From 9c7a85337109a883fbf83420dbf0431f67e04b82 Mon Sep 17 00:00:00 2001 From: mht-gthb Date: Fri, 30 Oct 2026 14:31:13 +0530 Subject: [PATCH] Update ProofpointPOD analytic rules, hunting queries and workbook metadata to reference CCF connector ProofpointCCPDefinition DASH-23412: Related content on the PoD CCF data connector page shows 0 workbooks, queries and analytics rule templates because content still references the legacy ProofpointPOD connector. Solution version bumped to 3.1.5 and repackaged. --- .../ProofpointPODBinaryInAttachment.yaml | 6 +- ...ointPODDataExfiltrationToPrivateEmail.yaml | 6 +- .../ProofpointPODEmailSenderIPinTIList.yaml | 6 +- .../ProofpointPODEmailSenderInTIList.yaml | 6 +- .../ProofpointPODHighRiskNotDiscarded.yaml | 6 +- ...pleArchivedAttachmentsToSameRecipient.yaml | 6 +- ...PODMultipleLargeEmailsToSameRecipient.yaml | 6 +- ...ipleProtectedEmailsToUnknownRecipient.yaml | 6 +- .../ProofpointPODSuspiciousAttachment.yaml | 6 +- .../ProofpointPODWeakCiphers.yaml | 6 +- .../Data/Solution_ProofPointPOD.json | 2 +- .../ProofpointPODHighScoreAdultValue.yaml | 4 +- .../ProofpointPODHighScoreMalwareValue.yaml | 4 +- .../ProofpointPODHighScorePhishValue.yaml | 4 +- .../ProofpointPODHighScoreSpamValue.yaml | 4 +- .../ProofpointPODHighScoreSuspectValue.yaml | 4 +- .../ProofpointPODLargeOutboundEmails.yaml | 4 +- ...tPODRecipientsHighNumberDiscardReject.yaml | 4 +- ...ecipientsLargeNumberOfCorruptedEmails.yaml | 4 +- ...ODSendersLargeNumberOfCorruptedEmails.yaml | 4 +- ...ntPODSuspiciousFileTypesInAttachments.yaml | 4 +- .../Package/3.1.5.zip | Bin 0 -> 28488 bytes .../Package/createUiDefinition.json | 20 +-- .../Package/mainTemplate.json | 168 +++++++++--------- .../ReleaseNotes.md | 1 + Workbooks/WorkbooksMetadata.json | 2 +- 26 files changed, 147 insertions(+), 146 deletions(-) create mode 100644 Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml index b3506047d11..98bf69a24f1 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODBinaryInAttachment.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -35,5 +35,5 @@ entityMappings: columnName: Name - identifier: UPNSuffix columnName: UPNSuffix -version: 1.0.3 +version: 1.0.4 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml index 976ba240294..d878685859e 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODDataExfiltrationToPrivateEmail.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -36,5 +36,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml index fec7eb6a62e..34f389a210b 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderIPinTIList.yaml @@ -10,9 +10,9 @@ requiredDataConnectors: - connectorId: ThreatIntelligenceTaxii dataTypes: - ThreatIntelligenceIndicator - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_maillog_CL + - ProofpointPODMailLog_CL queryFrequency: 1d queryPeriod: 14d triggerOperator: gt @@ -56,5 +56,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: ClientIP -version: 1.1.1 +version: 1.1.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml index 022167e6d7c..3ad83afa9ba 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODEmailSenderInTIList.yaml @@ -10,9 +10,9 @@ requiredDataConnectors: - connectorId: ThreatIntelligenceTaxii dataTypes: - ThreatIntelligenceIndicator - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_maillog_CL + - ProofpointPODMailLog_CL queryFrequency: 1d queryPeriod: 14d triggerOperator: gt @@ -48,5 +48,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: ClientEmail -version: 1.1.2 +version: 1.1.3 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml index df36e5a496a..13e9936b65f 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODHighRiskNotDiscarded.yaml @@ -5,9 +5,9 @@ description: | severity: Low status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -31,5 +31,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml index be5f6b026cd..05bb61c8bb1 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleArchivedAttachmentsToSameRecipient.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -34,5 +34,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml index a82899218e3..d41e5e6a82e 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleLargeEmailsToSameRecipient.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -33,5 +33,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.1 +version: 1.0.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml index 95adc94ac0e..021041e6ffb 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODMultipleProtectedEmailsToUnknownRecipient.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 30m queryPeriod: 30m triggerOperator: gt @@ -45,5 +45,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.1.1 +version: 1.1.2 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml index 5254e098fdf..84f85adba15 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODSuspiciousAttachment.yaml @@ -5,9 +5,9 @@ description: | severity: Medium status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 10m queryPeriod: 10m triggerOperator: gt @@ -32,5 +32,5 @@ entityMappings: fieldMappings: - identifier: FullName columnName: AccountCustomEntity -version: 1.0.2 +version: 1.0.3 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml index cd6574d0ed2..6545bc19f4c 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Analytic Rules/ProofpointPODWeakCiphers.yaml @@ -5,9 +5,9 @@ description: | severity: Low status: Available requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL queryFrequency: 1h queryPeriod: 1h triggerOperator: gt @@ -28,5 +28,5 @@ entityMappings: fieldMappings: - identifier: Address columnName: IPCustomEntity -version: 1.0.3 +version: 1.0.4 kind: Scheduled diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json b/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json index 340b494dae7..2d429aac0e2 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json +++ b/Solutions/Proofpoint On demand(POD) Email Security/Data/Solution_ProofPointPOD.json @@ -37,7 +37,7 @@ "Data Connectors/ProofPointEmailSecurity_CCP/ProofpointPOD_Definaton.json" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\solutions\\Proofpoint On demand(POD) Email Security", - "Version": "3.1.4", + "Version": "3.1.5", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml index 4cc486dd3a3..71e95bbaaa0 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreAdultValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'adult' filter classifier value description: | 'Search for emails with high score of 'adult' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml index 60d6724bf56..e69f68fce82 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreMalwareValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'malware' filter classifier valu description: | 'Search for emails with high score of 'malware' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml index 4c0495bb39d..2553c46835b 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScorePhishValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'phish' filter classifier value description: | 'Search for emails with high score of 'phish' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml index 6a1953eb3b3..de2f0ca8284 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSpamValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'spam' filter classifier value description: | 'Search for emails with high score of 'spam' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml index ce1534af839..edf75cf7239 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODHighScoreSuspectValue.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Emails with high score of 'suspect' filter classifier valu description: | 'Search for emails with high score of 'suspect' filter classifier value.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml index ae750bf286e..0b0f78bc70c 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODLargeOutboundEmails.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Large size outbound emails description: | 'Search for emails which size is 2 times grater than average size of outbound email for user.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - Exfiltration query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml index 5906295a920..04c96f59489 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsHighNumberDiscardReject.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Recipients with high number of discarded or rejected email description: | 'Search for recipients with high number of discarded or rejected emails.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml index bbafa6cadf3..49afe65554e 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODRecipientsLargeNumberOfCorruptedEmails.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Recipients with large number of corrupted emails description: | 'Search for recipients with large number of corrupted emails.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml index a3290537e63..3d123e19bbc 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSendersLargeNumberOfCorruptedEmails.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Senders with large number of corrupted messages description: | 'Search for senders with large number of corrupted messages.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml index 2f9b918e65d..b4977e521ed 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml +++ b/Solutions/Proofpoint On demand(POD) Email Security/Hunting Queries/ProofpointPODSuspiciousFileTypesInAttachments.yaml @@ -3,9 +3,9 @@ name: ProofpointPOD - Suspicious file types in attachments description: | 'Hunting for suspicious file types in attachments.' requiredDataConnectors: - - connectorId: ProofpointPOD + - connectorId: ProofpointCCPDefinition dataTypes: - - ProofpointPOD_message_CL + - ProofpointPODMessage_CL tactics: - InitialAccess query: | diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip b/Solutions/Proofpoint On demand(POD) Email Security/Package/3.1.5.zip new file mode 100644 index 0000000000000000000000000000000000000000..7bb355fde1a6c8f6d701934a2eb65d5094a9a0e5 GIT binary patch literal 28488 zcmZU)b8se6*RLIOV%whRj&0kvor#@^tvj|gv2EM7olNZHo9B7ouj-sS{YO{#+H0@9 zx~r@A{#~`Uq6|0$ItT~|49L5io*wAK651C$2*{WW2ng0ctBI4Dk&Bs{m8hAymA#dV zm4iKlwX=i$mhPE79vA9YZYlMHz2Vrb5nW4Ny3p|SB!naTx+Y6sKO)$lj>ReF%*%LN zI%)P^{t5nd{;`79(xPSp3v#Usf#$(ur4bG2C|ln)=-tny7nI>i9uUTQc4p{LzvcO; zbW@UHYP&dJdA27XjFTBz|C*K^JQuVWEd0_>k(kMShniT&eu@^|vF!_0%`flG_W|lx ztQrv+FNS>jQ$`RBsTFoSMVn zup@VnxJ>sCmW2R!5H!jkZjsO?=B)+@u6Cff2KR%QO$Gl$pLJIO;qTYA`Vrcgo$5Nw)|?80f(B#TKC$itjUxB)UI>Bx)1Gcl+% zbxt6xEB@b~L>?D|9M8z|JI3rB^k&;FaPlk+j22VYgMmGXK7a)x>tf1?{rPR8%dUiH zXm8MAS*T}dg)oQMYowg5f5vDWtbb;z)6$F$ErHTrl-Z~t_5^s*8*1Sg3oYa9k`w8gu8_mM{Eka%BTxUT7cbVjy&M`!UyV+$%pDzz}&*}%X!dF zL8}-%3$l7caNYSg+$6;G!`$?HNQ*aFFjIebcmG6CYvw{&ItKAm31wIeC)Rk}A26@1 z{V})+%hF%;JQCnPz+@Gns6TP)*c~vN*$qaNELEfPC>Li8*;1B8?8z1(S6j*Xc$~|H zrrOF|U38|gN~8)Jui$^ApPnH8k*Vr$lcQ|MbhUl6V@lD208(mkTe6ndHlo6VoiL`4 zVu=5sMW7YB3Lb%Y8P{~)4c?P|Z4`P9qZJGo?#&0H`c|-h$nrb=d3Xi(p%=D?g$*Ey z^j(Uct)_2ZU!#!ZXAQ>VKJnCc@R+U}UcK`a&x}ZCYtS>2qp?i*dSt>)W;~aDt|Y0$ z?-9{h>+|Lf$;TyF!7}6E;Z-cM=XpiAm4^54Z~SG{%qez}(m-O^63hE&j-vCVW;$yn zg#SYfx@*NsyTp&!)V?c(`CHzGAdhfk8(o^UWqeaXe36GX{SguXWEPKy1{3ynS|$QM-7I z^eCElbV6Yh*}Mz9mb+@ospd-{w?Uc;j(Bk%Zp@f;7=Dhh$3tV@pm2B^b)|4#IAUiT zo}fqaB_F6x$IKx~!@MurdE#>r3_l)f$XgL?+ABT@hRS$oEt%usyxez-2nG3u8T7W; z4NR9Q7*h~QO*=~w#91$6qiR?0khpB(@xFR~#9{T5om+*H6^#Tk-=wA%a{cgvZAj3W z)|j_wR%_{1?-&W1mPdHpv8EQN4|cy7y?Zrus9o9eUfXos5o%XgUNlq` z324Ll5xo>GV}mOP5ww#onLy}O$}FRe1EG`7+~{@;+Ou%2r}&I`___Y~13C{shZRWGB3Vrs=`q zB9n}UOo48O_Js3}E-+o>BCw%Ewp=#A>#ss`;7k#`C|x?But_os5708N=>6B&SjnI{ z`2u+Wjj$x?WRzIpxdCA+kaxI2n-af-*Kpq5(=H`cHJz2BvdfF93V$E0zXyd-ukYyf zOM6d~ zpJCrS3U=8w!IC*76Ny1aL5`b$nrD*hR`lRT_HUl#PUirsUU2)d>6}bb-TgppQf0A; z0pp`Y%;44}S~9EMDs(ypk*eZ6z;4}If*Q5u3K7S>OP3N%_jn2S;-%3GsvA|S%yqf- z@JF>P=rF*Jgl#A>FrE#^o#K~;tB%Ps9kXtxvQ|)pz5d=QFwD)|2mHP(0J&$2KF3ro zedw#0_!vy3g_(&ywrg-cWz3$kYiz$834CSOaQe+pi=7HftS28%L$zG@HB82!$i6|! zx1P@ogc)~0c(TAE4lY)alV+3yuNu7=LAEXCw^XmfX=#dqB9w7KoiR5E+7U)+_<6W0 za)ATC%xYRx)^8u0+Kkt-+mnEa_2bJ98wuS(ch;LP_$MD!LW< zwYgGJ(b;n0sLxP+9=waR6~S( z+=_joofxmW?*QnTFlm+KmczRs9_m*`fhlb(YMS8gSVe%3GlbqtgiMKrs)7?9lsWx9 zS$*{qL=rGy1D0AsJ{zh8W&DFxq%iISENF5h&gPOu#pHXY?F6sPt(JWWG5MERq%C}K zZrLhOZH78bj=hCShE-H)h6#NrOxml$FpHloi0q zc^@ae9iy-mM8gv69pi7>!Cp)!)e4YNci%}{C#sgay6zSiwpVyha1KwtX9=m}+)NFv z)28O#1fw1dLB^-lEgYV-VwENqi8181P1zWBytVvn9c`V2YyjouT^Hw7J!k)5(T|FY zIs3kSd(1Tu>&pubP&LPLUWN!5*?3N?2t7L{?&&P01-XCr!DA7Q1W?X!zsaSPuc zuhLOsEqNerEoNXC@Z4WDIKil_J9ldya^hLgT=|xT2F>NVqMq$~ZjXwii+?sPqGGjG z9KBw(JB-Tu(T4jFD0*W^!hPb{q;{CGYJO2c-cxCpuB%5uS6&8tSxb!JM#Y%(n=y^q zr(Y?kBfSY%fOF*Vszk5(tjV#dPs zg)R8~-e2r`n=RE9+_^O+?=6((>Xbe^Lq>DsaaMa|-yl2j9oPNVi5G82ycZc#`vQc5 zn?Cl!8*8IYvrE2Cgv<2cA-v%20lU!cB*2%I&B}Nwr=ceA~DlVw-V*lC}U)O~S%}czc%FuS_XJtTHW{w6Q?jOVrdjFXsVIm&*a>_LPAg(G6@l@kr-8*Rmzz~&NrzVH|y>;0`z;?@~!O6kJ&ZpEI6|h zdpqxcJfQ_jWYdg;y)`;DyUA0x@p8SXwz@R*|0?>Ic7A2zY+KzHtKBGdy(sA6E|2^7 z{w{ib++Oki23P#QB*O@i5>VC{1f=8}90cW`WUw=`vR5^;bF}>@9R4d7uDU+mHaP1U z-~0t2o6XI~rcup&wd&^+yAzu`N`1M{JdB?wyE&%kLnS5m(@2*fjs~|9JFXkDBzP2@ zu=phd$w2~vwrhwD&l&Qfd5YBNa3MsBAp+f?dAAm}jI*fh`hmlwk?Jo;b13h{UBUcW zg%o#%>>s`a1*UiYF3qgw)ef}E*RT%3KIWxqmks3BNJ8+u8B<`V#r0Hn$Lh70mOhhlMcI|B2qD2MZBvwG}!G99wg?}K18yE6Hd>6nu~PH<&$GHS0ZXy zW>(J6b@oSf*JrSYHa2UwcRi6N$i^Z_yb?{Ud7!d1s| z86SF7yFpkZA7l?RQVqqpd~3mXLg$3;`7%`KVL=wmf13F6iZLM%8ZPi=8qucZAFzkY4nf(C3E z4+Pdz*bO3%9>J}d2DcX^V97Zfdt`=H9V?BC^XkI#OsQ+xT`VkGH!pX;Z{XJ9xDfy4 zO8_v`GSI{m(c(nNuFx>vptWHRcFMjz+lL6ZQwlMj8P_u*C(yOi?4|O!VHxdKUIp7R zRKaZLMPrM)+7P&hZ)Q{-ms%x$K{DOy0d9Zcj-NMLSDHr)rVnb-p{5UK^nP~LAiu+&@>pCwMyVPLOWn|&V%bf$4jeK@#=7`yY0X0$tZCfi%zCo8@JEK|O zNS+Z3h1_2rQqmB>hK=yP?6H2Pv%qlqY+>mLxOAB$-`GermGd$rU-OGFeIEuEQy7hK z5l-8V2v0XUAcQtlLy}zTY~`?A{@B|!WoKDj`^q7=nFl8uLzE`xVM_T)Zxv_J@a4E! zS5kNoz*ak=XX6FH*9I?TIgeJrU&TR~B4S3|Kx9swHU2~vgB@%_bSX`JALMP8XM~+T$`1xKk$8pg5qNW z+P0`PtDUCZU|7!0HM-AdBjm9Kn^+>e9sGM1g2_s)69_r)AT0-W0vvlxZf{_<6c+h> z2!4`Z&r`f95vAYs%>YE06=}-E^}wu)2jJ>yc=@)Hryi=|AfGK8fneg-?Cv0!_`r2t zUJEI~r+yc4^9msxnKC0GYQ30425atGUKIYN85K;_hD(FIY4cS*${L(t;NCEZveRE7 z4<4%j$^k_2_pSN}2UaQ5F*N7$iW!zv2CGA5M;G5&wHDRnKZE}k+c_|=gO6fsQQCz=$mY$g zT}DQpz~hIv$_Q@Uu!@c2JWt(jD^G(LSqF3+Pf+5TWy$cwS1q2uPM8F8y$n^$6>5j_T z_3i%#A-s`tpW-&E?ihJr(JN$7Ywj38-8u?4Y0-7J8e5ZU;lM@mUbb8$(h1UUvFQWF z*ZKSf9cx$`G^|&=MPOgkK{0wdk8}HCb!0DqU#UtF2hxnnQG1$@4VXBDj)qkNHm?g%WuklzM+I zS+bH&uOpbn#bpSQN(ol$2rf){1(yxi1?mi;-RQk%U56WP9XYY-nCla-Tvv+zh2UFD zyv}g#*L7ETs_78d`xBiIBjb{qE8{Zp?|rNZgl5mRLRZ;4a5h7IGSuhsUF(pAdmSXk zvN$es4tRKPu~}_vx{r9z>ov%yU0i#7x7#dI^jR=9bgU&3t?h}9tR5Uu2~Zu(t)4yq zWWAiJ?6aJ$E9sh!uSEKkA0d2$w0m>0uqgr}CmoakB9McFg;V$&O-St{nOk50~PZM3fF`{WOoOSd#3ONNZNa zPuP};ptj}KCEVmSlA{~mY$$X4H5}e=fd>{}3ak^Cu@8EEPuMW}R_{^`d$S!8?iK}0 z%~%amrOhb>cID#X?Pu(~cF5_nSnfQKH%A&5UXiID$N6XQEE~V%5=}(?#G>;o+$*Br z2~~ZbfWKfa*&$lW0&!4~97BZ-*bi;N7TKW;=qo(VQWw>O+|YGjS;nBSKDdwsItb`7 z;{?F-fDpbR2!GogX$(=9nF+M0j8p`D{>4Zk(CYXr$Tra}vagw_ks0Z1mW9i#K)1)V z+ibt0J~xtu`il%sh`BH_KmaF4nkw)owRl%k27H5_;#y6r~?%<~K9LP!>m?KstOTt6|Qc*q-WIe(A0@cm|bfu-M>EO*-aNMI0 zKORmdm^oei_umC54frH$9uA{4(YMev8i5DUx9CgP!)?-C!Ok=&CKnKWh+G&eRCydy zR2_*gvjL2(c0!Ba9FPUb>*1e%BOWk59B|=}4kKvnUx{-JTM+WaC;Q3JH~V>={eq>p z<@G|8O77Gy`6pkoSuE_LF#^?iK7R~2^z{?Ntwqc5T{p5X#4pzB{lO{XE?t2PUu>dzbo$q&{d8SfJup#iE6oLa@0^ zZAo4{V+uh&TA$AL<%|VK zyrhSL&f*A@HpbSg-`c-|kLFPKVL~Ks0a0Y(*3^KZ*c5JJf; zv!f;cE$F=f8PoV4#v9RDF}!i1qx04pjv0!bfqVEUvDGRQ89qMXrK5#A!CcvyV-67* zoKYuuCVqSvW0Y!IFXs^Vf6(f2<+5a#)WWN0Pb`Dj(E?D0+b-MEpa?81bMcX?nCl6g zoCKQkz~ksoqeE3z1+J%K=j;bv9*>pjqDBYW5HDT`b6nm;7VGFOMJy5Iv$`Qk&NUD0 z-8TtHyjO|1I`-b_TYjfr9HEA~qfVPR^Y$4h@ZJ-#s008=%3$JEMYdC8$~VpmilL zd~bGFq2a7VAvU6t&gI{~wj7ry%Y9^4d9QPRa6imo$seMMnVyjleYe`z+Wr`n%R9h) z{wY#8b8+HNMCW&tL(TsX_6Ij8V1FWSN5zK==g+x|1Rn-;*Fjz6b}ftI()km&3C2a2 zkcJe%O72b$KkcJs&T=s0!sm6h-CnTXIvXfvI0l^+TP(vdG&m_U%$I;z96ueGeBn76 z{VjgO&r)^XSdBK4^zE`G37#M1lDm)jOk=xM2fmY^>2>9J4{doao{#m3%MPl2jr#Ul>~IyZ>rxQHG*NS5fHUi1<1&dYmbtN%)f3k zUep?~b!0aw>am!j-O6E|*q96kSkC(f@2)XJL~D7JP>{rkM}$QmjDeQcq$wI=uEyy+ zKorOt{eX)L(TOpG07ZrhnQ|wed^76pT@cZ5ImuEGGR&Id8zWH~KX2bF1A}+z;Zl9W z9b&2@yw3LSr}+-DaW*AB<<<*oyBYGqXS(ZEJM)m zn|Wxu4$$eMXl#1XKAf;B+7iOux(;tF#gBO*Y)J=Q#?T;NTRTJT1`FMoqz4COFKF<5YlV#HX-6XNr<1mMyjiV-gu9xuvMVcbD+iL7cZ|^z`bANCNy{``>j3iw) zYmEi#=Fwp+rT$33v^ZMsmibyHXsX5wkTir9=$LrCo6ml~o@~k|%5HP!C`ePLd;Ktx zly?RbcwK(K3t<(F)$c|U4!h$FA{0MkqWHmQZ($qnJX~fD3jc5od%gPEUe0WOI2^l} zWaft2GkC%!-&ZMj^E=wykGq8DcOyPAB=buI?IgJDTJk$<=l9ny^}TxFkgUFf+T%79 z;@RLDYAE~rkf#FuyM3dglzvsbg@ZwlK#T$(2%R2XkvvKHU~4a`C*QA-PTjsEwbSVn zYSHO(Xl6Hy>i($>RXPm2GPQeJ&43lZLttc+`8X?!zdcr^u_qtt(B@uAG&;*>Cbk@0 zH_0!@2RiY+8akp*Fs0qiSI4t;Xp6BKpYQt4rr8sW$;DNtP*Knxk_=^Dh;LA(TClCy z#jYFl<56$Z4!Tsro>^}}c=v7)mv>Of9-^D{4e+T5RsJ|5?zD1pM7wlpeM$i=RX`O< z%k$aufZkc9VEvzIebQXr-p_MamV|*%J=6e}MS>U$J)6^2s%4N^iRHy>*UE!4*x>0) z?ASf^RMGa0O;i+n*~L`RoL!0pxMv}l_C$R&nHubf=Puh07TkwYkqU3XwN8-MPM!Q^ zf*io#O?;%muau>cV|EFG1xu}|RB_3>T*F8ZKa;ffn`pN+jhBMtQ@!@`6)@SY zvKpaz00tYL{)1w{4#kJtq(#cO_k5xnq0!OZnW-uJpVo>o|LkUSgfg*N=i{%Nb#VdU z_RZA_;5jg@P8LOyZB4EI-9#8L@jlE8Fp(P>@wJ)75rSW*(zCIBHZS9F#<%E%MT?j* z8i(dSi?tZ(s$L>W)VwE*V3QE}Ck2e$7bO;^J-9bTv2AeQ%Z~P?wied!fXjuU^c@DG z9fl#{{AA?#FBr#8Q9R1K7?SdOem{cD;EOuIZa36s!E`AGb6*wcyP-2XV>jq7#{i*p z3vrm#j!V+%k{MG?b70)=iCljk=Av5*O&jwrOlY?SR^u4UNqzEpMEBuJ^=4A!{bn@6 z#eihfei(33AL!FY-;#bPV*+`N;Yf%M$eh=QzBgN7l=ri)P8Z_H;yXJ-_7=e@0%Yt; zjX^T$Kl)Dz1c=W7?#88qPnIs#;T!D@Hng`=6m0@=K0KW|C>ytm(EYOTGq?Z#NhEez zN)+}gfJ9jbr!t1DAuLu&Y@vDOYe7x)p>=;^BM=cQ#nLnV!CRYkwPe9lyC7(^foX1u z)oIrV{riK`?J=4j7sN)@H)0=R1mu03Kke`EULc~Uuvfc1;49GN5Vy$}@6-^`ZEg=( z7;JW1H&fTP8mEwBwlk+5)DAu>*+m?}4bRw*8-2Q(lG-V)^bxs~up*w~D`d{hihwf9 zBnh2uU1hD63#qQ0#s8dm#~wvNidWOYVM}K&sTc0(mm4qzWQn5^-tu0iC|aWpMFm;j zjbg(W;2npy6rGsqLo4pxS1o7Y+*gN>G*(MoAomhn|JVT?-$*aRyeKm1%&HJ>UW&9jFh$@?@Fu`dQun^r$&s<*!l2$W5S3U_^Pc9br<^}FNDoldWjrvF!a|j+&BiO*roJ8 z4@jv0l*-joPNCa+1-h`NbQIy|_ST$M#O>U@@Ci-c_{h*6J0u1N-6TLqm@*hPjw152 z5$u3<<^bx0>Dc3foeb6s*riIo;X+w`b7*^VNbB@7Y-=@LjZ-oeMys(dBq9(hfs^qo z=EDlyGr>;>Sr({pfh1$mc*suqM^Fm#VrJzmYjlZ+$r-jDgV@!DV#t5I)DBx9r+qu< zPonfWelm&qvmHa%XqX26!H(1wO`~X`ASDVZQD)!IFrRAV1oxMrC(_D4Qj_ARXGSYk zwD4RRwjTsKuJ<`fu|K*?yo}1i#To)s3k<(72|9)^45kn9*Yoibf`dbRGH!`*&i1n= zHKSlT<`Ne;=EYg=_o8(sje9VBchYFgdx?-#>KB(Ncqwc`1DVHah@#$#o?E*UmN42k zHR~o@1u77;G?C0Ywcmq0zy7PFE{ifSmIal?3 z%4^k)uj!Bn{)b|Jai%gs9MOp8T-V#M`joYn?p5H=llJ^2}^lp_%u?n zF-P4v%>KI=dEZ=|5dObya#fGQ#yy(9KA$@@4snADzRoh$J27&zx)b!yperzPR;yY1 z!dwcoa!TZw#O(1pzg&ZwvJL-S=I-ZC9O>}7XKP$;TJ2BIT3|`MtCb5&k}8=e$MpJr?LTo?E@djXS67xhVDzlI)K0B0K3jr#J*cYQ(*5Qy#14f<65N-~cUT|K#-?l5 zwJNG78Rvccu}D5>;e;W&z=_F3<(VwY)6$~Xlf(Rb4}bOz!IN8rO*Kq(nQ=LpjTQqMjIj&w>_Bqm1H8=0}ddmZXl zNs{*`j#lyuRM7(Soa=&N>%|zC(O1#|%q5JN2_n8Op`?J2Be+1avIZ`zqAuMo7jV=a z+=EovqYR}2EmhKQ(QdThnn4-JLk}taw3{g42YI zY^YPfO6AV{kX8c-orcEaez`X8R4V_1nQQ}fxjOz*WPuj5%S6ENVk-8X@`SFj(<4;V zrna?RendG7s|9zE+8VZ%om?Ap+f$Fv#C4oB!K?ohoDQfsKqcdJ1@HV!M$fg~Q4G1$ z*kM9;^y>wL(S${;^JxEh32p=uRiaXp_RA&BCM^>@LyNRqzOU6%Wkr}ZVNx($%p`W* zEuTC)dcJ<~0$nB-Ed!OP$FR_3fb<}R>uGI%aCvkbRf1m!h)blUblz$)@g>4gy;D!B zm_}7+Zr-{+>1jV9M$Tqr-smKPhR1alzQDLPZ?T$+;aZzZ?~c-5?^H26m15$iq@Khz z-}cL>M420KnW)Lno{MV-B_Yu(F-qc|o}QVZjwSb#La6H~O>mz$ik^_b48g(ZyjjIx z^D@ma+H6w!nS&)?`Ti#X!ufS1h7+a^KdTVB>0q`TYa*Te=2~E_SRq5^;9>+h5xldO z`HdO6F#@kzFzgNc(?hL>2dd>ym@(|r;BPw`ty~!c{h!(ydP8#^GjCN9u-!-=wGcsru&XT zuVAjk{o9pU=h+{x*mF_!FR8nHZ=&{6SqB`4Buyo+0flIBQ>xg@g@=S4(zeDGvG_NA0bD9_jG3I@or_%(+QD_ zMnJ z4U_5ZSuuf>lM#4{OA}-Y?e&JL2WsS%#ACWJDSI$0fCyezr<>o^25R$7TAf=+OZIYz*|;x*z9yK-2im9($rDLuWU2?bejT;DbO zd=eMS4xjhKey@4Q{iXf;>lL{w%h73rj4~&M!)o_i$fy=(nIv1j7~x}DropPHnDJ0h z4d^-#(AG}9utJ``^?nTzlmF2mocOUdl(g!aL^4v3lr%rkn3l4u!%LNi+aXYrl&>gR zA@xlTZN%VY>8{3uBA-N<(Kc$-wQMg+K8P?z`}XzRG+CHcDdQo#S`j5 zVip(q;KDN%oMr5tuAG>Mf1}ih=!;sQ4SNA&)ig$1Zn3@ZUt#YfjrXS838@{pQN;IW zI~9N}H1Xb_bU+Isl^}lx} zLQV1O2B;4bSF!!lDE?zSJ6b?{R#08j$z!s~PF_rx-;(7gw$Q81ytFWniK#QoR?r$D zL4$8HH}G^dT}=&(wiCrAv&hEmmYhabNG7kU*1h-(2+C+!%~jf*-@fXGQIO0!*G$)+ z;`QeF*9rWtBzU4xXNFqi#_8)pBsrcrov6m)`z+MPE6<=C(7Q2ar>rgWY5i}8IV4Gk zJQ6J|8cn%>(a1d^6+}cZ+P>p$7qm~D%IYN~+b7X7Rl?|2=GFl`VEXw5eRwv$>@~#1 z7yjCdd7+Kp0Co}aC!%wVGDDC*K5>c282-3q9kkm}jHg4&ZLbKK6v99p9FrU5w5yVf zveA^5^t&0?<)_zD79*>mQ}9I-5o+;RB35_+G^*{1f=xxo6}Lt>M=)8*xZ%?(_P_mY zp5^ao@`rO26%Kw}K?kc;iJ6%F;(;pzhPi7Ct9lP~*csa#r5s|9 zE*cj`!5eNh0}1#30r0*i(aPM;Oso;vY*ugc#@kWZxP{bYqbf-?Ygp+z%t{=9f5jTo zqi^URtHN&BCtoU;YV#nnQP1e!G1FC+Xp7dzprt5aMsC(OU#sAe_D$XyWoEEftwlwf z|1!02r0!|hpdFvNn>eelpnNkv6GL`YN#`Mk8d~j&1vI2=FEY`NIp||2Pi+=5{UO;5 zqo&K{Zgbl0F&5P_PXH!Ykn}q;I>dZn|Br3-H`?<>NqdmT~)WdsX$`0i?LsT(=S%MkK z$w{Q6Ws@6pIgr-U$yK^$(C+3gj0sRWLuK zX=BxCG1wFIn*wz%g-?&iCNpNyV9e%T9{Oa_OPj6Q;0Sew`nmhgrL5laf)|p_R2+Sx zjDGem>dZ>#AJK=SJMP-Kum){d|6NzUv>#v^fZ(SOQg3=GLp)&xVVc+-bPAuvex&RB zJI>su>^KDiSTHu!wv~a_PEZNo=ds=Woh@GmMyC=eRZCvyS`YI)*;K%4UdyT+&m12= zb3_<^h98+#gjCCk3gz$nZGLzBaYrjNYE>hmAVyhDS~?s-;b^0qp(wkmkZVffuqMY8 zDaoZA-Q6i%l%kBa3gfe<^QO%G0ijiF{{`de=F=G3Q60017+^u_XU)8<)SR@OMqdf(0Mw;s+vce1OEA zqLwb0LwnfCIo49rY68nciFjxN1D32Diz|&RIL>;sIQGfKu(4i-+^dPDs8McyK~FP94=li3)jm6AId;_mK4F z3spy@KOSv@Td26)du4?#6r#?lHL}5s@N;aXwxTLjP_SFlckxK^Nq>U%*#R6B_=rOfyaFyw(u-^3^aNRPY7BeK~GvW__HL8JI%1K)ETT~29WyE6@m?I3BJ*wVX zFPrz(hbq+{9co5jiucu-4er&`!^Ui}QZDDQd5YQ&DQX6}wcc--{|e6(?NzrF4fn6Y ze)+RO&g?n2Z%6o`O~1aB)S4e1Nm5ODFqMG}ri(zPgJ8MPx*P+h{Wuu1Wd+HmJXoi` z0o8!Lj1Z(z!IlhBZI4{1T}6RgWsO{-ZCovt4mVfsWlcwAyYm!oRa{I5QG9+jOj0g; zJ7J=9v=}U@8icIMg+R!(F7I@iB9?PLR@v9_ zeVXz?_+s+>7eNwo5wz~s^`lBbuAH%WRj5qX`x%KXJaS7a|UEp@}m;r_wReQd>sT?G-gT00g388AY*G4WSoT!Q{Od5UEWUJu} zaaAj(l8mGdKxCgPTJM^>9D06ghRPv`#1TsB`5W){Jo&7$964e`C9**|WlBUfD?)`V zCivMq1bb z;p$@plT6H^1k*70=L_2%-N4+!jGEy4}bp$E;8O9wszi z_C4rJqPHtMYTB{%P1G11w!Kn$?EX!nTL2T%dW*_xO7S`;dO&e1)h+HQZ|z6z1Gp|Be)z{bE-9UqRV|#}DRCv1y7x5+S|}`aB@JrFn^_3MmE% zuG_8zjR-DHt$*(DP=~U$sTOhYD)M=0iI9yh(vcnWoK*48Q`4uzfqW_==znEuh|VKK z^RHPCCxE}p<61LZG?9*ho=whSl0AxS99=Z@sKThh$6eL|&O7!Kufj!PkR_)z!yk^% znnQ|*1@TB8hcXgA&eeN27sy&!0X_Q&6tYX|OWeE@a*R!VwmZQ2p+VbqpENK%`47T(PIlWbvwAM&WpbjU zCFv&BvVJ@8t(CzM%_6s+Eh~3&$QBk-=Hy&8_97wsdhfps*IaZU=0a(%l;o_h_q;3D|OH&{^WT<`fp7n!&49py~f-Ys9c4xL9zgZ=>TO(HdM{&6ui1X z7bJDY%)?N2i4Ut|jwBaPd$t{mmL36-L> zx#fz%Bjrb0oVmdd9n+z83r*kx0V5USGJj)j=l@B5s67Wj7^!m4sJiq;36uD51X+W8 z>10U0E8Ldt-*G|pGx)?EkM@WhAxd-T{Kudf&la#)(`4y@vtN+ne&kGdeLT}cF6GCDWJw}kyM~y7rxfXRgE#{Pw|}38H?U9 zYZTCWNU4fC14E<*-%{51aUiYIjDfk$E2w=gU-^|wcFZ$#GVAPzx|xaUqbZGrY*GX! ziv{?;`tO8ELVBSUZxKG<@(OvZY9BA*&P^-7A>DyZ{BR52EO^w)90V0ZC@@PPG#tg5 zX;O-u^2bo|Ofj^zu&w8I?P#l6tZy@G9b0|`~-I{z}KRJG12E)?3*s}r6! zo(Q81w`7nGptDCb8@d-FhWrnHIWGgGccm&3+fC3Vs)3mPjWhnnunDO2A7sSXki>%4 zvSMD!G9HRYRP{52G>CnoIBN`0MRe>+^SLn5X?Z+Q^lG<9XQZaRSoVLr!*oW08(P>5xW#C_+mCCdO@sqi?kO*)- z87Q_PN-`g2oL!~qw@Fdkh;G(5?ih$=^K5R4TOd^!j5LL9DXysp+Ik(&bd2DHPwBg# zl!s4^m97D&aKkN}lPzv)z(n?OE~i)_TWHSe-FJ$$TBpKKerw)~ZXO>_=~rpocQWlQ zM)!!RRZF|r8dYmSsTdn^qCEU*qt+PJwYKL=2MConILn+J1COv{LVgOhF#j^C_wqcH z(!h+i?u-n^Aa6)-SMvi^Sgb1UOLVm{C|FjB&l$ZtUsL(V+_rdknj^K@!=6oPpCJz0 zI{y_23_UhFpLHc?D@4jk20C;h-+Oi=gxAaNXx9$~@0jtE%N29v)AYp9jHLHWS>A8% z3@4Ru)Zr7p+Ds zS~7}AcZ!Ts5<0yKS?SuOf_`#&p1lc4r$?)?%Xs3fC8NpPdk+pS+)*N!E+nV2AyfUd zSdf%4nAE8zr88w%nI9)-(lAFi388%Lh%!r`oH(u1J=P9PPdb*yfeUHOAfK?WCdIWN zxA+gZFtwVV8l`=!o_4P;BcAZk=lv0t_@~@UwWxH%it-SBW5U{VW~vr3h0hyUa>(w$ zEKh2`JbSWFuXulXlKid=MP}(~kmjT-b_b8NVQD|g)v6^&se1e9<1CDp!~`G!C|{ajMcbC2KRnky7mjtsm}8xKOSx}Nv-7Rs(j#se zGndct@TL1Neo&q4>&7sEbkeC$l^O2N_MM(Z#Rlg=__e`~PChkR&4WzEf#M1F06S4y zZA6n<(1rUS$UsM;(?PSfuLkbA?ndwrFQ{eo=t;m{3~ba#Y&QK5P_PwuCm_jL@Xbu4 z3ee8l>~gw{`}e6#ye})+nAQQ{bS6e1VYN;%PGjPK@GqMl4a%wX->{N(J{ojQ9b8=A4%N6my>NSX3axQ_`*=?MyLxTcv52c_7{Qv5 zmR|a=kL#0%)#tyK|1KCWZ~xnY_x;||X(SQ8^hpl6auA(mNsyy*X&SmQjL(GA8qrcWoCBWV#1XA^i zCecDQgnm_-Nj4f45^gmGyQAQ%4MOIsMwgI0RlY4w^5p-ou6K;C?0LdQV>_9NZ6_1k zb~3@lp4hf++nLz5abnv}Cbo0W{QmcTdDnf<`B1A?@4Z)d@2=kUbXPr1?c+{Yo|SzGI5i#G-J*g}!pA##|IqDl5ECXAB&T zrvF~)cGh>9tYZ@9)09#{nR?{%?=lvxFQ!6aYB(EaOWJr*<||{rBZo{fgkXfA|f`2KEQ3e{}=$4IKTka`u)EiI%O0;5854aGtQK)mc()qch`9~~uG zD7(typW_h;Z@X@u_S@X6B8c`Nidpma8@JxSn&?v))Q@ODah_mp*VN3=2^G|R&W4N|`C(Jl`Dm`(m;kPI*+^4=Ex zCRFB!6I2TzNiHlD?j>6>A1ul$v+6XK$}?U?;(6K&&0{gaxScM+2qYcieJc<64`Nau zcE$w!2Ri?U9~TyY%H;Cqe_)a>B{`}5A0P#mDQors(Pb)iqSpV1Jsl<{Kw##DwKeah zLluUuC8!qC-?u|cf*XDBOIzy&^KvZp)iiUyRt)`G{L(yGOuo zYMER90Ew`RCPpd> zx3`u2D%XL#;$EY>ZS&S_u^FMEp(M8dgPrdaVeCNI`G$qOH4?N%gP=wgr7ilCOf_;C zE@U)z3ZDkrA+H|E+UXLHHF^Z)-!3@`7TV8(RWKUr08>-AFj7##0i<^-6VZ8@$E*2P zHx7|tpcVKb278TRDIR;I7Eg*M#^=oJne0@--%-!jp1TK$Op_upY-QsgA(7WN?e~qc z@bz`p0YN8oS$_#>Cf{E()F5}8$oIzHHrtkl3zB}7e5KcldcI4wBitx$j9bufV4Z&+ zLw$B5#Sh`WuG5q)GzXeAM;yO$6#c*1gYk+k|6&+Kk${`pF16a#-W=^b{Sv}8m*a!> z-+F|{lc7n2*#1=8IzuU|q^8js7=O1682v9zNv9mJS7V=;N^6`b7m~Mvi>r|AU*H3B zI`+1ZW@V_pkP?)J7AW?=yzX zeou?rsNyMcW9E66nn}>M4uzAyH7!#KdUI`k2!dCY(YA za< zVD~ztP)Bn3k=0pZ#H+*-sXm37AU9!D!BWq?X$UBw&+H_PeIrlt>EG%OTVzv31^`_Dq1VSqVby|523_~-7_7*EcJRn5&9u{-{%l5&AumBDa5>2%!Nig; z5c6|1{hZ<=dR%ccf*{u-V*4DFDe@s-QZP~zDKPZ4%S94VH&i!cMyI)#$F=ENPhfDb zmu4PHu@=wu**7x>%+7S5=_^`uW}goUsuX@3Js(B;l|Q#2+lQQ!ZtosFy2sliz7YeK zCs&vsKJ3`NbTFW6PD$%~N5r3r>41f=N9H3LHy;7Tc5T_g+(d7|r`lH9AI;Wdi<(zH$0?@; zN?Tq7jVxst#rf-ess;4q__lVUn=|Xx*={iHa;d9FmK>S2(HurN4V2qis_WlXw<=Gc z<88O1*zMOHtUJrrCyyB71GZj$Nwp{kFD@f47<|-d^|eKJxhO3LdX9Hcbh#dTir4@W z?oG<{^k9tlOqAUn5*APE*)Ah6`Kv3#gJix-nQ5VR;znxE&T?B)-3;Q_Q23=mtK64( z%^7M9i`wr?MZTbPC?7xC8fDF>D(1@#r?KPZ4#zpoTmUEWi!7wJPwp-<8Xji;!}Ah$ z9^^3cHR5)ckbUm(T?$O1dK@8%>ioJ&GhE#(3s^B>yZ1T3Bsk-SJaKz8j8K__)m=^# zQXNt*wgjV)U-wBp?a$GrS>? zpwdU~t*H?s-mic?z6#uDLm59!)#v)a8E?a+J2u?i8(NM&I8cpM$6$?NWM@ktCE@z` z9e7YVidSl%1u>F;>*hig;cF%!`}Xa4t!aNzU`eqdJ0L<>PeKZfNd0eUY=)ho?$i*l|l|v&LP3mTExfLEriG5 zt&^g9dXK{V52lmobkE+hr4za6t%LHVlgUB}TLkNgk3x<=IVbaAwyb;JV>^?7Ha$Xi zChcL}9JK>Ep1`*%Z{Sw-+_|$lZ*L+3rf!=44BLvni{m|A{5jgX!DWZHfT0YwOB2l@ zj8OS8#}=mo&Se@mR5$0&vn3Gc*vUvFL78mrkB4{>3hFTN4k6zJXG$ctt4P~-jlLgNh&kMrkI=&5 zj9_Ns08rzzcISm1N{7L3Sy^FPx9<49ru=bkd*u!oP`zn}{8351IL$t9ByR5~Uk*DM z^)f=Yb>E7>Zt=};2)#-)R^S6NsT*xa6Dg%czMmlB=@My3B$DR@s;`DhDJxRmJu{~j zoS+NybB4jTtix^&(1R9h%m}yL2NPWD)d)6}h13>V5s-B@t!rB$_maIN@LS%!x=iI# z6peyf6jNZ64V`)kb{5y9&{j19=A~%a^M0B=#pseaEK=~aF{(y zeQ=2AXTe-&a@r#OL7+!3n5r%cG(3Us`UQ||n3?FD?}DjkJ$B89^X7uhH%OUqqo6?F zlACzOo7gShZoJ&{tEF;fvz!I92JC#!;p^~qClBBuwS>3jekCaR=y>}M!<+OR^c z^Xd-PE%T-V2N!Of144yiQ_b>FT!jPjBamBMI@PYx7sRZQ5kwN$E>NO>J=7YR6? z{47AIfaA%JfDgnN*e(c=i{UnJO_=z97EHYM&w`1$sfEJiErL#bP)H&uS;9^>&skvx z9%zL1-uS9J*>58P&~6_}Lc&GUP7cfmL<#sbrBao7auA>V5H~Rq28ppTDOJ)pA@}QC zZEvz#o1U*lj`u_VD3-r4Ta&50d@~c@&A8DA!Q3T^8m&QKN&u1EoC3x~jyV+$`&l52 zB3y7PaeGs~jrhqw27{ggjS;E{XpC5K={$X9OIV80pois4STltqen4a7GZ6g7yIcbK zZZ`OuyAacQXoIui4l}-R5H@G+gIMSn_gZla1spQ2Tp?EuW9b+ zSr&+|3wa9FK*8%V1DpiUVeVHq?7cP9V#Ui9u(R#+o+u zqkWzDM4L07H+=EMW^_?d4*v#w!DWnEM!@~6*gdLHZgs1v4TlmT)Ps~M2*4~1B%U3r z8d;wkK4<2GV3^He@3hk26AxpSr&qu$25Wk1E6NRV zX8|Mz`=<~lT-)2y#W`VreA+&AzukSn>i3~pWnV13kp;0GCrh#taR&!gOS0oxQm$ba zQ*{k_HrIP|P)A!Jhg@1l;@3hug>HopN4mMmM;Sn#_3Se-93@0&XD!DO|h7{55- zP_+|$zi_vNBhLXFTB4u${c-PpM(LOEb`fYHi!=nZQ^mXW7w_PA}zUaQm*H-z{ zqq_4w>;eS9K-f>DUU$3RcKg<=PBAWw^QsP6C8ijoxj(n=sT4W%K2Dy9@W^FAG))B5d&s?@>B6ag-5b>V{C7(h8&fjtee*T+p>6x+gTO2)svAunfyB`oO&( zNHGy_kJ@J@N2k00K<~uY9~y;&T7pY*j39o^dhKm2A*6xIM(&5d_*0BclZs_`yPk`O z%bRq76taa}VlalwxFbI4==5|5JEINalvQ4VK`aWph~`QHJAtM+>>P5FgeqLunWqq) z#V~9tsl~3z;iG)!5txCfqO7WuonVLG58@sh4wGALM(=FSbG;*VOwAvH}T3)_XrAW?NF%BzF} zB&)OeP#;h78QYo=A6M9qgpa)EgLzdu)bH&zD7n)GW&mYNj`v`?FxambF7BAPZ0#F} z9Di2LXpe}Q1hlWEu3itnS;AO~{MPXOY7XUBkU?zg6L#fnFj|4NZ9wsMBBUWg z+CYoq(r|GCRa;rE2OF+yqR~tOz}HwUK^}jU(O>mJ9KS?MA-A>ccDFVS$kIvz<}5A&Dl zw3ktp>2)Df?ZOkFy}Av1nQ9U{3-ThSQJL_lqCKnkr_q_TZ`1n-|47%=i`}rvdyukp z%GjO2Det4NGtBcIii( z>T;E68bz}$rBwh$EP*8}>kpn099ruh_FgR24{1p}^?^mq-S_mV&C9HjK z{U}U>Uc$aZ&i$ItXhN@B%hI~i1YniJr%^5NXfC{fFAC2>dx(X!`#rZOAzc4tb2bbl zDz1mLmf4z3=Vr-DdW&Q0L{1%Jn6hE7A0A?SLvpI;#^X#QoR7|neRJy z&>bjF9FwF#Yx{N3?qm5$Z*$kF>zF2e=f8$rT1$4ms_v4H(4gK0d32x}Kd-sa?3bvB z(BKmVzX-|Hl4z>S2mE#!# zS-bq30bJgLb`V=V9AT~ge1U|7brN4$1u!PKW1z25SGMky8XoLQO_ah=cMITaqzZIV z1)E=1w9xC3anyKy9XUp!k)c+O~+KyrJqmwCkmT!K8 z=QEcet29ww&n$9XYj-NiwgoI8?XXa0xCz7OKO-wED9t z)ts%q>Y}x?KuU}(8{8l?6}s%R6DZ(m_Py!O=mGAXi;TUL{-=Vf;7G3?`B?HKO5Sh6 zkUIdH5C2S(g+C^%mSDlx@v2XRD`S)Klyc(in6gn~G!Z|&l&|Iv>-BGl(t1?yi|!d- zLTa#>eHaEQ(Vh@=BcgUs(*O}y=sClOswwEe0=8xkTF!P!bvUu+94puAo!`sear`C< z@Ogi`V2>2Ii3R_H)*QKr|2Vm;kftQUdVg)cbmTT4wMCiEzWG$Z8D7t3m3(cykP<1z zKkUk4O}jYYT6`_a=Qkf!tx~`t_>ckdOy#VqKmw63C6)4x~9(uXns&oINXtFCrmpECK;2Aoe+^ zJMVjOWNh?VLQEp<5emc(CVNg`5SvftnPS|X2qjMOJfn8%0O}B)Ongaf%OP|4DaM2z z(@eU201TX7S`n)(#l>JxqiFwn3*|Q(_)#B*<}8v=+pv!?G@bmwY?2R?mF`!`GipMD z!|7PR=i*oFgj=j|M8)czBWS5(%vIcbkb{_bW%}`K;%q(MU~sbG;@Q*q_p&ZEnr!;% zq-t-WtY4pJ`^B$rW&FD3TiLH})FM6nx*m-qGN*gDGbJ)rB^Vdzj1kUR(=1%xw0UF@ z5Z}(Ztsmo>9Ed)zK5DjdRb<46!uCc@CUcR=1x)P>HeN1yC$_i2|$e)_KO zL^zeMDC7rPErEzSFvVx=FldAl!5kOW%s|gH$72dKz}7`-{iJB*y$;|a3cofV604;^ z268gsD~p8p(ZK*5>57auXorTuxRF%(PP%@da1&qikx5t}?1^E4ItcHgU3x>unX@4V z;HFSSR!tS*_p^>S5TLo7mJvRu%hJsKQic~q04B;$zHUJYKpFS0ke;Gy)}dxpo3Re^3rZn zRe_Bd>Zr)(y2GeP`ZCEUac096Thb|EwBN^Id~-(;iY>#(7JgE5*d{4E%jYtD1R^5Z ziUc7Nx`x6s8oPFkey^3!;?)xNQ$49m8thW)U{+i#26cipw;jiwRa}R(oXzr~$4FBP zmHp<^WOOl!8gIpvd&GC>9ipf(_i=(3GzQl~7^sinY6+|LkPkTw^-aB{-jEMAwWwPb zy5hKq-niW$3KS;$?(Mr@s_bn;wD1RW!XBW0dPLOP1b_{PINdO!A!OG=ItMN+SuYW; zFvoqNL;Xt84d1-+C-W0=DklSH?})DJT%sxbELw6m_%61x{Te>oaehIUJcTZTU~k_WOXq4d?0e35I7VM>z=|Y|ebPY<|Yq#r5 zIB$wlM^e!l0|I0vcp?lkUCf)Zgzu%9-?y{kc>K8@-L-B!K5Ehusu`LClig3#vf%^k zq{;>NpyE8uE&4%NO9f@&67Um#N$m;EL&_ApwHMBmOBAthhS<2R;AT$v=2Ih`<6`(P zV;=9Yir%AOc|1#IA!dM%(JvJ2d!JR=2ld}IU@~g{gdB=h??b%R>l{79d$tP?(~I>( zU$Lz3(SIwY0wD;Vl!8DkHt2Ha zB!D%sLV(HuSe(Z_n5QTm6NNvS?+07uK)99&_Z*}a_pej^kDsC_To(^t_?3MQ(S=wg`U&-`vd|1#7Ism)im)^# z@lzNy*}W1)3!Ch23Xc^hDXWz~;TBH+Hg{Ol@TB4}aRYZ^VD$qUoIYG0y&g|cyxeZ~ ztij9@VS~VtyWDQ#A&)vKlBt3q&lk+}-Z~F;akCm0b>xeajj(_O5WpSWm1r<~yVGhtYL-00`N7VwpH(;W6YeyMNmdI;6S5zdZcAiYZe;Q-! zZhDR5Fz&d2r#%m@^FhAk*(Rgq(g?0L!;Yn!P8}l6YH?l{AuMjlGrwPFWzFLDH z8zSW9Nl8ehm=lS14QFqqgI)6enVq=w)CHT5MQN|rSLl~EP1ErJ2=QwPhmuZB8}Or9 zOGot+?HB1(F^7RaR*JO5-)^Xa_$i3N1-`^v-mPTk4#ZzN1zB6LBpu%l>R*a%EF(7! zj#K{@5b1g#ktDp)Jkn_CH}%uk4&HqylJ|ul6t9HjXH74eeTUJ7{mLtLw)7>{kf?BW zk_x3le66L~K&npYHc(OBA?R;Vh1|Su0Hqk13=zO~?6it+scFIabW^PV>K+kuqd1Q&JYEDBa^_w;iDat1A9MxDhU*{r>ISR&i#~oYtZ#F2uk^-yii3 zHe7Jh61RDmrt0gi=B%`C@9<71O8uh%o3&0GXuBSIOWvhaN>Has^C(J29QN;Jvrt3uRo8D~p^7A|-fOopmFi zCuHi{z|s(^+`Gfa+$m)13DORe^K~zAhGzJe(yM!|~o*%0zHIe&g*(8gd4(E%@FV!2w>j zfMm;5pIgt@eG<8!-7eYS=`Yfkl?gXO^_dl1jG68O)CD&E{=#pr{V_UD2CdvFx6T3z z2!J<5s;2*uHp4qG6NRV2NASEO7A9BTKF^w8EJtvzu>{EV1B-qv)g$N&I-W@u~ z)y%Rarci!Q;BeK+pWq;09~J!p>djdv`h~{SukSS1|5VL}2galyk-EVr(ci;5J#4bd zt`W$t-JG<+`!3_WZrkTxbM`azsh({l6Jdw}9oJ$mFWH)tjO}b9Bwf?lbfD`u`$SD| zd$O!`kck@S-)tN!+06P0j8oPL?4-dvb}#luTW1gCTdNa3)2}zo4Ba`F+cS3Ei!61w zZ>(*{>W7B7xyNHtLx8SsPIde?R^1VTpZg->UK4uCIOLC9mq(TsRvX)^l4dkn^LGI3 zTwu;LR>91KPuw~j4DAJUdYP?KBg~2Zr_PTkX3PSKPuRrO3rNS5Wm4DsR|lpO!cCXh z6$vgO51AzGi#KMN)Ht-Rj*gCot?nkg9W07n$jQ-H$)DQe{Jo*g7yNpf}#JpQ7Z+V!F7) z6$%{R)oNbCm%xN1#?iR;ns>4YJ1En+&@vqWwpDr%zr*`RAhk5h}_ve$Z{~ z`R?}i_{|FAH*P#T8r?<7WOT98_a3QLUbeGJ-&TZ-O}eN#qVs2jTD#*1XVY$mW;Q2Q zyxvH?z@LM;T`=+@`U<6*{dvS(IbPFqv-$*!%qaT^UejBd)7xo#>~`_pwUjSGv58j@ zis4j~twhPa^hJdI*4)#9O88;x;A}Mi7p2@292ns9FJ{O^MwVSQs<@_0Zf9nHH89fk zcW4{ST9m^ekjT#75J&rGl-4V?rn2^ZO~ut`L?P4l@%9Ir=*gj8>~oL94Z->FYg9;L zVr?9CMts^gv;lCw*mq$O)mBB_&j+)I&8DyAMc1$6uea?TKKKhvc)uRuTA11MMdyH; zsZF!G9A()DHc-peFU=b`Z;W6Ve0pMgiWtLPBVxM)#;z%zFUBq;^ld#4%75h7bGTnX zE=l2cnHu!Sn-jhQZ&Li>i(<#k=a?_B69r$sfNc|QJF$Jv)N3T!_@F!OL9Y!7uYKrT zFU)d$K4oLmM?I64+0+kKOj0YzlBOI_Yhs@%3gsP^_WF!dG&Ac?Z5k2-kR@l$1zd1C?4_O($W!*&@a0owEsqtV}~ zqLSy5C#hTpey67ydn|`$`{B8pA$5`3NS(HYNz_0JO-CrU4oWyRo~pAKpoWhV{rHp5 zMci-6NHX~+o#mM+VGD{FM)?i-97KZC5-U9LEm@|<(ZyF=qgxfqncPZ$LYsVe?N3n8> z>TP}?PG-j6VOQH*<^nOHSo`=Z#6r zH7lLZijFLBytM#HAh+nG8cDtLfzv`HnqKS{#2pBs&bynv*yqx4%iUk7=L7E9y+vmu zr_NWeO%QldQ~BGgs|lM1TE4D{Vz5G-Tig>IUvZB$i}U=n++=~H^^+%;U2V_F4wX12#0^_#^mlfRg~(T6SjHPtxYo+KLf-3zV;wvjuC5Yemod$!my%nXv)vt@1?QIl_D#Nc*C*rcO?=u8o~=I}M((b_yKGtt zA6dAyxNz`;OJ-MV#{nwl#({eI({anBixA7w@9yZ!((-EW&N9mut{)fFZ(4mV35m(~ zEiF%6hn+C~RzZvSaH!267VTI>JHo~~@27LX($31x&djvTDcj7|$XU2>NV z_bX63wTe@%PNF;DU37hi`yT+#A=QhgTHZG%Rb)?=pN7fLkG&iT7_x}}A_1>ix3QC! zVI}|g?a5V%qdi;u(|VB5;MGU)B^6ysGAM3{Od*)pL(l!VVDLprdb}Oy(CdEr0#%d& z1;YUUzn@nJJb&W9Uy=Vm@qanJ?*Dwq|9OJN{~iGXQsmEq@c(n3g`x~3)W1u>fd3$% JthV{5{XY`#WB&jE literal 0 HcmV?d00001 diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json b/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json index aaa29383849..f9d3467b20a 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json +++ b/Solutions/Proofpoint On demand(POD) Email Security/Package/createUiDefinition.json @@ -316,7 +316,7 @@ "name": "huntingquery1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'adult' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'adult' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -330,7 +330,7 @@ "name": "huntingquery2-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'malware' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'malware' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -344,7 +344,7 @@ "name": "huntingquery3-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'phish' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'phish' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -358,7 +358,7 @@ "name": "huntingquery4-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'spam' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'spam' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -372,7 +372,7 @@ "name": "huntingquery5-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails with high score of 'suspect' filter classifier value. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails with high score of 'suspect' filter classifier value. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -386,7 +386,7 @@ "name": "huntingquery6-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for emails which size is 2 times grater than average size of outbound email for user. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for emails which size is 2 times grater than average size of outbound email for user. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -400,7 +400,7 @@ "name": "huntingquery7-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for recipients with high number of discarded or rejected emails. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for recipients with high number of discarded or rejected emails. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -414,7 +414,7 @@ "name": "huntingquery8-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for recipients with large number of corrupted emails. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for recipients with large number of corrupted emails. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -428,7 +428,7 @@ "name": "huntingquery9-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Search for senders with large number of corrupted messages. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Search for senders with large number of corrupted messages. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] @@ -442,7 +442,7 @@ "name": "huntingquery10-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "Hunting for suspicious file types in attachments. This hunting query depends on ProofpointPOD data connector (ProofpointPOD_message_CL Parser or Table)" + "text": "Hunting for suspicious file types in attachments. This hunting query depends on ProofpointCCPDefinition data connector (ProofpointPODMessage_CL Parser or Table)" } } ] diff --git a/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json b/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json index 1201e04f1a3..d572112b5a0 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json +++ b/Solutions/Proofpoint On demand(POD) Email Security/Package/mainTemplate.json @@ -55,7 +55,7 @@ "email": "azure-support@proofpoint.com", "_email": "[variables('email')]", "_solutionName": "Proofpoint On demand(POD) Email Security", - "_solutionVersion": "3.1.4", + "_solutionVersion": "3.1.5", "solutionId": "proofpointinc1600438591120.azure-sentinel-proofpointpod", "_solutionId": "[variables('solutionId')]", "workbookVersion1": "1.0.0", @@ -123,76 +123,76 @@ "huntingQueryTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7b281f4a-6a9a-439f-8b4f-f08eb24f2fb7')))]" }, "analyticRuleObject1": { - "analyticRuleVersion1": "1.0.3", + "analyticRuleVersion1": "1.0.4", "_analyticRulecontentId1": "eb68b129-5f17-4f56-bf6d-dde48d5e615a", "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'eb68b129-5f17-4f56-bf6d-dde48d5e615a')]", "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('eb68b129-5f17-4f56-bf6d-dde48d5e615a')))]", - "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','eb68b129-5f17-4f56-bf6d-dde48d5e615a','-', '1.0.3')))]" + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','eb68b129-5f17-4f56-bf6d-dde48d5e615a','-', '1.0.4')))]" }, "analyticRuleObject2": { - "analyticRuleVersion2": "1.0.1", + "analyticRuleVersion2": "1.0.2", "_analyticRulecontentId2": "aedc5b33-2d7c-42cb-a692-f25ef637cbb1", "analyticRuleId2": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'aedc5b33-2d7c-42cb-a692-f25ef637cbb1')]", "analyticRuleTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('aedc5b33-2d7c-42cb-a692-f25ef637cbb1')))]", - "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','aedc5b33-2d7c-42cb-a692-f25ef637cbb1','-', '1.0.1')))]" + "_analyticRulecontentProductId2": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','aedc5b33-2d7c-42cb-a692-f25ef637cbb1','-', '1.0.2')))]" }, "analyticRuleObject3": { - "analyticRuleVersion3": "1.0.1", + "analyticRuleVersion3": "1.0.2", "_analyticRulecontentId3": "c7cd6073-6d2c-4284-a5c8-da27605bdfde", "analyticRuleId3": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'c7cd6073-6d2c-4284-a5c8-da27605bdfde')]", "analyticRuleTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('c7cd6073-6d2c-4284-a5c8-da27605bdfde')))]", - "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c7cd6073-6d2c-4284-a5c8-da27605bdfde','-', '1.0.1')))]" + "_analyticRulecontentProductId3": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','c7cd6073-6d2c-4284-a5c8-da27605bdfde','-', '1.0.2')))]" }, "analyticRuleObject4": { - "analyticRuleVersion4": "1.0.2", + "analyticRuleVersion4": "1.0.3", "_analyticRulecontentId4": "bda5a2bd-979b-4828-a91f-27c2a5048f7f", "analyticRuleId4": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bda5a2bd-979b-4828-a91f-27c2a5048f7f')]", "analyticRuleTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bda5a2bd-979b-4828-a91f-27c2a5048f7f')))]", - "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bda5a2bd-979b-4828-a91f-27c2a5048f7f','-', '1.0.2')))]" + "_analyticRulecontentProductId4": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bda5a2bd-979b-4828-a91f-27c2a5048f7f','-', '1.0.3')))]" }, "analyticRuleObject5": { - "analyticRuleVersion5": "1.0.1", + "analyticRuleVersion5": "1.0.2", "_analyticRulecontentId5": "d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32", "analyticRuleId5": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'd1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32')]", "analyticRuleTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32')))]", - "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32','-', '1.0.1')))]" + "_analyticRulecontentProductId5": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','d1aba9a3-5ab1-45ef-8ed4-da57dc3c0d32','-', '1.0.2')))]" }, "analyticRuleObject6": { - "analyticRuleVersion6": "1.1.1", + "analyticRuleVersion6": "1.1.2", "_analyticRulecontentId6": "f8127962-7739-4211-a4a9-390a7a00e91f", "analyticRuleId6": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f8127962-7739-4211-a4a9-390a7a00e91f')]", "analyticRuleTemplateSpecName6": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f8127962-7739-4211-a4a9-390a7a00e91f')))]", - "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8127962-7739-4211-a4a9-390a7a00e91f','-', '1.1.1')))]" + "_analyticRulecontentProductId6": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f8127962-7739-4211-a4a9-390a7a00e91f','-', '1.1.2')))]" }, "analyticRuleObject7": { - "analyticRuleVersion7": "1.0.2", + "analyticRuleVersion7": "1.0.3", "_analyticRulecontentId7": "f6a51e2c-2d6a-4f92-a090-cfb002ca611f", "analyticRuleId7": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'f6a51e2c-2d6a-4f92-a090-cfb002ca611f')]", "analyticRuleTemplateSpecName7": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('f6a51e2c-2d6a-4f92-a090-cfb002ca611f')))]", - "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a51e2c-2d6a-4f92-a090-cfb002ca611f','-', '1.0.2')))]" + "_analyticRulecontentProductId7": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','f6a51e2c-2d6a-4f92-a090-cfb002ca611f','-', '1.0.3')))]" }, "analyticRuleObject8": { - "analyticRuleVersion8": "1.0.3", + "analyticRuleVersion8": "1.0.4", "_analyticRulecontentId8": "56b0a0cd-894e-4b38-a0a1-c41d9f96649a", "analyticRuleId8": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '56b0a0cd-894e-4b38-a0a1-c41d9f96649a')]", "analyticRuleTemplateSpecName8": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('56b0a0cd-894e-4b38-a0a1-c41d9f96649a')))]", - "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','56b0a0cd-894e-4b38-a0a1-c41d9f96649a','-', '1.0.3')))]" + "_analyticRulecontentProductId8": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','56b0a0cd-894e-4b38-a0a1-c41d9f96649a','-', '1.0.4')))]" }, "analyticRuleObject9": { - "analyticRuleVersion9": "1.1.2", + "analyticRuleVersion9": "1.1.3", "_analyticRulecontentId9": "35a0792a-1269-431e-ac93-7ae2980d4dde", "analyticRuleId9": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '35a0792a-1269-431e-ac93-7ae2980d4dde')]", "analyticRuleTemplateSpecName9": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('35a0792a-1269-431e-ac93-7ae2980d4dde')))]", - "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35a0792a-1269-431e-ac93-7ae2980d4dde','-', '1.1.2')))]" + "_analyticRulecontentProductId9": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','35a0792a-1269-431e-ac93-7ae2980d4dde','-', '1.1.3')))]" }, "analyticRuleObject10": { - "analyticRuleVersion10": "1.1.1", + "analyticRuleVersion10": "1.1.2", "_analyticRulecontentId10": "78979d32-e63f-4740-b206-cfb300c735e0", "analyticRuleId10": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', '78979d32-e63f-4740-b206-cfb300c735e0')]", "analyticRuleTemplateSpecName10": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('78979d32-e63f-4740-b206-cfb300c735e0')))]", - "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','78979d32-e63f-4740-b206-cfb300c735e0','-', '1.1.1')))]" + "_analyticRulecontentProductId10": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','78979d32-e63f-4740-b206-cfb300c735e0','-', '1.1.2')))]" }, - "dataConnectorCCPVersion": "3.1.4", + "dataConnectorCCPVersion": "3.1.5", "_dataConnectorContentIdConnectorDefinition1": "ProofpointCCPDefinition", "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", "_dataConnectorContentIdConnections1": "ProofpointCCPDefinitionConnections", @@ -210,7 +210,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPOD Workbook with template version 3.1.4", + "description": "ProofpointPOD Workbook with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -271,7 +271,7 @@ "kind": "DataType" }, { - "contentId": "ProofpointPOD", + "contentId": "ProofpointCCPDefinition", "kind": "DataConnector" } ] @@ -302,7 +302,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPOD Data Parser with template version 3.1.4", + "description": "ProofpointPOD Data Parser with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('parserObject1').parserVersion1]", @@ -434,7 +434,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreAdultValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreAdultValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -515,7 +515,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreMalwareValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreMalwareValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -596,7 +596,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScorePhishValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScorePhishValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -677,7 +677,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreSpamValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreSpamValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -758,7 +758,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighScoreSuspectValue_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODHighScoreSuspectValue_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -839,7 +839,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODLargeOutboundEmails_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODLargeOutboundEmails_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject6').huntingQueryVersion6]", @@ -920,7 +920,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODRecipientsHighNumberDiscardReject_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODRecipientsHighNumberDiscardReject_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject7').huntingQueryVersion7]", @@ -1001,7 +1001,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODRecipientsLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODRecipientsLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject8').huntingQueryVersion8]", @@ -1082,7 +1082,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODSendersLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODSendersLargeNumberOfCorruptedEmails_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject9').huntingQueryVersion9]", @@ -1163,7 +1163,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODSuspiciousFileTypesInAttachments_HuntingQueries Hunting Query with template version 3.1.4", + "description": "ProofpointPODSuspiciousFileTypesInAttachments_HuntingQueries Hunting Query with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject10').huntingQueryVersion10]", @@ -1244,7 +1244,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODBinaryInAttachment_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODBinaryInAttachment_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -1272,10 +1272,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1352,7 +1352,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODDataExfiltrationToPrivateEmail_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODDataExfiltrationToPrivateEmail_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject2').analyticRuleVersion2]", @@ -1380,10 +1380,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1456,7 +1456,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODHighRiskNotDiscarded_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODHighRiskNotDiscarded_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject3').analyticRuleVersion3]", @@ -1484,10 +1484,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1560,7 +1560,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODMultipleArchivedAttachmentsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODMultipleArchivedAttachmentsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject4').analyticRuleVersion4]", @@ -1588,10 +1588,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1664,7 +1664,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODMultipleLargeEmailsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODMultipleLargeEmailsToSameRecipient_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject5').analyticRuleVersion5]", @@ -1692,10 +1692,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1768,7 +1768,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODMultipleProtectedEmailsToUnknownRecipient_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODMultipleProtectedEmailsToUnknownRecipient_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject6').analyticRuleVersion6]", @@ -1796,10 +1796,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1872,7 +1872,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODSuspiciousAttachment_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODSuspiciousAttachment_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject7').analyticRuleVersion7]", @@ -1900,10 +1900,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -1976,7 +1976,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODWeakCiphers_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODWeakCiphers_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject8').analyticRuleVersion8]", @@ -2004,10 +2004,10 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_message_CL" - ] + "ProofpointPODMessage_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -2080,7 +2080,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODEmailSenderInTIList_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODEmailSenderInTIList_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject9').analyticRuleVersion9]", @@ -2108,22 +2108,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_maillog_CL" - ] + "ProofpointPODMailLog_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -2198,7 +2198,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "ProofpointPODEmailSenderIPinTIList_AnalyticalRules Analytics Rule with template version 3.1.4", + "description": "ProofpointPODEmailSenderIPinTIList_AnalyticalRules Analytics Rule with template version 3.1.5", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject10').analyticRuleVersion10]", @@ -2226,22 +2226,22 @@ "status": "Available", "requiredDataConnectors": [ { - "connectorId": "ThreatIntelligence", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligence" }, { - "connectorId": "ThreatIntelligenceTaxii", "dataTypes": [ "ThreatIntelligenceIndicator" - ] + ], + "connectorId": "ThreatIntelligenceTaxii" }, { - "connectorId": "ProofpointPOD", "dataTypes": [ - "ProofpointPOD_maillog_CL" - ] + "ProofpointPODMailLog_CL" + ], + "connectorId": "ProofpointCCPDefinition" } ], "tactics": [ @@ -3084,7 +3084,7 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.1.4", + "version": "3.1.5", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "Proofpoint On demand(POD) Email Security", diff --git a/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md b/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md index 64bfa892983..76a1c832c00 100644 --- a/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md +++ b/Solutions/Proofpoint On demand(POD) Email Security/ReleaseNotes.md @@ -1,5 +1,6 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|------------------------------------------------------| +| 3.1.5 | 29-10-2026 | Update **Analytic Rules**, **Hunting Queries** and **Workbook** metadata to reference the CCF data connector (ProofpointCCPDefinition) and its tables.| | 3.1.4 | 17-04-2026 | Update **ProofpointPOD_PollingConfig.json** to pass sinceTime parameter with firstWindowBackfillInMin configuration.| | 3.1.3 | 19-03-2026 | Update **ProofpointPOD_PollingConfig.json** to pass user-agent header with solution package version.| | 3.1.2 | 08-12-2025 | Update **ProofpointPOD_PollingConfig.json** to remove start and end time query params, it impacts time frames at server side and causes duplicate data ingestion.| diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 02c3df1f0eb..ef7878b4cc4 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -2949,7 +2949,7 @@ "ProofpointPOD_message_CL" ], "dataConnectorsDependencies": [ - "ProofpointPOD" + "ProofpointCCPDefinition" ], "previewImagesFileNames": [ "ProofpointPODMainBlack1.png",