From 59d9227d6e413f6a0d3450a93e4433ef738f4a94 Mon Sep 17 00:00:00 2001 From: Bhagya lakshmi Kukula Date: Fri, 30 Oct 2026 10:31:57 -0400 Subject: [PATCH] Cisco Miraki --- .../CiscoMeraki_PollerConfig.json | 8 ++- .../CiscoMeraki_dcr.json | 34 +--------- .../CiscoMerakiMultiRule_ccp/README.md | 43 ++++++++++++ .../table_CiscoMerakiAirMarshalEvents.json | 5 ++ ...tion_Cisco Meraki Events via REST API.json | 2 +- .../Package/3.2.2.zip | Bin 0 -> 19735 bytes .../Package/mainTemplate.json | 61 +++++++----------- .../ReleaseNotes.md | 2 + 8 files changed, 83 insertions(+), 72 deletions(-) create mode 100644 Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/README.md create mode 100644 Solutions/Cisco Meraki Events via REST API/Package/3.2.2.zip diff --git a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_PollerConfig.json b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_PollerConfig.json index 55d88772941..2b1ceaf2590 100644 --- a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_PollerConfig.json +++ b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_PollerConfig.json @@ -253,7 +253,8 @@ }, "stepCollectorConfigs": { "air_marshal_events": { - "shouldJoinNestedData": false, + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", "request": { "apiEndpoint": "[[concat(parameters('apiBaseUrl'),'/networks/$networkId$/wireless/airMarshal')]", "httpMethod": "GET", @@ -276,6 +277,11 @@ } } }, + "shouldJoinNestedData": true, + "joinedDataStepName": "network", + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, "connectorDefinitionName": "CiscoMerakiConnector", "dataType": "CiscoMerakiAirMarshalEvents", "dcrConfig": { diff --git a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_dcr.json b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_dcr.json index 8ffb5efc6b6..06b4c07dfbf 100644 --- a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_dcr.json +++ b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_dcr.json @@ -173,40 +173,12 @@ "Custom-CiscoMerakiAirMarshalEvents_CL": { "columns": [ { - "name": "ssid", - "type": "string" - }, - { - "name": "bssids", + "name": "network", "type": "dynamic" }, { - "name": "channels", + "name": "expand", "type": "dynamic" - }, - { - "name": "firstSeen", - "type": "datetime" - }, - { - "name": "lastSeen", - "type": "datetime" - }, - { - "name": "wiredMacs", - "type": "dynamic" - }, - { - "name": "wiredVlans", - "type": "dynamic" - }, - { - "name": "wiredLastSeen", - "type": "datetime" - }, - { - "name": "networkId", - "type": "string" } ] }, @@ -638,7 +610,7 @@ "clv2ws1" ], "outputStream": "Custom-CiscoMerakiAirMarshalEvents_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(lastSeen), now(), todatetime(lastSeen)) , Ssid = ['ssid'] , Bssids = ['bssids'] , Channels = ['channels'] , FirstSeen = ['firstSeen'] , LastSeen = ['lastSeen'] , WiredMacs = ['wiredMacs'] , WiredVlans = ['wiredVlans'] , WiredLastSeen = ['wiredLastSeen'] , NetworkId = ['networkId'] | project TimeGenerated , Ssid , Bssids , Channels , FirstSeen , LastSeen , WiredMacs , WiredVlans , WiredLastSeen , NetworkId" + "transformKql": "source | extend Ssid = tostring(expand.ssid) , Bssids = expand.bssids , Channels = expand.channels , FirstSeen = unixtime_seconds_todatetime(tolong(expand.firstSeen)) , LastSeen = unixtime_seconds_todatetime(tolong(expand.lastSeen)) , WiredMacs = expand.wiredMacs , WiredVlans = expand.wiredVlans , WiredLastSeen = unixtime_seconds_todatetime(tolong(expand.wiredLastSeen)) , NetworkId = tostring(network.id) , Types = expand.types | extend TimeGenerated = iff(isnull(LastSeen), now(), LastSeen) | project TimeGenerated , Ssid , Bssids , Channels , FirstSeen , LastSeen , WiredMacs , WiredVlans , WiredLastSeen , NetworkId , Types" }, { "streams": [ diff --git a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/README.md b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/README.md new file mode 100644 index 00000000000..2a79752b6a4 --- /dev/null +++ b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/README.md @@ -0,0 +1,43 @@ +# Cisco Meraki Air Marshal ingestion + +The Air Marshal collector lists an organization's wireless networks and calls +`/networks/{networkId}/wireless/airMarshal` for each network. Cisco's scan results +do not include the network ID. + +The collector retains the parent network record as `network` and the child scan +results as `expand`. The CCF nested `MvExpandTransformer` emits one row per scan +result with its parent network attached. The Air Marshal DCR input stream therefore +contains two dynamic columns, `network` and `expand`. + +The DCR maps `network.id` to `NetworkId`, preserves `expand.types` as the dynamic +`Types` array, and converts `firstSeen`, `lastSeen`, and `wiredLastSeen` from Unix +epoch seconds to UTC datetimes. `TimeGenerated` uses the converted `LastSeen`, +falling back to ingestion time when it is absent. Other event timestamps remain +null when absent. + +All classifications are retained, including empty arrays; ingestion does not +filter out unclassified SSIDs. For example, query classified results with: + +```kusto +CiscoMerakiAirMarshalEvents +| where Types has_any ("rogue", "spoof") +| project TimeGenerated, NetworkId, Ssid, Types, FirstSeen, LastSeen, WiredLastSeen +``` + +## Updating existing installations + +Deploy the updated Air Marshal table schema, DCR, and polling configuration +together. The joined input shape is not compatible with the previous flat DCR +input stream. Updating only the saved-search alias or table schema does not fix +collection. Existing ingested rows with missing values are not repaired by this +change. + +After updating, verify new scan results from multiple networks, including the +same SSID in different networks. Each result must retain its own `NetworkId`, +classification array, and converted timestamps. Also verify networks with no +scan results do not produce event rows. + +References: + +- [Cisco Air Marshal API](https://developer.cisco.com/meraki/api-v1/get-network-wireless-air-marshal/) +- [CCF nested API polling](https://learn.microsoft.com/azure/sentinel/isv/custom-connector-nested-api-polling) diff --git a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiAirMarshalEvents.json b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiAirMarshalEvents.json index 0194b7beb50..432465fd8ae 100644 --- a/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiAirMarshalEvents.json +++ b/Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiAirMarshalEvents.json @@ -62,6 +62,11 @@ "name": "NetworkId", "type": "string", "description": "Network ID where the Air Marshal event was detected." + }, + { + "name": "Types", + "type": "dynamic", + "description": "Array of SSID threat classifications, such as rogue or spoof. Empty when no classification applies." } ] } diff --git a/Solutions/Cisco Meraki Events via REST API/Data/Solution_Cisco Meraki Events via REST API.json b/Solutions/Cisco Meraki Events via REST API/Data/Solution_Cisco Meraki Events via REST API.json index fd5d36a64f0..f1f9003c869 100644 --- a/Solutions/Cisco Meraki Events via REST API/Data/Solution_Cisco Meraki Events via REST API.json +++ b/Solutions/Cisco Meraki Events via REST API/Data/Solution_Cisco Meraki Events via REST API.json @@ -14,7 +14,7 @@ ], "Metadata": "SolutionMetadata.json", "BasePath": "C:\\Github\\Azure-Sentinel\\Solutions\\", - "Version": "3.2.1", + "Version": "3.2.2", "TemplateSpec": true, "Is1PConnector": false } diff --git a/Solutions/Cisco Meraki Events via REST API/Package/3.2.2.zip b/Solutions/Cisco Meraki Events via REST API/Package/3.2.2.zip new file mode 100644 index 0000000000000000000000000000000000000000..6669582e71431ff495b9d74521417d01ef7bb690 GIT binary patch literal 19735 zcmY(~W2`VdxGv~r+qU&C+qP}nwr$(CZQHhO8}sdbCX+conl$atChgN+cjcvkK~Mky z03ZP7Qgn1AJ5wryAOHZ8FaQA1{~I-OG%;{CQLzv8tt=As_1);W*a!MfaC8bL@=0Kycnch{yI#Nb` z$(0y=(D24f!CJ#%n@}chdOunrrRz9OrN-1#8+^=*d^amPMjsfT&}7JfTqe27EYrkn zX?_@fxV0~jSSyEBOAPlKyu3-YP|X*y350&RLYWwC{(y#}VB7=$D z%mHQMzR7lt!pu~DT3k*18;`z{nI{u(jQ{#@??SU{jKz7gI67Y zO0nVV%b4oGf$LL4`xh$IjyMhzI7(_+4|NS?P!TMTP3NS(uV?{67h@tg4|S8J*#u3X z`}aA0O1GcRw)kv99Ig$m`o9YB4kM;Xbo5@$vrp zvh(v_-_a>$*)eCmeOyoxNqp)H)iOBH#vp*+E7_7b09(nW#VC%3PTJ7Y2FohC=yjMd zxt#WB@gqok6qY$NHlO?1+~IsYy}475kbS5>3v`!4-3iPXLE5&~6;6i=)&`OP=pX+C z8W60tipXI+CS7a4N$lut2r|!Ci7M!{XJFkQ6xfoaQx~XeY9Ld_;VgAXQKS;*A(5J8 zib@5k*oRWWL?LXFgg7V8LL*}_zuf8Z>7^mv0Zr%zJf~S=pV{oJ1Tp?CR!X;?>!)$M zXo2K1Zc2A7B((=gx`kOQ<>fR5Y3}< zy%T8+74oc&saD=a%^Crs>mqDluwZ%fru944k@9p42wq5uiOcEn*yq*az1f}R#!MfxVwMr;;!Z(Y8 zg`^|3K^?_Pgh{eWCDxE8sZJeZK4Jnq}G@sHKc81fSC5yW| z^437^r0N(P$K>X9T-9j&Hy znt4mCtZLeYpKL&c4q=zVe%}3yaC`;JNbMzA7gTv2|M8h8;1I(43%++_KVD?Do5Q!& zs+KM(uv@vB-BgaUwc4@h1O$o^RpA`Lu36=NlKH8Y0^CVB2qP1kap5W=sX4A)E`wuq zI5`+3ft!^|EiB+2my*Nb-cbe0J6bhrkiUH3IAo(bt0>ZjYGDvayEk}yXt-i5P;_0^ z0o4?}@9Gm^LYrfBZkp0_7qwre#~c776q7=@@)Q-MEr6)ZSl7(OGS^vHs;xqrG1w6nr7e-?LCj0smwgoLswWZ_r+BH+5MtS^lp1V~%!1*2==#S&(TAY=&}dwj;CC zQtH&)u(=R-HLzIX%sn?$Tm&&~LHbdWjPR0G1-WHacNB0Ur)lMiQ|KC|A=nV!mz?dX z@d22H)R)({WVm{eO?jq}-ZtwHBI7}zaO%Q(&Sr-&YNW@B84AOT>ICOWC7~8^vb*28 z`tmgeBW_As_`+1)bpAZF{pF3PJsq@!h>*d> z61e0+p9wCTbkv0}H&mau;bQ9)vq328%+nfFOs9}z4iD>z5q07R0x!7Iicde*WN}Az zi%1JHb)TzMHq(@R&eal>Ws5%_XXT2f;cW(gn?-(ggtxcB2bsc)hoew?4zD=VM2smj z$R@wh?ez}1AOl#VYm3MJ3c+|k#Qy|`H0Ylz65H(JS8B#nSwJ7!R{^C+wo~(xk$J!EX5!1tof8fXe7ws!QDP{D+Gp=Hp?ldpLL6>s6!*(fm{&;1Y!!8DU z<}-?)=k$7ebU-PskV0F+C;iG3g=6z&6I&S{;N5TckmAtxs>C8z727& zQtEwc$Te&(2A0SA*0pq?`UB%x+_jBj0ViRV8FaP`U$6K5{c)rZQ2zg_Tkhc8VN!(v z00dls01*GHTWkz0Y?V!H?5+Q+UjDaYx$&`b+HOref2-O2^Jn5P6H}ZKO3X1n!uC>2 zcubE$wIcm;f77G`Cn~_iaexQ~Af3um-q~~X+x#JI!-7ZJw_=C46rDX*{xBB@xVB}+ zin$ei`}=<4BV7KVej_uEa`vTv4 ze#?7(gAe760CI)D(M_^I(H8*w+o$<1TuQ>fSEmrC_?0!3)qvRJz_=dzd;X$CTpt4> zc*l45mj@>|95gidl;VPd4u!n{cD;%fjzn*Gk>oC1M@bcl=(8A>$GG5FB@Zx|LS82b52>L=lMB$zZ{?=K|c z*RA*uIo2ocWBAX-e_kuld>nLuH#%}SIA8Bh-Ft}mI-wWvNzIw9U>8Io)*ER_>#*o5 zUB=`oO^o7(paS~ur{GsUShQRTrxDZVDL6Yz`;HsUQ~la`ZbF?AS|~CFk?q^)G_=SU z-vLM)a2n(tQy-BW@L|8s_TN!vPOZn@&W;Zswj1~f)^ue@4dSHT%$t08nWaj%v5_;% z;l8eXTu~Qf1mvXZ4k#ojtOUT)RD^h;q%sccFR0vvVUxN#9KiXv)IfCLD1G#xtHZXt zqe)yZgeKsrVVD>oD%YzyR~PW*o4gyvhOsWqO#;FTdjC9xiX&$( z1g|tY#ocQ>t?XifjpzkH6iyR8Nv{6G!-EE?2X8y=N-Fo`5;^&CW+;k3hd8r+(G@ zWL>*^zyGI=sGdiPL(Zuh2J$O#zA`0`^pMmI5`}S#E(D^kbc(8LjBg2 zX7&RW-ch`7;#G=P-gGGIb1V9n#f_m{-&h#V9@1an{(9Cj?GK(ML=w;h{e_5dHwXP( zelLM8l9EGS;P%bT@eRf7lPl@;4-;hR&yGFDTzuh2T80@=PtHo;#C#$F8h^QQz0rAhlk$<4B z@&LaaUV6Z#Kb2Vy`IQ+i`Z<~OQ!(JuIBQd{;uxJ=)%wW=(Y2%SkrK`mBwR9)&H%j} ze!9Ws0F_xr*_Bxa_qt5_sReLpf{m#k`5fzogfRBftl=qn?)(^ZOjSSI@B;CTkmTKz zPk-mu)nh*OA3xLwbVxT|QDfJ&<+Y`y|7L6XbqyJcyaKk!^9EB(lXGr?8`Rk$VHZP@ zX=FKBnnAsC8aTF*aLv-WH5Nds~Ok&5Ze0^!Jdm&9&?R%WAr=;ylY$=rI6t1Y)k=@m;0l}ubm<4*c3LbV z^;@m*c={hsWVPeWKkLzP10A|XxUa9h36c3#$yNpFTA)et;TK;O=GN(fGWOnw zjhyVjHRQnE4gKCd25RiR{efh7+Nm=-$%s&UgnF*nTMeLDgg_41+ZikO%%=i|tMuUT z(qIjcPXYM&zS1LM23*eEeS2wl`0?P`h~-{)_=9;dzIp$AX!tO~hXlD`R@WOK8j-A5 z0Km-tVl*H~a&6CCoaZHviSzv=EhGRYSQ5%&W2I+|!|+!-_)xuX6KUZ+(T2DpihTCx z{?zLDYibhG@HJs~WR!Y_v~}|+4l(kvvmff|h`3z^ejN_7i(~@CqjRn5a@LiSRTVe#EYyX5a4$d8k_}r zdS_<_&J?*7b8+#E5c6_Vo-<;`D6CR|ZQolQ?Sy!3rGb>J=^@14LckD_DEC7dgj5oN zND@ks&qSg%W(1JugEz|GTWzVL41W0DD#^r&Pn6 z`Z37UBz0(4_0kcv3=0+z=%=ru}2OBm6u4IrpAFTgiAI`bD= zjwL1p^G0oy0+Bikcbka+CJJR(&Oe-%RrYQrG3oSvbAoxJPPia*UM^Ln$C!r)uD-&@ z!O(_xR4=qk>uKfg6oKShU}q67kVZ}6px8m zZ>d5@Z*IV%`ev2#>V#RigOFZ6*Y`8&p2tZ;Ibi}Iajunl#)(ZFkg+<>=mJCt5@pILBr8T|)1UBmVGP`e`!+8S6c zJeQ!qIhW#!Pf>3iUUE5>bb&JVj4Uul13BUZ|GTpRD%{v$EQR((5_;B12&BkOp#yvw zz(j;oM5(@^Dzceox=!S=qy`tUR8|HMDr0I^9uVwEmawz1DtJzxPbg4;Mwy%F%6W|G z6abf32q|@lDlS(d*;iFbilC1;mx^`QaK#bPjsLdWVDS6H6A76{-)i~h-#Bf6&?e{E z1r{8`HV+al?a0(D^HdVLDXcm#!DSsA!%YG4#m_|n@+9$S$v|HiopQYZNl0hB!WT_& z-uwsoH2GC=`mP{risC7v8(YbS6TEL^`QX)#G66BUN z8I>mjTEV2{4?UVg|GB(xsStf$ffbIuB10K2 z9jsyLNtov0)?0z+w2`qz3e96TgyLEGBn9ltHJ^KFF+HsNp z!5m>52+d0y{m-~%xIK)3RUfJTBgQg(-NA|x_L#nBQfDjEn>w?Y6YzpY66S)>EkN5W z6Ukw5B<udSm!-1jw;qym^6;CYtY6b|XhL z`I9<7iN1((UW$bNtHdw(fBU*4JG5ILVhH$?obP>h-JBg z6e3&qmhj&ylaPjL*5oLsHh$>eVbs4~|MLN8PPhR}sz~8p7{7rwXP65Gkg1Tp(wJ%p zwI}oZLR-R7m5lF>-%(stWD(7kCLd(8RWX);A6*XF$~^Wuuv z@+tOGgdZ0*bZd|N8|ux5X`(2FL^lt#gWTK#Mzye;bFT;Sa>XpvZs#a|4Nw7Fg<|Mx z?QWL0Pq5W+M@%Ea3q2u3#c_LZJC?p0{5sR8UB(_s5T-_(58J;o5cb+M(FLE>NbfS!jyKUxIoSIeu(UaM(zr z+T>nBQSH#eoXvqDS1V~}KYM*{BJ8b06^^CkQJZw{J=M@ro@1pQmep_WG{VcOap?4< zOxczlGw+rz_0w`8cF+`$Z#@WPGa&h|S9Dob)j>F{4crOFsvJOxM~uw~U=$Hldv|yM zC&$i#-{&SMHz+tYN3w3dl*cT5p(Ar<*9;FB`E-^#>gm7_eOe?6zK7&rXIV2XA1|5j za%;ZI)gr_2bX;XL#IVz5Ufa-1%(#vUhef{)4>$OzOxA4Ugi2NYrWvKvgFhXK%uDVhEicA0 zSky6C={HLCgJr+zDos^e?SnlEh^7B?`;K>b$n3>T>|PW03Kki5^uuq#Hn-ETl>+@3 zYT@KNCED(BpoC0w_Iya(G2XG7qZKBwOsDVIc)DD9r@lxqW(Nqo<`ijqDw765nO^V_ z4cpnKQ@pB)h_-2<adC)uR0^fgQfk|j$<=aEIb@~u=sAj1#pH!1XJgOpBxmIz zii!>_rnK%+qED?g_}pdEj~uOV(;{1{>Wo5*Gr(zRzxkY_lleSD6mcoq7|pol)$cJU zzk;Q4i5*fT|2GM${wG2Gp-6s7Ka=GzI~L2)lG(Si{<3j-1cQ9)JHOtp2R?&W%^bbg>tj*vvz{>|DcKsB78TCY#9`E|!Z(&v1v_eM))>PlH18NGBvn=gTRGbFut z3nD-N%%uKL{JMj#75M4qafCTYWE^M!cNZ-n@LCEhXeuRKlGSwt$t=`oja?>&9v=+k zGO7j_N*my=zsb-C*){!lER-El%3I5jA(8^V)<@?WJZfI7ARU2b%Z9TK0~!KOD+sJ{ zGRz2MM+qLs4#*Av9+@^54y5sz1=-7;5O;~Llzso-m){-)WRMSzfW!t9n*5zE+N3t0 ze6O+2eQ(~#a2eAOJw6zfmxfM11J625x^eQ8sK7E!_^ZKwpw$63L7;JtUCa8f%isO} z(I;W#`%EZ}SB_yl?`jZsm=>7v4LU1qxG*EkAIhA;A9=(K*{ZF1HSMfJjYVfaBDUsLWp&vDea7zPlGAgo# z&gWH(1F~w8bZZwD|K@J~A2-*N>2)wR;hMcLn|?;I#vU60TE>PS@cwvZvu*7=J16!< z{3dt;?n^@){AnP8;o$cS{WpG0)}z>zY6Im?I8$sa`=Xz}h>4@{*l*OIt8>rhz-!&tzI=Xk0TmkVXeixASKA{{mpPu4&)0#~a*Jjqhk z%tjyQ3B zh~#oDek_G)pocZ^a~DOaHIs5^MI}YIFaIHl|1dOmqc_{Jw#*n|Xjae__y{!p*>mP) z)@5GX$VXH2f*$B}*GBl2)fTV`k3}ohdpDK4#?3?xnr>@jo926vl1Wtv*Ri-^C*%cH zAS^@tN3vM-6ph6dxG4I?cKF2yC#UzZ_%vDjwaKjN`}jbvY7tH; z4H~3cRV=J*9R?}}Om+DZzEo9wI&zJZ4;n;;Ah(`K+@O9%*a>kli@3yhawx71l~cgWu>@n2()EdP!n zrt<4!UW+NsoNb#-;l|^^?K%tGz60^#o+{Hmdu|Es0L^m zVA@|NNR~DK@NLqZr9B1rcCOYEHc;u7s;hIOfKMV=XSi5!^@=R=5~n|+n$!ghn9{{iX7uYdSyCoiwwoFrK(MmZILs@%{^%U?blv z-8fsmT%af)De_BqNhC93q9*mpN2~9&M*QDdNFvC$RBHf*e6Xy0_y% z1rbKDNCmltFYOEW59MAj?Swn&R!YgB;*rTl`Lh3p-N*0t3_R)9v7=~(gYhOAOYpbS zQN$RS1h;D96?)P<1*-XD8j|h^jF4nHYTi`^E!p3KleV`)zZmH$WqvUpx@H+8d!AU? zJfoC}l6hW_VzYnNOC;QVn)j;_-Bpx#jvOelR_=v0O=F0}OyMX?L!PDeQCr<-Zf{K;P?I*Ru`7<_~Ol*&H6xLow3b$yD`&EGT zgXWo2f}M;b`U_Z`3ch$VQJ#06lnc?`=~LdaRi??Hm2z&8P(s1CPL2E|ghrv!X7S|0 z7*XhGFUU!tq~)p+D4La)pGkx;-p(eqkl}($*$dG?vW2Bs2^OY*D#+9w*E_Jf5?`NU zpI0N4vN+IHidk;Er#{kRTzw#~{b9rW89q&mDt-M_hF$4r;j$yGPs0a7Y%WY!re7ov z^k~;}f-h{A%5RTnDK-trXwHrk+rLpoO)DG2d~uuM1U#V?I!i}KcMW!qVmZs>fK}jL zYH9P5#)sBycMrjiLQ#`*%`HbaMk(ueK{+YZ=Pb3VEH6D&dILU4M2pVsNoJJGb<)4& zEO=&jBP5|>G3pPg9EE9EX`j+~^pSyl&qx^&a* z8ITOoL*Fx%B^* z1|fTNn6HYdEDNr)UVC3r7#&!Oj|uk&9NgPGVw}(N%89nQg#)&|XZbgx2kyawO{F(* z=^zrao#bya8cC;jDqc1ygM%wZ)%%6C>sl@Hr>HC5zU7+|n}4QmFP&1Yt~|+(ejGt( z@5?5VS)fuHvj;RI0w&%`XYgt0j!rGDK2`R}p9(fQGm)`$tuDA5Z5ETRQP+$uDABh; z&uxvYH=Dqz)~0pGJn=|da_~Ki=ng6UYkbcQN;=UiIm_@??b7jD@>*`{EbFsLc#fJ` zQl*_1uS*-ijnMg?*y2&U1!ty9K|Zk65j@Mdt_Cz7YqOid%?L9#JeY&^Z#ZKhvUvc; zp>sJa`@tZ>tmnE22@%7}09FdMzGgt4AGlLUou)#Ia>)tIek@WB{J#}jt?RYxqnqB2 zX<0O);#tOPF`FB5Rcs(`EFDn;hJH~yw7;^Lo2S)C95<7znh&|NY8%_fXZhlGVU0{~ z5iJsLhdae$q`O&ZDz#`2ZpcW;TIw29Cv=}vPRlLOux@77P%M`Qot3h-JT}p7+gKHI zq^`Q9Z6Q!%nJ9*MpeU-D(ZtD*Pa1A-JH3m#2c|MA;4XJ$YeGrS(t9BcKx&#~CrSV9 zt=}A%Q2($NAwVv!j+iLxoM4gmnBAQc?c~`z*cTVJeJ6q^E1;|w&4fPM9Op>_P6iX$ zgkf^BpLAR;gfwKy>t%{@m#k1$r;KRE(?_5P-W-K0q~#)#1L2t0!JqvKk0M6*JRr}C zZz&%v7-_wH%$LstJ!|4f#YV9~BgeXGWB1g0OkB*?Zw9^2{ZK#@@#pSbS9oR$1~?_J zSvkCG^ozXXZ%UK6w#0OFGZ9d4!&3`f!MUxO-use zU$asna}`>2$J3Y5u0VsN%mNPkwP)9-8TX(iB+AM!n3g?w2+M5=NFsvsb6H9W)ocTeOlV)q4KBj!h{y~0CvvlM*=YZ=sKDdT{=_dLi{ zMk3u$cMIdokSYO}KcR$NhH#qLlm3a21r{7{7dJs``x{n>!g5xP)(S|BhBR>TaEhvr zSvOck$Op_ZoJ|)cg5H&mKrT~|~^0u)4qS-f(>isLUyQIUWi{8z8LgfEB{VpMWs=IX(3=KBIN?bWI zer{4dg>@A@1a=*zC~RY*l+@ZECR@Wt9~Hx`znQ@q5hig^XVg<yGQT|@*fmfQS6QDIiUa5|9gPV-9LVCmV^3`;Cg zbiQ8`Q#=kFwb&RCLBc1yD`-fULRhOaWVvELg@n}PAc&BvONbJ1G{TT^UT|!qGzC%! zLoCKD`uX*$+rQv4U0UlQ8kS>yLt>H*$gpHX^^T5SgxvA3T35T0{ffzRECu=Or z21|UHz~$Y)IA4Kf@&W*C@oh9w_?b}4+U{#XtI62xc(h|9S9sT#tPDKt01|1?q8k5l zC(ABH#T`z|B+`;{^vT2%QK|>L!w5EkbgKuT(}eJbE5J{@LZg-DFq$#)akEP%npb<41MA0fSDqj*UkMNL_%f6c+6+p^)a5}qZYYr85 zi}7O=h(}d@~fV9HcEk@TeHrI)1aq?CU}x?DLil66VqC`bc+c~FxA<^yaJ8;l>1{M0n!qqJ zHu0yC^5;PZ0rtXmGY4`KinUFlqv3-JibM6DAWk30cx3EKCJ5Ftu2s?QHp@26sv;6uSnC%Zp10)Mtn6Rso^sdmo<#sxbOEXA&{mP zYM&L+X*Sk#R4JwuN&MXL5YuKi))p}}fLSyL=GZ{IOqG(qTM4n{1q;HO2oH=RM%00W zX#zd{?u^jIi~?S0|~H{K>TX=*U>t+q{D*IIXPACSA<$= z_vTBo2W0BDL#!4)`6|-Y)BnY^M7Zdnx#C=^1_(q+&bbd2gO1F}dw@2DDm#V$wY%2J4(0@F>prvEk`?FqqxkBxGO!_QKA~+? z>}=hmWgMKW%&aze_#4UX;%9MzwuEY`H2$>CjG-y&GxY)y^q+?~X(r4A*mP_5u8gIP zQ!iG}Z{b9`3jnvhocZ$GO32sQZw*+x?$H$AoLdL8Bko_H@Fb_Y3Mri;V?L5yRg4%{ zA94vC%uRL_P$FVn0@?=c@LH*`>xI|ZXm2V+t~F+DRn>xmiwkQhV9kkkz)J7f2rAq7 z5)hoXB;zI%BL&7=9?3>0h}!JGFQU4{;;hiw#=U?>l<}Y>wAWo<(`IWKk4&=CbGHh& z1?9T5DE25PFvN>RRz&gFvo#}mn^-!w`rleOXf@LF^soaLQ4&lH2M@o}u|glHP@28U zRrSft%LeygbCdB^C7b6!qmg*@MOhe`cs5yq`R#YcO&p({YBTke;M84GDXpD;1|TJ# zaLuVsdq(f zP>(TmyT4f*gIZ3=nmb~9B!>RI^s#okpTWT>gtz_oIk2g*y1!C6dT%z%hO4=k7$x!k8%liEl z;ESA~C3RC>>S#h1W#}s5jrf=c{0BVB`9YW6FmFt?oT2ug(MP;=QmGNv`v;!I(Ag*O zsXCWqtx*OSbhaba6PH6Y28A(HUroJmMQktpPofF7>xpi&qXa|X0|j$AB{sqrARBON zXZv2k5mla-utDfYn^@{G_wXGI=`cNMnhU%7jSHEO=+~Nkn9ZI3L6YL?Elq#EHy7g=}v##q2~Xw{1z09b_^b}&;BCnf%B*6oaxm`ntJH^VibP# zeBCe-3<7?oTRP1D@%u_IxX%l2W9R#WX)tNV_+kuqYfk0=8}K>KOIDYAB@*Y=#3d2x zAVG-0tfxs?xg!WD5{i0O0&24GVv7 zJitt8rh)WnpT?YSNK~sF?y! zAXeOMr6OE1%k>MpK%Nfi6 z$UI?Mw81*ElL+b=*Fy->kVjqQ>$IG5)FC>7xaQ* z8uL+4mhKOS@|3@wYss|}V-=s64rI#9B<FIYdoY z3Lipy3fB)12`kqVaDZ;F16wdx-&!q}DfvE}Bh1!scgTiXnpXmtX*p_0ZWYsBn4dk` z?f6)i>yXn2hYkRB4RPXs&~6W=U#0lt&X{wEfwVNqoi=B}JDH=yPk=4eYTO`a=w3US z3;?NFpf$_XNpqoiCzRlQK^+!+v7~fSQ$KzV!xBF~LsH14Srwf8)&garevGN3`^D=W zNk$Wq7B6c#Zh&x zFsIe4sCcBs(+O7*l}{)E>(v+CrlKZi&RvfWq$NYAvE8&qPL#GC8wE>o&KeFR`#s^h zZ5fXhh73tU3JZ-S{*RykBOR#Hc(kI$q*jM-FDGwt5U+=LiFUq?z+?Qt^rV<6dqenU zxC@1dDDcz>(H(S|jiaI%wJmMMVHVy$~T=6!b z)GRgnC&!zfQmva-z4u@0o};C!u~4rgQ%{4kE-b$s`(Xb9`TkqFx3lRkk^342u2m8_ z>#$#g;ix*bfyL!%vHKJO?9~$0dv_mzl{&HZdOxBAAnd+_H*2=JWwx-o@9J809*jp! z>Dyt*&B?)!9yXeT87x=g(0+f=zOtDdy zj6&1+Y{0YSbvuSUxocxusvLZ)vUfx8EYMQ3swY>yN=26~v*}WK2vkHqBeDaGP`ju& z-MY3-c^iKW1qi?%*=J;!>?gPbIeGN#owav_SsoCIzkOSbGdb@fzTE5_3q1SyG{0!^ z;J;8A@K*@eK~DIv5>-Z9v8yFHS!Ll=Mr<|}HGrn7-HNd0405gt+K5F^S(JA#89peC zmu&sNv_-9SG-DQF_R##qJtTIZv|Uc|gC!#@@G&i5X$$h(hH?R>r;{em$;(zZfG#>M zOwvKLSwI>~VN)2qYH8)24goGv|>4KP(hIL{KMZ zRw_i+k4zJoz>#BmG;bUo#E*1BS5P+-$-z-$WiRPt9!Qvj-VwVE;#Blu+Po`f?FHeX z6ggEiOZ5>Jjdlu{w-IzbZ@>j6bY~caEk*)bvF53JbZ@CKb^d`@?RSmM@yL6|I54V9 z7{l)5h~z7~@#^qI_w~HRct=Dd%+X_sBOQ-;XNhoUjr8{+(zrv9D)A)^BtO*-U!Zp|{s$831-Vg0=Wtxz~_ZB_y)6g98AacmTL#FR%Hx(CsR9 zZWFU+a0Hsbby{CcUQBy>Vw{}5COkUi4 zBeV*~gwB>sfdPG?VChO-q@@23zEOYw4}8NVR(poTI1ZgXOaSBr^<{1&t*NndCOmz( z0-ZMa$BZq;RuMlxUgd`YjoKopwkaHB#v-DqF?1b~q&h)9V^79Xb&|n1w%6rw1M2*45aq8nbAB2@^rx{&~-EPl$GmZ{%iPRmeJ4Pxh-;1*9Oc{ ze1O5d&U);{L4j7Mp?N;Zdu0}AQ~FMjO{y@?{Qq+|0&`BLD3;`jf97X*jW+# zkjjKYrUMy{S5`^mE}jLgmmJP z)!A9nA05uo8NQ={u0zW!Z69~C{71%iU7%bhyvaN9VD?_adY)V^^Vet|e`@wHO(m~% ztv`pNOFdbXia}_5^E3iJC)>?bp(t0wXWfAI;EaJHb{;)81xIAEK1YM5FHDYEpjwz% z%TX@_=LP8qOA!k-N)cMYHp?_i5hGW5K3ayL|Ci>y1rn)zoapW8`uTFNUuPFxwkgN6 zl|yCsFbijk-C`|l2bt`8Em) z;uAt8=^!BS$BGNw;9HQ z8cPXhZ??g@kYIDL?YyhBoE@V`i}X|cIq3YpQi&3#3$i?zM(1SU3~MP*p=B;!?rpwz zQQDLOxkCRPA+Dzc!0qX8B61;?Z9hHP@D zd^PRB^BvKIowvis?nsmQWKfnWRKmFSl7gIQ=To7aC95P0Y ztVH*Zg+mg8a7~-XpkDa#ktKKakrecS-$%|c)4&mol za&6k8uCA!eiNpWacWBkPfqG!l)|AdXk|K%gkfP8mzj8Dx+*jQ_CE8Zp-kG%$CNJQS zO!Dlq+euylO0}h2{wG>xzwguW^UL!0OU$f@H+s{4a zw%L~jt^QaxBAuQCm(TaFvk+Gs#}iTw`}gS@hLJRBj+7=~OQ9nMYOpY3B zOnCT>@j>wn(^HXDur!#|5Jh(!8l@jhjw&<@;d(6$?W(51j>y4e)M@0uJfEF1*#01G zl6bN!<<)~2tix>PFuxcH?~oDX(ZKJo?}r%H6Iz`5c-5Px3&SBFJM>(A`f@O_%daMs zc*j*+5n~@P6sj{-2dWTzo)p&ZH;Gw~sgVM#ZWA^V7LLr`B>f9RM}FQu zGXKw~=!G|yg#KwQ;owSXHkb+4GsZYPS34cs_^Bu_x0xvVQ`W#Q=UJ3^sio`6$x=S!l{W&M{Srz5 za&SxS^TF9fTQ-&C)!77bnH>DIYOJeLYBZ>^UA_$q!? z(I0yaS!U@t8dpwND`!@A6xE|t(=6q(incr0C|WIdRBNiVkhEH4vrc*|oAw1_yYLmi zX0qaagUPk`EtF00w>KYKTf6zXXyF&<1U#a#SfYi&4)h?xy2w%Kq#qTg#b4xgAhZGr zZFE1s-v!o&%6pZFzp_oxo!>EI2}!Qc_L7(6I*n?Q_ZbdsC&1?QU2DKTr-=7z36YS0 zYo&f}zjjQl^wkvfvL1@jzcXX2URt?LDs3LT2NV1M;6;U4jPl7Z6YuM5e~CwVtT!BT%AdY-*5GJLO^^4MATFlc zP31R16Sv_|*5*9TjosYW&fcrdD(FZ+wT6&YO12wn)34(i@G(}$a1D+nK8qpgT+l4Y zO+*hz=1yoh0WIDm?Uqd&BgMpDQ0bR&_>R^5%nlscNyRa5X<(m>E>+S3DJ~VWey#=$aw4|SAtiwwkB6Owjlnxt+2%ioH5_i% z6PsWqg;QK64`cUci1>PLPfPV`sTW=`<4HERyNmWpjErY(*uI&h6xfVoCfcHMYt53& z@1U>iV=i6IA3K!YFjy-S7G(3MxsAitHowg$PA56gYkDXv)#y#AbBO_yvcD!TjUHM! zzjbvb52KbQQdrHLdQgI5XL z$RJRAv2gbXy+-xNZpRSLu3G?Tx~&toEhKsFEMCERR; zH-gyNO`-BF6=Bu0s8y&VcJHMxr`<_CH$zzKQ&62lm0?#IEUvs5P+xAmQ0M0ApPQV? zRHZl|hYE;Qc7 zukhsSu4y3c^TvNGfx_@#yLmB*`0G(wC_dZXv}V-xyMO>5c)tA$W(y?3z7tox)Fi7n ze1C^c?gG~_DmH+ktnF`8mf8D-sC--bTVr*8U20j&q@W0zcCk!Smtwxj$DRN+#8azC znV#dci#`c2Yb;E=H!<=v1R_RM!+F)F34NoCJn`sx~g~d+sd8 zCp^`yCyp&g&ppbBy1^<>m6LMVW|%Z@ZsZS*7NcA^})uvmeM=)cUo47__lkaQ{_=#>gBY7jDFOp{(8%x z*;$GygN3&a<<{smJ=D@lP4So1*I9(gG+cuSVcstlE7D8bD)$J*Q87mMGU&meimneI z7nH82M@_cS?sEF^ae-82cg64*2|r-~8%tXE(pX_WYt ziG}(EhkZ_c5}LwCFRgOUyTBF4Fry~VKa%0n_aWn=j>$0ocbwrCfl&L?syY>e59^BRY8 zb@ZV%Y6(zV%$zo>&^K9vYv>}(OQ&JGF7+t7^UB+mT)(wG{wna*wA$?kvow4Gw})}9 z^9TkP!PMc%qQ4yBR9dgPe=d)F>+-O{Ec+f!wz&~viP_3VHp0`Lmg33#Gq5R)HrgM} z`Ta3#ZNS+Qr#PY3KjD;9jgfxs3V!8vw~?%<_!XyG!3SZAyy%;chaUdzdS<4AQ*Eb- zpKZ>$>@UfmDMgSj$io-<>yP;hXo=8Nak=Km$lMn39vjoln?I6NsEVGQHu~@IB)>{u zWDC++D$Zrq${s(PTWo*3{+;=VUH>AqDawR&xsAa_sn2Vx@h}Z1b<>Zm#Fj_RgclbH zo)G7RA{V32BXl1=Ej{LU$^gPiO#G%N>E6cx_cL*~Frifqp|hGjU9#@a8wg5Dfrs42 z$&{9ohO~M7$;paE9AHhOPK4&@)%#4^FvU;qa#EwFV2Low;9=mgcxOKCQDVI7XMMj( zTd+njU#%B|ekm|MhK`~yJawEEnD{O`QS0b;m-FVv2C0RNJ{c4Wov0>vJme!D`wx1yukz*FoxL5TM% z6PJ#VyUKcKDm@>QD2?ukl~m zI(%AX)z9-rZUhFfP{TeS+$M<&F;2e%J_nkenQ{j7WlJl5KnFg{P;1T@X*Jv#cL@B< zZM!%$lPws^w58H_`WeE&ehruh%6aL^58}34#Y`>V(`iwWhJNo5ry)*YQ&NIHcN_ZV96TJM%VG2A5UgV$46kx4Rd* zbo3y~n%=QQ9nFA}D8~lAFqYF7TTcLW+DIP6mE(_5ajK*Yth$uIFvpH<2N%e_?6`hg z?mh@p2iW+;fWQ}3M5mKMcqFg+Z*kpK|AgL_VuYCZyZ0lp;Teo1dlvfEXzo7>t{W_< zYH7`Z7U%(8&Slrd+vn-hlWin-Jk%Hs#)((AIKbaBD>5;LN#=1t#utJFVm=$(PqLp* z(~Z0QTI2bySHm$@(FiQ5KzVt8G7Qi4>RU+cCVwVTiOw8_jr$O66b^DBN(ii}2N3sV z)FO=gF_IRhw2SESYc7c_t}axIL7HG(yIqHcO;WdMeaW*M*62WIwjaQa84>mN!Q=Y_qD8}kW-X#;xU5;v(>01sK@Zog(@~R;GXoQFT!p_n z6fV`i(#zh!_cBp}Rf_7g=;8+|ij28nu`r>eVx#!~__0fp$A66f10(zICjZR>`FDq= aOS0MjkU=a=XlVZ~p}LG`ml Updated the polling interval and `t0`/`t1` time window configuration of the **CCF Connector** data types to fix duplicate ingestion.|