "description": "Highest-risk individuals (latest snapshot)", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize arg_max(TimeGenerated, *) by IndividualId\n| project DisplayName, EmailAddress, Department, Location, HumanRiskScore, HumanRiskFactor, AttackScore\n| top 50 by HumanRiskScore desc" }, { - "name": "Ttp_Impersonation_CL", - "lastDataReceivedQuery": "Ttp_Impersonation_CL\n | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" + "description": "Human risk score trend per individual", + "query": "MimecastHumanRisk_Individuals_CL\n| summarize Score = max(HumanRiskScore) by IndividualId, bin(TimeGenerated, 1d)\n| render timechart" } ], - "connectivityCriterias": [ + "dataTypes": [ { - "type": "IsConnectedQuery", - "value": [ - "Ttp_Url_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Attachment_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)", - "Ttp_Impersonation_CL\n | summarize LastLogReceived = max(TimeGenerated)\n | project IsConnected = LastLogReceived > ago(30d)" - ] - } - ], - "sampleQueries": [ + "name": "MimecastHumanRisk_Organization_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Organization_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, { - "description": "Ttp_Url_CL", - "query": "Ttp_Url_CL\n| sort by TimeGenerated desc" + "name": "MimecastHumanRisk_Behaviors_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Behaviors_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "description": "Ttp_Attachment_CL", - "query": "Ttp_Attachment_CL\n| sort by TimeGenerated desc" + "name": "MimecastHumanRisk_Attacks_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Attacks_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "description": "Ttp_Impersonation_CL", - "query": "Ttp_Impersonation_CL\n| sort by TimeGenerated desc" + "name": "MimecastHumanRisk_Individuals_CL", + "lastDataReceivedQuery": "MimecastHumanRisk_Individuals_CL\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" } ], "availability": { "status": 1, - "isPreview": false + "isPreview": true }, "permissions": { "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions on the workspace are required.", + "permissionsDisplayText": "Read and Write permissions are required.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { - "write": true, "read": true, + "write": true, "delete": true } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true - } } ], "customs": [ { - "name": "Azure Subscription", - "description": "Azure Subscription with owner role is required to register an application in Microsoft Entra ID and assign role of contributor to app in resource group." - }, - { - "name": "Microsoft.Web/sites permissions", - "description": "Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/)." - }, - { - "name": "REST API Credentials/permissions", - "description": "See the documentation to learn more about API on the [Rest API reference](https://integrations.mimecast.com/documentation/)" + "name": "Mimecast API 2.0 application", + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission. Create it in the Mimecast Administration Console under Integrations > API and Platform Integrations." } ] }, "instructionSteps": [ { - "description": "You need to have a resource group created with a subscription you are going to use.", - "title": "Resource group" - }, - { - "description": "You need to have an Azure App registered for this connector to use\n1. Application Id\n2. Tenant Id\n3. Client Id\n4. Client Secret", - "title": "Functions app" + "title": "1. Create a Mimecast API 2.0 application", + "description": "1. Sign in to the Mimecast Administration Console.\n2. Go to **Integrations** > **API and Platform Integrations** and create (or open) an API 2.0 application.\n3. Grant the application the **Human Risk - Read** permission.\n4. Copy the **Client ID** and **Client Secret**.\n5. Identify your regional API base URL: `https://api.services.mimecast.com` (global), `https://uk-api.services.mimecast.com` (UK) or `https://us-api.services.mimecast.com` (US)." }, { - "description": ">**NOTE:** This connector uses Azure Functions to connect to a Mimecast API to pull its logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the [Azure Functions pricing page](https://azure.microsoft.com/pricing/details/functions/) for details." - }, + "title": "2. Connect", + "description": "Enter the Mimecast API 2.0 credentials and base URL, choose how many months of data to request and how often to poll, then click Connect.", + "instructions": [ + { + "type": "Textbox", + "parameters": { + "label": "Mimecast API Base URL", + "placeholder": "https://api.services.mimecast.com", + "type": "text", + "name": "mimecastBaseUrl", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Base URL of the Mimecast API 2.0 for your region, including https:// and without a trailing slash (for example https://api.services.mimecast.com, https://us-api.services.mimecast.com or https://uk-api.services.mimecast.com).", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client ID", + "placeholder": "Mimecast API 2.0 Client ID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client Secret", + "placeholder": "Mimecast API 2.0 Client Secret", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. The Client ID and Client Secret of a Mimecast API 2.0 application that has the Human Risk READ permission.", + "visible": true, + "inline": false + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Months of data to request", + "placeholder": "3", + "type": "number", + "name": "monthsBack", + "defaultValue": "3", + "validations": { + "required": true + }, + "toolTip": "Minimum value is 1 (maximum accepted by the Mimecast API is 12)." + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Whole number of months, minimum 1 (the Mimecast API accepts 1 to 12; default 3), sent as monthsBack to the organization, behaviors and attacks endpoints. For behaviors and attacks it counts calendar months from the 1st of the starting month through today (1 = month-to-date). It does not apply to the individuals search.", + "visible": true, + "inline": false + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Polling interval", + "name": "pollingInterval", + "options": [ + { + "key": "60", + "text": "1 hour" + }, + { + "key": "240", + "text": "4 hours" + }, + { + "key": "480", + "text": "8 hours" + }, + { + "key": "720", + "text": "12 hours" + }, + { + "key": "1440", + "text": "24 hours" + }, + { + "key": "2880", + "text": "48 hours" + }, + { + "key": "10080", + "text": "7 days" + } + ], + "placeholder": "Select polling interval (recommended: 12 hours)", + "isMultiSelect": false, + "defaultAllSelected": false, + "required": true, + "validations": { + "required": true + } + } + }, + { + "type": "InfoMessage", + "parameters": { + "text": "Required. Select how often Sentinel queries the Mimecast Human Risk API (12 hours is recommended). Each poll writes a new snapshot, so shorter intervals increase ingestion volume. The Mimecast rate limits are far above what this connector uses.", + "visible": true, + "inline": false + } + }, + { + "type": "ConnectionToggleButton", + "parameters": { + "connectLabel": "Connect", + "disconnectLabel": "Disconnect", + "name": "toggle" + } + } + ] + } + ] + } + } + }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition6'))]", + "contentId": "[variables('_dataConnectorContentIdConnectorDefinition6')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + }, + "dependencies": { + "criteria": [ { - "description": ">**(Optional Step)** Securely store workspace and API authorization key(s) or token(s) in Azure Key Vault. Azure Key Vault provides a secure mechanism to store and retrieve key values. [Follow these instructions](https://docs.microsoft.com/azure/app-service/app-service-key-vault-references) to use Azure Key Vault with an Azure Function App." - }, + "version": "[variables('dataConnectorCCPVersion')]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector" + } + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections6'), variables('dataConnectorCCPVersion'))]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], + "properties": { + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "displayName": "Mimecast Human Risk (via Codeless Connector Framework)", + "contentKind": "ResourcesDataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('dataConnectorCCPVersion')]", + "parameters": { + "guidValue": { + "defaultValue": "[[newGuid()]", + "type": "securestring" + }, + "innerWorkspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "connectorDefinitionName": { + "defaultValue": "Mimecast Human Risk (via Codeless Connector Framework)", + "type": "securestring", + "minLength": 1 + }, + "workspace": { + "defaultValue": "[parameters('workspace')]", + "type": "securestring" + }, + "dcrConfig": { + "defaultValue": { + "dataCollectionEndpoint": "data collection Endpoint", + "dataCollectionRuleImmutableId": "data collection rule immutableId" + }, + "type": "object" + }, + "mimecastBaseUrl": { + "defaultValue": "mimecastBaseUrl", + "type": "securestring", + "minLength": 1 + }, + "clientId": { + "defaultValue": "clientId", + "type": "securestring", + "minLength": 1 + }, + "clientSecret": { + "defaultValue": "clientSecret", + "type": "securestring", + "minLength": 1 + }, + "monthsBack": { + "defaultValue": "monthsBack", + "type": "securestring", + "minLength": 1 + }, + "pollingInterval": { + "defaultValue": "pollingInterval", + "type": "array" + } + }, + "variables": { + "_dataConnectorContentIdConnections6": "[variables('_dataConnectorContentIdConnections6')]" + }, + "resources": [ { - "description": "**STEP 1 - App Registration steps for the Application in Microsoft Entra ID**\n\n This integration requires an App registration in the Azure portal. Follow the steps in this section to create a new application in Microsoft Entra ID:\n 1. Sign in to the [Azure portal](https://portal.azure.com/).\n 2. Search for and select **Microsoft Entra ID**.\n 3. Under **Manage**, select **App registrations > New registration**.\n 4. Enter a display **Name** for your application.\n 5. Select **Register** to complete the initial app registration.\n 6. When registration finishes, the Azure portal displays the app registration's Overview pane. You see the **Application (client) ID** and **Tenant ID**. The client ID and Tenant ID is required as configuration parameters for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app)" + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections6')))]", + "apiVersion": "2022-01-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections6'))]", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "kind": "ResourcesDataConnector", + "version": "[variables('dataConnectorCCPVersion')]", + "source": { + "sourceId": "[variables('_solutionId')]", + "name": "[variables('_solutionName')]", + "kind": "Solution" + }, + "author": { + "name": "Mimecast", + "email": "[variables('_email')]" + }, + "support": { + "name": "Mimecast", + "email": "support@mimecast.com", + "tier": "Partner", + "link": "https://mimecastsupport.zendesk.com/" + } + } }, { - "description": "**STEP 2 - Add a client secret for application in Microsoft Entra ID**\n\n Sometimes called an application password, a client secret is a string value required for the execution of Mimecast Data Connector. Follow the steps in this section to create a new Client Secret:\n 1. In the Azure portal, in **App registrations**, select your application.\n 2. Select **Certificates & secrets > Client secrets > New client secret**.\n 3. Add a description for your client secret.\n 4. Select an expiration for the secret or specify a custom lifetime. Limit is 24 months.\n 5. Select **Add**. \n 6. *Record the secret's value for use in your client application code. This secret value is never displayed again after you leave this page.* The secret value is required as configuration parameter for the execution of Mimecast Data Connector. \n\n> **Reference link:** [https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret](https://learn.microsoft.com/azure/active-directory/develop/quickstart-register-app#add-a-client-secret)" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskOrganizationPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Organization_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Organization_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTotal,riskResponses,totals.totalActions,totals.notifications,totals.outboundActions,totals.groupChanges" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.trends[*]", + "$.totals" + ], + "format": "json" + }, + "isActive": true + } }, { - "description": "**STEP 3 - Get Object ID of your application in Microsoft Entra ID**\n\n After creating your app registration, follow the steps in this section to get Object ID:\n 1. Go to **Microsoft Entra ID**.\n 2. Select **Enterprise applications** from the left menu.\n 3. Find your newly created application in the list (you can search by the name you provided).\n 4. Click on the application.\n 5. On the overview page, copy the **Object ID**. This is the **AzureEntraObjectId** needed for your ARM template role assignment.\n" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskBehaviorsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Behaviors_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Behaviors_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/behaviors')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "events" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.behaviors[*]" + ], + "format": "json" + }, + "isActive": true + } }, { - "description": "**STEP 4 - Deploy Mimecast API Connector**\n\n>**IMPORTANT:** Before deploying the Mimecast API connector, have the Mimecast API authorization key(s) or Token, readily available." + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskAttacksPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Attacks_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Attacks_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/organization/attacks')]", + "httpMethod": "GET", + "queryParameters": { + "monthsBack": "[[if(equals(parameters('monthsBack'), 'monthsBack'), '3', string(parameters('monthsBack')))]", + "fields": "attackTypes" + }, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$" + ], + "format": "json" + }, + "isActive": true + } }, { - "description": "Use this method for automated deployment of the Mimecast Targeted Threat Protection Data connector.\n\n1. Click the **Deploy to Azure** button below. \n\n\t[![Deploy To Azure](https://aka.ms/deploytoazurebutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy) [![Deploy to Azure Gov](https://aka.ms/deploytoazuregovbutton)](https://aka.ms/sentinel-MimecastTTPAzureDeploy-azuredeploy-gov)\n2. Select the preferred **Subscription**, **Resource Group** and **Region**. \n3. Enter the below information : \n\n\t a. Location - The location in which the data collection rules and data collection endpoints should be deployed\n\n\t b. WorkspaceName - Enter Microsoft Sentinel Workspace Name of Log Analytics workspace\n\n\t c. AzureClientID - Enter Azure Client ID that you have created during app registration\n\n\t d. AzureClientSecret - Enter Azure Client Secret that you have created during creating the client secret\n\n\t e. AzureTenantID - Enter Azure Tenant ID of your Azure Active Directory\n\n\t f. AzureEntraObjectID - Enter Object id of your Microsoft Entra App\n\n\t g. MimecastBaseURL - Enter Base URL of Mimecast API 2.0 (e.g. https://api.services.mimecast.com)\n\n\t h. MimecastClientID - Enter Mimecast Client ID for authentication\n\n\t i. MimecastClientSecret - Enter Mimecast Client Secret for authentication\n\n\t j. StartDate - Enter the start date in the 'yyyy-mm-dd' format. If you do not provide a date, data from the last 60 days will be fetched automatically. Ensure that the date is in the past and properly formatted\n\n\t k. MimecastTTPAttachmentTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Attachment'\n\n\t l. MimecastTTPImpersonationTableName - Enter name of the table used to store TTP Impersonation data. Default is 'Ttp_Impersonation'\n\n\t m. MimecastTTPUrlTableName - Enter name of the table used to store TTP Attachment data. Default is 'Ttp_Url'\n\n\t n. Schedule - Please enter a valid Quartz cron-expression. (Example: 0 0 */1 * * *) Do not keep the value empty, minimum value is 10 minutes\n\n\t l. LogLevel - Please add log level or log severity value. By default it is set to INFO\n\n\t o. AppInsightsWorkspaceResourceId - Migrate Classic Application Insights to Log Analytic Workspace which is retiring by 29 Febraury 2024. Use 'Log Analytic Workspace-->Properties' blade having 'Resource ID' property value. This is a fully qualified resourceId which is in format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}' \n4. Mark the checkbox labeled **I agree to the terms and conditions stated above**. \n5. Click **Purchase** to deploy.", - "title": "Azure Resource Manager (ARM) Template" + "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'MimecastHumanRiskIndividualsPoller', parameters('guidValue'))]", + "apiVersion": "2023-02-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "RestApiPoller", + "properties": { + "connectorDefinitionName": "MimecastHumanRiskCCF", + "dataType": "MimecastHumanRisk_Individuals_CL", + "dcrConfig": { + "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", + "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]", + "streamName": "Custom-MimecastHumanRisk_Individuals_CL" + }, + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/oauth/token')]", + "TokenEndpointHeaders": { + "Content-Type": "application/x-www-form-urlencoded", + "Accept": "application/json" + } + }, + "request": { + "apiEndpoint": "[[concat(trim(parameters('mimecastBaseUrl')), '/human-risk/v1/individuals/search?pageSize=1000&fields=firstName,lastName,tenureMonths,tenureStatus,startDateTime,behaviors.eventCount,behaviors.events,attacks.eventCount,attacks.events')]", + "httpMethod": "POST", + "isPostPayloadJson": true, + "queryParametersTemplate": "{}", + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-MimecastHumanRisk-CCF" + }, + "rateLimitQPS": 1, + "queryWindowInMin": "[[int(first(parameters('pollingInterval')))]", + "retryCount": 3, + "timeoutInSeconds": 120 + }, + "response": { + "eventsJsonPaths": [ + "$.individuals[*]" + ], + "format": "json" + }, + "paging": { + "pagingType": "NextPageToken", + "nextPageTokenJsonPath": "$.meta.nextPage", + "nextPageParaName": "pageToken", + "pagingInfoPlacement": "QueryString" + }, + "isActive": true + } } - ], - "id": "[variables('_uiConfigId5')]" - } + ] + }, + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections6'),'-', variables('dataConnectorCCPVersion'))))]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "version": "[variables('dataConnectorCCPVersion')]" } }, { @@ -6409,12 +8542,12 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.0", + "version": "3.1.1", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Mimecast", "publisherDisplayName": "Mimecast", - "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.

\n

Data Connectors: 5, Parsers: 11, Workbooks: 5, Analytic Rules: 13, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

An Azure app to enable Mimecast data to be viewed using analytical tables and charts which are brought into Azure.

\n

Data Connectors: 6, Parsers: 15, Workbooks: 6, Analytic Rules: 13, Playbooks: 1

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -6529,6 +8662,11 @@ "contentId": "[variables('_workbookContentId5')]", "version": "[variables('workbookVersion5')]" }, + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId6')]", + "version": "[variables('workbookVersion6')]" + }, { "kind": "Playbook", "contentId": "[variables('_Mimecast Data Connector Trigger Sync')]", @@ -6589,6 +8727,26 @@ "contentId": "[variables('parserObject11').parserContentId11]", "version": "[variables('parserObject11').parserVersion11]" }, + { + "kind": "Parser", + "contentId": "[variables('parserObject12').parserContentId12]", + "version": "[variables('parserObject12').parserVersion12]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject13').parserContentId13]", + "version": "[variables('parserObject13').parserVersion13]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject14').parserContentId14]", + "version": "[variables('parserObject14').parserVersion14]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject15').parserContentId15]", + "version": "[variables('parserObject15').parserVersion15]" + }, { "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId1')]", @@ -6613,6 +8771,11 @@ "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentId5')]", "version": "[variables('dataConnectorVersion5')]" + }, + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentIdConnections6')]", + "version": "[variables('dataConnectorCCPVersion')]" } ] }, diff --git a/Solutions/Mimecast/Package/testParameters.json b/Solutions/Mimecast/Package/testParameters.json index a6004ba15f1..bb3086e31a3 100644 --- a/Solutions/Mimecast/Package/testParameters.json +++ b/Solutions/Mimecast/Package/testParameters.json @@ -60,5 +60,27 @@ "metadata": { "description": "Name for the workbook" } + }, + "workbook6-name": { + "type": "string", + "defaultValue": "Mimecast Human Risk Workbook", + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + }, + "resourceGroupName": { + "type": "string", + "defaultValue": "[resourceGroup().name]", + "metadata": { + "description": "resource group name where Microsoft Sentinel is setup" + } + }, + "subscription": { + "type": "string", + "defaultValue": "[last(split(subscription().id, '/'))]", + "metadata": { + "description": "subscription id where Microsoft Sentinel is setup" + } } } diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml new file mode 100644 index 00000000000..938390fbf8d --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Attacks.yaml @@ -0,0 +1,70 @@ +id: 8265ae28-63f1-43a8-ac57-6d5f7a1dca5f +Function: + Title: Parser for Mimecast Human Risk Attacks + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskAttacks +FunctionAlias: MimecastHumanRiskAttacks +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskAttacks_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Attacks_CL + | extend + AttackScore = toint(column_ifexists('AttackScore', int(null))), + AttackFactor = tostring(column_ifexists('AttackFactor', '')), + AttackTypes = todynamic(column_ifexists('AttackTypes', dynamic(null))) + | extend AttackTypesRaw = iff(gettype(AttackTypes) != 'array' or array_length(AttackTypes) == 0, dynamic([{}]), AttackTypes) + | mv-expand AttackTypeItem = AttackTypesRaw + | extend + AttackFactorLabel = FactorLabel(AttackFactor), + AttackType = tostring(AttackTypeItem.type), + AttackTypeTotal = toint(AttackTypeItem.attackTotal), + AttackTypeScore = toint(AttackTypeItem.attackScore), + AttackTypeFactor = tostring(AttackTypeItem.attackFactor), + AttackTypeTrend = toint(AttackTypeItem.trend), + AttackTypeEvents = AttackTypeItem.events, + EventDelivered = toint(AttackTypeItem.events.delivered), + EventBlocked = toint(AttackTypeItem.events.blocked), + EventRemediated = toint(AttackTypeItem.events.remediated), + EventDownloadAttempted = toint(AttackTypeItem.events.downloadAttempted), + EventDownloaded = toint(AttackTypeItem.events.downloaded), + EventExecuted = toint(AttackTypeItem.events.executed), + EventUnknown = toint(AttackTypeItem.events.unknown), + EventAnomalous = toint(AttackTypeItem.events.anomalous), + EventSuspicious = toint(AttackTypeItem.events.suspicious), + EventMalicious = toint(AttackTypeItem.events.malicious), + EventReported = toint(AttackTypeItem.events.reported) + | extend + AttackTypeName = case(AttackType == 'actualPhishing', 'Actual Phishing', AttackType == 'malware', 'Malware', AttackType == 'identity', 'Identity', AttackType), + AttackTypeFactorLabel = FactorLabel(AttackTypeFactor) + | project + TimeGenerated, + AttackScore, + AttackFactor, + AttackFactorLabel, + AttackType, + AttackTypeName, + AttackTypeTotal, + AttackTypeScore, + AttackTypeFactor, + AttackTypeFactorLabel, + AttackTypeTrend, + AttackTypeEvents, + EventDelivered, + EventBlocked, + EventRemediated, + EventDownloadAttempted, + EventDownloaded, + EventExecuted, + EventUnknown, + EventAnomalous, + EventSuspicious, + EventMalicious, + EventReported, + AttackTypes + }; + MimecastHumanRiskAttacks_view diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml new file mode 100644 index 00000000000..4c00e97a57c --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Behaviors.yaml @@ -0,0 +1,75 @@ +id: 2716f1d3-a1e7-4979-9c41-45941c12bdf8 +Function: + Title: Parser for Mimecast Human Risk Behaviors + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskBehaviors +FunctionAlias: MimecastHumanRiskBehaviors +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskBehaviors_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Behaviors_CL + | extend + BehaviorType = tostring(column_ifexists('BehaviorType', '')), + Score = toint(column_ifexists('Score', int(null))), + Factor = tostring(column_ifexists('Factor', '')), + EventCount = toint(column_ifexists('EventCount', int(null))), + Trend = toint(column_ifexists('Trend', int(null))), + Events = todynamic(column_ifexists('Events', dynamic(null))) + | extend + BehaviorName = case(BehaviorType == 'training', 'Training', BehaviorType == 'simulatedPhishing', 'Simulated Phishing', BehaviorType == 'actualPhishing', 'Actual Phishing', BehaviorType == 'malware', 'Malware', BehaviorType == 'sensitiveDataHandling', 'Sensitive Data Handling', BehaviorType), + FactorLabel = FactorLabel(Factor), + EventAssigned = toint(Events.assigned), + EventCompleted = toint(Events.completed), + EventOverdue = toint(Events.overdue), + EventDelivered = toint(Events.delivered), + EventOpened = toint(Events.opened), + EventClicked = toint(Events.clicked), + EventReported = toint(Events.reported), + EventSubmittedData = toint(Events.submittedData), + EventAttachmentOpened = toint(Events.attachmentOpened), + EventBlocked = toint(Events.blocked), + EventRemediated = toint(Events.remediated), + EventFalsePositiveRemediated = toint(Events.falsePositiveRemediated), + EventAttachmentDownloaded = toint(Events.attachmentDownloaded), + EventDownloadAttempted = toint(Events.downloadAttempted), + EventDownloaded = toint(Events.downloaded), + EventExecuted = toint(Events.executed), + EventUnknown = toint(Events.unknown), + EventProperlyHandled = toint(Events.properlyHandled), + EventImproperlyHandled = toint(Events.improperlyHandled) + | project + TimeGenerated, + BehaviorType, + BehaviorName, + Score, + Factor, + FactorLabel, + EventCount, + Trend, + Events, + EventAssigned, + EventCompleted, + EventOverdue, + EventDelivered, + EventOpened, + EventClicked, + EventReported, + EventSubmittedData, + EventAttachmentOpened, + EventBlocked, + EventRemediated, + EventFalsePositiveRemediated, + EventAttachmentDownloaded, + EventDownloadAttempted, + EventDownloaded, + EventExecuted, + EventUnknown, + EventProperlyHandled, + EventImproperlyHandled + }; + MimecastHumanRiskBehaviors_view diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml new file mode 100644 index 00000000000..96e97fc9cc1 --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Individuals.yaml @@ -0,0 +1,148 @@ +id: 5cba6723-ef08-4b4f-b971-71ffb16fc7e4 +Function: + Title: Parser for Mimecast Human Risk Individuals + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskIndividuals +FunctionAlias: MimecastHumanRiskIndividuals +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskIndividuals_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Individuals_CL + | extend + IndividualId = tostring(column_ifexists('IndividualId', '')), + DisplayName = tostring(column_ifexists('DisplayName', '')), + EmailAddress = tostring(column_ifexists('EmailAddress', '')), + FirstName = tostring(column_ifexists('FirstName', '')), + LastName = tostring(column_ifexists('LastName', '')), + ManagerName = tostring(column_ifexists('ManagerName', '')), + ManagerId = tostring(column_ifexists('ManagerId', '')), + Department = tostring(column_ifexists('Department', '')), + Location = tostring(column_ifexists('Location', '')), + JobTitle = tostring(column_ifexists('JobTitle', '')), + TenureMonths = toint(column_ifexists('TenureMonths', int(null))), + TenureStatus = tostring(column_ifexists('TenureStatus', '')), + StartDateTime = todatetime(column_ifexists('StartDateTime', datetime(null))), + HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))), + HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')), + AttackScore = toint(column_ifexists('AttackScore', int(null))), + AttackFactor = tostring(column_ifexists('AttackFactor', '')), + Behaviors = todynamic(column_ifexists('Behaviors', dynamic(null))), + Attacks = todynamic(column_ifexists('Attacks', dynamic(null))) + | extend + BehaviorsSrc = iff(gettype(Behaviors) != 'array' or array_length(Behaviors) == 0, dynamic([{}]), Behaviors), + AttacksSrc = iff(gettype(Attacks) != 'array' or array_length(Attacks) == 0, dynamic([{}]), Attacks) + | mv-apply b = BehaviorsSrc on (summarize Bhv = make_bag(bag_pack(coalesce(tostring(b.type), 'none'), b))) + | mv-apply a = AttacksSrc on (summarize Atk = make_bag(bag_pack(coalesce(tostring(a.type), 'none'), a))) + | extend + HumanRiskFactorLabel = FactorLabel(HumanRiskFactor), + AttackFactorLabel = FactorLabel(AttackFactor), + SimulatedPhishingScore = toint(Bhv.simulatedPhishing.score), + SimulatedPhishingFactor = tostring(Bhv.simulatedPhishing.factor), + SimulatedPhishingTrend = toint(Bhv.simulatedPhishing.trend), + SimulatedPhishingEventCount = toint(Bhv.simulatedPhishing.eventCount), + SimulatedPhishingEvents = Bhv.simulatedPhishing.events, + ActualPhishingScore = toint(Bhv.actualPhishing.score), + ActualPhishingFactor = tostring(Bhv.actualPhishing.factor), + ActualPhishingTrend = toint(Bhv.actualPhishing.trend), + ActualPhishingEventCount = toint(Bhv.actualPhishing.eventCount), + ActualPhishingEvents = Bhv.actualPhishing.events, + TrainingScore = toint(Bhv.training.score), + TrainingFactor = tostring(Bhv.training.factor), + TrainingTrend = toint(Bhv.training.trend), + TrainingEventCount = toint(Bhv.training.eventCount), + TrainingEvents = Bhv.training.events, + MalwareScore = toint(Bhv.malware.score), + MalwareFactor = tostring(Bhv.malware.factor), + MalwareTrend = toint(Bhv.malware.trend), + MalwareEventCount = toint(Bhv.malware.eventCount), + MalwareEvents = Bhv.malware.events, + SensitiveDataHandlingScore = toint(Bhv.sensitiveDataHandling.score), + SensitiveDataHandlingFactor = tostring(Bhv.sensitiveDataHandling.factor), + SensitiveDataHandlingTrend = toint(Bhv.sensitiveDataHandling.trend), + SensitiveDataHandlingEventCount = toint(Bhv.sensitiveDataHandling.eventCount), + SensitiveDataHandlingEvents = Bhv.sensitiveDataHandling.events, + ActualPhishingAttackScore = toint(Atk.actualPhishing.score), + ActualPhishingAttackFactor = tostring(Atk.actualPhishing.factor), + ActualPhishingAttackTrend = toint(Atk.actualPhishing.trend), + ActualPhishingAttackEventCount = toint(Atk.actualPhishing.eventCount), + ActualPhishingAttackEvents = Atk.actualPhishing.events, + MalwareAttackScore = toint(Atk.malware.score), + MalwareAttackFactor = tostring(Atk.malware.factor), + MalwareAttackTrend = toint(Atk.malware.trend), + MalwareAttackEventCount = toint(Atk.malware.eventCount), + MalwareAttackEvents = Atk.malware.events, + IdentityAttackScore = toint(Atk.identity.score), + IdentityAttackFactor = tostring(Atk.identity.factor), + IdentityAttackTrend = toint(Atk.identity.trend), + IdentityAttackEventCount = toint(Atk.identity.eventCount), + IdentityAttackEvents = Atk.identity.events + | project + TimeGenerated, + IndividualId, + DisplayName, + EmailAddress, + FirstName, + LastName, + ManagerName, + ManagerId, + Department, + Location, + JobTitle, + TenureMonths, + TenureStatus, + StartDateTime, + HumanRiskScore, + HumanRiskFactor, + AttackScore, + AttackFactor, + HumanRiskFactorLabel, + AttackFactorLabel, + SimulatedPhishingScore, + SimulatedPhishingFactor, + SimulatedPhishingTrend, + SimulatedPhishingEventCount, + SimulatedPhishingEvents, + ActualPhishingScore, + ActualPhishingFactor, + ActualPhishingTrend, + ActualPhishingEventCount, + ActualPhishingEvents, + TrainingScore, + TrainingFactor, + TrainingTrend, + TrainingEventCount, + TrainingEvents, + MalwareScore, + MalwareFactor, + MalwareTrend, + MalwareEventCount, + MalwareEvents, + SensitiveDataHandlingScore, + SensitiveDataHandlingFactor, + SensitiveDataHandlingTrend, + SensitiveDataHandlingEventCount, + SensitiveDataHandlingEvents, + ActualPhishingAttackScore, + ActualPhishingAttackFactor, + ActualPhishingAttackTrend, + ActualPhishingAttackEventCount, + ActualPhishingAttackEvents, + MalwareAttackScore, + MalwareAttackFactor, + MalwareAttackTrend, + MalwareAttackEventCount, + MalwareAttackEvents, + IdentityAttackScore, + IdentityAttackFactor, + IdentityAttackTrend, + IdentityAttackEventCount, + IdentityAttackEvents, + Behaviors, + Attacks + }; + MimecastHumanRiskIndividuals_view diff --git a/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml new file mode 100644 index 00000000000..ead5142d62f --- /dev/null +++ b/Solutions/Mimecast/Parsers/MimecastHumanRisk/Mimecast_HumanRisk_Organization.yaml @@ -0,0 +1,55 @@ +id: 25194ae7-8559-4a86-aa1f-0081ca5189f5 +Function: + Title: Parser for Mimecast Human Risk Organization + Version: '1.1.0' + LastUpdated: '2026-10-21' +Category: Microsoft Sentinel Parser +FunctionName: MimecastHumanRiskOrganization +FunctionAlias: MimecastHumanRiskOrganization +FunctionQuery: | + let dummy_table = datatable(TimeGenerated: datetime) []; + let FactorLabel = (f: string) { case(f == 'veryLow', 'Very Low', f == 'low', 'Low', f == 'medium', 'Medium', f == 'high', 'High', f == 'veryHigh', 'Very High', 'Not Scored') }; + let MimecastHumanRiskOrganization_view = view() { + union isfuzzy=true + dummy_table, + MimecastHumanRisk_Organization_CL + | extend + Month = tostring(column_ifexists('Month', '')), + HumanRiskScore = toint(column_ifexists('HumanRiskScore', int(null))), + HumanRiskFactor = tostring(column_ifexists('HumanRiskFactor', '')), + HumanRiskScoreTrend = toint(column_ifexists('HumanRiskScoreTrend', int(null))), + AttackScore = toint(column_ifexists('AttackScore', int(null))), + AttackFactor = tostring(column_ifexists('AttackFactor', '')), + AttackTrend = toint(column_ifexists('AttackTrend', int(null))), + AttackTotal = toint(column_ifexists('AttackTotal', int(null))), + RiskResponses = toint(column_ifexists('RiskResponses', int(null))), + TotalActions = toint(column_ifexists('TotalActions', int(null))), + Notifications = toint(column_ifexists('Notifications', int(null))), + OutboundActions = toint(column_ifexists('OutboundActions', int(null))), + GroupChanges = toint(column_ifexists('GroupChanges', int(null))) + | extend + RecordType = iff(isempty(Month), 'Totals', 'Monthly'), + MonthStart = todatetime(strcat(Month, '-01')), + HumanRiskFactorLabel = FactorLabel(HumanRiskFactor), + AttackFactorLabel = FactorLabel(AttackFactor) + | project + TimeGenerated, + RecordType, + Month, + MonthStart, + HumanRiskScore, + HumanRiskFactor, + HumanRiskScoreTrend, + AttackScore, + AttackFactor, + AttackTrend, + AttackTotal, + RiskResponses, + TotalActions, + Notifications, + OutboundActions, + GroupChanges, + HumanRiskFactorLabel, + AttackFactorLabel + }; + MimecastHumanRiskOrganization_view diff --git a/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json b/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json new file mode 100644 index 00000000000..1ff8f4a787e --- /dev/null +++ b/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json @@ -0,0 +1,1490 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "# Mimecast Human Risk\n\nMonitor your organization's human risk posture using data from the Mimecast Human Risk connector. This workbook includes:\n\n- **Risk Overview** - average human risk score, risk response activity and how individuals are spread across risk factors.\n- **Risk Trends** - monthly human risk and attack scores.\n- **Highest Human Risks** - top 10 individuals, departments or locations by human risk score.\n- **Human Risk Behaviors and Organization Attacks** - scores and event breakdowns by behavior and attack type." + }, + "name": "q1", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 1, + "content": { + "json": ">**NOTE:** This workbook depends on parsers based on Kusto functions - **MimecastHumanRiskOrganization**, **MimecastHumanRiskBehaviors**, **MimecastHumanRiskAttacks** and **MimecastHumanRiskIndividuals** - which are deployed with the Microsoft Sentinel Solution.", + "style": "info" + }, + "name": "q1-note-parsers", + "styleSettings": { + "margin": "6px" + } + }, + { + "type": 1, + "content": { + "json": "Data is collected as snapshots at the polling interval chosen in the connector (default 12 hours). Each panel shows the latest snapshot inside the selected time range, so keep the time range at least as long as the polling interval.", + "style": "upsell" + }, + "name": "q1-note-snapshot", + "styleSettings": { + "margin": "6px" + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a1", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "typeSettings": { + "selectableValues": [ + { + "durationMs": 14400000 + }, + { + "durationMs": 28800000 + }, + { + "durationMs": 43200000 + }, + { + "durationMs": 86400000 + }, + { + "durationMs": 172800000 + }, + { + "durationMs": 604800000 + }, + { + "durationMs": 2592000000 + }, + { + "durationMs": 7776000000 + }, + { + "durationMs": 15552000000 + } + ], + "allowCustom": true + }, + "timeContext": { + "durationMs": 43200000 + }, + "value": { + "durationMs": 43200000 + } + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters-time", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-header", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Risk Overview\nAverage human risk, risk-response activity and how individuals are distributed across risk factors." + }, + "name": "h-overview", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| summarize Value = round(avg(HumanRiskScore), 1) | extend Metric = 'Average Human Risk Score (0-100)'", + "size": 3, + "title": "Human Risk Score", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "customWidth": "25", + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 4, + "maximumFractionDigits": 1 + } + } + }, + "showBorder": true + } + }, + "name": "q2", + "customWidth": "25", + "styleSettings": { + "margin": "4px", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "let T = MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by Month;\nT | summarize Notifications = avg(Notifications), GroupChanges = avg(GroupChanges), TotalActions = avg(TotalActions)\n| project Metric = dynamic(['Notifications','Group Changes','Risk Activity']), Value = pack_array(Notifications, GroupChanges, TotalActions)\n| mv-expand Metric to typeof(string), Value to typeof(real)\n| project Metric, Value = round(Value, 1)", + "size": 3, + "title": "Notifications, Group Changes and Risk Activity", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "Metric", + "formatter": 1 + }, + "leftContent": { + "columnMatch": "Value", + "formatter": 12, + "formatOptions": { + "palette": "greenRed" + }, + "numberFormat": { + "unit": 17, + "options": { + "maximumSignificantDigits": 4, + "maximumFractionDigits": 1 + } + } + }, + "showBorder": true + }, + "customWidth": "75" + }, + "name": "q7", + "styleSettings": { + "margin": "4px", + "showBorder": true + }, + "customWidth": "75" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Bucket = case(isempty(HumanRiskFactor) or HumanRiskFactor == 'notScored', 'Not Scored', HumanRiskFactor == 'veryLow', 'Very Low', HumanRiskFactor == 'low', 'Low', HumanRiskFactor == 'medium', 'Medium', HumanRiskFactor == 'high', 'High', HumanRiskFactor == 'veryHigh', 'Very High', 'Not Scored')\n| summarize Count = count() by Bucket\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o", + "size": 3, + "title": "Human Risk Factor Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "customWidth": "50", + "chartSettings": { + "showLegend": true, + "showMetrics": false + } + }, + "name": "q3", + "customWidth": "50", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Bucket = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\n| summarize Count = count() by Bucket\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o", + "size": 3, + "title": "Attack Factor Distribution", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "customWidth": "50", + "chartSettings": { + "showLegend": true, + "showMetrics": false + } + }, + "name": "q4", + "customWidth": "50", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + } + ], + "exportParameters": false + }, + "name": "group-overview", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Risk Trends\nMonthly organization human risk and attack scores." + }, + "name": "h-trends", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| project Month, ['Human Risk Score'] = HumanRiskScore\n| sort by Month asc", + "size": 1, + "title": "Human Risk Score Trends", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "columnchart", + "customWidth": "50", + "chartSettings": { + "showLegend": true, + "xAxis": "Month" + } + }, + "name": "q5", + "customWidth": "50", + "styleSettings": { + "margin": "4px", + "padding": "6px", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\n| sort by Month asc", + "size": 1, + "title": "Human Risk Score Trends - Risk Responses", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "columnchart", + "customWidth": "50", + "chartSettings": { + "showLegend": true, + "xAxis": "Month" + } + }, + "name": "q6", + "customWidth": "50", + "styleSettings": { + "margin": "4px", + "padding": "6px", + "showBorder": true + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| where isnotnull(AttackScore)\n| project Month, ['Attack Score'] = AttackScore\n| sort by Month asc", + "size": 1, + "title": "Attack Score Trends", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "linechart", + "chartSettings": { + "showLegend": true, + "xAxis": "Month" + } + }, + "name": "q12", + "styleSettings": { + "margin": "4px", + "padding": "6px", + "showBorder": true + } + } + ], + "exportParameters": false + }, + "name": "group-trends", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Highest Human Risks\nTop 10 individuals, departments or locations. Use the selector to switch views." + }, + "name": "h-highest", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "b1", + "version": "KqlParameterItem/1.0", + "name": "groupby", + "label": "Highest Risks", + "type": 2, + "isRequired": true, + "typeSettings": { + "additionalResourceOptions": [], + "showDefault": false + }, + "jsonData": "[{\"value\":\"individuals\",\"label\":\"Individuals\"},{\"value\":\"department\",\"label\":\"Departments\"},{\"value\":\"locations\",\"label\":\"Locations\"}]", + "value": "individuals" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters-groupby", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", + "size": 0, + "title": "Individuals Highest Human Risks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK FACTOR", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Very Low", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "blue", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "High", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Very High", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not Scored", + "representation": "gray", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + } + ], + "rowLimit": 10000 + } + }, + "name": "q8", + "conditionalVisibilities": [ + { + "comparison": "isEqualTo", + "parameterName": "groupby", + "value": "individuals" + } + ], + "conditionalVisibility": { + "parameterName": "groupby", + "comparison": "isEqualTo", + "value": "individuals" + }, + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", + "size": 0, + "title": "Departments Highest Human Risks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + } + ], + "rowLimit": 10000 + } + }, + "name": "q9", + "conditionalVisibilities": [ + { + "comparison": "isEqualTo", + "parameterName": "groupby", + "value": "department" + } + ], + "conditionalVisibility": { + "parameterName": "groupby", + "comparison": "isEqualTo", + "value": "department" + }, + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", + "size": 0, + "title": "Locations Highest Human Risks", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + } + ], + "rowLimit": 10000 + } + }, + "name": "q10", + "conditionalVisibilities": [ + { + "comparison": "isEqualTo", + "parameterName": "groupby", + "value": "locations" + } + ], + "conditionalVisibility": { + "parameterName": "groupby", + "comparison": "isEqualTo", + "value": "locations" + }, + "styleSettings": { + "margin": "4px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-highest", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Human Risk Behaviors" + }, + "name": "h-behaviors", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 1, + "content": { + "json": "Click a row to see its event breakdown.", + "style": "info" + }, + "name": "h-behaviors-info", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\n| sort by ['TOTAL EVENTS'] desc", + "size": 0, + "title": "Human Risk Behaviors (click a row to see event breakdown)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "HUMAN RISK FACTOR", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Very Low", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "blue", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "High", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Very High", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not Scored", + "representation": "gray", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "TOTAL EVENTS", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + }, + "exportFieldName": "STAGE", + "exportDefaultValue": "none", + "exportParameterName": "selected_behavior" + }, + "name": "q13", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "id": "73895154-b0e3-4cff-9156-adb5d1b1914f", + "cellValue": "selected_behavior", + "linkTarget": "parameter", + "linkLabel": "Clear Selection", + "subTarget": "none", + "style": "link" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selected_behavior", + "comparison": "isNotEqualTo", + "value": "none" + }, + "name": "q14", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\n| where BehaviorName == '{selected_behavior}'\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\n| where isnotnull(COUNT)\n| sort by COUNT desc", + "size": 0, + "title": "Event Breakdown for {selected_behavior}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "COUNT", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + } + }, + "name": "q15", + "conditionalVisibilities": [ + { + "comparison": "isNotEqualTo", + "parameterName": "selected_behavior", + "value": "none" + } + ], + "conditionalVisibility": { + "parameterName": "selected_behavior", + "comparison": "isNotEqualTo", + "value": "none" + }, + "styleSettings": { + "margin": "4px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-behaviors", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 12, + "content": { + "version": "NotebookGroup/1.0", + "groupType": "editable", + "items": [ + { + "type": 1, + "content": { + "json": "## Organization Attacks" + }, + "name": "h-attacks", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 1, + "content": { + "json": "Click a row to see its event breakdown.", + "style": "info" + }, + "name": "h-attacks-info", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\n| sort by ['TOTAL EVENTS'] desc", + "size": 0, + "title": "Organization Attacks (click a row to see event breakdown)", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK FACTOR", + "formatter": 18, + "formatOptions": { + "thresholdsOptions": "colors", + "thresholdsGrid": [ + { + "operator": "==", + "thresholdValue": "Very Low", + "representation": "green", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Low", + "representation": "blue", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Medium", + "representation": "yellow", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "High", + "representation": "orange", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Very High", + "representation": "redBright", + "text": "{0}{1}" + }, + { + "operator": "==", + "thresholdValue": "Not Scored", + "representation": "gray", + "text": "{0}{1}" + }, + { + "operator": "Default", + "thresholdValue": null, + "representation": "gray", + "text": "{0}{1}" + } + ] + } + }, + { + "columnMatch": "TOTAL EVENTS", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + }, + "exportFieldName": "ATTACKTYPE", + "exportDefaultValue": "none", + "exportParameterName": "selected_attack" + }, + "name": "q16", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 11, + "content": { + "version": "LinkItem/1.0", + "style": "paragraph", + "links": [ + { + "id": "23876233-22fb-4871-9841-83a1a9ccc975", + "cellValue": "selected_attack", + "linkTarget": "parameter", + "linkLabel": "Clear Selection", + "subTarget": "none", + "style": "link" + } + ] + }, + "conditionalVisibility": { + "parameterName": "selected_attack", + "comparison": "isNotEqualTo", + "value": "none" + }, + "name": "q17", + "styleSettings": { + "margin": "4px", + "showBorder": false + } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\n| where AttackTypeName == '{selected_attack}'\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\n| where isnotnull(COUNT)\n| sort by COUNT desc", + "size": 0, + "title": "Event Breakdown for {selected_attack}", + "timeContext": { + "durationMs": 0 + }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "filter": true, + "formatters": [ + { + "columnMatch": "HUMAN RISK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SIMULATED PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ACTUAL PHISHING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "TRAINING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "MALWARE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "SENSITIVE DATA HANDLING", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "ATTACK SCORE", + "formatter": 8, + "formatOptions": { + "min": 0, + "max": 100, + "palette": "greenRed" + } + }, + { + "columnMatch": "COUNT", + "formatter": 4, + "formatOptions": { + "palette": "blue" + } + } + ], + "rowLimit": 10000 + } + }, + "name": "q18", + "conditionalVisibilities": [ + { + "comparison": "isNotEqualTo", + "parameterName": "selected_attack", + "value": "none" + } + ], + "conditionalVisibility": { + "parameterName": "selected_attack", + "comparison": "isNotEqualTo", + "value": "none" + }, + "styleSettings": { + "margin": "4px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-attacks", + "styleSettings": { + "margin": "8px", + "padding": "10px", + "showBorder": true + } + }, + { + "type": 1, + "content": { + "json": "_Refresh the page to load the latest collected snapshot._" + }, + "name": "h-footer", + "styleSettings": { + "margin": "6px", + "showBorder": false + } + } + ], + "exportParameters": true + }, + "name": "group-main", + "styleSettings": { + "margin": "6px", + "padding": "12px", + "showBorder": true + } + } + ], + "fromTemplateId": "b8d6e9a4-3c1f-4e7a-9f52-6a0d1c7e2b35", + "name": "MimecastHumanRisk", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} \ No newline at end of file diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 7cb1c90f448..302170290bd 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -8152,6 +8152,26 @@ "subtitle": "", "provider": "Mimecast" }, + { + "workbookKey": "Mimecast_HumanRisk_Workbook", + "logoFileName": "Mimecast.svg", + "description": "A workbook providing insights into Mimecast Human Risk, including organization risk trends, behavior and attack metrics, and the individuals, departments and locations with the highest human risk.", + "dataTypesDependencies": [ + "MimecastHumanRisk_Organization_CL", + "MimecastHumanRisk_Behaviors_CL", + "MimecastHumanRisk_Attacks_CL", + "MimecastHumanRisk_Individuals_CL" + ], + "dataConnectorsDependencies": [ + "MimecastHumanRiskCCF" + ], + "previewImagesFileNames": [], + "version": "1.0.0", + "title": "Mimecast Human Risk Workbook", + "templateRelativePath": "Mimecast_HumanRisk_Workbook.json", + "subtitle": "", + "provider": "Mimecast" + }, { "workbookKey": "Mimecast_TTP_Workbook", "logoFileName": "Mimecast.svg", From 5aff5746d5ef0e0de46e28f263e3c672ebe34e81 Mon Sep 17 00:00:00 2001 From: Devendra Chavda Date: Fri, 23 Oct 2026 12:53:56 +0530 Subject: [PATCH 2/3] added release note --- Solutions/Mimecast/ReleaseNotes.md | 1 + 1 file changed, 1 insertion(+) diff --git a/Solutions/Mimecast/ReleaseNotes.md b/Solutions/Mimecast/ReleaseNotes.md index 0c8be41caf8..7a53d03e246 100644 --- a/Solutions/Mimecast/ReleaseNotes.md +++ b/Solutions/Mimecast/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified** | **Change History** | |---------------|--------------------------------|------------------------------------------------------------------------| +| 3.1.1 | 23-10-2026 | Added Mimecast Human Risk **Data Connector** (CCF) with **Parsers** and **Workbook**. | | 3.1.0 | 29-10-2025 | Added Log Ingestion API support in **Data Connectors**. Added Government button for support. | | 3.0.1 | 12-02-2025 | Updated default table for MimecastAudit to get the Connected label on **Data Connector** UI page. | | 3.0.0 | 09-09-2024 | Initial Solution Release | From 10dacd49dc9c73e33d93954d3cb2671b324eb23a Mon Sep 17 00:00:00 2001 From: Devendra Chavda Date: Fri, 30 Oct 2026 15:39:25 +0530 Subject: [PATCH 3/3] Update UI page and workbook --- ...MimecastHumanRisk_ConnectorDefinition.json | 12 +- Solutions/Mimecast/Package/3.1.1.zip | Bin 66228 -> 66851 bytes Solutions/Mimecast/Package/mainTemplate.json | 158 ++++---- .../Mimecast_HumanRisk_Workbook.json | 339 ++++++++++-------- 4 files changed, 271 insertions(+), 238 deletions(-) diff --git a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json index 41da5337285..1c0afc43795 100644 --- a/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json +++ b/Solutions/Mimecast/Data Connectors/MimecastHumanRisk_ccf/MimecastHumanRisk_ConnectorDefinition.json @@ -99,7 +99,7 @@ "customs": [ { "name": "Mimecast API 2.0 application", - "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission. Create it in the Mimecast Administration Console under Integrations > API and Platform Integrations." + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission." } ] }, @@ -110,7 +110,7 @@ }, { "title": "2. Connect", - "description": "Enter the Mimecast API 2.0 credentials and base URL, choose how many months of data to request and how often to poll, then click Connect.", + "description": "Enter the details below and click Connect.", "instructions": [ { "type": "Textbox", @@ -127,7 +127,7 @@ { "type": "InfoMessage", "parameters": { - "text": "Required. Base URL of the Mimecast API 2.0 for your region, including https:// and without a trailing slash (for example https://api.services.mimecast.com, https://us-api.services.mimecast.com or https://uk-api.services.mimecast.com).", + "text": "Required. Include https:// and do not add a trailing slash.", "visible": true, "inline": false } @@ -159,7 +159,7 @@ { "type": "InfoMessage", "parameters": { - "text": "Required. The Client ID and Client Secret of a Mimecast API 2.0 application that has the Human Risk READ permission.", + "text": "Required. Use the Client ID and Client Secret from step 1.", "visible": true, "inline": false } @@ -247,6 +247,10 @@ } } ] + }, + { + "title": "3. Verify the connection (post deployment)", + "description": "After you click **Connect**, verify that the connector is working:\n1. The connector status changes to **Connected** and **Data received** shows the last received time. The first data can take up to 30 minutes to appear.\n2. In **Logs**, run the below query to confirm that data is arriving in all four tables:\n```\nunion withsource=TableName MimecastHumanRisk_Organization_CL, MimecastHumanRisk_Behaviors_CL, MimecastHumanRisk_Attacks_CL, MimecastHumanRisk_Individuals_CL\n| summarize Records = count(), LastReceived = max(TimeGenerated) by TableName\n```\n3. Confirm that the parsers return data, for example `MimecastHumanRiskIndividuals | take 10`.\n4. If a table stays empty, check the **Mimecast API Base URL**, the **Client ID**, the **Client Secret** and that the application has the **Human Risk - Read** permission, then disconnect and connect again.\n5. Each poll adds a new snapshot at the selected polling interval. Open the **Mimecast Human Risk Workbook** to view the latest data." } ] } diff --git a/Solutions/Mimecast/Package/3.1.1.zip b/Solutions/Mimecast/Package/3.1.1.zip index 2fdef70727d209c65f75b5479f47c0c808de324d..d280b815310aa3fd100938a92119b301521ace90 100644 GIT binary patch delta 58699 zcmaHSQ*b9=)NO3rwv9OS0u`*Ke0t~%YdcAwqV zd#!aEL%<3m!Qd67LBY^~fPkQYOuhB$;2&WS{>{2$;&0)`Z$Ln-rwxd(FGzqCwBVLZ z#k_5i#CGLFoz?2NNm>r&*xM3Zs&ZOt`-LRe%*7xv0X1=9q+Yi2P77g=+n0nn8 zOQ4vN!M3F?Gyqo}8|$bcnl{|9QtjGVjuL-i9_E}j><$|xmH+E2b-n|NEvxz-9Qsc3 zU#g^tqPwHbP(O!5d0Se?gB$>$s+C0*PxvoWAAMebXr$SBbxLc3=RyOvTG z4hvQE@y67FgfkmX=x_z4)j)UsDKMFMVE2p5@T;y!fQ7>Ahcxm6z*bx2_oQ%fYnGFQdLxWbifjsHa?y&+GoN zqm_PHrfa|?Km-PP?oOg2WC1*4sLnu`EUNP1QeDYN>c`i}*rHCO*-Dy60$mklQ6F7T zTsRh^HL5e!CbJef6{}4D$@&+g6Ir_zOH|6iwknvwMxscixaa)|X#<(_q+&qxjfEAh z(V?nv&5NJhsM!ceEauLxykqB5a4F-JXZ#_;r=nAzYGHQrzlzm?1njnCzXr;gg9=-$ zu_6ZK@i@yQwnIEfQ@=p(G3EMOgZ%J9|Cn1qx0nddKxfhJaTEU$*MZ;7nI^EB)V?p0 z>oB4Pdnr96`ukV}1oLPm)rDP$U9Q3o>%rRS`(TDNubIF~TKQQk=Prhpv!k)P<+w*| zgbdeF#j)7a)|2-w1He*|ivu}+N684LKLvf6!JSDLxH0YWBjH%F(>k9iQO>{@H?^?& zHRaqx*Q8rm>VsERb^O)VkeLt@uB1W!h3wl&b2dXj`6anCT`l8_y6o*MdC~PRbyY7% z4AvKQ+nAknthLEc-Syk*%O6?)VsxSj?Hg$vJ`ASKiDeW3dMvelDIQb+f|n%G2vMT+Dg&T_#A zk3V*lEf_x&u3_`T$Rx0{JK=>oqyLGbd0%%HkbV{+^@atuAkHPbeq^a|>3xE|#&C^q zdb8KF)B^$#&?hB|%ee9M%TcmNUUcgdd8m(7&407iykYdyOgPI<4%R8z^Rqk70$KA` zGyDYnP_kIS%q?ksg{VQyFJHTu*h0p?Wlt1rMZO{$?^hJQcoS~V%(P~`NZF1{E2u)2 zmV@HCxcWb`-;UeZ_bblo%_|ZKcw34KwrTHq;ei9d?T_GWj;KoUz>^CM%<;fQ!AI|7 z14AllU|V5LXd}m!Qr$8C+gfX$RM&yiceI7N6qi^iFV&Ib z-2gl7A1|BBsb;mc@df?L`eb!*qY4ejyw3`wp_f&#Otrh3$!Q9i-Yjz2UXaFA4&c;< z*A-(B29Et3jli-w$hWU#QjHBbak!jklD+0%+W6!!qx-9A<~KLm zq?>ZtZdGCp>L=#)Sk$dPEkK8oVz%BlU{4!>3T|Mz$OVh8Z~ynz3wCfi3QfM!3%J1% zoi$r#M+i~lW$CbHhmz;M)8oeavnls$&X=NFLbE-U>fR^$`1GshtUV)d12*`>t~vce z@5qc%Do<6$>3wwAb;Xp>5CqiNhPxn+3QKwC%o9DyXO(&EOnW4GZ7W!?y`xYNpymHO z4{_#{8vle<2&)Hzy*f^$i(N#Aj*{K6rnl-M| zC2qEdo{N#ppewz$Fz#>#hFQ(pD8@QGQIAJJnsQm7a8qt(hLEhv&MJ*ty`UaX+t30% z;A$^9(Dbhc;a86A$S#<5FguZ1YLoZcS#;DxFS7o{=tLK+Ix}7Sj0S+VlqwpqIa>QR zhJQ79|DZs(^2MEU;b+>W*L3u52SXWm;|Mo-!J%Fv83!M&yxEst@u9T#@5KRURFpNX z=k!Ap5gR_5vznC+53zqG|E*wN0Pc5bWNK_fmS)%6ATZr%bp!vSa8%p=O3I(@dw8ds9`K%dX(Yd`J>QzhG`?pXt)P0ymN5#K#iY3!KL$8;L zPFn#gUw@lQ2jdt<I#(M}m%YV!EUu|7@lMUPshPqbp{r3DM85I_YSti6J>NUf-!b#=`OfUP*1=-&{!n z#|4X(8uFLX7NE!A9i$N#&~{573tTNTnHVHsxg721@$1|<%=)|M*P*0P3aR$$2@Nhr-q=C+l z5+ox>fQUVs4sq#@lF*3)%evPVvzoF7Ltq8;i=x(N1Tdt7*NNv_hDz2uvudOFj&+k=VXIPlyPU zEh$YzQB3;Vfjal)wG^;Ua~C+EI-2pcuui6e+xW0fhQ#%q;BC9~KL3(uU0v4F(n`$2YN_nc z&)n^X|C@5~N|+h(7Q~LDUY1BZ;gl{xGr_VGI$j_Bqmpv8nloNc_e)t>oKa4K?t(oa zfVnwyP8==z%+l3vA{sWWp?>VNL+xQdzf#H~_f8^*6kI>AphFiv9VonWhN4aaup)lj! z>UGUwaXSR#W3+K7PqT=`Tll#oi}7q?94ro;>oz^^rhN$4{;r-Z@B+-~mUH@x3~}4} zd&R~ML+8t9mvgssMrKj9d|4~2X{NI0(K?4JWEFtw0-FEQ_#(WLI6`-rPc&vC*RF;FPeAJ+ zS#JD|lxLaa+rd;kO#)ELn=LR2l?V1jI1GfFE;QuYeu*B4GROB2wz2_AyL?N1oj`;8 zGRrBa!n6+Z%)l-7`4_kS-aZ15#)PkId+vJ6-t(S0z;{>pFL7g+RsAW5bD=aLrdY=O z^{m4u1B$7?VqwsAuU^nsLqSEaEW8?OUgFD?fI`grqA2-5tO0=pe5cV!Z(E_DCP|^* z)`7jYtG&yG2Sx8Kbbp`oo>Mlb39V*kv-h5R2(2hOQ~`sq3ffbCB@sV9<^mp-cvqLC zxY)qQ;XBM=-N#^XF){K#+o_+`&t&jg;v7ONY1%t$Om$lt|xX~)7x!S zd{9}DTvcIMG6Ax)%WB^3l~o&8^JnQhJsbp9v&~!fn5_H`l$SvO%ASwDDA@=LtF>nN z(co7EhsvXWs2lE(VAP)%gl$n^V&c*wCvhieNGzJ;z%2oD!Rm-DG>idx@+Vz4?o8I*?kw6J z(`YD!gk7XNF3HXJxRLQ9Xozb zd`Sk=W4%v-urn~XWiPC;`IvT01;?*iVg#A7%7hFgX}wttFW~UOu+@x@lH;~6+s#K; zukP(7!SP8O0{8AnaHu}g6IZ?n!=t2q2Uxfy1mTNq!zK1`2)|)0VV6yz*boivnlk4| z0o7oczZ&d4Nexg~*s&-~qM(G7-ox{-X2s(kQKfqlX3BpbkBgZ$X$9vdZj?ateT zC&c1RtVIj#Eg*Z{)WD37NpBKJf$$&ZoNdVhpEBaUZW>7?3EVE$A63RdvTif5$Rd73 zcS+bWU*a#L%%iK!A5Ted)>wiyvKAP20kLigmr2&z!%+@F5>e4y-Gv)NtliD-qwcPB_(FJE!z} zC>NoeN`b*k`Do^9ePr*iz`RJKvK6k*a`xWR;{Wa(tV1GyD?J76ph8K8NBMF3r5q=&a3Xne}y{a=U^aHoPLmSa)c6604Wg}ecPVdC!x zVS2#{+5$G5&q4X$DBq9qD4&RkfTnyA&1{Oa&0-Zz#e?Hg#T`N;v{NBd3l`5IS}GcF z^^VA2oZ?woU3qeOQf+bx*hL8GvUi42uKJZnsv_-Ypj|EeBq}b3nip-^o!=^hZJxFb zZJdi~&P)1~F);9u=tXwfO4{DSWsX5pza*2=0Oh2t{oV88@8pE9Nl&Ludt~FnRf%y?C$&CbT*r62LJB*7Ml7L2@8KUQ z9GeW-2URW}O++fH>A^b_oUJmjTBqfI++Xg0mWgd+c8a+;ga za3}7WFU2)fUIWjb;VvA{j=LJmk=)M%l{fa&tr8)99*a-z>;T080J@N#@7az6dgwXC zxUBn+7ezX3Ej1E3b-Y#@XG_@2+v1#< zkXw*WDI~brP<{WUh!N+ldoYW;wR$VzqEI-&FEk}arjJ@|ntWYK6rV3`dK}L_MnyyQ z%$WZ7PanP|EWS1up!}o+lRy+FcdRCS9(EhMooxm7H>;7#*X?tm{4xRqhSve82Fn@>*rZC+lF!M!8_SYsgbC&~#3roBg#BmI1XCYaiL@h3LmaauFknRU_&%lgd?%?JUr;EL%2qh95Zy6t0nhF6*}?yh-G+Z;Y^X4Jb9@^L-skj`w`gdl7*xsO4}?BH*;O?8K|LzW8IRFT98%?Z#0S`UEfT;#%Y&0;4VE)$F~S^}uKfdN6K;r9~Z$pQgl1&N{js z7s&dPSBt(&nv4nP<6Y8XQx_=cvEV>x`Wwndh*S?b;i^_!UxEZ5I)V-lc&AUL0RYOl z^MDwDdzfHBHzE*dY_M(Uzx7OO5{1Q*%2rG?MVQIgy~saB!L_^F|HNwo#@3kh<8g$Q zpTpkm z&NBb#>jO8QM1TwbI{`>K5y*Py4a zg-+OSe{^!Y*tYO3-KMnet>_Z_>ySpxI_&Dj6*aHAxHJgE%@M1ZWmZ935a5gM3MYHh zl1AKBh@a9%LTKq%Q%IfCAv3_y%<}2^{kQG%O)`ruZFKk?x8N*P#%#B0XuF_@3>-h& zSE-F9s6Un+P)3=e@`K~XPS0P9M+%h2pb7lv94Oa5I3vjf$RZu%NRYq@w`=dM|1!&d zM`**Z6gi1dvfG=$J-!oK6d?3U6}V1&tgUv?yyb)vZmJ$r8&2x=T0CtUH^depj)Cna zeaIEPiOS=ictOPPo1G8E26zHWSWFw+>6c1_ zinJLF_(ETi=clZ`8*EPZS%CF#@1zBM zwvotXt-G^}W90zNa;g%T(CSomR#XDEmPmE&yNiJPieAq|raKI?%U3FDTFQ>90Bhmf zg#nX!i;w3}dUrB?1s*35OU@0P`HXR( zXUNEHkz$ZA33V@r*)yy12rplpzsh{k<>Re(kA^B0YgV{be(C{J&kA$wi;7+jtLmZj zy0%RUJuzN?Bmos+iu)D;N{NfX!h{GziH}LR!TpU2Sp5vpPG8AT_Xw9y8T5tJ#i8$! z)$Z$3Jv&!aNC?`#!t9V*sq09zf_l*RF)&WDSC2e=4MmSU#|m?hLERuRhU(aCuB$5E zVijeIeag`H=$#H*OT4dno!vpgF6ONSG?xZHN+reN&VYr-_&DKCC*f+=t*D{*Bs$DW zQfSnD{=~z?PI73CGO|D=I7-H^o60<{)}r0r9cQ&#x^+09Cx)DLW%5^SpJ(#w1pOLdG>a96*DwjFYPIId!7fJxr&bNBTzBkjq9( zQ2`Ut<^&=^a*~qDRblFPCd>TCJa4}KUF159R40;_Mh9+hCviKp=o1dslF@t5Fx-s9trrj1dbeoeG*z`((bXU z6yW02NQrDp&{HV3k6%JcuF5{Ckj}NIM@b2xW~rih59(Gh(ZR_xqj1;O6nsq;M((6l zn;Boc7cnVb`C@~Nyv02vQQfE=ENYbjlZqBD>~*N~BJX_2`z&$I8HN5@ZFk?SK-|dl zDm6}f^Pn`Ln1e0!%1`?&4T`$m&Lz2f4WNo%uol*pUH+6SRwJysD1pviKUa#ZyTmi) zCawnrejD;;K)vwR7+?)$ zhhm~k}E__c^+j1=0kKg8FKZV~1DSSZgYfQD}(% zi-(6tA`x6^sxDd&Z*%BrX{hFg(K6(j4PMCpkt+Z|V2WbO-kWhia+o=4OfS*81e71F zeHN`91M(+l>ImG|cn&Y^RXezh1K^+_t1$(cy5O}mR@o8eCOpUKLOF)vjS|LPS_ISU ze3s`>tIGabj`L|%(bvME46mn0=FC^L*MJV^-X`axw#J~trq^AETTaBtkgQn^`j+Wj2Z*aAMQhn93SeV*>EA|QI3%QFOzj7syHyM067^yaxl$M``WJNt7QtHLI`3cGsF z=>}#&&RF*$GRJw=UD;%}rik3lXm9=GGWwC9XDq4e8T<>I2(n;G8dWDvd=t*elwc|9 zTB!>-_;oQZ4mUU3*?4~^`yMlt)VO+egQ(xG=SPHD4AuzG0Pgmu+_?;^MN-)ER5Lou}{P^eFi6sER`8lVz z$Bckv9l`cNUR$$M@DPPNKL1eK48D zfy=)6Qqg1pxj_dQI=~Rk_!A9b!Z<~N!VI$st;J+o5&*|%0`tqHRZlgYuP7}SMUM8L z_^YOU38R0UEenMs0_K~@J=Vi$q)g>tVv$cu8oX;PyWadQM6t}ugcQNa-?$b<^LVMr z>z|iyTd+V#Gxc0sbb9qI5P%O#Jzxe1*9x^O6*KSi@OLtu2hjgud@(ohX1;Q;^_WX7 z%xbZEcuS;VcK;0qXeOz=UQf`(Oi0CB*S{Z>S4(TT$f~9C-bb6~x@xn)mCv8;wCGrw z%O}!1>`9qelW8USb$fH&14AItk5E>3$DOSFaP{~Sx<4VGIGz2SkDDDHsrqB*6LDCZ=szW%M_`)=x~1<%)lORo0& zfRF5YOH0qz7U1XL;p!{wr-4`g>lkc%60y5Y zkI8S1&X~M-+w^)pszG1_a=)vC`=^z6YFl>Cq@ggbsSe-?Jh+`&_HQWq94fmgCro3nRL9baLNJ3W`a>bx8Kl@oyb?LGSMi8DaA<7 z@opBUL?kWlpCIz= z1q?c8hM zm2xBhGpM`#67xGeSD55OJ3<(2GtXm#)!Q>du3AEiqH>WLzOM>K!}D_ak9g!-#;fZM zV$Gfz`CrbF;#rtdRel%J0!9V(gdJKirC24M@OV3DAkQ?u9`U-;0|6Mfhj5MG0_VLq#1lL^E;?1BSP2Y@6K2cgX zn~o;xP>x;#e@-yG5mKL62~1HP@hn=+PNjrb+?Oq(@ z8;4whO#|-)$4j`1nz7K`K+PUP{TsGgP3r2Ialbzvyt>a(<&l0Q2N<()q*i1s9t$VC zFtEz|Gi$ES?IVCxwMI#L5YNO8_nb*RlsD z&#t`HngH&4$nzhH8{mc3`xK$`1R4$Tcy(#eA7)a!hnQ1BJb+MC5rT2OUMx*qj(9xP z3Gvo^HZNdQL~1~^Q(Y>?nw#mNU5+fent;{BRmu@F0hov9K!`Y?vS{>9#;-rY|Hbi2 z&ZVNDst2ZcSgi8N8w^EHkixzTQymLesmBPMBpV9GWYpGQb|NDCX(5W;uZC(Y&0a;w zK;p2){7dP2ybkfcQ45cj+rEDs0LC;a>lmv&`755HbzUq`DaX`0H1Mgyf``$w0ZMdh zRDLeG2hgr+|D%SVL;eTzk*7!#U>mkd+oqq&qltl90A9V`<*L_|f%~Wacb(K%ppM*{ zxk2!zxQ^8Y@(Pw`V{u$O1{9wZFSDF?pMzt7f!L%GLwU53Ray{WS_cc6lp0 z^f^I31q;hpBx953G>Z&Asd+5dNO|u+PS0s9)|%v=wQZzG5T{iXB4KPTY#po5|AzYG zLzb>#epGn0ZAenm(ysQhuGYX{?biV!U;s)`Z~p3hK|TlY@rUYc*keQI9?GCI`8IxV z@hHA(s*sF7B|`>#(8n6o+;W*R_X!-bbrJLXd#n;_Xc7@^FqzfCJa$a#EadqY;lTH$ zW?}Xkad^T$FqGq2+b~uzoiTgVD(IupvwzdMaw>ydWvr&ZGEY?&xr0+84~bzS;DFI; zP-d;x5QHTM(t;2hmTnvf&J<=7U^_Vd>~hdpT^+ytvMD=~ZHU%5QoBvQ<>aHn03ffw zqO+OKh7X7D-RZvib=Pg`p5}=Ct(3t6VO^EjH;$9a4Ug7B_COrf`m?{|dDPwGi9+uJ z{ml8YDdsRuL0HC;_fK?5944&-JRA7BQd(K*a{?NzKJvw?DFSO6GYS-V^>HrO5zdg9 z-27?*DzS08FqDVl3))D2Ilg}^Ge!yidZWxdg&jchb{K0K35`pG4YeOffl{U*!2aaA5rO}qgUes}l*L~O&?G@~6El>` z@@x)J{icDJN;YmEXYTS@uF8_53{B&en)Lrs<)!~i^zfW_B=k1b&=+%JR0I9`8O^Kn zYY*KrY)wl*iE`L3Q+E{F;!-xbzoI;@cIFAW6-(PNFZdj3qeR$d4)uaB$$!aFG?q5k zAJ+Z7{{2MZ=PqaWKSC9tL#dk5od^8aC>BA7NhE+7AxLqPxEY>^vi6RAdzc)M0F9*9 z@gJKik%@_a*@Yyg&XJ}MD&BlMf2hu;2Q?C|iBOO3=R$LMsgggSyl1*RmR(D8#^w^9 zEJ>)@=fOdwIyYdoS0dtCG}Ml+$IT0Nl!IX7?(i$X&!1OKiVr|XD;HVJzu3+1ff!q> zz`g+P5MuRINL_6z`}bxXEt!PUYMNd-&LPjsk=q6o!s5`2u`riwqsXS{`VjG~e@k?{ z91z=BS5e8~CN&X3I>Qf7n}}Izy{(i^^Zip6RtuA^Ub^LgkEc#u*`mj9w^(5BL#7 z(a)cPGG{E|?uhovZSNNX3&={wLaOg{1$6AqAuZCQF&@CFIGasA{RSxE*<49Su#puw z384i_T<+G4YlE#dv6Z>sS1{|RP)~M4dvYog;6W@V?1iOCkGiGbd6G82L8t= zWJ7-vH&ZrU7~F|*Rn{CfB&9cnPN7}S!6iESbzd_|q_1$c= zB9Sc|Fropv@{wMGnMltCCP*YbDZN8EvUm6%rlU+A{Bo^SOq&rVG6uw*&`r3f;0X6* zT{aV*{avrnW55j&a^L;D*Zc{j4X622e@)`6Gxe^<+{?27?SFF3J-Aj9C@F~d1UWz6}tmd3yAwa(J^t1 zZ5$!PsCaq$&cVPps63A$c+>03`{8lJVPP&*c7LKXXqEPjS6kXhf9b*L!xPHpXGcLf z{(fG;!`5S^2UrcHIxJbnK>kx$>3GOy?Ri%+u|1)RdCYDbQ?Ru6FZT+tx*YFexGk{R z|Lg(AZjk+gjn&|n{uDE)2$Mc3*PJ6Dej4roziqlI}s)4ew$NL zzgX#qi$WCOZ^6X2em#!!mSb)e{gNx8QYrYa*((r#u$O;>9Y|nSzdZ1ZQKL{!TPSxb z9oy>qAy?TJdWtKKJftB~Ckb%N&n|_Q8U!%+f07o(k@yKm69OJnlb~I8p$rSgp+BvU ziJd;@IDQ(JR6hP_$;q-cZDDT4$qPMB5GM9#Iv?GHtdd9y%cS4Qhpfc&x>^yF3F1=1 z^LzVYwB3?Jg>8mDRGSBqhZr$+lonx;IkUYRpAt8W`YQk5p6+v5>y$wqa6B&B3RRa% z)6)y&8^lPthWk!}ISE1;!tje)2#O02dxVe(wE`0>oD7c7#R#f@aw(dR8ewnUDI3KO z$*4LXgP1G#A1@K+l#9Xs3in~_3dEB>f0h9%Dqhvia%v@U#*xv!9DJ3%oF732XR^^F z?2Qo!N4za;AIv0H_cx~&aF_nu9k!wB;Lu>^RrMSn+QcxWX^jYi3?oBEe^PTAH7eUw z!aZ6L_vwRvNF=@NG(C^DOK?J=aXEL3IW*l2>zpQmqK^#r=(VPf3p#epA zp|QFAT&iZnmc|Rw^^af!yGrzTZdClbb&Usk>gcc_Z@%ryF$oVI00F{x5s#+JO{9-NkJ;b|4H(z~s)suy1qxVBl%h9E5o zgip>Ro(1dN^ygV1xa;xtXYP`XtATy)qe@l5saZ`8oEE+?bEq(?Rac%NN#l6dkGgv( zGv@AkPLy@cf(;^DL5W3BbMYy?1(k2GBR-tAR>#hzJG(7Apmm=WT8H!%%#L?o6>8y( zQo$}tQSKdU6gf#YiPSxWDiUOnAX+6P@u}zFd?tbgs(=mU#HJ9QOnzCgWQjf9N<3i7 zOnMGdS2o~0x8N}bV?KSL+v=IB4t}eBr3Z2tsoxrD)nnNQz zXRn8Ve2khoGz8A^v1;#j^#05SZ`5(Xu?HWYvmY=r@<2sA@9`PSVXD?yz663yxaI8u zZca2LxeFKW0WD5bdj!EiL>u*>{`yU9@0LxD;1|Sb33$z?BiMx#mh?;rcxLWf_Qo%_$pfu#HwZY5hb zGmeSr)ETOt)Wl&m*^=dPCnv%;d;*q)jwyRVBO3?z;2xD5xU5!U2H7`bQpER8#PJps z;;rHqzzw-D(J)s-Zn6#bjScxabAcNChe(|k;h^M{Ha-lN{>624KsHj?ZWDxGcp}?V zG)YE9$&pk^@p-h0opRWzqQ9Ygrf_83MldgGcmf8!boGY{d_W1A}%N6uSa*_7PWT)&LbxP0w*%@;sJ%IbP# z?iicxREOdebI96pX;CRSn~8^wzP}BhJ7ur?ZFAr1a2*T8k92^YtBDYoOaslvjl+Tp zIGekL#GydB7p0Yo+$+7r6=vyAKvI&VdP#{fdOGPxh|X5ozt`xw+CaF;J}cM~8}J9W znIoKkm#~U(^bK}MS_CULAgqw!l%$0r}EmoikJT2G3n>#dIXm7ntP1C+S; zwaJt(a?|qiQzDT49OLjBxW=C3<7bBju)w+G$PwpK^XbORNy@yWHF~_qOyb*n*?9TE zx%-gMVQ`Du83V}6_tC$*8!^6(F#|n1#4?VI7(S1J%|e21uxDebGZujxM7wGK65&#t zH{?F^=k)m8hpa$H@}{GN3QAUj^ys#+>K%+=s=fgNNI$ur6ppqT#413g+{8s;MpE;nYpa4Mocf2JZc{shw->YqC(4T^Gi8qci54^Sy}?Dx zhHsoW23Dk}qyqCeMv!1GdJakmnN2~PPe6FBGq2UE?GhIE?OF_cp5^1W7%Ejv8w$Th z@C?>0Ova89p)c~cT^NnFP_XX+A`w#q#Uj58Er6zmP(hK8IHew=z?>e9IhrXqoc7Wq zQWQ2v0H16baPeW16e&PbOnfuXr0GzY4UtW|Ge|t4`)M!z&9K(L#Psr^KXNH7H6BM+ zQ}fee5BU6AI@1vShMWBN`6)jg?qpAR)YikA)U=nXPbO%|dFmk=Lgr}zEqZCTC5f8J zlUk{hT47sPM5by+1sL&~H48GT5!F&IRq|U}U5fvFHR}H^W9oVn_4T&XS@cgxtBr@G z_8X~BywbBI!TAPMn9gO8bH!I2U2oHYC)#=9+v=K41fhA6Y@E>y?nwRnqaCw72Y#31 z!D@c(Wt+eZ!gRQpt_=XZIOt_u7bO&M;TIWSCJ_|76no~deFbh#kVj=5WY+dg4$dIY zGs$~sgRWMyCb}QQz@M{{7A>%LX()rfw)#buLRwk?ftq8W0Qa&m6h#Gh3@J|87>Db) z?SYycc!D6B^TZO!X)NE4BJ$#Li+hY4-!kT|?QY#NK6cFg5G(+GBr(yV|KGN^j0q{A zzbqYcH03FlSnNY_aCC>-U%uo7e4nNt5_@l$)2JuJdzz?5EPw9uL#4I;Qrw$lox)+9 z07ynTA-FoAiGKbJ2V#YR0aA=5a8|cyhOi&7i_zWENd1nvv4`bDcZh;qq62+mu?3j2 zkjjfV+I?i+QtNwA(T&$B)S*bY*buqZB<%R5Iamm^LytojvFu558o zGMjh<=ZsL$)Wb^l;x2iYex7BRj1H(Chfy~T*~ok$P1*}N!V#pn2^%tsP!G&S1`QAn zWK1B`Kxivt(g%iR`<@y>*Y9KKB!pw$-s9TAidA*7?>pTd^bXM6wfkN&5W2ExYH@*N z7E$Q_(udWsPA^iG1dXNt2_HaOkpj@rVLtF@ zc`D0bX?xkX0uo86se+yM$2Fy7(B=r6sei5BKMOlCnQ&JlmnZLP^zj@ub)oX@xT7 z$&I;%1@xknLk&C??ywN}(q1CL_JIpXvEA^^JdtUT8ONVI_05ewyaVDr(B{KT$uzj! z%;{5xh2f@T?Nr|UH?JAQ#q0(NF!_m|kN?Cw`?$)ej0|?;qekIlWH3t*F6I%pL^8T~ zJR%(3YD|jIc5A7eh`Dx^R%7z`*x3x?Ix38WE|S-;mesl2=Sbt6h+<&pMd*3?t8m7R z3#ek3x;=xfW%8fr#sU&_N>-J`#{#mb#z?_0=UMNdW`unxt8Xa5uPSOP>W$QL9S`%Q=7AVemIF>cN9BJKAkvdSgM||gzr)i-x%vCm zzLo!6lG^0+2W$RL>`_1C4#ps6fO)9hRebh#b&`qshKTlo@aH16~DWZ2R5z>HG#i6aTvlqmK z(l;!u$ylm=u8?uRj*3C7MeW>~@BYoWBPql2E!&Xz|2t>_|7)TBvu^clTH50BpNaN= zJhU}+a2M|lIDrif5*;CO27Cu#S&mOGmaHl!95e-7nLGhSvo?7z1b7H{$Szzdl&*kk z-XkTn{XuVD?mt8~^hF%+nm3gRph0P2j01vbL>XNej$RYxx#R@N@!T!i2#n8E6yC3> z%k6-lFEypnW<>;?*!wVVT`bP#&KQiLrABmq`;|t(wkU_(5n@a|xAS%krN=iV%-O^W zJBtNJ2*x9@m=PuSQ_6cSjhHTS0fWMl+IX4t@5^=M&@3fL+0k14b3&aBuokFyGD_YH zAI>Z^qw(b0V@Q)54sE~ERi~np6Qd)O6Gy)lRL>JsEVrUC+ncsOVRH7OUuQDm|x@ipit(cpfd>dWn!zX-dKdhNCi#6L5gz zif(<;p~il(*Q`8}^R-NrZW>LS+E|n6(YjP;-9@Ldz04{!om^gq6|i9Ifm``JNqQR9 zxb*4J(qmUAON}O#aTh~~c#$7L_j{X=VHZQi#GYjlAqKkV7pS5X>JfSztSAk#a^!V_ptz zfeHlwMam%OHyBm;>S6!d;4H39Sv|br#PLoq4niE=PTJZt^4nQ!0O;+hzIySF?lcmV z&iU7-^x9qfpU%KLtBH25W;Hjfx({}ZUdlEc$<$J(jsYizLDU7K()ju5I&uIV`BkuU zFpIsr$o6k*spQ5C0O8gFjkvDlsGWO{uv?@7Kpjx$w+t(*(#yoYVmq39YGjfHq8icDQ%cwUef9cb0vR&BMx9CCe&m9Dhl8c zVu{h@wqSI6ibDjkbOvv-RP+|ryoYPRR5<<4hMgX|3~$>{0oP3a18B7F*}ML;sY}Sm zXeMQ3)J$@ojN*DSd+0M&|5K>UNp^tLTf`H9 z(eRiZ(E9{B<0K}Ib&c6n`XG;x7>Bq?t&ouy(9uaFJW@h=7jOWv%ek+v?}*W*tK7BI z$r39G`yJSKa2Y?k0+SR_!jiUXCuQq*9my1(r1?ADBt z%n9pC=`qpm2MV+X%jt~?V{)m)uKW$X4}t1~rtsr{iP#6^3;55|4U$II*=J3pzxOLS z6c$!?9fg3H0&ce;W_RI$ZL?K;1imuQl&KR%ZeBiuLP$iEC{{N!ofa4xk}=hPS3Vb$ z7eO}zFAZA4y%qX%GCfjQWO!0I?y;qkYr{Q zPe;WV_^z5M*jQw%oDMUkRtaJLM){Ju!YM;=Z908brmDgqCXG5OmP|;&_LVy`K(tfp`!hl;qxCh+<1gyx#6_LV@Q`J5QIKDHK@f zEB1Kf_Sx_Zr3HuNd;!4t4pEF=sQzK==QZsxLd zxL%dY#mPlX{dZVVte9(KSk9{KiYZ4!O&0+G{0M^8ipAb@a_QvwZY5B4=jopgo&oVe zDb>EA36gKxA&T*^^Z+%>z>H-ua5NTmTrkh`ToqiME*2`4FQGuKwESd}4XLhm-=}g$ z<(mH4TVIZ5OD*M)UzgN;T|3GywgxnOtAtd-sN#@K=>r&>3K2QyT@I?xC&@S)`J{`0 zku?^u8n$ruJ&y?ru0&U|Y6twxHQP8VU`HvbXOza<7h_sSp1+xS z#fR2b+G7AM=c9UKZ_vfk$U*5SpqeP}-+DR5lZ*h#O_sxQMtBBQe2@M*T7NgMP3tnSy%X4(1UfdZN_3OMl*C ziYO*49(d~T@I0p$P*P|-{KEn2VY8zU=%d=ZWUvRk-^=nj6bdtrotUck=^ z;FHqh;TYZ+OKI;I7ssD^nH~faPSGIRQx{KX8?5KT83dQVso4=<#{>lB|B&^SL2+$O zySTeMgy8P(5*$Ks4-UZzZW{>h?(Xg$+}+*X-JQ!h@AuyNZr!Qso;@}H)~q$VyC2#8 zCmpUg-?ZzY4%mA*sXdg}a))LEKwEM!Yy)=yLL=H&2oYFqvn{^lKOH*MS$*LO|gQdP^rtPdLvLL2yfHSrKnK;C5bXOgbUh zr@z7F#T#mcC{KSckKSX=u0@|;y!|ntxQ_Kqf#ZARcN($9^OzTA-BGPmLdd(+v*A_Olyf8wD2iTW%F=v>S zoBxFzfWp0jzYiUJ_GRn;MH~=_@42rsB`$;zR+qRpt1kPFmq;Uto?s#9C~ZNB5f*14 z@DjU|_I3$7Ghs5#-pNx8`i8r@QvNR#fq6KhwtUv@NMHm}!CA=o5~7Cg@$E(h=9#&l zOGzPxa?IJA;M%nL(bp^xi~=CAMiqd~oI*tC-(Dj_ct(1x1x*M2DjCdn`te5g9xZmt z?oVV7#vB-6M7kwQ^S#!P`03}p*%#>k*uAJN54jtNa2WA^`)TeXKU8!(1b^OzjG+eV z{vra7cYu^(guTU|U^o3n z%U4d`pTPC@NcGJotyKg|^V^xR%k|$-;;ke=#hpFB7=CVDat*W0?@xOwDL7E> zWI$PU=S@QM8U&%^?<|Fs$FlmVI3%|@gRjQWugldMMCA8A>nhl5_Eb3U2Lo!syMDMQN-zk)dMbpteYJKgBobAsr%_xt9Q?kS?&ku;H zJ#m0*eDhb3f{rxVEN}^!1+Y&+*BGA|($D4n%!ZU-nLkE~g9{p7d|$4lf&yMdeSzN|gmp zs#tVzJOY9kS|FO6;yjV*v;|@`_as~XhGKS3>03M4ifvXAp`6YA9T7|QP+178R2%p7 z)8D*X3o;!GDb1Wl*<@_lHC2V_+2y~jx8Z?!byg26kj#t&_CDvYFXgKGGfZ3nXJ)pc zSPn(m#q{GKHm&we0^%pswoMsbOR|Ds8MWadAgmT$DwzVb(Yim7UY7+4%hpg zKK84kc5=aYC-<>F(yOTaXNkV%*q)q?n{Rq@1%o#_fu~+*LOIk(f4m>PUeC9>lDV70 zWo}+xQaAYiqJB90iEkf3oHpeGk+Bd(Qg6fLTBIS42MD}wJeb>uD4yeE` zjTq-F1~u3Sb8+Z%cg2bKfSL@|%`^>-GM4eZq93D|!}7`$(`Oki{9T$Nz62AB!5*r{ z@~75Y?MIp%)Zk09L*bhVl3ePl72oWtmA#Z>o?SzJ! zN@=Rqj+=3ml?gxSZ*uK0M^kj?UNxioTr#ERz-39x zU&Mi#%g(j}{(JFP!xtT%nzIeji@%Y+?)#MkLPvdc#kT(83kEqrAJsTibu{a@T_xnT z86!~S`dMivt_Es^k8G3UGXdrJgmo)gx4#Q&&sHCcrmlePM+<~>FF)Y22Sd(Ec9ZTlm+R|8}X>=k2# zB0>)Q9EFVQ^!sCpO9kUlf(_r(!mm;Y2C?a*qT>xd0)4t%Kotq_SAH6nik8`zi_wvu zTW=xL@j+Shdqp5*nc~e^kf^XgO$iTNmZ95wXzJpbwbCThxpNu@)SfO zW-rDn|D+qDaXX6HnFl40_vek~Hsch$VA9Z*wc(YyVND5Svs;uRLN|b;i8xmu#OpfC z@OjrYCe3pM_!GDFe3a0l!=0ZUFVJfq;LrtsHfRv%%D&7dd4T z-PRKL^&?t7{EMdvludli+_Lw?7_oNDK8KfVA+hr**g@j<+yhtMa2M>peG(uXWbnQL zaqyb}Df%Jwv1lKwo9=^~b3(Ix&9I!s!#jU{I6@f?u>6WZzD>#ZcETkwfOTDU#+ZKs zMYN6cvk+RJ%#AdGA7aQS#q02i+`*>C*(D!&UfmJtYT#>GT+*jyLUPxwSLPW$V2S7S zZn?Q2iWF}5)FP6M9<%aoZ!Aqq?8I@M^!yKXlbGnpmkW~vm^z1pc(^hbWofn{;o*F3 z0cq=NVE@Sonm*@|DqS7vAI8T7%T4`~T?D_frQEi9&t<=dT0d^5> z9g*G8Fk+j)k5&1%FZGF)(w411PZ=&jeuH3OOcl46?jaz(#KRr-u3M*ZYx25Q9?X?# zBrtI6_w!c7(R}S(wYq_mVqNwdo7qD;u5XuZg`j2cP-h_cZ z>7FOfG(4y$ff=JvD&!^RQZ>@)->p2>(HGqX@NDNPhbF~VzYpW?)TvdbtB|3Vpvmme zy;u+1?{OH~mr^O@V1OIwfeU4rvoyf_K#G`W7 zvVar)4tkBLooIVTnht5Apwny}mWE3(Ho`vEz^g9!KvsB?GM*G}I0JbBm|(28=ZJyP z2AkI`S)E=^=^n5F%CSS+3yoaV>nLtu;x759{Z~%7N|BnR08k<6h1>OOiQ z2j*Y7%Khubtvob_T7T_GEeN#<9?)W3q&R2M;MgC8x5)nVPDX|YiR}%562-@~!B)nV zbN zt|_`F9n+m_`n)8fIP1JOm*cA!m^PpBCy08l$->%@5>)N>+y~8GX$zk}*MR{t^ znvt(V-oc2l665m4Zph+jr}@;*7qo(6Yt@=}Nt2E&#_Q!-ppf+)F?Z7e7epsgs&>B5 zSJa2coAj{w?oKVpWyclJjtx34BeDznFgY6l75cV86{*1Z~i#iD0R_kE~yHQxGn|#sL{Z zbARM16N_6W2RWp+KpYq@jH*<#XJAzM`o(dGN}KG9*Y8!$ct0F8$YC;!Ii0$6zM4wO zd>9r?Zychlt$??$v5;D-dh)VSx6XdeR-awaMd%6}g78^yVF5`xN^GLWp z^@zAWN{&o^PCwB&{3nHHT6-%~!>R1Crx8FU)iYcJn@DxfMz*Du>bp-JYdaXV-SM^R+T=D$<<$aSM zCUkv(7P)jNXYBXLS|A;2{CvF12;1V0-VfKfGc_w+;j?c~&!zsfgn{`o@EAf?TPy=P z(gRB&6#*wWpY>0SGMx3S!f!ap1$;|~bU-729fafd&sX4=R#$YEHeE6LN>S!#D`WSx zDNd735nA{D$O-*M>&A^fkKqMv>Ad?nM%iz!n)nYzYI9sw`SOmilQ_h$O(%wCVvw0` zH*>A+5i}*ugCb*{QO~@wYWXFt{Zva=&Q{K(9ZMJx>?bm%VK9G3ii$le1DV&~+H=;Q zGQKvMb^FH2gcItVz;wd9IRWKB6h=Y5SoQG``v{F*y^PU;i-p0W5EbSp6RKvO*zGb* zJ)>K*+U$TtW7P{mD7qCfH;>g7#7w`TDaDz5D-(AfLF0TdN8aCUj1~4@J{0sP9}4&n zA*#Bdj>QP4m6%eS6z5!wg`x^&-Ea9H$GK0#xu$jH)_Jb~G$E`_pH0ZfKTU|iKTQZo z%>Qaa)O^Mh;0^%4$=b4n;su%vCgIgYSqiv$dM$UUuxa+6&S2DvG| z8FDOXVt^okIeEv|NB#bf5GLh6LYQZE3Ds)>W-Cc55Dj-}&6_FxaL1|dt5mq0YTNw- zRgu3X;x<0jF9HqXpX!&L$4~W3L{lH_$p5E)v17YY{8#)!R~P0rez~hgFWAjonrR`e zgnfJvt;?Ve3k`U3ibK6?ruWMK{6iqD{D=zM0(TKZAc>6gQ5(yL^+|-{|0F``Bt|r$ zZvTe}1inVH~A#0*t)`Qql%2;Q&)>!0wh3{1@0|E}usY^4vjBE@6RQ^(bd|Ogd_efF*JI zK8j@UX<||2WbulflIc_GF^G6u&8@^|5w$gz1tpOokXU8N!m-!l;iDGc`Nxp_7PFxlQGNLTva1idxCKbCSqBzC;?@z%@sbJmTQ0=D^WUNIK zF5jReGwnNxg=(+`a7N&KRAy3nEz;A1$?@&y{uibj<}-aB=tVp!Nl_5|ftT-&HxR3l z^ny7~(w&2VOrct5DyI?1xONEgB&Urx*e2_B6*Xsow@uTh(@BT>U}j51B*=Xezg8Fg zm*wggdigmJH<(8yWMOn6x)={07norGeKLV3{w)HQyIx1%>Nfx_lc)b1M5yg4bU*r3 z3pK)iYgA3rNgtPGR8pucN_XV_4Q2mKoS@)Z>&^bm!OMfqMyu2m;*6y& z!X<{AfD;vBRwN+%+Ecms0TRF(XiU-RJ`l{J48HAtzb_{`OTKC(Nki0J#4cL$ZYL&feoxT|A zUZYxIo}0Y3$B`ev{kq>@D{UFyA8F%*goo_#5kb5E5eDZcO36-o#q4!56mP z0Xso4C{JHr(n3J$=t))&H&McKHDsNi4-ttXrZ7Ys^+6RA{LNRSG|_oc_`3xZNj1SD z9jO8ynizl_)E081VKk!-(HAfDvw|vo@P!Hy z%P+Q0Skeg`U0-_|P0LxPy*hbK?!%Hno3@ zY-$_KUey$@hi#AwbRt7fWM1?DmXdXhfr9U5PuIZfQuf|RB%@V6;j66~?fKsO@0G$H zY{9D%gpGd&gozC{(2TmRQMg;KNYKI#!05UNW}W|a(DR_5Mgfdw+6G_c_Gzu2W z)udjr(F=aD5H>+%1;yh^Lqbca6YecJt9Ged^jEKD*2GDJ-VQTVb&$_832 zQytb(a9Pxlhh)$=+#dQqTB=`Z$%ie!u#u+@`gg{`X^>m>*$o~c&3e3S&{hO9 z(f3_i?2Y?`CsjrdjvM_{S}h4_WWOn3U->{@QMnomg9}t@64EVP`U1W*j*ocL_X(Kz zTnLeo8)h)&gjS69ZzL*p8%`}jgkl4RMc*kDf#su|P^vB;gvoxTB0)Q0j_|KSI7aqE zsevxr$c-Hib$GmMNVG)3*Pm~(f)d-0M;>cO1vMx{@)foOJI(8sZF6q$uD>aq`LC_u zB$Ca(qgBh8JJgQ(_?pu%1tx8F0<+21@*K4tLU=2XpB8vE1E=0|&#hAi3quS0*K>Y0 zufjn!0~j@eWx6SvZqJ?;jv^8-#vHBWux{Z2NikNL_Bf6yTl7k4&Ykv&FNi3M=}gk< z(L_x*9${#4@5a)e65CHNheXrwNS*5MHcG?Zg*B8(C=;1-BxBG|j7ls_z`7_YlX?Q1 zw8wsV3_!Iubka4dK-^FFC+@~hS%M?x4^7}>{ruSj8856e_lmco zhF5XyHVArx#iML<)NY5MY4qH{iz@>0dNyljdCF@|V-m|D&!KutE1%q=m`&y8` z2b)`w70v>*C+aJ=<8qk6z$#S5py*v7oW8o`uLM7TqZAxE5B9-Mk(4wLHjZAY4v|h? z$|nxdYkq)h$dq}zU?-|}n}dmt=oCN>(0-2_C7xdrtqGW+0#wGejJdONJvo;83s7;n zta18?!nhVr9zh)OQsl3{2+Iwq?;{Ph*LWPjM#QF#k-W8qwmVz{SgQMWmDrard?m2 z-rR4m4twx*Rs@DTm|KcwPEM;Vt`3kTh^Lk|UpXDTUXQ{|r$R4sIEf>mF6MI7C)H6; zWfShU4tJ)2znrGOYLG{jLi!Y#*nS;Z}?VBlg{<|rrbQ-Gj^RV_<3tA0&PgM12;R>7Ll|;3L*X@B;qGM=(T8R!R^n ztQX3CTIIq_f%xvI5x9Y<$p6-DeR_O4MdW$%=;v*F+nN~&)thiupNB^qH|U;)8Gg34 zvvYXGcXM~}xH<|`sAkgZwoTa?+`jfgnRR@@&2Y3pvyi%2Xm_Hx#LO5lfeQ&%KAY}cUI!cB zj%p^=OB;BzNU3L!F>(DXTgQXl@g5bry~Un6s@)y%@luUbfz4fepV!V24PK}aDm9t5 zA)NCB#ZAS#j6q*|xT!b_7i`vi0*-0~&29j#!>gPUgGmcyHAGGKo}XeSNl2(dHmZu@ zYE=7L$NH`Q<3SG^fXDeU_DlL#Q$o;2KFucMSOd>K1fOt1B_tBG79r|yN6q#K3}(Yp zDvEVR<}~n;g?Jy()0@Zx#}lawo$%1-;cz57hmZA4+q8z;E?4E7;mB2QBN(p3LN7oi zUmr3Q6n4%+ajCpqF;298vPB=M9uM0+9_vqe%5Pl(Lay<@E+M*KKlUm7w~d@hgW5n- zPvQcZK+D3fnFE(!rk|jnZ?O;sG7!9o(>w&+00wIxgkICO>v*2OaoY7Y9{VzCDH{$q z!z}pcKS>MiQAc7d)L5dK{w5k9&Ef-^^RY1&Dbs`}{^2hlAjBnZiJsUBT6S;W!$i)X zwR#55;1jrUN}@inu6S`f*hC?J6hV5k=Q#16C~s3WiXoD?o&S82w|-!{?~J zEv;bbrFX(B!@6)OI3|B^d7R#i0an5%x|9dpTSHNh z8LKOtE&iT+5Ipv1`E{9)i=MF16KtIvMnLxE_>l-^KSfQjcf-)OI7I@w-TEGXFs*fK zN=#S<2Rh(RE-xZ}eQOu5oMI=^S&QLb+h09Lv7-nzbJ9XEN%&&`)TReBykAf+OxXNA ze4H`8*G&`iN(%bXu?qKo)f%2kKHo;_`fksj9v|WrO$)gu#?0a{Z+?yxa-3C!6w<TO0WvF$}+Dt2I7qRR#^&bts& zW#*MB5LOot$sg_c&dEa%3yW;dDIY`aS>MQc9eZ`!A{a*DPMvxTiC~G08O?v0cWVtxk%D_&mg5t}HDrF(bYK z^K1d|yg{esYJI3;X7FrBi>8UPhh4xsdFXrisNRUNdwj(T?NS4fLxLx6^X9$AG#%&Z z#`#S71J2Vk4mILt>%d{Eb*2-aFnRI(ukRcYn#I<;MixL+RcAq_muX8H%v+5Q;PaEnShV*B2S+kTFhb$&1H|4BssFNMpaSK2c@Nj+lc&8 zOZq*A{?D`Kx(boK&$}$$7=AzC1;)^%RXK^R1lFTrzWxiceplKPv5m*e#@f4KQNhoM zE$ojKUBWN@5M4{t8$Zyh^l&9orurJ6fdLx}4jO(VD|*(q*SRW{(zx$;3gjKjH}oXO zeP6G&f*%vjF~+8;X8ImhLCJpq3HUh%M@;`jgN(`^nUwR}Df;{J3&JfjpfoHVVU_&Q z7^CDqGU7{Fi+BBt-N&rJ7^XLADAT73=h8(8?W+r+^Yp_QoSUbom0+BM0MRYx)2 zJ@Nz-E4p>ZjJx|x{0p8XLWv{TQKVZjEKdP)(WG*4E3zMrKX=G#_V10*_`eFW9uDesT^Ad?bZHdk&`E~b3b?h!rTpG`LgE=Wu^`88t(!W z;zr1Rx{UE|ZJ~?A;gYMonSr7XGzG$|`n^Vjq2O-wf``Or@aUuD_T$$rL3Pqa&&VJ7 zg8JEgTi3G#z-N7OOZ*;wPIylI+KWArAyFXA7U)oe=G65V$gr{pP}B#BH8=E{dP>1= zQJ7W~DOe3Lqju+-@mIRSEo^mJZ zAb1~W$QEg0X9DX3NKZ1=laUah`(0EKcb=QA-rX!YE>{irHICzsvKwWuJ5NDupowL- z8ik?D_vc`pf+M4MW60GHZyg7K`=R^&0g(ge0>MMxgM_sUCu|)T9!;4PbDeXqiI>*= zb4o`v!Y>FRO)=NM^hAoR-H_7g{7lLm1s14>NP&^Rs+?Q}q_vZ~)}m)(UW)VIQ|1r6 z6CYRG)EL66u$T@GBBqr^V%cl}?3^7e^oZk}K@;(pJ1!?490X|Fs1ufcF+=Nqlc2vz zBUc~4xC_=U$};PKUKU`xz#Ubk)~PN?A(vcS_ru&x(P=z`< zNw;V$F(km9bEpY^Hih)TB$z0FOA9w_WGg0?HFzI+WG%rLjOH_`*J&DvHqZ2bAmT$qF^YmD`1?0!YefUt36 zJ=`6OmVD72n!7vPQD*S@C6!4Zh5LOz>PSJY{Xug@;0L;&=lw-uwxoD+g0U<$CX*z8 zh+UGlu!UY|SWl7*NI)0p+rvl{QZBWtjuzEzU$QQR)v@$6y?)_Ebz_FwPi%Qm3HJ@a z?cw2p-?sH|Y}?zfr^o|oB+nRJDmgJmnC-f!U4ZU~x~D;-5)LsAE`7MNMUq+ACg!W{ z#rfyRWT4UCv5mfJMcR09`me$~%7jQ0ovxHC?QQVDn)?SL5$cGwfY35-9g$MthyxK5 zmNzjdElo%x^`y{@;Hyz9;=!VmlPxoVE|^(4K0ZFY;A>ovpbM*=uPD<7=TT7N350e| zs}*=MLD(EvjKvFqyvWp&M+f)i~xSmdNKP;0T_hUtG#Zo%X!S1R&(F$R=tQR*+tjJpmNtgB(uV_hjN_)Y2+EI zn0e1pE?K;%t0KtH;Nemj;)4!^V8Tz^9=IeK@_m@B7Lb>$OTIr7MYPWrJv03-<&zV9 zuEUdMpk+R57!2xZdDNTT?@$HSVAU1I3raPOr0FTC1&UXZl>Mux(Ms<#H7`c;AJ_Yl z`*v4mBVpUFQ&r9bVR55fo|a=v2dqHxo$sL<0=gJ65%(q`G!%PVtw(?`-_rQ67S(Vo zqhlNO%FKMId`-5|g=%-*Cf*@D)c732Sb8PqbhSgrXE$}Ymo4d|_-qBPrs5oe1kXx8 z>8)dIs@E5YL3P1rbe9*aQVd)m!%GsYtXED#PYR4>)Hio72>VRWukgR#z7N<8l5XoO zCi}Jp6HAA^8LaH`gn$9QXH>D|9E|N(%PSn`B|RceQiTCd!2(E~JT3a`us8EaWH$TE z!Lf*D+kt}?TVfLWzHd>z2k)7o4HfHard#`6B9{(V0pGT``fuv%%)iB&*`xVz z-dvE~+dvpp`I6889T$68AJAo|S?Cw5ecDrX5;&qVTuxV?;nGOcuf zlRkLhsOX6zlGq9tOtHHdgv4JIy0BgpLVNrgWcMzBM|hLugE-d!jr(nSeny>5_B^WK z>p~}8^{Wf#(V{2;CD|=Q4rlfQ1wsGsdzdxN{1b{~uL3e_Cwlj+HoI6^a|;C&bMidX zT9ntdh|LJjEL1;0%JRx1G8dLx;nHZi1(a~4HVI1B&J!oNb}?Mnyyo(^d6FaUr$@|s z_44ZxV-lJI(m7OJQ?sO7oXPY6{uISf>YW9=htpdUY}Irl(Ml^lUr1=>39AUL$6^@d z>XRKyPuHfyRhly+{()S7?GQU3JDbfVN-yT$tP)UJJWdkenePq@*EZQM3h5Q?cf(>@ zp+TcmJDtHY&jqE`jM!fG@$7>*)LCz#mC8;h^q~^YsMccLQ(SLHW2KIl3*qNzm5Kkl zHEHrb8SK@Z_H13?4UlT8@-z)ccaz!g_=9>8wi=b>XN$lA3ClN$!r>0*mGupjus3k< z#>QjYhx`fn&0?v8uVtPPWD?9ErD>*`_AL&T52-uc{J0PiXFkcLcCu&7c3oPLFxFh` zjV$Egz>8GWqp>_VuGiU0xtQ(a;66OHilyP*H4%xj>M;TgFP(DAVY$C}U*GAF`G7?0 z_3D?^0*AD3>O&fLo^dUFDyLWIjud<**_TrgAl4FCtm_N!)N;WA3jBC&-F|@bM+7$p z@w-mtcX<0CLqE8T_iQyb#a~D7nep%wZ+kOgos*}mVq8@T#cr8+HFZqBOo&EWZwA)d z*mM|I+hbdufbE|I$fZAK3nt60cjosIBZ;JJ+Db;`YAjywp^Q^3ki9#Aqvl#b8J?fMCIVz!uSfke^ z%q})xYr5P73<9+|y*HvJjR8Vtq}>SqFix_9sqo~nYKAx~(_(#N^uz8mfx2T_sJZpw z)gfpr_Qyyh_8rrcb-H^hHy`6}zh-)oycWL2*yhznXMAIqExT>1_2J^`;!Y!vC*d8? zcJy45QTa{!$wZu*I$&4J*r8tJkONz{ob*za0qnNNZ-XXElV2T$VP*nY_;SVIz?RE6 zPX(=#pbmbL#p3Ha%{yc(f#}NCzQcD@8?8R|qftd^5$`2KqI;d2Psg7uitld>jXN`o zmU}Y~t6q8<^-|8RIUAxVl)ox>m5d2c&6gwFFUL^`n@pg194R6y^i{OWmGtxvvD=HF z(B_T7kN7xEL%M`NcP1=y`x3TT81C_v&y{%a6&zE}(zKduf-t9EKgpgM&T)hv&9jeB zo$jSwYIt>|uxT1KD`&(nN$TVZeKIZaaWbLTL1`OmYYp>qO1nye4ZkwBss4!uxN`hv zbWP;B&&rJ@t+|(s4RiiNnpcWDwcA;mS}pti?h>>9GL7*2x;sYJP`e&A9hh`KKTiThQBb7QF)pq~>Nk`?t7#48~zyzStz#JhOGztX|wa&>&USK5R9 zMhv_jebCa?B|$(aT{G7_ww17~7jYQBNMaf+fFjuxYmg&|>jb36v}%0Oun-tpU~#%U zMOKlwmb<#diX5~d9|)Gs1rD+MSw%c1?qv28Qc9Uih4~Xddo*(PNUqfhjZ=yIwux)) znUNw;mJ1tl&CY}aB`PyTPn~%?Jc)Hn_4!ecZV`(&@@tMseIthI$z4*Jhfx-{O0&Y* zj(A!P#S72*6~KDdoz+wA3>JbuT#(s)MA)=&;v)ewU112tc~| zZWCEr*U}qo^z)naKW(WiuUTIptd_^taCju__cK-5-s9QiMH;TQ;xx`-6}FgLxCs%G z&Tw(CbCfp7O6&d7%<~2I9vngoyqcfGJ8cSAgjeIR5rKw|e+wZQT3}D~n1>*tI75_Xb>5wNJ@|17O zF+3$H+vb>&g&+N4G3t3$37sU^GGkIwu1(R{0c;vK- z4YkM$ZYxGJ+>s?qSM>*_Fc*=I+-0McQnpSVt$io3@O!7ET-`AKq_BUOslsD#fNWa< zX{8TRkz=VLnJ$@{+iQl)H@3JO{0Bjx3UbfJM=L_<9!;DrZUPZfVM$1}ihe5}n`gt? z`IaCsvhwrOyoM+HOoPR7m&$I+1qDb6%gy?n?ye@Fmnp-TK5h8-Thtg zDpAHUG$t^XB!w`_Vj!QYGGt1Zeo)J2LTmsrR;l#GF9ty2%8_GBy7{X9hd1wLhskc5 zMM4gOg;PSjv#+TQlS6CExG>NGfCQ#Z8MQ2>t6yTMw-GKFj1=n&YWB<4H>J=28e>cG zo3AfTN%6+wc;kwVWPSRdH1S|~U95jxo#YZ$kj}?b6hJ*-(5=V-rnm590BExfu`%`0 zRq)g;IT-?gwOMKL&E<-G>S#%YrW5`soFyYxs*FEsemBOA#jsjr@*JN3YOWSC{bL?}Zha=h6 zN`sBltp^0R`Q7WFp@h|a!28c2?4oJionaq_B`00}cJec6a0hraQ1_AV45ULLoeZV| zZS_XMo^BSy*C&>~qPG+gxsUcIrC)Y%(5fy9PAz@nNO+1~t%qMJ2wehk}e>Ia>^$0)U2vohUX(a?czpTJyk6>_V1pG0EjY=#<%$~Om3e; zA!?+!njn4AsR5|Goj#y^i9I=s3^D>@Bw-Jw}J&f7$3ZH%nAaOnDf249pRcB z89S0tfm{4dFjEN2i+PcsC`K`u*-}_=Q>2jSp+$h1MJbxh5)6%$ElX{ei8r>H3Djs% z5xNUY-#b;_A=hPKqp`l~bRMa3`44^QSt_&`73e%+i7#!G%;gBOU#H{alB`dVqdDPW z#94T1+bomCccXBRA-amKT~g}ujz+R=d&{!Bipd|MC~;)Ne^UD<$B9(6Sr$=8L&c~& z?-v5purd$i3RMgQsC+bCxAFBPa)$Kz9+g74;rD|mf%&wID-?Xjv2Uwc4$--JXv}`b zkk_DPRQgW*SF!e2X$91AEFjlXN*w*t&Gx5i?|j8RJ}d)IL-6jQIFx0OqOS2q__|N+2ga5leK!@UDC)#iEk!qiWwmK2Z ztY#?ZJ7+b(`3~q-10KlUcQblvFD}C~d##-B=LLdS&i6}yG$*>FS2q3m%W3yO@h)kz z%~ZlD&mfODzOZPO%xJcbY#tX7y?;60D-cnPo zc9mF?DQ?bI4+v)wzb0KUNRu{;HH3;b)c!&7l}-X457*W)2cVSd__;j&saP?bralp$ z$JhPKkdFW-6hZKY!o|o+KD0-4!7o=Q@{Kd%jn2o6l{~y|*973n5U?8bU`I_Jo}Q0+QQ ze|=!HO?|+yS+{4OKf%J?s@VA&yN~xN)UiEQjix+@>OuZ|eQ1r>6@Gn)7P41*eF#1= z;=Us=70P61z2~1F5Vu3|Vv8Ir6ss)||9 ztFHCmhQ_nD)>F53nsWE%!s`%=CU=0wSz#~oR{4GU`7`+AEANY6xq?jA=SXA+gO1o0 zw&(b?^hm2)$~13(z5nR=v#({o?sPt<-4|MW7hZGs_MP#tY(3;N1Q0O8-5aec}R zxx+P#V?_36xbV=Vx2l&?+*1mujXs2^`f_7ZDEWj1cJ}5KV>Y*NdUM0y5KXDClP3lz zGoQ&_ci4pWeXj-+sJn8tugA?X9z}_9GB!0*TpCc(hKy+1qVzmd#Hs~*L7zcTVMdL^ zW|Zlob$hvC`8$0wHCdGI0e%U^L=$)P^=OimnCVgToK^4ii6mvtK;^7g!!O9Za+a&1 zr-l{z*gHv^eukT4BZB(WA=N0;tqAu9=U*l)y8F@|g+}%yvgy%$U#*Fj^kDBLEv=b| zRijBe;2_<)78jr5v~f+oP!EYdnc|vk0g7Wd@RHlY*S@rl9D{hNz*}B0&7G+n8a1)~ zk8e*oa47ZiI($WXb#0aGu@{#0%iZTH0$5J@*K$kNeR{QPdGi@o=x1upsBs3j`MR&2 z3)Pw-Es~*U(H2Y#c-7jf@D3^d@0^bVbG^u5nKAkpZnx6nBIJrF{<&wbZp%xcOfwO1 z@GNNw%MO}tHmlDTz}quz5Q3*viPJ(F*kP6$l3RVym};{lQfuOgx9$y727yMZM78J z_7XN!a2*nQ9#qv`2-_F7+=*c~UjATyM$bb9*2c?cMbg8XxvuLOBEfb0v3n(y0XEF3 zW&F8Wn>78d--J0W|Jke_NPDGtI!iPXRin`@qr`Bhsn#{a!)g#uo}qzK7#+aC0+~?d z)O|RDXWgH75mDKpdqlT4Jjc(W#HSfVPfyncS;p6Qn|J!nj#5Fnpo0mD%ac#`*t`B| zWdG$& zRVt!gF|RNPfoQ-Xfy9~2);R$4%n2*Vu?DLAI)$MmDxdtpbOS{XG#RZJ8Ljz(P#kY_ zcKm)ce64{=UzIjxw0Mjkxxg=xw%@NZ;)QWy z#a(D&}h&92gV*rEE3BRNi4m$tSVg4oDhYDI`ML38e6yu91q{&g$;y#%|Dgk z3%-9E9Wzq{EVqUQemRnmhI!rZejd}Z|D9TZd%P0@kh3AsNt$x&a8NT2S}iS5GsiOX z(iSpCXwlND6mFc9KiT|f2xk(sp8+kZg^h5A&C>7eg)u|vBRrCjBw1EbhNVC0H7h6f zq?+QK(UYYys&<42*n()fjv;xf;uOw_Ow<^JHnBd*{nR|oqGHcR3Muh6UINu%&jQpb zP_W>sokq83G-$`BlY|xaU>JCvLgPo|7}xoF(E+n!{9EJXZZL|NuW&ht2JfIEKQbd0 zieh^gk>6|~L~Wzr{zgSS$Ks|TtRF2F8b)tvzX!$X!E0Q7GQfn!oO`{f$Jn|+zgMzm zDLqdZluAmz^>%!hwI{)uWW9#yF(blrkfJUyYUAFDg(Ttb=w9)B-*h2vX($n}mR+-#N=&Kt=Fu43|a$Nx*=D+-U3_Ynf zMqI4QqP-WI+Y?(>IBS7Vb*%5T3Ab_7OI>MJO9od;Z?y@IOvwqR_cyS|U(i*er|5@O z?~&g)(`Rn}aabo9mETi5Gm@W-T6(suGX-wcuQy45y4OHEazRyMr$<;WH`#M%CAhJWtF$sLMCBWSU1GKz@_{B=;V z;Izl$q? zo2Ah+MXT$m(SzZALwn=sxZQ~)S`1x}pVaD0w-gYA*oa2Rg zVC|)3bUl|PkQrO^6k^c(?uZ#>8y9xxP^p*uR@To5 zyuCRVma6vr%3Qr0Y^0vYW0D+%XdAB|iY;%-}X+O}<*)3$9J)10ud{nGsc$k-xpy+H39h!$1D0^q_$;+Vn5Gd}_P02bx8 ztbL5T4eXD7!w4qv>n1SNZDzjA(;^G>$P5Gw7l2;vK5a2A3hH)FIS*g#9T&Vz_cX`Z zWTBFjd!UJvx+_H(l$*z{_+`_?mecNM6Cz)o!JxZ86y}B<4g0O4c;&U?g&3G-CXbjh zBEscdA0omgD7!*-%f-kgBe(!31&Fmc_vPRgiN`aGKwV30BzvB*O2} zRc~eM!ma1?ZJ|+K)t|SL8!ZMyM^$%x_{|{QEbh;O?R4dc+39+t$L$x=4{vj z{jG=RxN$ADcc-xV_#1=JP{D}fZaix%157_$2dK>?{B2nBt@M$9>73;mEGRqaHd5-9 z!Qhq5485d)L7yb1r#kD8MzH_w7!thDJ^%h%y~y?5it4qYA~3_BW{gKAT_hbzLG94f zD+Nk{Bws!4*ol<%OmJ=%(lDq4lPE`kCy*tU(>Kd=&uP(&$=bLg10hFb=L}bSl&dWB z7bghx(HW&kd@fZ3ZtFz$d@h4T9U&r`jBP#%D?(ovvy%O`KR8V&31 z3>BHY8M|O339xdZyn4m0omlawtmn{<3f#w;-tEL=zmvyN+PtThGu@<9v z-V!tJHB%Xr1i=xY6YE&=2ys}n_*uhP@(^WQ^e~QDV)K+5qI zgpy1~HtLNkcW=uEBrr0~2-`%IMV(caCdzv%Lw4-SaKk9|YQJHRZfmjygl=QLSX8aO z79q%Fa|`%6&WR6HmmxypPxAx_0khx2Pqm{&6Mrp?h|QYgB(vK%s=>b=)t$CmGTbmM zp(?WrW81=d;t5}`8+J{c+#H8oxLt$hbfV)ic7)1So}pTIiD%vf$?L6UG9RSUb{=`z zmV4<`d!}9_xrNk=5j4?xVOZ-$`27O*M|-78$2FYGNT`qHKcutc1)T#-78K>)B#SGQ ztA*8QAs%Pm&KEk*Eo=BZDq|OQpne@mTk>CBN@hMz(F&$tLdAVX({M{(o`?-=E0Lbx z9}{iCn)I(8PVddAE_hlqg3c-vp+Rl;fARQm+`IZfZD&qA=}wrcdb%n&@{c@kro7rN zdz@f~aM#M8G@o^G>h1!XwMC_>HtiQcP z=>!p#Rx?6TI4P0-Uj$}UF6x9JRPO&hw8!(i+?<76mIuIC<2Q}Qf>`^m67m9;EnH`x zCn0XihaTE)ziIzj(~ukPy09B=hdpl%yq=Sf>CVancSSOTSz+Ph^2u`fJ1;~h{}dnI zY2BIO3*~TzckqKCO1U|OB`Szsx*+(TBtIWI z2Lh%!MJS9*E(u-6;{po2f2Q8N_YQ1?;a7!kG?HOg(=uI8W~C39C@gP7l>vovLGsS0 zhs6AbC8o~kKg7gv^pX*xWcJU#bYQwNfqr49_TD~m68_D8?yFVY8vwA9Ago-vfQAKVYR?5mDCc|n!j1NG#w!3H`l4;G%k^I+2 zED4AJ4INbsrPU*E1a$+NeV;#&(?l8iz{}2f^$r5m;!cri$zbW z%G`)U+EHGtai}N%WmKf(KlS;iLog&&%hUpUf~PY=7=4F-_m3%6EvLc#Zzpa;xV7|3 zTDYG^IjjH?fMp<+YNy6u$}Tctvz;kDrg0UFSws;U!T`1UTnxUD`im1bH=@R6MnNo1 zx`W49yE*P}2BO^wb?iq(bJMV@Cuch)3%Xv>R6GSEQ@psVQFT+wfX})|pvh0!!^?L| za0TLHWrmbF7q{QzuOzUa2f=vQV$blI4y%C zBQ6pcz*A5|V8ak=H8nash&Gq-|7ga>vFF4)c~89sb1$+`W-xLKBgtYRb*Bb%<9)M6C#`Di6!%X3BInT1~U- zk2Zl&cba72syOMh!WX$+usrB=Pn6}s0iMwwi@eO^Z4AY_+4W^QMr=Yi)sNwVUyItX z(ghVpGZm_1EK8{H8jEG>IFmD33tZ(+tIq8`Q`G3B)j1xK zM3yTBt$7NK8)?t;T6ENl6(&>9ZPw$HsZH0P>Zvt#qSSq*EB~~apz}-GbgM_O0DiL{ zv;gCLeMxAcI*i5OF68(_5zZFSID1DLlGy%H@S`>FCm+<@cAinI(k~kFtnr-rV4(OV zC>p=cwmRpzEB%b_BivRmQk)g}hxc({y$=gQ`wB+rjcAuL;6p_i+ z3+{1gcpS}48u~JO7i4Pf(KGlG1f-=20zw8k(kvw-21|1DhgFveYOg(9M=N;^H2u0r z-Fub=3>PZ9N}i~(9;w{1D@l%q78>D*Pe8{Qz%kY57{G3JjTk@7?8YvaOVtU=h@uLv2k9vDtB`O8VHlI@rcM7DYV#15JcM{gDS ziHZ4lz?KM5lCC!2i9&sdc;w6;s_P=1Kek4hGJtuBc{_rVt+gNP2b4WPHw!Qp<#L zZZQAM-PLu$MRV9-I}N>n)$;oL^*}8^?sW`X)PELABY zhbD=+nhH>CqYJjBM-IaPAIh1}_ebiyPCMFC89RMRf`b}H$NwQ7?ATv`0T=Vpnh_$z znb{Sw1Wx}9qu6Yh0KaCqpIvkGm?u5AOHhAi@L|pfj7zUF%&OUo9@d$#WM**DGrgsM zut`U%YG$zMoUs`swq#^)olkNBqNBdfI!5)MzfxuU1vR8}XX+9G%QVw}REJV6j-I((P~M9Yau5`M zpaIoNQZMS@R7t3~!t#;16~|(du4}LWCf3Flmp_W=eOiv2ouBKwZr3tf&3+3RT)b() z!!^k0Dd=D_BWuI?$Bo#=FmsYFB!>Svwj|Z(Ob4MrRZI*@azP17vb0PjjW(mI7TJ}W zIEquQQIn1BFey}_OtyVY?6%z~efn*=WA?=N+l!XZ+8L zD+3N!r!nz<46z^rk3k$UPe%q+0FC}!=Aq-9AdVAm^XI!iHB9r^{&JK3cX*k_dCgAv z4n3x1d7>Ts{C{+tn`;2vz-j9o8#-Y16l`lp)MH|LE3Hk|U>En)hNb z$Mn{IGZ_=y5II-@gw>7vz!z0bjVvSkS?A^A??k6_wtxF?D%0--LE^vF9oy!Chb{?u z`^!^h9KO!AkZmO?YnxR^C(KrsU_w?s>qjGPO%0p!WJgty@+|cpKMIJZEv#8p+LUaM`#M4x2{e>klk)ku)hnpfTTu1xNw}`p55Zq~%rbP+P>ovNFe9xOk zJ>ESUw|bAh8tBJ;&WL;`ea^ps%&NmhECrlYNqkSan#CEly1#XXb1^mU@6~>3XN9xa zxOJw$vnodB@#de=Ijsu${{{195hy^vw-<7kb)%s(bnepBiV3tq2DiQI&j$)+5A|QX zVFS+8U85p<-E~E`23+Xd=gJ;=2fJ2AHwNgzxgELd!QI{ojdDjDR@=^q-f69wz5?F= z{KGqE9qZ)cxxK^NaVYNaJOpS%6FMV`#x34YM55cT&7t#g1@RF|ChQxz$|3G1X`;LKS@0j1ECNfd$+*Mr0ZEumB%4&lJmmmouPj@bSRHU3(UmnPcr-O9nHWb9U;q=WP zA21Gq(N8^pJR69$XVf(i=_FDc%uE??!x>kQsS9XaTrr_yKq`m%hOZslH0slOhqxYW zKZn{8|BC$GIuuXm(dos(U^A>GF-J4(rJ=YtsKsfqO0z+7JHW}9K}7_753by=qyJl| zWt(?EJPGbuQxTk9p8NfCG-b}#b>NN{3QLvtiO>M@5r$*N02E&(a2iN>VF;InkD?&- z|5O^Zz952d64MI}11&vdQxp65k+lC%&o9bxU83+_(HRYT>i1)lv&T}FxkXUw53Y(` zWSRv|Ge3-@tCOB5nPmcswP~Qego*sg?DxY?7YHIucN*b3B8Vo~mtU)>!Alyd;3;8b zM2mqWm~&ous08GvyG`JMGY`@>NU_)bb5hje#YHgu(n)`lhe_{$+^)0uc?M`0&-T{P z8(ccdwGn>_B|4gIe2FGRQnB&`)m6Jk9t0OAO^F%b!v`$V*Cztp9YbJ#P)@Mt9^oX!=PPIh^sNcp{(VHS6=Q^`5*r_l1K8f?%hjXtTAI$ zH@$hOA3)c-S`1+Nq8=KjXN-YiP+#NKj`f?v-zqL%C6&xtCq<-WhqfZmsRbH^me>=7Mn+HE~Ry3o-h@*bWoBK$o>-eLEpMq$wM(QG;MC1Q*4S_ zd%o{!24Jmh)C?(FJMWr^hV|7S-uW}3X?gL;*FxW82f+a7(Bo%R^^r|p_rk4IhiNX) za1G?eSQ_d$H~cNwm7*)WVo|IYLgT0nw+k$3#=ssP$nd8KL$6fWCAgSr zq?ESFsB!?X_jm4ryPpiK%m1Int;JG4B<+tOCC*wxD7MtLUHQtFhq8aZ)BloXi%iMo zq{34~=oeHjL>b@?91I^yfK2c&6IeE`Nj0H_5d+y- zP0mSfcEH~bNj2YVhI7))-Xdoo_c|9()(L+1cUFat`J8oxuMa8wJImR{_`Pb8f(Pm% z3E|s>1M1}PA9oUC3ssU*3j~0N>*Ut}x4zh9Db{=gZrU1OVKGM7+J1Pdc-PT6v6}2i zebs<^2UjX%>=D>VJvfLbeh3K;r80|GG2l_IWIj zkvT=s!mG9^*B8 z=%MZx9yzuozzQ$DzHBAuMSqBR7aw-^!ZT1WSwO%AUFaPwiVv8w8t@C?2YVc(+}$$r z!#c%PwdAp(y&}Ez9t#Ua#5rTZm0-CbWXB03jEwk+hk6+19!&Wa4hV~)q@m2o=aGiZ`hXHSL7X9KXk6s#i<&CTVjch^T}Pz!^v>Nwa_WOU{5Cs1V<&hu<6kp=|}vn ziQP#<2W>?3&0L`!)sx#^v9B*+mRn{e0~xLdrs6`G(f}^-LtK6{uG>@Z!oq5m_3B)^ zJ~h@|rDk3>H5F5CXhoVM%L!tAQfvQ4S1bY17I8RK+of>x#*OW$h@QL!pv3Hh4=~xp zyMxDQuT9iFRqb7KJWQ$$m_An=Z?iv0Ouw#nTeht&1G6AEkPczt8tTWElUnmAp76Es z3TiDxngB}zzu9cu1ax?!${%nsKuc~88#m*m<>D0wp=(CQvnh78*HCF<6$X8EO>L*% zJ?p68`z)T@m#_YUKMFo1^+CEzS{T;Y|)`*v)%v!!GId|~Ly z#twtEL*vymF+yu|Cvr>4>+!JrDpK1W=ukYv8=^VV)VDG+fZ;e+Q85JK9;2flgrdad zS3oBR#obV;5qh&0G>7O-IkSE0Z|}JAF$3As@U zStws_s$h!S!aaCG`!)`?2qhs0{6ZM)V!*8{yKFLP{^8W|rMPGv$0T7;eFi`J-M=gO z!a2o452W1SU7@W(GE~ZLZ^4H`@3**9o_@d8$y{Wg+Az^tciCfJxa!M^ejk7FX|h?S zdeCX2DHEI~+FwSD^FNnSCpydJvc}M674^>r*0cChvWP2F z{$00n>%^(9f&UAteY?mHG!A6~*NWN6!fiZHEIjT)7o{@jbBKr!Spgs}Ip^B3Ix?fK zEIkb{`q1}OWURikXjOk4`)dFaPYc6;c?BgE29!UFDGeZO9^ zRBxdz#I2#429 z0!8dij+D5bF5z&^`65GOw4=&%cqYUIs*f;{G{R&5^r8Ik}+Qzk)VE; zXLDy1*_Yw7y`t(F}k1E6)dFJMoosOV~DI zI}!QoYSR1@FQaJZj$Z2Rm8e0}Ws2wlCNq8yJ4_&lSv+xRItY<36OOk8lh{-iy~T6eq`3$u)Vs@ zHSFRRhbkLA9L7n)`hXWgKeVrKB2u?v@9a$5GapOqaY`N&&2GpoW|jUPt?*;p6go3J zNMM3eq$!~IFU?d1AK*wOhlKojX??kJ5}DvZ+s8sf>(4c-!Ees-LL3}E+fo2d;h?~N zx-KVaT_iP(kizA4<_Ks5-$l`EfuxDlfRROK=N7%DA3gOOjxYK1x_wvniCkBpNrV_P zM^h&pR`8boa=Isb)Dnw7A5(sNA*Dbi`S#Y)Ujzddv>JY9OaM4Ov%YFIcBIFeBp_P4 zOcDE*a*m~7YoKeqMfr)s&?t-*7d%uuV?X`@C0kF8n#GnKNV7@Ua9|#WK#q65rSFN` zKgSA=ph(7X_Rv_8Y)W}!|1mGuBoO3Te39uxCJJcj2Cy|$h-<7^|x zoNX>%6rnsCs>v@UbZdR;vAPqC2&47kun9&1Nc=qn9{@S}XXhz5G{SuFB~(1=`pcjF z@Y#6Qpp1_>R_JoF^AQr#osyp9A0|S>bCN8e;MoASFzvm$y1rgxv^B|_&xqNQlUwf0 z@BWn%&pnqz&${CFuC@QPi6sB!Rg=Fidqo^n&eYtf)pt=96^dSTgU+~R3}kZC7v4I%tjik_ps+rm z$$skd26u%LDq$trle4{S^*gJ>i;p!Tk;y3fn>y zOnb$$6lVAm+6s(RQsWS~LsE7dh?BxXD57CI>gM5jkLQM9_Qq+=VIlr!-gZ3vi2pbT;|x8=6nrLeEPHygwbdWCplE?5NyKCX zfcqz6w>#3W50m~VG&~{#a`wAvlIbP{yv2JSVl%1(`trz+S#qC-j@YJ?+6R)JxpRpX zm)fspHqnw4SpcXD+LE&!1=^DZ*WYyEi`@a%KJ=1_9Kpwy1Lv;P$g`!kl@BrrM+P_HUQE_}ehc3KogIN9fXlV4T1=>N*tL04;w zzQv$rXpg>i#f%mm56w)e>IMjIv~bttkO=|>84auB=myhOtzZw@pJhY|Uvqe&0F^Nv z4F8B123-YuQH-GP33xGW5-P>z1Onke!N)#ViJYLjh3cT@MBJvcATDE1FnZzvb6FAs zedlLfnGl2>sosGeg}@5|nLMUllOV6c`p~g&_Xi0K@QW*7b`i-R(TX1=)6sB+mj%q| z4jfhviK)|6D!45QN~|Mta0j|9;(N2{8X1BxVtct7Tq~f{7~%HCDSyI{f<`N0Gs<@I{#@78p-|Ct>X?<;_8LNgCTKwJKHZ9LF`o&xU)481UKsgQF6tZ%}-37L;Y zOA3hRsI)0cvOg`)X$e*Ms~MC;;Our+8PiZoa8fa|Qwo+l<>O-O5@B zoR38*VHZQHx3TUAyR@4DW?ht4Ntm7!pg8lq1)+uNcH+Mi-{GVSNP*466Nd*SWHGt7 zh=ri7GBMo}CG>29O+&`?C`gbz{2Q%B$v)WqY0%RZDI+B2pGS6Uq}4kYv%;kB|E*LEU~_J5P9~xyS~i@y9ZVQ{Bb1Uo!=VTFEh?@ zMgY|N?FK!G8oL!N)zK;cW=I32@oZ2l2zp&!QTnIw-V@BVc~zajn|UlBcde~8O*T9V zu8+^VH2N3Q6D652=2=FXCqxn9+ip+{h61)yXxJNB>=?{&#YvHq&)>#ueH*mA9KjW5 zmzQr5XpJdf)X6Ep;oq$%(G$mcderHopMX38KJO_{A7MZc!o>L>p7Gs3WXBwMAf6C? zr@t`4ogZp(5I^wp{C^8v8LtcFX%kR#3Fq)XI>ugq7JqTyer+eMWsr(Je*wQjyI))P z$#n2m|7yP3YluPBYck(DA4+oYZR$zxDEZgIVAr_0LqW#@OzP~MRGmfkVOC;8mB;b| zs4u16Bs*iTp*4X9QXC%c&n}oqqv?UySz;oF6_3|raUU)Z?MK`a8zZ-z1^J~ZzL)Iq)mQh5l91GM?*~S^`Xido(kPpff zY{{?|#)jFgJ>`lbwIswlCnHU;7%&Cuyu%A z=1i{a@kK2oR)uAU;DOQE9nU)24yfMLBM>bL7eVoAwf^EkF-`nqW2F4GtNsiKqzzJv zHrF$NR45o4G!TxUfYlw5iXcET#OG?C5fL8Np{Z%0x2=X!TKd+d4IF*D2#saF5{>os#3KX3q7lNZ5K_)ML8i)ck4 zT_nf763Z{lNCs854~e8Yyd@ShTGLUr;bKN+fSF2b5b>Y9B7M-710emPN#c~(RAw3991he~>cpmgG|8uDtz%ps?=a0_&&9x67#e1GWRcG`l1mb&2#M0)H%TLI zTcu!hlipgTh?>B`DjFK5*7idAZAYIt!tcf+sW*j^BsYo;IJ`5BrN^@Q1AnbH?YJ|< zYY#K~b5Du3Qz*?vrG-0s;_qx}aJv}(`L+{W=bAP_Jki#cW=Gk5+Ye8GAqTbp8o~NG zd3q;r$xls`7^R+*2KQ3-#4?9-@!2=1Pq1lo_rOnP{XS3kK|m2bXTZ721mH|@712mp zy7A@i18<8LuqpTwQHy~>iwYcQEB_xCX`as_$X%YsGickJ;S$yiCz-A zQf(zE`iFt3!y*V~CcRxA!T!zg;q5}m7L^tMxn$E6kbPauq{5Gr=W0(?guchcNsPFQ z3O+FWx_C0CrvN_4CArJwBuTt(C1+&Fwg?kS>G+cFmX;(P0#%+NQ!=;Jq`Z*+07NcK zkF6!c_lEBY(N4C8N7q?e-KEdLmHfU0Yzf@O*iz(X=P)6XbFqY)VexLoXqdf$78|kzLbv#$K z!QaKWZn>DTznAN$m+z*ymQU|pDzq_NN9Ju4`G0GY;a@#^31U&3)BJmdV_wz+xy}Cf z+gQy zMp?6W3B8J!Qzr`s0ger8YDyf}m7|KmE(o8a;3o`OBRVwu+gX}frK*|k&oX$`$%KNPD=i^fnh$x$O zK-ULU2_$3r777G!p^+qdSGib!T|E}SC|W*1irY@>MZe(XQ$X7&=&8O>VR;-Bj|Wq0 z6toi=u1ZaY9#+$<+iM9rc!iJnk7?j7VSQ`SGInm(yrs;=tSQ}PJ23Q)|Na*EMK}y|ur=tKc zB-;sm(LwK4wkhMG_1KgKXY6)!64@-V)GV2Ew-CHu3=r1Fel#b3G@k}^81!hKIKH9t zD`<-J=u9>?rAk^cC<2$9wblU}3%I4@8jVlQ3$J%1G;5c1mfT?`l2u3H&5KKi;mxee zP55BQ7H6ROu8<#14y7E9@e`5$i8k+&{{v!x9`vE@5)y*QoNpt2Ba&Za9SWJA0z4)R zl2yfwQ2)7+j!4z_vc{}0PIJm*1SKH?tfGrfM_k; z+vA*PO+Vb~h6WFM{^eE_I2m7o1!QsF2Xe>pOTr(A_h*k9_{MdMQ^ed)Ip=ytF_E4G zobcUxP2uTEpu0C|$8t{2|KdjC`_HE;Zn^!^k{%kr1j4a)+h$D$H>U!PV!t>B0{{nT zKMbX#%kKewHbW6jWhdWNp;Xw8AQO;nH0sbJA$4CIs5$pM7WFW7N6OE|r1Jev$p^*- zSsoVztMt%ZnaBnnzG4oDzMwmF__LD@I$}f2k5R>mx1hu0Y|X z;N2DP@>wE_*3{yg!s*x~T-77`TB zk_oc8MJRC8b&8F2{JTpMGf$Sx!x7(3H;L|OU*CtZn%Cvz(WZ_35af6_KuF661$d~q z2xC1DZ|6jl!I67R-B-jQ0N~oWkMk#UWGv+UB!mfDTXw0HQjw$D*NZzI+_NOKKjZQk zNbw4{^gTdUx6ETeaQR)~iD%&~Ys${#sA=#CS)%*uavhGAk$jaB;p8-9c`m%&+q5%O zPVpVl)%Bq>g_WyZg>SLlx=GRG-d~i~Mlt=S@{WF!y!ZE|(tx8{0Dh{LFeee~K$5tN zZE=ZxTi2vLc#^(^@1{hWfY0`P#W)W+#&X4eBd1toiTR2vd|hda0_4Iq^7=}xJiIrh z^+b4Z=6MMD=Hf-MwcfnIn+sb-7+N;;V&ask7S2@eSIc&jE&zAjJ3P|`c-lG!0T;-hz$QS$GfqR=SEMsuEl&GYtgU4f+)cR*lLhM3`Q=)=rA*h)eFcxU zuJ}6Z9=wRv5}5;kO^k~1bwYpyVW|gmI_2(72XhtsbF|MI26Q>8_X=ORU4SIbfyAXn zxc2gAN7dSclm*Kr8*@B;s|~rDCBL*)sKd32)*+4Koa@zA{P)z3y6<4R1Ed$~O=zFD zvWr3_WBgpuWHn_SmvXCk*)}V1h0Ql08o&jCUH0nhm!*A@hS*^&fNb4|6lx7yRd7f13vKSOr-vgv_C)Ee0qQtxNA$ln~Zy z8`jH;R>HR#HHCls@s9Q^p*~eZ-7!|5sjqWgy3=(_UUv+a&fQvOS5e)?MF|E#KgqELSywvj;5CFHyL3FI@2q@4}2W^9s*l7-2o368}& z@r+Br&G{l>0X%dm6^D2@ta=c7!TH#dNxw8EvfWGWXI!>3GN7%R!CB_hst2()=l^gs z$qDVt{zAF-9jhUm+8yK9gxbDlWHW%i2X{slDC#)g8%=KZ55)i#VR=&omJ?A0+cZ%slq8 zC%<7P!^4$i-MJjLQ)f25bpzd0J6YTPNyuC8vhR3^;k_7RfZt33y+A-CDNlI!)(_aE zsACqKZG-==3W?votHM*`E{3%G20cJJ`PJI9V&c#Nck?VSphj$|}tCHiYaQYaMR~pjv8D->{MK}xGut_z3I49O9 z`(4oSgfG+&q|(Rez(5+}6~!cchR$O7b|R`3Q#)vdU&wSC0+8JzX~s-MsrMohaJDpTx^#XqREmnlfz;0fc5`<1FC#|>V za2F?6O1hA<(g>`gSY6Iw{px}h+(}h?$a(#ojJmf&YPS2nKWAiO5AeGomk^r7Hr5In*_34=OO3s zWheZEGt@&tZi(caq`x|UF9o>5d`cvjjNRTPKi&;1p$*+(-@bWIT|OGoTW zbLw=fNdh9~6ld~J(eLd)h&c#sUesx7us%B4hrYQkI)5~C-`YcWi9gSK1NIwV zxqV_OmD8iGa&hj*?ztqO5xXyow!V#!l9-p!0oa~m9%|4h*11ci)a35usf#)O(|E>$ zVlR*mCH_D}Xu)#d$Py2+w@$f@UWlB^-^k{fUiK~0#Y0oWaC047GD_m2*IWDj&l@eru7|MV!p4R?Ns;}ol|J+QH?PnON!qe5x`Bg~P946`w;vqs3u)+d2zTkI}4 z3bv1*r4(yZ@`j8=(CbnU`Y^BOKG`W(Wk$6kJMDT4w9DlNUd{#ouHbfd99LmGkF$3F z@Uy%)Hpz&V4(9C?U$0ehcQJwDzKCcP0CQ*oOY;HDm_51QHUr*wA>yNf@ctWz z63&3yWTdN#^UEMpoFU1QfJIFI9~_FX{)ZhZSYAi!uO@Y9hbsC&CLTngW(PY>#rdlW z%al|eMgAj34vH>o@O~RY>*n=pKyfm+Rrw=-Bar?of6nu3(es90fFG`Ioe!Y2&1>^J z_Ic)Rn|r&{?QWaj5Wsz-pHjM!xamHdcGN?MKBv}Hy)gXdz5Ct5#dFR3yNlpipX|4> zr*fUjb*IQ#?E8%4PW9s1mgA24_r_aLoAPglJBPRQK2za@j(nx^OwVApyepT@v$@(r zUEzQuXV``(qBi@p)|PzZz)+80-}NJW<4|z(*YyDAJ4ova;NLUI8T#bYW#T*zZdeP$ zmi?rJp@Ud#?3l8?V(i#F3O5g_q~zggI6gswsctxa4qEL2l*@;IEYa=WE6C67Gq(T% z-V+^#stn_QuRFe>R~7}LZhZvs{-5BZgDmc~(EMV>?&;&&queVzC+i`et;_vKOPfC~ zu|adts`n3J0VnaM&@Kv1u_Q_!bFzMR8+WtpkOid7rP)@OL9J59XR_|@7%R9=N%=4^ z79y@57h#0%bO__V%!+62PPqg0m5OLh2nu|n_@om{$u`$WeR|QmNk29{<+3~(a}fKm zJgPWkUU~rgM1@qN$fwyRIjU7fNG=Znu>y14!#t&0fD?4Q+4;S%y?X)Bn8G4p=da7! z?(Nyqa(e?PeW+D3qkS+sBdVCc%v@*C7AI2-TC@t-TmPSG!f0N4%a41W!9C|#0a(^3 znc{%za#LG+jo#^Gu^Ms)lLz?s5X^+nUr zI6w(-J_$tGC|KZ<@$hJpB&TWmX)Uf6Lc>Cg6eML5evlaL$&8-&7VTv}v-Yn{>p5Kb zo}`HwACz7IfxNX9LkhfUZ~nVKvP=0qtq4HgKgiN(6OqR>2=#|k4R1aB?S?eNz&ADsauFaCt3JHU z=32>B0r$j6S7uE07=3YB>G_*sS--j}l%Mgi+2swToxrAg1-(A6*bm=rl=4E+rYZI8 zZhhN`#cF!?WCOlsLdRzE+_$)M&RsM zJgfGrTD{5r41gIGB}Mr6E=vQvbmlQj1)Q)N1i&%aT0&Rdf|<3#m`{I0i|bi!l;wi! z*M-9rPlv*Zaysjczi$7ez?-SuE{^)1L-(Dihgzxr%-)0o#&sY~`E8qS|1Y3xiG7bJ zs^qco)L5>al-vM`hhuQ-uH=U~8v(4QTOX~#s$_21wY}8h`61)+0wX;T1YAy8nQe!t3#f>#c-oHQ(X>-wwd(hjNY5@0sd+SJ3KZ`;+_+_-*G$X#4(+8h&7Nng+mY~nNF1A@}52Ign^>XXW+o!$j^Bf zS{YpPsmyQw<%b9DH~oTxs;-_S^gsZ3dYaKZ0`E^YQQasF`^c)N%NiaxEywq0a$jPjuRrUZsi}U zs$GS^lfS$P&k$ofE@m@+!lku8ZN4fnved^?!*c>0bz@`@;J7no^z{Y2`-}3C zvaAd6yw?T&>HJfqDPC=2<$bq!rp_P`0f$`L?V;qQ{{7N6Semco@mg}5uk6v{?zZMv z+@g@yFr=4l(D|;0{B&B^x?`a|E$w z&5>r!cGNM=D%BlxIE*eMI-&rJs^I));qd6p0v7AgA+6~AX3x{8UnESKAst#(NN^!d zmiQBej?hslY_qA1iI~H%WwZRc79h<`m_m(TOIq6150Cb2J9b&VPe1!L0cbuCMDc`e zYITfwyQPk1?>r)o;vhbl*18A*Ege7jW9L>;a4YF1QE+)hOeHNZp<@691@&a?c5nrE zLBWt^IH>vc5-Tz*|GXIg#k`;Ey%XF&ESTlG)x6E9@3fz{_7}HIZ}!em2vSBE{lgCq z@xah`a5fI0VjpGb=-fy#+ncJSk!&gd8%zlH^#Un?8u_K)W}^Jis21KpB#`L6WlVR3 zec>5XB%tJRVC@2GiR80UIDr%Kq~5lytig zmmXs{aJdjqli^H%UVtPphbiKZDpxMJNCY9KK)o#2kUdX4N`42>eo4IG=J|l>rdVNd zdcUOKYF{4Tu{^Irv z;b%)5Rg%j&_Z@#nR=3Ojp+JkLp!ZV$@}-Jp6z$w<%nYBjp^fL<7f;qMa?a}m=I@f6tWkLUt$tL@|72P)f*!KE8M7!Ox()7f2N2SuJW}W$AwaOY|>OM@nl~6u^nz;&HJle4ui?QdswAUNkE0bVG32 zVrCXcEUvY-S`&JgLL82A?LR8`HBkrkN%^rSV%z?MgVtt%bOqLS8{A(FsCjA?cdO`| zcQQeo*&2&vsWkT%$+f%bf2~xaM_2O9UEEjQaS|w7N$QVhTb9G@Yio5?8JN6^5eOag z>FR`o*>YsxW@v*5Hh$5C9>JnkZ{E}`Hp|K6pbwR>f7X-Snb?_XQ_va1uIaool zQHI=UetEW<5~cvZENjuZj{Oub9SEOXgZa~vwkK$$%2ekhW~OkSso<{uaO8B|Ih3bS z*^HSr&!d$yS{7AFs1(JCl8xZ?kMtuM8-*#&dHOXjb4vW96fpenH=qPjffh zYv0QTJlu_7qh71z%@%M{!3`-wk-?Lp15vb_v2S0?=pvV%&vU)|S5SV)2Nh0w_X%CbDvU_%s(RiA%&d zs@Dqp)e3aI-Gd~M6^}d&BRCIQYy%OX#A2xd0{a9=$;ldl-=kcKnm#f^) zRgAvr;IO^gAkP0sV_Nf<;M*k2R>1|Ma%3Kd1~h#bU^ zgF|bE$A`)yhnf!RJ=*$F{;nJ)hfl47jIW*z3}G;egOgH{IAgPN=ZG`w*MeOr^XhG= zU+EG_I+VTIB|w9jvd4jF;*9zLZ&YjwO@}WHbb+&WwRy14gnA(GOolT&R-LT{%rYF{bK)*(vDPc!^P5dVJyn;~T0J%iJs#mE;9drBL7nnnE3@&5WT zR0piBM3&)BY|hk7m2Y1>eXgxO6B?3v;65=bb>u+++#|Fh6IwVX1t&;qY{w&VZqE>K zQ5wSIek}lUh#)(5oyqOQAKXbfGyh}!{m)FCh7k>B-ql$my z=DfK1`A&OSUePj}z@XuwT74nKXf+lKsqJt9z9ps`qe*0!MMw;KE@qMRDU?5&h5!f8 zrT4K&*kt^|MNLryyJSvAx+!>~;xECs96Dul&yfdi=^85SP_Y`q8C%v^N#=!)vJ^O_ z?;%Qz*umvPq@A0kM^@pnRq~^0fmeTD9;fb=_nL7|XROU75=QEd)Mv=4aEnC{Rk$l8 zP7}qV|}TQGBuR_|%0 zy(f~ZPOUF>(|v+PV5%^&+Cr$4Ay5zc5Z{j+MR&jZiLn8hwMlrzskH6MTC8iSi6Ct^xy z`QpXXs_%Jzg6!Af;F!KsC<33j6|Ahw7zym8GDt_Y573$d4>g86_&91DvpsG^16eDT+@_yLYc(cR)p4;V0VNm4go@)^60- zaJ}ovBsM1ykYInivtukq`!4aT2+$zYIfX4IoRtwKMdbZ^uEPcG?!s2R6|w*VZK7W= zlumr%$_{`}O!A>F3F$Q>OCS0_h(PW!smJ#j4TQ7w6bi__@@7~wE?5fRrSOhnpdhrz zqGSQw->B@~hCLtHH{y7MEFp3Q?#K|c0*^1;4<9~UxJ!Rm-4(EK8Mrup z157SsA2HUSe8|wMkxG6S^ElrBAUwvWSKyI>@4`B|;{@ZN1|q{=x{`C5@KmCJ?~l+3Bcqvv4t>V879N%qt1JrBegQ^{#X^9sVlJCmD6=A=j)C;%h%1q z2v^UW^=S~NyRSX1-;{aWWPO08uua2Z!3sHZ!AS1pITQ~J{9USt!eV6wlNOkk8 zY8cLC>l_)9r^)n0r9LA&>F6}W*BRt8WGKg{$*LoTwD4svZtu#($o~Fb9wO2UZE;gR z6DiWB)NtFq)&o&g$MQp?-{7XhuQB7gD$}Cu2Xm)Ju>l*XK>%;7 z?ibQglU+2Xc1Bsx!+_Dnb2fFT43RYM7*XP4Se`{=jv1eVmBDQs*o!`+!U$fq1VrMV zIlgw#gp7G2MXC}#wi|X$jL2i#w9&!z(lvh%k(P_O5tMAoOv$X%jhP|Le_b;rkbC)- zao=-!NxDh*w1hAoPi0i{dP#9Ti6pQAw0O(#(p$RLW{eEtVm%Y)zUHJf&-*Z*)`?ut z&X4Ni#Qsku;V_AM%?speL!>>6iaxActZl%7BdaM?A;P+I>B63_WzTBa$(`@mt(JdO zG%lhD!KSa5R6cj-YsR+LFW2-crE4dKX_ZLUPYpT^H)CMHuelkNh#IlMMiFzm3HvB2 zo3nmeB17ETDfzc|`3{2+)=o*t+-1N-mczO=I3(p<)S_7Xz+kNTa~d-6;jf>Zt#z0H4{)gaK`?_fVv!Nf_(R@ z@Ma5;khq#)BKnJ*5ZAkfI5AN{ROTwBO9+w^QK8ygQ&4YFP|h^dQMSk_Igx*PSUDw6 zqu-K+3{}^fkw0CBQnR`bFrq3le3KI_LKyu$AlOP;T(N{@{O5ptuUm(4__V(V5!4B*%!*g7>7&_Zzb>>UVPBu%0;?SSnPSMNF!t#i#&XN;R z%2HLIB`4%6Q-+qD5SFe<3*CR{wP{tG78XS541B`XP+CpA4r@K;7@y~9`^$M}%gxJ$q7+*fB|`@-NQjfX@7sJAH~f$`ceEj zAm{o;6%SF!eTEqSe&POPEdFizrJaP>~SHCx!06*fbTGW>IQA!y}=f%D?g z#`{&{(Mm$2MT$j-fobm2aaM>zi}1Fp1(ViAIw^HVl$W+m$fbfCSafZb8?Sn{5bjw> zFAz8s*T4Stui@+0?bjMk3a|>SfVFb4 z67t17T{OMFKOFDxcgRy&0N2X%qt$;GN;2u+u;A{McRL!vKcGy1*K<`854PHbWeVGi z1UXSV#18;GLj-rW&6{=zcDe`^v_+>2P(QXiSbd^<^U52*#U6i$(&~!0P8Of!YaI)( zB&2aQeiG16;!cc7hj2P|!%V_B)HXYq%NNMrKMg;+HLIK12@*_E`Kh+~NEqI_VI*P8 z!$MQ7bCI$ScEg7Tx@nN;^^@g{$LsHW`N?rcD~y;wpbx^*_U`5Yh7X}F|L{P%)7w-l@~9Fmtq`-VZH z-b?CQkOtqrhSiA@91TFXnr~-1Z$!U#>1v(&*wN9=!I09KB0NF~gzK}w_S!d6bfT-D z80p7Y!|Zfj0K7Tp+^~2B>^lS-t9=NU93FxnF!W0u)VEtZ5z69D_}DNse9@>P^W)z z?O&nldyL&KcI*`tg=t$V=}3I-vm$#Z__fyc&PsVgE7OkML(w(tzxB&ld0NrRlw;rB zjJXOS>41M~=(-!CwGfvM=$5^!@SILr=tSNq2D+3o74o817cz0@tuOb|9IDlqyXv}a znpMD62Q>e~yCkBVZ0mNAN{LyknL}ilSp+7k!+CVXNLgCf$}`}y+n06#Jdhg*U!v`E zkchDBBn$|@0JTNgCz_OQ18H9ViDPFzr&yAwf3|<{k=BWiykA`!YwKDS8cszgyy#2m z)7wY%KehMuk?Q$$dQE5SyL6q^oHkmhZEhvk{8F3h?eA+AfmKC0&jQa{PF0yjS$i2u zb@xqWXb0qIe`j!ScyDmen%={IkR{%Q&v6&^Whch>@zq43PSMM%6@CQ?Rf?3ROF^r_ zt5bh?R}I`b1`2DFb}-r>C171vsG+J}mTOBbrD&72Rb#u2O3k_DN+0D`&~8#W+f;8_ z>wVRb@u-HWh}yS*gCWs=HU*0-BnvP2!NxlIvvj;TRExi$N;SuG}4ic&__F%gtTF(*MjexL7aTt-{2W$wqG>}nbQ9i%)DBv{!n1v&d z+^KWNLmn0RM^Z31kb{(k9TCDgcRRPIa|3*#71%cn-yGm`X)w4;LkteItRT^Y+9ld8 zY;Moy05K4c%!rT+H-Vv}tylr8A)tS_Ej3C>P!SriV{+jRNy4e4F^WINnK|&6O2~nK zYu50K)Q!J43#dQ;r@$MEKrL3t*GP1fP1eY|LKZ9x?5X;i48zOtC-NzBvtHN?A`DWl zuAGLKlrx|Uk;Lle|CYOS^7x2iEUJ)Spu3jQUXZG~8sXBDl~h>Fi-0DBJbQSaBvdm;&$ zLxb5b8Bm-7*+pC&G)X~wl@p2&(kY9X48`2i2Z~H$4?&3wH<5$O43ao6czv);NMd z*%W~~6^@@KiO`US4+aYbq*h%4OAeV#hR=eqL9^RA3jjpk^+Lo#!zO9VXom?3HJCIX z3+v^uFrKppedh#_3q0<3LOllpFfbitXPFgx+8Go9Z52!1&k?d$NBxxgJI@LLAm_1L|hsORGSa3Y^tvo`09cOO@EX zDY#UDWO}O1g?9jj8?YJ57o_k~Vz3^Q56U!4eS5@NaASW@S<*E7f%IpNcZqk4sP*!C zSoFdV-|axiMBJPgH$UGQ)jnUNWi&yM+k6b^OpqbqwBj&YETp!>CAKh5Cn74#u5zTK zzSs?gU-D&{I`Ke2UwR)6alcg{xOKKVeU{qHv-pJ1FWwARNu;YwYl6QkymwzXU>!I9%`-a zDRyU$5B*#gbqA9qPNAj~Rnm*1->014dVy7O!b*R7{n91T4_wp>E6^!Lf-4W1PsU%M zAdh92Ih7_YqE4@#G`yM$sH<)}a8=G3}iY}e-N9rtD@weMu_(l#r z&v|G2V%xj+V!0qUKpU|+8I%5ke#B>VI%Ph1*1@!&(B;ogvFRkEE`AQ1>!-QrFd}9b z7Lb3KzyX2#39vmT{S3EaC}4C#kBldOBXUZ~!4B472nppRUJ2^0)aLCe4ol7z`&H5v|)2Hp)3hYza}@vuuG9!x6E z#-vLs#)lOrWYX!3OdeL8lEY5tWW2v$k&Xw%qIU&U)GUgfQaa8VpsW)=B~C~m!cu=0 z3-H`o$3(4+9Ph2{*5(+sMVHvc;#@`6t1xJU?E*EylYWw()6e?YiL_}mM?hNjjK zR1^k7C}*;?Fqk!OpgJ-WA(Rmv;Cp`}j=iuUNHJjKiUx#UdN+*R&MBBiZLUQZE;-|$ z$&oKjhPLOv^JX)LeZ34ruaN>Ehv8Lpvo_f`WqZr!=~tddk4lw>5UH-LQKujMyt3u? zU_^dofr@BV4n=TkK+rBkwL0D%glgo)lce1wSFkGYyrs0`?(WJ#+ua?I8})w`TxWU^ ztIY{G+H7}reBqA8ij992jzm?nP&f-@x6F#H@8HISorJ#H-Cfusw_*>1BRBd5LnFi& z5F|hb7gLu&ng&_=(Eq_c+y|Dh`5>6s_Zba@v*OexySuNv83%@frSKgH>oo>`K>H~K zu?L`+Q`x-@do8eUgxH7ZWO9E6?f_A?{rJND@ZrOSyL447wD4-4L@~FdG%{j9isK6M zevkd~dA}C?0AiR{W#p6l+0dt}6rc zczRNgl&c4qV8ns$TAEW{$-RUfyO2&V*S&CtsDIC>4IZc?{dAy~l|CDYq=3t#KBH@l z$Qz$2hgaU&1is@-&%55;je_RI7Q)Cfn2d~%$dtJCsj_e6+sPcLR1Qr{0#)99ax? zhMGM2xmqr1TU&nu?sIzdUGtPuMcsGByG(y$L2Xwpri{G#DuP#vWSV#~62N6}X&X^U zI7OKze&c(S{qZBQGxp-ko%+b=-`sQmBPBT{-9I*yS%tUm-fU@G%14$LoS$@}y?^hr z+i#b))z6hxYYWI&q<&o*1w z?kncb!Z}3zmhg4EQKM{4gZ#YnJZkcSOvMIp;Lc@x?hEPC12SahvigZczYR*edAoGj z>0+_OyQ`3A>E42+!-%c5Nq72(d4Rl2$k8bqnso43mFX%CIO}3XMUg;NC^Ux+bw`?v zd8tmGDM){&3lg;`hDtMB5cJRmd1-%Y6&g!@uo0m&2O}!8)Nt?(~&b9UEDOw@0xk9v~X!Q+GZNr zXd2jRs@QCbykZ6$PDS%deVa}pEe0FU%EXl0e5!xhewx~VBBnDMR`JnQAb;}&aPkUL z!TxYB;|tOKLJ+vbf|M|c?pgVpJ=cmd=}hz{1y+Xu#vo?Gr@k%5WEDwozKm6bfqEhuksaH+k;|K_@2HOY@Z8 zJ$$sViDOQJZgNhi3e@VPh!O#4q`zAQB4xok6`MgtR{MD>0o~}9*uJgE#&T; z>Jwqe#Z4{+1=sq#LSwCP(aUgw!RC+sCy#j;c<$`U_g=`3AMeS($eDwswE}hpb?ZfK z%qtHtMxnUMCA$LbCMZl#MY$EM!6F$xe!S;Dxo{u*PyX+J{+GPP=}0snk13f4?CRtq zib@v%vS!rSFknnU$EtsUjp1YW-ZG>YnBb#@bE5^TM~bDbpRTROW0Saf_8~D zQbPe#=;J{9fzD%upu_wwQ{6?3f&%GtJhO`Fwg;B=>uc?Wg;zE2@E)T(Wx)`XI0 z9OPM@`ZY>w!+UQqQGI-GXY`ByIC^)Sm-J)M+w%L>pGtovWSqXcmB-U|!1Tn(^rR8f zlYFKp8^QE}k?Dg*OdsSkeXtQs9~zlHY{c|oKGTOA!Ss=l>7zzWALTQBv=L0-H!^*{ z5!3hcnZCafOg}I({h$%k5AvCQun|l@G&23L5z`OznSQttOg}O*{iqSskMfy*v=K~? z_s!bLelvgdWZ$5l>~99+1!`GCz09PTZH8txHmhdiX1W>noX7ZPXlG-ydNyvRpJC5= zj5pBGl)a@6&%fNtmm*vBIKQxffiv~GB0pO_<5SZ=X+r;G{q!F+q5ok0^dB~%|8V{E zA2p%>X#MoxZ$kh5CiE*?Z7upEn|9LROx^|dY{q{Aa(?GdYjFg=khUa}uy5DlN7VC= ztu5m3Sh&_`C zjr@PEnwvD5G4&|RR2}n0epk&+77Y*I{hZUcj(Nh+SqmnKhK%K@6)Wo%S;b;)ng!Yd z(u}RDTWFoNU{YwvSdMy8%Y0zytOb)nL&kDcjPa^EhSr&4Y;9V`I7iJGuc~Kgohil| zXc{GDV{6y0t!M5@^wGu*t8I2BjoF!O5<7nfjoCTaBz6uPvvasf>>M>_=V+7IDF;ki zJwRCURwW1>(`(K|bSoszz}F`Glf&Wuqv1FiCky#E)mlbj#p#HiI94luswXY=r2QL@{bt5 z{^gIq{^kDxP)h*<6aW+e000O8WqV$iDFOjP4rO~@UCBrJh-3Kx05j;9c>)1728jd# G0000fG#V-Z delta 58073 zcmV)+K#0GiiUhQU1PxG20|XQR000O8gJ4&&4fF~QgJ4%(LMg+y^!5M%VBWJ23-=Iz z)*zDjijAqg1%WpcNpS#bq;|aJj0yoJDvSFxfW}keNaWB2lD5AF(zG+TS0P*otMByab zX0E~+D!wZ*Q6>{hDFhA?4*TSA2m70uLLEpa1@pyLPV z+~!dhZ2`K`HLEDh;Qid!T&U^daoUs#3lpNK`Gwt(1-|MP3~kN9TQrqt^5YYt8EJ`$To)=2nOG@9!q z!lBdmvVfVlz* z%AqlG=hVG-X6V)&GjyvmL$BU{44rt#@wzS1Y5L=VlCQxM-I9v<^zskX5U?wN=l_rXl*rb75RaLz*aIe9BoD^~urLFH*H+yV< zuPoh_r8`DHm8E+(EwdFK4*>#p>XRlPGJn|aRL=%-sjGT6P}-T2z93(j+9sSS+LF!` z0oqGDQ_9_!*W*knXs=*kD`!gOOsSkHJL60#DnQokOp#cf7I2}+78E6vEbl@o3v&gc z^H5wU`WzREUb#?K>p~%!w_mpdB~5cYS>tPPpy*P0o?iYzI#5`ynr~y|0NWk84u8OJ zJ@Eyd&IX3ivS%IwLwDwwBy|nums0K%!eKxG*987~68_K75^l+Yo)bD(!gE3>kGLAZ zKb<|)n78Chop!}m2<}nIK``k{0Tk%flzKB_GgPT+7Vu_h`{vCcq_ZMtMp*e_o$ib% zKEJWByW_$`#3C4WTWzR+bALnqnSU^-oE`^#3beiXWS!%mTQTaGpTh04(XE`Gq5v8z7`a?FUO8Rp+Nq^F}vnx~Ig!Nuu z(t0mIdui)^xy#ymtoH>k%M5H~y|1kImGypStoKC)$nw_vl17gO4EM6NM1O^2${X&> z!d!vWJQTxydye70T^a6IYPi4nrOGxhAw6E3%O_;2;E0DsWe2*~5+d!FB?)LR6#T`hkV_vM^U5I}gQO(3#^d=v3~4mAeamf8AmJ zX_8|D!t=+pSE#t2X&og0YA9^HrLo z_rIp=Zia3z5bnF#YOZ^go4qK7Rx!y>186*5&e#JK><;Zp>jlJ4c3hra)~hl|AC5sf zee1X~yPGgbcYl{ONDI(j+8|x-60#nHbiqp?16vuSD}!`pklq=CbWs7aHiPs!D!9rP z6@uuNw^5gcxdQQdC^qWe92<47vQe+xMomg)LHiNkN*)t*V)R(~l>Ds%L1nWKxDn{TiX^8@4< zs7R)hRhp#RT22-cy;GU1_sA@~0@R|?rE4jBS{bgL;KFr=)+jO>i*tAw#IJbe7-X;W zjK)>X%+#h-H8YnrT&J%fS7vV$hU?yvhHC-ZOB=4s-ALABxGs1jWMC`9b!E7&4A(nj zxGpL{)_-TXo_ob#z;Z2HRS2S2-f~?Q<_hHJp;)f_b1c{W%5uGG%k|w9P9ERm7?{^> zu1=F48yKg!gEd$8rLsM}`~x;uQ){(9g%dzR!syRt%uRs3Mi?{v624snq#9^X+duGsvH}y%zsLJHzUVinQ&`1qOuGN*vw*9-pVo@ zZpj1&#@KR3A5k!-XWzMPzsGUxSW77=Br`u%mf>YB!)a~*%It5#GTdL%GAuxQY0Gdq z<$pbv;ewYh2DY*cSC-+*GQ2aE;i3X$ZII4`Tlda^g;Du@N) zRp~M+%Q6uDsbY>R%W_;&RF>u4OqP+kFMnW7c@wr}HDSP6z_={Ld};G?*&D=q49taZ zaSU)}Vy;Zgm5F(0Ow7fF$l8p|lAHMg=4I((LKx{aS!;p165)9;MrL)Mky)*b%&Rss z|BmZ_z3#B%4Bc_wij&*nnwM3%Tu*Pn0h^bHuE(nQkr-rh@_5KV)-+(hlZfP%Sbvxa z&uzrE%vSJF1JE&n( zMJ}5vX+;&9ygdVQ`bL0t;f)xO6Zfe_49FtPmp34nyd$j1fL!#R#sF6a$A6`vu0(7ejOn;F&ve|XOvfuV9baDGJmMl$uiSLp zlJHiX+z!`t+>%T5^adPs)(Y1H_^Cgz5qzS7%GgHbI>7P)snk}+XpGCTfolxu#v?Xo z3`hYVWN;R-8DC!CfXHfmPLU;cV~lPh6q(w9&P~%pz8^ORv!8HLztD&i?|&Bl81<~I z#;>Z_-{tkq{$#XRTUz9%*4*>ZW5&NbYB(;B-DWadP^nr1txIHEI53_Kl;U<6CHw9y zXJjLyjR+7CeSj*tMRsGW5ab;VK~7%`uu8lU3vz2&3$h6F3D!H;O zr-`JpEc0!sEX(*$Wm%5>sVvKBSz){G(*PPzmr+r_+D-RT=0%8|(0|gRenj(gr^vam zT_2gTI)Ji6os6k0%R6dWPG1zTio6lavbL;cS%mrWmgSOHhc#K2i(cOt;L5UGS(Yoy z^6prc3k#98S(c@@@kLC`+FWC>wt$JbG}M)d&;2wpCh6^!;RGk^D8nMd66cV!;ci|$gr0VFEUaRbzIbR13;l(#XQ^%{~N&u69; zJpO}iI0*l8NCsn0PMj|?*2k@xg%hNMQ7mc&=KU{1Nh>y~E^U+L>YhJ_p3v%>VRcn$ z_LQdJEnaPc0*DQ?#Z>8Yz!!;2*gadO<&1#EHVjx!;DSio#(z|Nk_mr3 zwtYe-#CL#WEgx!cn~jH1xU!!fYLifKy3z4#Wsl#7+V?n_MqB|D(87%opJ{XWEJ64L zLDIq{4-q^M*c~&0Pe{S6k9=_9&Ya-P!2f?eItC^h!kHbMHG%7ZFLhSv!=?IA$}{BLkR3&vO}rV^dj6!8$9d6eo22U zA1r@{1uAoXy?v++pl6Js7qI2nDZxNCh8>Oc7ivHMh^v_q01$5&#^#YuF?78N4Co%H zn0WlzU_KP`g&!%k*=QIP>YSdf75?yiN# zo7!zW)Z93Lh{H@|SQBWIsVDGHYchYE{OnQJ=%qEX0>bW5+nqIX$Zg6A!e;IJcd{#E z_uEgdXA;ag8Mt0>;aLGb^?t@t^ui5h)Er;S$b-{y>cd4O6S&jmzMz3{!S#hcNx6;A z+qS$N|4#Rm5OQ)GMmRK_V3^=rn%3iUFh(8;9>>@a@j#@`H9mb~aPUz`Td;pFL!fyG zbF1Zy9&sh$)R}$D8v&D$slhNITSO3&(nk!%fIfPpmp~DS3+N+oOPVEE81$owrl(Ef zaZ}G7S~hwlTPqrULpuPrvmzKXA9;@)0qB^Io@*l!tlxa>f2SQu@~~Uirl(RC=!Dhw8=6q4lxXhhE!pL{YnwbGETVtvThI={K9 z<8A)>J)uUBLk%cE?NNz_QwW<=-^7*F-fl#*IObrg)ZwLRFtWO zA{8Z9#z$M2FXhMXw~r|B=vGqqBmMOnjgZ6dQ}j$B3im%OGoS~ZrX??KAt|>@kn#ln z8Hf1K548j>uZ+@Y@DqPO`AGQFLrU;JJk*L3WqF!pa+^|RMU9)IMty&XQJ@Qzp~>VG zub`+DTN| z=jOG|=H5_e&Q*V%G%7S4RFt}TN^R{8rN#|5>m*HP{;7`ibm%oY@!=%kf13UzL$5 zwf0R?aBp=4yhjF8&LVf@i-W71`d3EwGv~>1zeS9ZVk0RR$yo*WZN%xjk(#&xzF-KE z?-~CqX|QcB%vXQm>|{0Jv0({Z)10?cd+cNuoB$-wY67Rp zj<##y%0cuP!NHn5IF`~ZZM`6?rrtZxh&lbwqwHnW!%KgCw1mp=fkF?P3@4Db^w_)E zBox~huI+kBL><>ec-r;oO^gmJ@)$^#jjxMo0BG_2ZRiTG(nfhbB#IEddz2MAnbBX zoRgOCxcI&hyd06=k2%E1$4Y$eNtf!EdbACs8NW(@qT{BXi;dP1*#xfT1V@4q$H$;S z{~q7N(!qK^c?dq4?l%V`mYQU~$2BFKb3CrQ6OAWYHE%%i!~<@KOW26UQzt0 zoa#BPG3ssrtnu?`we&8LzyR#)C!uk70SwZQjte>aBd`gLctu3E!)|>ciF70+vTy`^ z2UE>|4!nHNKLl=&N20MD0|}0Sd4~aZ+pmx+c%p~mKyvS;*@t5~faw%^xHgu0rd4qDj7VVKH5Lv00r z^;Og{G`-(uhV+tlSmug+r1`y)rdaMW4cpkt@aOqs=CbD}b<$)a8>?@OrW-PufwvZW zkCu`YbTIZw<;n~SJJ$TAo>)@-YuMGa{J?UI0A#vk1yHI3fW8rKPLctjXGOE z=6*Bq(Z$6neQ@sk*2oE`PhD!i)ERc++sOJYVx=NkUS6_J?A%GNgZ%V)iXzZ|)B{9P zXC{9OD`hV593>{wtBW%|t9In#ytxyBHy1k+I3gI8#3_mAOXHMf;j=T*zyg=2gqE9T z@3{^I$vBByVFk_wcH7F#xwl@1oR_V0a|;W1e|@fqRVd_p&B^=7$l>u+lka z7@1ADx4c}AS>vnSXlkU2Uw4jwUvu=|qI{bJV!iw;o%o>nIDgd@Kfm(xH+|VHeEOyb zuKDauPIu58D_U#Cr>~n&1!k$DoGKW)US7>ic+lJ`UTwv%2g1MeQAQXRYI4zCfn61_A26GZy#!E6PxJ2?-b%{8N~PaVbrkS zY->nwDg)RbD0&l_3LGL`>A^v#tEndH^=V*E^)RX`A_)N8Mbt_)k6I?>QN?ttsX{+qXkMyQWFk+I223LPi_zj(?VegyClfMOe5X)FDHx1&HfZ1oM*9B5r?L#zaOCCE1_$ThXo@AS-;((jl zVA~3C9RLUJGXnVIEubf+sZFk}iL4YjtNAKpb+#unX5g140w zWLGITo#SrBbQ}RcOhQhrZhWw76S= zi<^xeiRHClK5lW3qehzA&=|J+ZKY=-r0BZQRr+RsS5=H=ANG2x)`J?o4pmVjRn*8v zqegU9?=;&zT~Q63DGCmIN*}_3((H8xgB~0XduWkNQB_{_w74yt9{t`0K0*LGV9HBZ z1pKusKL{FNhC3P<~%iS{YBWHIC)Fwzw;Ddd-aj??D zmH};&hE?e7?Cc;(7DzS6GJ0`v7uQ!8zrMeu724A@2))tc1paxHNtD$9Z;p$Qb0Uwm zAmLU6h!Sq4Gj25sP<}R-7xaxqb7bOg5vJOIz(F-(H6L6~>s2SS?jG6=Mc>e!BwOrB z9Oj^wDge)=hr+>D)!?gY@T;u`-`Y$yczKb`^^}IsRxsS|br6P~g%lte#&6|iQeIC1ia#6M%><4dkhq45Mqh}XTpb7`gUnxK!Q zF!rO*#<2Eu)p<5LEPpH-O76enae{+1Ud}u@hJ72HuX+Mw_-a@I5%pZ;nC4@D%{iqP zFZ#@(-*~P$Gx88jcg)~vEitx)cELw~F?!?V6>^ZEWclalZhw`%+n;ic%|B&$@;hU! zvU#>_Ul@*zxndvpYqT=iPol_G{ZTAKD)$iH?jAf{!(6+xiQcSkJ&fB;Nec zW-qGHvuE)DhHAErPJgI0+ryTkxBCMHb_}EpoBbhb8M>hwodx3o%9TlfxBOf5$IS9@ z;@i;to+(X3Yt7*8A!T0pViNvkO;X{zFRL^zD?zTw>W{0sE@{y7&x>XpSb!yo?rjt{Pum^)kmDmrDIAzLK|N- z=@caj$QAO4$r2&3NyFiP+j?}IlOJJguYyH^s;zd(*NSVYptB&U-h8;a`*8K?m*r_S z^xSTgSoy5GOs%WP=CL$EV+th?)_*45X}_66z0%#rL(Po?h)xC*8P){SQg0LZr!|>P ze)g#U|I!*+0Xa{jwmWO&SVPNzP7pS0-&es-t$kpp-#*>n{&shN|BuhN_aFYx@;vpM z6L>Q}_~v@S_+_($xoa=Z0&O3N_wMHWf_^Rao=#C&`7 zMt&7N_*h9)t^*c_1 zAX}7~9RHewcitc=u53^ambgb6zw;n~#uyus1vADPbFeLc4kC>^M?DE4X9cm2>4ktV z^^eH+ad6_*C4L;5hVy^n|NIMulkR++4wt2**@yzn@t=@larJ>zTa28N4dkn(;oP{k zh2s&x`E+VqB*He`<=i00EWt0^I2w6qguM^K<{Qs7kniJ5m#{s)_DthFmAvdpp{yBe zaDvwNIN+0ihZZLrzhWtd7X)h}_>J zvh1OlGzwRzV(zJ!e-)j3EOz$VKw6!R)!A5`jj!T=Y&_KaW9i4QS?^ADLgt>31pP1 z^P`Du>_tJ|8P@FHQU~P}T3)K9L0kTqxdA$(?%0esm*(Hecwr+~D0YI9JfsakF*+t- zAHxZVnkldEPG=CL){14xI$w-kNZtpWNQUfxU;@l476DBV}Pk@#Sof;Revl z&B6QU`Ja}b#`lH&_yyDa%n2SJYG1#v(nwe|%%?8?xOFgq9w4j1kv};79p#@F@X<99 z7`h(sxj-$o*hZ8rqsBsOQWU|dR-87ddl+vQ%1W{Zn7Ag|7rEA;bX5!xURV+F$g#tJ ziQwqpzt_`=;PABhQWN(mA6zeF7Vs8uM7A$Jqjhahcot7!9%8$W)a7l;iz^dii`%r~ zX_hQ;;ZCH zS^IUUlHIG5-SnKmKjXiBucuC=lqVy9d!l4r9ir1H?JvoJ6M0nRYkH;T;8fIRJQy=H ze`Q@$>2Fy2!ZKHAy#+E0(q|FJx^p46FZ8|ZJtHc)`-ikk-#z%Vz(Ic_oQK$_r68wpB% zmaQ2I)~}-NyyVRy6m=s%MOXfR>Q=q|TXlSvP+rjQlxF?49b&KKeqHWlSxk%;xN7&- zdDU)iP|EtmD)kF;Ic1-L5po}KsjWv`W8~4AK0;a`^eFMfIPC?)#RY;HabKljp76E? zuw7>)@5UP&RGIW%M7>y31Nh`<74#qt4PaP-7ywpWWS4Y~YNl9Hh+KAm;R9sjc>)g? z&xno|%Nic}foCJ<2v2zo{slA}yc_EkH|gRCkEge`O~6t-pb2O0k4 zh>Jks${zz{%X-HUqx~pi zY2X$aL?&k+YGVWgzNhT(H?ho0BM%|x7AGa8xxuo>!h(Ti>x@5t3?l@2Nw=#{KYjk~ zQ=+6B<85=vBY^Q%!b1{MmqWHTlal;cZZc&M^Q{e>rCFbV))yS$QeXJ{C$l0HGe1xe zSI)qlIVLNm7uxH54EwWZk$Pr_AV!J@AjGBT8edPHXt?tfBUxU#QT=rWyWRrOKr*+thGu8D{EZlG*H}< z%!e%E{)>O-mHYnYNwm-<*x%f98^Jl7e5A^RMy~ft8jrMp+Jp7gov5jO-Tcw2?TZ?@ znh3tqZjM6nd}*+2JETLv*!jW!Q8_+#DV&fWO>aT?efCkNZ6bSM?nyk?AC4dJ?2cuL z2`MiT6ziHV4xCsLF5KzM>YqdX$A5x1Z{DzfbDdOK`i2Hzia9!P!4L(;I1EN{ zhuAiNoWRDHcpI1eMJ7O4?egEec_VRNbg=hA7+u+9ehnPi!b_81(Rd*oBW5|sR`}7W zkh4>X4o`)bStonKs-)AUmNj9%D^pa8oTxdsOg+Md>c!=-4H%%2 z>%EYI;%t|)mAaEZqziW!DXacD(#Ec`+Sn;ACyqS-G^|KopssmKX{z}Dryjy8XkMXq z!*y_6rLf+5{kTz&zUj#wGG?9?yo7kx8*Frcoqt)Sj>8uHfQ5hvs=$--?~VFt{rLD; zSjByQsq)oBqA3>c4!+Wz-M#n$nw)$lN5+@0wA+R2ILHWGZ%$wKIj<%-zLT#&(2sF{ z$eDW5JZZiIMB1N8aRt%N1WY>IA{;6CjBa2sF0iG9W#0jRHlR~sOexuhgTJ4|Kbwf* zrqDx9Am-VSa3s7+g>H82BOlBPPv*dQvK%s;uW6p>5uwPKP&x;dIbyPop>XHgGubx9 zSeI|Dq?=3zKKcwim3`Tja!C5dJc0DQT1#v>ykCH)%{8|DRe>TN;;FTf6;Qct^ zqLa~K7k?)t2h1iq`3v*7|3r?=qKh_Tl0mw1dbKCtsdoP9Qi7i0;ap!9ti1(aL>&YN zmzdQu0^#CXJY|BsFPUHztX#JG5;%o6fUEPHtAf~s@>hnE=;yD34>wOgi2pM-KECAI z6dF%(gnrEt2E0$~&=+zzYfp(IJ{lh$(xJFfGJkHaNQsYO-{y|!crko6d^CxAE+WMF z*k5yGc+Ir@sSRJkRi`x`JU~;h?2tge@mzCep$>pk>rh zh9|#A_z{j-HB?iYx=;;`)K9@mIOw}6GVs^Z6FY$)dJsf~ACaJ|@Gi-LRD$}Souu5W zeSaYq8H{#xD>&lz(<}3+UUZl0IGv(UjXrLGdX65=zdhwI3`fRXv5)&TTA55`POHkH zCU^J#mr!{N)jygllB6<$N~)TxD#1Z|u& z{OtKzRJ=Fds>So zqA-wc{|@b02r`6t54{n>7{y|K!p3X*+%3$uj+28u<5#J7B#?z!)@FkkkXURoeKBV_ zPb_+tA>A*X!W2nG)<^=y6R9JwpWAf`S0KqoZkts?9Roqt7|>jY7P`bReuMH-X8Ro zp3!eAD(du+-W|dg^Fl6-<^8n?LwzoWn%Y85RW}sa?V5@{z&mPoI|^#G4OK&?*2Tu# z)qV7^&_oi^o)A$67Q&!Uc}Of_ZSbFs%i{}hB9b1k)pQ-Na?ptRq6HA7HpZl zZU?Q181Q}4bD+&cJM*Ut7Jt;4yYquqv(THByf%36S(n+ zS0PNNpFp`SMmgzYAV*9#O^)0Zq9_UwdoWTJO4k35t3M~oAdJ#ToPV>CHjq472c1^e zXsR6rHk&O)A9OVZs)LTwH(E$*4*ROvqXb)MmT+@$aL8j69m1ZIvjz|~ur=v;ss1hc zV`h2y*>>phdzq$vSqM9p@cs~D;;S)d^oH{h|DfSek0$vliQoH@-_@R^LF>py=(?mu z*IJU6UPm@Y?Y3kXw13)t8N5zYmyJ?e&Atrvmaa-chO-IU+Gq;Ymeh~)$ zkk}tAu}SFzq9Da0fOe%sQL)Ie$3mfF+pa&P7XA9`ifgt}0DmTy^BB;F>ISr-7t34| z5e$fa6o!luvhkR{kDu{m@glq9Fb7#1?b(YJ=f zBg?0=aUjPH$NhG6+z9_2AJ3zNNaOK4+LT%Gs#Xg`e01;O6`X+-CxJ5{;w2oZz?K`h zfUGReU*Y?QynoqwmN@tgzNF!cvUq?q06h=BJo>ZA5kWTt3uNa54LTZ!Xx&Yr_XMsj zhdwl;OXeU5J%_nFh@-i*bO_8~4Wh_JwTPGfm$Y>dlK!eX(ARGiX>HexC9!L@Ob7U;Xq?n}gZ04{VIz5)~xU$w(*4oNiThLm&`?>c7s*KFkm7m2qddkI0$TgDB?6RY= z20?RjWK@WIH-I+3b@{W&t93O|-BNIR$3~bkUVqCqH7JxC@ZRrr@Nn22 z6)7BFhAzRj5-!UL7uUmI@)CMaYY{K2mNIiPmEXGnKT87>mRg79-)MlTji8SJNo$B5 z5YTzSNjY%V4szE6aNs`UyH@EUp~>rNx%A|zD#Ke)wZd#e=^S%_WuuWLmrEwBi+_64 zy@+*7WW*CCHV>N;`H-RkG#5_{M3mns(JvCn(T~~Ko@~p7YbIJkaUcKj(`+(89wwPs z0w}@sJll_GB3#TW)`CAn>==q?-V56qq4T{3GOcDI9+S&5BW zKxVy8GgT$JD$%t*b!+uT!GjcCiH%xZbnSrz1M9M&2`?{MDHmP}i(M__x5!K~^aZY# zMQ@hiK(3a%d$SZsy5)7Wb(t*>Qs{|nr>hWuE0KcYB)6#t=sWFT*y01zEPr1NUcjw8 z!v@~Nd2PCvMvmfil#a1adYICg=6%xi3vw@)EOw4_!Ui)FKSxNzJmGB(V7typ-i
VsJA#&M;50H)L2|S$bIC?l? zS;Heg@NDE9;VF;7zkp_gcYnjb(C<80|+9BY&p=KAoNyh^q)6WP}^vi2WAsIfJ|!iAJ;UQ{l?8AMJ@~o4_f1 z05DBO61oP~wn(RI7+kx!92m(6LU)xue+d79Tln76rs!X6hhy-ukbg@=oN^_cqjfi< zDTOAMgVV=w=OFoH2{_S5v`HN_S|cqz1#Oc}g5!QKT-)`MJK(q`B0rPb&uNebZjnJ` z()^(|Mlj%8%>I6pj;*>SaVVu;cxa10?Pxduc@It@p_!^Wg{o7iI)!A0wdxeAPN9vT zLQB3g%sGtK{?3rx-+v{=YpQpKRaUqvD_oToZgbv`OokVhYXq6R9~O%xUI~Im3I9AcU1*3Zt?*(RoyZKjx3ALlu-qIbo z49}B}WK&2x?GSP|1N3{z;0Ypb*N5D`zP&QAB^(rs!bH+YiaXkma~Ws8)hw1@DyC_EzZNMF_uO zkk%w?vmT$^S91Z`mq&*o!quz8y?J%GUP*FTZxH)ykFr|U4ikox02@1xl!cOC8n^Qv0@zpU=9TWR@Oe}U-Y{npcP=|)xD!$O+ z(L0pGV=)u0_-av|8`brqx?b$?xv>#%#6cY!QkTeLr^epBeJ*L77g=P4CVJ@sQr$c% z165_9+JD&-WOM$ggE~fXonlKJB?oq*B##uZOV7k3JP+}mxW1nhw6DId%8FSzyAH?M zwUjOq-A0M`y*-=<@^X+ z`A<=@kFbgU5N7#E{$8c`*l>D})!m&!M-C?M7=OLJifkS9_X|=5jI_pf;A*F6YuflP=dU-l-lTLy|YFR z3}zm_3ljDObXpACSGgNiD^}4Jsho_Z(SXAWo4@4Rnl($eRPkj9Calj zyWRZ`*=@F(-FCavRtyA@qIZp!GJtAZ(e*)V*wr;vGxW`b>{|XU`eSC11bLyXsKR)w zFy5_(@ow6ATk@3}QM<^Y9DhKzx^m@lsHM+$Jd{6{tRjGS?9ro?nt!+wAM-;Out!A7 zFVWWrmUEP%ss>QaWB$-F1iTPYvC%#_;^cL_PxNKL0F7MFGN3(x9#ukcz}}I#0QQWfZvE;eZ^Vyc1`tu^U63TEr0k629L8tB40BXF^|Bl zGLMV!01`a1DjpI6TrmeFr+7vDliJ&I%%tz5pFls%)E>qF>6)f$ir($D6usF|l|k2N zDyH5;s@@q4(SSaTuTpzdsXY!nwMSvOw92#l^7>{qCVd|ETKUPE zX0ZAsh#O4sQGY=F!(BWC1N1o06@H1;F4iOnM z4?WVSnifx`7C|M=?3FTUE(0b;ZPmcq$I zHe!i*B1o6)$HGu1D1eXX&#C35L48C41n*f(VR%fMi9xcUya?)7aR$+rwoPd&G+VJ6 zoaLX~UtZrZdAOH3x2IN7xfm@?ARASFn9%ftJ`a;*zh0C4gNb1Af^X2Z;eQt;eX&HTGnW^>Jpo~Lrn3K#v7!jR)0UJ>BhA!<7IhjB5<(Qc;Mv3_G{zh)LoLC z)^3?-%PbR}{WeVupxPV^hHa(U)ip&&x~lZr?Y5$-TC)XvYP;X1tX_pMR+&g&VJ6b% zhC>)FG~IzDq*qRWJO|oaVWoeHn^aUl9%)Z26VtJ z@@ID7C!rIPO!STN7^N5b(RHlA#eQn)R{`|VPrBQkHL+~yu}+y*mcj_fV=T^GWG7?H zRe#k)S(X>qt_OA`dSI_o1FM%TRYLko4P4DR|L^V$9}z261s5-i_^%Y3C?9GDTBQkY zS`!pd$Xsm@{}r}XrG zPtmo3sq|ofpbSkM9n@+LTW~`qeyaDvRe#x^S88mFj!++G%MiTMAl8KAEt}v-){(fv zb#P|4J*ox7DP_%?);8^KvD`X9)F82g#WQgy@XDIxmQm&6+)(Lpdu6hgN!bL+r5`K! zr0Eyr(kz#Le)ZlQK(WHTX_%4%zS(Y~LcW<^tSPGJo9RIs!m_?u09cDo>}71TIDe`% zAy~YDBPXkO>j$0zgQJKMV+C;Wl&txO^fWpv3S68b;%uR<7PRY@Rhp>v_IEu%kd zr@C)EY$P5x626EDH@*@3E!=YkdHKVgB_4YfrGQsc<~Np_Ft5(<#By-tHBU=es_buU zidEJ9je*>1;a_bZUkCLh#sM{TZ-0vo40=}gTEZ&U?s7uKMyAG9OrQ}7r$*5Tq*vF zp;X3$Ito|nA&CC`6TLey0Z@}6}ee*`A_jq_v=a3(*gs>{D{Icc3r4&(bo5B1r7I;U^?&egcY zEBmc|-lj3JDEyO1!bAHg!vLlTt&TV3bSr_i?S0U-)OW2!V)HI2HuQh|hW}+ZAdw1k z@YsYx$r15}i3knEe+WOd@7#M3iM}=II*#qg#Y#@(jp#x`}oZtomkb37o zr&xqz&_P36XaA2cp`Od6Z`lmL=opLAvXR+!MyDrxg)^Z}ax{d!E5mP@&AtihGz{eI z@4)91z@<90h&_>ei*qt#N4O<0AMtKYLAgLh5>w39d_E>TNubs)qI(X*4&dX)hXt{f z3Qa`&>;*3W3C72kPZkZi{XT)lPKu5*CUuyLDlRj?f_|anMY&pp{pY4K$t6LmLn6n& zIG&N0gP|UVoeO@jib|}LSZ;42Nf`JaTf$ObJ>*;9<8F{NXn&UEAOvP#hC;i)-WIX^ z>{wGK)mlVOC_Zz>(H_(I$_E-ZaRlQ^BrL@7Xlb%cm-6}BTpCMZ~18;aZg;ELPYAGILuojz#~m#(07tg+w(1E;&{Lm@tR#VBx7su z-0l9s?sU9?)3m^81X8v~E*X7;jMdKP6N?yCyvTm3*PtT4*oA+4Yg`G->RA8}D7hj- zb-~!6;Eo-2_^eMz>}X^fPzsufwj+^P!*=>V=|Zd5|I&qbt{>+#fFT#_LAcLa^~|UV zt*6#^r1_!O*9--pZ@=WOCg2A1HbxrNbF)gQtO5Yk+SVMP;LdQ^zTg@>^}~tP9}%BK z2mTJ?NGJWL&{$hxV1or|-%5bvv=265Zu7HGc;;Fdr3qIrh zU+`H%NDhDRm+OEQBx<+mu_)XdFT(O4c=j!x8}~o(Omok-oOU96Rz?A~7{gbZ(FJg$ zciwCd-GDKS7<)>6Ix} z{r$&*&|IRgL~wZ3!z-Lkzkj|fd*||^*YE&kJ?$j<{ek4+W&CV)oJ%EzW!MI*sUGt$ zZGI_b>&u&2PC~2crgeL)fe!pJ$Tr~ivRNxwwts8QJ0uzr}-c!jo zsBo=EoM_u6oMIb?Ss$OPHj-?I>NUe-tY+~h#0cLhJfH7rq*HDLb+1w&VMScuz;<4*+e4wv54JcMCoV7TeQ(di-!=gh%&;7^ zn%!uD6a8p!$Lp-u0K8ggcML_|M7S{l+(U9vpD=+h9=w8wXR`q6w-4LS494ZYp~?-8 z5R<1*HiJkq1MFZkdo#P{lMia}2y@P4r4^z6PCq-6FWQWl2$EOTHKYY%exC8?=wtbK|ZJL8~>clVMZXNKU`jssSM ze6)tOP5y8+dGp0t=hLw{<%-*kFxn|92iXcGif=R5W#sVVe-6+jI=h}NdbzRJDUx=B z+A#~XQnvlM5uzBW9a>G2)Q%@?cc>~a$dwVh9o+8#n5SYDDvJDI3O@KWq%<=j zsN%H$Vd-#@6Ys9cAHXMZkFX)WS}citc;?OVFUm4qT}g1EJ1m;N-5i?-S!K&P+H%Xo z7Lv}^fpO*TU}ucXsg~z1T=vRoAD4^k&urIJ-sP^SL@rF*AdMTAFNe4s4>tiwotFY| z7iryu;DuN~eL)`vhh9V&<{vJ+0r5%fIC*{-`2&94foTAt07 zN9TI_UuKT7FoEi&TY8|L^^!i$2dVD}Jve161CmE&Ax;hN5shsCY*fbhtC@ z1EJH#P=E$%lArF}XoF~&4bDOVa*uhV!JND&vb8#b5WAD6%Nh+3<}EI0_Q zm`XuzQj;i_`zjbF8fqzKS7pBfp_0p12V?=rBPbJG`(89=Gi>T03AkLA-yX`Rz3Pxs zMPhmq^>2r3eAbPwF^!|Z z6=Ro&S?cx5W?!+oQ_us~TS%g7xM`0Qd$mGygFL{S4)14z5 z+erc%#`D|*L@_l=M$u{J=1_C5K27#-wU$fI_5S)u-0XwvR@i&5G6@X%d?rH`dSQ}N*C#Dv zUGN!<(=FEd8HG&~dCCjMg(_100@x-*u>-PC6S=P|#w|}~_UY{3e?3YjXo5RQvU&HU z9<|YuVk};Q6IJ%)S8ME0#OnhDg@cQo$Ea%_FB0uX+WQD5H3May&q3L>=CqK`p7B^h z?TU)F9=#}D^yp~BR2PiNex!GT*X}&v zhb@X1UjMRB6mN{0w&(yfNJ$p)c?t*$(3?SK{+2{3;dm9_oRmb`o)3mq{Bm$yla}0} zSXYpy{C zX8yv@p>45jc&E`mn?o9E%5Dy+(0&*RLw=jmMdIABtlkDy_hJU<3jKq^O6FT&XDcJQ z>MBj4yr7y*lV<+&Nk<_&O8G3xsuMSTBV5~xLZEbyv(RdzoR^OCFg`vjP1mFM-;ZA^ z@wg6X5c-)rk3&ofGcN~gV5}mSiNtpeh{xkihXTWNFYxXfI!ei?6A21clD9go`t~Gp zlY0B{5e7xo+>1QG2sU5PylSl5&iAFT+^3tXt1F?8+j}}1thksdu%6Gs&u2XdE+*JG z=rvJgJlvx=NbR5P94C99LhslWgzS3Kor;Gw>Lk3d#l%V_BJAfRv@mq#_}h-A0bv@+ z`G33#!cx;8;ozi*p?922;IR_0wf#S-vAbsYkuB1g4goD-k3LL*dNLi8CP$=8Z=|(D zB`WA2#UF>bpr;8(YgJSuNp$K21r@g$*PG!k(o(k&%o{j<7)iH7bBnXbH!^NEqQF>) zSe`DUs0{uZBQ&C&(j>1+*=nCZ;#=G?C|bNG5DOe85OVXq$SeL*OXvdqd~SVoDRt<2 zZco-c!)h%6gra+$NpNzaa{jPv@S-sVb&XS*N=2P#85te+6jXt?m4@2goi|S-gVwzA zHifvT!pCusD|9j15%jR}clG|4KLu?kqUW!HkHqwzMAdv1lo1?L3~oeqKUB2T)fnas zVgRXq#U}km56DKm{nKj9Di{1@Mg|3t#^5ph2wDQboURSG%D87sQi-NTQE-9=UB|v= z=GTX5k|+4mG*a|isV$^LfKzROoXsC!EkS|7{XneJpmh4#m)%YLyXvET84cwpf|~WX zhZn#;FfUNvoP2(rNj zZ)=KmlUXLkHr}$eEcFy@_!Ld%|KKR#KRSvi_W#gP>9eD;hF89s4q*l@Xd|gTBJOBb zoYV05ds3d;p32u+yZ>8+Y<-Ck`u{{o8041-0h9c{M2HR~k2Y=QCyK~aomP=vxqBak zqdsdIwMMheIR(qlMZa~}0t=kA%0H+`)2*!l?Qc1Eju8jc_cv9c#ar~^r~gth*8fi` z=4cULbL4fPfg}&a)dl(-P)a6ee=_zbMQO zW;OlP|2GOVFf%UkzmhO@)2uJt{R#SwZ!kj@zEw1`x@QAAmuE-(_y6Xk5Qtm#@i~R~4+DDt-!PI`Xg-;4;7{f&q63KUtQpJp_RnI7Ifopnp$)$0i6kd&pGsDas#aSXOT^ zG^OaVMG6Wmfa)2fUsi%14lUQsl=yZWHF2tl|bXQG>%sJ*mWjhrA;z3YaXQ z=v;L?`DAoKet-Ved`JIE&-4nBSA9%hFgop53u+i-Y{QTmg1y;~Q9$lOTZF;9rW)PoOynHog5`p#dfPWXRG3wcm&Z<#MJG z5Zdejh4Y&l?k`%y2J89?KMH?dkN_t<0$@wK4>piYK^9-_9k^7%k4U!U`5|OMY9()u zw@An_(-WTd9)keq;eTk0u!9fM-Y3|2DD-``MA-5_PK%gRZ$(Cps<3uzgpC+kg<%9& zrgE_5l|SC_4}F|GjM)Pspj6rsZgb$Wca9P`frKK_(((Nvw)K0IYH4F z$ub357P^n_ue|>8?fYx9{YHUBkR=P(h8r9|5pN9Cv;;u;v8{e)4bq?1Ux&Qqvjc%m z_q%C_Z}onTR1 zD(J^$q^vL68_gelF6J*k*PBzcrQRcgrr|rz2IjNH`zh#U-?z?DRT%Msp_8M>usRk$ zR6xtkG!LBDB_zI>IIPNLx#?%_Lq^mLaEP5CClaXsdVg%@fI=k(MZ~qC6<=?c8zMb0 zG&bH{eeFl%3E$$9)Ig$CM7|=UCAsEDoHjsLL?sn8$(cKk=77|}J15FjWRE&lL+bn+ zh>~t_#6gcaTE{%WBV}zAnj^79_49}HmLcNbs|TPd&?4vpCanfy`Et6;&+n=i9a51i z=+oND!8fxQ?Pov_>ujB(Gs1m&IMvpjhoTq!eF`0>MaIu{}43uYq6JxB~H8KzqQkF^*Z1Bz zi-s|4r7M5aRN?L=r0zXye&<)_9oTh|z5}YeNn}S_+u&m0X%W@!+U}F^rl5)cP9%=l zB!v8tzbe5SIZ1JCVS;gEAt;gr(-YF@q#~g=+{qJEPJ6&o+NS3s)Qh=(lx4U_TrmSl zsaWbtNggv`-DZd3m^)z-vK<9CP5ll2?wW&c=4w2t2T9Tn?ntRXCRN06$Wr0 zWh#{6wf^4OSt&<25-+TFqj__M9ynmIQ-InV5BshvstCeHlS{#^G29CeUs8uFNKgLqNK?3y-3W1p-LttNFi@l$>2-D90p5_rR z_cyO$Vht(3gVZxR1@-$_;!E~GJ<<$#!8<`u*4t)LBB;EnJTqmsAc1Il%#D7LiGg3p z4+9rE%fzQ~ZHiBYwuHr-)M|h`QWGlTV7DaNh8$WI@fxpk^_BN{sXLCJf7(~t%eCa4 ze#Ncey`<^wFQO+b4<&Pj=p1R#F-T#2TLjV7H?hV$DHgfnn^^r+aj|##jB)7) zQa>0}w8Hg6m&{$cR_W7krx4sVCNw*pVIYgub!8NrGQMV2xK;@-CzK+gLKY`Ki{ETQ%6KE1E^Wz9wW^L(20cdRaGrt%aBH=N_c7EZ4)h z17v;MWvBMM8x3s)E&cf!khcJd-%vHxgbGo#1}W4~5qv&Zy?`T*ihZCj4RPw2GIL6V zN^2T)X&>djS#p2r@bx}fxsWR2iKwdhOg~L1X{j}a849v|MS3;zlY|gU)m92!kA7kO z5Gh{I=T*oEdiXllM-V7OV!Uj7VeFiZt_HjmRzzVW(#d0Y*FM2ml9?SJMf#7d9kum{ z72}?i;{CY;Uy^9qB&+ zK!jWjQ_PJ0P>!5nfh^b*jzcz7?=>DGKL}1wL?6DDLD;VB;ip5SUc4v70K;qdUx#~>yQ=j2OS|*bd%I+l<(g*# zJ9|$4Z^L7nyino8?9!bhFaZQ&{u1>$V%Y2?>9Y`*#zl$!l*!u=8atf!cR^sd(8S!= zL4#dGCa7pINeQs13l!OD(p}|If{!0B&Yw)6RVA9TQV5)=h0O|(Z#YwGLy;hMUe{V% zfJ4nZ3d>N?-&09Pkfv~>op;=R?izR9W$ALCkLwCM{^QPaN5##SMv`bkfhXhW$~_DB ziQ#Lu=2UDj=jT#+5zD7aqb=1Orl<1#b z-2-;ugd_Nkd607WZnK+KI zoh@QGJb5!$i+Y0>zH3bXh2s)GBGV0*PHfbL{}MlPJM_+-{}N1+V)Rp=D|Z>t0o*K?4tzKun#62@yYe1&*Cq@%B;o+4QZB(#BP^k1j!1r;CeHh8t zy|^?MP6K-=^_t5mwuxwC-)~cp;N$J&??=R+iwQ#RGeQJA`}XPw{f;xE%Y)!%p#Ib9 z^C(%rQxe&v-}tDLI)`obh->GLOc^P7LCztPQG*3XUPwKqckMR+hKK(iB*S-wLM{?D7bL}S8c9_JAhQuXCIUYt zEjpQ~`8q`(i3~yCKN1-%@l@8d1{YasH_y)0p{ER9;#0zg;J~|8V2)rb#`K$=5xB0t za}7Ta@^|v`bwhF(>7b}BgDdkZvd_tAFe@ytZlE#iR zmbB6dY&hi(A38tVx4ESI!K@gK_&F*~&G}uc#3mbuTQRv8Ne{L5bRx268%r3HcV#v; zqn}gD(;#L*5PSUqsR*X-Mp8Z!k z2-Oa9)U8d`Cif^-QnC1siN2a)Z&tMZ_F1;F>J*@AMvegd*f_w<)ll<@`?5!o(@>Ou zY7K7u>Yeq(6H}Ti?_F$3tOa+vg2J!@cT*s=MJf43LE*0dWASy_OG3>4(M|xr0OYgxOFoHfr@A$`|;HApLeqQ>Vz6g>jCt_>q!jT^6U$`YMvh zLxL1(_9}2CX*n` z1N&w&*E2eKwB*Lqo>f`NKvwSg{jhm5_#+1x&HofOv)`-hlv_M+v{~I$L`L}I=G&w4 z%5EC7f%F-jD6;tmb9Mrl)2})x=N3mIr3HcKOmkwfrN=s6-Xg4Vb@}d&$dP~AiD}hl zz8C|1nhxsydKkfRtpP;+{SZ8EpHV5MxNAQvbkDUeJxYf4HUp>3=^hvbgi zvL4V44bEE|szvs{Uc?L&cmuv**<*OsGwRA<{hF2=R*;Q*T0ZQZ0?!6^eoagA!6pEE zWS}iQrj=oMn2q^u(0*lBl(LakQ=LB*)uj~&Ex(B^1Ka!CM2%{BqQbpAMfb`r!WPV5 z(VH05Yo|7sj;Br3tb$jrJqfXsG830tYO)4Icay!B{?p5 z`peFs?7Z!scB2lRKKAv>Zizg+!%pgf8cY-^-?<;X0b%Z@i9(r+<_hyBFHPV>fKto^ zD@czs$#Z>di3m|@tur+k+=a48c+GIYWHr??x^!-M|y-}=)yDdY*_tcoCA=8vK=*H$S8QpGBUYfXJ6k(QA( zx)WtQCz+rtYFs3~{ix;(Nj!jY$w~i)s$|VFQIH693dUaKUD-InL=&r{!pO9AK7T>? z!!|WGRo61cut`D9Lv$>{<^d9CfSksj#|FJ_1@X5T`*{#LMkd@V4W*DhsF8iX?{7l! z4}&1H8TLtf5(QY?f@Fvw}42=gieG!@Pi+O zt@ol2DrSw}+4&CHd{~tu1b&DDxmF-d?Osg6;C>{X2>GEEIFtyvKhO*Yxt0A=jB;T%9(?mvdBDkzeLApdjPuuQii-VUVJf zwh%B|`dhcq9kF8_0R6|Bk7kp&S@GNPlJ%PG-UJ8lrIb@t;1-WhuLmcBrjG*VxlNKw zeVr~n#+q#viJlVR&2X^IgGr{5u88Bv5zSjD_3pqbOPk(@8VwT?Sj0mif;V)gE2>eE zN79XopMd>-nB#pm=^!)my`W7lpBL4&>0{R#8VM>$>AJtUJJu9b#kQ*f#W+5av?+5^ zKwl>r30wqkZb@B!{qs#(QJia0-Taj4KD<&Aql{`1GI|kMez8_p9&;K&;6xra;#vKa zvU4rXL8kU^MX_`JM=?GacPzd6u~Jy?;6S%fur~bZPvxuLrF)}(*MG6$d#r%xrt_ET zbHefA)t+#FAgE^&!>dx5vUBE3?ntde z>mrdd!nGDqRYgTq>;$VK{bJ)c?pFsT1GGJKa;`kYr4ygk1Kn_9w4)95#y?B_gij13 z`}c6QUd2uD2L`~IzabuV>j%3a%MNF(h~!aC-mzLLtH;~H@cN{5-giK?JHT)BwdK;KDuq#y>=CcH-Uj?qe z25xLHZelLna}3$hC6T~i3TTS*A#B&VGwfGRQ)RnezH_#a(ziW>Sej3J$`CNldGu(2 zfcUDZpxe(v48gt^=R|UBvtKIIrpgqm>wEdn3*$SsHWVr!3Vq7k zjHJQ6%VyN{w49N$R7cVr%mNmTer7$AKG_1lq-#UY8=sw2Qd+g6@00(e{vOhazbRTM zGPUe7Wx6M1lK1<)p1b0lrVlpigc;M;viCMB#e83ALAT(xEZEc2SLxDcvXkOO>?hU&gGaWiyGl?iFlb)B;djo^P?&L;~8uL?Oeja{0F{Xh5?G8kcV&7@-xL(7O#3N;;T`GkQDPjLoj%zd;Cjsont_AtmleYYq2NG3 zpc8>LcW1RASO-*5XG5*w_rF)DxT;Ks>rIPTi?UR@Tiwp~skMo~;H3`)(bMf(gs48pNOL;NxkSpDCw4IV zgH5TkO}GIgcvS|Z*WNQS9Et01`G+5m>~-9q{QFj44UslU)0ftYa$M2xA9O(snu4Pe zCogSvLP_|;`m_PAuXRpmjv9YpW4*?o{3`TAR!HDSKN=xhP2S1_b-(0_CvHT@2*Iq& z9&RcHCebA&fmh^iP|$|y9mm~9NTB;5VV-um%Q|HOQ{uoxm1#@^r(FW9?Kv!IWzd~B zZb0`c%i8q|djNA7L-wU2J0%t@p}ZDnE|~}BoF7e944LCW`wX2drY|FaP|rwunm)>_ zmLd3zp}aHFs~d>Pi6tdJEA!$)wnFYv?`!KfRYk-Gs`j#AoYCAW;rQ{(N6sP`DWlfU zOHi(e>nLX;=k~*Nw`0VDr^~-M|=gN$31 zGmeoIF&XXs_X6AW5qTHHH|wRL(hC0x#0N1@6F!3@BlhX*l|P1LpKp0|Pc@W{ zg|;G~>?dehxV~Ea$pm}YbXnmbayfkF#=Mi2ppBY<9Nk+)>@R`aXC~hp^N%_=@Cn=F zqf(x)h8&QBsSoo<(kRbKr zojlwe%a>HtySXwfap2KbrIh{i@F6OrhPCO#BL#7=<|!H+SC@RoWOlIhz|i&R%k<6o zytXo3lo^OLhfCIG|6xjhLCOA|!9LGhr;B z?RGq6xYgeao_!5CJTcf6dYf=(%P>N55l1RI`BQR=@r}=zw4@Q8P27LnF8#rK+P-^j zztpT)^H}8xeQq;U9`ZekDc)^%u)KzTkEP_ok4><^ZSv+0n!82_6WkOTI7;`YPFY^U zSY=QT-2l;KoUlKH2&|Vl6_T4Ctmlr27Msir-k?A9q|^mkR)Y2JFag?(L(}RsB00?r zysq5BI zAYBwCID-MAKegZu0+YkB`?1K@ZbDea59%$E8`_c%XVAa7p4;w$x3+?)5gZz&<9YIV zLtOs-yxH~Om+{p&+%Q9&a&E0vqbi$Q7}R2Of8%u6w`JBrSS!Ng;oy9Ds+7~0@Ud^} zDmyHXQ|i)F{25O2oQ$JeiQG03tX>Y&krV;)wMGgw!xgB-UJbelVb1_AYBSTydwHIV|GgS}viw80iDG9D&7gLAmMD<(C(7ksk6;Y%~(oA5H*u zo2mB%htrW>-jkHf(t8++R%*j2f)n&zy9|I-3raU{r*q2 ze_lxKUJ~M+oO5pT*+SE^Pi*zgXKqcNZ}yrqe}ldmKs_cYes%Z|&*JWUv+OTjr%OEV zyiW3#mxR$Bu9D86J@r{fIXwf2BM`g)re0P2?9hSs9{SQ|=S4CulopjQo_Z*fBWN*9 z)l-t+5)-({7mLYzefQf8%y@FPtTl z@NZ!Gq+ZK`;2x)tmbl?*XN_Jd-lb3YWtf|=10QzjDnEn6hOEYCxD+D`NHS+rRC9f% zJ68DvM>t#5@e?RxX^@f&jxiB7v|`%(@dG+q%{9bg|odY>J{95~>GKm=nEqkVMR z{Pj;amaURw^$@&u=J-2|*&S5x=kl5epckxg&mP2ZF}He51dMNxUngE|ZVMKY@Ge*H zCuMqX(R^aDJfE08cj?)71i!A$4|0BaS@{M$h}G}fH|xc)>%iF+-2vi>OH<Yu~m)}sG~=SYfZDG#RB3_`++X1ckMthq_nzSu0P(!iV zVpSqM1Tl_hz^5>Bbm*e-o6nre5#kCa_f~gCn&Z4$MeXRlvau<)de@CH>NQp9#7+Qp zhRv!>@^~VC_m?p^@^1l@Cc3{abi4X%Z04OXezw3#BZac5{#`0z)+0<6Shah+%K3UA zt8%MkO+V15bt&8a^Co#wGllZ%GV>^+PsHAz(9+)oR+;LjwJ%tYA8|cRH&>ao9J?7_ zu$iYir4~8Pn@b4((I^(<3UZ}hLZ&U}?VR^kL2NK>6DnO|k2aMUz_hy8@%Wz|&MLVH9HH~8J=1Ud%)0p|r=S?)> zy}mk&YRhJYZo00RB>$SPTQx{F@B(U=bZ8@~F^W`OS{_f7S6ezu`#4`uT90n!^`B%n0whDIYX%D@cm0BL6pyK2gMxK(9lZ z6x$LuQ)2v{g=6VQ;VK>HG0V$s-j}c>M#fjo8y{@-a$lhr}cp575zB951rfFeqT(wdizsh{@N-#)bk-#J)B+J@7f= z?17wwUD~J&?jar~mljDF$H*6hqr_C4Sx}=$u0v6Y-!icZoB&~({`V~vMUm>tJ>cC? zaz<(k=>iz-t0<5X8`Uc8Lo87wCoe~o42%|i5i-)kNfj@kqhVQJAR@EJMGiM{G4onx zjTk0j`v)7Kyne-QDK&>By8T;I^qo!m0#trF2fJ4Zf{iBFz-w7SnG}J%_F{Yr4K?{f zI@>^%i_~2u;F!)@IDJs-=d+$aEADw5D5A8wUK1eeK1%u8Dtt^TAw^*XGX}Q@uA$g> zXLd%lzr!u7OkIeymr!IAndEf5RQ=|m1P*Q*eVc&wfXSk#Ewh-=@qORYm_$>1YyOKn z1uN5eNgPRZ`MD>1&cEiaoorVdzMim&X=)(Q9J?-}_b0eQ5ap;D4SLdLYutkn z6CD_n+~n1PZS8iT!lZ@FlHT4qd7iWoX|?=bW|OL7r~QQgFG z)xAjKa}$LXzDm}BtozF+m~WHCRWihB=qfRMot=$3e^yIx&b*B)afgvyeEIV%nYh^E zLKW7~w$CeNBF32?q{~8PL)j^pUy9-WPOMz}Ba5Knv4UEq{>N>8%*+HJBY{}HWOU1S zhQ8gvT^1s~R`Azs-j5wGZak!@D$!hIGXW9zDA)g1rx+tR_mZFz47cR#&YA9U>1PN+ z;G^B>j!_FksQ4!%rih4lRO63`w*+QmQ0S+D!!hk%Y9Yum&2C^FieR%5#%=nkWe6@k zj=?YlrS&k2TI+v+yEYGO>b|eff8yxBuO~d!d!bf$^mF>6Hm@&hzmnUvXD~_c>z&DV z>>yrj46J87p>>9J*K~z-JJ|0?`=aG|e%!i$o5D=`dj1q*@`rR!+oybu#$&qIH+8!% z8`rjyBt%{Q;Rppxa`ke=dkmOMD{?po~;9lBX`D9b_5H# z-{o_rLlm_K)g%?*CEr&-Uxeci5$tDXIqB<;m$V=Bb(+dZY^kp%Y$}U@Veu;>wXE#I z0hv|NOfY=0xnW0|6Ms#fW_uuDpO?iP@Vp@`MV>Nj<~ZEcge;-}i$=8G{<^bd5YF*x zUX5ZJ(nsLJ2c$s=baQtcbmuV)O!-Z~KI~e@KzuC8OTHD=&n*kPJ)SUC^J-Ug?X0#f zc-$-M5?p2N-2BX$m=nBvxJ38rOsFzn_~l#7F@?I~zojRmR-E_vVs0UU1F5%Wr49Rd zu+!ukvwu`X6rcWmlXZ0aI9h0L1Q zRy>clpKGPf;4eAc_xosK)JGiCPq>#jf^2;_;mhh5nudt^B~V+Pwc88Q(^~?puymi_ zUUH{gd>z?lrWB3+MPJNPE~7N;jVS>x0?_brXgkZ#vIn0L!4|q}DBY$~4V!nYaLJ+a zVf(u`)OK&viwWFv<2<2tliO!fQp+$CuCP+Lr%G>dM}Pra;QeTP(r8m0BBW_Dg;+Nk z@(I)r&|E@9Bw+rnk&5Zz6tfX6#CgzMS8UQ|qg{v8C$l#8{a&a)(3H}-WfSpgfC!p| zlY>~eM1X$JusAHrE6!)U@y-byEz{v!hsQG&y%-CoNP0@I-Z=lBhipr#GLc2=8+C)2 zNbKeW*(+WzVb}!1K|ih1o_d}T6E+@iMyz!|JvoI3^(TEl{TovmjxnedpQN5c;Utu% zaeWTEV&O-H6zRUG+$goa3TXZUP#OV!AJO#KXm*oTsiwWuIXcu=rP4*STKQz%l<{w+ z-ZuZ8mNP&pvg=<2(G!oFv?7*eEx!}OffiZvn3KQU-1H~nXA9x0@Rl;`Z;=?ia>){M zxO|6}G<|t(Z4k2+B}3tmIi(D_^2aD`pi&=zjLTz^n!iX_1|hf`6|O!2YL{u7C%Yb< zFsA7`L+*q1_Bqx>h$~XWtS`q@18Qh(iSwzU`<#gBq5G^rVak<+=&3ZM(t0c2{pjb2 zD+!3pJ*W;6AFUyWX<0&=VPaKlfn?}OS{7#B{yH}L|GPM8BX~{LoDp*PLiE>(-V5-m z*cS%3umEL?W+--aWzB0h?eu|@Mo$}X@YVf~Jl>aR+g?E3ju+tcw6Xv7l@aaeelgd6 zI(3a4`a#4;IP5I+Y*sEqu7;%^q0l9G95V4WSu>{cyjB0uY45`%b1S7h8~gjr$*O5S z#}jv7UJ-}wd}Wp(ju2KllJa7jrgJR(XqGzwG5d|&N&YZ%qI_s~uBWU4wt>%yZpb&c z`(l>sw_|MIck0i-f{}0AFuosApPLm9*WgULAJ;TLr~eX%3p0oS`$D6Gd1YuIk^0Kv z=<2}%--U~NQ^i84WyFsVev%59WkA9ZOZS5M%|@mtPx1^py&5WwmldC$5ldpo1saqC z8t6F#v&nn2$&JUXPzG8PA+-a83oH!=s!T~gD1!eT<)kZI;(sd5&`>B!@iP8_fKCb) zA~hyqwm1xu%a291ViK1&qyMeyI8H7p#cf4v{3Q?uzS@L#{v4f&$AN$0lePO=L{sIU zNtxDIdgV%&lN0B{PezDO|H(wzEj={?5Qp>ED8jfDLa5hGz^b!wD10-W^o27!&VYV> zCGB+L3ew#Q(JM#wGg`@u{@RTe`Kl{s7%5ti?BDpP^Qs(W zDt=3CH%`I+Yioa`<|vQJnQGaL{k5GtO2*=sk;%O33rN>f=+XZ9l;c$q=OuAB2M^Tfpjh* zmp(`fNpSJ_umHxr+=1pC{@y4emyC_Q8kAYl7?lj2Tfx4kn~&O&{;f=F7%KXfG}-mlT+pe}9p=HiAONPr)s)xj0+ zu`-Ui2fSw8iDtOFASH`9(=_kqwW{O=zB`*}T&h5S9@cR32+~`Jsz9mf5&T~W<5^*O zo4pts;69XOq$p)d0x4qCdCYo?<|`86+=)`o}99CiQBf7VZ+H7Un~+A!|V&NC)&x3vB# zNowediQsxXTZQ0yO(5=?G{nh>9qhPWD=}^C2>({{7&E>!M_RX9$rx&ar?g^9GJgZu zaA7ND!gUT>!e`DmU^y>}?tDCIW{{)Z>GZ37laifm%6LIY_^2B z?28G!hLriI`>F0O+w+q7nw6nP-5Z~PMyNY9R&jeL23GkW6aPQP-YLGa?ui17Z6_Vu z=)SStQOCC3v2kPDX2*8NwsT|KwtMpZXXa&Q9_HcHZ|`#+&dWKwYOShT73LQ#tSqTp z^B0zg*=%M{`>=kSQAD4uq)RP|TQk9EY8Qg-u=znzGWf^~o+Q#kNywd zs)51Jbfb zZiF0en6CezinBcEXiU>l)g9gOCn9zy=B;vUIrpkj^M_sh`U#B^lSMdM7=*&OT5RLw`G1`>bF)1#Zz^wfJ;jDvyo~n$g@ki2rvlCyNB&=?BMf>)*fp2Pq-73k9k1T{$44`9y*0-T^SEOJoTG&+`dgUTC2YBVBO!zhJwYq*n%*xiK3GVN>R{1h3;sxMJ2zH|h zPa`?`^Z0tBye%7ikyU9t7(Wi=eO1lo4Sl8DINMOc&$JL9CBPIyl0(FEOjoi?p7Q#Am6P+kDahVd_{`iJsYv5v;-|+`;3^x_6+tN5xHen7wVxJLLsiyfyS&eo?n0Bm#989x0JeLF1>=oF8Iqm*|DT) zFKL|US`LtBvk51}ExJ&GF_3PaCI{mHh8~)=yfV^pXnHZUEkM-L7~v&JJTBJ|rTw1t+cCw&Kj4Em3G)!IKS%Em*`)7|3n_kJ4^vI% zMTg1S;YR|L9k3d+>i>Cqt~l+eDxCkl=9_tAQp#*+aystB(TvDW8Eq1XoKImMXB;H1 zcrgiWny>H1r3ThR2d=YGjgJy5V?@5QrKBVZ7Xx6pO&Fz9#fvF9JWLp;NE0hfiycSx z5;Qr|8%y{0tNnxO%M?PC#`crkbH`qqHrV6TI-vT|zD1NJXi96Y8&Bzo{QkEJ(_n*} zimZR4*Nm*O62nYXFy>>6hqZT^aw*@u6IZSD>VDih0SQbvoR<`v)*?&*WO7h@GLPr| z(TprK8es_)pBA_Fuq#UmD}e7aP##%>b6on|RTThovgoup;U2FSE!)qs>uAZPD(o@M zd6U@ejx7e^x2UWzEg8!!fUG7PbaERRqNq;ubZ09R_N4EBB%+wjH^_P>sj7c37lA1n z{NN?bz4-=-BguyI_TAQ`LoEw${;UtW@#=sS81;H(rY5< zer_&1%55Y_Lq8ROp_t40?^q2DafsRu#VsdeO4*6nJ?1rS`RVaVZKoo=W)JpyQKflH zggA4o!YSg6t?P(+(!61aw}p1X!q6XWSik1SwcFCq?En(rcs?S2 zm)HGe8?n@o3t73pX1VFetQU(=-0J>Doc)CYMXwx0h_BD{s_^i2(NDpPobZ5?lH zm`AQ(O-iAwgu}KrzR-GY9+Bn67e(kd#E1(WP@)9HxX7!Bu0Xa#{_t$Np+cDn$5YkD z2XT!gU`hYQ14D?Iv5ZsDhIjVs2T0`yx%mpAofB$5Y6}{y8x^lgK5q}oSaZ4YQ!qm$8P9Q!sB0=QV zU^1KI5YYn5ly?@Fjx66)vY5Q{(GfqAkR1mYMcCDtV3x?#p!%ytLz=PrYaSGm#DNUa zT)0Vda$>?$G7AxvX8s>12y`=nS7)8Y0z4(taD*a4)KE73fcj-YaolF5TG@rC@-cTo zef%S+BpNOVvc<+uPI7E{6{Rt$ebv-H%;cmwRJ+14CHDdmI=aC>Renh@OKIuUz9W0U z_=o9psy}6~n4)yu;sCmho;WZpEw4NCpK&^K5x*zuod?DL?LY*DyHFov+ z9=>2IPDT{3U!P5J(XHk6_K=Hocf&zIYInXmYpVaD>c`26hXh8|n{(2nU9z9pXPUjr zcwZ%NrcZ3v7q?ChP2csdj&XFaX?2qsX#A1lG-R~-l1ui!VTks!k0EL9-a=@qz%EK_ z(@m5_)6lv$h)wy1g=|9^5icmg%aw4ZWRVok$denu9vv~Z8KnL`n;+ZfYXZvJEPz{O zKQCf_-d!+JEjD3<*9;=Z>qsKblfU)SVQkLpC%@DLKq6^dCP(D z#Hpt+&H=+XO@0TeC?U!T20%et23i?LP=rV?T3j&Zz|FO1RJUD56gaPi7vjc5P-~C# z0xmLOV`oAB^gw5voMkh3;Iv8WqjW39$@Jm~IJV)mVE6u6{;A|BteS{jov9VA+VYd# z;fBY8zTACOS=rK!qbj}lER6%qRGm>-RJvLw#BlyMe~4a%I{t&x4$!y2SEUBY@glM` zwOD2}<|c#8E%^n)@RRlu`Y_f=rh-J3N$($jN#56@b4?+wSlOB)<79NmrVOJJxu{sy zf(VnR;#FIZYC&2_Rqi7&?%^~xBgSI6GUBzQN=>y4RA2O(!9htime%aUIF`IfTsiKWxnZH{NU?k8-S`=<9vZWKG@q{sd5JTC9re;4j1b zZ=NwM#D}F{&A)iI#Detql{G#aCfARc8ZjjdP`4Bd<>f{H@xJeQp2PafkCGzrdsa~j zNnwfY*#GFJZJAlb5s}W)3F>mKe;Ce49Qbs<6RhFr($oDA1gfiddk6Njr&`E__ZR2n z4Jt1Z)m*x}3|H{#rTTV|yLBxJ=z}UciXUllAI#nGD##87Kn;kbM-U^E&^W3yOg?r% zAQkw&qf4b7SZm@_WN_pfr;yZ>IstPvff*Ho)6TBWUoKqcYUG{W^56l-zQJUp+eK2P zEQhQ)G;6O;ypM-4EKW(zL!9?BY`SVB_qF1m4%pu;JrWTsm4Sm&1O6J{0yRKx*FV@% zmP4T79r8Z2whhT1)lo##`cUT$Y`6{9hxk#78RJ7Vu#VxMuh!@(-ue4yiWV&95A$WJ zjzP^K%uIQ*sj!6FtO}Oc8S~KeF8~b{9hNMO53|oQ3=UZj^v-Yz&vtyox7z4P2@Q!Yj7NeNvoz*-DgkPgw=nZeh~Y}imikb%hC21Ufh z3#WBo4m6DiRr$zp6$TY#MOMd$3My}(C*aB;2(|tolsh^eTE7K$63UGO&l09Bjv z<9D2sE96(i~ z0;#7)M4`#s9Axjq_&(B7d2g96GDNZ@7MN}p$;R?+|RtJ z?5IOr7Kf1If4>PSw`;>70hmKnV56^47Izz4%e+1d>92IddO4x2dfi68=jesyqbTpG zk^dQ*PbUch^L;0YE|TSuqqyJGs3&T+Rn{@i4O&O55zY(^eN0zIour3VW2=X(b|`m` zK$Wx>3f{wu5yQ=tSdX(<8p>kDkw4paew{?v1G#PWt59CNW16YAU$994)@xk5t5N(j zY^3GX6BjZn&wm8et52+F_vlO3mEu2dU!rCjk zpSHrD&t-&lPFX8)PosEe#g400`I=Y2P2#YP`fedDgD9NHoeGJ-CARhsT-ByLraf#{+sQ3J-*l5tx@S(=fOt}>#)ZOh3}}x$rfx{6*2t4|EN+TjJ;Pf+kx=-E*t+rOlMU=8p% z?hyvxHE%)3WJu&T*6snJBscp!Oc1vnA2~Xa1RBsQOO5X=4q$YqJ2F&M{Uw0>8CFkuyPeI5ET{ijHjW_ z5R6H;u&WB|Ved=3c0A?}wGPWYQ`&-9J+~~Bkq7#$X=LGauk2wkZYDr7e8$f>@dymL z$)JAXI#3q`N7fQ{l(5L2MU+*l#T-nX}WS>x>K2oVGN@iBvhJb(&4kpXyB3)!r2z~i(u>9K5X9t<0Ug@CV$Qr#aUz zTAoQ+ERJckpOY92mZ?|FiVlbN>72u({kO@g?%#`~0Mu-+BeIml^AZb!Gi$7MdP-so z^=R?P5r3yXClM?*VHWRuN*=%clDd#SRAPV3Az_g9U-(7zyo(AH&63@lOPf(j?o2&6 zhMm0e(TZSlY%F8iH4yo@=8$Gr!|!Nul@X&;7-?b@OR5VJE-TBP$4lq&jObJh9>;$} zoY1{vXLO@V3}&A+OVb~=EslenhyEa>7iUn8^Q<{92U#Fc(Jf#PN{7mA*wMqetS9vH zH(4DPEkT$UBzC>2*i5JV$2Y<2MEu)+N)eSxr-86Yx(N7lcT_5L8Q<_dGXHKC$!+B5 zsa;w!Bnm+JwOh6Cjgv1<8W9W=3T&E0;TVL-L zmKADo4s9>$N~zh#Fq=nobssYi#f>diY;QVVb^;Xe4cxR_e_K0%8Ah@4-vr?f**V+$ zjrniwc_T(XlR0n!D7CAgVsS>uVju6okr4H;TT6x``SeY|tb7pHkcBr!XsdB)_MOdV3d$x#6bRYmmf4J9ceTuc^1 zN6&Bhens_U2kcLl0>vz$XH(?cm^?NaZT!U?_VvyX-*jpBQ@w@t%#h7e?%Xz9WX?5d zPmsZzzmB0W$Ki_S?PEhv4x}~3{ew=f282B@{gz{?-z& zcY!OtZeLqQn|yHA@~@qBRI~?4&DO~L`Ww51*cSg8CkFC?WHdTk^7AnTNQg3=Aqsd! z(~$U8-!P$z`Yn>i^7vTUupzGBnB*7!Nxu@V%#Uu9S3k>JGJ>(za`p-GEJ7t7|4l5Q z^egm^VWY?2Bij|;&_i58CM);OkBtHt&NbiIIeYDPL__NgJ3a5%55I3LLP#qGR|=0k z9XA9QYetvP_p%zS`i0tr3P#fAIDfxkV#N9&NGL`IEBv_6fxk0bX>LKl{~eR`V!fs! zvlKJ;u6%jqBh^Kt;4ND_d@h4ZiW{E*MDwq*5mV5DUIr@2ezHFp?>>y3VG^Mwk5(KD znkp8hpO9t%ellx2tC>fL5ihPpFTq(jOOKfq8P}+Z#6nRrfpX^l-mZjZ4{Oo2I|mu> zegsb7XaP=@z}FZVur}iHO^f#uiUPaz(E2dkXAKZyIoC7N#b`;nP-gL>l%A=98Pw9~ z3XWz@j|Je%8K$wl%M-*A&;MM96_05YI}qhX?DH;n$>0+&14%q*AwRU86Ac8<&E(;_ zmIm{eIw=~eTGd<+3g~G{G`%ja^#yui|&0@2i=6;_Iqx(wVu`sql z2fAataVoQh2Mz+i`*$ck78(-D(R4;1Tsm=UtPuaBX)HWiaxqH&5i!cnERCOONKiLvj z0pf%F8Il4u zL0^R#hGvetPsGrKxVJ zL+)B(rH-(-AQBMoxU|RlS695Uj-Ax^s>;5HQ?Q|Xn~s$%vFgHBgBFwq^+OCZPA1|N z$J55*27oVK_YYRz-_4|1ss&BEz>P8p_~xkjFK}Y!%AJ6+^Br}Cf#(qQ6)JkvAV@Sf zCY^lr^iY0N>O9d4So}(6CYjHF|DZdNvz&;Ye@&P(maio_Vlr1m+4Tgw+AVx_wkf*T zR@PIbZM28IIz1SBUh0WgZPVP`!os|jlkYQcdb^u7is%bNig3%R+8SE{$hf$uxTfEi z(dU-lC;O#2t&~nFfItg&#RereAdG5?Nw(Uf^nzukn&VgooI*wUg^pR1r$LS`i)?Gx4{hj`$!>-tXY7JRI*n*iT^c@3AKuc^>K&*) z5oC=T1q}`hlwDF`2qD*doDr0yoTou@$2<<3$?oeIZB~4w(l-eGP5>36nZ6x&kCvsQ zLd#|Yn4?=Ktlcw>M5g?9dSUB9&^z-T3R#|l{p7x(ILVm$%I;%FrBNWzqv$Ndn+6ib z5(=3Q`{{f~AUO5`jqyT%Ss_9<3PP|WQ2C%jheP%X_#F|p7A>**Xt=U*rCRb*3Qf-S zANvEW8=#jh3|2r=moME!#=*n%ca=r}p&!%@U(msTLh-ljNhM`x9Wmn}O_5nJSTN2p z-9OZ6bD^}4u3z%qvWE?S6LfOSt@Bp+IC1zhs3`|zyJ_cL^GN%1)F}fjaY<;~pP}r7 zTCU?2fcIAgN2CBT%z6@`2#dYM2nqqwF(k8F(Q(p0F{R%^!@m0Qlpw;uu|-J+;n3_q zFObZFMf)NCrO26}`dkkSWab1?0Al(~#P0e|mhTK?oIDzQe!(c7(;c{#rYV%-pvVc% zuU1sY3h$%mdxa0(R0@cbwbIljDb&`7-~sBjfpO(|JFrmB<{Y3rqX!{v%3vicxD<}@ zjzF`sZx{ZJ-rH!Ehhx`5|Sl3;!p$Qxrd0Q`x?<<>jmQnLRm_QBhVIyT;Zj zU_+(f!fKE>>OET08G!T0BQg@UjUb%rs&P4L_cik6AME^6EAK;+g7YAf1R_8fb;t6> zg)`Ul4Kh9X5@vHtdYVaKFXlt%g{^B5c3GQksAy&`1>ALHX-@E!w1nv_0X@T+~ zTAn@}D0(7whGlK-Bi1~3nk80Hw-4tNn7rN>9oUY+dgdPy9SkwIc8t>9fs3(xDV}Q2 zvMOxA@)U@VA+HIpxgx%UXyCt6l`<=IR@04LJ6XoUGVC`}abRp%)P}w(yMdG^Fy^ff60lq$8>dC_)ZT za5W}DqVK8+ljDVGid_UV@ign>Vfv*=JoVc4Wh2uKg2epT(re!+viR55$`uK);J5^W zs!sTqGn9((v4F1OLK7kVEa(aZ-z4@!kuZ8v7OmNe;htt-cOL!P&asm8&`5>8TG#zV zkD&wj{c!57HvtB2d^Oj>L7PCzTW~db$yvblO!PYD0A}*$y~3+EIPSN3>}Yl|-(Q&D z%SkotND9b!U<|x>Q7z1L&`eQ-^8G5LK0u8&0`YUTE)fanW?Fb#5p)Q^vBt4?DN=-| z#=ce@i)tZnhAK*aZ#+Id)e$ilF_qyO-rz2i7E+IAcx6)Fp4l?K9&w;$O94Rj*-RWE z{=&=B@TK9*{X04pve!w-KWydOgLhFaq<7@rPIh)Uu{B{kRNI8j+R(WRwi~ZL`+{$I zEn@72l^K0D#ir(%^d|FgYAE`B1%!h7zkcuDnubp=-hR?Buwc6(Y)kmjF$)V>S7Z{k zh!{{`V*_+p8dOc|L5D!S8Ay6jGrn88)1*Eho`O2JkRb>q=s&mQauZ-zrpPjEZ1vp! z`P_6UrtlQzLnUh&>OwsuW--WehuSVy~(PCKlEi> z0|WGV8dhu;iDKJxmi&wOhon#+R@5Z*g8FFLOZ$@1X-q<89%X^B!9=%?s2&D)9@l|j zP;X39Fcb=Wt-rVX<$PfzQK5wg{^WA;FGou^nnH;8uJnE!1f*M_U60bwY_iNE6Hm_)%D(wIKx7Xfe)g&Bp}!?i1^7$J(+hdz|{@La$ zZ;tbdP_HvYZQKFzMC@UsKW0eehgS~lfT+Hi)Ikx{a@&6hef`=M7Aem?t~vZ59-Xin z1Zmd=dOM@A7e%|L;%JVN<(PsK$wWTnuLL6d{ta%LP>zuE-+iw!m=`DUsjcgSha9^W z0uG>a=W9H8tHj9rrZiaF?l#;VnT4R}<-6@u4}si6P#%FOF`l(Gio-f$EpOwRr`yZI zoZydegfftD2>$fEJl4ti zN&aEF>uITaVhW3_?XBdI^L(-!i)41SCq)nhY#`?e>kRPEr4TIN**Tms~3k13(W@dZ^uC1ng`M(K|BIUhnYvv$#);=ufElP}6r7AZ` z-~E!pX{KqmRX%}#e}k1`PpGe3cVmH7h?ZFk4}z2R``eWEjYUf$UQrkuE*URZDT+hv z#tvS$co1z@F3dqf6eTzHtW=K)W0u>EbXI*Z>cHvjZesW>n~7k!QUeFo$!+eUsU^qX z45iIT-&W?Ge>>N5bed%n!e>$Vd(mV3%_ty~|1?WR^1!Ib$j6!>v|n^RRL0FXW6=^) z?rrvNYp6H&t{&lM;%l}R$NGU~8dcKZozYApudbnkrg91sc?`wuw-QUxb6#dd&mLCP z7y-nSzC$cZNRx8)SH-8WjKPz1G5Xe;Cc#{+IBra!I`Ex-RW}8z-6B6t9C47ooP&vp zhI$sFE(|A37@&W3IzW&?F*HM17kp?9+`|(=96-?`HH$ObpYL263rJiRWt*yV(IN@@ z;|V?S&F0UAu*Bhs#~_T2C0e|PrS91E90#g>U*#T3S; zTRis1WxxTOrK911jPcBT1i!I&f}T=k`fvo>4|SXLj2+I5ppDWPGG%<;VtO-K^e$js zLpgp`82p}5FC!YH8Fpk1`JxQ=H4O=vf*#vx~! z!8WEfVauKB$je1GSsMC8(WrDjDtk_&T{{zx?!l-KaM>N{ufzf~#s_(3lwHZQD7B~Q zz$T|7i-`-`#~%Wut1JCorebytj|A%O8l}!h>wd4va$u9ziAo5@oqZi5w_G>Ibs88X zbYPRznLz*lSmp>Eju_QRjBWo~AbgVRxWl>j#zZNqM|2jZG0p5RW&CF(k|s0Yf62tz zl9{~#{xZ7ZQxwS)ix~Ixq#6j3wvk`;E1#q8xKO%aYzqUXH4c6DLR z+-`gxdIB-k{_XRdX&t;us?w*7-GnPxq;$q$?9tZoW$)%ELzkLZ>Cc}u3@0C`(S6+q z9qj`aA9`C)8v4TCBXi*aG5fXPmJT6yj)s6+OU+h>bAN6nS;*97z&L`AF{u7%qummm zsv21Tum_>qHnoV^IjE|7=*j!wt*wwopx07NgdE@8aqN%$B}jV6!QOEKTsW(Ntdkls zn9sJ4b!f}%`srfoy|_^or4+Qc?8oINg9e9tq?}9P#Ep)$N9f-@!tZZU!shQYsX&95 zF|cF2s{4x?oA{3zeY%JnNJ7qNPEIt;hzHmfZhy}9jAN!)&L(D4$OlIlIez{%bY_hg zx<>f%@KCge_uR|C_NLz-^_dnBX0!-tK}{ofQw$kK?2cN=E-G~?Orr=_=kKxpX~6@o z8x$Q62NMg4L1W=ZLpXHKa;ZE{{Y)>G;-Y+sp-uF%yq`Z(UU@4G@SqXta?~=}AOR{C z>t}5?_9+*565ei)omQKay2rc9aqU!inYqcxc$F8sF)l=Flrs#^C?ZGZJF4`@SZOdq zOR}Grh7c{-Ukd(jwX|MEr8}l(JFke`l5Dl?p~cm#In1Fw{9{k7a2ix*raF%=*&y}U zXd7+cxOVZWl$TWWepJ(=;e-tAar$ft=8yOJaZTk2Llu3Z7zh4a2|ng6n@x1aLe~8l z4}opS$V|T<)jj0*2w315qI)-+ClYDqU;hRQ13TwFW@Ich1KOx)f4*BaHQRMPL5Q*= zPb1`1ehjb;7pTz~(wA0DN>MgW@RyIh*ekh48+6A;HKftUa96C+7;+CFG}b6nJfq-u z$y>zX_;ap=)ULmWPjiNLrx!GkA!hXu9xt)7$T~{x6bP$TVIA~$cw^*t~b#{NV#3D6wQjI}Y)uFNAWfi>l0$D~6d{XvcMIrOIC>>3r>B zx)y**wTR;YoRWfhSQ+nWC;W(Y3}U+p1d_E$D6d*?>gA55@qqmr*vN!#90UvcakUfu z7mB!UV#e5a)o*r^pQ}IlHN3A_lHZ#Y+FqV(Nd0PdC2VD%tFtkHW&uyD-j%Auf7MbC zmRSAm#nq-Qj3~Ww3(x1+cFz$JCaGFUMg`gmo!xgkOeY(F(rqYl6A+y6n00ekt0j zsQwQ>{@`)DwgIc`+{C2VvWs=uDahIwSOdA~Zt+sPMNq#TItI$o=n>ynFONRMyY1=( z;vwH7AzK;+j1#ff1OMY;GGOY*w8!COcUacfNYkFP?{+{Ne8u%yGwxMJ$;<=3>;K)B zS@HPt{5zWIFQj?_djgTjPQ1tg_^(S?uwT*-VBS=0#Z!N)Z~%G(SoT1c9@=&le^OK)-fOA-qoj!dy{woM2Bq47i<%gu0HyNc zqap?SnE`?ohlw_7;^)M7;F87O`^6yD@Q}#+0_%-~kQ+89eLIX!2P+^ijpvNw89;t~ z#*Mzbg4M5kw5fM+rO-5+o1zH+6HTP=0s`qLlAHWZ9$Qr5iCA1?7{d<rQd1bW8f<|poeE=Bht|mK#Jsntg%A_6SD$i?@9yRrwI;~~z=A8?VA#&2%ieYb zR4>av%2)J!rzdsNXGju5c_B0m-w==B_DUNFT~b`UxQ6j1vkyue@U+N4&VQ77OkvGq z6r?1Q)#%a=4Qk5%9D4X*7km)6U59o^fBN32R&gkU#D1jdLxQH7{eGV2g)+m%z)}!% z^WCFSfd^eJZ*nMt1BFxiiC-~1DMKi^21M&SI};D+6LuX^cpv^F1H=vvZyLl+L>oJi zS-{rTD%pezOJczHJ-{ci*|QO;g8M08(D4>AtJh!iQKcRIPsS9@KaNp2Wt0)JDPjuB z5rsi45luvBd?C6uBTyg#0foo9V3Ipr5A6|O)>=~p|A7_YWD?y3Wmt;v2$3Qu3i^w{ z4V6z0oB+9dQ2}0WLk;kZ&>@Q=rf|yWbTE$c_zoHMimC}!D$ZINcfM+B>P_k#QeK=I zjh674t_-$SZYC{AxvpXBWlGo_dU$O;h8J2v;!Lyg*K6!}X3^47T0Nn1it(71a&cv% zuTusig_Ru8d}6HMl+YuEVtOuD3F?(VZ6VYmECw7S;~DaP8c@E|KSC14bz!^v)e6V%ejOU9Q~T%SZ$8uRuZIL7_Wy$@O@|J;=!|coD7Q(lbw%RXa zyfw!t^pEsMA!r?jNKEIoq{d{(Bq9D>_NKQ%{03Z%Au<k7^JLs2UG;aJscU7CYNJ zdEXqDU|Jtqgg7WZx!k}fY($2;)Kd@|HvpuKf#51s4&a!9r{coxNlpfHE&eo=2Je|d zi2NJSw|Ma*}M?hbw^?f7@GMNaF3!lnY zmOZ5}%5Kp;W>pxYN8#D71Ksp;LHMR7v)n>F*xp#IZn;;xRdr8Xb;Q2f{dn?tWyVSqs^}!v4G30Y+vuegCJQg+wJ90l^BwDd4d`JURm`W2h(pSC<;2 z1QSo`lBRs|J189^>4uj67+9%No^WN-V~=f*9$-W$m!V1Lw3$A|3-T~GBmc92F(9Vj zjG%8XnRwX23LegqF8=q4tUZP`km5<_!fS19!kugab3*F<`JEylR6^mll`27-suyml z9RatAjLS~u$d-=JH32CA!%rR1&m#+o^K*#7n=GF*+#62mf3yK``}bIOdvsH(>Vv4W7X~&4~|7zB3=MG;zr#tC=?_->SY=J3$j;C{y9g{Rf z5BAd9;V$8?g1D(_#CR;(hg@QWF5n?A-&^&_XGxzU-att2LC!cw6Dhex!zkK_m{aLZ zz^3!w_hDgT{P*YpsYy#uLeEGlW0wweP@U6oC$W$@Z zzT*z2>=r6U3UU#qjlCWZZ63Sv|A3>nohPci$QO>hu;U{AR3iP?)Cu(|`)@MhnDo&V zl2(>EL(;_F4bw*wyo=25cy05taQLQKXJXv(H!z{GpCp&^VkG_#cS2+E&$)Z-dy0fV zL|+?88YzbAa*P&8jtZzwQ?$n?E;7_*uvZ^I0YKR)MJ#0~?i~wV)|@sha3){!bwMXDG;1TDTW0?(9e^CS_xedObGrjI9NVMmY?dfh16`u%b3Iwu}lE zsQEU4)ItK+C2G!ASYiBRet*npQ|~ZIxBS2A-eo^`rt#X!nVjO^=`gNSo7pglAsb%< zMn1emcv^W9ll$&L19ytUOay(^i!;{I2W3lv$JJA^8a|Fm=^iFZ?b+h5+T58%L@5n# zBmBQ>S*>0vRZ+EkNQxu?zU(QJh3<(I^W;Dsr`#%MI_+fY3W73=tr){=Iy{(c>v)PB zrvazMi=D8e#Sr&jvJ2p+ED^k$f^6*(?2jPZDQOu(L=KG5Fa2_7 z=wC`^&iTC6w=qY7RNIv?o>Pj`mb7Ci;<;DgH=XZ|=DInFx;-KZFdVTM$hHt$U&R^``78E?uUKb(~wJzG0%Z(+Dc zUgo2IE}P#u*#`|NrbSug;NLCZaY+DCI?wYjoW6${$>%qpDXj zd5F2Iz#UoTER@hvK2fI3XZuZlGZGYg#<4Hz(rXcsp@~7ptCT|e%p;9%X<5kA?>R)6Du7^_1luhm zhgT;YI*HPlAiivaD5|>=|LVpbG-jp;d-{rm>`{Hfg5Hnooyg*VuTx)oqte{+WsZ7n zPfpi!ot&(*4g;Zmf;84#A3*!XjtCH{c?!?3!0<}S<9tN>4S`@~$&`s$UqYI=T)IEk zGUgnalWltrOLsi>vQZ9mqCUj|q%1~to>2B!Be@PDu3P~u6p6vcdk4g~*HO360-R7A z2_~!%!HK!tpJ1@PNc%X@FXLHA!HLw$3gX(-3RrM_F}f&b1;SFNVLs?|HrnP*^46XKae@Ju3xP9_-Za8S`6RyrOa5w8L$2mGCNiuhXf+?P9l+SBvLLH@RdjVBJkJ z(s2v>3mvSgofv&k*l!Ur#lHReW;g7!^ix|y2a7TJty-aNughuOO~%F3ZQV_E-EHC5 zF~dQ()32kcla6B03&!Y!6;JAt6MfB*te)+eW(vq%&ip3h7jRd`{2#-&(Z^?8b$N9n z!Cj6Q)Ry%2+Ckr*i-&(cVmyQO{OtzLAw&7LGEZv-v$%xug%pk|ONkVY&SEh!BeUq- zJmiv+`^z}wl1Bq)&)`IYd3&(l-o8CeZf)6x(^IV}nAT>?z)!bW!#B<2I3{~oNCUy% z8-sxj1`$-n6Cjb99(mxs*#QNj&6oV)4QbI^vZ}sh@lz0# zZ2;ypSZJ6d`$5PXBr7h(GbNZCF~}_D4+#7jBDPTi9=P>1{VsZc{`Df|N~Z{yd;b`L znORt#5{)CQvn-?kJJ_0`<)QDi9{OCp_;gHpJ#?9o^W%r07N~`Aouftl0L9q5POS$N z?FP+W0N~7y^_2;qTLi#yvga>SF*h8SEH5dedD>OrX@tLo%`bn|$+(4NXXacV50}sY zy?2h`iTHO!?t@+tUeQnB^|?IzBui)*zfS+@I2l4z_$=PksAZJwLB+oQLVhx-{7yxg z0(#kSa1T5&3{k>VlYzke=XvvauOCyNl7nrMNExX4&^u@bH{g@?douy@QH%ulY=Z*4H@fVWUndkX&4g&M7tlY)J;eO zPaKt|EA#G+EkNFszdCa`4@@21f0ZEwdm^RZpkO7#$J)Ag3etmAA%rSsCjnh{XS(5@}dvJ>X-5rAtO^oNf zVr)dwcBv%MLun!LRx=pCc($eyo=B1jZ{O?~RTP^|hAp#Apt)X@?pw&bsi#_9c11t|R;}B?*fzOEf^%}($>$dvr^Wl%Swe!?8cxW-!^qW$tk}(!WV`QTmdnKOL2j*#9X7ihjmw% zi0;gxXbd90E#IM~U{b8lq)|x9HFrc>OmGp?LHr^}>sA=&?M)I8t7~as)h=<#A=0Gz zrm*8oNmyVXHu4nCLgk02aAdBLTiHP5I5?31QfTi2vGaHD)cG=$K~qQ4`kRr7B?Vhc zpc(vm?ZbKz@T>e;en{7b!ECO^{piMH($|B?4 zobn_nNPkq)mxgdlAKVBy`qkONr|jP@PM}Kkqp-G&9(l%|{;o+Fc0MCBzbKvw-#33w{QX+Hsh@>UXIo0{Tyi}FZ zmL-R`vwV=o0cE!lH&(jFs%mn!g2z);vSyXpa{*VTM7`>$tetf9G*Vnj4G|iEZC`_#f!LT|GCt6e!fMQtZe7G_vK3AXt z{?KZE#+dgw2w}0)2M1&7|Pw4WkqAiWs|?a*G&CTAag06Xn-Y09=EHY{>w=Ni$&Vq7Z<^W37`{{po{l z2mNg8ZsQ!^oC(mB>Q?J1ulfha-}&bBx24woVM_G#+>ctc8Y9?s9gS`HNr%Yac2_^^ z?GG1{DArUwMC8GM-iRdd;{TX+>S%$l;`CxGsJSD7m$k``F?V_JUn%UYOf8tBgy}xt zuu{k}Sm|gDk}0b09GTA!$D!6u-ovf`i0-y!LE@!4ry{rN`>3T6bYfn0&m-w8os(>a zPN$;Skgx==zOa8#GB-6p_D4&>8STM>d&tpGfu2vA&nJ=-Lo9}mmLo|M+&~2i!R+w+&V{G}Po248Ee z?dG(eOD%gl)@lI)z_sv)JaDc>i@32{ZkS8#NT5?R^GQIXg&zY=x?zpg6E+aCzn(q! z?h^0Ku+7@(29x76`n#Ypt#C%m3ri>4+M_-11=}9S52rgj=O+WZf7n~3s!h!`ea)vCEynx6vn5SQsayAMKtcm?*v z@x!P$tq0kl_Tlhxd#Gpr@w|-YrLl8CL#A*^9eU2^{BK}^nRK|bhq+f0(bhY#{kzKM zC0>6f=rYs-Z&p`R^-JwPRW>mjc|5|h?k;IL?_0FS0o%kVWdXbe+j{NcFl|IAS5k5J zuu;32oRkrlkQ;CY5R{$lcRGZ9`0ab&lP{K&3koFOdki^C2$)ZtQ|QN(M(xKM{#ibW z=V#}Y+!seCl-z&wZ)>xGqa~W+<)i#jFwa>TcZF&+#pbBV;gWA^oL6e-8!s{-3l!YM)zL2y-I`&RKl+9U$;tUcvQzku-2VY zlePk3eS+hIdPdRW@$;>z*G(%}aE-UjJ}f7zl4p=!3_J+?$yOy4n0us;>4x-(x!Hx* zO2v%|d4MGZh^`)d(ZY)jChl4pb!TMhkM+aBENrOjHq*qs}{Ov z^ffUASoifX5z6|?1zSCkTJIeYdBW-kKk}%^@EzydpZ@^cc>X{b*RFF9bV6I=r^-^r zeGzTu?DrYK)vBWWR7>DY`X2CZ!#$TlUI?M#N@nbeatBQ0QT5zsf?sf7+F-O2HT>>_LW>>KM3Cpi75*tYfpkS6^xOSUI z&jPj=;%hjj^N%={Ojm ze-mw+7eO2lTLQvXKnMmg$SL;}{Z?4i<~P)xc=S>nSi{zf>waE`k3R_4<)}H!Z+^Db zT*0uA%|<{pv2&Maq^KlLiZRDf_sZuk9F~FVnua|zo>IyPn$lY|!@jb~F}U3kR~DR# zjYrr;d`C2+SDXk|om0;fC2W0&vKe1%e~9y{Ntp4Zc@i{Nh8kK9Y@V0&bDqFV-EHSJ z6cR*_Rvap>=G8-G#23i9GE#9XSLqZa5x2%(DUD5t0nhcJ z@fG$MSs8n@DLulCuByaHu}=AsmJ$^*p6$f>R%OH&U;?ipL4Ow|`e~MYrIc_7uD=UCDUAXE>-YdOW{l)B(1m)E{0pa&} zd|lW@MKk(&6BaO6Y2 z6L3NeZt`w?6G98@2ChFje<|CK&P$jJ!PDc@hooDX+*E5i9m z6#OoRGQWZC;>e~Ps!T}pgg8ZA@Fktiz+J_8iZn;&xHhTbUG{F_e{ok1tGA$%+ToGs z$$mnME7dch^=;0J?J9bTTOvce4zNJrR^<|T49p5a0F|$+*+|9|hy1lQKriulDwq(7 zt5=3F^2u%JQrAO_A~vM~+%ae#g(~-Okt7mDP6!j{(HrV5W<;KBLpVebwCB!Th^Pn% zy261BsztYOd`)Cge_b%bzEYJ;-I2J|Kc|z4N4{Tho`2z6m1h(g--b4*qI)FO&v99@ z>x=MFY2}U!td>4;*V<=|yqe=#x(K)*Q9!0uK%2HoDT?fWP!wYg4?ngwKRlifS8R|kw~EQ+KQJg(2% z21bVZtQ&Pi1m22CWQ41&1tjY-Qz|fTZDvS>2(B0s2v7S!*qr*Tz$3qXSUAw*NI5;O z78IYVWb11H3tjL_y6~O#po}OTbUeji$EpuXeXn)ve{LNMhiiSS&X0ZmQW8$YnXZ^Y zuGU1_lQ1rR)naW8HXIdjUIqx~&c`!%yplC*1aP*#VmDe+9$jRd_PX;+BILDoo^hSk z%QZ8RsAg4e<%JTAkw#Z)f$`t5|bT|7I?Vl)4$+vSHn;xJ=q$j$e87 z){3(|`3hVJ<(>%2-vn7E-9nk_abco6r ze^tQ_JYVoL!MDO;tqyl)OUzalONsos_im+_899MHqQso&P-gqn2|Cdsx=Lm0M2CnZ z({{ozX8KOurU8a1oPjUM4TTAZ?;S7Hlv`kEi-c32*{%G97ZCXiPIsxi%lB@|%_N%W z5V=mz%wdWSkz>nf3adJn;PjQYS%IL?e}DJTTV+2&he(@}db$vjdTtnY!dC*E(8yw@ zPX(Yda;d`jVOrI{slz`yMA{C}L+8dh9AuR7Q@@la{c_X#8=T6P?M;q>z^+zjkjpnjee@=Uj zY5v0VmheIgOA?jyY^_=hqVO`JIQwTzF6ErS!egsic;&NXi8Tu`GBQ;^y2VTduMnsC zWTyF!Zb?H{X(T=naITG_p}Rl-{PWNKckh}{#~K%4B~SrtWpAnC0Mle%>F#cSxVzgT zPDKt}OV5vyB3mlSsCz?#ySMaqe=vYQAd`99b5-CEw%mlJa(|D-;Z8>E&jYA0Ae}p# z#?9CSTV+C>{l8TPG`H;*xK9pm=e!;q>;);Ews32O`4nEOV7vmC#^vydRmYKMVv#2f zcBgibi5Z8QMn^=M25R&#gO6#=YG-zW7*be$s%bo8hPQSQiP`c*dY8tre@NH|+rdMd z99x?U(}dX$3c@OiW(1P;u&Fy&vW(TeM`-apm0yElbC_zjp2g-Ql_H~Qm~KI3(!&dj zH|j#}Rp0d|J;dDE0;&r+r&E_r#UniC3+zR|XV|;NV2xoAyv*Gj0)cvOu`yIiV8+#K8?y40 z1R4RUM_E-RS$mt`ZK-mkA~EPa5v)b^$Tq^Y>FRD90h=PEc~jqle>(lqcYlXm%Tal2 zxni$e(!5kMiuQjfBmWmTv8g?-}!fO1+4`an)MN302#%_n^+J&SAsA1@K zfHquQT7X-PuHAE5MWGdWqY-FR%9MzUT3*ORgE!9Zg)vmiv%4O;X_&RcRSPixjb0*I zCarNhNU6ZA<;)?V!`rVmjkQ&+3N@#q6^QY0@q*P~) z$Jcm5en{q7&1hq|+Gb{Q%}%wcd%v%k1Xd^IJPoL`80$2Pe=7Gf$JeB5OGDd32fJIn z2mJ@V2hR9`_yaA(S@=w>qOKam+Fx{yCF+!;ESuq1f>0(&X)+bGCSH}qyP9xk!co|m zw7tRZAXZFai5#lBv*InyO5q}FD#vycnVK`xl|ISLpj{_(wk_YZG5WGD<6#a{>9z0v z0VFYA+nmL9fBtwHd~}bgf8|b+{^F1=Cd-s}eEcdd-J){FS@j6IH!eoU6w0?VrfUb& z0KEbf0l7q}i_Uy;>A7qgFOHaKkng%m3>B&*VsK%Fr}Z3NeI`5hE%kY%q7|LQqqd;u!F zsIBD&G1XU$;QA=!=di|vEb5TJFa%*9kiIM{?jQ%V=_SR1!=UIE_B?uvFobb4E}p;= zlAws#e?SIO7FGloHE^fycxovc<^=8y5j}h2xiT2sB@27?jHn7{33DU z?@R(bpZ;A|`8bEw{C>H3jo3ixV2$)u$c*s7e;w;AB!^J=jg6Qu;+xTE(f@}XDb7?RY@%Z+8S=T9LUCPLTQdM z7DRRUbK}zDDsFs*Fi~c^!V<~5(lt)ymv=f~2YkvH56kO-UyOW}QQ)cbd+9ZC;r|P< zf5mKu1NRSta4`9GhCg>>QB^&(y#;^>lN7YqF`?o?GGs9op_rNaAQq$;4@(pf(SV1a zL_n*`{FE}(3-X1lSDuopk5!$g8M$9Sz?QA#~V^K;cdl zL(O!Q%%exN+DlRcn$2$ddc7;{BG9dBAK!8kqnHs3DB^#VR)|izb(N#f2T0T^0D#ycsqp;)N}A+l;1;0;o#} z0%OMDL!8dh!7hN1h1LmD zGMn=|(IjaZZ81Qh0+RM^VYL|M`g2ym&nD(qi(R2pRRs+57Ip(z<}6xu5Oi-`es^pw zP?V;NHX*&i@ghI0!ng4ac0DW)fBoqYf5@%~*MU#bFhSdn%TAR|D_yufKBb*G31%(> zt5`;gfsQWKcB<@KS&0BLYrsYAOB>O$?C2(VYPUNN3ut0TSOI>5SwTiaQI1jpcel3tpe>l^TW+zs5 zrjzSm6eS%Ec13-56`Yt!rsUlS${PW7k3AQzN={ygIaj~V$T%Q;D>DBWrkxKjk6svD zF+j({kOejBm5nF*pfhuQmvPCQV7O$|Bhr3_P7GrndMnV8Ygm>waE`k3VdIUq;lNOXFlI z@j{le4x~{L1*dI|!er-aL;&w&U`>nAxxt?6A zI#Zag)vc#bU9+S)A1;Rs8PQXh3y{}GPo>~&*sBa9$0e^r!;XC7u#)P)hqXJM^G zg|pv7WyAu=k22C`%UYqkTxISO6}cOk-X>RPxB--1k*O&!9--1w9E;)XF1hz*4Yn{z za!;;1Q3a!D_~)3hTN*eeC#+!9Z(VT01#FHA5Arl$aYcNJIhtZtr00KoBJ7<_hbp^L z_6iq+zktjpf5mEqfaH5TzP2`X$Q53A{2$m`ko<2qyJV~wQtF+%b15)L}O-CuU`#vnopQdoom9q;BBqy+k;G73&4^cOTtt16d zhf_2h{S~PxMSEK!VFpK-p@Ze;53b`|19ZZXLkWZQNKCC1+#QCKSW{k`pp&bw);y zOHRptt8+5k-7N{nBjn(_94IPgFi$8QXT*a$?0G_*pf30j&1P`T>O4i7GcvB))vzvm zxA3?thts08K>IlIJlS4o4Y@rM+Qmk{&sHSVe{4nuJMCbK;JV%=Qf<$2!333}tEU-M zDP#V(2IwUoPX&`8aTUT4Mn1U>T`+oxQN*S+09&NyAxQrW24zN69%wi}+(0U8B2OYA z9B@&HJa^`TM`=LN6%G)-q&EcJ!f}I7U1qp~E*N3=WXo5!QJ4DXbTaYC_Y2NxEd@Z4 zf8lL-Cb!v%ReQ%}$u2L#M}QXAXJvs2^41>gt>26Q}#2EG!Rt$U^_E9(s^70k)uwIuno? zWs?z^Q)STjm^$1e#xyk}cFf*#0#dOcf3})x_822`os^8{GSCZy%#3wuf{7P=N`n-b z$&2U2=%RE<3L^2;j9f~5i!J7mhJWdgss8_EzoF@H$baHkjCOJTYxCYm52OYj z`~mwSyB5JDHY6M}hgSYLqijTHT)~H>7JJoO7_d5%3nIZcTA0NBYdTFy{u+W(f8l&i zW^>^&nkT9E`n&ttlDeU-#~Nv@mZxubC+&Z@vpF)PyokJ{ic`PvD|Fz!0-1 zWSV@(c1F9yCvs)%IAre8J7}jre=_(dqyE1qB&UM=AN6Ebt}fh}EL=xhuCx4`y}#r7J_#cCvrJGa+c(zOLHb6A)7E8@=&Q)X^;3aQ4%D`B7GZF%dg8<*J28^Yx;|;xrT%gJbdcF!zO|1bVsu zE+vk1QVrRmK)D?bf5X^ei+$w{!A|~7sL~+%8XLn)b?0;c_V%_9QBM6u;1PdJ9edT| z&XI7XOO657tvbGh9qs;UV;DSl>(Er>Rub6}c5a3{reB|(#ITpWBYa8)1HOKFZfPfi z`%lZ?zu_e`#_vLKpnRKOqET-2YjWQ8)8L;h*EgE_46wxp-#6}CfUs`BU!Oe{dYF9yX z^43`w_D28Q=%4pM|J(^9M!s21G&2R7eXcet;y0ioe}=09w8V`PnAi|i_N9EL4tIBV|3j)rhhn!E zsq!K3f3*068|7iu4_RWh$INP_z0iIl3k=Aj4~d7Yr<6~#P3%!=we zB3yE8{;OsijWcxqZUA1=1O2|BJ1h*Xn#>D6e<^{4G+d{U#Y9vEe~LOHW4$aR+0qrc z`SaT>+8NZS+L`UPU9o(p4vPJT%68U|eb!O4%Y{BK9ZhVFxiyHiHy93vnTZxMS5Enf zu*BlVSwUC4d{LsYk#PGBp9yF4XY=RJ7!RmFdH$Yq^7Pq``h`wCk?hd9krfxFnL}DTJRs+nGPV@Sn|}|KI=oFZv*+Bh~;t!)O|itHX=X zD_z#$v=`pw0U^5jrY3Aufpg~r5%2;MY%p^!I?vS;BpyB6!Ovqror^*qGkk|GNd`3d z8V_cm0LrgxxY@N&Z+(}s1z{JR=i(QVe?Q?1kT;ZL*BA5vlDQ0NSbJ!mrsyn9$Uz9^ zk&groAZsABCq692DA|zC&Ur~hu}tEi1%oe(Dw^CKV-E=@W0~$yR2O2Zawg;^x)hlU zp?U$Q@7abd8f6w@W zhwqYO3?pD|vnRs9^%P!op1&nH@X-wDjV~cvcDjD4n8kmgazln(;m~o`@FAN<+?N*` zpC>NjTV9sPPc}?$0B()0V=1DZxw8pk!Pp>6Q`K`XI_TDQ`1J6i^XOpy`J#iS1a^h+ z_w$nJaqK%_ENZP>7fVK)Jo#Rnf83>Htd&JM+hnh4GJ6f|?ieEPpkmDXM8@?>xotF0 zXnDp!o>j?Tqop?V`%wg{4HS(r?`I>uzZOUzSdl)ch4eu-f6@nQf%HQw z(hqAP{V*HphiifKBP-I6Y9ak78|g=Df%Ic5(vNE){Wu%x$7_M~6D!hBY9ak38|f!& zf%I_KuAS`GQ%`m+`pNEkAfBU^)zr&uirIQ-W<$GbHms+ciIKAqUk~kUXjjjM_4G3_ zau(t>G&F5*se<#bx2jWUf2$s5Cl;_^rn_tK)7dk=H2kAF@Q+px|6U#V_f`-8ejWJt zR}cR|9rzDc5C6kD@IR~rzqZv@fm?e_RP8xC?1YB1!vp6@2ER zM`Uf0za!yV1(D35>YHrpAvH=PRYe8J9;&`crXEszX{4%b@7Y7ue>b_*Lux;bR2B0| z_E7arD)o>$NF!Cne3Cs>eUnK&q#mY`s$w3=9;&`cq#ja_(nwV?e`F6;-{esbsmE!g zs+c#jhpKPVsE5>(G*VT}7uiGAH(Au&e0MW;-zw$_%U}(dBx)j-rB*DhSELn-m1!2j z7LY`2S>3`ItO1ike@(epm&_#I7sq}7zz!~`3Xm_;V-+j^_#{Fa={-#{ZThOgI>CqGUYDG`YpoPvD zb26b&crxWf**NOTE:** This workbook depends on parsers based on Kusto functions - **MimecastHumanRiskOrganization**, **MimecastHumanRiskBehaviors**, **MimecastHumanRiskAttacks** and **MimecastHumanRiskIndividuals** - which are deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"q1-note-parsers\",\"styleSettings\":{\"margin\":\"6px\"}},{\"type\":1,\"content\":{\"json\":\"Data is collected as snapshots at the polling interval chosen in the connector (default 12 hours). Each panel shows the latest snapshot inside the selected time range, so keep the time range at least as long as the polling interval.\",\"style\":\"upsell\"},\"name\":\"q1-note-snapshot\",\"styleSettings\":{\"margin\":\"6px\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":14400000},{\"durationMs\":28800000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000},{\"durationMs\":15552000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":43200000},\"value\":{\"durationMs\":43200000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-time\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-header\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Risk Overview\\nAverage human risk, risk-response activity and how individuals are distributed across risk factors.\"},\"name\":\"h-overview\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| summarize Value = round(avg(HumanRiskScore), 1) | extend Metric = 'Average Human Risk Score (0-100)'\",\"size\":3,\"title\":\"Human Risk Score\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"customWidth\":\"25\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":true}},\"name\":\"q2\",\"customWidth\":\"25\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let T = MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by Month;\\nT | summarize Notifications = avg(Notifications), GroupChanges = avg(GroupChanges), TotalActions = avg(TotalActions)\\n| project Metric = dynamic(['Notifications','Group Changes','Risk Activity']), Value = pack_array(Notifications, GroupChanges, TotalActions)\\n| mv-expand Metric to typeof(string), Value to typeof(real)\\n| project Metric, Value = round(Value, 1)\",\"size\":3,\"title\":\"Notifications, Group Changes and Risk Activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":true},\"customWidth\":\"75\"},\"name\":\"q7\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":true},\"customWidth\":\"75\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(HumanRiskFactor) or HumanRiskFactor == 'notScored', 'Not Scored', HumanRiskFactor == 'veryLow', 'Very Low', HumanRiskFactor == 'low', 'Low', HumanRiskFactor == 'medium', 'Medium', HumanRiskFactor == 'high', 'High', HumanRiskFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Human Risk Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"showMetrics\":false}},\"name\":\"q3\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Attack Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"showMetrics\":false}},\"name\":\"q4\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":false},\"name\":\"group-overview\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Risk Trends\\nMonthly organization human risk and attack scores.\"},\"name\":\"h-trends\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| project Month, ['Human Risk Score'] = HumanRiskScore\\n| sort by Month asc\",\"size\":1,\"title\":\"Human Risk Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"columnchart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"xAxis\":\"Month\"}},\"name\":\"q5\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"6px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\\n| sort by Month asc\",\"size\":1,\"title\":\"Human Risk Score Trends - Risk Responses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"columnchart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":true,\"xAxis\":\"Month\"}},\"name\":\"q6\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"6px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| where isnotnull(AttackScore)\\n| project Month, ['Attack Score'] = AttackScore\\n| sort by Month asc\",\"size\":1,\"title\":\"Attack Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":true,\"xAxis\":\"Month\"}},\"name\":\"q12\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"6px\",\"showBorder\":true}}],\"exportParameters\":false},\"name\":\"group-trends\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Highest Human Risks\\nTop 10 individuals, departments or locations. Use the selector to switch views.\"},\"name\":\"h-highest\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"groupby\",\"label\":\"Highest Risks\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{\\\"value\\\":\\\"individuals\\\",\\\"label\\\":\\\"Individuals\\\"},{\\\"value\\\":\\\"department\\\",\\\"label\\\":\\\"Departments\\\"},{\\\"value\\\":\\\"locations\\\",\\\"label\\\":\\\"Locations\\\"}]\",\"value\":\"individuals\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-groupby\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":0,\"title\":\"Individuals Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000}},\"name\":\"q8\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"individuals\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"individuals\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":0,\"title\":\"Departments Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000}},\"name\":\"q9\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"department\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"department\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":0,\"title\":\"Locations Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000}},\"name\":\"q10\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"locations\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"locations\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-highest\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Human Risk Behaviors\"},\"name\":\"h-behaviors\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\"Click a row to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-behaviors-info\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":0,\"title\":\"Human Risk Behaviors (click a row to see event breakdown)\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"HUMAN RISK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"STAGE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_behavior\"},\"name\":\"q13\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"paragraph\",\"links\":[{\"id\":\"73895154-b0e3-4cff-9156-adb5d1b1914f\",\"cellValue\":\"selected_behavior\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Clear Selection\",\"subTarget\":\"none\",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected_behavior\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"name\":\"q14\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| where BehaviorName == '{selected_behavior}'\\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":0,\"title\":\"Event Breakdown for {selected_behavior}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000}},\"name\":\"q15\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_behavior\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_behavior\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-behaviors\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"## Organization Attacks\"},\"name\":\"h-attacks\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\"Click a row to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-attacks-info\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":0,\"title\":\"Organization Attacks (click a row to see event breakdown)\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"ATTACKTYPE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_attack\"},\"name\":\"q16\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":11,\"content\":{\"version\":\"LinkItem/1.0\",\"style\":\"paragraph\",\"links\":[{\"id\":\"23876233-22fb-4871-9841-83a1a9ccc975\",\"cellValue\":\"selected_attack\",\"linkTarget\":\"parameter\",\"linkLabel\":\"Clear Selection\",\"subTarget\":\"none\",\"style\":\"link\"}]},\"conditionalVisibility\":{\"parameterName\":\"selected_attack\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"name\":\"q17\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| where AttackTypeName == '{selected_attack}'\\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":0,\"title\":\"Event Breakdown for {selected_attack}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000}},\"name\":\"q18\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_attack\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_attack\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-attacks\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":1,\"content\":{\"json\":\"_Refresh the page to load the latest collected snapshot._\"},\"name\":\"h-footer\",\"styleSettings\":{\"margin\":\"6px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-main\",\"styleSettings\":{\"margin\":\"6px\",\"padding\":\"12px\",\"showBorder\":true}}],\"fromTemplateId\":\"b8d6e9a4-3c1f-4e7a-9f52-6a0d1c7e2b35\",\"name\":\"MimecastHumanRisk\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"# Mimecast Human Risk\\n\\nMonitor your organization's human risk posture using data from the Mimecast Human Risk connector. This workbook includes:\\n\\n- **Risk Overview** - average human risk score, risk response activity and how individuals are spread across risk factors.\\n- **Risk Trends** - monthly human risk and attack scores.\\n- **Highest Human Risks** - top 10 individuals, departments or locations by human risk score.\\n- **Human Risk Behaviors and Organization Attacks** - scores and event breakdowns by behavior and attack type.\"},\"name\":\"q1\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false,\"padding\":\"4px\"}},{\"type\":1,\"content\":{\"json\":\">**NOTE:** This workbook depends on parsers based on Kusto functions - **MimecastHumanRiskOrganization**, **MimecastHumanRiskBehaviors**, **MimecastHumanRiskAttacks** and **MimecastHumanRiskIndividuals** - which are deployed with the Microsoft Sentinel Solution.\",\"style\":\"info\"},\"name\":\"q1-note-parsers\",\"styleSettings\":{\"margin\":\"8px\"}},{\"type\":1,\"content\":{\"json\":\"Data is collected as snapshots at the polling interval chosen in the connector (default 12 hours). Each panel shows the latest snapshot inside the selected time range, so keep the time range at least as long as the polling interval.\",\"style\":\"upsell\"},\"name\":\"q1-note-snapshot\",\"styleSettings\":{\"margin\":\"8px\"}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"typeSettings\":{\"selectableValues\":[{\"durationMs\":14400000},{\"durationMs\":28800000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":172800000},{\"durationMs\":604800000},{\"durationMs\":2592000000},{\"durationMs\":7776000000},{\"durationMs\":15552000000}],\"allowCustom\":true},\"timeContext\":{\"durationMs\":43200000},\"value\":{\"durationMs\":43200000}}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-time\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-header\",\"styleSettings\":{\"margin\":\"4px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Risk Overview\\nAverage human risk, risk-response activity and how individuals are distributed across risk factors.\"},\"name\":\"h-overview\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| summarize Value = round(avg(HumanRiskScore), 1) | extend Metric = 'Average Human Risk Score (0-100)'\",\"size\":3,\"title\":\"Human Risk Score\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"customWidth\":\"25\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":false,\"size\":\"auto\"},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q2\",\"customWidth\":\"25\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"let T = MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by Month;\\nT | summarize Notifications = avg(Notifications), GroupChanges = avg(GroupChanges), TotalActions = avg(TotalActions)\\n| project Metric = dynamic(['Notifications','Group Changes','Risk Activity']), Value = pack_array(Notifications, GroupChanges, TotalActions)\\n| mv-expand Metric to typeof(string), Value to typeof(real)\\n| project Metric, Value = round(Value, 1)\",\"size\":3,\"title\":\"Notifications, Group Changes and Risk Activity\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"Metric\",\"formatter\":1},\"leftContent\":{\"columnMatch\":\"Value\",\"formatter\":12,\"formatOptions\":{\"palette\":\"greenRed\"},\"numberFormat\":{\"unit\":17,\"options\":{\"maximumSignificantDigits\":4,\"maximumFractionDigits\":1}}},\"showBorder\":false},\"customWidth\":\"75\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q7\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"},\"customWidth\":\"75\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(HumanRiskFactor) or HumanRiskFactor == 'notScored', 'Not Scored', HumanRiskFactor == 'veryLow', 'Very Low', HumanRiskFactor == 'low', 'Low', HumanRiskFactor == 'medium', 'Medium', HumanRiskFactor == 'high', 'High', HumanRiskFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Human Risk Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"showMetrics\":false},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q3\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Bucket = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| summarize Count = count() by Bucket\\n| extend o = case(Bucket == 'Very Low', 1, Bucket == 'Low', 2, Bucket == 'Medium', 3, Bucket == 'High', 4, Bucket == 'Very High', 5, 6) | sort by o asc | project-away o\",\"size\":3,\"title\":\"Attack Factor Distribution\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"showMetrics\":false},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q4\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false,\"padding\":\"8px\"}}],\"exportParameters\":false},\"name\":\"group-overview\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Risk Trends\\nMonthly organization human risk and attack scores.\"},\"name\":\"h-trends\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| where isnotnull(HumanRiskScore) and isnotnull(MonthStart)\\n| project MonthStart, ['Human Risk Score'] = HumanRiskScore\\n| sort by MonthStart asc\",\"size\":0,\"title\":\"Human Risk Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"xAxis\":\"MonthStart\",\"yAxis\":[\"Human Risk Score\"]},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q5\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\\n| sort by Month asc\",\"size\":0,\"title\":\"Human Risk Score Trends - Risk Responses\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"columnchart\",\"customWidth\":\"50\",\"chartSettings\":{\"showLegend\":false,\"xAxis\":\"Month\"},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q6\",\"customWidth\":\"50\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\\n| where isnotnull(AttackScore) and isnotnull(MonthStart)\\n| project MonthStart, ['Attack Score'] = AttackScore\\n| sort by MonthStart asc\",\"size\":0,\"title\":\"Attack Score Trends\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"linechart\",\"chartSettings\":{\"showLegend\":false,\"xAxis\":\"MonthStart\",\"yAxis\":[\"Attack Score\"]},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q12\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"10px\",\"showBorder\":true}}],\"exportParameters\":false},\"name\":\"group-trends\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Highest Human Risks\\nTop 10 individuals, departments or locations. Use the selector to switch views.\"},\"name\":\"h-highest\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"b1\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"groupby\",\"label\":\"Highest Risks\",\"type\":2,\"isRequired\":true,\"typeSettings\":{\"showDefault\":false},\"jsonData\":\"[{\\\"value\\\":\\\"individuals\\\",\\\"label\\\":\\\"Individuals\\\"},{\\\"value\\\":\\\"department\\\",\\\"label\\\":\\\"Departments\\\"},{\\\"value\\\":\\\"locations\\\",\\\"label\\\":\\\"Locations\\\"}]\",\"value\":\"individuals\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters-groupby\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":3,\"title\":\"Individuals Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q8\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"individuals\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"individuals\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":3,\"title\":\"Departments Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q9\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"department\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"department\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\\n| top 10 by ['HUMAN RISK SCORE'] desc\\n| serialize ['S.NO'] = row_number()\\n| project-reorder ['S.NO']\",\"size\":3,\"title\":\"Locations Highest Human Risks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q10\",\"conditionalVisibilities\":[{\"comparison\":\"isEqualTo\",\"parameterName\":\"groupby\",\"value\":\"locations\"}],\"conditionalVisibility\":{\"parameterName\":\"groupby\",\"comparison\":\"isEqualTo\",\"value\":\"locations\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}}],\"exportParameters\":true},\"name\":\"group-highest\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Human Risk Behaviors\"},\"name\":\"h-behaviors\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":3,\"title\":\"Human Risk Behaviors\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"HUMAN RISK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"STAGE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_behavior\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q13\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":1,\"content\":{\"json\":\"Click a row in the table above to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-behaviors-info\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\\n| where BehaviorName == '{selected_behavior}'\\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":3,\"title\":\"Event Breakdown for {selected_behavior}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q15\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_behavior\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_behavior\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}}],\"exportParameters\":true},\"name\":\"group-behaviors\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":12,\"content\":{\"version\":\"NotebookGroup/1.0\",\"groupType\":\"editable\",\"items\":[{\"type\":1,\"content\":{\"json\":\"---\\n## Organization Attacks\"},\"name\":\"h-attacks\",\"styleSettings\":{\"margin\":\"4px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\\n| sort by ['TOTAL EVENTS'] desc\",\"size\":3,\"title\":\"Organization Attacks\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK FACTOR\",\"formatter\":18,\"formatOptions\":{\"thresholdsOptions\":\"colors\",\"thresholdsGrid\":[{\"operator\":\"==\",\"thresholdValue\":\"Very Low\",\"representation\":\"green\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Low\",\"representation\":\"blue\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Medium\",\"representation\":\"yellow\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"High\",\"representation\":\"orange\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Very High\",\"representation\":\"redBright\",\"text\":\"{0}{1}\"},{\"operator\":\"==\",\"thresholdValue\":\"Not Scored\",\"representation\":\"gray\",\"text\":\"{0}{1}\"},{\"operator\":\"Default\",\"representation\":\"gray\",\"text\":\"{0}{1}\"}]}},{\"columnMatch\":\"TOTAL EVENTS\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"exportFieldName\":\"ATTACKTYPE\",\"exportDefaultValue\":\"none\",\"exportParameterName\":\"selected_attack\",\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q16\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}},{\"type\":1,\"content\":{\"json\":\"Click a row in the table above to see its event breakdown.\",\"style\":\"info\"},\"name\":\"h-attacks-info\",\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":false}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\\n| where AttackTypeName == '{selected_attack}'\\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\\n| where isnotnull(COUNT)\\n| sort by COUNT desc\",\"size\":3,\"title\":\"Event Breakdown for {selected_attack}\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"filter\":true,\"formatters\":[{\"columnMatch\":\"HUMAN RISK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SIMULATED PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ACTUAL PHISHING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"TRAINING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"MALWARE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"SENSITIVE DATA HANDLING\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"ATTACK SCORE\",\"formatter\":8,\"formatOptions\":{\"min\":0,\"max\":100,\"palette\":\"greenRed\"}},{\"columnMatch\":\"COUNT\",\"formatter\":4,\"formatOptions\":{\"palette\":\"blue\"}}],\"rowLimit\":10000},\"showRefreshButton\":true,\"showExportToExcel\":true,\"exportToExcelOptions\":\"visible\",\"showAnalytics\":true},\"name\":\"q18\",\"conditionalVisibilities\":[{\"comparison\":\"isNotEqualTo\",\"parameterName\":\"selected_attack\",\"value\":\"none\"}],\"conditionalVisibility\":{\"parameterName\":\"selected_attack\",\"comparison\":\"isNotEqualTo\",\"value\":\"none\"},\"styleSettings\":{\"margin\":\"8px\",\"showBorder\":true,\"padding\":\"6px\"}}],\"exportParameters\":true},\"name\":\"group-attacks\",\"styleSettings\":{\"margin\":\"10px\",\"padding\":\"8px\",\"showBorder\":false}},{\"type\":1,\"content\":{\"json\":\"_Refresh the page to load the latest collected snapshot._\"},\"name\":\"h-footer\",\"styleSettings\":{\"margin\":\"10px\",\"showBorder\":false}}],\"exportParameters\":true},\"name\":\"group-main\",\"styleSettings\":{\"margin\":\"8px\",\"padding\":\"16px\",\"showBorder\":true}}],\"fromTemplateId\":\"b8d6e9a4-3c1f-4e7a-9f52-6a0d1c7e2b35\",\"name\":\"MimecastHumanRisk\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -3336,7 +3336,7 @@ "Timer", "Trigger" ], - "lastUpdateTime": "2026-10-23T12:03:32.433Z", + "lastUpdateTime": "2026-10-30T15:26:25.889Z", "releaseNotes": { "version": "1.0", "title": "[variables('blanks')]", @@ -7214,7 +7214,7 @@ "customs": [ { "name": "Mimecast API 2.0 application", - "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission. Create it in the Mimecast Administration Console under Integrations > API and Platform Integrations." + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission." } ] }, @@ -7225,7 +7225,7 @@ }, { "title": "2. Connect", - "description": "Enter the Mimecast API 2.0 credentials and base URL, choose how many months of data to request and how often to poll, then click Connect.", + "description": "Enter the details below and click Connect.", "instructions": [ { "type": "Textbox", @@ -7242,7 +7242,7 @@ { "type": "InfoMessage", "parameters": { - "text": "Required. Base URL of the Mimecast API 2.0 for your region, including https:// and without a trailing slash (for example https://api.services.mimecast.com, https://us-api.services.mimecast.com or https://uk-api.services.mimecast.com).", + "text": "Required. Include https:// and do not add a trailing slash.", "visible": true, "inline": false } @@ -7274,7 +7274,7 @@ { "type": "InfoMessage", "parameters": { - "text": "Required. The Client ID and Client Secret of a Mimecast API 2.0 application that has the Human Risk READ permission.", + "text": "Required. Use the Client ID and Client Secret from step 1.", "visible": true, "inline": false } @@ -7362,6 +7362,10 @@ } } ] + }, + { + "title": "3. Verify the connection (post deployment)", + "description": "After you click **Connect**, verify that the connector is working:\n1. The connector status changes to **Connected** and **Data received** shows the last received time. The first data can take up to 30 minutes to appear.\n2. In **Logs**, run the below query to confirm that data is arriving in all four tables:\n```\nunion withsource=TableName MimecastHumanRisk_Organization_CL, MimecastHumanRisk_Behaviors_CL, MimecastHumanRisk_Attacks_CL, MimecastHumanRisk_Individuals_CL\n| summarize Records = count(), LastReceived = max(TimeGenerated) by TableName\n```\n3. Confirm that the parsers return data, for example `MimecastHumanRiskIndividuals | take 10`.\n4. If a table stays empty, check the **Mimecast API Base URL**, the **Client ID**, the **Client Secret** and that the application has the **Human Risk - Read** permission, then disconnect and connect again.\n5. Each poll adds a new snapshot at the selected polling interval. Open the **Mimecast Human Risk Workbook** to view the latest data." } ] } @@ -8038,7 +8042,7 @@ "customs": [ { "name": "Mimecast API 2.0 application", - "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission. Create it in the Mimecast Administration Console under Integrations > API and Platform Integrations." + "description": "A Mimecast API 2.0 application (Client ID and Client Secret) with the Human Risk READ permission." } ] }, @@ -8049,7 +8053,7 @@ }, { "title": "2. Connect", - "description": "Enter the Mimecast API 2.0 credentials and base URL, choose how many months of data to request and how often to poll, then click Connect.", + "description": "Enter the details below and click Connect.", "instructions": [ { "type": "Textbox", @@ -8066,7 +8070,7 @@ { "type": "InfoMessage", "parameters": { - "text": "Required. Base URL of the Mimecast API 2.0 for your region, including https:// and without a trailing slash (for example https://api.services.mimecast.com, https://us-api.services.mimecast.com or https://uk-api.services.mimecast.com).", + "text": "Required. Include https:// and do not add a trailing slash.", "visible": true, "inline": false } @@ -8098,7 +8102,7 @@ { "type": "InfoMessage", "parameters": { - "text": "Required. The Client ID and Client Secret of a Mimecast API 2.0 application that has the Human Risk READ permission.", + "text": "Required. Use the Client ID and Client Secret from step 1.", "visible": true, "inline": false } @@ -8186,6 +8190,10 @@ } } ] + }, + { + "title": "3. Verify the connection (post deployment)", + "description": "After you click **Connect**, verify that the connector is working:\n1. The connector status changes to **Connected** and **Data received** shows the last received time. The first data can take up to 30 minutes to appear.\n2. In **Logs**, run the below query to confirm that data is arriving in all four tables:\n```\nunion withsource=TableName MimecastHumanRisk_Organization_CL, MimecastHumanRisk_Behaviors_CL, MimecastHumanRisk_Attacks_CL, MimecastHumanRisk_Individuals_CL\n| summarize Records = count(), LastReceived = max(TimeGenerated) by TableName\n```\n3. Confirm that the parsers return data, for example `MimecastHumanRiskIndividuals | take 10`.\n4. If a table stays empty, check the **Mimecast API Base URL**, the **Client ID**, the **Client Secret** and that the application has the **Human Risk - Read** permission, then disconnect and connect again.\n5. Each poll adds a new snapshot at the selected polling interval. Open the **Mimecast Human Risk Workbook** to view the latest data." } ] } diff --git a/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json b/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json index 1ff8f4a787e..d7bfd662357 100644 --- a/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json +++ b/Solutions/Mimecast/Workbooks/Mimecast_HumanRisk_Workbook.json @@ -21,7 +21,8 @@ "name": "q1", "styleSettings": { "margin": "4px", - "showBorder": false + "showBorder": false, + "padding": "4px" } }, { @@ -32,7 +33,7 @@ }, "name": "q1-note-parsers", "styleSettings": { - "margin": "6px" + "margin": "8px" } }, { @@ -43,7 +44,7 @@ }, "name": "q1-note-snapshot", "styleSettings": { - "margin": "6px" + "margin": "8px" } }, { @@ -113,9 +114,9 @@ }, "name": "group-header", "styleSettings": { - "margin": "8px", - "padding": "10px", - "showBorder": true + "margin": "4px", + "padding": "8px", + "showBorder": false } }, { @@ -127,7 +128,7 @@ { "type": 1, "content": { - "json": "## Risk Overview\nAverage human risk, risk-response activity and how individuals are distributed across risk factors." + "json": "---\n## Risk Overview\nAverage human risk, risk-response activity and how individuals are distributed across risk factors." }, "name": "h-overview", "styleSettings": { @@ -169,14 +170,20 @@ } } }, - "showBorder": true - } + "showBorder": false, + "size": "auto" + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q2", "customWidth": "25", "styleSettings": { - "margin": "4px", - "showBorder": true + "margin": "8px", + "showBorder": false, + "padding": "8px" } }, { @@ -212,14 +219,19 @@ } } }, - "showBorder": true + "showBorder": false }, - "customWidth": "75" + "customWidth": "75", + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q7", "styleSettings": { - "margin": "4px", - "showBorder": true + "margin": "8px", + "showBorder": false, + "padding": "8px" }, "customWidth": "75" }, @@ -239,15 +251,20 @@ "visualization": "piechart", "customWidth": "50", "chartSettings": { - "showLegend": true, + "showLegend": false, "showMetrics": false - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q3", "customWidth": "50", "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": false, + "padding": "8px" } }, { @@ -266,15 +283,20 @@ "visualization": "piechart", "customWidth": "50", "chartSettings": { - "showLegend": true, + "showLegend": false, "showMetrics": false - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q4", "customWidth": "50", "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": false, + "padding": "8px" } } ], @@ -282,9 +304,9 @@ }, "name": "group-overview", "styleSettings": { - "margin": "8px", - "padding": "10px", - "showBorder": true + "margin": "10px", + "padding": "8px", + "showBorder": false } }, { @@ -296,7 +318,7 @@ { "type": 1, "content": { - "json": "## Risk Trends\nMonthly organization human risk and attack scores." + "json": "---\n## Risk Trends\nMonthly organization human risk and attack scores." }, "name": "h-trends", "styleSettings": { @@ -308,8 +330,8 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| project Month, ['Human Risk Score'] = HumanRiskScore\n| sort by Month asc", - "size": 1, + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| where isnotnull(HumanRiskScore) and isnotnull(MonthStart)\n| project MonthStart, ['Human Risk Score'] = HumanRiskScore\n| sort by MonthStart asc", + "size": 0, "title": "Human Risk Score Trends", "timeContext": { "durationMs": 0 @@ -317,18 +339,25 @@ "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", - "visualization": "columnchart", + "visualization": "linechart", "customWidth": "50", "chartSettings": { - "showLegend": true, - "xAxis": "Month" - } + "showLegend": false, + "xAxis": "MonthStart", + "yAxis": [ + "Human Risk Score" + ] + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q5", "customWidth": "50", "styleSettings": { - "margin": "4px", - "padding": "6px", + "margin": "8px", + "padding": "10px", "showBorder": true } }, @@ -337,7 +366,7 @@ "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| project Month, ['Risk Responses'] = coalesce(RiskResponses, 0)\n| sort by Month asc", - "size": 1, + "size": 0, "title": "Human Risk Score Trends - Risk Responses", "timeContext": { "durationMs": 0 @@ -348,15 +377,19 @@ "visualization": "columnchart", "customWidth": "50", "chartSettings": { - "showLegend": true, + "showLegend": false, "xAxis": "Month" - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q6", "customWidth": "50", "styleSettings": { - "margin": "4px", - "padding": "6px", + "margin": "8px", + "padding": "10px", "showBorder": true } }, @@ -364,8 +397,8 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| where isnotnull(AttackScore)\n| project Month, ['Attack Score'] = AttackScore\n| sort by Month asc", - "size": 1, + "query": "MimecastHumanRiskOrganization | where TimeGenerated {TimeRange} | where RecordType == 'Monthly' | summarize arg_max(TimeGenerated, *) by Month\n| where isnotnull(AttackScore) and isnotnull(MonthStart)\n| project MonthStart, ['Attack Score'] = AttackScore\n| sort by MonthStart asc", + "size": 0, "title": "Attack Score Trends", "timeContext": { "durationMs": 0 @@ -375,14 +408,21 @@ "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "linechart", "chartSettings": { - "showLegend": true, - "xAxis": "Month" - } + "showLegend": false, + "xAxis": "MonthStart", + "yAxis": [ + "Attack Score" + ] + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q12", "styleSettings": { - "margin": "4px", - "padding": "6px", + "margin": "8px", + "padding": "10px", "showBorder": true } } @@ -391,9 +431,9 @@ }, "name": "group-trends", "styleSettings": { - "margin": "8px", - "padding": "10px", - "showBorder": true + "margin": "10px", + "padding": "8px", + "showBorder": false } }, { @@ -405,7 +445,7 @@ { "type": 1, "content": { - "json": "## Highest Human Risks\nTop 10 individuals, departments or locations. Use the selector to switch views." + "json": "---\n## Highest Human Risks\nTop 10 individuals, departments or locations. Use the selector to switch views." }, "name": "h-highest", "styleSettings": { @@ -448,7 +488,7 @@ "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| project ['FULL NAME'] = coalesce(DisplayName, '-'), ['HUMAN RISK SCORE'] = HumanRiskScore, EMAIL = coalesce(EmailAddress, '-'), MANAGER = coalesce(ManagerName, '-'), DEPARTMENT = coalesce(Department, '-'), LOCATION = coalesce(Location, '-'), ['SIMULATED PHISHING'] = SimulatedPhishingScore, ['ACTUAL PHISHING'] = ActualPhishingScore, TRAINING = TrainingScore, MALWARE = MalwareScore, ['SENSITIVE DATA HANDLING'] = SensitiveDataHandlingScore, ['TENURE DURATION (MONTHS)'] = TenureMonths, ['ATTACK FACTOR'] = case(isempty(AttackFactor) or AttackFactor == 'notScored', 'Not Scored', AttackFactor == 'veryLow', 'Very Low', AttackFactor == 'low', 'Low', AttackFactor == 'medium', 'Medium', AttackFactor == 'high', 'High', AttackFactor == 'veryHigh', 'Very High', 'Not Scored')\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", - "size": 0, + "size": 3, "title": "Individuals Highest Human Risks", "timeContext": { "durationMs": 0 @@ -576,7 +616,11 @@ } ], "rowLimit": 10000 - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q8", "conditionalVisibilities": [ @@ -592,8 +636,9 @@ "value": "individuals" }, "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } }, { @@ -601,7 +646,7 @@ "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Grp = iff(isempty(Department), 'Not Provided', Department)\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by DEPARTMENT = Grp\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", - "size": 0, + "size": 3, "title": "Departments Highest Human Risks", "timeContext": { "durationMs": 0 @@ -678,7 +723,11 @@ } ], "rowLimit": 10000 - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q9", "conditionalVisibilities": [ @@ -694,8 +743,9 @@ "value": "department" }, "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } }, { @@ -703,7 +753,7 @@ "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskIndividuals | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by IndividualId | where isnotnull(HumanRiskScore)\n| extend Grp = iff(isempty(Location), 'Not Provided', Location)\n| summarize ['# OF INDIVIDUALS'] = count(), ['HUMAN RISK SCORE'] = round(avg(HumanRiskScore), 1), ['SIMULATED PHISHING'] = round(avg(SimulatedPhishingScore), 1), ['ACTUAL PHISHING'] = round(avg(ActualPhishingScore), 1), TRAINING = round(avg(TrainingScore), 1), MALWARE = round(avg(MalwareScore), 1), ['SENSITIVE DATA HANDLING'] = round(avg(SensitiveDataHandlingScore), 1) by LOCATION = Grp\n| top 10 by ['HUMAN RISK SCORE'] desc\n| serialize ['S.NO'] = row_number()\n| project-reorder ['S.NO']", - "size": 0, + "size": 3, "title": "Locations Highest Human Risks", "timeContext": { "durationMs": 0 @@ -780,7 +830,11 @@ } ], "rowLimit": 10000 - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q10", "conditionalVisibilities": [ @@ -796,8 +850,9 @@ "value": "locations" }, "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } } ], @@ -805,9 +860,9 @@ }, "name": "group-highest", "styleSettings": { - "margin": "8px", - "padding": "10px", - "showBorder": true + "margin": "10px", + "padding": "8px", + "showBorder": false } }, { @@ -819,7 +874,7 @@ { "type": 1, "content": { - "json": "## Human Risk Behaviors" + "json": "---\n## Human Risk Behaviors" }, "name": "h-behaviors", "styleSettings": { @@ -827,25 +882,13 @@ "showBorder": false } }, - { - "type": 1, - "content": { - "json": "Click a row to see its event breakdown.", - "style": "info" - }, - "name": "h-behaviors-info", - "styleSettings": { - "margin": "4px", - "showBorder": false - } - }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\n| project STAGE = BehaviorName, ['HUMAN RISK FACTOR'] = FactorLabel, ['HUMAN RISK SCORE'] = Score, ['TOTAL EVENTS'] = EventCount\n| sort by ['TOTAL EVENTS'] desc", - "size": 0, - "title": "Human Risk Behaviors (click a row to see event breakdown)", + "size": 3, + "title": "Human Risk Behaviors", "timeContext": { "durationMs": 0 }, @@ -982,38 +1025,28 @@ }, "exportFieldName": "STAGE", "exportDefaultValue": "none", - "exportParameterName": "selected_behavior" + "exportParameterName": "selected_behavior", + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q13", "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } }, { - "type": 11, + "type": 1, "content": { - "version": "LinkItem/1.0", - "style": "paragraph", - "links": [ - { - "id": "73895154-b0e3-4cff-9156-adb5d1b1914f", - "cellValue": "selected_behavior", - "linkTarget": "parameter", - "linkLabel": "Clear Selection", - "subTarget": "none", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "selected_behavior", - "comparison": "isNotEqualTo", - "value": "none" + "json": "Click a row in the table above to see its event breakdown.", + "style": "info" }, - "name": "q14", + "name": "h-behaviors-info", "styleSettings": { - "margin": "4px", + "margin": "8px", "showBorder": false } }, @@ -1022,7 +1055,7 @@ "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskBehaviors | where TimeGenerated {TimeRange} | summarize arg_max(TimeGenerated, *) by BehaviorType\n| where BehaviorName == '{selected_behavior}'\n| extend k = bag_keys(Events) | mv-expand k to typeof(string)\n| project ['EVENT TYPE'] = k, COUNT = toint(Events[k])\n| where isnotnull(COUNT)\n| sort by COUNT desc", - "size": 0, + "size": 3, "title": "Event Breakdown for {selected_behavior}", "timeContext": { "durationMs": 0 @@ -1106,7 +1139,11 @@ } ], "rowLimit": 10000 - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q15", "conditionalVisibilities": [ @@ -1122,8 +1159,9 @@ "value": "none" }, "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } } ], @@ -1131,9 +1169,9 @@ }, "name": "group-behaviors", "styleSettings": { - "margin": "8px", - "padding": "10px", - "showBorder": true + "margin": "10px", + "padding": "8px", + "showBorder": false } }, { @@ -1145,7 +1183,7 @@ { "type": 1, "content": { - "json": "## Organization Attacks" + "json": "---\n## Organization Attacks" }, "name": "h-attacks", "styleSettings": { @@ -1153,25 +1191,13 @@ "showBorder": false } }, - { - "type": 1, - "content": { - "json": "Click a row to see its event breakdown.", - "style": "info" - }, - "name": "h-attacks-info", - "styleSettings": { - "margin": "4px", - "showBorder": false - } - }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\n| project ATTACKTYPE = AttackTypeName, ['ATTACK FACTOR'] = AttackTypeFactorLabel, ['ATTACK SCORE'] = AttackTypeScore, ['TOTAL EVENTS'] = AttackTypeTotal\n| sort by ['TOTAL EVENTS'] desc", - "size": 0, - "title": "Organization Attacks (click a row to see event breakdown)", + "size": 3, + "title": "Organization Attacks", "timeContext": { "durationMs": 0 }, @@ -1308,38 +1334,28 @@ }, "exportFieldName": "ATTACKTYPE", "exportDefaultValue": "none", - "exportParameterName": "selected_attack" + "exportParameterName": "selected_attack", + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q16", "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } }, { - "type": 11, + "type": 1, "content": { - "version": "LinkItem/1.0", - "style": "paragraph", - "links": [ - { - "id": "23876233-22fb-4871-9841-83a1a9ccc975", - "cellValue": "selected_attack", - "linkTarget": "parameter", - "linkLabel": "Clear Selection", - "subTarget": "none", - "style": "link" - } - ] - }, - "conditionalVisibility": { - "parameterName": "selected_attack", - "comparison": "isNotEqualTo", - "value": "none" + "json": "Click a row in the table above to see its event breakdown.", + "style": "info" }, - "name": "q17", + "name": "h-attacks-info", "styleSettings": { - "margin": "4px", + "margin": "8px", "showBorder": false } }, @@ -1348,7 +1364,7 @@ "content": { "version": "KqlItem/1.0", "query": "MimecastHumanRiskAttacks | where TimeGenerated {TimeRange} | where isnotempty(AttackType) | summarize arg_max(TimeGenerated, *) by AttackType\n| where AttackTypeName == '{selected_attack}'\n| extend k = bag_keys(AttackTypeEvents) | mv-expand k to typeof(string)\n| project ['EVENT TYPE'] = k, COUNT = toint(AttackTypeEvents[k])\n| where isnotnull(COUNT)\n| sort by COUNT desc", - "size": 0, + "size": 3, "title": "Event Breakdown for {selected_attack}", "timeContext": { "durationMs": 0 @@ -1432,7 +1448,11 @@ } ], "rowLimit": 10000 - } + }, + "showRefreshButton": true, + "showExportToExcel": true, + "exportToExcelOptions": "visible", + "showAnalytics": true }, "name": "q18", "conditionalVisibilities": [ @@ -1448,8 +1468,9 @@ "value": "none" }, "styleSettings": { - "margin": "4px", - "showBorder": false + "margin": "8px", + "showBorder": true, + "padding": "6px" } } ], @@ -1457,9 +1478,9 @@ }, "name": "group-attacks", "styleSettings": { - "margin": "8px", - "padding": "10px", - "showBorder": true + "margin": "10px", + "padding": "8px", + "showBorder": false } }, { @@ -1469,7 +1490,7 @@ }, "name": "h-footer", "styleSettings": { - "margin": "6px", + "margin": "10px", "showBorder": false } } @@ -1478,8 +1499,8 @@ }, "name": "group-main", "styleSettings": { - "margin": "6px", - "padding": "12px", + "margin": "8px", + "padding": "16px", "showBorder": true } }