From eb45d8f7234137f4481d6f75b1b62fefa891b7ba Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Mon, 20 Jul 2026 14:13:58 +0200 Subject: [PATCH 01/71] Add HoneyForge Threat Detection solution v1.0.0 --- ...HoneyForge_DeceptionSensorInteraction.yaml | 143 +++ .../Data Connectors/HoneyForge.json | 114 ++ .../HoneyForge_FleetCoverage.yaml | 50 + .../HoneyForge_HighFrequency.yaml | 58 ++ .../HoneyForge_OffHoursActivity.yaml | 68 ++ .../HoneyForge_RepeatedProbes.yaml | 57 + .../HoneyForge_TopAttackingSources.yaml | 53 + Solutions/HoneyForge/Logos/HoneyForgeLogo.svg | 4 + .../Package/createUiDefinition.json | 46 + .../HoneyForge/Package/mainTemplate.json | 984 ++++++++++++++++++ .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 123 +++ Solutions/HoneyForge/SolutionMetadata.json | 51 + .../HoneyForge/Workbooks/HoneyForge.json | 228 ++++ 13 files changed, 1979 insertions(+) create mode 100644 Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml create mode 100644 Solutions/HoneyForge/Data Connectors/HoneyForge.json create mode 100644 Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml create mode 100644 Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml create mode 100644 Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml create mode 100644 Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml create mode 100644 Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml create mode 100644 Solutions/HoneyForge/Logos/HoneyForgeLogo.svg create mode 100644 Solutions/HoneyForge/Package/createUiDefinition.json create mode 100644 Solutions/HoneyForge/Package/mainTemplate.json create mode 100644 Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml create mode 100644 Solutions/HoneyForge/SolutionMetadata.json create mode 100644 Solutions/HoneyForge/Workbooks/HoneyForge.json diff --git a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml new file mode 100644 index 00000000000..0656b5b735a --- /dev/null +++ b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml @@ -0,0 +1,143 @@ +id: bb3b1339-c1fa-473a-8663-3fea78c2e7e2 +name: HoneyForge - Deception Sensor Interaction +description: | + Detects an interaction with a HoneyForge deception sensor. Any activity + involving a HoneyForge sensor must be treated as potentially unauthorised + until validated by the security operations team. + + HoneyForge sensors are passive decoy devices — legitimate systems and users + should never communicate with them. Any detected interaction may indicate + network scanning, lateral movement, or an actively compromised device. +severity: High +status: Available +requiredDataConnectors: + - connectorId: HoneyForge + dataTypes: + - CommonSecurityLog +queryFrequency: 5m +queryPeriod: 5m +triggerOperator: gt +triggerThreshold: 0 +tactics: + - Reconnaissance + - InitialAccess +relevantTechniques: [] +query: | + CommonSecurityLog + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + | extend + SrcIpAddr = tostring(SourceIP), + DstIpAddr = tostring(DestinationIP), + SensorID = tostring(DeviceCustomString1), + CustomerID = tostring(DeviceCustomString2), + SensorName = iff( + isempty(tostring(DeviceCustomString3)), + tostring(Computer), + tostring(DeviceCustomString3) + ), + EventType = iff( + isempty(tostring(DeviceEventClassID)), + "unknown", + tostring(DeviceEventClassID) + ), + EventActivity = tostring(Activity), + EventProtocol = tostring(Protocol) + | where isnotempty(SrcIpAddr) + | where isnotempty(DstIpAddr) + | summarize + TimeGenerated = max(TimeGenerated), + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + EventCount = count(), + SourcePorts = make_set(tostring(SourcePort), 20), + DestinationPorts = make_set(tostring(DestinationPort), 20), + Protocols = make_set(EventProtocol, 10), + Activities = make_set(EventActivity, 20), + CEFSeverities = make_set(tostring(LogSeverity), 10), + DeviceVersions = make_set(tostring(DeviceVersion), 10), + Collectors = make_set(tostring(CollectorHostName), 10) + by + SrcIpAddr, + DstIpAddr, + SensorID, + CustomerID, + SensorName, + EventType + | extend + SourcePortList = strcat_array(SourcePorts, ", "), + DestinationPortList = strcat_array(DestinationPorts, ", "), + ProtocolList = strcat_array(Protocols, ", "), + ActivityList = strcat_array(Activities, ", "), + CEFSeverityList = strcat_array(CEFSeverities, ", "), + DeviceVersionList = strcat_array(DeviceVersions, ", "), + CollectorList = strcat_array(Collectors, ", ") + | project + TimeGenerated, + FirstSeen, + LastSeen, + EventCount, + SrcIpAddr, + DstIpAddr, + SourcePortList, + DestinationPortList, + ProtocolList, + SensorID, + SensorName, + CustomerID, + EventType, + ActivityList, + CEFSeverityList, + DeviceVersionList, + CollectorList +suppressionDuration: 5h +suppressionEnabled: false +incidentConfiguration: + createIncident: true + groupingConfiguration: + enabled: true + reopenClosedIncident: false + lookbackDuration: 4h + matchingMethod: Selected + groupByEntities: + - IP + groupByAlertDetails: [] + groupByCustomDetails: + - CustomerID + - SensorID +eventGroupingSettings: + aggregationKind: AlertPerResult +alertDetailsOverride: + alertDisplayNameFormat: "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}" + alertDescriptionFormat: | + HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}} + using {{ProtocolList}}. Treat this activity as unauthorised until validated. +customDetails: + CustomerID: CustomerID + SensorID: SensorID + SensorName: SensorName + EventType: EventType + Activity: ActivityList + SourcePorts: SourcePortList + DestinationPorts: DestinationPortList + Protocol: ProtocolList + EventCount: EventCount + FirstSeen: FirstSeen + LastSeen: LastSeen + DeviceVersion: DeviceVersionList + Collector: CollectorList +entityMappings: + - entityType: IP + fieldMappings: + - identifier: Address + columnName: SrcIpAddr + - entityType: IP + fieldMappings: + - identifier: Address + columnName: DstIpAddr + - entityType: Host + fieldMappings: + - identifier: HostName + columnName: SensorName +version: 1.0.0 +kind: NRT diff --git a/Solutions/HoneyForge/Data Connectors/HoneyForge.json b/Solutions/HoneyForge/Data Connectors/HoneyForge.json new file mode 100644 index 00000000000..26cd4b8dfa9 --- /dev/null +++ b/Solutions/HoneyForge/Data Connectors/HoneyForge.json @@ -0,0 +1,114 @@ +{ + "id": "HoneyForge", + "title": "HoneyForge Threat Detection", + "publisher": "BUI", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "logo": "Logos/HoneyForgeLogo.svg", + "graphQueriesTableName": "CommonSecurityLog", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "HoneyForge sensor events", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" + } + ], + "sampleQueries": [ + { + "description": "All HoneyForge events — last 24 hours", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" + }, + { + "description": "Top source IPs interacting with sensors — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" + }, + { + "description": "Events by sensor — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" + ] + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (HoneyForge)", + "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "Read permissions to shared keys for the workspace are required to enable the Log Analytics agent.", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ] + }, + "instructionSteps": [ + { + "title": "", + "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." + }, + { + "title": "Step 1 — Deploy the CEF syslog forwarder", + "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", + "innerSteps": [ + { + "title": "1.1 — Install the Log Analytics agent and CEF collector", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "instructions": [ + { + "parameters": { + "fillWith": ["WorkspaceId", "PrimaryKey"], + "label": "Run on the Linux forwarder:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + { + "title": "Step 2 — Configure HoneyForge syslog forwarding", + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za)." + }, + { + "title": "Step 3 — Validate connectivity", + "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", + "instructions": [ + { + "parameters": { + "fillWith": ["WorkspaceId"], + "label": "Run the troubleshooter on the Linux forwarder:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ] + } + ] +} diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml new file mode 100644 index 00000000000..f08b675ef2a --- /dev/null +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml @@ -0,0 +1,50 @@ +id: 7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c +name: HoneyForge - Sensor Fleet Coverage and Health +description: | + Provides a per-sensor event summary for the past 30 days, giving visibility + into which sensors are active, which are quiet, and which may be offline or + misconfigured (no events in the last 10 minutes is the offline threshold). + + Use this query during routine operations to confirm full fleet coverage and + identify any gaps in your deception layer before an attacker does. +requiredDataConnectors: + - connectorId: HoneyForge + dataTypes: + - CommonSecurityLog +tactics: [] +relevantTechniques: [] +query: | + let lookback = 30d; + let offlineThreshold = 10m; + CommonSecurityLog + | where TimeGenerated >= ago(lookback) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + | extend + SensorID = tostring(DeviceCustomString1), + CustomerID = tostring(DeviceCustomString2), + SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) + | summarize + TotalEvents = count(), + UniqueSources = dcount(SourceIP), + FirstEvent = min(TimeGenerated), + LastEvent = max(TimeGenerated), + Protocols = make_set(tostring(Protocol), 10) + by SensorID, SensorName, CustomerID + | extend + MinutesSinceLast = datetime_diff('minute', now(), LastEvent), + SensorStatus = iff(datetime_diff('minute', now(), LastEvent) <= 10, "Online", "Offline / No Recent Events"), + ProtocolStr = strcat_array(Protocols, ", ") + | sort by SensorStatus asc, LastEvent desc + | project + SensorName, + SensorID, + CustomerID, + SensorStatus, + MinutesSinceLast, + TotalEvents, + UniqueSources, + FirstEvent, + LastEvent, + ProtocolStr +version: 1.0.0 diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml new file mode 100644 index 00000000000..815f8e03655 --- /dev/null +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml @@ -0,0 +1,58 @@ +id: 73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d +name: HoneyForge - High-Frequency Sensor Interactions +description: | + Detects source IPs generating an unusually high volume of events against + HoneyForge sensors in a short window (more than 50 events in any 10-minute + period). This pattern is characteristic of automated scanners, brute-force + tools, or worm-like lateral movement. + + High-frequency hits deserve immediate triage — especially if the source is + an internal IP, which would indicate a compromised or misconfigured device + inside the network. +requiredDataConnectors: + - connectorId: HoneyForge + dataTypes: + - CommonSecurityLog +tactics: + - Reconnaissance + - LateralMovement +relevantTechniques: [] +query: | + let lookback = 24h; + let burstWindow = 10m; + let burstThreshold = 50; + CommonSecurityLog + | where TimeGenerated >= ago(lookback) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + | extend + SrcIpAddr = tostring(SourceIP), + SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), + CustomerID = tostring(DeviceCustomString2) + | where isnotempty(SrcIpAddr) + | summarize + BurstCount = count(), + SensorsHit = dcount(SensorName), + SensorList = make_set(SensorName, 10), + Protocols = make_set(tostring(Protocol), 5), + DestPorts = make_set(tostring(DestinationPort), 10), + WindowStart = min(TimeGenerated), + WindowEnd = max(TimeGenerated) + by SrcIpAddr, CustomerID, bin(TimeGenerated, burstWindow) + | where BurstCount >= burstThreshold + | extend + SensorListStr = strcat_array(SensorList, ", "), + ProtocolStr = strcat_array(Protocols, ", "), + DestPortStr = strcat_array(DestPorts, ", ") + | sort by BurstCount desc + | project + SrcIpAddr, + CustomerID, + BurstCount, + SensorsHit, + WindowStart, + WindowEnd, + SensorListStr, + ProtocolStr, + DestPortStr +version: 1.0.0 diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml new file mode 100644 index 00000000000..b1b75667708 --- /dev/null +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml @@ -0,0 +1,68 @@ +id: 5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e +name: HoneyForge - Off-Hours Sensor Activity +description: | + Surfaces HoneyForge sensor interactions that occurred outside normal business + hours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on + weekends). Off-hours activity from internal IPs is especially suspicious — + it may indicate a compromised device operating autonomously or an insider + threat. + + Adjust the hour thresholds to match your organisation's working hours if + they differ from the defaults. +requiredDataConnectors: + - connectorId: HoneyForge + dataTypes: + - CommonSecurityLog +tactics: + - Reconnaissance + - LateralMovement +relevantTechniques: [] +query: | + let lookback = 7d; + let businessStart = 7; // 07:00 UTC + let businessEnd = 19; // 19:00 UTC + CommonSecurityLog + | where TimeGenerated >= ago(lookback) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + | extend + SrcIpAddr = tostring(SourceIP), + SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), + CustomerID = tostring(DeviceCustomString2), + HourUTC = hourofday(TimeGenerated), + DayOfWeek = dayofweek(TimeGenerated) + | extend + IsOffHours = case( + // Weekend (Saturday = 6d, Sunday = 0d) + DayOfWeek == 0d or DayOfWeek == 6d, true, + // Outside business hours on weekdays + HourUTC < businessStart or HourUTC >= businessEnd, true, + false + ) + | where IsOffHours == true + | where isnotempty(SrcIpAddr) + | summarize + TotalEvents = count(), + SensorsHit = dcount(SensorName), + SensorList = make_set(SensorName, 20), + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + HoursActive = make_set(HourUTC, 24), + Protocols = make_set(tostring(Protocol), 10) + by SrcIpAddr, CustomerID + | sort by TotalEvents desc + | extend + SensorListStr = strcat_array(SensorList, ", "), + ProtocolStr = strcat_array(Protocols, ", "), + HoursStr = strcat_array(todynamic(tostring(HoursActive)), ", ") + | project + SrcIpAddr, + CustomerID, + TotalEvents, + SensorsHit, + FirstSeen, + LastSeen, + HoursStr, + SensorListStr, + ProtocolStr +version: 1.0.0 diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml new file mode 100644 index 00000000000..514b2566cf0 --- /dev/null +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml @@ -0,0 +1,57 @@ +id: e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b +name: HoneyForge - Repeated Probes from Same Source +description: | + Finds source IPs that have probed HoneyForge sensors on multiple distinct + occasions separated by at least one hour, suggesting deliberate or scripted + reconnaissance rather than a one-off event. + + A legitimate network scanner that hits a sensor once might be an + oversight. One that returns hours or days later is a persistent threat. +requiredDataConnectors: + - connectorId: HoneyForge + dataTypes: + - CommonSecurityLog +tactics: + - Reconnaissance +relevantTechniques: [] +query: | + let lookback = 14d; + let minSessionGap = 1h; + let minReturnVisits = 2; + CommonSecurityLog + | where TimeGenerated >= ago(lookback) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + | extend + SrcIpAddr = tostring(SourceIP), + SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) + | where isnotempty(SrcIpAddr) + | sort by SrcIpAddr asc, TimeGenerated asc + | serialize + | extend + PrevTime = prev(TimeGenerated, 1), + PrevSrc = prev(SrcIpAddr, 1) + | extend + IsNewSession = iff(SrcIpAddr == PrevSrc and (TimeGenerated - PrevTime) < minSessionGap, 0, 1) + | summarize + TotalEvents = count(), + SessionCount = sumif(IsNewSession, IsNewSession == 1), + SensorsHit = dcount(SensorName), + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + SensorList = make_set(SensorName, 20) + by SrcIpAddr + | where SessionCount >= minReturnVisits + | extend DaySpan = datetime_diff('day', LastSeen, FirstSeen) + | sort by SessionCount desc, TotalEvents desc + | extend SensorListStr = strcat_array(SensorList, ", ") + | project + SrcIpAddr, + SessionCount, + TotalEvents, + SensorsHit, + DaySpan, + FirstSeen, + LastSeen, + SensorListStr +version: 1.0.0 diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml new file mode 100644 index 00000000000..fc02427007f --- /dev/null +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml @@ -0,0 +1,53 @@ +id: 795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f +name: HoneyForge - Top Attacking Source IPs +description: | + Identifies the source IP addresses that have interacted most frequently with + HoneyForge deception sensors over the past 7 days. Repeat offenders across + multiple sensors are especially high-priority — they indicate persistent + reconnaissance or an automated scanner that missed the exclusion list. + + Use this query as a starting point for threat-intel enrichment and to decide + which IPs warrant a block rule or further investigation. +requiredDataConnectors: + - connectorId: HoneyForge + dataTypes: + - CommonSecurityLog +tactics: + - Reconnaissance +relevantTechniques: [] +query: | + CommonSecurityLog + | where TimeGenerated >= ago(7d) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + | extend + SrcIpAddr = tostring(SourceIP), + SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), + CustomerID = tostring(DeviceCustomString2) + | where isnotempty(SrcIpAddr) + | summarize + TotalEvents = count(), + SensorsHit = dcount(SensorName), + CustomersAffected = dcount(CustomerID), + FirstSeen = min(TimeGenerated), + LastSeen = max(TimeGenerated), + SensorList = make_set(SensorName, 20), + Protocols = make_set(tostring(Protocol), 10), + DestPorts = make_set(tostring(DestinationPort), 20) + by SrcIpAddr + | sort by TotalEvents desc + | extend + SensorListStr = strcat_array(SensorList, ", "), + ProtocolStr = strcat_array(Protocols, ", "), + DestPortStr = strcat_array(DestPorts, ", ") + | project + SrcIpAddr, + TotalEvents, + SensorsHit, + CustomersAffected, + FirstSeen, + LastSeen, + SensorListStr, + ProtocolStr, + DestPortStr +version: 1.0.0 diff --git a/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg b/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg new file mode 100644 index 00000000000..23a0a4cde9a --- /dev/null +++ b/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/Solutions/HoneyForge/Package/createUiDefinition.json b/Solutions/HoneyForge/Package/createUiDefinition.json new file mode 100644 index 00000000000..c03d2db7ab4 --- /dev/null +++ b/Solutions/HoneyForge/Package/createUiDefinition.json @@ -0,0 +1,46 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", + "handler": "Microsoft.Azure.CreateUIDef", + "version": "0.1.2-preview", + "parameters": { + "config": { + "isWizard": false, + "basics": { + "description": "\n\n**Note:** Please refer to the following before installing the solution:\n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\n[HoneyForge](https://honeyforge.tech) is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook.\n\n**Data Connectors:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5, **Parser:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { "resourceProviders": ["Microsoft.OperationsManagement/solutions", "Microsoft.OperationalInsights/workspaces/providers/alertRules", "Microsoft.Insights/workbooks", "Microsoft.Logic/workflows"] }, + "location": { "metadata": { "hidden": true }, "allowedValues": [], "visible": false }, + "resourceGroup": { "allowExistingGroups": true }, + "armboard": { "value": "[steps('basics').resourceScope.resourceGroup.id]" } + } + }, + "basics": [ + { + "name": "getLAWorkspace", + "type": "Microsoft.Solutions.ArmApiControl", + "toolTip": "This filters by workspaces that exist in the Resource Group selected", + "condition": "[greater(length(resourceGroup().name),0)]", + "request": { + "method": "GET", + "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" + } + }, + { + "name": "workspace", + "type": "Microsoft.Common.DropDown", + "label": "Workspace", + "placeholder": "Select a workspace", + "toolTip": "This dropdown will list only workspaces that exist in the Resource Group selected", + "constraints": { + "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", + "required": true + }, + "visible": true + } + ], + "steps": [], + "outputs": { + "workspace": "[basics('workspace')]", + "location": "[location()]" + } + } +} diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json new file mode 100644 index 00000000000..dfa7fb3ec61 --- /dev/null +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -0,0 +1,984 @@ +{ + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "The Log Analytics workspace name to deploy this solution into." + } + }, + "location": { + "type": "string", + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Azure region for all resources." + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "Region of the Log Analytics workspace. Must match the workspace location." + } + } + }, + "variables": { + "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "_solutionId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "_solutionName": "HoneyForge Threat Detection", + "_solutionVersion": "1.0.0", + "_publisherId": "bui", + "_offerId": "honeyforge-threat-detection", + "_connectorContentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", + "_analyticRuleContentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "_parserContentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", + "_workbookContentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853" + }, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/Solution-', variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "version": "1.0.0", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "HoneyForge Threat Detection", + "publisherDisplayName": "BUI", + "descriptionHtml": "

HoneyForge is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook.

", + "contentId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-sl-',uniqueString(variables('_solutionId')))]", + "id": "[concat(variables('workspaceResourceId'),'/providers/Microsoft.SecurityInsights/contentpackages/', variables('_solutionId'))]", + "icon": "", + "contentKind": "Solution", + "packageKind": "Solution", + "packageId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "packageName": "HoneyForge Threat Detection", + "packageVersion": "1.0.0", + "source": { + "kind": "Solution", + "name": "HoneyForge Threat Detection", + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "DataConnector", + "contentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", + "version": "1.0.0" + }, + { + "kind": "AnalyticsRule", + "contentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "version": "1.0.0" + }, + { + "kind": "Parser", + "contentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", + "version": "1.0.0" + }, + { + "kind": "HuntingQuery", + "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", + "version": "1.0.0" + }, + { + "kind": "HuntingQuery", + "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", + "version": "1.0.0" + }, + { + "kind": "HuntingQuery", + "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", + "version": "1.0.0" + }, + { + "kind": "HuntingQuery", + "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", + "version": "1.0.0" + }, + { + "kind": "HuntingQuery", + "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", + "version": "1.0.0" + }, + { + "kind": "Workbook", + "contentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853", + "version": "1.0.0" + } + ] + }, + "firstPublishDate": "2026-07-20", + "providers": [ + "BUI" + ], + "categories": { + "domains": [ + "Security - Threat Intelligence", + "Security - Network" + ] + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_connectorContentId'), '-dc-', variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", + "displayName": "HoneyForge Threat Detection", + "contentKind": "DataConnector", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": {}, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/DataConnector-', variables('_connectorContentId'))]", + "properties": { + "contentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", + "kind": "DataConnector", + "version": "1.0.0", + "displayName": "HoneyForge Threat Detection", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_analyticRuleContentId'), '-ar-', variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "displayName": "HoneyForge - Deception Sensor Interaction", + "contentKind": "AnalyticsRule", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": { + "analyticRuleId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "analyticRuleVersion": "1.0.0" + }, + "resources": [ + { + "type": "Microsoft.SecurityInsights/AlertRuleTemplates", + "name": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "apiVersion": "2022-11-01-preview", + "kind": "NRT", + "location": "[parameters('location')]", + "properties": { + "description": "Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices — legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.", + "displayName": "HoneyForge - Deception Sensor Interaction", + "enabled": false, + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n EventType = iff(isempty(tostring(DeviceEventClassID)), \"unknown\", tostring(DeviceEventClassID)),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(CollectorHostName), 10)\n by SrcIpAddr, DstIpAddr, SensorID, CustomerID, SensorName, EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated, FirstSeen, LastSeen, EventCount,\n SrcIpAddr, DstIpAddr, SourcePortList, DestinationPortList, ProtocolList,\n SensorID, SensorName, CustomerID, EventType, ActivityList,\n CEFSeverityList, DeviceVersionList, CollectorList", + "severity": "High", + "suppressionDuration": "PT5H", + "suppressionEnabled": false, + "tactics": [ + "Reconnaissance", + "InitialAccess" + ], + "requiredDataConnectors": [ + { + "connectorId": "HoneyForge", + "dataTypes": [ + "CommonSecurityLog" + ] + } + ], + "status": "Available", + "alertDetailsOverride": { + "alertDisplayNameFormat": "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}", + "alertDescriptionFormat": "HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}} using {{ProtocolList}}. Treat this activity as unauthorised until validated." + }, + "customDetails": { + "CustomerID": "CustomerID", + "SensorID": "SensorID", + "SensorName": "SensorName", + "EventType": "EventType", + "Activity": "ActivityList", + "SourcePorts": "SourcePortList", + "DestinationPorts": "DestinationPortList", + "Protocol": "ProtocolList", + "EventCount": "EventCount", + "FirstSeen": "FirstSeen", + "LastSeen": "LastSeen", + "DeviceVersion": "DeviceVersionList", + "Collector": "CollectorList" + }, + "entityMappings": [ + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "SrcIpAddr" + } + ] + }, + { + "entityType": "IP", + "fieldMappings": [ + { + "identifier": "Address", + "columnName": "DstIpAddr" + } + ] + }, + { + "entityType": "Host", + "fieldMappings": [ + { + "identifier": "HostName", + "columnName": "SensorName" + } + ] + } + ], + "incidentConfiguration": { + "createIncident": true, + "groupingConfiguration": { + "enabled": true, + "reopenClosedIncident": false, + "lookbackDuration": "PT4H", + "matchingMethod": "Selected", + "groupByEntities": [ + "IP" + ], + "groupByAlertDetails": [], + "groupByCustomDetails": [ + "CustomerID", + "SensorID" + ] + } + }, + "eventGroupingSettings": { + "aggregationKind": "AlertPerResult" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/AnalyticsRule-', variables('_analyticRuleContentId'))]", + "properties": { + "contentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "kind": "AnalyticsRule", + "version": "1.0.0", + "displayName": "HoneyForge - Deception Sensor Interaction", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_parserContentId'), '-pr-', variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", + "displayName": "HoneyForge ASIM NetworkSession Parser", + "contentKind": "Parser", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('workspace'), '/HoneyForgeEvent')]", + "properties": { + "eTag": "*", + "displayName": "HoneyForgeEvent", + "category": "Microsoft Sentinel Parser", + "functionAlias": "HoneyForgeEvent", + "query": "let HoneyForgeEvent = (\n starttime: datetime = datetime(null),\n endtime: datetime = datetime(null),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n dstipaddr_has_any_prefix: dynamic = dynamic([]),\n ipaddr_has_any_prefix: dynamic = dynamic([]),\n dstportnumber: int = int(null),\n hostname_has_any: dynamic = dynamic([]),\n dvcaction: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool = false\n) {\n CommonSecurityLog\n | where not(disabled)\n | where DeviceVendor =~ \"BUI\"\n | where DeviceProduct =~ \"HoneyForge\"\n | where (isnull(starttime) or TimeGenerated >= starttime)\n | where (isnull(endtime) or TimeGenerated <= endtime)\n | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix))\n | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix))\n | where (array_length(ipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix))\n | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber)\n | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any))\n | extend\n EventVendor = \"BUI\", EventProduct = \"HoneyForge\",\n EventProductVersion = tostring(DeviceVersion),\n EventSchema = \"NetworkSession\", EventSchemaVersion = \"0.2.6\",\n EventType = \"NetworkSession\", EventResult = \"NA\",\n EventStartTime = TimeGenerated, EventEndTime = TimeGenerated,\n EventCount = toint(1),\n EventOriginalUid = tostring(ExtID),\n EventOriginalType = tostring(DeviceEventClassID),\n EventSeverity = case(toint(LogSeverity) >= 9, \"Critical\", toint(LogSeverity) >= 7, \"High\", toint(LogSeverity) >= 4, \"Medium\", \"Low\"),\n EventOriginalSeverity = tostring(LogSeverity),\n EventMessage = tostring(Activity),\n SrcIpAddr = tostring(SourceIP), SrcPortNumber = toint(SourcePort),\n DstIpAddr = tostring(DestinationIP), DstPortNumber = toint(DestinationPort),\n DstHostname = _SensorName,\n NetworkProtocol = tostring(Protocol), NetworkDirection = \"Inbound\",\n DvcHostname = tostring(Computer), DvcId = tostring(DeviceCustomString1), DvcIdType = \"Other\",\n HoneyForgeSensorID = tostring(DeviceCustomString1),\n HoneyForgeCustomerID = tostring(DeviceCustomString2),\n HoneyForgeSensorName = _SensorName\n | project-away _SensorName\n | where (array_length(dvcaction) == 0)\n | where (eventresult == '*' or EventResult =~ eventresult)\n | project TimeGenerated, EventVendor, EventProduct, EventProductVersion, EventSchema, EventSchemaVersion, EventType, EventResult, EventSeverity, EventOriginalSeverity, EventOriginalUid, EventOriginalType, EventMessage, EventStartTime, EventEndTime, EventCount, SrcIpAddr, SrcPortNumber, DstIpAddr, DstPortNumber, DstHostname, NetworkProtocol, NetworkDirection, DvcHostname, DvcId, DvcIdType, HoneyForgeSensorID, HoneyForgeCustomerID, HoneyForgeSensorName\n};\nHoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, dvcaction=dvcaction, eventresult=eventresult, disabled=disabled)", + "functionParameters": "starttime:datetime=datetime(null), endtime:datetime=datetime(null), srcipaddr_has_any_prefix:dynamic=dynamic([]), dstipaddr_has_any_prefix:dynamic=dynamic([]), ipaddr_has_any_prefix:dynamic=dynamic([]), dstportnumber:int=int(null), hostname_has_any:dynamic=dynamic([]), dvcaction:dynamic=dynamic([]), eventresult:string='*', disabled:bool=False", + "version": 2, + "tags": [ + { + "name": "description", + "value": "ASIM NetworkSession parser for HoneyForge Threat Detection Platform events." + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/Parser-', variables('_parserContentId'))]", + "properties": { + "contentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", + "kind": "Parser", + "version": "1.0.0", + "displayName": "HoneyForge ASIM NetworkSession Parser", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f-hq-',variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", + "displayName": "HoneyForge - Top Attacking Source IPs", + "contentKind": "HuntingQuery", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('workspace'), '/HoneyForge_TopAttackingSources')]", + "properties": { + "eTag": "*", + "displayName": "HoneyForge - Top Attacking Source IPs", + "category": "Hunting Queries", + "query": "CommonSecurityLog\n| where TimeGenerated >= ago(7d)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n CustomersAffected = dcount(CustomerID),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n SensorList = make_set(SensorName, 20),\n Protocols = make_set(tostring(Protocol), 10),\n DestPorts = make_set(tostring(DestinationPort), 20)\n by SrcIpAddr\n| sort by TotalEvents desc\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n DestPortStr = strcat_array(DestPorts, \", \")\n| project SrcIpAddr, TotalEvents, SensorsHit, CustomersAffected, FirstSeen, LastSeen, SensorListStr, ProtocolStr, DestPortStr", + "version": 2, + "tags": [ + { + "name": "description", + "value": "HoneyForge - Top Attacking Source IPs" + }, + { + "name": "tactics", + "value": "Reconnaissance" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f')]", + "properties": { + "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", + "kind": "HuntingQuery", + "version": "1.0.0", + "displayName": "HoneyForge - Top Attacking Source IPs", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b-hq-',variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", + "displayName": "HoneyForge - Repeated Probes from Same Source", + "contentKind": "HuntingQuery", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('workspace'), '/HoneyForge_RepeatedProbes')]", + "properties": { + "eTag": "*", + "displayName": "HoneyForge - Repeated Probes from Same Source", + "category": "Hunting Queries", + "query": "let lookback = 14d;\nlet minSessionGap = 1h;\nlet minReturnVisits = 2;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SrcIpAddr = tostring(SourceIP), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where isnotempty(SrcIpAddr)\n| sort by SrcIpAddr asc, TimeGenerated asc\n| serialize\n| extend PrevTime = prev(TimeGenerated, 1), PrevSrc = prev(SrcIpAddr, 1)\n| extend IsNewSession = iff(SrcIpAddr == PrevSrc and (TimeGenerated - PrevTime) < minSessionGap, 0, 1)\n| summarize TotalEvents = count(), SessionCount = sumif(IsNewSession, IsNewSession == 1), SensorsHit = dcount(SensorName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SensorList = make_set(SensorName, 20) by SrcIpAddr\n| where SessionCount >= minReturnVisits\n| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen), SensorListStr = strcat_array(SensorList, \", \")\n| sort by SessionCount desc, TotalEvents desc\n| project SrcIpAddr, SessionCount, TotalEvents, SensorsHit, DaySpan, FirstSeen, LastSeen, SensorListStr", + "version": 2, + "tags": [ + { + "name": "description", + "value": "HoneyForge - Repeated Probes from Same Source" + }, + { + "name": "tactics", + "value": "Reconnaissance" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b')]", + "properties": { + "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", + "kind": "HuntingQuery", + "version": "1.0.0", + "displayName": "HoneyForge - Repeated Probes from Same Source", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c-hq-',variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", + "displayName": "HoneyForge - Sensor Fleet Coverage and Health", + "contentKind": "HuntingQuery", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('workspace'), '/HoneyForge_FleetCoverage')]", + "properties": { + "eTag": "*", + "displayName": "HoneyForge - Sensor Fleet Coverage and Health", + "category": "Hunting Queries", + "query": "CommonSecurityLog\n| where TimeGenerated >= ago(30d)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SensorID = tostring(DeviceCustomString1), CustomerID = tostring(DeviceCustomString2), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize TotalEvents = count(), UniqueSources = dcount(SourceIP), FirstEvent = min(TimeGenerated), LastEvent = max(TimeGenerated), Protocols = make_set(tostring(Protocol), 10) by SensorID, SensorName, CustomerID\n| extend MinutesSinceLast = datetime_diff('minute', now(), LastEvent), SensorStatus = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"Online\", \"Offline / No Recent Events\"), ProtocolStr = strcat_array(Protocols, \", \")\n| sort by SensorStatus asc, LastEvent desc\n| project SensorName, SensorID, CustomerID, SensorStatus, MinutesSinceLast, TotalEvents, UniqueSources, FirstEvent, LastEvent, ProtocolStr", + "version": 2, + "tags": [ + { + "name": "description", + "value": "HoneyForge - Sensor Fleet Coverage and Health" + }, + { + "name": "tactics", + "value": "Reconnaissance" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c')]", + "properties": { + "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", + "kind": "HuntingQuery", + "version": "1.0.0", + "displayName": "HoneyForge - Sensor Fleet Coverage and Health", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d-hq-',variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", + "displayName": "HoneyForge - High-Frequency Sensor Interactions", + "contentKind": "HuntingQuery", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('workspace'), '/HoneyForge_HighFrequency')]", + "properties": { + "eTag": "*", + "displayName": "HoneyForge - High-Frequency Sensor Interactions", + "category": "Hunting Queries", + "query": "let lookback = 24h;\nlet burstWindow = 10m;\nlet burstThreshold = 50;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SrcIpAddr = tostring(SourceIP), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize BurstCount = count(), SensorsHit = dcount(SensorName), SensorList = make_set(SensorName, 10), Protocols = make_set(tostring(Protocol), 5), DestPorts = make_set(tostring(DestinationPort), 10), WindowStart = min(TimeGenerated), WindowEnd = max(TimeGenerated) by SrcIpAddr, CustomerID, bin(TimeGenerated, burstWindow)\n| where BurstCount >= burstThreshold\n| extend SensorListStr = strcat_array(SensorList, \", \"), ProtocolStr = strcat_array(Protocols, \", \"), DestPortStr = strcat_array(DestPorts, \", \")\n| sort by BurstCount desc\n| project SrcIpAddr, CustomerID, BurstCount, SensorsHit, WindowStart, WindowEnd, SensorListStr, ProtocolStr, DestPortStr", + "version": 2, + "tags": [ + { + "name": "description", + "value": "HoneyForge - High-Frequency Sensor Interactions" + }, + { + "name": "tactics", + "value": "Reconnaissance" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d')]", + "properties": { + "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", + "kind": "HuntingQuery", + "version": "1.0.0", + "displayName": "HoneyForge - High-Frequency Sensor Interactions", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e-hq-',variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", + "displayName": "HoneyForge - Off-Hours Sensor Activity", + "contentKind": "HuntingQuery", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "Microsoft.OperationalInsights/workspaces/savedSearches", + "apiVersion": "2020-08-01", + "name": "[concat(parameters('workspace'), '/HoneyForge_OffHoursActivity')]", + "properties": { + "eTag": "*", + "displayName": "HoneyForge - Off-Hours Sensor Activity", + "category": "Hunting Queries", + "query": "let lookback = 7d;\nlet businessStart = 7;\nlet businessEnd = 19;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SrcIpAddr = tostring(SourceIP), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), CustomerID = tostring(DeviceCustomString2), HourUTC = hourofday(TimeGenerated), DayOfWeek = dayofweek(TimeGenerated)\n| extend IsOffHours = case(DayOfWeek == 0d or DayOfWeek == 6d, true, HourUTC < businessStart or HourUTC >= businessEnd, true, false)\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize TotalEvents = count(), SensorsHit = dcount(SensorName), SensorList = make_set(SensorName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), HoursActive = make_set(HourUTC, 24), Protocols = make_set(tostring(Protocol), 10) by SrcIpAddr, CustomerID\n| sort by TotalEvents desc\n| extend SensorListStr = strcat_array(SensorList, \", \"), ProtocolStr = strcat_array(Protocols, \", \")\n| project SrcIpAddr, CustomerID, TotalEvents, SensorsHit, FirstSeen, LastSeen, SensorListStr, ProtocolStr", + "version": 2, + "tags": [ + { + "name": "description", + "value": "HoneyForge - Off-Hours Sensor Activity" + }, + { + "name": "tactics", + "value": "Reconnaissance" + } + ] + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e')]", + "properties": { + "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", + "kind": "HuntingQuery", + "version": "1.0.0", + "displayName": "HoneyForge - Off-Hours Sensor Activity", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_workbookContentId'), '-wb-', variables('_solutionId'))]", + "location": "[parameters('location')]", + "properties": { + "contentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853", + "displayName": "HoneyForge Threat Detection Workbook", + "contentKind": "Workbook", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "1.0.0.0", + "parameters": { + "workspace": { + "defaultValue": "", + "type": "string" + }, + "location": { + "defaultValue": "[resourceGroup().location]", + "type": "string" + }, + "workbook-id": { + "defaultValue": "8eb1cbec-31bc-44b1-9548-ef98e8719853", + "type": "string" + }, + "workbook-name": { + "defaultValue": "HoneyForge Threat Detection", + "type": "string" + } + }, + "variables": {}, + "resources": [ + { + "type": "microsoft.insights/workbooks", + "name": "[parameters('workbook-id')]", + "location": "[parameters('location')]", + "apiVersion": "2022-04-01", + "kind": "shared", + "properties": { + "displayName": "[parameters('workbook-name')]", + "serializedData": "{\"version\": \"Notebook/1.0\", \"items\": [{\"type\": 9, \"content\": {\"version\": \"KqlParameterItem/1.0\", \"parameters\": [{\"id\": \"a1b2c3d4-0001-0000-0000-000000000001\", \"version\": \"KqlParameterItem/1.0\", \"name\": \"TimeRange\", \"label\": \"Time Range\", \"type\": 4, \"isRequired\": true, \"value\": {\"durationMs\": 604800000}, \"typeSettings\": {\"selectableValues\": [{\"durationMs\": 3600000}, {\"durationMs\": 14400000}, {\"durationMs\": 43200000}, {\"durationMs\": 86400000}, {\"durationMs\": 259200000}, {\"durationMs\": 604800000}, {\"durationMs\": 2592000000}], \"allowCustom\": true}}, {\"id\": \"a1b2c3d4-0002-0000-0000-000000000002\", \"version\": \"KqlParameterItem/1.0\", \"name\": \"CustomerID\", \"label\": \"Customer\", \"type\": 2, \"isRequired\": false, \"query\": \"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\", \"value\": \"All\", \"typeSettings\": {\"additionalResourceOptions\": [\"value:All\"], \"showDefault\": false}, \"defaultValue\": \"value:All\", \"timeContext\": {\"durationMs\": 0}, \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\"}], \"style\": \"pills\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\"}, \"name\": \"parameters\"}, {\"type\": 1, \"content\": {\"json\": \"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device \\u2014 treat all interactions as suspicious until validated.\"}, \"name\": \"header\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\", \"size\": 4, \"title\": \"Overview\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"tiles\", \"tileSettings\": {\"titleContent\": {\"columnMatch\": \"TotalEventsLabel\", \"formatter\": 12, \"formatOptions\": {\"palette\": \"auto\"}}, \"showBorder\": false, \"tiles\": [{\"id\": \"tile-events\", \"title\": \"Total Events\", \"query\": \"TotalEventsLabel\"}, {\"id\": \"tile-sources\", \"title\": \"Unique Source IPs\", \"query\": \"UniqueSourcesLabel\"}, {\"id\": \"tile-sensors\", \"title\": \"Sensors Triggered\", \"query\": \"SensorsHitLabel\"}, {\"id\": \"tile-customers\", \"title\": \"Customers Affected\", \"query\": \"CustomersLabel\"}]}}, \"name\": \"overview-tiles\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\", \"size\": 0, \"title\": \"Event Timeline\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"timechart\", \"chartSettings\": {\"seriesLabelSettings\": [{\"seriesName\": \"Events\", \"color\": \"blue\"}]}}, \"name\": \"timeline\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\", \"size\": 0, \"title\": \"Top 25 Attacking Source IPs\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"table\", \"gridSettings\": {\"formatters\": [{\"columnMatch\": \"TotalEvents\", \"formatter\": 8, \"formatOptions\": {\"palette\": \"redBright\"}}], \"sortBy\": [{\"itemKey\": \"TotalEvents\", \"sortOrder\": 2}]}}, \"name\": \"top-sources\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"\\ud83d\\udfe2 Online\\\", \\\"\\ud83d\\udd34 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\", \"size\": 0, \"title\": \"Sensor Fleet Health\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"table\", \"gridSettings\": {\"formatters\": [{\"columnMatch\": \"Status\", \"formatter\": 1}, {\"columnMatch\": \"TotalEvents\", \"formatter\": 8, \"formatOptions\": {\"palette\": \"blue\"}}]}}, \"name\": \"sensor-health\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\", \"size\": 3, \"title\": \"Events by Severity\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"piechart\", \"chartSettings\": {\"seriesLabelSettings\": [{\"seriesName\": \"Critical\", \"color\": \"redBright\"}, {\"seriesName\": \"High\", \"color\": \"red\"}, {\"seriesName\": \"Medium\", \"color\": \"orange\"}, {\"seriesName\": \"Low\", \"color\": \"yellow\"}]}}, \"name\": \"severity-chart\", \"styleSettings\": {\"maxWidth\": \"50%\"}}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\", \"size\": 3, \"title\": \"Events by Protocol\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"piechart\"}, \"name\": \"protocol-chart\", \"styleSettings\": {\"maxWidth\": \"50%\"}}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\", \"size\": 0, \"title\": \"Off-Hours Activity (Top 20 Sources)\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"table\", \"gridSettings\": {\"formatters\": [{\"columnMatch\": \"Events\", \"formatter\": 8, \"formatOptions\": {\"palette\": \"orange\"}}]}}, \"name\": \"offhours\"}], \"styleSettings\": {}, \"fromTemplateId\": \"sentinel-HoneyForge\", \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}", + "version": "1.0", + "sourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace'))]", + "category": "sentinel" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/Workbook-', variables('_workbookContentId'))]", + "properties": { + "contentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853", + "kind": "Workbook", + "version": "1.0.0", + "displayName": "HoneyForge Threat Detection Workbook", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] + }, + "version": "1.0.0", + "source": { + "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "name": "HoneyForge Threat Detection", + "kind": "Solution" + }, + "author": { + "name": "BUI", + "email": "support@bui.co.za" + }, + "support": { + "tier": "Partner", + "name": "BUI", + "email": "support@bui.co.za", + "link": "https://honeyforge.tech" + } + } + } + ] +} \ No newline at end of file diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml new file mode 100644 index 00000000000..535a1bedaf8 --- /dev/null +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -0,0 +1,123 @@ +id: b1b6b693-679e-4ebf-afc8-7faf6af266ab +Function: + Title: HoneyForgeEvent + Version: '1.0.0' + LastUpdated: '2026-07-20' + Description: | + ASIM NetworkSession parser for HoneyForge Threat Detection Platform events. + Normalises CEF events from the CommonSecurityLog table (DeviceVendor="BUI", + DeviceProduct="HoneyForge") to the ASIM NetworkSession schema v0.2.6. + FunctionName: HoneyForgeEvent + FunctionAlias: HoneyForgeEvent + Category: Microsoft Sentinel Parser + FunctionQuery: | + let HoneyForgeEvent = ( + starttime: datetime = datetime(null), + endtime: datetime = datetime(null), + srcipaddr_has_any_prefix: dynamic = dynamic([]), + dstipaddr_has_any_prefix: dynamic = dynamic([]), + ipaddr_has_any_prefix: dynamic = dynamic([]), + dstportnumber: int = int(null), + hostname_has_any: dynamic = dynamic([]), + dvcaction: dynamic = dynamic([]), + eventresult: string = '*', + disabled: bool = false + ) { + CommonSecurityLog + | where not(disabled) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + // Time filter + | where (isnull(starttime) or TimeGenerated >= starttime) + | where (isnull(endtime) or TimeGenerated <= endtime) + // IP prefix filters + | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix)) + | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix)) + | where (array_length(ipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) + or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix)) + // Port filter + | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber) + // Sensor name filter + | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) + | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any)) + // ASIM field mappings + | extend + // Event metadata + EventVendor = "BUI", + EventProduct = "HoneyForge", + EventProductVersion = tostring(DeviceVersion), + EventSchema = "NetworkSession", + EventSchemaVersion = "0.2.6", + EventType = "NetworkSession", + EventResult = "NA", + EventStartTime = TimeGenerated, + EventEndTime = TimeGenerated, + EventCount = toint(1), + EventOriginalUid = tostring(ExtID), + EventOriginalType = tostring(DeviceEventClassID), + EventSeverity = case( + toint(LogSeverity) >= 9, "Critical", + toint(LogSeverity) >= 7, "High", + toint(LogSeverity) >= 4, "Medium", + "Low"), + EventOriginalSeverity = tostring(LogSeverity), + EventMessage = tostring(Activity), + // Source + SrcIpAddr = tostring(SourceIP), + SrcPortNumber = toint(SourcePort), + // Destination (the sensor) + DstIpAddr = tostring(DestinationIP), + DstPortNumber = toint(DestinationPort), + DstHostname = _SensorName, + // Network + NetworkProtocol = tostring(Protocol), + NetworkDirection = "Inbound", + // Device (sensor) + DvcHostname = tostring(Computer), + DvcId = tostring(DeviceCustomString1), + DvcIdType = "Other", + // HoneyForge-specific custom fields (retained for hunting) + HoneyForgeSensorID = tostring(DeviceCustomString1), + HoneyForgeCustomerID = tostring(DeviceCustomString2), + HoneyForgeSensorName = _SensorName + | project-away _SensorName + // Apply dvcaction filter (no action in HoneyForge events, pass-through) + | where (array_length(dvcaction) == 0) + // Apply eventresult filter + | where (eventresult == '*' or EventResult =~ eventresult) + | project + TimeGenerated, + EventVendor, + EventProduct, + EventProductVersion, + EventSchema, + EventSchemaVersion, + EventType, + EventResult, + EventSeverity, + EventOriginalSeverity, + EventOriginalUid, + EventOriginalType, + EventMessage, + EventStartTime, + EventEndTime, + EventCount, + SrcIpAddr, + SrcPortNumber, + DstIpAddr, + DstPortNumber, + DstHostname, + NetworkProtocol, + NetworkDirection, + DvcHostname, + DvcId, + DvcIdType, + HoneyForgeSensorID, + HoneyForgeCustomerID, + HoneyForgeSensorName + }; + HoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, + dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, + dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, dvcaction=dvcaction, + eventresult=eventresult, disabled=disabled) diff --git a/Solutions/HoneyForge/SolutionMetadata.json b/Solutions/HoneyForge/SolutionMetadata.json new file mode 100644 index 00000000000..32f68167749 --- /dev/null +++ b/Solutions/HoneyForge/SolutionMetadata.json @@ -0,0 +1,51 @@ +{ + "publisherId": "bui", + "offerId": "honeyforge-threat-detection", + "firstPublishDate": "2026-07-20", + "lastPublishDate": "2026-07-20", + "provider": "BUI", + "categories": { + "domains": [ + "Security - Threat Intelligence", + "Security - Network" + ] + }, + "support": { + "name": "BUI", + "email": "support@bui.co.za", + "tier": "Partner", + "link": "https://honeyforge.tech" + }, + "industry": {}, + "recommendedBy": [], + "learningResources": [ + { + "title": "HoneyForge Documentation", + "description": "Product documentation and user manual for the HoneyForge Threat Detection Platform.", + "type": "Documentation", + "url": "https://honeyforge.tech" + } + ], + "threatAnalysisTactics": [ + "Reconnaissance", + "InitialAccess" + ], + "threatAnalysisTechniques": [], + "prerequisites": "To integrate with HoneyForge:\n\n1. A HoneyForge subscription and at least one deployed sensor.\n2. A Linux machine to host the CEF syslog forwarder (can be the same machine as the Log Analytics agent).\n3. Outbound TCP/UDP 514 allowed from the forwarder to the syslog collector.\n\nContact BUI at support@bui.co.za to obtain your HoneyForge subscription.", + "version": "1.0.0", + "title": "HoneyForge Threat Detection", + "description": "HoneyForge is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect and alert on malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog, and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook to help your security team identify, investigate, and respond to threats detected by the platform.", + "logo": "Logos/HoneyForgeLogo.svg", + "contentSchemaVersion": "3.0.0", + "packagedContent": [], + "initialDisplayState": "expanded", + "metadata": { + "contentSchemaVersion": "3.0.0", + "contentId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "contentKind": "Solution", + "displayName": "HoneyForge Threat Detection", + "contentProductId": "bui-honeyforge-threat-detection", + "id": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "version": "1.0.0" + } +} diff --git a/Solutions/HoneyForge/Workbooks/HoneyForge.json b/Solutions/HoneyForge/Workbooks/HoneyForge.json new file mode 100644 index 00000000000..056cee44430 --- /dev/null +++ b/Solutions/HoneyForge/Workbooks/HoneyForge.json @@ -0,0 +1,228 @@ +{ + "version": "Notebook/1.0", + "items": [ + { + "type": 9, + "content": { + "version": "KqlParameterItem/1.0", + "parameters": [ + { + "id": "a1b2c3d4-0001-0000-0000-000000000001", + "version": "KqlParameterItem/1.0", + "name": "TimeRange", + "label": "Time Range", + "type": 4, + "isRequired": true, + "value": { + "durationMs": 604800000 + }, + "typeSettings": { + "selectableValues": [ + { "durationMs": 3600000 }, + { "durationMs": 14400000 }, + { "durationMs": 43200000 }, + { "durationMs": 86400000 }, + { "durationMs": 259200000 }, + { "durationMs": 604800000 }, + { "durationMs": 2592000000 } + ], + "allowCustom": true + } + }, + { + "id": "a1b2c3d4-0002-0000-0000-000000000002", + "version": "KqlParameterItem/1.0", + "name": "CustomerID", + "label": "Customer", + "type": 2, + "isRequired": false, + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(CustomerID)\n| distinct CustomerID\n| sort by CustomerID asc", + "value": "All", + "typeSettings": { + "additionalResourceOptions": ["value:All"], + "showDefault": false + }, + "defaultValue": "value:All", + "timeContext": { "durationMs": 0 }, + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + } + ], + "style": "pills", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces" + }, + "name": "parameters" + }, + { + "type": 1, + "content": { + "json": "# HoneyForge Threat Detection\n---\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated." + }, + "name": "header" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\n CustomersAffected = dcount(CustomerID)\n| extend\n TotalEventsLabel = tostring(TotalEvents),\n UniqueSourcesLabel = tostring(UniqueSources),\n SensorsHitLabel = tostring(SensorsHit),\n CustomersLabel = tostring(CustomersAffected)", + "size": 4, + "title": "Overview", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "tiles", + "tileSettings": { + "titleContent": { + "columnMatch": "TotalEventsLabel", + "formatter": 12, + "formatOptions": { "palette": "auto" } + }, + "showBorder": false, + "tiles": [ + { "id": "tile-events", "title": "Total Events", "query": "TotalEventsLabel" }, + { "id": "tile-sources", "title": "Unique Source IPs", "query": "UniqueSourcesLabel" }, + { "id": "tile-sensors", "title": "Sensors Triggered", "query": "SensorsHitLabel" }, + { "id": "tile-customers","title": "Customers Affected", "query": "CustomersLabel" } + ] + } + }, + "name": "overview-tiles" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by bin(TimeGenerated, 1h)\n| sort by TimeGenerated asc", + "size": 0, + "title": "Event Timeline", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "timechart", + "chartSettings": { + "seriesLabelSettings": [ + { "seriesName": "Events", "color": "blue" } + ] + } + }, + "name": "timeline" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n SensorList = strcat_array(make_set(SensorName, 10), \", \"),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr\n| sort by TotalEvents desc\n| take 25", + "size": 0, + "title": "Top 25 Attacking Source IPs", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "TotalEvents", + "formatter": 8, + "formatOptions": { "palette": "redBright" } + } + ], + "sortBy": [{ "itemKey": "TotalEvents", "sortOrder": 2 }] + } + }, + "name": "top-sources" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n SensorID = tostring(DeviceCustomString1)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n LastEvent = max(TimeGenerated)\n by SensorName, SensorID, CustomerID\n| extend\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"🟢 Online\", \"🔴 Offline\")\n| sort by Status asc, TotalEvents desc\n| project\n Status,\n SensorName,\n SensorID,\n CustomerID,\n TotalEvents,\n UniqueSources,\n LastEvent,\n MinutesSinceLast", + "size": 0, + "title": "Sensor Fleet Health", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Status", + "formatter": 1 + }, + { + "columnMatch": "TotalEvents", + "formatter": 8, + "formatOptions": { "palette": "blue" } + } + ] + } + }, + "name": "sensor-health" + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n Severity = case(\n toint(LogSeverity) >= 9, \"Critical\",\n toint(LogSeverity) >= 7, \"High\",\n toint(LogSeverity) >= 4, \"Medium\",\n \"Low\"\n )\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by Severity\n| sort by Events desc", + "size": 3, + "title": "Events by Severity", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart", + "chartSettings": { + "seriesLabelSettings": [ + { "seriesName": "Critical", "color": "redBright" }, + { "seriesName": "High", "color": "red" }, + { "seriesName": "Medium", "color": "orange" }, + { "seriesName": "Low", "color": "yellow" } + ] + } + }, + "name": "severity-chart", + "styleSettings": { "maxWidth": "50%" } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n EventProtocol = tostring(Protocol)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(EventProtocol)\n| summarize Events = count() by EventProtocol\n| sort by Events desc", + "size": 3, + "title": "Events by Protocol", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "piechart" + }, + "name": "protocol-chart", + "styleSettings": { "maxWidth": "50%" } + }, + { + "type": 3, + "content": { + "version": "KqlItem/1.0", + "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n HourUTC = hourofday(TimeGenerated),\n DayOfWeek = dayofweek(TimeGenerated)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize\n Events = count(),\n SensorsHit = dcount(SensorName),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr, CustomerID\n| sort by Events desc\n| take 20", + "size": 0, + "title": "Off-Hours Activity (Top 20 Sources)", + "timeContextFromParameter": "TimeRange", + "queryType": 0, + "resourceType": "microsoft.operationalinsights/workspaces", + "visualization": "table", + "gridSettings": { + "formatters": [ + { + "columnMatch": "Events", + "formatter": 8, + "formatOptions": { "palette": "orange" } + } + ] + } + }, + "name": "offhours" + } + ], + "styleSettings": {}, + "fromTemplateId": "sentinel-HoneyForge", + "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" +} From 33feecf10a7755289d2fc4f343c0a3744e05aa3b Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Mon, 20 Jul 2026 15:19:42 +0200 Subject: [PATCH 02/71] Fix: ARM resource names, workbook TimeRange, createUiDefinition provider, parser params --- .../Package/createUiDefinition.json | 29 +++++++++++++++---- .../HoneyForge/Package/mainTemplate.json | 10 +++---- .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 11 +------ .../HoneyForge/Workbooks/HoneyForge.json | 14 ++++----- 4 files changed, 36 insertions(+), 28 deletions(-) diff --git a/Solutions/HoneyForge/Package/createUiDefinition.json b/Solutions/HoneyForge/Package/createUiDefinition.json index c03d2db7ab4..352f9fc9ee8 100644 --- a/Solutions/HoneyForge/Package/createUiDefinition.json +++ b/Solutions/HoneyForge/Package/createUiDefinition.json @@ -6,11 +6,28 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution:\n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\n[HoneyForge](https://honeyforge.tech) is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook.\n\n**Data Connectors:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5, **Parser:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", - "subscription": { "resourceProviders": ["Microsoft.OperationsManagement/solutions", "Microsoft.OperationalInsights/workspaces/providers/alertRules", "Microsoft.Insights/workbooks", "Microsoft.Logic/workflows"] }, - "location": { "metadata": { "hidden": true }, "allowedValues": [], "visible": false }, - "resourceGroup": { "allowExistingGroups": true }, - "armboard": { "value": "[steps('basics').resourceScope.resourceGroup.id]" } + "description": "\n\n**Note:** Please refer to the following before installing the solution:\n\n\u2022 Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n \u2022 There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\n[HoneyForge](https://honeyforge.tech) is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook.\n\n**Data Connectors:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5, **Parser:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "subscription": { + "resourceProviders": [ + "Microsoft.OperationsManagement/solutions", + "Microsoft.Insights/workbooks", + "Microsoft.Logic/workflows", + "Microsoft.SecurityInsights" + ] + }, + "location": { + "metadata": { + "hidden": true + }, + "allowedValues": [], + "visible": false + }, + "resourceGroup": { + "allowExistingGroups": true + }, + "armboard": { + "value": "[steps('basics').resourceScope.resourceGroup.id]" + } } }, "basics": [ @@ -43,4 +60,4 @@ "location": "[location()]" } } -} +} \ No newline at end of file diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index dfa7fb3ec61..56037cc142b 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -451,7 +451,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f-hq-',variables('_solutionId'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f-hq-',variables('_solutionId'))]", "location": "[parameters('location')]", "properties": { "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", @@ -539,7 +539,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b-hq-',variables('_solutionId'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b-hq-',variables('_solutionId'))]", "location": "[parameters('location')]", "properties": { "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", @@ -627,7 +627,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c-hq-',variables('_solutionId'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c-hq-',variables('_solutionId'))]", "location": "[parameters('location')]", "properties": { "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", @@ -715,7 +715,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d-hq-',variables('_solutionId'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d-hq-',variables('_solutionId'))]", "location": "[parameters('location')]", "properties": { "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", @@ -803,7 +803,7 @@ { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/''5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e-hq-',variables('_solutionId'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e-hq-',variables('_solutionId'))]", "location": "[parameters('location')]", "properties": { "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index 535a1bedaf8..e10e06814a6 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -19,8 +19,6 @@ Function: ipaddr_has_any_prefix: dynamic = dynamic([]), dstportnumber: int = int(null), hostname_has_any: dynamic = dynamic([]), - dvcaction: dynamic = dynamic([]), - eventresult: string = '*', disabled: bool = false ) { CommonSecurityLog @@ -82,10 +80,6 @@ Function: HoneyForgeCustomerID = tostring(DeviceCustomString2), HoneyForgeSensorName = _SensorName | project-away _SensorName - // Apply dvcaction filter (no action in HoneyForge events, pass-through) - | where (array_length(dvcaction) == 0) - // Apply eventresult filter - | where (eventresult == '*' or EventResult =~ eventresult) | project TimeGenerated, EventVendor, @@ -117,7 +111,4 @@ Function: HoneyForgeCustomerID, HoneyForgeSensorName }; - HoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, - dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, - dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, dvcaction=dvcaction, - eventresult=eventresult, disabled=disabled) + HoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, disabled=disabled) diff --git a/Solutions/HoneyForge/Workbooks/HoneyForge.json b/Solutions/HoneyForge/Workbooks/HoneyForge.json index 056cee44430..448df7f299c 100644 --- a/Solutions/HoneyForge/Workbooks/HoneyForge.json +++ b/Solutions/HoneyForge/Workbooks/HoneyForge.json @@ -66,7 +66,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\n CustomersAffected = dcount(CustomerID)\n| extend\n TotalEventsLabel = tostring(TotalEvents),\n UniqueSourcesLabel = tostring(UniqueSources),\n SensorsHitLabel = tostring(SensorsHit),\n CustomersLabel = tostring(CustomersAffected)", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\n CustomersAffected = dcount(CustomerID)\n| extend\n TotalEventsLabel = tostring(TotalEvents),\n UniqueSourcesLabel = tostring(UniqueSources),\n SensorsHitLabel = tostring(SensorsHit),\n CustomersLabel = tostring(CustomersAffected)", "size": 4, "title": "Overview", "timeContextFromParameter": "TimeRange", @@ -94,7 +94,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by bin(TimeGenerated, 1h)\n| sort by TimeGenerated asc", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend CustomerID = tostring(DeviceCustomString2)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by bin(TimeGenerated, 1h)\n| sort by TimeGenerated asc", "size": 0, "title": "Event Timeline", "timeContextFromParameter": "TimeRange", @@ -113,7 +113,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n SensorList = strcat_array(make_set(SensorName, 10), \", \"),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr\n| sort by TotalEvents desc\n| take 25", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n SensorList = strcat_array(make_set(SensorName, 10), \", \"),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr\n| sort by TotalEvents desc\n| take 25", "size": 0, "title": "Top 25 Attacking Source IPs", "timeContextFromParameter": "TimeRange", @@ -137,7 +137,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n SensorID = tostring(DeviceCustomString1)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n LastEvent = max(TimeGenerated)\n by SensorName, SensorID, CustomerID\n| extend\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"🟢 Online\", \"🔴 Offline\")\n| sort by Status asc, TotalEvents desc\n| project\n Status,\n SensorName,\n SensorID,\n CustomerID,\n TotalEvents,\n UniqueSources,\n LastEvent,\n MinutesSinceLast", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n SensorID = tostring(DeviceCustomString1)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n LastEvent = max(TimeGenerated)\n by SensorName, SensorID, CustomerID\n| extend\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"🟢 Online\", \"🔴 Offline\")\n| sort by Status asc, TotalEvents desc\n| project\n Status,\n SensorName,\n SensorID,\n CustomerID,\n TotalEvents,\n UniqueSources,\n LastEvent,\n MinutesSinceLast", "size": 0, "title": "Sensor Fleet Health", "timeContextFromParameter": "TimeRange", @@ -164,7 +164,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n Severity = case(\n toint(LogSeverity) >= 9, \"Critical\",\n toint(LogSeverity) >= 7, \"High\",\n toint(LogSeverity) >= 4, \"Medium\",\n \"Low\"\n )\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by Severity\n| sort by Events desc", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n Severity = case(\n toint(LogSeverity) >= 9, \"Critical\",\n toint(LogSeverity) >= 7, \"High\",\n toint(LogSeverity) >= 4, \"Medium\",\n \"Low\"\n )\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| summarize Events = count() by Severity\n| sort by Events desc", "size": 3, "title": "Events by Severity", "timeContextFromParameter": "TimeRange", @@ -187,7 +187,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n EventProtocol = tostring(Protocol)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(EventProtocol)\n| summarize Events = count() by EventProtocol\n| sort by Events desc", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n EventProtocol = tostring(Protocol)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| where isnotempty(EventProtocol)\n| summarize Events = count() by EventProtocol\n| sort by Events desc", "size": 3, "title": "Events by Protocol", "timeContextFromParameter": "TimeRange", @@ -202,7 +202,7 @@ "type": 3, "content": { "version": "KqlItem/1.0", - "query": "CommonSecurityLog\n| where {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n HourUTC = hourofday(TimeGenerated),\n DayOfWeek = dayofweek(TimeGenerated)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize\n Events = count(),\n SensorsHit = dcount(SensorName),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr, CustomerID\n| sort by Events desc\n| take 20", + "query": "CommonSecurityLog\n| where TimeGenerated {TimeRange}\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n CustomerID = tostring(DeviceCustomString2),\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n HourUTC = hourofday(TimeGenerated),\n DayOfWeek = dayofweek(TimeGenerated)\n| where \"{CustomerID}\" == \"All\" or CustomerID =~ \"{CustomerID}\"\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize\n Events = count(),\n SensorsHit = dcount(SensorName),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated)\n by SrcIpAddr, CustomerID\n| sort by Events desc\n| take 20", "size": 0, "title": "Off-Hours Activity (Top 20 Sources)", "timeContextFromParameter": "TimeRange", From 98a57fd54c3a1badbb8549b2e5b5182a8a1aa96a Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Mon, 20 Jul 2026 15:27:04 +0200 Subject: [PATCH 03/71] Add HoneyForge to ValidConnectorIds --- .../detectionTemplateSchemaValidation/ValidConnectorIds.json | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 161a2036124..aec643bff12 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -322,5 +322,6 @@ "GSDetectionAlerts", "VaikoraSecurityCenter", "VaikoraO365", - "GambitSecurityPush" -] \ No newline at end of file + "GambitSecurityPush", + "HoneyForge" +] From c816951c7faaea957835c39eec6d4db4f38ef4e5 Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Tue, 21 Jul 2026 09:02:12 +0200 Subject: [PATCH 04/71] Fix CI failures: TTK IDs/location/vars, KQL columns, logo xlink, non-ASCII, connector permissions --- ...HoneyForge_DeceptionSensorInteraction.yaml | 4 +- .../Data Connectors/HoneyForge.json | 215 +++++++++--------- .../HoneyForge_HighFrequency.yaml | 2 +- .../HoneyForge_OffHoursActivity.yaml | 2 +- .../HoneyForge_TopAttackingSources.yaml | 2 +- Solutions/HoneyForge/Logos/HoneyForgeLogo.svg | 4 +- .../HoneyForge/Package/mainTemplate.json | 72 +++--- .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 204 ++++++++--------- 8 files changed, 255 insertions(+), 250 deletions(-) diff --git a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml index 0656b5b735a..87d79db5e33 100644 --- a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml +++ b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml @@ -5,7 +5,7 @@ description: | involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team. - HoneyForge sensors are passive decoy devices — legitimate systems and users + HoneyForge sensors are passive decoy devices - legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device. severity: High @@ -56,7 +56,7 @@ query: | Activities = make_set(EventActivity, 20), CEFSeverities = make_set(tostring(LogSeverity), 10), DeviceVersions = make_set(tostring(DeviceVersion), 10), - Collectors = make_set(tostring(CollectorHostName), 10) + Collectors = make_set(tostring(Computer), 10) by SrcIpAddr, DstIpAddr, diff --git a/Solutions/HoneyForge/Data Connectors/HoneyForge.json b/Solutions/HoneyForge/Data Connectors/HoneyForge.json index 26cd4b8dfa9..747d57cb74b 100644 --- a/Solutions/HoneyForge/Data Connectors/HoneyForge.json +++ b/Solutions/HoneyForge/Data Connectors/HoneyForge.json @@ -1,114 +1,119 @@ { - "id": "HoneyForge", - "title": "HoneyForge Threat Detection", - "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", - "logo": "Logos/HoneyForgeLogo.svg", - "graphQueriesTableName": "CommonSecurityLog", - "graphQueries": [ - { - "metricName": "Total events received", - "legend": "HoneyForge sensor events", - "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" - } - ], - "sampleQueries": [ - { - "description": "All HoneyForge events — last 24 hours", - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" - }, - { - "description": "Top source IPs interacting with sensors — last 7 days", - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" - }, - { - "description": "Events by sensor — last 7 days", - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" - ] - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (HoneyForge)", - "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "delete": true + "id": "HoneyForge", + "title": "HoneyForge Threat Detection", + "publisher": "BUI", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious \u00e2\u20ac\u201d because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "logo": "Logos/HoneyForgeLogo.svg", + "graphQueriesTableName": "CommonSecurityLog", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "HoneyForge sensor events", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" } - }, - { - "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", - "permissionsDisplayText": "Read permissions to shared keys for the workspace are required to enable the Log Analytics agent.", - "providerDisplayName": "Keys", - "scope": "Workspace", - "requiredPermissions": { - "action": true + ], + "sampleQueries": [ + { + "description": "All HoneyForge events \u00e2\u20ac\u201d last 24 hours", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" + }, + { + "description": "Top source IPs interacting with sensors \u00e2\u20ac\u201d last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" + }, + { + "description": "Events by sensor \u00e2\u20ac\u201d last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } - } - ] - }, - "instructionSteps": [ - { - "title": "", - "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." - }, - { - "title": "Step 1 — Deploy the CEF syslog forwarder", - "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", - "innerSteps": [ + ], + "connectivityCriterias": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", - "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", - "instructions": [ - { - "parameters": { - "fillWith": ["WorkspaceId", "PrimaryKey"], - "label": "Run on the Linux forwarder:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" + ] } - ] + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (HoneyForge)", + "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false }, - { - "title": "Step 2 — Configure HoneyForge syslog forwarding", - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za)." + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)" + }, + { + "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)" + } + ] }, - { - "title": "Step 3 — Validate connectivity", - "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", - "instructions": [ + "instructionSteps": [ + { + "title": "", + "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." + }, + { + "title": "Step 1 \u00e2\u20ac\u201d Deploy the CEF syslog forwarder", + "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", + "innerSteps": [ + { + "title": "1.1 \u00e2\u20ac\u201d Install the Log Analytics agent and CEF collector", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run on the Linux forwarder:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, { - "parameters": { - "fillWith": ["WorkspaceId"], - "label": "Run the troubleshooter on the Linux forwarder:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}" - }, - "type": "CopyableLabel" + "title": "Step 2 \u00e2\u20ac\u201d Configure HoneyForge syslog forwarding", + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings \u00e2\u2020\u2019 SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za)." + }, + { + "title": "Step 3 \u00e2\u20ac\u201d Validate connectivity", + "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the troubleshooter on the Linux forwarder:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ] } - ] - } - ] -} + ] +} \ No newline at end of file diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml index 815f8e03655..af685ba69ee 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml @@ -6,7 +6,7 @@ description: | period). This pattern is characteristic of automated scanners, brute-force tools, or worm-like lateral movement. - High-frequency hits deserve immediate triage — especially if the source is + High-frequency hits deserve immediate triage - especially if the source is an internal IP, which would indicate a compromised or misconfigured device inside the network. requiredDataConnectors: diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml index b1b75667708..f8e429ac97b 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml @@ -3,7 +3,7 @@ name: HoneyForge - Off-Hours Sensor Activity description: | Surfaces HoneyForge sensor interactions that occurred outside normal business hours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on - weekends). Off-hours activity from internal IPs is especially suspicious — + weekends). Off-hours activity from internal IPs is especially suspicious - it may indicate a compromised device operating autonomously or an insider threat. diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml index fc02427007f..3102049a56c 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml @@ -3,7 +3,7 @@ name: HoneyForge - Top Attacking Source IPs description: | Identifies the source IP addresses that have interacted most frequently with HoneyForge deception sensors over the past 7 days. Repeat offenders across - multiple sensors are especially high-priority — they indicate persistent + multiple sensors are especially high-priority - they indicate persistent reconnaissance or an automated scanner that missed the exclusion list. Use this query as a starting point for threat-intel enrichment and to decide diff --git a/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg b/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg index 23a0a4cde9a..ce4a81b0dd4 100644 --- a/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg +++ b/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg @@ -1,4 +1,4 @@ - + - + \ No newline at end of file diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index 56037cc142b..b457119906c 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -10,17 +10,10 @@ } }, "location": { - "type": "string", - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Azure region for all resources." - } - }, - "workspace-location": { "type": "string", "defaultValue": "", "metadata": { - "description": "Region of the Log Analytics workspace. Must match the workspace location." + "description": "Azure region for all resources." } } }, @@ -55,13 +48,13 @@ "icon": "", "contentKind": "Solution", "packageKind": "Solution", - "packageId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "packageId": "[variables('_solutionId')]", "packageName": "HoneyForge Threat Detection", "packageVersion": "1.0.0", "source": { "kind": "Solution", "name": "HoneyForge Threat Detection", - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8" + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", @@ -132,7 +125,14 @@ "Security - Threat Intelligence", "Security - Network" ] - } + }, + "solutionId": "[variables('_solutionId')]" + }, + "plan": { + "name": "[variables('_solutionName')]", + "publisher": "[variables('_publisherId')]", + "product": "[concat('TemplateEmptyDeployment-', variables('_offerId'))]", + "version": "[variables('_solutionVersion')]" } }, { @@ -160,7 +160,7 @@ "version": "1.0.0", "displayName": "HoneyForge Threat Detection", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -180,7 +180,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -226,10 +226,10 @@ "kind": "NRT", "location": "[parameters('location')]", "properties": { - "description": "Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices — legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.", + "description": "Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices \u00e2\u20ac\u201d legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.", "displayName": "HoneyForge - Deception Sensor Interaction", "enabled": false, - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n EventType = iff(isempty(tostring(DeviceEventClassID)), \"unknown\", tostring(DeviceEventClassID)),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(CollectorHostName), 10)\n by SrcIpAddr, DstIpAddr, SensorID, CustomerID, SensorName, EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated, FirstSeen, LastSeen, EventCount,\n SrcIpAddr, DstIpAddr, SourcePortList, DestinationPortList, ProtocolList,\n SensorID, SensorName, CustomerID, EventType, ActivityList,\n CEFSeverityList, DeviceVersionList, CollectorList", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n EventType = iff(isempty(tostring(DeviceEventClassID)), \"unknown\", tostring(DeviceEventClassID)),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(Computer), 10)\n by SrcIpAddr, DstIpAddr, SensorID, CustomerID, SensorName, EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated, FirstSeen, LastSeen, EventCount,\n SrcIpAddr, DstIpAddr, SourcePortList, DestinationPortList, ProtocolList,\n SensorID, SensorName, CustomerID, EventType, ActivityList,\n CEFSeverityList, DeviceVersionList, CollectorList", "severity": "High", "suppressionDuration": "PT5H", "suppressionEnabled": false, @@ -251,8 +251,8 @@ "alertDescriptionFormat": "HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}} using {{ProtocolList}}. Treat this activity as unauthorised until validated." }, "customDetails": { - "CustomerID": "CustomerID", - "SensorID": "SensorID", + "Customer": "CustomerID", + "Sensor": "SensorID", "SensorName": "SensorName", "EventType": "EventType", "Activity": "ActivityList", @@ -306,8 +306,8 @@ ], "groupByAlertDetails": [], "groupByCustomDetails": [ - "CustomerID", - "SensorID" + "Customer", + "Sensor" ] } }, @@ -326,7 +326,7 @@ "version": "1.0.0", "displayName": "HoneyForge - Deception Sensor Interaction", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -346,7 +346,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -412,7 +412,7 @@ "version": "1.0.0", "displayName": "HoneyForge ASIM NetworkSession Parser", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -432,7 +432,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -500,7 +500,7 @@ "version": "1.0.0", "displayName": "HoneyForge - Top Attacking Source IPs", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -520,7 +520,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -588,7 +588,7 @@ "version": "1.0.0", "displayName": "HoneyForge - Repeated Probes from Same Source", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -608,7 +608,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -676,7 +676,7 @@ "version": "1.0.0", "displayName": "HoneyForge - Sensor Fleet Coverage and Health", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -696,7 +696,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -764,7 +764,7 @@ "version": "1.0.0", "displayName": "HoneyForge - High-Frequency Sensor Interactions", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -784,7 +784,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -852,7 +852,7 @@ "version": "1.0.0", "displayName": "HoneyForge - Off-Hours Sensor Activity", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -872,7 +872,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -906,7 +906,7 @@ "type": "string" }, "location": { - "defaultValue": "[resourceGroup().location]", + "defaultValue": "[parameters('location')]", "type": "string" }, "workbook-id": { @@ -944,7 +944,7 @@ "version": "1.0.0", "displayName": "HoneyForge Threat Detection Workbook", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, @@ -964,7 +964,7 @@ }, "version": "1.0.0", "source": { - "sourceId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", + "sourceId": "[variables('_solutionId')]", "name": "HoneyForge Threat Detection", "kind": "Solution" }, diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index e10e06814a6..831f16f1f4e 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -10,105 +10,105 @@ Function: FunctionName: HoneyForgeEvent FunctionAlias: HoneyForgeEvent Category: Microsoft Sentinel Parser - FunctionQuery: | - let HoneyForgeEvent = ( - starttime: datetime = datetime(null), - endtime: datetime = datetime(null), - srcipaddr_has_any_prefix: dynamic = dynamic([]), - dstipaddr_has_any_prefix: dynamic = dynamic([]), - ipaddr_has_any_prefix: dynamic = dynamic([]), - dstportnumber: int = int(null), - hostname_has_any: dynamic = dynamic([]), - disabled: bool = false - ) { - CommonSecurityLog - | where not(disabled) - | where DeviceVendor =~ "BUI" - | where DeviceProduct =~ "HoneyForge" - // Time filter - | where (isnull(starttime) or TimeGenerated >= starttime) - | where (isnull(endtime) or TimeGenerated <= endtime) - // IP prefix filters - | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix)) - | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix)) - | where (array_length(ipaddr_has_any_prefix) == 0 - or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) - or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix)) - // Port filter - | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber) - // Sensor name filter - | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) - | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any)) - // ASIM field mappings - | extend - // Event metadata - EventVendor = "BUI", - EventProduct = "HoneyForge", - EventProductVersion = tostring(DeviceVersion), - EventSchema = "NetworkSession", - EventSchemaVersion = "0.2.6", - EventType = "NetworkSession", - EventResult = "NA", - EventStartTime = TimeGenerated, - EventEndTime = TimeGenerated, - EventCount = toint(1), - EventOriginalUid = tostring(ExtID), - EventOriginalType = tostring(DeviceEventClassID), - EventSeverity = case( - toint(LogSeverity) >= 9, "Critical", - toint(LogSeverity) >= 7, "High", - toint(LogSeverity) >= 4, "Medium", - "Low"), - EventOriginalSeverity = tostring(LogSeverity), - EventMessage = tostring(Activity), - // Source - SrcIpAddr = tostring(SourceIP), - SrcPortNumber = toint(SourcePort), - // Destination (the sensor) - DstIpAddr = tostring(DestinationIP), - DstPortNumber = toint(DestinationPort), - DstHostname = _SensorName, - // Network - NetworkProtocol = tostring(Protocol), - NetworkDirection = "Inbound", - // Device (sensor) - DvcHostname = tostring(Computer), - DvcId = tostring(DeviceCustomString1), - DvcIdType = "Other", - // HoneyForge-specific custom fields (retained for hunting) - HoneyForgeSensorID = tostring(DeviceCustomString1), - HoneyForgeCustomerID = tostring(DeviceCustomString2), - HoneyForgeSensorName = _SensorName - | project-away _SensorName - | project - TimeGenerated, - EventVendor, - EventProduct, - EventProductVersion, - EventSchema, - EventSchemaVersion, - EventType, - EventResult, - EventSeverity, - EventOriginalSeverity, - EventOriginalUid, - EventOriginalType, - EventMessage, - EventStartTime, - EventEndTime, - EventCount, - SrcIpAddr, - SrcPortNumber, - DstIpAddr, - DstPortNumber, - DstHostname, - NetworkProtocol, - NetworkDirection, - DvcHostname, - DvcId, - DvcIdType, - HoneyForgeSensorID, - HoneyForgeCustomerID, - HoneyForgeSensorName - }; - HoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, disabled=disabled) +FunctionQuery: | + let HoneyForgeEvent = ( + starttime: datetime = datetime(null), + endtime: datetime = datetime(null), + srcipaddr_has_any_prefix: dynamic = dynamic([]), + dstipaddr_has_any_prefix: dynamic = dynamic([]), + ipaddr_has_any_prefix: dynamic = dynamic([]), + dstportnumber: int = int(null), + hostname_has_any: dynamic = dynamic([]), + disabled: bool = false + ) { + CommonSecurityLog + | where not(disabled) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + // Time filter + | where (isnull(starttime) or TimeGenerated >= starttime) + | where (isnull(endtime) or TimeGenerated <= endtime) + // IP prefix filters + | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix)) + | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix)) + | where (array_length(ipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) + or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix)) + // Port filter + | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber) + // Sensor name filter + | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) + | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any)) + // ASIM field mappings + | extend + // Event metadata + EventVendor = "BUI", + EventProduct = "HoneyForge", + EventProductVersion = tostring(DeviceVersion), + EventSchema = "NetworkSession", + EventSchemaVersion = "0.2.6", + EventType = "NetworkSession", + EventResult = "NA", + EventStartTime = TimeGenerated, + EventEndTime = TimeGenerated, + EventCount = toint(1), + EventOriginalUid = tostring(ExtID), + EventOriginalType = tostring(DeviceEventClassID), + EventSeverity = case( + toint(LogSeverity) >= 9, "Critical", + toint(LogSeverity) >= 7, "High", + toint(LogSeverity) >= 4, "Medium", + "Low"), + EventOriginalSeverity = tostring(LogSeverity), + EventMessage = tostring(Activity), + // Source + SrcIpAddr = tostring(SourceIP), + SrcPortNumber = toint(SourcePort), + // Destination (the sensor) + DstIpAddr = tostring(DestinationIP), + DstPortNumber = toint(DestinationPort), + DstHostname = _SensorName, + // Network + NetworkProtocol = tostring(Protocol), + NetworkDirection = "Inbound", + // Device (sensor) + DvcHostname = tostring(Computer), + DvcId = tostring(DeviceCustomString1), + DvcIdType = "Other", + // HoneyForge-specific custom fields (retained for hunting) + HoneyForgeSensorID = tostring(DeviceCustomString1), + HoneyForgeCustomerID = tostring(DeviceCustomString2), + HoneyForgeSensorName = _SensorName + | project-away _SensorName + | project + TimeGenerated, + EventVendor, + EventProduct, + EventProductVersion, + EventSchema, + EventSchemaVersion, + EventType, + EventResult, + EventSeverity, + EventOriginalSeverity, + EventOriginalUid, + EventOriginalType, + EventMessage, + EventStartTime, + EventEndTime, + EventCount, + SrcIpAddr, + SrcPortNumber, + DstIpAddr, + DstPortNumber, + DstHostname, + NetworkProtocol, + NetworkDirection, + DvcHostname, + DvcId, + DvcIdType, + HoneyForgeSensorID, + HoneyForgeCustomerID, + HoneyForgeSensorName + }; + HoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, disabled=disabled) From 192875a3f44c3f339f18728e25bb2d7b4f56745a Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Mon, 27 Jul 2026 06:12:31 +0200 Subject: [PATCH 05/71] Restore HoneyForge entry in ValidConnectorIds after upstream merge --- .../detectionTemplateSchemaValidation/ValidConnectorIds.json | 1 + 1 file changed, 1 insertion(+) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 92c76629053..c79a8f69a06 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -261,6 +261,7 @@ "MicrosoftDefenderForCloudTenantBased", "RidgeBotDataConnector", "ValenceSecurity", + "HoneyForge", "HVPollingIDAzureFunctions", "CBSPollingIDAzureFunctions", "AzureCloudNGFWByPaloAltoNetworks", From f0d6eed90434e1a42db7a7353f59233474417050 Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Tue, 28 Jul 2026 08:07:09 +0200 Subject: [PATCH 06/71] Fix CI: CEF sharedKeys permission, parser FunctionName indent, solutionId variable --- .../Data Connectors/HoneyForge.json | 241 +++++++++--------- .../HoneyForge/Package/mainTemplate.json | 1 + .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 6 +- 3 files changed, 129 insertions(+), 119 deletions(-) diff --git a/Solutions/HoneyForge/Data Connectors/HoneyForge.json b/Solutions/HoneyForge/Data Connectors/HoneyForge.json index 747d57cb74b..043c17c338b 100644 --- a/Solutions/HoneyForge/Data Connectors/HoneyForge.json +++ b/Solutions/HoneyForge/Data Connectors/HoneyForge.json @@ -1,119 +1,128 @@ { - "id": "HoneyForge", - "title": "HoneyForge Threat Detection", - "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious \u00e2\u20ac\u201d because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", - "logo": "Logos/HoneyForgeLogo.svg", - "graphQueriesTableName": "CommonSecurityLog", - "graphQueries": [ - { - "metricName": "Total events received", - "legend": "HoneyForge sensor events", - "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" - } - ], - "sampleQueries": [ - { - "description": "All HoneyForge events \u00e2\u20ac\u201d last 24 hours", - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" - }, - { - "description": "Top source IPs interacting with sensors \u00e2\u20ac\u201d last 7 days", - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" - }, - { - "description": "Events by sensor \u00e2\u20ac\u201d last 7 days", - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" - } - ], - "connectivityCriterias": [ - { - "type": "IsConnectedQuery", - "value": [ - "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" - ] - } - ], - "dataTypes": [ - { - "name": "CommonSecurityLog (HoneyForge)", - "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "read and write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true - } - } - ], - "customs": [ - { - "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)" - }, - { - "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)" - } - ] - }, - "instructionSteps": [ - { - "title": "", - "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." - }, - { - "title": "Step 1 \u00e2\u20ac\u201d Deploy the CEF syslog forwarder", - "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", - "innerSteps": [ - { - "title": "1.1 \u00e2\u20ac\u201d Install the Log Analytics agent and CEF collector", - "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId", - "PrimaryKey" - ], - "label": "Run on the Linux forwarder:", - "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}" - }, - "type": "CopyableLabel" - } - ] - } - ] - }, - { - "title": "Step 2 \u00e2\u20ac\u201d Configure HoneyForge syslog forwarding", - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings \u00e2\u2020\u2019 SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za)." - }, - { - "title": "Step 3 \u00e2\u20ac\u201d Validate connectivity", - "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", - "instructions": [ - { - "parameters": { - "fillWith": [ - "WorkspaceId" - ], - "label": "Run the troubleshooter on the Linux forwarder:", - "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}" + "id": "HoneyForge", + "title": "HoneyForge Threat Detection", + "publisher": "BUI", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "logo": "Logos/HoneyForgeLogo.svg", + "graphQueriesTableName": "CommonSecurityLog", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "HoneyForge sensor events", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" + } + ], + "sampleQueries": [ + { + "description": "All HoneyForge events — last 24 hours", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated \u003e= ago(24h)\n| sort by TimeGenerated desc" + }, + { + "description": "Top source IPs interacting with sensors — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated \u003e= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" + }, + { + "description": "Events by sensor — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated \u003e= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived \u003e ago(3d)" + ] + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (HoneyForge)", + "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)" + }, + { + "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)" + } + ] }, - "type": "CopyableLabel" - } - ] - } - ] + "instructionSteps": [ + { + "title": "", + "description": "\u003e**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." + }, + { + "title": "Step 1 — Deploy the CEF syslog forwarder", + "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", + "innerSteps": [ + { + "title": "1.1 — Install the Log Analytics agent and CEF collector", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run on the Linux forwarder:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py \u0026\u0026 sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ] + }, + { + "title": "Step 2 — Configure HoneyForge syslog forwarding", + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za)." + }, + { + "title": "Step 3 — Validate connectivity", + "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the troubleshooter on the Linux forwarder:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py \u0026\u0026 sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ] + } + ] } \ No newline at end of file diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index b457119906c..b5d6019690e 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -19,6 +19,7 @@ }, "variables": { "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", + "solutionId": "bui.honeyforge-threat-detection", "_solutionId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", "_solutionName": "HoneyForge Threat Detection", "_solutionVersion": "1.0.0", diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index 831f16f1f4e..a6cafa1669b 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -7,9 +7,9 @@ Function: ASIM NetworkSession parser for HoneyForge Threat Detection Platform events. Normalises CEF events from the CommonSecurityLog table (DeviceVendor="BUI", DeviceProduct="HoneyForge") to the ASIM NetworkSession schema v0.2.6. - FunctionName: HoneyForgeEvent - FunctionAlias: HoneyForgeEvent - Category: Microsoft Sentinel Parser +FunctionName: HoneyForgeEvent +FunctionAlias: HoneyForgeEvent +Category: Microsoft Sentinel Parser FunctionQuery: | let HoneyForgeEvent = ( starttime: datetime = datetime(null), From 84245cd1984a219d10fe75e552ecab9d2daf65ec Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Tue, 4 Aug 2026 19:58:37 +0200 Subject: [PATCH 07/71] fix: ASIM FunctionParams + savedSearches apiVersion for CI --- .../HoneyForge/Package/mainTemplate.json | 15 +- .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 205 +++++++++--------- 2 files changed, 108 insertions(+), 112 deletions(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index b5d6019690e..cee470f0cf1 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -19,7 +19,6 @@ }, "variables": { "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "solutionId": "bui.honeyforge-threat-detection", "_solutionId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", "_solutionName": "HoneyForge Threat Detection", "_solutionVersion": "1.0.0", @@ -227,7 +226,7 @@ "kind": "NRT", "location": "[parameters('location')]", "properties": { - "description": "Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices \u00e2\u20ac\u201d legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.", + "description": "Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices \u2014 legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.", "displayName": "HoneyForge - Deception Sensor Interaction", "enabled": false, "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n EventType = iff(isempty(tostring(DeviceEventClassID)), \"unknown\", tostring(DeviceEventClassID)),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(Computer), 10)\n by SrcIpAddr, DstIpAddr, SensorID, CustomerID, SensorName, EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated, FirstSeen, LastSeen, EventCount,\n SrcIpAddr, DstIpAddr, SourcePortList, DestinationPortList, ProtocolList,\n SensorID, SensorName, CustomerID, EventType, ActivityList,\n CEFSeverityList, DeviceVersionList, CollectorList", @@ -385,7 +384,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-04-01", "name": "[concat(parameters('workspace'), '/HoneyForgeEvent')]", "properties": { "eTag": "*", @@ -471,7 +470,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-04-01", "name": "[concat(parameters('workspace'), '/HoneyForge_TopAttackingSources')]", "properties": { "eTag": "*", @@ -559,7 +558,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-04-01", "name": "[concat(parameters('workspace'), '/HoneyForge_RepeatedProbes')]", "properties": { "eTag": "*", @@ -647,7 +646,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-04-01", "name": "[concat(parameters('workspace'), '/HoneyForge_FleetCoverage')]", "properties": { "eTag": "*", @@ -735,7 +734,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-04-01", "name": "[concat(parameters('workspace'), '/HoneyForge_HighFrequency')]", "properties": { "eTag": "*", @@ -823,7 +822,7 @@ "resources": [ { "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2020-08-01", + "apiVersion": "2022-04-01", "name": "[concat(parameters('workspace'), '/HoneyForge_OffHoursActivity')]", "properties": { "eTag": "*", diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index a6cafa1669b..293215c0dd6 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -7,108 +7,105 @@ Function: ASIM NetworkSession parser for HoneyForge Threat Detection Platform events. Normalises CEF events from the CommonSecurityLog table (DeviceVendor="BUI", DeviceProduct="HoneyForge") to the ASIM NetworkSession schema v0.2.6. -FunctionName: HoneyForgeEvent -FunctionAlias: HoneyForgeEvent -Category: Microsoft Sentinel Parser + FunctionName: HoneyForgeEvent + FunctionAlias: HoneyForgeEvent + Category: Microsoft Sentinel Parser +FunctionParams: | + starttime:datetime=datetime(null), + endtime:datetime=datetime(null), + srcipaddr_has_any_prefix:dynamic=dynamic([]), + dstipaddr_has_any_prefix:dynamic=dynamic([]), + ipaddr_has_any_prefix:dynamic=dynamic([]), + dstportnumber:int=int(null), + hostname_has_any:dynamic=dynamic([]), + disabled:bool=false FunctionQuery: | - let HoneyForgeEvent = ( - starttime: datetime = datetime(null), - endtime: datetime = datetime(null), - srcipaddr_has_any_prefix: dynamic = dynamic([]), - dstipaddr_has_any_prefix: dynamic = dynamic([]), - ipaddr_has_any_prefix: dynamic = dynamic([]), - dstportnumber: int = int(null), - hostname_has_any: dynamic = dynamic([]), - disabled: bool = false - ) { - CommonSecurityLog - | where not(disabled) - | where DeviceVendor =~ "BUI" - | where DeviceProduct =~ "HoneyForge" - // Time filter - | where (isnull(starttime) or TimeGenerated >= starttime) - | where (isnull(endtime) or TimeGenerated <= endtime) - // IP prefix filters - | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix)) - | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix)) - | where (array_length(ipaddr_has_any_prefix) == 0 - or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) - or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix)) - // Port filter - | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber) - // Sensor name filter - | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) - | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any)) - // ASIM field mappings - | extend - // Event metadata - EventVendor = "BUI", - EventProduct = "HoneyForge", - EventProductVersion = tostring(DeviceVersion), - EventSchema = "NetworkSession", - EventSchemaVersion = "0.2.6", - EventType = "NetworkSession", - EventResult = "NA", - EventStartTime = TimeGenerated, - EventEndTime = TimeGenerated, - EventCount = toint(1), - EventOriginalUid = tostring(ExtID), - EventOriginalType = tostring(DeviceEventClassID), - EventSeverity = case( - toint(LogSeverity) >= 9, "Critical", - toint(LogSeverity) >= 7, "High", - toint(LogSeverity) >= 4, "Medium", - "Low"), - EventOriginalSeverity = tostring(LogSeverity), - EventMessage = tostring(Activity), - // Source - SrcIpAddr = tostring(SourceIP), - SrcPortNumber = toint(SourcePort), - // Destination (the sensor) - DstIpAddr = tostring(DestinationIP), - DstPortNumber = toint(DestinationPort), - DstHostname = _SensorName, - // Network - NetworkProtocol = tostring(Protocol), - NetworkDirection = "Inbound", - // Device (sensor) - DvcHostname = tostring(Computer), - DvcId = tostring(DeviceCustomString1), - DvcIdType = "Other", - // HoneyForge-specific custom fields (retained for hunting) - HoneyForgeSensorID = tostring(DeviceCustomString1), - HoneyForgeCustomerID = tostring(DeviceCustomString2), - HoneyForgeSensorName = _SensorName - | project-away _SensorName - | project - TimeGenerated, - EventVendor, - EventProduct, - EventProductVersion, - EventSchema, - EventSchemaVersion, - EventType, - EventResult, - EventSeverity, - EventOriginalSeverity, - EventOriginalUid, - EventOriginalType, - EventMessage, - EventStartTime, - EventEndTime, - EventCount, - SrcIpAddr, - SrcPortNumber, - DstIpAddr, - DstPortNumber, - DstHostname, - NetworkProtocol, - NetworkDirection, - DvcHostname, - DvcId, - DvcIdType, - HoneyForgeSensorID, - HoneyForgeCustomerID, - HoneyForgeSensorName - }; - HoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, disabled=disabled) + CommonSecurityLog + | where not(disabled) + | where DeviceVendor =~ "BUI" + | where DeviceProduct =~ "HoneyForge" + // Time filter + | where (isnull(starttime) or TimeGenerated >= starttime) + | where (isnull(endtime) or TimeGenerated <= endtime) + // IP prefix filters + | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix)) + | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix)) + | where (array_length(ipaddr_has_any_prefix) == 0 + or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) + or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix)) + // Port filter + | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber) + // Sensor name filter + | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) + | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any)) + // ASIM field mappings + | extend + // Event metadata + EventVendor = "BUI", + EventProduct = "HoneyForge", + EventProductVersion = tostring(DeviceVersion), + EventSchema = "NetworkSession", + EventSchemaVersion = "0.2.6", + EventType = "NetworkSession", + EventResult = "NA", + EventStartTime = TimeGenerated, + EventEndTime = TimeGenerated, + EventCount = toint(1), + EventOriginalUid = tostring(ExtID), + EventOriginalType = tostring(DeviceEventClassID), + EventSeverity = case( + toint(LogSeverity) >= 9, "Critical", + toint(LogSeverity) >= 7, "High", + toint(LogSeverity) >= 4, "Medium", + "Low"), + EventOriginalSeverity = tostring(LogSeverity), + EventMessage = tostring(Activity), + // Source + SrcIpAddr = tostring(SourceIP), + SrcPortNumber = toint(SourcePort), + // Destination (the sensor) + DstIpAddr = tostring(DestinationIP), + DstPortNumber = toint(DestinationPort), + DstHostname = _SensorName, + // Network + NetworkProtocol = tostring(Protocol), + NetworkDirection = "Inbound", + // Device (sensor) + DvcHostname = tostring(Computer), + DvcId = tostring(DeviceCustomString1), + DvcIdType = "Other", + // HoneyForge-specific custom fields (retained for hunting) + HoneyForgeSensorID = tostring(DeviceCustomString1), + HoneyForgeCustomerID = tostring(DeviceCustomString2), + HoneyForgeSensorName = _SensorName + | project-away _SensorName + | project + TimeGenerated, + EventVendor, + EventProduct, + EventProductVersion, + EventSchema, + EventSchemaVersion, + EventType, + EventResult, + EventSeverity, + EventOriginalSeverity, + EventOriginalUid, + EventOriginalType, + EventMessage, + EventStartTime, + EventEndTime, + EventCount, + SrcIpAddr, + SrcPortNumber, + DstIpAddr, + DstPortNumber, + DstHostname, + NetworkProtocol, + NetworkDirection, + DvcHostname, + DvcId, + DvcIdType, + HoneyForgeSensorID, + HoneyForgeCustomerID, + HoneyForgeSensorName From d3b8ddb2092c57bc81ea1972021be9ab87b4547e Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Thu, 20 Aug 2026 10:53:42 +0200 Subject: [PATCH 08/71] Add V3 package: workbook, data connector, analytic rule, hunting queries --- .../HoneyForge/Data/Solution_HoneyForge.json | 27 + Solutions/HoneyForge/Package/Package.zip | Bin 0 -> 15332 bytes .../Package/createUiDefinition.json | 228 ++- .../HoneyForge/Package/mainTemplate.json | 1408 ++++++++++------- .../HoneyForge/Package/testParameters.json | 32 + 5 files changed, 1073 insertions(+), 622 deletions(-) create mode 100644 Solutions/HoneyForge/Data/Solution_HoneyForge.json create mode 100644 Solutions/HoneyForge/Package/Package.zip create mode 100644 Solutions/HoneyForge/Package/testParameters.json diff --git a/Solutions/HoneyForge/Data/Solution_HoneyForge.json b/Solutions/HoneyForge/Data/Solution_HoneyForge.json new file mode 100644 index 00000000000..765d04845ce --- /dev/null +++ b/Solutions/HoneyForge/Data/Solution_HoneyForge.json @@ -0,0 +1,27 @@ +{ + "Name": "HoneyForge", + "Author": "BUI - support@bui.co.za", + "Logo": "", + "Description": "The [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.", + "Workbooks": [ + "Solutions/HoneyForge/Workbooks/HoneyForge.json" + ], + "Data Connectors": [ + "Solutions/HoneyForge/Data Connectors/HoneyForge.json" + ], + "Analytic Rules": [ + "Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml" + ], + "Hunting Queries": [ + "Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml", + "Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml", + "Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml", + "Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml", + "Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml" + ], + "BasePath": "C:\\GitHub\\Azure-Sentinel\\", + "Version": "3.0.3", + "Metadata": "SolutionMetadata.json", + "TemplateSpec": true, + "Is1PConnector": false +} diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip new file mode 100644 index 0000000000000000000000000000000000000000..a922b46aba890406b23b7137818820ba551649f3 GIT binary patch literal 15332 zcmZ{Lb8s#&({F9td}`aaZMUa9wQZi-?Wt|swr$(C?s?z)*ZuB%o6KyI$?PPvnIyaW zTSXaAFfKzHlgcAI3OTIW*{KUf1@Ujrbf=DYL=p=W|p>=&X#tz^j1!G zwp-dZcALY<-`56Atr)Xe4h#vXq*aO(ibtI6h7{#RgOtwVwGs$p(J4HS-J5R-IHz`J z3KtAiW~qnqZWKLY<)D6b-iMB^uCB-F=H@3YJU~GL8-=~fa4|-ToEmEfYqb37DZ-I> zGK;pUKG6+9Yz-E+$n6(Tt1) zffuG)t`%(UoNt^bs(RX58%j<~aW%VG!?Cf!!iS8_6+Q@FH0rWOvCNzM1-Dc^G_EHi zr&SRNvgcUvCLS4>WBO@*&PXMWTVeVu*Tu#n3Z!&MI4^|FBU|MhuPP|o0t$u3G0r%! z53(=6`4>=XX%=`H{#9aU5{P_{4=ay{D|6`hta5SZby1@uakBHpYmvP?K*Mk>1MCVb zlaY&C_Cm}0by-PxJVxjgO}7sidOBC04l0|Y)ULf;{m(KmLB0wH$5EVBk|e#KNGD&6Ax7+AJfNXAGkUk!DbpF1lvf6q)lLry*;j`TKZ9nsCRrtydb z$S<}S=0Lx`>ZE0Xoo|N=Q!26oe*v~%nmwn+!w|AS5D*1*GyU13x$T#5{`3&vih0OJ zf6VEQr`IicRPczK zyW4wR17mvz`1l4rZWS*Z%_`I~^9y02`Cq16X0OkLNNwi1@YY^z&P2z-QzqKIKut{U}h1N_C`et|I&66aBJe0B^M z?vX*#oE8z6$IPU1$?elCLp6F>AXXrl#_?=WeMV37I6ZEP> z_@PJ_!#Ck%Hg6BkBSFToUhUJM?Ec{>-ULx?b{)M{=M>GX5 zr^cIgBpxX3McKcLh(7D*&e9SQrY`P7ismuAm4~X8$Aa8ux5E*$rE2BCKva4OgTBCp z);+<;rdlin(BY>;lR85kAVTdRGVXs2>~oo*yR7NWAg$9hJ)Qp*Twk*4G5Y{HKWKi% z-`Iqw*B_p~=q_vV>-n@ev_^FIif^Ez-UM^J&Ny=;KG8qohvU-8;^%UFu84}(H{?~p zrllckZGMp_N0X1z!&yxHWe1JGVfLB1$0#=9O`dXh3AkHUdYg)jv`qh`U4S(Im8qEM znk*1TeLb^9{TbbFZt{p5G$RyNt*~pP!^Rh@wm`9-hwMe>jW^y5`wF1samQ+22;8N# zPKBU3gF)IVm~j1ahoSI<=k=!A@~ke>PtXpnz4BGZ%#g9e*Vxg!4MGbJ`SY400#mfS z+jLt^L`qleG&Q6RJ^>Y$b{{|n=I&z+Vioy!S1~D1vXi9<+z5%&$`YQ6o=l_2 z5Cq2Q?AI8l(aN&X7`bG?jlrevMqsD3&;bfOKs7~wB6tL%!`@VYUI0R5_c!jwomkMK z<*Q*e8@GI+A!^>+u^}9su{b5AB{rTJ+^^N|zLe55h?L~KglMIT&Jfv+0LR3#+VG-# zjXLFS4nkYCg_;_mPSf2m)6#Bbzgku`8ptNs8(D?nFqE{RD~181zTcST&}_Z>85O%P zWEFIgzMEw88K_iE&pCZ(FaLlZq6byoNaH2k`c-z8e8(KM~r(*Wd)xAQ=!|T z^Fl8==;hQR#tUu~kQkoVeI(_&W|PsQdOysuvk~MYdv}4gLH`jrcnw z9|l>i;zDsEmX)GL8#cO-yy7WS%T82dn;3+=q;;O-L}U~kWW4s2inD^azrKww`1Dw~ z%66I_BH3S!sgsl#ce2pw8Zh;{AW|dX$J)i0J8L+>`Xcny8yJWj(Ap7fe~-`8QDs^S z#6YQ-c)=Afgb`2bsC7pYu8Tf>x9nSWx_A%jTlPL(`gpw_JLVT5LwCA1pnFD`8OUS% z!4u?{y)1IN-het^EZYoxP#+E_g=4r|O*nl5R<_>-XJOJYYXL_xt`FpRU>c2;8x!4y z5Wvku2Zm%W(ll712^BQKp&wyc;l>L5+?j)he=lI73!POzEXguO2EK6O&;nb4;CG_P zD?@K%()x?y^@v+=X`|dY$3_91E8c3Rpgr30R20(sdk9~D9^>8ke!F$WO$-0Qm_iXs zAuCQ;%V9|XMJD%e?guz(q%XbkVJWS**|s)fz+`8#?KZ$9)f0yjd9ub*IU+if+?eP# zFh>^!{gv`%2mTzo0=q@jV)u~UUL|)`IAlv7V`fIb zND~cF&P)z?)U83PS%sHasD)LscM^@FL(l4k@@PPnT;7l-Pv9k-J=SjDma?KTH1=j) zOWYghnO99{vC<$A)TFE?PR4HWYT6>9GV7;#dHc1-U`HXDV}cF~Y#xeXQ2;z67GY0d|9EWjG@*c6 z5ev9+rx*y$r5!|RW3ml6vqgf0q-q;$QiifT1(n{^RY`!d1=JbFZ>V0(huimNg>5<` z`*^}FpKL;6(X%Rzfsa73=!DbJ>6$Q&(o+;R?LDtRY1nU&P?+~6kS8r!@`uW`7|zpJ z4%X<(rsww&8|RT3I5V|icvhzmg=W-HeIjwz+Z)b$6xiUa{sQTWh5lPdoC#ams7p~k zGms;vyVaA`+MWv|53*(cklAAE_HgI?voN@j=>848lmLI>=?Fn02d^Eu1@*h0xL7ga zsJL737LS8MO5@S}!qsO1#Ow0-_D#)x+A><#ds$?v%g_b(LbnBZgU`=(9#`d5$`lZS zLoTc7Ownbd>qEhLalgyH77a^RbmTqixql(*As#*(+;nqEB^-WF$J8MqRD+NR_%=AD&jZ(ls$o~u- z8zW0wRZ|;#>wo6Xe@&b#p9{wg&gSbMUznuh%qtnG`a>C8)RN{6De`Lhb^bc9cZmv` z07=RIG>}Cwix%>Yj^~;$ppxgGvh^AJY>R9|f&Q`(Sm*>Iv9T6T8wE85Q4pfqe{@>~ z+wC2uc;OdeC|un71kyyVJUtj$MfX+6GXxhqmc+O=!8A!3j?<@SqVhd5Xf zmcp^$g!1)EL83HBlsV&0^ZSA^Z_D59Cq_+d=^l-rI`@<+7Db9nWZoG#+C6I9LHyXx zgO|MO2B}?{Fmn$}Ap%f0%8z{qBy#l#ElkIigKVKSnpR);M(&(e{}LR1RQLq)v`|8f zy$49}8&b-*`a(hNOXMW-i|}C9**RTT_&je^#cQ{e0%OWbzi#wBL?H_dwqcb87zYOf zL=y_IF+ld**W>T;q(}hopWEK~PTYG^Xs*78^$&b!odXV7w{gKa9Z+AgNT$Llc)}Hu z@=)*IV+T%51Hfmi^1kA!s5r7n=#&7aE+S%_A@A}(JpzK3;JMVFdSyQvk7A{2wl&at zk!ZRJ@;zXg;F{GnJ^+&;NIc7K(f<0-ER+Cld;k<9$SpM7q$?UUN<7ea)ABTysn1lm z!N%&VOJD9*oqB9pLdV~zC-V=w!CO_QcQ1Z%NH_^6DbN6V3IO>jD7-QKt7N`PKfn|a z2#qdE-f+$Y$0cy%mb-;c9!;jyXqd-p;>km6$hlD=oU;J#6JYWu4B26sCEXaO>|1>- zM!_=PVE+B$_xav>s9r&pLW*0ih~g?T^}K34>E zN>-fYluMDi3tda>8g5BJig+=qPuSYLTbMQyVaRsNu>*BWO#f3;Qb4wcG1o%Xb4_VwR7S{(9Haf7PU3)huRm`m5X2t2>9 zg6DQn^4r|D&R!_&MzX5CV9+QAS43@3%NYn&+EYe(k#$G z^c${X&s2V-7R4ISXWYu*RxMSQ>(;=~bXi?;kv}3-{9$B6Yr_mchHwEX@O(u8b_~%? zuT(Vny`%;AS^9#g5$VmoYB>48sKJtHEi3-(M= zF>0!0d-EQ?4cKA94MZ&r7yU4HJqeImU9hO&^2dK(;$%@#jSAHU{peA9hOz8G1G6B zwAIZp&WMsy0?K z^Af5cIeT##chcIxb7|+69ql?GPiTke27;ugAU;Le;bt(O+Xuy)B*!takI>Z*L6@J* zVG+5S;xeVYw)s}z--0#8EEc33SMvn&l@Fl{QujAIr`e3DCzm*4D1}(9{D`Z3BZ_-; z#?{VCqF_HuOO~FpZBiOXb}AA-srfq7^R&0L%Ak`rfuyR0WFPXv)!wh`zP=*w?@!>732 z)pVVc3}q3-{l#>4ewftI$`q-NbegU1VUShPdv0f|%DthZLGSK(EwP+?!)vC3nk%TZ za;f9JiO*t>az8aJBF@{&!l~%oz1V(3AY_9^Ht(A#B32*sc(&W#+`fY|h!hVxt$#;Q zWnt;nc|3h9X#3&Lu=jf^ZB#!I7ALL;1>+v;>W2ph4#LnS^oJ&y*)xGI#fHJsvZ*GN z5*KJ)A_3P$jw64^lF!m>;0*#jYG4>}a-rp;M^q@Rj3HTK^rU;MnZLLBMSu}d+-kHd zbV2k-+4HCkJ&brsr$Y@iCV5iX`uAV=ymC;6aOfWIsw$t9@meTd(A@WI75HxH5>ctA zo#@HYx(t1Bt@swEoZ`tnt!XRyna9DG^&sa4=2(cT$%KBEp^y~xR3VwWmbeE=jm$Yp z6pnBB)CxVWQjB<`U0!#H(SE zd9c){apJ1e$fgM$Q=tGNtNC~$*;}kV!FgEf6FukN<8WOha%5RPkv}pf%#jg5C9uIt zxk~z_(M9`u!6R6kut@6P(2v4C0W(UaX@p-70^hJwY)E)wv)CvDkX)!xumBXM0^p+v zLHqSTv*0ln;bhPq;KuS$2mvCx!q>E`*^d3i>CQmcAFxJ(QYiThR4n>F$tYkrZwX7C zfjbs{27F;pPy!yAzdv@mk{j)%idFCydJ_Bm0}vdB$zryF1fYskE(`oAWUK8OBLh_UX7ja=)LcS#8n~vWA>_ z$)%UZ+4Od`6gmP-`-LZ{oJc0J#GtcGY**WB95aA9@HUtp{Wj5T{ZtsEGOj>!!w{%+ zW^B@J7IUl*RhK?vteVtF!#%mW6%7>8NybN4C}N5MX}g-`FXskB4TiE)Bu@ID3Ecq$ z-t6*U>HZSBh-RgWXCx&PNmx6Sv6#&bL+1+Zro(-6mqc&}pYmrbyh(0*{Ox)+2g}Qb zXRT>5J|=bh>htT4?V82)Mb6Y{-U=b~l)vx{-=IgBvTGFXxZVKaIyKSnUD3@rA>VfE zvtG1^RK({y7KCzlHy(Mw1^yZX9_$q!*!yr$x$I9Um*^H=HQJe(ci8LOB9O}ayP5S4 z4ym7if58$-o^Np$8|haTaz`eUv;CEq8uMt@9Ep&6^?~~W6O+h__n_^`(Ww$oI72Kf zEV3wn&?LZ(w&(z~z0xjd5rk+6xo>5uj{Du8x_oCUR?qj;fF1`Pm_F^H3`VNsB8lKEq9wW|JB3OC3mz#!Dz>#Lm#%C=K1jX5y{Z(zz9LJ3h65hw zsE*dZF7Q>DnE!bj5%|W%XDNay1bO!RzBBki#E%t!w$#64CLAKM_y9kpJvRI`^HevP zEA~xAAlN`LEzzl>`M1UuJfcFZ{Tj>@7nx*^CyrxiZfso8i$0ow1P{K zn=`Max{-#)tDx{-*+{kB7cXDSLq^`Vnuq)=Cwav-$1$xpo}-4m(Wbj(x=-w`yaS_g z>Nn8*ijt;@CbXI)tJet}_OaCCI`ZTi5POC0$4vjCT5m&iGgoeGx}+&Gg-ELJFLRtg zZx1GmtEcal{?%`y6P-oXMamR`h_*xE*iGr@HT-N&C!aNo+Ic7R>W0k)_U`qgY>xNz zYySJ6rnem-cN`Pm)9GoI8+Vi+XIBe42Gs09Z?t`ny;Gyep5cdsxtZWh+y~6;hdDCh zlcU7(t4a$KGhURD0%T|Wlnc-0vM--S*u1vQ0*do^{4<%y#jiIj!l#@LeAkU_iCvz0 z6wf0~yqX~Wt|Es}?yCYzPMT*2i8>S1U-+gEg*V#{{@!QuFiU zRu{$$vBg5|TKZW03uEf$P-H?|xw<$2`*u#5K;iuZUSl=HHhB6af|~PsgR|(@y^_0$ zT^|A?;*}xVe6Cbi3VVIF3|I%<;Wm~Vx^)*nFLL`(lOqzHBN3fF-V83Z)Cy0L`Yt(5 zL~WTYaNW+Rf%>wlwG|nvlMi;+-i5#cn4(^rn-<>3(GpEcH9D@_cB$Xpi%+K?IWeDl zcV-2%T+}#jeTVI>zJ%ooW@zIw(yA%hsCY8s#(sI>^-e2l{1ZNN$$&I>adn2MOoJZZ zlRWX?#U?PmrN?MGh5ZfPc!u{CC64EjR~66w?oov8W3R-yO)hRncP*%5s__+j z(;^YJk{&wra$|v`Ia%5+4>%yiIeJIW{h5pD$q?CBzIpP0>)#c~wd9kP_mHQyKe@%u z`yyIuhyM^%gxww;0rZri3KHI%VvK!ji$#4%&fH|gA@qe2%Zfm@1@3TENG91) z6jlgf(6FTTvaDkwikYH?(XzK3AhaPUbK+?sZBUVq-UfMK4@{8XUNa-Q)}|`(JstbT zmo;oLch(@lCrRNfntJNsG+OK!D-02aA169X<b{cbZKl(s zW6YxAGvIg@+{Tm_;ZMe8+aPFKOW-)#;|6-&o((+GxbT1MHI*cGDMjoI<$ z1!f8(!otr$JgXh61rJU|#;+CRrN1bllZ7C+OYl`BgCuvfT6Z zE>vO7#|9zzKpR7HfiDpgvCn<_+O*H=EHtXAE?Bp@xQO+dPswatXR@aKX@r5e(lAXd zr70QSDKwNMNl2-rJw5pS)ak>qSzE+X@hNz`Vg#3p50Ge=bCy3QNk!465S+P#eLqS% z&3q|%uIY6roQY9PimPS!y(X2zw4ao%Ev%MDWX=h zvuXO&=0?l)mxzlI3u=KWHp+BCFvOWN5C~^y9LJMGC7uH_Kq}n98w_YC2A05qf$73>xOSaA_0}8tj4+@;A_|mW+|Tu|Xad2k)kE z8n1Z=Uoex?UqO~mk+$OO{A7CAi$#%Kei4K#`IoB?((cmnaqNh>oxZg#N%AsjP(6xJ zFp4!>Vrv_8;53m1eOeqOZ5Pll1Th}N)7{5Y&_h>LfcQmDL-V4BfZb`N5Ku87uP#*3 zPh~qEkLgrPbPAtztz|FO>PrG%Hyed4Jg&}nb6n}EsT&Hc;3bKyr+^B9JPG*}9s%%+ zAVB_Xt_12=RH&$aAVu2#8wx*cMMDj#Ei)$1##lq}7GJf|zyJya$Ld883v3sk0IgDpamRXxO=qhK58HnV)`B z;$8o!Pv+0# z``RA#`qtK(zr6SM<-MZw+vIz?X>s+8;!F5hxp^3cjzAZ`kk^+U!z}+`9~V$`au~)q zR>TFSIX>x8H2RmVK>(h5Z?aU`VH?TkUPg;6=)UhtIJMbV8spM^c#r~Lt|rmk;x8Qi zMcquMa-&B2cgZAxSWZvjd9RZDla|ZrLuz80yaVq~z+?^og;<3)&4m4EMjOrGh%8#kaHnHSY?K}*2Q+ac22#j1cU-IzeG()(gVfLqJ zx5aD&8n0#9ksB8|ic5@=pm@%uIKG>?(=U!yECbgjR1=c$E)zkUTIui8A6HsL&6c4} zQy}Au+o_GJdCc!4gGR74%QZ#MpCY%A?#CJor5fcnDqz_#Z+1vIS@5Yv4xOS{brD9F zCh8InRCprexD*7lhJZJ4V#Q5$ThpKg3=KsC{Jm33&@j7g*UBIp&1Fd5&eG>VUyU)2 za`wl-Q~0_xI4;&0viBi^uy$}6tKu`Y7p2*Y;ER+)r^*Zf+q?I1`e=WAc5{o;WaUD193XC#Ra8ioa`D`6|hE z$c^P3b{rg4)VWecYf6sso-!Bf6sD3?PE zg$&XvHcPQ75G_4K39Yrl*N|BN>~HWDn-0TYF1TM$rM~kYi;tbPcIRz|iu7ZsT+YZPS zIg2sNxF~yCsC5Qm)5>RZ1af{b;8*De(y1YGcT{$QW(cB@4lM1SH1D9&cnaijhs3Gu zvEjzjD0ZEh_H>u82&P)jwfQU}=seS}xLVl!+@fvRdxk)o?!mMjR;tz57U+Bj z8*VTnz0a0xJDPN^>o=}kIHvH)V&aphFA}=D!FU(oV`|> z`f(laU=Y8|8a7AEx2iF>KaQVPCgf&N;?bisIpt7e_t5{=x=+6KjbetpV3pMEl?quQ3vrL`C#Ge^XU_VX7Qx^r1(v97D7WrXV zVvSG}T}2joc6`znQuY5<_J}@rgZl@h9D}kc9xfRft|=b&&HkrdGK3r%hJT}PN))gu z59p^xhMM|pO1)jsN3*PD>^BtpB{UYb+?}OW5sT*@g{8@*ynD=5%}zxDXH{gmxF)9#ST;Go}45An@zn5BE3&klQ~bE)%CdcnyD@r8`zkA%Xr zgo3L=a~JNtp+N#RA>Y!?sEW^B%E=NYjkzPTYwT3k<0?+}l`s;V~=l=uVU)#~@(xOy*^R35iAD=+({j;bAQD~uO?r4J66 zJ_EMAF1IBs>~^JX%uEw)Z)4eJ_FxS}nG5ir->&s=499{O$F3(4VG|ckgN%^K5k(!c zyv>!z7uSg&oGwhXaGj1zb}ONgnlojD0@+*M>U(50b+fi=AV$YBEEyBUaWfSaDhtM> zy^vA$umokNUAk;0rj1h4fLF&d+@rZDP&ulYd@kvDyFz5%~(FNC2R2B>-tj)wfGDxyILa#<1$_Ej;K z@^ff;zyDe#5=n1V*{Ra*6qba=IKyJUdK($zLSt}dFL2JZF#b<6(LYT~MXYL0-wAUV6Y3_^*(T!B5PHGoJQfT1-#5;6hm@DRt&9S&u%o@v9@d zmX{sGEWP8kSlo#o@6^?r{Y5h2~0-Xd=-|^kA;VUQ*!L_4%!AF@}n1z_N!pjZ&L=zlGU;EE_-)n(KK7E_=B=*5FHQTD zl90h26t&-6yD-x#M-4sLOS6qykC_Cw^9pmp_@jyd??jJ zxR*Aeb1sZSl{*{==>9!x4eOXan_Iq66>BeVoCX8TrTR(UK-yXiA^|BR7;M4zPK}3h z_z9XlMYJ&K7`*HIdaUz!n|A0p-TiXwg-e+J^FkEEERV|WOcgIVtOIT+g z)ec~%0DMb|qKuinP*|Bau811rsQJ=t1@Fa1TM{&}6Q)?aD9c6hh5ld5njy;_|Uw4$`dRC_K6 z-1d-DOYAKCQiUT@NpKmgs*qNjR5>rm??sTXvvePztZm$zK7d6TVXf?>P)nV%$IBvT z?=k2RH0Uk_w71W1^Zje!4lkjn)pUE0nSGy+3otJP4YAi{&w$DEgy3_># zVn#%VjJ)3xV2&y(fMtSxPvw7>)G)KkUgeVAm-|Eff7;RrsRezvfPafykAsl0R>iNC z2kTqKMrT?nYZBLe;%ye|$~mo+q?FIAw9;nO-$9a4=!UsfWV$4;Fq~a`3kcALH&}(# z>i;TbJ|oeS)?npR>R&yRRJ%*N#Wo5<#su&(qbgQub{M#Wc35t)$>x$|)2_V1wO2~| zTyr==z(oA}NCsv+5NyHcBYRC1S zugh)w-+Ec_i;xqCz^u#+AM^V>Vz-Os@HXKm2Cmjvq z6XWaxgo|%)lXf}NUUh?|VI6B0yw=Z>lO+}M=_f#P(D3=6ZnitZGL0n57uR){jRvhD z{}jZVS{|W1#Oz9XRx$1FG9Rzg3?8|j>SaMni2~}wemBOtdhX>w!V%ohLD4G&L@5~e zlhzKtcr6I59KS!4!_`*VZRXqkaUmCSJC=8p@IZ(%MZHHzw?@9zcvOCk_)n-6n2oY7 zR#-3hG^e0f!v{9OvUJ&@pGxaQAfAinmssTT*P;Qyd~2pMubOxs8&?Mk(0Sv<<%pWnT~;jrXhRSQebEzkJCY*t1S+AxsctX8;@>s^xp zvoXZ?5K4KSv5c-I-+DwKxsGfRM5jArfMmsv7NkUhx=d`0K%bcoQ+9?-rr{%`IcNI{ zMdV$xcF;yFn;Lb{E^K;n)TRdBSqryti(Hq@SV=cPs)raURC6vSV`QRo!NU`A08Z1f zq@=#3aZYn5*Io#GiA%JXMa9vXD^DneRbs0-cN2c&7@qfyE>HBl(CnSqow+|+GjztC z*HDG}@(2qcdZCpY(e@%#lyGL=BBto05@sW;J%_Lo0k^7fzRpDb_=G^Y$YDFk8^9Qz znL`0UHYCMSn4=8fxme^+KDHgGRgZqMj$zCwV9GAzFYBG2bYtsxaxqzz)MFe&NLdayQw^cn<{Ny{zxn1+ord?*dbG)r-Nefgc0vpKR>=5e5|IMm7CgQeOT=D-jp zL%-xoM}Ic`jZ%A9E&;u8PD=X*C9@oUu8Wq=p>`)bg7Kx86|;s>#tB;z7wBOy`fW|U z@sQF&-ubAZleYIJZZwu0B7~e$83)ec^7=@cXoefeld)U@wY+^{)40O@`>JWo?)Nz% z0}9A%-t$4Tgn6kiHdSH1gVMcGOh>Jea&Ukk@j6&jN%-s6RwSB(vApk!uYTb>TxkD6{~ip`*7;PmJ`J2k8yp`~sjI5w=^)G#m*K-O z7g%CxGAxeYxq~4`Wwg^;5rhh+y2YX%Nd^qQzYET@z>ZC(G^ho$^Mc7pl=5y+xwCU& z?GGT6SmicYhU2V8a98B9`z2)!&*_^E^}|F@2&4W|)tqr7akO^p z5vN>K;LR7k-m9nLXW|@r%0RL4uYsH|4x?%P@rW)+$Sf$Ql|asg2j6VSWmt?EML^f< zoZNM*Pem}xEyOQSCm^T9Z-NL7%g9eak+3)*OHj;A@4lZcUAz^mf@NaX|Dv;2Ju8nN zhNCax;sSWAo*nn1oj#ZrkIz1Nb1nzn^f-D8&s({3QwZ9{OA@T_$kEeZeED-65#k(Z z5F7#G3@)sGn(of<=!DD!UFWskLcE^lzyw_n;SxJ|1U|etT|pmh)H+a7{(k9QV}N|)9xoviAg&vB}4h27wB>#9J{uVWJj~+pFlnruxwBFG@7Y9m0uYHxp~4aq&Q^CKF9Nwjk2B{WO_)7ze zOkBrmYszWu$VPeWcdC<#CLU7AMp=e1$;WgK&$6y+0Xx7Vd+h7mdSl}856~~z;EpXi z+>4D!Z(YP+e*kI(TM1!Kp(U)N5Laof&SC#M_H@zm)5OBZH0FT?J7fvO&u_V{vIKAL!j+EuXKf0#|L!}*2WF? z*pW1)JT+pU4-{|l*oc^1C1wdE9-;lq`GUA8dz3L4yK4#7pT47vRxeh+5)_5iHdt1_ zlkVBib_WB@sT#`<+u2VubJc%W+~1$@;}eb;iJf~~(Fa_ZpbWu>j9eT<*ufg&Z4rn& z4g6&esQnvypgT80q0bD^JAs7s_QXTLu?Wd`Es}5iiL6-I(swS>_cdtXEgb`BI5R+) z@Q*^@m6n(24oSk!PLtwyQoTx+^B03Vgk5FBTT*?jC^^#y4f-xbYiu)N);R9TiDvNk zdJ=q@Nay%U+{?rWPAl3!oP@HZ1Hlk)#2EOZ;0IK5b-sx6-wCkstYP5#BfQtfo4!Xs zKx!yy)JK<7-Hh)#mY~)fL%#fa0sJHLjHblP<=`h0!n-!o_ z8Iu#(fZs0L{y+h~c4ZIRYyb&&n&2)`N|Geps!?$MwbvZFcNizUIZ9DS z!9XZ*R9v}52!z-M?(o5SLf}CgeLq~`(!tC{s}Jx zd50N62{W&kf@EmH6Sb_{Z(&1;kx}N<+@H^oLy0d0NZH=Q=9EVk4Qs$r_KBSL_226X z107Nn^Ncy8d;qkzw`>VoEkuGI0QUKFMBg_*)_P#3tW z5s_!wJ0>XkRG28~ow&^N<>K^Nk|}6hLp}`QiOTO~fg&Bpx1iXW(4a@?MynD-{zX`I z8EWeeMX0%JEqNtDS{`NHqa z(k9?ABC-(H5-jrRtPu^s(^o)UB%+$KLC}mP-3%BVwpwdoQCAv$I2auo z8e%Pgu#i7-_L?lb(QRg2Sv%b{CjGH217^`7jDmc zyv+UnQOaA0e6LSPZkixk-r>0+)4tLmgAsa0oUG(x!QUWV;761KDOvH4Ahaxe6)vezm?%CVP4%A^Czugl@q9XL)Oxld;RN>yWmRj_ z$JKX9)mS5}d>(knDve`k&q7|`|<<(+3i)$)bGVxKwp(~k=MX09n4TlA~a?M(M8%Vt_v)rLm z8E$-1WJm-lWAC*kW^!Zz`;}^B2Dj8hc5K@Rkgwa&ko&A~Dr-{Wm(a!8_T`HZtQ?fJ z`Pq#|bW+p#hitj6c}?{mpV-ostiFoecNgC){b|UHEq3N8bZq38(e@V%Evt%b!Mxkz z!ni{CFZP2v-EZ9D{T>9=b$Iue8xKG+8C5_`i@ZH8cEke%>G-ssj){=?hZjx)wqY18 z~btOz{r%rOkr^9C!k4aRwRc9`<5B;nIq;5uv> zpH}a-`2;6YjZ9kdyjF$WU8y^)%^Tk!YGqJ#Q{DaXqbLImf(H7(=hFT|ng5px1OCJQ tm(1G#Ddd0R)c>ytAfUp4vwvy2{~u~yQ3f31KT|;dmEeC|n&&^g{{#1^v;hDB literal 0 HcmV?d00001 diff --git a/Solutions/HoneyForge/Package/createUiDefinition.json b/Solutions/HoneyForge/Package/createUiDefinition.json index 352f9fc9ee8..20365ea6904 100644 --- a/Solutions/HoneyForge/Package/createUiDefinition.json +++ b/Solutions/HoneyForge/Package/createUiDefinition.json @@ -6,27 +6,23 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution:\n\n\u2022 Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n \u2022 There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution.\n\n[HoneyForge](https://honeyforge.tech) is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook.\n\n**Data Connectors:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5, **Parser:** 1, **Workbooks:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", + "Microsoft.OperationalInsights/workspaces/providers/alertRules", "Microsoft.Insights/workbooks", - "Microsoft.Logic/workflows", - "Microsoft.SecurityInsights" + "Microsoft.Logic/workflows" ] }, "location": { "metadata": { - "hidden": true + "hidden": "Hiding location, we get it from the log analytics workspace" }, - "allowedValues": [], "visible": false }, "resourceGroup": { - "allowExistingGroups": true - }, - "armboard": { - "value": "[steps('basics').resourceScope.resourceGroup.id]" + "allowExisting": true } } }, @@ -46,7 +42,7 @@ "type": "Microsoft.Common.DropDown", "label": "Workspace", "placeholder": "Select a workspace", - "toolTip": "This dropdown will list only workspaces that exist in the Resource Group selected", + "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", "constraints": { "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", "required": true @@ -54,10 +50,214 @@ "visible": true } ], - "steps": [], + "steps": [ + { + "name": "dataconnectors", + "label": "Data Connectors", + "bladeTitle": "Data Connectors", + "elements": [ + { + "name": "dataconnectors1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This Solution installs the data connector for HoneyForge. You can get HoneyForge CommonSecurityLog data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." + } + }, + { + "name": "dataconnectors-link1", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more about connecting data sources", + "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" + } + } + } + ] + }, + { + "name": "workbooks", + "label": "Workbooks", + "subLabel": { + "preValidation": "Configure the workbooks", + "postValidation": "Done" + }, + "bladeTitle": "Workbooks", + "elements": [ + { + "name": "workbooks-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs workbook(s) to help you gain insights into the telemetry collected in Microsoft Sentinel. After installing the solution, start using the workbook in Manage solution view." + } + }, + { + "name": "workbooks-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-monitor-your-data" + } + } + }, + { + "name": "workbook1", + "type": "Microsoft.Common.Section", + "label": null, + "elements": [ + { + "name": "workbook1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": null + } + } + ] + } + ] + }, + { + "name": "analytics", + "label": "Analytics", + "subLabel": { + "preValidation": "Configure the analytics", + "postValidation": "Done" + }, + "bladeTitle": "Analytics", + "elements": [ + { + "name": "analytics-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following analytic rule templates. After installing the solution, create and enable analytic rules in Manage solution view." + } + }, + { + "name": "analytics-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/tutorial-detect-threats-custom?WT.mc_id=Portal-Microsoft_Azure_CreateUIDef" + } + } + }, + { + "name": "analytic1", + "type": "Microsoft.Common.Section", + "label": "HoneyForge - Deception Sensor Interaction", + "elements": [ + { + "name": "analytic1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects an interaction with a HoneyForge deception sensor. Any activity\ninvolving a HoneyForge sensor must be treated as potentially unauthorised\nuntil validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices - legitimate systems and users\nshould never communicate with them. Any detected interaction may indicate\nnetwork scanning, lateral movement, or an actively compromised device." + } + } + ] + } + ] + }, + { + "name": "huntingqueries", + "label": "Hunting Queries", + "bladeTitle": "Hunting Queries", + "elements": [ + { + "name": "huntingqueries-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "This solution installs the following hunting queries. After installing the solution, run these hunting queries to hunt for threats in Manage solution view. " + } + }, + { + "name": "huntingqueries-link", + "type": "Microsoft.Common.TextBlock", + "options": { + "link": { + "label": "Learn more", + "uri": "https://docs.microsoft.com/azure/sentinel/hunting" + } + } + }, + { + "name": "huntingquery1", + "type": "Microsoft.Common.Section", + "label": "HoneyForge - Sensor Fleet Coverage and Health", + "elements": [ + { + "name": "huntingquery1-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Provides a per-sensor event summary for the past 30 days, giving visibility\ninto which sensors are active, which are quiet, and which may be offline or\nmisconfigured (no events in the last 10 minutes is the offline threshold).\n\nUse this query during routine operations to confirm full fleet coverage and\nidentify any gaps in your deception layer before an attacker does. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)" + } + } + ] + }, + { + "name": "huntingquery2", + "type": "Microsoft.Common.Section", + "label": "HoneyForge - High-Frequency Sensor Interactions", + "elements": [ + { + "name": "huntingquery2-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Detects source IPs generating an unusually high volume of events against\nHoneyForge sensors in a short window (more than 50 events in any 10-minute\nperiod). This pattern is characteristic of automated scanners, brute-force\ntools, or worm-like lateral movement.\n\nHigh-frequency hits deserve immediate triage - especially if the source is\nan internal IP, which would indicate a compromised or misconfigured device\ninside the network. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)" + } + } + ] + }, + { + "name": "huntingquery3", + "type": "Microsoft.Common.Section", + "label": "HoneyForge - Off-Hours Sensor Activity", + "elements": [ + { + "name": "huntingquery3-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Surfaces HoneyForge sensor interactions that occurred outside normal business\nhours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on\nweekends). Off-hours activity from internal IPs is especially suspicious -\nit may indicate a compromised device operating autonomously or an insider\nthreat.\n\nAdjust the hour thresholds to match your organisation's working hours if\nthey differ from the defaults. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)" + } + } + ] + }, + { + "name": "huntingquery4", + "type": "Microsoft.Common.Section", + "label": "HoneyForge - Repeated Probes from Same Source", + "elements": [ + { + "name": "huntingquery4-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Finds source IPs that have probed HoneyForge sensors on multiple distinct\noccasions separated by at least one hour, suggesting deliberate or scripted\nreconnaissance rather than a one-off event.\n\nA legitimate network scanner that hits a sensor once might be an\noversight. One that returns hours or days later is a persistent threat. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)" + } + } + ] + }, + { + "name": "huntingquery5", + "type": "Microsoft.Common.Section", + "label": "HoneyForge - Top Attacking Source IPs", + "elements": [ + { + "name": "huntingquery5-text", + "type": "Microsoft.Common.TextBlock", + "options": { + "text": "Identifies the source IP addresses that have interacted most frequently with\nHoneyForge deception sensors over the past 7 days. Repeat offenders across\nmultiple sensors are especially high-priority - they indicate persistent\nreconnaissance or an automated scanner that missed the exclusion list.\n\nUse this query as a starting point for threat-intel enrichment and to decide\nwhich IPs warrant a block rule or further investigation. This hunting query depends on HoneyForge data connector (CommonSecurityLog Parser or Table)" + } + } + ] + } + ] + } + ], "outputs": { - "workspace": "[basics('workspace')]", - "location": "[location()]" + "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", + "location": "[location()]", + "workspace": "[basics('workspace')]" } } -} \ No newline at end of file +} diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index cee470f0cf1..cca3d266154 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -1,270 +1,575 @@ { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", + "metadata": { + "author": "BUI - support@bui.co.za", + "comments": "Solution template for HoneyForge" + }, "parameters": { + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, "workspace": { "defaultValue": "", "type": "string", "metadata": { - "description": "The Log Analytics workspace name to deploy this solution into." + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" } }, - "location": { + "workbook1-name": { "type": "string", - "defaultValue": "", + "defaultValue": null, + "minLength": 1, "metadata": { - "description": "Azure region for all resources." + "description": "Name for the workbook" } } }, "variables": { + "email": "support@bui.co.za", + "_email": "[variables('email')]", + "_solutionName": "HoneyForge", + "_solutionVersion": "3.0.3", + "solutionId": "bui.honeyforge-threat-detection", + "_solutionId": "[variables('solutionId')]", + "workbookVersion1": "", + "workbookContentId1": "", + "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", + "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", + "_workbookContentId1": "[variables('workbookContentId1')]", "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "_solutionId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", - "_solutionName": "HoneyForge Threat Detection", - "_solutionVersion": "1.0.0", - "_publisherId": "bui", - "_offerId": "honeyforge-threat-detection", - "_connectorContentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", - "_analyticRuleContentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", - "_parserContentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", - "_workbookContentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853" + "_workbookcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','wb','-', uniqueString(concat(variables('_solutionId'),'-','Workbook','-',variables('_workbookContentId1'),'-', variables('workbookVersion1'))))]", + "uiConfigId1": "HoneyForge", + "_uiConfigId1": "[variables('uiConfigId1')]", + "dataConnectorContentId1": "HoneyForge", + "_dataConnectorContentId1": "[variables('dataConnectorContentId1')]", + "dataConnectorId1": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "_dataConnectorId1": "[variables('dataConnectorId1')]", + "dataConnectorTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentId1'))))]", + "dataConnectorVersion1": "1.0.0", + "_dataConnectorcontentProductId1": "[concat(take(variables('_solutionId'),50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentId1'),'-', variables('dataConnectorVersion1'))))]", + "analyticRuleObject1": { + "analyticRuleVersion1": "1.0.0", + "_analyticRulecontentId1": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", + "analyticRuleId1": "[resourceId('Microsoft.SecurityInsights/AlertRuleTemplates', 'bb3b1339-c1fa-473a-8663-3fea78c2e7e2')]", + "analyticRuleTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-ar-',uniquestring('bb3b1339-c1fa-473a-8663-3fea78c2e7e2')))]", + "_analyticRulecontentProductId1": "[concat(take(variables('_solutionId'),50),'-','ar','-', uniqueString(concat(variables('_solutionId'),'-','AnalyticsRule','-','bb3b1339-c1fa-473a-8663-3fea78c2e7e2','-', '1.0.0')))]" + }, + "huntingQueryObject1": { + "huntingQueryVersion1": "1.0.0", + "_huntingQuerycontentId1": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", + "huntingQueryTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c')))]" + }, + "huntingQueryObject2": { + "huntingQueryVersion2": "1.0.0", + "_huntingQuerycontentId2": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", + "huntingQueryTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d')))]" + }, + "huntingQueryObject3": { + "huntingQueryVersion3": "1.0.0", + "_huntingQuerycontentId3": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", + "huntingQueryTemplateSpecName3": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e')))]" + }, + "huntingQueryObject4": { + "huntingQueryVersion4": "1.0.0", + "_huntingQuerycontentId4": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", + "huntingQueryTemplateSpecName4": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b')))]" + }, + "huntingQueryObject5": { + "huntingQueryVersion5": "1.0.0", + "_huntingQuerycontentId5": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", + "huntingQueryTemplateSpecName5": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-hq-',uniquestring('795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f')))]" + }, + "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" }, "resources": [ { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/Solution-', variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('workbookTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "version": "1.0.0", - "kind": "Solution", - "contentSchemaVersion": "3.0.0", - "displayName": "HoneyForge Threat Detection", - "publisherDisplayName": "BUI", - "descriptionHtml": "

HoneyForge is a hardware-based honeypot SaaS platform that deploys deception sensors across your network to detect malicious activity in real time. This solution ingests HoneyForge sensor events into Microsoft Sentinel via CEF syslog and provides an analytic rule, hunting queries, an ASIM parser, and an operational workbook.

", - "contentId": "c1fd352d-366b-4853-8511-9fa254b8a8a8", - "contentProductId": "[concat(take(variables('_solutionId'),50),'-sl-',uniqueString(variables('_solutionId')))]", - "id": "[concat(variables('workspaceResourceId'),'/providers/Microsoft.SecurityInsights/contentpackages/', variables('_solutionId'))]", - "icon": "", - "contentKind": "Solution", - "packageKind": "Solution", - "packageId": "[variables('_solutionId')]", - "packageName": "HoneyForge Threat Detection", - "packageVersion": "1.0.0", - "source": { - "kind": "Solution", - "name": "HoneyForge Threat Detection", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "kind": "DataConnector", - "contentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", - "version": "1.0.0" - }, - { - "kind": "AnalyticsRule", - "contentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", - "version": "1.0.0" - }, - { - "kind": "Parser", - "contentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", - "version": "1.0.0" - }, - { - "kind": "HuntingQuery", - "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", - "version": "1.0.0" - }, - { - "kind": "HuntingQuery", - "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", - "version": "1.0.0" - }, - { - "kind": "HuntingQuery", - "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", - "version": "1.0.0" - }, - { - "kind": "HuntingQuery", - "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", - "version": "1.0.0" - }, + "description": "HoneyForge Workbook with template version 3.0.3", + "mainTemplate": { + "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "contentVersion": "[variables('workbookVersion1')]", + "parameters": {}, + "variables": {}, + "resources": [ { - "kind": "HuntingQuery", - "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", - "version": "1.0.0" + "type": "Microsoft.Insights/workbooks", + "name": "[variables('workbookContentId1')]", + "location": "[parameters('workspace-location')]", + "kind": "shared", + "apiVersion": "2021-08-01", + "metadata": { + "description": "" + }, + "properties": { + "displayName": "[parameters('workbook1-name')]", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "version": "1.0", + "sourceId": "[variables('workspaceResourceId')]", + "category": "sentinel" + } }, { - "kind": "Workbook", - "contentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853", - "version": "1.0.0" + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", + "properties": { + "description": ".description", + "parentId": "[variables('workbookId1')]", + "contentId": "[variables('_workbookContentId1')]", + "kind": "Workbook", + "version": "[variables('workbookVersion1')]", + "source": { + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" + }, + "author": { + "name": "BUI", + "email": "[variables('_email')]" + }, + "support": { + "name": "BUI", + "email": "support@bui.co.za", + "tier": "Partner", + "link": "https://honeyforge.tech" + } + } } ] }, - "firstPublishDate": "2026-07-20", - "providers": [ - "BUI" - ], - "categories": { - "domains": [ - "Security - Threat Intelligence", - "Security - Network" - ] - }, - "solutionId": "[variables('_solutionId')]" - }, - "plan": { - "name": "[variables('_solutionName')]", - "publisher": "[variables('_publisherId')]", - "product": "[concat('TemplateEmptyDeployment-', variables('_offerId'))]", - "version": "[variables('_solutionVersion')]" + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_workbookContentId1')]", + "contentKind": "Workbook", + "displayName": "[parameters('workbook1-name')]", + "contentProductId": "[variables('_workbookcontentProductId1')]", + "id": "[variables('_workbookcontentProductId1')]", + "version": "[variables('workbookVersion1')]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_connectorContentId'), '-dc-', variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('dataConnectorTemplateSpecName1')]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", - "displayName": "HoneyForge Threat Detection", - "contentKind": "DataConnector", + "description": "HoneyForge data connector with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", + "contentVersion": "[variables('dataConnectorVersion1')]", "parameters": {}, "variables": {}, "resources": [ + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "id": "[variables('_uiConfigId1')]", + "title": "HoneyForge Threat Detection", + "publisher": "BUI", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "logo": "Logos/HoneyForgeLogo.svg", + "graphQueriesTableName": "CommonSecurityLog", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "HoneyForge sensor events", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" + } + ], + "sampleQueries": [ + { + "description": "All HoneyForge events — last 24 hours", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" + }, + { + "description": "Top source IPs interacting with sensors — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" + }, + { + "description": "Events by sensor — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" + ] + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (HoneyForge)", + "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)" + }, + { + "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." + }, + { + "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", + "innerSteps": [ + { + "title": "1.1 — Install the Log Analytics agent and CEF collector", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run on the Linux forwarder:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "Step 1 — Deploy the CEF syslog forwarder" + }, + { + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" + }, + { + "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the troubleshooter on the Linux forwarder:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "Step 3 — Validate connectivity" + } + ] + } + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/DataConnector-', variables('_connectorContentId'))]", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", "properties": { - "contentId": "de361f30-5d75-4172-bc2a-f1416fc6715e", + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", "kind": "DataConnector", - "version": "1.0.0", - "displayName": "HoneyForge Threat Detection", + "version": "[variables('dataConnectorVersion1')]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('_dataConnectorContentId1')]", + "contentKind": "DataConnector", + "displayName": "HoneyForge Threat Detection", + "contentProductId": "[variables('_dataConnectorcontentProductId1')]", + "id": "[variables('_dataConnectorcontentProductId1')]", + "version": "[variables('dataConnectorVersion1')]" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", + "apiVersion": "2023-04-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', last(split(variables('_dataConnectorId1'),'/'))))]", + "dependsOn": [ + "[variables('_dataConnectorId1')]" + ], + "location": "[parameters('workspace-location')]", + "properties": { + "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentId1'))]", + "contentId": "[variables('_dataConnectorContentId1')]", + "kind": "DataConnector", + "version": "[variables('dataConnectorVersion1')]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } }, + { + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentId1'))]", + "apiVersion": "2021-03-01-preview", + "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", + "location": "[parameters('workspace-location')]", + "kind": "GenericUI", + "properties": { + "connectorUiConfig": { + "title": "HoneyForge Threat Detection", + "publisher": "BUI", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "graphQueries": [ + { + "metricName": "Total events received", + "legend": "HoneyForge sensor events", + "baseQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"" + } + ], + "dataTypes": [ + { + "name": "CommonSecurityLog (HoneyForge)", + "lastDataReceivedQuery": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriterias": [ + { + "type": "IsConnectedQuery", + "value": [ + "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| summarize LastLogReceived = max(TimeGenerated)\n| project IsConnected = LastLogReceived > ago(3d)" + ] + } + ], + "sampleQueries": [ + { + "description": "All HoneyForge events — last 24 hours", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" + }, + { + "description": "Top source IPs interacting with sensors — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" + }, + { + "description": "Events by sensor — last 7 days", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" + } + ], + "availability": { + "status": 1, + "isPreview": false + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "read and write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "read": true, + "write": true, + "delete": true + } + }, + { + "provider": "Microsoft.OperationalInsights/workspaces/sharedKeys", + "permissionsDisplayText": "read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).", + "providerDisplayName": "Keys", + "scope": "Workspace", + "requiredPermissions": { + "action": true + } + } + ], + "customs": [ + { + "description": "To collect data from non-Azure VMs, they must have Azure Arc installed and enabled. [Learn more](https://learn.microsoft.com/azure/azure-monitor/agents/azure-monitor-agent-install)" + }, + { + "description": "The **Common Event Format (CEF) via AMA** solution must be installed in your Microsoft Sentinel workspace. [Install from Microsoft Marketplace](https://marketplace.microsoft.com/en-us/product/saas/azuresentinel.azure-sentinel-solution-commoneventformat)" + } + ] + }, + "instructionSteps": [ + { + "description": ">**NOTE:** This connector uses the **Common Event Format (CEF)** to forward HoneyForge sensor events to Microsoft Sentinel via syslog. An ASIM parser (`HoneyForgeEvent`) is deployed with this solution to normalise the events to the ASIM NetworkSession schema." + }, + { + "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", + "innerSteps": [ + { + "title": "1.1 — Install the Log Analytics agent and CEF collector", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId", + "PrimaryKey" + ], + "label": "Run on the Linux forwarder:", + "value": "sudo wget -O cef_installer.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_installer.py && sudo python cef_installer.py {0} {1}" + }, + "type": "CopyableLabel" + } + ] + } + ], + "title": "Step 1 — Deploy the CEF syslog forwarder" + }, + { + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" + }, + { + "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", + "instructions": [ + { + "parameters": { + "fillWith": [ + "WorkspaceId" + ], + "label": "Run the troubleshooter on the Linux forwarder:", + "value": "sudo wget -O cef_troubleshoot.py https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/DataConnectors/CEF/cef_troubleshoot.py && sudo python cef_troubleshoot.py {0}" + }, + "type": "CopyableLabel" + } + ], + "title": "Step 3 — Validate connectivity" + } + ], + "id": "[variables('_uiConfigId1')]" + } + } + }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_analyticRuleContentId'), '-ar-', variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('analyticRuleObject1').analyticRuleTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", - "displayName": "HoneyForge - Deception Sensor Interaction", - "contentKind": "AnalyticsRule", + "description": "HoneyForge_DeceptionSensorInteraction_AnalyticalRules Analytics Rule with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, - "variables": { - "analyticRuleId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", - "analyticRuleVersion": "1.0.0" - }, + "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", + "parameters": {}, + "variables": {}, "resources": [ { "type": "Microsoft.SecurityInsights/AlertRuleTemplates", - "name": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", - "apiVersion": "2022-11-01-preview", + "name": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "apiVersion": "2023-02-01-preview", "kind": "NRT", - "location": "[parameters('location')]", + "location": "[parameters('workspace-location')]", "properties": { - "description": "Detects an interaction with a HoneyForge deception sensor. Any activity involving a HoneyForge sensor must be treated as potentially unauthorised until validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices \u2014 legitimate systems and users should never communicate with them. Any detected interaction may indicate network scanning, lateral movement, or an actively compromised device.", + "description": "Detects an interaction with a HoneyForge deception sensor. Any activity\ninvolving a HoneyForge sensor must be treated as potentially unauthorised\nuntil validated by the security operations team.\n\nHoneyForge sensors are passive decoy devices - legitimate systems and users\nshould never communicate with them. Any detected interaction may indicate\nnetwork scanning, lateral movement, or an actively compromised device.", "displayName": "HoneyForge - Deception Sensor Interaction", "enabled": false, - "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n EventType = iff(isempty(tostring(DeviceEventClassID)), \"unknown\", tostring(DeviceEventClassID)),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(Computer), 10)\n by SrcIpAddr, DstIpAddr, SensorID, CustomerID, SensorName, EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated, FirstSeen, LastSeen, EventCount,\n SrcIpAddr, DstIpAddr, SourcePortList, DestinationPortList, ProtocolList,\n SensorID, SensorName, CustomerID, EventType, ActivityList,\n CEFSeverityList, DeviceVersionList, CollectorList", + "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n DstIpAddr = tostring(DestinationIP),\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(\n isempty(tostring(DeviceCustomString3)),\n tostring(Computer),\n tostring(DeviceCustomString3)\n ),\n EventType = iff(\n isempty(tostring(DeviceEventClassID)),\n \"unknown\",\n tostring(DeviceEventClassID)\n ),\n EventActivity = tostring(Activity),\n EventProtocol = tostring(Protocol)\n| where isnotempty(SrcIpAddr)\n| where isnotempty(DstIpAddr)\n| summarize\n TimeGenerated = max(TimeGenerated),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n EventCount = count(),\n SourcePorts = make_set(tostring(SourcePort), 20),\n DestinationPorts = make_set(tostring(DestinationPort), 20),\n Protocols = make_set(EventProtocol, 10),\n Activities = make_set(EventActivity, 20),\n CEFSeverities = make_set(tostring(LogSeverity), 10),\n DeviceVersions = make_set(tostring(DeviceVersion), 10),\n Collectors = make_set(tostring(Computer), 10)\n by\n SrcIpAddr,\n DstIpAddr,\n SensorID,\n CustomerID,\n SensorName,\n EventType\n| extend\n SourcePortList = strcat_array(SourcePorts, \", \"),\n DestinationPortList = strcat_array(DestinationPorts, \", \"),\n ProtocolList = strcat_array(Protocols, \", \"),\n ActivityList = strcat_array(Activities, \", \"),\n CEFSeverityList = strcat_array(CEFSeverities, \", \"),\n DeviceVersionList = strcat_array(DeviceVersions, \", \"),\n CollectorList = strcat_array(Collectors, \", \")\n| project\n TimeGenerated,\n FirstSeen,\n LastSeen,\n EventCount,\n SrcIpAddr,\n DstIpAddr,\n SourcePortList,\n DestinationPortList,\n ProtocolList,\n SensorID,\n SensorName,\n CustomerID,\n EventType,\n ActivityList,\n CEFSeverityList,\n DeviceVersionList,\n CollectorList\n", "severity": "High", - "suppressionDuration": "PT5H", + "suppressionDuration": "PT1H", "suppressionEnabled": false, - "tactics": [ - "Reconnaissance", - "InitialAccess" - ], + "status": "Available", "requiredDataConnectors": [ { - "connectorId": "HoneyForge", "dataTypes": [ "CommonSecurityLog" - ] + ], + "connectorId": "HoneyForge" } ], - "status": "Available", - "alertDetailsOverride": { - "alertDisplayNameFormat": "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}", - "alertDescriptionFormat": "HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}} using {{ProtocolList}}. Treat this activity as unauthorised until validated." - }, - "customDetails": { - "Customer": "CustomerID", - "Sensor": "SensorID", - "SensorName": "SensorName", - "EventType": "EventType", - "Activity": "ActivityList", - "SourcePorts": "SourcePortList", - "DestinationPorts": "DestinationPortList", - "Protocol": "ProtocolList", - "EventCount": "EventCount", - "FirstSeen": "FirstSeen", - "LastSeen": "LastSeen", - "DeviceVersion": "DeviceVersionList", - "Collector": "CollectorList" - }, + "tactics": [ + "Reconnaissance", + "InitialAccess" + ], "entityMappings": [ { "entityType": "IP", @@ -294,458 +599,359 @@ ] } ], - "incidentConfiguration": { - "createIncident": true, - "groupingConfiguration": { - "enabled": true, - "reopenClosedIncident": false, - "lookbackDuration": "PT4H", - "matchingMethod": "Selected", - "groupByEntities": [ - "IP" - ], - "groupByAlertDetails": [], - "groupByCustomDetails": [ - "Customer", - "Sensor" - ] - } - }, "eventGroupingSettings": { "aggregationKind": "AlertPerResult" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/AnalyticsRule-', variables('_analyticRuleContentId'))]", - "properties": { - "contentId": "bb3b1339-c1fa-473a-8663-3fea78c2e7e2", - "kind": "AnalyticsRule", - "version": "1.0.0", - "displayName": "HoneyForge - Deception Sensor Interaction", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } - } - } - ] - }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_parserContentId'), '-pr-', variables('_solutionId'))]", - "location": "[parameters('location')]", - "properties": { - "contentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", - "displayName": "HoneyForge ASIM NetworkSession Parser", - "contentKind": "Parser", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, - "variables": {}, - "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-04-01", - "name": "[concat(parameters('workspace'), '/HoneyForgeEvent')]", - "properties": { - "eTag": "*", - "displayName": "HoneyForgeEvent", - "category": "Microsoft Sentinel Parser", - "functionAlias": "HoneyForgeEvent", - "query": "let HoneyForgeEvent = (\n starttime: datetime = datetime(null),\n endtime: datetime = datetime(null),\n srcipaddr_has_any_prefix: dynamic = dynamic([]),\n dstipaddr_has_any_prefix: dynamic = dynamic([]),\n ipaddr_has_any_prefix: dynamic = dynamic([]),\n dstportnumber: int = int(null),\n hostname_has_any: dynamic = dynamic([]),\n dvcaction: dynamic = dynamic([]),\n eventresult: string = '*',\n disabled: bool = false\n) {\n CommonSecurityLog\n | where not(disabled)\n | where DeviceVendor =~ \"BUI\"\n | where DeviceProduct =~ \"HoneyForge\"\n | where (isnull(starttime) or TimeGenerated >= starttime)\n | where (isnull(endtime) or TimeGenerated <= endtime)\n | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix))\n | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix))\n | where (array_length(ipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix))\n | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber)\n | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any))\n | extend\n EventVendor = \"BUI\", EventProduct = \"HoneyForge\",\n EventProductVersion = tostring(DeviceVersion),\n EventSchema = \"NetworkSession\", EventSchemaVersion = \"0.2.6\",\n EventType = \"NetworkSession\", EventResult = \"NA\",\n EventStartTime = TimeGenerated, EventEndTime = TimeGenerated,\n EventCount = toint(1),\n EventOriginalUid = tostring(ExtID),\n EventOriginalType = tostring(DeviceEventClassID),\n EventSeverity = case(toint(LogSeverity) >= 9, \"Critical\", toint(LogSeverity) >= 7, \"High\", toint(LogSeverity) >= 4, \"Medium\", \"Low\"),\n EventOriginalSeverity = tostring(LogSeverity),\n EventMessage = tostring(Activity),\n SrcIpAddr = tostring(SourceIP), SrcPortNumber = toint(SourcePort),\n DstIpAddr = tostring(DestinationIP), DstPortNumber = toint(DestinationPort),\n DstHostname = _SensorName,\n NetworkProtocol = tostring(Protocol), NetworkDirection = \"Inbound\",\n DvcHostname = tostring(Computer), DvcId = tostring(DeviceCustomString1), DvcIdType = \"Other\",\n HoneyForgeSensorID = tostring(DeviceCustomString1),\n HoneyForgeCustomerID = tostring(DeviceCustomString2),\n HoneyForgeSensorName = _SensorName\n | project-away _SensorName\n | where (array_length(dvcaction) == 0)\n | where (eventresult == '*' or EventResult =~ eventresult)\n | project TimeGenerated, EventVendor, EventProduct, EventProductVersion, EventSchema, EventSchemaVersion, EventType, EventResult, EventSeverity, EventOriginalSeverity, EventOriginalUid, EventOriginalType, EventMessage, EventStartTime, EventEndTime, EventCount, SrcIpAddr, SrcPortNumber, DstIpAddr, DstPortNumber, DstHostname, NetworkProtocol, NetworkDirection, DvcHostname, DvcId, DvcIdType, HoneyForgeSensorID, HoneyForgeCustomerID, HoneyForgeSensorName\n};\nHoneyForgeEvent(starttime=starttime, endtime=endtime, srcipaddr_has_any_prefix=srcipaddr_has_any_prefix, dstipaddr_has_any_prefix=dstipaddr_has_any_prefix, ipaddr_has_any_prefix=ipaddr_has_any_prefix, dstportnumber=dstportnumber, hostname_has_any=hostname_has_any, dvcaction=dvcaction, eventresult=eventresult, disabled=disabled)", - "functionParameters": "starttime:datetime=datetime(null), endtime:datetime=datetime(null), srcipaddr_has_any_prefix:dynamic=dynamic([]), dstipaddr_has_any_prefix:dynamic=dynamic([]), ipaddr_has_any_prefix:dynamic=dynamic([]), dstportnumber:int=int(null), hostname_has_any:dynamic=dynamic([]), dvcaction:dynamic=dynamic([]), eventresult:string='*', disabled:bool=False", - "version": 2, - "tags": [ - { - "name": "description", - "value": "ASIM NetworkSession parser for HoneyForge Threat Detection Platform events." - } - ] + "customDetails": { + "FirstSeen": "FirstSeen", + "EventCount": "EventCount", + "DeviceVersion": "DeviceVersionList", + "CustomerID": "CustomerID", + "LastSeen": "LastSeen", + "SensorName": "SensorName", + "Activity": "ActivityList", + "SensorID": "SensorID", + "Protocol": "ProtocolList", + "EventType": "EventType", + "DestinationPorts": "DestinationPortList", + "SourcePorts": "SourcePortList", + "Collector": "CollectorList" + }, + "alertDetailsOverride": { + "alertDisplayNameFormat": "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}", + "alertDescriptionFormat": "HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}}\nusing {{ProtocolList}}. Treat this activity as unauthorised until validated.\n" + }, + "incidentConfiguration": { + "groupingConfiguration": { + "lookbackDuration": "4h", + "matchingMethod": "Selected", + "groupByCustomDetails": [ + "CustomerID", + "SensorID" + ], + "groupByAlertDetails": [], + "reopenClosedIncident": false, + "groupByEntities": [ + "IP" + ], + "enabled": true + }, + "createIncident": true + } } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/Parser-', variables('_parserContentId'))]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('AnalyticsRule-', last(split(variables('analyticRuleObject1').analyticRuleId1,'/'))))]", "properties": { - "contentId": "b1b6b693-679e-4ebf-afc8-7faf6af266ab", - "kind": "Parser", - "version": "1.0.0", - "displayName": "HoneyForge ASIM NetworkSession Parser", + "description": "HoneyForge Analytics Rule 1", + "parentId": "[variables('analyticRuleObject1').analyticRuleId1]", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "kind": "AnalyticsRule", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "contentKind": "AnalyticsRule", + "displayName": "HoneyForge - Deception Sensor Interaction", + "contentProductId": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "id": "[variables('analyticRuleObject1')._analyticRulecontentProductId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f-hq-',variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('huntingQueryObject1').huntingQueryTemplateSpecName1]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", - "displayName": "HoneyForge - Top Attacking Source IPs", - "contentKind": "HuntingQuery", + "description": "HoneyForge_FleetCoverage_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, + "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", + "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-04-01", - "name": "[concat(parameters('workspace'), '/HoneyForge_TopAttackingSources')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "HoneyForge_Hunting_Query_1", + "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "HoneyForge - Top Attacking Source IPs", + "displayName": "HoneyForge - Sensor Fleet Coverage and Health", "category": "Hunting Queries", - "query": "CommonSecurityLog\n| where TimeGenerated >= ago(7d)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n CustomersAffected = dcount(CustomerID),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n SensorList = make_set(SensorName, 20),\n Protocols = make_set(tostring(Protocol), 10),\n DestPorts = make_set(tostring(DestinationPort), 20)\n by SrcIpAddr\n| sort by TotalEvents desc\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n DestPortStr = strcat_array(DestPorts, \", \")\n| project SrcIpAddr, TotalEvents, SensorsHit, CustomersAffected, FirstSeen, LastSeen, SensorListStr, ProtocolStr, DestPortStr", + "query": "let lookback = 30d;\nlet offlineThreshold = 10m;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SensorID = tostring(DeviceCustomString1),\n CustomerID = tostring(DeviceCustomString2),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize\n TotalEvents = count(),\n UniqueSources = dcount(SourceIP),\n FirstEvent = min(TimeGenerated),\n LastEvent = max(TimeGenerated),\n Protocols = make_set(tostring(Protocol), 10)\n by SensorID, SensorName, CustomerID\n| extend\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\n SensorStatus = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"Online\", \"Offline / No Recent Events\"),\n ProtocolStr = strcat_array(Protocols, \", \")\n| sort by SensorStatus asc, LastEvent desc\n| project\n SensorName,\n SensorID,\n CustomerID,\n SensorStatus,\n MinutesSinceLast,\n TotalEvents,\n UniqueSources,\n FirstEvent,\n LastEvent,\n ProtocolStr\n", "version": 2, "tags": [ { "name": "description", - "value": "HoneyForge - Top Attacking Source IPs" - }, - { - "name": "tactics", - "value": "Reconnaissance" + "value": "Provides a per-sensor event summary for the past 30 days, giving visibility\ninto which sensors are active, which are quiet, and which may be offline or\nmisconfigured (no events in the last 10 minutes is the offline threshold).\n\nUse this query during routine operations to confirm full fleet coverage and\nidentify any gaps in your deception layer before an attacker does." } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f')]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1),'/'))))]", "properties": { - "contentId": "795b6ec0-3e9a-4b12-8f4d-1a2b3c4d5e6f", + "description": "HoneyForge Hunting Query 1", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject1')._huntingQuerycontentId1)]", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", "kind": "HuntingQuery", - "version": "1.0.0", - "displayName": "HoneyForge - Top Attacking Source IPs", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "contentKind": "HuntingQuery", + "displayName": "HoneyForge - Sensor Fleet Coverage and Health", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject1')._huntingQuerycontentId1,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b-hq-',variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('huntingQueryObject2').huntingQueryTemplateSpecName2]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", - "displayName": "HoneyForge - Repeated Probes from Same Source", - "contentKind": "HuntingQuery", + "description": "HoneyForge_HighFrequency_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, + "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", + "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-04-01", - "name": "[concat(parameters('workspace'), '/HoneyForge_RepeatedProbes')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "HoneyForge_Hunting_Query_2", + "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "HoneyForge - Repeated Probes from Same Source", + "displayName": "HoneyForge - High-Frequency Sensor Interactions", "category": "Hunting Queries", - "query": "let lookback = 14d;\nlet minSessionGap = 1h;\nlet minReturnVisits = 2;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SrcIpAddr = tostring(SourceIP), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where isnotempty(SrcIpAddr)\n| sort by SrcIpAddr asc, TimeGenerated asc\n| serialize\n| extend PrevTime = prev(TimeGenerated, 1), PrevSrc = prev(SrcIpAddr, 1)\n| extend IsNewSession = iff(SrcIpAddr == PrevSrc and (TimeGenerated - PrevTime) < minSessionGap, 0, 1)\n| summarize TotalEvents = count(), SessionCount = sumif(IsNewSession, IsNewSession == 1), SensorsHit = dcount(SensorName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), SensorList = make_set(SensorName, 20) by SrcIpAddr\n| where SessionCount >= minReturnVisits\n| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen), SensorListStr = strcat_array(SensorList, \", \")\n| sort by SessionCount desc, TotalEvents desc\n| project SrcIpAddr, SessionCount, TotalEvents, SensorsHit, DaySpan, FirstSeen, LastSeen, SensorListStr", + "query": "let lookback = 24h;\nlet burstWindow = 10m;\nlet burstThreshold = 50;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize\n BurstCount = count(),\n SensorsHit = dcount(SensorName),\n SensorList = make_set(SensorName, 10),\n Protocols = make_set(tostring(Protocol), 5),\n DestPorts = make_set(tostring(DestinationPort), 10),\n WindowStart = min(TimeGenerated),\n WindowEnd = max(TimeGenerated)\n by SrcIpAddr, CustomerID, bin(TimeGenerated, burstWindow)\n| where BurstCount >= burstThreshold\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n DestPortStr = strcat_array(DestPorts, \", \")\n| sort by BurstCount desc\n| project\n SrcIpAddr,\n CustomerID,\n BurstCount,\n SensorsHit,\n WindowStart,\n WindowEnd,\n SensorListStr,\n ProtocolStr,\n DestPortStr\n", "version": 2, "tags": [ { "name": "description", - "value": "HoneyForge - Repeated Probes from Same Source" + "value": "Detects source IPs generating an unusually high volume of events against\nHoneyForge sensors in a short window (more than 50 events in any 10-minute\nperiod). This pattern is characteristic of automated scanners, brute-force\ntools, or worm-like lateral movement.\n\nHigh-frequency hits deserve immediate triage - especially if the source is\nan internal IP, which would indicate a compromised or misconfigured device\ninside the network." }, { "name": "tactics", - "value": "Reconnaissance" + "value": "Reconnaissance,LateralMovement" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b')]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2),'/'))))]", "properties": { - "contentId": "e4905b78-2c3d-4e5f-9a0b-1c2d3e4f5a6b", + "description": "HoneyForge Hunting Query 2", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject2')._huntingQuerycontentId2)]", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", "kind": "HuntingQuery", - "version": "1.0.0", - "displayName": "HoneyForge - Repeated Probes from Same Source", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "contentKind": "HuntingQuery", + "displayName": "HoneyForge - High-Frequency Sensor Interactions", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject2')._huntingQuerycontentId2,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c-hq-',variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('huntingQueryObject3').huntingQueryTemplateSpecName3]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", - "displayName": "HoneyForge - Sensor Fleet Coverage and Health", - "contentKind": "HuntingQuery", + "description": "HoneyForge_OffHoursActivity_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, + "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", + "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-04-01", - "name": "[concat(parameters('workspace'), '/HoneyForge_FleetCoverage')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "HoneyForge_Hunting_Query_3", + "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "HoneyForge - Sensor Fleet Coverage and Health", + "displayName": "HoneyForge - Off-Hours Sensor Activity", "category": "Hunting Queries", - "query": "CommonSecurityLog\n| where TimeGenerated >= ago(30d)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SensorID = tostring(DeviceCustomString1), CustomerID = tostring(DeviceCustomString2), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize TotalEvents = count(), UniqueSources = dcount(SourceIP), FirstEvent = min(TimeGenerated), LastEvent = max(TimeGenerated), Protocols = make_set(tostring(Protocol), 10) by SensorID, SensorName, CustomerID\n| extend MinutesSinceLast = datetime_diff('minute', now(), LastEvent), SensorStatus = iff(datetime_diff('minute', now(), LastEvent) <= 10, \"Online\", \"Offline / No Recent Events\"), ProtocolStr = strcat_array(Protocols, \", \")\n| sort by SensorStatus asc, LastEvent desc\n| project SensorName, SensorID, CustomerID, SensorStatus, MinutesSinceLast, TotalEvents, UniqueSources, FirstEvent, LastEvent, ProtocolStr", + "query": "let lookback = 7d;\nlet businessStart = 7; // 07:00 UTC\nlet businessEnd = 19; // 19:00 UTC\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2),\n HourUTC = hourofday(TimeGenerated),\n DayOfWeek = dayofweek(TimeGenerated)\n| extend\n IsOffHours = case(\n // Weekend (Saturday = 6d, Sunday = 0d)\n DayOfWeek == 0d or DayOfWeek == 6d, true,\n // Outside business hours on weekdays\n HourUTC < businessStart or HourUTC >= businessEnd, true,\n false\n )\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n SensorList = make_set(SensorName, 20),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n HoursActive = make_set(HourUTC, 24),\n Protocols = make_set(tostring(Protocol), 10)\n by SrcIpAddr, CustomerID\n| sort by TotalEvents desc\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n HoursStr = strcat_array(todynamic(tostring(HoursActive)), \", \")\n| project\n SrcIpAddr,\n CustomerID,\n TotalEvents,\n SensorsHit,\n FirstSeen,\n LastSeen,\n HoursStr,\n SensorListStr,\n ProtocolStr\n", "version": 2, "tags": [ { "name": "description", - "value": "HoneyForge - Sensor Fleet Coverage and Health" + "value": "Surfaces HoneyForge sensor interactions that occurred outside normal business\nhours (before 07:00 or after 19:00 UTC, Monday to Friday, and all day on\nweekends). Off-hours activity from internal IPs is especially suspicious -\nit may indicate a compromised device operating autonomously or an insider\nthreat.\n\nAdjust the hour thresholds to match your organisation's working hours if\nthey differ from the defaults." }, { "name": "tactics", - "value": "Reconnaissance" + "value": "Reconnaissance,LateralMovement" } ] } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c')]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3),'/'))))]", "properties": { - "contentId": "7bf37318-4d5e-6f7a-0b1c-2d3e4f5a6b7c", + "description": "HoneyForge Hunting Query 3", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject3')._huntingQuerycontentId3)]", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", "kind": "HuntingQuery", - "version": "1.0.0", - "displayName": "HoneyForge - Sensor Fleet Coverage and Health", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "contentKind": "HuntingQuery", + "displayName": "HoneyForge - Off-Hours Sensor Activity", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject3')._huntingQuerycontentId3,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d-hq-',variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('huntingQueryObject4').huntingQueryTemplateSpecName4]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", - "displayName": "HoneyForge - High-Frequency Sensor Interactions", - "contentKind": "HuntingQuery", + "description": "HoneyForge_RepeatedProbes_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, + "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", + "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-04-01", - "name": "[concat(parameters('workspace'), '/HoneyForge_HighFrequency')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "HoneyForge_Hunting_Query_4", + "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "HoneyForge - High-Frequency Sensor Interactions", + "displayName": "HoneyForge - Repeated Probes from Same Source", "category": "Hunting Queries", - "query": "let lookback = 24h;\nlet burstWindow = 10m;\nlet burstThreshold = 50;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SrcIpAddr = tostring(SourceIP), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize BurstCount = count(), SensorsHit = dcount(SensorName), SensorList = make_set(SensorName, 10), Protocols = make_set(tostring(Protocol), 5), DestPorts = make_set(tostring(DestinationPort), 10), WindowStart = min(TimeGenerated), WindowEnd = max(TimeGenerated) by SrcIpAddr, CustomerID, bin(TimeGenerated, burstWindow)\n| where BurstCount >= burstThreshold\n| extend SensorListStr = strcat_array(SensorList, \", \"), ProtocolStr = strcat_array(Protocols, \", \"), DestPortStr = strcat_array(DestPorts, \", \")\n| sort by BurstCount desc\n| project SrcIpAddr, CustomerID, BurstCount, SensorsHit, WindowStart, WindowEnd, SensorListStr, ProtocolStr, DestPortStr", + "query": "let lookback = 14d;\nlet minSessionGap = 1h;\nlet minReturnVisits = 2;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| where isnotempty(SrcIpAddr)\n| sort by SrcIpAddr asc, TimeGenerated asc\n| serialize\n| extend\n PrevTime = prev(TimeGenerated, 1),\n PrevSrc = prev(SrcIpAddr, 1)\n| extend\n IsNewSession = iff(SrcIpAddr == PrevSrc and (TimeGenerated - PrevTime) < minSessionGap, 0, 1)\n| summarize\n TotalEvents = count(),\n SessionCount = sumif(IsNewSession, IsNewSession == 1),\n SensorsHit = dcount(SensorName),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n SensorList = make_set(SensorName, 20)\n by SrcIpAddr\n| where SessionCount >= minReturnVisits\n| extend DaySpan = datetime_diff('day', LastSeen, FirstSeen)\n| sort by SessionCount desc, TotalEvents desc\n| extend SensorListStr = strcat_array(SensorList, \", \")\n| project\n SrcIpAddr,\n SessionCount,\n TotalEvents,\n SensorsHit,\n DaySpan,\n FirstSeen,\n LastSeen,\n SensorListStr\n", "version": 2, "tags": [ { "name": "description", - "value": "HoneyForge - High-Frequency Sensor Interactions" + "value": "Finds source IPs that have probed HoneyForge sensors on multiple distinct\noccasions separated by at least one hour, suggesting deliberate or scripted\nreconnaissance rather than a one-off event.\n\nA legitimate network scanner that hits a sensor once might be an\noversight. One that returns hours or days later is a persistent threat." }, { "name": "tactics", @@ -756,84 +962,77 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d')]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4),'/'))))]", "properties": { - "contentId": "73cf5ff5-5e6f-7a8b-1c2d-3e4f5a6b7c8d", + "description": "HoneyForge Hunting Query 4", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject4')._huntingQuerycontentId4)]", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", "kind": "HuntingQuery", - "version": "1.0.0", - "displayName": "HoneyForge - High-Frequency Sensor Interactions", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "contentKind": "HuntingQuery", + "displayName": "HoneyForge - Repeated Probes from Same Source", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject4')._huntingQuerycontentId4,'-', '1.0.0')))]", + "version": "1.0.0" } }, { "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e-hq-',variables('_solutionId'))]", - "location": "[parameters('location')]", + "name": "[variables('huntingQueryObject5').huntingQueryTemplateSpecName5]", + "location": "[parameters('workspace-location')]", + "dependsOn": [ + "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" + ], "properties": { - "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", - "displayName": "HoneyForge - Off-Hours Sensor Activity", - "contentKind": "HuntingQuery", + "description": "HoneyForge_TopAttackingSources_HuntingQueries Hunting Query with template version 3.0.3", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" - } - }, + "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", + "parameters": {}, "variables": {}, "resources": [ { - "type": "Microsoft.OperationalInsights/workspaces/savedSearches", - "apiVersion": "2022-04-01", - "name": "[concat(parameters('workspace'), '/HoneyForge_OffHoursActivity')]", + "type": "Microsoft.OperationalInsights/savedSearches", + "apiVersion": "2025-07-01", + "name": "HoneyForge_Hunting_Query_5", + "location": "[parameters('workspace-location')]", "properties": { "eTag": "*", - "displayName": "HoneyForge - Off-Hours Sensor Activity", + "displayName": "HoneyForge - Top Attacking Source IPs", "category": "Hunting Queries", - "query": "let lookback = 7d;\nlet businessStart = 7;\nlet businessEnd = 19;\nCommonSecurityLog\n| where TimeGenerated >= ago(lookback)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend SrcIpAddr = tostring(SourceIP), SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), CustomerID = tostring(DeviceCustomString2), HourUTC = hourofday(TimeGenerated), DayOfWeek = dayofweek(TimeGenerated)\n| extend IsOffHours = case(DayOfWeek == 0d or DayOfWeek == 6d, true, HourUTC < businessStart or HourUTC >= businessEnd, true, false)\n| where IsOffHours == true\n| where isnotempty(SrcIpAddr)\n| summarize TotalEvents = count(), SensorsHit = dcount(SensorName), SensorList = make_set(SensorName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), HoursActive = make_set(HourUTC, 24), Protocols = make_set(tostring(Protocol), 10) by SrcIpAddr, CustomerID\n| sort by TotalEvents desc\n| extend SensorListStr = strcat_array(SensorList, \", \"), ProtocolStr = strcat_array(Protocols, \", \")\n| project SrcIpAddr, CustomerID, TotalEvents, SensorsHit, FirstSeen, LastSeen, SensorListStr, ProtocolStr", + "query": "CommonSecurityLog\n| where TimeGenerated >= ago(7d)\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| extend\n SrcIpAddr = tostring(SourceIP),\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\n CustomerID = tostring(DeviceCustomString2)\n| where isnotempty(SrcIpAddr)\n| summarize\n TotalEvents = count(),\n SensorsHit = dcount(SensorName),\n CustomersAffected = dcount(CustomerID),\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n SensorList = make_set(SensorName, 20),\n Protocols = make_set(tostring(Protocol), 10),\n DestPorts = make_set(tostring(DestinationPort), 20)\n by SrcIpAddr\n| sort by TotalEvents desc\n| extend\n SensorListStr = strcat_array(SensorList, \", \"),\n ProtocolStr = strcat_array(Protocols, \", \"),\n DestPortStr = strcat_array(DestPorts, \", \")\n| project\n SrcIpAddr,\n TotalEvents,\n SensorsHit,\n CustomersAffected,\n FirstSeen,\n LastSeen,\n SensorListStr,\n ProtocolStr,\n DestPortStr\n", "version": 2, "tags": [ { "name": "description", - "value": "HoneyForge - Off-Hours Sensor Activity" + "value": "Identifies the source IP addresses that have interacted most frequently with\nHoneyForge deception sensors over the past 7 days. Repeat offenders across\nmultiple sensors are especially high-priority - they indicate persistent\nreconnaissance or an automated scanner that missed the exclusion list.\n\nUse this query as a starting point for threat-intel enrichment and to decide\nwhich IPs warrant a block rule or further investigation." }, { "name": "tactics", @@ -844,141 +1043,134 @@ }, { "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/HuntingQuery-5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e')]", + "apiVersion": "2022-01-01-preview", + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('HuntingQuery-', last(split(resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5),'/'))))]", "properties": { - "contentId": "5a15c525-6f7a-8b9c-2d3e-4f5a6b7c8d9e", + "description": "HoneyForge Hunting Query 5", + "parentId": "[resourceId('Microsoft.OperationalInsights/savedSearches', variables('huntingQueryObject5')._huntingQuerycontentId5)]", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", "kind": "HuntingQuery", - "version": "1.0.0", - "displayName": "HoneyForge - Off-Hours Sensor Activity", + "version": "[variables('huntingQueryObject5').huntingQueryVersion5]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" } } } ] }, - "version": "1.0.0", + "packageKind": "Solution", + "packageVersion": "[variables('_solutionVersion')]", + "packageName": "[variables('_solutionName')]", + "packageId": "[variables('_solutionId')]", + "contentSchemaVersion": "3.0.0", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", + "contentKind": "HuntingQuery", + "displayName": "HoneyForge - Top Attacking Source IPs", + "contentProductId": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", + "id": "[concat(take(variables('_solutionId'),50),'-','hq','-', uniqueString(concat(variables('_solutionId'),'-','HuntingQuery','-',variables('huntingQueryObject5')._huntingQuerycontentId5,'-', '1.0.0')))]", + "version": "1.0.0" + } + }, + { + "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", + "apiVersion": "2023-04-01-preview", + "location": "[parameters('workspace-location')]", + "properties": { + "version": "3.0.3", + "kind": "Solution", + "contentSchemaVersion": "3.0.0", + "displayName": "HoneyForge", + "publisherDisplayName": "BUI", + "descriptionHtml": "

Note: Please refer to the following before installing the solution:

\n

• Review the solution Release Notes

\n

• There may be known issues pertaining to this Solution, please refer to them before installing.

\n

The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

\n

Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

\n

Learn more about Microsoft Sentinel | Learn more about Solutions

\n", + "contentKind": "Solution", + "contentProductId": "[variables('_solutioncontentProductId')]", + "id": "[variables('_solutioncontentProductId')]", + "icon": "", + "contentId": "[variables('_solutionId')]", + "parentId": "[variables('_solutionId')]", "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" + "kind": "Solution", + "name": "HoneyForge", + "sourceId": "[variables('_solutionId')]" }, "author": { "name": "BUI", - "email": "support@bui.co.za" + "email": "[variables('_email')]" }, "support": { - "tier": "Partner", "name": "BUI", "email": "support@bui.co.za", + "tier": "Partner", "link": "https://honeyforge.tech" - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_workbookContentId'), '-wb-', variables('_solutionId'))]", - "location": "[parameters('location')]", - "properties": { - "contentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853", - "displayName": "HoneyForge Threat Detection Workbook", - "contentKind": "Workbook", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "parameters": { - "workspace": { - "defaultValue": "", - "type": "string" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "kind": "Workbook", + "contentId": "[variables('_workbookContentId1')]", + "version": "[variables('workbookVersion1')]" }, - "location": { - "defaultValue": "[parameters('location')]", - "type": "string" + { + "kind": "DataConnector", + "contentId": "[variables('_dataConnectorContentId1')]", + "version": "[variables('dataConnectorVersion1')]" }, - "workbook-id": { - "defaultValue": "8eb1cbec-31bc-44b1-9548-ef98e8719853", - "type": "string" + { + "kind": "AnalyticsRule", + "contentId": "[variables('analyticRuleObject1')._analyticRulecontentId1]", + "version": "[variables('analyticRuleObject1').analyticRuleVersion1]" }, - "workbook-name": { - "defaultValue": "HoneyForge Threat Detection", - "type": "string" - } - }, - "variables": {}, - "resources": [ { - "type": "microsoft.insights/workbooks", - "name": "[parameters('workbook-id')]", - "location": "[parameters('location')]", - "apiVersion": "2022-04-01", - "kind": "shared", - "properties": { - "displayName": "[parameters('workbook-name')]", - "serializedData": "{\"version\": \"Notebook/1.0\", \"items\": [{\"type\": 9, \"content\": {\"version\": \"KqlParameterItem/1.0\", \"parameters\": [{\"id\": \"a1b2c3d4-0001-0000-0000-000000000001\", \"version\": \"KqlParameterItem/1.0\", \"name\": \"TimeRange\", \"label\": \"Time Range\", \"type\": 4, \"isRequired\": true, \"value\": {\"durationMs\": 604800000}, \"typeSettings\": {\"selectableValues\": [{\"durationMs\": 3600000}, {\"durationMs\": 14400000}, {\"durationMs\": 43200000}, {\"durationMs\": 86400000}, {\"durationMs\": 259200000}, {\"durationMs\": 604800000}, {\"durationMs\": 2592000000}], \"allowCustom\": true}}, {\"id\": \"a1b2c3d4-0002-0000-0000-000000000002\", \"version\": \"KqlParameterItem/1.0\", \"name\": \"CustomerID\", \"label\": \"Customer\", \"type\": 2, \"isRequired\": false, \"query\": \"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\", \"value\": \"All\", \"typeSettings\": {\"additionalResourceOptions\": [\"value:All\"], \"showDefault\": false}, \"defaultValue\": \"value:All\", \"timeContext\": {\"durationMs\": 0}, \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\"}], \"style\": \"pills\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\"}, \"name\": \"parameters\"}, {\"type\": 1, \"content\": {\"json\": \"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device \\u2014 treat all interactions as suspicious until validated.\"}, \"name\": \"header\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\", \"size\": 4, \"title\": \"Overview\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"tiles\", \"tileSettings\": {\"titleContent\": {\"columnMatch\": \"TotalEventsLabel\", \"formatter\": 12, \"formatOptions\": {\"palette\": \"auto\"}}, \"showBorder\": false, \"tiles\": [{\"id\": \"tile-events\", \"title\": \"Total Events\", \"query\": \"TotalEventsLabel\"}, {\"id\": \"tile-sources\", \"title\": \"Unique Source IPs\", \"query\": \"UniqueSourcesLabel\"}, {\"id\": \"tile-sensors\", \"title\": \"Sensors Triggered\", \"query\": \"SensorsHitLabel\"}, {\"id\": \"tile-customers\", \"title\": \"Customers Affected\", \"query\": \"CustomersLabel\"}]}}, \"name\": \"overview-tiles\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\", \"size\": 0, \"title\": \"Event Timeline\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"timechart\", \"chartSettings\": {\"seriesLabelSettings\": [{\"seriesName\": \"Events\", \"color\": \"blue\"}]}}, \"name\": \"timeline\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\", \"size\": 0, \"title\": \"Top 25 Attacking Source IPs\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"table\", \"gridSettings\": {\"formatters\": [{\"columnMatch\": \"TotalEvents\", \"formatter\": 8, \"formatOptions\": {\"palette\": \"redBright\"}}], \"sortBy\": [{\"itemKey\": \"TotalEvents\", \"sortOrder\": 2}]}}, \"name\": \"top-sources\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"\\ud83d\\udfe2 Online\\\", \\\"\\ud83d\\udd34 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\", \"size\": 0, \"title\": \"Sensor Fleet Health\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"table\", \"gridSettings\": {\"formatters\": [{\"columnMatch\": \"Status\", \"formatter\": 1}, {\"columnMatch\": \"TotalEvents\", \"formatter\": 8, \"formatOptions\": {\"palette\": \"blue\"}}]}}, \"name\": \"sensor-health\"}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\", \"size\": 3, \"title\": \"Events by Severity\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"piechart\", \"chartSettings\": {\"seriesLabelSettings\": [{\"seriesName\": \"Critical\", \"color\": \"redBright\"}, {\"seriesName\": \"High\", \"color\": \"red\"}, {\"seriesName\": \"Medium\", \"color\": \"orange\"}, {\"seriesName\": \"Low\", \"color\": \"yellow\"}]}}, \"name\": \"severity-chart\", \"styleSettings\": {\"maxWidth\": \"50%\"}}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\", \"size\": 3, \"title\": \"Events by Protocol\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"piechart\"}, \"name\": \"protocol-chart\", \"styleSettings\": {\"maxWidth\": \"50%\"}}, {\"type\": 3, \"content\": {\"version\": \"KqlItem/1.0\", \"query\": \"CommonSecurityLog\\n| where {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\", \"size\": 0, \"title\": \"Off-Hours Activity (Top 20 Sources)\", \"timeContextFromParameter\": \"TimeRange\", \"queryType\": 0, \"resourceType\": \"microsoft.operationalinsights/workspaces\", \"visualization\": \"table\", \"gridSettings\": {\"formatters\": [{\"columnMatch\": \"Events\", \"formatter\": 8, \"formatOptions\": {\"palette\": \"orange\"}}]}}, \"name\": \"offhours\"}], \"styleSettings\": {}, \"fromTemplateId\": \"sentinel-HoneyForge\", \"$schema\": \"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}", - "version": "1.0", - "sourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace'))]", - "category": "sentinel" - } + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject1')._huntingQuerycontentId1]", + "version": "[variables('huntingQueryObject1').huntingQueryVersion1]" }, { - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/Workbook-', variables('_workbookContentId'))]", - "properties": { - "contentId": "8eb1cbec-31bc-44b1-9548-ef98e8719853", - "kind": "Workbook", - "version": "1.0.0", - "displayName": "HoneyForge Threat Detection Workbook", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" - } - } + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject2')._huntingQuerycontentId2]", + "version": "[variables('huntingQueryObject2').huntingQueryVersion2]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject3')._huntingQuerycontentId3]", + "version": "[variables('huntingQueryObject3').huntingQueryVersion3]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject4')._huntingQuerycontentId4]", + "version": "[variables('huntingQueryObject4').huntingQueryVersion4]" + }, + { + "kind": "HuntingQuery", + "contentId": "[variables('huntingQueryObject5')._huntingQuerycontentId5]", + "version": "[variables('huntingQueryObject5').huntingQueryVersion5]" } ] }, - "version": "1.0.0", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "HoneyForge Threat Detection", - "kind": "Solution" - }, - "author": { - "name": "BUI", - "email": "support@bui.co.za" - }, - "support": { - "tier": "Partner", - "name": "BUI", - "email": "support@bui.co.za", - "link": "https://honeyforge.tech" + "firstPublishDate": "2026-07-20", + "lastPublishDate": "2026-07-20", + "categories": { + "domains": [ + "Security - Threat Intelligence", + "Security - Network" + ] } - } + }, + "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" } - ] -} \ No newline at end of file + ], + "outputs": {} +} diff --git a/Solutions/HoneyForge/Package/testParameters.json b/Solutions/HoneyForge/Package/testParameters.json new file mode 100644 index 00000000000..ce5f1185079 --- /dev/null +++ b/Solutions/HoneyForge/Package/testParameters.json @@ -0,0 +1,32 @@ +{ + "location": { + "type": "string", + "minLength": 1, + "defaultValue": "[resourceGroup().location]", + "metadata": { + "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" + } + }, + "workspace-location": { + "type": "string", + "defaultValue": "", + "metadata": { + "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" + } + }, + "workspace": { + "defaultValue": "", + "type": "string", + "metadata": { + "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" + } + }, + "workbook1-name": { + "type": "string", + "defaultValue": null, + "minLength": 1, + "metadata": { + "description": "Name for the workbook" + } + } +} From b7f2dbdbc043171054b61705ab0a39c84a67cb55 Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Thu, 20 Aug 2026 12:58:05 +0200 Subject: [PATCH 09/71] Add HoneyForge workbook preview images --- .../HoneyForgePreviewImages/HoneyForgeBlack.png | Bin 0 -> 68059 bytes .../HoneyForgePreviewImages/HoneyForgeWhite.png | Bin 0 -> 66137 bytes Workbooks/Images/Preview/HoneyForgeBlack.png | Bin 0 -> 68059 bytes Workbooks/Images/Preview/HoneyForgeWhite.png | Bin 0 -> 66137 bytes 4 files changed, 0 insertions(+), 0 deletions(-) create mode 100755 Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeBlack.png create mode 100755 Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeWhite.png create mode 100755 Workbooks/Images/Preview/HoneyForgeBlack.png create mode 100755 Workbooks/Images/Preview/HoneyForgeWhite.png diff --git a/Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeBlack.png b/Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeBlack.png new file mode 100755 index 0000000000000000000000000000000000000000..abd740d12ff4d19200ef57ab7df3d28dd53bce78 GIT binary patch literal 68059 zcmdSBbySsG)c?EbE|KmOi%_~t5K$0CF-Vb+?vhUF?gj+}1(cLdK@cgCEIy3aPgyFz+Y&#_Y`GOh2Q8G;UAbrGIwN9s1M-;$9h=sZ#=7;k8M#X;%4LzTAO9w za}?_Ajgq{Kx|8(qqk^8dVM<4EacInYt5y~eY>(*Jz>byokPZpm=W*#%Y=E>g0;Ul(Ts zF@sytrKF@*46{sWFPwk%&r3ZT&(F_~`nn-uR8&;P;L?FFdL+i5Z$J&LI6S&S8A2~| zZfUScu`}+fNTT%XCOj7Zz4rE~1L4=jFYp+%*HeKeN)XXufKi&*I-}Ou0xciX&^RGp3Dbu2_ zFKTaWZF^mMS4bULLc~i=$cu@Sy(G*QqF`PVR$IC>_F9Mh`?%=eQ_aeHm|OiC4~qx& z_S3nLs}?xeb3+!u`OrSSd zR5V-Q=teeokfVoPpyjtl_w0J%hS#w%FD=O|rNkn0iN`TaF0e6{y9YOXh-xFw2}?Q4 z+gc^RFtCDH7I$chOA0ll-cQhHXZD5bVH*3*Nzo6SOa;WOZk>k9@#(xb-I=1;GjB)n zT0g}OVo+sR*5M<2dj0wb`zlTU#G#}_Kl6SxWuG~Z91N5KERZDe`Lo0cuULU2HzzKP zdx=2^zPuHC^IG*QZvM=$Tt=OH3lu4%ill!U_UC@Qs=_PuGG}- zIJ4eyS^0zckweXv6UFl8qv~zUIP=M{ouZw_iyj#7BzagJMg`5rtB6M9Bp+=(;do1B zSk>~v=T4MWbAk0xxw+|`{mR73FInF{VfD2e4Ar?wXfN5Z8MX|xd@vuqc3cpKW>d?D zIZ%+Re=$c-DF!W0^a8~)sZ8y9mAJ5_pxhOPSIpI(3=Ky(^BG&c!vd;g)ITEzjYP{; zFz(KUPDxG+8}l~kCit`{>^&Q`YdCC_xlKhtX2#n2dVf7DkWA zni!!r`u==+a|TD2;d;F=&E+?XLs25MRh3go+lCjiHu9d=kYtQ7hKx3ounG&~YPEGY z{Gd8ywXB_4^!IVGBNbGib~fu;4s(+cIKuH5#O=29K#NGvXZ~lpvpn7@C*AernTn3^ z%;wFyirQWZkZe^-NVja-89&8B8JnILu3|&epG@@mcF~qs_}aNhpP2}cqw_UCaN4(w zL&cKlo2F!Z)-^+@wne>6#{35biDgd5WSq9UB+*8v4#jO?Z{ffn8zGanS3G~A^%*NVsb}l{qA~YzIL6xUa)`ep zkNs_xuQKUV3JVV^2|h94=wf@)V2H5^IX}D8;X+WZIygXhisRVaLW9veoaSjyjz%5Y z(8n^AGJ<R}eXBW_U(G#pt7tp3Yp)Hs!hp27Nw&&qu3Yg(E z{8oSV&kC>}&VMS!!=j${(`xUiX4GQDkzHF1{yt9UnV@4`qjr6}F?ykog@mSFJkVmr zqwR-~2U>`N?=vDvRnp2rnyLAVdV@x$o(zJ$#X4QZ$&+O&HYog50ByD2k=p%i_YS)=jUFMUUNh9ApG>xV@HFAb1xPXyqu-U)({F2T>jtI)5EOvVWHCi%RWoF3{BZ3?>o0$1 zTrK{Z2kV&N+8JRr7sG+S3Nv-&4wV>Xm zbDaItfQP#opffEh&VQXIb@Gw_g)0K1Xu4hBWgfj`rGLLF-_`coR4@Kp zWIs`Yy`Ngk5tY>6?O+WHvICe}%>DT)UVEcgvdCi}R5 z;(K%%J3ARAYKQw^WeIJHPso~<3>S}td)&X5LB6ZtrOM}L>$d6Wj$c0;kr+LjjS2Uh zC}Od2(0O#qCB5}fPXOcW!VK^JCmvn?s&rOTO1uFQ1^uu|^xH>yv@8nYF5-z()K(fE z$ujQvO~$@z6NS7@#xc#94aVCTs2HVl@50QZs>zODJdNO!3vhfQ|16X3eUeq!{&Q|s z-MpEYW|Pfr_iMLY*x451@B}vU1wXZ@{yj5xu^&cPJnC#}s%S&$g#5=X2C>Z-=W1tX>D8isVkCNzcXdrs*_pfX!Y5~u%t}1Zp3a#rFqnN_ z9ek?W-lxnkb$0!mwv2$5oJPv4;j8|-N~uimIRD=MRfkrxUU}}^{l4fY_TQr~#fv5~ z_e%<7IyZU$Eov8-e97_Ucbfmys5x3+@UXOEiSuN;Shw;Y`%(oMF8=7{NA|4$xmm() zud??PE(_C-SMVgZi_6Pcjhu*YS#WtxxSp~+iT;Agg6T`jn|QnUk)|Z!%f|^_h6%Sh z;cF$QK=$FoxO=LPA3q-HLZO0Nvtrav&d#3Oobe^zZtw2KLCwz3i@h%j9lJ1la+{O< z4;lT6`-0Xd;y32XYIaY_#0w;*AFtx2*3RMKrfT8T-XU>9-Ke0*EH%Gq_e)^36fV7Y z|9-63T1pE2_Uic2N7YL(2=UYXnY{e`rit2@-D2&>jxn*ZegdXHxOPenyJ+K;u!38? z#a1gZZrr#bY&%Ejvb~Ubd^YfK;_%*HdPm2tuc=~GoY8o;^WSb57`*9sxElS%HGI{w!6m(t;gn65w(N0@Ffl2q`fsJPcoBz%QaV+?FObb{cXo7GbzZGt780V; z{~Xfzij3{wV!bDUgUWOMuVM$66Dx3|?hF3-=WZ_dKnP}c4LB-r2I&oCb? zfArxQR*p()kkEt^#{FEC)*y<@J>}+4;ipqu-BKDIR|Xq>NF-kgO}dhwo}O~?@U(pn zrBl0mx8V8+C69CPu0M*pJKsCfmNXJ<4)x8%{4pr9bD!|fMfO(BdD zv=1IU7^<*jx}9`^;T$=+Uf@mb!id%3&pMT%}&caRem zmr_oz@a^f^L~VEVgw}+Kvc?I!tbqZCVRu?+OAE4q8Swc|XD54lHn-)Cw{~|1b;M#- zanYEVn9iR+pOKM)ay#0+Fn6XV<7e)G!HazY40E4RLhMMg*a#B00Y8GTEUfvMlz+Ul)#v~+TI zwwCq!dxO7P`1k?sf!>3jMZ03>(W&Ga0(Fd7nb`G9+p;rzbj>dD6pv3nPCa;V{qbFj zhrh06>he+->osG~&dvRdRAiJ$|(3U#`^#z!buUqXT<+u)16^Y*zf}3Jg83u<$e3 zcMm+C*;pmnb)#?cKG;O-YaVB#D~IrLG=YJE+|Ezy-6a%4X@5nnZvN`zGaKTCr+7B^ zHIX;D%V~c)pf^{Q36>qcnRO$Wvc0Rz{!4O|=CxFnfXz)CvxyoSJw3gJ{#+85z17g- zV&3D;PM-Cxt^QS;2V}C+MMa6|>+9>D_4QH~mDAYBQ)6HgN+%1N_k1)^2Ct+4`}&lfDSgD>Wds71s5!VvKE>cobPx1>Y%$%Iq)sAca z115edd-DbH$H&JJX=%hfJUq7(uVJ|zZa2a#7n==V%eA`3f=Mf6L0B*lG+ynf-{0l*kR>KDGY$8ZlBfF&28ggKHc^| zw!eX@!LLP$p?H{$ZV@k^I`BUp!2D4y5RF%rB;!;h%hMo7M-~wsje(-(dxnV^?AVy* znA1$?O(mtqCO?7?2Az~OV8h_`y~iySWo6Ov2?+SCrlk2TC+J5jEEOFb1iihzW7Y_e zeUJFOkI(U7Axf1*U;KENcz?ud)}Yy+h*UNsKOY|w17?E10{sYRzE+H`SZw{sRZV}= zZ$4OVt&sbV?L<>YYd+n7@W7Aa@geY=!~5I|GeTuai&t|iMpSuO5-d@>_lKIbGcTM_L)cZN8>s0 zh=~VFOsCGTfS0(ISZp~diOaG+@p3H_{2ecCDA%P+-mp8~J-ocTI$q#vBvUjvQ&3db z6viOdQ)#Uaj`5!>$VCgoB^OSQCeK)}UM0f7A@&_MQwShtSl^!s&$gVb z<1P}vmUw%p-a`s8eJlb>E{p?N+~)=cjbQV4k_B5sg(h$gwv!M*OthTe?L5dIPECaSM&rcSVJT3b5Um=shKwK&%*abuy2$G#2y`^q@JYiiuy6 zi1~tx;DQg-XrGr^T zw(k0vZTB>6I$3vj$tM*Sq3i2b@lKG->;cDE1Lw&t@lT&V;Sv(I^kyr<7YUd}WtR^~ z1~8r&J9KpPh~(tphzL@c?y0J!!uxd)D8dy9{4dVc9sa%?zXKk|SG%YU4tmYa-6 zW7p8$dH&%MZ0qc0qic!6ng1qz2g^GpGEpd(5=M?xWvjv?k%ethCv_Llt}+W)W)p(A z)za-=q?inN-s4k}SDmFRU`u=IuUF_b`{%uT2L}2OJIDZ*4L%3drpBq(Q}N$2&mA|~ zO-40T+Q#cPnak<58DBe8FotP}y_hMws%4*shMeJDNdhpD=qPaL&4wkPx}G{YRc^X4 z?VMpWz_Ccmzz|ydaxcqqZ9>If+5;l?e@sKGzp%v@9kuY@MIGxwqfH6co2$22w$Vka ziBD-xamDFzi_Y;3VQ@<@R5@`*D>>UBaxzv!TSilJOzP*N?`5w)wzu7#>U-q)sEmR> zvQpKA*Qum9{>p7c5_lLkjS`@G2+;)Q>NL*WYz8(FV~bou{ic=^|@f5{odzDR=+Pg|TLd{wYOXz53nq$HiHlTvAd@Ac-l1u~51n9)VMdh>d;Y3sN4me}1h= zd~EEma}QN!Y~Y_T-Ghav9@+1c>*-2{-<8G>oBgoB=C^mMv(gazGl8$g33jj#${@I= zMtpm168V6NNp~@D+#leyFtE`*J3YCnqEcvkj~NW;!-o$ldcXK#NB-urLLg?3#hj|^np7X3*N4zq?91#AqfEk__;a3 zF)6hF#2n<{pkC+XG#T@=f-^w%6zNETGRS(-pTl+eG6ss@Y=|^hB^4co%fjq?chxLD zT@s!ZesmwZB(v&Bt5#(~BaO7Zqr)bUJYQ_(m-!~DuFKE|a^qFxI$c_>HsUr_BPX}R za*0dze&q_z+N171cS<%@%qxF)m%Y6p@sK53$g{A(H8jch*5$y^2hJU!FI$N3zAD*@~pRtE!@f zlbGjQs#w6+ueS{{H0gAnJ!1vE_on6k=Qd-*lSsh%j)$!_P zGr^e;ZH%zjoAkpa{D1!ZS#bIV>p%7hQ|ylDwI}6fc<GHw5LDlVLqQcemj%2L+0R zj)yx-0dO>9B03jbp7m@yS-+@q)JUb{I(=?_?2|3u^LEl2E+-cj?FbW)i7mPnah*aH)nRG}jHk-u)T;>Xmf5q#G#}RX{_7bgB6$EI6fS+ykBtPA zh+V+Ki45q#NpuRMn1MGaz?jJx8N(*skBDH3I$DB2HCI#!fv3-jxeSBx^71kUv2;Ie zw9GUB2`nJ6WCO$V0c&p1<(+C{@@Rp(S z`yXtg+WHy5C<89-c|w$Ue6Y0v7js45LKMVW{aF~q2aUSC!hZEhe|p4)Yn!{f3fkI? zRd$Qsk4p?QWqh#r7jx5*iO0mo{s|jG5gv%qd6ocE(*?Tzph%#UkpsN+^tdOioS? z=cPXqDD?M}BdG_t(4uzd;h4jyIfOIP{W*7#Irk%=`uY9seZ&}$NTGVIj*d>qLjLw` z!n)H#Q*eTEMQ65oBi-F3;P0p&ou8J7c#(~~**p^~?dPSDbB+Rp{KPit2i;s_wlCqcVp7*D- zXn@UV)qh6_4P{Za$hkaPv6i298}%Qb$^)Ur@<zKmirhsKCDyfCqt7x^Z%n z>1l-pEPIB7hM&XKNLw2YBO{}6ZvNmaiikA55tAYvT3H{>7e8wnoe2)l`n-_Ed+vE5Rg^`zTpl zi0E~{Ch)-m+)bn8x_Z@5CD$iCJzY=)B@Iy*@3R(M@%09b1X24-;QxBxJ-!Yy_|oJ> zaDI7tc|EI7E<@-A@lPgv&MoaUr=NIWCQmMorb)b9UoPo}6blm0Avve(-QpM?9v-=s z-zQ)8xF5+-Qd0WEB!WA=qFG6*kWGe%hgTMNU}8O83!C-tmk9+m^(#mSv2t)=Ap<97 zk|adkybXB?W3HyACaZ-W7T3LTM`Riezb1HPWH5{G4(UU{JyiR$qW`%Uh&gb48v`0T z(-8GH!=GSSYrBOWG$iDQ7#~RvJbM4o_4Ht#+uFs&3Z>T-5K)JV9Kkq^WRc?Gv#oe8ycdcEUH%oA@2eEnORbj zQE1ExBZ>coH;5xd?ZNh?7Bow^M~OmwFcOTuRw5^4lB5SWZF}hNy$pv1l3vI!DCjNJ z5<_A#kF!(b{v0BI5+-8QK6pgZ^XGlZ*c6a(!OGQ0wh-fBM;^(aKxnejfI)&nff9%j zjq5bzr$s}-sywJ0usYcpZ0_vrjLc42V;gf>dT-qK8gIgRoYk@IDCM5-dqDpZ*w`lU;Y}QxULXf+>B9IS4S;ia$eA4>=o=DN{A|CAqbstKQcF% z#3Sd_g&>yO8WeT(&_@G;3Aa5h!~kz9E6b^?pO3rx)c;p!d^Q+9WDI2s9=<1q%?~ST zAngW<268R%#%6E?A6#}!T*0MR9?T^p4&?OYXl8l11UYDs2Zx*@D@ZpT*9|P>pGZoI zM10+Ib9x2|*x^X*1PR$#jT4q%$f+eD@ZdnQ1#H=;w3Po1WBt*p*c;7F z`Sw8a3o)V*GcMqNQhq$XLiz4VS;t$mN!P8=%@1?%R!BGg95zb#Ykj7+Nkv7KJL@*v z9x3d0$bWotf~X3Pklftd&DZU)Z+dE+ZQnhuAcm2scQ}>x(S&}Ms%QQKvj~mUp~6Ig z+(DLZRBVn1wj^aoM@LVwp4_kT1JHCK>;)~2-uHV1ml2c&;f`vzDP*ICgI zNPHMf!a-PJjg5_s%!FadV?0Y{)5YJR0<9Mm1^Qo!XA|+b_Asmt<*21}FjIR^UVCenOTAe7tY!qI z>nPu(-`82Cqjc@@o(idPpmnWDJ7zQNqIe!{Dl?0#XMdG#SS7>Nm!^2t>7a#Sa?cy{79umZm;a&C8w;oS&zf$bZ>{Z75$RoJv}(l@VgV$bGR{RZApj5 zV%HPD-1hrTVEevDvU&vSg=kQ2xU_*i?p^CGDp=rBJ{X z`h}v8#_KO<*0*57BycphcGiqM)x3&kfbyodexTfwy5yBFmZtb3dFd|ADq4Mdc=qx` zG1>S~iM7|>>`G2jpQy9h=!;q|sWgpIO8s07QM+l`%RtUBkBI95)vE!t{~I#*>b#cq zF0|wPCc#H9dgiER!sY)hhiLX&I^_H+b*Txl;R~~Ek+({iW(_zg$6)=nYq>i%t|K>6 z)5sL``LPA;Z*x}St=&Q|KBqNGnVHpk(=0J8Nm#2dGG0om=1H`akly&*$+f(QjLYeP zSw@OY^93BFCnOo~@G|yr2mI}FE-U<8PO1{Z?8F%QT{FzQ9M(8)UBO(u$b1E*Tk@dU z&?h^LJH*p-q76rMVVY)vC^ekKb+)yDR#F?PzXHnd9e>0rb5*Syj`lV0(QWY*&>|F+=ER>E(dxsrS9%({PY%-8;*vPWHvC+jjLo8$ zV&8E5DI*_YO89Cutm3jMox>+E69dq2f4M|&oY`e$jGT&cSA&iNz=L~cWig%jHc7JrLmVpl6tnx}F4wk~{M z4X=Nl!|0H2ZZW6f5=_?P=2qCe^>$9>Fa%?$hGU#ekl|^L7)jWzbH%?0jn@dNYrn-d{xead&E%7}Pwp5v^X9TyoU;8f+j?S5WTX9Bxk zYQj%%m{wgP&5!j1slOcR_fgL)@m{t;<-=@a-IBo&zwTqkfO4sDn$c^;3l>?= z+nJ`d1M$V#efQ9xI@5H_zG)(-7zo?`CO70o8A>aSt9D;Fn@pkYx$F^H$;RPQ3GdR* zaKevnf~fBVY!gn@6-ovX%#D|J8rtWNGRxQ-OV0Sey1P+od$g6b1TeqYP!iM0hbdB6XbsOEe*L}zRb0$x`yuHz9=hK@8?-SgG(wC#75epj| z14t%y#T)X({~Tgj^#LY$qBDvSpNX-T>zSR5m|_GwF`h_zM}?s-Y2gqKyhDu$;Vb<1 zQVNTIJ-CihEX+pIRgI0h;lLm6ihtNDpvwDI$;7w!%Vp2lFA3a~KgL?=#R){@qCT99 z%`2~HzH|6Sz){d6E?~6HeZdB&R!ex*u6&qu>;gRw5jY3ih@k~-v*e9=hEc2K1DT4? zLuGCRLFH>GQR0T%s7J!oT|TC(8ELg`-laR^yc=f1zQ1EHH(AKtM`KpRIV*H*(zhn{ zP9pm3O+xb1Ik$$X1;@%!$XP<<4yT=>bRCI2$6bjjKJ^rB!kN#lW$sdFsO4R0!Y8aI zoFqX20E!l~I`h+B=z9CMt@T`!9D~oVCSo*_E3{+i*WLMNS}rkoThe$~7j=CYMV-Yh zICN`O);j8J$Hv!T@aCB+?+@(=Px^3+dQ6QunyxDkxjE_YW-o9Kh=)#*J#YD9Z)=kF zB%vC!O_Wep_1HT*XUS^j{X=Q=4vT8EJ7FFHQdLrcYL9$GZ0Ge>$2i(+Pn5PxAMxa0 z^_}p}e_GKf?m`g6G~)e}EZN#Zmr8nHHpZ~Agt|clPqZSyk4zy%ad5}E(oGxhTDi(Q z=X(vnTMP_(527`L$@@(*_%8^fuIu?xT<6P}dA#gwB3l03p{*_>NuOiCTEWTvh`{r= z687H7F#gil6{os>y_&i0n4tUEOE)y|hOozR$X*J$CP@bLO+VF3bE5A1nyyB<$@)#= zjMr6gS6aFpt*PHWp}!kfp5#eLi$Zv&yz?!*Fr{ST%E$GDM6~?U&7q$buDf8NriSaf zpn|1bYB{M*$3XUn9${pk(zJ{r`c2@3g~HKjnhBH1+w4QzWmX?MAj=OX7_a{!Ul2!E zjfUd58u?*`LY|w*ldR$A%EjUeqPB0`gKW#IZ^AB+&1Ihhr){Hl8U z=I1X@0(#LFcDPi6TIDgBQNbJiy_$DWcn!Dgt}}k#Q$}4G51W)%BupS~L-Bf&kW6!g zzgZ9@leS$sC8ofBMB*OQ{zl;JIK$MG->##Y?5YW)Yo(P1C;74gMKRG(aF&01bLEHK zaK6s%zkoUs?UH`_NM*?ebFvG?B7JJ%${zAT!)1x$cA^X0R!M~UQViRtMjN9fVvw(y z)IZuAeb7nrYVzcI-S|t|(^bVuhLCl>TSFyg#1s3>R3{To%^UpQzFD7rc+Gd05(Jh+ zw(;=%rbTsijQgt(zN~5XQ{_&EHtu6Z=ZuGrhNSY{a{u^T9n+h( z-1heP^zn)F^xi(v$@-7X*reN9xM;ehmy%v)98T-Eul19qU9{DG z4Fy^h8tBE9Z^R1Jp}~Bw4S2n^yIXsrp1rnABu4ct-v40G9+k8zc))z`m$t-#Eq&+L zDM+iAP5qOnKiL7C_)zpp*N*gX5$@r%QNt5-rv72GlCZLwDM%2qWP~JQz^AP^ebY!Z1yyrVd(sDajQbM!+Q;-* z*UK|?KgT7VNs3{yb`!*gb2e%YFcI}DW>sQ%UNXld4jXj8^PAQ;Tr47+Z(@N;f=q*4=7f*a*l<>LdY^p3KO&}tdqe45lRKVI>QAf>KSxtqo);^Cp~ z%W~D5th8S2R#33@ln;U1FEaYtIfWs+McmVM1^#10^qQ?bRGnwuH^qh|i*>2B=icvf zh(nYEGH&#k(J%5dJWVTUBGhAl0bz%;bUcjCO8a$mlxqQ{fz9 zU$|s6rTHCqU;F2C^t)S!M@g0!Pz`vqR27PQv0=$0x#OWK*n>*gsVX>XTd|s5afiKl zC>M;T+HO4vGlgCHe7{fLxB4bV-G{DRz0?jU1RWS~Pq!I#2dh7dLN&@KqIEXd>J zk~_1oad&KgpQxB=lmONKl}Dk40i*Zk@Gwbb&lgObT3kC#QpYO_xaLpxxpe!@?%#bSV}7B9Vz;I3*)eoTq+Dy8j}q<;imk+{&RN6SD!D{ zW9(bwdA2ULlYC;(Phq?kA@<|oXbZBB~<^@AFrn&$bezGlt&shmw~;}vWo229>JShPvDk@@2{<%6oiME)0^%eq`}zW9b@ zXb>q=!zm8>p8MVFV!D{(7rlb6xfo;B3-1Tm$ct7(q*WRNM$u-g%Y`B8It*bRsL zWcif9Fh&$jpV?v4#Mfo!Kdc$j`;6fUp)<}J;R~;!8p$xR_g!4y#{6lD<#IKoVly1w zuSsiPmTJxDZ*I1(5JCY1%5@fl`dWh{w0Lj5zfWq79*6U%u8EkPlpQL(98Z4DIc%`= zywS4)H{Lq6&F>Ti z(jSP*ZxKA%rF|vHcn<$7rTT*hjSn9X2bZBc{939hlz;2nAeN)QyHsML{doJ3UDHFH zc+`E|-`6`WVf%2&>11a~PiQe?FHiOpPK5iiFm36;^w24)!C3yw4~~7#`U{-3k_07& zwPC~khZ%nA&S>UdN$ztLgmn2Cm#fHQ$yVs?nMhtvuIX|wdas{+X{R|Qr*++C-Ih_n zjaM{czu6Zcys)3~5zv7RW9IUw=X2^yC_)tn-X$A;mHCi;>VY8-d0A5v`$K4$*Zu67BkVAz zGA6<}lZQWA!co)=7`X;fm<7Mfq#|$*V)xaLsyU1roKt%@8V&3vHGlTJw$^sQE9UXt z=G7f@W_!&j#m2sbmO?OTHyw?)y6Fu!Q1un={gG&LPX1}zJjW$9t>1o>wbhw2F9eP; z3iM={Yu=r^m5+5SOWW8V6&_{MAaw=Puby+d0$+z(qLggl_NDVN`49JnJbQI;{z|T( za6K!+DPr9}Ck;|RQ07f1kdEzDeY+;roHZ9nm+g2mijK->XI|F7NivR)%WyX})U&I* zc`I&*H{LE1OP#zQ=!hqWlTgb#CtZWZ5b=_}toWWw;+)w53)metnusEar?jz-lF z>eXgnFykiYxYYWRv{Ij2{J48k$}~)_3`HIKBdMyFeiRXaGBRkW3@Gmu7f1%F$P4_D zq`6v+86(O`nxvv=pwF~WQzUm|#%jpT4KL7t`FKR4ly|H(X18q*~>@C5QSI4~r#-#_0vqXj6&zl~6;~Y5g zXP3w*(7!e<3%up8>I?sqvE+kN$k-pk!%bb;lR+T3Ya>;iC{?iwhkVQ|KY8vVI{Mv9 znTKg^!h^3d-E*|oMaXcvQ`8p-sUEj^P(ZCYkF8sD;dC_`?@8>ro?YdewLa6fE@J3H zif1Jk$WK`z7|Un+HzlaGbc?~!_XtCj2bHEV{Jcp@>ka04v5~g!aUt@Bd;hnrm%RKS zKa!InVG8>jM25frA4vdK3YPsiCsxOQR|UBV6sU8RFssMEDPge+{r5*Zvoen#(;%Q8 zRHRidk-k_6QD6(l|L60nau)4GfwlrR=zl9TH*ekY)-DQA$?eC!P{sML?tk^FeIuXE zc{AfROq9F(2(yabt3rW)f>F3*pZJ@*$y?@Zhq*KV=shyBNFVXH%x6+$CxJ``{{Yvl zHl#ob4nnRTLl)OPA@QaksD*z}jse+|7WCe-us?_ld3p8R%YvCuw8sLdLF0T<+hCzMhp{6k%`QPL3Et`)@ zyNgukw-@_2#vLa&>;=zs;X{j`ysw0MJG8l#i>~P!{U4Vp7HO&J0D^2hStlWC|GR}` zMH}OpzJBl9`xhWUWrUxMbm8v?7ihTsG1-N8s3bBWx7J(l;Q>V(x$3~vOo!zmFR0M~ zePAkdafqkTV&{eaznei&Ya0+EyVWro9Af&OLI)^M;TH_#Uja}ZwuP*X%}2q78;Js@ zl)y&E>+)=bj1+|Sn?1MI1C{{tegS*o@A|++HZx3!C0)QS=c<|r8 zeS7oH9s7~C)WbjQTuKi;}?=LR(DmKA7yuh2mtVAw$NV17Wm0oD=Zyfyd2XW$Ya-$s7AC!lfP z3#)YD!J3GK#!!IvAgHKH^ewnOAh+-Kgvfr6e*Oohv|IV~8qW`Es!%R7(WrjYzc}^l z7Zzx2VQd*F%%in6Slzl6WD`*4>gaA_atVPx+)oZKs)|%rC+l41;Xw+8Dvk%8jusa< zIiEo#o!k10qf>594y%X=4Gh9YX%85g8!)-GX`Vfj0v}utY;yO3zjQy@(U4bAXoA`| z&>3u25&!PnKb=3^mLQ~{rQIAQ>{@Tku9(|xxNx7Qj)+6iKg+=7-9%cWZG zeVID-?j6x|HV3~P;?nW020tT4bn8~f4JrF9_uta)x2AxQbX+7k+Fii__9?~+9_L;M z>)v&dZkyqfB!aVX=%xLQ1EbJuqgeK5LHf{`R#w^b}$W^EGspE`Hf6X4FxP7 zmIfi%z%{_Qdva@4=>k;)<^Be6AY&7$XTZ10;d&(`Q0ML- zrX;a9=9BJzh!+_d380sEKmbl(e?L;b21G#@xWR?*Z^>a%H#aw99A{wn(8HuPgOdrJ zX$xnA&s`ZQvkf{sYX;z3lT&GGuJEM9sQcMegBL8doU}9w;ap*`2$kOm{)x|S;qL7e zVKP8~72v0oJlY{t+D>TjL2`gW)Sc`;-Tpm5pr)pVU;?lazzBGOdjklf?QJORIP2M8 zzZ#AC5!j^-=#|vXth5$2RqZ?j0|WRJ;)H7k_{j7C6Ql=YP&t{N4q*E1iG~s51~pbv zz!6~cpQoSz;u{cJ3Is(0&*ys~-Su2=Z!h94dkZvp4C-MgWJ2)+{6lN~=?+hdm?Lp> z0EtHVKTelSiyP@ezjx0YSpAjX1P`^f!+d=)VNqwGfIU=VM1q)fy#j2u%~gd z1Y`iX@QBDrul;=|xK9&+0EkV2XN7@r-bs4h@^X2I521wmb5#St3Xr8>XJ?;++XpEG(Z$J0xD^fMP|X1R3^c~j37Rzo^VGe9 zJ)0uwMw^+L3Ed%FhkI+`*hI7$AO>L9Avc13u(6OGZjxOP|9^OVnL4`DThN#!2TJ|n zyGNOXKhxGm33S|cDAL>yU({@TrbA9iaLb4_0);sP#>b7Z2RH=spul*cp%9|a8tGZ$ zw;aBQoNT)uk zcdxxBTxUD4!f*QHcCv4v-DdMXI3u2TVU%pgFW(k zoVso=4U)*n$RMZ>h&tFOd9GrA!7I>C0R{p_H9a$f0n!jq2+=oeN>QVNa0-^)7cM&# z&qVr#fEz>jFwhLbPV3At@3VbOW`cB63Agu8_9lU1@B#=8P=_pF23=|yhlhtfX9CZQ zgd26IJ?E2&W1t6+od59U5-mEB=&9wo2sqAj)L+R>#W< zObtFfDlPc^9atRj5;%Kfw&B-ay{y|C>4yFfsndNng)sWShwq;NjQ$Loz!0Dfn~)k+ zGQ51guDF;Kp-8-aeDunmY=Eoy2`ogX@)4?&h*G%*4mm60izx&q&ldC(m&s;KSsN^3LUwA+cAqkg#`t?4Sq5$U84PM2d^8IzGW6Sgerj3k z*Oe@!|EnVw86EPhU$1xn)!G8^3CJ!4OIj+d{`Tf<+^U(#Vszj2_m;0L$WVvXu|PPM zQiQG1k&*4LjA|Xqfnb4K=v9m&ofIsf6qMtxG)8eKL-Pz+iO<4<@$=`;r+{|yAJ}*w z3{#JWf?l2wNw>o(@Qoe)=RpVn2idCSIF6;NstS{d_?FVr?-#?%-dg@CY!#tZA$5}H zzABArWhAOZDgUjo( zZ46wFIq4w|$bD%uvn$}8v6P~I)0-LoAELaid2;fMXr<$D6ZlA29RT;ppxFZ&+p^xh zyG<8T_zWmrg!zVf^@ENqAZK6rRO;4OR%zb;^XcZJIM1URfJX!^flEZx3jXS^#up^U z3MrI@-~qV_(in%}N($L(bgv&SQ)vV!|0&(eH8*|H>3!OuzYVB7q`L^5K^VPA7LkHR zButn-^q7I38Mr~hU!rqds}=S~tY_NB;U*`e9L0{v5moUGOyr;i3KNcH3^-SRjW2rG z!lM9F%TVRG7KVm_%?y|zz}L`jHNx@N4J987QgoY7hRpDsi9&K|T<~eoIsQSZyq_2EbeSio1 z3j7d@(zz>?!4B8qKlc*~0!7zW;|ku3-!0S73T9VAI)-j3DSyQ(!iQYRc_T)AzNUAuN| z9U7W-)amUna&vzM1U&>&G>BUUQFX6R#ATZcfmRH!hcQaz|7YAtd}ylV>?{Ja)PGM~ zyO3zNBKN8ybeN$ss;Wlbn7N!x7QKv#ivw+f4&9kDj~*pBY&j2`34+Up-!ugouKj}p zr1uGl&H!7625Lt&^1t2+(OJ#08$Vm&31n{G#0B;L zb@1Nbc?_~%3R?pO=_RETe5w^wsK4D1=Vv+grkyd#isnYKgpO z;x{I3YHlu5tDG$;-x=Zk9gbs4l_(feb^Bq#1H9b+#kyMt3nr1gF>oZ{l! zJ#wHRz2oDl5H-Q%zK@3FLq|$4B0_GP7vpElkxP8ZUdY{eTSn+q`1`0H?OH0o~ zQxpVv0qjbT%FSp%rnC5ZLSzCVR`H8|&hy6Fmmg?|{NgVwbsn^-xP$8j(i`bHKpIs^ z(V;2N=~t{qjEvFF9_56`nOlmu^EroVEoY(#V6%_jRKY4bVTNv!dT27$xQ%^7%>9GgPMYaJYn~0IG#FBp%FrO0Nl7ZRGE+(=8MDc(qDfK45=mx4$&k4d5)LI} zdy~v;QwW)#>+T$#^LyXtS?_w+e?8CozwcS+tkbaV{oUX1eSe1Qb6wXhvK|lc`l1!2 z%pll~d#iFkmLid10|6!2$%f4qSagOC?Q4HdP7)$D?g@%RiSMH{%Uw5m(YqC+m%WbK z9Q70{QENaq48<7%XV|5k*Dqn>^kANkZo2?HaW!O2lsZHhPx#o__j$83PC#3}?r^ae zOy|eo;un*?vvUdeLLz)(g6IH2@FpNiyqJV4)a`(J#QXFN4Gk}dA@94ew!@wkAwus~u%@GW8^As`@cYPtiRDtOkQpcAhL z%ujGd-23;h1&DU&{P}Gtxb^d{gjYBbvUQz~!_}*#N&SgkyvLj>93=ha)meq99;4ao zF)`cG-F@rqyoDRbjHttn9}Ri8dM;uD`At#c6E^+45VCgO<-%O~)7XTS=!9ZkLfx<( zv1*x-krBIu-AV|Y4?{44NDdQF!U>L|uN!=>-Y8 z5N&LQ)D}ueYy|~;%h1nEt5%)dcATd;bev6ZT}0(l=w<%6v1BVB-%lKAWCH|xVs<-tLcKpvHB7ooG4`0Ee!nU`b19G7{iJ#C?Q7S7e;<#4>NguReG|2@xj&b0PvPj73^< z%!Sd>GyIaV;WEg*w#*q^Oh92ESV*L#-6I$Wlvxbfjf~K0q3I%5B$WHZmo{)T2kjA2 z)%4m)K&i15YXEIRGn9dcEGz`EGD$~^)GgN6iHA-kl7NucLzs!>kEnEwW|3XKgMDt5 zu^2qTeC3_z`n~6tl0FUr?S*0P#=*fsL|>FI@343fO6EfrjTTR|F9<#Xo5uibffR4sltXT#1?FsTZzuW?w81P868Xr?tOpL@iR@~T*}l#hfcjAtm0QqM z*eGO$g>ezZ7{gmEs)vBig|#Q^&-!2ssy^o1v17*{fY9KG@YZW*83G3Jj=0>E$HCyw z)L%L{g`kK_tbciC0qJv0@_+pJ;TSL+{lr2&%5D&Q6t{;2o#gzPjeuvcR&RZ|d=r~a zPEIa0do$)d1Pf!HkA2-m%Mii}ed#vqN)$^3)5AuFOrL>)^dF0vIPZ=0)SaFBIjF3% ziDbgkDn2Yoj&E02FZRyCH1O>n7ONfjyl+3H3vi)UouT&c>gw2tVu$!807OK!aRxFV z2)z#jmnA|rbK$$dZN+I_$Z+o?e58qA0K6ev5wePbEruE%=M6gUN?i~?RM+7x(eDmm zfdni94>dIzbsv|R`o6$}nTTZl@38A&j7DH*ltj*GoH3!}Vb}~Ar+tI<52s0UQ|7O5A?Op;uZlZC!rozJ~*-x|~lj=6?9 zLJ2Qk5dFSEtrO(`0I3r7GER*?k#b7k`_o8MGcu>skn>*StFudx-^pe}>BNexvKclS z^WgP?eIQ!IRBUz*6=@0(k#J;i0o~L$u_?q$WrSW+>TV76fuIb&zN?AW4nl1M zRWYFe$#BGI2GPao$5Grvh`ee!&;?*lEpq0qs-<8ci3 zh@xo;teEf!j!Sm@?0Ad7?FEG_v0)(AJ}m6)_lREt%qf79citaUhe1N?wI!UYhGhW& zk&$FgoUXNIFQv8vR{*3IvU8gjC9Sf%Dke0~Mb*F{@&0d*uiIUgttrZU)mjKW09etK ze}dYsz4Z?S0VujMhm@{mExufX?Fh6K@pZEYar^m%92g|;S~r7VlU;Y!$*DD+W}#td zG>p3JSxU-h6J~>Gm$l{XJCCD-!OlX0uY^{Cmy-e2#>1gm>}bgJ;_Ss{kKy(qplFr) z1_pNcs*FEbK&B}DnVp;rZvjN#f%>@tu-8wdHUBym)0*_WJRU`2szhX_L?cha6$ZH9 z9$jQ`pPF(GngSlpg8HEV3oG%?pbE-XN_r)c$^nlcs%TV0UDULMl>GAZ8hKUL;V7Wz zF<>Ffq5?o87k}9dRVvA3X}Y0#<^QO|G}*=?I<&N*%|p3^tTI@wp+bgPXa#}a6?aue zu&iId6e222Y!tK263I&-d29jjNgRwIcq0;jlS!mS9|E-?)o4kd3i(^t+f%y=+mTe) z=@yOjp`DMYz+4T}Qy{P{xRi!T{!*x;4=1C? zL$!Nw={1tPgmS)LPszoolvr$#js!I+&?_zg^O!y#dxTb%2^hYziaDAoR6!t?319rg zV0D7AS^;+#(I0L4dv6Xej8-CmbTZ44xm+>!$vg%KebG!1$o`dWw|b1|sbs_ZV@+;N zrk|I1``DEsY@bRNL0|J^NXiF4#03MA8$60+2o4*X*fs^%orhzp;DDlkr!2Is?HmfQ zaLn=^NjZt2Y{kbCN099PtQ9CfF$X5Vxt$h@qrd)nt~<@UW;wwSNorG5ySB+Pho#AF zR*JA3Ag(0PJ@$q6>+`F~z_Kyz6v}Yo*#lpoR@MRR0&CQL&LcHi5ZHU!XgQ&GzzaQk zdoPn|9d0x}vp&^y4c2U0Wj1fIb)3nbjrWOT8A&PJ3;!|H0DPz`{iGQR-e=|5dEY1|1}fB#2NsrC-k$A_MC;W1)0~UnQ6iNMbssE zGb&M(LZ5m@P}IB_YV^w5ww5$tL_rGtn#=%#_nQ$FG+D}+T?q8&&$^NeM@GlO+kv?| ziNJuV!PsCXAN}R>dom`Ak@kh169X9;BBgxC*nG3FaH^rXEgS@I5LSWV0PfE-;p_YaSa599Z|*I-{?Bt&W1%pH0JPUQ&3b~R-34I3lV{o z@WY)SlgA1-{H{`1X5yDE!mtFE0Yrt0VGB{1gB12VcMohQj{y`B;T+2x7$cgu|az=^?@`EZqQg zH}~}P>^*AwN?R3hl!qGAi-ZBbpp3HA=1VlA+_0QJxfasl>_PQUMhsZy3gCgjM$BD& zD2c*tTD#83+?v27(-R{Fm=+^rU1fl!3chOMeo0}|rz$SP3r>dg)1%T~?#1rHwZBy| zT(x)shNJo|R>cOJ%rZ<%Of)rO2EdiL@yEAR4(|co56SmGcj&mvuhAR{UkBefxD`5P zsF^q8b75BiGRG#LVD^~u^M};b9;O)P`iKvRs&J_$+uL9McTMHHoi*vm(A!=NN^g-8 z?ey-`Xd($`=@N&3-eErSCfmMif>Kp$6xAH5nQ z`p@o}&YwJ<7yezVs@oR*mq+>e0$dKU<{$%Rw=d_eU&i1cvs@3<$E26WI1qUVo`j15 z+z5kt@n^}xx%dh5^W*wgRN#?narKQu%#=}7`dC-1rN6>IFUS%x@cR!Yn(djS5-rYu zu7{=4v-w|yHx`zfJOA-|&F%jX1o2a9q5r1n9X?F?w~Nt#^@kO)PCe~RTmpiE%(VV} ziAEoA=RxCn)3wYKcpEXN0nU~Eo7DwWZe~8P1`Ofyw)iavbBaOwUw%-Be`H+Y-L}Rm z?mxbnt@$^F$NzeZ|2L*a|E)#>pdj<5?&>Kpenq@4FzYGJLa=I|y?-QPXqI6!hR7p9 ze%ZneiP@?_TfHaZ1rn*XvyC6d3r#+lxs>vc9eT5D`@jGqg2+8_S4v(xW#nX-v*A*6 zXR4c#g)h&JVr$g!;NT!=$F8#b5}Mp67*qCTd-CGW9-&U!DIKaVEN+P{E&wWB|fpqR?Qt z)Q}M>YFHN{ls@vk$)gAspS-bgi+oIv;MZO9zC49RMa}4at>W^J3ls;-@u){9!54sFlVw4s^O+HD^8C}-Vs z85%fYU})dTEOyWFNsj)~zh)UZIg$-7V~tulVfwcx{1vj^75nub8ym=vn5dp@dOYzc zw$Hv@J+9~I%zP^e{`uuDbw}(CnB$ew~0o1i3-kCMCy7!o~RuOh)lXN9&FK4c!zDo zDXCAZzm&hmdZppfeBYU{BndKlnaMY(_K-t%Cy*tv!z8_`a){_P%>4?0AOf9We%=wj z1n39`Lc$x#P=#2&Sn2DR(9W&%D(b%eD!s@eL!xh2a!}Q4T3@Ln1G5}oPeb4KWR2vy z=jr&zerVn!o)!QW>GEPKtKHrwvkJO z&G&;?LL7?FJ0R=IQYibugY}v+kGYSt}fPG1XNFueR zHc88mMn&BYtQI}5Rw?`*LZ9X+(>~Vpr1rFrdfmI1(;5_tP zSt~a`M`=@Wl0h~`Ukffyq>1O)(V7cxy|QY4r(0E>g7FvX80%sVd(!G6BO@1O(k3*7 z(u(2)ZiwF-ozl^AQnc{iXW#wIyJ?~Qcx7~4`IDS5aV0U1K8IrCS8smYp{}DCR;M;s zH@Cl}Qq%>;Yi~ZB6-Z9ll}sP8;j(4(5t&Uh_sd9VwX^^8&59U<3bxut@e#2@)7e|X z>U#Y0g0uVR;x=QOB9tT2UHb)@Fz&HUb%<9HOYQmAL5)muNp08YJeZvvoc*S4q<<)> z{Dx!pXqE;?es*5sw&WE+dGHu|)20?D6qNQfjOdteq`H;$wAo%3d2&3Meznadt?nS* zOo5_p{!}QitwXy`keZs>!=q?3F8tC#BAhnl$QJu;Muq1l9C zdQy3#K>twkR~47?1S!GP_UiWu-WnXrN}GH{n%32f+_8I-^WjWtw^>2l*h!<0@nx+8 z14d?CRe_3=v(%}$Vb{FxbeBlor0!Em`Z}FW%jj-p<0r>B|CZ8IdV(y@e*14mRYY9Rr z8f`Z8%Pj!J*MOtL!f;quHyFMyYcR_sK+IaS7|N6K3JSZ%0d6tlPv^VezH>+IGtfL1 zba88l%`ti@wH7G~-JfAId$QMRKqzZbeQ2}<%edtMhP(~_z*@-FHJ5D$NSHGIWmGi~4D zXXivf!_GuDu@_n1AP=222?NkX{Agm_gbZ`E0XgkC^KM~GdTnhPmb#}^+kw4%)%o?` zs4m-;?B(UP2Jp;$cZSW+pFckgFS|#g*3TI>+YNjbSiO4nVcZ>Z!!=xr3JY&z@_ZYu z^)iMQqyW{={xnMSJI~TlSZWQzdg(5V%z9>>079Y1sa>`b=r)0}bx&bmas?Z6MWVsVoPGNg`AM(Y#v!^C{nzpN86rdn&o z^5umXNy?+p51qIh@)e;dAgc_khtRH$Hvk);#1E4@h6z^8=p??0;2RadmeqZGG}YC& z0RQb0$)}#(xoz8#m7J3G-SzBy&mB!PfAsXJAUZ~WM~{e)36nkzWA=U2sKPUQAN$YB z;E5s0tpnD(g`4}2zHzLdBGXxrOvyMr#+7@_a%7y-d)NuL8?(yCDIbxvI@R5T@~2V& zPOm24k)aS~y2M#6sc@N+(bqJyAo2w#I$u75Ft8?}_G{b-~ ztjbdE#EE;y-{9L280HQh7R+Bz-cyU_0lHm~n^2kw*8z(V4M}7!yPZwAUyJCXF(nSRTG7;@BxxZZjM3XA1!kXK zIDdX;=X0_=NfqMSo-|$EF6J_k`V%g|3mZZ*QqP$6yzX~(tLfA+cK|n`kT|Kv%xJZ| z>4-=2BWrcAx;CRtSje_AaQ01W*7Kw*K_OhtUB&%Wb-g7v^^om)!F{|EhG*a;ho?rc z8|Haik7e8vNv4X}+xOQ*C!03`Nr{=shCOmdU9ZhlTBu*OxxlPpiOJ_$p9#s3#H{yY z2zAIl$yMn^UTj{tRO=>}F|it-(U2F3LL*|ld-hcFa$#q*08=M*}gPiEOA}E29xn&KUnD>Bk304=c2Xm=> z6L?HT7(wimp8lc1vU+uk?U_Zz&-y`Vs@0+ubm?86D6JRX{WL0%}S6 zU<|{^`t{^dES0BXc3g#q(ppTz)&L@Xa6E_Z946_Yj`edFBQ@Tnm@rpe0P1(K%(NMp zu@eQmmBOSA0M6e92|mgdW{KO#Gk;^<8ZzV?92`HTmW8AO%$K}9$uw7c5;I631b{u? zd)Y=YOYEREK*Io0Xx@R);D|F=w1OikuG5Zq`rNqv9)Fx>h8Y&gAIcPdA-GQyUCs;r zOm#8^Yr*_=zB^`Nu_TAh&Wz=ITK!l+c?_J&)MPV156@w8@mQ{6MNU7zpV?#Ium1|i zCA2dw%9KQ`-XbD$3PJQPirrtE{NBBld*G6+rm4w;hxzPBA_>#T1BV!xVRWph(U>%J z_@QL@OT5J^pwjb-xz-tE*|OYN!n6(`FiDN%zZSqf$`0^24oy)GRmQ{kg~QYF_1;HG zwGEXG#?5|zh|O6RrShR&wT^;&1E+Rl?2Rq^_Ep6RXeH`Kov4m03!g6dUZo;KDLIQs zq@8IK1uL*MsNq(VmF*h@F8Cc}=t0bbvVW+U8}xn6)f4k>mnKUktBrz+tCZ{f(BWbb z;zL>jXKz#L(&?i>o=bQ~N>C=RQ1mUt-CM+dqY-&fdE5ZGNjujuZFLit(P11C0a!Oe z)TZsW&1DqUYHmt_Qx9036~>B zZeFFw#T+&?d|Eax-#?6?vW^5|guEANZV7A*Tco88!HBvINfi_n0w7du2A{q6^8m@Y zgV2@iC>{XZo4j)2JZ7LEt1<6i2b7qNJbkQxvZg_QxedoTa)5)z2Fdt@@ma$oh5G)hvR0yj7JmYq9~!D8?(-fqW&6XZL+ zvu6L`qUTbfIy;(Bww{Yi$aS*sz#!EuS*$%V{YrTDu$Sa!sjJ^l;{?NZpndNc9cVI2 z{?T3{VPD)&HaQ$oL+D492QbfEjj#9Y_>+&1_bC8Xy$z&$$H)|r%G-FI7dWt_W*Nlq z`CJZG&@@z}+WnQyDPc&ugh>*W*Cy=<5HKcZfNU(i3}s0q?$XRdF6C>uxCTb4%6eh_ zba`*RuZ#!kE@K-!e(+$}6>~CDiaZPoiU}c1n~;hstEuz7P5DMSvon*WnS8vw@>6hE zUkCoFvdbh;d1h6PY;df`6ESFILtncV)!r4;?c+IadD43N`uw2XH;;~K31&>_nq!bE zx3pO#49g(`A~72$jvp9h-NghQGvLjLU5gmVcM6hB__&?nu(o!+1DjY#h!$n`?wvbv zb(y=c@A`Hd+D`QV24i+pGN@m4_WWTcw`lMw#6&V@HS3HcJ=E0+Q z>`8XnBzCEPs}0KXE!(#%FfhYORk@QbGpVM|mR`aj#whl6VR_TCp>yHcuDr$EK{`$= zOQ%=GUl|8wY%6(+yhcOGQohJ5srK6qT8@^_c~zRl<*hp3e- z5o?gznK0^BJuP7~0oDzj+acn)2sg+<#GE@Ym?g%lBvZA&6U26PhKLE_Nh5O;kGQz* z(i#p~`UCUAaML)XVlcIcs-D_Ix{A8;Q!46PC<(+M_g8``~GFzzxC|AEX#c-DW7}QYC+=KTZE4V zx-82?WfOz1ns_yIa z_eE{H9=z#Gr-jV$(O_$e12mWlL47e;EDI=!1YQ$8ysAp}UiPRe)8X*I?X2W8Fa!&o z@W^7f$w!guB#$f9hS-gkE_wC)v*Tjb-8F#h;R0jR@BnOZ}=IpjDpUeh=j7#J9x>JyTW4HzTS);<%6!qLW6&C+jHJ1NmE;o}u} z@7wD2qjt;wFB@+tE7AO^ zpWl_QttUbU0B`K-^t`rU$z7BxF?OZM=?PlNb~Hf}YH_?r3yC8b+pNY(E@T^S5fuCt ztpxKa)Mbmzb8(7Ap~<`NXiJPse0h&OZK%0F!Du;R*&C_o*O0CVi&%v1p>KDyoh3)A zHI5mqTEF|P`6HBjS^kq4FRy`lwfcm2Rs~LP2wnWJ?X2R(e$`tYIW7HTCzBNVEc2bc zorg-chYp>hWqxWLm*@QSnX#~@le+cD2fhQ_)eeiyPX0fT2EMyCl^r)d5Om z(uj}{-Btf8f=r^Rf{2bpRAdY)o^pOGdQ-w~Q0|WPS!CXrto`a;cL*6r{VH5>M!}m9 z`|A8*v_Q%xb%r!J>MEmq(vDNfoHmn)iR)2vDqn~E0YyN&?--(xSZGj9yWeasCP&sF zQSPy55Jg238RE5=k-aP3vdr{|*tQexj*rnzlPe<~_i+g*uC&IdrHsN1$UExl_z|jDs9YK71gYO)@g#ox zp6J?2_+li;rZfV>1W1oAMjm83sOh{0@+Osc1l7V4cqIeo+VdHRL zV%19?GRCkB?l?~%=*`Cvu>}|?$E1(Im>1kK@L@2wdl(QvL7?s-lTHxkaV^Bv3U3*d zwTh9^PMi(YvXvY57IxR8@{$p^>+MQkmDU{?6qL*y0};4Z~U_JOF?tO++8X>GDI3u&rPZoRC&N?@emZgs9)Jx$s6JtP>Aq+q-XH zD76G*Y^)z^v2?7`?-13`XCT}IV%&_TQWocu5jHKdt3*-6OroD@PZW+WLZgZE6hhUb z33m|Z=cu>XXdS>~@~FJ1*%DB29@^i?$igV0Q<|F96Hj{K%8A=sSCG#48cRZbwpk3a1u}J=MJPPPb>^fhKbl7 z^4u8dQ{WAQ#2wQ#h_Vl`Bo|hN;K16t+FZ<7!J#04JYkqFrG)gj;1DS^0GU%2W^rXn zx#@a&&SHq!OS2oj@fIl87Nmt#r54{G4ekRc@CZZ}#JN1iwTe)Fhi&xrL#p!6o;{1q zyAr1XV!?64wmjm<{deHYd-fZr znoEQkpkMKN@5n$uk|_aW2+jCZLJe;ikrX>|MD`_Hv1?Ez%R2qYF;U>OVALTxuo_B2 z{GP9Kb7;p{hjXVOA`h;6E0~4|ti+fbm$DeVJQFw3iCE{P2L+24F5HZ+cSpl`HO0`T zt^>(I#09)~46r}9heTePdSB9D@Vd^rA8vLE0pan?8 zR-35S)u6}t8Q0!JUy4y@qC+zEFYKlYBXWB(;+CN3x=SfFYENS?mBBpFVSvnX$K*iOl_Gi^} zoSY23e!2VrYqj+Sv#+N7TzX*GvWh%OthM9|Nmh9;{&m61a)Xee#sF&TIUu*nBU@!g zXW;Fg$^L|r7M`A5*4C<|S4_Sa9An;{e|-laGYbbtVj(4O*o!?w--qtXoxfGPk;!d# z+P+=;J0&Mu3^p%uM)o5Ing+8t#w+O5(!jo}zKepJ7|eBmW1mb$VQbmvaM0zRg4kCY z`-TnOzF|Pi;1vD|Js%kpkYNO^Rav>N(J~@LWn}WDXT)^1Lwuq|Thk`WrssiIMsZRn zeM-q@>`8o50w`fY14{}o<|#$YjH;nAg218$G)%$450ou3Y220?GL2nHM(p;((i7_s z} zw6xIC1Ddov`jz0U=`<5{u6;INYnrZ<*5=gdORFT%c+ouqi`=DB_@-x;>ij`DOggdQ z{tNRM?%;uzkmQf0l;^qLAncqpWZS{+A}l2}oii=;zMS$v#M$$SCEq!-yw{ZQ6`Iq> zU6m@vD-7s%56hyG_GNyQ8)gk*AI0HQEZ9_nbj?~rjBCHZqzVEa zN!{D8<0j|x$AzXr!@je^+C`ZhjR3Fe(U0fhR-2!!N%a6&(3MX?HR}hT_JK4l! z`jfg-I}I}p+gi`U9KnL%#&prtrj^GqE35R5$ut2SkL;t7tR#E;`#GS5#SDD6CWtYq zMfJ<@>jMF~PK4lC+sE|N`eKv@oJV5H%f@RDtC@$w04bCdQ^H!R)lv#y5qxwgBsgJ-^FE`EqI*moKR((Veo{>z6Xa}coXp! zTDn5C>)-shQ(PMY$_=J3PDTW0FJZ=m)^n|nF#|Cpzu~5{L4Hym+ zYa>F!E#`DOp{S9YEN$NAY-AT!&WqCMwi)fL6xF)>5 zOl{Q(O%e&o-iu1FZ-(kgzT#MVki>fp(kVX0C!A#B*M8!?~g6e|V%pGb>YfdTHXjiKX(arlyBP|x- zLV6m~VzP6vIVfpi>?#J+RgL1+LzBA_5?vaKq6B?LB~R)Zm=1UL$N5cs9@VR^%oF|S zAa5{WlS9ohGo>kJmp8uh(WR?LCsk30b`G@m>s#mLaa-1P99Qm~t_PJ3An8 ze6QkS-xD`o6xXhmXBpdaF;;g`BBiKyxvtk`V}n0F>zdWn3M|an8A~zUZ_%fa5O}vm zg{5#U8|(gFJ&%_Sy?*ER?z8V7VA?lae&Tw8uLnbNXX_rOeGt6%hf1u;5gQQe6n2wI z9}~N1n4ebHLrHvRE+;b}}mMou?s1hE*)ag=xLuN3< z<%ZUN7lWhm`C>@QW-!}vDiRym5p5d(=8ZOp&6U_r`;7~4=MFihwf8JtIA6T=-o76n zw)(`vJ;*l_8pGn4dtH35hTk9>07doR&AY(vgr2LQvGG6|`k5qH>2w8~B~><|6>hX( zlQ?fV<+j?+P;bhuL0CyZFZ~1pi$4!Y6sABg9U<_rODJ&AN-Hv>-=nrR>73Sj936)i zm=5a&9AkguC;xl~hSNdJe5uzunx1{p>%HHZ6H}OH;y=|FpR1&o=dIb)-^*9hG{3mQ ztn8!wiJ=2~Xz>QU>t|e=WKxSJ*(ay9Hn}*t*#GMT`V#UlFfcH5i7s4@|NZ)BGp~Zp zyt&`V?w!AA?$-}iU&H7B_0Q2evcF#wdHC7fA2XY zzAkr>mwH=S={-IB0rVr{sa%tlMH#bv@eN0G?Ubp(;xgg#HUp}ri%Tv!;R|Gk9#qs8 zW36*H;$=RyUG|R@e!P7T+LT)SmxN&uG{2^f(9d8cEtSH7+~OUN&a$pt>}PMjZ)9X- zBNDmmR4Z2xY$;BBT{(A?s2>DX9L@ztlhcJ7ZOQ~D#`0$qjiy@I2F+oN;DK%@21Hd^ z2!;%D8V1H<*ySM_Po&f7Z7rhtO<}vs)rZoxC(C1usD>Q33c@c62fti3_ui?gWm{Q! zy0MNmc~)1#@@MP*o(HoCnbr06vGW!z?t-U^>hAT`aNaNpjwVcQPdRQW=y@RJ3c=B) zyJ+ca?;OTqQ<5g<&y%fk|NeafTW)!Ho5+P~s;j%O_ybLY#ql#~n0o<^IYnAN{FEjT zzAEAU&?iIa9S;gE7Jo1>U829mr;xoKZF;Hub5wj%QZ2}8l%lm-vFYij@TCuzzWn{H zrfVz~EywsQJ~8p6scD=frw>m_>)=HQeJ)+R2u5`s6dy0pccMu=;VTRSDSR3ovhvDM z`>%0OqpboK2JD~~!>s)fP%5fpU`yBpVPVNvD#R4PU{6GM8;LQQk<56BitXEZOS*6@ zb{$&jc3W|L4_mYqbhrc70{Bh@HroS&f6YlPgDAYY{1z4ttGDwuN;#$i1xd!7V7f~| z<}>##b`%i&F2Ej^CI5aHQ!?3W`KoJbb^s@beapS%0Opm8YjBn+?5RxgeRMHd0-8NA!J zuObxx4|5EYZ?4?%oDdN<-lwD8_N(gl=aG+4Tg%GIhv7k;{+0WIf(G$G0!y%fYii|G(`sReM!4LmE3?Vj(*+f>S zCSB(VwWFHaWH(NLf1L(3aV|Iw^rrm$3d!LUSUGe;nP{-c031g8nxP!>f@ZHX}afrCnr2 zh;@cUVEr2ssVtE6pB|pRHLQGphRGPg^rjN9Ofsy(Oi`*Wqp&mHB1dnxcXV7r0uYB~ zz{r!Pscm_A1*mU!1eHbkDT^xt7Rp1<8Ur(M07b4x70B7{wUaeK9Hh^G|gLVG z)2&>ypFqNgm|qAdG%G5{XjEPlmX_l_4~VDq!v{$3Xu=qU$C+x%32(&n`Hb)|0)>X2 z0+&lF(PuP5hYS44kH-aTa<7sGf}3uZZ5+&@q9-OCNmRhPJ8Szpg~+`9J~?e?(_9go zoUDbQ%2U!g9QXXW+@+0we9G~Y7UA&a8K0h6XR?RWXL}y!jo_M->eE=^SP$F$amV6Q zQq+%$v*kA>-@JMA>YHysU2QTE!T9!b_>HWYd#?3)jf}rD&)Yo9pcu*D7cj~6zeqlD zO0}vl`x-5Nzp{66!ERqKYBhq+%`<%LjAhMM%sYD{8Z7K>SpNQ`XKU^pi5R?vW3n@5 zCa{)_&s;aB(IKdweT`6kk%K7=K^_3%SYN)&H7*I z<4bxXdDOdC%12bT?W`{oV`l`f$NrxB-#_TC%)jw|{Hs@LXq};s^WzZ(#xvGoe(C=4%V#HE>*Zi{j z%Y0AmM-L>IXvF3nzQyQtI3l`U+_rwJ$M5REmiblzi&03Xl$@u*a@N#PkF6U6Cpbk6 z!%qj0|5XkYFwcGbr-QmZ`IalNLNEI?`fn+mSuyuFqps$h|I`L9O#iAYOnsIthfr$g zjvZ=>ig)H;lYN(t)stwHZwN>asH*zOlL63FrGm&KzvZDv*4$e@o9=xj8;-1wmt|pd zpHx!|hksZohA)Gv%@_?-p@1R_xTd!D5{7kDFcqLQA=TVPOoif;lT|F%&AnOb4Mrwb zBvTO3h<#r74JPSNSn5t>+2O_mL-f^zVv(c@K#*?$ezc7^nykNxV1&Uhj93$ad}>{j zb$|HJeRF4AMcxwPz}+q&tW11#n~8w_Pfa;yU$`=Ml!;Cj1oYJ)9qR-};a#=ikWvY& z#R%Zo8*YX}sc|Z!(e4Ru!RpZ^a~Eo!d}x6ub}zzs*Q2xEYQRh`nVFr`(h5?I!9xck z^%*CC?^M*qOc{_)yq2MZJi^()2xxXYv5x!fdi*t%p;)K=U*2?)Vv4yQDj=c`hbO=n zW9|-o%qrNHpoB`{KhEX+{hG6M7%~vanE>%G0i^ehgaBk)@9)Pi4ePng>e|rTzQ&1HCOC=|sKlk-5A1Y`9DFnjG>DHp7;OM|1v6@ADA<{g%mA0;f2L&?|BMM7Ot zsZ^@R^xPZEPImcUdj~T#R>oWHcG>$;tw1%hi+SlqVC@qnDz01dn}if~F=E54*w_B| zmo$G-wP-mYfGP|?Vv(Q~eMyRkELU%PsI6~*-lTCeR$sxdn15#H z%`+cT_)+ko@7lHT{xRR{HN4_3#y4IZRaFjBu#^hqRv8_Ym|k$rozy-=@C3CT9k!}D zhL+Aw=H`iD7fUGKt$RpT+|C0B4j3}^6*OCQVW0ca`jr0(vgfcR`B;5X?ciVY0o$=z zCThgB`QitDhyHq}RQqS2Iy5*pcn?T~ot^#N?l|R(tYT%i=+5>n4(KSUwCDBlIx%5nF#Ha;CfWjLYsgz1TF=Qk_SRJcS$&m}1LTvXWnX5-ce+XL(cD`( z-BRY_1LBr8uK4?+LaV-Bn{W0{VEsSYbp3Dc>HdHJ_NEyN7SYoEyyl*->=LtqUxfs! z1algy=(|TEN}kL;YS|^IHt>goc{m{8_%)OoSRs2?9zsZJwtA#G_cC{>%^UBNINvi; zx_hM{ zKu}qYpvwp{dEpVB!&_K%0@n(e`S{J1G7JJm=UIJuVyaNG@+uCdq^Fi$yMAUpu6S_# zk@1=N;lB&1KB0BngpHz~X(&5HMyvjj^5Umriudoo<=C}ubA7r%Ow|{`GuQ17s2+X) z;rB;~pK@BXw1g`Buk90^ZWJ*0O&NNx{2xRZ{tK&d@04qPsQ#OX6IK2|Ci1T8$jf_9 zxw^g9?Mq0zqFUu3+&SXdK6rI?shxc9RbT(dkK<7ODAGUG%|QdQ3bb~X@Fne&Gy{d((i*(s^JOSAY7%?3NT6cSCm{cpy^X@WjW( zRg$V`{}W@>@(Ed4y1uCpAFSH2_b>tdaOg9txwT6duBILU2M7dwze1Z}LIHJ|nHbp1*I}X&ICU`{6H!x$`mNcyOYM04+XlQ)f9) z`Z=QdL!Phs^ywLy(YP;Q{6x5#*gY{-j~n!#&=Ogem!r}wMMJ!PB^^uz&HpJFBklYq zkY8sDE!~8cPKe+fPQ9;o3JRXWM?wB)q7(SMGWM(Uu#&;mW=}^@Ypc=Otzs8dO-oD5 z8YwOpD>;YytdbM>cAyR#fiTR_veiBLeIIx{<2WkZEBveT!dGO#hyi^klAFF!0Q)U+K8Nq~QuDB7DZlASPX_>TBLYpl>9Cm>NYd( z8wrIuC zPr!wmAH_4hqv7_~&ucblX&*$$T<=)w0oh2@A!Q5ahrRiP3{51MF7@POe2W{VoF z2UrFE#KK0S&p2a&XWM>O0(#^E#n>qzP_w6)J>qqR_;CexYY&15fyxmFya1j)4+tHw z5%U*Jk59oz87LSlU_d|&QnORTq}A6K3wxG6w_(GE3DC>- zU+Fl355og?$TiHxLE!|sk+__-HBJ86vuKCV^BQ)<;xBI4*gx%s{jn({&4yzpr-_M=7`9*nz~8Cu2=BZTrKJD z;)5;;;Y{1@02sHf`7+$1-yL%WN~wBJ7B0t+qN$6DKJoZD+>15IR|S%bR$@OagyGS5 zj8M*C2XH(fFp%tPvh`~+ERCe#gFFGpxQQFP)Zp>~s|jU<_?>)w7b(|T4QeFcs#fvc zfd6-@<5T!O6$>Uhe8f#{ILKq52FHF!z9b3$Dw zx*dVNrP;I}8|nR`fr#xJEM5!7pdF%)GCt=Pxl$~7YwF80H?W+ZS6c$_ZhhajzPdN>sM~`NB+P{BJuX&(Zc{gVP|?0#Gth+7q9VVTe-O1 zN))a9XSzcYa0JYHQJL6e>JNr-Fy8VO>v;4tc=;au5Pmc{cQhF0SAzS6g}bmGvO3=p8j952&YRBY#?DPu4fZ@ZhRI$x=qBwfgRAA}Rj4`s-F~G7kOusHIc;omdilcnG;^8gafi7Q=+ooAQ_tq^ zB*Q3E_Wt%cfQg}AhWUR{+MB1`yly^V_Z##&ePI2~hx*mgzY`h^InV(DIO4kxcJ{IC#A{FM1oFgT z_N5E+8+5!I!slKtyTt2A1Xi^ss0oOaJb(}PWl}9@?F%=HtcE4m_1*v6yTWEGJ~+$+ zTeZEwQ=!Jk&jX0eoGu6yQhJdz} z@@ynI6UH;RU`YrFYS@@(@~uQ0=tVEhvukYT-q#LT=`lfi>c1M%hN!$ru9V{Wi}rgi zClHN!Mq@OHz+D7r=IO@!)dGmsTeuug4*fN}u?$|H%7aH9O2LUX&Q-KJ{~0p)};&a25U+I+z@n~$g2MNPB>qu!jNU#MYpA_C^V0e zJOiO_F2*AMr$FVbLAu7bD8XEaSENTfvG#*xLG4v~uXqTdk7?Fv!*cjU{-m$z9?dW?=Ql zqGgl%kVlgFjX%bj=ulBc1^v^`D*rVy_!~Y#$AA&v7rU};C#tGJBYB28Db%6kv3Sev zt(e9~qPo5WK20##Vp_+BB_$=(R|B>l_l7%Xl$^d=o*lG4N?3vaX%T)ba-DuVz{c=p6@wz&tDK z=N>ftn6BW@pJTE@;MVerx%KUCaCZGo?D@9AtG)*)$0jwOJ-FoY4*cRo%&7>5s{6(& z93{qnSe{>f#=LZ)Fp7YY?yBvsCur#?i-ggX2EB3GD2`JrD4z~4De6f^H33K2@T9znOAwJ9g~8}ej4lFq_o;1W#=!WV zOb`#MBG_xkL8KSX{`W_?H$L?9d#&ZMjLJ5j5c=oX3_Oa^_o<>>N8@3E6Ee)d=I9W` z13aD9GTx#w>`gUAgG}Ec92u<*PkC>DO{GAyBl5X zRH=Uu1}B++e*FI{BL~sW`NFN}=K>8H>kmJq8yWgBSu( z=4ywkOv;Vdf$yLmp|AgfOpb8U;YF5hut|gE2xV|DcDPNZZ3%Bs7pC+l&!0c< zylL*kvVs2LFa+!j9!t9aXq@aBg(G}K#0@U@C6;YR)zNlC)m{TN!_PhDw7}xlO6ZZ( z&XxH7{BdmVO?nwYB*6_|H2+$zapXJcwR|Li6BdR44h`FP%eMdOR}U`XU`?Jyi4||z zlqZgEmek&AYL%B_!E5+`s3we-vZ9uYgFaCMq*GrW0i+is2vo^rG?wZxd|nF7K1UeE z|0pw>QOCvK9Uvcd34;a!InR#&C^TkH8;~oP;kQfnsR);vS&9bnZJt^3UnR#~`yWrD zcOY6}x~51i)R?W0Mq z@M{_v!yLGO24F*G!sQ%0f&OAZroibCNhb7U zbgo4b*~5OmHAlJ0Tv+ha2M=`-(?gTrhtQigy$Q1diQ!G(fSmA{7^jj`-v7! z8_=U7;o-Kc15h9d5|=_tZ#99QT@5%OJEMY^BZhHw2tsi98#$o~hIoBRYbpVC<+)78 zL+XI!1!9NpyFI}Jo9-XMf_44QPBjke@C_s1Bk|6CtNV!>4YkxfdHj}P(gO)Oxo#8F zVxUX-Ou%`X8X6H)sxGdo6w|qBATVuKqUUJo_{HkHJ5A0W*GzPlMQkwksqeaeQ5Xy( zNeoXxdU*eFJ4n}Pw*gH(L{|Z9+gaMk%MqL#e*i&XDF6k-ccQlF*RWoNWLE+0_}~@H z4wn_9+a9cBe0VgnXcP?Kb)9Jmlc{#zxIWnnvd_qMKJ&y!f#*Z`CupSc1dvq0TEYQH zS~@z9(JJ}b`pIgND zZMr$W-A>l!MG_F~HOne1dxPY&anmOJ>AI$MW>tN58L^#q*?*TK9JZeh4nBJ>7E={R zpdp>t+h#VNZB`uG0}u~q%Za1dEWB~2ezacmh50MeI(*Xki&l6sprDx$Djwy_h?rCY z;L`+838JY45P$}~C$wW6GAtU&I9*X4Q}O3YUaM$IX0M7k0kOQgFoJDU~Rq$k@_2RDqMDGKv1rR^^U?Tvvo45VV15KPOm@r6*#4^Nv;kAt}jvl{r zpW*i5EkGfLu1ey)mh~0YUWOmVDa>ji%8bI|0F4ZHodCgocDsO615*;9>m>49ugA1FaBs0#fN8|y-T(l~BwAtwNbaih2B%;|QHM+w_kPV7Dc^R{{siFS1p@!UoFm zD<+W28uS()Fn-qFKSBs=Sd4_G0R(E<$iyhd8D@3Id>N&Gp2h~mj-?EIHNcYg5?a?7 zf+vT6tGdC@JSzGgH6-*tF|5vtsukM`{3=LgG4C5eD3n?38LT+N!ieUz@S_FVQkyk#(d zp0UZLjp58@Thq764!fMKVlO%zp+>F>5E>!;k*x>p?h>3s1}U3@xsEG!c3X+IRB;x0 z*XZWfmQK6o<9?-~yj{0-i*XfWQLXt==_A8+tFsNuGcszVOM1_n{bCEq6aui~JA*M+ zhs)Tn$MDv*knyqlQD2R{d-L+`XTo=fOX(Zk)A*|z&Yrm*yzWpE5N{A5ah6#!B1r-#P;J>RW8+ zx6RCvmX8@0y=KlF#WXd%0PpECuGX>5Ve7;&MEz;g}nULMQ?jkf^HKc9NF|*U!_i`#u?V zKgsuDhb86AdD`+_iDpl+4_q&LF1l3^XZ1`@O^o&a5x;aXJ2NGZdNDC}i5V%rvJ@l< z@H+4>f7#uzy8fphpRRV2!aK@>jDW~lfJSj(XMn1I?Z66)ql0L%~dGSEu5wB4*)vfyRc;N|8%q%$j&v#E< z1$tbb%r#&CI(`H3mT-o5H(_%Ep3}fLLU@Hf8F8j>;i|Rt!R?DDiXFMP9+piv4{y3@ zs6+c36*5>$6h|BC>mOh@0;kso$_M5T4&D+V$%K)Eiq=}4o(7m4oh`aj$dt2_`#Y=j zzyhRv084%T&S^L`;Gg?pU~mVrUkwCUWDUH$ym(p-c2>;%AL)C@UFWX9XO;;J3P-#f zkIHY`fD;($I|455=QW-*JLy2;!=Q8*@yrebsaBCL33DqR01&{vlGw7v45Ti^RqFM< zzptDGJqM64;?ZHRT~~{!w~GkA|6;FnG0q zOTl*vO^{=qiU;locJ!ND>yuz~j`R_^-`C+;Y+wUmEp7A3$;m-@1#Y@pi{9UE?!SzqgUKfMMtgm z3oLFdQ(dC6>N`BX7pt}~Zss+3u{%8M8?%G5mm?Vl7{uA@iT{{YYqDQ7CBN*&`Nom# zAW6A7ctfQAA@s%}(<1U>dg3)0)rTGmvmGormcKnrw!Hb92L-^RneS?;NJdWr-Kua? zRz;aJ;SuMyzdV(*R#|n`@NYb@SlJPR|2CzaM_Qa}WGvwgZik3#>&KCW(R!px^eqjB<@OBHx zWbfcE8i!KA3aDp|sadg!v6feU^{O4?>2-BS8_Ci~`J(7eL$XDT7(`SE+3 zte+%Jkl#AOk;fM9AkELF@|3_dJPJ>W;79sav z|CH8jTdo%Mj~xiX_=lZ$-ua_S3^E6D>ZhKW)t)EtBL1(B=$!l^7miAZc= z)E+2fW^`Q4I=1BUT;}p?zn0*nr9gr8h7>{Z!M7$;EK020-GPAPW?tHf1Ok6#O6)Vm z5JzFH@*Yl{wiNb211G(cgkAfgbj(%&K??1#GB5}t2)(D4pZLj~8yDsOw&!nuV1XBR zUs)vOR|uUSAor>Jc4sOMTs{V_i4v$t4w?~(*oS7U%R48iDTHH<)$%ak;mXiqqc#a> zIUDuIp(!V*ur74xe+9?Q+q#Tzi`!(M_b7iOur+{z@+%%`U)QQI{tnFPB&H3R z#~~n`A5Lp-%g;bRPLgBY zEB*bqwPUlK?{BJs^uMbH{s*fOC+cvz$Q6SBv%*-b7HwW69Y{IDO;=k@lK!SRDMZYm z7;tgMd;(Rl>43zZ`&%3CkK*rVdWpl+C>?APqPM`)4D6yGf1Z5q&EJD&Y9+KN9C;Q1 zEI?nxd+D;7FN}>2DZDPp;avyQYDfn~v?Ex#;WVi0MSza?5&VqQ}Kte@BqMJ zH)Ha>35P}kc$lU6+ugqR~P{iQ_RAwn5RMrT+79YI%ZUxg$fS^BEL#_w`B>WZ7#xmK>d zOFILB=APpNa%}^hqzP`<_cH^9)yYGeTnq7C;Rj&$^6K2RHTVAIOkUeYyJ}?ppKp*X zSuK}rAM!~-q(T$qv*k|hn~3NJYN^ZuN*lR9=RAr`xs(NL&pB6q`-{<`dQWp27wV>$ zg;-Y#eRm0I1>h!uMf52OFVe;Ee~;>(FjY%T7aCUc0e?d`Vjq`3eDB$xe>=b$X&TV? zaR~m4$6HZDcsr>1U>cf;bNL}gZj4;Ecb?ZPmPAd^$317p>Idu+3Gk}W6R4S${A&A| z9@*TEq=R&~6O-#l3i(q-86C38N%8eAUTpK2Xb1d;?t10eOi`0!ItQu80N55x+EOg{ zc_PiQeZ!((S|bZrDr9G}`mCeRFI=3(ewyCMW;QQIf7_&}+QXM%bSLUi{n-rXWGl8W zPl2ihC(w++9EkC**Nlh&Y)&)GXInw2{szBrZlL5tr%Q6VzPTZ^HQ<#H*8`Kd2Ct1Y zZJD*;xK;aqJVw86QIy6C>Bm^E_0VYoX)jvkx$O@Ulv5wX$KO8+5I2g$S8|KFY~i(< z;cFx%wO8%AUeUSfc(__{(7S3<5rMzqWB9mE>G#Z{BBNESGzj@P=P_}rQ<#KS1lX)3xb;%-AQ=`4%5b9n>ZaMnV7LKE zI?U>GZUW1Ck8EFn)ILD?sB?e}lU_{v6lz58apxu4qzNY7R>I|rC}xlvZ>e1j5ouF^ zwFkIFQ62czNR+3BI`CDy7cSWY%T5y9X;oXCe2FJck_!+>*Uh^|0^i$)I#7a@V+}~> zFU6WZ=MoH{0z-O$FA21S{5I!3&2NLtWOnAW`Dr}C*l1K8Q#U;BY0vNA<5J>_%1AVH zgB?Eyq({hF1rtF*BOif_o6#*i#ZPB#;+2B4UHMT}9xArb#F!_!lE zQdOo-%i2itDln?m(5KJ>j?LxAL0n8EVq2(^O%Oj3fJwQ7wpkdFNWsq{)Crdhki(Yx zfl$|${A2pE6@Xu`Ja9s*W1LSZM!%u(AOE@unalizzF*F6o6#}tyMJKg3mWS5Zb3tZ zM9%B5>d>JD40A4HY(S6N6=Yz|L1VQwLT)UwK&oywFk%%fn{F41MgxfBws5`_^7+8x z8=v|LCHcH-FT1k%5ma!aUnc`!hm=gm_m+C&M8DDmjvcrL6%#ct)KYcXZnu*9zq7(k zlD7^Vs+KGzkekzUJF^+3kmcjJfzPtd*er-sc#Po~LAG-oUxv%-CHW74WiDN^oV49g z3nS7*Mn~@>xTe8J)27;?DH0e|?H?m!uK95HB>@%K4hJw|50^nOvTpoI#TT27k0`u{ zSp4ogeHg>(E(=SFKeQA?TcY&RsRVB=B0Wub1kfS|GXd@bk;nuUz>Q%6x#5?iX73}R z#h2%fuM&jFNrn0K?6#n@ffaUa7Dghj1l?P`?67$UbXnQS*>C)6u28t-3r%t=-F~_& zO)Oi1B{{ewStkU$l=z)+S33+6S_aWa6yJkL9Da1;nqqNM*n^Tz;Q{L&GQ48)Pfy1L zC?e_tMFooXG@Vx0Qc24aho-;?tP((0RP?d8UlyPs7n%-lKbF)UbHjYk5xD+AeTr|@ zhK%$8+HPnjtwyGc7M_yg3?g1V5+Y_PQG|*86^KD%fI$)UP)d?Wn{ILo$q|nn3BLapmlG;(VVQxaAyId2=u$&GGt4Cu{yh)CNo`5z|Y@7NZ;Q zYY0$HIOxe8l_-Nnkg0=udU>hkJ9NVOaZD012X#NOTLBCZF%*NKP2kUj9>3Af4@3t- zAC116aODUTY}J26579#EggL5Dwn@xebZ^B~RQ$vhvAO}&0?*Y%+70r*4dO^E$lqi? za0|N+MvSC)FGqiXc2f@UDg%O|L-POCokJi}rSqo!fGmxzlNo%5SD0uAHdNbdd(3UK z;(*~G0re@^3Q1KXA!xsFRcZScOB5Z1s71YaX?yPw;kptrrvFs7Jbs*gVv&`T;p1Tc zYKPwkCE0$kr=GRS)H11D@J)pxHRgryv2Z-Q1A)&%Ia42#? zlE4*B!TBS(wSz)k-%^jt^M5Py;yVI6IpaGR(mQwTSGFq|men$OEuMcdyTAnfE$B|Z zsWqlF%QKd)Nqix$vK@+fUCe_ZMi|^Z`R4o#z8c0>*nT=ceI7k=?$4v?Nlqav6sIpc zbq)wEO@_wtYVCCoD)fb`7J2cLRSi5f!l)KvvFvW|!NA{%pL12^D@m$_EZJ z{IPI~NE>IWU-_$+3vr>;bfxC<$2b)fz2`E8a2ognmcZlD;{D*@8`P+|h3^w2z!w0)SY6d>~S z%g!<8c+I#F%#h0Tthj_@a_Zdew$Kz^6Iup|-~~}%2N4$Q8T23pOWuh$28MhN3j)3% zXbz}uZCF5hFF#4EAb5Hq$rDgSF-e>!fEzaN6@?-*GW3Olo#Scska~kEoRYA;p7loG z?$7j=8}gw@oQcGhidpdzs4Izh2!^E>dUgV9K^8}U3AApso^In=p=ku`kDX4FUnt~+ ztwIR-D^kCSIF&G>>_cwC10#Yl+hxpw@bw{e^9W{B~ z=UfEU)itF)*`?V_?YkNo7Y9xwav#NS>gOqbByC=4zD7aA$f!~E$_%qg&%esH?NM2O zodJ&q|2y1cG!M|CE*7uzyaTH0#h&_($?tNsu(Kr+`SLJ($B6A#aHw?-q);WQIhG zh-=m`iC9f({|DYfforb=ODz+qcV;wzzZW`3x_JdTEkM)q&NL!0oKiDzm)>7mq^}S% z`Mu?Zim*@M!J+2bGoPAVsJt~_u;!~u?EpZ4TW{nNN2-NEQ>_xW8;Ejuv8dA9HdXXkU9JtYNJbmccKRpN*5GJ-{3kD(X@9+B|?EDLD0~bL>>CPv0pABheTd+N>CIi3} zr|RWDEzo!AKR|9Sn6gw#@t52I=%3M;>4$a!1l!eJ-y;3MIe4YaE0Z}TWhfQkbs~G= zfglJ%IipQ-=J3IjhH}ytGQw6^E0su;9}XiIBEmNpO@8fnzYpjKS3nsfiDA1N1iNT4n8n_-6l24x#%L0E3Sf0AxUOx600m&YWvVE#p}G>zJ-MKkS+o@0li3w zD=IE+{706^w3%i~(#YW8L?4UZ45?FUD?0u$iS$l6Dg-_UNGPN%LZ2G43$J5~b4%^m zFn&WE0~hBY^3fNyr_urhCcm;tE{lQPNdyweT+lBL6ji^vC(LU>@bH?0Wy^)WDfe~b zL2q(Ww|KZpv14=CJCW&R1jFl&<%%kYXZ~NvmkIOn#+3sGB&yu=G&-i^3>W?+q4VoK z!jm6+&SUPZe}d;-++uNikYMm-Zr!+ z^g4d6UIJJJ0c1ZSkOli7nvh789&!t%128*2^%i9tX@}J5OjAP01x5&~6P(BvFH-J? zFJUTZFc^#%y@7MlHG@@`ISMLhVGVaK1xhrWZ{->W<2OviQA{gwjYnz*=M@tqSIFtW zoYaOn4GE~Xm}U~tiC&1>Pe1+S2kU3THQ@U3b!6e}ANqmtJ%D?Wuc2VqWE5)_u-mGB zD&?@BtV?QaYU{dmD5y~k7ZbNXDmGP#Oy6ja*nco3sDw6e%bWFaC9q`=B^w&D>ky!2 zjIRrD(ccDUWTwM?Eoer1`d}>5yFGXmB5CcLiH-ocNE#WXpdzI!Dx}_|Oc1`-P=wo} z`Y}UM3@tcE#QseL_zt}8t5M6xgn39SVW3Vq6r$db7}_`pfG1GX1_q^$NRhb}IPB0E zr+*qq1P2ZnAT}_`s}Uk6wd0g6@WLN#IfgipZueXE&b?Tf#x8C|W0> z58jDTc_-i50@+(D6t%tr)H^0n4bE?gXPdwPOQ&i)YomZ75*LE9mw9xFs;v0u)!-B2 zyeemfbK^D*Nj&(_cIzIAcR>=z1J!uJYUIg_|9ot(x#t}$)<7t%rJF;3>x1c^85#be z(b`W=TugZTp~z+}z$B{OY zc^#PyhEC5AY|ybeew?qzOB@n*2snP_a(oGPk*u=uej6V7JGdPEK${*Qk76;}@Dxh% zZvpRCc0mgZulcXKQ|JIiQjR40b9NgzAe`Rdaax5Sa9ei&WRDhnP*5!V-%R1-P3kc+ z10|FP=??ejxk|LsGpGSwito z=rUsEAhB$Lw#{mE^msOoH6nA94`5!r7Fh9Ml!NI=au^i+ctoUk2WUZ_H8{Kw&+!Ii zTK4$yremqA0cpeeP6e*kk3D2MrP4<_(|9)>zgUv!icmnM3Do6Fnf&G*wrZ|5kYgK7%P(E-Hl|c$P;dxyp%=uuUYUOkLVr&cxHa{ z0J^lim?c_5o`K}&gu2Pvt)B)B#P$~DJt>Dp z#u_Cvi(sujUpfKgGip^*!b|dK5}#8+N2!2K{ms1u`I8g~${GTW2*CiugYXSFni7PY zjy#+4d~Sq8H{3?a9>gT)zEtw#S|@(g&i0NuK>x$jWew z(5eG%6bV04B^JXREPQg+qkG#-mq}iW6q^VSQ{CRL1qNGcsi_a(8mgKJcn3=T4w&6i z9+?8fU&57%okW20Qp+bhAXzLT?E}zThiyR@2mF%xL5g3cP7p9g5VTVK!|QFK#f-${ z2b?aB?T@o5p{CYCQoDOL;gR^1OUyo4g{AqKTt*+NmN=8ljFdJ*xtN(PnLcl|A8Qes?`MZ zFdgwI(6Gk$^!*rsM@!F}LI*i9lFI;P96;Bgr!GZ=;#x^!4-rin^7%U-FH%{B7nr~C zSqrvW$-B^9h#kW8@+E8x)Z+m9Rk&NlB(pU0;;lt@fEC zfdmz9hlqukYTyeJEf+QWp+dRwr%>Vfy$kY_?f@GL)BWP`F8TlgC~ZPIjL$q^U=T-& zHMm!oLt0J%NBwFva1+f+*NxQ+$rX`A4KDaC<(Zr$K(n%Z%+YQTcpY(S_QPo82w`*N zp$Ll^av8hHVCUuwR3?4FuTh|9-X;Ixt(lJ6KanREKCt#Y&sOzeKCQRp4|4@MCbT*p?743mWq*p{qSvUC6pX(wk5&55lL3hB)eX+HYj_MuEhk>BjW4O zxjcrqr(ytKvqZc~wMTN?U#*5)Y$6v=qJ0R4pedA0fE2s;FU&V+g57W|{NoOpNiWLU z2p(nE*MXCuAk~7hM14)tp??xQ7$!8ueZdvOynQk)T4AnT6Xbu1tzeW^{ zSt3v5F?Ys|95GEHKBC}>3jY^a|A3W56c8#f;+SLRNb+4kD(bca#glwH1D!fk$XJ2K zB%%*tg5@n;dvQKoZfWL|%H7Sok;PE&g6xbis#q=UTjXsbgJG z0du;E{s{rgfXK`dJ00O>Qx_-vGs+g!u4`cWMusHh-$tHhaKlu1un4VR9LD74>ImYN zEt+wyv=QPH68dq3HDk{oz!^qmEorxg+v3XM_-9QlUb2Kil~33*hG@_kJOqe3H`7dP z8E%dWYQ`Qa9bfr> zZKM;Jk1HyHy8M>E|9S~`eJPl_A*l=nr~)KXhpxXLE%&zH*T>!vzUM{*)L;_rXmxs3tM?S zY$>*n^TnMOdWf}jkdf=j@P|Uza7rqmZ^ut29GV(B1R#0rMQ82t-jL8(vBP2PJsw91p3wW@0nq_52vYK4O^ zxz~!YS^c>5-I&>34wLE!0Ey0-PtsPJPcb$(6ct=m=_q#IbbM3}(F46dG8`s zlZ`C^cja#;dKD+6Z7yDLJ<9vbsN8w^kkU);Df*Mg#`gPJQ>RTv!AFCp-tx~`_G#Y$ zfk#U#og&XqSe-~M^UbPVL1gPdkb_l4xXHuO;Q8)*aB2a_W5;B=-ku6$)uW3qLl}oM zw6a408`JJmR_!~4ulh47UK7TQj|zc4Q1=$p52H_l=N#62k zFAPuqW(wQh3oH{9d$MW=S z+b^q3Ugx>MIvZ&jgAn;|w@AK;F2j8fTTrXwzWffA(8h$txvxy7mH%1KSIA;abYo2JrO3sXC&UdP@SbGbow@Zr05YNmz%k9# z4-gHmCb#r6xmCsK3!_1feC_GhShRSd7!TxX5b@aY3k*!G`R~u$NN(k;{`HafUcdAD11F!66fYsdQ22_9bM`Uh! zJiVM-9*yq~KJXWP>zDx_;838@+C+?3U5x~T1X1a8*Xf?jB6&T?2Plk42j=>7Z*D~s zt}8Ddnu+>TiDPFku&g#I0-_+sFupFrB6=FHgOgXI%SlBlwmT%Qzkr_^rQk(fAmThA z$Hwjj&fsYUrO$h86z~Uaal~e`X$mh*He-BzvLBb3ugjM6@$o^=6lyILP$2)H0Ae`` zPgv*r)*r`*(pg6O2q=Gvj)7VYg%~z{3o@aP4OVC2s+3)L+A87C+oGwVF^}nroVk^U z`Smw4OTw%<%d{?Y<99d9HxBt>t0In2$#C5uiaeRe&?E;JDlspmT?K8L=!hUkCDe;% z{Wb0#*TyU{vv4Pwt83}%^77obO6y>CaAYRXymJNjtEOHeq=u#^;3Qmw=Zx|cH$kNO zIl1!U#%D7{goR<7i>HTjzmmn!bJl}pFw3$Ea1YGNrImmmQyu9c$2m&|W=N)hju8Lq z!t)RT!Nj>UFX0RUPI)g}wKuS30h`TdS8)s>i$Xo62w+^dVF~#99dSF9-2zwBzKRo` zf`>;S$)MO6zX5KwCg7X3zQ6Cr=^E##L0d=&Ga~x~WN!*8fu494GrDYhPYB47a~z(| zrs{4!C!4Z4Um7v!LUQ)126IgJQ~S!dMpU#MBGh@U;^0k{=wSJdHXUlRXt&>^F`9xf zK}9y0K9m%94 z{23J%hzWwo^#Hw-5daQaOj(gsjAPT2^SY!H&W2nZ7Ki`Wp`Q4PseEExl-${b&n zkRs%O?Zansc`^pTG2z4fTQc+_eHM@&%o*4|`XviUA-*Ce-;gU?kaLeBUC)A< zEvOU9Kxly$iWtH47y?P5(SU?fEWJJK3-|^jWIwT>*21eAZojH8q z&EOc=)BQJ|5LfW*n1f06+;C0y_=(?-5Z)@xM5k!LcQ9S@InF-0L|NBw}N zjXpW&1M;GEiP8ksCM0alfCh*gb}{c>47c z=}+gT;)L!)`q_r$!|;VR%`5&`QVTfJP3Ht=iO>!`>d!t!pTs2GrxmG{T5hBNAf6 ziI4Ue3@;x72a3Y!MSgKO2l`-0xr_1&q#HVc>@)Ev=AWL;}5?K4#sb-&^oyQ45zbHURDM<`L z7$j~G!VJiA5g(Rx@q;oz+%(FvlYnKrqx~02&>FrJG6F*B`e4FHeQ4^gqsL1=cY(~_LSPC@=J#7;lB*REHqRD#=w1wgt&VVFUfaG?8a7Oc6P&Wf9 zZJS;*2uR&d=MYz5I%NvGd}aEk$6NcG08XLkB#Aw%;j1uTWU z1<0WQn-xzQZKh(ZO-Nj6Um9Ka8DCF0MEq z`VooH{ag>pDQPh>|qp=KwLo|Y0X_sL9BX`yfoOpkayS74+W|-K})&eJoJJ^I!6MO_tM1W#I zpJFn!_Y|+|3Ouk^f0xAAa)|M%D*;s4tK`dgvVGe-6=rsJc3$`J2-jL?Xk%k@hTZ$&<<>-4)O>`sET&q!0+hOe zh$fB4qHJ$JSa07Q%Hy&IM6o6O{Dte|o_gKZcU-F&kDEqgz*E4k6x+PnE11(40ZS`Y zaB5yWZ9CHS29{wnGr2iaL3FX}?)1YVP3Q=z#vIK1^yw%-9Gl!DYxGg3=Kd-m?_Mb}^}u0sc7PV2kmYTgFQ zNJ6!kFH_y^;S3kn0;lTUpc1pB!_2XM2P{ml*O#h1UD{9RB$*w+;Ag+OY|kddXvHMm ze7&0CvfT0Ivd&UyJ863G%LUce)op}Qa%?5NwaDpK^7&LZ&eq) zneD(yigStilJ4o@VFVVs0}hkTva&&dcIvSz3lO2Kfwve#xcmWX^o*WcarFprLEDV^ zkvc7tbKOP{sTY}h13Zl)4@P;1@hIJYf1N2apG}0SAvo|m9`yJsRUBOV>*1k~O|rK^ z-alCwv^}!aOwkL_=9!++kplY+Z~W(a;Nsq%4bs84lrgn4;WpE`6jbi;Tn2}H3(ZdD60lYZ5lcv zkPBtKH7K$5z>f22kKmaE^j+^^u~>LZHI9AiwOLPrcJ9>G(@TJv)G}!slh^m&!1nbG z-Ywy5_h-5}0L`2iis}boCFD!_&OkC&0EpIaQLwF%Okq^1S*=sB)FPn`M^eSHYy(e= zh~mEEZ0xDuI)dliNGa$0vs%>I>P5+XrYAxAOnpv$6HT2Ga%Y;)uW9?>SRI^Oc7 zaG2$_Hr}2xCBQ2LFMl>vZ!`T;F()Ui<`qEPKp2@`n}C$Q@XAE}wv%`N4kAW_zgJ$S z!#}~_Jy%}cWjJTrlyeFDBemWjf40KEU`5P|aGG5m?(PjhUQP6WnsTaa@scH` z`Xr-mihlg~ae~+y>};)dw;D_7O{Y9F4@pXrxUZq8{>i?)y1M%5Rns>OXL^63zdKj% zUc6+%zBfcBo-$>@ygxsD=YJtd$6JF%AoP1h{vCH4H`BndaB2;k=~w>i19kwj~F`D|X_&*@8|wZb`<(>wE><;EHu zFGiR8jjIkAJ=%7s+9K!Z{cgXWm+M=ZZstk4>vpA!CG%DWJ`egZz;^0!b^Jl|uA$u0 z%j+Vf!tWXdr4@UcX1!fhkZQ>qEIr$=m>tx|Nj>4`+PN=CD8DH`QjUaC=frBSe}8Fj zX4P%aI16RH7N(H>$Dr6`i$Y^v-7_5q9w)1WMiMqKmT;<#-&eo)vh~!8Z_G+oV~nQk zP3Vw|$xCt*G2d{=|B9r&VeO!-m#>>%JZBc$>*LMXrCtol#Cr{C!a9T9rtIY7~NSep$2L#^d8LC>|!l8qY@cUN`X_ffj< zlMxgh%o*#C&U4y3?lR1>F>Z*}(_D9J^NrZ{YOlUIF=`q5N|7c0f#tR;Bg>rc9I=6VQ_jMKa*C_tC?_Uiz2<_F+ z9o?lU>uO#m^5O24@mGUh0_^1s8Ot**04D5jkPg zr>5z>-rafDIv(OyGm34DcSri9*-MCyceGcR+#E<+y42n&*jaL*{zy#&$71ordu^2i zHu+D&(vJ1S_FuEjx4%7T^eA5DH+PxW#%$*1vDofN!}MLZ+C{olV>Syf7Er7#wma%H z_PIZu9WTZ(Ra-5(kf-Br_viAs{6JITB%`+TjX&FF751rcm|Z_HhMpUYt!UF0$uHR3 znwMtpQ_QKp*L7EO^gxHsZB{L#McH0jCVb$QKo=v^`L%1MZ-01PSi;=dO5Sm8>7l|p z?+=Vus}2XP4sh;-8r^s#Uon0y+fH!2zBO|0?EJQaPy2t5Hdn5c-PG~4b;-W_o9|TX zcx+#5{PkI1Sb$NUU!tMmaJZ-bod)Y5>B|`w>{}bGWVqG={uMGG8<|$ejo0;x3{62El?m9&g=UpOc&8apA9!7eU#*bS$ zCT!qoDB=?y@*dw5#ORW{*-^txG#xSZ;8$t5AdzAm?b}+tx7exwyS458!1eYahsJ`n4PFLU?_}wPL4TdUgZ*syen?8&tKZ2`f4sY>f3$ znz}^asfS~HU1|;XNdJ;{MUGwdi$r55rI^6Gr*qG;4&8m-m60GOBPyqTdClA7zdVhu z4*FSAZ9}`7HhaLvQdRa;(c4VHRfU7ACF61iN)fYNOh*Pv)?DDIu?$D9yLI=ku-4vd zz-f4qQtVq;B4aaB?^?;O6#KY%>&8zCppGoMXUwm?S97&pFt`iT%j=Ae`dTkucN~uyt)!Us$5m6FCEuYRebe za(CpOJ`oh|Ei+_KYkS|{q}X%b;v>iVqjmm3A18NsbWeFu!6s1y-+IxY+%G48U0it9 zw9Lu0_PU9cxmtGPa8=Eba+aZkn*G7{L&bg9hh}INmc`Ac#Vj}Ux#YnG?*Ut7FQ0^@ z6PjZM-8W0R4h26RH(fQy%cg5_f!tVFeZ*~n2EP9L-i0sYW{2DNR(tQ=T($X5EHc#U zd;PC&4nK&tF3Mluy3#1y&ooS?Ou)S`a@)3EZ=H%BgJOeN!+ek7-Qyim5qrF%b4!ea z^nTEcjL97+E3oi0l$(#U>|;<`_^azTXOBm7m{l@wiuH%u`V70)?l}^0rYh%Dt5a9O zK;zss#UAOR?)$|I_H~Nf(irB+}CYqA#bwyD;o>=fL^;`Taj8Y;MRMq>}km z_|qSD96Q44JCW!0RA#B%qs_OD==J8?G;o;ZH-oF~4jkmLhr_NLiLo~3vc|pB>#SP` zi!!yMJf#%sx)qBP-;SPs(_h|DrPy<2mS)$J(kS$wLk1XTTaIy(@Cm7ts`Rh)q8SjnRh-)Fy>rr9BUu7G;qAK zPA4JEr_4jeU0blB_GH6P{nxxlw3EkPFRISVVz|$plCEQ4^|J1gYLcb><%G>`mWtai zZn%4OR)4U+=k_j(ycbiQ+D;$qt)4BaBkM3{aJyK*K&ks)v#Lj%?+#QvxZCP!y6)Bw zn*(Ys%z5t;-}_W*`sy9EWx@?wQ8GPu-I5!E3K@#=(s{Qxy!8|1Y%9$w)f$xbE3D6G zUmkVx3oBAs?eLBI$ihZeX2y!(hX*ys(h8P+%@eI>jchT>Q;StnOY&>oWq#&Un|;#& zbIfGGvqN>Jhve@s-pXA7}m(BEEHC=Xp<^!aEM#WFZJEOlkzAwGA>)6E_^Cah#XpL=Fg5#N*}4e`GX|S z$tK&SZN~)liXFPbM^6{3AKa4RoxzIHIoKtbb_Euyp5}f;QfjLVCq1DU!c6Xu5Q14okDP?3rTm_RW#0Etc0^A9N)+RE67A zrzCVQPxZ3054So#=aQb0%)rk}6i(=0sT`hN^WpC71FgOG`}C5#Qv;XWS-9EgPC#*3 z##m%LJ;i4&8kovj6y^HkUgY`cdTT_LYD8-JXTkFC;Zpghn|twMe6cq7 z5bi(xCsjety|>)II^`i1=)HMdb;mIaiw)X`Pw(zEZo?J6%^P`t~nG|v6EYLSU= zdTHWHri9!GnfMR?cLmMA-{gNU^8S5K{(VpWJ7B=S*U7)v$^XMTc{e`&!X=H=&0qEo Q(F#)Bt@>;1&Z8Ip7g4fIOaK4? literal 0 HcmV?d00001 diff --git a/Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeWhite.png b/Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeWhite.png new file mode 100755 index 0000000000000000000000000000000000000000..3248bf9dcbae09e81090bcc09aeb6274721e15a2 GIT binary patch literal 66137 zcmbrmXH-;K*DY)}Mi6L4MG&EBK$3uxGb$<>1d5zQB4_63$mL}3tDQJ; zTH?eB5}UK9;gu7sR;KXxAI@qr_f8aa&@I9bC(Z9F-92%lD4gub_!Rtn&Ouhk`NRo| zM&!Rgn(VWmo;X3wkh^~ui`0{;Yz9W72#ks%I)9w|jUAlkgkEql&%&UKv zFrPzG*Zwr#9n*McrjxOxdxvCayqxVL=SMcS?g!_d|NZAh*&FEt?7PP%q$yU z)FrD#jtaWliSUVZipg9iuFDDeBSct$!g^x9ZNiV z5iehU-OE%hprdY&#IG$}es=txvmM&1}nA z5TwQ^sV3F13Use^y5)#>6byd;lRm3;x}$49KQt=KCIfeL=bANowot|s8$g*?t8x)5akyPs3 zF~fPD9z#V{>O;}kMisS}LUQ9r4|I(jLO4iCd#laQ_#Rsoi-y}w`dCA-koU-CvZozU zDOnPd4t&K*15Dgs%xfvPh}<=$vVZ6O%_76zNq!B_8-i8q`!E#}$9HFgB3K-anu_eu zWi&rJX?>7d-N=pBW*cLv}!@3iOLd{eid=EICX5&^=*7x%hHNL z?xrzot2Hf$o@a$_jo6)}q50fYQOzLld_x~O+TJJi#5hm6mPA48pKCcw@1L~Zs_PGB zH*g94ZaKBqA}aJP(%5F8jXiPJ;4q)pEe7MCtjTz|`Jz9XTy3g%j`mg~V{jue$z2IG zm)hm)+PX-W^|JbV^U(|$z7m7g?<+!E2k*p~ExhQ}t~_7i)?3Yxh;c~D7o(?1HK06t zfW0I-BTM>YEAfo^Twff)p9?>{O6)ZcOJ}O-_rIFe!yewm)ZT@VX#hb87_JBns{kwsdB3*m0?Jv%2Y9~-jtQ~ ze>{AS+T7tgV4il56SvH+5>9l|j4fsrE5*NLj}vu`%T!9tZ(lvkt(N>5V^pEpRKmfM zh4OVPFD|dix33z{w%&e|shF6Vqi$~PkGu{CcF$d4t@mx* zyEsg5WHV_$)6{##@Tc;a#Eddb#&CIW$u+#k;B5K z*>!!jc4m#N0@Wi;xgtS!M&9*z=_q!C5W~uc1wE{Cu4n$CKFg~#;f+Owaf^;+DuvQV zCTUX}W*XEes~i=Te6Q2W!(O>6Z!03}`7q8)$RH~+@~JDmh+*hI9lL`MO!)1O%Xp2} zRjeiN@R^EzEjs)|%TvGZN%<^$)uM0|o`FTBjMJvXxW2ZhI)3w8Z!&JSkmnduZAGN@rvO8q?c*>A1o%Omc$v&W?x}>cBWmO|5F_ zN-X2Rk9Myo24O$W95-zg_*Qw0>Ay7)SI)AFn~aa{9-{7LQzFszb8;}^HcWTqWmz34 zph;n{W#!~^&Fz0fnmG54U!j^zz0bbwZrb=BbZSdl~bC(j5x*akXmdiJSoEi@tr*I6p@F>db@5 z9~7;h9*1F5>s&%QlsZtMw}Z}`#E;Y5YSW5w+0wO@(C@2k&n%AOv5LGHm93+DFiUuK zDgiy06Kaw+9?xajQGGBf{^0m~tC1YnVhjEt-Z!l34Z2s{$+vzOrBUFmNpdW~p0qIf zFxL2R?NR84R2~IycEIOGJp)dadJT>aAA_&~GkU@Gcg*qm_i$kXK2dJ$?E(%vRHBDp zvD+PYh>i(cb#-j{{&6cojE$LvpO?;Tc%{FHUUD)v!Y}<)mmranILz^%j}E~P`{XxK zwxnnWt0zl}KZr;k#EwU>S}Wo#L=u%R3oT-AN38XKeeK_0X}KtG%jH|{6UAFxEr+f$ z73vOptCmHPANkX{=7w@Y_G>C)o*jFRy!~|a=zA<);*G_FTJHc_iQ9%PJmZ)dYCDb1 z(6lJDcOdV$uWk|6;O6uSrG~Imf&RGkNe1ZFX;mC7EIK&;*woEpfjW7AIp=|>oV-%h z9G5v;k*fD%N`S7mM;uO<&O6}r0@WDr+@Fc7!b$^?(FX(D<@VZ&_md!`uW!(93A204QRRqT%Tm>=0e zn0wcqgv~4;wOwMFs5PRFiLu;GEkZLly1nxD{&8=WduvRAB(C()RuS5U>v*?3J;6_O z88X}Z6HA$OR#mG+anr%C80lgKGXnhsAuCSzc18|wCG3-qtF!e);>}JH@K4zG{g~6O zFN?b8BCik*6^pN#9_$UN))_e+^m`kzzZJ9S#c)~quhMhTQhD5+?rK_lC7hnVA96T= zi#(dUlTqgv`UE}0`H6|lLmKVI#<6zNQykxRUJet@Pe@gdBF6IYe)7a?i56{9y$^j* z*mCRq5DWYKpNUJyvOI4#$N1v-WN|jud72kYv$9R&wq{=gB`?((!a5A&& z1x?}ZT{#kem(JRoqlE5=os%l>>Ch-n%P4h7>)kTUCm$N?8u*!zagcha*gCQ*-Q{OH z-iwNcoSsU~$xOaDctvHw+b;W6nb?f1pAnV4pG?;HDy3us;q&yGI=-Ww3h!5(W=L6S zBptZ>$L}=!d^_u5w~l*mYNZlp{NoIfD}tkqrCQ19vV52V%4^(HO-W}a?(S=J`IYD# z$52NC=2o(m+_Wx#f0ApIn&OlD98X%!LeUqJKk_&qU&iNH$}3ps+;vWU%J=3SX|%M~ zty5P6hVRP-U8r*@Q*YJbzhiDj-kaX778R}BU&+qC+Dv2E9!ZO;I`dh#pDHvD%oFue ziN`pJ+Qac`Mk!*?W_ZkEeXbivN`uSakP1J`KLB@?cLjsXk*WoviK;Zn;uLEE@YWpBmM5cOFLhqIW* zTLw->+esmWgQ^gxE4gguDLA70D0j)+tsQM-Rw@Vov zV$$s1@wvag=UzS>){%F~Y>mHqz0&FI#BGNkH0f7bB1#u~9d-B2!)wfDYHj7?vdYxs z7ZNW`)NX&B7ib-vHTuV+lO|Y#yI#04v+C{Ee=rt#qI=Ki9sKkC6#z(#M8~yGh-Pe9A1E&K!)*(qEB$5XGnq4D6yKOSyga zyE;im2E5o;CySJa@Ak(Pf#|m94G)76sUPg+YSd*{=Gfy<%SNoWH$ay(BF|T0j$koY&yDKLLANW_}t(j{X^Rk@cjWlRX zMEv5m-B@3(ce6@GPgK-j`Mv2lY!P4XQGUF_y&HmVY-t|Yx+vzv40V;rnk0({-&VR~ z^t$^ts%$)kuxRF0_M1Jg=Z(_8H$+WmFwlDJ4gI+PpuSg2PA^I8`w#U<5$EUK6F!f| zQ*ha(dx`=E6`C)(l28Yta<|`GxA`CWO5M%O(Hv@zs&|fNwjBM~6GfYSmN2cGZ%h2> zG(E6zJcKq|RWsJ*F<|J|VRA6OPVk}-)UU4$MH>xb@&t+0SMJl(sH@3%zA=#ZEKcJk zI+r{lm5Tbs++&da)x3&r%A168!dW7LK+hd)8rMA-ZKYqVVkC#2Tg;0{4{2^Qo0|%2 zyYLEK>RbKfVtgB*EZob#!=FACh{?4GPW|O``4{;)R6!^0;5{DN0n1hW#kuE^2eV(M z=zjU`hmG7Mw~@Tdkdsp^ZBArU&dE#^pBHD=itU-GY-D8dP5)q?$$5~Vh4T4s$!n!> z{PMnDrFC7zm|^{ock0~{27P|e)X2_V%Jl6|YEzjwjz_wk%YhB8yCaw{#SyM8sa+-Sv+on@ zAG#{{Z;ixZ@Y*>T)vb4?%q^VQIZNApQHcvRVb`53f=+YaL}7ER1%y1X3eE#68rU!H z{Ex$!U!KvIVZQ2fvpZ)X8S|h?dy?@U|Hz`{M3I} zH)Ezx?zXAgJ(VZ}$Lb%&(i%phGY+E&3~jB+yeYgbJM{55F0%VU#a;|%d;n!44}?ZH z(|C@|>h=Po1b_BR!<)hb6HjVUrruXLWejP`yEK24uhU-%$O#z#J4ngRKi5;Pc*us7 zuoTHpxR+?>lak>~QT{pRq2*Y4M6c^HExB!cI(@*DO6!ird-rDqs?n^D;fhp6*A298 zRO{S?Lrr4}4apMj&?r0|E!50@*IH>Yw|{AuRGC_75aZib`dZ;c#|y$44(?)*Q3AR5t8Bq$UtY)Ec7ocviu)?xD8aD!mqH+#PCQ*Ebk^ zC8tH8&eDYL5H%-7=x*0tUip~Wu`3|`+Q}laN>SHwy(TKk(x5=9S#%VCgqK@7n!2}2 zTC-Nx?a$+L$LXug%Jl9nTeWQ)mU+X1LADmfbtScgONU;R-}nI@EkvKNqG-mZ|>o;j<**Q0wpAs6~wP~nDhATfDWNEM* z#^X|#oaZj}J*-YAm8<1eAM2pLe3@F0XWLP}RU)^x&T!tl@MWXaQBU4(-8;vF6L0JH zMSN$jF7de6=$04A*R>so>#BFDN3`u)ICdzKCtOgIRFcq$Ut3F64PZQTd@o$%SGxhf zsp<6OqsOME%iHPpDS^py9)6u4GX4spiN8?< zQCtU?#h@1u%uGWO%(Ut7J3CL%iPb2}`K!4SLuUkQyX%M?vw^IpH}-W!+WJwv4|7+- zQZS)!-=k7qWGQPr$&sF8)aw#@^v9w@^OQ^L{*3Ob-A1bJd12ufsK?rIUYA!X{PT4k z=v*hebbl+VSPnr`-PbiEAW28|ymGu6XNZ zQqK@H!0u_@?3ppM_c1MDESi0_x=o{dyPbjFgTIsql*fsZ8;Ucx$511+ zzO3<5QPzT4<~gHErTVurbY%92LHWLKVm{KEm5Cf&a*=Hp7{tfV#6)4|(M)sAoiCXy z6V$$|J5fj~@RGOGYQ4t2QAcIPXz03z#1-i0`Ub{eRM(82wmIxQe|Gx%oMg6;$Tq#O z2YGN36%j49=0#u}NJI3^haHlKy$kvNZEs$OEKp3LRXtyZ*juIciugY&ZIlx4X53qA zeDvB$n8UXzGr+r=Ksd8j$t2D#^JO}6D(>SKy$-F`H)NOMnc2B#B>586-lvz0N0m&= zIEg!Vrr@NBb#yi6f6mtiY&K3kdLmmn+?t@;{se&l<@GS9jw!SzpETFPPexJYP?GD-cJ^1jc4VHcFM)ak=n zZM2(${`wyXG{CO0FCAuPqA|d%`B2fiPtcOXUO$f+d%j|1ptrBEO?+L71?!<*z9)_P zlRl(}-F(e!)pj2pXRvJ{YuanCpQ!#Yz5+G4d0XIM{a)0#U)tyhy>M!9Gy~NS(aPM^ zzEl}%0gMwTV@p0M3wu>}j#EX>Ug`G`3>&IaPrg~UCxDz2?`f+an9_8+aW+z(l3>N$ z`Dp4^1#P`^3h8M&xk*R5E#Zv4Y7I|6cTd{v848X=l$=6lYmx(bE~Yc_RGLd z%`e47^)KHk153{1HOIbDW^ca`koW%;Cat;0Ffgi2Gdr!})pRS?njW>(#1s6(hFPVP z8Z}y`n?tP8FKVIiq@;0bb#jE$^L?caGwx=>Kq4&iUc*_lrya96|5t0j{>o zxR06Uy|kfD)MBL7thb-cStdDNlVfSaDWQO_{|Gg3SM4wFgXlHaW_}OKkf-=b|JPvf z{WF&Th7|G(g}=9v|NZ`ozO(QjjtM{A{QuwW&y+L&z2rpU$^Rk}c;WH6f42Zbu8aRK z4|qQ1ApE2GwUkg+4~>W%6jrBh?Ds_%4kjk1y~6;KGhgPG*;efr9M9R*r&vnefAHX? zm6cVxbRJQ?;y?HZ7QoZK=+Zj9(acZDU`dBhqK6C$mm++UmzRGUm#Ns(8z*2*d;Xpu zIlRu`x0ezU67pQCtgI|f(zhzfpWx{!POp?Kc`UPP@99~Ypllwv48p$e_D>m1K|w!P z#pp$SyMyh;O%HJ|!v6d+4;wXj=HtaV!(%`t6@7PxxLqt@`-*RL;ZC-~bLj^qBgef##NS1mf7hR>{d(PgRO z3`3+}=IX!xcep8vNeN~yvmMbyZ!hIymo}Oh28@UYTKJVAb&6nV`tU46l^2c2y}i9J z@~81$vo4|<8X6g`t*u^dV#jx-XG%YBKXP<*9IkZEqW508Jv%pNb$o#5J zUA}IaJiMWSv1qu$9{cOp6E4FVZ2`2CapT6r>89|3 zUuLb-vZ7&tLrry9aMz z>?i7~4%ey!d)8{Ul)p7KwV9RVI8J}36>&-@K;Yyk#Bd)RAu`_6b7<;_d+jZj`^_k#jPL=v`;-1Ap6xT84$-bIdiEeR%_TzaYcGXJ6U4LSh z_gbY)wL7lgGAl8&iNRlgKFPa)myb`tVe*a!3T3gsIcwFQ7Yi1aU}0gozUdko62k9y zL=&!4on9zR>FTINpl`1P8W&+JXz!4fBzcHx~M`{t}Z-U6L zW%AVR-9yi8c({zY4lKT;HUw`Zn*I2YvehA`0wD~+#HCx>_38o>*pmUVOVws8=kh7u zf9*}D5@xl)=)dkb;k&!|gRiqULPavC+;(JXDwv`FHEU9~bBBlw4Gm2dk#Jb%vGJtL ze!|eMLN6yLhxfcRgYWixLyxJKk5z(iD8*SU_va(kqWL`&9`2OwPb7%0miD-G%duMi zOnm_39*m*aB1`T5T)e!ZVy}*QB1^?cepQvI@6krn!CEzL=@fm4M`jc8c!Fp-RBYNX z*)YA4?T#CVF;q`7VVl)!Q^+_{E*htfkCFgN!X;F<#(!{9;yeD}Vdx@N@rKuPGvp-s@!0 zdx+u~ySjZdWN%hKQ(pp7vw`%t9w;!VTK_`Um#xYqVAU(z9w(sg=T|p_O`yDWUK*C^ zb+DM_`t7pT!UT~}!Cg6Xv3BG8wWZ#ih#EsICO0>*?aaxb5YknNpYOWNy=u0*6)=!@ z@%9xX8c;8$8iUX53W$j4czSwY@xLrVQ&ZEHW&A_ChZz|eXqQ3rsDJ(b_|!!5>7)Db zvgq-4kAU}%jZ&hh26v1?iCKI1=4_j5r^GH2HNT6{bul-K?S-ElY;2EgZ1QRh?Qi{c z>pV2}Qp+9`v>lQ&6bsO#`m1quxq9}s8dNtFyLMJbkm6Un_bU`iO%)__nZ?h4hHT0U zS08{J0ilsAB(+`z{-hPMOEC0a6>weZmE+XR>xyJoM{ep*Je)vMR>Qy`KP%Z!H}ndZ znx7f35XwIu`H^h2+Wx^ z2WsYkT%!8dqb=zy_{#nCNjt=2wR!c-*Kgn0B_$<4g)y@*Gry3SPD>eho6z4?PRYv6 ztqctj?SC8+LfQviebxES%+57Y!GHaAGz?fooL*&cEBBgHuk^nWed1a2FInmEG|8IF z|6ci-=YNO%UKp*!(oYC={JX6a!d2%RUnRKc3wN7)(c!xqZ=J8y=LR3)#%PeceYV$g zadDYphHsA)A)iO>DpJ$Z!mAGsO#azEdy+oLI9oOCVMu7`;rR7GkvAL(4%rB<4wosY zLfn?X3+q&#wT2L5IjO1lxMP+-kx7QV?rNOgkVVr9Sf%gnc~p+AH9tV!dg9$tN>h@A z_rfY5Sck|@`rMEyxivNVfT`T7C7j-y^aCQ6!QY(=GHzbRb8vHqef}3MJu^~uaVZ7x z^E7VG@z5q5w-x$=ej=vk_kH27XK9^w6;xhFS5N*Iu%9?V=MDRTKP-XaX;-|O8UCkx zKQjr{SjL50{eM7uU4ilc6k+cvVY0IkG%@q^#NJP6$|zOU3nKg3xdjE9kcsf>i4&7T zEdUP8X1*o|8eau83Ynk|6<`MM#YBBhT~`-V>%Dv0zq7SfO;=ZUkXN|IX!EKjbX@2c z=yXBbVK#`AkqY}5<}&L6?kAQfk7(!F`1sV(C~fVlg7ttkp);M24>Age9s^#WpcDQ` zab47+Et*RPf3U}R4~w*{U%!4$)_nRTEMPl~+Su4IUY_jQ+}!+!m0e6s%&FTrDl(Ey zO3Fw_N2j&3lQMo+udaegDj2SagjNHE=;6)9c=twfAvPW!l?M+VguH(JT7Tx%r!hMK z9%nd3s4iaY#c1RSR%IL}>}?tO{B zs$jelBsWBW%gjx%?~&qfK$p1URtiq=GR?lMZ@*}{xdTZ>C)F5(P(t@1OH-3N(7(+)EO=^36A5p zOs%OAM^G(zj#N{WaTMzq2KjkIB`HrX;s#XQ(_}B<3Mf2LR|1;Og2kagSgeg!V)F7( zhK5NHtNbntT})MyZmYwtgT17Fwl3pa`IWfz$`z4*3y69KV{r%G z21Wh(ZtBQtKfoKHLKJu!Ej6{&<$`Kuh%N*c;a4jr;LWEwC*S~M0)wwT2z94+H#|yw z4|fVXQ(#G}W7S$J68K1P40XAUj!rDn=-Ly-wA@D>n=Xu*lRH+Aaj>)h9I>zG>fsOE z{aP{Mcdc^4zO~NxaJyGs#S&mLx#39g#ZLr?2Y%Dm$Vt~#ycd3NI$X#@iY`ZbOyx6W z5qK7%9B^%Gd%Fez22xVe?a4q&WLE$H5l}r^>Fm0kUjYWW=|n{ik5n}@9KR6tfZR9v zsF8v25upGG{i||YJqVPFkd|7`Qi{I;^s=&<(a|1?#H6+hc(b{!tp_N?_H2xi)#T@Z zhD8SdqoUN*)ZSWecPKokh<}|eEjTz>#+Dg3o;L8DjY8M=)ucaO9*B#JdmK9R{q40} zs9_DZdP>qww>UW!f{c5Yb^aRS_yqWwgOig?Ofx`!@L7MpUT$eA|EC|9we(Xwx8_== z94s21pQ63}{K%@?>QD)*a6LR58ui)n5-mf|j4L;_ zKLSnBwjC+&gNR6j0a=&p{J*(ajkEzJs$e4@Sayd|3Cm~iwVBwBu7xE=<-d3It>jC;dL{GP=col>cQm@0Wh21(TAI;UNMsCQV^p$M^w(r_Jx0`=0BTS!LMQ9}5nWaQ#IZMlYco z!K%_Pu{)Xu9uc-lL{_KmB%}q53Gm6m;RLY&va30!EV9|eA}$jlaKLC|Gjp(Y2lCQE=T-0C4S>6`^zcU| zCu1X&Mdh~UJ1OaNH>R7GfxnT{;~*5-B_s^UuG|ELq6nH~WJCm0cvD&wr`8hW=>SWN ze(J)4#kcR@tpF%Hi6%lOL6zvm4;W$L8lxZ{ta(@{`}8Gf5JYp;OB>x zuFIN$G=H6`P!pp^dgI@cl7`U8yl}Oo_U9^;ntnu|5xKHBQcl@6w8 zGVOe3q+n*231&rbKB5oI%)Ce}LCQMNQ`L38wc6eB9z=ww7~z8b%Fuhx6y{rL&;&2k;y6-v zhk@pm`5wAK(17dk3qPgFsJYMAjgPrcr&*v)NMU42;f(%cxEtR@eiz z`+{Z*+0j+Nt&m_!ar{34zamwN6AC{lR$59*Z^u2R$$fXn+^bfK+Ym^#<68g$i*S3S z`~AiVzPpLhJVuB+6=Gv!t3VmqUPueK0;b&1IRl}Bs67pb1cV|2m>Aq`0X~{<6cUVs4?cOkM0CPt{v< z8&sj%uBu-l zoZEoI5X=dst;|IwJSc1mkN^}+HY6lKK>_TyG=NS1H9cKsHzrC>%P$LB3nF82*B@<8 z79rb2nC)vS)+M+TD(&H0ezPA}Auc$%xRfGpD0M>{$$0VNLg$~%_aFuKBX>wYG_(RYDbjd9)R)Ys4>q8dJ*D0>j%cnql|U=c6;QU;WCRiRObK!~pb zGVV`*YisTR=*cW)|~R?5$3P~@6`RV4C! z#1V+^L7x1L^Eo)=AuoEtH`m=p6%-Vpsr-c$8<4@gAZGgjT8z2$C@pnogd#E=RQm10 zSw$!$AQ}Yi8{asaM8Vk$?ca3aAsKoG99|=yJM#SyNM!LsV23(F#HE37pM? z`Qk*K?_~xC2AjxV8y?$GxfT)G2ly6u)xtlCeg}&H)k*zs82KOLf$5^w>*@&y%L0zS zz82yl0&Is?-9Qx%8Y77@^vXd7458drvhHK9F+i`QK)(P*1JPR!rWuIYgyX|yXp1rJ zZtE(I0G16vt!${TSC+t|ls??L3x$o$?~KUw8@^H~(}?(1b+D8h9=drJN+LczQQT8!ZX85!%rLSy603_5u0zMnIVl78e(*Ka7jv?by4R-~%e;5(K;)`dhu&XqKY<9Bh*YyQURw<<6yYyR&}p@x$+Hjx zspdPAu`oU20K5Rdt2~LM4Bj@WLpzZ5E^?&A~u#^2W2}mxPqmL9g(djnYE! zs08SC2f$`rL0)HrG6-QyEACNPTwMHI+GKUGNLo%#&Z;N#?GA1N3;L1@03*F}o1XxL zkT3vZkPUzx(bQ(~Uaqa|SxD^!l}oq6F453)_Hv@vQVyfH*Q3XuxN^sG>n~N06#z8i zl#q~ENkG_mjK0%r2r|=(kv^C!AZ;TmDhg4nKsWso^hQxhsm~f)djsBvzzl%hKvLAP zhP80^5oz8q5NeF(0|P<&szKO8YW0?ws~m476H#y#aL9H5x)44{_Z(b?xLbf~sot3+5uUrH28)$CnxZtGAP2tur7jDkO?faktPKg5 z8C-Uhn0mMwIcjJ-Wi|7)tA9NjK)6g+HEf7wS&!lW`Z+j)Tz@rgS zv9WdfLFkpf!)kVL?q+al%4}lWEGb28L``eOt;+6|08i*ca0{?BPOv^?{cnK#=n*1w$r2oLL287AJXg(q4=2@l z%VqNOAGV{P5S0ifQV1|T-zYp&b}2jWx|CndX-fJ$7KLaw7*jjl_Mz7~vmhZGfuW@a%!pY0Eo`p_0r1O6P5tM1iqao}A%Irsea64STmqRcn3|bc zHHBSoC@chK0Tgez#5{b(&3n*2%7W;D5Ae1H(<8ZqFjGj_)sYIG6})b_O%BqaAx4|N zd7g{BjA-SiF$Pz5#{P!32Q$_4(b7m=f@T1cDFj2$WK{}68$W!wiokb-MS?EBd_5Ve zGsCI)Y{mwED z33KDCNHK#P8#LeaoKMVxN);T{6i{z@k7!5gd)&3zVOFyEIe^5f4-*9>C+*9Zdq_cs zZ2iqkfi!{{En&_LvZ@ovST}F>BA91j1ex3g%If#&qoeu& z6ga^>@j~{|fJY!qp~_vRqDli9b+QT?S_2*!CA5X@L6h)PyCv!A_n}*qj24R2_lwBO z$*DRy6+@3Nd)jgl(E|{2N7!qU(&g0_r3araAbXZPSYU#t<_jdS2iowZ%a=1?6tnqQh)n9@K=fTLHXN*!bb?usUJuRZz`HFL+zO*U5I*bRaVau;L~Kt|wmy>=DB*BdqSbr*pUXh5nV>N1tG@Lkvo2*v2e zsk46b4%K72g^vS}N7TYN6q57+gi#mh93bN%OnBlVRO>RK@g9+*ah`i)}DtdK3o(^ol>UMG)C;7skC4aH2Xq$Cf1T;MWC_Nvb)*^x}VVDna zChEfnHdp{0KLBLNotMzw+S>i)B^d&7km3x6MLH5F4#>Cy+-?Mb^W33g(ruF<*iz`E zZ#@j>ev`KeR_Wx<_tDW;+$aI-SgZ^d>DKvFA}2h693lX!Erw@6im*WmlPuezVwOR& z)iANOchEsWvcy7so+J_wj87ySFZ-U^2mSMTZH#9oay%;Ra!}(`_QcIa^S>-qwZO*U z$(C!pmt>?t>HgwpKUP(Se4G^K)<9RG=)7!4rZhlV0h&dEa0jDB=!Pff&CSe$$f
=KU!K^tVTaM4puf`5kL-FB_dIYx-5JIgpiFWha7+L^72x6j+0z|4NZo; z!ye9b01OWt_y#SE)Z)U5#$SK!)f@nL0rR*vcYZ!PI+`R(pZd}b2=h$aFbqL_>_sACV{;Z377BgO zosGmdRRN3v_|CWI4S+;hc2p1av^a7A3D96eu|R2pfD)hfc(Z>#D+>!E0ix4E6FAj&YF{dX zsqI4-&Sle|`s}FKYr;HT&^QSKfp^x%a$8&FTk6|k23>giVZgCOLTPDfp(~_p{`2S0 zCnrp#v`lD0QvfCFq<14S_n4<1{y0X@TeDTvfgG6gulY7b$A=v7`;4^&A0Gg!M1Xpt z!k*=&a{8;4E#EhY9hQ|=vB+TUsFStkzIvr{;qL19#YFp% zz^MD*k|k0D2s-)1;``pYxf->H*T=*p*KzH`n)-PxCM;vSuf{#_7sjZH(M*z6=X zKH;LF5@nK6_;a32>Ry2$HIJ(D%#2r)n2bV*@9sMt`~6qWe^sq%%bCPv3p)_G$n#=z z+wqxwG4b>MN{B#PjG1k?xC>7)A8%dsEf0=ov26uxM)VY+^+4t0cjHB7wgJ4 z)x_eG{QV`*;ABnEc#Qv|*CF>Ton7)jZBKH>9VJI^llVmzDWK>!V@JCLbp3}Lme&h+ zZ-AX0F3~xsG|f04aO8hd97p>^d9osL5RI$QON02gv4BffIghK*2c!X)xCuq;aVm!7F(2i z(}F_S0I5uW0TErNO8$vkPv011bwu3b5TkzcXrgpIV?$lQrN$g%RK?hME3%}nJ5$vEux~J4+fPs^DYeT>*{-`TP~0OrvF{~M>+@>Xc}p=? zC@~w|WjViB@II{Zn(#b&GiJXd;{CV^-|R^8YaRQ&Oq%NgY9dwIgo&mC_4#;8-^)ig zt~W=B?5O*e&uS*3bl79G(1es2?$Ew#*G01%r39Dr>TB3md0y#L36uIiD+2pk68NsYCwTD}34GHMi9|x?jVYQsQ`tv{6QYuU5fBy5b*p zA8*=C3NwrbZ%l0MlljyqWPIbrQPh6%8CdWj3W)y0v-?*Mvu!Mcpa1n1cX9Cjq`8CQ zOL~9tlKA28tSx#vOj@Xf^F7?2XQT)cjND@f1B*3Q{qtV9{~O zpv|ay_Vtkl=XXbC>8B(jGdkjEetzL8%-osfRO$YaxNq!y$?Gk@%h>*GX>|XwdnU8x z4C{WYs1jbU#jaJW?oG2sxbp>^W5Zlveh3MXp32EStmW;edFh*jc{IMoeeUHs?PP+S z{>e)W`LC?)pO!P4jLI|&iKLi*#WW^v1v+uJqvOKXZ7T*D((!n$^_MGmj{85N`PsBP zUX=4v*4uI2VAA`(vL-5ac(YdTB5O6H+-g*8y}XtmJ}SZAD3yHtyA^!ePaq)eak?mN z(3%c|$gxb^n9AbAs_{W;kw#YkENntd{mR}#Y&icX=aP4uQYu5Ww1k`QeeTL>67IG4 z%Ho&39rVz>oYjtlZpFIu7G@KEgh$hljZyVKtYnX;(TP#ms74mc=qm*=%J%Mstg?6k`u3Qn*QZP- z3YWhv^-IAPHLgdsS`R-IF`@l%rRqX`Q2jL0?xgBXIJOu1i_19VTc7SeY%$r&?wD3h z%zfw@b(n$S?bC>oDfs8O;BB#d-OsA)j6EUNC^f2FvotYIbDh`n(QmbUBEHks=iO&% zbGqce6CaXubBk-)j;{Dg&8Cs4`Uc4ail7t7f49dK$Iw$MENQs05qeqZ>6hCQ=QW!g z6{0F^YTm58Z`B!=-Z$~hC!J`fP0^pl1Rv$+7t2^_PPnvBptJTF^UF#8GblnjzHC<2NCk_ALWGED=LGbkzo zk~2t>3@SONJF9W+z0dh~?mc&m@5g5JuzRf4U2nbh&YCrA*7H1*&KQ%IQpYjDT&2A8 z+kb`jm}%pRr+rLr!Q$@Wv*db-80mN8?(fL9L+uW-@(!tJ zz9VzjH8S?N`|W(0dhd0tN>k5``o%RfnK?nOa-O(rhO+`xLiC%oISNm!c@ItgGy;3A zte-kwPh@!R&g47Q83(Dt{9S4|DSczCv#Xi*`1XS*+|6EA{!ShBb_&rG3dR-V<|9ry z5!RIgMl*WZitQGG$1r%!s*~~_5>Lk7hGBoLwiSQV%+1?k)H(xbe*8&gj1$qtVB&$( zJ@jSz^&1A?D)=AX?-9QEz*#!bC^9v9l+b}vM1E&N_Kbqs#P~+cM3o<}(c8HyznQ25 zi(0ma>z_F><;}z|wdcA&mj8B=tyibFeyz%XV{6lI`D}e_Xj$H})T+$T3WbS|Ft3sD z_GJUzcor--;f1g6)3#pY_r@H|zXX)Mw1}|SkaLVp=(r-gXM)YV?U1U-8-0oyul9pj zk86{hQL{*$(bY`#s@}Hhp845|`%X$e@pPf#Zg!EHejbAx^#!IL4`=+i-M%f`@XOO5 zF0z~AoVBs-NHJXx|8#h0Qm=MoWs;2k2PTtvW7qKNQpC{1B-@8;YOXzNmxd~b+MQC8 zqKU$LMfkB43@<3cvD7DMP2b=<)Ti9NAe!BtJLBR1qibZ$wf*}w%ka*R7n$%W*q(aT zHkf&&nV$z!UN;R&Z%HgJl`CY3HB-zsGw?H02-fG($Y5gEaG4g-(BkD7`{cEn&c`a> z`&&FExt1|2MQY>Ys(Z+uWzNo+Pj_F8Co>h;a0#R3_YkZij9 zJ*yI~r`PrD;<`2ZUNen*{EQ{H_-#;rlRvMDzvl_d?eC`pRkAi4L)uQr-S;i63h8C; zq|ugrgUuxN*kR?BW)N&)%DSIEK@!D1NiiPLvCh0sPfd74T(8Hs;OF@(+&WUJjB6?;d zJIBx^2(Zu}KeSsDEHm@-B}HE2HS$@q<;k1l#?ErLpEKcRy)~$%T6-I#5f3X`41>{^ zX5pB1t{~C9S^gf*qB|~iZQm=GYW_5;+*u3r(&b96n(U&TrmlH)O(W)Y6vZPV4^f&V z4afO6By&@O)_w`sbKPsoI*b{6BuvKWU3LrX3VPpMQe4o|3?fQD96g`~Cadbn6~Pia z$IkAK1%-)jY-a>-=yFk9J;_-|Lzh4a55ohs31TG+vcazm6NG8^)}DOZ5@OvQ-;Af* zH4G89pBMDYKBrHDRhUcFA+n&qbiKLbu;Pj1`f}t9d6mry9(K2r{hU3(7}!z& z?Jef=mWY}^L!Lwj^9u?NPPa8Qt9e$K&n2nYzC)rhMk+b!K{XkK^&8LhPuJ6geQym;=#X5 zbW4*1@kL#tn!=N^5?B7jyQVp>#JXOy?Y%f7I>a!v6L{9}O!oSi^A~!juHPXIlzDRb z9YcaNJ)v&S(igsRPfvWiOi8RMwB>sI`{K^7EQyz~?dQS?%J-+)Y`3Uf5Bq1;3De78 z%nETWCT62fyS=uu`AyAJZEx}3(RAxC;->0G#%l{Zcevk6#B4T+EawQ+k_>TNXyhzYnUy+YuLa;_&ObmDr?x1Z0Pv7IXv)#fP>XtkDW=f2X8l zOSI1W%h`$ecp52XOuf3*p~>NF^TlwFAZt-uw%;tiJ0Ho@=IdJ1sgkyvJ=CsG%IkDL zeHpi_ekejd^`Y#B%h7C68tGZmV+RjnH9d0k+MakZH2;XU4vBm+GIvXL-eWwUI6rq~WJZzepx3e`M7tFKcTMIty1Bd zJ*VjEkgBrde*8>eOQmh>UzBsV{9bH6u#GWU<=OBH`FLI8+UNw88_cE zs<;zrI<~TAVjO#1*E)t%G&()3tFhzRP-C!u&fAy=q3?;8ynCo_|VTN?`GtBQ$E5tG45RkYQIjM-o!LorxbmeahmRXIS=?_q&DU zr%QH1X4b>EYtB+pKAC#chW~`QPAhsV(rZH}uE4%)-ACf`1-}Vv#@4n+{;uDq7HH-b zUPQ+&7TB!HIJh%647HE8H2>sVr}RHnDfhN_huhNQw!++n-8%xrr*0kzzi(LuiaEYk5|LZv^{H7>VV$I!f&lrCCW%3Lo{0_SwI}wSv?k!i-r-j3m3D-NU zm86Z6kNB~3c~nF^SZmMU{`hg0?&M%N_lk1tfX-~nx=-x4*{)AyPOE7QlD)Lk)}<3h z1?1(%FABGfq_Lj6bE;>=NwjasxQK2I+c@13=JjjtE>)_uZPxPpp0TIHDI~^Q2zxe3q}Stzt{w5$<#$pt zm#X|vwdw6}bImIRUnBbMw!^6>|H5PF)Rp?5V#>v?Pns=YlNGY`IR1XpMD|?fg$Li9 ziu}N&`T4_o;poOza$SA&RF|bw3dv#?(LqCFC?Ej zjxS%YQ>x>$+rQv{BnItIlTUOmm^>YTk9DRy9djyoaF}^*8P`(lj*|cjYZqcV^|2Xp zI`~}vHT+i*#y>M7q2Ug2JT_Wb$AAk{zD!jpzAG-Mj{ zET%sCeE;Xa{tqO!{{POL{qF_-F`57KoZtT~_VRz9!GE6t8iD_B9QglQ(SNPzzgC2& z{oi@;-+AyqXdcW188pRIN(mQjqkdI!V7j|6cDB@TD*}oRP(y%E{Exu)+|LzPKsr-p zmI2%Ktn2F(Ky+V)^P=!@+NcJ}`F~>7>g;M@>5bb0c0m?m<_CE?oa-Ev#I?8FwBT?N zpd912h^+u;*5M7~p?A)Qy!fXB-ienut|0a}I{byp1E_~e%V7oBC)B}{Zay)Ig@JacVHCOjgN>Ew{ru~wCcJLUl*JpOVheKqwzt1 z^9`GoIm6mc-~IkYnZ*r!0E&XJn=@V5*e3o-O4&9* zC?)}#5^?CHw|D=s;haz;{s1_dDWorRFIYGQx-AM2tK+lLC;QYA08(N&=i4&!=86{} z^ANZUAVv5_?Dn3wdl2g7m2d`ojyu?I&t}5X!K$PAAguv3Ld4QTgwWZPSgSSwN-_D@ zv<`0_+X2Z9{;^pp;s~;hO+bvPi;F)&0Df6jKwppon4VByJc^Z_on#Av32=YRn_t99 zWaX5VwLqu^A<2PrOg0uwgjC>3rV-A1wCX?T80_g#T(E?F8 z9k}bj#>!d~0Srho(3)_7cu)}ntsVqoL2M=9@NB>*E0cXxK%!(*z4$0mB3hjy1qtbcNE%9~1d! z3?o;-0fL#&43rficol$0(ZC?41SvdGYGGHIP{4v@0bgQgquHw~F<2x6yb{rQ4lzVY zP!d|WxihWo1w6Qj0jns}7(|%FAtZr38CsPpfnaAK?1F&0;O}OJs;b_){ozM28UVs0 za2DW#Kdm-$D8!ODkQ^g-XqYpZ`~87zpI zj!rUIXz>}~-V$L`L-1iVX~Rgrus2ucVcmKZz)a$(neB*_Cv zt~7vvh9;e0FINFHk#4cgoo|Bw;8Ut~JwsY(7Ne_e((7IAzhD{N2@}DpPO@NLZ$ZL^Km%=Cg0?np#0WC(UZ0 z6cKn_mm04FmWot=2*}Fd9%g#;Qg>Ify^w?s0vG~<6S4GN=V*Zah9JkZNIgd#;KK-& z3cWM^_UiKgE?fi53E*rYy8+v*06%rv?IPRd%Lw5JwpWD=8#x|C%(5SJnM7kB!*7=Y zNH-d-f8-jfPs89zoN8Xy2CoQQfh2(5B3mKnvv~)$g0Sz*0Fr}+Rkz&v0|3+jX-0z} zspU&eY5;i#SnDThQmgX_Vh?ddeNXOMk<&Z3xG>FCtlDku}ub$HNvYRuw#s{TOnd(4U{>VgEf@` zVWG3!#jY`4)M)L8T`;JDj6Lu{QyLItpeKTahC-`;?jf&>d0L zA}}N4X-xt2YzAmZsi}e6Mg0h?YX)Lf2zHzg*nY%n zSJlvnK%<7(E8v&20NH(>w_NS^PW7RBz+Forh70n1U8Xgfmo*ov!TZZ#NlWx;%Xl8QLc1ZnpA+=23luALAQe%Zc(B^9#K1BO2CCy zfY3hkb0H0wFls3Zt-#AoMKp5~p?PoM zo6?*Uyb58G`KPDHU4MP3MR4?^7u{9jy>|H@|I1M?PE9{LmQW*!s4+mpve^B=Vw;8; zP4GuW$#8%Ewn@Um|IVXVU;8a1LGm9-_F6iK|KSB0`q)M(<$s0PHWub-ss002-4Grw z1JpSU7JNY5F8^CBruH1rw2-=*b;U{~M3X3hT3odKxBjBdc22JaiVe~F20Q=+^9=>( zD)DdinILu}_XS^M_WaTR4z?*pLF5DimK=X+hJQEre^1Ww|79#+bqd%j@M4Q%{*_u- zSU4D*_nqcpv@{T5ZM!x-uSBI|vDhM*7H2kc(b&(w*f-`=@VR<{`J@ntB*K}2tg1_a zfli>B`fOyIs@ju=7|w_{;iTIJq2(zZzey!Rmscw98%Ju%@k+S(Nw4P65s_(zHyE$? zsnW^z>8P@hfzmOfj-N%L&+kl_VZT=AS<%I+Lu^1xz*z|5ZE)m>TL5fJnsYR`=N0r2 z#9Gf=g_pgjE7A&*O3zr530l4nVH~~$VNtD$|5>t`7C3!uKWFA#(Uxu*FuvmFbTBv| zBZ79v@~7!ckte47!>v0@banGGM-)}>zfQ48Nw1i$%a!F+P&<-dw^=`*kzcOg$*Wf( zM%y`YLiCt8>JsH~+{3GWaSbOTO1RF7Cpzv~}}Ow@pX(QU}6U z1w#wiS*LGb3XObEHcl6i*Xw>mCPXd$R;9 zrEz!DnvACw0pMb#bEO8#YM9kL36wZOF8xzRJecOrlJo45E4K<#x*RN0rsj^{Am5}x z{;ArU1gA4<^M-&>2gsn|F%v4#V4);efwfLnPqDf|7nc#09$CW!yN&K=yRsu+6Snme zY7=^9w@HLWZypQ1U1VO{B}6CvrT#%4&-zh>9`+u>$MtcT52QGNiHr$X_dgw~8vg2a zS`(E;X*pD`p-yj?rCW41kY*iwW}hz+EJNgb=~_y<@$~Zy*6fy`>?&0=h4PyuC!w|B z>;AYFE5d+R0s(00|%3>P(rKeyYBg*_xRH(c$umlHBPUm6K4KO;SM!-B`qa?1J1 zUE`@%hTuMO-rqgtx6+TN3mrNPjjadnORomqd2C2k2M7z=*~1QXk!<`Ay}spWR4G^o z)oc_<1gkv8qs{o*;rEM$EIHXk);JxAhT+33svub8<24WM;N|$y5D8m^oI#%{sUE+p z(fJwK|Mq<$eSFI9sb}#Saw83d_a9k|D|XQo?E#?~^| z+^bJpFiZ4W$85A3c3KR)?|8kAujhe&!Y9(&jv}`82-x7ls?2zmSC+m|G|rGplq-AS zDqQ_fxJg_kjS2r@p)M<%z+}FPT{o0vNK}JIfpMu+XvBy!Ezj5;H!B=Ut6xU8CJ0yH_FXUjT87H- zjdA!@`);vTw^6>VWOCqf!5}VpY(E%V1uU1WTs`0dcxT0N7odC$6qYZaucrT&9jOo` zkSCXB3mBETpB>!yi&$ui628b6v_D?{BQO_qb(y5YG-td#Pbii}4^nBKnOb>NUpQy) zbi-Gw=r?*6@D&x5-eQyp5rH4rLNRE7>xot+2@R!wXph+7=D z8c?Axm>yJAN)0o-2p6n=^b|K=OvHd+RbpcJreTb)B7I_ zx6IUUC5yycv?f!Ry(Ip99Dcm+wfaX$sHt>tZ*TUkTO>1?RvLv~2KziZDLF$_~7}F?81as3bfTK`~Jgj zXl*W-`|<@<6Vur5!Y(3N=4_!G?tcWGLTwG~nwjU;DDZ@EED5}xRC7;h$9h_iA;$J2 z4Mog46m1)`j^-OiiLUn=88jj%2}nTtUmQhuDtzN_6P zo*fHYt{!|NQs|l5mvJyOX|>P0vee`S^;@m%`rNKh61RTZw!TZj-flvMJbVOa$mf@H zdoxu-a+)p*-dM{XN_>R1tPkICv(DhO@8V+J>@HKjWk6<`g->GHXZ^zJJy#%y^UgT6;>}iM-M|{s}iisqY(bDZGG-xTk`TRcA{6 zHTHb7uztnbt~(ve%h2#+Pku}x+GsMn9~<#~?R@@b%+d{9vXeA;XQ&n3AYCT&{CcHY z$_dS1DsGmO+d*r0HKGL`YUz_y{CJmpX-OC#lf{4WFtQu5N4S|*{Z8$?vpo@u=*h_G z_RsfYud;lbDQa$?Fyo+E$8~3ay}*x- z%_(PlQw+h>lfbeS(Y=977oJl4T=RC1Jrs1*w+9ePw)wm!q z8+~?Xb|95w=n!sfs_}4RBUU%PR-I^GDebpG?X1^4OvC%=JtX%=aN>;q7jXA17htSo zORqH5U7aZ3?H&xzrCOxKL`6EgC*{m14LQl0{RU4-A^+hW8Y)9;e@7#($*8aDvGh4i zeFuNpPuHn&{D>pba|akN5>3%$XSL8v2Zo7~hgkOe>Y+zKc@<}U3>Ti?6yL0#-dy*K z%gy-yY25Qpw1}cYq3Ne5nVwrhmRT)zS%g!siTcT?1U0AaOKp%qWc3}KOb*D%3wV^|C=Pi(Pr{u@o z{(Po76CIVX!BA|O;qQVkWX|?=;TsOSr31RV-D!i`Tmc)@uUrXvFMitZLCzHvG*j(^=b#Ie9i66@~DoYe66wRxJx^zeNhm$}0 z;7QwerqsqrkC}P+aa4hZpU9#D=8v0a47nevS1hJ}@r}EPR_OhnEcZgS;v@bHMt{1m zF*{8q*?yVIDP>-$QRhI&^W{^3mNe=29?rZt5+k?Dt$SSE8<)=WJ1Zsk z4on1?p?%J9%Y_fxnM=(@@EMOJhee($QEH~2sk^poPCezjQE_sb2Djek#>+(e1r0ri z?^8*A0#AJPh|Ayx6ly|$%LScj$qnpWjBUHO}#_w`+8zc4yW#k=u>M*%f<8QA- zr!snf5k}TiN%Mp}BkaD#P2QQ)#oH?)QFDf|*DqlNYf97`7HTfXN!!gm_If+6(`~_N ztiav9!ZRWWb9I2tZm5|8x>nu)bD`LxKXSGdf_s#EIQZD9$&nWKkWxRNd1PSw(_*Kg z{3n&+uGPW9#1)jHeyKaK_(iKT{Jd`Q_$x9$N@m_}lg7xLF01Sg3TFKc55F$!-gI?y z@x|Zr{O*2N4q&z@MT~~-_>S6Z+7)MEmMbM9noWOwW}LCH==7zD8QbKh4QXq+Npbnx zfkk@O3Y!^H;qCf{fG>A_8&D75N$=0mFuCOLIH6m6R!1HFOjHcM9&h!}RWS5QznD=? z&*HK0E4i=V)%i&PkF)(X?Rl87)M5JD)$85@dXea`ORw4bq#93_vOXwJdSsjlLO{kmi`F>?!JzjSw& z8;#0aR3GZ#X3>^riRST#tyr zOfwgfY|fCx|4yTW`WDxdR5t=+NeO)a4t3jOKkDR1MWDsw9UA%Vs(qqb%97R`TXeNV zC`)_l^EzHdoIg@*e>EfQt5*u~g*us4>!Kph<{yK=&CTW-*FP8g3#?X7kLQ}gS(Nh? zsG%x$>75C824s!Z3tV3O=_!VyS}r@&iChKSX?F;&+WGnuk_Szz4Ge}iWoCvVPw&)p z8!g{9x8){-&`z7KE|qpq?s-%`azM^t%xaB)`jU81L?8D=!JP{HdkorItsGlWv>#FrGwQOqNAcI z-dL{-UXBmy%`u?)`Vw?ESoP7~aGq^{`Rypp5E7}l`%qTHWx2zUqDAYRWoymSjK*1u z-=3AZLaC)0!kasJ?aMx8vn#(|K)&-~-rZ|e2OoPstO=^L*YG;bYtfMn_VlOclkR+(c@TBL9W3**m?HysI-`uoTIwL7^GH(6b^w zi@VCOsZU0IqW`^qwapzP8rMxD9(YcAaGadY}S=}y4 zd^gB_q$~7h0g8%j=J$s@{B-Zr%Iw9^x8tp9#-G}Zz7n@Tyh_|2u#wFer3i8hlC+5S8d1A5PDU)n?8~xs8BQFxV*9g zwma~F(&KJJEta#15w{*^-Iz>>z}OpAx3;Cz9F?BGvEL7s{eIY^e$4rG+%nu`*J6%Y zJ3?LgQXJC-`Vkp6CtRQ1yke_`{X;CWEsL>{mrdwH)0U4f+3OtAs#l)Y8NXF;i3RUn zKk>#&z@yyimOuQM;q-G-D~XGxPlD+c^t=R(a}U;KqD2#XUj+$C<53p3RlI=Bx;H&t z?(qSWqw=NoiC4_c)r_NeXP1w=TGWvH@>*V<=aUJMxml+eyF3-Svbn{m)=8SBa!D=b zP?MXcTX=VuDz2^a7i|?`sI5uu$mCOJf^Lahji}Zg>j~=8jF??~B(XB)R}hfYM&K*% z+i!y>p782QUA|#Y?v3k;7m|f}MnbXcHsT^wWiF}W1w6KI+P0~ogWfg!V%?H8xh%h5 zO07&M3(6N3XmEsdpBa^sVQ<#Zkv{sk_A<0tPp?LhZGbVpM{&O}V&Wy(JY(T?Y+t?2 z!xMaPqj(-nje@f9?i^&!!~vw`}sj$!>^gKq+}IkdW%1-JIx?`^Kp zy3skypF3O!rW(F!=S4+BbkIE^^I&}s+s;3sx;6sG&x%_r6Oypg;`bBdztZaCv&QIwL{@Kg7gLKphK_kybcbX$x+C{dds zlP=7|)%`oiPV${++l^TVBS(AjXm9ho+O~1PP^Y;x>K-}x_!H~YQ8@jKSD3zNd7OtR zFj66w8QBnh@;!2jh{gveqL4Y>2*mAz4lzY6&Mq>#t;Ak9VgKdf*?M8N^eDEq+35s{ z(nGIqf7K(q^q>q|D@}aMX54JTnJ`C%At|!Jd^x!E*+I)>HL{VIw!^ilHkm;@H{^0#$t9|~#J5FuL@v$7*JgE|lfrgK#Cxdyc_drm9&IEVFC?dY{j<<1@53z8 zUeUVQk#G`jXlPjc@_>q(X2QACin^T1H+F;COzg%tiKxnqqgIQpMoz=Ha-`vMBe%tP zCaDbgA7Ep0J!MtZy0TL;s|4{jwx?D$vx6JM?DXr;9FTGGPo(hB`E6JPeoXQcx1z@9 z*yT0tn{MVcbgdH^WnVhKh15^V(|p6Z;{WJ;VZsfmkxwE92V~4ADh|D>uEe9|@U}M5 zy2>IfP+(|gdJ9tWBb@kzqnXy4vLl!5*ts0WpNFmJdnlMQGm%;}uess1377wvQb|hINHINY^$`!S z9c?EpkALyMDfhllB6Km-uj|X}S=7^CxMKtF10#Gvewxw|-!HoJshs!L7jgBOX!11d z`X27+NsD1tdi(yN^s+Txo1L=@11Xcf)Tv{K51Q$esLKasus=5=>9#fzz@db^4RLOp zRr!Ppv$LczYVX?&OT6m|M*B#s)kg4v#(k59&2d6@c3aOXBf;xd9c|a>RR6a2?i|jTmIeC@$r zNQhcXh&pPN@96fk+EKaGcHh()E#d64+0k8y0OeBpd`hUHeKBj?7IVreXq17H*j&m| zRd#l#dC6In;Lt1fz`=L1sjMwz@j47c-@AN>#Y*vC7iH;pW@E9ir9s;4#(6q$d_px3 zx@S~KW_(a<{*F%9Wq;BIXMLo5q?!(egJZ%QA0Rb#>Nb87&1SP;VTr`IS*y4A?~ej! zb(?Xsr5OP?lMd{TE@$B-@y}}MHD#NB%@j@B_Z9W?2Pkg;SsgW6s~vqLnRrVWG-@{i zF5n?^S#reToaf+0SkW{sdau~wRj!V733uOnx95+1VgTNL`v!fB=4MGc5B8j%x@sLI z_g;@RIKm?RQQeRN!&G40SWU=r{pIe)fv=;F&{^ZkM2&cxT-xsy|h&t4qg zIja>qCKFntfXrq;A-9uZ{%j*WgXa3@ZJQn=yr0xj9r96IE8kmQ?+(e{TfS?quR*pW zS}k<;#kAhgW+e0xPEd>-BeUW|00RXIH$pM5C|$LDq^M%HV0`gR7HyW?&oKJ?DRn_*v!hR3-BPN5`n>< z%ZV|fUX^|Q{bl|sdXdR+wmuCiN-A(Stw$~0sKA(}D5jyI;wFOAabJcTe2;qW+yOFpq z$eAY0&+mXyys(GbKS%(-V!~s6#}ibW6ts*y3MRfsw?Cw-7i0E4s}(fe-ZCKjg{kIm z^7LO%=$0iPiwixovwx|I;hNQ(cbj6@l<8bj?FF!?wiPI_N8ULvcQp(tWZT23@eH6P zRPF5YK&W=CF3bUmL7yi?b+p=%4ln4#I>t{vK1z-B)u6fqi)`s?pSgyS5xXqX3$+J$ z(KN{6qtbLq9%N*xZ(TD|l;a0Ig6@v2Z57;InmBFph_2UgHy)if^C|r8q$h%e- z<#p!PoM{tfbKB|(7s^a$p)709rC5Q5&u2h*m8GE#30BRyPYNO>&0VM{Wq?2*wk2<% ztEkG6HGrhrDo2)lp-u>r{tWio9u=5)eJ{xan@8=rey0NJK_Iy@C=9gyX9o&IAR*dd zF4EuxzXZud>2KfM1i4@TjFIEt_>_uU`oB;(nLsxgju%>DGO~2l-m@-h2Hv#JO46t! zPmVeBHfHkLy|09@4V4LviH%)B`sJCK3XjFa04Rr~5A)5t+2H8br6fpncl`<1@>yd4 z6@cZXS5_LLV+W{waWxDlWCx`cra^d%O(f1MP z*%D9VvaH3dA|t;E{pn!la-L?1P^lnF#+s>@vATMCD}WJUq$HN#5)T3$U0K+f4{Vv6 zo0o|W#w%P+M8n|<5_;enR~n3VRY9Ka1FEobn?t*}fE4vH9695yEHvj592;Qv{20A;wE-@!34>4hOCx=GQ+wVXBDt)b>*@4fOhQlJS z`Z10z4H|VIZLzIUz!M^MUsy>(lY)YX8{Z1+A%Ecpqg^KYM;=BG+2ko2DVfmFx}?gb zxH%J$`bKp>jCC|eE=$(Ie3Cs*$W=r~gvkmSb>=Gmj{s))lCS$9`Q1TdC}d`4KAVZ3 zhQ)TGqAChkX&Q1ny1G(O!8HI)L1meO0#m3}a^&Guhh2~?IFPmG1T0n&?(vUdEZ?KM zYqejp)cvBjDB0Jh&`5vH@4Fvc;wgy_(l^ZF4QFl`y+o!@A{Y#{KePNUbbgVrlxZ-ay zMa*Qeqyf_Lq3D(lDg+3M*6(mr?ImrAq^|5Orkd{tvJ&raF(H8S-&pXSQ9)VT%f7R8 ztaFuLEXcFQKCEg2Hk*TRr`BuRAJpCGx*f;@rB*=BR8KyVrL}6OzY6J&XU#$dG|A1r z?n=OYm-@tkTAF=4DAMU5NZkrZ>FPsqtT#~Fkx>@9zxnB0@VnCns{+l`WMXr<}gne=uNu$yZ*oj$@Gc zA#6en-4`Skqd6su1{`BiT|W29rLAw1OGpUaa|L5$3a(JM%n?=jqLl^IB5pVl!l>6m zGxUCcp?-J7Y$+_ezv@Sxm6Z*#1*HL{At50q z6bkWKywqly7|~OL&(5;Eu^Ky{6IVKWL$RR-TTMogBBTJ8f<-+Ctz)b_TdEy>t>FR+>L(Xts4G}l#1N0E4#z26?XIkDkKBM<_< z;C{>*t3H@b!mCTL$V4jnb#lqnnsa(X%sjxHX?#3^AHG+8`KKc~#oq}KI8MskFu(iz z)Faeae8IV@4DWge79)fk#IW#E$_$Y zY^X~7ithPD_+gK=;+nj+-zDa%+M(b^!DJ0gs8T9fa4oz}MA4?ZVdwAkJC0~7+fhnO zd^$xm5Ep*Wb&a=<#T`x9^Y_cQ%usAP^-#7UdvsQp^!d|qzCm`a=e45 zVG%_u0)sM_qz?r3XMwf*QnR!_%+Zc1o>-^h2YkVc2PSrA1I zhXPRvpOuxBxnqwY21CN=1J0v?sOsbd$a>Sibry$0kf?6l#ohU%1^M~Q0$*p#sYlKi zzMjFYNBakIJM|p2Bu*r%E%Y8at*T6O?D~sOS63a8$R|##75R3!h_4>4Y_x(D!Z@Ou zBzqh2d#$MWBU%PF0o0xi_{Euf7q?ymxU$|!-QQV5E-S^k_ykbZMA=kU1b$5|uRnv-I^+c0PM#aA_6q?HfU8i@;FDjb#7u`;165VqL0tp}> znWGw3`ofe_9X=j8X99i#g;Kx(c<3vB`ODpFsQ4yQ6@A~D2CD5HhP5tnwI`hK7iY2f z=pl71LaXvCa9yz~PTCERK|;d(xlMYlf{cu;zC12g{q9Zx9-^wFsGg-J$N66cZ|m-( z`U}1_cVGqz1Nt3O9|N;cJoS}je+;`@`s`1YKe0e@7Wb?@4J%)rr)wn>a3SLrOQ z@vp;VK@!zL!mHW?fD{F6Kl6_(vH~+{iICUL2h{5)x{@sBc5YP1<`bPV#EF5HLd0vQXf8falkD?-Fn$2_pS?-{-6 z29KLbtdeO?czuLYvc%<416^UHm7k#UEssl)Ao)%C)e?~s>OBYYEanK66*R-=J#h(@ zcS8`63@khq7qQloxo?p^uxe^zkbi%0ogK8quj)i5g8=?HwmJ^N-a;%G)LAwc$hN5( zC`eR@eEt!!sxFyS;U<^y8)@^{p82^R8t~77{Yd;LgBGYKCPZU1Wl%( z3k{1sIp_UnB1_TD3=wh;*}-tWnqq1Okwrz&(v{jr_UaCSnNH~z3jv*eiO-si*14f= zjnkfFHO&2y5V4<=wHt)Z42lc1Q7e8 z(3OB>g|@qp$L{m9)!WyUQ zF0$yOcnzOwzsI6g%G368F4mLOa(Zo&fwMwGKg~FBQ&CyXz+83FdE!n_n_11R&$C0Q z)`QLYzcwN19(k6|Y<%U^Vesu23a~LP+SwModc`lVOz;JXhvWnql+-}~-3t>dBxua! zQpfJSLTlGPo@93tCg58oQ(5_v_Xn(-YNqbW2_%SQ2V@9j2n*3hG|zmGNgLg-+SYxD2K|nXH}QgK$c`<=iB(%ko;`{x~>E}`Y6T_ z+Y?c@Zk{e7_NaqYvc@3wZ8q5lODF}Z+eKEiWw26!9mFvare=#=C(lml$!IA0L&)zi3+SBsQ$g6FUH<^Yq?3(f66 z!znkcVX9S7s}ojFMxfPDD4+01%T#tuz+Q5&;}LVAOJ%)8X!xT7`;KE8pQF)q#j|I8 z+%FIB&KjS;o4e#{X3t@lA%XE5v%3B(?Yg?!kW7Jeh-|XzqT-v(dr{VEY~(EZtCaD- z84NFWM*i+6J9e00KlA%yKP&kaHW6RCs0cQ6Sjc|4@f+*p-9E0EK8R0`lj6sc8xniSA}%T+%f)G}Ou1(0KUhPM6O>gyj8D z9u8W63k)Q5hkj<_uPI_ zYos`b5Za{)ZHPTSU5dpWfk1??dNXWdjsXkFt^8Dp&5myyF*e)Wbf=$xGN!zdt}Z9w zTAE_ncR4jTpXrMG1!?vUb*7&re{Y5w7YpL+Gmy6RSqkQ-m6YDs)i;IvX}{YxnfmKi zVj^L)gFcPHITpNItCYcHdJ*hv=d2dWUlCer7sc$~ z*G1fvQ6WVS#|eK~S8bY*doGu4x_j?Jl~Srg+U=Z;Q?TWZ2=H?df8Mn4iq`9ECzYqP z#>d4^=GzB8N!f9qBhH7K^k7TYd-G}h^)JLLm|$F=lQ!QIk^1_|!@%Ndv84(Oz> z%V1ga3sKOz>Z4T;Zwv&jaG1YNWI5N;F$q|%AG=R)(hW5^@k?hV^*e#^u!h|oCWPWj$~7o$S^UO9+d ztL?FWbY6k;qD>%=ySfYd_1qIJgy3KxN7t2aTQqmmdx*g($8$d!9zAJ)g!ePF@ z7GVZD@Aph-FImw9T{7)Cgs zeSLjS$9jsH{=Pbo*_DsAZZfo|Ij<_WZ4{=HRF%qUa;xW(ffE~F=<1N#xjLN2Bol#V z#k`^1+8=nwdrL;(i?3MVPiv{P<*@VFVRJ^7YB4w_&Dl;V(wNMOq60R9Le$-_!<5_3 z*|vRPE@Zk$b$E}D*7rU`-UBiXJ{v$^*bY;SKfgJU#rs}j#DA2`a(2=-Q7K4w<^rA)2s1ywt1~(TUuCu z0W*0-vm*fsGd~zz*`c7q?Dqwz60^;_{dtlPZAwQu$W~>YuP|iy`lVsO&z$({+w*|h z-=W!?z#8Xl_+<8)(?FD8@LhcKo9uh<+kzacy6AQ`XVxA1Y;^-)7Pb)!KdE~YNjbpq zu#rjfO2{W;XdiEDKSTDOM;jwt%5A)3*0k>MWy+y%K03K{I#Oe)m3Ya(ou6XUwG=eAt=XwjEgfUGMN1GLpn<=+=aIf4qNU0p0@`h z?5Z2JJj;Bqd#3dG>~iOs_87;R3mH_cJq8;i5qL?=zc?B`kqbMNir8**3@n8>lsbHM zSH#S;1g#EsQu!7ZZmeXFc4JIcW!%iJ(D4i*pU#_XxId-#t?nZZwkOt#NlR;~KO(Xt-twmIlFuGB20ke7r5f9v znNW`g)cGPxubdS@Q6eb?RAl`bJVXERsQpT@gGZqV`O6vcxCr)0<{i&=XG!w!D z#E9z*3d^dwVE%P-7?*mwE@A|(Ztf1TuxmIZl#8cuTU)DRR3!=obg(7;+cPHe%+U%f z1UG0`Tzuv|VOQi{$>l9Ot{`cKAq|vLH@wg_9q6JMP-td*KTnC`E~6z?<IY5LW@*W@YQ$Se7nUhE}y0IluEA`_m}&=fca%`31(!jqe+M zZ&oKLen{(bztXCvFA24feGxNs;Ys)gA=aowvF|$X6$@P`OBh-z5h5P6wEF91_?cI4 zJc>>SF+&-RzBJc@{w$FeD%)SJFZ+@dWc_GoPi6=VHcr_XYE`*Bxmq!pq^%cAnKw7f z{$MvL`J8fe=AHqE)`tx35l-k2#}sZe{f-v4f>ZM$oAt-3O09ml_UTi3SBk$%etw5w zgAyy#@r_%bRlX~OCnCI=BcDE6Q}W?%YhwgTvXq9>m`Z89_%zaF_OzVYK*$zrt7KT) zT|l+)Dp7^|Rd-v`@@%(KXD_vdo$-VPtEk!Qw}djLeYz;J@z^)tIyu_Y0y8~2`6aIL zrQ#=lpWvdca}>O&`ta_Dv=S-Lq5dKQm)e#E2iDv*GPiZYx*?kLb#rc>?>x^LSY{Pg zXr^C?t>~PnkI!Fj>E&A4Ji*RH9(Wc9lG}I6jCq!N4|KF2Hj^h9QSaefW(9ehyt5OL zRz5^#LYcPETJBl+pgdQ(j66ox?R}#LM|68zqO_UP-Ry&wzjp*Ikbj>KJwzlNu*U`; z@fdE$q~uO(R^+D`ROw$=qG2A|z!xS~Y+I}vz4hyVadbtK!K9emoT4k*SruZSEF#RxR)ho(`=FEYLHzj0%;o8j6U)CA&WtJR`Zh?SIS=rFwIh@z z7)@qU0x~N!Zu25IW3SHpG?Jt1Xwe>D_$G~fkn3wDK}7q#woJyd0%!4xZK^L9{Gu=D zv3EZ;&el$sNwT|yax>l%INT;)^Ng9@O0{{JLwD(M@{6oZ*Na=L{#Tc?=%8rCej03M zQaSp4To%A*2k{oH!ARPgRmvAd!23PP&WbF1BeY>AWlY%ER#b zI~m(r*;_lIpXOa0H~~$*gZmTbG=Qt}R~xk)enTow_l!?tEC0|vN0!vDYJJOHPyG(W z&wZrC1q$ExahY{#>FKw&ny`et(nVNHPXkfUxX`epj+IC4aHFxizv_en5_>tBj@dxK zta6Z?pJPe*HBMT4`6BL7g@+ING}fMR7lWM~jPL@^{cn0&+L0+t0M18d|JHW)sU>vu zqy&r~i~~IvT=_p9P4ckJ+I84=262g;YXvOCr8zO(Z z_j#kwT^IYZkcPtbByPkG?Q4?IVVvf#1q~nSYrp*OHBNJ6@y>n%g77a!KVOFSeWW60 zc{n3sb9&|)xsL4owbu@fYp)%iPPqMTaDQV&mko7}n9r4G@MHXD3m&9b{+zFDC9o2-z7j5x^;lm$5gz2rb%bXAFagTLgPjqnb9 zqRGKhi|`6~k4NnAur~C6P-i%@uw^&Q48hd<u8OePr6QJ7qG`p>VY=**uJzcGLAFc)8?a+rLrN^j1W{Zm5) zjo?BZxPF&V1cCal_NY=TVJ2inF75qGBI#oC`XO0)Lq|YVjXu&{cH5e7`;k;j>sKb5 z;y&fECj;^&`dnY}`pOwAjnI-v9mxbh@hRB$eWpV*JMkNN_1|m>zIxnh;Ju!&(K{n^ z(rB{&^YClh`@HBbylVFu@crp!BbB3l&0wwtja%=^UId#)0PZZyX6^&D1Tq@&<}f9d z8V)FfANNWRman|V`V!y;_^>)jQ71{VwWZ7Px8&8TJd?JR-?1ohp`uHyvPP(}S_YY+ z16#;Lc$1@DhzVY{W!+ZNPXg@#7}G$VF|9+#*AJfog2MMck)ab2zi;{=pL_Ti`GsA& z4}dbR!ndtT+=PeVa{#675F;3#Nudf>qwcczL;`D;SPM!%n>H}w3s1ugKiYc);mx> zxCG^r$9&e9<#j>QboKuHGj-1v)rCI@=9{O^kcUZfKv4m_he@|u?+bftsU#cA8dR2GGHp*|?9sm;u zM>;c#ReCpWm-VL;TP~@d3RO}(_^qj>302PLDM`HHqrmabywiPh0AKX_tCWz^vJHFg z2-8CjV;N^OT&l5@6Z!-EW~`Z$sjuW(rO}=?cL8tBWg8Zmm60v2my8Ka?tDrS(eSxC)S+P z<8R#`EG?2pzD^&>je9czU0i=L1)G_-Wo2X>C2zM1ha<@$+Fr<KZH(L`nQ7RJnPABClJAPIYag8t4aOb|zO=wOClYq2ub z!XRz7_+ZaScZrQeO4mckIQUd1yhDyO_c_YC*gH)teJ%7=3PEf#N<+fH1aNU%XPTp@bw*Ey%rad1DrX=h{6Xiu)eFH+ z<_F*WFJEs~V93mlJ&~xD*{UD+wrg5qtA268@@s~@7&yg0#0AykfEIf?npGzFw*AOr z>^>W{u0NLgowKgnk9}#|m(4r8bA{8@r0UOI4Rfwq|5vB7sxkO5n=Oz6yKrv+TNuT; ztq$E0p29SZNW@Zoc3@3)Ogmnn#iGyVEw?AU(7VL(yS^CKlqHUlu=8quuJ~2)eA?&O zOEPO$=rhmv;M$n%S3(lC)28yl_m3`G)w;!^Us9ZB);a5DE*!-90A)M=`lwXYTlx#f zMdK!AZ|!NjUCOd=S2oYS)^n|Qd$CEGT6~VC-yG>0GkQ~B&vcXh)E!4@YVb3=g}k=Z z3FlvAelcX9e_ZWE!ZBvYQeM$0+d(W(rOM;9F5@jh7J4Ww7^b4w8-LAPdw!N++gvU= z8ftZFHMkhjXNU4ke{|%MJ$|crZV`L*=5@Zz{KBHN1HxP~f%}wl!gKS|IDZa_l=}Oj z$x(HTQjDEvC>+o;Yh`+Jz-QeD%6_X}YaRxB@1Z9W-O3<@cUxekYpkg z_HhIwUB=DsyEY>0kem#^8*i?nH-J8&Z+&)4{tQg6Z5t;V$;GfMMtkzFJgQBN915}S zEqax|Q0mZJ{)b&ed`$mD0UtEc5^i()BzKXY&%GyIc5}KtJjgqK?Z0O$gR^mFc49hz zJ9S!>l*fnFjy_p-J5)No2oNibI0@^y_G0F6y+qo*S{%Wvc{-A_zi?<#d}zk=qI%&G z_ndPJeYRt}qdkmNnx|)p7hg3l6&vHqyBGsT6++urhvGxWy3u4nA2+$mKz47anj<(F z9^`{uE8R)B8kYuf;}anD-ntk%uBK z#LedM?$-bgV?r!zg1dz7mX}bMQD|!E;T^W^7<X!TSa6fk}ZU=$n(+aul)D9M((M<-9^TQ?k_b(wU45l| z*4^NIH%y3a(fG>EwaR)^!2vsq{zAU~!c=cNH&+au*Q>O^Kx(A~DWe2pM>?lGf>B8k zTf?lrzdYCGlf?~?Na)1t3>8He->^vxkl~(mQ0Johj-rIbyGiP&2d8!+ZA5?%YNPRx#zxLjLL1Idfm>8URhYUPK!l`f&5f z?)3oT9cUdHId^K6K=XL$x1I#8`cRiqV*k)a8q_2Ku$PsZD(md*O#FOGDhYs#s7E%y z^R(5rbMWe5JI>XzCIk3I4nep;aRmTA_^(IMBio=}xnwb+ff6kVm)|X@!U)j;Xu4TU zwxyy1e$&Op8_>H~8NEwrWeIv_7vSX~@gX43f+$VZUiZ9>w|Px%NJ34(=T9&a@&h3; zC<-t0z$--3akC#s8R*%>HHSdK3!&pC(Tjr{>GBRKb)B2V>hB7w2}qazX}CP&qrm7yG2vij>40hIkF5yoNfsvb&`qYt%m>qB$ibp!$-sKCcWq=!mo|Kpdz9NgykM=?qfk!}~`)^lwgu{##G<(w5*GH?;n+sos z2aK#U#Xk@8x@sQh97Pr!!?h&Ef@mB1`E;ZL!tiMWz-MZDnvgC{LO3MQ?Fi>=7b3t) z02n1tLbEmKN?F~z7cpHz24TptyI)O~3*%pJ3z7vtFn38m@D?|G@nA4ica=N<<$#pW z$o=6pG+szS^KV|35KvLGgmZNGZZ7*;gIt%Dg$2MdZF2X#sRT%?yCbVyNJvNtC^>cX z^kks5(4nECC6&+}aasd4VCK_(mpG4*5a{Dq%Os1tbr^QVo>cXnLwMn{c1e>rySd=iB@_ z>%th7)KCFgvcQNn2<_m^v20pSz3zS?p`r2@ri;v-24r)KY}ru zfLCpjTsB1549YRp%-W;Oi&Tw3l~sh_P+Obf&iI1 zWPx5Lkf)rT3kq!qvRhaHJm2ll?Z%hqWT2^}7WaWE21RslfHJmjOOaO(J33~M z<{2!9-Od<{#is{5z{r%01RjY1ybRzod7>LmCp2fnqTR%+Y^Fex1O&)<4$vZXyOR0p z-2k@D1;sKb#_{gi$@+ZSOJM)W8>%qvnxxk5$sXT}^cka#Tw;7S*M_V?=?lOx2;VR! z8d_*KghkSFZ{NP1N2m$%hw(fh6Drp&eSX;EOG5>P*9<$w11nVH)xOVoIh9!#UO97c zno!Ki=8bPf+JzNM1-X+Tl+~rBW0VS}0F#?t>ma8Nd(WE7i-pkBmCaq}iaIiF;i zkFS&x3msdOKQA?2Haf9s?4eE1Haq>#-pDEjn@6EdgR>D75?|St$RoUgfx|=gwf$kW zgwOj`&}@&ij717q_y7T~TbBmk`4qL(>>lL9&p&Y8jo^^vPwLDinJ`xsHfmi!IP5rN zmL;q`}xr%x+qaM{}f-%(^%e%1&)BkKdbY*XLN`lxQS3+}o1Apla zFgfV}zf8^rAZGofXkR+= zzn>Gd(Uxn`o`^(H5!e$fVmN2511IPSV>XKbTfP63a)eEPIA?<0a0S!Vb4c|qZ$`NAm zKW;%)6)cLE1}kIF_lU5Pu*o+XrF05HlLR8n4>);4@eAZ)UcWK0EtVZx|0O~Iy!!$6 zK43XavtQwpCofvERe@IPNuAj`fC+!wy-~x(9v$UfD(_w!F=Rgd(qQU9aGgZA9mc}I z=V8}jcO?wT3O}d$oo~5`Pzx)6`o-vVsRW@>jnH(T4a(G@@>>>Q4{Ip2AtTY8+m%F4 z@7a04_Q*<$%o_jF-$@UY7lxIP2?*KI`~Yx_K-v5Q1U-tXx$B!GHxWyN^_5NvDsv>Q z?UEGlezN(WnKze^4$87%io!8fcDk;UINUSN$Y|G!`@Sh<2DoDahMT1i*%zt_m5R7y zjE2&G?`fDM(bAI4eb>Wc=v61pT42Faxt*au-RMw>&NbC+KHZiX@! zlF{W)^ddhJ5v&n34wp3ThYA0gvaIZ~Odh6!%xq5I&y_&`Y?z;8qRJytZ+?B5o};w{ z+!UsUUWEH#u=~%FQa93n1|>*EEr1>H?VAe%n{N;T>cbf*If2ZBJAqgWg0}#xM}BIt zA=bVa=l-wbvdc@eRv)X^fWjrnP}G_jdEFVH`6wdcx-c@h)e(QLC|~NpQGbf<150q6Jf}KVmWvF zA-nt7Uetm8k6YRNyEh~MeFKRH;O72-8#J91#6IP75g?$j?zF6}vyp6XIdLjGAm{*7 zuE{?Wiz@XdSVG-1X-Ek)f%MzFl*4t%yNF!pLtdnFEt~6snRizIKH?38RaX6~Id?Mp zE_g_C1b->v0G0!>=?;pj^OGynmYrau(p^&m9{#F5aN-&V7tEp~qI*%ZHmD z4uovYE&K-Q!0v=&t6p)NGm7v3b5FzH1Ys%7xz2|rLiFa#>a?6tl+r#qJ2C{9p#?Y9 zfck3ld)7Jak81g_w9z*jJaa6ERG0X_=*BD++$?!DFe<=J*osfGMImJT$k3>#NR^b182gqH- z1A`DaVUDcnYkL8~T}1x~Yb_BmeR_R^f#4;lE*{4}^&gjDSe3PvJfCB&v4DP8*U->d zz5|l1L8Or7(9lqS4;g8g?6B`d0v;H2wzqI}YjleN7HxSs3Vg01@8$B`#Z>i7e zHSxGEL;`{C;>f#`8?&a2F_b!=g<9Z_$phm1&6_JAiy8Hs8qQ9X!}+*bwVr{iSaERf2u+DG@PLVWu9*I_iAjUf8CRLkL8 zhCBv{8CDl3U`qo+Ad&?|5jBFiT7fk|aTQQGD*#$Q6=NQ+cJhT97|_Cdy>EK+%$J$H zz%pK|GgSv_3W-QSJW%|64I}TX#wo;lL?HduM!T%!U)-WWuQ0_1Wb<{hTrrU+`4)=R&8k)MxZ+ySt75O|;)0KCHnKzotK zDtgR?=*qXi#{1@MG`{FgYTjHAgG+-RIM$W*JaEH+!C0;M&jL;~#Vg`k2M4k60NKUG zdJwT9!FFUaclck91IAc*3JM`W5|kM2yLxEAp_UC;LgEvzoydCtGU?qFOTuEIC)$O^ zOR)TwLNiji z5mG{$)MU%UphCp8+NeE zMxHYT`UO^zh%10L3Uu=oo1{53+{8a&zHh&Nz2-e_Fw};8XV`IZNW59N+i)@Tjt}fN z7N8>?5RCxp=yRzK7u}LSz!6Tsft%7{m?=j~I@58)r)UrA~1ZPNyJq^ zB->C}6i9I!rA(m5KrT9#*xT%LvT{hE=B$w2;6=nUL6Y)F+Y{;6BhE3Is)>ZPf$f*c zn_H%yX1PRbrYt_m35$Iin5Zqt=|$TlB19=mlQ3+)>wj3pF&W?lOOd*LNzoN+19MZK zXgE47)8o1(&H>xx4bbR3jYKFzNkx^KVseF%={p_>cZc#Zljgus(JQP)W^q?)A?S5PqBdNlhEN z5(d5sns#VVF`$c|4GN4X@Bv0CI6#&tfrVIQD3=I7Pa)O#f^Oq%n24lbB9*P+x~*XC zeu#*OWCQ09aym$boO2RvQY#W^UYn~l0a7C3nT*_mWC_Pg6%7V-?59BAz7xdQ^Ic~2 z<=aqG1LT=5GzfGKpqdXszpk`ZDMk~C6lz0Fe~EZ@oKGrtWIf%uXOwGJgT5he~_m{7o3v0Od}ws#t~z!sPd zTF~qRl-K9N4IUkHR|56Pjboa|P%4S%y&n!a$iox>lGQZ#gzsYKdS0lg>9^e3AIik$zk36O(AXLy6C> zbK;XZNY|xT>s0bR2v#U956LQlABYA<{yfT-T+>jf5VYd}*?n@f22kUDkN@Rb|LoEMS4hglT!t5V z50&uGAS5UG<0k@}b*%#sP+4m!I0W)Pr~V(SUWXBdi;8Yvp^dBWZ&Bskg6if)ZD6nx z{li~GaWdac>1HP!X6adUY8Ud9BqwBotbF~y@221|xYBrk;8<{{3%mT_lvh`5SKh(%^?D#+BH~R~mc5zko<%66a@FA0f9&LW z-jm$rrVveyu-i)QV+AQDO`MVEt^b~j5`*1r#~w=MAhit z!;<|B;3Hf0%s(&Bl7t}g=$@9>G_#!_HGXj?SckuEnhN6&9MRz?M47Ib9ZvgD_a%Jq zvoVbd@3>gk@+?e=o*+-jw&zj5BD^Y!w(Whe2VI+nQhDaSEGZLeSg2IsEMq#c$RbSS zhKlSvLXNVv!@e zE6Q&k4u27OOh>z)$4sNabmhv2zOL(mnZM$4GjayBkH6R9YdpQzPf%wJo~b~&5o^GQI*&YFIVYLoc& z?QHT?&sqlLc#pQ5B-8VDHP8i>_S+zT{qSqbYG6El&p=DdDEWCvvXIC3&)%J^HNsw> zEsC))MHxNeq$k)sAYFZVto~UJK2$7R;LVNob2B}?DN5NFcyv2^se`Fdo$s*W-_yOb zF#vkCuyChjpSDuRXZiDEqJ=ChwRJA9Wo)$wK6qE0S_bd-KdZbEeU9mL=d%iSR|@#r zzwW~JXMyVfT|YP%l|Kbzqx!j|Iy5UQV@mF6OGffn%bzJl{n}#66Akzc25}D-TuX8~ zROnTWC*v4Tx8t9>{O-v#<>{5&_HYWV)wssX55htre$Y~YHq7sNcY(3TI-cZ zt!rJ>{A1jjH2aKOGeyj7G}*c`Vf<3QR|5rlvPqpKvPIU5v62r_0_M_V%KE0(y|p{L z_0CC)pDD~N7rY`2%l{JL%k zJw1za$HzA|w+Oan2Rtyx*5SNV3j4`$jk8n`c~p-m&~r!`<|)6-=_|RFWp{Wq^IdZA zA-E^XJy?phwAARVpqJ$5Zw?KGMjhb$nx_&Lw!|&IZ=UL5PPhEl07#1RZX{1w|H-8Cvg^^CDKC-#zR5=>TLgH^idz+joh=F5g+AucsA3BfR!B%nCi5 zns3A@UI|+F;tg}wvNA~G^S$g=IK_sKX3aE?9Z(HSGX7W4TUbMpds+%-gnSjd!)Q54N4Fz0vub zF+Tac^up=RFH@Fg;|_CgiQF1l0hcG>>wY?v2{(7_`E`rW^S8t&Q`+&Xyp^e$wedH2 zv-h=W5!BQ+WtAjJws8(kW?3BUsZ(f@&HsJl(iBQa{+-Y+bQQ(~60f%G*xjjiO%kF3hGMDxy~R-gf^!-_#n^M9iPMO;AYR2f(lEV|^F6FD{5Hy>uw} z`V^~v{8J?w{KS`(L6Pj!gKE(M?_W+Pt@u&#e!X*VS&Q-FFxKgR+AH6TriE#dabW@d zaL_*}KspaFB}s|B15H*}YYzA6B}E&0#PJ-dNclP`-5S*VI_bmBQp6s-fR5SrluXU@ z*XN0Bdv{9)|5(LXS%SAL+pG3MjM=D=>DOfO4gVpnnn#WlZE)E@%J;S5``@0^i;sQ} zv;4Koyse3LuC6ZKw7^cwbWHfKAow2ga-&Wiyk8sC(f6Uqe)l_*@(HgSsu$S>exQo- zO$yfLX3Meps*z`kxf-S&($=__D!9*j8ksBT_WlY$Q8R62WL1v)RI4M5`F={+_6GfV zDfnN%EfjU?%l=i{wf$`P3V~iXer*jNq#4Zrm5>Vk*sP>{ zQ|x&eE?3-nb^JtbC+<&r+pmAAFAa;q2td_d&1T?iK~XAg^dI(;Dx0(NtPB_%*6vL#Pih~;X7uj2YH4n)K?2r7ig?asgK8n-OTx}dINUXyYE6( z$GpFpFK6A>HGjpMg$k~IGUlIepDUV|ho2L5fhz)**dD-*q$Wu~M#L!8KRebgG*-eEcgo2KVcOQDLa$|y z=f2FiG`_u9Sv%?5IogNmb;395X384hIVr7Sx37%~*lG4Jt>q7MNUL{cO=906pJ=|& z?IJ&5@@7lBdnh1%HwCAQSQW3S^Wuvq5^lS#`e1gj0r0oKD92Y~cz&(m7Rd@K&U`>* z*h6=^!Zmt*Bhl+_Vz-!AMMZEmTkYgVkF$~3YQB}#iL5LZp6)sxR(_qCd5r@ZtODK2 zyoSCph9`~|^Kbc9x>Gw;YcX~X*L!LLDo%gpm?^wg1!YKI-?>xHzwuk^3B4r*ou_{Y zX6*1cD}N9woPEf0@oNDjcobc$_R?u7AgBZM_TsPN&lTV1M ze0zChZ}c~<%g$9PKg&Rtw;?%kunhN&#T&LCUux_ZH zE|@Q<)nZO+M9jj!>XBR^7)#Hrp3WHWfDM&eI$$Q=M_WY4Vsxt(8~3WfqtigYWJRf< zpeVaQI7yXTQ}c4|hHeyBtwV%Ls*uM|)sTcg!o@D(^LI>M@uuG?(Eh#_TR3B(1A>rb zqfe(mF^J3%5bAi3TZ`LvFC{v}rbE72_sN?y2$+c3nXEOX9podtVFvjmv2JLrWU%+Ku9Ng=2 zPd}GU!je^((B_PRz_<^e5qsz|1*Z;_<1HN zv?LA$LlX>#(XSbWwlDko)dL#1`1WOXHO(9$;5B?(taF<>>$S3>?5YLLcH8XyXtr+A z`g*(XBUcJRk)wqONkZ>#f7-y>L$-XDp^>WN?^Lqi-^w5}{^8_)Bnp{I4GA`UWlcRV zjfrQG3)Mk0Ts<77oa~!U{q?Q}4_uflpjIONkAti>XfS)ry*S9%i**j3)ApE-qtyzJt%Se0 z;^vw+^#saSp2BQPf)wy&CKo)E-B6#jkXQTli&mtBb2mbNhZZbEiyXA&lh^cw8>gb7 z$nMCdm)4Kg9QtNX+#Ri`?%cSC&v@lS{Axo2zAszAdICG}-P}>W^3w!b>p7YU>IGa$sN;nV!gLfJeD^|y#x$}CD9>08e^Rue_!sT^xfP z)UBi8kj$2}vOZ23yE#haE}Lxax4N>cw%%c&dOZB{u!9?2)^LqN#%1g$2IJ^^^ijh#b?FD_R5WBpx9gMTK>j)Brw?aB*d)?YvM=tu82a?n zKCh2~nSHm;Gyf0OW_sS})`(;k?mC{Z>-qZ4(n`Y)DR?@mSZ%}Po8vvzeDM=~y|ed! zt$J0E8+cHB-zPvSMgyGWl~!qAx0q!eXz`~yy5RQe?X6)aGI&>dKKN9$_4}mWbn_ZH zsN(6FxO$^kJL}&kxNoKhvQFU(?%8lWOg=uZ(K(Ml0hJbuQ90Y$<#d6$7pUZ!@6zha zTQJVB+Hhodk(>U+rNu=}BR zA34an<@xoi(;|fy%U^>`xek4s5Qs~V*wzS(+0T{Y7j6L^1fl7Nj0%BjAIB_{J_zO* z6QT}Q6reWG0S%%LfB{%&XQ#auFWtbwqWrO~!VYpZI?+uK3*@XjVGfW%cdYnYkh z!F_IYRP92M3g!j45NXJ0%!bFzjV#KUuGDJ|+Q+dS1`QKcKA}V9>%SPV-7G-?r6A!KPT|?mMi#V(a4SiG|e@f->idKV|gwMP*vf zglP(I+OAp$)qhanJ%eJ}zp9$lnmo^2@XV*`CwP;h)3DhfH5VhsE_?I1plFciU*-- z1=8yG>SRiA?++2;(gD|zQ^zs@QhEZ#f%s1$1O*G7kxV$b-{l;k*)#BNhV@`jGHYM! z!l1B92hr~`{f`LN2Q`QHyvy! zizJ{KD!Sd#JN`rogSMr0=o@Ht)3t)b1jSIL`~n_9$bR(~iDcU>Cyei=`*Cv>yUIEz zg2Vlc#fDmiTK$T*N{!$lw;`a;Y5Q0TgX=eeDJaa!WK-WqepAAm1rvmyyHzr?tcC|Q z<%YzwCHp!*m|Irrc;e~A#l^L)mrFR{9r?0jTGYNpX4l)NW?2QE??%BxPwkp3TGI1p zYTs)eI&v(1``|l1-t1>X94#fzM=Y$hQlPYk|GLg()lcf#o4bUg75}a3oST?z+e#`~ z@8t2G$ShfA!r*To7XK?4EC6{~iElbxaMG%zhP!#OXMJAtld1{zch3hj#H(u?XQl@K znjDXg?;I>wddM#O{ll3~MuGN-cH3w@DS73M`GP<+x4u7ftmjQIP8yq)6FPQIQ+tiN zaj++`m2WLek#2N&TPW%5LSTh=Td;o7?Z_)hs$_z*svs0}Q74s(HETJdE130NUIN2n`FDRl8EcPTErhe z68TL;^^y&e=O7F=Di-fzNs4e5~^Mj4bACk@tC9Gz-I4Q+)TPYHq1-S zAPdmPoT9-j5D`gBOWWoH)n*xhOn0r(N}XvCAA5Ej&=~)LYM_cb$U1k)h);Y1s7}sf z7vVW$?wWzk%1Y7>wgj)=T;3a_&Wc=l6%PzKB*5j{ z*f3rbnJ;M`gbuP6XJs8}I*U3^(RmD3G*Fg5{ki6ea+3L^*?6S>```3C9+(9vl1?5B zK7BA4+S*G7Lsx~# z&YwJS%FE(IrEz(>pjce~-ui{I`<(!=zDBMst$8+D=V;gl=w!_A-BYdZ(IWQ}pc5zW z893L%xbD_=Wp(5s)kzr2J?=W0!<^WqJ%_|Ip%jL1PuS1|G6)39P*H>5ksdG-O9jcq z4A4;m7v1UC_f}{D{|2OCF$tqU3DAP#BfPUtHY+bEaCNS)E<%ZPP*P|Bx=i#HD7yY| z2!b;|;a>saDJx|wC#8uqPjAOG|MB@4$g34%_7X+;)RN?21`lAF1H0s?P2C710IEJH z;34yTi-irr2dcA3RF7BtZ3~oVb6b<;8s?T2*Rt4A(cT(cd=352!(IDn8HaL%`Ae>& zmdbY_(}gNEk1q5C+}-9|Fh-r8^I@*fGj;o67`Cz?yuKOc_8UK5cO&MOP0F#9j#df@+^2X>n3m zM5N&?ol^WoJ)}hom?VTFF~YRULi1?zWp^k+ZUGfjD-hBRPqEG|*9I-ga56U~J#T<$m~VQb|P`ey&QD9 z);Ih>r5F$wqg>8lB19@zl~COo#3`c8CO6jRx?L+4*=%}0$Zl@TZDLXN8A@^>i3#P` zmZD0Mjpfk%>J>gdKBzmkLk-gbp*h+%;vd2yoK?&G z#2;kG_mvhDpX7629~ytJU9PTdo{e-EZoXUi%7#>k6|TvhOfM-J2_G4WeuGU;OB=AV z9GuR463Kl2ZU*2U!aIKac#D=90{Ly<3K&8%!q})(Jm^+*bo4azO&1WAu>^sd0EPYfv*HG#Kuefh(^_*E)6kCtaLGhzO6X|f zE;+xGx*^|u`9f-cTfC)>b4p6PC4v?pRDiH`*BO8)jXR3v7?3mz3GuB$Dq zk@QQ)m6+Lc@y`tF2(z08aLuX_%9h|WE*=_4XB{y*QoK#79pABMkw5q#pSpp;tNdK& z{~I#T3N?hEFK6O8?vm@YE`ueC@Wg%-#f~5sOMkIU{Qqf@XWMk7-QVo9lot!_;x{&z zW`#wu#P5qMbFbT{Y>i5st@Xlf{Lnx2~sM?}?$0l(*W?BWuiA zkn%z6Rf4nVMJL_nP*qYTV*Ebns`a>4iE@KfRNB_vYzM-oL-67^P;A(`8ve zbZP26^x?p&?w%vNGgYS7GS!*9<2Nl$3pAZed?!|=r8oYB6+ot-&PnsD!7E7T;lFH& zxj%=0Hl|%wiBbt48OWymr7(6Hs7#p!IWhrPnoJnBcN2snF6L(0hg52ILGL8MPytLV z3kXp4ix-i0D^M21?T7s;79w*&cSAmY!g8p>8|g_OtvP$rKMt^)H>A1&%u(PvXY9S! zKh%}$OR|oW_B9Sa0NU!nGqjo;EJrH-KzKj7?K!wTO-)U86WkJ?>T(AoPg%;AJ&$3B z`+M0<32jQt{>-1qxY*qJ$fn`!0|z-$$J}{noPba?02m-3ABizda!{<)bBlA>gg4d~xq26SOK>kL~Rk5#~xq(`9T;O zYeXt2N!eOimE5y%zjJ4l$-oto*YK;ZNQ#U+8Fw6wlh~M8;85h;2Lh<=>g-{z$%dk`l>I?rQR8zb;ZE!&!|TSz8g=FZlu>D6nB`@fURNU(@bExG z9D!LLTh?rE_;AvC|8%<45)FGvN9MT!BD@1|L@lk`+1gX*97;x=a-N!K!{JmqkI9?a zM}-l4%|p~p^@THk=C?6%_p}D3FIP;{!#6T8Wf~};z}~-gSa9pcCsC|vY?^WN$A$$fO#eb%Xi~Vw!z^y` zweN7Wzjk@=}q=f}uYE572x(dIiu#6(p)b6*}> z{P%T-Sw3P7)Lh%m1(~^C$ipvR`S6q08v?Zs>x$bNosGUsO>G_ea_4Lvsy!_JZ9W|G zVB^!uL$Gb0bLBuu^zH+M7}FC zOn^^-3Ah4%aqYWe?%E5;(ATJ5tU51=eDvb+gUD4P zgB|Thu59j;SLcszN5HnOE^QJ%UAhy1ZFq1}q2#)rLQO+caHp2RdrBjruJlc9xS`$K%nvZgky5L6F7RK6suOtV-Oih&<%SPu z$^noC{I}?wI#WULQPPq8ds5OdfP6`7aPCusTnz%|AoeVHe&ExrnN947J2dQYIPeY* zv-n8);n#I8xY|u)a>=CXEy&THDCDczxn!0Bc6%Uv)BdJge7ZjkBidZsfozy=FY2WS z?8D5wJfQYD!}=i0$?N`BG1`-^92Y(+3Y&T-TqX7dA2Wkny4E*3NkiV&zPS;1@c~ms8SncWYpC#vJwz6keklyf zwYZ;&{Kl-$%6KJqKBzuR$7fWiAF!TLsd?_{GR{pGC|{7D`m$ZR(0cl-x@VPKhe_<@ zt#MKidFE2OJ>}I4$p~(}*e(-p`qIiuKk;i?)RWcWp*j3yJ9>0$>&0k*-vUT$csQ~0 zfN1FG^~d_oJG>qha}qA}v`LJPApi2L33;`mamn1wX#PO`1bl*sA8mXABRUc<)k6m%&|9 zVQI((%e#@5T9daw4Ec(x(gwUfn9r|mWMd;6$PUv2Hi&2dEhhs`6#02z=8=;0{3n_M z=V|Sbr%!PZh!GN4M1e3+S|Zl7c#)G?5V&X*O= zWih!>A3y!)cV4rVsp-{(mCvX0eK&nbKMz&50AMc}n$?g1ao&MA%IJObsov}E3i)!g zdGRc(Ou5nt@x3gIDD&dy9z?dSd9Z9IZ_HUTUz?v`h*01X78clvHw=5c%DVAs9PGA= zG%3FVpDHkkYfbKZcgvsL!2!7JJ}HQo4Dh4qxcx%l!(lByjonEW+F%lmPj3%lF36}i zL1Xlb?Zorz+n1xzoZlXbx<%CxzmXWH1L=#nMGk&ferzwA6=mcrz1U#v)gJ-`5B|;3Ve@d9lz%^9h-@Ni?bS%=DrH`5CM%aBOwEXD>dzaxA@Y ziQk#eh#AL+-S_zOST_c)=c83kGi@uL^9zIsi1D70`lZH0n}$WkJqNp@r6u3`;-u1| zqX{Z5z7d`@*X_#rxa4?$I{$k%7>TN97pbtV<+L^OhYDQj+He7PKZ0Y<=${|k>-rI#7P3b7Z-Yd} zhWhXgP{uX`A>Yr3PUGCq$grRe^#UvMu~50_md zk)L6hZl9uUmq531*2$=k-;xl^-r3awgbQD0vlQJkR;^Q=f(qx)hj<;QdVDwU#g=dV z9PXE-H+qhHPuxkJ-1aPH)kHCzj@g6D)sT?n;ftguUsBMaXHNk<@h%2AAJiT%i}{^B z^92mw&>s=0Q%)zDMLe(D@=Ih8(`jH}l=GO1GrXbB+A^~IZcYA{N4|TAYi1EChoYCQ zIj_2+7P4n4zJ(L?&P#32d=euA)tdqIPJoQXg#| zGLpQr<Ayn?WCuo$V1M#= z(a_|tefpjE`mr1FuguFDM$1>WJ^LO@KSi1+5jV{3+IIJ!AWq4tST471EHn9)<)@ek z`?D{iUBpk3GF8m0pX(DUysvmqC{z0c^BPSp>E;#6fr0?AKQ{z_sY0KVvO;Z{Y&+E% z`+AdjVQ3Jjm6YiAo^vfQMBKNZjkqyUk}F1a&J?#^bxHPNAe_4D24!=7y({2~xaaKC z8+n4W>aelsf3%1Jfq<-3#S+ak2T6)&X`Xy}qYX&%z8TlL(|I6%GTFQ z=<`Z)Itx6ysZ0%YO*ZiJ<69ol#f0;}7FA9s16%^MG&B~SH!s5pZ!W$3a6{$Dg+ZQL z_h@gg2VY-USxpH=v9+x(-jf!JzSrNC)ub#oAX(3K@EgyLQP=N0k)~o?vW7Z$c1uK9 z>m^Ft>L)rm%Mb_B9`I-AR9aoktd>YdbGsecpeHY&vr<8>ccbqLEe7RcZz@B-i#Q2a z?KwkHoxM(y7|U1LV3qi0b<>DMQJKbx>+f|to}?;jNzl|Zn5%2q-q0$3|A*n3vxsG) zXWr7#kF>1dJAw`OO3C>OtU~~_JM$A0e*dNO@#q@w-C$mM7Pf){(k$SV`rc?-%~G2; zn*&+(y~S03>+Z(M`GpwG$Riq@(Hh?(iJ|PN!3fVc|MxxZma}pu&WtWxY&M}4s&&X8 z-Kf-1SyuYK{L&0gQM82NbsAD;#!d^+#EzHLZ)}*1b#|{Q!U?L%D3v9#L$m>y*?VR- z4ylU$h6S*4;*|_wjvnhTBq`2s0c>b?X~~$&vPDXcl6KOt$v)jL76q}Ptl?@*OXPwd zB{O7*jE&FlkSG1v+QOjDym4EbO6wqT@q>H4ysF@Z)Q2*3+V*2BW?wNiYIZgE3oFUC z)l8XLBM{6@eM*$+6lHcglBFxA{Z!}BvWu*<=k+#wD^*F6Fd7b{II>CQdbtIKHzg&S zr8cEa&UVmD?_?CahS8P5|!@sY` zDacm0NUilc)2CWGD9RC@KZ*r;hoKM=EyH181zMhtE#a1U@!WDj8)XJwGElU+cSo7k z6`t=~>{DDYtTn;zT>AD-3O^#3PiXRlxSqE*^SkfFJviN}rh?+!M-4mDczIT43*Tot zcfqAuHAmB{+B>NI(Wu{`l+SyiEAZ5`gpR|u#&nj3P^-p1_JTrwRi4P>D<75N5er%~ zY|AE3rfTP?5qe(w%FA+J%Z?PqT#9*r?yftWhiZ;usLTK@0WPYzgO~3YpLYh_V;vP1 znJzyz?eb@ua)8Qu&zT?v4rHg?aebGDocbT7GA^E_Z?Al+e0$q1=^61bMaugxcp=il z`3BAMT<7XWJ5&G6^Y`smR<_-8(i`reBcNSSR8Ws?;fs;thAwJ(;p8D#2c?avOax?BC^-C1&%~8TaGw`89?&gWR;0aGElFL=USqhzh<2mcC>uOu6 z!p0W7Qwkey)34v#np7e&+mTr+ol=5--@HC4JtTc3hDKh%0c8RU;9q5DBrGSz1?Ja}$ z67cf{8{OPkn|=(|GtVkWW5bN;RC~*H%Gv1uo(;^Lxa6C`c02j3^%j}v2Vo(SuDBD7 z8wNJBgDIg)427j7oUa;r_T{uiDT&l=%x`1qX^|Az8g@HhKX`dvtvA{@g)C70@h?gR zvI1AVy-DI;xUeT*Sk}j%m<9mf?VXDMfcL^ICjY~o$ZOZG{j%wnd#|er(Pp1Bue0Lv z1)JX=375p_?eT0V6bEgVUF=Q6v(-rZ*49jEl2;!KUTX7pdZhetb&&GCfF%^wRj*5;N==I7M@ZW2T znw7wG$5wXtMKPX^oYDEj{K`-wR%J5q6-W024oU32GcLW0nzSY4?Rc4jEHUHT_ZT^Xy>7Y7wvt0OtaL?)(~PJhN^Ow5}Z7>m{Yd3Q8p%cD_I zkh6Hwbu~Y+T+P*{SVzKco4GbZ`crPtD`vJ$fQ`@ zATBYebf@tOX;ENKW3IOHc&^y7Y}I*zT`4eiAJ@XVZ-q#ke?=fB{w(<<_yw1UXvE@*J>V0wv<8CTsBtZ} zt%-)c>+7t9X@AWI*ZsDZo;M=#n>jwc_&Wq=#%wWHo1|LJ{R14+3~#mWabmx3sP!@% zOeW>Oegy1YbII)vta4;NbjU#)E|w#m?>}k;@6XOpu?*I?idGQRa$M+Ub-A(App&Op zp0u7*YbH%J>g*}>l}|Kf`CkDO1nm17)$zt2WnS5>a{~i(c>n+a08;$*W~ ztzNxK_wD$2ptre-#TvBl<(Krsp(mvWuWnnbt8p=!mMp2Wf01Gr2ejn#|Q7F+wix;oxXEZU;O2mhyD zTUMp)raKkQ1T*+3Myu8G<^g4QzpN8y&ni}-L)rlV0D$+4&;tMf02Rk^97UrM-Fn*{ zy8AaCCdyTH!($i`w?`qJ;T@44p`NhJJb0001B-Xrt? z002Nm%IEWHZ)??^+wRlGp5SeB6^l3MpTGHx{^`sAq~`R@2OiUzE(D1W*2}Y8#fIwT z8J=Pn&7q+UE&0f$idcUsB$G;J{ZLV^4F|{Aur_An`b?(B28STIU z0000g1)&E3001ghI-S<~_3Hw+&DF#lkN;8gq;#9EYmUeDm>Pmia;2I}?+ikUs&O!( zT*%he*FK`IwwqOQ^IA~1LaygXk_^L;q0r>%B_}UQvl4PlXJVVHm%2*QmU{!U&6N`l zt0tM0_w%3V#JO{9YXtxR0K5x-=wX`XWViZMgdP9@00^8QZgUl_uGO1+Ueyl=W_FIp z2PGG_HEOwf;2$5-?LD8K(K#F+l*XDxI`ryy^{ac=DAwE-h;6R2v6z;=_&e?U-)w6I z0002Im#LwLX`0%#YnKikI&?+wG5uz}0000$8M7=)narr(Jotw8@7=9ftiive?3jk3 z1JArHeYpGs4@rs^V$!8%kdj*{`@lnzQrSMOzy0&t^7H3390~i&Wv3Xe)}jOZH1y^n znf2xWI{^Ry0F(>EFm&X|5m}a{s;a8Xz6d=4000n3kw`>upYGM`dtXt1-zkN|mnL$T zp@zm59e(~*z4pW*)t0yf{~(R#Q@Y{i$F<-`k1Jc|TSb|ktI-#KueW-8nd1Qf003MA z*LAgR+cup&d)8kf^Z)<=KycO9*X#8+_UYKsH&k6y>o1puSgb*BJpWsL-};`k_)-T2 zJ}?DmOpW!+wYmBs)$Ms%xw`WFd1qrWE&RW`)qCIy3aPgyFz+Y&#_Y`GOh2Q8G;UAbrGIwN9s1M-;$9h=sZ#=7;k8M#X;%4LzTAO9w za}?_Ajgq{Kx|8(qqk^8dVM<4EacInYt5y~eY>(*Jz>byokPZpm=W*#%Y=E>g0;Ul(Ts zF@sytrKF@*46{sWFPwk%&r3ZT&(F_~`nn-uR8&;P;L?FFdL+i5Z$J&LI6S&S8A2~| zZfUScu`}+fNTT%XCOj7Zz4rE~1L4=jFYp+%*HeKeN)XXufKi&*I-}Ou0xciX&^RGp3Dbu2_ zFKTaWZF^mMS4bULLc~i=$cu@Sy(G*QqF`PVR$IC>_F9Mh`?%=eQ_aeHm|OiC4~qx& z_S3nLs}?xeb3+!u`OrSSd zR5V-Q=teeokfVoPpyjtl_w0J%hS#w%FD=O|rNkn0iN`TaF0e6{y9YOXh-xFw2}?Q4 z+gc^RFtCDH7I$chOA0ll-cQhHXZD5bVH*3*Nzo6SOa;WOZk>k9@#(xb-I=1;GjB)n zT0g}OVo+sR*5M<2dj0wb`zlTU#G#}_Kl6SxWuG~Z91N5KERZDe`Lo0cuULU2HzzKP zdx=2^zPuHC^IG*QZvM=$Tt=OH3lu4%ill!U_UC@Qs=_PuGG}- zIJ4eyS^0zckweXv6UFl8qv~zUIP=M{ouZw_iyj#7BzagJMg`5rtB6M9Bp+=(;do1B zSk>~v=T4MWbAk0xxw+|`{mR73FInF{VfD2e4Ar?wXfN5Z8MX|xd@vuqc3cpKW>d?D zIZ%+Re=$c-DF!W0^a8~)sZ8y9mAJ5_pxhOPSIpI(3=Ky(^BG&c!vd;g)ITEzjYP{; zFz(KUPDxG+8}l~kCit`{>^&Q`YdCC_xlKhtX2#n2dVf7DkWA zni!!r`u==+a|TD2;d;F=&E+?XLs25MRh3go+lCjiHu9d=kYtQ7hKx3ounG&~YPEGY z{Gd8ywXB_4^!IVGBNbGib~fu;4s(+cIKuH5#O=29K#NGvXZ~lpvpn7@C*AernTn3^ z%;wFyirQWZkZe^-NVja-89&8B8JnILu3|&epG@@mcF~qs_}aNhpP2}cqw_UCaN4(w zL&cKlo2F!Z)-^+@wne>6#{35biDgd5WSq9UB+*8v4#jO?Z{ffn8zGanS3G~A^%*NVsb}l{qA~YzIL6xUa)`ep zkNs_xuQKUV3JVV^2|h94=wf@)V2H5^IX}D8;X+WZIygXhisRVaLW9veoaSjyjz%5Y z(8n^AGJ<R}eXBW_U(G#pt7tp3Yp)Hs!hp27Nw&&qu3Yg(E z{8oSV&kC>}&VMS!!=j${(`xUiX4GQDkzHF1{yt9UnV@4`qjr6}F?ykog@mSFJkVmr zqwR-~2U>`N?=vDvRnp2rnyLAVdV@x$o(zJ$#X4QZ$&+O&HYog50ByD2k=p%i_YS)=jUFMUUNh9ApG>xV@HFAb1xPXyqu-U)({F2T>jtI)5EOvVWHCi%RWoF3{BZ3?>o0$1 zTrK{Z2kV&N+8JRr7sG+S3Nv-&4wV>Xm zbDaItfQP#opffEh&VQXIb@Gw_g)0K1Xu4hBWgfj`rGLLF-_`coR4@Kp zWIs`Yy`Ngk5tY>6?O+WHvICe}%>DT)UVEcgvdCi}R5 z;(K%%J3ARAYKQw^WeIJHPso~<3>S}td)&X5LB6ZtrOM}L>$d6Wj$c0;kr+LjjS2Uh zC}Od2(0O#qCB5}fPXOcW!VK^JCmvn?s&rOTO1uFQ1^uu|^xH>yv@8nYF5-z()K(fE z$ujQvO~$@z6NS7@#xc#94aVCTs2HVl@50QZs>zODJdNO!3vhfQ|16X3eUeq!{&Q|s z-MpEYW|Pfr_iMLY*x451@B}vU1wXZ@{yj5xu^&cPJnC#}s%S&$g#5=X2C>Z-=W1tX>D8isVkCNzcXdrs*_pfX!Y5~u%t}1Zp3a#rFqnN_ z9ek?W-lxnkb$0!mwv2$5oJPv4;j8|-N~uimIRD=MRfkrxUU}}^{l4fY_TQr~#fv5~ z_e%<7IyZU$Eov8-e97_Ucbfmys5x3+@UXOEiSuN;Shw;Y`%(oMF8=7{NA|4$xmm() zud??PE(_C-SMVgZi_6Pcjhu*YS#WtxxSp~+iT;Agg6T`jn|QnUk)|Z!%f|^_h6%Sh z;cF$QK=$FoxO=LPA3q-HLZO0Nvtrav&d#3Oobe^zZtw2KLCwz3i@h%j9lJ1la+{O< z4;lT6`-0Xd;y32XYIaY_#0w;*AFtx2*3RMKrfT8T-XU>9-Ke0*EH%Gq_e)^36fV7Y z|9-63T1pE2_Uic2N7YL(2=UYXnY{e`rit2@-D2&>jxn*ZegdXHxOPenyJ+K;u!38? z#a1gZZrr#bY&%Ejvb~Ubd^YfK;_%*HdPm2tuc=~GoY8o;^WSb57`*9sxElS%HGI{w!6m(t;gn65w(N0@Ffl2q`fsJPcoBz%QaV+?FObb{cXo7GbzZGt780V; z{~Xfzij3{wV!bDUgUWOMuVM$66Dx3|?hF3-=WZ_dKnP}c4LB-r2I&oCb? zfArxQR*p()kkEt^#{FEC)*y<@J>}+4;ipqu-BKDIR|Xq>NF-kgO}dhwo}O~?@U(pn zrBl0mx8V8+C69CPu0M*pJKsCfmNXJ<4)x8%{4pr9bD!|fMfO(BdD zv=1IU7^<*jx}9`^;T$=+Uf@mb!id%3&pMT%}&caRem zmr_oz@a^f^L~VEVgw}+Kvc?I!tbqZCVRu?+OAE4q8Swc|XD54lHn-)Cw{~|1b;M#- zanYEVn9iR+pOKM)ay#0+Fn6XV<7e)G!HazY40E4RLhMMg*a#B00Y8GTEUfvMlz+Ul)#v~+TI zwwCq!dxO7P`1k?sf!>3jMZ03>(W&Ga0(Fd7nb`G9+p;rzbj>dD6pv3nPCa;V{qbFj zhrh06>he+->osG~&dvRdRAiJ$|(3U#`^#z!buUqXT<+u)16^Y*zf}3Jg83u<$e3 zcMm+C*;pmnb)#?cKG;O-YaVB#D~IrLG=YJE+|Ezy-6a%4X@5nnZvN`zGaKTCr+7B^ zHIX;D%V~c)pf^{Q36>qcnRO$Wvc0Rz{!4O|=CxFnfXz)CvxyoSJw3gJ{#+85z17g- zV&3D;PM-Cxt^QS;2V}C+MMa6|>+9>D_4QH~mDAYBQ)6HgN+%1N_k1)^2Ct+4`}&lfDSgD>Wds71s5!VvKE>cobPx1>Y%$%Iq)sAca z115edd-DbH$H&JJX=%hfJUq7(uVJ|zZa2a#7n==V%eA`3f=Mf6L0B*lG+ynf-{0l*kR>KDGY$8ZlBfF&28ggKHc^| zw!eX@!LLP$p?H{$ZV@k^I`BUp!2D4y5RF%rB;!;h%hMo7M-~wsje(-(dxnV^?AVy* znA1$?O(mtqCO?7?2Az~OV8h_`y~iySWo6Ov2?+SCrlk2TC+J5jEEOFb1iihzW7Y_e zeUJFOkI(U7Axf1*U;KENcz?ud)}Yy+h*UNsKOY|w17?E10{sYRzE+H`SZw{sRZV}= zZ$4OVt&sbV?L<>YYd+n7@W7Aa@geY=!~5I|GeTuai&t|iMpSuO5-d@>_lKIbGcTM_L)cZN8>s0 zh=~VFOsCGTfS0(ISZp~diOaG+@p3H_{2ecCDA%P+-mp8~J-ocTI$q#vBvUjvQ&3db z6viOdQ)#Uaj`5!>$VCgoB^OSQCeK)}UM0f7A@&_MQwShtSl^!s&$gVb z<1P}vmUw%p-a`s8eJlb>E{p?N+~)=cjbQV4k_B5sg(h$gwv!M*OthTe?L5dIPECaSM&rcSVJT3b5Um=shKwK&%*abuy2$G#2y`^q@JYiiuy6 zi1~tx;DQg-XrGr^T zw(k0vZTB>6I$3vj$tM*Sq3i2b@lKG->;cDE1Lw&t@lT&V;Sv(I^kyr<7YUd}WtR^~ z1~8r&J9KpPh~(tphzL@c?y0J!!uxd)D8dy9{4dVc9sa%?zXKk|SG%YU4tmYa-6 zW7p8$dH&%MZ0qc0qic!6ng1qz2g^GpGEpd(5=M?xWvjv?k%ethCv_Llt}+W)W)p(A z)za-=q?inN-s4k}SDmFRU`u=IuUF_b`{%uT2L}2OJIDZ*4L%3drpBq(Q}N$2&mA|~ zO-40T+Q#cPnak<58DBe8FotP}y_hMws%4*shMeJDNdhpD=qPaL&4wkPx}G{YRc^X4 z?VMpWz_Ccmzz|ydaxcqqZ9>If+5;l?e@sKGzp%v@9kuY@MIGxwqfH6co2$22w$Vka ziBD-xamDFzi_Y;3VQ@<@R5@`*D>>UBaxzv!TSilJOzP*N?`5w)wzu7#>U-q)sEmR> zvQpKA*Qum9{>p7c5_lLkjS`@G2+;)Q>NL*WYz8(FV~bou{ic=^|@f5{odzDR=+Pg|TLd{wYOXz53nq$HiHlTvAd@Ac-l1u~51n9)VMdh>d;Y3sN4me}1h= zd~EEma}QN!Y~Y_T-Ghav9@+1c>*-2{-<8G>oBgoB=C^mMv(gazGl8$g33jj#${@I= zMtpm168V6NNp~@D+#leyFtE`*J3YCnqEcvkj~NW;!-o$ldcXK#NB-urLLg?3#hj|^np7X3*N4zq?91#AqfEk__;a3 zF)6hF#2n<{pkC+XG#T@=f-^w%6zNETGRS(-pTl+eG6ss@Y=|^hB^4co%fjq?chxLD zT@s!ZesmwZB(v&Bt5#(~BaO7Zqr)bUJYQ_(m-!~DuFKE|a^qFxI$c_>HsUr_BPX}R za*0dze&q_z+N171cS<%@%qxF)m%Y6p@sK53$g{A(H8jch*5$y^2hJU!FI$N3zAD*@~pRtE!@f zlbGjQs#w6+ueS{{H0gAnJ!1vE_on6k=Qd-*lSsh%j)$!_P zGr^e;ZH%zjoAkpa{D1!ZS#bIV>p%7hQ|ylDwI}6fc<GHw5LDlVLqQcemj%2L+0R zj)yx-0dO>9B03jbp7m@yS-+@q)JUb{I(=?_?2|3u^LEl2E+-cj?FbW)i7mPnah*aH)nRG}jHk-u)T;>Xmf5q#G#}RX{_7bgB6$EI6fS+ykBtPA zh+V+Ki45q#NpuRMn1MGaz?jJx8N(*skBDH3I$DB2HCI#!fv3-jxeSBx^71kUv2;Ie zw9GUB2`nJ6WCO$V0c&p1<(+C{@@Rp(S z`yXtg+WHy5C<89-c|w$Ue6Y0v7js45LKMVW{aF~q2aUSC!hZEhe|p4)Yn!{f3fkI? zRd$Qsk4p?QWqh#r7jx5*iO0mo{s|jG5gv%qd6ocE(*?Tzph%#UkpsN+^tdOioS? z=cPXqDD?M}BdG_t(4uzd;h4jyIfOIP{W*7#Irk%=`uY9seZ&}$NTGVIj*d>qLjLw` z!n)H#Q*eTEMQ65oBi-F3;P0p&ou8J7c#(~~**p^~?dPSDbB+Rp{KPit2i;s_wlCqcVp7*D- zXn@UV)qh6_4P{Za$hkaPv6i298}%Qb$^)Ur@<zKmirhsKCDyfCqt7x^Z%n z>1l-pEPIB7hM&XKNLw2YBO{}6ZvNmaiikA55tAYvT3H{>7e8wnoe2)l`n-_Ed+vE5Rg^`zTpl zi0E~{Ch)-m+)bn8x_Z@5CD$iCJzY=)B@Iy*@3R(M@%09b1X24-;QxBxJ-!Yy_|oJ> zaDI7tc|EI7E<@-A@lPgv&MoaUr=NIWCQmMorb)b9UoPo}6blm0Avve(-QpM?9v-=s z-zQ)8xF5+-Qd0WEB!WA=qFG6*kWGe%hgTMNU}8O83!C-tmk9+m^(#mSv2t)=Ap<97 zk|adkybXB?W3HyACaZ-W7T3LTM`Riezb1HPWH5{G4(UU{JyiR$qW`%Uh&gb48v`0T z(-8GH!=GSSYrBOWG$iDQ7#~RvJbM4o_4Ht#+uFs&3Z>T-5K)JV9Kkq^WRc?Gv#oe8ycdcEUH%oA@2eEnORbj zQE1ExBZ>coH;5xd?ZNh?7Bow^M~OmwFcOTuRw5^4lB5SWZF}hNy$pv1l3vI!DCjNJ z5<_A#kF!(b{v0BI5+-8QK6pgZ^XGlZ*c6a(!OGQ0wh-fBM;^(aKxnejfI)&nff9%j zjq5bzr$s}-sywJ0usYcpZ0_vrjLc42V;gf>dT-qK8gIgRoYk@IDCM5-dqDpZ*w`lU;Y}QxULXf+>B9IS4S;ia$eA4>=o=DN{A|CAqbstKQcF% z#3Sd_g&>yO8WeT(&_@G;3Aa5h!~kz9E6b^?pO3rx)c;p!d^Q+9WDI2s9=<1q%?~ST zAngW<268R%#%6E?A6#}!T*0MR9?T^p4&?OYXl8l11UYDs2Zx*@D@ZpT*9|P>pGZoI zM10+Ib9x2|*x^X*1PR$#jT4q%$f+eD@ZdnQ1#H=;w3Po1WBt*p*c;7F z`Sw8a3o)V*GcMqNQhq$XLiz4VS;t$mN!P8=%@1?%R!BGg95zb#Ykj7+Nkv7KJL@*v z9x3d0$bWotf~X3Pklftd&DZU)Z+dE+ZQnhuAcm2scQ}>x(S&}Ms%QQKvj~mUp~6Ig z+(DLZRBVn1wj^aoM@LVwp4_kT1JHCK>;)~2-uHV1ml2c&;f`vzDP*ICgI zNPHMf!a-PJjg5_s%!FadV?0Y{)5YJR0<9Mm1^Qo!XA|+b_Asmt<*21}FjIR^UVCenOTAe7tY!qI z>nPu(-`82Cqjc@@o(idPpmnWDJ7zQNqIe!{Dl?0#XMdG#SS7>Nm!^2t>7a#Sa?cy{79umZm;a&C8w;oS&zf$bZ>{Z75$RoJv}(l@VgV$bGR{RZApj5 zV%HPD-1hrTVEevDvU&vSg=kQ2xU_*i?p^CGDp=rBJ{X z`h}v8#_KO<*0*57BycphcGiqM)x3&kfbyodexTfwy5yBFmZtb3dFd|ADq4Mdc=qx` zG1>S~iM7|>>`G2jpQy9h=!;q|sWgpIO8s07QM+l`%RtUBkBI95)vE!t{~I#*>b#cq zF0|wPCc#H9dgiER!sY)hhiLX&I^_H+b*Txl;R~~Ek+({iW(_zg$6)=nYq>i%t|K>6 z)5sL``LPA;Z*x}St=&Q|KBqNGnVHpk(=0J8Nm#2dGG0om=1H`akly&*$+f(QjLYeP zSw@OY^93BFCnOo~@G|yr2mI}FE-U<8PO1{Z?8F%QT{FzQ9M(8)UBO(u$b1E*Tk@dU z&?h^LJH*p-q76rMVVY)vC^ekKb+)yDR#F?PzXHnd9e>0rb5*Syj`lV0(QWY*&>|F+=ER>E(dxsrS9%({PY%-8;*vPWHvC+jjLo8$ zV&8E5DI*_YO89Cutm3jMox>+E69dq2f4M|&oY`e$jGT&cSA&iNz=L~cWig%jHc7JrLmVpl6tnx}F4wk~{M z4X=Nl!|0H2ZZW6f5=_?P=2qCe^>$9>Fa%?$hGU#ekl|^L7)jWzbH%?0jn@dNYrn-d{xead&E%7}Pwp5v^X9TyoU;8f+j?S5WTX9Bxk zYQj%%m{wgP&5!j1slOcR_fgL)@m{t;<-=@a-IBo&zwTqkfO4sDn$c^;3l>?= z+nJ`d1M$V#efQ9xI@5H_zG)(-7zo?`CO70o8A>aSt9D;Fn@pkYx$F^H$;RPQ3GdR* zaKevnf~fBVY!gn@6-ovX%#D|J8rtWNGRxQ-OV0Sey1P+od$g6b1TeqYP!iM0hbdB6XbsOEe*L}zRb0$x`yuHz9=hK@8?-SgG(wC#75epj| z14t%y#T)X({~Tgj^#LY$qBDvSpNX-T>zSR5m|_GwF`h_zM}?s-Y2gqKyhDu$;Vb<1 zQVNTIJ-CihEX+pIRgI0h;lLm6ihtNDpvwDI$;7w!%Vp2lFA3a~KgL?=#R){@qCT99 z%`2~HzH|6Sz){d6E?~6HeZdB&R!ex*u6&qu>;gRw5jY3ih@k~-v*e9=hEc2K1DT4? zLuGCRLFH>GQR0T%s7J!oT|TC(8ELg`-laR^yc=f1zQ1EHH(AKtM`KpRIV*H*(zhn{ zP9pm3O+xb1Ik$$X1;@%!$XP<<4yT=>bRCI2$6bjjKJ^rB!kN#lW$sdFsO4R0!Y8aI zoFqX20E!l~I`h+B=z9CMt@T`!9D~oVCSo*_E3{+i*WLMNS}rkoThe$~7j=CYMV-Yh zICN`O);j8J$Hv!T@aCB+?+@(=Px^3+dQ6QunyxDkxjE_YW-o9Kh=)#*J#YD9Z)=kF zB%vC!O_Wep_1HT*XUS^j{X=Q=4vT8EJ7FFHQdLrcYL9$GZ0Ge>$2i(+Pn5PxAMxa0 z^_}p}e_GKf?m`g6G~)e}EZN#Zmr8nHHpZ~Agt|clPqZSyk4zy%ad5}E(oGxhTDi(Q z=X(vnTMP_(527`L$@@(*_%8^fuIu?xT<6P}dA#gwB3l03p{*_>NuOiCTEWTvh`{r= z687H7F#gil6{os>y_&i0n4tUEOE)y|hOozR$X*J$CP@bLO+VF3bE5A1nyyB<$@)#= zjMr6gS6aFpt*PHWp}!kfp5#eLi$Zv&yz?!*Fr{ST%E$GDM6~?U&7q$buDf8NriSaf zpn|1bYB{M*$3XUn9${pk(zJ{r`c2@3g~HKjnhBH1+w4QzWmX?MAj=OX7_a{!Ul2!E zjfUd58u?*`LY|w*ldR$A%EjUeqPB0`gKW#IZ^AB+&1Ihhr){Hl8U z=I1X@0(#LFcDPi6TIDgBQNbJiy_$DWcn!Dgt}}k#Q$}4G51W)%BupS~L-Bf&kW6!g zzgZ9@leS$sC8ofBMB*OQ{zl;JIK$MG->##Y?5YW)Yo(P1C;74gMKRG(aF&01bLEHK zaK6s%zkoUs?UH`_NM*?ebFvG?B7JJ%${zAT!)1x$cA^X0R!M~UQViRtMjN9fVvw(y z)IZuAeb7nrYVzcI-S|t|(^bVuhLCl>TSFyg#1s3>R3{To%^UpQzFD7rc+Gd05(Jh+ zw(;=%rbTsijQgt(zN~5XQ{_&EHtu6Z=ZuGrhNSY{a{u^T9n+h( z-1heP^zn)F^xi(v$@-7X*reN9xM;ehmy%v)98T-Eul19qU9{DG z4Fy^h8tBE9Z^R1Jp}~Bw4S2n^yIXsrp1rnABu4ct-v40G9+k8zc))z`m$t-#Eq&+L zDM+iAP5qOnKiL7C_)zpp*N*gX5$@r%QNt5-rv72GlCZLwDM%2qWP~JQz^AP^ebY!Z1yyrVd(sDajQbM!+Q;-* z*UK|?KgT7VNs3{yb`!*gb2e%YFcI}DW>sQ%UNXld4jXj8^PAQ;Tr47+Z(@N;f=q*4=7f*a*l<>LdY^p3KO&}tdqe45lRKVI>QAf>KSxtqo);^Cp~ z%W~D5th8S2R#33@ln;U1FEaYtIfWs+McmVM1^#10^qQ?bRGnwuH^qh|i*>2B=icvf zh(nYEGH&#k(J%5dJWVTUBGhAl0bz%;bUcjCO8a$mlxqQ{fz9 zU$|s6rTHCqU;F2C^t)S!M@g0!Pz`vqR27PQv0=$0x#OWK*n>*gsVX>XTd|s5afiKl zC>M;T+HO4vGlgCHe7{fLxB4bV-G{DRz0?jU1RWS~Pq!I#2dh7dLN&@KqIEXd>J zk~_1oad&KgpQxB=lmONKl}Dk40i*Zk@Gwbb&lgObT3kC#QpYO_xaLpxxpe!@?%#bSV}7B9Vz;I3*)eoTq+Dy8j}q<;imk+{&RN6SD!D{ zW9(bwdA2ULlYC;(Phq?kA@<|oXbZBB~<^@AFrn&$bezGlt&shmw~;}vWo229>JShPvDk@@2{<%6oiME)0^%eq`}zW9b@ zXb>q=!zm8>p8MVFV!D{(7rlb6xfo;B3-1Tm$ct7(q*WRNM$u-g%Y`B8It*bRsL zWcif9Fh&$jpV?v4#Mfo!Kdc$j`;6fUp)<}J;R~;!8p$xR_g!4y#{6lD<#IKoVly1w zuSsiPmTJxDZ*I1(5JCY1%5@fl`dWh{w0Lj5zfWq79*6U%u8EkPlpQL(98Z4DIc%`= zywS4)H{Lq6&F>Ti z(jSP*ZxKA%rF|vHcn<$7rTT*hjSn9X2bZBc{939hlz;2nAeN)QyHsML{doJ3UDHFH zc+`E|-`6`WVf%2&>11a~PiQe?FHiOpPK5iiFm36;^w24)!C3yw4~~7#`U{-3k_07& zwPC~khZ%nA&S>UdN$ztLgmn2Cm#fHQ$yVs?nMhtvuIX|wdas{+X{R|Qr*++C-Ih_n zjaM{czu6Zcys)3~5zv7RW9IUw=X2^yC_)tn-X$A;mHCi;>VY8-d0A5v`$K4$*Zu67BkVAz zGA6<}lZQWA!co)=7`X;fm<7Mfq#|$*V)xaLsyU1roKt%@8V&3vHGlTJw$^sQE9UXt z=G7f@W_!&j#m2sbmO?OTHyw?)y6Fu!Q1un={gG&LPX1}zJjW$9t>1o>wbhw2F9eP; z3iM={Yu=r^m5+5SOWW8V6&_{MAaw=Puby+d0$+z(qLggl_NDVN`49JnJbQI;{z|T( za6K!+DPr9}Ck;|RQ07f1kdEzDeY+;roHZ9nm+g2mijK->XI|F7NivR)%WyX})U&I* zc`I&*H{LE1OP#zQ=!hqWlTgb#CtZWZ5b=_}toWWw;+)w53)metnusEar?jz-lF z>eXgnFykiYxYYWRv{Ij2{J48k$}~)_3`HIKBdMyFeiRXaGBRkW3@Gmu7f1%F$P4_D zq`6v+86(O`nxvv=pwF~WQzUm|#%jpT4KL7t`FKR4ly|H(X18q*~>@C5QSI4~r#-#_0vqXj6&zl~6;~Y5g zXP3w*(7!e<3%up8>I?sqvE+kN$k-pk!%bb;lR+T3Ya>;iC{?iwhkVQ|KY8vVI{Mv9 znTKg^!h^3d-E*|oMaXcvQ`8p-sUEj^P(ZCYkF8sD;dC_`?@8>ro?YdewLa6fE@J3H zif1Jk$WK`z7|Un+HzlaGbc?~!_XtCj2bHEV{Jcp@>ka04v5~g!aUt@Bd;hnrm%RKS zKa!InVG8>jM25frA4vdK3YPsiCsxOQR|UBV6sU8RFssMEDPge+{r5*Zvoen#(;%Q8 zRHRidk-k_6QD6(l|L60nau)4GfwlrR=zl9TH*ekY)-DQA$?eC!P{sML?tk^FeIuXE zc{AfROq9F(2(yabt3rW)f>F3*pZJ@*$y?@Zhq*KV=shyBNFVXH%x6+$CxJ``{{Yvl zHl#ob4nnRTLl)OPA@QaksD*z}jse+|7WCe-us?_ld3p8R%YvCuw8sLdLF0T<+hCzMhp{6k%`QPL3Et`)@ zyNgukw-@_2#vLa&>;=zs;X{j`ysw0MJG8l#i>~P!{U4Vp7HO&J0D^2hStlWC|GR}` zMH}OpzJBl9`xhWUWrUxMbm8v?7ihTsG1-N8s3bBWx7J(l;Q>V(x$3~vOo!zmFR0M~ zePAkdafqkTV&{eaznei&Ya0+EyVWro9Af&OLI)^M;TH_#Uja}ZwuP*X%}2q78;Js@ zl)y&E>+)=bj1+|Sn?1MI1C{{tegS*o@A|++HZx3!C0)QS=c<|r8 zeS7oH9s7~C)WbjQTuKi;}?=LR(DmKA7yuh2mtVAw$NV17Wm0oD=Zyfyd2XW$Ya-$s7AC!lfP z3#)YD!J3GK#!!IvAgHKH^ewnOAh+-Kgvfr6e*Oohv|IV~8qW`Es!%R7(WrjYzc}^l z7Zzx2VQd*F%%in6Slzl6WD`*4>gaA_atVPx+)oZKs)|%rC+l41;Xw+8Dvk%8jusa< zIiEo#o!k10qf>594y%X=4Gh9YX%85g8!)-GX`Vfj0v}utY;yO3zjQy@(U4bAXoA`| z&>3u25&!PnKb=3^mLQ~{rQIAQ>{@Tku9(|xxNx7Qj)+6iKg+=7-9%cWZG zeVID-?j6x|HV3~P;?nW020tT4bn8~f4JrF9_uta)x2AxQbX+7k+Fii__9?~+9_L;M z>)v&dZkyqfB!aVX=%xLQ1EbJuqgeK5LHf{`R#w^b}$W^EGspE`Hf6X4FxP7 zmIfi%z%{_Qdva@4=>k;)<^Be6AY&7$XTZ10;d&(`Q0ML- zrX;a9=9BJzh!+_d380sEKmbl(e?L;b21G#@xWR?*Z^>a%H#aw99A{wn(8HuPgOdrJ zX$xnA&s`ZQvkf{sYX;z3lT&GGuJEM9sQcMegBL8doU}9w;ap*`2$kOm{)x|S;qL7e zVKP8~72v0oJlY{t+D>TjL2`gW)Sc`;-Tpm5pr)pVU;?lazzBGOdjklf?QJORIP2M8 zzZ#AC5!j^-=#|vXth5$2RqZ?j0|WRJ;)H7k_{j7C6Ql=YP&t{N4q*E1iG~s51~pbv zz!6~cpQoSz;u{cJ3Is(0&*ys~-Su2=Z!h94dkZvp4C-MgWJ2)+{6lN~=?+hdm?Lp> z0EtHVKTelSiyP@ezjx0YSpAjX1P`^f!+d=)VNqwGfIU=VM1q)fy#j2u%~gd z1Y`iX@QBDrul;=|xK9&+0EkV2XN7@r-bs4h@^X2I521wmb5#St3Xr8>XJ?;++XpEG(Z$J0xD^fMP|X1R3^c~j37Rzo^VGe9 zJ)0uwMw^+L3Ed%FhkI+`*hI7$AO>L9Avc13u(6OGZjxOP|9^OVnL4`DThN#!2TJ|n zyGNOXKhxGm33S|cDAL>yU({@TrbA9iaLb4_0);sP#>b7Z2RH=spul*cp%9|a8tGZ$ zw;aBQoNT)uk zcdxxBTxUD4!f*QHcCv4v-DdMXI3u2TVU%pgFW(k zoVso=4U)*n$RMZ>h&tFOd9GrA!7I>C0R{p_H9a$f0n!jq2+=oeN>QVNa0-^)7cM&# z&qVr#fEz>jFwhLbPV3At@3VbOW`cB63Agu8_9lU1@B#=8P=_pF23=|yhlhtfX9CZQ zgd26IJ?E2&W1t6+od59U5-mEB=&9wo2sqAj)L+R>#W< zObtFfDlPc^9atRj5;%Kfw&B-ay{y|C>4yFfsndNng)sWShwq;NjQ$Loz!0Dfn~)k+ zGQ51guDF;Kp-8-aeDunmY=Eoy2`ogX@)4?&h*G%*4mm60izx&q&ldC(m&s;KSsN^3LUwA+cAqkg#`t?4Sq5$U84PM2d^8IzGW6Sgerj3k z*Oe@!|EnVw86EPhU$1xn)!G8^3CJ!4OIj+d{`Tf<+^U(#Vszj2_m;0L$WVvXu|PPM zQiQG1k&*4LjA|Xqfnb4K=v9m&ofIsf6qMtxG)8eKL-Pz+iO<4<@$=`;r+{|yAJ}*w z3{#JWf?l2wNw>o(@Qoe)=RpVn2idCSIF6;NstS{d_?FVr?-#?%-dg@CY!#tZA$5}H zzABArWhAOZDgUjo( zZ46wFIq4w|$bD%uvn$}8v6P~I)0-LoAELaid2;fMXr<$D6ZlA29RT;ppxFZ&+p^xh zyG<8T_zWmrg!zVf^@ENqAZK6rRO;4OR%zb;^XcZJIM1URfJX!^flEZx3jXS^#up^U z3MrI@-~qV_(in%}N($L(bgv&SQ)vV!|0&(eH8*|H>3!OuzYVB7q`L^5K^VPA7LkHR zButn-^q7I38Mr~hU!rqds}=S~tY_NB;U*`e9L0{v5moUGOyr;i3KNcH3^-SRjW2rG z!lM9F%TVRG7KVm_%?y|zz}L`jHNx@N4J987QgoY7hRpDsi9&K|T<~eoIsQSZyq_2EbeSio1 z3j7d@(zz>?!4B8qKlc*~0!7zW;|ku3-!0S73T9VAI)-j3DSyQ(!iQYRc_T)AzNUAuN| z9U7W-)amUna&vzM1U&>&G>BUUQFX6R#ATZcfmRH!hcQaz|7YAtd}ylV>?{Ja)PGM~ zyO3zNBKN8ybeN$ss;Wlbn7N!x7QKv#ivw+f4&9kDj~*pBY&j2`34+Up-!ugouKj}p zr1uGl&H!7625Lt&^1t2+(OJ#08$Vm&31n{G#0B;L zb@1Nbc?_~%3R?pO=_RETe5w^wsK4D1=Vv+grkyd#isnYKgpO z;x{I3YHlu5tDG$;-x=Zk9gbs4l_(feb^Bq#1H9b+#kyMt3nr1gF>oZ{l! zJ#wHRz2oDl5H-Q%zK@3FLq|$4B0_GP7vpElkxP8ZUdY{eTSn+q`1`0H?OH0o~ zQxpVv0qjbT%FSp%rnC5ZLSzCVR`H8|&hy6Fmmg?|{NgVwbsn^-xP$8j(i`bHKpIs^ z(V;2N=~t{qjEvFF9_56`nOlmu^EroVEoY(#V6%_jRKY4bVTNv!dT27$xQ%^7%>9GgPMYaJYn~0IG#FBp%FrO0Nl7ZRGE+(=8MDc(qDfK45=mx4$&k4d5)LI} zdy~v;QwW)#>+T$#^LyXtS?_w+e?8CozwcS+tkbaV{oUX1eSe1Qb6wXhvK|lc`l1!2 z%pll~d#iFkmLid10|6!2$%f4qSagOC?Q4HdP7)$D?g@%RiSMH{%Uw5m(YqC+m%WbK z9Q70{QENaq48<7%XV|5k*Dqn>^kANkZo2?HaW!O2lsZHhPx#o__j$83PC#3}?r^ae zOy|eo;un*?vvUdeLLz)(g6IH2@FpNiyqJV4)a`(J#QXFN4Gk}dA@94ew!@wkAwus~u%@GW8^As`@cYPtiRDtOkQpcAhL z%ujGd-23;h1&DU&{P}Gtxb^d{gjYBbvUQz~!_}*#N&SgkyvLj>93=ha)meq99;4ao zF)`cG-F@rqyoDRbjHttn9}Ri8dM;uD`At#c6E^+45VCgO<-%O~)7XTS=!9ZkLfx<( zv1*x-krBIu-AV|Y4?{44NDdQF!U>L|uN!=>-Y8 z5N&LQ)D}ueYy|~;%h1nEt5%)dcATd;bev6ZT}0(l=w<%6v1BVB-%lKAWCH|xVs<-tLcKpvHB7ooG4`0Ee!nU`b19G7{iJ#C?Q7S7e;<#4>NguReG|2@xj&b0PvPj73^< z%!Sd>GyIaV;WEg*w#*q^Oh92ESV*L#-6I$Wlvxbfjf~K0q3I%5B$WHZmo{)T2kjA2 z)%4m)K&i15YXEIRGn9dcEGz`EGD$~^)GgN6iHA-kl7NucLzs!>kEnEwW|3XKgMDt5 zu^2qTeC3_z`n~6tl0FUr?S*0P#=*fsL|>FI@343fO6EfrjTTR|F9<#Xo5uibffR4sltXT#1?FsTZzuW?w81P868Xr?tOpL@iR@~T*}l#hfcjAtm0QqM z*eGO$g>ezZ7{gmEs)vBig|#Q^&-!2ssy^o1v17*{fY9KG@YZW*83G3Jj=0>E$HCyw z)L%L{g`kK_tbciC0qJv0@_+pJ;TSL+{lr2&%5D&Q6t{;2o#gzPjeuvcR&RZ|d=r~a zPEIa0do$)d1Pf!HkA2-m%Mii}ed#vqN)$^3)5AuFOrL>)^dF0vIPZ=0)SaFBIjF3% ziDbgkDn2Yoj&E02FZRyCH1O>n7ONfjyl+3H3vi)UouT&c>gw2tVu$!807OK!aRxFV z2)z#jmnA|rbK$$dZN+I_$Z+o?e58qA0K6ev5wePbEruE%=M6gUN?i~?RM+7x(eDmm zfdni94>dIzbsv|R`o6$}nTTZl@38A&j7DH*ltj*GoH3!}Vb}~Ar+tI<52s0UQ|7O5A?Op;uZlZC!rozJ~*-x|~lj=6?9 zLJ2Qk5dFSEtrO(`0I3r7GER*?k#b7k`_o8MGcu>skn>*StFudx-^pe}>BNexvKclS z^WgP?eIQ!IRBUz*6=@0(k#J;i0o~L$u_?q$WrSW+>TV76fuIb&zN?AW4nl1M zRWYFe$#BGI2GPao$5Grvh`ee!&;?*lEpq0qs-<8ci3 zh@xo;teEf!j!Sm@?0Ad7?FEG_v0)(AJ}m6)_lREt%qf79citaUhe1N?wI!UYhGhW& zk&$FgoUXNIFQv8vR{*3IvU8gjC9Sf%Dke0~Mb*F{@&0d*uiIUgttrZU)mjKW09etK ze}dYsz4Z?S0VujMhm@{mExufX?Fh6K@pZEYar^m%92g|;S~r7VlU;Y!$*DD+W}#td zG>p3JSxU-h6J~>Gm$l{XJCCD-!OlX0uY^{Cmy-e2#>1gm>}bgJ;_Ss{kKy(qplFr) z1_pNcs*FEbK&B}DnVp;rZvjN#f%>@tu-8wdHUBym)0*_WJRU`2szhX_L?cha6$ZH9 z9$jQ`pPF(GngSlpg8HEV3oG%?pbE-XN_r)c$^nlcs%TV0UDULMl>GAZ8hKUL;V7Wz zF<>Ffq5?o87k}9dRVvA3X}Y0#<^QO|G}*=?I<&N*%|p3^tTI@wp+bgPXa#}a6?aue zu&iId6e222Y!tK263I&-d29jjNgRwIcq0;jlS!mS9|E-?)o4kd3i(^t+f%y=+mTe) z=@yOjp`DMYz+4T}Qy{P{xRi!T{!*x;4=1C? zL$!Nw={1tPgmS)LPszoolvr$#js!I+&?_zg^O!y#dxTb%2^hYziaDAoR6!t?319rg zV0D7AS^;+#(I0L4dv6Xej8-CmbTZ44xm+>!$vg%KebG!1$o`dWw|b1|sbs_ZV@+;N zrk|I1``DEsY@bRNL0|J^NXiF4#03MA8$60+2o4*X*fs^%orhzp;DDlkr!2Is?HmfQ zaLn=^NjZt2Y{kbCN099PtQ9CfF$X5Vxt$h@qrd)nt~<@UW;wwSNorG5ySB+Pho#AF zR*JA3Ag(0PJ@$q6>+`F~z_Kyz6v}Yo*#lpoR@MRR0&CQL&LcHi5ZHU!XgQ&GzzaQk zdoPn|9d0x}vp&^y4c2U0Wj1fIb)3nbjrWOT8A&PJ3;!|H0DPz`{iGQR-e=|5dEY1|1}fB#2NsrC-k$A_MC;W1)0~UnQ6iNMbssE zGb&M(LZ5m@P}IB_YV^w5ww5$tL_rGtn#=%#_nQ$FG+D}+T?q8&&$^NeM@GlO+kv?| ziNJuV!PsCXAN}R>dom`Ak@kh169X9;BBgxC*nG3FaH^rXEgS@I5LSWV0PfE-;p_YaSa599Z|*I-{?Bt&W1%pH0JPUQ&3b~R-34I3lV{o z@WY)SlgA1-{H{`1X5yDE!mtFE0Yrt0VGB{1gB12VcMohQj{y`B;T+2x7$cgu|az=^?@`EZqQg zH}~}P>^*AwN?R3hl!qGAi-ZBbpp3HA=1VlA+_0QJxfasl>_PQUMhsZy3gCgjM$BD& zD2c*tTD#83+?v27(-R{Fm=+^rU1fl!3chOMeo0}|rz$SP3r>dg)1%T~?#1rHwZBy| zT(x)shNJo|R>cOJ%rZ<%Of)rO2EdiL@yEAR4(|co56SmGcj&mvuhAR{UkBefxD`5P zsF^q8b75BiGRG#LVD^~u^M};b9;O)P`iKvRs&J_$+uL9McTMHHoi*vm(A!=NN^g-8 z?ey-`Xd($`=@N&3-eErSCfmMif>Kp$6xAH5nQ z`p@o}&YwJ<7yezVs@oR*mq+>e0$dKU<{$%Rw=d_eU&i1cvs@3<$E26WI1qUVo`j15 z+z5kt@n^}xx%dh5^W*wgRN#?narKQu%#=}7`dC-1rN6>IFUS%x@cR!Yn(djS5-rYu zu7{=4v-w|yHx`zfJOA-|&F%jX1o2a9q5r1n9X?F?w~Nt#^@kO)PCe~RTmpiE%(VV} ziAEoA=RxCn)3wYKcpEXN0nU~Eo7DwWZe~8P1`Ofyw)iavbBaOwUw%-Be`H+Y-L}Rm z?mxbnt@$^F$NzeZ|2L*a|E)#>pdj<5?&>Kpenq@4FzYGJLa=I|y?-QPXqI6!hR7p9 ze%ZneiP@?_TfHaZ1rn*XvyC6d3r#+lxs>vc9eT5D`@jGqg2+8_S4v(xW#nX-v*A*6 zXR4c#g)h&JVr$g!;NT!=$F8#b5}Mp67*qCTd-CGW9-&U!DIKaVEN+P{E&wWB|fpqR?Qt z)Q}M>YFHN{ls@vk$)gAspS-bgi+oIv;MZO9zC49RMa}4at>W^J3ls;-@u){9!54sFlVw4s^O+HD^8C}-Vs z85%fYU})dTEOyWFNsj)~zh)UZIg$-7V~tulVfwcx{1vj^75nub8ym=vn5dp@dOYzc zw$Hv@J+9~I%zP^e{`uuDbw}(CnB$ew~0o1i3-kCMCy7!o~RuOh)lXN9&FK4c!zDo zDXCAZzm&hmdZppfeBYU{BndKlnaMY(_K-t%Cy*tv!z8_`a){_P%>4?0AOf9We%=wj z1n39`Lc$x#P=#2&Sn2DR(9W&%D(b%eD!s@eL!xh2a!}Q4T3@Ln1G5}oPeb4KWR2vy z=jr&zerVn!o)!QW>GEPKtKHrwvkJO z&G&;?LL7?FJ0R=IQYibugY}v+kGYSt}fPG1XNFueR zHc88mMn&BYtQI}5Rw?`*LZ9X+(>~Vpr1rFrdfmI1(;5_tP zSt~a`M`=@Wl0h~`Ukffyq>1O)(V7cxy|QY4r(0E>g7FvX80%sVd(!G6BO@1O(k3*7 z(u(2)ZiwF-ozl^AQnc{iXW#wIyJ?~Qcx7~4`IDS5aV0U1K8IrCS8smYp{}DCR;M;s zH@Cl}Qq%>;Yi~ZB6-Z9ll}sP8;j(4(5t&Uh_sd9VwX^^8&59U<3bxut@e#2@)7e|X z>U#Y0g0uVR;x=QOB9tT2UHb)@Fz&HUb%<9HOYQmAL5)muNp08YJeZvvoc*S4q<<)> z{Dx!pXqE;?es*5sw&WE+dGHu|)20?D6qNQfjOdteq`H;$wAo%3d2&3Meznadt?nS* zOo5_p{!}QitwXy`keZs>!=q?3F8tC#BAhnl$QJu;Muq1l9C zdQy3#K>twkR~47?1S!GP_UiWu-WnXrN}GH{n%32f+_8I-^WjWtw^>2l*h!<0@nx+8 z14d?CRe_3=v(%}$Vb{FxbeBlor0!Em`Z}FW%jj-p<0r>B|CZ8IdV(y@e*14mRYY9Rr z8f`Z8%Pj!J*MOtL!f;quHyFMyYcR_sK+IaS7|N6K3JSZ%0d6tlPv^VezH>+IGtfL1 zba88l%`ti@wH7G~-JfAId$QMRKqzZbeQ2}<%edtMhP(~_z*@-FHJ5D$NSHGIWmGi~4D zXXivf!_GuDu@_n1AP=222?NkX{Agm_gbZ`E0XgkC^KM~GdTnhPmb#}^+kw4%)%o?` zs4m-;?B(UP2Jp;$cZSW+pFckgFS|#g*3TI>+YNjbSiO4nVcZ>Z!!=xr3JY&z@_ZYu z^)iMQqyW{={xnMSJI~TlSZWQzdg(5V%z9>>079Y1sa>`b=r)0}bx&bmas?Z6MWVsVoPGNg`AM(Y#v!^C{nzpN86rdn&o z^5umXNy?+p51qIh@)e;dAgc_khtRH$Hvk);#1E4@h6z^8=p??0;2RadmeqZGG}YC& z0RQb0$)}#(xoz8#m7J3G-SzBy&mB!PfAsXJAUZ~WM~{e)36nkzWA=U2sKPUQAN$YB z;E5s0tpnD(g`4}2zHzLdBGXxrOvyMr#+7@_a%7y-d)NuL8?(yCDIbxvI@R5T@~2V& zPOm24k)aS~y2M#6sc@N+(bqJyAo2w#I$u75Ft8?}_G{b-~ ztjbdE#EE;y-{9L280HQh7R+Bz-cyU_0lHm~n^2kw*8z(V4M}7!yPZwAUyJCXF(nSRTG7;@BxxZZjM3XA1!kXK zIDdX;=X0_=NfqMSo-|$EF6J_k`V%g|3mZZ*QqP$6yzX~(tLfA+cK|n`kT|Kv%xJZ| z>4-=2BWrcAx;CRtSje_AaQ01W*7Kw*K_OhtUB&%Wb-g7v^^om)!F{|EhG*a;ho?rc z8|Haik7e8vNv4X}+xOQ*C!03`Nr{=shCOmdU9ZhlTBu*OxxlPpiOJ_$p9#s3#H{yY z2zAIl$yMn^UTj{tRO=>}F|it-(U2F3LL*|ld-hcFa$#q*08=M*}gPiEOA}E29xn&KUnD>Bk304=c2Xm=> z6L?HT7(wimp8lc1vU+uk?U_Zz&-y`Vs@0+ubm?86D6JRX{WL0%}S6 zU<|{^`t{^dES0BXc3g#q(ppTz)&L@Xa6E_Z946_Yj`edFBQ@Tnm@rpe0P1(K%(NMp zu@eQmmBOSA0M6e92|mgdW{KO#Gk;^<8ZzV?92`HTmW8AO%$K}9$uw7c5;I631b{u? zd)Y=YOYEREK*Io0Xx@R);D|F=w1OikuG5Zq`rNqv9)Fx>h8Y&gAIcPdA-GQyUCs;r zOm#8^Yr*_=zB^`Nu_TAh&Wz=ITK!l+c?_J&)MPV156@w8@mQ{6MNU7zpV?#Ium1|i zCA2dw%9KQ`-XbD$3PJQPirrtE{NBBld*G6+rm4w;hxzPBA_>#T1BV!xVRWph(U>%J z_@QL@OT5J^pwjb-xz-tE*|OYN!n6(`FiDN%zZSqf$`0^24oy)GRmQ{kg~QYF_1;HG zwGEXG#?5|zh|O6RrShR&wT^;&1E+Rl?2Rq^_Ep6RXeH`Kov4m03!g6dUZo;KDLIQs zq@8IK1uL*MsNq(VmF*h@F8Cc}=t0bbvVW+U8}xn6)f4k>mnKUktBrz+tCZ{f(BWbb z;zL>jXKz#L(&?i>o=bQ~N>C=RQ1mUt-CM+dqY-&fdE5ZGNjujuZFLit(P11C0a!Oe z)TZsW&1DqUYHmt_Qx9036~>B zZeFFw#T+&?d|Eax-#?6?vW^5|guEANZV7A*Tco88!HBvINfi_n0w7du2A{q6^8m@Y zgV2@iC>{XZo4j)2JZ7LEt1<6i2b7qNJbkQxvZg_QxedoTa)5)z2Fdt@@ma$oh5G)hvR0yj7JmYq9~!D8?(-fqW&6XZL+ zvu6L`qUTbfIy;(Bww{Yi$aS*sz#!EuS*$%V{YrTDu$Sa!sjJ^l;{?NZpndNc9cVI2 z{?T3{VPD)&HaQ$oL+D492QbfEjj#9Y_>+&1_bC8Xy$z&$$H)|r%G-FI7dWt_W*Nlq z`CJZG&@@z}+WnQyDPc&ugh>*W*Cy=<5HKcZfNU(i3}s0q?$XRdF6C>uxCTb4%6eh_ zba`*RuZ#!kE@K-!e(+$}6>~CDiaZPoiU}c1n~;hstEuz7P5DMSvon*WnS8vw@>6hE zUkCoFvdbh;d1h6PY;df`6ESFILtncV)!r4;?c+IadD43N`uw2XH;;~K31&>_nq!bE zx3pO#49g(`A~72$jvp9h-NghQGvLjLU5gmVcM6hB__&?nu(o!+1DjY#h!$n`?wvbv zb(y=c@A`Hd+D`QV24i+pGN@m4_WWTcw`lMw#6&V@HS3HcJ=E0+Q z>`8XnBzCEPs}0KXE!(#%FfhYORk@QbGpVM|mR`aj#whl6VR_TCp>yHcuDr$EK{`$= zOQ%=GUl|8wY%6(+yhcOGQohJ5srK6qT8@^_c~zRl<*hp3e- z5o?gznK0^BJuP7~0oDzj+acn)2sg+<#GE@Ym?g%lBvZA&6U26PhKLE_Nh5O;kGQz* z(i#p~`UCUAaML)XVlcIcs-D_Ix{A8;Q!46PC<(+M_g8``~GFzzxC|AEX#c-DW7}QYC+=KTZE4V zx-82?WfOz1ns_yIa z_eE{H9=z#Gr-jV$(O_$e12mWlL47e;EDI=!1YQ$8ysAp}UiPRe)8X*I?X2W8Fa!&o z@W^7f$w!guB#$f9hS-gkE_wC)v*Tjb-8F#h;R0jR@BnOZ}=IpjDpUeh=j7#J9x>JyTW4HzTS);<%6!qLW6&C+jHJ1NmE;o}u} z@7wD2qjt;wFB@+tE7AO^ zpWl_QttUbU0B`K-^t`rU$z7BxF?OZM=?PlNb~Hf}YH_?r3yC8b+pNY(E@T^S5fuCt ztpxKa)Mbmzb8(7Ap~<`NXiJPse0h&OZK%0F!Du;R*&C_o*O0CVi&%v1p>KDyoh3)A zHI5mqTEF|P`6HBjS^kq4FRy`lwfcm2Rs~LP2wnWJ?X2R(e$`tYIW7HTCzBNVEc2bc zorg-chYp>hWqxWLm*@QSnX#~@le+cD2fhQ_)eeiyPX0fT2EMyCl^r)d5Om z(uj}{-Btf8f=r^Rf{2bpRAdY)o^pOGdQ-w~Q0|WPS!CXrto`a;cL*6r{VH5>M!}m9 z`|A8*v_Q%xb%r!J>MEmq(vDNfoHmn)iR)2vDqn~E0YyN&?--(xSZGj9yWeasCP&sF zQSPy55Jg238RE5=k-aP3vdr{|*tQexj*rnzlPe<~_i+g*uC&IdrHsN1$UExl_z|jDs9YK71gYO)@g#ox zp6J?2_+li;rZfV>1W1oAMjm83sOh{0@+Osc1l7V4cqIeo+VdHRL zV%19?GRCkB?l?~%=*`Cvu>}|?$E1(Im>1kK@L@2wdl(QvL7?s-lTHxkaV^Bv3U3*d zwTh9^PMi(YvXvY57IxR8@{$p^>+MQkmDU{?6qL*y0};4Z~U_JOF?tO++8X>GDI3u&rPZoRC&N?@emZgs9)Jx$s6JtP>Aq+q-XH zD76G*Y^)z^v2?7`?-13`XCT}IV%&_TQWocu5jHKdt3*-6OroD@PZW+WLZgZE6hhUb z33m|Z=cu>XXdS>~@~FJ1*%DB29@^i?$igV0Q<|F96Hj{K%8A=sSCG#48cRZbwpk3a1u}J=MJPPPb>^fhKbl7 z^4u8dQ{WAQ#2wQ#h_Vl`Bo|hN;K16t+FZ<7!J#04JYkqFrG)gj;1DS^0GU%2W^rXn zx#@a&&SHq!OS2oj@fIl87Nmt#r54{G4ekRc@CZZ}#JN1iwTe)Fhi&xrL#p!6o;{1q zyAr1XV!?64wmjm<{deHYd-fZr znoEQkpkMKN@5n$uk|_aW2+jCZLJe;ikrX>|MD`_Hv1?Ez%R2qYF;U>OVALTxuo_B2 z{GP9Kb7;p{hjXVOA`h;6E0~4|ti+fbm$DeVJQFw3iCE{P2L+24F5HZ+cSpl`HO0`T zt^>(I#09)~46r}9heTePdSB9D@Vd^rA8vLE0pan?8 zR-35S)u6}t8Q0!JUy4y@qC+zEFYKlYBXWB(;+CN3x=SfFYENS?mBBpFVSvnX$K*iOl_Gi^} zoSY23e!2VrYqj+Sv#+N7TzX*GvWh%OthM9|Nmh9;{&m61a)Xee#sF&TIUu*nBU@!g zXW;Fg$^L|r7M`A5*4C<|S4_Sa9An;{e|-laGYbbtVj(4O*o!?w--qtXoxfGPk;!d# z+P+=;J0&Mu3^p%uM)o5Ing+8t#w+O5(!jo}zKepJ7|eBmW1mb$VQbmvaM0zRg4kCY z`-TnOzF|Pi;1vD|Js%kpkYNO^Rav>N(J~@LWn}WDXT)^1Lwuq|Thk`WrssiIMsZRn zeM-q@>`8o50w`fY14{}o<|#$YjH;nAg218$G)%$450ou3Y220?GL2nHM(p;((i7_s z} zw6xIC1Ddov`jz0U=`<5{u6;INYnrZ<*5=gdORFT%c+ouqi`=DB_@-x;>ij`DOggdQ z{tNRM?%;uzkmQf0l;^qLAncqpWZS{+A}l2}oii=;zMS$v#M$$SCEq!-yw{ZQ6`Iq> zU6m@vD-7s%56hyG_GNyQ8)gk*AI0HQEZ9_nbj?~rjBCHZqzVEa zN!{D8<0j|x$AzXr!@je^+C`ZhjR3Fe(U0fhR-2!!N%a6&(3MX?HR}hT_JK4l! z`jfg-I}I}p+gi`U9KnL%#&prtrj^GqE35R5$ut2SkL;t7tR#E;`#GS5#SDD6CWtYq zMfJ<@>jMF~PK4lC+sE|N`eKv@oJV5H%f@RDtC@$w04bCdQ^H!R)lv#y5qxwgBsgJ-^FE`EqI*moKR((Veo{>z6Xa}coXp! zTDn5C>)-shQ(PMY$_=J3PDTW0FJZ=m)^n|nF#|Cpzu~5{L4Hym+ zYa>F!E#`DOp{S9YEN$NAY-AT!&WqCMwi)fL6xF)>5 zOl{Q(O%e&o-iu1FZ-(kgzT#MVki>fp(kVX0C!A#B*M8!?~g6e|V%pGb>YfdTHXjiKX(arlyBP|x- zLV6m~VzP6vIVfpi>?#J+RgL1+LzBA_5?vaKq6B?LB~R)Zm=1UL$N5cs9@VR^%oF|S zAa5{WlS9ohGo>kJmp8uh(WR?LCsk30b`G@m>s#mLaa-1P99Qm~t_PJ3An8 ze6QkS-xD`o6xXhmXBpdaF;;g`BBiKyxvtk`V}n0F>zdWn3M|an8A~zUZ_%fa5O}vm zg{5#U8|(gFJ&%_Sy?*ER?z8V7VA?lae&Tw8uLnbNXX_rOeGt6%hf1u;5gQQe6n2wI z9}~N1n4ebHLrHvRE+;b}}mMou?s1hE*)ag=xLuN3< z<%ZUN7lWhm`C>@QW-!}vDiRym5p5d(=8ZOp&6U_r`;7~4=MFihwf8JtIA6T=-o76n zw)(`vJ;*l_8pGn4dtH35hTk9>07doR&AY(vgr2LQvGG6|`k5qH>2w8~B~><|6>hX( zlQ?fV<+j?+P;bhuL0CyZFZ~1pi$4!Y6sABg9U<_rODJ&AN-Hv>-=nrR>73Sj936)i zm=5a&9AkguC;xl~hSNdJe5uzunx1{p>%HHZ6H}OH;y=|FpR1&o=dIb)-^*9hG{3mQ ztn8!wiJ=2~Xz>QU>t|e=WKxSJ*(ay9Hn}*t*#GMT`V#UlFfcH5i7s4@|NZ)BGp~Zp zyt&`V?w!AA?$-}iU&H7B_0Q2evcF#wdHC7fA2XY zzAkr>mwH=S={-IB0rVr{sa%tlMH#bv@eN0G?Ubp(;xgg#HUp}ri%Tv!;R|Gk9#qs8 zW36*H;$=RyUG|R@e!P7T+LT)SmxN&uG{2^f(9d8cEtSH7+~OUN&a$pt>}PMjZ)9X- zBNDmmR4Z2xY$;BBT{(A?s2>DX9L@ztlhcJ7ZOQ~D#`0$qjiy@I2F+oN;DK%@21Hd^ z2!;%D8V1H<*ySM_Po&f7Z7rhtO<}vs)rZoxC(C1usD>Q33c@c62fti3_ui?gWm{Q! zy0MNmc~)1#@@MP*o(HoCnbr06vGW!z?t-U^>hAT`aNaNpjwVcQPdRQW=y@RJ3c=B) zyJ+ca?;OTqQ<5g<&y%fk|NeafTW)!Ho5+P~s;j%O_ybLY#ql#~n0o<^IYnAN{FEjT zzAEAU&?iIa9S;gE7Jo1>U829mr;xoKZF;Hub5wj%QZ2}8l%lm-vFYij@TCuzzWn{H zrfVz~EywsQJ~8p6scD=frw>m_>)=HQeJ)+R2u5`s6dy0pccMu=;VTRSDSR3ovhvDM z`>%0OqpboK2JD~~!>s)fP%5fpU`yBpVPVNvD#R4PU{6GM8;LQQk<56BitXEZOS*6@ zb{$&jc3W|L4_mYqbhrc70{Bh@HroS&f6YlPgDAYY{1z4ttGDwuN;#$i1xd!7V7f~| z<}>##b`%i&F2Ej^CI5aHQ!?3W`KoJbb^s@beapS%0Opm8YjBn+?5RxgeRMHd0-8NA!J zuObxx4|5EYZ?4?%oDdN<-lwD8_N(gl=aG+4Tg%GIhv7k;{+0WIf(G$G0!y%fYii|G(`sReM!4LmE3?Vj(*+f>S zCSB(VwWFHaWH(NLf1L(3aV|Iw^rrm$3d!LUSUGe;nP{-c031g8nxP!>f@ZHX}afrCnr2 zh;@cUVEr2ssVtE6pB|pRHLQGphRGPg^rjN9Ofsy(Oi`*Wqp&mHB1dnxcXV7r0uYB~ zz{r!Pscm_A1*mU!1eHbkDT^xt7Rp1<8Ur(M07b4x70B7{wUaeK9Hh^G|gLVG z)2&>ypFqNgm|qAdG%G5{XjEPlmX_l_4~VDq!v{$3Xu=qU$C+x%32(&n`Hb)|0)>X2 z0+&lF(PuP5hYS44kH-aTa<7sGf}3uZZ5+&@q9-OCNmRhPJ8Szpg~+`9J~?e?(_9go zoUDbQ%2U!g9QXXW+@+0we9G~Y7UA&a8K0h6XR?RWXL}y!jo_M->eE=^SP$F$amV6Q zQq+%$v*kA>-@JMA>YHysU2QTE!T9!b_>HWYd#?3)jf}rD&)Yo9pcu*D7cj~6zeqlD zO0}vl`x-5Nzp{66!ERqKYBhq+%`<%LjAhMM%sYD{8Z7K>SpNQ`XKU^pi5R?vW3n@5 zCa{)_&s;aB(IKdweT`6kk%K7=K^_3%SYN)&H7*I z<4bxXdDOdC%12bT?W`{oV`l`f$NrxB-#_TC%)jw|{Hs@LXq};s^WzZ(#xvGoe(C=4%V#HE>*Zi{j z%Y0AmM-L>IXvF3nzQyQtI3l`U+_rwJ$M5REmiblzi&03Xl$@u*a@N#PkF6U6Cpbk6 z!%qj0|5XkYFwcGbr-QmZ`IalNLNEI?`fn+mSuyuFqps$h|I`L9O#iAYOnsIthfr$g zjvZ=>ig)H;lYN(t)stwHZwN>asH*zOlL63FrGm&KzvZDv*4$e@o9=xj8;-1wmt|pd zpHx!|hksZohA)Gv%@_?-p@1R_xTd!D5{7kDFcqLQA=TVPOoif;lT|F%&AnOb4Mrwb zBvTO3h<#r74JPSNSn5t>+2O_mL-f^zVv(c@K#*?$ezc7^nykNxV1&Uhj93$ad}>{j zb$|HJeRF4AMcxwPz}+q&tW11#n~8w_Pfa;yU$`=Ml!;Cj1oYJ)9qR-};a#=ikWvY& z#R%Zo8*YX}sc|Z!(e4Ru!RpZ^a~Eo!d}x6ub}zzs*Q2xEYQRh`nVFr`(h5?I!9xck z^%*CC?^M*qOc{_)yq2MZJi^()2xxXYv5x!fdi*t%p;)K=U*2?)Vv4yQDj=c`hbO=n zW9|-o%qrNHpoB`{KhEX+{hG6M7%~vanE>%G0i^ehgaBk)@9)Pi4ePng>e|rTzQ&1HCOC=|sKlk-5A1Y`9DFnjG>DHp7;OM|1v6@ADA<{g%mA0;f2L&?|BMM7Ot zsZ^@R^xPZEPImcUdj~T#R>oWHcG>$;tw1%hi+SlqVC@qnDz01dn}if~F=E54*w_B| zmo$G-wP-mYfGP|?Vv(Q~eMyRkELU%PsI6~*-lTCeR$sxdn15#H z%`+cT_)+ko@7lHT{xRR{HN4_3#y4IZRaFjBu#^hqRv8_Ym|k$rozy-=@C3CT9k!}D zhL+Aw=H`iD7fUGKt$RpT+|C0B4j3}^6*OCQVW0ca`jr0(vgfcR`B;5X?ciVY0o$=z zCThgB`QitDhyHq}RQqS2Iy5*pcn?T~ot^#N?l|R(tYT%i=+5>n4(KSUwCDBlIx%5nF#Ha;CfWjLYsgz1TF=Qk_SRJcS$&m}1LTvXWnX5-ce+XL(cD`( z-BRY_1LBr8uK4?+LaV-Bn{W0{VEsSYbp3Dc>HdHJ_NEyN7SYoEyyl*->=LtqUxfs! z1algy=(|TEN}kL;YS|^IHt>goc{m{8_%)OoSRs2?9zsZJwtA#G_cC{>%^UBNINvi; zx_hM{ zKu}qYpvwp{dEpVB!&_K%0@n(e`S{J1G7JJm=UIJuVyaNG@+uCdq^Fi$yMAUpu6S_# zk@1=N;lB&1KB0BngpHz~X(&5HMyvjj^5Umriudoo<=C}ubA7r%Ow|{`GuQ17s2+X) z;rB;~pK@BXw1g`Buk90^ZWJ*0O&NNx{2xRZ{tK&d@04qPsQ#OX6IK2|Ci1T8$jf_9 zxw^g9?Mq0zqFUu3+&SXdK6rI?shxc9RbT(dkK<7ODAGUG%|QdQ3bb~X@Fne&Gy{d((i*(s^JOSAY7%?3NT6cSCm{cpy^X@WjW( zRg$V`{}W@>@(Ed4y1uCpAFSH2_b>tdaOg9txwT6duBILU2M7dwze1Z}LIHJ|nHbp1*I}X&ICU`{6H!x$`mNcyOYM04+XlQ)f9) z`Z=QdL!Phs^ywLy(YP;Q{6x5#*gY{-j~n!#&=Ogem!r}wMMJ!PB^^uz&HpJFBklYq zkY8sDE!~8cPKe+fPQ9;o3JRXWM?wB)q7(SMGWM(Uu#&;mW=}^@Ypc=Otzs8dO-oD5 z8YwOpD>;YytdbM>cAyR#fiTR_veiBLeIIx{<2WkZEBveT!dGO#hyi^klAFF!0Q)U+K8Nq~QuDB7DZlASPX_>TBLYpl>9Cm>NYd( z8wrIuC zPr!wmAH_4hqv7_~&ucblX&*$$T<=)w0oh2@A!Q5ahrRiP3{51MF7@POe2W{VoF z2UrFE#KK0S&p2a&XWM>O0(#^E#n>qzP_w6)J>qqR_;CexYY&15fyxmFya1j)4+tHw z5%U*Jk59oz87LSlU_d|&QnORTq}A6K3wxG6w_(GE3DC>- zU+Fl355og?$TiHxLE!|sk+__-HBJ86vuKCV^BQ)<;xBI4*gx%s{jn({&4yzpr-_M=7`9*nz~8Cu2=BZTrKJD z;)5;;;Y{1@02sHf`7+$1-yL%WN~wBJ7B0t+qN$6DKJoZD+>15IR|S%bR$@OagyGS5 zj8M*C2XH(fFp%tPvh`~+ERCe#gFFGpxQQFP)Zp>~s|jU<_?>)w7b(|T4QeFcs#fvc zfd6-@<5T!O6$>Uhe8f#{ILKq52FHF!z9b3$Dw zx*dVNrP;I}8|nR`fr#xJEM5!7pdF%)GCt=Pxl$~7YwF80H?W+ZS6c$_ZhhajzPdN>sM~`NB+P{BJuX&(Zc{gVP|?0#Gth+7q9VVTe-O1 zN))a9XSzcYa0JYHQJL6e>JNr-Fy8VO>v;4tc=;au5Pmc{cQhF0SAzS6g}bmGvO3=p8j952&YRBY#?DPu4fZ@ZhRI$x=qBwfgRAA}Rj4`s-F~G7kOusHIc;omdilcnG;^8gafi7Q=+ooAQ_tq^ zB*Q3E_Wt%cfQg}AhWUR{+MB1`yly^V_Z##&ePI2~hx*mgzY`h^InV(DIO4kxcJ{IC#A{FM1oFgT z_N5E+8+5!I!slKtyTt2A1Xi^ss0oOaJb(}PWl}9@?F%=HtcE4m_1*v6yTWEGJ~+$+ zTeZEwQ=!Jk&jX0eoGu6yQhJdz} z@@ynI6UH;RU`YrFYS@@(@~uQ0=tVEhvukYT-q#LT=`lfi>c1M%hN!$ru9V{Wi}rgi zClHN!Mq@OHz+D7r=IO@!)dGmsTeuug4*fN}u?$|H%7aH9O2LUX&Q-KJ{~0p)};&a25U+I+z@n~$g2MNPB>qu!jNU#MYpA_C^V0e zJOiO_F2*AMr$FVbLAu7bD8XEaSENTfvG#*xLG4v~uXqTdk7?Fv!*cjU{-m$z9?dW?=Ql zqGgl%kVlgFjX%bj=ulBc1^v^`D*rVy_!~Y#$AA&v7rU};C#tGJBYB28Db%6kv3Sev zt(e9~qPo5WK20##Vp_+BB_$=(R|B>l_l7%Xl$^d=o*lG4N?3vaX%T)ba-DuVz{c=p6@wz&tDK z=N>ftn6BW@pJTE@;MVerx%KUCaCZGo?D@9AtG)*)$0jwOJ-FoY4*cRo%&7>5s{6(& z93{qnSe{>f#=LZ)Fp7YY?yBvsCur#?i-ggX2EB3GD2`JrD4z~4De6f^H33K2@T9znOAwJ9g~8}ej4lFq_o;1W#=!WV zOb`#MBG_xkL8KSX{`W_?H$L?9d#&ZMjLJ5j5c=oX3_Oa^_o<>>N8@3E6Ee)d=I9W` z13aD9GTx#w>`gUAgG}Ec92u<*PkC>DO{GAyBl5X zRH=Uu1}B++e*FI{BL~sW`NFN}=K>8H>kmJq8yWgBSu( z=4ywkOv;Vdf$yLmp|AgfOpb8U;YF5hut|gE2xV|DcDPNZZ3%Bs7pC+l&!0c< zylL*kvVs2LFa+!j9!t9aXq@aBg(G}K#0@U@C6;YR)zNlC)m{TN!_PhDw7}xlO6ZZ( z&XxH7{BdmVO?nwYB*6_|H2+$zapXJcwR|Li6BdR44h`FP%eMdOR}U`XU`?Jyi4||z zlqZgEmek&AYL%B_!E5+`s3we-vZ9uYgFaCMq*GrW0i+is2vo^rG?wZxd|nF7K1UeE z|0pw>QOCvK9Uvcd34;a!InR#&C^TkH8;~oP;kQfnsR);vS&9bnZJt^3UnR#~`yWrD zcOY6}x~51i)R?W0Mq z@M{_v!yLGO24F*G!sQ%0f&OAZroibCNhb7U zbgo4b*~5OmHAlJ0Tv+ha2M=`-(?gTrhtQigy$Q1diQ!G(fSmA{7^jj`-v7! z8_=U7;o-Kc15h9d5|=_tZ#99QT@5%OJEMY^BZhHw2tsi98#$o~hIoBRYbpVC<+)78 zL+XI!1!9NpyFI}Jo9-XMf_44QPBjke@C_s1Bk|6CtNV!>4YkxfdHj}P(gO)Oxo#8F zVxUX-Ou%`X8X6H)sxGdo6w|qBATVuKqUUJo_{HkHJ5A0W*GzPlMQkwksqeaeQ5Xy( zNeoXxdU*eFJ4n}Pw*gH(L{|Z9+gaMk%MqL#e*i&XDF6k-ccQlF*RWoNWLE+0_}~@H z4wn_9+a9cBe0VgnXcP?Kb)9Jmlc{#zxIWnnvd_qMKJ&y!f#*Z`CupSc1dvq0TEYQH zS~@z9(JJ}b`pIgND zZMr$W-A>l!MG_F~HOne1dxPY&anmOJ>AI$MW>tN58L^#q*?*TK9JZeh4nBJ>7E={R zpdp>t+h#VNZB`uG0}u~q%Za1dEWB~2ezacmh50MeI(*Xki&l6sprDx$Djwy_h?rCY z;L`+838JY45P$}~C$wW6GAtU&I9*X4Q}O3YUaM$IX0M7k0kOQgFoJDU~Rq$k@_2RDqMDGKv1rR^^U?Tvvo45VV15KPOm@r6*#4^Nv;kAt}jvl{r zpW*i5EkGfLu1ey)mh~0YUWOmVDa>ji%8bI|0F4ZHodCgocDsO615*;9>m>49ugA1FaBs0#fN8|y-T(l~BwAtwNbaih2B%;|QHM+w_kPV7Dc^R{{siFS1p@!UoFm zD<+W28uS()Fn-qFKSBs=Sd4_G0R(E<$iyhd8D@3Id>N&Gp2h~mj-?EIHNcYg5?a?7 zf+vT6tGdC@JSzGgH6-*tF|5vtsukM`{3=LgG4C5eD3n?38LT+N!ieUz@S_FVQkyk#(d zp0UZLjp58@Thq764!fMKVlO%zp+>F>5E>!;k*x>p?h>3s1}U3@xsEG!c3X+IRB;x0 z*XZWfmQK6o<9?-~yj{0-i*XfWQLXt==_A8+tFsNuGcszVOM1_n{bCEq6aui~JA*M+ zhs)Tn$MDv*knyqlQD2R{d-L+`XTo=fOX(Zk)A*|z&Yrm*yzWpE5N{A5ah6#!B1r-#P;J>RW8+ zx6RCvmX8@0y=KlF#WXd%0PpECuGX>5Ve7;&MEz;g}nULMQ?jkf^HKc9NF|*U!_i`#u?V zKgsuDhb86AdD`+_iDpl+4_q&LF1l3^XZ1`@O^o&a5x;aXJ2NGZdNDC}i5V%rvJ@l< z@H+4>f7#uzy8fphpRRV2!aK@>jDW~lfJSj(XMn1I?Z66)ql0L%~dGSEu5wB4*)vfyRc;N|8%q%$j&v#E< z1$tbb%r#&CI(`H3mT-o5H(_%Ep3}fLLU@Hf8F8j>;i|Rt!R?DDiXFMP9+piv4{y3@ zs6+c36*5>$6h|BC>mOh@0;kso$_M5T4&D+V$%K)Eiq=}4o(7m4oh`aj$dt2_`#Y=j zzyhRv084%T&S^L`;Gg?pU~mVrUkwCUWDUH$ym(p-c2>;%AL)C@UFWX9XO;;J3P-#f zkIHY`fD;($I|455=QW-*JLy2;!=Q8*@yrebsaBCL33DqR01&{vlGw7v45Ti^RqFM< zzptDGJqM64;?ZHRT~~{!w~GkA|6;FnG0q zOTl*vO^{=qiU;locJ!ND>yuz~j`R_^-`C+;Y+wUmEp7A3$;m-@1#Y@pi{9UE?!SzqgUKfMMtgm z3oLFdQ(dC6>N`BX7pt}~Zss+3u{%8M8?%G5mm?Vl7{uA@iT{{YYqDQ7CBN*&`Nom# zAW6A7ctfQAA@s%}(<1U>dg3)0)rTGmvmGormcKnrw!Hb92L-^RneS?;NJdWr-Kua? zRz;aJ;SuMyzdV(*R#|n`@NYb@SlJPR|2CzaM_Qa}WGvwgZik3#>&KCW(R!px^eqjB<@OBHx zWbfcE8i!KA3aDp|sadg!v6feU^{O4?>2-BS8_Ci~`J(7eL$XDT7(`SE+3 zte+%Jkl#AOk;fM9AkELF@|3_dJPJ>W;79sav z|CH8jTdo%Mj~xiX_=lZ$-ua_S3^E6D>ZhKW)t)EtBL1(B=$!l^7miAZc= z)E+2fW^`Q4I=1BUT;}p?zn0*nr9gr8h7>{Z!M7$;EK020-GPAPW?tHf1Ok6#O6)Vm z5JzFH@*Yl{wiNb211G(cgkAfgbj(%&K??1#GB5}t2)(D4pZLj~8yDsOw&!nuV1XBR zUs)vOR|uUSAor>Jc4sOMTs{V_i4v$t4w?~(*oS7U%R48iDTHH<)$%ak;mXiqqc#a> zIUDuIp(!V*ur74xe+9?Q+q#Tzi`!(M_b7iOur+{z@+%%`U)QQI{tnFPB&H3R z#~~n`A5Lp-%g;bRPLgBY zEB*bqwPUlK?{BJs^uMbH{s*fOC+cvz$Q6SBv%*-b7HwW69Y{IDO;=k@lK!SRDMZYm z7;tgMd;(Rl>43zZ`&%3CkK*rVdWpl+C>?APqPM`)4D6yGf1Z5q&EJD&Y9+KN9C;Q1 zEI?nxd+D;7FN}>2DZDPp;avyQYDfn~v?Ex#;WVi0MSza?5&VqQ}Kte@BqMJ zH)Ha>35P}kc$lU6+ugqR~P{iQ_RAwn5RMrT+79YI%ZUxg$fS^BEL#_w`B>WZ7#xmK>d zOFILB=APpNa%}^hqzP`<_cH^9)yYGeTnq7C;Rj&$^6K2RHTVAIOkUeYyJ}?ppKp*X zSuK}rAM!~-q(T$qv*k|hn~3NJYN^ZuN*lR9=RAr`xs(NL&pB6q`-{<`dQWp27wV>$ zg;-Y#eRm0I1>h!uMf52OFVe;Ee~;>(FjY%T7aCUc0e?d`Vjq`3eDB$xe>=b$X&TV? zaR~m4$6HZDcsr>1U>cf;bNL}gZj4;Ecb?ZPmPAd^$317p>Idu+3Gk}W6R4S${A&A| z9@*TEq=R&~6O-#l3i(q-86C38N%8eAUTpK2Xb1d;?t10eOi`0!ItQu80N55x+EOg{ zc_PiQeZ!((S|bZrDr9G}`mCeRFI=3(ewyCMW;QQIf7_&}+QXM%bSLUi{n-rXWGl8W zPl2ihC(w++9EkC**Nlh&Y)&)GXInw2{szBrZlL5tr%Q6VzPTZ^HQ<#H*8`Kd2Ct1Y zZJD*;xK;aqJVw86QIy6C>Bm^E_0VYoX)jvkx$O@Ulv5wX$KO8+5I2g$S8|KFY~i(< z;cFx%wO8%AUeUSfc(__{(7S3<5rMzqWB9mE>G#Z{BBNESGzj@P=P_}rQ<#KS1lX)3xb;%-AQ=`4%5b9n>ZaMnV7LKE zI?U>GZUW1Ck8EFn)ILD?sB?e}lU_{v6lz58apxu4qzNY7R>I|rC}xlvZ>e1j5ouF^ zwFkIFQ62czNR+3BI`CDy7cSWY%T5y9X;oXCe2FJck_!+>*Uh^|0^i$)I#7a@V+}~> zFU6WZ=MoH{0z-O$FA21S{5I!3&2NLtWOnAW`Dr}C*l1K8Q#U;BY0vNA<5J>_%1AVH zgB?Eyq({hF1rtF*BOif_o6#*i#ZPB#;+2B4UHMT}9xArb#F!_!lE zQdOo-%i2itDln?m(5KJ>j?LxAL0n8EVq2(^O%Oj3fJwQ7wpkdFNWsq{)Crdhki(Yx zfl$|${A2pE6@Xu`Ja9s*W1LSZM!%u(AOE@unalizzF*F6o6#}tyMJKg3mWS5Zb3tZ zM9%B5>d>JD40A4HY(S6N6=Yz|L1VQwLT)UwK&oywFk%%fn{F41MgxfBws5`_^7+8x z8=v|LCHcH-FT1k%5ma!aUnc`!hm=gm_m+C&M8DDmjvcrL6%#ct)KYcXZnu*9zq7(k zlD7^Vs+KGzkekzUJF^+3kmcjJfzPtd*er-sc#Po~LAG-oUxv%-CHW74WiDN^oV49g z3nS7*Mn~@>xTe8J)27;?DH0e|?H?m!uK95HB>@%K4hJw|50^nOvTpoI#TT27k0`u{ zSp4ogeHg>(E(=SFKeQA?TcY&RsRVB=B0Wub1kfS|GXd@bk;nuUz>Q%6x#5?iX73}R z#h2%fuM&jFNrn0K?6#n@ffaUa7Dghj1l?P`?67$UbXnQS*>C)6u28t-3r%t=-F~_& zO)Oi1B{{ewStkU$l=z)+S33+6S_aWa6yJkL9Da1;nqqNM*n^Tz;Q{L&GQ48)Pfy1L zC?e_tMFooXG@Vx0Qc24aho-;?tP((0RP?d8UlyPs7n%-lKbF)UbHjYk5xD+AeTr|@ zhK%$8+HPnjtwyGc7M_yg3?g1V5+Y_PQG|*86^KD%fI$)UP)d?Wn{ILo$q|nn3BLapmlG;(VVQxaAyId2=u$&GGt4Cu{yh)CNo`5z|Y@7NZ;Q zYY0$HIOxe8l_-Nnkg0=udU>hkJ9NVOaZD012X#NOTLBCZF%*NKP2kUj9>3Af4@3t- zAC116aODUTY}J26579#EggL5Dwn@xebZ^B~RQ$vhvAO}&0?*Y%+70r*4dO^E$lqi? za0|N+MvSC)FGqiXc2f@UDg%O|L-POCokJi}rSqo!fGmxzlNo%5SD0uAHdNbdd(3UK z;(*~G0re@^3Q1KXA!xsFRcZScOB5Z1s71YaX?yPw;kptrrvFs7Jbs*gVv&`T;p1Tc zYKPwkCE0$kr=GRS)H11D@J)pxHRgryv2Z-Q1A)&%Ia42#? zlE4*B!TBS(wSz)k-%^jt^M5Py;yVI6IpaGR(mQwTSGFq|men$OEuMcdyTAnfE$B|Z zsWqlF%QKd)Nqix$vK@+fUCe_ZMi|^Z`R4o#z8c0>*nT=ceI7k=?$4v?Nlqav6sIpc zbq)wEO@_wtYVCCoD)fb`7J2cLRSi5f!l)KvvFvW|!NA{%pL12^D@m$_EZJ z{IPI~NE>IWU-_$+3vr>;bfxC<$2b)fz2`E8a2ognmcZlD;{D*@8`P+|h3^w2z!w0)SY6d>~S z%g!<8c+I#F%#h0Tthj_@a_Zdew$Kz^6Iup|-~~}%2N4$Q8T23pOWuh$28MhN3j)3% zXbz}uZCF5hFF#4EAb5Hq$rDgSF-e>!fEzaN6@?-*GW3Olo#Scska~kEoRYA;p7loG z?$7j=8}gw@oQcGhidpdzs4Izh2!^E>dUgV9K^8}U3AApso^In=p=ku`kDX4FUnt~+ ztwIR-D^kCSIF&G>>_cwC10#Yl+hxpw@bw{e^9W{B~ z=UfEU)itF)*`?V_?YkNo7Y9xwav#NS>gOqbByC=4zD7aA$f!~E$_%qg&%esH?NM2O zodJ&q|2y1cG!M|CE*7uzyaTH0#h&_($?tNsu(Kr+`SLJ($B6A#aHw?-q);WQIhG zh-=m`iC9f({|DYfforb=ODz+qcV;wzzZW`3x_JdTEkM)q&NL!0oKiDzm)>7mq^}S% z`Mu?Zim*@M!J+2bGoPAVsJt~_u;!~u?EpZ4TW{nNN2-NEQ>_xW8;Ejuv8dA9HdXXkU9JtYNJbmccKRpN*5GJ-{3kD(X@9+B|?EDLD0~bL>>CPv0pABheTd+N>CIi3} zr|RWDEzo!AKR|9Sn6gw#@t52I=%3M;>4$a!1l!eJ-y;3MIe4YaE0Z}TWhfQkbs~G= zfglJ%IipQ-=J3IjhH}ytGQw6^E0su;9}XiIBEmNpO@8fnzYpjKS3nsfiDA1N1iNT4n8n_-6l24x#%L0E3Sf0AxUOx600m&YWvVE#p}G>zJ-MKkS+o@0li3w zD=IE+{706^w3%i~(#YW8L?4UZ45?FUD?0u$iS$l6Dg-_UNGPN%LZ2G43$J5~b4%^m zFn&WE0~hBY^3fNyr_urhCcm;tE{lQPNdyweT+lBL6ji^vC(LU>@bH?0Wy^)WDfe~b zL2q(Ww|KZpv14=CJCW&R1jFl&<%%kYXZ~NvmkIOn#+3sGB&yu=G&-i^3>W?+q4VoK z!jm6+&SUPZe}d;-++uNikYMm-Zr!+ z^g4d6UIJJJ0c1ZSkOli7nvh789&!t%128*2^%i9tX@}J5OjAP01x5&~6P(BvFH-J? zFJUTZFc^#%y@7MlHG@@`ISMLhVGVaK1xhrWZ{->W<2OviQA{gwjYnz*=M@tqSIFtW zoYaOn4GE~Xm}U~tiC&1>Pe1+S2kU3THQ@U3b!6e}ANqmtJ%D?Wuc2VqWE5)_u-mGB zD&?@BtV?QaYU{dmD5y~k7ZbNXDmGP#Oy6ja*nco3sDw6e%bWFaC9q`=B^w&D>ky!2 zjIRrD(ccDUWTwM?Eoer1`d}>5yFGXmB5CcLiH-ocNE#WXpdzI!Dx}_|Oc1`-P=wo} z`Y}UM3@tcE#QseL_zt}8t5M6xgn39SVW3Vq6r$db7}_`pfG1GX1_q^$NRhb}IPB0E zr+*qq1P2ZnAT}_`s}Uk6wd0g6@WLN#IfgipZueXE&b?Tf#x8C|W0> z58jDTc_-i50@+(D6t%tr)H^0n4bE?gXPdwPOQ&i)YomZ75*LE9mw9xFs;v0u)!-B2 zyeemfbK^D*Nj&(_cIzIAcR>=z1J!uJYUIg_|9ot(x#t}$)<7t%rJF;3>x1c^85#be z(b`W=TugZTp~z+}z$B{OY zc^#PyhEC5AY|ybeew?qzOB@n*2snP_a(oGPk*u=uej6V7JGdPEK${*Qk76;}@Dxh% zZvpRCc0mgZulcXKQ|JIiQjR40b9NgzAe`Rdaax5Sa9ei&WRDhnP*5!V-%R1-P3kc+ z10|FP=??ejxk|LsGpGSwito z=rUsEAhB$Lw#{mE^msOoH6nA94`5!r7Fh9Ml!NI=au^i+ctoUk2WUZ_H8{Kw&+!Ii zTK4$yremqA0cpeeP6e*kk3D2MrP4<_(|9)>zgUv!icmnM3Do6Fnf&G*wrZ|5kYgK7%P(E-Hl|c$P;dxyp%=uuUYUOkLVr&cxHa{ z0J^lim?c_5o`K}&gu2Pvt)B)B#P$~DJt>Dp z#u_Cvi(sujUpfKgGip^*!b|dK5}#8+N2!2K{ms1u`I8g~${GTW2*CiugYXSFni7PY zjy#+4d~Sq8H{3?a9>gT)zEtw#S|@(g&i0NuK>x$jWew z(5eG%6bV04B^JXREPQg+qkG#-mq}iW6q^VSQ{CRL1qNGcsi_a(8mgKJcn3=T4w&6i z9+?8fU&57%okW20Qp+bhAXzLT?E}zThiyR@2mF%xL5g3cP7p9g5VTVK!|QFK#f-${ z2b?aB?T@o5p{CYCQoDOL;gR^1OUyo4g{AqKTt*+NmN=8ljFdJ*xtN(PnLcl|A8Qes?`MZ zFdgwI(6Gk$^!*rsM@!F}LI*i9lFI;P96;Bgr!GZ=;#x^!4-rin^7%U-FH%{B7nr~C zSqrvW$-B^9h#kW8@+E8x)Z+m9Rk&NlB(pU0;;lt@fEC zfdmz9hlqukYTyeJEf+QWp+dRwr%>Vfy$kY_?f@GL)BWP`F8TlgC~ZPIjL$q^U=T-& zHMm!oLt0J%NBwFva1+f+*NxQ+$rX`A4KDaC<(Zr$K(n%Z%+YQTcpY(S_QPo82w`*N zp$Ll^av8hHVCUuwR3?4FuTh|9-X;Ixt(lJ6KanREKCt#Y&sOzeKCQRp4|4@MCbT*p?743mWq*p{qSvUC6pX(wk5&55lL3hB)eX+HYj_MuEhk>BjW4O zxjcrqr(ytKvqZc~wMTN?U#*5)Y$6v=qJ0R4pedA0fE2s;FU&V+g57W|{NoOpNiWLU z2p(nE*MXCuAk~7hM14)tp??xQ7$!8ueZdvOynQk)T4AnT6Xbu1tzeW^{ zSt3v5F?Ys|95GEHKBC}>3jY^a|A3W56c8#f;+SLRNb+4kD(bca#glwH1D!fk$XJ2K zB%%*tg5@n;dvQKoZfWL|%H7Sok;PE&g6xbis#q=UTjXsbgJG z0du;E{s{rgfXK`dJ00O>Qx_-vGs+g!u4`cWMusHh-$tHhaKlu1un4VR9LD74>ImYN zEt+wyv=QPH68dq3HDk{oz!^qmEorxg+v3XM_-9QlUb2Kil~33*hG@_kJOqe3H`7dP z8E%dWYQ`Qa9bfr> zZKM;Jk1HyHy8M>E|9S~`eJPl_A*l=nr~)KXhpxXLE%&zH*T>!vzUM{*)L;_rXmxs3tM?S zY$>*n^TnMOdWf}jkdf=j@P|Uza7rqmZ^ut29GV(B1R#0rMQ82t-jL8(vBP2PJsw91p3wW@0nq_52vYK4O^ zxz~!YS^c>5-I&>34wLE!0Ey0-PtsPJPcb$(6ct=m=_q#IbbM3}(F46dG8`s zlZ`C^cja#;dKD+6Z7yDLJ<9vbsN8w^kkU);Df*Mg#`gPJQ>RTv!AFCp-tx~`_G#Y$ zfk#U#og&XqSe-~M^UbPVL1gPdkb_l4xXHuO;Q8)*aB2a_W5;B=-ku6$)uW3qLl}oM zw6a408`JJmR_!~4ulh47UK7TQj|zc4Q1=$p52H_l=N#62k zFAPuqW(wQh3oH{9d$MW=S z+b^q3Ugx>MIvZ&jgAn;|w@AK;F2j8fTTrXwzWffA(8h$txvxy7mH%1KSIA;abYo2JrO3sXC&UdP@SbGbow@Zr05YNmz%k9# z4-gHmCb#r6xmCsK3!_1feC_GhShRSd7!TxX5b@aY3k*!G`R~u$NN(k;{`HafUcdAD11F!66fYsdQ22_9bM`Uh! zJiVM-9*yq~KJXWP>zDx_;838@+C+?3U5x~T1X1a8*Xf?jB6&T?2Plk42j=>7Z*D~s zt}8Ddnu+>TiDPFku&g#I0-_+sFupFrB6=FHgOgXI%SlBlwmT%Qzkr_^rQk(fAmThA z$Hwjj&fsYUrO$h86z~Uaal~e`X$mh*He-BzvLBb3ugjM6@$o^=6lyILP$2)H0Ae`` zPgv*r)*r`*(pg6O2q=Gvj)7VYg%~z{3o@aP4OVC2s+3)L+A87C+oGwVF^}nroVk^U z`Smw4OTw%<%d{?Y<99d9HxBt>t0In2$#C5uiaeRe&?E;JDlspmT?K8L=!hUkCDe;% z{Wb0#*TyU{vv4Pwt83}%^77obO6y>CaAYRXymJNjtEOHeq=u#^;3Qmw=Zx|cH$kNO zIl1!U#%D7{goR<7i>HTjzmmn!bJl}pFw3$Ea1YGNrImmmQyu9c$2m&|W=N)hju8Lq z!t)RT!Nj>UFX0RUPI)g}wKuS30h`TdS8)s>i$Xo62w+^dVF~#99dSF9-2zwBzKRo` zf`>;S$)MO6zX5KwCg7X3zQ6Cr=^E##L0d=&Ga~x~WN!*8fu494GrDYhPYB47a~z(| zrs{4!C!4Z4Um7v!LUQ)126IgJQ~S!dMpU#MBGh@U;^0k{=wSJdHXUlRXt&>^F`9xf zK}9y0K9m%94 z{23J%hzWwo^#Hw-5daQaOj(gsjAPT2^SY!H&W2nZ7Ki`Wp`Q4PseEExl-${b&n zkRs%O?Zansc`^pTG2z4fTQc+_eHM@&%o*4|`XviUA-*Ce-;gU?kaLeBUC)A< zEvOU9Kxly$iWtH47y?P5(SU?fEWJJK3-|^jWIwT>*21eAZojH8q z&EOc=)BQJ|5LfW*n1f06+;C0y_=(?-5Z)@xM5k!LcQ9S@InF-0L|NBw}N zjXpW&1M;GEiP8ksCM0alfCh*gb}{c>47c z=}+gT;)L!)`q_r$!|;VR%`5&`QVTfJP3Ht=iO>!`>d!t!pTs2GrxmG{T5hBNAf6 ziI4Ue3@;x72a3Y!MSgKO2l`-0xr_1&q#HVc>@)Ev=AWL;}5?K4#sb-&^oyQ45zbHURDM<`L z7$j~G!VJiA5g(Rx@q;oz+%(FvlYnKrqx~02&>FrJG6F*B`e4FHeQ4^gqsL1=cY(~_LSPC@=J#7;lB*REHqRD#=w1wgt&VVFUfaG?8a7Oc6P&Wf9 zZJS;*2uR&d=MYz5I%NvGd}aEk$6NcG08XLkB#Aw%;j1uTWU z1<0WQn-xzQZKh(ZO-Nj6Um9Ka8DCF0MEq z`VooH{ag>pDQPh>|qp=KwLo|Y0X_sL9BX`yfoOpkayS74+W|-K})&eJoJJ^I!6MO_tM1W#I zpJFn!_Y|+|3Ouk^f0xAAa)|M%D*;s4tK`dgvVGe-6=rsJc3$`J2-jL?Xk%k@hTZ$&<<>-4)O>`sET&q!0+hOe zh$fB4qHJ$JSa07Q%Hy&IM6o6O{Dte|o_gKZcU-F&kDEqgz*E4k6x+PnE11(40ZS`Y zaB5yWZ9CHS29{wnGr2iaL3FX}?)1YVP3Q=z#vIK1^yw%-9Gl!DYxGg3=Kd-m?_Mb}^}u0sc7PV2kmYTgFQ zNJ6!kFH_y^;S3kn0;lTUpc1pB!_2XM2P{ml*O#h1UD{9RB$*w+;Ag+OY|kddXvHMm ze7&0CvfT0Ivd&UyJ863G%LUce)op}Qa%?5NwaDpK^7&LZ&eq) zneD(yigStilJ4o@VFVVs0}hkTva&&dcIvSz3lO2Kfwve#xcmWX^o*WcarFprLEDV^ zkvc7tbKOP{sTY}h13Zl)4@P;1@hIJYf1N2apG}0SAvo|m9`yJsRUBOV>*1k~O|rK^ z-alCwv^}!aOwkL_=9!++kplY+Z~W(a;Nsq%4bs84lrgn4;WpE`6jbi;Tn2}H3(ZdD60lYZ5lcv zkPBtKH7K$5z>f22kKmaE^j+^^u~>LZHI9AiwOLPrcJ9>G(@TJv)G}!slh^m&!1nbG z-Ywy5_h-5}0L`2iis}boCFD!_&OkC&0EpIaQLwF%Okq^1S*=sB)FPn`M^eSHYy(e= zh~mEEZ0xDuI)dliNGa$0vs%>I>P5+XrYAxAOnpv$6HT2Ga%Y;)uW9?>SRI^Oc7 zaG2$_Hr}2xCBQ2LFMl>vZ!`T;F()Ui<`qEPKp2@`n}C$Q@XAE}wv%`N4kAW_zgJ$S z!#}~_Jy%}cWjJTrlyeFDBemWjf40KEU`5P|aGG5m?(PjhUQP6WnsTaa@scH` z`Xr-mihlg~ae~+y>};)dw;D_7O{Y9F4@pXrxUZq8{>i?)y1M%5Rns>OXL^63zdKj% zUc6+%zBfcBo-$>@ygxsD=YJtd$6JF%AoP1h{vCH4H`BndaB2;k=~w>i19kwj~F`D|X_&*@8|wZb`<(>wE><;EHu zFGiR8jjIkAJ=%7s+9K!Z{cgXWm+M=ZZstk4>vpA!CG%DWJ`egZz;^0!b^Jl|uA$u0 z%j+Vf!tWXdr4@UcX1!fhkZQ>qEIr$=m>tx|Nj>4`+PN=CD8DH`QjUaC=frBSe}8Fj zX4P%aI16RH7N(H>$Dr6`i$Y^v-7_5q9w)1WMiMqKmT;<#-&eo)vh~!8Z_G+oV~nQk zP3Vw|$xCt*G2d{=|B9r&VeO!-m#>>%JZBc$>*LMXrCtol#Cr{C!a9T9rtIY7~NSep$2L#^d8LC>|!l8qY@cUN`X_ffj< zlMxgh%o*#C&U4y3?lR1>F>Z*}(_D9J^NrZ{YOlUIF=`q5N|7c0f#tR;Bg>rc9I=6VQ_jMKa*C_tC?_Uiz2<_F+ z9o?lU>uO#m^5O24@mGUh0_^1s8Ot**04D5jkPg zr>5z>-rafDIv(OyGm34DcSri9*-MCyceGcR+#E<+y42n&*jaL*{zy#&$71ordu^2i zHu+D&(vJ1S_FuEjx4%7T^eA5DH+PxW#%$*1vDofN!}MLZ+C{olV>Syf7Er7#wma%H z_PIZu9WTZ(Ra-5(kf-Br_viAs{6JITB%`+TjX&FF751rcm|Z_HhMpUYt!UF0$uHR3 znwMtpQ_QKp*L7EO^gxHsZB{L#McH0jCVb$QKo=v^`L%1MZ-01PSi;=dO5Sm8>7l|p z?+=Vus}2XP4sh;-8r^s#Uon0y+fH!2zBO|0?EJQaPy2t5Hdn5c-PG~4b;-W_o9|TX zcx+#5{PkI1Sb$NUU!tMmaJZ-bod)Y5>B|`w>{}bGWVqG={uMGG8<|$ejo0;x3{62El?m9&g=UpOc&8apA9!7eU#*bS$ zCT!qoDB=?y@*dw5#ORW{*-^txG#xSZ;8$t5AdzAm?b}+tx7exwyS458!1eYahsJ`n4PFLU?_}wPL4TdUgZ*syen?8&tKZ2`f4sY>f3$ znz}^asfS~HU1|;XNdJ;{MUGwdi$r55rI^6Gr*qG;4&8m-m60GOBPyqTdClA7zdVhu z4*FSAZ9}`7HhaLvQdRa;(c4VHRfU7ACF61iN)fYNOh*Pv)?DDIu?$D9yLI=ku-4vd zz-f4qQtVq;B4aaB?^?;O6#KY%>&8zCppGoMXUwm?S97&pFt`iT%j=Ae`dTkucN~uyt)!Us$5m6FCEuYRebe za(CpOJ`oh|Ei+_KYkS|{q}X%b;v>iVqjmm3A18NsbWeFu!6s1y-+IxY+%G48U0it9 zw9Lu0_PU9cxmtGPa8=Eba+aZkn*G7{L&bg9hh}INmc`Ac#Vj}Ux#YnG?*Ut7FQ0^@ z6PjZM-8W0R4h26RH(fQy%cg5_f!tVFeZ*~n2EP9L-i0sYW{2DNR(tQ=T($X5EHc#U zd;PC&4nK&tF3Mluy3#1y&ooS?Ou)S`a@)3EZ=H%BgJOeN!+ek7-Qyim5qrF%b4!ea z^nTEcjL97+E3oi0l$(#U>|;<`_^azTXOBm7m{l@wiuH%u`V70)?l}^0rYh%Dt5a9O zK;zss#UAOR?)$|I_H~Nf(irB+}CYqA#bwyD;o>=fL^;`Taj8Y;MRMq>}km z_|qSD96Q44JCW!0RA#B%qs_OD==J8?G;o;ZH-oF~4jkmLhr_NLiLo~3vc|pB>#SP` zi!!yMJf#%sx)qBP-;SPs(_h|DrPy<2mS)$J(kS$wLk1XTTaIy(@Cm7ts`Rh)q8SjnRh-)Fy>rr9BUu7G;qAK zPA4JEr_4jeU0blB_GH6P{nxxlw3EkPFRISVVz|$plCEQ4^|J1gYLcb><%G>`mWtai zZn%4OR)4U+=k_j(ycbiQ+D;$qt)4BaBkM3{aJyK*K&ks)v#Lj%?+#QvxZCP!y6)Bw zn*(Ys%z5t;-}_W*`sy9EWx@?wQ8GPu-I5!E3K@#=(s{Qxy!8|1Y%9$w)f$xbE3D6G zUmkVx3oBAs?eLBI$ihZeX2y!(hX*ys(h8P+%@eI>jchT>Q;StnOY&>oWq#&Un|;#& zbIfGGvqN>Jhve@s-pXA7}m(BEEHC=Xp<^!aEM#WFZJEOlkzAwGA>)6E_^Cah#XpL=Fg5#N*}4e`GX|S z$tK&SZN~)liXFPbM^6{3AKa4RoxzIHIoKtbb_Euyp5}f;QfjLVCq1DU!c6Xu5Q14okDP?3rTm_RW#0Etc0^A9N)+RE67A zrzCVQPxZ3054So#=aQb0%)rk}6i(=0sT`hN^WpC71FgOG`}C5#Qv;XWS-9EgPC#*3 z##m%LJ;i4&8kovj6y^HkUgY`cdTT_LYD8-JXTkFC;Zpghn|twMe6cq7 z5bi(xCsjety|>)II^`i1=)HMdb;mIaiw)X`Pw(zEZo?J6%^P`t~nG|v6EYLSU= zdTHWHri9!GnfMR?cLmMA-{gNU^8S5K{(VpWJ7B=S*U7)v$^XMTc{e`&!X=H=&0qEo Q(F#)Bt@>;1&Z8Ip7g4fIOaK4? literal 0 HcmV?d00001 diff --git a/Workbooks/Images/Preview/HoneyForgeWhite.png b/Workbooks/Images/Preview/HoneyForgeWhite.png new file mode 100755 index 0000000000000000000000000000000000000000..3248bf9dcbae09e81090bcc09aeb6274721e15a2 GIT binary patch literal 66137 zcmbrmXH-;K*DY)}Mi6L4MG&EBK$3uxGb$<>1d5zQB4_63$mL}3tDQJ; zTH?eB5}UK9;gu7sR;KXxAI@qr_f8aa&@I9bC(Z9F-92%lD4gub_!Rtn&Ouhk`NRo| zM&!Rgn(VWmo;X3wkh^~ui`0{;Yz9W72#ks%I)9w|jUAlkgkEql&%&UKv zFrPzG*Zwr#9n*McrjxOxdxvCayqxVL=SMcS?g!_d|NZAh*&FEt?7PP%q$yU z)FrD#jtaWliSUVZipg9iuFDDeBSct$!g^x9ZNiV z5iehU-OE%hprdY&#IG$}es=txvmM&1}nA z5TwQ^sV3F13Use^y5)#>6byd;lRm3;x}$49KQt=KCIfeL=bANowot|s8$g*?t8x)5akyPs3 zF~fPD9z#V{>O;}kMisS}LUQ9r4|I(jLO4iCd#laQ_#Rsoi-y}w`dCA-koU-CvZozU zDOnPd4t&K*15Dgs%xfvPh}<=$vVZ6O%_76zNq!B_8-i8q`!E#}$9HFgB3K-anu_eu zWi&rJX?>7d-N=pBW*cLv}!@3iOLd{eid=EICX5&^=*7x%hHNL z?xrzot2Hf$o@a$_jo6)}q50fYQOzLld_x~O+TJJi#5hm6mPA48pKCcw@1L~Zs_PGB zH*g94ZaKBqA}aJP(%5F8jXiPJ;4q)pEe7MCtjTz|`Jz9XTy3g%j`mg~V{jue$z2IG zm)hm)+PX-W^|JbV^U(|$z7m7g?<+!E2k*p~ExhQ}t~_7i)?3Yxh;c~D7o(?1HK06t zfW0I-BTM>YEAfo^Twff)p9?>{O6)ZcOJ}O-_rIFe!yewm)ZT@VX#hb87_JBns{kwsdB3*m0?Jv%2Y9~-jtQ~ ze>{AS+T7tgV4il56SvH+5>9l|j4fsrE5*NLj}vu`%T!9tZ(lvkt(N>5V^pEpRKmfM zh4OVPFD|dix33z{w%&e|shF6Vqi$~PkGu{CcF$d4t@mx* zyEsg5WHV_$)6{##@Tc;a#Eddb#&CIW$u+#k;B5K z*>!!jc4m#N0@Wi;xgtS!M&9*z=_q!C5W~uc1wE{Cu4n$CKFg~#;f+Owaf^;+DuvQV zCTUX}W*XEes~i=Te6Q2W!(O>6Z!03}`7q8)$RH~+@~JDmh+*hI9lL`MO!)1O%Xp2} zRjeiN@R^EzEjs)|%TvGZN%<^$)uM0|o`FTBjMJvXxW2ZhI)3w8Z!&JSkmnduZAGN@rvO8q?c*>A1o%Omc$v&W?x}>cBWmO|5F_ zN-X2Rk9Myo24O$W95-zg_*Qw0>Ay7)SI)AFn~aa{9-{7LQzFszb8;}^HcWTqWmz34 zph;n{W#!~^&Fz0fnmG54U!j^zz0bbwZrb=BbZSdl~bC(j5x*akXmdiJSoEi@tr*I6p@F>db@5 z9~7;h9*1F5>s&%QlsZtMw}Z}`#E;Y5YSW5w+0wO@(C@2k&n%AOv5LGHm93+DFiUuK zDgiy06Kaw+9?xajQGGBf{^0m~tC1YnVhjEt-Z!l34Z2s{$+vzOrBUFmNpdW~p0qIf zFxL2R?NR84R2~IycEIOGJp)dadJT>aAA_&~GkU@Gcg*qm_i$kXK2dJ$?E(%vRHBDp zvD+PYh>i(cb#-j{{&6cojE$LvpO?;Tc%{FHUUD)v!Y}<)mmranILz^%j}E~P`{XxK zwxnnWt0zl}KZr;k#EwU>S}Wo#L=u%R3oT-AN38XKeeK_0X}KtG%jH|{6UAFxEr+f$ z73vOptCmHPANkX{=7w@Y_G>C)o*jFRy!~|a=zA<);*G_FTJHc_iQ9%PJmZ)dYCDb1 z(6lJDcOdV$uWk|6;O6uSrG~Imf&RGkNe1ZFX;mC7EIK&;*woEpfjW7AIp=|>oV-%h z9G5v;k*fD%N`S7mM;uO<&O6}r0@WDr+@Fc7!b$^?(FX(D<@VZ&_md!`uW!(93A204QRRqT%Tm>=0e zn0wcqgv~4;wOwMFs5PRFiLu;GEkZLly1nxD{&8=WduvRAB(C()RuS5U>v*?3J;6_O z88X}Z6HA$OR#mG+anr%C80lgKGXnhsAuCSzc18|wCG3-qtF!e);>}JH@K4zG{g~6O zFN?b8BCik*6^pN#9_$UN))_e+^m`kzzZJ9S#c)~quhMhTQhD5+?rK_lC7hnVA96T= zi#(dUlTqgv`UE}0`H6|lLmKVI#<6zNQykxRUJet@Pe@gdBF6IYe)7a?i56{9y$^j* z*mCRq5DWYKpNUJyvOI4#$N1v-WN|jud72kYv$9R&wq{=gB`?((!a5A&& z1x?}ZT{#kem(JRoqlE5=os%l>>Ch-n%P4h7>)kTUCm$N?8u*!zagcha*gCQ*-Q{OH z-iwNcoSsU~$xOaDctvHw+b;W6nb?f1pAnV4pG?;HDy3us;q&yGI=-Ww3h!5(W=L6S zBptZ>$L}=!d^_u5w~l*mYNZlp{NoIfD}tkqrCQ19vV52V%4^(HO-W}a?(S=J`IYD# z$52NC=2o(m+_Wx#f0ApIn&OlD98X%!LeUqJKk_&qU&iNH$}3ps+;vWU%J=3SX|%M~ zty5P6hVRP-U8r*@Q*YJbzhiDj-kaX778R}BU&+qC+Dv2E9!ZO;I`dh#pDHvD%oFue ziN`pJ+Qac`Mk!*?W_ZkEeXbivN`uSakP1J`KLB@?cLjsXk*WoviK;Zn;uLEE@YWpBmM5cOFLhqIW* zTLw->+esmWgQ^gxE4gguDLA70D0j)+tsQM-Rw@Vov zV$$s1@wvag=UzS>){%F~Y>mHqz0&FI#BGNkH0f7bB1#u~9d-B2!)wfDYHj7?vdYxs z7ZNW`)NX&B7ib-vHTuV+lO|Y#yI#04v+C{Ee=rt#qI=Ki9sKkC6#z(#M8~yGh-Pe9A1E&K!)*(qEB$5XGnq4D6yKOSyga zyE;im2E5o;CySJa@Ak(Pf#|m94G)76sUPg+YSd*{=Gfy<%SNoWH$ay(BF|T0j$koY&yDKLLANW_}t(j{X^Rk@cjWlRX zMEv5m-B@3(ce6@GPgK-j`Mv2lY!P4XQGUF_y&HmVY-t|Yx+vzv40V;rnk0({-&VR~ z^t$^ts%$)kuxRF0_M1Jg=Z(_8H$+WmFwlDJ4gI+PpuSg2PA^I8`w#U<5$EUK6F!f| zQ*ha(dx`=E6`C)(l28Yta<|`GxA`CWO5M%O(Hv@zs&|fNwjBM~6GfYSmN2cGZ%h2> zG(E6zJcKq|RWsJ*F<|J|VRA6OPVk}-)UU4$MH>xb@&t+0SMJl(sH@3%zA=#ZEKcJk zI+r{lm5Tbs++&da)x3&r%A168!dW7LK+hd)8rMA-ZKYqVVkC#2Tg;0{4{2^Qo0|%2 zyYLEK>RbKfVtgB*EZob#!=FACh{?4GPW|O``4{;)R6!^0;5{DN0n1hW#kuE^2eV(M z=zjU`hmG7Mw~@Tdkdsp^ZBArU&dE#^pBHD=itU-GY-D8dP5)q?$$5~Vh4T4s$!n!> z{PMnDrFC7zm|^{ock0~{27P|e)X2_V%Jl6|YEzjwjz_wk%YhB8yCaw{#SyM8sa+-Sv+on@ zAG#{{Z;ixZ@Y*>T)vb4?%q^VQIZNApQHcvRVb`53f=+YaL}7ER1%y1X3eE#68rU!H z{Ex$!U!KvIVZQ2fvpZ)X8S|h?dy?@U|Hz`{M3I} zH)Ezx?zXAgJ(VZ}$Lb%&(i%phGY+E&3~jB+yeYgbJM{55F0%VU#a;|%d;n!44}?ZH z(|C@|>h=Po1b_BR!<)hb6HjVUrruXLWejP`yEK24uhU-%$O#z#J4ngRKi5;Pc*us7 zuoTHpxR+?>lak>~QT{pRq2*Y4M6c^HExB!cI(@*DO6!ird-rDqs?n^D;fhp6*A298 zRO{S?Lrr4}4apMj&?r0|E!50@*IH>Yw|{AuRGC_75aZib`dZ;c#|y$44(?)*Q3AR5t8Bq$UtY)Ec7ocviu)?xD8aD!mqH+#PCQ*Ebk^ zC8tH8&eDYL5H%-7=x*0tUip~Wu`3|`+Q}laN>SHwy(TKk(x5=9S#%VCgqK@7n!2}2 zTC-Nx?a$+L$LXug%Jl9nTeWQ)mU+X1LADmfbtScgONU;R-}nI@EkvKNqG-mZ|>o;j<**Q0wpAs6~wP~nDhATfDWNEM* z#^X|#oaZj}J*-YAm8<1eAM2pLe3@F0XWLP}RU)^x&T!tl@MWXaQBU4(-8;vF6L0JH zMSN$jF7de6=$04A*R>so>#BFDN3`u)ICdzKCtOgIRFcq$Ut3F64PZQTd@o$%SGxhf zsp<6OqsOME%iHPpDS^py9)6u4GX4spiN8?< zQCtU?#h@1u%uGWO%(Ut7J3CL%iPb2}`K!4SLuUkQyX%M?vw^IpH}-W!+WJwv4|7+- zQZS)!-=k7qWGQPr$&sF8)aw#@^v9w@^OQ^L{*3Ob-A1bJd12ufsK?rIUYA!X{PT4k z=v*hebbl+VSPnr`-PbiEAW28|ymGu6XNZ zQqK@H!0u_@?3ppM_c1MDESi0_x=o{dyPbjFgTIsql*fsZ8;Ucx$511+ zzO3<5QPzT4<~gHErTVurbY%92LHWLKVm{KEm5Cf&a*=Hp7{tfV#6)4|(M)sAoiCXy z6V$$|J5fj~@RGOGYQ4t2QAcIPXz03z#1-i0`Ub{eRM(82wmIxQe|Gx%oMg6;$Tq#O z2YGN36%j49=0#u}NJI3^haHlKy$kvNZEs$OEKp3LRXtyZ*juIciugY&ZIlx4X53qA zeDvB$n8UXzGr+r=Ksd8j$t2D#^JO}6D(>SKy$-F`H)NOMnc2B#B>586-lvz0N0m&= zIEg!Vrr@NBb#yi6f6mtiY&K3kdLmmn+?t@;{se&l<@GS9jw!SzpETFPPexJYP?GD-cJ^1jc4VHcFM)ak=n zZM2(${`wyXG{CO0FCAuPqA|d%`B2fiPtcOXUO$f+d%j|1ptrBEO?+L71?!<*z9)_P zlRl(}-F(e!)pj2pXRvJ{YuanCpQ!#Yz5+G4d0XIM{a)0#U)tyhy>M!9Gy~NS(aPM^ zzEl}%0gMwTV@p0M3wu>}j#EX>Ug`G`3>&IaPrg~UCxDz2?`f+an9_8+aW+z(l3>N$ z`Dp4^1#P`^3h8M&xk*R5E#Zv4Y7I|6cTd{v848X=l$=6lYmx(bE~Yc_RGLd z%`e47^)KHk153{1HOIbDW^ca`koW%;Cat;0Ffgi2Gdr!})pRS?njW>(#1s6(hFPVP z8Z}y`n?tP8FKVIiq@;0bb#jE$^L?caGwx=>Kq4&iUc*_lrya96|5t0j{>o zxR06Uy|kfD)MBL7thb-cStdDNlVfSaDWQO_{|Gg3SM4wFgXlHaW_}OKkf-=b|JPvf z{WF&Th7|G(g}=9v|NZ`ozO(QjjtM{A{QuwW&y+L&z2rpU$^Rk}c;WH6f42Zbu8aRK z4|qQ1ApE2GwUkg+4~>W%6jrBh?Ds_%4kjk1y~6;KGhgPG*;efr9M9R*r&vnefAHX? zm6cVxbRJQ?;y?HZ7QoZK=+Zj9(acZDU`dBhqK6C$mm++UmzRGUm#Ns(8z*2*d;Xpu zIlRu`x0ezU67pQCtgI|f(zhzfpWx{!POp?Kc`UPP@99~Ypllwv48p$e_D>m1K|w!P z#pp$SyMyh;O%HJ|!v6d+4;wXj=HtaV!(%`t6@7PxxLqt@`-*RL;ZC-~bLj^qBgef##NS1mf7hR>{d(PgRO z3`3+}=IX!xcep8vNeN~yvmMbyZ!hIymo}Oh28@UYTKJVAb&6nV`tU46l^2c2y}i9J z@~81$vo4|<8X6g`t*u^dV#jx-XG%YBKXP<*9IkZEqW508Jv%pNb$o#5J zUA}IaJiMWSv1qu$9{cOp6E4FVZ2`2CapT6r>89|3 zUuLb-vZ7&tLrry9aMz z>?i7~4%ey!d)8{Ul)p7KwV9RVI8J}36>&-@K;Yyk#Bd)RAu`_6b7<;_d+jZj`^_k#jPL=v`;-1Ap6xT84$-bIdiEeR%_TzaYcGXJ6U4LSh z_gbY)wL7lgGAl8&iNRlgKFPa)myb`tVe*a!3T3gsIcwFQ7Yi1aU}0gozUdko62k9y zL=&!4on9zR>FTINpl`1P8W&+JXz!4fBzcHx~M`{t}Z-U6L zW%AVR-9yi8c({zY4lKT;HUw`Zn*I2YvehA`0wD~+#HCx>_38o>*pmUVOVws8=kh7u zf9*}D5@xl)=)dkb;k&!|gRiqULPavC+;(JXDwv`FHEU9~bBBlw4Gm2dk#Jb%vGJtL ze!|eMLN6yLhxfcRgYWixLyxJKk5z(iD8*SU_va(kqWL`&9`2OwPb7%0miD-G%duMi zOnm_39*m*aB1`T5T)e!ZVy}*QB1^?cepQvI@6krn!CEzL=@fm4M`jc8c!Fp-RBYNX z*)YA4?T#CVF;q`7VVl)!Q^+_{E*htfkCFgN!X;F<#(!{9;yeD}Vdx@N@rKuPGvp-s@!0 zdx+u~ySjZdWN%hKQ(pp7vw`%t9w;!VTK_`Um#xYqVAU(z9w(sg=T|p_O`yDWUK*C^ zb+DM_`t7pT!UT~}!Cg6Xv3BG8wWZ#ih#EsICO0>*?aaxb5YknNpYOWNy=u0*6)=!@ z@%9xX8c;8$8iUX53W$j4czSwY@xLrVQ&ZEHW&A_ChZz|eXqQ3rsDJ(b_|!!5>7)Db zvgq-4kAU}%jZ&hh26v1?iCKI1=4_j5r^GH2HNT6{bul-K?S-ElY;2EgZ1QRh?Qi{c z>pV2}Qp+9`v>lQ&6bsO#`m1quxq9}s8dNtFyLMJbkm6Un_bU`iO%)__nZ?h4hHT0U zS08{J0ilsAB(+`z{-hPMOEC0a6>weZmE+XR>xyJoM{ep*Je)vMR>Qy`KP%Z!H}ndZ znx7f35XwIu`H^h2+Wx^ z2WsYkT%!8dqb=zy_{#nCNjt=2wR!c-*Kgn0B_$<4g)y@*Gry3SPD>eho6z4?PRYv6 ztqctj?SC8+LfQviebxES%+57Y!GHaAGz?fooL*&cEBBgHuk^nWed1a2FInmEG|8IF z|6ci-=YNO%UKp*!(oYC={JX6a!d2%RUnRKc3wN7)(c!xqZ=J8y=LR3)#%PeceYV$g zadDYphHsA)A)iO>DpJ$Z!mAGsO#azEdy+oLI9oOCVMu7`;rR7GkvAL(4%rB<4wosY zLfn?X3+q&#wT2L5IjO1lxMP+-kx7QV?rNOgkVVr9Sf%gnc~p+AH9tV!dg9$tN>h@A z_rfY5Sck|@`rMEyxivNVfT`T7C7j-y^aCQ6!QY(=GHzbRb8vHqef}3MJu^~uaVZ7x z^E7VG@z5q5w-x$=ej=vk_kH27XK9^w6;xhFS5N*Iu%9?V=MDRTKP-XaX;-|O8UCkx zKQjr{SjL50{eM7uU4ilc6k+cvVY0IkG%@q^#NJP6$|zOU3nKg3xdjE9kcsf>i4&7T zEdUP8X1*o|8eau83Ynk|6<`MM#YBBhT~`-V>%Dv0zq7SfO;=ZUkXN|IX!EKjbX@2c z=yXBbVK#`AkqY}5<}&L6?kAQfk7(!F`1sV(C~fVlg7ttkp);M24>Age9s^#WpcDQ` zab47+Et*RPf3U}R4~w*{U%!4$)_nRTEMPl~+Su4IUY_jQ+}!+!m0e6s%&FTrDl(Ey zO3Fw_N2j&3lQMo+udaegDj2SagjNHE=;6)9c=twfAvPW!l?M+VguH(JT7Tx%r!hMK z9%nd3s4iaY#c1RSR%IL}>}?tO{B zs$jelBsWBW%gjx%?~&qfK$p1URtiq=GR?lMZ@*}{xdTZ>C)F5(P(t@1OH-3N(7(+)EO=^36A5p zOs%OAM^G(zj#N{WaTMzq2KjkIB`HrX;s#XQ(_}B<3Mf2LR|1;Og2kagSgeg!V)F7( zhK5NHtNbntT})MyZmYwtgT17Fwl3pa`IWfz$`z4*3y69KV{r%G z21Wh(ZtBQtKfoKHLKJu!Ej6{&<$`Kuh%N*c;a4jr;LWEwC*S~M0)wwT2z94+H#|yw z4|fVXQ(#G}W7S$J68K1P40XAUj!rDn=-Ly-wA@D>n=Xu*lRH+Aaj>)h9I>zG>fsOE z{aP{Mcdc^4zO~NxaJyGs#S&mLx#39g#ZLr?2Y%Dm$Vt~#ycd3NI$X#@iY`ZbOyx6W z5qK7%9B^%Gd%Fez22xVe?a4q&WLE$H5l}r^>Fm0kUjYWW=|n{ik5n}@9KR6tfZR9v zsF8v25upGG{i||YJqVPFkd|7`Qi{I;^s=&<(a|1?#H6+hc(b{!tp_N?_H2xi)#T@Z zhD8SdqoUN*)ZSWecPKokh<}|eEjTz>#+Dg3o;L8DjY8M=)ucaO9*B#JdmK9R{q40} zs9_DZdP>qww>UW!f{c5Yb^aRS_yqWwgOig?Ofx`!@L7MpUT$eA|EC|9we(Xwx8_== z94s21pQ63}{K%@?>QD)*a6LR58ui)n5-mf|j4L;_ zKLSnBwjC+&gNR6j0a=&p{J*(ajkEzJs$e4@Sayd|3Cm~iwVBwBu7xE=<-d3It>jC;dL{GP=col>cQm@0Wh21(TAI;UNMsCQV^p$M^w(r_Jx0`=0BTS!LMQ9}5nWaQ#IZMlYco z!K%_Pu{)Xu9uc-lL{_KmB%}q53Gm6m;RLY&va30!EV9|eA}$jlaKLC|Gjp(Y2lCQE=T-0C4S>6`^zcU| zCu1X&Mdh~UJ1OaNH>R7GfxnT{;~*5-B_s^UuG|ELq6nH~WJCm0cvD&wr`8hW=>SWN ze(J)4#kcR@tpF%Hi6%lOL6zvm4;W$L8lxZ{ta(@{`}8Gf5JYp;OB>x zuFIN$G=H6`P!pp^dgI@cl7`U8yl}Oo_U9^;ntnu|5xKHBQcl@6w8 zGVOe3q+n*231&rbKB5oI%)Ce}LCQMNQ`L38wc6eB9z=ww7~z8b%Fuhx6y{rL&;&2k;y6-v zhk@pm`5wAK(17dk3qPgFsJYMAjgPrcr&*v)NMU42;f(%cxEtR@eiz z`+{Z*+0j+Nt&m_!ar{34zamwN6AC{lR$59*Z^u2R$$fXn+^bfK+Ym^#<68g$i*S3S z`~AiVzPpLhJVuB+6=Gv!t3VmqUPueK0;b&1IRl}Bs67pb1cV|2m>Aq`0X~{<6cUVs4?cOkM0CPt{v< z8&sj%uBu-l zoZEoI5X=dst;|IwJSc1mkN^}+HY6lKK>_TyG=NS1H9cKsHzrC>%P$LB3nF82*B@<8 z79rb2nC)vS)+M+TD(&H0ezPA}Auc$%xRfGpD0M>{$$0VNLg$~%_aFuKBX>wYG_(RYDbjd9)R)Ys4>q8dJ*D0>j%cnql|U=c6;QU;WCRiRObK!~pb zGVV`*YisTR=*cW)|~R?5$3P~@6`RV4C! z#1V+^L7x1L^Eo)=AuoEtH`m=p6%-Vpsr-c$8<4@gAZGgjT8z2$C@pnogd#E=RQm10 zSw$!$AQ}Yi8{asaM8Vk$?ca3aAsKoG99|=yJM#SyNM!LsV23(F#HE37pM? z`Qk*K?_~xC2AjxV8y?$GxfT)G2ly6u)xtlCeg}&H)k*zs82KOLf$5^w>*@&y%L0zS zz82yl0&Is?-9Qx%8Y77@^vXd7458drvhHK9F+i`QK)(P*1JPR!rWuIYgyX|yXp1rJ zZtE(I0G16vt!${TSC+t|ls??L3x$o$?~KUw8@^H~(}?(1b+D8h9=drJN+LczQQT8!ZX85!%rLSy603_5u0zMnIVl78e(*Ka7jv?by4R-~%e;5(K;)`dhu&XqKY<9Bh*YyQURw<<6yYyR&}p@x$+Hjx zspdPAu`oU20K5Rdt2~LM4Bj@WLpzZ5E^?&A~u#^2W2}mxPqmL9g(djnYE! zs08SC2f$`rL0)HrG6-QyEACNPTwMHI+GKUGNLo%#&Z;N#?GA1N3;L1@03*F}o1XxL zkT3vZkPUzx(bQ(~Uaqa|SxD^!l}oq6F453)_Hv@vQVyfH*Q3XuxN^sG>n~N06#z8i zl#q~ENkG_mjK0%r2r|=(kv^C!AZ;TmDhg4nKsWso^hQxhsm~f)djsBvzzl%hKvLAP zhP80^5oz8q5NeF(0|P<&szKO8YW0?ws~m476H#y#aL9H5x)44{_Z(b?xLbf~sot3+5uUrH28)$CnxZtGAP2tur7jDkO?faktPKg5 z8C-Uhn0mMwIcjJ-Wi|7)tA9NjK)6g+HEf7wS&!lW`Z+j)Tz@rgS zv9WdfLFkpf!)kVL?q+al%4}lWEGb28L``eOt;+6|08i*ca0{?BPOv^?{cnK#=n*1w$r2oLL287AJXg(q4=2@l z%VqNOAGV{P5S0ifQV1|T-zYp&b}2jWx|CndX-fJ$7KLaw7*jjl_Mz7~vmhZGfuW@a%!pY0Eo`p_0r1O6P5tM1iqao}A%Irsea64STmqRcn3|bc zHHBSoC@chK0Tgez#5{b(&3n*2%7W;D5Ae1H(<8ZqFjGj_)sYIG6})b_O%BqaAx4|N zd7g{BjA-SiF$Pz5#{P!32Q$_4(b7m=f@T1cDFj2$WK{}68$W!wiokb-MS?EBd_5Ve zGsCI)Y{mwED z33KDCNHK#P8#LeaoKMVxN);T{6i{z@k7!5gd)&3zVOFyEIe^5f4-*9>C+*9Zdq_cs zZ2iqkfi!{{En&_LvZ@ovST}F>BA91j1ex3g%If#&qoeu& z6ga^>@j~{|fJY!qp~_vRqDli9b+QT?S_2*!CA5X@L6h)PyCv!A_n}*qj24R2_lwBO z$*DRy6+@3Nd)jgl(E|{2N7!qU(&g0_r3araAbXZPSYU#t<_jdS2iowZ%a=1?6tnqQh)n9@K=fTLHXN*!bb?usUJuRZz`HFL+zO*U5I*bRaVau;L~Kt|wmy>=DB*BdqSbr*pUXh5nV>N1tG@Lkvo2*v2e zsk46b4%K72g^vS}N7TYN6q57+gi#mh93bN%OnBlVRO>RK@g9+*ah`i)}DtdK3o(^ol>UMG)C;7skC4aH2Xq$Cf1T;MWC_Nvb)*^x}VVDna zChEfnHdp{0KLBLNotMzw+S>i)B^d&7km3x6MLH5F4#>Cy+-?Mb^W33g(ruF<*iz`E zZ#@j>ev`KeR_Wx<_tDW;+$aI-SgZ^d>DKvFA}2h693lX!Erw@6im*WmlPuezVwOR& z)iANOchEsWvcy7so+J_wj87ySFZ-U^2mSMTZH#9oay%;Ra!}(`_QcIa^S>-qwZO*U z$(C!pmt>?t>HgwpKUP(Se4G^K)<9RG=)7!4rZhlV0h&dEa0jDB=!Pff&CSe$$f
=KU!K^tVTaM4puf`5kL-FB_dIYx-5JIgpiFWha7+L^72x6j+0z|4NZo; z!ye9b01OWt_y#SE)Z)U5#$SK!)f@nL0rR*vcYZ!PI+`R(pZd}b2=h$aFbqL_>_sACV{;Z377BgO zosGmdRRN3v_|CWI4S+;hc2p1av^a7A3D96eu|R2pfD)hfc(Z>#D+>!E0ix4E6FAj&YF{dX zsqI4-&Sle|`s}FKYr;HT&^QSKfp^x%a$8&FTk6|k23>giVZgCOLTPDfp(~_p{`2S0 zCnrp#v`lD0QvfCFq<14S_n4<1{y0X@TeDTvfgG6gulY7b$A=v7`;4^&A0Gg!M1Xpt z!k*=&a{8;4E#EhY9hQ|=vB+TUsFStkzIvr{;qL19#YFp% zz^MD*k|k0D2s-)1;``pYxf->H*T=*p*KzH`n)-PxCM;vSuf{#_7sjZH(M*z6=X zKH;LF5@nK6_;a32>Ry2$HIJ(D%#2r)n2bV*@9sMt`~6qWe^sq%%bCPv3p)_G$n#=z z+wqxwG4b>MN{B#PjG1k?xC>7)A8%dsEf0=ov26uxM)VY+^+4t0cjHB7wgJ4 z)x_eG{QV`*;ABnEc#Qv|*CF>Ton7)jZBKH>9VJI^llVmzDWK>!V@JCLbp3}Lme&h+ zZ-AX0F3~xsG|f04aO8hd97p>^d9osL5RI$QON02gv4BffIghK*2c!X)xCuq;aVm!7F(2i z(}F_S0I5uW0TErNO8$vkPv011bwu3b5TkzcXrgpIV?$lQrN$g%RK?hME3%}nJ5$vEux~J4+fPs^DYeT>*{-`TP~0OrvF{~M>+@>Xc}p=? zC@~w|WjViB@II{Zn(#b&GiJXd;{CV^-|R^8YaRQ&Oq%NgY9dwIgo&mC_4#;8-^)ig zt~W=B?5O*e&uS*3bl79G(1es2?$Ew#*G01%r39Dr>TB3md0y#L36uIiD+2pk68NsYCwTD}34GHMi9|x?jVYQsQ`tv{6QYuU5fBy5b*p zA8*=C3NwrbZ%l0MlljyqWPIbrQPh6%8CdWj3W)y0v-?*Mvu!Mcpa1n1cX9Cjq`8CQ zOL~9tlKA28tSx#vOj@Xf^F7?2XQT)cjND@f1B*3Q{qtV9{~O zpv|ay_Vtkl=XXbC>8B(jGdkjEetzL8%-osfRO$YaxNq!y$?Gk@%h>*GX>|XwdnU8x z4C{WYs1jbU#jaJW?oG2sxbp>^W5Zlveh3MXp32EStmW;edFh*jc{IMoeeUHs?PP+S z{>e)W`LC?)pO!P4jLI|&iKLi*#WW^v1v+uJqvOKXZ7T*D((!n$^_MGmj{85N`PsBP zUX=4v*4uI2VAA`(vL-5ac(YdTB5O6H+-g*8y}XtmJ}SZAD3yHtyA^!ePaq)eak?mN z(3%c|$gxb^n9AbAs_{W;kw#YkENntd{mR}#Y&icX=aP4uQYu5Ww1k`QeeTL>67IG4 z%Ho&39rVz>oYjtlZpFIu7G@KEgh$hljZyVKtYnX;(TP#ms74mc=qm*=%J%Mstg?6k`u3Qn*QZP- z3YWhv^-IAPHLgdsS`R-IF`@l%rRqX`Q2jL0?xgBXIJOu1i_19VTc7SeY%$r&?wD3h z%zfw@b(n$S?bC>oDfs8O;BB#d-OsA)j6EUNC^f2FvotYIbDh`n(QmbUBEHks=iO&% zbGqce6CaXubBk-)j;{Dg&8Cs4`Uc4ail7t7f49dK$Iw$MENQs05qeqZ>6hCQ=QW!g z6{0F^YTm58Z`B!=-Z$~hC!J`fP0^pl1Rv$+7t2^_PPnvBptJTF^UF#8GblnjzHC<2NCk_ALWGED=LGbkzo zk~2t>3@SONJF9W+z0dh~?mc&m@5g5JuzRf4U2nbh&YCrA*7H1*&KQ%IQpYjDT&2A8 z+kb`jm}%pRr+rLr!Q$@Wv*db-80mN8?(fL9L+uW-@(!tJ zz9VzjH8S?N`|W(0dhd0tN>k5``o%RfnK?nOa-O(rhO+`xLiC%oISNm!c@ItgGy;3A zte-kwPh@!R&g47Q83(Dt{9S4|DSczCv#Xi*`1XS*+|6EA{!ShBb_&rG3dR-V<|9ry z5!RIgMl*WZitQGG$1r%!s*~~_5>Lk7hGBoLwiSQV%+1?k)H(xbe*8&gj1$qtVB&$( zJ@jSz^&1A?D)=AX?-9QEz*#!bC^9v9l+b}vM1E&N_Kbqs#P~+cM3o<}(c8HyznQ25 zi(0ma>z_F><;}z|wdcA&mj8B=tyibFeyz%XV{6lI`D}e_Xj$H})T+$T3WbS|Ft3sD z_GJUzcor--;f1g6)3#pY_r@H|zXX)Mw1}|SkaLVp=(r-gXM)YV?U1U-8-0oyul9pj zk86{hQL{*$(bY`#s@}Hhp845|`%X$e@pPf#Zg!EHejbAx^#!IL4`=+i-M%f`@XOO5 zF0z~AoVBs-NHJXx|8#h0Qm=MoWs;2k2PTtvW7qKNQpC{1B-@8;YOXzNmxd~b+MQC8 zqKU$LMfkB43@<3cvD7DMP2b=<)Ti9NAe!BtJLBR1qibZ$wf*}w%ka*R7n$%W*q(aT zHkf&&nV$z!UN;R&Z%HgJl`CY3HB-zsGw?H02-fG($Y5gEaG4g-(BkD7`{cEn&c`a> z`&&FExt1|2MQY>Ys(Z+uWzNo+Pj_F8Co>h;a0#R3_YkZij9 zJ*yI~r`PrD;<`2ZUNen*{EQ{H_-#;rlRvMDzvl_d?eC`pRkAi4L)uQr-S;i63h8C; zq|ugrgUuxN*kR?BW)N&)%DSIEK@!D1NiiPLvCh0sPfd74T(8Hs;OF@(+&WUJjB6?;d zJIBx^2(Zu}KeSsDEHm@-B}HE2HS$@q<;k1l#?ErLpEKcRy)~$%T6-I#5f3X`41>{^ zX5pB1t{~C9S^gf*qB|~iZQm=GYW_5;+*u3r(&b96n(U&TrmlH)O(W)Y6vZPV4^f&V z4afO6By&@O)_w`sbKPsoI*b{6BuvKWU3LrX3VPpMQe4o|3?fQD96g`~Cadbn6~Pia z$IkAK1%-)jY-a>-=yFk9J;_-|Lzh4a55ohs31TG+vcazm6NG8^)}DOZ5@OvQ-;Af* zH4G89pBMDYKBrHDRhUcFA+n&qbiKLbu;Pj1`f}t9d6mry9(K2r{hU3(7}!z& z?Jef=mWY}^L!Lwj^9u?NPPa8Qt9e$K&n2nYzC)rhMk+b!K{XkK^&8LhPuJ6geQym;=#X5 zbW4*1@kL#tn!=N^5?B7jyQVp>#JXOy?Y%f7I>a!v6L{9}O!oSi^A~!juHPXIlzDRb z9YcaNJ)v&S(igsRPfvWiOi8RMwB>sI`{K^7EQyz~?dQS?%J-+)Y`3Uf5Bq1;3De78 z%nETWCT62fyS=uu`AyAJZEx}3(RAxC;->0G#%l{Zcevk6#B4T+EawQ+k_>TNXyhzYnUy+YuLa;_&ObmDr?x1Z0Pv7IXv)#fP>XtkDW=f2X8l zOSI1W%h`$ecp52XOuf3*p~>NF^TlwFAZt-uw%;tiJ0Ho@=IdJ1sgkyvJ=CsG%IkDL zeHpi_ekejd^`Y#B%h7C68tGZmV+RjnH9d0k+MakZH2;XU4vBm+GIvXL-eWwUI6rq~WJZzepx3e`M7tFKcTMIty1Bd zJ*VjEkgBrde*8>eOQmh>UzBsV{9bH6u#GWU<=OBH`FLI8+UNw88_cE zs<;zrI<~TAVjO#1*E)t%G&()3tFhzRP-C!u&fAy=q3?;8ynCo_|VTN?`GtBQ$E5tG45RkYQIjM-o!LorxbmeahmRXIS=?_q&DU zr%QH1X4b>EYtB+pKAC#chW~`QPAhsV(rZH}uE4%)-ACf`1-}Vv#@4n+{;uDq7HH-b zUPQ+&7TB!HIJh%647HE8H2>sVr}RHnDfhN_huhNQw!++n-8%xrr*0kzzi(LuiaEYk5|LZv^{H7>VV$I!f&lrCCW%3Lo{0_SwI}wSv?k!i-r-j3m3D-NU zm86Z6kNB~3c~nF^SZmMU{`hg0?&M%N_lk1tfX-~nx=-x4*{)AyPOE7QlD)Lk)}<3h z1?1(%FABGfq_Lj6bE;>=NwjasxQK2I+c@13=JjjtE>)_uZPxPpp0TIHDI~^Q2zxe3q}Stzt{w5$<#$pt zm#X|vwdw6}bImIRUnBbMw!^6>|H5PF)Rp?5V#>v?Pns=YlNGY`IR1XpMD|?fg$Li9 ziu}N&`T4_o;poOza$SA&RF|bw3dv#?(LqCFC?Ej zjxS%YQ>x>$+rQv{BnItIlTUOmm^>YTk9DRy9djyoaF}^*8P`(lj*|cjYZqcV^|2Xp zI`~}vHT+i*#y>M7q2Ug2JT_Wb$AAk{zD!jpzAG-Mj{ zET%sCeE;Xa{tqO!{{POL{qF_-F`57KoZtT~_VRz9!GE6t8iD_B9QglQ(SNPzzgC2& z{oi@;-+AyqXdcW188pRIN(mQjqkdI!V7j|6cDB@TD*}oRP(y%E{Exu)+|LzPKsr-p zmI2%Ktn2F(Ky+V)^P=!@+NcJ}`F~>7>g;M@>5bb0c0m?m<_CE?oa-Ev#I?8FwBT?N zpd912h^+u;*5M7~p?A)Qy!fXB-ienut|0a}I{byp1E_~e%V7oBC)B}{Zay)Ig@JacVHCOjgN>Ew{ru~wCcJLUl*JpOVheKqwzt1 z^9`GoIm6mc-~IkYnZ*r!0E&XJn=@V5*e3o-O4&9* zC?)}#5^?CHw|D=s;haz;{s1_dDWorRFIYGQx-AM2tK+lLC;QYA08(N&=i4&!=86{} z^ANZUAVv5_?Dn3wdl2g7m2d`ojyu?I&t}5X!K$PAAguv3Ld4QTgwWZPSgSSwN-_D@ zv<`0_+X2Z9{;^pp;s~;hO+bvPi;F)&0Df6jKwppon4VByJc^Z_on#Av32=YRn_t99 zWaX5VwLqu^A<2PrOg0uwgjC>3rV-A1wCX?T80_g#T(E?F8 z9k}bj#>!d~0Srho(3)_7cu)}ntsVqoL2M=9@NB>*E0cXxK%!(*z4$0mB3hjy1qtbcNE%9~1d! z3?o;-0fL#&43rficol$0(ZC?41SvdGYGGHIP{4v@0bgQgquHw~F<2x6yb{rQ4lzVY zP!d|WxihWo1w6Qj0jns}7(|%FAtZr38CsPpfnaAK?1F&0;O}OJs;b_){ozM28UVs0 za2DW#Kdm-$D8!ODkQ^g-XqYpZ`~87zpI zj!rUIXz>}~-V$L`L-1iVX~Rgrus2ucVcmKZz)a$(neB*_Cv zt~7vvh9;e0FINFHk#4cgoo|Bw;8Ut~JwsY(7Ne_e((7IAzhD{N2@}DpPO@NLZ$ZL^Km%=Cg0?np#0WC(UZ0 z6cKn_mm04FmWot=2*}Fd9%g#;Qg>Ify^w?s0vG~<6S4GN=V*Zah9JkZNIgd#;KK-& z3cWM^_UiKgE?fi53E*rYy8+v*06%rv?IPRd%Lw5JwpWD=8#x|C%(5SJnM7kB!*7=Y zNH-d-f8-jfPs89zoN8Xy2CoQQfh2(5B3mKnvv~)$g0Sz*0Fr}+Rkz&v0|3+jX-0z} zspU&eY5;i#SnDThQmgX_Vh?ddeNXOMk<&Z3xG>FCtlDku}ub$HNvYRuw#s{TOnd(4U{>VgEf@` zVWG3!#jY`4)M)L8T`;JDj6Lu{QyLItpeKTahC-`;?jf&>d0L zA}}N4X-xt2YzAmZsi}e6Mg0h?YX)Lf2zHzg*nY%n zSJlvnK%<7(E8v&20NH(>w_NS^PW7RBz+Forh70n1U8Xgfmo*ov!TZZ#NlWx;%Xl8QLc1ZnpA+=23luALAQe%Zc(B^9#K1BO2CCy zfY3hkb0H0wFls3Zt-#AoMKp5~p?PoM zo6?*Uyb58G`KPDHU4MP3MR4?^7u{9jy>|H@|I1M?PE9{LmQW*!s4+mpve^B=Vw;8; zP4GuW$#8%Ewn@Um|IVXVU;8a1LGm9-_F6iK|KSB0`q)M(<$s0PHWub-ss002-4Grw z1JpSU7JNY5F8^CBruH1rw2-=*b;U{~M3X3hT3odKxBjBdc22JaiVe~F20Q=+^9=>( zD)DdinILu}_XS^M_WaTR4z?*pLF5DimK=X+hJQEre^1Ww|79#+bqd%j@M4Q%{*_u- zSU4D*_nqcpv@{T5ZM!x-uSBI|vDhM*7H2kc(b&(w*f-`=@VR<{`J@ntB*K}2tg1_a zfli>B`fOyIs@ju=7|w_{;iTIJq2(zZzey!Rmscw98%Ju%@k+S(Nw4P65s_(zHyE$? zsnW^z>8P@hfzmOfj-N%L&+kl_VZT=AS<%I+Lu^1xz*z|5ZE)m>TL5fJnsYR`=N0r2 z#9Gf=g_pgjE7A&*O3zr530l4nVH~~$VNtD$|5>t`7C3!uKWFA#(Uxu*FuvmFbTBv| zBZ79v@~7!ckte47!>v0@banGGM-)}>zfQ48Nw1i$%a!F+P&<-dw^=`*kzcOg$*Wf( zM%y`YLiCt8>JsH~+{3GWaSbOTO1RF7Cpzv~}}Ow@pX(QU}6U z1w#wiS*LGb3XObEHcl6i*Xw>mCPXd$R;9 zrEz!DnvACw0pMb#bEO8#YM9kL36wZOF8xzRJecOrlJo45E4K<#x*RN0rsj^{Am5}x z{;ArU1gA4<^M-&>2gsn|F%v4#V4);efwfLnPqDf|7nc#09$CW!yN&K=yRsu+6Snme zY7=^9w@HLWZypQ1U1VO{B}6CvrT#%4&-zh>9`+u>$MtcT52QGNiHr$X_dgw~8vg2a zS`(E;X*pD`p-yj?rCW41kY*iwW}hz+EJNgb=~_y<@$~Zy*6fy`>?&0=h4PyuC!w|B z>;AYFE5d+R0s(00|%3>P(rKeyYBg*_xRH(c$umlHBPUm6K4KO;SM!-B`qa?1J1 zUE`@%hTuMO-rqgtx6+TN3mrNPjjadnORomqd2C2k2M7z=*~1QXk!<`Ay}spWR4G^o z)oc_<1gkv8qs{o*;rEM$EIHXk);JxAhT+33svub8<24WM;N|$y5D8m^oI#%{sUE+p z(fJwK|Mq<$eSFI9sb}#Saw83d_a9k|D|XQo?E#?~^| z+^bJpFiZ4W$85A3c3KR)?|8kAujhe&!Y9(&jv}`82-x7ls?2zmSC+m|G|rGplq-AS zDqQ_fxJg_kjS2r@p)M<%z+}FPT{o0vNK}JIfpMu+XvBy!Ezj5;H!B=Ut6xU8CJ0yH_FXUjT87H- zjdA!@`);vTw^6>VWOCqf!5}VpY(E%V1uU1WTs`0dcxT0N7odC$6qYZaucrT&9jOo` zkSCXB3mBETpB>!yi&$ui628b6v_D?{BQO_qb(y5YG-td#Pbii}4^nBKnOb>NUpQy) zbi-Gw=r?*6@D&x5-eQyp5rH4rLNRE7>xot+2@R!wXph+7=D z8c?Axm>yJAN)0o-2p6n=^b|K=OvHd+RbpcJreTb)B7I_ zx6IUUC5yycv?f!Ry(Ip99Dcm+wfaX$sHt>tZ*TUkTO>1?RvLv~2KziZDLF$_~7}F?81as3bfTK`~Jgj zXl*W-`|<@<6Vur5!Y(3N=4_!G?tcWGLTwG~nwjU;DDZ@EED5}xRC7;h$9h_iA;$J2 z4Mog46m1)`j^-OiiLUn=88jj%2}nTtUmQhuDtzN_6P zo*fHYt{!|NQs|l5mvJyOX|>P0vee`S^;@m%`rNKh61RTZw!TZj-flvMJbVOa$mf@H zdoxu-a+)p*-dM{XN_>R1tPkICv(DhO@8V+J>@HKjWk6<`g->GHXZ^zJJy#%y^UgT6;>}iM-M|{s}iisqY(bDZGG-xTk`TRcA{6 zHTHb7uztnbt~(ve%h2#+Pku}x+GsMn9~<#~?R@@b%+d{9vXeA;XQ&n3AYCT&{CcHY z$_dS1DsGmO+d*r0HKGL`YUz_y{CJmpX-OC#lf{4WFtQu5N4S|*{Z8$?vpo@u=*h_G z_RsfYud;lbDQa$?Fyo+E$8~3ay}*x- z%_(PlQw+h>lfbeS(Y=977oJl4T=RC1Jrs1*w+9ePw)wm!q z8+~?Xb|95w=n!sfs_}4RBUU%PR-I^GDebpG?X1^4OvC%=JtX%=aN>;q7jXA17htSo zORqH5U7aZ3?H&xzrCOxKL`6EgC*{m14LQl0{RU4-A^+hW8Y)9;e@7#($*8aDvGh4i zeFuNpPuHn&{D>pba|akN5>3%$XSL8v2Zo7~hgkOe>Y+zKc@<}U3>Ti?6yL0#-dy*K z%gy-yY25Qpw1}cYq3Ne5nVwrhmRT)zS%g!siTcT?1U0AaOKp%qWc3}KOb*D%3wV^|C=Pi(Pr{u@o z{(Po76CIVX!BA|O;qQVkWX|?=;TsOSr31RV-D!i`Tmc)@uUrXvFMitZLCzHvG*j(^=b#Ie9i66@~DoYe66wRxJx^zeNhm$}0 z;7QwerqsqrkC}P+aa4hZpU9#D=8v0a47nevS1hJ}@r}EPR_OhnEcZgS;v@bHMt{1m zF*{8q*?yVIDP>-$QRhI&^W{^3mNe=29?rZt5+k?Dt$SSE8<)=WJ1Zsk z4on1?p?%J9%Y_fxnM=(@@EMOJhee($QEH~2sk^poPCezjQE_sb2Djek#>+(e1r0ri z?^8*A0#AJPh|Ayx6ly|$%LScj$qnpWjBUHO}#_w`+8zc4yW#k=u>M*%f<8QA- zr!snf5k}TiN%Mp}BkaD#P2QQ)#oH?)QFDf|*DqlNYf97`7HTfXN!!gm_If+6(`~_N ztiav9!ZRWWb9I2tZm5|8x>nu)bD`LxKXSGdf_s#EIQZD9$&nWKkWxRNd1PSw(_*Kg z{3n&+uGPW9#1)jHeyKaK_(iKT{Jd`Q_$x9$N@m_}lg7xLF01Sg3TFKc55F$!-gI?y z@x|Zr{O*2N4q&z@MT~~-_>S6Z+7)MEmMbM9noWOwW}LCH==7zD8QbKh4QXq+Npbnx zfkk@O3Y!^H;qCf{fG>A_8&D75N$=0mFuCOLIH6m6R!1HFOjHcM9&h!}RWS5QznD=? z&*HK0E4i=V)%i&PkF)(X?Rl87)M5JD)$85@dXea`ORw4bq#93_vOXwJdSsjlLO{kmi`F>?!JzjSw& z8;#0aR3GZ#X3>^riRST#tyr zOfwgfY|fCx|4yTW`WDxdR5t=+NeO)a4t3jOKkDR1MWDsw9UA%Vs(qqb%97R`TXeNV zC`)_l^EzHdoIg@*e>EfQt5*u~g*us4>!Kph<{yK=&CTW-*FP8g3#?X7kLQ}gS(Nh? zsG%x$>75C824s!Z3tV3O=_!VyS}r@&iChKSX?F;&+WGnuk_Szz4Ge}iWoCvVPw&)p z8!g{9x8){-&`z7KE|qpq?s-%`azM^t%xaB)`jU81L?8D=!JP{HdkorItsGlWv>#FrGwQOqNAcI z-dL{-UXBmy%`u?)`Vw?ESoP7~aGq^{`Rypp5E7}l`%qTHWx2zUqDAYRWoymSjK*1u z-=3AZLaC)0!kasJ?aMx8vn#(|K)&-~-rZ|e2OoPstO=^L*YG;bYtfMn_VlOclkR+(c@TBL9W3**m?HysI-`uoTIwL7^GH(6b^w zi@VCOsZU0IqW`^qwapzP8rMxD9(YcAaGadY}S=}y4 zd^gB_q$~7h0g8%j=J$s@{B-Zr%Iw9^x8tp9#-G}Zz7n@Tyh_|2u#wFer3i8hlC+5S8d1A5PDU)n?8~xs8BQFxV*9g zwma~F(&KJJEta#15w{*^-Iz>>z}OpAx3;Cz9F?BGvEL7s{eIY^e$4rG+%nu`*J6%Y zJ3?LgQXJC-`Vkp6CtRQ1yke_`{X;CWEsL>{mrdwH)0U4f+3OtAs#l)Y8NXF;i3RUn zKk>#&z@yyimOuQM;q-G-D~XGxPlD+c^t=R(a}U;KqD2#XUj+$C<53p3RlI=Bx;H&t z?(qSWqw=NoiC4_c)r_NeXP1w=TGWvH@>*V<=aUJMxml+eyF3-Svbn{m)=8SBa!D=b zP?MXcTX=VuDz2^a7i|?`sI5uu$mCOJf^Lahji}Zg>j~=8jF??~B(XB)R}hfYM&K*% z+i!y>p782QUA|#Y?v3k;7m|f}MnbXcHsT^wWiF}W1w6KI+P0~ogWfg!V%?H8xh%h5 zO07&M3(6N3XmEsdpBa^sVQ<#Zkv{sk_A<0tPp?LhZGbVpM{&O}V&Wy(JY(T?Y+t?2 z!xMaPqj(-nje@f9?i^&!!~vw`}sj$!>^gKq+}IkdW%1-JIx?`^Kp zy3skypF3O!rW(F!=S4+BbkIE^^I&}s+s;3sx;6sG&x%_r6Oypg;`bBdztZaCv&QIwL{@Kg7gLKphK_kybcbX$x+C{dds zlP=7|)%`oiPV${++l^TVBS(AjXm9ho+O~1PP^Y;x>K-}x_!H~YQ8@jKSD3zNd7OtR zFj66w8QBnh@;!2jh{gveqL4Y>2*mAz4lzY6&Mq>#t;Ak9VgKdf*?M8N^eDEq+35s{ z(nGIqf7K(q^q>q|D@}aMX54JTnJ`C%At|!Jd^x!E*+I)>HL{VIw!^ilHkm;@H{^0#$t9|~#J5FuL@v$7*JgE|lfrgK#Cxdyc_drm9&IEVFC?dY{j<<1@53z8 zUeUVQk#G`jXlPjc@_>q(X2QACin^T1H+F;COzg%tiKxnqqgIQpMoz=Ha-`vMBe%tP zCaDbgA7Ep0J!MtZy0TL;s|4{jwx?D$vx6JM?DXr;9FTGGPo(hB`E6JPeoXQcx1z@9 z*yT0tn{MVcbgdH^WnVhKh15^V(|p6Z;{WJ;VZsfmkxwE92V~4ADh|D>uEe9|@U}M5 zy2>IfP+(|gdJ9tWBb@kzqnXy4vLl!5*ts0WpNFmJdnlMQGm%;}uess1377wvQb|hINHINY^$`!S z9c?EpkALyMDfhllB6Km-uj|X}S=7^CxMKtF10#Gvewxw|-!HoJshs!L7jgBOX!11d z`X27+NsD1tdi(yN^s+Txo1L=@11Xcf)Tv{K51Q$esLKasus=5=>9#fzz@db^4RLOp zRr!Ppv$LczYVX?&OT6m|M*B#s)kg4v#(k59&2d6@c3aOXBf;xd9c|a>RR6a2?i|jTmIeC@$r zNQhcXh&pPN@96fk+EKaGcHh()E#d64+0k8y0OeBpd`hUHeKBj?7IVreXq17H*j&m| zRd#l#dC6In;Lt1fz`=L1sjMwz@j47c-@AN>#Y*vC7iH;pW@E9ir9s;4#(6q$d_px3 zx@S~KW_(a<{*F%9Wq;BIXMLo5q?!(egJZ%QA0Rb#>Nb87&1SP;VTr`IS*y4A?~ej! zb(?Xsr5OP?lMd{TE@$B-@y}}MHD#NB%@j@B_Z9W?2Pkg;SsgW6s~vqLnRrVWG-@{i zF5n?^S#reToaf+0SkW{sdau~wRj!V733uOnx95+1VgTNL`v!fB=4MGc5B8j%x@sLI z_g;@RIKm?RQQeRN!&G40SWU=r{pIe)fv=;F&{^ZkM2&cxT-xsy|h&t4qg zIja>qCKFntfXrq;A-9uZ{%j*WgXa3@ZJQn=yr0xj9r96IE8kmQ?+(e{TfS?quR*pW zS}k<;#kAhgW+e0xPEd>-BeUW|00RXIH$pM5C|$LDq^M%HV0`gR7HyW?&oKJ?DRn_*v!hR3-BPN5`n>< z%ZV|fUX^|Q{bl|sdXdR+wmuCiN-A(Stw$~0sKA(}D5jyI;wFOAabJcTe2;qW+yOFpq z$eAY0&+mXyys(GbKS%(-V!~s6#}ibW6ts*y3MRfsw?Cw-7i0E4s}(fe-ZCKjg{kIm z^7LO%=$0iPiwixovwx|I;hNQ(cbj6@l<8bj?FF!?wiPI_N8ULvcQp(tWZT23@eH6P zRPF5YK&W=CF3bUmL7yi?b+p=%4ln4#I>t{vK1z-B)u6fqi)`s?pSgyS5xXqX3$+J$ z(KN{6qtbLq9%N*xZ(TD|l;a0Ig6@v2Z57;InmBFph_2UgHy)if^C|r8q$h%e- z<#p!PoM{tfbKB|(7s^a$p)709rC5Q5&u2h*m8GE#30BRyPYNO>&0VM{Wq?2*wk2<% ztEkG6HGrhrDo2)lp-u>r{tWio9u=5)eJ{xan@8=rey0NJK_Iy@C=9gyX9o&IAR*dd zF4EuxzXZud>2KfM1i4@TjFIEt_>_uU`oB;(nLsxgju%>DGO~2l-m@-h2Hv#JO46t! zPmVeBHfHkLy|09@4V4LviH%)B`sJCK3XjFa04Rr~5A)5t+2H8br6fpncl`<1@>yd4 z6@cZXS5_LLV+W{waWxDlWCx`cra^d%O(f1MP z*%D9VvaH3dA|t;E{pn!la-L?1P^lnF#+s>@vATMCD}WJUq$HN#5)T3$U0K+f4{Vv6 zo0o|W#w%P+M8n|<5_;enR~n3VRY9Ka1FEobn?t*}fE4vH9695yEHvj592;Qv{20A;wE-@!34>4hOCx=GQ+wVXBDt)b>*@4fOhQlJS z`Z10z4H|VIZLzIUz!M^MUsy>(lY)YX8{Z1+A%Ecpqg^KYM;=BG+2ko2DVfmFx}?gb zxH%J$`bKp>jCC|eE=$(Ie3Cs*$W=r~gvkmSb>=Gmj{s))lCS$9`Q1TdC}d`4KAVZ3 zhQ)TGqAChkX&Q1ny1G(O!8HI)L1meO0#m3}a^&Guhh2~?IFPmG1T0n&?(vUdEZ?KM zYqejp)cvBjDB0Jh&`5vH@4Fvc;wgy_(l^ZF4QFl`y+o!@A{Y#{KePNUbbgVrlxZ-ay zMa*Qeqyf_Lq3D(lDg+3M*6(mr?ImrAq^|5Orkd{tvJ&raF(H8S-&pXSQ9)VT%f7R8 ztaFuLEXcFQKCEg2Hk*TRr`BuRAJpCGx*f;@rB*=BR8KyVrL}6OzY6J&XU#$dG|A1r z?n=OYm-@tkTAF=4DAMU5NZkrZ>FPsqtT#~Fkx>@9zxnB0@VnCns{+l`WMXr<}gne=uNu$yZ*oj$@Gc zA#6en-4`Skqd6su1{`BiT|W29rLAw1OGpUaa|L5$3a(JM%n?=jqLl^IB5pVl!l>6m zGxUCcp?-J7Y$+_ezv@Sxm6Z*#1*HL{At50q z6bkWKywqly7|~OL&(5;Eu^Ky{6IVKWL$RR-TTMogBBTJ8f<-+Ctz)b_TdEy>t>FR+>L(Xts4G}l#1N0E4#z26?XIkDkKBM<_< z;C{>*t3H@b!mCTL$V4jnb#lqnnsa(X%sjxHX?#3^AHG+8`KKc~#oq}KI8MskFu(iz z)Faeae8IV@4DWge79)fk#IW#E$_$Y zY^X~7ithPD_+gK=;+nj+-zDa%+M(b^!DJ0gs8T9fa4oz}MA4?ZVdwAkJC0~7+fhnO zd^$xm5Ep*Wb&a=<#T`x9^Y_cQ%usAP^-#7UdvsQp^!d|qzCm`a=e45 zVG%_u0)sM_qz?r3XMwf*QnR!_%+Zc1o>-^h2YkVc2PSrA1I zhXPRvpOuxBxnqwY21CN=1J0v?sOsbd$a>Sibry$0kf?6l#ohU%1^M~Q0$*p#sYlKi zzMjFYNBakIJM|p2Bu*r%E%Y8at*T6O?D~sOS63a8$R|##75R3!h_4>4Y_x(D!Z@Ou zBzqh2d#$MWBU%PF0o0xi_{Euf7q?ymxU$|!-QQV5E-S^k_ykbZMA=kU1b$5|uRnv-I^+c0PM#aA_6q?HfU8i@;FDjb#7u`;165VqL0tp}> znWGw3`ofe_9X=j8X99i#g;Kx(c<3vB`ODpFsQ4yQ6@A~D2CD5HhP5tnwI`hK7iY2f z=pl71LaXvCa9yz~PTCERK|;d(xlMYlf{cu;zC12g{q9Zx9-^wFsGg-J$N66cZ|m-( z`U}1_cVGqz1Nt3O9|N;cJoS}je+;`@`s`1YKe0e@7Wb?@4J%)rr)wn>a3SLrOQ z@vp;VK@!zL!mHW?fD{F6Kl6_(vH~+{iICUL2h{5)x{@sBc5YP1<`bPV#EF5HLd0vQXf8falkD?-Fn$2_pS?-{-6 z29KLbtdeO?czuLYvc%<416^UHm7k#UEssl)Ao)%C)e?~s>OBYYEanK66*R-=J#h(@ zcS8`63@khq7qQloxo?p^uxe^zkbi%0ogK8quj)i5g8=?HwmJ^N-a;%G)LAwc$hN5( zC`eR@eEt!!sxFyS;U<^y8)@^{p82^R8t~77{Yd;LgBGYKCPZU1Wl%( z3k{1sIp_UnB1_TD3=wh;*}-tWnqq1Okwrz&(v{jr_UaCSnNH~z3jv*eiO-si*14f= zjnkfFHO&2y5V4<=wHt)Z42lc1Q7e8 z(3OB>g|@qp$L{m9)!WyUQ zF0$yOcnzOwzsI6g%G368F4mLOa(Zo&fwMwGKg~FBQ&CyXz+83FdE!n_n_11R&$C0Q z)`QLYzcwN19(k6|Y<%U^Vesu23a~LP+SwModc`lVOz;JXhvWnql+-}~-3t>dBxua! zQpfJSLTlGPo@93tCg58oQ(5_v_Xn(-YNqbW2_%SQ2V@9j2n*3hG|zmGNgLg-+SYxD2K|nXH}QgK$c`<=iB(%ko;`{x~>E}`Y6T_ z+Y?c@Zk{e7_NaqYvc@3wZ8q5lODF}Z+eKEiWw26!9mFvare=#=C(lml$!IA0L&)zi3+SBsQ$g6FUH<^Yq?3(f66 z!znkcVX9S7s}ojFMxfPDD4+01%T#tuz+Q5&;}LVAOJ%)8X!xT7`;KE8pQF)q#j|I8 z+%FIB&KjS;o4e#{X3t@lA%XE5v%3B(?Yg?!kW7Jeh-|XzqT-v(dr{VEY~(EZtCaD- z84NFWM*i+6J9e00KlA%yKP&kaHW6RCs0cQ6Sjc|4@f+*p-9E0EK8R0`lj6sc8xniSA}%T+%f)G}Ou1(0KUhPM6O>gyj8D z9u8W63k)Q5hkj<_uPI_ zYos`b5Za{)ZHPTSU5dpWfk1??dNXWdjsXkFt^8Dp&5myyF*e)Wbf=$xGN!zdt}Z9w zTAE_ncR4jTpXrMG1!?vUb*7&re{Y5w7YpL+Gmy6RSqkQ-m6YDs)i;IvX}{YxnfmKi zVj^L)gFcPHITpNItCYcHdJ*hv=d2dWUlCer7sc$~ z*G1fvQ6WVS#|eK~S8bY*doGu4x_j?Jl~Srg+U=Z;Q?TWZ2=H?df8Mn4iq`9ECzYqP z#>d4^=GzB8N!f9qBhH7K^k7TYd-G}h^)JLLm|$F=lQ!QIk^1_|!@%Ndv84(Oz> z%V1ga3sKOz>Z4T;Zwv&jaG1YNWI5N;F$q|%AG=R)(hW5^@k?hV^*e#^u!h|oCWPWj$~7o$S^UO9+d ztL?FWbY6k;qD>%=ySfYd_1qIJgy3KxN7t2aTQqmmdx*g($8$d!9zAJ)g!ePF@ z7GVZD@Aph-FImw9T{7)Cgs zeSLjS$9jsH{=Pbo*_DsAZZfo|Ij<_WZ4{=HRF%qUa;xW(ffE~F=<1N#xjLN2Bol#V z#k`^1+8=nwdrL;(i?3MVPiv{P<*@VFVRJ^7YB4w_&Dl;V(wNMOq60R9Le$-_!<5_3 z*|vRPE@Zk$b$E}D*7rU`-UBiXJ{v$^*bY;SKfgJU#rs}j#DA2`a(2=-Q7K4w<^rA)2s1ywt1~(TUuCu z0W*0-vm*fsGd~zz*`c7q?Dqwz60^;_{dtlPZAwQu$W~>YuP|iy`lVsO&z$({+w*|h z-=W!?z#8Xl_+<8)(?FD8@LhcKo9uh<+kzacy6AQ`XVxA1Y;^-)7Pb)!KdE~YNjbpq zu#rjfO2{W;XdiEDKSTDOM;jwt%5A)3*0k>MWy+y%K03K{I#Oe)m3Ya(ou6XUwG=eAt=XwjEgfUGMN1GLpn<=+=aIf4qNU0p0@`h z?5Z2JJj;Bqd#3dG>~iOs_87;R3mH_cJq8;i5qL?=zc?B`kqbMNir8**3@n8>lsbHM zSH#S;1g#EsQu!7ZZmeXFc4JIcW!%iJ(D4i*pU#_XxId-#t?nZZwkOt#NlR;~KO(Xt-twmIlFuGB20ke7r5f9v znNW`g)cGPxubdS@Q6eb?RAl`bJVXERsQpT@gGZqV`O6vcxCr)0<{i&=XG!w!D z#E9z*3d^dwVE%P-7?*mwE@A|(Ztf1TuxmIZl#8cuTU)DRR3!=obg(7;+cPHe%+U%f z1UG0`Tzuv|VOQi{$>l9Ot{`cKAq|vLH@wg_9q6JMP-td*KTnC`E~6z?<IY5LW@*W@YQ$Se7nUhE}y0IluEA`_m}&=fca%`31(!jqe+M zZ&oKLen{(bztXCvFA24feGxNs;Ys)gA=aowvF|$X6$@P`OBh-z5h5P6wEF91_?cI4 zJc>>SF+&-RzBJc@{w$FeD%)SJFZ+@dWc_GoPi6=VHcr_XYE`*Bxmq!pq^%cAnKw7f z{$MvL`J8fe=AHqE)`tx35l-k2#}sZe{f-v4f>ZM$oAt-3O09ml_UTi3SBk$%etw5w zgAyy#@r_%bRlX~OCnCI=BcDE6Q}W?%YhwgTvXq9>m`Z89_%zaF_OzVYK*$zrt7KT) zT|l+)Dp7^|Rd-v`@@%(KXD_vdo$-VPtEk!Qw}djLeYz;J@z^)tIyu_Y0y8~2`6aIL zrQ#=lpWvdca}>O&`ta_Dv=S-Lq5dKQm)e#E2iDv*GPiZYx*?kLb#rc>?>x^LSY{Pg zXr^C?t>~PnkI!Fj>E&A4Ji*RH9(Wc9lG}I6jCq!N4|KF2Hj^h9QSaefW(9ehyt5OL zRz5^#LYcPETJBl+pgdQ(j66ox?R}#LM|68zqO_UP-Ry&wzjp*Ikbj>KJwzlNu*U`; z@fdE$q~uO(R^+D`ROw$=qG2A|z!xS~Y+I}vz4hyVadbtK!K9emoT4k*SruZSEF#RxR)ho(`=FEYLHzj0%;o8j6U)CA&WtJR`Zh?SIS=rFwIh@z z7)@qU0x~N!Zu25IW3SHpG?Jt1Xwe>D_$G~fkn3wDK}7q#woJyd0%!4xZK^L9{Gu=D zv3EZ;&el$sNwT|yax>l%INT;)^Ng9@O0{{JLwD(M@{6oZ*Na=L{#Tc?=%8rCej03M zQaSp4To%A*2k{oH!ARPgRmvAd!23PP&WbF1BeY>AWlY%ER#b zI~m(r*;_lIpXOa0H~~$*gZmTbG=Qt}R~xk)enTow_l!?tEC0|vN0!vDYJJOHPyG(W z&wZrC1q$ExahY{#>FKw&ny`et(nVNHPXkfUxX`epj+IC4aHFxizv_en5_>tBj@dxK zta6Z?pJPe*HBMT4`6BL7g@+ING}fMR7lWM~jPL@^{cn0&+L0+t0M18d|JHW)sU>vu zqy&r~i~~IvT=_p9P4ckJ+I84=262g;YXvOCr8zO(Z z_j#kwT^IYZkcPtbByPkG?Q4?IVVvf#1q~nSYrp*OHBNJ6@y>n%g77a!KVOFSeWW60 zc{n3sb9&|)xsL4owbu@fYp)%iPPqMTaDQV&mko7}n9r4G@MHXD3m&9b{+zFDC9o2-z7j5x^;lm$5gz2rb%bXAFagTLgPjqnb9 zqRGKhi|`6~k4NnAur~C6P-i%@uw^&Q48hd<u8OePr6QJ7qG`p>VY=**uJzcGLAFc)8?a+rLrN^j1W{Zm5) zjo?BZxPF&V1cCal_NY=TVJ2inF75qGBI#oC`XO0)Lq|YVjXu&{cH5e7`;k;j>sKb5 z;y&fECj;^&`dnY}`pOwAjnI-v9mxbh@hRB$eWpV*JMkNN_1|m>zIxnh;Ju!&(K{n^ z(rB{&^YClh`@HBbylVFu@crp!BbB3l&0wwtja%=^UId#)0PZZyX6^&D1Tq@&<}f9d z8V)FfANNWRman|V`V!y;_^>)jQ71{VwWZ7Px8&8TJd?JR-?1ohp`uHyvPP(}S_YY+ z16#;Lc$1@DhzVY{W!+ZNPXg@#7}G$VF|9+#*AJfog2MMck)ab2zi;{=pL_Ti`GsA& z4}dbR!ndtT+=PeVa{#675F;3#Nudf>qwcczL;`D;SPM!%n>H}w3s1ugKiYc);mx> zxCG^r$9&e9<#j>QboKuHGj-1v)rCI@=9{O^kcUZfKv4m_he@|u?+bftsU#cA8dR2GGHp*|?9sm;u zM>;c#ReCpWm-VL;TP~@d3RO}(_^qj>302PLDM`HHqrmabywiPh0AKX_tCWz^vJHFg z2-8CjV;N^OT&l5@6Z!-EW~`Z$sjuW(rO}=?cL8tBWg8Zmm60v2my8Ka?tDrS(eSxC)S+P z<8R#`EG?2pzD^&>je9czU0i=L1)G_-Wo2X>C2zM1ha<@$+Fr<KZH(L`nQ7RJnPABClJAPIYag8t4aOb|zO=wOClYq2ub z!XRz7_+ZaScZrQeO4mckIQUd1yhDyO_c_YC*gH)teJ%7=3PEf#N<+fH1aNU%XPTp@bw*Ey%rad1DrX=h{6Xiu)eFH+ z<_F*WFJEs~V93mlJ&~xD*{UD+wrg5qtA268@@s~@7&yg0#0AykfEIf?npGzFw*AOr z>^>W{u0NLgowKgnk9}#|m(4r8bA{8@r0UOI4Rfwq|5vB7sxkO5n=Oz6yKrv+TNuT; ztq$E0p29SZNW@Zoc3@3)Ogmnn#iGyVEw?AU(7VL(yS^CKlqHUlu=8quuJ~2)eA?&O zOEPO$=rhmv;M$n%S3(lC)28yl_m3`G)w;!^Us9ZB);a5DE*!-90A)M=`lwXYTlx#f zMdK!AZ|!NjUCOd=S2oYS)^n|Qd$CEGT6~VC-yG>0GkQ~B&vcXh)E!4@YVb3=g}k=Z z3FlvAelcX9e_ZWE!ZBvYQeM$0+d(W(rOM;9F5@jh7J4Ww7^b4w8-LAPdw!N++gvU= z8ftZFHMkhjXNU4ke{|%MJ$|crZV`L*=5@Zz{KBHN1HxP~f%}wl!gKS|IDZa_l=}Oj z$x(HTQjDEvC>+o;Yh`+Jz-QeD%6_X}YaRxB@1Z9W-O3<@cUxekYpkg z_HhIwUB=DsyEY>0kem#^8*i?nH-J8&Z+&)4{tQg6Z5t;V$;GfMMtkzFJgQBN915}S zEqax|Q0mZJ{)b&ed`$mD0UtEc5^i()BzKXY&%GyIc5}KtJjgqK?Z0O$gR^mFc49hz zJ9S!>l*fnFjy_p-J5)No2oNibI0@^y_G0F6y+qo*S{%Wvc{-A_zi?<#d}zk=qI%&G z_ndPJeYRt}qdkmNnx|)p7hg3l6&vHqyBGsT6++urhvGxWy3u4nA2+$mKz47anj<(F z9^`{uE8R)B8kYuf;}anD-ntk%uBK z#LedM?$-bgV?r!zg1dz7mX}bMQD|!E;T^W^7<X!TSa6fk}ZU=$n(+aul)D9M((M<-9^TQ?k_b(wU45l| z*4^NIH%y3a(fG>EwaR)^!2vsq{zAU~!c=cNH&+au*Q>O^Kx(A~DWe2pM>?lGf>B8k zTf?lrzdYCGlf?~?Na)1t3>8He->^vxkl~(mQ0Johj-rIbyGiP&2d8!+ZA5?%YNPRx#zxLjLL1Idfm>8URhYUPK!l`f&5f z?)3oT9cUdHId^K6K=XL$x1I#8`cRiqV*k)a8q_2Ku$PsZD(md*O#FOGDhYs#s7E%y z^R(5rbMWe5JI>XzCIk3I4nep;aRmTA_^(IMBio=}xnwb+ff6kVm)|X@!U)j;Xu4TU zwxyy1e$&Op8_>H~8NEwrWeIv_7vSX~@gX43f+$VZUiZ9>w|Px%NJ34(=T9&a@&h3; zC<-t0z$--3akC#s8R*%>HHSdK3!&pC(Tjr{>GBRKb)B2V>hB7w2}qazX}CP&qrm7yG2vij>40hIkF5yoNfsvb&`qYt%m>qB$ibp!$-sKCcWq=!mo|Kpdz9NgykM=?qfk!}~`)^lwgu{##G<(w5*GH?;n+sos z2aK#U#Xk@8x@sQh97Pr!!?h&Ef@mB1`E;ZL!tiMWz-MZDnvgC{LO3MQ?Fi>=7b3t) z02n1tLbEmKN?F~z7cpHz24TptyI)O~3*%pJ3z7vtFn38m@D?|G@nA4ica=N<<$#pW z$o=6pG+szS^KV|35KvLGgmZNGZZ7*;gIt%Dg$2MdZF2X#sRT%?yCbVyNJvNtC^>cX z^kks5(4nECC6&+}aasd4VCK_(mpG4*5a{Dq%Os1tbr^QVo>cXnLwMn{c1e>rySd=iB@_ z>%th7)KCFgvcQNn2<_m^v20pSz3zS?p`r2@ri;v-24r)KY}ru zfLCpjTsB1549YRp%-W;Oi&Tw3l~sh_P+Obf&iI1 zWPx5Lkf)rT3kq!qvRhaHJm2ll?Z%hqWT2^}7WaWE21RslfHJmjOOaO(J33~M z<{2!9-Od<{#is{5z{r%01RjY1ybRzod7>LmCp2fnqTR%+Y^Fex1O&)<4$vZXyOR0p z-2k@D1;sKb#_{gi$@+ZSOJM)W8>%qvnxxk5$sXT}^cka#Tw;7S*M_V?=?lOx2;VR! z8d_*KghkSFZ{NP1N2m$%hw(fh6Drp&eSX;EOG5>P*9<$w11nVH)xOVoIh9!#UO97c zno!Ki=8bPf+JzNM1-X+Tl+~rBW0VS}0F#?t>ma8Nd(WE7i-pkBmCaq}iaIiF;i zkFS&x3msdOKQA?2Haf9s?4eE1Haq>#-pDEjn@6EdgR>D75?|St$RoUgfx|=gwf$kW zgwOj`&}@&ij717q_y7T~TbBmk`4qL(>>lL9&p&Y8jo^^vPwLDinJ`xsHfmi!IP5rN zmL;q`}xr%x+qaM{}f-%(^%e%1&)BkKdbY*XLN`lxQS3+}o1Apla zFgfV}zf8^rAZGofXkR+= zzn>Gd(Uxn`o`^(H5!e$fVmN2511IPSV>XKbTfP63a)eEPIA?<0a0S!Vb4c|qZ$`NAm zKW;%)6)cLE1}kIF_lU5Pu*o+XrF05HlLR8n4>);4@eAZ)UcWK0EtVZx|0O~Iy!!$6 zK43XavtQwpCofvERe@IPNuAj`fC+!wy-~x(9v$UfD(_w!F=Rgd(qQU9aGgZA9mc}I z=V8}jcO?wT3O}d$oo~5`Pzx)6`o-vVsRW@>jnH(T4a(G@@>>>Q4{Ip2AtTY8+m%F4 z@7a04_Q*<$%o_jF-$@UY7lxIP2?*KI`~Yx_K-v5Q1U-tXx$B!GHxWyN^_5NvDsv>Q z?UEGlezN(WnKze^4$87%io!8fcDk;UINUSN$Y|G!`@Sh<2DoDahMT1i*%zt_m5R7y zjE2&G?`fDM(bAI4eb>Wc=v61pT42Faxt*au-RMw>&NbC+KHZiX@! zlF{W)^ddhJ5v&n34wp3ThYA0gvaIZ~Odh6!%xq5I&y_&`Y?z;8qRJytZ+?B5o};w{ z+!UsUUWEH#u=~%FQa93n1|>*EEr1>H?VAe%n{N;T>cbf*If2ZBJAqgWg0}#xM}BIt zA=bVa=l-wbvdc@eRv)X^fWjrnP}G_jdEFVH`6wdcx-c@h)e(QLC|~NpQGbf<150q6Jf}KVmWvF zA-nt7Uetm8k6YRNyEh~MeFKRH;O72-8#J91#6IP75g?$j?zF6}vyp6XIdLjGAm{*7 zuE{?Wiz@XdSVG-1X-Ek)f%MzFl*4t%yNF!pLtdnFEt~6snRizIKH?38RaX6~Id?Mp zE_g_C1b->v0G0!>=?;pj^OGynmYrau(p^&m9{#F5aN-&V7tEp~qI*%ZHmD z4uovYE&K-Q!0v=&t6p)NGm7v3b5FzH1Ys%7xz2|rLiFa#>a?6tl+r#qJ2C{9p#?Y9 zfck3ld)7Jak81g_w9z*jJaa6ERG0X_=*BD++$?!DFe<=J*osfGMImJT$k3>#NR^b182gqH- z1A`DaVUDcnYkL8~T}1x~Yb_BmeR_R^f#4;lE*{4}^&gjDSe3PvJfCB&v4DP8*U->d zz5|l1L8Or7(9lqS4;g8g?6B`d0v;H2wzqI}YjleN7HxSs3Vg01@8$B`#Z>i7e zHSxGEL;`{C;>f#`8?&a2F_b!=g<9Z_$phm1&6_JAiy8Hs8qQ9X!}+*bwVr{iSaERf2u+DG@PLVWu9*I_iAjUf8CRLkL8 zhCBv{8CDl3U`qo+Ad&?|5jBFiT7fk|aTQQGD*#$Q6=NQ+cJhT97|_Cdy>EK+%$J$H zz%pK|GgSv_3W-QSJW%|64I}TX#wo;lL?HduM!T%!U)-WWuQ0_1Wb<{hTrrU+`4)=R&8k)MxZ+ySt75O|;)0KCHnKzotK zDtgR?=*qXi#{1@MG`{FgYTjHAgG+-RIM$W*JaEH+!C0;M&jL;~#Vg`k2M4k60NKUG zdJwT9!FFUaclck91IAc*3JM`W5|kM2yLxEAp_UC;LgEvzoydCtGU?qFOTuEIC)$O^ zOR)TwLNiji z5mG{$)MU%UphCp8+NeE zMxHYT`UO^zh%10L3Uu=oo1{53+{8a&zHh&Nz2-e_Fw};8XV`IZNW59N+i)@Tjt}fN z7N8>?5RCxp=yRzK7u}LSz!6Tsft%7{m?=j~I@58)r)UrA~1ZPNyJq^ zB->C}6i9I!rA(m5KrT9#*xT%LvT{hE=B$w2;6=nUL6Y)F+Y{;6BhE3Is)>ZPf$f*c zn_H%yX1PRbrYt_m35$Iin5Zqt=|$TlB19=mlQ3+)>wj3pF&W?lOOd*LNzoN+19MZK zXgE47)8o1(&H>xx4bbR3jYKFzNkx^KVseF%={p_>cZc#Zljgus(JQP)W^q?)A?S5PqBdNlhEN z5(d5sns#VVF`$c|4GN4X@Bv0CI6#&tfrVIQD3=I7Pa)O#f^Oq%n24lbB9*P+x~*XC zeu#*OWCQ09aym$boO2RvQY#W^UYn~l0a7C3nT*_mWC_Pg6%7V-?59BAz7xdQ^Ic~2 z<=aqG1LT=5GzfGKpqdXszpk`ZDMk~C6lz0Fe~EZ@oKGrtWIf%uXOwGJgT5he~_m{7o3v0Od}ws#t~z!sPd zTF~qRl-K9N4IUkHR|56Pjboa|P%4S%y&n!a$iox>lGQZ#gzsYKdS0lg>9^e3AIik$zk36O(AXLy6C> zbK;XZNY|xT>s0bR2v#U956LQlABYA<{yfT-T+>jf5VYd}*?n@f22kUDkN@Rb|LoEMS4hglT!t5V z50&uGAS5UG<0k@}b*%#sP+4m!I0W)Pr~V(SUWXBdi;8Yvp^dBWZ&Bskg6if)ZD6nx z{li~GaWdac>1HP!X6adUY8Ud9BqwBotbF~y@221|xYBrk;8<{{3%mT_lvh`5SKh(%^?D#+BH~R~mc5zko<%66a@FA0f9&LW z-jm$rrVveyu-i)QV+AQDO`MVEt^b~j5`*1r#~w=MAhit z!;<|B;3Hf0%s(&Bl7t}g=$@9>G_#!_HGXj?SckuEnhN6&9MRz?M47Ib9ZvgD_a%Jq zvoVbd@3>gk@+?e=o*+-jw&zj5BD^Y!w(Whe2VI+nQhDaSEGZLeSg2IsEMq#c$RbSS zhKlSvLXNVv!@e zE6Q&k4u27OOh>z)$4sNabmhv2zOL(mnZM$4GjayBkH6R9YdpQzPf%wJo~b~&5o^GQI*&YFIVYLoc& z?QHT?&sqlLc#pQ5B-8VDHP8i>_S+zT{qSqbYG6El&p=DdDEWCvvXIC3&)%J^HNsw> zEsC))MHxNeq$k)sAYFZVto~UJK2$7R;LVNob2B}?DN5NFcyv2^se`Fdo$s*W-_yOb zF#vkCuyChjpSDuRXZiDEqJ=ChwRJA9Wo)$wK6qE0S_bd-KdZbEeU9mL=d%iSR|@#r zzwW~JXMyVfT|YP%l|Kbzqx!j|Iy5UQV@mF6OGffn%bzJl{n}#66Akzc25}D-TuX8~ zROnTWC*v4Tx8t9>{O-v#<>{5&_HYWV)wssX55htre$Y~YHq7sNcY(3TI-cZ zt!rJ>{A1jjH2aKOGeyj7G}*c`Vf<3QR|5rlvPqpKvPIU5v62r_0_M_V%KE0(y|p{L z_0CC)pDD~N7rY`2%l{JL%k zJw1za$HzA|w+Oan2Rtyx*5SNV3j4`$jk8n`c~p-m&~r!`<|)6-=_|RFWp{Wq^IdZA zA-E^XJy?phwAARVpqJ$5Zw?KGMjhb$nx_&Lw!|&IZ=UL5PPhEl07#1RZX{1w|H-8Cvg^^CDKC-#zR5=>TLgH^idz+joh=F5g+AucsA3BfR!B%nCi5 zns3A@UI|+F;tg}wvNA~G^S$g=IK_sKX3aE?9Z(HSGX7W4TUbMpds+%-gnSjd!)Q54N4Fz0vub zF+Tac^up=RFH@Fg;|_CgiQF1l0hcG>>wY?v2{(7_`E`rW^S8t&Q`+&Xyp^e$wedH2 zv-h=W5!BQ+WtAjJws8(kW?3BUsZ(f@&HsJl(iBQa{+-Y+bQQ(~60f%G*xjjiO%kF3hGMDxy~R-gf^!-_#n^M9iPMO;AYR2f(lEV|^F6FD{5Hy>uw} z`V^~v{8J?w{KS`(L6Pj!gKE(M?_W+Pt@u&#e!X*VS&Q-FFxKgR+AH6TriE#dabW@d zaL_*}KspaFB}s|B15H*}YYzA6B}E&0#PJ-dNclP`-5S*VI_bmBQp6s-fR5SrluXU@ z*XN0Bdv{9)|5(LXS%SAL+pG3MjM=D=>DOfO4gVpnnn#WlZE)E@%J;S5``@0^i;sQ} zv;4Koyse3LuC6ZKw7^cwbWHfKAow2ga-&Wiyk8sC(f6Uqe)l_*@(HgSsu$S>exQo- zO$yfLX3Meps*z`kxf-S&($=__D!9*j8ksBT_WlY$Q8R62WL1v)RI4M5`F={+_6GfV zDfnN%EfjU?%l=i{wf$`P3V~iXer*jNq#4Zrm5>Vk*sP>{ zQ|x&eE?3-nb^JtbC+<&r+pmAAFAa;q2td_d&1T?iK~XAg^dI(;Dx0(NtPB_%*6vL#Pih~;X7uj2YH4n)K?2r7ig?asgK8n-OTx}dINUXyYE6( z$GpFpFK6A>HGjpMg$k~IGUlIepDUV|ho2L5fhz)**dD-*q$Wu~M#L!8KRebgG*-eEcgo2KVcOQDLa$|y z=f2FiG`_u9Sv%?5IogNmb;395X384hIVr7Sx37%~*lG4Jt>q7MNUL{cO=906pJ=|& z?IJ&5@@7lBdnh1%HwCAQSQW3S^Wuvq5^lS#`e1gj0r0oKD92Y~cz&(m7Rd@K&U`>* z*h6=^!Zmt*Bhl+_Vz-!AMMZEmTkYgVkF$~3YQB}#iL5LZp6)sxR(_qCd5r@ZtODK2 zyoSCph9`~|^Kbc9x>Gw;YcX~X*L!LLDo%gpm?^wg1!YKI-?>xHzwuk^3B4r*ou_{Y zX6*1cD}N9woPEf0@oNDjcobc$_R?u7AgBZM_TsPN&lTV1M ze0zChZ}c~<%g$9PKg&Rtw;?%kunhN&#T&LCUux_ZH zE|@Q<)nZO+M9jj!>XBR^7)#Hrp3WHWfDM&eI$$Q=M_WY4Vsxt(8~3WfqtigYWJRf< zpeVaQI7yXTQ}c4|hHeyBtwV%Ls*uM|)sTcg!o@D(^LI>M@uuG?(Eh#_TR3B(1A>rb zqfe(mF^J3%5bAi3TZ`LvFC{v}rbE72_sN?y2$+c3nXEOX9podtVFvjmv2JLrWU%+Ku9Ng=2 zPd}GU!je^((B_PRz_<^e5qsz|1*Z;_<1HN zv?LA$LlX>#(XSbWwlDko)dL#1`1WOXHO(9$;5B?(taF<>>$S3>?5YLLcH8XyXtr+A z`g*(XBUcJRk)wqONkZ>#f7-y>L$-XDp^>WN?^Lqi-^w5}{^8_)Bnp{I4GA`UWlcRV zjfrQG3)Mk0Ts<77oa~!U{q?Q}4_uflpjIONkAti>XfS)ry*S9%i**j3)ApE-qtyzJt%Se0 z;^vw+^#saSp2BQPf)wy&CKo)E-B6#jkXQTli&mtBb2mbNhZZbEiyXA&lh^cw8>gb7 z$nMCdm)4Kg9QtNX+#Ri`?%cSC&v@lS{Axo2zAszAdICG}-P}>W^3w!b>p7YU>IGa$sN;nV!gLfJeD^|y#x$}CD9>08e^Rue_!sT^xfP z)UBi8kj$2}vOZ23yE#haE}Lxax4N>cw%%c&dOZB{u!9?2)^LqN#%1g$2IJ^^^ijh#b?FD_R5WBpx9gMTK>j)Brw?aB*d)?YvM=tu82a?n zKCh2~nSHm;Gyf0OW_sS})`(;k?mC{Z>-qZ4(n`Y)DR?@mSZ%}Po8vvzeDM=~y|ed! zt$J0E8+cHB-zPvSMgyGWl~!qAx0q!eXz`~yy5RQe?X6)aGI&>dKKN9$_4}mWbn_ZH zsN(6FxO$^kJL}&kxNoKhvQFU(?%8lWOg=uZ(K(Ml0hJbuQ90Y$<#d6$7pUZ!@6zha zTQJVB+Hhodk(>U+rNu=}BR zA34an<@xoi(;|fy%U^>`xek4s5Qs~V*wzS(+0T{Y7j6L^1fl7Nj0%BjAIB_{J_zO* z6QT}Q6reWG0S%%LfB{%&XQ#auFWtbwqWrO~!VYpZI?+uK3*@XjVGfW%cdYnYkh z!F_IYRP92M3g!j45NXJ0%!bFzjV#KUuGDJ|+Q+dS1`QKcKA}V9>%SPV-7G-?r6A!KPT|?mMi#V(a4SiG|e@f->idKV|gwMP*vf zglP(I+OAp$)qhanJ%eJ}zp9$lnmo^2@XV*`CwP;h)3DhfH5VhsE_?I1plFciU*-- z1=8yG>SRiA?++2;(gD|zQ^zs@QhEZ#f%s1$1O*G7kxV$b-{l;k*)#BNhV@`jGHYM! z!l1B92hr~`{f`LN2Q`QHyvy! zizJ{KD!Sd#JN`rogSMr0=o@Ht)3t)b1jSIL`~n_9$bR(~iDcU>Cyei=`*Cv>yUIEz zg2Vlc#fDmiTK$T*N{!$lw;`a;Y5Q0TgX=eeDJaa!WK-WqepAAm1rvmyyHzr?tcC|Q z<%YzwCHp!*m|Irrc;e~A#l^L)mrFR{9r?0jTGYNpX4l)NW?2QE??%BxPwkp3TGI1p zYTs)eI&v(1``|l1-t1>X94#fzM=Y$hQlPYk|GLg()lcf#o4bUg75}a3oST?z+e#`~ z@8t2G$ShfA!r*To7XK?4EC6{~iElbxaMG%zhP!#OXMJAtld1{zch3hj#H(u?XQl@K znjDXg?;I>wddM#O{ll3~MuGN-cH3w@DS73M`GP<+x4u7ftmjQIP8yq)6FPQIQ+tiN zaj++`m2WLek#2N&TPW%5LSTh=Td;o7?Z_)hs$_z*svs0}Q74s(HETJdE130NUIN2n`FDRl8EcPTErhe z68TL;^^y&e=O7F=Di-fzNs4e5~^Mj4bACk@tC9Gz-I4Q+)TPYHq1-S zAPdmPoT9-j5D`gBOWWoH)n*xhOn0r(N}XvCAA5Ej&=~)LYM_cb$U1k)h);Y1s7}sf z7vVW$?wWzk%1Y7>wgj)=T;3a_&Wc=l6%PzKB*5j{ z*f3rbnJ;M`gbuP6XJs8}I*U3^(RmD3G*Fg5{ki6ea+3L^*?6S>```3C9+(9vl1?5B zK7BA4+S*G7Lsx~# z&YwJS%FE(IrEz(>pjce~-ui{I`<(!=zDBMst$8+D=V;gl=w!_A-BYdZ(IWQ}pc5zW z893L%xbD_=Wp(5s)kzr2J?=W0!<^WqJ%_|Ip%jL1PuS1|G6)39P*H>5ksdG-O9jcq z4A4;m7v1UC_f}{D{|2OCF$tqU3DAP#BfPUtHY+bEaCNS)E<%ZPP*P|Bx=i#HD7yY| z2!b;|;a>saDJx|wC#8uqPjAOG|MB@4$g34%_7X+;)RN?21`lAF1H0s?P2C710IEJH z;34yTi-irr2dcA3RF7BtZ3~oVb6b<;8s?T2*Rt4A(cT(cd=352!(IDn8HaL%`Ae>& zmdbY_(}gNEk1q5C+}-9|Fh-r8^I@*fGj;o67`Cz?yuKOc_8UK5cO&MOP0F#9j#df@+^2X>n3m zM5N&?ol^WoJ)}hom?VTFF~YRULi1?zWp^k+ZUGfjD-hBRPqEG|*9I-ga56U~J#T<$m~VQb|P`ey&QD9 z);Ih>r5F$wqg>8lB19@zl~COo#3`c8CO6jRx?L+4*=%}0$Zl@TZDLXN8A@^>i3#P` zmZD0Mjpfk%>J>gdKBzmkLk-gbp*h+%;vd2yoK?&G z#2;kG_mvhDpX7629~ytJU9PTdo{e-EZoXUi%7#>k6|TvhOfM-J2_G4WeuGU;OB=AV z9GuR463Kl2ZU*2U!aIKac#D=90{Ly<3K&8%!q})(Jm^+*bo4azO&1WAu>^sd0EPYfv*HG#Kuefh(^_*E)6kCtaLGhzO6X|f zE;+xGx*^|u`9f-cTfC)>b4p6PC4v?pRDiH`*BO8)jXR3v7?3mz3GuB$Dq zk@QQ)m6+Lc@y`tF2(z08aLuX_%9h|WE*=_4XB{y*QoK#79pABMkw5q#pSpp;tNdK& z{~I#T3N?hEFK6O8?vm@YE`ueC@Wg%-#f~5sOMkIU{Qqf@XWMk7-QVo9lot!_;x{&z zW`#wu#P5qMbFbT{Y>i5st@Xlf{Lnx2~sM?}?$0l(*W?BWuiA zkn%z6Rf4nVMJL_nP*qYTV*Ebns`a>4iE@KfRNB_vYzM-oL-67^P;A(`8ve zbZP26^x?p&?w%vNGgYS7GS!*9<2Nl$3pAZed?!|=r8oYB6+ot-&PnsD!7E7T;lFH& zxj%=0Hl|%wiBbt48OWymr7(6Hs7#p!IWhrPnoJnBcN2snF6L(0hg52ILGL8MPytLV z3kXp4ix-i0D^M21?T7s;79w*&cSAmY!g8p>8|g_OtvP$rKMt^)H>A1&%u(PvXY9S! zKh%}$OR|oW_B9Sa0NU!nGqjo;EJrH-KzKj7?K!wTO-)U86WkJ?>T(AoPg%;AJ&$3B z`+M0<32jQt{>-1qxY*qJ$fn`!0|z-$$J}{noPba?02m-3ABizda!{<)bBlA>gg4d~xq26SOK>kL~Rk5#~xq(`9T;O zYeXt2N!eOimE5y%zjJ4l$-oto*YK;ZNQ#U+8Fw6wlh~M8;85h;2Lh<=>g-{z$%dk`l>I?rQR8zb;ZE!&!|TSz8g=FZlu>D6nB`@fURNU(@bExG z9D!LLTh?rE_;AvC|8%<45)FGvN9MT!BD@1|L@lk`+1gX*97;x=a-N!K!{JmqkI9?a zM}-l4%|p~p^@THk=C?6%_p}D3FIP;{!#6T8Wf~};z}~-gSa9pcCsC|vY?^WN$A$$fO#eb%Xi~Vw!z^y` zweN7Wzjk@=}q=f}uYE572x(dIiu#6(p)b6*}> z{P%T-Sw3P7)Lh%m1(~^C$ipvR`S6q08v?Zs>x$bNosGUsO>G_ea_4Lvsy!_JZ9W|G zVB^!uL$Gb0bLBuu^zH+M7}FC zOn^^-3Ah4%aqYWe?%E5;(ATJ5tU51=eDvb+gUD4P zgB|Thu59j;SLcszN5HnOE^QJ%UAhy1ZFq1}q2#)rLQO+caHp2RdrBjruJlc9xS`$K%nvZgky5L6F7RK6suOtV-Oih&<%SPu z$^noC{I}?wI#WULQPPq8ds5OdfP6`7aPCusTnz%|AoeVHe&ExrnN947J2dQYIPeY* zv-n8);n#I8xY|u)a>=CXEy&THDCDczxn!0Bc6%Uv)BdJge7ZjkBidZsfozy=FY2WS z?8D5wJfQYD!}=i0$?N`BG1`-^92Y(+3Y&T-TqX7dA2Wkny4E*3NkiV&zPS;1@c~ms8SncWYpC#vJwz6keklyf zwYZ;&{Kl-$%6KJqKBzuR$7fWiAF!TLsd?_{GR{pGC|{7D`m$ZR(0cl-x@VPKhe_<@ zt#MKidFE2OJ>}I4$p~(}*e(-p`qIiuKk;i?)RWcWp*j3yJ9>0$>&0k*-vUT$csQ~0 zfN1FG^~d_oJG>qha}qA}v`LJPApi2L33;`mamn1wX#PO`1bl*sA8mXABRUc<)k6m%&|9 zVQI((%e#@5T9daw4Ec(x(gwUfn9r|mWMd;6$PUv2Hi&2dEhhs`6#02z=8=;0{3n_M z=V|Sbr%!PZh!GN4M1e3+S|Zl7c#)G?5V&X*O= zWih!>A3y!)cV4rVsp-{(mCvX0eK&nbKMz&50AMc}n$?g1ao&MA%IJObsov}E3i)!g zdGRc(Ou5nt@x3gIDD&dy9z?dSd9Z9IZ_HUTUz?v`h*01X78clvHw=5c%DVAs9PGA= zG%3FVpDHkkYfbKZcgvsL!2!7JJ}HQo4Dh4qxcx%l!(lByjonEW+F%lmPj3%lF36}i zL1Xlb?Zorz+n1xzoZlXbx<%CxzmXWH1L=#nMGk&ferzwA6=mcrz1U#v)gJ-`5B|;3Ve@d9lz%^9h-@Ni?bS%=DrH`5CM%aBOwEXD>dzaxA@Y ziQk#eh#AL+-S_zOST_c)=c83kGi@uL^9zIsi1D70`lZH0n}$WkJqNp@r6u3`;-u1| zqX{Z5z7d`@*X_#rxa4?$I{$k%7>TN97pbtV<+L^OhYDQj+He7PKZ0Y<=${|k>-rI#7P3b7Z-Yd} zhWhXgP{uX`A>Yr3PUGCq$grRe^#UvMu~50_md zk)L6hZl9uUmq531*2$=k-;xl^-r3awgbQD0vlQJkR;^Q=f(qx)hj<;QdVDwU#g=dV z9PXE-H+qhHPuxkJ-1aPH)kHCzj@g6D)sT?n;ftguUsBMaXHNk<@h%2AAJiT%i}{^B z^92mw&>s=0Q%)zDMLe(D@=Ih8(`jH}l=GO1GrXbB+A^~IZcYA{N4|TAYi1EChoYCQ zIj_2+7P4n4zJ(L?&P#32d=euA)tdqIPJoQXg#| zGLpQr<Ayn?WCuo$V1M#= z(a_|tefpjE`mr1FuguFDM$1>WJ^LO@KSi1+5jV{3+IIJ!AWq4tST471EHn9)<)@ek z`?D{iUBpk3GF8m0pX(DUysvmqC{z0c^BPSp>E;#6fr0?AKQ{z_sY0KVvO;Z{Y&+E% z`+AdjVQ3Jjm6YiAo^vfQMBKNZjkqyUk}F1a&J?#^bxHPNAe_4D24!=7y({2~xaaKC z8+n4W>aelsf3%1Jfq<-3#S+ak2T6)&X`Xy}qYX&%z8TlL(|I6%GTFQ z=<`Z)Itx6ysZ0%YO*ZiJ<69ol#f0;}7FA9s16%^MG&B~SH!s5pZ!W$3a6{$Dg+ZQL z_h@gg2VY-USxpH=v9+x(-jf!JzSrNC)ub#oAX(3K@EgyLQP=N0k)~o?vW7Z$c1uK9 z>m^Ft>L)rm%Mb_B9`I-AR9aoktd>YdbGsecpeHY&vr<8>ccbqLEe7RcZz@B-i#Q2a z?KwkHoxM(y7|U1LV3qi0b<>DMQJKbx>+f|to}?;jNzl|Zn5%2q-q0$3|A*n3vxsG) zXWr7#kF>1dJAw`OO3C>OtU~~_JM$A0e*dNO@#q@w-C$mM7Pf){(k$SV`rc?-%~G2; zn*&+(y~S03>+Z(M`GpwG$Riq@(Hh?(iJ|PN!3fVc|MxxZma}pu&WtWxY&M}4s&&X8 z-Kf-1SyuYK{L&0gQM82NbsAD;#!d^+#EzHLZ)}*1b#|{Q!U?L%D3v9#L$m>y*?VR- z4ylU$h6S*4;*|_wjvnhTBq`2s0c>b?X~~$&vPDXcl6KOt$v)jL76q}Ptl?@*OXPwd zB{O7*jE&FlkSG1v+QOjDym4EbO6wqT@q>H4ysF@Z)Q2*3+V*2BW?wNiYIZgE3oFUC z)l8XLBM{6@eM*$+6lHcglBFxA{Z!}BvWu*<=k+#wD^*F6Fd7b{II>CQdbtIKHzg&S zr8cEa&UVmD?_?CahS8P5|!@sY` zDacm0NUilc)2CWGD9RC@KZ*r;hoKM=EyH181zMhtE#a1U@!WDj8)XJwGElU+cSo7k z6`t=~>{DDYtTn;zT>AD-3O^#3PiXRlxSqE*^SkfFJviN}rh?+!M-4mDczIT43*Tot zcfqAuHAmB{+B>NI(Wu{`l+SyiEAZ5`gpR|u#&nj3P^-p1_JTrwRi4P>D<75N5er%~ zY|AE3rfTP?5qe(w%FA+J%Z?PqT#9*r?yftWhiZ;usLTK@0WPYzgO~3YpLYh_V;vP1 znJzyz?eb@ua)8Qu&zT?v4rHg?aebGDocbT7GA^E_Z?Al+e0$q1=^61bMaugxcp=il z`3BAMT<7XWJ5&G6^Y`smR<_-8(i`reBcNSSR8Ws?;fs;thAwJ(;p8D#2c?avOax?BC^-C1&%~8TaGw`89?&gWR;0aGElFL=USqhzh<2mcC>uOu6 z!p0W7Qwkey)34v#np7e&+mTr+ol=5--@HC4JtTc3hDKh%0c8RU;9q5DBrGSz1?Ja}$ z67cf{8{OPkn|=(|GtVkWW5bN;RC~*H%Gv1uo(;^Lxa6C`c02j3^%j}v2Vo(SuDBD7 z8wNJBgDIg)427j7oUa;r_T{uiDT&l=%x`1qX^|Az8g@HhKX`dvtvA{@g)C70@h?gR zvI1AVy-DI;xUeT*Sk}j%m<9mf?VXDMfcL^ICjY~o$ZOZG{j%wnd#|er(Pp1Bue0Lv z1)JX=375p_?eT0V6bEgVUF=Q6v(-rZ*49jEl2;!KUTX7pdZhetb&&GCfF%^wRj*5;N==I7M@ZW2T znw7wG$5wXtMKPX^oYDEj{K`-wR%J5q6-W024oU32GcLW0nzSY4?Rc4jEHUHT_ZT^Xy>7Y7wvt0OtaL?)(~PJhN^Ow5}Z7>m{Yd3Q8p%cD_I zkh6Hwbu~Y+T+P*{SVzKco4GbZ`crPtD`vJ$fQ`@ zATBYebf@tOX;ENKW3IOHc&^y7Y}I*zT`4eiAJ@XVZ-q#ke?=fB{w(<<_yw1UXvE@*J>V0wv<8CTsBtZ} zt%-)c>+7t9X@AWI*ZsDZo;M=#n>jwc_&Wq=#%wWHo1|LJ{R14+3~#mWabmx3sP!@% zOeW>Oegy1YbII)vta4;NbjU#)E|w#m?>}k;@6XOpu?*I?idGQRa$M+Ub-A(App&Op zp0u7*YbH%J>g*}>l}|Kf`CkDO1nm17)$zt2WnS5>a{~i(c>n+a08;$*W~ ztzNxK_wD$2ptre-#TvBl<(Krsp(mvWuWnnbt8p=!mMp2Wf01Gr2ejn#|Q7F+wix;oxXEZU;O2mhyD zTUMp)raKkQ1T*+3Myu8G<^g4QzpN8y&ni}-L)rlV0D$+4&;tMf02Rk^97UrM-Fn*{ zy8AaCCdyTH!($i`w?`qJ;T@44p`NhJJb0001B-Xrt? z002Nm%IEWHZ)??^+wRlGp5SeB6^l3MpTGHx{^`sAq~`R@2OiUzE(D1W*2}Y8#fIwT z8J=Pn&7q+UE&0f$idcUsB$G;J{ZLV^4F|{Aur_An`b?(B28STIU z0000g1)&E3001ghI-S<~_3Hw+&DF#lkN;8gq;#9EYmUeDm>Pmia;2I}?+ikUs&O!( zT*%he*FK`IwwqOQ^IA~1LaygXk_^L;q0r>%B_}UQvl4PlXJVVHm%2*QmU{!U&6N`l zt0tM0_w%3V#JO{9YXtxR0K5x-=wX`XWViZMgdP9@00^8QZgUl_uGO1+Ueyl=W_FIp z2PGG_HEOwf;2$5-?LD8K(K#F+l*XDxI`ryy^{ac=DAwE-h;6R2v6z;=_&e?U-)w6I z0002Im#LwLX`0%#YnKikI&?+wG5uz}0000$8M7=)narr(Jotw8@7=9ftiive?3jk3 z1JArHeYpGs4@rs^V$!8%kdj*{`@lnzQrSMOzy0&t^7H3390~i&Wv3Xe)}jOZH1y^n znf2xWI{^Ry0F(>EFm&X|5m}a{s;a8Xz6d=4000n3kw`>upYGM`dtXt1-zkN|mnL$T zp@zm59e(~*z4pW*)t0yf{~(R#Q@Y{i$F<-`k1Jc|TSb|ktI-#KueW-8nd1Qf003MA z*LAgR+cup&d)8kf^Z)<=KycO9*X#8+_UYKsH&k6y>o1puSgb*BJpWsL-};`k_)-T2 zJ}?DmOpW!+wYmBs)$Ms%xw`WFd1qrWE&RW`)qC Date: Thu, 20 Aug 2026 13:06:57 +0200 Subject: [PATCH 10/71] Resolve ValidConnectorIds conflict, restore HoneyForge entry --- .../ValidConnectorIds.json | 679 +++++++++--------- 1 file changed, 347 insertions(+), 332 deletions(-) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index c79a8f69a06..950dd0e8094 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -1,332 +1,347 @@ -[ - "AbnormalSecurityPush", - "Netclean_ProActive_Incidents", - "42CrunchAPIProtection", - "FortyTwoCrunchAPIProtection", - "AIVectraDetect", - "AIVectraStream", - "VectraXDR", - "AWS", - "AWSS3", - "AWSSecurityHub", - "Agari", - "AkamaiSecurityEvents", - "AlcideKAudit", - "AlsidForAD", - "Anvilogic", - "Armorblox", - "ApacheHTTPServer", - "ApacheTomcat", - "ARGOSCloudSecurity", - "AristaAwakeSecurity", - "ASimDnsActivityLogs", - "ArubaClearPass", - "AzureActiveDirectory", - "AzureActiveDirectoryIdentityProtection", - "AzureActivity", - "AzureAdvancedThreatProtection", - "AzureFirewall", - "AzureInformationProtection", - "AzureKeyVault", - "AzureKubernetes", - "AzureMonitor(IIS)", - "AzureMonitor(VMInsights)", - "AzureMonitor(WireData)", - "AzureNSG", - "AzureSecurityCenter", - "AzureSql", - "AzureStorageAccount", - "Barracuda", - "BarracudaCloudFirewall", - "BetterMTD", - "BehaviorAnalytics", - "BeyondSecuritybeSECURE", - "Bitglass", - "BitSight", - "BlackberryCylancePROTECT", - "blacklens_io", - "BloodHoundEnterprise", - "BoschAIShield", - "BoxDataConnector", - "BroadcomSymantecDLP", - "CEF", - "CheckPoint", - "CiscoASA", - "CiscoAsaAma", - "CiscoDuoSecurity", - "CiscoFirepowerEStreamer", - "CiscoISE", - "CiscoMeraki", - "CiscoSDWAN", - "CiscoSecureEndpoint", - "CiscoSEG", - "CiscoUCS", - "CiscoUmbrellaDataConnector", - "CiscoWSA", - "Citrix", - "CitrixWAF", - "Claroty", - "CloudflareDataConnector", - "CognniSentinelDataConnector", - "ContrastProtect", - "Corelight", - "CrowdStrikeFalconEndpointProtection", - "CyberArk", - "CyberArkEPM", - "CyberpionSecurityLogs", - "CynerioSecurityEvents", - "DDOS", - "DNS", - "Darktrace", - "DarktraceRESTConnector", - "DataminrPulseAlerts", - "Dataverse", - "DatawizaDapSolution", - "DigitalGuardianDLP", - "DigitalShadows", - "DragosSitestoreCCP", - "Dynamics365", - "Dynamics365Finance", - "EgressDefend", - "ESETEnterpriseInspector", - "ESETPROTECT", - "EsetSMC", - "ESI-ExchangeAdminAuditLogEvents", - "ExtraHopNetworks", - "F5", - "F5BigIp", - "FieldEffectCCF", - "Flare", - "ForcepointCasb", - "ForcepointDlp", - "ForcepointNgfw", - "ForgeRock", - "Fortinet", - "FortiWeb", - "GCPDNSDataConnector", - "GoogleSCCDefinition", - "GWorkspaceRAPI", - "GoogleWorkspaceReportsAPI", - "GoogleThreatIntelligenceRelevanceSystemAlertsAPI", - "GravityZoneDataConnector", - "GreyNoise2SentinelAPI", - "IdentityInfo", - "ibossAma", - "ImpervaWAFCloudAPI", - "ImpervaWAFGateway", - "ImportedConnector", - "InfobloxCloudDataConnector", - "InfobloxNIOS", - "IoT", - "JamfProtect", - "JiraAuditAPI", - "JuniperSRX", - "KeeperSecurityPush2", - "LastPass", - "LookoutAPI", - "LumenThreatFeedConnector", - "McAfeeePO", - "MicrosoftAzurePurview", - "MicrosoftCloudAppSecurity", - "MicrosoftCopilot", - "MicrosoftDefenderAdvancedThreatProtection", - "MicrosoftSysmonForLinux", - "MicrosoftThreatProtection", - "MimecastSEGAPI", - "MorphisecCCF", - "NasuniEdgeAppliance", - "NXLogDnsLogs", - "NXLogLinuxAudit", - "Netskope", - "Office365", - "OfficeATP", - "OktaSSO", - "OktaSSOv2", - "OnapsisPlatform", - "OneIdentity", - "OCILogs", - "OracleDatabaseAudit", - "OracleCloudInfraConnector", - "OracleCloudInfrastructureLogsConnector", - "OracleWebLogicServer", - "OrcaSecurityAlerts", - "PaloAltoCDL", - "PaloAltoNetworks", - "PaloAltoPrismaCloud", - "Pathlock_TDnR", - "Perimeter81ActivityLogs", - "PingFederate", - "PostgreSQL", - "PowerAutomate", - "PowerPlatformAdmin", - "PRODAFTUstaATPCCPDefinition", - "ProofpointPOD", - "ProofpointTAP", - "ProofpointTAPNativePoller", - "ProofpointTAPv2", - "PulseConnectSecure", - "QscoutAppEventsCCFDefinition", - "QualysKB", - "QualysVulnerabilityManagement", - "RedCanaryDataConnector", - "RedSiftPush", - "RubrikSecurityCloudAzureFunctions", - "SailPointIdentityNow", - "SailPointIdentityNowConnector", - "SalesforceServiceCloud", - "SalesforceServiceCloudCCPDefinition", - "SAP", - "SAPBTPAuditEvents", - "SAPLogServ", - "SAPETDAlerts", - "SecurityEvents", - "SemperisDSP", - "SenservaPro", - "SentinelOne", - "SlackAuditAPI", - "Snowflake", - "SonicWallFirewall", - "SonraiDataConnector", - "SophosCloudOptix", - "SophosXGFirewall", - "StealthTalkAnomalousAuth", - "SquadraTechnologiesSecRmm", - "SquidProxy", - "Symantec", - "SymantecEndpointProtection", - "SymantecProxySG", - "SymantecVIP", - "Syslog", - "Tenable.ad", - "TenableVM", - "TenableIE", - "ThreatIntelligence", - "ThreatIntelligenceTaxii", - "ThreatIntelligenceUploadIndicatorsAPI", - "DelineaSecretServer_CEF", - "TrendMicro", - "TrendMicroApexOne", - "TrendMicroCAS", - "TrendMicroTippingPoint", - "TrendMicroXDR", - "UbiquitiUnifi", - "vArmourAC", - "VMwareCarbonBlack", - "vCenter", - "VMwareESXi", - "VMwareSDWAN", - "WAF", - "WindowsFirewall", - "WindowsForwardedEvents", - "WireX_Systems_NFP", - "ZimperiumMtdAlerts", - "Zscaler", - "ZscalerPrivateAccess", - "illusiveAttackManagementSystem", - "WindowsSecurityEvents", - "IronNetIronDefense", - "GCPIAMDataConnector", - "Illusive", - "NGINXHTTPServer", - "ZeroNetworksSegmentAuditFunction", - "ZeroNetworksSegmentAuditNativePoller", - "Theom", - "Votiro", - "ISCBind", - "DynatraceRuntimeVulnerabilities", - "DynatraceAttacks", - "DynatraceAuditLogs", - "DynatraceProblems", - "Authomize", - "MicrosoftDefenderThreatIntelligence", - "ZeroFox_Alert_Polling", - "CortexXDR", - "CortexXDRDataConnector", - "CorelightConnectorExporter", - "MimecastSIEMAPI", - "MimecastTTPAPI", - "MimecastAuditAPI", - "PingFederateAma", - "vArmourACAma", - "ContrastProtectAma", - "InfobloxCloudDataConnectorAma", - "ClarotyAma", - "illusiveAttackManagementSystemAma", - "TrendMicroApexOneAma", - "PaloAltoCDLAma", - "CiscoSEGAma", - "AtlassianBeaconAlerts", - "GCPAuditLogsDefinition", - "PrancerLogData", - "MicrosoftDefenderForCloudTenantBased", - "RidgeBotDataConnector", - "ValenceSecurity", - "HoneyForge", - "HVPollingIDAzureFunctions", - "CBSPollingIDAzureFunctions", - "AzureCloudNGFWByPaloAltoNetworks", - "PaloAltoNetworksAma", - "FortinetAma", - "CrowdStrikeFalconEndpointProtectionAma", - "AIVectraDetectAma", - "ZscalerAma", - "SyslogAma", - "FortinetFortiWebAma", - "InfobloxSOCInsightsDataConnector_API", - "InfobloxSOCInsightsDataConnector_Legacy", - "InfobloxSOCInsightsDataConnector_AMA", - "NetskopeDataConnector", - "NetskopeWebTransactionsDataConnector", - "NetskopeAlertEventsConnector", - "CefAma", - "WindowsFirewallAma", - "1Password", - "RadiflowIsid", - "CustomLogsAma", - "SilverfortAma", - "IllumioSaaSDataConnector", - "CTERA", - "Workday", - "SamsungDCDefinition", - "CommvaultSecurityIQ_CL", - "ExtraHop", - "ContrastADR", - "CyfirmaAttackSurfaceAlertsConnector", - "CyfirmaBrandIntelligenceAlertsDC", - "CyfirmaDigitalRiskAlertsConnector", - "CyfirmaVulnerabilitiesIntelDC", - "CyfirmaCyberIntelligenceDC", - "VeeamCustomTablesDataConnector", - "CyfirmaCompromisedAccountsDataConnector", - "RSAIDPlus_AdminLogs_Connector", - "FilewallM365", - "TacitRedThreatIntel", - "CyrenThreatIntel", - "CybleVisionAlerts", - "VersasecCms", - "VisaThreatIntelligence", - "KnowBe4Defend", - "CTM360CBSConnectorDefinition", - "CTM360HackerViewConnectorDefinition", - "XbowSecurityConnector", - "NetskopeWebTxConnector", - "SOCPrimeAuditLogsDataConnector", - "ContrastADRCCF", - "DarktraceActiveAISecurityPlatform", - "CheckPointCyberintAlerts", - "CheckPointCyberintIOC", - "CheckpointHECConnection", - "D3SOARConnectorDefinition", - "ValimailEnforce", - "VaikoraSentinel", - "VaikoraSecurityCenter", - "UniFiSiteManagerConnectorDefinition", - "UtimacoESKMConnector", - "GSDetectionAlerts", - "VaikoraSecurityCenter", - "VaikoraO365", - "GambitSecurityPush", - "TailscaleCCF", - "TailscalePremiumCCF", - "WhisperSecurityConnector" -] +[ + "AbnormalSecurityPush", + "HoneyForge", + "Netclean_ProActive_Incidents", + "42CrunchAPIProtection", + "FortyTwoCrunchAPIProtection", + "AIVectraDetect", + "AIVectraStream", + "VectraXDR", + "AWS", + "AWSS3", + "AWSSecurityHub", + "Agari", + "AkamaiSecurityEvents", + "AlcideKAudit", + "AlsidForAD", + "Anvilogic", + "Armorblox", + "ApacheHTTPServer", + "ApacheTomcat", + "ARGOSCloudSecurity", + "AristaAwakeSecurity", + "ASimDnsActivityLogs", + "ArubaClearPass", + "AzureActiveDirectory", + "AzureActiveDirectoryIdentityProtection", + "AzureActivity", + "AzureAdvancedThreatProtection", + "AzureFirewall", + "AzureInformationProtection", + "AzureKeyVault", + "AzureKubernetes", + "AzureMonitor(IIS)", + "AzureMonitor(VMInsights)", + "AzureMonitor(WireData)", + "AzureNSG", + "AzureSecurityCenter", + "AzureSql", + "AzureStorageAccount", + "Barracuda", + "BarracudaCloudFirewall", + "BetterMTD", + "BehaviorAnalytics", + "BeyondSecuritybeSECURE", + "Bitglass", + "BitSight", + "BlackberryCylancePROTECT", + "blacklens_io", + "BloodHoundEnterprise", + "BoschAIShield", + "BoxDataConnector", + "BroadcomSymantecDLP", + "CEF", + "CheckPoint", + "CiscoASA", + "CiscoAsaAma", + "CiscoDuoActivityConnectorDefinition", + "CiscoDuoAuthConnectorDefinition", + "CiscoDuoSecurity", + "CiscoFirepowerEStreamer", + "CiscoISE", + "CiscoMeraki", + "CiscoSDWAN", + "CiscoSecureEndpoint", + "CiscoSEG", + "CiscoUCS", + "CiscoUmbrellaDataConnector", + "CiscoWSA", + "Citrix", + "CitrixWAF", + "Claroty", + "CloudflareDataConnector", + "CognniSentinelDataConnector", + "ContrastProtect", + "Corelight", + "CrowdStrikeFalconEndpointProtection", + "CyberArk", + "CyberArkEPM", + "CyberpionSecurityLogs", + "CynerioSecurityEvents", + "DDOS", + "DNS", + "Darktrace", + "DarktraceRESTConnector", + "DataminrPulseAlerts", + "Dataverse", + "DatawizaDapSolution", + "DigitalGuardianDLP", + "DigitalShadows", + "DomainTools", + "DragosSitestoreCCP", + "Dynamics365", + "Dynamics365Finance", + "EgressDefend", + "ESETEnterpriseInspector", + "ESETPROTECT", + "EsetSMC", + "ESI-ExchangeAdminAuditLogEvents", + "ExtraHopNetworks", + "F5", + "F5BigIp", + "FieldEffectCCF", + "Flare", + "ForcepointCasb", + "ForcepointDlp", + "ForcepointNgfw", + "ForgeRock", + "Fortinet", + "FortiWeb", + "GCPDNSDataConnector", + "GoogleSCCDefinition", + "GWorkspaceRAPI", + "GoogleWorkspaceReportsAPI", + "GoogleThreatIntelligenceRelevanceSystemAlertsAPI", + "GravityZoneDataConnector", + "GreyNoise2SentinelAPI", + "IdentityInfo", + "ibossAma", + "ImpervaWAFCloudAPI", + "ImpervaWAFGateway", + "ImportedConnector", + "InfobloxCloudDataConnector", + "InfobloxNIOS", + "IoT", + "JamfProtect", + "JiraAuditAPI", + "JuniperSRX", + "KeeperSecurityPush2", + "LastPass", + "LookoutAPI", + "LumenThreatFeedConnector", + "McAfeeePO", + "MicrosoftAzurePurview", + "MicrosoftCloudAppSecurity", + "MicrosoftCopilot", + "MicrosoftDefenderAdvancedThreatProtection", + "MicrosoftSysmonForLinux", + "MicrosoftThreatProtection", + "MimecastSEGAPI", + "MorphisecCCF", + "NasuniEdgeAppliance", + "NXLogDnsLogs", + "NXLogLinuxAudit", + "Netskope", + "Office365", + "OfficeATP", + "OktaSSO", + "OktaSSOv2", + "OnapsisPlatform", + "OneIdentity", + "OCILogs", + "OracleDatabaseAudit", + "OracleCloudInfraConnector", + "OracleCloudInfrastructureLogsConnector", + "OracleWebLogicServer", + "OrcaSecurityAlerts", + "PaloAltoCDL", + "PaloAltoNetworks", + "PaloAltoPrismaCloud", + "Pathlock_TDnR", + "Perimeter81ActivityLogs", + "PingFederate", + "PostgreSQL", + "PowerAutomate", + "PowerPlatformAdmin", + "PRODAFTUstaATPCCPDefinition", + "PRODAFTUstaPCFICCPDefinition", + "ProofpointPOD", + "ProofpointTAP", + "ProofpointTAPNativePoller", + "ProofpointTAPv2", + "PulseConnectSecure", + "QscoutAppEventsCCFDefinition", + "QualysKB", + "QualysVulnerabilityManagement", + "RedCanary_ConnectorDefinition", + "RedCanaryDataConnector", + "RedSiftPush", + "RubrikSecurityCloudAzureFunctions", + "SailPointIdentityNow", + "SailPointIdentityNowConnector", + "SalesforceServiceCloud", + "SalesforceServiceCloudCCPDefinition", + "SAP", + "SAPBTPAuditEvents", + "SAPLogServ", + "SAPETDAlerts", + "SecurityEvents", + "SemperisDSP", + "SenservaPro", + "SentinelOne", + "SlackAuditAPI", + "Snowflake", + "SonicWallFirewall", + "SonraiDataConnector", + "SophosCloudOptix", + "SophosXGFirewall", + "StealthTalkAnomalousAuth", + "SpyCloudEnterpriseProtectionCCF", + "SquadraTechnologiesSecRmm", + "SquidProxy", + "Symantec", + "SymantecEndpointProtection", + "SymantecProxySG", + "SymantecVIP", + "Syslog", + "Tenable.ad", + "TenableVM", + "TenableIE", + "ThreatIntelligence", + "ThreatIntelligenceTaxii", + "ThreatIntelligenceUploadIndicatorsAPI", + "DelineaSecretServer_CEF", + "TrendAIVisionOneOAT", + "TrendAIVisionOneWorkbench", + "TrendMicro", + "TrendMicroApexOne", + "TrendMicroCAS", + "TrendMicroTippingPoint", + "TrendMicroXDR", + "UbiquitiUnifi", + "vArmourAC", + "VMwareCarbonBlack", + "vCenter", + "VMwareESXi", + "VMwareSDWAN", + "WAF", + "WindowsFirewall", + "WindowsForwardedEvents", + "WireX_Systems_NFP", + "ZimperiumMtdAlerts", + "Zscaler", + "ZscalerPrivateAccess", + "illusiveAttackManagementSystem", + "WindowsSecurityEvents", + "IronNetIronDefense", + "GCPIAMDataConnector", + "Illusive", + "NGINXHTTPServer", + "ZeroNetworksSegmentAuditFunction", + "ZeroNetworksSegmentAuditNativePoller", + "Theom", + "Votiro", + "ISCBind", + "DynatraceRuntimeVulnerabilities", + "DynatraceAttacks", + "DynatraceAuditLogs", + "DynatraceProblems", + "Authomize", + "MicrosoftDefenderThreatIntelligence", + "ZeroFox_Alert_Polling", + "CortexXDR", + "CortexXDRDataConnector", + "CorelightConnectorExporter", + "MimecastSIEMAPI", + "MimecastTTPAPI", + "MimecastAuditAPI", + "PingFederateAma", + "vArmourACAma", + "ContrastProtectAma", + "InfobloxCloudDataConnectorAma", + "ClarotyAma", + "illusiveAttackManagementSystemAma", + "TrendMicroApexOneAma", + "PaloAltoCDLAma", + "CiscoSEGAma", + "AtlassianBeaconAlerts", + "GCPAuditLogsDefinition", + "PrancerLogData", + "MicrosoftDefenderForCloudTenantBased", + "RidgeBotDataConnector", + "ValenceSecurity", + "HVPollingIDAzureFunctions", + "CBSPollingIDAzureFunctions", + "AzureCloudNGFWByPaloAltoNetworks", + "PaloAltoNetworksAma", + "FortinetAma", + "CrowdStrikeFalconEndpointProtectionAma", + "AIVectraDetectAma", + "ZscalerAma", + "SyslogAma", + "FortinetFortiWebAma", + "InfobloxSOCInsightsDataConnector_API", + "InfobloxSOCInsightsDataConnector_Legacy", + "InfobloxSOCInsightsDataConnector_AMA", + "NetskopeDataConnector", + "NetskopeWebTransactionsDataConnector", + "NetskopeAlertEventsConnector", + "CefAma", + "WindowsFirewallAma", + "1Password", + "RadiflowIsid", + "CustomLogsAma", + "SilverfortAma", + "IllumioSaaSDataConnector", + "CTERA", + "Workday", + "SamsungDCDefinition", + "CommvaultSecurityIQ_CL", + "CommvaultSecurityIQConnector", + "ExtraHop", + "ContrastADR", + "CyfirmaAttackSurfaceAlertsConnector", + "CyfirmaBrandIntelligenceAlertsDC", + "CyfirmaDigitalRiskAlertsConnector", + "CyfirmaVulnerabilitiesIntelDC", + "CyfirmaCyberIntelligenceDC", + "VeeamCustomTablesDataConnector", + "CyfirmaCompromisedAccountsDataConnector", + "RSAIDPlus_AdminLogs_Connector", + "FilewallM365", + "TacitRedThreatIntel", + "CyrenThreatIntel", + "SpeculusThreatIntel", + "CybleVisionAlerts", + "VersasecCms", + "VisaThreatIntelligence", + "KnowBe4Defend", + "CTM360CBSConnectorDefinition", + "CTM360HackerViewConnectorDefinition", + "XbowSecurityConnector", + "NetskopeWebTxConnector", + "SOCPrimeAuditLogsDataConnector", + "ContrastADRCCF", + "DarktraceActiveAISecurityPlatform", + "CheckPointCyberintAlerts", + "CheckPointCyberintIOC", + "CheckpointHECConnection", + "D3SOARConnectorDefinition", + "ValimailEnforce", + "VaikoraSentinel", + "VaikoraSecurityCenter", + "UniFiSiteManagerConnectorDefinition", + "UtimacoESKMConnector", + "GSDetectionAlerts", + "VaikoraSecurityCenter", + "VaikoraO365", + "GambitSecurityPush", + "TailscaleCCF", + "TailscalePremiumCCF", + "WhisperSecurityConnector", + "CayosoftGuardianConnector", + "VaronisSaaSAlertsPush", + "RecordedFutureIdentityAlertImporter", + "VectraRUXConnector", + "cybereinforce_cte" +] \ No newline at end of file From 52c738df3e67d95ff056b2266ac3e1752132f86d Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Fri, 21 Aug 2026 14:36:21 +0200 Subject: [PATCH 11/71] Fix parser: convert FunctionParams block scalar to ParserParams list format --- .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 34 ++++++++++++++----- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index 293215c0dd6..f7068572401 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -10,15 +10,31 @@ Function: FunctionName: HoneyForgeEvent FunctionAlias: HoneyForgeEvent Category: Microsoft Sentinel Parser -FunctionParams: | - starttime:datetime=datetime(null), - endtime:datetime=datetime(null), - srcipaddr_has_any_prefix:dynamic=dynamic([]), - dstipaddr_has_any_prefix:dynamic=dynamic([]), - ipaddr_has_any_prefix:dynamic=dynamic([]), - dstportnumber:int=int(null), - hostname_has_any:dynamic=dynamic([]), - disabled:bool=false +ParserParams: + - Name: starttime + Type: datetime + Default: datetime(null) + - Name: endtime + Type: datetime + Default: datetime(null) + - Name: srcipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: dstipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: ipaddr_has_any_prefix + Type: dynamic + Default: dynamic([]) + - Name: dstportnumber + Type: int + Default: int(null) + - Name: hostname_has_any + Type: dynamic + Default: dynamic([]) + - Name: disabled + Type: bool + Default: false FunctionQuery: | CommonSecurityLog | where not(disabled) From 33fabdd08048d938e77e81b64d4cfbdda96cb495 Mon Sep 17 00:00:00 2001 From: Ryno Seegers Date: Tue, 25 Aug 2026 06:00:49 +0200 Subject: [PATCH 12/71] Fix parser: add top-level FunctionName/FunctionAlias for KQL validator --- Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index f7068572401..51bffcde9fc 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -10,6 +10,8 @@ Function: FunctionName: HoneyForgeEvent FunctionAlias: HoneyForgeEvent Category: Microsoft Sentinel Parser +FunctionName: HoneyForgeEvent +FunctionAlias: HoneyForgeEvent ParserParams: - Name: starttime Type: datetime From 3ea397e070537adce0be1c7b2f9989d9e681bd26 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 25 Aug 2026 06:52:17 +0200 Subject: [PATCH 13/71] Update HoneyForge.json --- Solutions/HoneyForge/Data Connectors/HoneyForge.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Solutions/HoneyForge/Data Connectors/HoneyForge.json b/Solutions/HoneyForge/Data Connectors/HoneyForge.json index 043c17c338b..a56fc1d4a46 100644 --- a/Solutions/HoneyForge/Data Connectors/HoneyForge.json +++ b/Solutions/HoneyForge/Data Connectors/HoneyForge.json @@ -2,7 +2,7 @@ "id": "HoneyForge", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -87,7 +87,7 @@ "innerSteps": [ { "title": "1.1 — Install the Log Analytics agent and CEF collector", - "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { "parameters": { @@ -125,4 +125,4 @@ ] } ] -} \ No newline at end of file +} From 91d710f17703441bd8e1310f1b3904f8d6e9f7ec Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 25 Aug 2026 06:53:37 +0200 Subject: [PATCH 14/71] Update mainTemplate.json --- Solutions/HoneyForge/Package/mainTemplate.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index cca3d266154..9d6fdd814c3 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -197,7 +197,7 @@ "id": "[variables('_uiConfigId1')]", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -280,7 +280,7 @@ "innerSteps": [ { "title": "1.1 — Install the Log Analytics agent and CEF collector", - "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { "parameters": { @@ -403,7 +403,7 @@ "connectorUiConfig": { "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "graphQueries": [ { "metricName": "Total events received", @@ -484,7 +484,7 @@ "innerSteps": [ { "title": "1.1 — Install the Log Analytics agent and CEF collector", - "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Sentinel workspace values.", + "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { "parameters": { From d6a21bc0ea5ab6798cbafea7323aaca943e0891b Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 25 Aug 2026 07:11:34 +0200 Subject: [PATCH 15/71] Update createUiDefinition.json --- Solutions/HoneyForge/Package/createUiDefinition.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Solutions/HoneyForge/Package/createUiDefinition.json b/Solutions/HoneyForge/Package/createUiDefinition.json index 20365ea6904..0d3916ee4d2 100644 --- a/Solutions/HoneyForge/Package/createUiDefinition.json +++ b/Solutions/HoneyForge/Package/createUiDefinition.json @@ -104,13 +104,13 @@ { "name": "workbook1", "type": "Microsoft.Common.Section", - "label": null, + "label": "HoneyForge", "elements": [ { "name": "workbook1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": null + "text": "This solution installs the HoneyForge workbook to gain insights into deception sensor events." } } ] From 227ccd5217a3bcc673b4f696a3a19c9fe34722db Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 25 Aug 2026 07:13:43 +0200 Subject: [PATCH 16/71] Update mainTemplate.json --- Solutions/HoneyForge/Package/mainTemplate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index 9d6fdd814c3..d26c9f2f694 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -30,7 +30,7 @@ }, "workbook1-name": { "type": "string", - "defaultValue": null, + "defaultValue": "HoneyForge", "minLength": 1, "metadata": { "description": "Name for the workbook" From 70f40134d7960d63da5d9bc1fba7b25bfbd51778 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Wed, 26 Aug 2026 06:08:58 +0200 Subject: [PATCH 17/71] Update ValidConnectorIds.json --- .../detectionTemplateSchemaValidation/ValidConnectorIds.json | 2 -- 1 file changed, 2 deletions(-) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 690275525e0..b232d6ce54e 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -352,6 +352,4 @@ "VectraRUXConnector", "cybereinforce_cte", "HoneyForge" -] - "cybereinforce_cte" ] From c9efb02361a54a0237a5ff189d570ef9b5319895 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Wed, 26 Aug 2026 08:07:14 +0200 Subject: [PATCH 18/71] Update HoneyForgeEvent.yaml --- .../HoneyForge/Parsers/HoneyForgeEvent.yaml | 87 ++++--------------- 1 file changed, 17 insertions(+), 70 deletions(-) diff --git a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml index 51bffcde9fc..159a02985a8 100644 --- a/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml +++ b/Solutions/HoneyForge/Parsers/HoneyForgeEvent.yaml @@ -39,26 +39,9 @@ ParserParams: Default: false FunctionQuery: | CommonSecurityLog - | where not(disabled) | where DeviceVendor =~ "BUI" | where DeviceProduct =~ "HoneyForge" - // Time filter - | where (isnull(starttime) or TimeGenerated >= starttime) - | where (isnull(endtime) or TimeGenerated <= endtime) - // IP prefix filters - | where (array_length(srcipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(SourceIP, srcipaddr_has_any_prefix)) - | where (array_length(dstipaddr_has_any_prefix) == 0 or has_any_ipv4_prefix(DestinationIP, dstipaddr_has_any_prefix)) - | where (array_length(ipaddr_has_any_prefix) == 0 - or has_any_ipv4_prefix(SourceIP, ipaddr_has_any_prefix) - or has_any_ipv4_prefix(DestinationIP, ipaddr_has_any_prefix)) - // Port filter - | where (isnull(dstportnumber) or toint(DestinationPort) == dstportnumber) - // Sensor name filter - | extend _SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)) - | where (array_length(hostname_has_any) == 0 or _SensorName has_any (hostname_has_any)) - // ASIM field mappings | extend - // Event metadata EventVendor = "BUI", EventProduct = "HoneyForge", EventProductVersion = tostring(DeviceVersion), @@ -66,64 +49,28 @@ FunctionQuery: | EventSchemaVersion = "0.2.6", EventType = "NetworkSession", EventResult = "NA", + EventCount = int(1), EventStartTime = TimeGenerated, EventEndTime = TimeGenerated, - EventCount = toint(1), - EventOriginalUid = tostring(ExtID), - EventOriginalType = tostring(DeviceEventClassID), EventSeverity = case( - toint(LogSeverity) >= 9, "Critical", - toint(LogSeverity) >= 7, "High", - toint(LogSeverity) >= 4, "Medium", - "Low"), - EventOriginalSeverity = tostring(LogSeverity), - EventMessage = tostring(Activity), - // Source + LogSeverity == "10", "High", + LogSeverity == "7", "Medium", + LogSeverity == "4", "Low", + "Informational"), + NetworkProtocol = case( + Protocol == "6", "TCP", + Protocol == "17", "UDP", + Protocol == "1", "ICMP", + tostring(Protocol)), SrcIpAddr = tostring(SourceIP), SrcPortNumber = toint(SourcePort), - // Destination (the sensor) DstIpAddr = tostring(DestinationIP), DstPortNumber = toint(DestinationPort), - DstHostname = _SensorName, - // Network - NetworkProtocol = tostring(Protocol), - NetworkDirection = "Inbound", - // Device (sensor) + DstHostname = tostring(DestinationHostName), DvcHostname = tostring(Computer), - DvcId = tostring(DeviceCustomString1), - DvcIdType = "Other", - // HoneyForge-specific custom fields (retained for hunting) - HoneyForgeSensorID = tostring(DeviceCustomString1), - HoneyForgeCustomerID = tostring(DeviceCustomString2), - HoneyForgeSensorName = _SensorName - | project-away _SensorName - | project - TimeGenerated, - EventVendor, - EventProduct, - EventProductVersion, - EventSchema, - EventSchemaVersion, - EventType, - EventResult, - EventSeverity, - EventOriginalSeverity, - EventOriginalUid, - EventOriginalType, - EventMessage, - EventStartTime, - EventEndTime, - EventCount, - SrcIpAddr, - SrcPortNumber, - DstIpAddr, - DstPortNumber, - DstHostname, - NetworkProtocol, - NetworkDirection, - DvcHostname, - DvcId, - DvcIdType, - HoneyForgeSensorID, - HoneyForgeCustomerID, - HoneyForgeSensorName + DvcAction = "Detect", + AdditionalFields = bag_pack( + "SensorName", iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)), + "CustomerID", tostring(DeviceCustomString2), + "ThreatName", tostring(Activity), + "RuleID", tostring(DeviceEventClassID)) From 1ec7dbb4a39b1fc0324f3179da63835b995c69eb Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:22:25 +0200 Subject: [PATCH 19/71] Delete Sample Data/ASIM/Fortinet_Fortigate_WebSession_IngestedLogs.csv --- ...inet_Fortigate_WebSession_IngestedLogs.csv | 30 ------------------- 1 file changed, 30 deletions(-) delete mode 100644 Sample Data/ASIM/Fortinet_Fortigate_WebSession_IngestedLogs.csv diff --git a/Sample Data/ASIM/Fortinet_Fortigate_WebSession_IngestedLogs.csv b/Sample Data/ASIM/Fortinet_Fortigate_WebSession_IngestedLogs.csv deleted file mode 100644 index c5320b89456..00000000000 --- a/Sample Data/ASIM/Fortinet_Fortigate_WebSession_IngestedLogs.csv +++ /dev/null @@ -1,30 +0,0 @@ -TenantId,TimeGenerated [UTC],DeviceVendor,DeviceProduct,DeviceVersion,DeviceEventClassID,Activity,LogSeverity,AdditionalExtensions,DeviceAction,Protocol,ApplicationProtocol,DeviceExternalID,DeviceInboundInterface,DeviceOutboundInterface,DestinationHostName,DestinationPort,DestinationIP,DeviceName,Message,SourceIP,Computer,RequestURL,Type -test-tenant-id,"12/2/2024, 5:35:25.263 PM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0316013056,webfilter utm passthrough,5,"start=Dec 02 2024 18:35:21;logver=700140601;vd=root;eventtime=1733160922753130687;tz=""+0100"";logid=0315012545;subtype=webfilter;eventtype=urlfilter;deviceSeverity=information;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test1;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=CONNECT|User-Agent=Mozilla/5.0 (Linux Android 10 K)",passthrough,6,HTTPS,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost,443,146.59.231.198,test-host,URL was exempted because it is in the URL filter list,192.168.1.2,test-host,https://accounts.google.com/,CommonSecurityLog -test-tenant-id,"12/9/2024, 9:54:59.935 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 10:54:58;logver=700140601;vd=root;eventtime=1733738099387945126;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test2;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost1,80,142.250.200.3,test-host,URL belongs to an allowed category in policy,192.168.1.5,test-host,http://www.google.eu/,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:57.662 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:56;logver=700140601;vd=root;eventtime=1733738576673815547;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test22;ad.agent=test1;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost2,80,142.250.65.227,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:57.662 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:56;logver=700140601;vd=root;eventtime=1733738576673815547;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test21;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost3,80,142.250.65.227,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:57.662 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:56;logver=700140601;vd=root;eventtime=1733738576673815547;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test14;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost4,80,142.250.65.227,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 9:54:58.821 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0318012801,webfilter utm passthrough,6,"start=Dec 09 2024 10:54:57;logver=700140601;vd=root;eventtime=1733738097548935397;tz=""+0100"";logid=0318012801;subtype=webfilter;eventtype=ftgd_err;deviceSeverity=warning;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test15;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost5,80,172.217.168.195,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 9:54:58.821 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0318012801,webfilter utm passthrough,6,"start=Dec 09 2024 10:54:57;logver=700140601;vd=root;eventtime=1733738097548935397;tz=""+0100"";logid=0318012801;subtype=webfilter;eventtype=ftgd_err;deviceSeverity=warning;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test14;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost6,80,172.217.168.195,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:20.139 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:18;logver=700140601;vd=root;eventtime=1733738539033428721;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test154;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=HEAD|User-Agent=Mozilla/5.0 (X11 Linux aarch64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost7,80,142.250.187.195,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:01.276 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:01:58;logver=700140601;vd=root;eventtime=1733738518753360834;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test3;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost8,80,172.217.17.67,test-host,URL belongs to an allowed category in policy,192.168.2.10,test-host,http://gstatic.com/,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:58.897 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:52;logver=700140601;vd=root;eventtime=1733738577040919079;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test32;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost9,80,142.250.187.195,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:59.044 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 20:02:54;logver=700140601;vd=root;eventtime=1733738576522657421;tz=""+1000"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test332;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost10,80,142.250.66.195,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:52.496 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:48;logver=700140601;vd=root;eventtime=1733738570438330090;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test34;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost11,80,184.28.84.242,test-host,URL belongs to an allowed category in policy,192.168.50.2,test-host,http://apple.com/,CommonSecurityLog -test-tenant-id,"12/9/2024, 9:57:56.865 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0315012545,webfilter utm passthrough,4,"start=Dec 09 2024 10:57:51;logver=700140601;vd=root;eventtime=1733738273866871021;tz=""+0100"";logid=0315012545;subtype=webfilter;eventtype=urlfilter;deviceSeverity=information;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test354;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost12,80,184.28.84.242,test-host,URL belongs to an allowed category in policy,192.168.7.2,test-host,http://captive.apple.com/,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:06.245 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:04;logver=700150632;vd=root;eventtime=1733738525613152583;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test355;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (Windows NT 10.0 Win64 x64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/132.0.0.0",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost13,80,13.107.6.158,test-host,URL belongs to an allowed category in policy,192.168.70.8,test-host,http://edge-http.microsoft.com/captiveportal/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 10:02:58.897 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 11:02:52;logver=700140601;vd=root;eventtime=1733738577040919079;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test655;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost14,80,142.250.187.195,test-host,URL belongs to an allowed category in policy,192.168.1.2,test-host,http://connectivitycheck.gstatic.com/generate_204,CommonSecurityLog -test-tenant-id,"12/9/2024, 9:54:59.935 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 10:54:58;logver=700140601;vd=root;eventtime=1733738099387945126;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test65;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost15,80,142.250.200.3,test-host,URL belongs to an allowed category in policy,192.168.1.5,test-host,http://www.google.eu/,CommonSecurityLog -test-tenant-id,"12/9/2024, 9:54:59.935 AM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0317013312,webfilter utm passthrough,5,"start=Dec 09 2024 10:54:58;logver=700140601;vd=root;eventtime=1733738099387945126;tz=""+0100"";logid=0317013312;subtype=webfilter;eventtype=ftgd_allow;deviceSeverity=notice;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test6;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;rawdata=Method=GET|User-Agent=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246",passthrough,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost16,80,142.250.200.3,test-host,URL belongs to an allowed category in policy,192.168.1.8,test-host,http://www.google.eu/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:42:44.113 PM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0316013056,webfilter utm blocked,6,"start=Jan 17 2025 13:42:39;logver=700140601;vd=root;eventtime=1737117762101183062;tz=""+0100"";logid=0316013056;subtype=webfilter;eventtype=ftgd_blk;deviceSeverity=warning;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test9;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Ireland;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;method=domain;rawdata=Method=GET|User-Agent=Dalvik/2.1.0 (Linux U Android 11 SM-G398FN Build/RP1A.200720.012)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost17,80,54.171.6.170,test-host,URL belongs to a denied category in policy,192.168.1.123,test-host,http://vas.samsungapps.com/stub/stubUpdateCheck.as?appId=com.samsung.android.timezone.data_R&callerId=com.samsung.android.timezone.updater,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:44:04.992 PM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0316013056,webfilter utm blocked,6,"start=Jan 17 2025 13:44:02;logver=700140601;vd=root;eventtime=1737117843843068354;tz=""+0100"";logid=0316013056;subtype=webfilter;eventtype=ftgd_blk;deviceSeverity=warning;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test37;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;method=domain;rawdata=Method=GET|User-Agent=User-Agent=Mozilla/5.0 (X11 Linux x86_64)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost18,80,147.154.111.115,test-host-1,URL belongs to a denied category in policy,192.168.10.3,test-host-1,http://members.dyndns.org/nic/update?,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:43:17.795 PM",Fortinet,FortiGate-101E,"7.0.14,build0601 (GA)",0316013056,webfilter utm blocked,6,"start=Jan 17 2025 13:43:13;logver=700140601;vd=root;eventtime=1737117793266256995;tz=""+0100"";logid=0316013056;subtype=webfilter;eventtype=ftgd_blk;deviceSeverity=warning;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test07;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Italy;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;method=domain;rawdata=Method=GET|User-Agent=Dalvik/2.1.0 (Linux U Android 10 Infinix X657C Build/QP1A.190711.020)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost19,80,108.156.2.5,test-host,URL belongs to a denied category in policy,192.168.10.2,test-host,http://cdn2.palmplaystore.com/static/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:43:13.541 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:43:11;logver=700140601;vd=root;eventtime=1737117791693404190;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test09;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost20,80,35.186.224.24,test-host-0,URL was blocked because it is in the URL filter list,192.168.10.10,test-host-0,http://apresolve.spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:41:00.517 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:40:58;logver=700140601;vd=root;eventtime=1737117659303179290;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test99;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost21,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.11.2,test-host,http://apresolve.spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:41:00.517 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:40:58;logver=700140601;vd=root;eventtime=1737117659303179290;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test98;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost22,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.11.2,test-host,http://apresolve.spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:41:00.517 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:40:58;logver=700140601;vd=root;eventtime=1737117659303179290;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test88;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost23,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.11.2,test-host,http://apresolve.spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:41:00.517 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:40:58;logver=700140601;vd=root;eventtime=1737117659303179290;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test04;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost24,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.11.2,test-host,http://apresolve.spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:44:45.476 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:44:42;logver=700140601;vd=root;eventtime=1737117883815016430;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test91;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost25,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.1.125,test-host,http://spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:44:03.717 PM",Fortinet,FortiGate-101F,"7.0.14,build0601 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:44:01;logver=700140601;vd=root;eventtime=1737117842461868550;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test88;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=United States;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=GET",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost26,80,35.186.224.24,test-host,URL was blocked because it is in the URL filter list,192.168.2.126,test-host,http://apresolve.spotify.com/,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:45:34.181 PM",Fortinet,FortiGate-101E,"7.0.15,build0632 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:45:32;logver=700150632;vd=root;eventtime=1737117933643454960;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test78;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Germany;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=POST|Request-Content-Type=application/x-www-form-urlencoded|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost27,80,3.79.215.191,test-host-2,URL was blocked because it is in the URL filter list,192.168.70.123,test-host-2,http://global.quickconnect.to/Serv.php,CommonSecurityLog -test-tenant-id,"1/17/2025, 12:45:34.181 PM",Fortinet,FortiGate-101E,"7.0.15,build0632 (GA)",0315012544,webfilter utm blocked,6,"start=Jan 17 2025 13:45:32;logver=700150632;vd=root;eventtime=1737117933643454960;tz=""+0100"";logid=0315012544;subtype=webfilter;eventtype=urlfilter;deviceSeverity=warning;urlfilteridx=1;urlfilterlist=filterlist;policyid=000;poluuid=00000000-0000-0000-0000-000000000000;policytype=policy;externalID=000000000;ad.agent=test766;srccountry=Reserved;srcintfrole=lan;srcuuid=00000000-0000-0000-0000-000000000000;dstcountry=Germany;dstintfrole=wan;dstuuid=00000000-0000-0000-0000-000000000000;profile=Webfilter;reqtype=direct;direction=outgoing;urlsource=Local URLfilter Block;crscore=30;craction=8;crlevel=high;rawdata=Method=POST|Request-Content-Type=application/x-www-form-urlencoded|User-Agent=Mozilla/5.0 (X11 Linux x86_64)",blocked,6,HTTP,test-fortigate-device,test-inbound-vlan,test-outbound-vlan,testhost28,80,3.79.215.191,test-host-2,URL was blocked because it is in the URL filter list,192.168.70.123,test-host-2,http://global.quickconnect.to/Serv.php,CommonSecurityLog From 82347869a1990a76ed4ff30d99b2474153bf9c21 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:24:31 +0200 Subject: [PATCH 20/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DCR.json --- .../Data Connectors/CortexXDR_ccp/DCR.json | 833 ------------------ 1 file changed, 833 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DCR.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DCR.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DCR.json deleted file mode 100644 index c6662072880..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DCR.json +++ /dev/null @@ -1,833 +0,0 @@ -{ - "name": "CortexXdrDCR", - "apiVersion": "2021-09-01-preview", - "type": "Microsoft.Insights/dataCollectionRules", - "location": "[parameters('workspace-location')]", - "kind": null, - "properties": { - "streamDeclarations": { - "Custom-CortexXdrStreamIncidents": { - "columns": [ - { - "name": "incident_id", - "type": "string" - }, - { - "name": "incident_name", - "type": "string" - }, - { - "name": "creation_time", - "type": "long" - }, - { - "name": "modification_time", - "type": "long" - }, - { - "name": "detection_time", - "type": "long" - }, - { - "name": "status", - "type": "string" - }, - { - "name": "severity", - "type": "string" - }, - { - "name": "description", - "type": "string" - }, - { - "name": "assigned_user_mail", - "type": "string" - }, - { - "name": "assigned_user_pretty_name", - "type": "string" - }, - { - "name": "alert_count", - "type": "int" - }, - { - "name": "low_severity_alert_count", - "type": "int" - }, - { - "name": "med_severity_alert_count", - "type": "int" - }, - { - "name": "high_severity_alert_count", - "type": "int" - }, - { - "name": "critical_severity_alert_count", - "type": "int" - }, - { - "name": "user_count", - "type": "int" - }, - { - "name": "host_count", - "type": "int" - }, - { - "name": "notes", - "type": "string" - }, - { - "name": "resolve_comment", - "type": "string" - }, - { - "name": "resolved_timestamp", - "type": "long" - }, - { - "name": "manual_severity", - "type": "string" - }, - { - "name": "manual_description", - "type": "string" - }, - { - "name": "xdr_url", - "type": "string" - }, - { - "name": "starred", - "type": "boolean" - }, - { - "name": "hosts", - "type": "dynamic" - }, - { - "name": "users", - "type": "dynamic" - }, - { - "name": "incident_sources", - "type": "dynamic" - }, - { - "name": "rule_based_score", - "type": "int" - }, - { - "name": "manual_score", - "type": "int" - }, - { - "name": "wildfire_hits", - "type": "int" - }, - { - "name": "alerts_grouping_status", - "type": "string" - }, - { - "name": "mitre_tactics_ids_and_names", - "type": "dynamic" - }, - { - "name": "mitre_techniques_ids_and_names", - "type": "dynamic" - }, - { - "name": "alert_categories", - "type": "dynamic" - }, - { - "name": "original_tags", - "type": "dynamic" - }, - { - "name": "tags", - "type": "dynamic" - } - ] - }, - "Custom-CortexXdrStreamManagement": { - "columns": [ - { - "name": "AUDIT_ID", - "type": "int" - }, - { - "name": "AUDIT_OWNER_NAME", - "type": "string" - }, - { - "name": "AUDIT_OWNER_EMAIL", - "type": "string" - }, - { - "name": "AUDIT_ASSET_JSON", - "type": "string" - }, - { - "name": "AUDIT_ASSET_NAMES", - "type": "string" - }, - { - "name": "AUDIT_HOSTNAME", - "type": "string" - }, - { - "name": "AUDIT_RESULT", - "type": "string" - }, - { - "name": "AUDIT_REASON", - "type": "string" - }, - { - "name": "AUDIT_DESCRIPTION", - "type": "string" - }, - { - "name": "AUDIT_ENTITY", - "type": "string" - }, - { - "name": "AUDIT_ENTITY_SUBTYPE", - "type": "string" - }, - { - "name": "AUDIT_SESSION_ID", - "type": "int" - }, - { - "name": "AUDIT_CASE_ID", - "type": "int" - }, - { - "name": "AUDIT_INSERT_TIME", - "type": "long" - }, - { - "name": "AUDIT_SEVERITY", - "type": "string" - }, - { - "name": "AUDIT_SOURCE_IP", - "type": "string" - }, - { - "name": "AUDIT_USER_AGENT", - "type": "string" - }, - { - "name": "AUDIT_USER_ROLES", - "type": "dynamic" - } - ] - }, - "Custom-CortexXdrStreamAgent": { - "columns": [ - { - "name": "TIMESTAMP", - "type": "long" - }, - { - "name": "RECEIVEDTIME", - "type": "long" - }, - { - "name": "ENDPOINTID", - "type": "string" - }, - { - "name": "ENDPOINTNAME", - "type": "string" - }, - { - "name": "DOMAIN", - "type": "string" - }, - { - "name": "TRAPSVERSION", - "type": "string" - }, - { - "name": "CATEGORY", - "type": "string" - }, - { - "name": "TYPE", - "type": "string" - }, - { - "name": "SUBTYPE", - "type": "string" - }, - { - "name": "RESULT", - "type": "string" - }, - { - "name": "REASON", - "type": "string" - }, - { - "name": "DESCRIPTION", - "type": "string" - } - ] - }, - "Custom-CortexXdrStreamEndpoint": { - "columns": [ - { - "name": "agent_id", - "type": "string" - }, - { - "name": "agent_status", - "type": "string" - }, - { - "name": "operational_status", - "type": "string" - }, - { - "name": "host_name", - "type": "string" - }, - { - "name": "agent_type", - "type": "string" - }, - { - "name": "ip", - "type": "dynamic" - }, - { - "name": "last_seen", - "type": "long" - }, - { - "name": "tags", - "type": "dynamic" - }, - { - "name": "users", - "type": "dynamic" - } - ] - }, - "Custom-CortexXdrStreamAlerts": { - "columns": [ - { - "name": "external_id", - "type": "string" - }, - { - "name": "severity", - "type": "string" - }, - { - "name": "matching_status", - "type": "string" - }, - { - "name": "end_match_attempt_ts", - "type": "long" - }, - { - "name": "local_insert_ts", - "type": "long" - }, - { - "name": "bioc_indicator", - "type": "string" - }, - { - "name": "matching_service_rule_id", - "type": "string" - }, - { - "name": "attempt_counter", - "type": "int" - }, - { - "name": "is_whitelisted", - "type": "boolean" - }, - { - "name": "starred", - "type": "boolean" - }, - { - "name": "mitre_technique_id_and_name", - "type": "dynamic" - }, - { - "name": "mitre_tactic_id_and_name", - "type": "dynamic" - }, - { - "name": "agent_version", - "type": "string" - }, - { - "name": "agent_fqdn", - "type": "string" - }, - { - "name": "agent_os_type", - "type": "string" - }, - { - "name": "agent_data_collection_status", - "type": "boolean" - }, - { - "name": "mac", - "type": "string" - }, - { - "name": "alert_id", - "type": "string" - }, - { - "name": "detection_timestamp", - "type": "long" - }, - { - "name": "name", - "type": "string" - }, - { - "name": "category", - "type": "string" - }, - { - "name": "endpoint_id", - "type": "string" - }, - { - "name": "description", - "type": "string" - }, - { - "name": "host_ip", - "type": "string" - }, - { - "name": "host_name", - "type": "string" - }, - { - "name": "source", - "type": "string" - }, - { - "name": "action", - "type": "string" - }, - { - "name": "action_pretty", - "type": "string" - }, - { - "name": "causality_actor_causality_id", - "type": "string" - }, - { - "name": "causality_actor_process_command_line", - "type": "string" - }, - { - "name": "causality_actor_process_image_md5", - "type": "string" - }, - { - "name": "causality_actor_process_image_name", - "type": "string" - }, - { - "name": "causality_actor_process_image_path", - "type": "string" - }, - { - "name": "causality_actor_process_image_sha256", - "type": "string" - }, - { - "name": "causality_actor_process_signature_status", - "type": "string" - }, - { - "name": "identity_type", - "type": "string" - }, - { - "name": "operation_name", - "type": "string" - }, - { - "name": "cloud_provider", - "type": "string" - }, - { - "name": "resource_type", - "type": "string" - }, - { - "name": "cluster_name", - "type": "string" - }, - { - "name": "container_id", - "type": "string" - }, - { - "name": "action_country", - "type": "string" - }, - { - "name": "dns_query_name", - "type": "string" - }, - { - "name": "fw_email_recipient", - "type": "string" - }, - { - "name": "fw_email_sender", - "type": "string" - }, - { - "name": "fw_email_subject", - "type": "string" - }, - { - "name": "event_type", - "type": "string" - }, - { - "name": "action_file_macro_sha256", - "type": "string" - }, - { - "name": "action_file_md5", - "type": "string" - }, - { - "name": "action_file_name", - "type": "string" - }, - { - "name": "action_file_path", - "type": "string" - }, - { - "name": "action_file_sha256", - "type": "string" - }, - { - "name": "fw_rule_id", - "type": "string" - }, - { - "name": "fw_rule", - "type": "string" - }, - { - "name": "image_name", - "type": "string" - }, - { - "name": "actor_process_image_name", - "type": "string" - }, - { - "name": "actor_process_command_line", - "type": "string" - }, - { - "name": "actor_process_image_md5", - "type": "string" - }, - { - "name": "actor_process_image_path", - "type": "string" - }, - { - "name": "actor_process_os_pid", - "type": "int" - }, - { - "name": "actor_process_image_sha256", - "type": "string" - }, - { - "name": "actor_process_signature_status", - "type": "string" - }, - { - "name": "actor_process_signature_vendor", - "type": "string" - }, - { - "name": "actor_thread_thread_id", - "type": "string" - }, - { - "name": "action_local_ip", - "type": "string" - }, - { - "name": "action_local_port", - "type": "int" - }, - { - "name": "module_id", - "type": "string" - }, - { - "name": "os_actor_process_command_line", - "type": "string" - }, - { - "name": "os_actor_thread_thread_id", - "type": "string" - }, - { - "name": "os_actor_process_image_name", - "type": "string" - }, - { - "name": "os_actor_process_os_pid", - "type": "int" - }, - { - "name": "os_actor_process_image_sha256", - "type": "string" - }, - { - "name": "os_actor_process_signature_status", - "type": "string" - }, - { - "name": "os_actor_process_signature_vendor", - "type": "string" - }, - { - "name": "os_actor_effective_username", - "type": "string" - }, - { - "name": "action_process_signature_status", - "type": "string" - }, - { - "name": "action_process_signature_vendor", - "type": "string" - }, - { - "name": "action_registry_data", - "type": "dynamic" - }, - { - "name": "action_registry_full_key", - "type": "string" - }, - { - "name": "action_external_hostname", - "type": "string" - }, - { - "name": "action_remote_ip", - "type": "string" - }, - { - "name": "action_remote_port", - "type": "int" - }, - { - "name": "action_process_image_command_line", - "type": "string" - }, - { - "name": "action_process_image_name", - "type": "string" - }, - { - "name": "action_process_image_sha256", - "type": "string" - }, - { - "name": "fw_url_domain", - "type": "string" - }, - { - "name": "user_agent", - "type": "string" - }, - { - "name": "alert_domain", - "type": "string" - }, - { - "name": "event_id", - "type": "string" - }, - { - "name": "event_timestamp", - "type": "long" - }, - { - "name": "actor_process_instance_id", - "type": "string" - }, - { - "name": "actor_process_causality_id", - "type": "string" - }, - { - "name": "actor_causality_id", - "type": "string" - }, - { - "name": "action_registry_key_name", - "type": "string" - }, - { - "name": "action_registry_value_name", - "type": "string" - }, - { - "name": "action_local_ip_v6", - "type": "string" - }, - { - "name": "action_remote_ip_v6", - "type": "string" - }, - { - "name": "action_process_instance_id", - "type": "string" - }, - { - "name": "action_process_causality_id", - "type": "string" - }, - { - "name": "os_actor_process_image_path", - "type": "string" - }, - { - "name": "os_actor_process_causality_id", - "type": "string" - }, - { - "name": "os_actor_causality_id", - "type": "string" - }, - { - "name": "container_name", - "type": "string" - }, - { - "name": "namespace", - "type": "string" - }, - { - "name": "dst_action_external_hostname", - "type": "string" - }, - { - "name": "dst_action_external_port", - "type": "int" - }, - { - "name": "image_id", - "type": "string" - }, - { - "name": "malicious_urls", - "type": "dynamic" - }, - { - "name": "fw_is_phishing", - "type": "boolean" - }, - { - "name": "user_name", - "type": "string" - } - ] - } - }, - "destinations": { - "logAnalytics": [ - { - "workspaceResourceId": "[variables('workspaceResourceId')]", - "name": "clv2ws1" - } - ] - }, - "dataFlows": [ - { - "streams": [ - "Custom-CortexXdrStreamIncidents" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), IncidentId=incident_id, IncidentName=incident_name, CreationTime=datetime(1970-01-01) + (creation_time * 1ms), ModificationTime=datetime(1970-01-01) + (modification_time * 1ms), DetectionTime=datetime(1970-01-01) + (detection_time * 1ms), Status=status, Severity=severity, Description=description, AssignedUserMail=assigned_user_mail, assignedUserPrettyName=assigned_user_pretty_name, AlertCount=alert_count, LowSeverityAlertCount=low_severity_alert_count, MedSeverityAlertCount=med_severity_alert_count, HighSeverityAlertCount=high_severity_alert_count, CriticalSeverityAlertCount=critical_severity_alert_count, UserCount=user_count, HostCount=host_count, Notes=notes, ResolveComment=resolve_comment, ResolvedTimestamp=datetime(1970-01-01) + (resolved_timestamp * 1ms), ManualSeverity=manual_severity, ManualDescription=manual_description, XdrUrl=xdr_url, Starred=starred, Hosts=todynamic(hosts), Users=todynamic(users), IncidentSources=todynamic(incident_sources), RuleBasedScore=rule_based_score, ManualScore=manual_score, WildfireHits=wildfire_hits, AlertsGroupingStatus=alerts_grouping_status, MitreTacticsIdsAndNames=todynamic(mitre_tactics_ids_and_names), MitreTechniquesIdsAndNames=todynamic(mitre_techniques_ids_and_names), AlertCategories=todynamic(alert_categories), OriginalTags=todynamic(original_tags), Tags=todynamic(tags)", - "outputStream": "Custom-PaloAltoCortexXDR_Incidents_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamManagement" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), AuditId=AUDIT_ID, AuditOwnerName=AUDIT_OWNER_NAME, AuditOwnerEmail=AUDIT_OWNER_EMAIL, AuditAssetJSON=todynamic(AUDIT_ASSET_JSON), AuditAssetNames=AUDIT_ASSET_NAMES, AuditHostName=AUDIT_HOSTNAME, AuditResult=AUDIT_RESULT, AuditReason=AUDIT_REASON, AuditDescription=AUDIT_DESCRIPTION, AuditEntity=AUDIT_ENTITY, AuditEntitySubtype=AUDIT_ENTITY_SUBTYPE, AuditSessionId=AUDIT_SESSION_ID, AuditCaseId=AUDIT_CASE_ID, AuditInsertTime=datetime(1970-01-01) + (AUDIT_INSERT_TIME * 1ms), AuditSeverity=AUDIT_SEVERITY,AuditSourceIp=AUDIT_SOURCE_IP,AuditUserAgent=AUDIT_USER_AGENT,AuditUserRoles=todynamic(AUDIT_USER_ROLES)", - "outputStream": "Custom-PaloAltoCortexXDR_Audit_Management_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamAgent" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), Timestamp=datetime(1970-01-01) + (TIMESTAMP * 1ms), ReceivedTime=datetime(1970-01-01) + (RECEIVEDTIME * 1ms), EndpointId=ENDPOINTID, EndpointName=ENDPOINTNAME, Domain=DOMAIN, TrapsVersion=TRAPSVERSION, Category=CATEGORY, AgentType=TYPE, Subtype=SUBTYPE, Result=RESULT, Reason=REASON, Description=DESCRIPTION", - "outputStream": "Custom-PaloAltoCortexXDR_Audit_Agent_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamAlerts" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), ExternalId = external_id, Severity = severity, MatchingStatus = matching_status, EndMatchAttempt = datetime(1970-01-01) + (end_match_attempt_ts * 1ms), LocalInsert = datetime(1970-01-01) + (local_insert_ts * 1ms), BiocIndicator = bioc_indicator, AttemptCounter = attempt_counter, Whitelisted = is_whitelisted, Starred = starred, MitreTechniqueIdAndName = todynamic(mitre_technique_id_and_name), MitreTacticIdAndName = todynamic(mitre_tactic_id_and_name), AgentVersion = agent_version, AgentFQDN = agent_fqdn, AgentOSType = agent_os_type, AgentDataCollectionStatus = agent_data_collection_status, MacAddress = mac, AlertId = alert_id, DetectionTimestamp = datetime(1970-01-01) + (detection_timestamp * 1ms), Name = name, Category = category, EndpointId = endpoint_id, Description = description, HostIp = host_ip, HostName = host_name, Source = source, Action = action, ActionPretty = action_pretty, CausalityActorCausalityId = causality_actor_causality_id, CausalityActorProcessCommandLine = causality_actor_process_command_line, CausalityActorProcessImageMd5 = causality_actor_process_image_md5, CausalityActorProcessImageName = causality_actor_process_image_name, CausalityActorProcessImagePath = causality_actor_process_image_path, CausalityActorProcessImageSha256 = causality_actor_process_image_sha256, CausalityActorProcessSignatureStatus = causality_actor_process_signature_status, IdentityType = identity_type, OperationName = operation_name, CloudProvider = cloud_provider, ResourceType = resource_type, ClusterName = cluster_name, ContainerId = container_id, ActionCountry = action_country, DnsQueryName = dns_query_name, FwEmailRecipient = fw_email_recipient, FwEmailSender = fw_email_sender, FwEmailSubject = fw_email_subject, EventType = event_type, ActionFileMacroSha256 = action_file_macro_sha256, ActionFileMd5 = action_file_md5, ActionFileName = action_file_name, ActionFilePath = action_file_path, ActionFileSha256 = action_file_sha256, FwRuleId = fw_rule_id, FwRule = fw_rule, ImageName = image_name, ActorProcessImageName = actor_process_image_name, ActorProcessCommandLine = actor_process_command_line, ActorProcessImageMd5 = actor_process_image_md5, ActorProcessImagePath = actor_process_image_path, ActorProcessOsPid = actor_process_os_pid, ActorProcessImageSha256 = actor_process_image_sha256, ActorProcessSignatureStatus = actor_process_signature_status, ActorProcessSignatureVendor = actor_process_signature_vendor, ActorThreadThreadId = actor_thread_thread_id, ActionLocalIp = action_local_ip, ActionLocalPort = action_local_port, ModuleId = module_id, OsActorProcessCommandLine = os_actor_process_command_line, OsActorThreadThreadId = os_actor_thread_thread_id, OsActorProcessImageName = os_actor_process_image_name, OsActorProcessOsPid = os_actor_process_os_pid, OsActorProcessImageSha256 = os_actor_process_image_sha256, OsActorProcessSignatureStatus = os_actor_process_signature_status, OsActorProcessSignatureVendor = os_actor_process_signature_vendor, OsActorEffectiveUsername = os_actor_effective_username, ActionProcessSignatureStatus = action_process_signature_status, ActionProcessSignatureVendor = action_process_signature_vendor, ActionRegistryData = todynamic(action_registry_data), ActionRegistryFullKey = action_registry_full_key, ActionExternalHostname = action_external_hostname, ActionRemoteIp = action_remote_ip, ActionRemotePort = action_remote_port, MatchingServiceRuleId = matching_service_rule_id, ActionProcessImageCommandLine = action_process_image_command_line, ActionProcessImageName = action_process_image_name, ActionProcessImageSha256 = action_process_image_sha256, FwUrlDomain = fw_url_domain, UserAgent = user_agent, AlertDomain = alert_domain, EventId = event_id, EventTimestamp = datetime(1970-01-01) + (event_timestamp * 1ms), ActorProcessInstanceId = actor_process_instance_id, ActorProcessCausalityId = actor_process_causality_id, ActorCausalityId = actor_causality_id, ActionRegistryKeyName = action_registry_key_name, ActionRegistryValueName = action_registry_value_name, ActionLocalIpV6 = action_local_ip_v6, ActionRemoteIpV6 = action_remote_ip_v6, ActionProcessInstanceId = action_process_instance_id, ActionProcessCausalityId = action_process_causality_id, OsActorProcessImagePath = os_actor_process_image_path, OsActorProcessCausalityId = os_actor_process_causality_id, OsActorCausalityId = os_actor_causality_id, ContainerName = container_name, Namespace = namespace, DstActionExternalHostname = dst_action_external_hostname, DstActionExternalPort = dst_action_external_port, ImageId = image_id, MaliciousUrls = todynamic(malicious_urls), FwIsPhishing = fw_is_phishing, UserName = user_name", - "outputStream": "Custom-PaloAltoCortexXDR_Alerts_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamEndpoint" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), AgentId=agent_id, AgentStatus=agent_status, OperationalStatus=operational_status, HostName=host_name, AgentType=agent_type, IpAddress=ip, LastSeen=datetime(1970-01-01) + (last_seen * 1ms), Tags=todynamic(tags), Users=todynamic(users)", - "outputStream": "Custom-PaloAltoCortexXDR_Endpoints_CL" - } - - ], - "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" - } -} \ No newline at end of file From be524e529ea30419e6dbb5df760328df06398033 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:26:04 +0200 Subject: [PATCH 21/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json --- .../DataConnectorDefinition.json | 174 ------------------ 1 file changed, 174 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json deleted file mode 100644 index 976a39bd97f..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json +++ /dev/null @@ -1,174 +0,0 @@ -{ - "name": "CortexXDRDataConnector", - "apiVersion": "2022-09-01-preview", - "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", - "location": "{{location}}", - "kind": "Customizable", - "properties": { - "connectorUiConfig": { - "id": "CortexXDRDataConnector", - "title": "Palo Alto Cortex XDR", - "publisher": "Microsoft", - "descriptionMarkdown": "The [Palo Alto Cortex XDR](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/09agw06t5dpvw-cortex-xdr-rest-api) data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table so that queries don't need to parse it again, thus resulting in better performance.", - "graphQueries": [ - { - "metricName": "Total incident logs received", - "legend": "Palo Alto Cortex XDR incident Logs", - "baseQuery": "PaloAltoCortexXDR_Incidents_CL" - }, - { - "metricName": "Total Endpoint logs received", - "legend": "Palo Alto Cortex XDR endpoint Logs", - "baseQuery": "PaloAltoCortexXDR_Endpoints_CL" - }, - { - "metricName": "Total Audit Management logs received", - "legend": "Palo Alto Cortex XDR Audit Management Logs", - "baseQuery": "PaloAltoCortexXDR_Audit_Management_CL" - }, - { - "metricName": "Total Agent Audit logs received", - "legend": "Palo Alto Cortex XDR Agent Audit Logs", - "baseQuery": "PaloAltoCortexXDR_Audit_Agent_CL" - }, - { - "metricName": "Total Alert logs received", - "legend": "Palo Alto Cortex XDR Alert Logs", - "baseQuery": "PaloAltoCortexXDR_Alerts_CL" - } - ], - "sampleQueries": [ - { - "description": "Get Sample of Cortex XDR incident logs", - "query": "PaloAltoCortexXDR_Incidents_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR endpoint logs", - "query": "PaloAltoCortexXDR_Endpoints_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR alert logs", - "query": "PaloAltoCortexXDR_Alerts_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR Audit Management logs", - "query": "PaloAltoCortexXDR_Audit_Management_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR Agent Audit logs", - "query": "PaloAltoCortexXDR_Audit_Agent_CL| take 10" - } - ], - "dataTypes": [ - { - "name": "PaloAltoCortexXDR_Incidents_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Incidents_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Endpoints_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Endpoints_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Alerts_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Alerts_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Audit_Management_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Audit_Agent_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriteria": [ - { - "type": "HasDataConnectors", - "value": null - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "tenant": null, - "licenses": null, - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and Write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true, - "action": false - } - } - ] - }, - "instructionSteps": [ - { - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "#### Configuration steps for the Palo Alto Cortex XDR API \n Follow the instructions to obtain the credentials. you can also follow this [guide](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/3u3j0e7hcx8t1-get-started-with-cortex-xdr-ap-is) to generate API key." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "#### 1. Retrieve API URL\n 1.1. Log in to the Palo Alto Cortex XDR [**Management Console**] with Admin user credentials\n 1.2. In the [**Management Console**], click [**Settings**] -> [**Configurations**] \n 1.3. Under [**Integrations**] click on [**API Keys**].\n 1.4. In the [**Settings**] Page click on [**Copy API URL**] in the top right corner." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "#### 2. Retrieve API Token\n 2.1. Log in to the Palo Alto Cortex XDR [**Management Console**] with Admin user credentials\n 2.2. In the [**Management Console**], click [**Settings**] -> [**Configurations**] \n 2.3. Under [**Integrations**] click on [**API Keys**].\n 2.4. In the [**Settings**] Page click on [**New Key**] in the top right corner.\n 2.5. Choose security level, role, choose Standard and click on [**Generate**]\n 2.6. Copy the API Token, once it generated the [**API Token ID**] can be found under the ID column" - } - }, - { - "parameters": { - "label": "Base API URL", - "placeholder": "https://api-example.xdr.au.paloaltonetworks.com", - "type": "text", - "name": "apiUrl" - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "API Key ID", - "placeholder": "API ID", - "type": "text", - "name": "apiId" - }, - "type": "Textbox" - }, - { - "type": "Textbox", - "parameters": { - "label": "API Token", - "placeholder": "API Token", - "type": "password", - "name": "apiToken" - } - }, - { - "parameters": { - "label": "toggle", - "name": "toggle" - }, - "type": "ConnectionToggleButton" - } - ], - "innerSteps": null - } - ], - "isConnectivityCriteriasMatchSome": false - } - } -} \ No newline at end of file From d3df4207f826f58c258d6b285e35a3bf8678c72a Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:27:21 +0200 Subject: [PATCH 22/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/PollingConfig.json --- .../CortexXDR_ccp/PollingConfig.json | 221 ------------------ 1 file changed, 221 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/PollingConfig.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/PollingConfig.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/PollingConfig.json deleted file mode 100644 index 9d808349372..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/PollingConfig.json +++ /dev/null @@ -1,221 +0,0 @@ -[ - { - "type": "Microsoft.SecurityInsights/dataConnectors", - "apiVersion": "2021-10-01-preview", - "name": "CortexXdrAgent", - "location": "{{location}}", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Audit_Agent_CL", - "auth": { - "type": "APIKey", - "ApiKey": "{{apitoken}}", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "{{apiUrl}}/public_api/v1/audits/agents_reports", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "{{apiId}}" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'timestamp', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'timestamp', 'operator': 'lte', 'value': {_QueryWindowEndTime} } ], 'sort': { 'field': 'timestamp', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.data" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamAgent", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - }, - { - "type": "Microsoft.SecurityInsights/dataConnectors", - "apiVersion": "2021-10-01-preview", - "name": "CortexXdrAlerts", - "location": "{{location}}", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Alerts_CL", - "auth": { - "type": "APIKey", - "ApiKey": "{{apitoken}}", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "{{apiUrl}}/public_api/v1/alerts/get_alerts", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "{{apiId}}" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'creation_time', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'creation_time', 'operator': 'lte', 'value': {_QueryWindowEndTime} }], 'sort': { 'field': 'creation_time', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.alerts" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamAlerts", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - }, - { - "type": "Microsoft.SecurityInsights/dataConnectors", - "apiVersion": "2021-10-01-preview", - "name": "CortexXdrEndpoints", - "location": "{{location}}", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Endpoints_CL", - "auth": { - "type": "APIKey", - "ApiKey": "{{apitoken}}", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "{{apiUrl}}/public_api/v1/endpoints/get_endpoints", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "{{apiId}}" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{}", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 60, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamEndpoint", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - } - } - }, - { - "type": "Microsoft.SecurityInsights/dataConnectors", - "apiVersion": "2021-10-01-preview", - "name": "CortexXdrIncidents", - "location": "{{location}}", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Incidents_CL", - "auth": { - "type": "APIKey", - "ApiKey": "{{apitoken}}", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "{{apiUrl}}/public_api/v1/incidents/get_incidents", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "{{apiId}}" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'creation_time', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'creation_time', 'operator': 'lte', 'value': {_QueryWindowEndTime} }], 'sort': { 'field': 'creation_time', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.incidents" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamIncidents", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - }, - { - "type": "Microsoft.SecurityInsights/dataConnectors", - "apiVersion": "2021-10-01-preview", - "name": "CortexXdrManagement", - "location": "{{location}}", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Audit_Management_CL", - "auth": { - "type": "APIKey", - "ApiKey": "{{apitoken}}", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "{{apiUrl}}/public_api/v1/audits/management_logs", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "{{apiId}}" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'timestamp', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'timestamp', 'operator': 'lte', 'value': {_QueryWindowEndTime} } ], 'sort': { 'field': 'timestamp', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.data" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamManagement", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - } -] \ No newline at end of file From 8eec36e5cca3ffbaa2ff6a8a2e1ed1aa713aea6d Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:30:26 +0200 Subject: [PATCH 23/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_agent.json --- .../CortexXDR_ccp/table_agent.json | 79 ------------------- 1 file changed, 79 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_agent.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_agent.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_agent.json deleted file mode 100644 index f2783669c48..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_agent.json +++ /dev/null @@ -1,79 +0,0 @@ -{ - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "apiVersion": "2021-03-01-privatepreview", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "{{location}}", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "description": "The time when the record was generated" - }, - { - "name": "Timestamp", - "type": "datetime", - "description": "The timestamp of the event" - }, - { - "name": "ReceivedTime", - "type": "datetime", - "description": "The time when the event was received" - }, - { - "name": "EndpointId", - "type": "string", - "description": "Unique identifier of the endpoint" - }, - { - "name": "EndpointName", - "type": "string", - "description": "Name of the endpoint involved in the event" - }, - { - "name": "Domain", - "type": "string", - "description": "Domain associated with the endpoint" - }, - { - "name": "TrapsVersion", - "type": "string", - "description": "Version of the Traps agent installed on the endpoint" - }, - { - "name": "Category", - "type": "string", - "description": "Category of the event" - }, - { - "name": "AgentType", - "type": "string", - "description": "Type of agent involved in the event" - }, - { - "name": "Subtype", - "type": "string", - "description": "Subtype of the event" - }, - { - "name": "Result", - "type": "string", - "description": "Outcome or result of the event" - }, - { - "name": "Reason", - "type": "string", - "description": "Reason for the event or action" - }, - { - "name": "Description", - "type": "string", - "description": "Detailed description of the event" - } - ] - } - } -} \ No newline at end of file From 735d6e9462c39a88b96ebc656752e7e252685fb5 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:31:52 +0200 Subject: [PATCH 24/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_alerts.json --- .../CortexXDR_ccp/table_alerts.json | 570 ------------------ 1 file changed, 570 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_alerts.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_alerts.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_alerts.json deleted file mode 100644 index c5ac4031e8f..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_alerts.json +++ /dev/null @@ -1,570 +0,0 @@ -{ - "name": "PaloAltoCortexXDR_Alerts_CL", - "apiVersion": "2021-03-01-privatepreview", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "{{location}}", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Alerts_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "isDefaultDisplay": true, - "description": "The timestamp (UTC) reflecting the time in which the event was generated." - }, - { - "name": "ExternalId", - "type": "string", - "description": "Unique identifier for the alert in the external system (Cortex XDR)." - }, - { - "name": "Severity", - "type": "string", - "description": "Level of severity of the alert (e.g., Low, Medium, High, Critical)." - }, - { - "name": "MatchingStatus", - "type": "string", - "description": "Status of matching detection logic (e.g., matched or not matched)." - }, - { - "name": "EndMatchAttempt", - "type": "datetime", - "description": "Timestamp of the last match attempt in Unix epoch format." - }, - { - "name": "LocalInsert", - "type": "datetime", - "description": "Local timestamp of when the alert was inserted into the system in Unix epoch format." - }, - { - "name": "BiocIndicator", - "type": "string", - "description": "Indicator or behavior related to the alert, stored as a dynamic object (behavioral IOC data)." - }, - { - "name": "MatchingServiceRuleId", - "type": "string", - "description": "ID of the matching rule or service used to trigger the alert." - }, - { - "name": "AttemptCounter", - "type": "int", - "description": "Number of attempts to match this alert with detection rules." - }, - { - "name": "Whitelisted", - "type": "bool", - "description": "Indicates whether the alert has been whitelisted (true/false)." - }, - { - "name": "Starred", - "type": "bool", - "description": "Indicates whether the alert has been marked as important or starred (true/false)." - }, - { - "name": "MitreTechniqueIdAndName", - "type": "dynamic", - "description": "MITRE ATT&CK technique ID and name associated with the alert." - }, - { - "name": "MitreTacticIdAndName", - "type": "dynamic", - "description": "MITRE ATT&CK tactic ID and name associated with the alert." - }, - { - "name": "AgentVersion", - "type": "string", - "description": "Version of the Cortex XDR agent that generated the alert." - }, - { - "name": "AgentFQDN", - "type": "string", - "description": "Fully qualified domain name (FQDN) of the endpoint device where the alert originated." - }, - { - "name": "AgentOSType", - "type": "string", - "description": "Operating system type of the agent (e.g., Windows, macOS, Linux)." - }, - { - "name": "AgentDataCollectionStatus", - "type": "boolean", - "description": "Status indicating whether the agent is actively collecting data (true/false)." - }, - { - "name": "MacAddress", - "type": "string", - "description": "MAC address of the endpoint device, represented as a dynamic object." - }, - { - "name": "AlertId", - "type": "string", - "description": "Unique identifier for the alert in Cortex XDR." - }, - { - "name": "DetectionTimestamp", - "type": "datetime", - "description": "Timestamp when the detection occurred, in Unix epoch format." - }, - { - "name": "Name", - "type": "string", - "description": "Name of the detection or alert." - }, - { - "name": "Category", - "type": "string", - "description": "Category or classification of the alert (e.g., malware, suspicious activity)." - }, - { - "name": "EndpointId", - "type": "string", - "description": "Unique identifier for the endpoint where the alert was detected." - }, - { - "name": "Description", - "type": "string", - "description": "Detailed description of the alert or detection." - }, - { - "name": "HostIp", - "type": "string", - "description": "IP address of the host machine where the alert was generated, represented as a dynamic object." - }, - { - "name": "HostName", - "type": "string", - "description": "Name of the host machine where the alert was generated." - }, - { - "name": "Source", - "type": "string", - "description": "Source of the alert or detection data (e.g., Cortex XDR, endpoint agent)." - }, - { - "name": "Action", - "type": "string", - "description": "Action taken in response to the alert (e.g., block, quarantine, notify)." - }, - { - "name": "ActionPretty", - "type": "string", - "description": "Human-readable version of the action taken for the alert." - }, - { - "name": "CausalityActorCausalityId", - "type": "string", - "description": "Causality ID of the actor involved." - }, - { - "name": "CausalityActorProcessCommandLine", - "type": "string", - "description": "Command line used by the causality actor's process." - }, - { - "name": "CausalityActorProcessImageMd5", - "type": "string", - "description": "MD5 hash of the causality actor's process image." - }, - { - "name": "CausalityActorProcessImageName", - "type": "string", - "description": "Name of the causality actor's process image." - }, - { - "name": "CausalityActorProcessImagePath", - "type": "string", - "description": "Path to the causality actor's process image." - }, - { - "name": "CausalityActorProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the causality actor's process image." - }, - { - "name": "CausalityActorProcessSignatureStatus", - "type": "string", - "description": "Signature status of the causality actor's process." - }, - { - "name": "IdentityType", - "type": "string", - "description": "Type of identity associated with the entry." - }, - { - "name": "OperationName", - "type": "string", - "description": "Name of the operation being logged." - }, - { - "name": "CloudProvider", - "type": "string", - "description": "Cloud provider associated with the log entry." - }, - { - "name": "ResourceType", - "type": "string", - "description": "Type of resource involved in the log entry." - }, - { - "name": "ClusterName", - "type": "string", - "description": "Name of the cluster involved." - }, - { - "name": "ContainerId", - "type": "string", - "description": "Identifier for the container." - }, - { - "name": "ActionCountry", - "type": "string", - "description": "Country in which the action was taken." - }, - { - "name": "DnsQueryName", - "type": "string", - "description": "DNS query name associated with the log entry." - }, - { - "name": "FwEmailRecipient", - "type": "string", - "description": "Email recipient in the firewall log." - }, - { - "name": "FwEmailSender", - "type": "string", - "description": "Email sender in the firewall log." - }, - { - "name": "FwEmailSubject", - "type": "string", - "description": "Subject line of the email in the firewall log." - }, - { - "name": "EventType", - "type": "string", - "description": "Type of the event being logged." - }, - { - "name": "ActionFileMacroSha256", - "type": "string", - "description": "SHA256 hash of the file macro involved in the action." - }, - { - "name": "ActionFileMd5", - "type": "string", - "description": "MD5 hash of the file involved in the action." - }, - { - "name": "ActionFileName", - "type": "string", - "description": "Name of the file involved in the action." - }, - { - "name": "ActionFilePath", - "type": "string", - "description": "Path to the file involved in the action." - }, - { - "name": "ActionFileSha256", - "type": "string", - "description": "SHA256 hash of the file involved in the action." - }, - { - "name": "FwRuleId", - "type": "string", - "description": "Identifier for the firewall rule." - }, - { - "name": "FwRule", - "type": "string", - "description": "Description of the firewall rule." - }, - { - "name": "ImageName", - "type": "string", - "description": "Name of the image involved." - }, - { - "name": "ActorProcessImageName", - "type": "string", - "description": "Name of the image used by the actor's process." - }, - { - "name": "ActorProcessCommandLine", - "type": "string", - "description": "Command line used by the actor's process." - }, - { - "name": "ActorProcessImageMd5", - "type": "string", - "description": "MD5 hash of the actor's process image." - }, - { - "name": "ActorProcessImagePath", - "type": "string", - "description": "Path to the actor's process image." - }, - { - "name": "ActorProcessOsPid", - "type": "int", - "description": "OS process ID of the actor's process." - }, - { - "name": "ActorProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the actor's process image." - }, - { - "name": "ActorProcessSignatureStatus", - "type": "string", - "description": "Signature status of the actor's process." - }, - { - "name": "ActorProcessSignatureVendor", - "type": "string", - "description": "Vendor of the signature for the actor's process." - }, - { - "name": "ActorThreadThreadId", - "type": "string", - "description": "Thread ID of the actor's thread." - }, - { - "name": "ActionLocalIp", - "type": "string", - "description": "Local IP address associated with the action." - }, - { - "name": "ActionLocalPort", - "type": "int", - "description": "Local port associated with the action." - }, - { - "name": "ModuleId", - "type": "string", - "description": "Identifier for the module." - }, - { - "name": "OsActorProcessCommandLine", - "type": "string", - "description": "Command line used by the OS actor's process." - }, - { - "name": "OsActorThreadThreadId", - "type": "string", - "description": "Thread ID of the OS actor's thread." - }, - { - "name": "OsActorProcessImageName", - "type": "string", - "description": "Name of the image used by the OS actor's process." - }, - { - "name": "OsActorProcessOsPid", - "type": "int", - "description": "OS process ID of the OS actor's process." - }, - { - "name": "OsActorProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the OS actor's process image." - }, - { - "name": "OsActorProcessSignatureStatus", - "type": "string", - "description": "Signature status of the OS actor's process." - }, - { - "name": "OsActorProcessSignatureVendor", - "type": "string", - "description": "Vendor of the signature for the OS actor's process." - }, - { - "name": "OsActorEffectiveUsername", - "type": "string", - "description": "Effective username of the OS actor." - }, - { - "name": "ActionProcessSignatureStatus", - "type": "string", - "description": "Signature status of the action process." - }, - { - "name": "ActionProcessSignatureVendor", - "type": "string", - "description": "Vendor of the signature for the action process." - }, - { - "name": "ActionRegistryData", - "type": "dynamic", - "description": "Dynamic object containing registry data for the action." - }, - { - "name": "ActionRegistryFullKey", - "type": "string", - "description": "Full registry key associated with the action." - }, - { - "name": "ActionExternalHostname", - "type": "string", - "description": "External hostname associated with the action." - }, - { - "name": "ActionRemoteIp", - "type": "string", - "description": "Remote IP address associated with the action." - }, - { - "name": "ActionRemotePort", - "type": "int", - "description": "Remote port associated with the action." - }, - { - "name": "ActionProcessImageCommandLine", - "type": "string", - "description": "Command line used by the action process's image." - }, - { - "name": "ActionProcessImageName", - "type": "string", - "description": "Name of the action process's image." - }, - { - "name": "ActionProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the action process's image." - }, - { - "name": "FwUrlDomain", - "type": "string", - "description": "Domain of the URL in the firewall log." - }, - { - "name": "UserAgent", - "type": "string", - "description": "User agent string associated with the log entry." - }, - { - "name": "AlertDomain", - "type": "string", - "description": "Domain associated with the alert." - }, - { - "name": "EventId", - "type": "string", - "description": "Unique identifier for the event." - }, - { - "name": "EventTimestamp", - "type": "datetime", - "description": "Timestamp for when the event occurred." - }, - { - "name": "ActorProcessInstanceId", - "type": "string", - "description": "Instance ID of the actor's process." - }, - { - "name": "ActorProcessCausalityId", - "type": "string", - "description": "Causality ID of the actor's process." - }, - { - "name": "ActorCausalityId", - "type": "string", - "description": "Causality ID associated with the actor." - }, - { - "name": "ActionRegistryKeyName", - "type": "string", - "description": "Name of the registry key associated with the action." - }, - { - "name": "ActionRegistryValueName", - "type": "string", - "description": "Name of the registry value associated with the action." - }, - { - "name": "ActionLocalIpV6", - "type": "string", - "description": "Local IPv6 address associated with the action." - }, - { - "name": "ActionRemoteIpV6", - "type": "string", - "description": "Remote IPv6 address associated with the action." - }, - { - "name": "ActionProcessInstanceId", - "type": "string", - "description": "Instance ID of the action process." - }, - { - "name": "ActionProcessCausalityId", - "type": "string", - "description": "Causality ID of the action process." - }, - { - "name": "OsActorProcessImagePath", - "type": "string", - "description": "Path to the OS actor's process image." - }, - { - "name": "OsActorProcessCausalityId", - "type": "string", - "description": "Causality ID of the OS actor." - }, - { - "name": "OsActorCausalityId", - "type": "string", - "description": "Causality ID associated with the OS actor." - }, - { - "name": "ContainerName", - "type": "string", - "description": "Name of the container." - }, - { - "name": "Namespace", - "type": "string", - "description": "Namespace associated with the log entry." - }, - { - "name": "DstActionExternalHostname", - "type": "string", - "description": "Destination external hostname for the action." - }, - { - "name": "DstActionExternalPort", - "type": "int", - "description": "Destination external port for the action." - }, - { - "name": "ImageId", - "type": "string", - "description": "Identifier for the image." - }, - { - "name": "MaliciousUrls", - "type": "dynamic", - "description": "Dynamic object containing malicious URLs related to the entry." - }, - { - "name": "FwIsPhishing", - "type": "bool", - "description": "Indicates if the firewall log entry is related to phishing." - }, - { - "name": "UserName", - "type": "string", - "description": "Username associated with the log entry." - } - ] - } - } -} \ No newline at end of file From 0bbd4a18229dc68b0e5b00ccb4471d3939b6d299 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:34:57 +0200 Subject: [PATCH 25/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_endpoint.json --- .../CortexXDR_ccp/table_endpoint.json | 65 ------------------- 1 file changed, 65 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_endpoint.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_endpoint.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_endpoint.json deleted file mode 100644 index 37c2090c994..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_endpoint.json +++ /dev/null @@ -1,65 +0,0 @@ -{ - "name": "PaloAltoCortexXDR_Endpoints_CL", - "apiVersion": "2021-03-01-privatepreview", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "{{location}}", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Endpoints_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "isDefaultDisplay": true, - "description": "The timestamp (UTC) reflecting the time in which the event was generated." - }, - { - "name": "AgentId", - "type": "string", - "description": "Unique identifier for the Cortex XDR agent installed on the endpoint." - }, - { - "name": "AgentStatus", - "type": "string", - "description": "Current status of the Cortex XDR agent (e.g., active, inactive, disconnected)." - }, - { - "name": "OperationalStatus", - "type": "string", - "description": "Operational state of the endpoint (e.g., online, offline)." - }, - { - "name": "HostName", - "type": "string", - "description": "Name of the host machine where the Cortex XDR agent is installed." - }, - { - "name": "AgentType", - "type": "string", - "description": "Type of Cortex XDR agent (e.g., Windows, macOS, Linux)." - }, - { - "name": "IpAddress", - "type": "dynamic", - "description": "IP address of the host machine, stored as a dynamic object." - }, - { - "name": "LastSeen", - "type": "datetime", - "description": "Timestamp of when the agent was last seen active, in Unix epoch format." - }, - { - "name": "Tags", - "type": "dynamic", - "description": "Tags or labels associated with the endpoint, stored as a dynamic object." - }, - { - "name": "Users", - "type": "dynamic", - "description": "List of users associated with the endpoint, stored as a dynamic object." - } - ] - } - } -} \ No newline at end of file From b5d0bf0befc62346a04de31439bdff962e077973 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:35:31 +0200 Subject: [PATCH 26/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_incidents.json --- .../CortexXDR_ccp/table_incidents.json | 200 ------------------ 1 file changed, 200 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_incidents.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_incidents.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_incidents.json deleted file mode 100644 index b0a879b7e84..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_incidents.json +++ /dev/null @@ -1,200 +0,0 @@ -{ - "name": "PaloAltoCortexXDR_Incidents_CL", - "apiVersion": "2021-03-01-privatepreview", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "{{location}}", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Incidents_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "isDefaultDisplay": true, - "description": "The timestamp (UTC) reflecting the time in which the event was generated." - }, - { - "name": "IncidentId", - "type": "string", - "description": "The unique identifier for the incident." - }, - { - "name": "IncidentName", - "type": "string", - "description": "The name of the incident" - }, - { - "name": "CreationTime", - "type": "datetime", - "description": "The time which the incident was created." - }, - { - "name": "ModificationTime", - "type": "datetime", - "description": "The time which the incident was updated." - }, - { - "name": "DetectionTime", - "type": "datetime", - "description": "The time which the incident was detected." - }, - { - "name": "Status", - "type": "string", - "description": "The status of the incident." - }, - { - "name": "Severity", - "type": "string", - "description": "The severity of the incident." - }, - { - "name": "Description", - "type": "string", - "description": "The description of the incident." - }, - { - "name": "AssignedUserMail", - "type": "string", - "description": "The assigned user mail address." - }, - { - "name": "assignedUserPrettyName", - "type": "string", - "description": "The assign user display name." - }, - { - "name": "AlertCount", - "type": "int", - "description": "The number of alerts regarding the incident." - }, - { - "name": "LowSeverityAlertCount", - "type": "int", - "description": "The number of low severity alerts regarding the incident." - }, - { - "name": "MedSeverityAlertCount", - "type": "int", - "description": "The number of medium severity alerts regarding the incident." - }, - { - "name": "HighSeverityAlertCount", - "type": "int", - "description": "The number of high severity alerts regarding the incident." - }, - { - "name": "CriticalSeverityAlertCount", - "type": "int", - "description": "The number of critical severity alerts regarding the incident." - }, - { - "name": "UserCount", - "type": "int", - "description": "The user count regarding the incident." - }, - { - "name": "HostCount", - "type": "int", - "description": "The host count regarding the incident." - }, - { - "name": "Notes", - "type": "string", - "description": "The notes regarding the incident." - }, - { - "name": "ResolveComment", - "type": "string", - "description": "The resolve comment writen in the incident." - }, - { - "name": "ResolvedTimestamp", - "type": "datetime", - "description": "The timestemp when the incident has been resolved." - }, - { - "name": "ManualSeverity", - "type": "string", - "description": "The severity applied manually regarding the incident." - }, - { - "name": "ManualDescription", - "type": "string", - "description": "Any comments associated with the event." - }, - { - "name": "XdrUrl", - "type": "string", - "description": "The link of the incident." - }, - { - "name": "Starred", - "type": "bool", - "description": "Is the incident starred." - }, - { - "name": "Hosts", - "type": "dynamic", - "description": "The hosts regarding the incident." - }, - { - "name": "Users", - "type": "dynamic", - "description": "Any comments associated with the event." - }, - { - "name": "IncidentSources", - "type": "dynamic", - "description": "The sources regarding the incident." - }, - { - "name": "RuleBasedScore", - "type": "int", - "description": "The rule base score of the incident." - }, - { - "name": "ManualScore", - "type": "int", - "description": "The manual score of the incident." - }, - { - "name": "WildfireHits", - "type": "int", - "description": "The wild fire hits." - }, - { - "name": "AlertsGroupingStatus", - "type": "string", - "description": "The alert grouping status." - }, - { - "name": "MitreTacticsIdsAndNames", - "type": "dynamic", - "description": "Mitre tactics ids and names." - }, - { - "name": "MitreTechniquesIdsAndNames", - "type": "dynamic", - "description": "Mitre techniques ids and names." - }, - { - "name": "AlertCategories", - "type": "dynamic", - "description": "The alert grouping status." - }, - { - "name": "OriginalTags", - "type": "dynamic", - "description": "The original tags of the incident." - }, - { - "name": "Tags", - "type": "dynamic", - "description": "The tags of the incident." - } - ] - } - } -} \ No newline at end of file From e38e5af825efb9e6e97d03bfa66cfa696568f38e Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:36:01 +0200 Subject: [PATCH 27/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_managment.json --- .../CortexXDR_ccp/table_managment.json | 109 ------------------ 1 file changed, 109 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_managment.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_managment.json b/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_managment.json deleted file mode 100644 index 41e942d9acc..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data Connectors/CortexXDR_ccp/table_managment.json +++ /dev/null @@ -1,109 +0,0 @@ -{ - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "apiVersion": "2021-03-01-privatepreview", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "{{location}}", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "description": "The time when the record was generated" - }, - { - "name": "AuditId", - "type": "int", - "description": "Unique identifier for the audit event" - }, - { - "name": "AuditOwnerName", - "type": "string", - "description": "Name of the owner who initiated the audit event" - }, - { - "name": "AuditOwnerEmail", - "type": "string", - "description": "Email address of the audit owner" - }, - { - "name": "AuditAssetJSON", - "type": "dynamic", - "description": "JSON object containing the audit asset details" - }, - { - "name": "AuditAssetNames", - "type": "string", - "description": "Names of the assets involved in the audit" - }, - { - "name": "AuditHostName", - "type": "string", - "description": "Host name associated with the audit event" - }, - { - "name": "AuditResult", - "type": "string", - "description": "Result of the audit event (e.g., SUCCESS)" - }, - { - "name": "AuditReason", - "type": "string", - "description": "Reason for the audit event" - }, - { - "name": "AuditDescription", - "type": "string", - "description": "Description of the audit event" - }, - { - "name": "AuditEntity", - "type": "string", - "description": "Entity type associated with the audit event" - }, - { - "name": "AuditEntitySubtype", - "type": "string", - "description": "Subtype of the audit entity (e.g., Login)" - }, - { - "name": "AuditSessionId", - "type": "int", - "description": "Session ID related to the audit event" - }, - { - "name": "AuditCaseId", - "type": "int", - "description": "Case ID related to the audit event" - }, - { - "name": "AuditInsertTime", - "type": "datetime", - "description": "Time when the audit record was inserted into the system." - }, - { - "name": "AuditSeverity", - "type": "string", - "description": "The Severity of the Audit log." - }, - { - "name": "AuditSourceIp", - "type": "string", - "description": "The source Ip of the audit log." - }, - { - "name": "AuditUserAgent", - "type": "string", - "description": "The User Agent of the audit user." - }, - { - "name": "AuditUserRoles", - "type": "dynamic", - "description": "The roles of the audit user." - } - ] - } - } -} \ No newline at end of file From 36053f3fdb99a66402638e236652d28492f715d7 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:36:18 +0200 Subject: [PATCH 28/71] Delete Solutions/Palo Alto Cortex XDR CCP/Data/Solution_CortexXDR.json --- .../Data/Solution_CortexXDR.json | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Data/Solution_CortexXDR.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Data/Solution_CortexXDR.json b/Solutions/Palo Alto Cortex XDR CCP/Data/Solution_CortexXDR.json deleted file mode 100644 index 1eee8b183fb..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Data/Solution_CortexXDR.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "Name": "Palo Alto Cortex XDR CCP", - "Author": "Microsoft", - "Logo": "", - "Description": "The [Palo Alto Cortex XDR](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/09agw06t5dpvw-cortex-xdr-rest-api) data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch agents, alerts, incidents, management and endpoint logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table, thus resulting in better performance.", - "Data Connectors": [ - "Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json" - ], - "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Palo Alto Cortex XDR CCP", - "Version": "3.0.4", - "Metadata": "SolutionMetadata.json", - "TemplateSpec": false, - "Is1PConnector": false -} From 033c2298cae94ee0f121d9e01510a75eb4047c6d Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:36:34 +0200 Subject: [PATCH 29/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/3.0.0.zip --- .../Palo Alto Cortex XDR CCP/Package/3.0.0.zip | Bin 15895 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/3.0.0.zip diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.0.zip b/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.0.zip deleted file mode 100644 index 3af8735c5618f34164fd6007a19c031e0df88f6d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15895 zcma*O1CZ#z+wM8GZQHhO+qP}nw(U7%+qUhQGqz{;{J(qm?ssq1)^55wNmq5hNvcwL zy7T@X1!-Uq6aa{SCB!;O6X3sXhyVltwuY8=DyFs$Hij;ybXLyxcCH@K0DvI>>GfYb zRTWqO@Pq&(^TdC3R@cb<+V|S&NGxgpH@e-uVt%@oBws@6q1pWU4-U0-1=4C3L8KA`0~I`rn;97v$%}%+%D>fAxLt_njYN zL+~xGjN6@WIlF3{j2JA5XXBsjWGIxRDg1fJT@w#h4#?LtTXsCG3JKX;Q7Y~+) z3%*F)#$DL_v0u{S7oP^|x7oR$+@Y8u(4K!j<6SZ05$75H{`dG5Qx<1V5+TU{5dJPX znQVz-v@E?BTb!m-TEv)d8>Zao%@qaI5-2!HL{8?WC_{%+P(&`6gveYmXFmS8Z?=A7 zV`Bv_?k+pS1`748GmU4C^X&s&%3MOO=UVq6UN#@{E@uf-p zHit#R&mkz~)f-T*O1X2?78E)J*DEU(FDQVXNt2A&exUQ$(@|K(YWgDXNyGMRJKIM&2y5i`d zf+SPv;Z+o6uc_l`F%RhR)`anShw>it-r|bCKgHdVeBe9#ZOYziU{aV) ze2<7woovl}pC`k?{xwUEBUwb`50zn*{qiQm;w7S3B6UI}0zW9t7mfn@Z>x8L3i7L%ZV#IB2U?JfHUe3C^9k7*Dcf%&6lc2km>6u_dIN==sObI8FG8=~1TWmg# z%pm1#V%~?jJnMCb57Sz1`WfO-_uBmJwVA#fbC#L*wN_);6~?9i&GjtG$%p+J%jwn{ zWEkNi`BDh%)2U$>`0(~$FAHZxcZc`cA_kBHgb{(FL%{UHBzwxZp~7;1&T@CZb7BVZ zbxj1kb3Z$`>O3{v_I4lFBT7b%;DrIZIcM)KaLe=G9HoJCZ?G2i0K9SI`SK3pW^>qc ztlG3u9e7JrV?JrTrLBI*+stFOfXPztuC{*RLw>SktGYC)1yvl+%4`X>R0Hx^-kAYo zrmul&VG)B@gLKfYFM5%EMkJ4MMysyJIw^Z3V3t-=RejQGV$|aUa?=<-dBFTvptDAX z9-Hk@uflZ$JaKqF3S1k4iBhy&%%tVa&(T?KKAsc$p}ml z5vC7^D(-k$aFe>8kOOc2V+9o`$3h?uzX}ercyVYoO++1I=pOwrQGS%Li7n;66aG_{ z_`x=)$ikm5=HIy)+x-^#HlWp&hqHF~H_y_q1>HPC26G>Pz3%tf+=SNqZ32i4 z9o{;aHF5mXx*tyAqxDv6z_m#)0K2Y{kAaFNq;d!%&|qRb5y}cQ7#IM|*WAQ^t)-j0s zeKA9{$)&*CcL7ds@__%{jmEQx!FI>rcSYhkM7d&grF0Kqpi~A)Jem&HZ(_oXUlZhfCz_;iG1Tk*0=|@$YOdD4G@i-ItxEeBm1KXX+smIb-w5a>n~?y z&i9?2QAQ)Yl0W%9`WdVe;j4~o&#rhFz=_#OU^ggI6Drh&1;8gEK&}E2J^8$H)Dw1( z6*hn>rh>O3!I6LlepHAP7CWbRs{;R^J+ohZ;E(9_IKGGTqZ0ed^M$Ihde1M*YcMNa zYiSb&SL&Gm@2%eEz@FvOB!g%YFj7Wg4BG}_eDhenK?T|$=CEFH3AaDyb5<0m+uCvU_LD66(PPxB`f`mJ{->jTv%L@>8RrL!IB@>{g_sGF5etc2>~?Lg5?{G~ z6j3$cmB-(<=ynyGo0&bUeqKk=rDZzmoDXiZNHS+JtdKDeAo7oj^pg+W#+ zq5Mgi#oL`B=+8(-J;zBv3=)^Vv@z?b#rYlw7{2&k2*sQi^Ltg%ixu`%HZ9JN{9SlN zS2#O4mn70k|;y? z)h+XbU((>I#|!E}`9=9JM~Q!KC;l%l=U-WiMc_nm+n(J)`Lfg8K<3+b8+^mu@!;@c zS9$zTR`TdK<*9&YbB>>jSu6bK3D(ZK^WgrsofeMS_>VhK<3k@j1dXn@TmJXqKShD= z8YuJfeD4AYgU8F+g1;#X>pC8s1CIGHpvudzP6FHg?zi`!5oG6&<{U1!)L*1y0h{YSG zS^&#%a1t;YKv9QB6o8?_k)e7v79O^&asCC>gYDu|SoERL+u^ zU%j7*-G`qKFfO<){o!0NH=7`m!h!LIUB`k}QtH;^gbXCQjBUay5jTaC- zQJ1KtqDC*)Uvy9gUTW+bn1 z==u1mA--#S_WFRGO(~s832uTtNS?c5sdQ|yqkG%d6?>Se?EFkHN0TzTnw>4f;#j_| zF*QfL-dH-td8p%Z%sX5V!kmc3J1psjYe}GDvc6!q935UxYvp@hV^9MQ`LADUOAU#QC4r5?S2s_~3LuF@HymC#y7y-dG`b?xP*Tw8 zhCn}?ac~FG4UW3&qXT4$)nKCxRFuHsn4W7w;+<=l0se&%z*Fbg@6VrUt96~uVPJJz zd66Um{JXsIyAVBQxg7|M56pg8_R0)K(58r@P`;b|?W5SV4fl#y7=Npk(xV$7jP3U~ z@Z&`=YAGP@oq3(nx!8lVbiQbim{b;AK=Uoo{cOyI=Q-WP$omfmQERSw8PEXZO%x`_ zBQk+P5Mu-#_9q@Tci~uUG~HcmNL;6KVp_Q~fYkM}(i2G) zs|Opn*mJn*piXs9hNeKOFZ=05*WaekLF0&h}o+J(zS90W@4% zt6IPI_8SE8_}$(vzTlJ2zfc0V1_PtzdxLV9C?ae2`t+V^{NhnX5D~eyXPW!-vF~7$*|w zB{u0q#7OR&rPM-LUdC|C>yjR5MfXWMGAW;=~4>y0pj`p{|uUx^>B3wlT(f0R`Xc5H!KCe=Z)t%s;x8oKd!aH0HP9*w| zE=5*s+O6j>eN+HfRZD&BAo^V>STMRP(pV<^D*BKQ5t{2LQn+<;=2X3{4IDgFYt~r->t3-UWb)jfH~ThEYl57 zl+8U-&v!+a@-cw2qF-0hz2~|&M}x3nw*mFNT}Y)x6scrijVx$`i=VVxPCRi6P9bHv znKTk5JOu&s=yY(A;tlrR?=)cbAjE$BpuyFw?Hb82C&n6Eem?Uf*GsX=z&OSG+wV6A zAZ7mx==T0XSOmY*;gza=H485=<-E=DHwGvnxCZ*898!V(r4Le(-9;L?sEz>%B4AdB zN>Za0ULrlF>?X@uw{@M{y4-#3VMZ9O;oe6w)8M|vHC*qWszX9i#u;U|G_49XC3{+tf3lO2iibAO&thhDH8sXC$730L`A@q zbF~IwRTm57$a@p8ye>p$%)@wFu$)a;##~XTtE56Qf~%kswY8X|zO$4_HE5j@?DEvo zzpWo7+?akaD{%`v{7mJwL_in?g%zbAY#jU6k(UV}B=(`C0@ zqy5u}P+|wc_@%G+Xz^L#L4)bOrc)bK2TWF!0HM2og=xdI7OxZ*CX1f;794rfbno+* z*(Yc#Fx+H&d=rCR-M>PPTj8ex3fZSB`RxE1bv($z32OQ`BC^VTm7==5y2g~16H&J* zLrXOIl*mJ~{bJ}o2zLd+_M*x?wb>ErESo@U`A{dlH1OU8E>;sOuja2>(<&X6R_Ifw$6%ANXX)m-5)?j4A>sz;y9fb z?$te>2~<~Z0`tZSEI3b~YJmlyUG9&s`tTxtM|&dIGeq~xe281VFXhu#4n;{i2aj)#n_&+McL6!m+DdluT;C?E&{WQ61^rrvPl*flxMgO_JG3D$~qr!pz^oRld| z3wu4-Cqb1b;Z6scG31`QU^7smK@5MpCeTliXu&~DhPya85>u5p$_;yikTcr^3Z~?e zB=8!%y93613F6+l=Yox|rV}g54Vx*_HUmaAG#{;NTo?!cB9V_wqGL(^tk8%!3ize8 z5cEC*cIy~IOypc?Yi0@B<^2tUWdJq9Ye#%W3d7@u*IhCNz4?}^x!9BX=u0!lxF`Zq#nwpTxRWk3o#$5d#y|K-d%wyCGh zmXctR{I?o1AnW_LS*T!%!@9S#jPALVNpWjNrnAPo>NvaqT9fGb%DlH{re?Un^r5R6 zIS~h=KQ@;$`J`2TTBfJKbpi*CoXV8W20*70dppmFyK1KDwLAq&N>4(uFeHQ$KTX2E zlShmee1- z7Qn6jhX`48BK}P7Fz13r)@vm@iGwh?y*v-xEYSc#-D);xM8&E&sDXC6>?5>pT(|^X zdr^`Lp+qJaUnL4pIf5wJ{N2e32-=*zmToyO3?f;EnAk5d`67m{AKIuKkov9^R%CeIn!f}USS3_%4TeR;{IT@4 z$`IvSsoWAmvY}jAj|JB0gk*^ve4x6qOi+vm=X}CYWLaTGfEbmu@^!Fr1GoPwZ3Fe# zZ;DhKAXt%hoFBk};k`d~nm6F_Gzk$R9F(a5hc_J?!27Z7-HI_L{o_tnR~a&o zd3T0-mlt_%mH9OFcHIy-^veD%Mh7m(U(HXTSJNT-OpEt#7}-hsZs$fsUlZF_MEaU0 z@cj+vn$Q^?Clbu6g z^(IMD8K^9KwDZ6N>15tt6@GJmAaBgBnQc{9?nXcS)v07MN+n_*D^al>viiMEv-q~F z$yce`k*(mU23e%Fo43>0pXHajt8d`=QoD27pjy*g?4MJSFZT>Xb)Uo{4{-{~#~4Qy z52?BV)nV6)#VL{-CiR-qJ;*=;qvy-Lw=i*c+Cs(8)-sOliG0|4y{H`&=H+hD${bN= zkt5|qqctXNp7)euH;5T*dA^o;VV#O_xZ7iH@Fw?nRFN|8o zQwj8{WX{x9s$u`W^~-D)h~Dzi3uUMtb>0-#$J`i_@y?VWm_|tkugPr@t~{zelD^oO zcE=$qq{#f1?z$-mT>@(Jv7{VZIIwywB7ck(h!>&!!v*CY@LtXCXy5}41adjFSsFXc z_6C6b#(AU4r%O4rf_k2sP_CbX8_*HJ-VjEGh}fBK_fxcVNAsZvOv8{8)VR)^8(sWc z5^q&jdRFFj3=NJxp;Cltqj-D(2%r;#Dt4h(npcHBT)L73BzM zb;viia03#nc%^Orcr&;g6_DB(x3*dPZSC-{<5EoJ?!}^OpYa_o-qB4$_k*SLX*B*z zc6<JLyCEm5m9H-n;M=mMLQVB1+-Fzdc^MSN9e<7kl?o0V- zA=|YLZByoQwlsLmkx=3vO;8Cv7y4LzWkx&7Z!ZGNku*gU- zWkZXp)WaghK^GYUuUgeu@nRam$-#Y3;RE^ihJ!tjU@e>0(X>^K0~t8aXaC;wE*(ah zyPeW^0?3Smg`E+hb{sX^<{-Fqc~TDf^#|<^3HYoHeGK^O>!-wDKoQrIJ)JZ(f7NHq*p*it#Q2m_2!sC}eLw;xS zCO2AphbV!-sxO%>rc8TM8Um6d=2NMMO_2&#gY}ES0DoeHx;Ux;ETP{n)~&07z{&Zkh|Itd-3k`NFSY^{FQtdlv=R=FN*k1Unzb^9;~|z8d>H zV`w{{^oHgEqgd4LE+Ji7K79rri{36|j=3kCGBgC(fB!Cql@S~c04k$4$~;ALyL`Xb z3FY{Uv$B#Ird0TA^>^IGEobF(nHL#rWc5q-K#2Z?(cUG_dxG>CspKWw;AtOqRHMqg zzj>yMoaUd!>>Ov`t`itX96us@M#O|H5SNU$&)Q7{GffEb);`(_u6|W z&)S7{iQCzSSwzC-%lMYP0C{0C0Y)4fWQ(tO81;hWWz;&Ds+GgEanhuF8p#J%+A}__ zdMwJlD4=6)a{?B#&060}`Egs!=Dg|InEL-qrp5i~JD&2L%2+D_{o}~!!r9%?OHj_v z{_FO_yC4a6=d}UZ6E;uCjom?&9q3#0?z1JdAv0*O=bJ&fzNnijlS{(PTtgi7PC{c4 z8UKwpF;|IP&~kuyZzNN5f;Zct|KQ@ClCMMnWMl;akZCm&HDPKp`{&>T2@aGavh*i4 z`ZN<`z>)u>5S$ms8wP0HnlPx@tUkCSfN`?4O$%m?6HxyxB~T>2BRbJbbWOrsCs9RncN=-hAm3z4V~^< zl%ffFyz4j7&2G%KH8d$GRC&!O>Fj;?99??5MawcBAmLmcpUZI z1R;Z-sR$YC1*A=?)O1+uvoF-ni!v)sYem#b+D(!6(4z|Bbv;%zOl@rKym3*e6F5U| zuOgbO5A%EX@(h_uZyH^RFH>MwR$#*qx(?F|)3UW@4D5|Bg zv{xlY{zgy`Q7q(K8%;rz zYu~e$&?2eHy|~2+QhqU_O`*}rZ>|(IVYOSpSm#2^U^%_YIf+o?WUq z+K)wTCw9A`)NasakHAP-@!~#QOB5(|?b-+9?C>YFG&}F!Teb8?h3p}zFGl(g!o;Og zzQ(RowfUK~vS7P<~9X{A=eE*Rq*NqDT!O|A7b%2?v``gWf98j0ujj^Sr~Gq6|UOfXdwMvyL!s@Yd$(o8Y!p>x1~){b_}j3DQ23F zbM>Q&o3(L5yI!1lr2$U$wYJPZr~w2Rcg!TgBHV$zInnQH`lF_+2yW!66Ot(GqL}*7{&{>NI#POu7cQv^au-!7mQ|=AhrlhFrlqVd-oDl)At=}*` zxG??J8m7-tzrELli+i8LgmlhEP^Sa1k z_Hq>B{jE-q+dDq-gOiKP39GIRDR)Z-+c;Hpf=Lk(@`^4`%8)5Ifm996S4lh6^dy>; z)z7_OVx@+kkk&EgNk;aTQg0j!s4ospg0(fo5Q&yCXpXrdeclvvAGKz+hc%`_++mwk z&TzJdsJ2?SCBB~YYzyOn(y{h%g1kIDzjm}6zN*D`7if*1%ciJwvP*H$oZ=d4&>jL& zjsb`N+Q`UVqh{wRN|y(U9yTY0URN&qD@Q%q^2acV%P=ca zaw{#6IUig@)pgVy7H^CD;XTCdI&A4q@!m34d3{zo@Au)*y@9rv@NVc6jYe4;v{Tbh zc%o>_Esl~qo%$ieNkoUW!jQ!o>j;U~bZWtasPa7e^n+ge{GvXd_AiCE!r70}^U%B^E zW$B8G3mao{8FxjLjW+UL?Zbh#2L5|t@;_)XfE6N6aQl6d&}&d^ikgtYRrza?*$lsy zPwbS<%`9ZUy7$Hn z_+ih$sdb0r(z@LTqqBF#mn7aA#Fq6|1%+*0{sMZqH~3dCZt!lr?&-gxyT4O~3gLM_Cpo+Ch4I9A6M&Hm+1gm_{4U%kuu6@gocIraK9LN z+hb99a{O7v$#*52Y%<%60i*MyZGRII&8J|3x8M2nzf(2){%rlzRKY`Yxf6$XO~W<42=CEzxV^hl$YjRTZeBG55Ixp(CT-J?jv|H0abx}l_;yjVlv?y^U-V<_rV zai1XjVrJ$Jn4Pje1cL^yPUsjK#erj(RxX9=fXD|bCiyVQ&WFur`upkKSscrOJXCD| zgVw~+Z(wlpcij{!9w)vc$--2PRfK> zj{xV`?K`DiAMAM}LSSt>d;-)bBdh~Ly<~JQj|nl$Oacg!$cYu8;s@VJaQ%@MwXb0U z$C2k*r-6j5^mz_3Ci0sFQTqbODzg}DWZ9oOGsc_+i6$5fJE#byyGDO=LgIeB*c-m% zE=6c{S|_|ZTz6j?a6=}QOX#rRm_hYYRSa+u8ab`g;pd&btdOGK7)U*O{#u5BZSVqZ z**C!LUQW(AJ1i~!TpOZ(WwJo_$SuQTfW^3Sn4D$%V^?~=I+P60JR7!w(aGbb4e+ib z6I+-UOoDH2{N{Lh){${9xH=r^jZHN_L3!laF_g2xQ$P)o7Zi9;8)_UJujt{Eh%AQM z{?(lW@SeIxLMk3kO~23>prqVc16Dzacm@2|;ztWsY6k5^uqMTVT1Y#MkG5YILH07B z#zc~~8MX@n72c=6c^OXUa|DntOVIRFORAi7?(TmeG$$H#GI>6rR`Sj6E<8Krq5OS8 zgY4OXtk2Qs!gAx&@9pWAz4hXAvIorF5&1L!1<#zM>VGyoL5VPlf8-)ka!cij67o*p z#`2(2Ej~i1;@!DRGSxcR254E;&>>X`u1XVc`vXKH3ttI5I;A0gPRc&z4msf^R}Dp- z{aZE6HK&D7dpdmecRVwWDKA(CR~5DQegxs5l5O8_q&`{s3f|-dC_Z}US-SOu{Rf<( zSM`L0Ssb9=r@lC(LM~g(?q#0aq`wxgekjV`pFr1Ue=;T-%*2W3X7U>rB^DDt96pzQ z<9zni5jpvT#K&32gyW~uui|E8$D&`9ne|>3+1Obd+$w&J+>DEdv$_t%D=g1~h#6It zA^7F__hnxg_;>&DiQ@$MKg^7jG1JF#H+)T5+RHSRydi66rg}@W&c|QQ|Pn8(^-dz%QR?jM5<&AqE0X5T}WM ze&TB~O2)$m-K_kQ{I8?LFPAI-kGIou_Iyb=qYwd)H%6M#2T!i&ocSk2wO7XYLT5Sa zg)3EEan;TGrhZQ`UxyevfG+|@cNf~&ydr*Y!1HV|b@9iD&+i0zSSm<&e^G$n!vr|u zxbxo`pLet&4T=9^Wk!hB{yQrZZ1O)@8TbFi${>dRFII*x^#5dK29b=-&YCQKDj>pO zNxFdQ6EQMl0h*S}b}wnzanRcj$U4gj%V!#N{Ww~OVaG0=hwh=a@51Q*I3p8}GwMH2 zY_LQz#7J>o0vEVB2pIJvDWKqsL*mTK(ac&pla`-zn8hAWIM!8);;3TDsl?aTi3lyZmEi zoR!W3{s$|Q@+4^Un%m3|UgsKMDV*g13q@~W6|U+{E4Wfwm*{uO_R9FwnxwPhtpXdL zwPE|zP*hD@BxM(_s+U%>UR?NGm4fB9MWo_bV;(Vw!}*@46`D1Ji<03S&S0psu zVKhv8yGD{F6SSEi3tMN?3Wh8ZjJTKf$k;1~ygsYSqxe;c@VjIp^l?=)*ln6FcPJ;0 zC|+oQe7;~4?mE8vzMm!JFl}{@ClBU>W6QG-eCO7!W7+i~08@}GF&Ef8q|!(z3Xe99dYZ?5Ec(eBZ*$ zmKOXiPKQx~!oG|H79#H?6DuB<3C~bDG+OKo1*LzkM#8n}sP1sV8|}XAbLq%y*F)4c zg@~$5A(`mT&gR9Xj(9nj5QKDw4TV*e>ilkN4)PLlJhnSHWn_P58aF3{{g;mG`&vu?f-}3OIeUW zs@?jqCOuUmmdhRuGYhvpsZN#smB)G${(;Ci@@+0hq0(EhiTQD8jU|UfxqFNvqVcdL z%8j<>;_E)!zM1m<`%;qlftybh>w-ta%-2MDiig^`(jqn}N>?c75<{1x9nn(>1tNBpzx=?Yq(`eFdYFG@=S-chu1u zX8$Ab64r3X95q2TTgf(Nl`pC>`m4cvlmbywP;EIF^DC+=`n z)}C6bl6g1rRUTMcw~t*G!>Daib#!o&g1PRHE)KY-Tg<>?S$(d z*aQ7s*zNWUU~7PXH`;%(KiL23ug*4wAyMyrF$TX3QWXFFI5&>b^bxw~3Z%@;&}GOk zmjGr>Z&=@e@P~mWXzq|T zhTeyut|jY&wm>ATVq8xZr+yLScm?M<%ae?_vVq9PBDb_l-HsLyBHX9^zAg>hW&)bu z*_`h>*MM=pb*-vx)o!1lxA|~2$rpVl7&{9c&ha%P< z3)vMFD`D%!TS0x4@@*wIK}WBun%n4`MBuyIYwNRdA?%Z_i)+iiq*Ye9~(0TFjE_ zZYjObLi=my^>8w%G(4%AHUw#&WYRwfo~sJaTu_pTQ_mD|}sOzzP2;g0*pRRtJ%m1J%iY?H^QNRf^V2g0tdh(D#s-OxF)iKO| zR^$m`etv)Eeo5DSzMWvl)8R4)=gIjm){v3;Gt1h(B5x?^wFZ8-l;2?YQA!GynKUi} zwIJC9sDA2?giDCO;tNQ=KrJGFdAhK4l;gnb!?*K2`LBIQ{RzLy>A`2!ISuSRZWc2i zBQmQe6}VpI{71oLgi7xWUk#ffd`AUdhETrrMZS>D`(-jR+!K~4ks?7+;lNGw%ARUu z_ItsQty5D7n^e6)=PQj=<5q7wsiHlY9SEqa@y~6(@7AVU4>gyaF7C0RI#STDJ5aR^ z9J8W_?o74%s-}`cwOFjFG=spcT0y1}sKqt6I%h^4)wy99d|tv>W?(DXX%+gcJZN>94ircquu-d|R?7Zb(6iCtJ^e6ub{dtEsz)mPiqJN-ZX_z$a9+wf^I(Pdx?+r4E3F|rz%ZFn@qLu1?&sk!JCIFMN^-M zR%ocStGT5Z=RNJ4jB)b*{jvf8%sl}DDEu#Xnfw3YE<^w4E;DvA{pTxFwG=Tmv$V5xv9!1QfAyGo z{qvV4|4)xui^jLzkqE*sexy4Fra}@`>yp%%_y{i5^+m;UaFzOvfMh7!%cy4O%ZJ;V zq_;R}Ua0tyWQL~yuw0H)K!TiQH+SCL-j|uvE&mTh|L3xZbRN?!Mt5mT2PfRn1Bry@ zC{o_TG}x7Hp(jFRb0_lw2?tEvm(FAA{^gyDv)Oz6nYj-klVRv&PK0Z!=>G8C~yw3ou2B_PFVPT1ibs{Ol8FVRU#Iyz(Y3_WFVq-x- zT;RV1)hE8g3DZVL$OS6BYci!XbIlR0@eY2$O3s>MZ&ga>U6SPU#=^0P)`#+FtUiN_ z7f%liwe_qi;B1R2 zg!m*7sT4-VH@0wZ_LvL1FQ8{A+(619U=-M-1_1HK8*&FTzxf6igW5@w6b1z9C>7K5 zwQkK&hZ&|@!aztQO^(k<((|$NC&{e3wLkHxwO!4e6Jt<@CKyCxjJTSmfr@1?9vOvT zqGT$DhDBo3dS_ux#=~jaE^ntN5Bb7`78;Qud8;QE#N2L&!G8c)np^Aa5a(?e8 zlx3usc?cmB^tg~~dzQFP%{=%}u@JPk{^^P--qNK@fT{Du7==ED&j5nB5u#|=eABu> zh~}9s+I@k|7qil0$tD6g&f?5d5Oc1e)W6QE>v>w&EHTh^H(7{ZU|m{SXntQOWhV@Y z#P-`p3d+-4D4Rs;-6Eh>^N4-RR-vVC$Go=E0^TfN0T&d|uZ@Ai>l$|2JFi5^XPJd& zEC*T_+R052+4S|b;c%Ynpoi~>wz#OyrFQtpVn*nR$vO(vUbX|-Geg4Mrb?nU?7AHL z7=;#}L1vW^4XPGmzT}5VkW!?^8qN~!rEr!JfDO^QL&rTMiQuwST)Vt3K@Vz!5FpmP z?62*5=ue?)qP<6b#nor-gN~@XTDr}sEBe*+Er&BEb_EM~3z)OMQP{@a9G*)di!YPA zXWd<Dh-{|$q;EwFcBd0+8+d9rX~xhL2ENFD;@+E(AWH&)g0 zHvp7ZjVi&(u}sZBNVt`dW;;t7{#;0q=Fz0WOs_tpR>wa+<}GVeKqwx`NK0r*Kq6Vu zHEjfqL?fE!4+$A~4*?#0Vuy>@XO1Lw2bIy}qXFck*)rxhXX`gWsgdx3N!^CX<122E zlTN_Yat*|Cbq!C&KftJ(^}1&l3M~A?)t#TpneREqY#$JeJ+iHBj4|DP zKkc0Nw8sad@H~Si2e~Em=#fsmiMgeqq+J2DDLaGL9(n37jW=91Gim&>(9G(^E#y35 zM{{+);W(ayP%>)F)CU#Iw?jRV@oU0>0ilf_*evYZ%;b;qi@ z>g~|6YeO3et@ZhV#ja)Ju|hqgX(f}KAtNocs)A`$+?ui>3hgj#Rk_3>%m?+R`TzPdENZV&H!uZ4uz z7v0w6*2XtAIR!1fF$v!71*aS|ee2~H?P{mwQkAhL<+Eg?p4Fb(&x2+oJ3QN0H(v2r zG+mOtX~f=EW7mbSxnam(vLfQofj_|tBNA?%@-ucEs`cY#>W+hsZ6w(TV~C0Ki28_}2ymLIM7N?9~5V3K0P?{+GGB zHSj;D|KH|nPyoRHn5+ML*#GG0f4?O9{}xt{4dDN`s{RZ9A5~S52K{&U002P$O7p*? JEbo6>{}&zlsu2JH From 2071d99da72773d223a616ad080fef7c809823e7 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:36:46 +0200 Subject: [PATCH 30/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/3.0.1.zip --- .../Palo Alto Cortex XDR CCP/Package/3.0.1.zip | Bin 15902 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/3.0.1.zip diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.1.zip b/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.1.zip deleted file mode 100644 index 3a321c1fde224081c7d298eed34aef30cf0337c9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15902 zcma*Ob8s&~`}P^zwrwZh*tTukwr%soc1~<3C$??dC)xA-cI(~e-KwqK>FSy3s-AoL zpRTLB@9U!|0}6%)1of`~J8@_O{nv#IL+ns<(-& zZg$Pz>Ja zcW1nj1dZG9dDEbjg?|e)(Y~!t0~PkfjX-vL%b6dGkxl^@gaf2ZTGCFCK41ZLKb6U~c(tM+yqJzgfefbW?kJRGmJ9sEO*UfU zQi5lwUjPp*QhDA>@(I4gVDclv`eU-5c{XX#dPqGVgZZ5{`Ku0O*H4LpL_(^2k#xne zAtfo6(j&qcs$L71u~I(p6M=E#i!PM|)`R)AfI#Zo1Iy8zK7R7fq4?lW&ijnrrQoy( z-S}QH;X2v6*M2Xi{hb^3JV%PCNJF(jwB3r|MkTAHu_PKqsKov-ns0z#4BvLIM2Fcu zde43y0Y5{F?WcB8@j?1a$3ioLk{5~$8N+yf>DU2rSOqp4?lV&V;HUx^Uy z-LVws-56!wLKk zDIrrFqg_hMzt>gdd>9I*+)j_ZhM8{JpM1L3Gqz*P*44YxYlwM9KMH)hSj9TNHvw_) zFK)p`<6jeOMxZ@jYd65mZJh)gy2JRoz0Fi`LR_NEi4~sxW)(*|(T9#_=LR$9d4wNO zQ^@WZp^%*gIonm`YLE;J2HT#}a4Uwc4V#Z!J2yf&9|Gm7Odt6|*XX|>AF!URZlJEU zKs&{&OPN$lgFMo90z?UI^cgfpYPnz-zB~!Oq66-mnyrWOXy!vB&(6HMY$-r z+-1TA++83cuko#!4KVz`B74Sy5je+g+;mqj7pz~l9@<^hv5D@%Onu@KIhO_dT z<{cUfXHV8p_CyeCJF-tDjCk@P$>&yNKq-smLp?C z(Dqn^B=fkbzp-AR?hU)3IpZA<`ZFU7ScA|70?VjHe!w)d+I{^c?X5sI)B77yfAN=?5c zHkNL^CO)w2)klP#4&M|hRCcb9lGEz6N3IV(^Fxr97Uz$ehEWDZAHZe0TS>+$+;^~? z^TZLY8A4&psVimESC05#P6hpf_EqWrbaeTk zpB-U^#7l^JI&cqqx`GIl!tFs)br+RVLWfzUV!6+HP7*5aA>VJQ)@5zJowewB!aDl5 z{+Wpi@ioo$UVxqbP-l?9`*wQJc^K|5>-c69iy%CS;TueeN-KNRBcCh+wS-# zFhEFRPrRTh?oE8bYgsi<3ora}3AKIMofXCL;Z(did@u4n0nRUK!Bt~Zz$;Gel!pW- zjWK}N)Hgf+DFu^rxUK-e>px6FT$V&kee4;ggdW#g1f_`DB0I`Pgc+2DS^8}JZi zBnEohK=rG@_aTTVY@(7gdnPrmO<@D6l=~cIWUFS#Iuh*70m7<4q=B z;r-TmOX2fK52^?q7an*sYF;!J(ieUgY5Vq!^m`{m@5eaURNf1`|CqZ#>`_9D$(Cpx z*E3~!JQpkz7VF$&hHnh~rX%XcYTU}pHX|UO-f8y!W6Px*fOo3=M$S&8d=;!SD+X7XUxxl(cmM`;5505RS%j>q< zN~yUgj-LZ=`Q>1I8(jDI#e(51xp%G1ec`HGFy`snueVux#0==mni*$&bey+DP!8px z>8vY5y5!7#15pI>c~fO{ZdJ?rxs++n{!p#E8+gLUYBu1;<>3^!0-EWnWnBz@o@&Rw z1{q4H^5V#1eG}MpbLua}lJMXCfaey9(siM+t1CTR=&S*BRN zJ>Os}1J@k@R<)7eUD*D4?Nvc+<{}+&7FIj0I1;=nPHKvewlYSu4sU(SLk)kPRDD-1 zNl5HkL$a2JIP~GhD`xw7X_c)4^kslR=J@woDa;;r83$Jbdtk znX=xg`|az>d*bn!mCGQVTLWf+BXL%=e(~4jc5erjtqcChV)4a`LcSJVR3$4k(gmyjuZrqFDZ1Mfv0ouh{5#w+lJA5pr{=ZU^ zJbuEr1@{2Z15KZF}u%O-@29 z8>?FtNT3zVXTB5kdF2lg@ZPZ6kvV$`n1MRtiUPTx^RG^0vX9-{U!nYbSBtK$LGU*2 zR1}um5S4QwT&D^K;?e@@S?bL@pe|8QKuNbdIHZ@We%)G>hHQjW-lT%&c2VFU3q)D zv0foaVmjD|bN+18TaFfc7;JyNs#$1yyE5YpB)c77aq-~mxq_$f=gf~hPrsSBmjE@L zSt{8){~d9Q;PQTY*?z{RTUFBl@`i-v;QtHZu3b*l>Hq0H!Rlr+NfQuZZJ;pH!`2Dt z(Tz8uv#+>}X^z={#XQwp+ro61soz1^ch!`?(mK`#m*H%wdu;pFFIboxpsq$53;9X$(yg}G$wEzVOndEGQ7M~0jOUU1k9AsHkyMZ*S*CQ)9LrH zGTndP#SahNjU1@h;bR1J=vZ{^7)&*@n76#ctKxR*NObSxc8|B18{JjYe3D=gP7G5? zbP}0$pD--P@HF=45obi z7i+$}=(79JN$R`=zM`Jm!fpJWOoVVuM~tyl$XCJvZBqSp8$!fX-x@O4(P!Ot$RRhi z3&=MZq=9QfbAX4D2WDZ;Sdt9(p@X0zHr!VOXpI_VsQ~D<3Gbu68~(7pWVAWfsXWUy zcdYFNUf)Mem*N4ailWaz*+ukflt8nfV3!f?nNLEUZ4{AoPoq3okDI5edvQEn25t#m zp_2v%EetayQ~zREvC0MZ7U(K?^#JU8=BmZ{xb-&uC@=0jS6Q9FE6;tA>d-LLt0Lr! z4}_xkC+gbqW<(^v>*eIt(m5dEyvVFfFUAVL$vSpkLM_Sz4H==L1FTx92e-XBgxt>Mu}afi8Q`)d9$hwAHXR2w(%2 zks`i}fKErK2@!4aGS~j)0?~3$=e%GV(fJ}Q~f-) zOZ3|MCxsI`iHGk3yrzqc^)8Aq|c5% zR?gl*+d~p0JCWL$Z0Y_j{B9*kq zKR{pD6-}{g02A(gY~>Ud+Z~KMrrvx3P|bEJ!XG^24pj5-YifBt*rH^ z(#jz^)#>wayv+7RE#*mU)drAsf8Hr%Z61h{cl7T+AGV_&7H$Cp(teli1WmQOe(ja$ zB3%Y@i5Js;>qenAw92Ey#q_4J#&Yp9!+hW+uFeY!S+G@BAA_Zq>Wh7LlE^?F=>)LU zo+;{lLuKfx5>=foYv!H>60wU8)hHtg0%eEhs%BgRh#VT6XQ1l~TmWm@o%5|M8Y_C(dC_jAMFVdPDBK!O-} zq)5DmZ|*@zK7+YVZg~;o8(Afa^26tgG_65#Ow6Y18x}^Os%3J~XbmjM-Zh$$Mu6Xi zR)XJFAn%;Rh{;@<989esI=rf2Ir`Buz4pYHWU#!i*q#z!<@#}@X|AfjJBx%4k=Wf3 zUzYtB%phayMxw#y-fC;091mru(mRBK=W6b-s)mLJ~8_aeE(0 zRW0p4X_^KP5OOy*f1dHfE^VuL&Q~q{n+`9L%B;WsS&|v1!@&jmUfefXvSw}O>0LAm z+MU{`{l^B-g|_+)nhgXNBrFTq+_5$53m}Q@N z*=a2elq~qFrvS2k`B{Vsl0U3@zsT-f%9s?j<77Q=x~WWd0BN&`N^CB8f8l6G2}z&0 zU62=bHU#2yKaow}qE8gO}wck{x&CroPxu8+g8;Si)SsYA1D_-;GN0pp06ASK*(LZ z_0WvuoqVo(&XbsW4Izcax^}*5_#YvtnRA^LD4;{yGEnfMzR&#A1u|E%ya+`D0y+2>}74*#)FtMk7 z;kSUS?SI6`qLB;a^F+CnEwY`fIY=Lb${yr<6J&}73+Yw@TrgBB<6uTxnQ|^LJ4q0e z^lham&jk}%;QbY;y=94`W%G~!OhD7+ZntzQ`rwervc$!{iOH9-b^5>ixrJ)#Yvmrmhks*6{HDg2Y&=bC&jO$#i`4&3REJYU_ts;bL&}@Z z*r^UzdXmX2BPJWkm-m`y8&6A-Ex-e-pUj59zIXgZ8G)=M!VVgznp(00`^Ve^s9DEc zBk_|y!xk7$Jnc#lg|6TWsDI!HRDS=qTqusWNJ4q@;K+%qgOkPUs24}0qE_`=A$%Z@AA5_4-cO_A&t zgQz=Ak;X**@A%*sWH_VT%a_XE+`mv)W>*|88q3$?AAXvQ3fU!+ad#Ey*ls!9{x&&$ zJ598^w7)SN5NSp^q;$Iub2vX#HoKZ$UwP9z3)`St(|a7=a!~Jgjl%Wr#i9@J3(2Ng zN0s)eJ0LWWR|};XQ`-ONHm3Vif(1t|*9RQp5^Vnt6~ErhKCq<-;OO?Ic2}8Fe8ebq z#+XKqQxJ>R`(t~5q!PbD%;v!Rz9fw3R7k+xopOsewR5b2ly##tyC|1{cJYy;yZsa{ z_}rIHtXCm_qPkIq^z+xazJ8JDEgq*_f%-}RS#f2mjU}1rQW=J2oMPaN+6DF8v&uK+ zi-YB06uw%L%zx#flY!JVs3sR*#<>-M)omU5Wu!{F2J06sq3}%b=6%nA5NaZn%caHD z+-|lv3gSB{98%zIy z!>>E#N^QA&Y0A*VaQ_P?O_(W$uXhY+Jeyz3(R82f?YsHGi^>13X8hKil{L6woD7_M zW%vc%J55pr(_Mo)tCV042}y&y#QBjOqWZj!-4BK$T{%4MAUEa=rIiv@SM;b3~YajKQ zf=o}_{y5CHo6hIe*)V@QoG})5H^-x7mU_f^VZTgeWvZDYPt=zY17}8%fI76B)DhX- z$+1Jx| zi$@ru%CgG%jAaS_WJPuEtx;%@be2YZ@Q@`*rMI3;UV*(5PHD5_RYdn4X=&j>LX#|z z_TEaaeH-CFshp+J1HP0J-&o3OsO5-<%5#^&a$;G9F+XYKxw)k&oOo7Q>it5s7;30U zuy1q~&S<_SN35)~N}Gdk>oPAKX0OIRFlqnAKOH0-x9#-?-k&$VIH*Y1c(jm|XfO@< zrmnJsC|nazOQrJ%(n79d$We|2nzfN{g#~Y4s@8}?H`pzK#Dp1K4-_IrG>QjMn?h1! zfppEkO(mZfsP@~*Q213VCyO>Rh)?#ehKujWE4mK1z=CxhT8GotwfAM=JRgF_P6rHF zWUu$ip2%S{_vf~T1zSioY@5Om)0Js?G$UF2Lb$o<7HtAU6@U2SabF>7*ZUDtcn1|u(1QU_GIfU?; zCy>-(;}@d>hM>A`v64RFOKSv7j$S~o5j{>nXJLjR?}u0&{&(0a8N0S8h^Y3&ZR8 zV<}>gs@|-f%HghPV-KWrnm|6bx5?&2nrg#5%7V);tmD~o2!$3w`6Z$*xZN(;dIdS0 z1H6W!zfQc?&Y;&I=sGtMb1#%{=DUQN{CZWkz2EHOeHw@dcwOgpBq-EDDR-62^S|Am zUgw7@;~`KdzMX5&hKm^amoQrluBwsCn*PLV;`FVh`tusZLTF z0?GMbe8>dKkqua*3zgPDmoi*vdt~V! z8VuPM#$aQA_agLL3@b9a93%`g-i$uxgR!dRAeu@f$9TJ{wMkhFV3Ua{x5FILogi`6 ztP?~_iG-@b2{X0R&$zpy!qWP9`Dn%QFxS3-&{hDxkR+;?~8|YE@pdc?Tkltx-T%&n8@{i0M|h*Oh2AH7>_rwR^My$lMAt zS>`^$WgP1fCs@eX5ew8ZUG01b3_3#sb*mva+5>i*4)rQgVRf^JbD`Ga4q-D93s-tO zoh(Cor<;AYFcs8HH-fO(6J1Z3<4q#xTg16vkpp+9S*(Llp*isDwiMpY_h3|c03$@! z)4eznukp>0c&W5p9J9lx+6gU-W3Ke#lqr=7751|?xXrgTR^oL*l~{SEju^-G9e!tB zH({8dX9iN1S}_^RYE^xXn!HDiv$C8jvsy8=l2%L9eT?{G1S6kiO;cMtTQ3q!>QtW4 z>$9k)hRcGH-F#z~(wjzC;`NOBbFGn%Xgm2sfxW0W+k(#O`o)~)JOQ=`^N*lOIF$~9GDOR=g=tqPLN zDRN?rGJZBgaEzZyt{}`hD-p8GHew>^Qh_eO_6rw+msvUl7`lSu;YPUpzc@(;Sus`( zFtxX2M!v=|kkG7TU7O6vi5k!r2cbcD7xgH#Mv!-{CceozYYo6ncyd>EO?XIDi(`)YP z4Awm7tztyePzUfx7pH$=MOngP)4tl2+OYqrXgTgWoWYH8pWygP0-;=dw%s;c1b+3d z=4w5YahTX{hu3((P&@>u;J}ajb}vz)(zW|NnP5k-prhG&{obpiHz{m~Kzl#deHI}q zpYbt%ldU7fX`nM2-Z&Xix0Y078AtD?rS8yhUzF7Mmqj?3M&zJ&1EdpSzD%s5AKt*N zB|42JcPajZ(VA7OU9F1tX{qcRJmQzzfRa{v75uyrk%f%+($cK;wz{PgzRv2z##pV} zNKI@J{dP@bzIM!p)@MwoA9}4=u1wm6?G{KSAd<#YLs!>_Ie)W_ey-YFWwlPwC8t#k z_AJ{BCc_K5B22+>of~RXBZ%c61V@pUn~kT5_hawU^y}1X;?*XN z-{^F4EDap?up=@7QHx!dtJh$?Yf}QVF0(O^mqj+4_h#bo`aZNP#?kOvoNJ@X%L0BQ z0K0!lh^IR|C+eeHb;McvU8eJo0S@0%=Q}&S0=x759JeR!;cD^YCW{WtDkq&4fmYkE zRG6r?Fot^h-r5)nI(z$jg6sX}T3q3Drls^9b)~JHiTQj9J6g&JwI`YzMr|nYjg{YG zpO+T1#q`XZ4}}hh0)I!V<1lSr@;&YsS~JmhP+)woTCW#f(pyf-_#kzl9)XLnO2{*6 z?FxLLRd8pfq|rKT7CF3i_u9~rOr(Ylf&&lUyLLu`(iZ%lUjEaJDLl0lY*DB5NyKAxnPiNrm_pB#C67I7l&=Iob!RX9+Gv7IGi;<258N& z>(BV+Fm9{1~&VFs;5Bl^-6I!J^046(GA%}Rb?gJx@Lu~LPmH6n7C88%WzbTr({ z9Kh`DAk@2}UZ2}PCF2vo1#rfxYemW5ki#*}k(gjsM1el1&zCl42}-9_MfX?Minch8 zqT=*(8&z1X;U!~qio2JUzoOQgAOP)+$B^b|2{S^XX9=2T>C9NN!QIBLU+!j)Z4`Cg zq*5@NsU@zdGHQ!!p*`KkIiPZ^-Jc+@i79Ry>p*U9v)=+CuVn~H8#8-@m8ln)(-v5 z{2iV=#(on}cBNZ4Zc?QOKL|s!xj{I|NF%+hr9-X+T|Dy034f-60ID+@cVH%anYK(i zl_X?laWdacRLqV@gyC!Nz4p-%`Pia5+ zRX)F4GB>m3bejkLS3VT&Dz=D-J{!F%4w?G?dmze>V7H--$Gj=wOFvRev1eD3M#Ft1 zVZb{&4OfNSEt-jfWHO#IgOw3${8@TMZg8|8;T zoED0E&xL3*&wow$g6Kj|Sf$Z|(T$jGLheAVzK|p1K=E5S?VesTSqMXtwa7l&{C9kj zR>2YlbyblMg1{|4!Se~T-`)A3Wv8=i0!`!?1mKRv5KgJdeK;ZdX&oS=g);qRkVrOq z+NoK9uQBjA137o|CB?jDF@||qwU>|Ab}F_he?S?808N60Y6{_bqX%t#gXulJxY=)^ zf^#~qZD}ewDMQ)&S`?O^d0TD%*}y564EWqM+a+2mp!?FNXZKm1b3TNEjjoRwn3^O&V>y>;Me9H)2i_+6u_?}G%%}VN z89msX%0WC;oxegGT;m-!umA#GH-%nDNv|k!aP?zvp(Aps-SiKF# zyW{`UU9;~YJz#qbB)T@+cw0q!Lm{0@WUg>Pnd z^}=fddg#c+5#fWB;-4A4J9M9OVLlA0i9&tlQT>&o^5@Yx0?_OwsDZ=_u5$R#N&`Vy zdb`i+yCO@9@lNjrPBV@Rn*-iQoRR3F^xqV*UC%RbD24Um)B$(BK%iNw=T(9c3xs z^7hQLQvoKxA3V%~1GMV`b3P(BG3(KZan;WtAwOr(!joJehcco2{dG( ziHB6#J(V{`*gJC<*NaBAS_Jy+K^rN7Ej?n^cF2p+Vd+K)Ut*8Ue?(S#%rbOhw_}gi8dY1CleBo9J~Y` z7XN-RQgM-k;WN26z_VAV=y3xIKcI{S&tI`$)!o>h&7deN`@Jfvsk1huRpQ#D1)qRo zWetQ+M1c*tBf2V6=*#PZU|$6EXHVpr>lif_h1)>dgymzY8?B}+{bim;!HB&xE8uth zO;!S4#3$+(@t{mL%r_aF(mdm~b&oYsY;XJ=A62~@OUoQ0`nIt;Nzx458*rYN;19o7 ztnvXjF%}YCFu*jRAn7#)E%RZWVMbw5A%MFiAg`0~hYxTeXSpzBNsN@w2dBvFmp{{e z+Uysq#;0^-xxJVz%7c!nqSj`2UB9DLpj!+Z$PWd#qZeaxR)J{H?|tf&uJqTq_vZ+8 zNE$@nP)ShW{U`+L9Pn)3>zigoSCYHet`KgVbO`|wG2uPCn%M z?!tRr326~Lp}s97~~Xv<@t#0do^3_%OuKD(Kl*jZhq8a3s40cf=Jd2 zT9u5Q5)ag}PPubS$Bl>Gazx!;Ok6x!V-Ud8IS4;|?%4MPxAzpmTz2;(ApAKoUGBJlYvW3n z{;W^Fk0c)H52Dsj`Hce5Rqp;4V!3vRFifW3LsdQLzb;f)B?UZlKCwb|r0OpCs=_6v zuQ)z5=a(^*$lHc!7-f{N=I6ZCq~Uw)kgK>>Scfg*bA1(Rg{MytV5T~Tu$Zjv3|pjB znGe!mZBXPWgzWChAT&61LZC|qBI~E#u?$L~ZBJ?PslHVs!K_(`{oK`!cAEY#pNwJy z^pj;PD6i?QZ>AivtoiTp1WFNscn*ROU{45dEi(vKqW}q}BN%SO{YPf7dm9U{D@#-4ndD9mRSjFfxrOPH? zxbzN%^jHtpxkVw*(O$Lz*9B9Y5pt$xCT(y>!q)^l&JUIOFL=Oyo%)Ww8L_j6R5H7cd^$;DpXZ!PmssRhzBCq}m z!Wrt+F__s^`wY9>Q@TPbjR%8k7^(z>ya z1)aHH>lHDp*S-~E4!mpqDlPP!(ab%*yq{BlBS{RT!|p406?mp~ElxrI(C>1T#0@K56nXy=l2o+#$c#b9llFAP^-$ zAUp&@$27%50>1{d6BF3coV5TAuYL9cGL_BQu8aO;ty8j9BAeJ z*VRYEfQWq#f()(1hOHErdrk&HM;6J$(va)vNYp83Jtbe$@~4@4JievekGbzbJu%Nj z+;6{tHU|WDVgeTWLjtZYWVfk|NP6#!u>@pMq6O|PdGU;=OmM{HU}U$3sw00OJn7iA z=a_IDWAR}1$V@W^nrMGjkM@)&c=CkznZ$lE4CME*&qGK2WcU3M`7oRZ&)c`b(*F?B z+h?EG5sZRYitnic7!*N|R{+k~o@6C74O7<_cw}7bwzYZX5Iz<5^ytJk650GuXZ_ax znfnWDYSrwj^v5)$yC`__+JGLTxLN5XM;68WrhY!Yak}XyU$#Sm?`HqVkr&OQnDwir9NB<(5^g zMQj!vL=Di&x0Kz5oV=^fZewnie(_YcKnwd7#o5kS_{{&ZW~*3njhsdJQA>?Putbzo zLhKXxTNpxFE-!TN?3{hg?c~g_mic&mWXlCmGbeL${`j8{0RRJEM8@6-Ghak+RyV<* zIhKcnLZNO?B1z8YiYukJ7?L!dKMYjLGUUnL^X1tNPNL&7FL1`O)L;5b)YTWNZN~cg z!utLm#Ee<8zVik8Pvuns-^{SF!?P7k%70M|N0dn~;4cX)hQ}WZXsRXZuuH1DRrNpb z9j;N=BY43RoYCm`QZ*fj)4jN1VUsN2)rN`_sTy^Q4+44L83tv4zU){IZ%KMH1Kz>$ z1eCbmQD9+yu496}FgswV%4DO@@ync1Iyyz0cs9EA5bnnr3mAq7jH&t!8rmLr=pR*#QEpH1fII}RGbBh zwgGy^lJ@9U*P}_gE_BbmZfBEV&bQ3%S-Z#E>Q|YvwO5iY_A4%u@A&n8O{}$3X*U#l z49x0eyz^8FLGG1jxrCrQd9XQ;Tf3DFnaUx(DNWT({SYOl=WYK4lLBfy!x!Ao&kwMo z3?x)G(XU7d4j>@lXJ8=3{{@*HI{xpF8RkF8%*5I3A6}+rC2D4FWpCwbPr--duuvf z4Ed_*Wocv!i?vY*YI#>_A&S0}ogy-{N37Z^V3F<^BTVst4}agNq$y021JaXh3im$# z919Us7Kh*7{$wh0yd~_O>4ai|q%G~ZUMxFsetuCa1%G-)h~%m%6EobV#gbYi6&F+L z{k(5bB*_WexM^~qF=~rNUkn7*~ zPeR9Imi3O%b96?x6lxdNnnQY%ZNgv6|2CGrRjFBb$x_ej^GBlEA1b49228HryghKV zHZz)uqomI8<87DZV@S&G3G@9=94eP^q0C~Nl(vZ( zm}9#q4unS0<@$~!KOeb#lFew?1dyKC*w@TDGY4mCK|nRdN~l{Is#=8*P*4daNu^QrjbqLAQL@vC)4o%s1(Lg;U;r2QZ zPD(RW4r6_71cH|a_`y4}9X`5CsXZa8xG`o@imqa{x7|R_^pFUTnX*_7rykcHR-xr* zuz6)vnXA7?#Wzu;As1nyx7~G+p2vd9p;~cO{y)so{aeh9!XI; z$$H!|mW2Dvww#nWDEFRo7vYF@zZ@Ld-k1Gfo-Cc&?kNpEQig!Jw=}lzP1JM)41pEY zqD$~{t32!^YsCrv))TiCsMgk2_#{po8S zPn7E+xg`+_9^z_&9d# z*wRPAYJYxU@NQj$zGtB`_}((>=A%J-kv F{{h@WrWF7H From 8139576d79b6b75841df66c03bb4a63a21ac49fc Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:37:00 +0200 Subject: [PATCH 31/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/3.0.2.zip --- .../Palo Alto Cortex XDR CCP/Package/3.0.2.zip | Bin 15899 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/3.0.2.zip diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.2.zip b/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.2.zip deleted file mode 100644 index 3181e4e4ba937476bcf65dcf8ba554d298ee6ac8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15899 zcma*OW3VVew_tf}+qlQJZQHhO+qP}nwr$%s@4?*fb@ZF=o|u@aj6z0a?W$k3D|4?U zF9i&O0s!%^HMvS^0{kxoE5O?Qwc-WmBNAtNOv<=_4>_xr&IvGKv= zROWno?JeM1D#2)`2LpDP_A?Ec1DUfxf5FvP%y84SAnj`ubTm{n=N0C6fr|&r%?V#9 zX6+_q_S7$7{)|TbQoRAs{RpMEu80A$vaVxNo*@Vq;?k zF7`ev-T8JHP8x@J&G z+}A!Z`OOPo39Y0-sxPLG0qcY zKAS5Vku3Km@fc5h0O|2<%`tJ;9IGT?EvUAq&f<=X>~$NW^SeiGJTCd2P^$dspqw~E z@$pRrWv{8@XfYS)>CTwpWryMc^TGU@uRqz%f%#}gFAr(QKy2VU>wU`3a$r)3R&4JN zp&IF$*FJZ;z1>@;EPIl$a6P3#q}}o+{o)m(XaZGy1Ogu@^%ssj`fsaOyu-|H?PqUS z-|vCNwi7vqpjAEI?hUvXePx`-8qwbN_t!zbLk9gVZZnnUdlHCoPkd6XwmL_Kc4Pk_He4rM-)mr6XLhyYLNkJ0q zBOHrLztS%EtMRx--*Y`X8HL)vH`$}!e>n%} zjem?Y>jQSVt>669wRGTZXb<6N_cTyK32+KA#Fe@C8I>PtMjY6mpXtt?XW@N7P9eCU z2Z49yW^7lMDuL0{>TJ15z^v#w*Ka&*?cNArzw?wRF?{CoU!mrKJzzeW-GX1M0d*$;SuxIi2>_J;uVu@}OFp+2SsO_p=>G*nqC9om_M)d(hfN}c#;RNigJIf-2B3bJDT?;9U(uz(!=!>_2nrV$ z#g}zCYq;>AZb_r}z6-;Nlq9581{i}!9Xoz7AE2ZPw6ZREo2ow#8>IK}x@`Lz%RW_j zS0!Xv&htC{?dX8*e!Wob@6`Okd4uDtOXlmGVgfOM+lFCRWti#=6oR*>(|D&gkzjuE z6G&8HuG)$rje>OF`vCaN;j6F(r}4S704*1n;)6`xOeY<_u-RvtFQMXr2^kHQ^t~8< z({0{I=>dFt^I6Hpe_akmm9(+D4UXcKN3aG~U+cw(?H)I|yb`0s+a8sLz)pviCx(IJ zb0du!noCsM{W4gX%6!qUBIeO=^9j`EXV!>723ZIUV1OS)LAioluSHJPxJcprzF0xv z?6)(qDwIR$7{t*x*e>;rN2nL3go$q&2WHA(C|rxu4wwc6c3veDx^2~;>F=j=V|FM5 zawmHZ&qGL^J)4hCcxt-Ztr;p8+m&Ko$bTESl=63nIXlRnW_%<{`I|8sXP5{r{jj%7 z9aw`r0-SBT?}&DHu;;Y^9OH0w3*0RmD3%?_Q%ZXRhd^o)Nq|H~G#?o!fV52-EK4tX97WuVZ}>)E|VuRBEF zJ{Ue(garw{c&N{vJXHU%ag}o^;9G_1&GJPjXovTaHI!HRkQ>$qG{yN-RslZkQNa=; zvrxc%`*c1KhHW;aK{f?qfF^Do`DZjfivSFNjuRJ%{fWuRb*ujzw(5_ ziC?R94xtR}}2 z)H+fY-NkS(O61`0D!bI%{(|2$unTCQA}>_(az#BwM;E>hgL(oCc{BZyKO)bBWX7l7 z+fy!kYei?J_Zk=nHa3srS$B5PNtY4nN?ELe!cN0{5Qt4gu0$xyL*EMHY6X?Hq46gH zzw*Q@PvH@}E~^}+$y<+HVJF;9GGPxv-30JU1n#_~ zvq4ATvo-htq%N|;$_L0~5*oDBW%Gk(YKvTdK|7p)M5{Jcn675CN15^%Ze41^1U_2o zimzI8_hE_AcU4yWEc_h4J&ySUgGJdMmwMW0YJslsbhH4t~k1hkkVls4&^N0A8-Q!OKM=SZ?RYnPp^GGxCh zwozd5d8_;TFrHA$aN-pN&#Ww}M=@Z(vB&n0&a)6sH0((ARF-vZj69k`hJGP`5FFm( zM;R-j70v(^V{|PL7WahDb&rJnoW_6q zi0;ZMuH(%0{&{Eqe#Q@bu2XtD>LU~Dft2wic+9U^(|Vs+?q;$-<;lAtsz&y>w{O0^ zFzP!sM)b49tp9--=b|t$9})%@x@;N@%e!XyY&g_JAP08r5*cj zmfH;>&}>*hsL#QW8FueqyN6x)&gDJ4^VxWzBNabQRs+zkebQj|QwA9VOY8|?lZc*{ z@bBOC&8KbhF!|v>#m5C-A^Ijn{TOv1P?vjS~ z-y8sp0F>fa@Wvs@k7sX~mzvH<#)DOwK;#QTOz?0}?J)(P-#$^ZL9S_&5_ZOBbcc%vzo53xJ5n<=n2)mXhxuw5Y96=RC1M8^t&%C?w@km(c0Bcs z^F5Aj=fxrNA-kCin8MY6j3?Dz8irmW3sduA6+nHe7@b@Wn%El=VCu+v>&--C+1ffc z8j`o6i`~}gSE-_febp{p>qNo#)FE?sh=q;(-F~#ssGq&0UQ;Lth-1|!V%g4~fE)c2 zf%zkHERQ5Zssbn!@(RVX;SDUE4tlwJ&(J4}jG!gMt?^c|Sgko@a?sQS^#?h@wCNwKk$kaQWN{@3 zl-IZFyo`Pg2-d|qJxU59PAsi zT$vcS5jA1yj3TU2f0TGM3DA84E{YA|89u&biE}ai@Bv8({u`$quWOTi=6H}9fWLcI zSUQ69!QXGvfKK?#>}+KMcpGWfzRWf_1r__^TIM~s$lPcsNpkRb`dGk?eD2!-HZ#$Ty*6YpNDA!ap~-Jc4q()?5}1h z+QTl7%q-$vB``P^El+U4_Bo<$=aoEk#h;>4-y&CS?;MRQraD|B68(30E%33Bmi`lL zqx&bteUJneeba=qy$@SAfJgnTj+_9|T_M{XGmH=?usZ2BxCqSK78m_~fHyM2m(lYu zT&I#^Bl>`oB;q*S1a59l$7@lG^>g*b{&$0v)DB4TKywCFZk}5>btd&zxIh-rk&-C; zf?XIhv3Zg8_uDHVf~9bmpg$NX%K=3&JX8a~xKq^pIe_CwP~bT4O&_f-u^GsvqqUp7 z5ybpCoPYT|AJ}8K?DviKMYo@QM*)smBY`fLy&CiAEK|1*c8Q)JbfOyDpzY0vLt^yTF{xG%Ny@TxqaMtyD{0uteXj9K``w6yqz3)e4RW!8hiwd1)Uu{IIUrn zERl^eaaX}8L$2z=gLotH>>J9{yDynL2$&1JcUdC$;`nywC3X6m^J zbh62+}6zMwbgV0&vB{O-=DSCEph_SKX0x`=9X(Hs=jb5eRxpc7SB(g9XVnf z+6!vwW@$tDw6om|ob%u=jSsdwf(XZHdpcL7}vPd}e6K^onbAx}=P zpHC0B+SYK{!8!}Zokfc-BR%F(hxC_718RokPShLxemIh9hch9?I}hn%8{J=K`-ks_ zxRBt7(4*v9T-3i#Y;$fr{TSvZ(-%(JjeN%62)6hzr?G2VikQ&IvN>KC-SH+K%#j=x4_tyllM=bi5Fu=ReS2chFLK0A{AT zLoBIwIZp?Hbk@(IKtJ5GbmCN8cfk9w>PmkHgYimnBHAtGjOPumaM8#0y5IFPSccL# z!!Q>BRf=hE?b+jGcjfiW_9HdKl8*!7cz1&yiudelo~*ZY1LL*acS>&bf0U zs%*h#DT(5{@Vlr;^l=T+;X=`z(ngZNKJrD@3HP?{apExk8j9`5-*vUZ$6ggrL%t*9 zcrWnG{_KS8=mgv1iP4%w_W=r+(BBWi)vMwr|G+rMJxqJ8xFB>9Qe+xrb4@f~(Kl8& zeO)%)3P!+73*3NaRZ{7a{Y(P^-h|fV-|=)dk_3{!jB+AAuO29D#Berh+r~ErkLqYt zlMiS21IVGr%2t@!!)v2ggV7lq>E@LXRk^fbJXs4LrFZ^p-wj78!XgiC3*oNcVe((x z@b%N~@d`f|aH-WfM(un6ntQ}zi{&T)IL5mO{4xVxj{dL_UWVFQ2ri?F0s+ovNRdEJ zy#ih&E-dRf)lQ*#ncY0!YW8}J|6$Fgqd=zaZN06B+;ti1g5#C1>!uxMg?LY-K)X@+ zT?!Er$6I7%ECH_l!QtmNxN>DXp?>Tvr1y`%d?YL$xWY?IBVQvKDFo3bgDb*HbUERs z3|Q+SssJ3W&6dOx_H-LV{;QN*(}4X~aF5#6CBO>sdh$^cz=-p~Aa~5cCB+}AoO&!1 zwZBs;NZ(tIYkxT<{sO};n(KVoH2i{E(mV}?1yTW=xn67w43gYErU7D>S7l z^F?hCI%qZ@cHR0StU?-{m)b;D*+Xw+;V8}Qt43z}-01=asi7p59n00uP=XPc>b$lL z-IgP=2IR&r@?4+argGE?^oTD>e$;*fVL{t|$!}G37d}FR=JhQ;0;r+_H^b$GDc`Zr zEV7P5TkvCPG?gJjIek=e&3-Sjyx$l3mBs%DM!(@rCFC=QL5s=F!^{O$*O( zrNK}qc6MdN>wdF zv|RemG^)h@qjn}D{@7-Qt<$Jb{-z;wUu&IBc4U%C9+}}!Kq3v?61CX`oUn=Fx#VYS zMn37$bGmAie=T=RpUN^5PJZ7Ut8+?o+Qr{*Ou-cFI) z!_9*v?PB97Oo#Q^wW3mMOUlz_<*U;ZC|(?%s3F)}#Al~hY`vg|1&}i?l~2)?7E_+E zq}kBELpLHbRk__xk@twyycJX4v{|zkMn6pMl8sPrHx6Kqi_9{pP7cIAfX3sI4uR^eU5Dc4bJUxyYq>Be(NN1!sRxx3y)YU^Gknrn&w} z1O{$zU@~jmevQbeKyRka7&;U#nGS*Vr*a9}QnD6n(RleuRur0mrl3rYr#~4&x{y&j zF^Ah(&CoEu{F`I{6yj_L`@lxTp>NvXe^)w4>6i`a1IvqwbmlO793v|-%V4fJcBevd z%e>b&8ihtUg&j(6T)foN_e$he&Nw9S>s`sN@5FGBF&+j63x&DJ?=r)fJaFbc$ygIW zWRVP)tHuzPt4v=YQ4?x$I=?wb(GjyF_0jfv(wowSv%s)qFj2Snb@LVT6I@Yoe3y^f z54WagTuA=$uq~0zlv65E=c$B5W{mW<{M1j41al}klhKqeX`@Wv8nU6>H;?KO{%k14 zDFGgsY;hkXxnKmPVEjm}Co8Lea9z3*vbls{kZ55%Oy|g$vjFNYaLud_`h(8Dnlc0l z-}ou8e*I}?QAsrXIC+R-NB`W%UM+LMAIVcUJTsjUj^TL|)@e|n zU8r}-3`O2`$Do~qk{CP~^uCmHJ9v%kF!x0^hRf%a{TuA()tIpa5oW8@@6}WBJ zVGONLUug`UsQ+;c4gg1r-=5e3ZojL|2y{@-50+eX<_N5B_rt136Z)Wt-&+<)Z};YQMdN<_hu}Cap87x*aUcPnwqP2DXkgD^c zThZd~CC|_*akz=Q*S(Opxtr4Cx8JY~+aprna_uv;mmU5K$8;S@r-*U~L1K~15DO(Y z!O|Yt4yWRoF|2bM+49Uqh#*|;`;EPKe_l(%Y`M3JV#f5*bg&}TkYyN}*+!nyWFBko zO{sXTX&ObA=eP`4;BhojhUOU#{W5=$<9(+8O4}DW?i}ZtYwKAozqWULS;_`d`P%|> zA?U(bwx}BNeuwVmlLR*Kw#@D$S@2dF)@a(BlmMcUrWh~43Mnd=ktIH+bdq)4mVn4+ zt1j~Ap(%CE1+xI!_~cqWv1w*tUq$E`z6fhT_gsnFv+}K(a!`;hV0TAi0DI=*>OA#JJW>L|y! zuJW|R6bu^}`b@1HB~at~0T_&b^?4$Y2)b+lJ}+f1=wZlA#Fs5A12I^Hlw!Vtw6$)& zN;tE#zDsg~`o%xgzkQJ~C994>UB<2ELW#a1nXww>Oj|gup2y=pkeUBuPk_o)qK4lx z(!27UVnkL)I8pg8I~*l91ZX16T!78gBX6+w{w%NU4PjTJ0h6H}wga=Flhk%zw7JGW z4%zKT>-EG^NQ^I8FE?#)*lq-65wV|wTa~B;(a@$d&_|E9G5M2wHpWlvv`F^K4j^r| zRN5S5ZdM&`YBV{lmCsJ6U<}%>3VMMH+xnatf6Ma=xB5?mWsiHY{3*c{jtuuCWO2w9 zu~!!`y<&@51gtCksVq!$u+8+V>x^C3U+^wqla8mZ2g9pvF>S0}5f8xi{Y7x8R1r4` zeBw5~3{q=(SVISW+|ZVP>-h!3i9j5YT+PjFF7d05X-XuMx9m=OolFkNM?*(PyNHbP zB1))2X$7|QZKZ*uaj-~u9;ysTcxe&Yk3J+0o|O_N;hVEP_=l5W`KhUVgMR?EBjl_G zZ(P&4N|?%6(e5&cPmH)VM9O)SN#q~1bZ1c;JjQ&!7q{HbmeT#r&(t~C3*`N82#So5 zQu`%D^J!zy)SwEvV#R}>`YlC<;lGE^$`rjI9Ov>uVLsZ26WB13R05F1*5M>M!HhF% zNQ5f?{a}odB-|HBs-Ug(!Z3iFk>Q2V3GCpWks=&>Hj&g$uR@s__9ww}^TPim8d!p} zmC$MQ!-SoZf)%267$(tp*C%UkSRC%|0qGjGEdP1A++!PV9>v8iQf8gbLT0Y*=&E}d8=Z;r50TvH` z7jKuj&N?wQcb9-7onqF?QIqYltA-N!Je3J<5S6Kxe+Zs`oHy@BDX}MS)va=|{~0wpSW~U7#Jskh*b?xH(vaE0)jBeSqHxbU6yzXu?OZ3)7!^ zKM6N5>T(eXS{Nj&8x8+ReN>bi-)+Wr1DBVx#07pl-Z6I?@C31w$X;S~`RsLPJNqg? zzw=NJkwAUx2F>R zbXQ(FN*s;!A_vWmzMG)=q;w|j3?qfiUV&aPzE=;*i^LhXuNFP&lsIE##qHJ-NP*9H zmpK0Ql--bp^F)J4_-45Vlx9X3c<^g?vFvf*;h53qC18nz05-EPMi41f9Hj~>dtFh> zzi_a{G`L5tzWsb!1ca^3p|)N3#>=b3k2PTieXfP}9PvF7jJ3EI_{;sq=(Y4_W4E|b zWB)dOGlM|WaFA3nx2(%ACqxR6fMfksjwLsp){oqTT04E2e83uZ!YFr5LH|M%x{D>Z zIe~X67{o=UzdY(eqdQ>-K9hmG7gcjTM{m4~_?qV3VTbvY*$lu+8%i6-wuXNEe0sV! z+e^kd0ia9ARj`J@X>3NMX2Mh-$C78KMV=*raoq*a1gh0pl~|EvY#Qn!%#arhO8wBV zNA$tr0@TdP{YN)CqGfxC<4r2pHttagN|;|77LY)xMuVXvdK!~eTW_!cfUIG;&vAhp znTY*XjPJP+RH$d$hYP4{7=9@ZZCKrgF`h((^K?UJ1uNl0GaiQHg4Vk!nrpsa)r*)C z6jGDsy??n;cx^+5y87$nLWAM3z5f(Ezkc?B3!y-huciL|kJprIHgrb%7PsLE3Ulg= zw2hO=q{(q-#W=xoY{JSQYH@(J^%aEW2^JNpt^bFMO6$I)+Wa&m8k{MY2}M>^TZ$m_ z$3zispLiDA(dVY1M8P3NlrM0@KI`np&5kKK?w_O686z@9>5ck}y2vsJ-hE*bgUAoi z%2j!)SS@yaYThjRlf_5odVRpBdP(eBEyOyFsTM^Nq((|EY4}Fm8B|Ja&LS&|tw|88 z2q*Y5itNn(>L+qz=CeU1@;$HwFF$`U5tvZExokvHf^F+@Q>KNi7&88gX-Kbh4sbh^ z387s)XX(o0WpeB?JDFKds<8%~9OGQc+)9Blv-Q!sY{&_)Ohf0u37z1fm)C@&N@PWd zYB$UT3mQ#9t&+z^gPZI=LAD)b8Y`O0KP@6z5N-B2E)ZK)qkoL7jHZw~#0$0wt;OV$ zLv((re{NBdC|u%7pdTYLl~Gps2+ zH7>QVP2D%*3X#J%8hMQ?b*Zo_#euS+?UPi&HRrY;>-T{e8DX~W0edhJa~s-!I_D2{ zDNn^({qx0*3X^E400T*br-S#x_}78@mfbR7Mh*mTxUwrjvE3qfpna!wFOVil#Vh z0cBQJ=Yc*C&u_61G$CbYslF4t)?~%Upz>?E`ePTmtd+{m(ydXoSeIGDcck`I*63R# z2ede7k?Vd+W$)_r*^=FlnErU=dg*ejqw8$N(lJ@yZ)!E5DOrzq4zQ+H{#;PaT2Sp* zmV}*!OA-3DdAi$vgi5Tzw;oWX1le7ET1&z2RTr)O(Pg1bv^yTM#6lZ>^=-)Z_EQ zvx(S9h4=A#zhKj~=~i!g>yAom9Vxy~mESjNv&qYCDrRB3;aC?;hesG8py{x-`MWKZ zzG-i&S~#wg)w*y5)K}w=A@%162?S+s?}ZkwI{CJ$?>D2OV&QHilB1%AhZm=@s$#Bm z=IUX4x%)?FB8rTDkT@2s)Cn>Y7d?;Upw6~!4JBKJuT2|Gge2LkBDxT}S_iWvBenZU z$|2b`s>puLcM9)F(eiZj(KhwI1ufPwl-9^M%K)q>`97s%O*m9{+Pd=R^aDn=C*CZo zIo^LJo^4fJe|lg-zP6jZA#TvWEGz2v_MQ%He#drqm@%y>dVz+a^#uIVC3;&m^X9<& zV|kIvDsM(YAWJe=z1;1n-dOm8F)eY9`YI`;_x9YtM8cANOUnJS?IOVzw`6QUqPV!-gECSQWHWa`<$cnmA~%(saK}Xz zlW(W#386=XRkWF-q1=V!E5^M`vwUL#4NQ=E0%UaRLQk>o*7>Y^&1sE6G)du>s0Wmj zEv$hGY?n>34#(Xpf>?kRtQ@U@4o(lxY)pEO%MskT>w^a}iOOsY60Mbn8M~`hx_;!t zegGeK)05{(sMzzPgnq(1wK1TVr1FjhD979*FyswEfvF3x&C)s6U?L2wv?7@_6NAMT zqy6a`s7B3}ljRVw{$HbGK?iX#V2{VYV`(B`lWfec$lpVQ- z^VTeb$(f@Fp3;paf~x$+>W{pyfp@;!wu`#$qHR31_diM!gKOcg1W(RKofFpd0~h%QRZRW2wqpT(>a z3aC3y?;dye<^K}}N-6SE7T{(b4@d(v3Quey@>MRLo7I?1G(Y_fBxc}U8~MC$hsyo8 z2&dk<$m?OC#bqgZ|UNBPP0UpxBcZEe~$K#Z5=bq63iQMx?K52J5JO6sRpXh?w0M#um1D65@;mU4ofUVXr?|QmF8jNnxV+*B;*+CQJMO82? zJH;O#S;O$zesiNU@s4M*JJ<<fx+nAZPSoN{@i!qg3>q%WSA7lRf7edpEGZiwCRL6f4@fsUj_P6-{OiljX zl&QYd7tv=NGJ^yE&2i`L<-CK!I~4t)$>TrpOkMY*6ld8wEc5kZ!5PmAEc@cIsh;kf3yvy6s%9TB}w>a#|QF6s~e zW(|iKtB>&<@Ui&pZM>)Ml$9 z3g?sC!SgoX$M?>~EAtNg$IM7sNQ>rWz6Go-FXn2TP*jVuJyotQ@H|By+4}|Z3BQXf z4dewAQhxeq)u_P+FR&qYf}fbkhN68I6lzV25GSSs^5rwZpYM^yDM)IQfdB`J(1%^$ zF+KVw0x9usjeJ;qUhu(P=#|}$`N_q4B4<9+i$VmO!4D})=an(teOTigsK6t0XudU* z_Q;O7D6imZ{jG9aCR;lP%7+IEa$7sZ;Jh3{uiy1>Hc{?NzvKHDu21wwS4Wwb6?1XI+AkE6_&-h?Ni>+UDd=Y&$!A11*WbT zURCE75#@=S`pKz86ffpx-4sP3JFQ^K*cX_G3?i~Ur7HQRjvyeXTY9i)O>8(DB$ep) zlkZI7Bnf%!#)^TInN@ut3;M$?N8Zsj3!trzNU}&i)I+~aY4N-qmGrjjMTzYT@<`5 z_#P&=NhC$vFwf5CISq6&^f}BKq7IPL)b6UFTg%UB0r+z8{+tZW&XaRduH?O~W227s zzvG}m$%mntL;m*?u@w*F3{QZhF6-{jvH}OtJCVX-T(?lPJ!TKFnRYz2V>N2Wt{jDi zP$U$Ox1*wRXOxEDn2Pd;-a-OGE{=8rQ-<$Ly9aueBln@RDVzI}pm?@D+$(7?U2w5BInBQ`a9J;kL>K5mvVM*zO3Mz&qzr zs*;N*@?1unrIjD_KACK;-aJ5X;=+;l*7x7<&z%O|fYpBqJhL&kN`B$dLi{KpgdyEz zvR@jJDiqFU{s=Vzt1Y%%p5~g#{1wnOrbhhDK&Et|Gj}!hea{R{GLC%1098=!UY)P* zMhRZ&YSbJ?>-PqNn~SL;vZ&fG@5Du%LI(+)SZQGaA{Y`}A;Yy)^H_+-2iu#4HET*1 z6OZgs#fjnbeTrcv>GR{U5cVA_6DP_6pQ?_tw#+aKj_D=lR;hSmg^R7XO$#m`ZTH2K zKjnjNR*CyG_MC^)s;1hg zu;idr9SR-&X`apaYsC%+m@xsmc9m`e_;QxmR|5jD1IT=b^AJzKiS zRD>fgd-j8RX^6V@YoVZBS4H{QZ{hw&*$JYcE7ZL zV7^cAz3y)|Vs@1N*rxLGE?sfNq9>Z&Nt;6^h?)(~IB^RwGqULgIqkfN+_I*y-Faa% zGC{XBiGe_1EXNHb%na_KavZc<&Y+wnwu5)JDpAaKCrY<}Qv;U6t?T4m%{p zS58$!>IqHWKsec;#&Rab42a1Bo)emTVGb2duH|VKG25aQMK);g3)vktB8t5@c=y!- zuSMp5?NrlJDYNqTP10h`xa2mniIeN~->aN@Y%!Rt= z1bCGhwFz)0Hc7ya7P+5Mfakl~^I8$E@hEjC9!<8sfW+gysnrlOeIVG@>< z8I$W}d*;kTA(=IwyrU6l1j8jEhFmI!h_;M=rCh2cK~K5#M47Z9sWYD$l3%yE6uqV* zQ_{v<=9A|<>M&Vrl9pUnF6G5%AqUHuEai_txmU;xCtz0! zM~}a(CDq>kttU&jv{6rHA;W2^77tNrv7sY9!l5?p# zJtZ|hbw_(lk`zJrxfJ!I{4&R93YqYZ$s$~-2UM*tE!?B_4UCHD@zZ4dlFt(4oT4^i z#rIs}1NS$+Y~LX^up|uWie?yT&KQzfIG07aCst5#*pVj^`0=<4f@$T+Z6dla>fP~Y zCC&az_~4j|8uM!;4fuo35mjC~4rPf;dW-ncF=E(Vz5XC|*T98Ky6y}lpi;2>9W^w= z??nkB=(q3p$!~&1uTLBJu|%kp{&_;~^JREguJnS&uh45UO7;Ht6~z~r9h8E+1xD2~ zUo{XmKJxeK9pM7vmxvtF4^Z=vZ>|<>E%|8Ritx>BSB^_>LJ#8i;$KNt1#TTXx6ApI z+wioKF?qIUDX#%ANuI)c-3Nn4FpnYrn;!HR9r1S^? zxxH>+Sd+wL+NCz*$Cd_w}vzdmJcO8 z5Gm16Yg2Gf(#d$(Hy&i;{I4ZJW?V1rmsZ6~N43T!m2;%R{*l$Y0Z9hAq&Pb7m_NV2 z!17Yy5CvC+yTGgf0CUfP0P_EBn8p7eh8g-l!_3Ih;|98{@x%P$ea`Z}u7`TFU) zCgCMUk{cp+B$2M+H!Pd&=pQd@(an`RxA$f0c*pkx(f@Z@SSpwC4x_uIrGo=*=#f}l zV-zX(aT@Ger@#ZDqPdglfS4U7_DlOIW&i44*~#=H?##@akkKGyGB7Qq`OpRH%ToC@ zg3Yxxl{$)K&G@P$yqVF`APBjvtE2!)*TF^}5z;MMWsPHr`UEXR{*VXvz@WG>M4T1e zop>7iA@%|T9$gxX*VguQI()o2&A5SP^)Hh z3ZZ0dbcv6PzCob`2Ta4p`H6c$lF8sQNiE;ErHvK3XPk5u#wUFm!!BW9J?@FSdxr^; z#^#x)CJojpIJjQ5RD67#{*vQq`+4sH7Ije934?-SWvc`d`ZMSfj__%9Qj(nc9)-qy z|JVTM?~lLu_9u)R9l;lhYsQj1^#8l%NjE%cQwg78Sm z1rj7uFx1UcIt^bvAj#6s-hpyic)(pAfF@sCVW*e65f*_04c}0gaf~ja2k2g~(-JkN zwXym;K(C>m+L_!N_gOW87NtyQFp35h5A+g5{?Nv;9s`SG^*6DrVF+W=7}jyo+| z?_WPpj@h0vNLNkgU#S-3P@itaTTLGrDKSt=$FmX(pSu#P`F>UiVkvPFI~geJ%P8gb z{)MuL@H7i1WP~0UbZO5N)2^NeA1V@r_R>3DF~M89a`rcIniwP3!|)zJ5Hmy+37v0R z=MUC6vq5{vxBg;MTrA#10LNLJc@AXC5s>^hSY!kFA zK7q(?+fZIi!k4@4VWRHqVKd}L8W^n@gB`6^GFfvlM!Auba|k!m&_ z_I->3^S^NRVmlKCCS}rC?Re#ONIf&;RFF6-=s#R*Iu#=3VVu^Pt(2j<+EJMKHmeIp&FfB74goA=!5 za`oI2BD4~9IHSz*4;ZZ3$gq$e+~+St;cfEm?3q7Sd|#i<9ho1<^gfe@06DkSb{>pW zwEgq}x5Oh6 zujrUGf<~bIndS=)9{30b9(-nli_>F@AaMhg*5IWEY55gYV)-uAF z?tYkd%6;DBg^_=mL6e2t5`1z`Bih8=l2_C!2ilaG!E28=^^?LIuAG@P`dnyc@#GS8 znlSXGseU?Dkf7$7smYOOlR5v+#r^}adLt_=%SR_p z;aDV1f~{%9&PILLnXtKG$WNj?y#BzCV1)q*w^r!|I~LXI=_=-g=G6s8b8Ox~t`1q_ zoBlf7`V?p4S-onkb&A6GpY`}Jy@5j@P!n)Rf&l>FA_4sC0|KD{|KCdW|C$OB0Wkhs zux<_b&*lHOU=0cY_#eUge+~PeJo>*r68(P*Yxpnk{{PLY|APM~tIA7({(E}>0HA-Z M`QKTA=Rdvw3n=Tp1ONa4 From 0d14f1d9f7e0784335d86d4405e36d92f4d40b6c Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:37:13 +0200 Subject: [PATCH 32/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/3.0.3.zip --- .../Palo Alto Cortex XDR CCP/Package/3.0.3.zip | Bin 15902 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/3.0.3.zip diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.3.zip b/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.3.zip deleted file mode 100644 index c8231c37efbf7fd620931a68adf6161ebdb9f6c1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15902 zcma*OV{|V~6z&<@$%$>-wr$(C&3|k=Ik9a!C&r0w+nV#ci7j^?MX$K*7*}p#HTC{YY(~|Lwv6A_OvVHZyWHQ?n8^Gqr?+--uy^x> z1p)^9FZX}k)KuYtAh}SUEgJsCe|?MQm;He#(hotT2PT$c5_RjM^q9m59`)5(`BF%w z#MbL+b9ut*VRpTl|TIFA=j* z*ko{eSo6Lc_NTS#b0mj*YZ`4d*^22!380zT+9(9ItgECDMc>Iz5gFPeMs0;_k@g5Z zOmUwNZ_ns=W0)j6q$lYV&RyIYCL)F`Hov|7@f2XZIqZ({n0$e_E%m5QEGuw+eo-qK zZ~Ctg@nvHMMz~G0C6!1D4u;g*S>K>Yq7#;JNo=WQ-@U zC0u|hO>(l_xgMp)g21>S*RQt^0>>lfwT{rUUkq-^R4y#l2XrP|1O>}ED@whUDVeuP zQcr91hoai=DxlOSZ$nB`wMBE8vTt{i^AUSS9WDf_@t5R;lfBx|pz9V`MC zYut?LM@iC{P`^g0nV+uos)stvvD^~|LL+H&d`FU=4qZM-XEbaANRDmnt7n~=f-|%r zpc-Q&)U6CvtwQk0DTNZHQZY3xQ#*~Hy`U-5PhLUt*!Upb?m#A=Tj8e`yO9<^f{kB( zE#aD+#SAb!;iM;NP3dCycYt5QJhZcTHtw=(gDl9HPh%DjD(@L2iV@Stvmb&=V)r+3 zYG8_DG2}wQmX5nD+3sFGPLA0hGs#v>6 z5XM&FCUr4VHI!4y@BM(WiuAS!C1Qph7j|pUlF+T5gB&UrhV?NxUN*yDyl@RPbD0>U zG{E#7K$0*<77L$iS``e{Inv(TJ%Py0+Kxd|$pp{^zZ!Ak>t{|(s=@0Ux7Jprn?F-Bstu40w9 z-9YyAkO+^NvRE~T9_KD*q2))gc?FcDT^lMvNuld)qK@~&G{ zwQr=u{6nx&wRy*rA`(wX&+ z!r(o52$*|QW9!aDO*g<0SV1l7H*StqYW`lrjie0wNz(Age1Z(G7ByCS)d`IT!Qmla zX`3Qa@kmBmLQ4V)>9U?#BX}e_@svPl=)hYj=-?vB$)@etQJ2lFc|cLhN7}gImo))G=6*Jaexf| zaOL!*$@_dWn>UZJ%Y?B%UG>AUk`yi9bWN^Qo80MF9^QL9*IKSuQ=34o(z^~WcpFb$ zd3R10PjTo{Vl4J8o7!I=$Bu1Vx=2{4FMyt2u_mi} zAbIp=+^aV&mhgKE10kN6jbBz1)EM7%b%_%k0%=LY!_Ah7h)4bnZ%m>z`nzrqk8}Q) z2!9Z(O5$sG@V|FjNJ;!K>`ZTL{Zf-t(9;`}5Z#|~%fQn&o`29Uw|-x!F;%C0{9dbL zbD;6}q+QF7$oA8VS2`3+m*Qv|aj?_eb|q?V7z&Uo2h{Hc5H2&J;MJ-;;l%y2dANu@ zqI-6O(;k~MQm8}K`eM8U*dF6fJZe^rwf>><-|g!IQj~#&LZT()je-CI!b1W2H~wF8 z$7cM0${q4QxwA8}vR5^;bF}>@djGFNhk*HP@n8HWbXR^hE(hXCyD!o0KZ=E!I#T@n zq))3&?wWC_WNXKr%QeW$&-TqcoJfkqOd!D6;F5Ilcusvs{_9^!f2uKH6cW*3hgZ+H zZe3BI#-}DHC;!Fg$ZmJLpYH+1(99R&#%}ecp%= z&`*IkKY7$K7nIQ5{8!M=!`~CMQ4MEdH>1eW_Nen2h#X@TnErSYLRtL8Bx+>wDw-(Ujd@vu=Y4W!RQ z6(FE{&qFJ$Ipi#_-Wgw)^EwppNd!5BM_=1xDPmTa3l0aAdY4y-OSA-24brR$CQKa9 z7$~K=97@8<;yw5sQm81(=SuNFS+EgI`@;|ZNt?h_n!?}T+VTqovqh}8?{h6bY*zs% z!+AJDZGDJPZ;2=ZrqFJ@xT&Np(%;`mBObPU?ag)lpFCa}Z`U!eF`lf?H%5~ioLLXY zbqav%`r_Shxz8hx7Q-W=^kRp^1e)XvK1Y1n_BJ1}vK%R5V$D>>5e{oR%(EBh;_+YO zqJVr5bbo~M=zxtYGu@`Ps@|LHn*dMj7u-qsjAfS%Wy+uOV-g~uNsplmOKEvw3Qt+z z^a1UK43wU#am>~vf(4-T^m$UfrJ^L00}jS_?<&o81gO(<9idp^QqGuucfU_(I7pN=*jjTD@2y}1kr0}9Nrsr(rf_NDBIt7kyR^3&Wg@%8R~uDB7@AW>A1=m;pi z2-%J@ZUl+KkF&VL*PMhQLPHZF@7&kar8-{?x1-bB`KXFpOz*%A` zI2_*x$J}NhAV5I?gwCl{R{1(p*?H~BDj})=8J<*i>ZaYp(6AnxTm+p}wF(i-ydMKd zb3a=G>u0yJN1K;f9mN;|IWdMm=X}Ow5jfL^!RU1xkqa$VShpM~j(|FD;$S{lO&x4y zRrn^|XdW@l=>B=h;VqtPy7;z6*tlHaXX?kr1;_Jhu_n;1<&*22z*nCtz%|_hY7n;_ z%dy%x%?&&Pe^xB z4zQTrZ&4tl;f)Cs3!nNq7`wJ+ib|qkNy1_ zkVY_3PiVF)RDY@;rE|Xzox$*S+Zx%J2m!iA2=$Ei$^w#5n#8{##;p#6GN&--FU07D zjstr)Jn$PeJFq&q`G zB{Pd5MJ6L#j*JmP+oKK=&*PvqVY)-y874!g$2zX|X8`h9!hYQdEv6JQfY3_o@(Yl1 zum(*_8=5#R38y1izq(-aM6c}(vzlR5eyd({Y!mzzzU(^p?21EyoSK*ecS0pMrbAm_ z2D%jj;Vu!@RIRPUzhR46VT7w?EV?fj9}H^d%!oN;v~_;>F7r;mj*?vjU^*lR42(6&M*z)y z#3}_MKFe-8#gytPJv~HNdrjibrJb>WSr0_K(1n>K#Y+`!NEc$V9(+GIgWPEZ`-3`r z);E+Gpd(vL|9L`UBHMUIa$+^8iwH9xx++wp>R1^rrPXT#Xb3&>Lz0n^~O$yt%b( zHORTuP@Fn(sV@pZ_8Vu)XIG*HA8+j{BLFt?^vHv=WKJ`;;4>V zKWB`%W_1^hd>I(VhghNV;v-#dUV~f?AOodxQIXYNhozL$VE<4x->#KB&iD)2=LXJK zx-U<4HWl1$TEzJ1T^K3)U&)+x)=+qYPK0@=JsGSU==R}z-Odg#kFtGb?A~f%LWjn+ z5hO|h<`X!Xy!-s+zcRep;>tm~E#7QU{o1xyGdt#u!;WE!{+OwYzBtXH%k8JI!^Pf# zNrska7oE6Fl*ZApZE2UH22gW|4MiZ*+%k;%j!;3G=FE*~V^=YWi~Ni-y>h;ji+cUd zp3wN!qOqa5ZM%0H5G)|N$@jY<=3IEmD^Rsq13UDQ1G#g>iv`v0@j#p-@*v_f8P*pt z=mQD&rO7xLL1Cw8jzp(vWUh$)>H?jUsCt&B>2PaBJl0wyqdr88<7}s-TMnt zAT!egVy5V($uHE68WBJ4FP|1LXFeTq8E?@4~>0J0o;C! zn8*h&LBp&4zMn(Xp(u!LBPBtBw?j}Nm}FE3gfA6w6PLXsFbPm*6j>z>$@uo5o9(?9 zCb_wjS;y0FjaQjCg|{2$O%2d{da(JZSn`zR>tQo*;~xQuwDuEAziTe-AfN3y z$ji-PPUk5F$U|3ju^97oD_}*Q(?raAFtm{|ClHuORM?*39I3N;##G!p7EI(!42xx( zzahu;eb(95J$l4N8wvAR6u}`Y_Jp-68PrF=2h)mK0(m7*j6QJtP+&v!WkF4M>+nj& z^dImCs2H{F(7~05R8NwcZa*GLJci+SF|jz$41sm8fs!Lw_p-?K%lWyw*PEa#GZfg= zOYvpD=@GIfwz^-Io6Fa>MG0`it$myhuR&_H-K^?QPnwx);8&sA?XSPe^VZ*m$|s%rq3X+ra-R36f9&+!&dc6mn=30a9j;V7tq`OVXe zE?GukSdBaf;W||$+lDWvgMspz174{~z_Zulec4sEZ|3&r<0PzdQfU}uS)BMdFJVcH zLL<)hx~nqo6uIiAa=d`}k>>tI#&^+hm7PEPJLf@ZR9r{uU=n>lRwHQ(n9MH_fn^7*s2{H92h=!wZ)$1 zs$1U^EYW04ZpRi&@VHj5E6mM+munm6I4=!6&N;_3BDf>*c*jM(2yMwn<(5I^qv@+n_TZ?+sWAQs@=|ZtE3F$0^!24au?HYo`i7A7m z$g6>Uz^Z#*CJflvZyNL6O@%-~=uyH>+kGF~{ZM=k`p*6h6z=mGQSH1LV9FL1io!)e zAN(f2B+%Frq7f{){94&=dBEin;G$yNL&30T}*RX`f$$>{* zT^H!IRK)7ZrLV6yTW2@E8|3c?j+NqzpKEm1ub=1M&V1U+Kw7TNi3LzOXzsDoA=gem#eo zoor^QeIhM&W&8Tr2KlJFtP4u?c4;&Wh4ib*sv=q~ zI*MyN1@gKExw>&e&v873n>l&9`2io#m7rsS9B7#{ma2M8h@Hlmw(F$zZm$)%G|#gF z7VD{+EWlD4pCd}>b=z1OuYR5q`$n(EcNMJ&(S4gWO?o#B$6A?;>z@#n@LM$`+qdxg zrrJ%6uWG4&$kFkp#wjFv35|MDF_N2F>9tT+r*fQ%s1$oz0CJh_Qti!YOiIKUROW8~ z4Sr4z|3eT~{BXV%GcpFjMHED%b?bC_&jdk?=S*WF{9f^Nl2pEz!dY@e7J0dX@wJEOm$EIuHNJLqoEAZ?}8hwiIDG=bR@S1`fzRpInV9FN^S35}tndRo<#!#Vvx3K((n6&8+&x){|E45q01`6VP(ZXb+$YXEX4 zx393BNQ@F}^6-ub?)n{;z=iC9K)qf+z^R`{t^N^u*AwX6JuXKacQMc*;YIMb706QT zmxJ&U{MJHfIZX^0NC8W_G)meP=mJ@BMc1)zI^FZk`q@^C??Zx^ZKI|#xu&n(mJw?A zMYso^Z-Ks-9>5OimW+jVz4*HfHX?!dx0$Ilr0y42py%MM6NiS89Iv)vTP=Fp+Dl6deIgR4Ej915m<2kHX>+&3A1!Oh# zC>3bb^?ZmoKKYy)_?Mzq92-rbTQA8ZT*WlfqF2fsJ(V>|5rU<4 z*cIhWm3@U|DxrJSK&RLG4!>d4P$Y)Y^!QcCkW1w~=hW2@u`phjFqTv9Jb0>sezhyv zX=8y*1d!^f`%pFQYDz9l#_vFvO>K7b1-hmdlrl#s<~Ku~SF@iYZ<=hUO|81n3NWgYWGKDkGcJ4P zg#?wzP${g!=fLp&nkmx*7XQFizX-Fvsa;HVm4Ip)9_5c_7&QN~)aPv^jHwVSAMkO& zu;?<6P0I43+TX^k96+s>Y)z4r3vxH@=HvHi5Z+%TyR%A<)Mh7?lWaoo@{taD8PJ0X zTc?hMP)iy}D{D{--34-Uj`Crlm}1h6;!pDM?#oa$2aj-Fqf*Q=hC zDI$R@w1C!zch4}6`d^A___qgwGt{;z57VUy) z4hCh^k(Bcp*t}GN=)EXcSJvr}sq=fM^0vkWd$z!G4DC-}y2%yklP~Y0suJ+qpAAUM z2{LD<>AtmHT(dVPs;gdGkP{#|#-fzRTKiP9Gr;dz1G`Z_Fajl6QR7g8!dzlS$0FOF!MIK{}kA z;LmvjGiBQrW?nv}17Q70gPNn39KEOuU+uHJS4!2T5htRtrq?Kt^b;6fr*j`>tk_L|n}N*j(`Bqt^Io*`5No30(9sYBPFUAl(X^%{*hC%IV6N zvJ`A-eMzOl&`>IZG)ad}Y6+Lq)|n|{m7SZ=?Aa0@o6tV231Ajb2!D=W>WK%kr#810 z37qjRk?d{QDrr{mxKhQgx7|@(_rHUo<*eCcSt9=W%TL%{>QDByFuc@k9s%Mq z5oG+ojvXu<9w}ty$O0g1fZW@^iBZKS;w|L&bIw`iyqB|+IEj+mDe@rA6Ah6xtY>mY zRIQ7H8|bD=-@|IhMSf%GEJ$%9{gw?OP>sS@0T3r!yg56Az*=zB&@bhQLnX_SkoYGi zpT*Gk!y185KODG!1kL&yd2O5hFWkNaaf}DtmKzvEexz zf#1JCRm1dG;8=w%9>QL%hA7`l)q5XI8&gwSaU{y@8i_dzn5K0qhaWF$xku%?1s-t-(m z&&LiA%f^@tPkY&&r6{}>-Ps!5KGb3-XskQD1(4wka?hVCUpZe;mu8pjE*i^MPe_^?0cl+C9^KCcE?9jBJJ0MbzvPNz990Zbr!ZkwWjsdy=9}` z?I?xo-HAo*;}w$9F^?+kQFTD1Bd-)nGbFeF(QQccrvM8EEY}4b;NWkygoHV?2J5-5VCt`KreOnSnbgISY?oPhJo!UOqK+3#U znq8EOM>~Jd*4=sx7kuhVBGN0DKUQ6@MEdzMu5(x*e9glyQ=od(e^UHA<-wdpc%cl# zJWf7vO67uj=2_{R{K?L|KMG$ZN$UUizLTEBHK;lVPsX{G3$xoA@M)w8+y3c1IZ~~iOyN)$NeQ(SxD$ zk5=N&w7EH$QKA%#Yjxxm%_DVUDg9-wGP4X{0TE%XtK`wK4V?O-p3OU&ENuxK%?KC9 zJejQmem5b!;5z-zMq@W35k`AcypGQ> zz1eEa>V`OO?CK`U3k8X`y5mWtPcNO%y{l32P9#G->|UZr^(5tl!O~Wx(!zK>d#<2A z0|wS4FaB6~ABhXHg_}npEXKl-OU%i!O$3>V^pLheTdiVon8&i1b0sc=N`-S09oFRQE!e=W;Cuo~YR2SBHMmZrOi*={=-^gTXr zy|a=Nu5+m)$Wx*j@{FHmgpxTXA(zV(kE8~lrjelR@z!f2--!s^y;UsX2XC@i0*mm| zI~~e}i>eh2Be#Ym#Q|%X+e{>!mnaQ7Ns;=NE2oOJFo;YItVK%f$tZe^bwGptI~$Co zX=)kF#JoM^i=PeYGtF2ZkUNt>XB;Z*hzzn6t6eokFwhad=YT_%~mX;N#oKzhfuQ{ZE($={||q^bFJYSHrLLX}bdQ}Mw9&Cu3I zl)xo*`W43Xb$)rif6s^aQr4KaP}*G<{M`gA2AvipV;qF={&_8@AiY_W>l(7Kc>D{@<$T;E zw#zHrMk;@n#r?J2b+PD&B-_SYExcXm#D;|s9g%r615??^ZpMD&GQNG=Qbc<}18)lI z$1aWenk21>%2|O?IKER4&X3Xw z*wu)cbV-^vvElV-38o?txJerSe8_3Y#(kheCVH`60ZF%D2;Tc~IGyTv>2S{M^AWOs zgbFdgB|#b?S`e!Op?Fr+C^$X6qS|vnr?vNfPzr*t%%Qqo@gc~kB8)w30)M1~eINdI zm4-ia7zoJo$?Q4%XyrKj6mR!Ad^QK9t=>*dSy(d^lo6o@N+Ps+sm4+q%j`z3!DyJf zO*&=|IcHKl!)3ffh&aSjT$v)e74FrbGFl&Wqt_j_g&c22-VCchpI|cIKz+#cZnnjE z$!P=OV2EH8UsSm`JNtb(lM28Y(Bd+lFp6kS=9qpkiNnXqEoZ|^_mQ`E$`#RDkTQZ+@g9vipbgIN%yZ*>D}agP0k%F+MXNv-2p zLSuOihKOL!V@9O|XiF7leVZu8>yympICx(dmMYw*iuMO>*kzwtyV^3R#3Md9o;IOS zmR+kqV~8$;;@=e|GYWqLul%b>6Q{#zNXwtic(icOT5kyaP%n*BtAkvp^`}Ld45g8p zN7iR8?ieN&K6k#Q+0HDuWw;|`5lvps@UIvebC$~`bG86|+ zYj~ zDQ2#rGsd1{kJn-Qc_s19cwcj%Rw zNn%4w!%?K}Z^dh*)&q*k!P)@y0FU5_l+Lk*uwessMGY3D(wiimG<|b#x#)%-VCnikpjznkX*vR9 zVTIeh25!ed&uZ!h=vg{3{CXhK5mfxmG(VA+8rZKaiztt@>a~_Bb7~7um5A4=7bDtf z#WVlT+YP`8Jim@8UW4)H_G=wkq>cu(RB5Z0e%edyj4f@2mZ377YjzmW=v8Tnm(cCtd2DMo%e3yr zqj6@|T3pa)BebvRj5LTDc*|Um+O;RO1!6NWHk?^Lwwc5V?^#!=`P)7uY!5Ej&Ax1% zE2CSxXhsSgiwTfAcP>e|uWZ6}zO6H}$EfkUj>Msf+1OV6Y4i?>#fbg9N=HUf#X@md zMxS#7u+s^H+rL&8t5vJ+{dQjpP|BVdtWnl0EMtFS-~_9Ijhk##wF4l4a_KA-m-?$; zv#PLn&PfWn_Yfh!*4c@ zE38%F3`C?6Lb?uHyN^wojCDtI^`ddT?AG}MkiMEgOc~;D5HPgaohN#P>XhrMzMssh zius$7D6WbcK7QPWKbf=U(-(J}OWogg6VVimgQRf~rLfRZco_L)dv*40D`+`t0&TkJ zVq_^k6){CP)p}SZnQ7e*GEOP((Z!A{{(tZfl&z1~@9ooWThQa2qv%civyC8%Q*Ki` zRz$<~r)(>~kKf?rdlD?7n-c=36FB}#8cq#NDAsmUHpCAGmSsoVJKQm#&u!Un4>PAX z#mv(&wH`s9yTxp(XI;%3zb!4$*yK-331v&?X_k8&)SJqlF{dZZ(q1H|c4SsAhHJbT zX<`$jD%$zAY=W{U%1^ph2S{V|<2%KxS3reEp~5ipWfgOr&`V(<5yB81ILbu<|x}Qkj=VLA2wnip9Uv{D{aa(k8~j*;wIB`Wf@q?XkdALgM$L%*kQ={5O_|aAV{| zE=84#L%O}%EO&3U#weI-G{ooIc53D#)dqk54@HpJep3SEs!GwhJk7XQ8iAxGBs5#q zgH^Wp3R0SBy-^akQC6hXMp{slCYYw0+l&P~{szzeTd4b0c=D~%omH&L>Woa@&;7nf z16?uE?NApwt%?qKr4&MSV)ph$2a!41#reDHOTVv49-*)sep3u=lkRg{ezOOKmTJt4ByjUgz&aPlK7ao z7ZQZwv0Y^nTYo9{PNpnPadB~NR6gUnh_cZ^!MANV#K9!sJVM@(4ii){@({N_U=h9c zmu*oa3WS_u{F8vZcjdyT?q5KZ7ug`>0X^`ZUb)C?Lf%;AWUV-eGkkmvK$P zpJAA`eA|IEm8NTd%vb>K0+L#9G%>x?b0{`k!J|)tpKtZ%>e<7m zE3fO%5AjXIm~QFKgpl>eLv2R)x$3Z{cmw9hJ_@+h@6(LQdO9A>m1)$lc7jQ<%!61> z&Py%TFDSE~r0kN4s5?(~AHD~S0+1Jd^7%34G~%w6!0%QWA@w0*h@}68A3q=Gi7$@#`!+M>ci`Fge z^?%&ole-M<|FH#Rs)a-5^DIV$%qA)HjC_d**!+#Bl6mhZ{~$KXA;-xn5_$}DYFGJ2 zi&@b$K4gzO)(zDVl9H#Fm;?4-^h{SG|jK{0uPd%XnlX#wfCXK3owh6=sJ{5Zc7UA_~8vQEQjqQyr?G0sfd`S0*K<?b$p4g{v z;(zoEP2J~ue2E5O64$~_jO3cqJuS?ck-x)Xg<@i!MEQMSpG=Zfm<{NXvWZ)wB7CDh z_TD$2W)7w?WY#}XTGg;Gy1`9*$WX;o=k?f$^DJ%QHJ#}>fSieq=gNzc$5H(?^0bU` zSkJf@H%nilaRKXm0Tz?B^B~&<%6|JFIa4v|VwixS4{RWfp^?d$y8W0d_SfG^Ksyy< z3rwMRwX>7}6?x{+b2IUdgdUp-8-+sLVQ{u$_JEi=BK3BHDRu9*7^Jij)ung@WqN5U zT`pzW4zHQdI=|rRcDH^M{S?c)C~{m;bp&pIR;3M+0Q(g(zif;u-|!zaql}$AUv}(g z$kx(qq3#7!H9y^5>E=4id%(Gwzl(_6JFj|6VFZZs-%-C%12uY-3%wTd%1kZ{^DjSz za6yhFHSb3}odSJF95+cpS%Dr1G(?^v`uK?H&M)mxnRR#Sl{WY~2>f6jsSHIqX+V4VD$7Liz^%g z_65GkmCz7>ihlb}R)C{{_6!mO{yI!XBu+RP&i=Tk3vWnp4lV}9iWIBG`7N>8?{Rbc zkwJbMV#?|IL-R>C=JDylbzKGQg%J!G6esC-w`N5?0L~xe5Pk7^2lOGDuJmOPW~%5L zM=~`%ST%d9f(=0==>@Gw#!QI^YFVq?xTWF5!E8F>ZOtbv9*@%t;A-uM7e96ES%TYp ziV)PhppuL;3E(9xYM~inraJ$H6uc^sFz!cDL?al3#+{R=ow0HuFPR-sbsnBI6g3sk zQLDo;_jT%^F%Za62b{8-x{gNf7U&QRTfwN5lSDwlH~{w!(eC~q2@y;v|Le}=zrXL z%k0+bSkXk=bol)ae`m8|uSu_=X zzib}tHp7tLpBY7#C^SSpowto}8{dB0%@TH;vcAJtfbhk&=iLRpb??@->UtN1D@c}{ z4Qd`zZ6p%*AfvlXY{Re!*wRBsFVKMhdhs!BGXg#rR?BMwN^Ow%bthc~mqnlgKCm=e zUX46v`iu^%7?q%O(dc`a+M$pZFrg?fR$i{&tMaA2W@WVFvKh3zALII)JiKaD>;Y z5Jptl(dV!&VvguqNTp6Cl`L=(W0hIH-v@WR{+HkuiW481qW6Ci>%lh>_1{8|oE)ux zb_r-7iMJ2#WUGr;pULFzipPM`DU}8L%PQ`iN9GWRNK=9M|Cw=vp@E1 zu;r7nw$0JNwC|inSRR!f)o-S)g>;}VQRh7Eb@9}6z~z?ZA~h!ok>KiT>yhEGh%5Qe z>boXoB0d>k!;p#8uDRXjMAaOT!*)SxtdNfR}9Z)s~k z#;(?RFHs~%xUc5vO+=~vQEI?ue|#%rd#|L&VU)9;-WWVtp3>d&a&u`DjfZK{_^NO& zUCtOF15{4!jXK#(9lQr!Oq*_5{BqIq@E)}Nd!^2n&-Pp*()X6rNUl0j8$*6Cx_4>~ zUNf1&+enVnQ&!~7p4yFdB(lwfe0Pz3(mOUtyu=jP~oP^6_ICWc1L#dW+SX z?BCzP&SF+IFOMMjCje|(2~C|}D78#K9FPZdfl80{X^^8f3=MJJFTG?8B$)C3_CcM8 zkwx2y<{t40oWm28AN~>{0(mwT&TGM+J)F|lT{&hUj#u|qxj*c7MvM%zN1Q*Fofp@5 zuoy>74n}r!s0#1{;YrJ;J;#Xc7=sI&OJpXVUyhKakhQHV+-~ z6W%u`@@_Z}p1Ws*rvECWx5qZGBNz#<6z8Yy(krTxpaeT-by^YE((l<+;*oZ$+tuQk zh5MY}-=!JVOl0*rlMh+%7CZ*LqFuGF+7nlo;x3oQ<1mnv!R`X;%y>bGxwXxlwJWZ!I(+oU{U%U} z!rcPZS60U-B$lPzzO*6(-tze|R7zC<5AUPTaAhbYBmg-!QsSwvT(-mQGIUb) z$NE4_XVOZB%q&vHp0i|PxZ=c~e>S?P8CYy0^@)nSJla-N%No~-E386Xk2?0Vh?%a8 zIWl(%yhIAf3`W?mDAsny!e_p~ znzj6|D_|DkTP+2EV2LQ_gw!YSRTx51CjSo|bI!Wrc5>!d%Xm0CwB_Vdiz9V%e*YgY za&Z~>A~N(wnE4`lv$zQc%`xA{7YcQI5=wGBm0x5g<#=VX_Q4Boa73x;P1&$5OnV1N>lZ%M5>b1g{4GnXQFWR~ zu_KldSvhgR4t!>)^xn|*;3?4~7U&wH%54Dhok9-qgQ>B) zuzZ>1Z#-4b$MGWBGq22kP`@zZ~A)9=@OGy<{E6}M CSqQA1pmR zCp5pa*|N})TA{R6FHESQ=r^<@!KX%zsI8TGR^y>5osb{=`j0aOp2LBcBrMt66$K1} zy?mCa1&N=JD(dy>-#3SOJ@hLjlk zH?oE42U73h`7)=aV>|A0gfFW0leGV2__X;?CCLa-TZ@BYDMR4%Mdv1Voj~P!*axyGu>Yg zL2mFkvCyps=fm>%etrc0Gnvg|4QoKK0|8w<0{=6a0fV4{{y(nj|J{Iw0fhN~d#qc7 z{(JoY>#+t00{+i(_P-bZ&%^e=e;E1yD1P(L^Y;JkX!}?8KR27A4EVovARv%`t@&TC J%J<*s{{rOwtug=r From 80fb853e2e42070420d5e871fa83b276a75dadb4 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:37:32 +0200 Subject: [PATCH 33/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/3.0.4.zip --- .../Palo Alto Cortex XDR CCP/Package/3.0.4.zip | Bin 15951 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/3.0.4.zip diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.4.zip b/Solutions/Palo Alto Cortex XDR CCP/Package/3.0.4.zip deleted file mode 100644 index 8cefd5d8f2564388941358a6e938329730ab1600..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15951 zcma)@V~i+3v!=(kZQHhW#uc?ERme ziZUz!_$;)OMeq={<#E!jd5ikDEw(7aFMfm@1}?#7!tHE?G9Qs9N@Asm6rq$bbR%(d zuhypYi)~$(m+K-@gxUUrJCf;3@3j*JLGk4M_3X^4oiFpvXB6Nqn4O7@ zY3xuv2P9HzBdMIbCGZQ~8c(>g;!cJ=5)PQSZ|S?{-5>W#&Ze)iN9JCHih7}vfhldx zdoD;{R;uq|Y;G;;)X_w%#%DzlP0W`1frzE;MR};Y4z}{}VD8b$%V>*K`zRrb``p+& z2E}tBnk--*q>~u;G3V$oXfjy*HFhUc5#zsu?ifzU76}`R4{JmkfeQ;u8acQ#Yy*nx zDtvRWYvv1zp%m%&PWr1;8Q|E6o2XcC z2a>K~any9F)LQ)fStU(RdwX6c@Am_M+ETMH;4|pjK`Q!cIA~H*Er{nxC*B1t;0ah$ z#l^^->{2Hv^NjJe{C>Z{wc2FdX$(CFA+}5=wxKHBqSc?k&6$r>lWHYQ$hu4weB7DY z64HK=?f1~3vT>h|u~ZG5iVKkIbpIKt?KL z6~O`W2GvAL+dCs%*;c8B;FvP$5v)y(gm|G|0r^87BS&(jLYs zU}7n3XZuK`6igMVU}&18wdp>(gA>P`z5Zq{bAl?}{*660z>h3*Apq~YW9nQ+ zchb+JCB|sXX(0BtfL((;H!!(0?J=tUPl=k$qviF=Z)(K};Za4Q-T;!o?pS6}K@
  • oYu|78#h%+mXRRBi`7KF`V8ks6~Syl7EDPZN(i&%JL|R8B2tj z(8V}cS?f%$&-NZ16n*3>$L#jN6N3eVtcqUuwUqy9wP8fS+!PVK)yrUmF2GC&~ zNYE6DA$X%;Mbce%N)h2BNBN0KT`FN6`U$sX=sA`sNkG)u)H<#!R%D0T_bO{K2kh#r zN^JMX^lG)>kU1YlX~9_EyZ;o>I*v#y=R4xwOV_NbTZ->2wSqK@55cF$7TVKWaRj#< zx32imGkN4Gfy$&{^9QQ^d-kp+pk&i&{BAA`BJ2`C3Av}c?p+wxKY}| zI2@VC;!18+d*M6WrY#C}u`f(YlF=8}s4;$}Ejen*r|7oIM1v*~1c98s&5F(_yyYAb z@sXbBp>hJCgIxbb@=6)Q-Il0pC~u8CU$o)&r10o$t}-Bx7*Y^Gj2%r{h*|sdtd(um z3Qs~U`Wf?j@a}@1(N4ON(iHxJh&SZwR7i*z2VP_QHV^gzCZ42sV+idJaC)te;n=zb}lIYOj+3WZ$D7$0i2@T4q z8EpZ%0YNFKxUE8^6>m;B_$4fXkuAqTAmev<_r{u}?x@xuY%&BCKUByY8e|I$BQ}sZ zJSIOGvvptPc1 zzO&HPNy2YApPL<}J|Ow!V0O1i5I8Y6VDq|W31AYzWV+A0Oh5@A#NKt&%(d}08o(t0ObEm>m2N+{|~K0 z{HJv`1{Su;CN}og{}k{4s&cmf6z)GNXL@^Ne(huBbSRd%_ZrpyD_@YICCQhNY}{sc zU5`U8-8kdG&rV97u|U1|eU;fB9h@@l)%iY@5Dg+Oy#9NSFqpb){?noa`bY zBPAszBPHXx?)SS7V&k3Ksm%H0%3Id8RFcUo4<76w?PnS?2Qp`Y;hej#nDM%6LB`i8 z=y0fL&ND3U2`&x{F9&>qxV5Xa$zzYC`4>5Au2GD zM+|w)2`P9_?+y6tsCa@Uvf-S1H-;E(o2-x#-!@c<@rx@mkR?D+l8BtFO+kh(hk&R| z5GkRFLiP;&A@5Y}=<3Q5T>R~i440cBI2l-av_;Uk3ld<_7o@KY-YLqdq2yHn$Gjthi!P-D=7WXxzA#F=L-WzBJ|5D} zq1eDr_WQKm<-n9M?bu#Xp<0<*w|)4LAI%(!3xid|UxB1lfyoIS>S9WX0N zBdMoaBI0!^UkPAsU9lu*-6*Np7`>sh%Nj!qZi4(OJ5W}rj6DXR&1VOr^BB$#E^|;g z>6dk$yZydVbN_t!PZziT4PzCWnS}7$nt%erhnt*rH(MY}sqTiqkdA_GmL{iy4Pk_H z{9qP85w-$iaoZC!YqJHol!z0DLb0`0>M2^44rN8eKq zIB+~a(wsam!}x%lf^$Ik18z=D+b%3t0-~nW*mIGBSTS&~UU=Htyy8QD<|t94d(Gs% zK+ghrz96rWWZxfBKQ zd=*E}9#QT*$nEK%m(*gqd!t089cl$+P=oJPZZu%2^p93{EmM+I$*nB&Q<$6HGgnk;rOeP`8%hOK@8xwU^rA6 zr#b_L;qA#a-e^oDSswia6IEEMHe<-5Al-LA06uE?D{R4Oee4>5l#5I9K%{MCkPn{7 z?l8|5Q}9BCjD$)3j)&cJpZY01VNY(mDmiy=D`2UU|L$x-;(rJT*2C)SeEPE75v5hs z;di^+BXbj4>$3?YFmQZLXYkj_1_( zpZzc%-$tv(#CSVSCA(1uxDCd;M;=^!$H`=L^mSe7a=>^V=Z+x5dg4>}fkcSg=gCge z5c4f|JO_g{k5o;~3G@}lo7W3=7!@n4g?3sDCdC06sB33v7o(Za{;&wgh-1 z0L+mmq@h|HwZZ^X!%*;0Cf*m&#EA}b#9-s|>QLexw_^>e3;h*6n<4gddQ)QE zS-Mlx*BJX{dG_bjv-o4AMppKe}PRI>98E4vLgj7|wV^7Ctc6BpU`W`x&F) z5C0;vPL7U&D?=-l2= zqKAfPDK+(sz(~6Jg5bcSR~HsyI&@tiPua0HTuP(U7Op1v#0N@BN{nvU6u2xPdWSXL z*+L>_{)UFdk_(1-Sq~CZLQNTywp`!~a}3ZonH6FsU*1+!yk~qS?)vXPaL3 zjhf=52~&NcFP!fvcsd*2tK;U=^Jxo(51P2U<`167<9CdMA}^wo<&s#qdF&fGp`q)r zZE&DxJ3sV0mGa6ALL<*zUSzT6{x$*YO1ci&5tLby^TFGz?}IzqC!~4nEZ11Fqn7Vw zeYRQcIYVz6`jG(^h}_t4huc?w$31X=@oYpmmG=P&2}7F`w8=CPwg`UMc+$_^Y$uocfiqLSLFx&HGQpK9M9Y7f#qSQuY~;@bu@_3*e3iq z$*{RZHb##gf0?gL50Sz6c@&w06n5ySI}pjB zBJILshq2OFN~SICQUrfWR^k58C+ZuzQSU)AFq71oH*L%cMp1#^A%-`O4{{;T<;+o4 zW1!`EKk4uQ{%kGQ_whxD*tl@j%p9xSt5i^cz zt2`btN{1W-7%8*?oW{Pn@h(ZItiuU45d1RyUuTJ5HW&UcFURGq`C@P)_`jY#;QSex zZeX+Br%gV=E=2Hnv8%W~S8Lfc2XeH)t9koxW!zOh%j9ZjorSMJhiz&H9Q+qU=+P06 z9s>H;2YsJs#6yu_I|d2@{2yn$f>23Hc3|I1Vn$B;#~@=qOeiu6?BjqAz`H#|x5SzG zb9wvoJ@of!IC&4d$L;v96PpMk)NEKlt;j_Y81Qdcy@Z{+3*uir^j*G&fyS~Pkp0J8 zd7_Wvq72pq8`$ni!{gZ?>ChPG@Uy&Qpf??{H|FCO9@c4ov9u0z_a9qM-9WG1rSR(= z5e`S`^dCpoSfbIUX%>L;+#Cdq`j8ZnaYY~~NaSdq5u8bjMFv!y2W1RIO!TvrYgYi7 zU0;%8cl&s-<`` zKWuQB6WiUdE6wE_J0kd4p_X0_M>jyVnl2Xgr${}kC2#YWTmw-~*79GcsbN#WE~;i7 zu~4uwfBj>Y?VZTDF``IJ-*UzaNHS$AfkL6KQ9T>q!O|I^mwQf(d{f8>S~J}nZ`O)HsA32cTnmO4|xQtsGfNB6R+Es|iawC%f_ zHk6df+2C{m7RUN&fuTL<@yg65-cbREW6}165bjtY-f~_mKvNVIi}@D2ZcoqAxMZ%w zH6qo2gVzEd3u);;#x}ZpRNMneVAVHGINklQbpv?N&+5nt5Ze*9%`w9WaRRH8X@iTv zylHXK?+17#Cwv|~3&V9PDK=sVI8Gvo!%g7f;c~nZvsgbyK%t^cw{@B8vpNSoUhnqq9ui+}|O7 zy4Q(nY=gEpACe<2x5F>yfIUku8;H%o9+{#HK|{r(wBQ1m48nJB^OYG>@{=TM1&<;& z-1IP^Lclq!O%Gt^2LvL;2s&$QxNT@a_S|Ye1G1AoE9XWv@!$f_UzW`YmLgG>M3c!bO)g*E+rYtC!B>TJs(CRq1yp(2PA{{Y3tKxpNsmDrP5?NZfv=;l9j%ko z)3Me=$UxBP=E7wQrEGy*JU4fC;QjeLo4K?V44z`UfRfnl#nf?&h^wU&v(wXc1J7K7 zYnXc(z`kqOmQnifW45e?>plS>Hmho1@=_*>_f#z0x?=1eIoQu6<(Dam+R>|SVlr*!1h0hMt|8vJgViOrVq4pc54%xoMVG3ubv5#VKz{x}y>~B(+nby)lJJ1|NmQ)a|pu&&K9= z1jK?L%Dt>iM9;T~2&=blksjlb$cO%vX+VJ2E1F7}%>A4MleLb5@g(zIcz7(3*3KLgh zzZiGy5S&E9ax-ZtM6dz^=F#EcD#;z-wb!Y~>W+_j|D?gysM!o-tP^92t+<@~mNibc zOvhNoyXg0w1CX-w1?uwtL|FK|(e9a~b-e`7KjyT>aS;O?7hDDXUIHn{{@e{N$L=hF zR8Yf!1Q9T!OCh1z1TU5rQ*xW>pwqg_X<6#BdOsnIT6ga)mZ?v-*)~A#z6^E4_0HGz z&Gv;ozC0NELEMul1)Ky$A8P1hof!bQcQP){Q zq!PGJ33hp6;rHoJ3OA-3Y$s-mkE5%UGG<_lkA`@$jyf5B8BJII^+Etm$X!v&Hr z)P`+pGEjP@+^>ut)E;>OZBDnHxR1s3W9-qUuM}H)?*ks2QmD8>n%_x9C9~eyLT|-` zw%u+^@p;oJ*<~A$5<=i29KQeiz#i8MA32uj;5M^Db;hMn1Qjt4I-5H{=JZWrV!rN7 zID#)jlNWQUlxF~C3yw6=p3uT*Tl*ugJ7N6al>)*DksM)FFWWs8-H?++7oAe!iW|4P@Z^Mmecq_w(@dT*kn*-kB`n1;dpmy}{yEtw|Bv7~s$R2Ac z*$J9V_74>miJN<*W@bx}HdMml-ru@U;NO+?&kQ-IYWk_R={h zdcO-1PxNKNE8xWAA88@{i(_?f3?L@5udv@)g0^^8;Mw|7)IIhzyVDq+)-BEmZ?pW_ zc`EAbJ}%K=vBJtdUiI~^$-l4s7h2wk09kyA^+4KP$xNrVgaPNP?=pTh-CnLmESThw z9dz?4QpqPukVXDwyC#s2zbvcalkPXBq&)O$Hm!e@nJd436=GYKmLKnBl;WVq^>%m! zr0Ei(Onzp-&?%M5rR*O^V8P!hep}Mk9bYMGpH4~PhsOzt=H#JR@acp{RrUDguKivKSSibrlfeN5ItbV_U>|9Qp6tQ7%I%~YCh_nN0 zGYg4t%6ordt3nD&ow!|;6>-o9V0S%{;cN3TRJ{PLkzTFmP#|?O0N#_*IebCcRIpL) z;V)U1e-MgSpXb-3f?L;?aVNVd z5DXFuVUgEqf-ItltKm1WpnB&v2dy7^M%SQ_^5tq=6&X2hyn>}S9Cg| zDV4%TjkYmhTcLLr#U<)lPn2B@ATYuD%9nad7edM4sY**iR_Exla4C3U5lJ`3#JrEn zmQiyC)J5QiRS)j~J04^Togcuy{;j{Hn%DpFBoYxK43sG!hgS_7 z!0U0#y9Gn6l+RmfO*!y1y4z!<%Z$i|*GM;G3=W&Z__v?Mk<*^9=F8vvyPr0fI%OI5 z&t%3<=SKLcMwX4piOZ_M5$~yHc%FXJuJj7%YrCwpDu(wp_!BA_s1;ecH2UoG-j$xj zE-SV~bJTmYDe^?;2#8vfB&iHkW*z=K@K73=^sh3%89$I0X4lM?iVJt6FaGLO5*ei; zF^{FF*fv?+?qAb5_N&ELsT$E6!I5>c2rD=5M=`zT9%?VYIim_}&nSJXjnB-}?C@VW z=Br3d%1F21M3y-W@sP43ENwCEFe(!=hqMku+8lC_!0?qiKO?xf8%?1iwzg7^tcg5W z4f+w=NK8vd1uC-zoP~5M#VbwIsE`Vr7Gd)p^>oXEuy*+fI6ITvppC9<(1dfmXP)ik zV)?b*ql;1;pp{>#Q0D@!3?+*yp|97do?h9YJ#NcvzLI&b6=4nL-AReSYH7-Gf-I1t zvgtp?hZPTh9yZ6rvDvGM6y7wZE;}RVK^q-iX(l#K^zSMOAHo!3^y!}{@pxCf_AbNP z90+ir4~8cOGe&5E+0pit&@^dMe77fHo>IbE@8X7WQXSWWRZmiY$ zh@<112NlwmdM*!hjO!{-N=(79fuT>;%25I}uI_ok1XiCW0*Rr^243@0=YsCP%S3(I zvoa8aMad}V8^~Jg=Bq?9JL|ioCTO1hL;c$q2~)D_7}fu{)toCaG$b=sqnv7sq}B6! z+y$}-yzdH9n@ZLQSVnqRo>7j->WCyNe{#T4@j!qk!psHOOg-=gYwykS*6yB)DkjKDSEkPc=J`f9M zj2#Z&xf#}QR1=F(vGGAUN*cUWICEl0J7^mD-Su82bR2D0{-g+mb z^Mt^%cqgug?@xJaCR?-(>rmoyvK+cwEhD?_y}Qo;0N`VFl09MpIXyR*>$u0x%xoES z2&E+D$-gjwG9(P}8(EGqjN{>mmU&ucUGQaHq6u3MM5%%$AVpa@OFbNUUW*|%++l2O z7QjL5XD^9CP8sg|u?7;-OgdnQcS z$k4J|8K{az7Ss2PRT@`%6{?AbB-72`HM64NfO_%NdCU#uDtHV#E zP&oPGiZgc79gt41X8!X>ZLC~^!!qWCw?xt=bpdvKUo&AP1oR;Piq0+~uBS+lg<&_; zgD>vN3P#8xk?$p-*${sr?oyit5%J&Re#sCpBEKQDH-R&rK)nUtOOmXy)o`!oKuUc6 z+r;^kZhh-y1){=4>Tb#5zKQKEI7G+&EVOnWXxNb7z5=DwozqE^{u${A#mXg+()vS9au2Z>%mQ>@$mEwNO@VajbcES`=9e zZ!gQlVgPJKt`FBJSG0wBZ7 z2mnl{tC15X#q#U+K9FHR*~5yzOxx~;4JBMZLHM2vz`{LSKFmN}!|+S+Xv69@s^f`7 zxX`uLmNDbQxFo`|ozS~9hj1+QD|iu;qJmYR#IUr|&N(NB2FH3ixrpLq3(8IJfE3kE zZ*U^zt8%n7y%L8Tu}*}@PFdpB*-^$D)5~mXrP^Y(S&_<(uF=(KwFIz7hFaqC)NAUD z4!|_cg_EPooq?vZcYFF9(5a0b5RJ%%6LNUhZ=!#@G1u16q@YmcG@h`-LE9W=ZEx9x z&k-=$?eMr0tjvc>`)G2BFebvJ22p@#s#fKxW3@Q+mAeZ}I+}T4Y1I39yyrqMRYf9J z9cz>$f~zOtmV&IsokAuvv~{Di3g|ER`k&|x2HvhIMNV|lM{4a#3CW6C%q0p0u9e%=@vG|u@;MD zm&xrG8;Vm_uVyzgm@8u}+mYA9o$j zVn?}7uze)}kuN=4Z<{OuzIs-1w4O=ZO>DQrsy(2|AEtn@C(7I@(-Zv#Ij63y3 z$LCMRyH~aP(@At$AX3>6RmZ9}D55%VD*TEj=t8$ixuE)OF8A#rG}CcVT_U#;a={!~ zOU7jiP1bBe(bgJWa%p_Fx74PmC^VO3v7)WoDsWr*DYVrUwuC!X7$`GhJsmwivh8$N1$aSDMLtFUkQEg*HeR-v& zu7blUd>yMgCbKcps2;f)ilNwIr_6gxn_qF!r6nK-)1w2-w?^PPZ^$y zyBBJ{-EyAvI0dh!-m26Zrah&*qFT?g1Ki-CMZxqt5rhZkU9!1J_1kA*iTFLi}dfJR?zoK}+d7xOnTZ1%5yUTDMW^DZ?b-cIP$+xL^ zkmd5EIb0=n+-TN;o@>%r?PtC5M%hELg4X$!QE8*YvQMpscDr!Hzuie_3@L1LZi6~< zor81jvE1tDs4iM}BFH{fAh6llYVP-a<Z9-S7c32Fq#-X$D6lt^Bw1# zhy1Nut)BE(^TFT+>@*b50(jNQ1vOf?5zSoMsTvB4^vS{pA<0e9UW&cXupPl+t;gqXq-5w zFt(A5v}EP$jE-6-tuIfTZOrp#Lh4 zF?YGz8tOUdR=;4fv9XlBtW&Hl-BR9}Z`c@o&zXO4Nc_-!A0gZXsPRMT)M#>B9Jlpt zYPvI0yC0iWcWPB@Q->9?;7BcM9B-y7t_e*fNrjuIG2BANPjF8dkF(li$d6IiD2+J| zJ0SdFTfI;{I@5nw>!nX~ajzWbG^{~cz2E`WnNJZ)x>>E{1k}A-lZzDG8 zw5fEB>%(R#hoX@$3VJ^#@3XqMB<${$k&+;rc?v4; zk|q^-sOd#I&a0SxJ5A?=AINJNb0;ErOQ<)D`qLJI5@Br&Fht-p`pq%7)t0TWw=w;y zJghJdkr!-=ctSYaLhC(YyKIVeIB!=G!~?8g<>(A_aC&%WW72zE4&laK?>%ryRc2$5 z=&Ur%I9#pL^&{^0a?4^iCUiSa5PQ6l)JgcDJ^Xn|b+;`*Ip-V$gI(k0A6@utmd@CN zNinU{i)GVI4HsKY_NGq(dn>sPo513(ao@d#x?G1W-pb#aM=7nzlTP`2-fXO=%ptz+ zYC)%#SAn-_`U;MUHeF*Wxzng0(k<13>H{ZRU&0=uBFiqSYZBcdi$)&VVb9dyfVD+!fp=>2oxN{>YhOa~pIhjWHsB@=p(13 zFqD6E9JfdOOWq_gW*f~07ZyI^@D*THqy zlnmmkDvDeL#p7nnmp{42dpyp|%IX9^_FL{parqL-q`n{=)$wWc-wk&EE=hLckjB>I zCd*>27k++iyi~mBKKBn~f0w3gl>r*lVm<)v!qRsB$1v_i+TtuMf-^wzI?O z`~u`Y=eUY$V6EF5LT;bIeJ@d%dk!--JWlL&bRq@`zzn7$BBZl`oFT3t7oh+#Fn^tKP2lmx^r*4U&u?z?6VSuG!n=BPfp_J0P5lxr zp^Ie`z8(>@e0!)>Yxt5WS{12B8@k?2&zS)&7nJ#NmbGoQ#|{#65-@t6a_8w-P7dTr z9Y|hX64a7xg@2Ysi+;BIt@BT}bl2%FXx{Bu#in$Zs7v0m^fWC?seByAlLSoz{woTK zWYX~ZT_takjHIeN+BfSND%#;GedY6E$gI6e$sSwixg9tQ!g0rB2xZaORI1=f<~F00 zF3k9aP8@#IJ}ugEK;^OX0k~exL)lK|?!{2!Bz4-#O|#|B4+s03A~~OCarBJ#cXlbO z-%JVXG+e{nIDA}9*85ZxUQ@ZZD)aDrheh(_>T#g|xbOKy_H7dU64R9_AS2tOA-)Q|3KU) znTw*fFiA{;@ZkxF<^v-HUtoaB*fUs1oVuBC@GMe7!jutPdzs<6jQ&V`fh81T^m(m- zsnf8dP_p`S2y2X3&9g<{0DAHU=DZ(a7`>N{G`m0g=wrQAaIKdV4uLdGVN2QtYA#-a zf)n=_ttxDA>Aosy`0b7m7e>#x!gQid`DirVu$6<-Duy0Zx}D`ip6wjNHSF0*#u}=RnZ|=2rf$y zZ+3%5A~I6)JvgVreU8aKRt-4gBv%YZ@~q?cO{RoTwzz%ww%*kLcHwBX5*Kpp4=ET7 z;^yf{)vcZ$twLh3_MK*!f?Mxp%+a4x1#Y@ButVFS(v?J2QGHcY5!mLo=>3gTJ(ge} zNDA?+Jr5JnUGmyWxCf@gV#Gos7qc6jtC(9dpbAU5n_x`YzY78?ZA5k|dPkaBo=*Fd zykdjf%xg&ve|?wTKZfD<=YW!3IX00R|GK54W*vcC<|bTI$^x^?3Mnmy^L(s965c`;b?y~2HwMC}YX?-ekxN$miG`@9dW ze#;X`Q>i!YhVNsnF4+%F19c{j--BL2TDCKtM#>Q#l8lV=Iw4QvxJ>{)4D0<0*B56V z$R`mh{MtLL=jc7=mv-p8MQ$gIps;QZu`U};X2`Rr^cH&ND~^Bv+I#g80h!2oOxjCh z=gJp#5*MkzF3?DQhZT{q0l^@B9R;0p9C`@Et}X7ya@5S(It4$L+P?4ZW6Pl%fUUa( zezi3W;W&-%clab5^t~7zjAA*>G=|K>x z$xQQf>8REVho=^P#%An38?l$Kg+FWorBsrwyzb~OD{}O8!s$-AdgLOUz{r@TaNXP) zAAmbAs?8MxRKZ!{)SvOm`w_q`^+C}3Df>4Mc#W&Sneb0LSO_{p%TQ%cYW{`tnuHpA z=4ZNtj%4ixZ)K?X%oW*({K5*F0%_Y26}`0L)xx}|iWF>B5~e1BvO_g__#6)Bd#+|k z<_s=Mx>FdV{_Csd#NgzOnfEKf#uQi zYQ!<)7c^-3$asazM(?AP4!P85N9OsZ0=Lm#mI3EQW2_NUhNf%_RBNRrJuqJyJOCF% z^Yi2+WLFBgoeypJ7yJ(Wc*QMwCkzBtLq=9SPE)@AVmR!$SxO4;0Fo$MK7e= z^7qw4&n-_;+caXTQu#!pTU+ZV=USrGJOWVC*)vY#7~Dilt)1?>)BA504`YID=Z)L>nAdZ5pT*yl~^6s67u{EVro zhQ6U2E1cy3F@`gkeJCj`-My3uI!s7K9{w7xqm2!(2C3MxJr1R@WRoa$?`r@&3zwOn zbvU>bJD{?tw224y1PMR@y41w!kJoEFONJ4t>JA@;4J0ZKZO|Me77L-FiXXBTco+R~ zm~WIUgCucmLQfFmQcKk!-DpPrLClRNEvS?#Z30QY1EGOb`Oz+48ff&?eMR zTN#5Za9A~hlU<-ULVz)XjGe0Xux8#&K^;f zRY`+Qw`w8t+kdny?Yrsjgw7X&B;w5ZOe^nJkq8?}?9^S*qe7OAEd&Zl`RLP(&e^JM@sg?;K0m(W)=UEJ16J;j z%ifiV9GoOCM_h@*SWq(XnFI~{jcST)9#AJ&kI;kxfKc+O+d>ptIOYy0gXuJSGqLw$ z**jmb?#E9vK1_emZt-+3UB1txcazmgn?)|5n+1MXUD+!OWn${qx0fU7C}MD3%7W?< zXiZ^c6&TBvsGy+@=b*0aT+>D?xbqY>Fc1lq8onsTg%9gnZo-6%&hbmo>5%zy-vRxI z-`3*qcfE^qJIG_X+r#hrkmOG0LEL>+h{h*_9LaMhA%?Tg6CaYpu{L>dm2T`v2sJJV;uZ}>-IV)Sqkm+=k~iE zT7|^>)Gn*BR8o=4S6pY^cfsiKbHa3eGKTUB7_>@i^(h^a0QpGv#l;VY88k{wI;)%H4#V=h-ZhsCci ztw@J8Z*?CesmzOw{nD$yT-e{gmC8HVK$wGCxs@oWlne4$Ey;ADlkpg(AR_3KvSy8r>t5}q5pYvR~ z6|b|L9q?7H!BU}CsTVR=`_P+%TAhSawW1m=3+qG2EdrhtRf-vKG;om%-IKwUuV;?=ek#w9`;A^aWvQCl z^jmHA?fXKLI^=y_eEoO%)lR4_tik%gHCgHTVl5HK^yG`Zm`z zHGq2TPT*M0|LD8*uJ|MLCZ`9JP4CpN`^eSIe2Q2VpHkp_ll>D7n;tB+KXfyAM)-sY zyaBIt=ZAPNmkn5zc~Ry|tU#i;53p*HvDm~E@QEek?N$ntQRC(ekVB<JI3_2ich5lIJxlt{0J8gl)FlbsU==Y}S zb0UuWXy7%GQs%A={Sp3dj#Biz==a+M)kbyE%@ML=%B7+LaK$+@$-CrPbc|VptEO3u z)vxw9SxpY>f}fHe;-(T?mfNAeMKr~!z003Dpfd9ZWKp+(0 z|BYe)cW4bA0OP-)?ACz)O#gqOY)}Be|3KOQ-T8mGxBq@H;{W0N>K`Zf|EA#nx&03X XCoc{9Z#w`0&_8SbH-_;3XZ1e-;8(b= From 415143f529449daf8f1c0d47e77bbcf922acdaef Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:37:49 +0200 Subject: [PATCH 34/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/createUiDefinition.json --- .../Package/createUiDefinition.json | 85 ------------------- 1 file changed, 85 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/createUiDefinition.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/createUiDefinition.json b/Solutions/Palo Alto Cortex XDR CCP/Package/createUiDefinition.json deleted file mode 100644 index 8cad7714a3b..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Package/createUiDefinition.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/0.1.2-preview/CreateUIDefinition.MultiVm.json#", - "handler": "Microsoft.Azure.CreateUIDef", - "version": "0.1.2-preview", - "parameters": { - "config": { - "isWizard": false, - "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Palo%20Alto%20Cortex%20XDR%20CCP/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Palo Alto Cortex XDR](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/09agw06t5dpvw-cortex-xdr-rest-api) data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch agents, alerts, incidents, management and endpoint logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table, thus resulting in better performance.\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", - "subscription": { - "resourceProviders": [ - "Microsoft.OperationsManagement/solutions", - "Microsoft.OperationalInsights/workspaces/providers/alertRules", - "Microsoft.Insights/workbooks", - "Microsoft.Logic/workflows" - ] - }, - "location": { - "metadata": { - "hidden": "Hiding location, we get it from the log analytics workspace" - }, - "visible": false - }, - "resourceGroup": { - "allowExisting": true - } - } - }, - "basics": [ - { - "name": "getLAWorkspace", - "type": "Microsoft.Solutions.ArmApiControl", - "toolTip": "This filters by workspaces that exist in the Resource Group selected", - "condition": "[greater(length(resourceGroup().name),0)]", - "request": { - "method": "GET", - "path": "[concat(subscription().id,'/providers/Microsoft.OperationalInsights/workspaces?api-version=2020-08-01')]" - } - }, - { - "name": "workspace", - "type": "Microsoft.Common.DropDown", - "label": "Workspace", - "placeholder": "Select a workspace", - "toolTip": "This dropdown will list only workspace that exists in the Resource Group selected", - "constraints": { - "allowedValues": "[map(filter(basics('getLAWorkspace').value, (filter) => contains(toLower(filter.id), toLower(resourceGroup().name))), (item) => parse(concat('{\"label\":\"', item.name, '\",\"value\":\"', item.name, '\"}')))]", - "required": true - }, - "visible": true - } - ], - "steps": [ - { - "name": "dataconnectors", - "label": "Data Connectors", - "bladeTitle": "Data Connectors", - "elements": [ - { - "name": "dataconnectors1-text", - "type": "Microsoft.Common.TextBlock", - "options": { - "text": "This Solution installs the data connector for Palo Alto Cortex XDR. You can get Palo Alto Cortex XDR data in your Microsoft Sentinel workspace. After installing the solution, configure and enable this data connector by following guidance in Manage solution view." - } - }, - { - "name": "dataconnectors-link1", - "type": "Microsoft.Common.TextBlock", - "options": { - "link": { - "label": "Learn more about connecting data sources", - "uri": "https://docs.microsoft.com/azure/sentinel/connect-data-sources" - } - } - } - ] - } - ], - "outputs": { - "workspace-location": "[first(map(filter(basics('getLAWorkspace').value, (filter) => and(contains(toLower(filter.id), toLower(resourceGroup().name)),equals(filter.name,basics('workspace')))), (item) => item.location))]", - "location": "[location()]", - "workspace": "[basics('workspace')]" - } - } -} From d78817189aec5aae020a005c97a800042768f1fd Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:38:02 +0200 Subject: [PATCH 35/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/mainTemplate.json --- .../Package/mainTemplate.json | 2725 ----------------- 1 file changed, 2725 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/mainTemplate.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/mainTemplate.json b/Solutions/Palo Alto Cortex XDR CCP/Package/mainTemplate.json deleted file mode 100644 index c75984830bb..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Package/mainTemplate.json +++ /dev/null @@ -1,2725 +0,0 @@ -{ - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "1.0.0.0", - "metadata": { - "author": "Microsoft", - "comments": "Solution template for Palo Alto Cortex XDR CCP" - }, - "parameters": { - "location": { - "type": "string", - "minLength": 1, - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" - } - }, - "workspace-location": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" - } - }, - "workspace": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" - } - }, - "resourceGroupName": { - "type": "string", - "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "resource group name where Microsoft Sentinel is setup" - } - }, - "subscription": { - "type": "string", - "defaultValue": "[last(split(subscription().id, '/'))]", - "metadata": { - "description": "subscription id where Microsoft Sentinel is setup" - } - } - }, - "variables": { - "_solutionName": "Palo Alto Cortex XDR CCP", - "_solutionVersion": "3.0.4", - "solutionId": "azuresentinel.azure-sentinel-solution-cortexccp", - "_solutionId": "[variables('solutionId')]", - "workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]", - "dataConnectorCCPVersion": "3.0.4", - "_dataConnectorContentIdConnectorDefinition1": "CortexXDRDataConnector", - "dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]", - "_dataConnectorContentIdConnections1": "CortexXDRDataConnectorConnections", - "dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]", - "blanks": "[replace('b', 'b', '')]", - "_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]" - }, - "resources": [ - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnectorDefinition1'), variables('dataConnectorCCPVersion'))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", - "displayName": "Palo Alto Cortex XDR", - "contentKind": "DataConnector", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorCCPVersion')]", - "parameters": {}, - "variables": {}, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", - "apiVersion": "2022-09-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", - "location": "[parameters('workspace-location')]", - "kind": "Customizable", - "properties": { - "connectorUiConfig": { - "id": "CortexXDRDataConnector", - "title": "Palo Alto Cortex XDR", - "publisher": "Microsoft", - "descriptionMarkdown": "The [Palo Alto Cortex XDR](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/09agw06t5dpvw-cortex-xdr-rest-api) data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table so that queries don't need to parse it again, thus resulting in better performance.", - "graphQueries": [ - { - "metricName": "Total incident logs received", - "legend": "Palo Alto Cortex XDR incident Logs", - "baseQuery": "PaloAltoCortexXDR_Incidents_CL" - }, - { - "metricName": "Total Endpoint logs received", - "legend": "Palo Alto Cortex XDR endpoint Logs", - "baseQuery": "PaloAltoCortexXDR_Endpoints_CL" - }, - { - "metricName": "Total Audit Management logs received", - "legend": "Palo Alto Cortex XDR Audit Management Logs", - "baseQuery": "PaloAltoCortexXDR_Audit_Management_CL" - }, - { - "metricName": "Total Agent Audit logs received", - "legend": "Palo Alto Cortex XDR Agent Audit Logs", - "baseQuery": "PaloAltoCortexXDR_Audit_Agent_CL" - }, - { - "metricName": "Total Alert logs received", - "legend": "Palo Alto Cortex XDR Alert Logs", - "baseQuery": "PaloAltoCortexXDR_Alerts_CL" - } - ], - "sampleQueries": [ - { - "description": "Get Sample of Cortex XDR incident logs", - "query": "PaloAltoCortexXDR_Incidents_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR endpoint logs", - "query": "PaloAltoCortexXDR_Endpoints_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR alert logs", - "query": "PaloAltoCortexXDR_Alerts_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR Audit Management logs", - "query": "PaloAltoCortexXDR_Audit_Management_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR Agent Audit logs", - "query": "PaloAltoCortexXDR_Audit_Agent_CL| take 10" - } - ], - "dataTypes": [ - { - "name": "PaloAltoCortexXDR_Incidents_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Incidents_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Endpoints_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Endpoints_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Alerts_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Alerts_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Audit_Management_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Audit_Agent_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriteria": [ - { - "type": "HasDataConnectors", - "value": null - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and Write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true, - "action": false - } - } - ] - }, - "instructionSteps": [ - { - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "#### Configuration steps for the Palo Alto Cortex XDR API \n Follow the instructions to obtain the credentials. you can also follow this [guide](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/3u3j0e7hcx8t1-get-started-with-cortex-xdr-ap-is) to generate API key." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "#### 1. Retrieve API URL\n 1.1. Log in to the Palo Alto Cortex XDR [**Management Console**] with Admin user credentials\n 1.2. In the [**Management Console**], click [**Settings**] -> [**Configurations**] \n 1.3. Under [**Integrations**] click on [**API Keys**].\n 1.4. In the [**Settings**] Page click on [**Copy API URL**] in the top right corner." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "#### 2. Retrieve API Token\n 2.1. Log in to the Palo Alto Cortex XDR [**Management Console**] with Admin user credentials\n 2.2. In the [**Management Console**], click [**Settings**] -> [**Configurations**] \n 2.3. Under [**Integrations**] click on [**API Keys**].\n 2.4. In the [**Settings**] Page click on [**New Key**] in the top right corner.\n 2.5. Choose security level, role, choose Standard and click on [**Generate**]\n 2.6. Copy the API Token, once it generated the [**API Token ID**] can be found under the ID column" - } - }, - { - "parameters": { - "label": "Base API URL", - "placeholder": "https://api-example.xdr.au.paloaltonetworks.com", - "type": "text", - "name": "apiUrl" - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "API Key ID", - "placeholder": "API ID", - "type": "text", - "name": "apiId" - }, - "type": "Textbox" - }, - { - "type": "Textbox", - "parameters": { - "label": "API Token", - "placeholder": "API Token", - "type": "password", - "name": "apiToken" - } - }, - { - "parameters": { - "label": "toggle", - "name": "toggle" - }, - "type": "ConnectionToggleButton" - } - ] - } - ], - "isConnectivityCriteriasMatchSome": false - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", - "apiVersion": "2022-01-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", - "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorCCPVersion')]", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "[variables('_solutionName')]", - "kind": "Solution" - }, - "author": { - "name": "Microsoft" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "criteria": [ - { - "version": "[variables('dataConnectorCCPVersion')]", - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "kind": "ResourcesDataConnector" - } - ] - } - } - }, - { - "name": "CortexXdrDCR", - "apiVersion": "2022-06-01", - "type": "Microsoft.Insights/dataCollectionRules", - "location": "[parameters('workspace-location')]", - "kind": "[variables('blanks')]", - "properties": { - "streamDeclarations": { - "Custom-CortexXdrStreamIncidents": { - "columns": [ - { - "name": "incident_id", - "type": "string" - }, - { - "name": "incident_name", - "type": "string" - }, - { - "name": "creation_time", - "type": "long" - }, - { - "name": "modification_time", - "type": "long" - }, - { - "name": "detection_time", - "type": "long" - }, - { - "name": "status", - "type": "string" - }, - { - "name": "severity", - "type": "string" - }, - { - "name": "description", - "type": "string" - }, - { - "name": "assigned_user_mail", - "type": "string" - }, - { - "name": "assigned_user_pretty_name", - "type": "string" - }, - { - "name": "alert_count", - "type": "int" - }, - { - "name": "low_severity_alert_count", - "type": "int" - }, - { - "name": "med_severity_alert_count", - "type": "int" - }, - { - "name": "high_severity_alert_count", - "type": "int" - }, - { - "name": "critical_severity_alert_count", - "type": "int" - }, - { - "name": "user_count", - "type": "int" - }, - { - "name": "host_count", - "type": "int" - }, - { - "name": "notes", - "type": "string" - }, - { - "name": "resolve_comment", - "type": "string" - }, - { - "name": "resolved_timestamp", - "type": "long" - }, - { - "name": "manual_severity", - "type": "string" - }, - { - "name": "manual_description", - "type": "string" - }, - { - "name": "xdr_url", - "type": "string" - }, - { - "name": "starred", - "type": "boolean" - }, - { - "name": "hosts", - "type": "dynamic" - }, - { - "name": "users", - "type": "dynamic" - }, - { - "name": "incident_sources", - "type": "dynamic" - }, - { - "name": "rule_based_score", - "type": "int" - }, - { - "name": "manual_score", - "type": "int" - }, - { - "name": "wildfire_hits", - "type": "int" - }, - { - "name": "alerts_grouping_status", - "type": "string" - }, - { - "name": "mitre_tactics_ids_and_names", - "type": "dynamic" - }, - { - "name": "mitre_techniques_ids_and_names", - "type": "dynamic" - }, - { - "name": "alert_categories", - "type": "dynamic" - }, - { - "name": "original_tags", - "type": "dynamic" - }, - { - "name": "tags", - "type": "dynamic" - } - ] - }, - "Custom-CortexXdrStreamManagement": { - "columns": [ - { - "name": "AUDIT_ID", - "type": "int" - }, - { - "name": "AUDIT_OWNER_NAME", - "type": "string" - }, - { - "name": "AUDIT_OWNER_EMAIL", - "type": "string" - }, - { - "name": "AUDIT_ASSET_JSON", - "type": "string" - }, - { - "name": "AUDIT_ASSET_NAMES", - "type": "string" - }, - { - "name": "AUDIT_HOSTNAME", - "type": "string" - }, - { - "name": "AUDIT_RESULT", - "type": "string" - }, - { - "name": "AUDIT_REASON", - "type": "string" - }, - { - "name": "AUDIT_DESCRIPTION", - "type": "string" - }, - { - "name": "AUDIT_ENTITY", - "type": "string" - }, - { - "name": "AUDIT_ENTITY_SUBTYPE", - "type": "string" - }, - { - "name": "AUDIT_SESSION_ID", - "type": "int" - }, - { - "name": "AUDIT_CASE_ID", - "type": "int" - }, - { - "name": "AUDIT_INSERT_TIME", - "type": "long" - }, - { - "name": "AUDIT_SEVERITY", - "type": "string" - }, - { - "name": "AUDIT_SOURCE_IP", - "type": "string" - }, - { - "name": "AUDIT_USER_AGENT", - "type": "string" - }, - { - "name": "AUDIT_USER_ROLES", - "type": "dynamic" - } - ] - }, - "Custom-CortexXdrStreamAgent": { - "columns": [ - { - "name": "TIMESTAMP", - "type": "long" - }, - { - "name": "RECEIVEDTIME", - "type": "long" - }, - { - "name": "ENDPOINTID", - "type": "string" - }, - { - "name": "ENDPOINTNAME", - "type": "string" - }, - { - "name": "DOMAIN", - "type": "string" - }, - { - "name": "TRAPSVERSION", - "type": "string" - }, - { - "name": "CATEGORY", - "type": "string" - }, - { - "name": "TYPE", - "type": "string" - }, - { - "name": "SUBTYPE", - "type": "string" - }, - { - "name": "RESULT", - "type": "string" - }, - { - "name": "REASON", - "type": "string" - }, - { - "name": "DESCRIPTION", - "type": "string" - } - ] - }, - "Custom-CortexXdrStreamEndpoint": { - "columns": [ - { - "name": "agent_id", - "type": "string" - }, - { - "name": "agent_status", - "type": "string" - }, - { - "name": "operational_status", - "type": "string" - }, - { - "name": "host_name", - "type": "string" - }, - { - "name": "agent_type", - "type": "string" - }, - { - "name": "ip", - "type": "dynamic" - }, - { - "name": "last_seen", - "type": "long" - }, - { - "name": "tags", - "type": "dynamic" - }, - { - "name": "users", - "type": "dynamic" - } - ] - }, - "Custom-CortexXdrStreamAlerts": { - "columns": [ - { - "name": "external_id", - "type": "string" - }, - { - "name": "severity", - "type": "string" - }, - { - "name": "matching_status", - "type": "string" - }, - { - "name": "end_match_attempt_ts", - "type": "long" - }, - { - "name": "local_insert_ts", - "type": "long" - }, - { - "name": "bioc_indicator", - "type": "string" - }, - { - "name": "matching_service_rule_id", - "type": "string" - }, - { - "name": "attempt_counter", - "type": "int" - }, - { - "name": "is_whitelisted", - "type": "boolean" - }, - { - "name": "starred", - "type": "boolean" - }, - { - "name": "mitre_technique_id_and_name", - "type": "dynamic" - }, - { - "name": "mitre_tactic_id_and_name", - "type": "dynamic" - }, - { - "name": "agent_version", - "type": "string" - }, - { - "name": "agent_fqdn", - "type": "string" - }, - { - "name": "agent_os_type", - "type": "string" - }, - { - "name": "agent_data_collection_status", - "type": "boolean" - }, - { - "name": "mac", - "type": "string" - }, - { - "name": "alert_id", - "type": "string" - }, - { - "name": "detection_timestamp", - "type": "long" - }, - { - "name": "name", - "type": "string" - }, - { - "name": "category", - "type": "string" - }, - { - "name": "endpoint_id", - "type": "string" - }, - { - "name": "description", - "type": "string" - }, - { - "name": "host_ip", - "type": "string" - }, - { - "name": "host_name", - "type": "string" - }, - { - "name": "source", - "type": "string" - }, - { - "name": "action", - "type": "string" - }, - { - "name": "action_pretty", - "type": "string" - }, - { - "name": "causality_actor_causality_id", - "type": "string" - }, - { - "name": "causality_actor_process_command_line", - "type": "string" - }, - { - "name": "causality_actor_process_image_md5", - "type": "string" - }, - { - "name": "causality_actor_process_image_name", - "type": "string" - }, - { - "name": "causality_actor_process_image_path", - "type": "string" - }, - { - "name": "causality_actor_process_image_sha256", - "type": "string" - }, - { - "name": "causality_actor_process_signature_status", - "type": "string" - }, - { - "name": "identity_type", - "type": "string" - }, - { - "name": "operation_name", - "type": "string" - }, - { - "name": "cloud_provider", - "type": "string" - }, - { - "name": "resource_type", - "type": "string" - }, - { - "name": "cluster_name", - "type": "string" - }, - { - "name": "container_id", - "type": "string" - }, - { - "name": "action_country", - "type": "string" - }, - { - "name": "dns_query_name", - "type": "string" - }, - { - "name": "fw_email_recipient", - "type": "string" - }, - { - "name": "fw_email_sender", - "type": "string" - }, - { - "name": "fw_email_subject", - "type": "string" - }, - { - "name": "event_type", - "type": "string" - }, - { - "name": "action_file_macro_sha256", - "type": "string" - }, - { - "name": "action_file_md5", - "type": "string" - }, - { - "name": "action_file_name", - "type": "string" - }, - { - "name": "action_file_path", - "type": "string" - }, - { - "name": "action_file_sha256", - "type": "string" - }, - { - "name": "fw_rule_id", - "type": "string" - }, - { - "name": "fw_rule", - "type": "string" - }, - { - "name": "image_name", - "type": "string" - }, - { - "name": "actor_process_image_name", - "type": "string" - }, - { - "name": "actor_process_command_line", - "type": "string" - }, - { - "name": "actor_process_image_md5", - "type": "string" - }, - { - "name": "actor_process_image_path", - "type": "string" - }, - { - "name": "actor_process_os_pid", - "type": "int" - }, - { - "name": "actor_process_image_sha256", - "type": "string" - }, - { - "name": "actor_process_signature_status", - "type": "string" - }, - { - "name": "actor_process_signature_vendor", - "type": "string" - }, - { - "name": "actor_thread_thread_id", - "type": "string" - }, - { - "name": "action_local_ip", - "type": "string" - }, - { - "name": "action_local_port", - "type": "int" - }, - { - "name": "module_id", - "type": "string" - }, - { - "name": "os_actor_process_command_line", - "type": "string" - }, - { - "name": "os_actor_thread_thread_id", - "type": "string" - }, - { - "name": "os_actor_process_image_name", - "type": "string" - }, - { - "name": "os_actor_process_os_pid", - "type": "int" - }, - { - "name": "os_actor_process_image_sha256", - "type": "string" - }, - { - "name": "os_actor_process_signature_status", - "type": "string" - }, - { - "name": "os_actor_process_signature_vendor", - "type": "string" - }, - { - "name": "os_actor_effective_username", - "type": "string" - }, - { - "name": "action_process_signature_status", - "type": "string" - }, - { - "name": "action_process_signature_vendor", - "type": "string" - }, - { - "name": "action_registry_data", - "type": "dynamic" - }, - { - "name": "action_registry_full_key", - "type": "string" - }, - { - "name": "action_external_hostname", - "type": "string" - }, - { - "name": "action_remote_ip", - "type": "string" - }, - { - "name": "action_remote_port", - "type": "int" - }, - { - "name": "action_process_image_command_line", - "type": "string" - }, - { - "name": "action_process_image_name", - "type": "string" - }, - { - "name": "action_process_image_sha256", - "type": "string" - }, - { - "name": "fw_url_domain", - "type": "string" - }, - { - "name": "user_agent", - "type": "string" - }, - { - "name": "alert_domain", - "type": "string" - }, - { - "name": "event_id", - "type": "string" - }, - { - "name": "event_timestamp", - "type": "long" - }, - { - "name": "actor_process_instance_id", - "type": "string" - }, - { - "name": "actor_process_causality_id", - "type": "string" - }, - { - "name": "actor_causality_id", - "type": "string" - }, - { - "name": "action_registry_key_name", - "type": "string" - }, - { - "name": "action_registry_value_name", - "type": "string" - }, - { - "name": "action_local_ip_v6", - "type": "string" - }, - { - "name": "action_remote_ip_v6", - "type": "string" - }, - { - "name": "action_process_instance_id", - "type": "string" - }, - { - "name": "action_process_causality_id", - "type": "string" - }, - { - "name": "os_actor_process_image_path", - "type": "string" - }, - { - "name": "os_actor_process_causality_id", - "type": "string" - }, - { - "name": "os_actor_causality_id", - "type": "string" - }, - { - "name": "container_name", - "type": "string" - }, - { - "name": "namespace", - "type": "string" - }, - { - "name": "dst_action_external_hostname", - "type": "string" - }, - { - "name": "dst_action_external_port", - "type": "int" - }, - { - "name": "image_id", - "type": "string" - }, - { - "name": "malicious_urls", - "type": "dynamic" - }, - { - "name": "fw_is_phishing", - "type": "boolean" - }, - { - "name": "user_name", - "type": "string" - } - ] - } - }, - "destinations": { - "logAnalytics": [ - { - "workspaceResourceId": "[variables('workspaceResourceId')]", - "name": "clv2ws1" - } - ] - }, - "dataFlows": [ - { - "streams": [ - "Custom-CortexXdrStreamIncidents" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), IncidentId=incident_id, IncidentName=incident_name, CreationTime=datetime(1970-01-01) + (creation_time * 1ms), ModificationTime=datetime(1970-01-01) + (modification_time * 1ms), DetectionTime=datetime(1970-01-01) + (detection_time * 1ms), Status=status, Severity=severity, Description=description, AssignedUserMail=assigned_user_mail, assignedUserPrettyName=assigned_user_pretty_name, AlertCount=alert_count, LowSeverityAlertCount=low_severity_alert_count, MedSeverityAlertCount=med_severity_alert_count, HighSeverityAlertCount=high_severity_alert_count, CriticalSeverityAlertCount=critical_severity_alert_count, UserCount=user_count, HostCount=host_count, Notes=notes, ResolveComment=resolve_comment, ResolvedTimestamp=datetime(1970-01-01) + (resolved_timestamp * 1ms), ManualSeverity=manual_severity, ManualDescription=manual_description, XdrUrl=xdr_url, Starred=starred, Hosts=todynamic(hosts), Users=todynamic(users), IncidentSources=todynamic(incident_sources), RuleBasedScore=rule_based_score, ManualScore=manual_score, WildfireHits=wildfire_hits, AlertsGroupingStatus=alerts_grouping_status, MitreTacticsIdsAndNames=todynamic(mitre_tactics_ids_and_names), MitreTechniquesIdsAndNames=todynamic(mitre_techniques_ids_and_names), AlertCategories=todynamic(alert_categories), OriginalTags=todynamic(original_tags), Tags=todynamic(tags)", - "outputStream": "Custom-PaloAltoCortexXDR_Incidents_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamManagement" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), AuditId=AUDIT_ID, AuditOwnerName=AUDIT_OWNER_NAME, AuditOwnerEmail=AUDIT_OWNER_EMAIL, AuditAssetJSON=todynamic(AUDIT_ASSET_JSON), AuditAssetNames=AUDIT_ASSET_NAMES, AuditHostName=AUDIT_HOSTNAME, AuditResult=AUDIT_RESULT, AuditReason=AUDIT_REASON, AuditDescription=AUDIT_DESCRIPTION, AuditEntity=AUDIT_ENTITY, AuditEntitySubtype=AUDIT_ENTITY_SUBTYPE, AuditSessionId=AUDIT_SESSION_ID, AuditCaseId=AUDIT_CASE_ID, AuditInsertTime=datetime(1970-01-01) + (AUDIT_INSERT_TIME * 1ms), AuditSeverity=AUDIT_SEVERITY,AuditSourceIp=AUDIT_SOURCE_IP,AuditUserAgent=AUDIT_USER_AGENT,AuditUserRoles=todynamic(AUDIT_USER_ROLES)", - "outputStream": "Custom-PaloAltoCortexXDR_Audit_Management_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamAgent" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), Timestamp=datetime(1970-01-01) + (TIMESTAMP * 1ms), ReceivedTime=datetime(1970-01-01) + (RECEIVEDTIME * 1ms), EndpointId=ENDPOINTID, EndpointName=ENDPOINTNAME, Domain=DOMAIN, TrapsVersion=TRAPSVERSION, Category=CATEGORY, AgentType=TYPE, Subtype=SUBTYPE, Result=RESULT, Reason=REASON, Description=DESCRIPTION", - "outputStream": "Custom-PaloAltoCortexXDR_Audit_Agent_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamAlerts" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), ExternalId = external_id, Severity = severity, MatchingStatus = matching_status, EndMatchAttempt = datetime(1970-01-01) + (end_match_attempt_ts * 1ms), LocalInsert = datetime(1970-01-01) + (local_insert_ts * 1ms), BiocIndicator = bioc_indicator, AttemptCounter = attempt_counter, Whitelisted = is_whitelisted, Starred = starred, MitreTechniqueIdAndName = todynamic(mitre_technique_id_and_name), MitreTacticIdAndName = todynamic(mitre_tactic_id_and_name), AgentVersion = agent_version, AgentFQDN = agent_fqdn, AgentOSType = agent_os_type, AgentDataCollectionStatus = agent_data_collection_status, MacAddress = mac, AlertId = alert_id, DetectionTimestamp = datetime(1970-01-01) + (detection_timestamp * 1ms), Name = name, Category = category, EndpointId = endpoint_id, Description = description, HostIp = host_ip, HostName = host_name, Source = source, Action = action, ActionPretty = action_pretty, CausalityActorCausalityId = causality_actor_causality_id, CausalityActorProcessCommandLine = causality_actor_process_command_line, CausalityActorProcessImageMd5 = causality_actor_process_image_md5, CausalityActorProcessImageName = causality_actor_process_image_name, CausalityActorProcessImagePath = causality_actor_process_image_path, CausalityActorProcessImageSha256 = causality_actor_process_image_sha256, CausalityActorProcessSignatureStatus = causality_actor_process_signature_status, IdentityType = identity_type, OperationName = operation_name, CloudProvider = cloud_provider, ResourceType = resource_type, ClusterName = cluster_name, ContainerId = container_id, ActionCountry = action_country, DnsQueryName = dns_query_name, FwEmailRecipient = fw_email_recipient, FwEmailSender = fw_email_sender, FwEmailSubject = fw_email_subject, EventType = event_type, ActionFileMacroSha256 = action_file_macro_sha256, ActionFileMd5 = action_file_md5, ActionFileName = action_file_name, ActionFilePath = action_file_path, ActionFileSha256 = action_file_sha256, FwRuleId = fw_rule_id, FwRule = fw_rule, ImageName = image_name, ActorProcessImageName = actor_process_image_name, ActorProcessCommandLine = actor_process_command_line, ActorProcessImageMd5 = actor_process_image_md5, ActorProcessImagePath = actor_process_image_path, ActorProcessOsPid = actor_process_os_pid, ActorProcessImageSha256 = actor_process_image_sha256, ActorProcessSignatureStatus = actor_process_signature_status, ActorProcessSignatureVendor = actor_process_signature_vendor, ActorThreadThreadId = actor_thread_thread_id, ActionLocalIp = action_local_ip, ActionLocalPort = action_local_port, ModuleId = module_id, OsActorProcessCommandLine = os_actor_process_command_line, OsActorThreadThreadId = os_actor_thread_thread_id, OsActorProcessImageName = os_actor_process_image_name, OsActorProcessOsPid = os_actor_process_os_pid, OsActorProcessImageSha256 = os_actor_process_image_sha256, OsActorProcessSignatureStatus = os_actor_process_signature_status, OsActorProcessSignatureVendor = os_actor_process_signature_vendor, OsActorEffectiveUsername = os_actor_effective_username, ActionProcessSignatureStatus = action_process_signature_status, ActionProcessSignatureVendor = action_process_signature_vendor, ActionRegistryData = todynamic(action_registry_data), ActionRegistryFullKey = action_registry_full_key, ActionExternalHostname = action_external_hostname, ActionRemoteIp = action_remote_ip, ActionRemotePort = action_remote_port, MatchingServiceRuleId = matching_service_rule_id, ActionProcessImageCommandLine = action_process_image_command_line, ActionProcessImageName = action_process_image_name, ActionProcessImageSha256 = action_process_image_sha256, FwUrlDomain = fw_url_domain, UserAgent = user_agent, AlertDomain = alert_domain, EventId = event_id, EventTimestamp = datetime(1970-01-01) + (event_timestamp * 1ms), ActorProcessInstanceId = actor_process_instance_id, ActorProcessCausalityId = actor_process_causality_id, ActorCausalityId = actor_causality_id, ActionRegistryKeyName = action_registry_key_name, ActionRegistryValueName = action_registry_value_name, ActionLocalIpV6 = action_local_ip_v6, ActionRemoteIpV6 = action_remote_ip_v6, ActionProcessInstanceId = action_process_instance_id, ActionProcessCausalityId = action_process_causality_id, OsActorProcessImagePath = os_actor_process_image_path, OsActorProcessCausalityId = os_actor_process_causality_id, OsActorCausalityId = os_actor_causality_id, ContainerName = container_name, Namespace = namespace, DstActionExternalHostname = dst_action_external_hostname, DstActionExternalPort = dst_action_external_port, ImageId = image_id, MaliciousUrls = todynamic(malicious_urls), FwIsPhishing = fw_is_phishing, UserName = user_name", - "outputStream": "Custom-PaloAltoCortexXDR_Alerts_CL" - }, - { - "streams": [ - "Custom-CortexXdrStreamEndpoint" - ], - "destinations": [ - "clv2ws1" - ], - "transformKql": "source | project TimeGenerated = now(), AgentId=agent_id, AgentStatus=agent_status, OperationalStatus=operational_status, HostName=host_name, AgentType=agent_type, IpAddress=ip, LastSeen=datetime(1970-01-01) + (last_seen * 1ms), Tags=todynamic(tags), Users=todynamic(users)", - "outputStream": "Custom-PaloAltoCortexXDR_Endpoints_CL" - } - ], - "dataCollectionEndpointId": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]" - } - }, - { - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "[parameters('workspace-location')]", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "description": "The time when the record was generated" - }, - { - "name": "Timestamp", - "type": "datetime", - "description": "The timestamp of the event" - }, - { - "name": "ReceivedTime", - "type": "datetime", - "description": "The time when the event was received" - }, - { - "name": "EndpointId", - "type": "string", - "description": "Unique identifier of the endpoint" - }, - { - "name": "EndpointName", - "type": "string", - "description": "Name of the endpoint involved in the event" - }, - { - "name": "Domain", - "type": "string", - "description": "Domain associated with the endpoint" - }, - { - "name": "TrapsVersion", - "type": "string", - "description": "Version of the Traps agent installed on the endpoint" - }, - { - "name": "Category", - "type": "string", - "description": "Category of the event" - }, - { - "name": "AgentType", - "type": "string", - "description": "Type of agent involved in the event" - }, - { - "name": "Subtype", - "type": "string", - "description": "Subtype of the event" - }, - { - "name": "Result", - "type": "string", - "description": "Outcome or result of the event" - }, - { - "name": "Reason", - "type": "string", - "description": "Reason for the event or action" - }, - { - "name": "Description", - "type": "string", - "description": "Detailed description of the event" - } - ] - } - } - }, - { - "name": "PaloAltoCortexXDR_Alerts_CL", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "[parameters('workspace-location')]", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Alerts_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "isDefaultDisplay": true, - "description": "The timestamp (UTC) reflecting the time in which the event was generated." - }, - { - "name": "ExternalId", - "type": "string", - "description": "Unique identifier for the alert in the external system (Cortex XDR)." - }, - { - "name": "Severity", - "type": "string", - "description": "Level of severity of the alert (e.g., Low, Medium, High, Critical)." - }, - { - "name": "MatchingStatus", - "type": "string", - "description": "Status of matching detection logic (e.g., matched or not matched)." - }, - { - "name": "EndMatchAttempt", - "type": "datetime", - "description": "Timestamp of the last match attempt in Unix epoch format." - }, - { - "name": "LocalInsert", - "type": "datetime", - "description": "Local timestamp of when the alert was inserted into the system in Unix epoch format." - }, - { - "name": "BiocIndicator", - "type": "string", - "description": "Indicator or behavior related to the alert, stored as a dynamic object (behavioral IOC data)." - }, - { - "name": "MatchingServiceRuleId", - "type": "string", - "description": "ID of the matching rule or service used to trigger the alert." - }, - { - "name": "AttemptCounter", - "type": "int", - "description": "Number of attempts to match this alert with detection rules." - }, - { - "name": "Whitelisted", - "type": "bool", - "description": "Indicates whether the alert has been whitelisted (true/false)." - }, - { - "name": "Starred", - "type": "bool", - "description": "Indicates whether the alert has been marked as important or starred (true/false)." - }, - { - "name": "MitreTechniqueIdAndName", - "type": "dynamic", - "description": "MITRE ATT&CK technique ID and name associated with the alert." - }, - { - "name": "MitreTacticIdAndName", - "type": "dynamic", - "description": "MITRE ATT&CK tactic ID and name associated with the alert." - }, - { - "name": "AgentVersion", - "type": "string", - "description": "Version of the Cortex XDR agent that generated the alert." - }, - { - "name": "AgentFQDN", - "type": "string", - "description": "Fully qualified domain name (FQDN) of the endpoint device where the alert originated." - }, - { - "name": "AgentOSType", - "type": "string", - "description": "Operating system type of the agent (e.g., Windows, macOS, Linux)." - }, - { - "name": "AgentDataCollectionStatus", - "type": "boolean", - "description": "Status indicating whether the agent is actively collecting data (true/false)." - }, - { - "name": "MacAddress", - "type": "string", - "description": "MAC address of the endpoint device, represented as a dynamic object." - }, - { - "name": "AlertId", - "type": "string", - "description": "Unique identifier for the alert in Cortex XDR." - }, - { - "name": "DetectionTimestamp", - "type": "datetime", - "description": "Timestamp when the detection occurred, in Unix epoch format." - }, - { - "name": "Name", - "type": "string", - "description": "Name of the detection or alert." - }, - { - "name": "Category", - "type": "string", - "description": "Category or classification of the alert (e.g., malware, suspicious activity)." - }, - { - "name": "EndpointId", - "type": "string", - "description": "Unique identifier for the endpoint where the alert was detected." - }, - { - "name": "Description", - "type": "string", - "description": "Detailed description of the alert or detection." - }, - { - "name": "HostIp", - "type": "string", - "description": "IP address of the host machine where the alert was generated, represented as a dynamic object." - }, - { - "name": "HostName", - "type": "string", - "description": "Name of the host machine where the alert was generated." - }, - { - "name": "Source", - "type": "string", - "description": "Source of the alert or detection data (e.g., Cortex XDR, endpoint agent)." - }, - { - "name": "Action", - "type": "string", - "description": "Action taken in response to the alert (e.g., block, quarantine, notify)." - }, - { - "name": "ActionPretty", - "type": "string", - "description": "Human-readable version of the action taken for the alert." - }, - { - "name": "CausalityActorCausalityId", - "type": "string", - "description": "Causality ID of the actor involved." - }, - { - "name": "CausalityActorProcessCommandLine", - "type": "string", - "description": "Command line used by the causality actor's process." - }, - { - "name": "CausalityActorProcessImageMd5", - "type": "string", - "description": "MD5 hash of the causality actor's process image." - }, - { - "name": "CausalityActorProcessImageName", - "type": "string", - "description": "Name of the causality actor's process image." - }, - { - "name": "CausalityActorProcessImagePath", - "type": "string", - "description": "Path to the causality actor's process image." - }, - { - "name": "CausalityActorProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the causality actor's process image." - }, - { - "name": "CausalityActorProcessSignatureStatus", - "type": "string", - "description": "Signature status of the causality actor's process." - }, - { - "name": "IdentityType", - "type": "string", - "description": "Type of identity associated with the entry." - }, - { - "name": "OperationName", - "type": "string", - "description": "Name of the operation being logged." - }, - { - "name": "CloudProvider", - "type": "string", - "description": "Cloud provider associated with the log entry." - }, - { - "name": "ResourceType", - "type": "string", - "description": "Type of resource involved in the log entry." - }, - { - "name": "ClusterName", - "type": "string", - "description": "Name of the cluster involved." - }, - { - "name": "ContainerId", - "type": "string", - "description": "Identifier for the container." - }, - { - "name": "ActionCountry", - "type": "string", - "description": "Country in which the action was taken." - }, - { - "name": "DnsQueryName", - "type": "string", - "description": "DNS query name associated with the log entry." - }, - { - "name": "FwEmailRecipient", - "type": "string", - "description": "Email recipient in the firewall log." - }, - { - "name": "FwEmailSender", - "type": "string", - "description": "Email sender in the firewall log." - }, - { - "name": "FwEmailSubject", - "type": "string", - "description": "Subject line of the email in the firewall log." - }, - { - "name": "EventType", - "type": "string", - "description": "Type of the event being logged." - }, - { - "name": "ActionFileMacroSha256", - "type": "string", - "description": "SHA256 hash of the file macro involved in the action." - }, - { - "name": "ActionFileMd5", - "type": "string", - "description": "MD5 hash of the file involved in the action." - }, - { - "name": "ActionFileName", - "type": "string", - "description": "Name of the file involved in the action." - }, - { - "name": "ActionFilePath", - "type": "string", - "description": "Path to the file involved in the action." - }, - { - "name": "ActionFileSha256", - "type": "string", - "description": "SHA256 hash of the file involved in the action." - }, - { - "name": "FwRuleId", - "type": "string", - "description": "Identifier for the firewall rule." - }, - { - "name": "FwRule", - "type": "string", - "description": "Description of the firewall rule." - }, - { - "name": "ImageName", - "type": "string", - "description": "Name of the image involved." - }, - { - "name": "ActorProcessImageName", - "type": "string", - "description": "Name of the image used by the actor's process." - }, - { - "name": "ActorProcessCommandLine", - "type": "string", - "description": "Command line used by the actor's process." - }, - { - "name": "ActorProcessImageMd5", - "type": "string", - "description": "MD5 hash of the actor's process image." - }, - { - "name": "ActorProcessImagePath", - "type": "string", - "description": "Path to the actor's process image." - }, - { - "name": "ActorProcessOsPid", - "type": "int", - "description": "OS process ID of the actor's process." - }, - { - "name": "ActorProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the actor's process image." - }, - { - "name": "ActorProcessSignatureStatus", - "type": "string", - "description": "Signature status of the actor's process." - }, - { - "name": "ActorProcessSignatureVendor", - "type": "string", - "description": "Vendor of the signature for the actor's process." - }, - { - "name": "ActorThreadThreadId", - "type": "string", - "description": "Thread ID of the actor's thread." - }, - { - "name": "ActionLocalIp", - "type": "string", - "description": "Local IP address associated with the action." - }, - { - "name": "ActionLocalPort", - "type": "int", - "description": "Local port associated with the action." - }, - { - "name": "ModuleId", - "type": "string", - "description": "Identifier for the module." - }, - { - "name": "OsActorProcessCommandLine", - "type": "string", - "description": "Command line used by the OS actor's process." - }, - { - "name": "OsActorThreadThreadId", - "type": "string", - "description": "Thread ID of the OS actor's thread." - }, - { - "name": "OsActorProcessImageName", - "type": "string", - "description": "Name of the image used by the OS actor's process." - }, - { - "name": "OsActorProcessOsPid", - "type": "int", - "description": "OS process ID of the OS actor's process." - }, - { - "name": "OsActorProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the OS actor's process image." - }, - { - "name": "OsActorProcessSignatureStatus", - "type": "string", - "description": "Signature status of the OS actor's process." - }, - { - "name": "OsActorProcessSignatureVendor", - "type": "string", - "description": "Vendor of the signature for the OS actor's process." - }, - { - "name": "OsActorEffectiveUsername", - "type": "string", - "description": "Effective username of the OS actor." - }, - { - "name": "ActionProcessSignatureStatus", - "type": "string", - "description": "Signature status of the action process." - }, - { - "name": "ActionProcessSignatureVendor", - "type": "string", - "description": "Vendor of the signature for the action process." - }, - { - "name": "ActionRegistryData", - "type": "dynamic", - "description": "Dynamic object containing registry data for the action." - }, - { - "name": "ActionRegistryFullKey", - "type": "string", - "description": "Full registry key associated with the action." - }, - { - "name": "ActionExternalHostname", - "type": "string", - "description": "External hostname associated with the action." - }, - { - "name": "ActionRemoteIp", - "type": "string", - "description": "Remote IP address associated with the action." - }, - { - "name": "ActionRemotePort", - "type": "int", - "description": "Remote port associated with the action." - }, - { - "name": "ActionProcessImageCommandLine", - "type": "string", - "description": "Command line used by the action process's image." - }, - { - "name": "ActionProcessImageName", - "type": "string", - "description": "Name of the action process's image." - }, - { - "name": "ActionProcessImageSha256", - "type": "string", - "description": "SHA256 hash of the action process's image." - }, - { - "name": "FwUrlDomain", - "type": "string", - "description": "Domain of the URL in the firewall log." - }, - { - "name": "UserAgent", - "type": "string", - "description": "User agent string associated with the log entry." - }, - { - "name": "AlertDomain", - "type": "string", - "description": "Domain associated with the alert." - }, - { - "name": "EventId", - "type": "string", - "description": "Unique identifier for the event." - }, - { - "name": "EventTimestamp", - "type": "datetime", - "description": "Timestamp for when the event occurred." - }, - { - "name": "ActorProcessInstanceId", - "type": "string", - "description": "Instance ID of the actor's process." - }, - { - "name": "ActorProcessCausalityId", - "type": "string", - "description": "Causality ID of the actor's process." - }, - { - "name": "ActorCausalityId", - "type": "string", - "description": "Causality ID associated with the actor." - }, - { - "name": "ActionRegistryKeyName", - "type": "string", - "description": "Name of the registry key associated with the action." - }, - { - "name": "ActionRegistryValueName", - "type": "string", - "description": "Name of the registry value associated with the action." - }, - { - "name": "ActionLocalIpV6", - "type": "string", - "description": "Local IPv6 address associated with the action." - }, - { - "name": "ActionRemoteIpV6", - "type": "string", - "description": "Remote IPv6 address associated with the action." - }, - { - "name": "ActionProcessInstanceId", - "type": "string", - "description": "Instance ID of the action process." - }, - { - "name": "ActionProcessCausalityId", - "type": "string", - "description": "Causality ID of the action process." - }, - { - "name": "OsActorProcessImagePath", - "type": "string", - "description": "Path to the OS actor's process image." - }, - { - "name": "OsActorProcessCausalityId", - "type": "string", - "description": "Causality ID of the OS actor." - }, - { - "name": "OsActorCausalityId", - "type": "string", - "description": "Causality ID associated with the OS actor." - }, - { - "name": "ContainerName", - "type": "string", - "description": "Name of the container." - }, - { - "name": "Namespace", - "type": "string", - "description": "Namespace associated with the log entry." - }, - { - "name": "DstActionExternalHostname", - "type": "string", - "description": "Destination external hostname for the action." - }, - { - "name": "DstActionExternalPort", - "type": "int", - "description": "Destination external port for the action." - }, - { - "name": "ImageId", - "type": "string", - "description": "Identifier for the image." - }, - { - "name": "MaliciousUrls", - "type": "dynamic", - "description": "Dynamic object containing malicious URLs related to the entry." - }, - { - "name": "FwIsPhishing", - "type": "bool", - "description": "Indicates if the firewall log entry is related to phishing." - }, - { - "name": "UserName", - "type": "string", - "description": "Username associated with the log entry." - } - ] - } - } - }, - { - "name": "PaloAltoCortexXDR_Endpoints_CL", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "[parameters('workspace-location')]", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Endpoints_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "isDefaultDisplay": true, - "description": "The timestamp (UTC) reflecting the time in which the event was generated." - }, - { - "name": "AgentId", - "type": "string", - "description": "Unique identifier for the Cortex XDR agent installed on the endpoint." - }, - { - "name": "AgentStatus", - "type": "string", - "description": "Current status of the Cortex XDR agent (e.g., active, inactive, disconnected)." - }, - { - "name": "OperationalStatus", - "type": "string", - "description": "Operational state of the endpoint (e.g., online, offline)." - }, - { - "name": "HostName", - "type": "string", - "description": "Name of the host machine where the Cortex XDR agent is installed." - }, - { - "name": "AgentType", - "type": "string", - "description": "Type of Cortex XDR agent (e.g., Windows, macOS, Linux)." - }, - { - "name": "IpAddress", - "type": "dynamic", - "description": "IP address of the host machine, stored as a dynamic object." - }, - { - "name": "LastSeen", - "type": "datetime", - "description": "Timestamp of when the agent was last seen active, in Unix epoch format." - }, - { - "name": "Tags", - "type": "dynamic", - "description": "Tags or labels associated with the endpoint, stored as a dynamic object." - }, - { - "name": "Users", - "type": "dynamic", - "description": "List of users associated with the endpoint, stored as a dynamic object." - } - ] - } - } - }, - { - "name": "PaloAltoCortexXDR_Incidents_CL", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "[parameters('workspace-location')]", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Incidents_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "isDefaultDisplay": true, - "description": "The timestamp (UTC) reflecting the time in which the event was generated." - }, - { - "name": "IncidentId", - "type": "string", - "description": "The unique identifier for the incident." - }, - { - "name": "IncidentName", - "type": "string", - "description": "The name of the incident" - }, - { - "name": "CreationTime", - "type": "datetime", - "description": "The time which the incident was created." - }, - { - "name": "ModificationTime", - "type": "datetime", - "description": "The time which the incident was updated." - }, - { - "name": "DetectionTime", - "type": "datetime", - "description": "The time which the incident was detected." - }, - { - "name": "Status", - "type": "string", - "description": "The status of the incident." - }, - { - "name": "Severity", - "type": "string", - "description": "The severity of the incident." - }, - { - "name": "Description", - "type": "string", - "description": "The description of the incident." - }, - { - "name": "AssignedUserMail", - "type": "string", - "description": "The assigned user mail address." - }, - { - "name": "assignedUserPrettyName", - "type": "string", - "description": "The assign user display name." - }, - { - "name": "AlertCount", - "type": "int", - "description": "The number of alerts regarding the incident." - }, - { - "name": "LowSeverityAlertCount", - "type": "int", - "description": "The number of low severity alerts regarding the incident." - }, - { - "name": "MedSeverityAlertCount", - "type": "int", - "description": "The number of medium severity alerts regarding the incident." - }, - { - "name": "HighSeverityAlertCount", - "type": "int", - "description": "The number of high severity alerts regarding the incident." - }, - { - "name": "CriticalSeverityAlertCount", - "type": "int", - "description": "The number of critical severity alerts regarding the incident." - }, - { - "name": "UserCount", - "type": "int", - "description": "The user count regarding the incident." - }, - { - "name": "HostCount", - "type": "int", - "description": "The host count regarding the incident." - }, - { - "name": "Notes", - "type": "string", - "description": "The notes regarding the incident." - }, - { - "name": "ResolveComment", - "type": "string", - "description": "The resolve comment writen in the incident." - }, - { - "name": "ResolvedTimestamp", - "type": "datetime", - "description": "The timestemp when the incident has been resolved." - }, - { - "name": "ManualSeverity", - "type": "string", - "description": "The severity applied manually regarding the incident." - }, - { - "name": "ManualDescription", - "type": "string", - "description": "Any comments associated with the event." - }, - { - "name": "XdrUrl", - "type": "string", - "description": "The link of the incident." - }, - { - "name": "Starred", - "type": "bool", - "description": "Is the incident starred." - }, - { - "name": "Hosts", - "type": "dynamic", - "description": "The hosts regarding the incident." - }, - { - "name": "Users", - "type": "dynamic", - "description": "Any comments associated with the event." - }, - { - "name": "IncidentSources", - "type": "dynamic", - "description": "The sources regarding the incident." - }, - { - "name": "RuleBasedScore", - "type": "int", - "description": "The rule base score of the incident." - }, - { - "name": "ManualScore", - "type": "int", - "description": "The manual score of the incident." - }, - { - "name": "WildfireHits", - "type": "int", - "description": "The wild fire hits." - }, - { - "name": "AlertsGroupingStatus", - "type": "string", - "description": "The alert grouping status." - }, - { - "name": "MitreTacticsIdsAndNames", - "type": "dynamic", - "description": "Mitre tactics ids and names." - }, - { - "name": "MitreTechniquesIdsAndNames", - "type": "dynamic", - "description": "Mitre techniques ids and names." - }, - { - "name": "AlertCategories", - "type": "dynamic", - "description": "The alert grouping status." - }, - { - "name": "OriginalTags", - "type": "dynamic", - "description": "The original tags of the incident." - }, - { - "name": "Tags", - "type": "dynamic", - "description": "The tags of the incident." - } - ] - } - } - }, - { - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "apiVersion": "2022-10-01", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "location": "[parameters('workspace-location')]", - "kind": null, - "properties": { - "schema": { - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "columns": [ - { - "name": "TimeGenerated", - "type": "datetime", - "description": "The time when the record was generated" - }, - { - "name": "AuditId", - "type": "int", - "description": "Unique identifier for the audit event" - }, - { - "name": "AuditOwnerName", - "type": "string", - "description": "Name of the owner who initiated the audit event" - }, - { - "name": "AuditOwnerEmail", - "type": "string", - "description": "Email address of the audit owner" - }, - { - "name": "AuditAssetJSON", - "type": "dynamic", - "description": "JSON object containing the audit asset details" - }, - { - "name": "AuditAssetNames", - "type": "string", - "description": "Names of the assets involved in the audit" - }, - { - "name": "AuditHostName", - "type": "string", - "description": "Host name associated with the audit event" - }, - { - "name": "AuditResult", - "type": "string", - "description": "Result of the audit event (e.g., SUCCESS)" - }, - { - "name": "AuditReason", - "type": "string", - "description": "Reason for the audit event" - }, - { - "name": "AuditDescription", - "type": "string", - "description": "Description of the audit event" - }, - { - "name": "AuditEntity", - "type": "string", - "description": "Entity type associated with the audit event" - }, - { - "name": "AuditEntitySubtype", - "type": "string", - "description": "Subtype of the audit entity (e.g., Login)" - }, - { - "name": "AuditSessionId", - "type": "int", - "description": "Session ID related to the audit event" - }, - { - "name": "AuditCaseId", - "type": "int", - "description": "Case ID related to the audit event" - }, - { - "name": "AuditInsertTime", - "type": "datetime", - "description": "Time when the audit record was inserted into the system." - }, - { - "name": "AuditSeverity", - "type": "string", - "description": "The Severity of the Audit log." - }, - { - "name": "AuditSourceIp", - "type": "string", - "description": "The source Ip of the audit log." - }, - { - "name": "AuditUserAgent", - "type": "string", - "description": "The User Agent of the audit user." - }, - { - "name": "AuditUserRoles", - "type": "dynamic", - "description": "The roles of the audit user." - } - ] - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','dc','-', uniqueString(concat(variables('_solutionId'),'-','DataConnector','-',variables('_dataConnectorContentIdConnectorDefinition1'),'-', variables('dataConnectorCCPVersion'))))]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "version": "[variables('dataConnectorCCPVersion')]" - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',variables('_dataConnectorContentIdConnectorDefinition1'))]", - "apiVersion": "2022-09-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectorDefinitions", - "location": "[parameters('workspace-location')]", - "kind": "Customizable", - "properties": { - "connectorUiConfig": { - "id": "CortexXDRDataConnector", - "title": "Palo Alto Cortex XDR", - "publisher": "Microsoft", - "descriptionMarkdown": "The [Palo Alto Cortex XDR](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/09agw06t5dpvw-cortex-xdr-rest-api) data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table so that queries don't need to parse it again, thus resulting in better performance.", - "graphQueries": [ - { - "metricName": "Total incident logs received", - "legend": "Palo Alto Cortex XDR incident Logs", - "baseQuery": "PaloAltoCortexXDR_Incidents_CL" - }, - { - "metricName": "Total Endpoint logs received", - "legend": "Palo Alto Cortex XDR endpoint Logs", - "baseQuery": "PaloAltoCortexXDR_Endpoints_CL" - }, - { - "metricName": "Total Audit Management logs received", - "legend": "Palo Alto Cortex XDR Audit Management Logs", - "baseQuery": "PaloAltoCortexXDR_Audit_Management_CL" - }, - { - "metricName": "Total Agent Audit logs received", - "legend": "Palo Alto Cortex XDR Agent Audit Logs", - "baseQuery": "PaloAltoCortexXDR_Audit_Agent_CL" - }, - { - "metricName": "Total Alert logs received", - "legend": "Palo Alto Cortex XDR Alert Logs", - "baseQuery": "PaloAltoCortexXDR_Alerts_CL" - } - ], - "sampleQueries": [ - { - "description": "Get Sample of Cortex XDR incident logs", - "query": "PaloAltoCortexXDR_Incidents_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR endpoint logs", - "query": "PaloAltoCortexXDR_Endpoints_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR alert logs", - "query": "PaloAltoCortexXDR_Alerts_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR Audit Management logs", - "query": "PaloAltoCortexXDR_Audit_Management_CL| take 10" - }, - { - "description": "Get Sample of Cortex XDR Agent Audit logs", - "query": "PaloAltoCortexXDR_Audit_Agent_CL| take 10" - } - ], - "dataTypes": [ - { - "name": "PaloAltoCortexXDR_Incidents_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Incidents_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Endpoints_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Endpoints_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Alerts_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Alerts_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Audit_Management_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Audit_Management_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - }, - { - "name": "PaloAltoCortexXDR_Audit_Agent_CL", - "lastDataReceivedQuery": "PaloAltoCortexXDR_Audit_Agent_CL\n | where TimeGenerated > ago(12h) | summarize Time = max(TimeGenerated)\n | where isnotempty(Time)" - } - ], - "connectivityCriteria": [ - { - "type": "HasDataConnectors", - "value": null - } - ], - "availability": { - "status": 1, - "isPreview": false - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and Write permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "read": true, - "write": true, - "delete": true, - "action": false - } - } - ] - }, - "instructionSteps": [ - { - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "#### Configuration steps for the Palo Alto Cortex XDR API \n Follow the instructions to obtain the credentials. you can also follow this [guide](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/3u3j0e7hcx8t1-get-started-with-cortex-xdr-ap-is) to generate API key." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "#### 1. Retrieve API URL\n 1.1. Log in to the Palo Alto Cortex XDR [**Management Console**] with Admin user credentials\n 1.2. In the [**Management Console**], click [**Settings**] -> [**Configurations**] \n 1.3. Under [**Integrations**] click on [**API Keys**].\n 1.4. In the [**Settings**] Page click on [**Copy API URL**] in the top right corner." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "#### 2. Retrieve API Token\n 2.1. Log in to the Palo Alto Cortex XDR [**Management Console**] with Admin user credentials\n 2.2. In the [**Management Console**], click [**Settings**] -> [**Configurations**] \n 2.3. Under [**Integrations**] click on [**API Keys**].\n 2.4. In the [**Settings**] Page click on [**New Key**] in the top right corner.\n 2.5. Choose security level, role, choose Standard and click on [**Generate**]\n 2.6. Copy the API Token, once it generated the [**API Token ID**] can be found under the ID column" - } - }, - { - "parameters": { - "label": "Base API URL", - "placeholder": "https://api-example.xdr.au.paloaltonetworks.com", - "type": "text", - "name": "apiUrl" - }, - "type": "Textbox" - }, - { - "parameters": { - "label": "API Key ID", - "placeholder": "API ID", - "type": "text", - "name": "apiId" - }, - "type": "Textbox" - }, - { - "type": "Textbox", - "parameters": { - "label": "API Token", - "placeholder": "API Token", - "type": "password", - "name": "apiToken" - } - }, - { - "parameters": { - "label": "toggle", - "name": "toggle" - }, - "type": "ConnectionToggleButton" - } - ] - } - ], - "isConnectivityCriteriasMatchSome": false - } - } - }, - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnectorDefinition1')))]", - "apiVersion": "2022-01-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectorDefinitions', variables('_dataConnectorContentIdConnectorDefinition1'))]", - "contentId": "[variables('_dataConnectorContentIdConnectorDefinition1')]", - "kind": "DataConnector", - "version": "[variables('dataConnectorCCPVersion')]", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "[variables('_solutionName')]", - "kind": "Solution" - }, - "author": { - "name": "Microsoft" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "criteria": [ - { - "version": "[variables('dataConnectorCCPVersion')]", - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "kind": "ResourcesDataConnector" - } - ] - } - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates", - "apiVersion": "2023-04-01-preview", - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('dataConnectorTemplateNameConnections1'), variables('dataConnectorCCPVersion'))]", - "location": "[parameters('workspace-location')]", - "dependsOn": [ - "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" - ], - "properties": { - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "displayName": "Palo Alto Cortex XDR", - "contentKind": "ResourcesDataConnector", - "mainTemplate": { - "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", - "contentVersion": "[variables('dataConnectorCCPVersion')]", - "parameters": { - "guidValue": { - "defaultValue": "[[newGuid()]", - "type": "securestring" - }, - "innerWorkspace": { - "defaultValue": "[parameters('workspace')]", - "type": "securestring" - }, - "connectorDefinitionName": { - "defaultValue": "Palo Alto Cortex XDR", - "type": "securestring", - "minLength": 1 - }, - "workspace": { - "defaultValue": "[parameters('workspace')]", - "type": "securestring" - }, - "dcrConfig": { - "defaultValue": { - "dataCollectionEndpoint": "data collection Endpoint", - "dataCollectionRuleImmutableId": "data collection rule immutableId" - }, - "type": "object" - }, - "apiUrl": { - "defaultValue": "apiUrl", - "type": "securestring", - "minLength": 1 - }, - "apiId": { - "defaultValue": "apiId", - "type": "securestring", - "minLength": 1 - }, - "apiToken": { - "defaultValue": "apiToken", - "type": "securestring", - "minLength": 1 - } - }, - "variables": { - "_dataConnectorContentIdConnections1": "[variables('_dataConnectorContentIdConnections1')]" - }, - "resources": [ - { - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('DataConnector-', variables('_dataConnectorContentIdConnections1')))]", - "apiVersion": "2022-01-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/metadata", - "properties": { - "parentId": "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/dataConnectors', variables('_dataConnectorContentIdConnections1'))]", - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "kind": "ResourcesDataConnector", - "version": "[variables('dataConnectorCCPVersion')]", - "source": { - "sourceId": "[variables('_solutionId')]", - "name": "[variables('_solutionName')]", - "kind": "Solution" - }, - "author": { - "name": "Microsoft" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } - } - }, - { - "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CortexXdrAgent', parameters('guidValue'))]", - "apiVersion": "2023-02-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Audit_Agent_CL", - "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('apitoken')]", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "[[concat(parameters('apiUrl'),'/public_api/v1/audits/agents_reports')]", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "[[parameters('apiId')]" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'timestamp', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'timestamp', 'operator': 'lte', 'value': {_QueryWindowEndTime} } ], 'sort': { 'field': 'timestamp', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.data" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamAgent", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - }, - { - "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CortexXdrAlerts', parameters('guidValue'))]", - "apiVersion": "2023-02-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Alerts_CL", - "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('apitoken')]", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "[[concat(parameters('apiUrl'),'/public_api/v1/alerts/get_alerts')]", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "[[parameters('apiId')]" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'creation_time', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'creation_time', 'operator': 'lte', 'value': {_QueryWindowEndTime} }], 'sort': { 'field': 'creation_time', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.alerts" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamAlerts", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - }, - { - "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CortexXdrEndpoints', parameters('guidValue'))]", - "apiVersion": "2023-02-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Endpoints_CL", - "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('apitoken')]", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "[[concat(parameters('apiUrl'),'/public_api/v1/endpoints/get_endpoints')]", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "[[parameters('apiId')]" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{}", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 60, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamEndpoint", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - } - } - }, - { - "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CortexXdrIncidents', parameters('guidValue'))]", - "apiVersion": "2023-02-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Incidents_CL", - "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('apitoken')]", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "[[concat(parameters('apiUrl'),'/public_api/v1/incidents/get_incidents')]", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "[[parameters('apiId')]" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'creation_time', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'creation_time', 'operator': 'lte', 'value': {_QueryWindowEndTime} }], 'sort': { 'field': 'creation_time', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.incidents" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamIncidents", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - }, - { - "name": "[[concat(parameters('innerWorkspace'),'/Microsoft.SecurityInsights/', 'CortexXdrManagement', parameters('guidValue'))]", - "apiVersion": "2023-02-01-preview", - "type": "Microsoft.OperationalInsights/workspaces/providers/dataConnectors", - "location": "[parameters('workspace-location')]", - "kind": "RestApiPoller", - "properties": { - "connectorDefinitionName": "CortexXDRDataConnector", - "dataType": "PaloAltoCortexXDR_Audit_Management_CL", - "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('apitoken')]", - "ApiKeyName": "Authorization" - }, - "request": { - "apiEndpoint": "[[concat(parameters('apiUrl'),'/public_api/v1/audits/management_logs')]", - "headers": { - "Accept": "application/json", - "User-Agent": "Scuba", - "x-xdr-auth-id": "[[parameters('apiId')]" - }, - "httpMethod": "Post", - "queryParametersTemplate": "{ 'request_data': { 'filters': [ { 'field': 'timestamp', 'operator': 'gte', 'value': {_QueryWindowStartTime} },{ 'field': 'timestamp', 'operator': 'lte', 'value': {_QueryWindowEndTime} } ], 'sort': { 'field': 'timestamp', 'keyword': 'desc' } } }", - "queryTimeFormat": "UnixTimestampInMills", - "queryWindowInMin": 5, - "logResponseContent": true - }, - "response": { - "eventsJsonPaths": [ - "$.reply.data" - ] - }, - "dcrConfig": { - "streamName": "Custom-CortexXdrStreamManagement", - "dataCollectionEndpoint": "[[parameters('dcrConfig').dataCollectionEndpoint]", - "dataCollectionRuleImmutableId": "[[parameters('dcrConfig').dataCollectionRuleImmutableId]" - }, - "paging": { - "offsetParaName": "$.request_data.search_from", - "pagingType": "Offset", - "offsetEndParaName": "$.request_data.search_to", - "pageSize": 100 - } - } - } - ] - }, - "packageKind": "Solution", - "packageVersion": "[variables('_solutionVersion')]", - "packageName": "[variables('_solutionName')]", - "contentProductId": "[concat(take(variables('_solutionId'), 50),'-','rdc','-', uniqueString(concat(variables('_solutionId'),'-','ResourcesDataConnector','-',variables('_dataConnectorContentIdConnections1'),'-', variables('dataConnectorCCPVersion'))))]", - "packageId": "[variables('_solutionId')]", - "contentSchemaVersion": "3.0.0", - "version": "[variables('dataConnectorCCPVersion')]" - } - }, - { - "type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages", - "apiVersion": "2023-04-01-preview", - "location": "[parameters('workspace-location')]", - "properties": { - "version": "3.0.4", - "kind": "Solution", - "contentSchemaVersion": "3.0.0", - "displayName": "Palo Alto Cortex XDR CCP", - "publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation", - "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The Palo Alto Cortex XDR data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch agents, alerts, incidents, management and endpoint logs and it supports DCR-based ingestion time transformations that parses the received security data into a custom table, thus resulting in better performance.

    \n

    Data Connectors: 1

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", - "contentKind": "Solution", - "contentProductId": "[variables('_solutioncontentProductId')]", - "id": "[variables('_solutioncontentProductId')]", - "icon": "", - "contentId": "[variables('_solutionId')]", - "parentId": "[variables('_solutionId')]", - "source": { - "kind": "Solution", - "name": "Palo Alto Cortex XDR CCP", - "sourceId": "[variables('_solutionId')]" - }, - "author": { - "name": "Microsoft" - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - }, - "dependencies": { - "operator": "AND", - "criteria": [ - { - "kind": "DataConnector", - "contentId": "[variables('_dataConnectorContentIdConnections1')]", - "version": "[variables('dataConnectorCCPVersion')]" - } - ] - }, - "firstPublishDate": "2024-12-07", - "providers": [ - "Palo Alto" - ], - "categories": { - "domains": [ - "Security - Threat Protection" - ] - } - }, - "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/', variables('_solutionId'))]" - } - ], - "outputs": {} -} From 76a2aa606c094951b38e1707875a2ec38b4cd10e Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:38:14 +0200 Subject: [PATCH 36/71] Delete Solutions/Palo Alto Cortex XDR CCP/Package/testParameters.json --- .../Package/testParameters.json | 38 ------------------- 1 file changed, 38 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/Package/testParameters.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/Package/testParameters.json b/Solutions/Palo Alto Cortex XDR CCP/Package/testParameters.json deleted file mode 100644 index 554801e41b7..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/Package/testParameters.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "location": { - "type": "string", - "minLength": 1, - "defaultValue": "[resourceGroup().location]", - "metadata": { - "description": "Not used, but needed to pass arm-ttk test `Location-Should-Not-Be-Hardcoded`. We instead use the `workspace-location` which is derived from the LA workspace" - } - }, - "workspace-location": { - "type": "string", - "defaultValue": "", - "metadata": { - "description": "[concat('Region to deploy solution resources -- separate from location selection',parameters('location'))]" - } - }, - "workspace": { - "defaultValue": "", - "type": "string", - "metadata": { - "description": "Workspace name for Log Analytics where Microsoft Sentinel is setup" - } - }, - "resourceGroupName": { - "type": "string", - "defaultValue": "[resourceGroup().name]", - "metadata": { - "description": "resource group name where Microsoft Sentinel is setup" - } - }, - "subscription": { - "type": "string", - "defaultValue": "[last(split(subscription().id, '/'))]", - "metadata": { - "description": "subscription id where Microsoft Sentinel is setup" - } - } -} From 6242a4d950e559f97c5e1564ccb05abc6b7a7784 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:38:26 +0200 Subject: [PATCH 37/71] Delete Solutions/Palo Alto Cortex XDR CCP/ReleaseNotes.md --- Solutions/Palo Alto Cortex XDR CCP/ReleaseNotes.md | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/ReleaseNotes.md diff --git a/Solutions/Palo Alto Cortex XDR CCP/ReleaseNotes.md b/Solutions/Palo Alto Cortex XDR CCP/ReleaseNotes.md deleted file mode 100644 index f24527cd820..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/ReleaseNotes.md +++ /dev/null @@ -1,7 +0,0 @@ -| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | -|-------------|--------------------------------|--------------------------------------------------------------------------| -| 3.0.4 | 12-06-2026 | Updating CCF Polling file to implement parameters | -| 3.0.3 | 09-04-2025 | Updating CCF connector parameters | -| 3.0.2 | 10-02-2025 | Advancing CCF **Data Connector** from Public preview to Global Availability.| -| 3.0.1 | 22-01-2025 | Added Preview tag to **Data Connector** | -| 3.0.0 | 17-12-2024 | Initial Solution Release | From f9de44a86eb5ecc399a0d3b362332a20ec5d681e Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:38:39 +0200 Subject: [PATCH 38/71] Delete Solutions/Palo Alto Cortex XDR CCP/SolutionMetadata.json --- .../SolutionMetadata.json | 16 ---------------- 1 file changed, 16 deletions(-) delete mode 100644 Solutions/Palo Alto Cortex XDR CCP/SolutionMetadata.json diff --git a/Solutions/Palo Alto Cortex XDR CCP/SolutionMetadata.json b/Solutions/Palo Alto Cortex XDR CCP/SolutionMetadata.json deleted file mode 100644 index 9fda8ba23c6..00000000000 --- a/Solutions/Palo Alto Cortex XDR CCP/SolutionMetadata.json +++ /dev/null @@ -1,16 +0,0 @@ -{ - "publisherId": "azuresentinel", - "offerId": "azure-sentinel-solution-cortexccp", - "firstPublishDate": "2024-12-07", - "providers": ["Palo Alto"], - "categories": { - "domains": ["Security - Threat Protection"], - "verticals": [] - }, - "support": { - "name": "Microsoft Corporation", - "email": "support@microsoft.com", - "tier": "Microsoft", - "link": "https://support.microsoft.com" - } -} \ No newline at end of file From fc89f460adbfebef3863ec5ab7e2f2df981c1982 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:39:08 +0200 Subject: [PATCH 39/71] Delete Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/DCR.json --- .../TrendMicroCAS_CCF/DCR.json | 155 ------------------ 1 file changed, 155 deletions(-) delete mode 100644 Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/DCR.json diff --git a/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/DCR.json b/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/DCR.json deleted file mode 100644 index 9cdd8a6bbee..00000000000 --- a/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/DCR.json +++ /dev/null @@ -1,155 +0,0 @@ -{ - "name": "TrendMicroCAS_DCR", - "apiVersion": "2023-04-01-preview", - "type": "Microsoft.Insights/dataCollectionRules", - "location": "{{location}}", - "properties": { - "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", - "streamDeclarations": { - "Custom-TrendMicroCASV2_CL": { - "columns": [ - { - "name": "log_item_id", - "type": "string" - }, - { - "name": "service", - "type": "string" - }, - { - "name": "event", - "type": "string" - }, - { - "name": "message_scan_type", - "type": "string" - }, - { - "name": "message_affected_user", - "type": "string" - }, - { - "name": "message_location", - "type": "string" - }, - { - "name": "message_detection_time", - "type": "datetime" - }, - { - "name": "message_triggered_policy_name", - "type": "string" - }, - { - "name": "message_triggered_security_filter", - "type": "string" - }, - { - "name": "message_action", - "type": "string" - }, - { - "name": "message_action_result", - "type": "string" - }, - { - "name": "message_mail_message_id", - "type": "string" - }, - { - "name": "message_mail_message_sender", - "type": "string" - }, - { - "name": "message_mail_message_recipient", - "type": "dynamic" - }, - { - "name": "message_mail_message_submit_time", - "type": "datetime" - }, - { - "name": "message_mail_message_delivery_time", - "type": "datetime" - }, - { - "name": "message_mail_message_subject", - "type": "string" - }, - { - "name": "message_mail_message_file_name", - "type": "string" - }, - { - "name": "message_file_name", - "type": "string" - }, - { - "name": "message_file_upload_time", - "type": "datetime" - }, - { - "name": "message_security_risk_name", - "type": "string" - }, - { - "name": "message_detected_by", - "type": "string" - }, - { - "name": "message_risk_level", - "type": "string" - }, - { - "name": "message_file_sha1", - "type": "string" - }, - { - "name": "message_file_sha256", - "type": "string" - }, - { - "name": "message_virus_name", - "type": "string" - }, - { - "name": "message_detection_type", - "type": "string" - }, - { - "name": "message_ransomware_name", - "type": "string" - }, - { - "name": "message_triggered_dlp_template", - "type": "dynamic" - }, - { - "name": "friendlyName", - "type": "string" - } - ] - } - }, - "destinations": { - "logAnalytics": [ - { - "workspaceResourceId": "{{workspaceResourceId}}", - "name": "clv2ws1" - } - ] - }, - "dataFlows": [ - { - "streams": [ - "Custom-TrendMicroCASV2_CL" - ], - "destinations": [ - "clv2ws1" - ], - "outputStream": "Custom-TrendMicroCASV2_CL", - "transformKql": "source | extend TimeGenerated = iff(isnull(['message_detection_time']), now(), ['message_detection_time']) , LogItemId = ['log_item_id'] , Service = ['service'] , Event = ['event'] , ScanType = ['message_scan_type'] , AffectedUser = ['message_affected_user'] , Location = ['message_location'] , DetectionTime = ['message_detection_time'] , TriggeredPolicyName = ['message_triggered_policy_name'] , TriggeredSecurityFilter = ['message_triggered_security_filter'] , Action = ['message_action'] , ActionResult = ['message_action_result'] , MailMessageId = ['message_mail_message_id'] , MailMessageSender = ['message_mail_message_sender'] , MailMessageRecipient = ['message_mail_message_recipient'] , MailMessageSubmitTime = ['message_mail_message_submit_time'] , MailMessageDeliveryTime = ['message_mail_message_delivery_time'] , MailMessageSubject = ['message_mail_message_subject'] , MailMessageFileName = ['message_mail_message_file_name'] , FileName = ['message_file_name'] , FileUploadTime = ['message_file_upload_time'] , SecurityRiskName = ['message_security_risk_name'] , DetectedBy = ['message_detected_by'] , RiskLevel = ['message_risk_level'] , FileSHA1 = ['message_file_sha1'] , FileSHA256 = ['message_file_sha256'] , VirusName = ['message_virus_name'] , DetectionType = ['message_detection_type'] , RansomwareName = ['message_ransomware_name'] , TriggeredDlpTemplate = ['message_triggered_dlp_template'] , ConnectorName = ['friendlyName'] | project TimeGenerated , LogItemId , Service , Event , ScanType , AffectedUser , Location , DetectionTime , TriggeredPolicyName , TriggeredSecurityFilter , Action , ActionResult , MailMessageId , MailMessageSender , MailMessageRecipient , MailMessageSubmitTime , MailMessageDeliveryTime , MailMessageSubject , MailMessageFileName , FileName , FileUploadTime , SecurityRiskName , DetectedBy , RiskLevel , FileSHA1 , FileSHA256 , VirusName , DetectionType , RansomwareName , TriggeredDlpTemplate , ConnectorName" - } - ] - } -} \ No newline at end of file From 2238f5532dd24a83c66306a0b50c0f12a8f5c5f4 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:39:23 +0200 Subject: [PATCH 40/71] Delete Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/PollingConfig.json --- .../TrendMicroCAS_CCF/PollingConfig.json | 55 ------------------- 1 file changed, 55 deletions(-) delete mode 100644 Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/PollingConfig.json diff --git a/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/PollingConfig.json b/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/PollingConfig.json deleted file mode 100644 index 0862e742af6..00000000000 --- a/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/PollingConfig.json +++ /dev/null @@ -1,55 +0,0 @@ -{ - "type": "Microsoft.SecurityInsights/dataConnectors", - "apiVersion": "2024-09-01", - "name": "TrendMicroCASConnector", - "location": "{{location}}", - "kind": "RestApiPoller", - "properties": { - "auth": { - "type": "APIKey", - "ApiKey": "[[parameters('apiToken')]", - "ApiKeyName": "Authorization", - "ApiKeyIdentifier": "Bearer" - }, - "request": { - "apiEndpoint": "[[concat('https://', parameters('serviceURL'), '/v1/siem/security_events')]", - "httpMethod": "GET", - "rateLimitQPS": 1, - "queryWindowInMin": 10, - "queryTimeFormat": "yyyy-MM-ddTHH:mm:ssZ", - "retryCount": 3, - "timeoutInSeconds": 120, - "headers": { - "Content-Type": "application/json", - "Accept": "application/json" - }, - "queryParameters": { - "service": "[[parameters('service')]", - "event": "[[parameters('eventType')]", - "start": "{_QueryWindowStartTime}", - "end": "{_QueryWindowEndTime}" - } - }, - "response": { - "eventsJsonPaths": [ - "$.security_events[*]" - ], - "format": "json" - }, - "paging": { - "pagingType": "NextPageUrl", - "nextPageTokenJsonPath": "$.next_link", - "isNextPageTokenRelativeUrl": false - }, - "connectorDefinitionName": "TrendMicroCASConnector", - "dataType": "TrendMicroCASV2_CL", - "dcrConfig": { - "streamName": "Custom-TrendMicroCASV2_CL", - "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", - "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" - }, - "addOnAttributes": { - "friendlyName": "[[parameters('friendlyName')]" - } - } -} \ No newline at end of file From abf54414d9f406d8990cb62bff0a309d32408821 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Mon, 31 Aug 2026 06:39:42 +0200 Subject: [PATCH 41/71] Delete Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCASConnector.json --- .../TrendMicroCASConnector.json | 288 ------------------ 1 file changed, 288 deletions(-) delete mode 100644 Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCASConnector.json diff --git a/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCASConnector.json b/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCASConnector.json deleted file mode 100644 index fbd5f37b4a6..00000000000 --- a/Solutions/Trend Micro Cloud App Security/Data Connectors/TrendMicroCAS_CCF/TrendMicroCASConnector.json +++ /dev/null @@ -1,288 +0,0 @@ -{ - "name": "TrendMicroCASConnector", - "apiVersion": "2025-07-01-preview", - "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", - "location": "{{location}}", - "kind": "Customizable", - "properties": { - "connectorUiConfig": { - "id": "TrendMicroCASConnector", - "title": "Trend Micro Cloud App Security (via Codeless Connector Framework)", - "publisher": "Microsoft", - "descriptionMarkdown": "The [Trend Micro Cloud App Security](https://www.trendmicro.com/en_be/business/products/user-protection/sps/email-and-collaboration/cloud-app-security.html) data connector provides the capability to retrieve security event logs of the services that Cloud App Security protects into Microsoft Sentinel through the SIEM API. The connector provides the ability to get events which helps to examine potential security risks, analyze your team's use of collaboration, diagnose configuration problems and more. It supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parse the received security event data into custom columns so that queries don't need to parse it again, thus resulting in better performance.", - "graphQueriesTableName": "TrendMicroCASV2", - "graphQueries": [ - { - "metricName": "Total security events received", - "legend": "Trend Micro CAS Security Events", - "baseQuery": "{{graphQueriesTableName}}" - }, - { - "metricName": "Recent Events", - "legend": "Recent Events", - "baseQuery": "{{graphQueriesTableName}} | where TimeGenerated > ago(24h)" - } - ], - "sampleQueries": [ - { - "description": "Get sample of recent security events", - "query": "{{graphQueriesTableName}}\n| take 20" - } - ], - "dataTypes": [ - { - "name": "TrendMicroCASV2", - "lastDataReceivedQuery": "TrendMicroCASV2\n| where TimeGenerated > ago(6h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" - } - ], - "connectivityCriteria": [ - { - "type": "HasDataConnectors" - }, - { - "type": "IsConnectedQuery", - "value": [ - "TrendMicroCASV2 | where TimeGenerated > ago(7d) | take 1" - ] - } - ], - "availability": { - "isPreview": true, - "status": 1 - }, - "permissions": { - "resourceProvider": [ - { - "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read, Write, and Delete permissions are required.", - "providerDisplayName": "Workspace", - "scope": "Workspace", - "requiredPermissions": { - "write": true, - "read": true, - "delete": true, - "action": false - } - } - ], - "customs": [ - { - "name": "Trend Micro CAS API Token", - "description": "A Trend Micro Cloud App Security API token is required. [See the documentation to learn more about Trend Micro CAS API](https://docs.trendmicro.com/enterprise/cloud-app-security-integration-api-online-help/supported-cloud-app-/log-retrieval-api/get-security-logs.aspx)." - } - ] - }, - "instructionSteps": [ - { - "title": "1. Configure Trend Micro CAS Data Streams", - "description": "Add one or more data streams by selecting the cloud service and event type combinations you want to monitor.", - "instructions": [ - { - "type": "DataConnectorsGrid", - "parameters": { - "mapping": [ - { - "columnName": "Friendly Name", - "columnValue": "properties.addOnAttributes.friendlyName" - }, - { - "columnName": "Service", - "columnValue": "properties.request.queryParameters.service" - }, - { - "columnName": "Event Type", - "columnValue": "properties.request.queryParameters.event" - } - ], - "menuItems": [ - "DeleteConnector" - ] - } - }, - { - "type": "ContextPane", - "parameters": { - "label": "Add Data Stream", - "title": "Add Trend Micro CAS Stream", - "subtitle": "Configure a new service and event type combination", - "contextPaneType": "DataConnectorsContextPane", - "instructionSteps": [ - { - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "## Configuration\n\nConfigure the connection to your Trend Micro Cloud App Security instance and select which service and event type to monitor." - } - }, - { - "type": "Textbox", - "parameters": { - "label": "Trend Micro CAS Service URL", - "placeholder": "api.tmcas.trendmicro.com", - "type": "text", - "name": "serviceURL", - "validations": { - "required": true - } - } - }, - { - "type": "Textbox", - "parameters": { - "label": "API Token", - "placeholder": "Enter your Trend Micro CAS API Token", - "type": "password", - "name": "apiToken", - "validations": { - "required": true - } - } - }, - { - "type": "InfoMessage", - "parameters": { - "text": "The API token will be securely stored and used for authentication with the Trend Micro CAS API.", - "visible": true, - "inline": true - } - }, - { - "type": "Markdown", - "parameters": { - "content": "## Stream Configuration\n\nSelect the cloud service and event type for this data stream." - } - }, - { - "type": "Dropdown", - "parameters": { - "label": "Cloud Service", - "name": "service", - "options": [ - { - "key": "exchange", - "text": "Exchange" - }, - { - "key": "sharepoint", - "text": "SharePoint" - }, - { - "key": "onedrive", - "text": "OneDrive" - }, - { - "key": "dropbox", - "text": "Dropbox" - }, - { - "key": "box", - "text": "Box" - }, - { - "key": "googledrive", - "text": "Google Drive" - }, - { - "key": "gmail", - "text": "Gmail" - }, - { - "key": "teams", - "text": "Teams" - }, - { - "key": "exchangeserver", - "text": "Exchange Server" - }, - { - "key": "salesforce_sandbox", - "text": "Salesforce Sandbox" - }, - { - "key": "salesforce_production", - "text": "Salesforce Production" - }, - { - "key": "teams_chat", - "text": "Teams Chat" - } - ], - "required": true - } - }, - { - "type": "Dropdown", - "parameters": { - "label": "Event Type", - "name": "eventType", - "options": [ - { - "key": "securityrisk", - "text": "Security Risk" - }, - { - "key": "virtualanalyzer", - "text": "Virtual Analyzer" - }, - { - "key": "ransomware", - "text": "Ransomware" - }, - { - "key": "dlp", - "text": "Data Loss Prevention (DLP)" - } - ], - "required": true - } - }, - { - "type": "Textbox", - "parameters": { - "label": "Friendly Name", - "placeholder": "Descriptive name combining service and event type (e.g., 'SharePoint-Ransomware')", - "type": "text", - "name": "friendlyName", - "validations": { - "required": true - } - } - }, - { - "type": "InfoMessage", - "parameters": { - "text": "Each data stream configuration creates a dedicated poller for the selected service and event type combination. You can add multiple streams as needed.", - "visible": true, - "inline": true - } - } - ] - } - ] - } - } - ] - }, - { - "title": "2. Migrate from legacy Azure Function connector (optional)", - "description": "Use this section if you are moving from the legacy Trend Micro CAS Azure Function connector to this CCF connector.\n\n### Migration summary\n\n- The legacy connector used Azure Function app settings such as `WorkspaceID`, `WorkspaceKey`, `TrendMicroCASToken`, and `TrendMicroCASServiceURL`.\n- This CCF connector uses connector stream configuration fields instead (`serviceURL`, `apiToken`, `service`, `eventType`, and `friendlyName`) and writes to the `TrendMicroCASV2` table.\n- Existing detections and hunting content should query the `TrendMicroCAS` parser alias so both legacy and CCF data remain supported during transition.", - "instructions": [ - { - "type": "Markdown", - "parameters": { - "content": "### Recommended migration steps\n\n1. Keep the legacy connector running while you configure at least one CCF data stream.\n2. In **Step 1**, add streams for each service/event type pair you currently ingest.\n3. Verify new events appear in the CCF table:\n\n```kusto\nTrendMicroCASV2\n| where TimeGenerated > ago(1h)\n| take 20\n```\n\n4. Verify normalized parser output still returns expected data:\n\n```kusto\nTrendMicroCAS\n| where TimeGenerated > ago(1h)\n| take 20\n```\n\n5. After validation, disable or remove the legacy Azure Function connector to avoid duplicate ingestion and cost." - } - }, - { - "type": "Markdown", - "parameters": { - "content": "### Troubleshooting\n\nIf no CCF data appears:\n- Confirm the API token is valid and has permission to read security events.\n- Confirm the service URL is correct (for example, `api.tmcas.trendmicro.com`).\n- Check that selected **Cloud Service** and **Event Type** values match what your tenant generates.\n- Wait a few polling cycles and rerun the validation query." - } - } - ] - } - ] - } - } -} \ No newline at end of file From df4159412e0c725d4db4c2acbcbce0ad98b26156 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 4 Sep 2026 09:46:43 +0200 Subject: [PATCH 42/71] =?UTF-8?q?Update=20Package.zip=20=E2=80=94=20sync?= =?UTF-8?q?=20with=20CI-fixed=20mainTemplate.json=20v3.0.3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Solutions/HoneyForge/Package/Package.zip | Bin 15332 -> 15333 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip index a922b46aba890406b23b7137818820ba551649f3..bf241fbbe54e2cc430def48129ea0c4966b617b3 100644 GIT binary patch literal 15333 zcmZ{rLy#yu5TM7lZQI5h+qP}nwr$(CZQHizjc4D#TeY=SyPF)k)9F4XhjjXDc`0BJ z6aWAK2mnJV5}jD8qkA|y004L?Kmf#lRvQBgTV)d)dusz{6FN&LJKGzdE5|MI#9Kdp zk&x5ulw$(Q#6+4c8}8W6#<9p&+M1Hv9|KNn1d2qA003{>pCBQoMCN*b!g*Coye~Wi^ zEZn@b;Bq_%V3tfaAJSUTQt3N?uwjYMfmD~SoFDLic?ud%)EQUfW&+q%k>Y|7kbl0e z2rZH*GGv1oe)#_|mUs)s01H|Hyw%W9UO zud7aLjqUY!VU&lFiaDHr5G#W%ZfOy?t(J{!Z~Uh#}5yeEf>H=05i1|hN~YGDT;2Wr|qq=v-7VwYu;ITue5GFCFmUWhsaVK^cXNA5(wRqux$r@IfLR*fka?ZpHm{qRYqF=P` zYWCq&H}OM|??IC1Q53OoPknTmgVE>59(JPv%aHP$fs;BAKF#As=wgzY(1q}6Z<5<& z%aaUv;g=d9n2v4Ady821R3;jmtV|;H>lg94a-U?tJ~gvEOqn42S|q$gYNS}G*p{Zf z@D2r!+NL0u1`@duG2nDb>LV-&l%){dU59i1+s7;%0^f54sVs^ZJz7x`nNIo!xC+@%=hqaP{&M zujv_c&AVOj)r{AbZNZ|cU+NVb!g!L99ocByE&fP8aiVQU&TSjynPa~mF5QJ)3fGRx ztFbrmRUKt$4M|(9mg*jK8MW^A!^HN;&Zp%4SPKqi2EMz@t8!P9OFP-=8L;=V>-yW? zb9BAbs$q7x4` zOTqPTZLvTQ9tK5KvWcz`eSSW%odGB<;#OgehPafp-bgw0lwyGZ)N#_vza{ZcZJ60;#V=t>SFJS&FFO;Li# zCgq=s6Q}d!4_W79YR&pJx4!=5?6Ee6M`~%GFQxXEq)RjyXclT$)?qnkc3`5?D_5cg z2*-=jBj>37KzN*m2QJmb-m=7sqtm}q%Df{!$jC><(A9Dq*BdsmRnu)ShMC{W*?f;@ zR;LpjIgu0wr7|r|{U8bE8tB!g+AD8&spAEzO*Oi|1*Lz$F}&z11RmM&s45a z1k)QA$Uqj9p__-gk$o5#Ft_^3E4M&BRg-$uuH7QVydOS6Gum1hUPi1{DCf zdBgU_huf8~Nklqm7!$tA=6E1_+yCPK9&t4mpj$0u!-a~y$9Iq1kpB!VzCrl;6Fm=Y zjy6#67xHK^K2QU@U&@a$yz!Jjr9y=rN>xus-YPg!1 zK(n54UR)Ib1wDZxqO|q~OhVYc1r!#1Ffg-3mRxL_u?6QCAt!!|^^%gXq#FmES08tuSyX|!3FYTo1vYu^n{=j5n!!-f? zF#8vE)r9($-lfxCDCzOApV`Q3dK)Xdb9KG}f~>r~ft#n#3(-oTo`SWPJnCIQ$}r$~ zHgy54ADkdraPkCUX1P|!Tjfk~xph}DvlXI8im#-IVnajc%19(iRI_$Qb`HcDxubhF zefxM!X(6ZANhF%In5>W+OX2kLBudVahEPYV@u2oZBxl6&Y$XF}r zx0>X^X-c5}wlZ`+E|>jx42+9rG5hXxdZospgp~?Jp=~I=IxG#aIHc$A@Ir7QyUlcO zQ{SW2z&vV_^yj^Tj|csR8Zsb33(#%`AamJMHXgO1cNtHvlG#gkt+J^(zU*II@@Y%S zrjvng=)9z?7B*XJIJDHL%Db$WP^|&WsddAOiPH0AsW-ILLK;Hnoz}xSRSeChm0+k3sPabwAUP(Nb~nMZp&uYN2L0!sSuELtoH~yVR(p zC4H#9311woS56oOU8!C2jX(&bPc|qWa%$D&8KM%2kP;;ZN4&Kyj{FTjxP~0_^Lkb$ z`R}ugW=sDQ-vUtT5G7nBJjkeWy?E^bmKF`wL2B}DTRAF|s$jCjOVQU`%K(k0ZW=x9 zLidAGA>jAI2x^H0RXmd^m|N~Oa4s?OT05m`NNk{x!uz-D{rMU>^~e{rhaf3)pUvFl z*9KJb1dPkkj)|r-0>uuR?>xV+qrQoRIcY#r{ogbE-;Siq&%tA z&%yoaDVtsl>o`ycwM1_Ej)JA|s=)R}qE15HBRQOQg4}#RrWrDihisk$rx((0dz+|; zX;qt2-rNh=d+jC|Zk{3T%k~M9JkY#7u(Uvsx6|6ysKyygfs!dwn^QaVwNQo9XfL*h zvfISeut=3gXyF}MD^w>&UCLvIGF0nC8QkD(AENbZmkP%9GAvYf@hn+{_O zK&lV7wTKR!t(zaa(1ve8GU;UZb&^{&4*(9Ms zeRs&Xk(9}qY4ZRIe9?N{{?a4o9dT^X6IWasx~EG-FH*0M=m)inj2-$O8hG4}QiFke8yRT>=wKsqDPmskcSyYH1f>p6 z+Z(yET73qvd$*lzuLRzSYOg8LukpLpEcZ3martnOzzCNX1-@AhYe!)#y^ zy2Miahf(%Gg8AqU1PMv^V{ z;OG35<%)wt51dpH+u2@GNsE`MbwD9VENT>>wip-8^8{YQg7}vG{wjP;BkMM6#C5sT zQVhAGx9Zp;^JNf+)sdGic~^5$I^KE~?h^23Ihf6bYzUT#j$5j{T%U!A0b{o3YE29a zxxD2)ELMHr`t(4(NlpAA4R@8bXUGK6SJWx=^AQbs52->^f|6D2G4w_^!@Tr94=)a`9UgQ^Na@}ajT14 zsHogKvdHq|>QF6sQq9B%wmn8t&F|9jycF9MoLy0n(z=i}b`ei-2OM(@2+=?@7Bart)QW1MIEeG? zce7r9iTbK}-Sb9{!+B@l9665Ki3Zfi%mNVOqm!z&tmDC!dPH4@O9Y%tX9N}XVD1e0 zv60bo;xz(H78GH+cm|lnh4h$Hf(Kl99h4D9A`)qyO(G(gY=TOlrZUjI9O>#1&5N}3 zp#h3Nvfj|YS7jcDPUM{!8BQ^RR$M=7x+j#g%ofq847(p+pawL4(ob0@U=P5C!m1PB zsi03`43ziI;zljqL(ak-9E%)0%t4b+aMj_B{$56E)bW;~N_8p$%Ur@b5c9|U?;#LB z-b{(?jemX@LoTwIx&OVW(!c^2InEHm2)=Pc>D1zH;yo$e+hqr~!zkQP&=Qdcb>w1Lqx!bbn*aR`=rx}eP z1)i4KMPHr0WTmg|;(HCnj@fX7vtlYOzP11fuP z+%aq>EFok7PaE4xaow|}_C?1GCEkqv>ABSksc^6Sl7iu0$|W^2=ZDv>eKatI`aq?``EB(&2@dIs`apu#9lu>8H`-;fF?wKK ztmy`4U5dLMWKaJL3`U!I+o80W$1^BZXt$_5S{Wz+ye5Z%H`!yP0kZk-w{4tYAGf*H zM}muHBtR-lj;?}|eogtBH+3P=!~p}s74XsZCUosmkx9OXFscHF8h9g_=(Tb_g zgo>2f<>D}qp?UTqY5s`=)>Dy`* z?UMLp6cN5`K@Q0+Fs(<@NX^T3(%YwZ*KBhccWtp(XOimGIF$}CRL?A?m;0h>7VA?MMF!|5H; z$qWxQK9bTzt9qFt>mvdIl+uUpr4PJO=>~RrTW6X>ZHp;(IYOrX<_%+zqd*oGz7EZ(|v$RvQDw<6(SPa|M@`r5zLrNPta1XlkU!N&}sc_ z%-VW#!~?XN9g1>H2NceblHP8C2*xHP0N6}O(uz((U;$?&Lnl#5{JXNwznS4=iL*h zlfc$YU$LK>&BCgL(?IH_eA01Za=?;lEg>_-w7sH&>3jaAdr!x8PugXMs7Ew&(zXJI za%U1n;zP-B(|FQIENdbG?oIzJ^w}aPl@h}wMrL>lF-GDueBJp?qw>0*Ifu19Gg_kX ztHyXRh0#giPcx`>k4pK0-cQI>AY~d-$emu7+OgGLWvpk3Y3yY~aHcNU66U5cO?+wR zI@1)2-?YB8O6}r-Ob7@R_TWjdJU2%#1>7Ulsi-pUUWka0Dsob$1^}#uRGC(pIVOgC zf<=gKm;~2aS_G3V(tZpkdYxL97Y5phS0z~4V?m3VHtKYc+X(u#)bdA zQ50x>oo-L)^dQB4v7rXh{7AfWn~<(&tPF8%ds#f{(|OsdxO{48Ng%vMA_t7Y!fvn*)Ss(-qBKHLLLHoW)WRK?A&V z7_g`(0s*mT2ZUjj&7zLV+UD?6`Gu$QvuMj&X{{pDCMvXw6w>)X%{IZK%agtI#Thlj z`L1`8e9tNhjS9yzm9{mN%q?l0ijFGgHyj4v1DzPFhn{dJ3MW7n&QzSUc!T;!{jk9p z-8CqW@nMGT4(1D1JMO9H>TT4nSGsm-&c!f#W*#SDEf&XX6p?B{I#oh+)VZqos189o zteGe8ZIKO@IdDA|r?i^5?($yudcH5i+OMa`a&WFaT1JGT{19}={&qjjHWtaEP68qA z;X(rRT9@KlSfw0gN7sM%8MI{kOlOZu>@{ne+(VMy+|F=*DhOw)h-0Ce zbrpjbd?41+*&EB@R(c8`3P1l;W<}#fulprivN+k%yWPnJ1zYw=J5l8$YpU&0x0m?WvuBc76Ao5c2bopvE=3n@u2-A> z`EKlU8%JhG-e;yN8OtjrZK(KVOowkA{c$FnoW?DOp9GH=Yo89yxxA>47Kf>u%h26I z491Tyz8CM%a%5TVut|GO9WPd}xW?)J{gX4MJr}s-YO4lcUOT%EG;{;Jig&dv!a%L+ zz5BDePt`W8hs+FpsQOMVG+x}U@-Mz@n%~EL_L`2pA89?ZcaoJn*viC*po1Hc6vRFA z-U~fY+=g%}pimNlS+uO;^{EF#OhPGLb*m}KLq}U7w!+!8m>)KL+OD($M|;gE00rY= z#T~4=({d(5Q=2>~`*N_8^5`!GQL)XVf#4B#i<9%IS{Ji`5n1==c0ss6E9DItTBiml z%}@sYLdAHicizVKcvitlf`t758QW01|4(%4`4}kbAO#W9sdyUYQth7(JI^c%3$j+q z2(me86Ub;CTVgE5?bXow_Hr7xv-I~tM&C3w6m(?Ve#?m$%%oz(}0P8qOm>eMdUWlRHLcJ;T(Vq3S|{B((rz z;$C$4sGIN<`+t8NEW6_}0AFxq%6(O*0+Wv?9!?QVpyH3Fj;3Hmpi|Nrn$ek3Q4=Tr zmmx!&BHE}~Qw5o&dWBVLBq5UHZt*ici;2ceeaZ7poJFTdKpw|4j+Aa?YSSfmD8v?b zi&yO{)Ze1F+FZT~ZJrgS<^o?80lrs_RkH;v`O17+2Iey?Z2l`eUBTWp!Kl(5Puq#~ zf^Z#_b%x2_WSsY<(v*G2P9@a_)9DAyWKLldSbdjoT+%sabR8DOeCmM2Gtgw3CBydG-}O{e@N?4*;V z%Lw=0c*F%w$no=Dcb7^0RIK(X$g5g>Zlh0BJ`9Z;GLV)lL9QzKxz~@ixbcro$`(vJ zAc&FSl-4MyhF0sLM%31} z=gqCvNgDK5^^c)j9@o`Q^CHtKz2#N3qAVh{G-d#})MxY}+9a+A8q*LRU8#{K*VWE` zksQ*$9Q1Ww#w(#=OyKO0XotV$#l9!t9IpW)Hy}3X?3oHG*)mBb&5Pe8#4E`lF_W-y zh=Eh>EN(Mql+e6@(659J?kSw3z`vVvf0v{&Kb(H?cx51)oq!p%jO$x0ljKaPqR?)v zaiC)>rt%aIB!AHN0Epho!~E$ms9C#*YOz=$l?lcqbYkTTp_76WWw&$Ogo#+q?DHRb z{^n@BY^^(0-O_7kRrGZi{kB~!Skl_<*~x^Mx|w^4_WdATb7!}F@fMTQaSD>yVwjZo zja@27+gV30sf8=o#FbZh=;q3|%muDQO9gvpu9^%UV0s0$lB>7eje1tE%oM7r)j38A z-UH4l>I2LpbYKC6-j@3;?bCUO*~y=qw~A9#_q;C>=IfJ~i1pGwOsF?_^UV&v)VRgt zgv@w@`L4=AwhZ}$9~32TAb8u_<@KlAu}RYig7GvD6PFMBal6?Kp10*bzoaGXi7Ohy zrJo~HJk^wr(XRYtWON6^*&Y*gn_BqHbq(jNhDV&IT#&AI!l`k`#h2^p!Gr*LE34bx34k(L!Q_ikZ5zV5o_tPL-^Yvv1< zrm1He6pV%808rbBN2NHz6Q8rC=xdBu{?o01Bx^wyqKgCQ*yA-5bdl(m=UZ}m88hk* zlSu0JZKIR6rt$ERBHi}*Nm)d`nJJEcw9}2lC~IODcIz;@_mkM+VmiLvs9qsCvFIrj zAGE(AGJ7JS2!Sp8;vZy0nIX88ixNf-x;VQ;kzvJVJEpoBJ&kncVuQ{A4jx%bn8fsz zvUd+KoONVunKe$VJ{*RCK5fU^ zMrsEMpXW1wQgj{3a7DHHW2n?>cin-+r~X7}=pY^%4I=2&mNypSBtcjMl50`S0nIKQ zd6@j{)iJ++^=1e0V_GmV$s2SKzFLc0M^crkO{vMLg;j~*APC19EXH~+R* ztNYa-C_5dz-ALPkx&^?rkJsz45v?a0a;8^5_wJTo*n^t!Nt=arq;7*d^mOf^* z@GAnyqBl3!^#UNR6))Vdots@H4Al?_)e(qYqGT@i%`Jj-TJV{l=%68^F>%E76Q7vf z_QR@R6I94XNR4CY34n4gnoZ{5u#?2B`&AuYl!&mRloP7Z;u06fS)K@kjXzWgM!EN> z>d}pvhZp;Apo}u8wnaq=#_{x>C30{!$t;(^S!U#s9!UTa(Qj6K{!%_P(7lKGHcRK! z5|&1EtZ<^)YF9~^t1}@KsQTN@{y^wxVNCp{puWL)D3l7Cdxgo$?xG$sL=6$ z2ZZGcgF|}b1Q6q)osYzlm2tP28}G|;jkLM(!otyQ`{y5wEGNLY!P)VI2D)@$<3$LX z*KC|dZm+_+Fc?U?Sl{`2ZVa8 zDX8HvzylG$Ww*?$2*f@p^c8KFm41 zgV>$eUBi$;#HVXC3u1LUnT->1V_kV*gPT)`R_O1RQ$C+ z6BpL6>^VDNew7A8cQEK+Ry0R3EFrlf+)4{^1+F^CVD#{w;W-AGT2_z(MUmH0^O)q} zT}Tb6X9JCAj2;5iMAtyp^+~lfwur>EKi-(t7n68&-RN^+ib;m<;(=zYPoSKSFRpO_$SKw2M<=iv`0vauQt?@L3HWiuaZA|oM6gNjZbfLx1{egC&HrDXWmY`m{%B2(NghrMZjnl|@Mv#4M)x=C2ZO5v9X`ZdtBp3_@~ zwFmR~?+?%yxdex>(u)0ZjVp@vFg+ZE^}GlKFSuayJ$G)hHpf#(_y&USg!UQe+q1mQmJT4fM=~__}Zh+63ojVo-(A|3XGI@4~ zN0Spv`xcx0%HvLWmf#m2S#{{&30%VhXHf=Mpz`8ce#igls`lY5uaMKa`7cdnuPzk1 z^d9VQmc9)vmE=yrCpB~5kte8`KD^95c?=rh8M{DBZ!H2} z(1%_V1iuAapD=mJ_-KQ3Pub(`PeVd)+)t`)zII}Q@5pQDX-dBHAb%x>1b?Z_p?(Aw9oO6P2buJ*%?u<9iCbAVHcfF zg$-mK-iwHHo8(IG>G90TjXUq#=N%hczK;~i;y_z>psdJnXL7R(S3#)QRRR6U!{)97 zt$n%75?U*qoAJMv&bp(Q{l-$2#bkE|6OR+{AOZzv7=eL1bq~`x9JyUC8Wu>i$A`pS zZyl-IkD$2ZabU(qIaA?y^L;_;Nx-S%p^>!$*8+X^U zxevL9K)oG_ZRgxD915sqq#>D~CO6xRC&A%w*jSQVA0ZDWMkYlp+9aGou*u>0(_x?2>2G3?9t4YX}v3B-jPU7EIN-~@dhAq3WE)>bZfs9bbiy`s{&EjqwKsmKg`j6y80KG zN~KZf;$Mu@Z4ivOa3^-dxGb!UBjH7%1k_tEffnMDzZf{1h*9`F1DF_bOm>FzMGF~q z42Ivz7Bd+ba%_N2E3oplM+FG6d0MS#Pv`G)`&z@Z-*b93kd+h0f>ILPsU z<%dp4hckxq^9+!f&NmKEf6M(@Tw~PXF*~U>G)JfJy%ltm?!L8m~5grws<4ezRsPG>p`?1A?oYB2^2_ zQ`gwc2rRdHUSX!p`C@o-JlPl^m2Z6ud}CPyvQCTN?hrERey)^0cfgbNUX1=9Rq69# zEya^y*FOQbuVx0>oAw5tF z62p**tnsHZh$;2rX}~HK&{l^j3o{qw6PiG;718bW>}mP6?Gt$$c41zld&vIsBy2E` z(*!{)B%V}l_MVu2lxz;E;oay=27u4sL({W((pRskK&q9yAlLW=NL4u|r2!R~6nMZ& z`>QET_JK>%PXIA1#W&?;vT?FOYT@`+n`+K(ql8)3Fat4R%TR7-FtLy98eG8&k+}ZH zj&1W-b+$W$2o;<=z=ld!rqa1o83PDau;$rSyQJ_DaxKQwF(I1`y=ZQGB3!tjCV`}x zj$3>5A5$#Cd2(1Px!4UW8t?;@$GtFeZXKiDDa#Y8`Pa3~Z}2F+kV|Qf9t+dzBvgOn z=K6#)x~lwgMQNwf;&vs`HW^z@tb{sow2H6?>glpf0C%M-XHrG>X=O%56#oc}@#Tg{ zw_!96UcXp#%g--<%Na(8CuO~I?<9$sHbe`NiPCIHD&ef8b7Z)EO11GTt>Z*TC1k}4 zH<>Iec2H~L)?@ST925OYxHR1AZ}GL|V`nanH@m0H8CpA_ckhoXkQlow;1*M@O4ruy ztjpjX)9g*pe;UXj6C7LnKkcNZ3kH9?>*iLw{E4alnA2d8&^80_3G^AzjYJUS0FkTl znOVwV`{_JczTF$6xf3~mPSL^3S;n@PKznqJ%e|hC23%~Jewh5SV(+Ouj@5~u6iMkh zwrh7(zGetxby|CLRo{Y9#_+c4dH-_Y7hL{-!{g!q;BkIdf!ht3fABaH008|h2J#6pEL2xfU%$)F@2=0k$Kq>TkT+aKu%86NlNgnLwQ9I`r%p% zr3YZH zCUs!_Y`>a5GWlX$;iEV!RYp_#WQ@fGRY&;6%_meetHKqMlE42vT}%q;vP4d%mNhm? zxAL5!k?9Kjo!h?R$cA8r`w7zI>(b{Ql^3x%HO$`EmwVFmb-UAtS%$fsavu((|9(u?BM!k`M7!~KuZ)I9I1Lh&RJU-kR_#(zkp-Fm0c?Nb(DlR4Ri zu_6Wm*6y*iOYuBgr0$?`O&kd;4kn;M~@PjVW}n zQNR`{*Pc~686Hh$At#fcjjAypK!QFJsU{lXqo@}Jx3B~ygcD+@6?>GFdN|)2TS_`3 zSI=Ul#$D=E+q~$IZP^P>SoFfw`7^gDIvEq3mcCNeo;mWMZby`KC?`xgEeJ?ipXG5K zT()L_FoVbb})g+wovUSi>^ zxLBEbcvsTM)x1Z(P?tw(;gqm|H_<`q6G!^$9ZXo|nk@7{-#}mTFy{tu+fBo^aG>8D z0;4v&mEHh~>^)@9_6oh51fX1}g)58=+!r<_nS1CF)Ujl`xtgpNlXS7PjVRxKfwk%y zGR!6y<#}5Ha_!0Xx-!Ux)i_$KLSxV_NR4x0J-=q%#ETU;HePvUdA`cICu~nc z39TzrN^rw&&r*yoDsDHGmeOtWSB;{I3jCZa0Yd_oHzCg)PhH=k2=2%}~xU;YYfNnjPzN!RTms_7mM82w> z77GO9Dw9r+KBNDJLFIjsd?@xJGz?jD_u%~eekR{&FAs3NcZ?iKsF?TdcIzn?KJc&4 z;F5u(`%pb@K)T3SQBdldpLxDFF*I*2Qf%1Y*jwC~xE~fiE}qXw+sfp6VA_`Lqp+jLiq=7WSAcGWD7$O zw&xQJlFbY3rw;^O)uyM;Edp-nW>xeFfsM1J`upraU6cOZ#{Ph{JpgJ$qmDGI=JE|ms3)L<#QgFJ0P;(Dlv(V@b-;?s_ zrM8#qkq&Od*06BbatrYCwkcZ3WBb&!w9o$lax}>8g!mB<|YK zy9r(%EfHCLSI1{QG!0q0E&+ab)aJJuD+R#y-uWaE2hwc}eT>JETmtE{_Uwl3i zj&Gp2_l$ci{(WI5GTW2R3(oGD^ucjtItT$Oi{p`MB&=*mTcUXbJReH&D_o^01Rk@JrHRQg2u(L88k z`)CL=tX(mw#Gnn;i1*jF2X(=bk2?VsrZ2bPc1b!=Y;}ijPU7%pMQmm z2MchDvw{)`5So}otZUZ|M1jBpzc*5;N>~`Et0%@WQYMpj@;f-Gqz4t==MIXy)8O4? zm+JTc-NnY@jLK^j`nzYWqD#(hk#3_|@yMsj6H@}0($|XztIPx|xX^h{<%ee%A?w3TZIDBdeG|B^M#Lt<{eVm3s_2!UoGDV{*AfXCxzJmqLBCP_ zv^C+(Z)KN`7^Y|4m{_zU6WPSZ370-CD)C_w6rc$dT%EIg$5&i{tK|$eG>E{+g+8t( z=bl+5WI%?wvmrw(^BWG(A+%@%Tt!dxq3i3;&ncqSa`J2=Ia9Is=UrZAgooUjFQ8xt zl7qFdJtM@SdgDe7*i7E#V#EEFqt}~nXe0gMD&zUQPcpwG9=h9|3Eo5QksghE2cnE) zRkkUsD0I8cEpSiM+cP>2fwtEF_ zO9oQV=S?i-VY6a9CRWS)bN^kWDx5%$j~^q%FylBJ#0HVGUj~}3rr}vfSSY-Rw%=5w z2xm!P!Gc*9o~=XaY0Jh7Tc}-77~gd%GID1v9CO_;TavIbRL=TV%~?{7EJVm{fmbq)I}hoB ze~>9O{sf~!_PzmfkIs(VzekUDM7|EAHg+qaQl#y-?d!np;HA0=x>tL*rcuLH-097Z z=$gd?9_tRrANOgxa}SMgkOzXU~nQBF7){ zL7|C!0JWZg9aB_DnW9|q+J8=nZYIDN={HGIA(C9tZfZrk4**%1YKgL%%IPLO6Mis* zkNmTntcRcg%ApMXdArJk7O5(PM(Ovx{yL2vxtQJn3e1)yz{#Bn`yS>gig|S5DsF|| zj$9SrYV!eY$WfjQsatV=@#vet6nx@5!75>p_YGGbBvFJ!YAoOeg;%L2R+J!C7jLmB zYJZ7XcrkGo@G+!R@+I3am`MvUw|O2jO6Ay5k$bGI?>v6KNrcEuB5_pQ6j&^*-U2_} zIhJLR0-r)@mBU!vTohd=SxZWs;R^-~wm-Dn6Ui`zo^};E5Ne2`2OdObz27BZ=%a$D z-0;mQqUw_!S?#P8fjs**$zv9)t?S3V(~tY%nPr*ZTeESdGq)FkDK_9(wuQLbR0u@U z6o>cn2xM;Qh~y?ocDK{37t&3$LiOPtmHVt%kgoD&-)VAHPF;az6>+PUU+Yf+&lnMK(NqT74qeZFzZcyG0jnzwX)j1cOq-^6n9AK*~}ps>JT48a+Q=Tu*b* zt-da+b%j1hHu9V5KgQ~Jj6P}NJD;ajcKzHlgcAI3OTIW*{KUf1@Ujrbf=DYL=p=W|p>=&X#tz^j1!G zwp-dZcALY<-`56Atr)Xe4h#vXq*aO(ibtI6h7{#RgOtwVwGs$p(J4HS-J5R-IHz`J z3KtAiW~qnqZWKLY<)D6b-iMB^uCB-F=H@3YJU~GL8-=~fa4|-ToEmEfYqb37DZ-I> zGK;pUKG6+9Yz-E+$n6(Tt1) zffuG)t`%(UoNt^bs(RX58%j<~aW%VG!?Cf!!iS8_6+Q@FH0rWOvCNzM1-Dc^G_EHi zr&SRNvgcUvCLS4>WBO@*&PXMWTVeVu*Tu#n3Z!&MI4^|FBU|MhuPP|o0t$u3G0r%! z53(=6`4>=XX%=`H{#9aU5{P_{4=ay{D|6`hta5SZby1@uakBHpYmvP?K*Mk>1MCVb zlaY&C_Cm}0by-PxJVxjgO}7sidOBC04l0|Y)ULf;{m(KmLB0wH$5EVBk|e#KNGD&6Ax7+AJfNXAGkUk!DbpF1lvf6q)lLry*;j`TKZ9nsCRrtydb z$S<}S=0Lx`>ZE0Xoo|N=Q!26oe*v~%nmwn+!w|AS5D*1*GyU13x$T#5{`3&vih0OJ zf6VEQr`IicRPczK zyW4wR17mvz`1l4rZWS*Z%_`I~^9y02`Cq16X0OkLNNwi1@YY^z&P2z-QzqKIKut{U}h1N_C`et|I&66aBJe0B^M z?vX*#oE8z6$IPU1$?elCLp6F>AXXrl#_?=WeMV37I6ZEP> z_@PJ_!#Ck%Hg6BkBSFToUhUJM?Ec{>-ULx?b{)M{=M>GX5 zr^cIgBpxX3McKcLh(7D*&e9SQrY`P7ismuAm4~X8$Aa8ux5E*$rE2BCKva4OgTBCp z);+<;rdlin(BY>;lR85kAVTdRGVXs2>~oo*yR7NWAg$9hJ)Qp*Twk*4G5Y{HKWKi% z-`Iqw*B_p~=q_vV>-n@ev_^FIif^Ez-UM^J&Ny=;KG8qohvU-8;^%UFu84}(H{?~p zrllckZGMp_N0X1z!&yxHWe1JGVfLB1$0#=9O`dXh3AkHUdYg)jv`qh`U4S(Im8qEM znk*1TeLb^9{TbbFZt{p5G$RyNt*~pP!^Rh@wm`9-hwMe>jW^y5`wF1samQ+22;8N# zPKBU3gF)IVm~j1ahoSI<=k=!A@~ke>PtXpnz4BGZ%#g9e*Vxg!4MGbJ`SY400#mfS z+jLt^L`qleG&Q6RJ^>Y$b{{|n=I&z+Vioy!S1~D1vXi9<+z5%&$`YQ6o=l_2 z5Cq2Q?AI8l(aN&X7`bG?jlrevMqsD3&;bfOKs7~wB6tL%!`@VYUI0R5_c!jwomkMK z<*Q*e8@GI+A!^>+u^}9su{b5AB{rTJ+^^N|zLe55h?L~KglMIT&Jfv+0LR3#+VG-# zjXLFS4nkYCg_;_mPSf2m)6#Bbzgku`8ptNs8(D?nFqE{RD~181zTcST&}_Z>85O%P zWEFIgzMEw88K_iE&pCZ(FaLlZq6byoNaH2k`c-z8e8(KM~r(*Wd)xAQ=!|T z^Fl8==;hQR#tUu~kQkoVeI(_&W|PsQdOysuvk~MYdv}4gLH`jrcnw z9|l>i;zDsEmX)GL8#cO-yy7WS%T82dn;3+=q;;O-L}U~kWW4s2inD^azrKww`1Dw~ z%66I_BH3S!sgsl#ce2pw8Zh;{AW|dX$J)i0J8L+>`Xcny8yJWj(Ap7fe~-`8QDs^S z#6YQ-c)=Afgb`2bsC7pYu8Tf>x9nSWx_A%jTlPL(`gpw_JLVT5LwCA1pnFD`8OUS% z!4u?{y)1IN-het^EZYoxP#+E_g=4r|O*nl5R<_>-XJOJYYXL_xt`FpRU>c2;8x!4y z5Wvku2Zm%W(ll712^BQKp&wyc;l>L5+?j)he=lI73!POzEXguO2EK6O&;nb4;CG_P zD?@K%()x?y^@v+=X`|dY$3_91E8c3Rpgr30R20(sdk9~D9^>8ke!F$WO$-0Qm_iXs zAuCQ;%V9|XMJD%e?guz(q%XbkVJWS**|s)fz+`8#?KZ$9)f0yjd9ub*IU+if+?eP# zFh>^!{gv`%2mTzo0=q@jV)u~UUL|)`IAlv7V`fIb zND~cF&P)z?)U83PS%sHasD)LscM^@FL(l4k@@PPnT;7l-Pv9k-J=SjDma?KTH1=j) zOWYghnO99{vC<$A)TFE?PR4HWYT6>9GV7;#dHc1-U`HXDV}cF~Y#xeXQ2;z67GY0d|9EWjG@*c6 z5ev9+rx*y$r5!|RW3ml6vqgf0q-q;$QiifT1(n{^RY`!d1=JbFZ>V0(huimNg>5<` z`*^}FpKL;6(X%Rzfsa73=!DbJ>6$Q&(o+;R?LDtRY1nU&P?+~6kS8r!@`uW`7|zpJ z4%X<(rsww&8|RT3I5V|icvhzmg=W-HeIjwz+Z)b$6xiUa{sQTWh5lPdoC#ams7p~k zGms;vyVaA`+MWv|53*(cklAAE_HgI?voN@j=>848lmLI>=?Fn02d^Eu1@*h0xL7ga zsJL737LS8MO5@S}!qsO1#Ow0-_D#)x+A><#ds$?v%g_b(LbnBZgU`=(9#`d5$`lZS zLoTc7Ownbd>qEhLalgyH77a^RbmTqixql(*As#*(+;nqEB^-WF$J8MqRD+NR_%=AD&jZ(ls$o~u- z8zW0wRZ|;#>wo6Xe@&b#p9{wg&gSbMUznuh%qtnG`a>C8)RN{6De`Lhb^bc9cZmv` z07=RIG>}Cwix%>Yj^~;$ppxgGvh^AJY>R9|f&Q`(Sm*>Iv9T6T8wE85Q4pfqe{@>~ z+wC2uc;OdeC|un71kyyVJUtj$MfX+6GXxhqmc+O=!8A!3j?<@SqVhd5Xf zmcp^$g!1)EL83HBlsV&0^ZSA^Z_D59Cq_+d=^l-rI`@<+7Db9nWZoG#+C6I9LHyXx zgO|MO2B}?{Fmn$}Ap%f0%8z{qBy#l#ElkIigKVKSnpR);M(&(e{}LR1RQLq)v`|8f zy$49}8&b-*`a(hNOXMW-i|}C9**RTT_&je^#cQ{e0%OWbzi#wBL?H_dwqcb87zYOf zL=y_IF+ld**W>T;q(}hopWEK~PTYG^Xs*78^$&b!odXV7w{gKa9Z+AgNT$Llc)}Hu z@=)*IV+T%51Hfmi^1kA!s5r7n=#&7aE+S%_A@A}(JpzK3;JMVFdSyQvk7A{2wl&at zk!ZRJ@;zXg;F{GnJ^+&;NIc7K(f<0-ER+Cld;k<9$SpM7q$?UUN<7ea)ABTysn1lm z!N%&VOJD9*oqB9pLdV~zC-V=w!CO_QcQ1Z%NH_^6DbN6V3IO>jD7-QKt7N`PKfn|a z2#qdE-f+$Y$0cy%mb-;c9!;jyXqd-p;>km6$hlD=oU;J#6JYWu4B26sCEXaO>|1>- zM!_=PVE+B$_xav>s9r&pLW*0ih~g?T^}K34>E zN>-fYluMDi3tda>8g5BJig+=qPuSYLTbMQyVaRsNu>*BWO#f3;Qb4wcG1o%Xb4_VwR7S{(9Haf7PU3)huRm`m5X2t2>9 zg6DQn^4r|D&R!_&MzX5CV9+QAS43@3%NYn&+EYe(k#$G z^c${X&s2V-7R4ISXWYu*RxMSQ>(;=~bXi?;kv}3-{9$B6Yr_mchHwEX@O(u8b_~%? zuT(Vny`%;AS^9#g5$VmoYB>48sKJtHEi3-(M= zF>0!0d-EQ?4cKA94MZ&r7yU4HJqeImU9hO&^2dK(;$%@#jSAHU{peA9hOz8G1G6B zwAIZp&WMsy0?K z^Af5cIeT##chcIxb7|+69ql?GPiTke27;ugAU;Le;bt(O+Xuy)B*!takI>Z*L6@J* zVG+5S;xeVYw)s}z--0#8EEc33SMvn&l@Fl{QujAIr`e3DCzm*4D1}(9{D`Z3BZ_-; z#?{VCqF_HuOO~FpZBiOXb}AA-srfq7^R&0L%Ak`rfuyR0WFPXv)!wh`zP=*w?@!>732 z)pVVc3}q3-{l#>4ewftI$`q-NbegU1VUShPdv0f|%DthZLGSK(EwP+?!)vC3nk%TZ za;f9JiO*t>az8aJBF@{&!l~%oz1V(3AY_9^Ht(A#B32*sc(&W#+`fY|h!hVxt$#;Q zWnt;nc|3h9X#3&Lu=jf^ZB#!I7ALL;1>+v;>W2ph4#LnS^oJ&y*)xGI#fHJsvZ*GN z5*KJ)A_3P$jw64^lF!m>;0*#jYG4>}a-rp;M^q@Rj3HTK^rU;MnZLLBMSu}d+-kHd zbV2k-+4HCkJ&brsr$Y@iCV5iX`uAV=ymC;6aOfWIsw$t9@meTd(A@WI75HxH5>ctA zo#@HYx(t1Bt@swEoZ`tnt!XRyna9DG^&sa4=2(cT$%KBEp^y~xR3VwWmbeE=jm$Yp z6pnBB)CxVWQjB<`U0!#H(SE zd9c){apJ1e$fgM$Q=tGNtNC~$*;}kV!FgEf6FukN<8WOha%5RPkv}pf%#jg5C9uIt zxk~z_(M9`u!6R6kut@6P(2v4C0W(UaX@p-70^hJwY)E)wv)CvDkX)!xumBXM0^p+v zLHqSTv*0ln;bhPq;KuS$2mvCx!q>E`*^d3i>CQmcAFxJ(QYiThR4n>F$tYkrZwX7C zfjbs{27F;pPy!yAzdv@mk{j)%idFCydJ_Bm0}vdB$zryF1fYskE(`oAWUK8OBLh_UX7ja=)LcS#8n~vWA>_ z$)%UZ+4Od`6gmP-`-LZ{oJc0J#GtcGY**WB95aA9@HUtp{Wj5T{ZtsEGOj>!!w{%+ zW^B@J7IUl*RhK?vteVtF!#%mW6%7>8NybN4C}N5MX}g-`FXskB4TiE)Bu@ID3Ecq$ z-t6*U>HZSBh-RgWXCx&PNmx6Sv6#&bL+1+Zro(-6mqc&}pYmrbyh(0*{Ox)+2g}Qb zXRT>5J|=bh>htT4?V82)Mb6Y{-U=b~l)vx{-=IgBvTGFXxZVKaIyKSnUD3@rA>VfE zvtG1^RK({y7KCzlHy(Mw1^yZX9_$q!*!yr$x$I9Um*^H=HQJe(ci8LOB9O}ayP5S4 z4ym7if58$-o^Np$8|haTaz`eUv;CEq8uMt@9Ep&6^?~~W6O+h__n_^`(Ww$oI72Kf zEV3wn&?LZ(w&(z~z0xjd5rk+6xo>5uj{Du8x_oCUR?qj;fF1`Pm_F^H3`VNsB8lKEq9wW|JB3OC3mz#!Dz>#Lm#%C=K1jX5y{Z(zz9LJ3h65hw zsE*dZF7Q>DnE!bj5%|W%XDNay1bO!RzBBki#E%t!w$#64CLAKM_y9kpJvRI`^HevP zEA~xAAlN`LEzzl>`M1UuJfcFZ{Tj>@7nx*^CyrxiZfso8i$0ow1P{K zn=`Max{-#)tDx{-*+{kB7cXDSLq^`Vnuq)=Cwav-$1$xpo}-4m(Wbj(x=-w`yaS_g z>Nn8*ijt;@CbXI)tJet}_OaCCI`ZTi5POC0$4vjCT5m&iGgoeGx}+&Gg-ELJFLRtg zZx1GmtEcal{?%`y6P-oXMamR`h_*xE*iGr@HT-N&C!aNo+Ic7R>W0k)_U`qgY>xNz zYySJ6rnem-cN`Pm)9GoI8+Vi+XIBe42Gs09Z?t`ny;Gyep5cdsxtZWh+y~6;hdDCh zlcU7(t4a$KGhURD0%T|Wlnc-0vM--S*u1vQ0*do^{4<%y#jiIj!l#@LeAkU_iCvz0 z6wf0~yqX~Wt|Es}?yCYzPMT*2i8>S1U-+gEg*V#{{@!QuFiU zRu{$$vBg5|TKZW03uEf$P-H?|xw<$2`*u#5K;iuZUSl=HHhB6af|~PsgR|(@y^_0$ zT^|A?;*}xVe6Cbi3VVIF3|I%<;Wm~Vx^)*nFLL`(lOqzHBN3fF-V83Z)Cy0L`Yt(5 zL~WTYaNW+Rf%>wlwG|nvlMi;+-i5#cn4(^rn-<>3(GpEcH9D@_cB$Xpi%+K?IWeDl zcV-2%T+}#jeTVI>zJ%ooW@zIw(yA%hsCY8s#(sI>^-e2l{1ZNN$$&I>adn2MOoJZZ zlRWX?#U?PmrN?MGh5ZfPc!u{CC64EjR~66w?oov8W3R-yO)hRncP*%5s__+j z(;^YJk{&wra$|v`Ia%5+4>%yiIeJIW{h5pD$q?CBzIpP0>)#c~wd9kP_mHQyKe@%u z`yyIuhyM^%gxww;0rZri3KHI%VvK!ji$#4%&fH|gA@qe2%Zfm@1@3TENG91) z6jlgf(6FTTvaDkwikYH?(XzK3AhaPUbK+?sZBUVq-UfMK4@{8XUNa-Q)}|`(JstbT zmo;oLch(@lCrRNfntJNsG+OK!D-02aA169X<b{cbZKl(s zW6YxAGvIg@+{Tm_;ZMe8+aPFKOW-)#;|6-&o((+GxbT1MHI*cGDMjoI<$ z1!f8(!otr$JgXh61rJU|#;+CRrN1bllZ7C+OYl`BgCuvfT6Z zE>vO7#|9zzKpR7HfiDpgvCn<_+O*H=EHtXAE?Bp@xQO+dPswatXR@aKX@r5e(lAXd zr70QSDKwNMNl2-rJw5pS)ak>qSzE+X@hNz`Vg#3p50Ge=bCy3QNk!465S+P#eLqS% z&3q|%uIY6roQY9PimPS!y(X2zw4ao%Ev%MDWX=h zvuXO&=0?l)mxzlI3u=KWHp+BCFvOWN5C~^y9LJMGC7uH_Kq}n98w_YC2A05qf$73>xOSaA_0}8tj4+@;A_|mW+|Tu|Xad2k)kE z8n1Z=Uoex?UqO~mk+$OO{A7CAi$#%Kei4K#`IoB?((cmnaqNh>oxZg#N%AsjP(6xJ zFp4!>Vrv_8;53m1eOeqOZ5Pll1Th}N)7{5Y&_h>LfcQmDL-V4BfZb`N5Ku87uP#*3 zPh~qEkLgrPbPAtztz|FO>PrG%Hyed4Jg&}nb6n}EsT&Hc;3bKyr+^B9JPG*}9s%%+ zAVB_Xt_12=RH&$aAVu2#8wx*cMMDj#Ei)$1##lq}7GJf|zyJya$Ld883v3sk0IgDpamRXxO=qhK58HnV)`B z;$8o!Pv+0# z``RA#`qtK(zr6SM<-MZw+vIz?X>s+8;!F5hxp^3cjzAZ`kk^+U!z}+`9~V$`au~)q zR>TFSIX>x8H2RmVK>(h5Z?aU`VH?TkUPg;6=)UhtIJMbV8spM^c#r~Lt|rmk;x8Qi zMcquMa-&B2cgZAxSWZvjd9RZDla|ZrLuz80yaVq~z+?^og;<3)&4m4EMjOrGh%8#kaHnHSY?K}*2Q+ac22#j1cU-IzeG()(gVfLqJ zx5aD&8n0#9ksB8|ic5@=pm@%uIKG>?(=U!yECbgjR1=c$E)zkUTIui8A6HsL&6c4} zQy}Au+o_GJdCc!4gGR74%QZ#MpCY%A?#CJor5fcnDqz_#Z+1vIS@5Yv4xOS{brD9F zCh8InRCprexD*7lhJZJ4V#Q5$ThpKg3=KsC{Jm33&@j7g*UBIp&1Fd5&eG>VUyU)2 za`wl-Q~0_xI4;&0viBi^uy$}6tKu`Y7p2*Y;ER+)r^*Zf+q?I1`e=WAc5{o;WaUD193XC#Ra8ioa`D`6|hE z$c^P3b{rg4)VWecYf6sso-!Bf6sD3?PE zg$&XvHcPQ75G_4K39Yrl*N|BN>~HWDn-0TYF1TM$rM~kYi;tbPcIRz|iu7ZsT+YZPS zIg2sNxF~yCsC5Qm)5>RZ1af{b;8*De(y1YGcT{$QW(cB@4lM1SH1D9&cnaijhs3Gu zvEjzjD0ZEh_H>u82&P)jwfQU}=seS}xLVl!+@fvRdxk)o?!mMjR;tz57U+Bj z8*VTnz0a0xJDPN^>o=}kIHvH)V&aphFA}=D!FU(oV`|> z`f(laU=Y8|8a7AEx2iF>KaQVPCgf&N;?bisIpt7e_t5{=x=+6KjbetpV3pMEl?quQ3vrL`C#Ge^XU_VX7Qx^r1(v97D7WrXV zVvSG}T}2joc6`znQuY5<_J}@rgZl@h9D}kc9xfRft|=b&&HkrdGK3r%hJT}PN))gu z59p^xhMM|pO1)jsN3*PD>^BtpB{UYb+?}OW5sT*@g{8@*ynD=5%}zxDXH{gmxF)9#ST;Go}45An@zn5BE3&klQ~bE)%CdcnyD@r8`zkA%Xr zgo3L=a~JNtp+N#RA>Y!?sEW^B%E=NYjkzPTYwT3k<0?+}l`s;V~=l=uVU)#~@(xOy*^R35iAD=+({j;bAQD~uO?r4J66 zJ_EMAF1IBs>~^JX%uEw)Z)4eJ_FxS}nG5ir->&s=499{O$F3(4VG|ckgN%^K5k(!c zyv>!z7uSg&oGwhXaGj1zb}ONgnlojD0@+*M>U(50b+fi=AV$YBEEyBUaWfSaDhtM> zy^vA$umokNUAk;0rj1h4fLF&d+@rZDP&ulYd@kvDyFz5%~(FNC2R2B>-tj)wfGDxyILa#<1$_Ej;K z@^ff;zyDe#5=n1V*{Ra*6qba=IKyJUdK($zLSt}dFL2JZF#b<6(LYT~MXYL0-wAUV6Y3_^*(T!B5PHGoJQfT1-#5;6hm@DRt&9S&u%o@v9@d zmX{sGEWP8kSlo#o@6^?r{Y5h2~0-Xd=-|^kA;VUQ*!L_4%!AF@}n1z_N!pjZ&L=zlGU;EE_-)n(KK7E_=B=*5FHQTD zl90h26t&-6yD-x#M-4sLOS6qykC_Cw^9pmp_@jyd??jJ zxR*Aeb1sZSl{*{==>9!x4eOXan_Iq66>BeVoCX8TrTR(UK-yXiA^|BR7;M4zPK}3h z_z9XlMYJ&K7`*HIdaUz!n|A0p-TiXwg-e+J^FkEEERV|WOcgIVtOIT+g z)ec~%0DMb|qKuinP*|Bau811rsQJ=t1@Fa1TM{&}6Q)?aD9c6hh5ld5njy;_|Uw4$`dRC_K6 z-1d-DOYAKCQiUT@NpKmgs*qNjR5>rm??sTXvvePztZm$zK7d6TVXf?>P)nV%$IBvT z?=k2RH0Uk_w71W1^Zje!4lkjn)pUE0nSGy+3otJP4YAi{&w$DEgy3_># zVn#%VjJ)3xV2&y(fMtSxPvw7>)G)KkUgeVAm-|Eff7;RrsRezvfPafykAsl0R>iNC z2kTqKMrT?nYZBLe;%ye|$~mo+q?FIAw9;nO-$9a4=!UsfWV$4;Fq~a`3kcALH&}(# z>i;TbJ|oeS)?npR>R&yRRJ%*N#Wo5<#su&(qbgQub{M#Wc35t)$>x$|)2_V1wO2~| zTyr==z(oA}NCsv+5NyHcBYRC1S zugh)w-+Ec_i;xqCz^u#+AM^V>Vz-Os@HXKm2Cmjvq z6XWaxgo|%)lXf}NUUh?|VI6B0yw=Z>lO+}M=_f#P(D3=6ZnitZGL0n57uR){jRvhD z{}jZVS{|W1#Oz9XRx$1FG9Rzg3?8|j>SaMni2~}wemBOtdhX>w!V%ohLD4G&L@5~e zlhzKtcr6I59KS!4!_`*VZRXqkaUmCSJC=8p@IZ(%MZHHzw?@9zcvOCk_)n-6n2oY7 zR#-3hG^e0f!v{9OvUJ&@pGxaQAfAinmssTT*P;Qyd~2pMubOxs8&?Mk(0Sv<<%pWnT~;jrXhRSQebEzkJCY*t1S+AxsctX8;@>s^xp zvoXZ?5K4KSv5c-I-+DwKxsGfRM5jArfMmsv7NkUhx=d`0K%bcoQ+9?-rr{%`IcNI{ zMdV$xcF;yFn;Lb{E^K;n)TRdBSqryti(Hq@SV=cPs)raURC6vSV`QRo!NU`A08Z1f zq@=#3aZYn5*Io#GiA%JXMa9vXD^DneRbs0-cN2c&7@qfyE>HBl(CnSqow+|+GjztC z*HDG}@(2qcdZCpY(e@%#lyGL=BBto05@sW;J%_Lo0k^7fzRpDb_=G^Y$YDFk8^9Qz znL`0UHYCMSn4=8fxme^+KDHgGRgZqMj$zCwV9GAzFYBG2bYtsxaxqzz)MFe&NLdayQw^cn<{Ny{zxn1+ord?*dbG)r-Nefgc0vpKR>=5e5|IMm7CgQeOT=D-jp zL%-xoM}Ic`jZ%A9E&;u8PD=X*C9@oUu8Wq=p>`)bg7Kx86|;s>#tB;z7wBOy`fW|U z@sQF&-ubAZleYIJZZwu0B7~e$83)ec^7=@cXoefeld)U@wY+^{)40O@`>JWo?)Nz% z0}9A%-t$4Tgn6kiHdSH1gVMcGOh>Jea&Ukk@j6&jN%-s6RwSB(vApk!uYTb>TxkD6{~ip`*7;PmJ`J2k8yp`~sjI5w=^)G#m*K-O z7g%CxGAxeYxq~4`Wwg^;5rhh+y2YX%Nd^qQzYET@z>ZC(G^ho$^Mc7pl=5y+xwCU& z?GGT6SmicYhU2V8a98B9`z2)!&*_^E^}|F@2&4W|)tqr7akO^p z5vN>K;LR7k-m9nLXW|@r%0RL4uYsH|4x?%P@rW)+$Sf$Ql|asg2j6VSWmt?EML^f< zoZNM*Pem}xEyOQSCm^T9Z-NL7%g9eak+3)*OHj;A@4lZcUAz^mf@NaX|Dv;2Ju8nN zhNCax;sSWAo*nn1oj#ZrkIz1Nb1nzn^f-D8&s({3QwZ9{OA@T_$kEeZeED-65#k(Z z5F7#G3@)sGn(of<=!DD!UFWskLcE^lzyw_n;SxJ|1U|etT|pmh)H+a7{(k9QV}N|)9xoviAg&vB}4h27wB>#9J{uVWJj~+pFlnruxwBFG@7Y9m0uYHxp~4aq&Q^CKF9Nwjk2B{WO_)7ze zOkBrmYszWu$VPeWcdC<#CLU7AMp=e1$;WgK&$6y+0Xx7Vd+h7mdSl}856~~z;EpXi z+>4D!Z(YP+e*kI(TM1!Kp(U)N5Laof&SC#M_H@zm)5OBZH0FT?J7fvO&u_V{vIKAL!j+EuXKf0#|L!}*2WF? z*pW1)JT+pU4-{|l*oc^1C1wdE9-;lq`GUA8dz3L4yK4#7pT47vRxeh+5)_5iHdt1_ zlkVBib_WB@sT#`<+u2VubJc%W+~1$@;}eb;iJf~~(Fa_ZpbWu>j9eT<*ufg&Z4rn& z4g6&esQnvypgT80q0bD^JAs7s_QXTLu?Wd`Es}5iiL6-I(swS>_cdtXEgb`BI5R+) z@Q*^@m6n(24oSk!PLtwyQoTx+^B03Vgk5FBTT*?jC^^#y4f-xbYiu)N);R9TiDvNk zdJ=q@Nay%U+{?rWPAl3!oP@HZ1Hlk)#2EOZ;0IK5b-sx6-wCkstYP5#BfQtfo4!Xs zKx!yy)JK<7-Hh)#mY~)fL%#fa0sJHLjHblP<=`h0!n-!o_ z8Iu#(fZs0L{y+h~c4ZIRYyb&&n&2)`N|Geps!?$MwbvZFcNizUIZ9DS z!9XZ*R9v}52!z-M?(o5SLf}CgeLq~`(!tC{s}Jx zd50N62{W&kf@EmH6Sb_{Z(&1;kx}N<+@H^oLy0d0NZH=Q=9EVk4Qs$r_KBSL_226X z107Nn^Ncy8d;qkzw`>VoEkuGI0QUKFMBg_*)_P#3tW z5s_!wJ0>XkRG28~ow&^N<>K^Nk|}6hLp}`QiOTO~fg&Bpx1iXW(4a@?MynD-{zX`I z8EWeeMX0%JEqNtDS{`NHqa z(k9?ABC-(H5-jrRtPu^s(^o)UB%+$KLC}mP-3%BVwpwdoQCAv$I2auo z8e%Pgu#i7-_L?lb(QRg2Sv%b{CjGH217^`7jDmc zyv+UnQOaA0e6LSPZkixk-r>0+)4tLmgAsa0oUG(x!QUWV;761KDOvH4Ahaxe6)vezm?%CVP4%A^Czugl@q9XL)Oxld;RN>yWmRj_ z$JKX9)mS5}d>(knDve`k&q7|`|<<(+3i)$)bGVxKwp(~k=MX09n4TlA~a?M(M8%Vt_v)rLm z8E$-1WJm-lWAC*kW^!Zz`;}^B2Dj8hc5K@Rkgwa&ko&A~Dr-{Wm(a!8_T`HZtQ?fJ z`Pq#|bW+p#hitj6c}?{mpV-ostiFoecNgC){b|UHEq3N8bZq38(e@V%Evt%b!Mxkz z!ni{CFZP2v-EZ9D{T>9=b$Iue8xKG+8C5_`i@ZH8cEke%>G-ssj){=?hZjx)wqY18 z~btOz{r%rOkr^9C!k4aRwRc9`<5B;nIq;5uv> zpH}a-`2;6YjZ9kdyjF$WU8y^)%^Tk!YGqJ#Q{DaXqbLImf(H7(=hFT|ng5px1OCJQ tm(1G#Ddd0R)c>ytAfUp4vwvy2{~u~yQ3f31KT|;dmEeC|n&&^g{{#1^v;hDB From f4a5ba847513301ac56962777b4c1312f8449f40 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 6 Oct 2026 09:22:16 +0200 Subject: [PATCH 43/71] Add MITRE ATT&CK relevantTechniques mappings (T1595, T1590, T1190, T1133) --- .../HoneyForge/Package/mainTemplate.json | 50 +++++++++++-------- 1 file changed, 28 insertions(+), 22 deletions(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index d26c9f2f694..4f2754a23a9 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -122,7 +122,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -197,7 +197,7 @@ "id": "[variables('_uiConfigId1')]", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -209,15 +209,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -279,7 +279,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -296,11 +296,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -316,7 +316,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ] } @@ -403,7 +403,7 @@ "connectorUiConfig": { "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "graphQueries": [ { "metricName": "Total events received", @@ -427,15 +427,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -483,7 +483,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -500,11 +500,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -520,7 +520,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ], "id": "[variables('_uiConfigId1')]" @@ -637,7 +637,13 @@ "enabled": true }, "createIncident": true - } + }, + "relevantTechniques": [ + "T1595", + "T1590", + "T1190", + "T1133" + ] } }, { @@ -1093,7 +1099,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "HoneyForge", "publisherDisplayName": "BUI", - "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", + "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1173,4 +1179,4 @@ } ], "outputs": {} -} +} \ No newline at end of file From 3daa46f36faf4ff7c2bee9d2f192ef7b2e3cb411 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 6 Oct 2026 09:23:21 +0200 Subject: [PATCH 44/71] Repackage solution with updated mainTemplate (MITRE relevantTechniques) --- Solutions/HoneyForge/Package/Package.zip | Bin 15333 -> 97856 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip index bf241fbbe54e2cc430def48129ea0c4966b617b3..0b0f6d2221394100f4212390a0b1e62e1e40af59 100644 GIT binary patch literal 97856 zcmeHwOOqT&awbR8?qO~+li6O=YP9NZSXcF%c!;3XM3aLS0iuO&lD3A10a;a9)j6oD zELLWrS>!;b!`dGAAk$%QYc_{H?_qzz=nqJLK!^P!yPtc6$0IYcy849|8)E~aG9%;R z;qKw_g}cYW*MItFfANX@`M3P;zyIss{pu6?|DWUGFiuBD$#6V~i=_3tJRAM|>nLjc zW!^bShH>Lw)Ho@Maei-YO+9H1<5ApChRLXC#Xn6aNvo3$^}Bp+bA97(bA7wHzOmL# z#)E7|<-FQ|(^#eYJK3nftM8IYo@OIzW}~%E|5LArNfCGBg4(C<;DdNtoMaO!_{F#T zQ8UV?<8d}A{F7~1>K7+?xj{8@r@Kino(_ud z;=z=^dNxV&Y&z*Aznx^$@$yPbnt1NiR35snDep|uvF=Xeo2-bYdD2~t+S4K$B}q5w zMnx8l<2;Yz$*@@zuQ2Gmh+aO@qi7zUWYa;niBFqfB+ZBMq}$2x*~?ZGeV;_>C@+$@ zOSMMDNfNz0%_gt%aokCo(#e<6=}Fo-iPAjkCX@6vn(R%oAs2tN8<`J?s`Td#|Ci|t z3YpiYzD4L-rra=39d?r5sE|&Oa_j}gQP>W zUs|<{vb-ekmsVDupD}26to386<*r3|;(M8}XarVfPJfj3quo(Fm=$R!$LuAOBzl~7 zCRv{Kis%qxl8%xAO=zAJ({cS6+FAB$qe=C;1F7q7d4P_<8PNy}OhxXAj~d;?XMPzT z@hPzt^{&)+BiOIwNgB5Yi6ht0Yv};vXw>SE7pBNF^ZoJ?KU~68t3fng2oHUu=+dZ+ z(-v_Q-4@i`mee6t?02a{q|8o8J3&qLlV));N#df}gMOU8wmzq$LL=RY z4Qfj2l6Mc3Lf-EN-|ELkf9-ddmkcAd_D6ZzKPmDxsVrYwjU2+sW7`Hxj3%SJm1W{^ zoOFny+z}CASM2Bm)=Wz)t4nLP8;40}I!TL}>CV!s7XR9>o2TvO(&}`S{xF5IB$dAG z^!tT$&FeS`yKq3Y0MXW+kZOt2#PCR->UBX+sOTgj^HAiq^<o@Utb^(x+R|wof8igIBHy7RpRU8DqW3v} zO1&nbRTa2pL*!DeIHjbJ@H4o{nUraY>FT9@J*t3EmP)wO<-Bs{iA)hxI)WHx6a0f{ zS6}^{(r!~V#p;@sNlJc1>tr-po>_MJ#mYm7Ux;+far5|PHFAWzB2`|$OOpP=dub`< z%DZ1ihUHAJR|nqLQRJN{jBaP1!tlE84c}oJGaix?V{cyDz`kU$DXQbUH|$w0{Sgqm@8y17Hleucd-A@lfoATTW9?^IE&T z)!x|Jy4&n*^y23B?X9?Z=hIKOnp?djzI~^&ncPk`^(>Uy6J`y|TSZcK2g#(MVF;&^ zv@9*syk+@P52U8Ix=6;8GS4qK2+Q;}Gjgc~D4txHpN&yWv!iNRY)FcsmsnDXZMEGm zo1Bv=nbiHipC*%8fOp;3^LW=S=kxCEc5mzU*2bOYc6TRfe%iYoH`m)6o#tkDE7|Vt z#GkfrcP#I^^}G|#Ir*W&Ig5;7ANy#VE_wUAN&HqU-`ASctM)XHb^jFGg7|xf5^fbapm(6uaJO z-&O3|6n?$ay_+mXS+4FKPNA5y3Ormr`Nn2 zuPeqCzFmy6T-`gM>>?vrh_X9pP?p{=Mp-U-`|eKr)1Xxi22~c3-qCe=c=}5WjE;}4W{>c z4WI$4HCn;EVz}iP%`=84ja?~V)}s5Tweci-odO8W*EFeQh0QHv#N$-=gvhtKzPY8) z@#c7vyiSu-TT)|dLF_;(Hb$Rk9tsM{6BL914C3m22Ou;Vb@L~LZ!20b*!Jw5Z!m@P z;?66aG?aIk?);1S6-Cbtu!v~^PEw=};uiuDEi4cT8WEkQ#fd#Cc&*MRA{VdYn%ol; z&`vmr-(B;$3AI6g0_P_#v`_^|1hUefTQ;EqXzNwKGduC>tE%{@Zz7Kf^voQTSaC9# zmGsWaiPX}VCj}1-?&7ks`SgNfV7`Bqju?Z@PvS{pEj{zTBFY=h^*cD|G9qkB20?7| zwghGiZY}S>}DL4WJi^(*>v)6Q-ho2Z^cd8KC$3%@!*SGI**WREI)p3{< zv>T*%D60;U=q!TI1BHHG67tnAL|+1EYDys z9^^EIfcqyi^!m8*AR7*|kw7;%FgrdT{azoH?O~1XB;R3`#HsQ9e~6BckLmQ8{!=NX z?IbB?mlso-*VS$${oLP+?&HW-pE{_f)H{WwZ>~6Pr1=OkI2;$VW&6D<0PzQtbqc3q z{xHYsc+{RbkE1y6D2i(aK5py|28Lcfx5nLWs?Hjo>a&R_eEQ66t7YIGe@?uRpJbaZJBWh#>pxCenuZ5AE%8D193E z#Y#Uq#u>dn`D~Gepifd#_v}g`6Mr9_;A~eGfk<1ddE|^gdY$HJJ00NM3_bvG zA+Vf_qw-F|laAxz5%?*JaSZtyC0jUEo<+%P9D_tO^`nT7mM00!S`;ndgAk$HbY4QI z?s37q8^wM2n!qO^Wbqyt#~gA|Bz(rsbRTza0sl_8nXLvWR*DNRjttQ<0%-)eO6Vs_{Ov^6v%gbJ+LsQ*7Q|g?e8h=tCV_`1dqtJ zpx!$=-l33b$|H*Y$oa&3Z9cN}G0nK`*w^L@>2_{EaKA9GWxy+}?Q)vk#yzrwinP$m z@Cn3*wytX3cqi%^{ejk+lFiCmoE0MUL86p2{mWm>xc9u$jPy#=0lqLCJ&udciCRi5 z_cDoibnwC$lJ0^cxwk>KgnD2XLMWGUJb;y_)(QBiWzadKiAXDckxf_$sr8VF$X#T! zSzAfe*Cs1c>ATRGxg}BpW!IjX&bo#dSE=00%5^Gsij=@b`v=aV#ua<)rs+_vT1ls# zf9bAfy69+<_WSTNg1w9pTQzE#vaa3^o08acmufc583}imsx}3r=I1;GW^v6l$2K*K z+$;*Lz?D1LH7yF7aiL`NDnO=aI~^^1OXg~{aia97SgYP^W3XyPL{^;Vt}SNFAf?TTPR7Jgj~-z+%2p5dwQ#(B5l<%ZYBu75++k@9 zs*|H^jQ7!QQ2=)aYExb%Nw)N6^_}Y$0+Dzm{Ylz&v(Jxt<3flVLVk{^dkSCha)a<%ye>(MLL|Jv{@>+hWBxe45jiF>2L%NiVe zP=Z)tU&VQ{tfhf8P>})VT*kq}VWP^cM4#V}?kahGfREBnJfK~g@O}M9x79}vu{vuX zkwpg04}D`kl4sW^#g(0>*B5PP$nG;J>D~vI5qBBv`z!9=c@>N*p06AJ_pE7aEiTUg z1{0ul(qaF3SPvDvUbIIR?}ylqe0%hO`bLc+Bzuzex`0Rs$23QYW-G84&z|(YPm))v zI0|OHQ~WFyXGyt^J(%`c*w3+Fpsv%dWZ8BKhllH3Iy3Yheaeqyq@P8%sf7H5ZL@LL zRY7jum@c^3IHOq{#bV8&P9BM{rOlz*0q7G&yEio3J45iV(uqZ%usJLv)}|nBN6w2< zRkn^HTgHM_%GW9gR$)4tYCd-Lk$kkw0M@#Ot#WmO_pyLhYIa$fyE~i(@G4`UlueGT z*E=DOCS!zPFL;+6=`0cZ$_Wj78jg<#r6pkm_dxr2vK1o9G5T;Fowhj_hVgh@+Z~Sw zu-?fBqAA{w&F^*WYrfVVWbL&f_$Zm^1R5rQniFxLXUC(8dm$Y5uupKZW`s&8D6JYE zPOc!Ofa4mcKy*9lXOkJZ0}3H3zKS~011mF?NJIUT{&wAB={H+xRGXnsFreA=Fn1iR zjYp+;`BH`Sr&00BgsT}G1~)1W)~Ya$Iw=r(fVo_T zGiF-2;nOrC@}A^KRs^hTpY+O5U;~64mrch@j-xI2ceyf*6XOE^hFQRL$9D@>O^L%% z_0wQHe6R{}rWNXhc+}zI^Y||7PAU$^M3(uC-Z!Lu2_p!!@34ZE?{K*~X)@6U`(2VE zPa3Ej6<=PoY4X?v`z_4*#kc$6t^^ZPsB{$zcR{DUsH5HDeW=TyL1VXnupLh(Byn)w zE8r^?9vINbS5!z8>WN8%(L(l%lK^o`hMZUA@ z)@4*P`})1FNabS!Lup*WFX?6Yvw-lqfe)_GiM$?i#wMq;6u6-BDJiN*!9d-jqqL8V z7j#b_%cnxEfLveL4_)fUmQ5w2sE|u~2bV%WYek86DLe3clwS1Hb0{OtOLPcpC?cF7#F$r=yh3Wf2_;%yG6GEM+v@M+e2U`=u zILF*1Y?2h(1*~4LXI34U&RkW*6T=Q^Ctz~aNr34Bbe7U9-|D10H1TG+m0}=VKs5(b z?buJ~Ukb@5@;NeAc6P7K5`Q_Kwg+hrw{-ft)|_%|=*RKoRTr-8RQ?Ew#h%$FpD))~ zB`d%gGy&kOj#x$bK3AOP6Xg?48%$1>XX~x_?MDa5!blrj<%(~3#-wU%`R@6Y$u5uJ zW!61~wGT82`_wT~1FF+F_{>wlLmthr&qb2Jf)+z`0p9hLClLPkgINS3VNK<1ae6F{ z$9}FH{T)AirP5*v2uO2eAS4I=UOK`_RW@36o%FRse>>^KlvZ$n9DD#Iu(6Et8Co5} zqaR!FK^J|)`U_ePhtm;ln32|vLNQ|^ril+|9gmJj8s?$Vf=(EzdQfEv8HWWig5tIrlB7vhr6A}Zo66h3e)%_l=KMM$Rb#E^{Xkep0NjZBPixD|u zsW6c|njn~jaz+N5WswDcAk>OJw1X8!Q$ke#Z5yYmG-}2xDnp$U(!~K?jdB5Pi*f*j z)0^W)bss`qcXt~?3u8ve1Nv_xkCADWd#VDI&q-fLUlE-Uwc#oRt!cE_5gHL~ZZpPQ zT|J~%%0-(hyGE*6@_H~g9dyV2YOT7a1NCF&7is4e0x@CKGFc;sMF` zfP%H(+fJQ<(bMi0ZFtUjn6J^l(C(IkFY5fn`qH&Ai_- z*7zAmJhkisF?YJYr!rg|LEoZp2<%3lax$h*N$o^VL8LxUU}&m@4PmodlT>=Es}>`f za7{h{n%A?u11p|7vQTO1&cOmxp*u$dME#s@A~4l5zYQM$A_cq1UtUm`smj_KLwrqb z1zC$;TroGSsnjcoAE-C5&Sngk9T3j0>Wp5YQr_fB&TyV(pI@S9IMC-ET{r7Y=@J1x zx`l0ot!q3PMZ*m26}K~_+^4Oys)A~^00F+tTSJp*po6;+_?86qcN3{5Qlt=GquUl} zpTCB^cr(H={w`g45q>Ts!n>{L*(1Y5mS32$7GN0WlicT`reYr5T+L#2G4U;v11QI>TWaaALsNDi z@7}s)uT@~ewAH;5iWtCS7>F{9gF&^dG=WNRlpyM<8yIX^g6EO~a??pH^^kx-9+qgB zjG9ySAfO|qwLFeB?XcfqpAL0*NmG6z_DJ0n(uBl9NO>ns0vZ?fbPaQ7;Av2SHfY`^ z=p7d4!y*~iGj5%lEuTYte(TmZPmaF4hiTxv9~PSg`j)d|n=^^{3W`pHYA&jvw`fcf z)RKj6kZ|F&-BGlAxc`{4(Ze4&T7GHmL*9bCTv0cO5O@h0QD-ESr$pv}+87b-flVrX zY}+RF&9#4{;LO8>t(!<+P7^kqgY>Ug2W7hMsT)J$=n+D9euRbJIYGcN^%Clh@{&-e z6qqRV!?@e%AVo1U&s!1zOq6?Z*oLtjj%}o3O*MPcOeY?pt_ZpZ$yH#?5t0Z|Vs*1h zo^|*UBRdeF?x-`!rqDF|g`<}Q_oZ;3X4Y%+RSnd64ak|E6F%+qlhMj)fz=L{*2ANt zgG2g=hKdc3d#i}7gpAMLx~21F@f|#1MP#Ch4raK!XB2I=*b{K8^&>sZr`;@Ci(r|& z2FBWT%{Y4f#BX}}=)pm>y}h+Uop^bxm34Du@qq~O#S``>qL=jT{z&y2->iMRcM$Dt zY}=b^oFTU10zimk?N&1dxIdXMob&AhoL5FJ;gCaZL248YW~2I1bL zx-L@lWqy4+#f3+hryf?Y45mdN^&nRZq0gEf6(eg|2j6I3Yei4NoY1h*%b$&HyWf5D zk~{SB=Yt8*`^gMe1s<{7o~h6&MGvmlm}k6T0FElGSA#TE`ctP4)mzl&A43N8v6NK* zZS;`d>3f_vV3MAlSsL{_q?tP}(oDnBEv%oUApN(-x^auB#C60{G}Cmu6$vHlCNrh? z7U-ElQg9ItWbw3*=(y&SsFUaUbK7%N3ldH?hJo9O3_H)m0=M$cQ?8TX6_*?2}~ z8D|WcUv1s4h$pL-UFyE7onEUaNZ&+8Rp`ZsrkFHBd6^0Ky@n8Vl2cY7m@eF(LWZuR zETMPBI6z05_&4Xq=?aAFuhAuTy|_jk^22_fBdKDaR1B4Sb7fm{O{H+e6rPwz63i@ zSd?zv+CPYp{|>lF4y!2ZsWrSbB-V*^1sxi|0>jm8w_wxqt^tPDmtWyyZ5=3T@h3Sp z3utkt6+M7+@GI^fR5M@J#xzuh7|t2f-VBFq+2`4A@%gEwucAeHC1$v&f`aJ8jw?@}0X;$I$ zEGu*n@NL4E#feqr6X=4=@0_LAt^e9q-*O{?1-M)UYj9X{iHdVj26}nkb@#HX=ay(B zBfc(=hlder^Ld4J%BB3@rFFN=`GyQ;({~0wez6dUI`2@L3Ho!@ArPL0S04xAd)i$# z8UjW>tWWLA%m=X_@SSLCUew>>4ju5)#zJIGX)Ly6e^*?!r7jZ#;Z09qTi}KhxxUk0 zYjr-Ky3aS!7;?=hJW9Vjx%WVP0X(L{t)EV#g2lPbQ6#(3YO zF+9nulXKA%5|U9T=H<8yXVW#ulU8cSnQ%=|hSy0fujh@-IM?^s4N1h~LMlp2o?4yt zsx0DlrK@n&BfM_)HIjTu-*u209FP`l>%B{fQ|kh@Ed6Ae?QV3Mf3^l@?Is2k$~# zPd}0N`R?QuS}yE9ZV=aJm0kIDN4~suck$=m5bJ3^KNzV(>ylF#j$GXHL47vj2Fuh2 zAAN{HM~=}*0)G~Dt}wXheW2EL1{Ix?vR|rr+H(aDy+@eH5m{%Omc0D%Bsm5iOE48AlUctF4+;#3|sykqA0jB^@=UyS3w&uz~gUh^pH zdd7r(hs*5d;y$$c+&J>Ld>;*uzSU)*Ourk4{a={FK16P=qkdW7$d<6+?Ug&`m-$g# z$KHE~d{=eVJK~3^$rN4C@qST9KF^8IU(2aE`)45s`;s+azXmIKPJZWis5jWshweyU z(zBLE<{)PQ$9aF5RCTzErFv2>Rhb?upO7xn)7cf!B@W`;Fs!WmjL~#Y;K7 zpOYnT9NTfL+1qezKYQ&fYY$Rni#V_^vfg=XowKu0%98%BC`k3nU%My{!FAk*$N%}3 zvpGwdTki+pm|l`IO)WVuI%6F>@9K0OhjX`XZ&DXXl4&?YDpCK{V-*H9tMvu^%yAA! zo_vxg*m1n5rR^ksI+zo01_Re{9QrDovWy#5Vuxg`Ga?{Mz2R!?-5% zfl5N2PAZBROuwNAX>@FtHh!qQk)~)*LD$%ThN3E0jy-2YQ(YN>`}jPiJ{2`mrj4+ zJou2*^Bo(=M({dKPQ4l6FT~O6o2N(BmlyO8HABQ94e)pPurtApIyCP~_~jnb9(9nE z7daFHNo*ajt#a00mH3ttxiKW!NrB8wl*<57pGddDpKIeX0IU8S6!oah}68J{swNa;^NNTYI8rJn+2WvDN`C+pfs22F^L}LayTw# z%jT}Z>P698D^d@AU<$$qYK-fUC&8DYT2!M_oP7bv?P}33@dpp!NtN&Kc|AIAOh>P9 zCG&``c;fMT{Zw7?z7F(cSL+LR3gnsBWrS7Cxu4O*28XXd3%xdM;^%%8dSW{#$raCO@E96ayZ^FlJiV7i}T2859gsO zM;gL;$TTAnr9gF0{h5h=glq;F0McP0vgHLL>v12VWdr0pf=uH7GB>4J4t-rJQmI0w zJoK%+t9&FAANt7hOS!j}HD;j??Q3vO`CD)1LtlFZDxVwn2z_c^+Rtc)#`=19W)e?v z=s7hyLjM+ZpnqD)*AL1}R%S3e(bP-*QEC31H!?fUqY`^oxUj;jh9z}t?!@Xxc3ODW zOt)w`)xzrZz|fMOh41W>8;)sLLYFRw%oGYKp`;^ldEc8(czLJd2S*zZ&nW(-N-{Xd zz(Kwcm1MTDtCG?Vl2D!E4CFggO;XjOpzuKL{iC%#hB14!f{KF6L# zg=VP0B5NOqsu8fnejli|L5Wh*PTg1=NL-9IV`S5%#47>Xp;!BK2}V5F?Q}4U)t-b} zrAJg#QA-9)fque zd;CEM2^EJUS_`OeMhR4jLZ#vARoTkX)8~Pw-X@z0(VuY7VfPbpKLi39t@thp^f1ed znmN6C9-_vWJ*vAgHK#1)9ut|g_E$ip3TFj{lU$8|i;OrVoRUQf{2XGpM%?dD5+t31 z_Li7z25sP1`83I=gQD8&055AVH2@dL%M=DVKp3+KlW^G|AyPK%icE!_U%}FzML{2U z4`_W0a!A82vhiM%1C#pHGP#6kSEt5|Z@g9O*^l3GyI9+)=_Pg-vC%apc1OJ#5`jKBsf z321QsO8117vD1;d;*$gj?C8ND13gy|&@QJVq5A9}?lDjJ z%nPSJS9d45RqN$b#Ek%-_{lxYN!s$#LcOk@RT0}uQY>0zuJ9NPRm-uKNBPjGuqcLd z)to&jjVlCB;m~}}Xj$D#E1e6b=n&yENiFO&1^RE=T0CWkG*A*n7WbR`&cifbI0c9y zZfV&lX+h_$)tAnMK-g~XJ6A{bbqZ#ILvc|sW`n1FCs++T6MYq@m(mst&TtB@uto`u z!c^humVm#}rK`LG<)=AW@wet+S=BGIn(MWp>OWDaSMIrn`W9uM)dlCH+)F!#<0Z$_jk@XE?h?pzldQcD<@|V47lR62GbxKmv_{VTjfx=YhsQIcphm=u% z3*v*IS$%(RRsW0N!PUsZ#${)L$GF}ES0o$)5yPb&>@I+eO91MI$%`&IBQ2?v|8S&* z6AuW)m#gwPWME3V4*49Esi3@=7Op1xj3j}M=%0*8LX=a&6D2OVPU4#^qRUNj%d(m= z>#!g+z*GzQJzocT@1MlOudU!~nwiOUzvH~)3=ME*-l?40Tc}hYTMKL^XWM*HUNQmo z)qJ>=(T~dX){l=YL+U3U3+iW<+w=p&Q~I|I7z7EQmRmD&GoZwZ_`D~jvP=-YG&~&8 zjx;$o00Ny0GPU)>DxI?Ypc_bd62 zB2~ocN!mHl_oXNYPDYHu`05S0bRri=QmnGlR}abGlJ5V~e3pS?@STJ)t0L99(Xzej zLEmRFpx$iQTQC4klZUBPQHW}%%TkU<-|{7ED8p+*)P)x+&~Ko(bQ@XZdZSVf1T;Gt zM!hNB&_|XR9@%vY<5cIwfWSwys2`8%T6J}OiuJG^#52UDv=b1IRySNsf}{6Wc+}14 zrYL78tE44#I&Am2s!VA&>@$t*9;CX<>>}P{Owh4?XC+8be9`y2%S+bD{7lQt4@(GJ zoiE(SdXEKAaphW2Mc2ZaMOE7l^6O;`eh1?|A1>(<&sy>|G!0fQ(4Qs^TfG6@R+kny z+yVD#cq^e~=?0c`VCz7pVbM4a5GRjr68{q=ZeU4=fn2FOmogBjP+-X#U2s*KPiYPo zl7mb__fukex{GSr8I%Y4tnR?WdI^iu(#a3_i&m+r+QV>g!m_TT_H+K!9i6JgDSs{+ zsvazDAee1^X=TO9aShH)`IuXBYkxGuvZgg|B*nPJ-ui&?)=fl`y7OMfTQ}{(c@s%W zTKBow$F-@?-Hnn5Q@tSP<*&$1I2mNWwef%qo&_K8MZ+f!Ul`8{GPaf79R zt%St#a~Fr*S$|Jq*hxpnD5C!+`lyUST38CD2(r6AC{@Eu7EW~gRRv!+9f-O%skYDFFm@ zM;al2QWZ2;YQ%g+C3HY374(A46lVf|1RTj2Zyj>13Vw+=V`-+08(a8SIL5_%SEF{h zYCN*S;mndl{m<{01f>ieD@qcH34bkznemL!%W~|M5K@7*rO)K0MQk<838{l$$xHhc zWBwZFb;i^U!n%fLij0=Kb=$TA{lIdee&9@{_XKn1eWHn_pUGe`CjCSPf+z1UehXJm zj{R4jQ_=oG9`zHX354q(@J-;3Q~2~wIY9pe3qgbc|0!adaosaxyZ~tX$Z0|GT+Sg~ z&iultW{lLoG6-r`&DE7kq(L*1z?sD8e!Qwd(V{Sob5(wkJVz07h(SMau zUG>;Fxk)%z=u;Qw_v5-&AAu4`U+@^HHl-Vp-I3d{k2TYq8#G$dlq{|4E&P(ZOMg3P zG}+`~RZ6RiNK zIduoCzH&5rv5l6VN~NW4oMe;y<{DaN313yazpTo3cI7u{^jsu$L1iHNog?o zFdLEj7w7`K^#MWB;N~W?v!Kz!)|D|}Dz6BMzAdi5ZHjS5<`RYV-H&enH5g`XEn2^Q zZ+$)b_UM7~5SC&J=>uYY7v)fFA*(C!wW-{drX3CL$(NhA)Ul!fH z-ctgbE6*eZVG^C;>&>bBq+p$=HxW{;u)qf~4s-6HDU4ir+j80U1|zMUJVC$OGrPHM8W(_lHAQ+S7hB8e2&wO&1>k85Q!%xrCrr|Thx@6_6o}H z5J4BI!2D+Zbpdj}rfGH*2z0!F`QG`6E+TXIUIYAx(@8Hzrma9iUIwVixjGw>?=uo~ zWF4f}od8RRUo)$g5hWuT7@cuEIw2m9mbG89TJxYo;vN8DySA-Hk2BVD@aO&t$xq^$ za@NK<0x4LisN)goC}_wWC_k;|s$%L5CkN>v`K^nf<1it25%+wWkJC!Eyq}rwK6IxFL#z_r1e#Zr$2<&!$hbRCB-l==|hYt4v zxiU0}Y#+*PJDc?5QJQnUgr%Gg8UXS2wLVUJRB1AcCEpEUIHvc8y*CJ^CoVtTmUpbn;*dA34 z?#8#=0b_4`%fS>be((RfLG!iDm;f9KE_M^(RFC!+R0g77E`#PTf@(-R9|nj&hj@?R{3U*2VtJXD$Fe;bbh z*lmcjIbJ+XfZL9~Lv%V{!LfPcRIYBIv8Mu67jd1R<1F-7QZ@*PhfJ`@*Wf|(^oZSl z;pvGxpnj^{i*bO9wdf1X8r`wwgY|F*w>WF^8fkI~j^%PDWiFMeV*1}Crq$`;~kU|5>*Ah`H}=FdZCh-0Ebs+3AotH(3s{! zF^{I68aoaqN&;yoj?PIA$H4FCEW9QV*v3pmD8LC00?HubzPV=S^CDouf3H?BiS^qKv)4$D-6@l$^yw^DOSMZ9? zBke&=Zs-h1pCAPmQLqh6+VLsPwSzg1x`sed(=o1KM9wJqtaspv4ir14+0fx&S z>@n5U%zD}vUO~q0t#aPIZ|bW;`IW;ho`--MItjSDe}YIR%JYHV^ELqwfQzG}Oojx#y&gFe}B4O0%bUddTv0SQ(0dV(GE#01V~s2jN=#QdySe(WK^aJum%)(Fv8|ToumS%7 z{K4la)DIa-zUZ(%LMVCX3@CZWE}R#IwHh}!-Oq60Pd|Bal#O>ep&;B;6yWyD#gog7 zr?tMrZ?q)-0`cVPwKW$NJR%_dxjsA@3>_Jc))+EHvtK2Sd|rR;+vMUah?YW2zk|mc z;D!7D0N2JZzTH1=lndz9Se3Adhbri~aT@fL;Jrm$wNdPCClqmeR)vc%l2OD##}rFd zQBwiS)O!L3RoW2?KMFW3Zln1w9P^M>fYNyD!tx3ipqF7bT`$T4mGog?DJu}16s59t zUc(ljGaar&Om$DdBYZEqWR&LG%Qu8eAumgbq@1fQVv{20g8Rb$ zMP-173D3RFaA*sO#p!&UGB`uaA`u9#8k}S~f*=e=EZfKgC)%ceD5-G2${)Y zm>4Ovt{*0@8l!IsCZ0ELyCpR%{kdS`IduoCzH*p&vAvHP+zm{80~1>|r+?kR#8(Lu zFQ^Ozx4jHZyufZ*n$a6ledzVRrmvnuyAK&2zUZ*tHavWwuFbS)OEp<;?QMYI- zI%)cB{P}0t9%rNe=ig*Sa__S>{VO^k_mw1?Bosvm+n+W-y=*YZkX*4ZSH(~=Mub_? z6MCN`Un2#0qMGsN$0Jn!FMs&sKmPF#*etzHlT)uu^jRDs!m)S%xN%YxnV3EY8Z$U50iT1cvSf?ilca37?v zys^D2HsIvXdpiCGk=`E?pc z55D|rZTImmM$30L5hd*9OB8FH=}U&R7Z&glY)AV@5Q^NIYU9n{D(p!G^eSf~#Qjqw zuikH~kXWay<3To~J*%akF!)|vpkLW&1oRCaZVs<+tVUAkdqmT=v+PyPYq@GVqD#JO z%D6cQk%8T5XUEKGEvLoA_`+_O)JM3H5q@WUFH;+V(gAw&Z2vyMBAR)pF(Fq4=AQaVt?U&>u$R=S|;G6k2sRFHDn!$rPC&8*zgVL!?z9Y@7X;?tH= zGgIVR)jg=!IP;XvqpY8~+J}C(^4I<220*25ae`KF?~H%M&y$2)?#%Dc1JtUz`FNLf zxcf6Y8v=iy=L?07fh4Y5+r0G&yIr}T&1w~=+jy_)JhKmBQE{|D8Ro{mG@Ne7G6nxS8DfWk5q{)PM>j2mpG8g+V7rsH< z?WsB@#?=jUKWJ%+)Kza8x48Swp5GeQa>`8{Ev)#C99LoYLoL!Z8BfS(2~yF(-fP_0^#S)l=JbQr_r-(%t9jKOD8~hZh@! zSH-1AB1=g5f^r%@2w6K5i(dqeIdT<-uDE7~!qvJ@WyH^Y0CmxsbMq9OW8$jOv0$DW zOz<4T4Oifz#=lncq_LwmdT>{7EkC(iXU!=-8i!$k_d zcRSoUzF3zTZoMb&yB+QvY~eD)rD_AS3vU{KxXv#d2H+^LMlZ$PAqQ$3jin}`C4O^# z^HaLyeA9Eq9AN*sP(d9)7+BT2xI+Lt=gPX>kRuoz3LbG{plF{?;sz;hN$4ac@p4Ol zlN7Ylx}$c+sYh?dYb-6fNsZ!G)SXD@Iv$Ebw)uV+S=}}L39@}offWtxT*k=qME1>_ zU%xr{`cMDtFFuh!|NVay|1{bBbTWH#MwtkmqBQgydf0;94 zLenFtfqK#!V#(_B1pzJI@UT&@-sNlSt&P?u4qX|BSbLxv*moLuOo2V$4Y{G;Frgc` zHljOF#-7>ZwiuUaITfg~&f4lVrQTZd()f8cXqm@t!R9xHmge85KgAQe;*PW5NkB@Y zjrgLDZyLh4&_Fpvi_hNEoeo`QeCrk?OSf)a4pNG!uK)XwVJzvHhx0sN7T&mOLWY4@F!rP zTeoD7l;4vlySP?mMi;;+%tsz;%ZIO;AeaZwcc|)T3qUq@c0w4&qO)kDcMzGd2SeRlfgj~um1s}AK(wYBJfsS{RRr(Jf05p0FV zfWW{W?UKZ({yQWrW@9#@?DQM{ZS78myW^Dh;*)IPOk0C)PdZAe^9{a>sh19baO4zE zYZ(P_I{dB@8Vhh_K2vy_X#X!BJMiNHJ6O6^W4-ONEkTt(>$3$gSso;#esQua?9ZPs zue1myT3KE9@ksU=%PWWyc;Y1Eduf0B<&o1O*a%liop5t#9M<5nD}iVw?ZT7Aa=oRL z5wM`3{7pPgo7&*G4;yv8xqhd)?jtK|CUIsiGZL6PLs6&GfiPF)huqr3l{|Ym^Kc6f z;&#HgT#y6C1BmrWHh?-IA{_Fhz)>vRZfWMbXbzVzBDrviES}`XhTvs#*ArfIxPY(z zDzN-5#s)axg7vLzQ6mDFEf$fa`&~T1DGpEDFdi=}7F<>~*z%Ik@YsF4rsAuSF1Hfh z{~XtBjp*7I6j8kOTor5JFmCMb zWCDyv@EJy-k6nTcR9cMPGVMX!O^(unwO?aSLGTxy`?#GU-Dx|-np6N_zf&8{0`Bfk zvs|{S!?Z9Qq3{>v?^ymK<6|=4R;Q{!OKw0Eo9IGH1WN~~%88ZwMBJk&#panc=vvW# z!9iUI$tP$vvCm<{42KyqfGF=htaX%|A|};{lf6mcyvPbsE868$y1Ey9TMJy~Jsj>&k%X604WJLoM6fm|odcKrKt)**nT*1s9}7(#?${f> z+9*%Nl}??8_5JQp2bDyUuBh02dK!tOOe(cNS)T>^T>WXl>yoOFJqzqM9A2m7O-vE@ zbQ;bZT5|}!rt5A}#Z9T$QDs!GOH}`tee+z_eGz#(LbJk?!Y!LucG#r&D{ryPJ<=h0MXSsfV#JbcI60!3OZh=hTlwzt0g`MJ`P14XT#+IL{W?x|a zUk<<5YDgjC;%X7g2TP@B0@VvE=yts+5u#BeP*i~{{klR~eoYTUf<J5r;ONZDdfDv3 zUog=B!Ug&lH?UkKdIs-ahla-K(Vp?xgS#K%CixtR?y@G!%k3V-sYd8X)cno|g)g{s z;*#e!!TGCtAyk!W1ui#<%gxtnXdKN4h{4g}WhD(M#O>d5^9NmbjZ4N~lX2sHrd$w_ z?+w5MQl-J=5F*?~qDTbGksFM15rqpP(lAevj1IleaFqvN%}sZYxcT1l8TQ^o_(38+BssGo^boh7 z)0N*N_-9UF_zj2CQA)>LS-29t*rC^tM%9=ZjvFXNfE9-ua z7~fjwknz>1kK3lO&{#isT7Iy%P~p_B{#QB`XGa`pO)CPx+N4l!@amxsSwQ?bc$8wU z5qX~G2CzfU;87MCM}6)MxvoST>y$|X>6Q7CD_WqW3KCtcAcO7-FHNP8@h)I0bRLIG z6h7cBW|_hXCqsmN1Fi2d3v?V7z&KU7K2~0=zWsR2#w_ELc7YzmGb~&BvM*X#IA;(Z zbu+S_`9#Q7J+v^6ITQeq3C==Vf+m-h_`3ipoOiKcQk?n`#Xzi-g{>@Z<=?V5Bi1~p z)|zdW1)=PBb-pya0EKx2r63U;0w;d zyR+^{6mjy#dQ%D0@d&yg%^*68PjU1I%L>R`9(7LOU4?uv6FPkDP&XJ1(SDdzDnoFJ(SbE(x8@qC>+41_;-nWCGhU9S)OjO4eTi%n7;} zT;immNPEgU1p-A#J*-Eur2!itnUN@;Q#L70dI~zAux1{5=qnv%_mN)X8~sSVXiM^= z5nwmQZ$7i1OMss&c+Kzy_iOILx%F=3_U3X(*%!&`NxRPX>vG7CWtA=Gd9H^8&n2Yi z$as21YwY&Bk=2_7`B$4D|6`G>a$=k-lB)$$L|lc7z)XkP3IDwh zAzj&fE41b)LN=lb4|=X37B|>Jmu%2^EBk0R#W9tRL7#Eh%kl;N+yFe2ciKgL-B#g% z77udqjw6I;Rov`Mcgb^sJe2eR literal 15333 zcmZ{rLy#yu5TM7lZQI5h+qP}nwr$(CZQHizjc4D#TeY=SyPF)k)9F4XhjjXDc`0BJ z6aWAK2mnJV5}jD8qkA|y004L?Kmf#lRvQBgTV)d)dusz{6FN&LJKGzdE5|MI#9Kdp zk&x5ulw$(Q#6+4c8}8W6#<9p&+M1Hv9|KNn1d2qA003{>pCBQoMCN*b!g*Coye~Wi^ zEZn@b;Bq_%V3tfaAJSUTQt3N?uwjYMfmD~SoFDLic?ud%)EQUfW&+q%k>Y|7kbl0e z2rZH*GGv1oe)#_|mUs)s01H|Hyw%W9UO zud7aLjqUY!VU&lFiaDHr5G#W%ZfOy?t(J{!Z~Uh#}5yeEf>H=05i1|hN~YGDT;2Wr|qq=v-7VwYu;ITue5GFCFmUWhsaVK^cXNA5(wRqux$r@IfLR*fka?ZpHm{qRYqF=P` zYWCq&H}OM|??IC1Q53OoPknTmgVE>59(JPv%aHP$fs;BAKF#As=wgzY(1q}6Z<5<& z%aaUv;g=d9n2v4Ady821R3;jmtV|;H>lg94a-U?tJ~gvEOqn42S|q$gYNS}G*p{Zf z@D2r!+NL0u1`@duG2nDb>LV-&l%){dU59i1+s7;%0^f54sVs^ZJz7x`nNIo!xC+@%=hqaP{&M zujv_c&AVOj)r{AbZNZ|cU+NVb!g!L99ocByE&fP8aiVQU&TSjynPa~mF5QJ)3fGRx ztFbrmRUKt$4M|(9mg*jK8MW^A!^HN;&Zp%4SPKqi2EMz@t8!P9OFP-=8L;=V>-yW? zb9BAbs$q7x4` zOTqPTZLvTQ9tK5KvWcz`eSSW%odGB<;#OgehPafp-bgw0lwyGZ)N#_vza{ZcZJ60;#V=t>SFJS&FFO;Li# zCgq=s6Q}d!4_W79YR&pJx4!=5?6Ee6M`~%GFQxXEq)RjyXclT$)?qnkc3`5?D_5cg z2*-=jBj>37KzN*m2QJmb-m=7sqtm}q%Df{!$jC><(A9Dq*BdsmRnu)ShMC{W*?f;@ zR;LpjIgu0wr7|r|{U8bE8tB!g+AD8&spAEzO*Oi|1*Lz$F}&z11RmM&s45a z1k)QA$Uqj9p__-gk$o5#Ft_^3E4M&BRg-$uuH7QVydOS6Gum1hUPi1{DCf zdBgU_huf8~Nklqm7!$tA=6E1_+yCPK9&t4mpj$0u!-a~y$9Iq1kpB!VzCrl;6Fm=Y zjy6#67xHK^K2QU@U&@a$yz!Jjr9y=rN>xus-YPg!1 zK(n54UR)Ib1wDZxqO|q~OhVYc1r!#1Ffg-3mRxL_u?6QCAt!!|^^%gXq#FmES08tuSyX|!3FYTo1vYu^n{=j5n!!-f? zF#8vE)r9($-lfxCDCzOApV`Q3dK)Xdb9KG}f~>r~ft#n#3(-oTo`SWPJnCIQ$}r$~ zHgy54ADkdraPkCUX1P|!Tjfk~xph}DvlXI8im#-IVnajc%19(iRI_$Qb`HcDxubhF zefxM!X(6ZANhF%In5>W+OX2kLBudVahEPYV@u2oZBxl6&Y$XF}r zx0>X^X-c5}wlZ`+E|>jx42+9rG5hXxdZospgp~?Jp=~I=IxG#aIHc$A@Ir7QyUlcO zQ{SW2z&vV_^yj^Tj|csR8Zsb33(#%`AamJMHXgO1cNtHvlG#gkt+J^(zU*II@@Y%S zrjvng=)9z?7B*XJIJDHL%Db$WP^|&WsddAOiPH0AsW-ILLK;Hnoz}xSRSeChm0+k3sPabwAUP(Nb~nMZp&uYN2L0!sSuELtoH~yVR(p zC4H#9311woS56oOU8!C2jX(&bPc|qWa%$D&8KM%2kP;;ZN4&Kyj{FTjxP~0_^Lkb$ z`R}ugW=sDQ-vUtT5G7nBJjkeWy?E^bmKF`wL2B}DTRAF|s$jCjOVQU`%K(k0ZW=x9 zLidAGA>jAI2x^H0RXmd^m|N~Oa4s?OT05m`NNk{x!uz-D{rMU>^~e{rhaf3)pUvFl z*9KJb1dPkkj)|r-0>uuR?>xV+qrQoRIcY#r{ogbE-;Siq&%tA z&%yoaDVtsl>o`ycwM1_Ej)JA|s=)R}qE15HBRQOQg4}#RrWrDihisk$rx((0dz+|; zX;qt2-rNh=d+jC|Zk{3T%k~M9JkY#7u(Uvsx6|6ysKyygfs!dwn^QaVwNQo9XfL*h zvfISeut=3gXyF}MD^w>&UCLvIGF0nC8QkD(AENbZmkP%9GAvYf@hn+{_O zK&lV7wTKR!t(zaa(1ve8GU;UZb&^{&4*(9Ms zeRs&Xk(9}qY4ZRIe9?N{{?a4o9dT^X6IWasx~EG-FH*0M=m)inj2-$O8hG4}QiFke8yRT>=wKsqDPmskcSyYH1f>p6 z+Z(yET73qvd$*lzuLRzSYOg8LukpLpEcZ3martnOzzCNX1-@AhYe!)#y^ zy2Miahf(%Gg8AqU1PMv^V{ z;OG35<%)wt51dpH+u2@GNsE`MbwD9VENT>>wip-8^8{YQg7}vG{wjP;BkMM6#C5sT zQVhAGx9Zp;^JNf+)sdGic~^5$I^KE~?h^23Ihf6bYzUT#j$5j{T%U!A0b{o3YE29a zxxD2)ELMHr`t(4(NlpAA4R@8bXUGK6SJWx=^AQbs52->^f|6D2G4w_^!@Tr94=)a`9UgQ^Na@}ajT14 zsHogKvdHq|>QF6sQq9B%wmn8t&F|9jycF9MoLy0n(z=i}b`ei-2OM(@2+=?@7Bart)QW1MIEeG? zce7r9iTbK}-Sb9{!+B@l9665Ki3Zfi%mNVOqm!z&tmDC!dPH4@O9Y%tX9N}XVD1e0 zv60bo;xz(H78GH+cm|lnh4h$Hf(Kl99h4D9A`)qyO(G(gY=TOlrZUjI9O>#1&5N}3 zp#h3Nvfj|YS7jcDPUM{!8BQ^RR$M=7x+j#g%ofq847(p+pawL4(ob0@U=P5C!m1PB zsi03`43ziI;zljqL(ak-9E%)0%t4b+aMj_B{$56E)bW;~N_8p$%Ur@b5c9|U?;#LB z-b{(?jemX@LoTwIx&OVW(!c^2InEHm2)=Pc>D1zH;yo$e+hqr~!zkQP&=Qdcb>w1Lqx!bbn*aR`=rx}eP z1)i4KMPHr0WTmg|;(HCnj@fX7vtlYOzP11fuP z+%aq>EFok7PaE4xaow|}_C?1GCEkqv>ABSksc^6Sl7iu0$|W^2=ZDv>eKatI`aq?``EB(&2@dIs`apu#9lu>8H`-;fF?wKK ztmy`4U5dLMWKaJL3`U!I+o80W$1^BZXt$_5S{Wz+ye5Z%H`!yP0kZk-w{4tYAGf*H zM}muHBtR-lj;?}|eogtBH+3P=!~p}s74XsZCUosmkx9OXFscHF8h9g_=(Tb_g zgo>2f<>D}qp?UTqY5s`=)>Dy`* z?UMLp6cN5`K@Q0+Fs(<@NX^T3(%YwZ*KBhccWtp(XOimGIF$}CRL?A?m;0h>7VA?MMF!|5H; z$qWxQK9bTzt9qFt>mvdIl+uUpr4PJO=>~RrTW6X>ZHp;(IYOrX<_%+zqd*oGz7EZ(|v$RvQDw<6(SPa|M@`r5zLrNPta1XlkU!N&}sc_ z%-VW#!~?XN9g1>H2NceblHP8C2*xHP0N6}O(uz((U;$?&Lnl#5{JXNwznS4=iL*h zlfc$YU$LK>&BCgL(?IH_eA01Za=?;lEg>_-w7sH&>3jaAdr!x8PugXMs7Ew&(zXJI za%U1n;zP-B(|FQIENdbG?oIzJ^w}aPl@h}wMrL>lF-GDueBJp?qw>0*Ifu19Gg_kX ztHyXRh0#giPcx`>k4pK0-cQI>AY~d-$emu7+OgGLWvpk3Y3yY~aHcNU66U5cO?+wR zI@1)2-?YB8O6}r-Ob7@R_TWjdJU2%#1>7Ulsi-pUUWka0Dsob$1^}#uRGC(pIVOgC zf<=gKm;~2aS_G3V(tZpkdYxL97Y5phS0z~4V?m3VHtKYc+X(u#)bdA zQ50x>oo-L)^dQB4v7rXh{7AfWn~<(&tPF8%ds#f{(|OsdxO{48Ng%vMA_t7Y!fvn*)Ss(-qBKHLLLHoW)WRK?A&V z7_g`(0s*mT2ZUjj&7zLV+UD?6`Gu$QvuMj&X{{pDCMvXw6w>)X%{IZK%agtI#Thlj z`L1`8e9tNhjS9yzm9{mN%q?l0ijFGgHyj4v1DzPFhn{dJ3MW7n&QzSUc!T;!{jk9p z-8CqW@nMGT4(1D1JMO9H>TT4nSGsm-&c!f#W*#SDEf&XX6p?B{I#oh+)VZqos189o zteGe8ZIKO@IdDA|r?i^5?($yudcH5i+OMa`a&WFaT1JGT{19}={&qjjHWtaEP68qA z;X(rRT9@KlSfw0gN7sM%8MI{kOlOZu>@{ne+(VMy+|F=*DhOw)h-0Ce zbrpjbd?41+*&EB@R(c8`3P1l;W<}#fulprivN+k%yWPnJ1zYw=J5l8$YpU&0x0m?WvuBc76Ao5c2bopvE=3n@u2-A> z`EKlU8%JhG-e;yN8OtjrZK(KVOowkA{c$FnoW?DOp9GH=Yo89yxxA>47Kf>u%h26I z491Tyz8CM%a%5TVut|GO9WPd}xW?)J{gX4MJr}s-YO4lcUOT%EG;{;Jig&dv!a%L+ zz5BDePt`W8hs+FpsQOMVG+x}U@-Mz@n%~EL_L`2pA89?ZcaoJn*viC*po1Hc6vRFA z-U~fY+=g%}pimNlS+uO;^{EF#OhPGLb*m}KLq}U7w!+!8m>)KL+OD($M|;gE00rY= z#T~4=({d(5Q=2>~`*N_8^5`!GQL)XVf#4B#i<9%IS{Ji`5n1==c0ss6E9DItTBiml z%}@sYLdAHicizVKcvitlf`t758QW01|4(%4`4}kbAO#W9sdyUYQth7(JI^c%3$j+q z2(me86Ub;CTVgE5?bXow_Hr7xv-I~tM&C3w6m(?Ve#?m$%%oz(}0P8qOm>eMdUWlRHLcJ;T(Vq3S|{B((rz z;$C$4sGIN<`+t8NEW6_}0AFxq%6(O*0+Wv?9!?QVpyH3Fj;3Hmpi|Nrn$ek3Q4=Tr zmmx!&BHE}~Qw5o&dWBVLBq5UHZt*ici;2ceeaZ7poJFTdKpw|4j+Aa?YSSfmD8v?b zi&yO{)Ze1F+FZT~ZJrgS<^o?80lrs_RkH;v`O17+2Iey?Z2l`eUBTWp!Kl(5Puq#~ zf^Z#_b%x2_WSsY<(v*G2P9@a_)9DAyWKLldSbdjoT+%sabR8DOeCmM2Gtgw3CBydG-}O{e@N?4*;V z%Lw=0c*F%w$no=Dcb7^0RIK(X$g5g>Zlh0BJ`9Z;GLV)lL9QzKxz~@ixbcro$`(vJ zAc&FSl-4MyhF0sLM%31} z=gqCvNgDK5^^c)j9@o`Q^CHtKz2#N3qAVh{G-d#})MxY}+9a+A8q*LRU8#{K*VWE` zksQ*$9Q1Ww#w(#=OyKO0XotV$#l9!t9IpW)Hy}3X?3oHG*)mBb&5Pe8#4E`lF_W-y zh=Eh>EN(Mql+e6@(659J?kSw3z`vVvf0v{&Kb(H?cx51)oq!p%jO$x0ljKaPqR?)v zaiC)>rt%aIB!AHN0Epho!~E$ms9C#*YOz=$l?lcqbYkTTp_76WWw&$Ogo#+q?DHRb z{^n@BY^^(0-O_7kRrGZi{kB~!Skl_<*~x^Mx|w^4_WdATb7!}F@fMTQaSD>yVwjZo zja@27+gV30sf8=o#FbZh=;q3|%muDQO9gvpu9^%UV0s0$lB>7eje1tE%oM7r)j38A z-UH4l>I2LpbYKC6-j@3;?bCUO*~y=qw~A9#_q;C>=IfJ~i1pGwOsF?_^UV&v)VRgt zgv@w@`L4=AwhZ}$9~32TAb8u_<@KlAu}RYig7GvD6PFMBal6?Kp10*bzoaGXi7Ohy zrJo~HJk^wr(XRYtWON6^*&Y*gn_BqHbq(jNhDV&IT#&AI!l`k`#h2^p!Gr*LE34bx34k(L!Q_ikZ5zV5o_tPL-^Yvv1< zrm1He6pV%808rbBN2NHz6Q8rC=xdBu{?o01Bx^wyqKgCQ*yA-5bdl(m=UZ}m88hk* zlSu0JZKIR6rt$ERBHi}*Nm)d`nJJEcw9}2lC~IODcIz;@_mkM+VmiLvs9qsCvFIrj zAGE(AGJ7JS2!Sp8;vZy0nIX88ixNf-x;VQ;kzvJVJEpoBJ&kncVuQ{A4jx%bn8fsz zvUd+KoONVunKe$VJ{*RCK5fU^ zMrsEMpXW1wQgj{3a7DHHW2n?>cin-+r~X7}=pY^%4I=2&mNypSBtcjMl50`S0nIKQ zd6@j{)iJ++^=1e0V_GmV$s2SKzFLc0M^crkO{vMLg;j~*APC19EXH~+R* ztNYa-C_5dz-ALPkx&^?rkJsz45v?a0a;8^5_wJTo*n^t!Nt=arq;7*d^mOf^* z@GAnyqBl3!^#UNR6))Vdots@H4Al?_)e(qYqGT@i%`Jj-TJV{l=%68^F>%E76Q7vf z_QR@R6I94XNR4CY34n4gnoZ{5u#?2B`&AuYl!&mRloP7Z;u06fS)K@kjXzWgM!EN> z>d}pvhZp;Apo}u8wnaq=#_{x>C30{!$t;(^S!U#s9!UTa(Qj6K{!%_P(7lKGHcRK! z5|&1EtZ<^)YF9~^t1}@KsQTN@{y^wxVNCp{puWL)D3l7Cdxgo$?xG$sL=6$ z2ZZGcgF|}b1Q6q)osYzlm2tP28}G|;jkLM(!otyQ`{y5wEGNLY!P)VI2D)@$<3$LX z*KC|dZm+_+Fc?U?Sl{`2ZVa8 zDX8HvzylG$Ww*?$2*f@p^c8KFm41 zgV>$eUBi$;#HVXC3u1LUnT->1V_kV*gPT)`R_O1RQ$C+ z6BpL6>^VDNew7A8cQEK+Ry0R3EFrlf+)4{^1+F^CVD#{w;W-AGT2_z(MUmH0^O)q} zT}Tb6X9JCAj2;5iMAtyp^+~lfwur>EKi-(t7n68&-RN^+ib;m<;(=zYPoSKSFRpO_$SKw2M<=iv`0vauQt?@L3HWiuaZA|oM6gNjZbfLx1{egC&HrDXWmY`m{%B2(NghrMZjnl|@Mv#4M)x=C2ZO5v9X`ZdtBp3_@~ zwFmR~?+?%yxdex>(u)0ZjVp@vFg+ZE^}GlKFSuayJ$G)hHpf#(_y&USg!UQe+q1mQmJT4fM=~__}Zh+63ojVo-(A|3XGI@4~ zN0Spv`xcx0%HvLWmf#m2S#{{&30%VhXHf=Mpz`8ce#igls`lY5uaMKa`7cdnuPzk1 z^d9VQmc9)vmE=yrCpB~5kte8`KD^95c?=rh8M{DBZ!H2} z(1%_V1iuAapD=mJ_-KQ3Pub(`PeVd)+)t`)zII}Q@5pQDX-dBHAb%x>1b?Z_p?(Aw9oO6P2buJ*%?u<9iCbAVHcfF zg$-mK-iwHHo8(IG>G90TjXUq#=N%hczK;~i;y_z>psdJnXL7R(S3#)QRRR6U!{)97 zt$n%75?U*qoAJMv&bp(Q{l-$2#bkE|6OR+{AOZzv7=eL1bq~`x9JyUC8Wu>i$A`pS zZyl-IkD$2ZabU(qIaA?y^L;_;Nx-S%p^>!$*8+X^U zxevL9K)oG_ZRgxD915sqq#>D~CO6xRC&A%w*jSQVA0ZDWMkYlp+9aGou*u>0(_x?2>2G3?9t4YX}v3B-jPU7EIN-~@dhAq3WE)>bZfs9bbiy`s{&EjqwKsmKg`j6y80KG zN~KZf;$Mu@Z4ivOa3^-dxGb!UBjH7%1k_tEffnMDzZf{1h*9`F1DF_bOm>FzMGF~q z42Ivz7Bd+ba%_N2E3oplM+FG6d0MS#Pv`G)`&z@Z-*b93kd+h0f>ILPsU z<%dp4hckxq^9+!f&NmKEf6M(@Tw~PXF*~U>G)JfJy%ltm?!L8m~5grws<4ezRsPG>p`?1A?oYB2^2_ zQ`gwc2rRdHUSX!p`C@o-JlPl^m2Z6ud}CPyvQCTN?hrERey)^0cfgbNUX1=9Rq69# zEya^y*FOQbuVx0>oAw5tF z62p**tnsHZh$;2rX}~HK&{l^j3o{qw6PiG;718bW>}mP6?Gt$$c41zld&vIsBy2E` z(*!{)B%V}l_MVu2lxz;E;oay=27u4sL({W((pRskK&q9yAlLW=NL4u|r2!R~6nMZ& z`>QET_JK>%PXIA1#W&?;vT?FOYT@`+n`+K(ql8)3Fat4R%TR7-FtLy98eG8&k+}ZH zj&1W-b+$W$2o;<=z=ld!rqa1o83PDau;$rSyQJ_DaxKQwF(I1`y=ZQGB3!tjCV`}x zj$3>5A5$#Cd2(1Px!4UW8t?;@$GtFeZXKiDDa#Y8`Pa3~Z}2F+kV|Qf9t+dzBvgOn z=K6#)x~lwgMQNwf;&vs`HW^z@tb{sow2H6?>glpf0C%M-XHrG>X=O%56#oc}@#Tg{ zw_!96UcXp#%g--<%Na(8CuO~I?<9$sHbe`NiPCIHD&ef8b7Z)EO11GTt>Z*TC1k}4 zH<>Iec2H~L)?@ST925OYxHR1AZ}GL|V`nanH@m0H8CpA_ckhoXkQlow;1*M@O4ruy ztjpjX)9g*pe;UXj6C7LnKkcNZ3kH9?>*iLw{E4alnA2d8&^80_3G^AzjYJUS0FkTl znOVwV`{_JczTF$6xf3~mPSL^3S;n@PKznqJ%e|hC23%~Jewh5SV(+Ouj@5~u6iMkh zwrh7(zGetxby|CLRo{Y9#_+c4dH-_Y7hL{-!{g!q;BkIdf!ht3fABaH008|h2J#6pEL2xfU%$)F@2=0k$Kq>TkT+aKu%86NlNgnLwQ9I`r%p% zr3YZH zCUs!_Y`>a5GWlX$;iEV!RYp_#WQ@fGRY&;6%_meetHKqMlE42vT}%q;vP4d%mNhm? zxAL5!k?9Kjo!h?R$cA8r`w7zI>(b{Ql^3x%HO$`EmwVFmb-UAtS%$fsavu((|9(u?BM!k`M7!~KuZ)I9I1Lh&RJU-kR_#(zkp-Fm0c?Nb(DlR4Ri zu_6Wm*6y*iOYuBgr0$?`O&kd;4kn;M~@PjVW}n zQNR`{*Pc~686Hh$At#fcjjAypK!QFJsU{lXqo@}Jx3B~ygcD+@6?>GFdN|)2TS_`3 zSI=Ul#$D=E+q~$IZP^P>SoFfw`7^gDIvEq3mcCNeo;mWMZby`KC?`xgEeJ?ipXG5K zT()L_FoVbb})g+wovUSi>^ zxLBEbcvsTM)x1Z(P?tw(;gqm|H_<`q6G!^$9ZXo|nk@7{-#}mTFy{tu+fBo^aG>8D z0;4v&mEHh~>^)@9_6oh51fX1}g)58=+!r<_nS1CF)Ujl`xtgpNlXS7PjVRxKfwk%y zGR!6y<#}5Ha_!0Xx-!Ux)i_$KLSxV_NR4x0J-=q%#ETU;HePvUdA`cICu~nc z39TzrN^rw&&r*yoDsDHGmeOtWSB;{I3jCZa0Yd_oHzCg)PhH=k2=2%}~xU;YYfNnjPzN!RTms_7mM82w> z77GO9Dw9r+KBNDJLFIjsd?@xJGz?jD_u%~eekR{&FAs3NcZ?iKsF?TdcIzn?KJc&4 z;F5u(`%pb@K)T3SQBdldpLxDFF*I*2Qf%1Y*jwC~xE~fiE}qXw+sfp6VA_`Lqp+jLiq=7WSAcGWD7$O zw&xQJlFbY3rw;^O)uyM;Edp-nW>xeFfsM1J`upraU6cOZ#{Ph{JpgJ$qmDGI=JE|ms3)L<#QgFJ0P;(Dlv(V@b-;?s_ zrM8#qkq&Od*06BbatrYCwkcZ3WBb&!w9o$lax}>8g!mB<|YK zy9r(%EfHCLSI1{QG!0q0E&+ab)aJJuD+R#y-uWaE2hwc}eT>JETmtE{_Uwl3i zj&Gp2_l$ci{(WI5GTW2R3(oGD^ucjtItT$Oi{p`MB&=*mTcUXbJReH&D_o^01Rk@JrHRQg2u(L88k z`)CL=tX(mw#Gnn;i1*jF2X(=bk2?VsrZ2bPc1b!=Y;}ijPU7%pMQmm z2MchDvw{)`5So}otZUZ|M1jBpzc*5;N>~`Et0%@WQYMpj@;f-Gqz4t==MIXy)8O4? zm+JTc-NnY@jLK^j`nzYWqD#(hk#3_|@yMsj6H@}0($|XztIPx|xX^h{<%ee%A?w3TZIDBdeG|B^M#Lt<{eVm3s_2!UoGDV{*AfXCxzJmqLBCP_ zv^C+(Z)KN`7^Y|4m{_zU6WPSZ370-CD)C_w6rc$dT%EIg$5&i{tK|$eG>E{+g+8t( z=bl+5WI%?wvmrw(^BWG(A+%@%Tt!dxq3i3;&ncqSa`J2=Ia9Is=UrZAgooUjFQ8xt zl7qFdJtM@SdgDe7*i7E#V#EEFqt}~nXe0gMD&zUQPcpwG9=h9|3Eo5QksghE2cnE) zRkkUsD0I8cEpSiM+cP>2fwtEF_ zO9oQV=S?i-VY6a9CRWS)bN^kWDx5%$j~^q%FylBJ#0HVGUj~}3rr}vfSSY-Rw%=5w z2xm!P!Gc*9o~=XaY0Jh7Tc}-77~gd%GID1v9CO_;TavIbRL=TV%~?{7EJVm{fmbq)I}hoB ze~>9O{sf~!_PzmfkIs(VzekUDM7|EAHg+qaQl#y-?d!np;HA0=x>tL*rcuLH-097Z z=$gd?9_tRrANOgxa}SMgkOzXU~nQBF7){ zL7|C!0JWZg9aB_DnW9|q+J8=nZYIDN={HGIA(C9tZfZrk4**%1YKgL%%IPLO6Mis* zkNmTntcRcg%ApMXdArJk7O5(PM(Ovx{yL2vxtQJn3e1)yz{#Bn`yS>gig|S5DsF|| zj$9SrYV!eY$WfjQsatV=@#vet6nx@5!75>p_YGGbBvFJ!YAoOeg;%L2R+J!C7jLmB zYJZ7XcrkGo@G+!R@+I3am`MvUw|O2jO6Ay5k$bGI?>v6KNrcEuB5_pQ6j&^*-U2_} zIhJLR0-r)@mBU!vTohd=SxZWs;R^-~wm-Dn6Ui`zo^};E5Ne2`2OdObz27BZ=%a$D z-0;mQqUw_!S?#P8fjs**$zv9)t?S3V(~tY%nPr*ZTeESdGq)FkDK_9(wuQLbR0u@U z6o>cn2xM;Qh~y?ocDK{37t&3$LiOPtmHVt%kgoD&-)VAHPF;az6>+PUU+Yf+&lnMK(NqT74qeZFzZcyG0jnzwX)j1cOq-^6n9AK*~}ps>JT48a+Q=Tu*b* zt-da+b%j1hHu9V5KgQ~Jj6P}NJD;ajc Date: Tue, 6 Oct 2026 09:24:48 +0200 Subject: [PATCH 45/71] Add HoneyForge workbook logo SVG --- Workbooks/Images/Logos/HoneyForge.svg | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 Workbooks/Images/Logos/HoneyForge.svg diff --git a/Workbooks/Images/Logos/HoneyForge.svg b/Workbooks/Images/Logos/HoneyForge.svg new file mode 100644 index 00000000000..561462a008a --- /dev/null +++ b/Workbooks/Images/Logos/HoneyForge.svg @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file From 19ace02f802242333d22af41fabc818a26222c34 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 6 Oct 2026 09:25:12 +0200 Subject: [PATCH 46/71] Add HoneyForge workbook entry to WorkbooksMetadata.json --- Workbooks/WorkbooksMetadata.json | 46 +++++++++++++++++++++++--------- 1 file changed, 33 insertions(+), 13 deletions(-) diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index 3daba8e4dfc..bafa190b3d2 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -113,6 +113,26 @@ "subtitle": "", "provider": "Microsoft" }, + { + "workbookKey": "HoneyForgeWorkbook", + "logoFileName": "HoneyForge.svg", + "description": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment.", + "dataTypesDependencies": [ + "CommonSecurityLog" + ], + "dataConnectorsDependencies": [ + "CefAma" + ], + "previewImagesFileNames": [ + "HoneyForgeBlack.png", + "HoneyForgeWhite.png" + ], + "version": "1.0.0", + "title": "HoneyForge Threat Detection", + "templateRelativePath": "HoneyForge.json", + "subtitle": "", + "provider": "BUI" + }, { "workbookKey": "IdentityAndAccessWorkbook", "logoFileName": "Microsoft_logo.svg", @@ -329,7 +349,7 @@ "tier": "Community" }, "author": { - "name": "Tom\u00e1\u0161 Kubica" + "name": "Tomáš Kubica" }, "source": { "kind": "Community" @@ -5216,7 +5236,7 @@ { "workbookKey": "ThreatAnalysis&Response", "logoFileName": "Azure_Sentinel.svg", - "description": "The Defenders for IoT workbook provide guided investigations for OT entities based on open incidents, alert notifications, and activities for OT assets. They also provide a hunting experience across the MITRE ATT&CK\u00ae framework for ICS, and are designed to enable analysts, security engineers, and MSSPs to gain situational awareness of OT security posture.", + "description": "The Defenders for IoT workbook provide guided investigations for OT entities based on open incidents, alert notifications, and activities for OT assets. They also provide a hunting experience across the MITRE ATT&CK® framework for ICS, and are designed to enable analysts, security engineers, and MSSPs to gain situational awareness of OT security posture.", "dataTypesDependencies": [ "SecurityAlert" ], @@ -6425,7 +6445,7 @@ { "workbookKey": "MicrosoftExchangeSearchAdminAuditLog", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook is dedicated to On-Premises Exchange organizations. It uses the MSExchange Management event logs to give you a simple way to view administrators\u2019 activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Exchange Audit Event logs via Legacy Agent.", + "description": "This workbook is dedicated to On-Premises Exchange organizations. It uses the MSExchange Management event logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Exchange Audit Event logs via Legacy Agent.", "dataTypesDependencies": [ "ESIExchangeConfig_CL" ], @@ -6446,7 +6466,7 @@ { "workbookKey": "MicrosoftExchangeSearchAdminAuditLog-Online", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators\u2019 activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange).", + "description": "This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange).", "dataTypesDependencies": [ "OfficeActivity" ], @@ -6968,7 +6988,7 @@ { "workbookKey": "MicrosoftSentinelCostGBP", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook provides an estimated cost in GBP (\u00a3) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", + "description": "This workbook provides an estimated cost in GBP (£) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", "dataTypesDependencies": [], "dataConnectorsDependencies": [], "previewImagesFileNames": [ @@ -7124,7 +7144,7 @@ { "workbookKey": "MicrosoftSentinelCostEUR", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook provides an estimated cost in EUR (\u20ac) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", + "description": "This workbook provides an estimated cost in EUR (€) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", "dataTypesDependencies": [], "dataConnectorsDependencies": [], "previewImagesFileNames": [ @@ -7640,7 +7660,7 @@ { "workbookKey": "InsiderRiskManagementWorkbook", "logoFileName": "Azure_Sentinel.svg", - "description": "The Microsoft Insider Risk Management Workbook integrates telemetry from 25+ Microsoft security products to provide actionable insights into insider risk management. Reporting tools provide \u201cGo to Alert\u201d links to provide deeper integration between products and a simplified user experience for exploring alerts. ", + "description": "The Microsoft Insider Risk Management Workbook integrates telemetry from 25+ Microsoft security products to provide actionable insights into insider risk management. Reporting tools provide “Go to Alert” links to provide deeper integration between products and a simplified user experience for exploring alerts. ", "dataTypesDependencies": [ "SigninLogsSigninLogs", "AuditLogs", @@ -10810,7 +10830,7 @@ { "workbookKey": "HybridAttack-Cloud&Identity", "logoFileName": "Azure_Sentinel.svg", - "description": "Behavior-led hunting for a hybrid identity attack, end-to-end across 7 MITRE ATT&CK phases: Initial Access \u2192 Lateral Movement \u2192 Persistence \u2192 Discovery \u2192 Defense Evasion \u2192 Credential Access \u2192 Exfiltration. Each tile correlates Entra ID, Azure, on-prem AD, and Defender XDR signals.", + "description": "Behavior-led hunting for a hybrid identity attack, end-to-end across 7 MITRE ATT&CK phases: Initial Access → Lateral Movement → Persistence → Discovery → Defense Evasion → Credential Access → Exfiltration. Each tile correlates Entra ID, Azure, on-prem AD, and Defender XDR signals.", "dataTypesDependencies": [ "AADNonInteractiveUserSignInLogs", "AADServicePrincipalSignInLogs", @@ -10854,7 +10874,7 @@ "HybridAttack-Cloud&IdentityWhite.png" ], "version": "1.0.0", - "title": "Hybrid Attack \u2014 Cloud & Identity Kill-Chain (Preview)", + "title": "Hybrid Attack — Cloud & Identity Kill-Chain (Preview)", "templateRelativePath": "HybridAttack-Cloud&Identity.json", "subtitle": "", "provider": "Microsoft" @@ -11177,14 +11197,14 @@ "logoFileName": "DomainTools.svg", "description": "# DomainTools CCF workbook provides insights into domains flagged by DomainTools, their ingestion frequency, domain types.", "dataTypesDependencies": [ - "DomainToolsThreatIntelDomains_CL" + "DomainToolsThreatIntelDomains_CL" ], "dataConnectorsDependencies": [ - "DomainToolsCCFDefinition" + "DomainToolsCCFDefinition" ], "previewImagesFileNames": [ - "DomainToolsCCFWorkbookWhite.png", - "DomainToolsCCFWorkbookBlack.png" + "DomainToolsCCFWorkbookWhite.png", + "DomainToolsCCFWorkbookBlack.png" ], "version": "1.0", "title": "DomainTools Threat Intelligence CCF Dashboards", From 3230f405add49678ed8035c2672af8562d88c1bc Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 6 Oct 2026 11:43:15 +0200 Subject: [PATCH 47/71] Merge upstream master: resolve ValidConnectorIds.json conflict (365 upstream + HoneyForge) --- .../ValidConnectorIds.json | 726 +++++++++--------- 1 file changed, 367 insertions(+), 359 deletions(-) diff --git a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json index 66004099bc6..3e2965a06ff 100644 --- a/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json +++ b/.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json @@ -1,360 +1,368 @@ [ - "ContraForceEvents", - "AbnormalSecurityPush", - "Netclean_ProActive_Incidents", - "42CrunchAPIProtection", - "FortyTwoCrunchAPIProtection", - "AIVectraDetect", - "AIVectraStream", - "VectraXDR", - "AWS", - "AWSS3", - "AWSSecurityHub", - "Agari", - "AkamaiSecurityEvents", - "AlcideKAudit", - "AlsidForAD", - "Anvilogic", - "Armorblox", - "ApacheHTTPServer", - "ApacheTomcat", - "ARGOSCloudSecurity", - "AristaAwakeSecurity", - "ASimDnsActivityLogs", - "ArubaClearPass", - "AzureActiveDirectory", - "AzureActiveDirectoryIdentityProtection", - "AzureActivity", - "AzureAdvancedThreatProtection", - "AzureFirewall", - "AzureInformationProtection", - "AzureKeyVault", - "AzureKubernetes", - "AzureMonitor(IIS)", - "AzureMonitor(VMInsights)", - "AzureMonitor(WireData)", - "AzureNSG", - "AzureSecurityCenter", - "AzureSql", - "AzureStorageAccount", - "Barracuda", - "BarracudaCloudFirewall", - "BetterMTD", - "BehaviorAnalytics", - "BeyondSecuritybeSECURE", - "Bitglass", - "BitSight", - "BlackberryCylancePROTECT", - "blacklens_io", - "BloodHoundEnterprise", - "BoschAIShield", - "BoxDataConnector", - "BroadcomSymantecDLP", - "CEF", - "CheckPoint", - "CiscoASA", - "CiscoAsaAma", - "CiscoDuoActivityConnectorDefinition", - "CiscoDuoAuthConnectorDefinition", - "CiscoDuoSecurity", - "CiscoFirepowerEStreamer", - "CiscoISE", - "CiscoMeraki", - "CiscoSDWAN", - "CiscoSecureEndpoint", - "CiscoSEG", - "CiscoUCS", - "CiscoUmbrellaDataConnector", - "CiscoWSA", - "Citrix", - "CitrixWAF", - "Claroty", - "CloudflareDataConnector", - "CognniSentinelDataConnector", - "ContrastProtect", - "Corelight", - "CrowdStrikeFalconEndpointProtection", - "CyberArk", - "CyberArkEPM", - "CyberpionSecurityLogs", - "CynerioSecurityEvents", - "DDOS", - "DNS", - "Darktrace", - "DarktraceRESTConnector", - "DataminrPulseAlerts", - "Dataverse", - "DatawizaDapSolution", - "DigitalGuardianDLP", - "DigitalShadows", - "DomainTools", - "DragosSitestoreCCP", - "Dynamics365", - "Dynamics365Finance", - "EgressDefend", - "ESETEnterpriseInspector", - "ESETPROTECT", - "EsetSMC", - "ESI-ExchangeAdminAuditLogEvents", - "ExtraHopNetworks", - "F5", - "F5BigIp", - "FieldEffectCCF", - "Flare", - "ForcepointCasb", - "ForcepointDlp", - "ForcepointNgfw", - "ForgeRock", - "Fortinet", - "FortiWeb", - "GCPDNSDataConnector", - "GoogleSCCDefinition", - "GWorkspaceRAPI", - "GoogleWorkspaceReportsAPI", - "GoogleThreatIntelligenceRelevanceSystemAlertsAPI", - "GravityZoneDataConnector", - "GreyNoise2SentinelAPI", - "IdentityInfo", - "ibossAma", - "ImpervaWAFCloudAPI", - "ImpervaWAFGateway", - "ImportedConnector", - "InfobloxCloudDataConnector", - "InfobloxNIOS", - "IoT", - "JamfProtect", - "JiraAuditAPI", - "JuniperSRX", - "KeeperSecurityPush2", - "LastPass", - "LookoutAPI", - "LumenThreatFeedConnector", - "McAfeeePO", - "MicrosoftAzurePurview", - "MicrosoftCloudAppSecurity", - "MicrosoftCopilot", - "MicrosoftDefenderAdvancedThreatProtection", - "MicrosoftSysmonForLinux", - "MicrosoftThreatProtection", - "MimecastSEGAPI", - "MorphisecCCF", - "NasuniEdgeAppliance", - "NXLogDnsLogs", - "NXLogLinuxAudit", - "Netskope", - "Office365", - "OfficeATP", - "OktaSSO", - "OktaSSOv2", - "OnapsisPlatform", - "OneIdentity", - "OCILogs", - "OracleDatabaseAudit", - "OracleCloudInfraConnector", - "OracleCloudInfrastructureLogsConnector", - "OracleWebLogicServer", - "OrcaSecurityAlerts", - "PaloAltoCDL", - "PaloAltoNetworks", - "PaloAltoPrismaCloud", - "Pathlock_TDnR", - "Perimeter81ActivityLogs", - "PingFederate", - "PostgreSQL", - "PowerAutomate", - "PowerPlatformAdmin", - "PRODAFTUstaATPCCPDefinition", - "PRODAFTUstaPCFICCPDefinition", - "ProofpointPOD", - "ProofpointTAP", - "ProofpointTAPNativePoller", - "ProofpointTAPv2", - "PulseConnectSecure", - "QscoutAppEventsCCFDefinition", - "QualysKB", - "QualysVulnerabilityManagement", - "RedCanary_ConnectorDefinition", - "RedCanaryDataConnector", - "RedSiftPush", - "RubrikSecurityCloudAzureFunctions", - "SailPointIdentityNow", - "SailPointIdentityNowConnector", - "SalesforceServiceCloud", - "SalesforceServiceCloudCCPDefinition", - "SAP", - "SAPBTPAuditEvents", - "SAPLogServ", - "SAPETDAlerts", - "SecurityEvents", - "SemperisDSP", - "SenservaPro", - "SentinelOne", - "SlackAuditAPI", - "Snowflake", - "SonicWallFirewall", - "SonraiDataConnector", - "SophosCloudOptix", - "SophosXGFirewall", - "StealthTalkAnomalousAuth", - "SpyCloudEnterpriseProtectionCCF", - "SquadraTechnologiesSecRmm", - "SquidProxy", - "Symantec", - "SymantecEndpointProtection", - "SymantecProxySG", - "SymantecVIP", - "Syslog", - "Tenable.ad", - "TenableVM", - "TenableIE", - "ThreatIntelligence", - "ThreatIntelligenceTaxii", - "ThreatIntelligenceUploadIndicatorsAPI", - "DelineaSecretServer_CEF", - "TrendAIVisionOneOAT", - "TrendAIVisionOneWorkbench", - "TrendMicro", - "TrendMicroApexOne", - "TrendMicroCAS", - "TrendMicroTippingPoint", - "TrendMicroXDR", - "UbiquitiUnifi", - "vArmourAC", - "VMwareCarbonBlack", - "vCenter", - "VMwareESXi", - "VMwareSDWAN", - "WAF", - "WindowsFirewall", - "WindowsForwardedEvents", - "WireX_Systems_NFP", - "ZimperiumMtdAlerts", - "Zscaler", - "ZscalerPrivateAccess", - "illusiveAttackManagementSystem", - "WindowsSecurityEvents", - "IronNetIronDefense", - "GCPIAMDataConnector", - "Illusive", - "NGINXHTTPServer", - "ZeroNetworksSegmentAuditFunction", - "ZeroNetworksSegmentAuditNativePoller", - "Theom", - "Votiro", - "ISCBind", - "DynatraceRuntimeVulnerabilities", - "DynatraceAttacks", - "DynatraceAuditLogs", - "DynatraceProblems", - "DynatraceAttacksCCPDefinition", - "DTAttacksV3CCPDefinition", - "DTRunVulnCCPDefinition", - "DTRunVulnV3CCPDefinition", - "DynatraceProblemsCCPDefinition", - "DTProblemsV3CCPDefinition", - "Authomize", - "MicrosoftDefenderThreatIntelligence", - "ZeroFox_Alert_Polling", - "CortexXDR", - "CortexXDRDataConnector", - "CorelightConnectorExporter", - "MimecastSIEMAPI", - "MimecastTTPAPI", - "MimecastAuditAPI", - "PingFederateAma", - "vArmourACAma", - "ContrastProtectAma", - "InfobloxCloudDataConnectorAma", - "ClarotyAma", - "illusiveAttackManagementSystemAma", - "TrendMicroApexOneAma", - "PaloAltoCDLAma", - "CiscoSEGAma", - "AtlassianBeaconAlerts", - "GCPAuditLogsDefinition", - "PrancerLogData", - "MicrosoftDefenderForCloudTenantBased", - "RidgeBotDataConnector", - "ValenceSecurity", - "HVPollingIDAzureFunctions", - "CBSPollingIDAzureFunctions", - "AzureCloudNGFWByPaloAltoNetworks", - "PaloAltoNetworksAma", - "FortinetAma", - "CrowdStrikeFalconEndpointProtectionAma", - "AIVectraDetectAma", - "ZscalerAma", - "SyslogAma", - "FortinetFortiWebAma", - "InfobloxSOCInsightsDataConnector_API", - "InfobloxSOCInsightsDataConnector_Legacy", - "InfobloxSOCInsightsDataConnector_AMA", - "NetskopeDataConnector", - "NetskopeWebTransactionsDataConnector", - "NetskopeAlertEventsConnector", - "CefAma", - "WindowsFirewallAma", - "1Password", - "RadiflowIsid", - "CustomLogsAma", - "SilverfortAma", - "SynqlyIntegrationConnector", - "IllumioSaaSDataConnector", - "CTERA", - "Workday", - "SamsungDCDefinition", - "CommvaultSecurityIQ_CL", - "CommvaultSecurityIQConnector", - "ExtraHop", - "ContrastADR", - "CyfirmaAttackSurfaceAlertsConnector", - "CyfirmaBrandIntelligenceAlertsDC", - "CyfirmaDigitalRiskAlertsConnector", - "CyfirmaVulnerabilitiesIntelDC", - "CyfirmaCyberIntelligenceDC", - "VeeamCustomTablesDataConnector", - "CyfirmaCompromisedAccountsDataConnector", - "RSAIDPlus_AdminLogs_Connector", - "FilewallM365", - "TacitRedThreatIntel", - "CyrenThreatIntel", - "SpeculusThreatIntel", - "CybleVisionAlerts", - "VersasecCms", - "VisaThreatIntelligence", - "KnowBe4Defend", - "CTM360CBSConnectorDefinition", - "CTM360HackerViewConnectorDefinition", - "XbowSecurityConnector", - "NetskopeWebTxConnector", - "SOCPrimeAuditLogsDataConnector", - "ContrastADRCCF", - "DarktraceActiveAISecurityPlatform", - "CheckPointCyberintAlerts", - "CheckPointCyberintIOC", - "CheckpointHECConnection", - "D3SOARConnectorDefinition", - "ValimailEnforce", - "VaikoraSentinel", - "VaikoraSecurityCenter", - "UniFiSiteManagerConnectorDefinition", - "UtimacoESKMConnector", - "GSDetectionAlerts", - "VaikoraSecurityCenter", - "VaikoraO365", - "GambitSecurityPush", - "TailscaleCCF", - "TailscalePremiumCCF", - "WhisperSecurityConnector", - "CayosoftGuardianConnector", - "GTIVulnerabilitiesConnector", - "VaronisSaaSAlertsPush", - "RecordedFutureIdentityAlertImporter", - "ThinkstCanary", - "VectraRUXConnector", - "cybereinforce_cte", - "UniqkeyEventsConnector", - "StratoSecurePush", - "CatoNetworksEventsPush", - "HoneyForge" -] + "1Password", + "42CrunchAPIProtection", + "AIVectraDetect", + "AIVectraDetectAma", + "AIVectraStream", + "ARGOSCloudSecurity", + "ASimDnsActivityLogs", + "AWS", + "AWSS3", + "AWSSecurityHub", + "AbnormalSecurityPush", + "Agari", + "AkamaiSecurityEvents", + "AlcideKAudit", + "AlsidForAD", + "Anvilogic", + "ApacheHTTPServer", + "ApacheTomcat", + "AristaAwakeSecurity", + "Armorblox", + "ArubaClearPass", + "AtlassianBeaconAlerts", + "Authomize", + "AzureActiveDirectory", + "AzureActiveDirectoryIdentityProtection", + "AzureActivity", + "AzureAdvancedThreatProtection", + "AzureCloudNGFWByPaloAltoNetworks", + "AzureFirewall", + "AzureInformationProtection", + "AzureKeyVault", + "AzureKubernetes", + "AzureMonitor(IIS)", + "AzureMonitor(VMInsights)", + "AzureMonitor(WireData)", + "AzureNSG", + "AzureSecurityCenter", + "AzureSql", + "AzureStorageAccount", + "Barracuda", + "BarracudaCloudFirewall", + "BehaviorAnalytics", + "BetterMTD", + "BeyondSecuritybeSECURE", + "BitSight", + "Bitglass", + "BlackberryCylancePROTECT", + "BloodHoundEnterprise", + "BoschAIShield", + "BoxDataConnector", + "BroadcomSymantecDLP", + "CBSPollingIDAzureFunctions", + "CEF", + "CTERA", + "CTM360CBSConnectorDefinition", + "CTM360HackerViewConnectorDefinition", + "CatoNetworksEventsPush", + "CayosoftGuardianConnector", + "CefAma", + "CheckPoint", + "CheckPointCyberintAlerts", + "CheckPointCyberintIOC", + "CheckpointHECConnection", + "CiscoASA", + "CiscoAsaAma", + "CiscoDuoActivityConnectorDefinition", + "CiscoDuoAuthConnectorDefinition", + "CiscoDuoSecurity", + "CiscoFirepowerEStreamer", + "CiscoISE", + "CiscoMeraki", + "CiscoSDWAN", + "CiscoSEG", + "CiscoSEGAma", + "CiscoSecureEndpoint", + "CiscoUCS", + "CiscoUmbrellaDataConnector", + "CiscoWSA", + "Citrix", + "CitrixWAF", + "Claroty", + "ClarotyAma", + "CloudflareDataConnector", + "CognniSentinelDataConnector", + "CommvaultSecurityIQConnector", + "CommvaultSecurityIQ_CL", + "ContraForceEvents", + "ContrastADR", + "ContrastADRCCF", + "ContrastProtect", + "ContrastProtectAma", + "Corelight", + "CorelightConnectorExporter", + "CortexXDR", + "CortexXDRDataConnector", + "CrowdStrikeFalconEndpointProtection", + "CrowdStrikeFalconEndpointProtectionAma", + "CustomLogsAma", + "CyberArk", + "CyberArkEPM", + "CyberpionSecurityLogs", + "CybleVisionAlerts", + "CyfirmaAttackSurfaceAlertsConnector", + "CyfirmaBrandIntelligenceAlertsDC", + "CyfirmaCompromisedAccountsDataConnector", + "CyfirmaCyberIntelligenceDC", + "CyfirmaDigitalRiskAlertsConnector", + "CyfirmaVulnerabilitiesIntelDC", + "CynerioSecurityEvents", + "CyrenThreatIntel", + "D3SOARConnectorDefinition", + "DDOS", + "DNS", + "DTAttacksV3CCPDefinition", + "DTProblemsV3CCPDefinition", + "DTRunVulnCCPDefinition", + "DTRunVulnV3CCPDefinition", + "Darktrace", + "DarktraceActiveAISecurityPlatform", + "DarktraceRESTConnector", + "DataminrPulseAlerts", + "Dataverse", + "DatawizaDapSolution", + "DelineaPlatformConnector", + "DelineaSecretServer_CEF", + "DigitalGuardianDLP", + "DigitalShadows", + "DomainTools", + "DragosSitestoreCCP", + "Dynamics365", + "Dynamics365Finance", + "DynatraceAttacks", + "DynatraceAttacksCCPDefinition", + "DynatraceAuditLogs", + "DynatraceProblems", + "DynatraceProblemsCCPDefinition", + "DynatraceRuntimeVulnerabilities", + "ESETEnterpriseInspector", + "ESETPROTECT", + "ESI-ExchangeAdminAuditLogEvents", + "EgressDefend", + "EsetSMC", + "ExtraHop", + "ExtraHopNetworks", + "F5", + "F5BigIp", + "FieldEffectCCF", + "FilewallM365", + "Flare", + "ForcepointCasb", + "ForcepointDlp", + "ForcepointNgfw", + "ForgeRock", + "FortiWeb", + "Fortinet", + "FortinetAma", + "FortinetFortiNdrCloudDataConnector", + "FortinetFortiWebAma", + "FortyTwoCrunchAPIProtection", + "GCPAuditLogsDefinition", + "GCPDNSDataConnector", + "GCPIAMDataConnector", + "GSDetectionAlerts", + "GTIVulnerabilitiesConnector", + "GWorkspaceRAPI", + "GambitSecurityPush", + "GoogleSCCDefinition", + "GoogleThreatIntelligenceRelevanceSystemAlertsAPI", + "GoogleWorkspaceReportsAPI", + "GravityZoneDataConnector", + "GreyNoise2SentinelAPI", + "HVPollingIDAzureFunctions", + "HoneyForge", + "ISCBind", + "IdentityInfo", + "IllumioSaaSDataConnector", + "Illusive", + "ImpervaWAFCloudAPI", + "ImpervaWAFGateway", + "ImportedConnector", + "InfobloxCloudDataConnector", + "InfobloxCloudDataConnectorAma", + "InfobloxNIOS", + "InfobloxSOCInsightsDataConnector_AMA", + "InfobloxSOCInsightsDataConnector_API", + "InfobloxSOCInsightsDataConnector_Legacy", + "IoT", + "IronNetIronDefense", + "JamfProtect", + "JiraAuditAPI", + "JuniperSRX", + "KeeperSecurityPush2", + "KnowBe4Defend", + "LastPass", + "LookoutAPI", + "LumenThreatFeedConnector", + "McAfeeePO", + "MicrosoftAzurePurview", + "MicrosoftCloudAppSecurity", + "MicrosoftCopilot", + "MicrosoftDefenderAdvancedThreatProtection", + "MicrosoftDefenderForCloudTenantBased", + "MicrosoftDefenderThreatIntelligence", + "MicrosoftSysmonForLinux", + "MicrosoftThreatProtection", + "MimecastAuditAPI", + "MimecastSEGAPI", + "MimecastSIEMAPI", + "MimecastTTPAPI", + "MorphisecCCF", + "NGINXHTTPServer", + "NXLogDnsLogs", + "NXLogLinuxAudit", + "NasuniEdgeAppliance", + "Netclean_ProActive_Incidents", + "Netskope", + "NetskopeAlertEventsConnector", + "NetskopeAlertsEvents", + "NetskopeClientStatus", + "NetskopeDataConnector", + "NetskopeWebTransactionsDataConnector", + "NetskopeWebTxConnector", + "OCILogs", + "Office365", + "OfficeATP", + "OktaSSO", + "OktaSSOv2", + "OnapsisPlatform", + "OneIdentity", + "OracleCloudInfraConnector", + "OracleCloudInfrastructureLogsConnector", + "OracleDatabaseAudit", + "OracleWebLogicServer", + "OrcaSecurityAlerts", + "PRODAFTUstaATPCCPDefinition", + "PRODAFTUstaIoCUploadIndicators", + "PRODAFTUstaPCFICCPDefinition", + "PaloAltoCDL", + "PaloAltoCDLAma", + "PaloAltoNetworks", + "PaloAltoNetworksAma", + "PaloAltoPrismaCloud", + "Pathlock_TDnR", + "Perimeter81ActivityLogs", + "PingFederate", + "PingFederateAma", + "PostgreSQL", + "PowerAutomate", + "PowerPlatformAdmin", + "PrancerLogData", + "ProofpointPOD", + "ProofpointTAP", + "ProofpointTAPNativePoller", + "ProofpointTAPv2", + "PulseConnectSecure", + "QscoutAppEventsCCFDefinition", + "QualysKB", + "QualysVulnerabilityManagement", + "RSAIDPlus_AdminLogs_Connector", + "RadiflowIsid", + "RecordedFuture", + "RecordedFutureIdentityAlertImporter", + "RedCanaryDataConnector", + "RedCanary_ConnectorDefinition", + "RedSiftPush", + "RidgeBotDataConnector", + "RubrikSecurityCloudAzureFunctions", + "SAP", + "SAPBTPAVL", + "SAPBTPAuditEvents", + "SAPETDAlerts", + "SAPLogServ", + "SOCPrimeAuditLogsDataConnector", + "SailPointIdentityNow", + "SailPointIdentityNowConnector", + "SalesforceServiceCloud", + "SalesforceServiceCloudCCPDefinition", + "SamsungDCDefinition", + "SecurityEvents", + "SemperisDSP", + "SenservaPro", + "SentinelOne", + "SilverfortAma", + "SlackAuditAPI", + "Snowflake", + "SonicWallFirewall", + "SonraiDataConnector", + "SophosCloudOptix", + "SophosXGFirewall", + "SpeculusThreatIntel", + "SpyCloudEnterpriseProtectionCCF", + "SquadraTechnologiesSecRmm", + "SquidProxy", + "StealthTalkAnomalousAuth", + "StratoSecurePush", + "Symantec", + "SymantecEndpointProtection", + "SymantecProxySG", + "SymantecVIP", + "SynqlyIntegrationConnector", + "Syslog", + "SyslogAma", + "TacitRedThreatIntel", + "TailscaleCCF", + "TailscalePremiumCCF", + "Tenable.ad", + "TenableIE", + "TenableVM", + "Theom", + "ThinkstCanary", + "ThreatIntelligence", + "ThreatIntelligenceTaxii", + "ThreatIntelligenceUploadIndicatorsAPI", + "TrendAIVisionOneOAT", + "TrendAIVisionOneWorkbench", + "TrendMicro", + "TrendMicroApexOne", + "TrendMicroApexOneAma", + "TrendMicroCAS", + "TrendMicroTippingPoint", + "TrendMicroXDR", + "UbiquitiUnifi", + "UniFiSiteManagerConnectorDefinition", + "UniqkeyEventsConnector", + "UtimacoESKMConnector", + "VMwareCarbonBlack", + "VMwareESXi", + "VMwareSDWAN", + "VaikoraO365", + "VaikoraSecurityCenter", + "VaikoraSecurityCenter", + "VaikoraSentinel", + "ValenceSecurity", + "ValenceSecurityCcfPush", + "ValimailEnforce", + "VaronisSaaSAlertsPush", + "VectraRUXConnector", + "VectraXDR", + "VeeamCustomTablesDataConnector", + "VersasecCms", + "VisaThreatIntelligence", + "Votiro", + "WAF", + "WhisperSecurityConnector", + "WindowsFirewall", + "WindowsFirewallAma", + "WindowsForwardedEvents", + "WindowsSecurityEvents", + "WireX_Systems_NFP", + "Workday", + "XbowSecurityConnector", + "ZeroFox_Alert_Polling", + "ZeroNetworksSegmentAuditFunction", + "ZeroNetworksSegmentAuditNativePoller", + "ZimperiumMtdAlerts", + "Zscaler", + "ZscalerAma", + "ZscalerPrivateAccess", + "blacklens_io", + "cybereinforce_cte", + "ibossAma", + "illusiveAttackManagementSystem", + "illusiveAttackManagementSystemAma", + "vArmourAC", + "vArmourACAma", + "vCenter" +] \ No newline at end of file From 9c9a3176657ececf18efaaa087690bec6fba451f Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Thu, 8 Oct 2026 09:38:02 +0200 Subject: [PATCH 48/71] Fix: add MITRE relevantTechniques to analytic rule YAML source --- .../HoneyForge_DeceptionSensorInteraction.yaml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml index 87d79db5e33..84213891b8c 100644 --- a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml +++ b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml @@ -21,7 +21,11 @@ triggerThreshold: 0 tactics: - Reconnaissance - InitialAccess -relevantTechniques: [] +relevantTechniques: + - T1595 + - T1590 + - T1190 + - T1133 query: | CommonSecurityLog | where DeviceVendor =~ "BUI" From d8a8020438ee0c1fc83e2a79b74a08d9ba31f1d1 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Thu, 8 Oct 2026 09:39:12 +0200 Subject: [PATCH 49/71] Fix: add MITRE relevantTechniques to analytic rule YAML source From 20c319014a94492873d0cb1cd8e5fd3fc5bc865b Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Thu, 8 Oct 2026 09:39:57 +0200 Subject: [PATCH 50/71] Repackage: rebuild Package.zip with MITRE techniques in mainTemplate From fdacb4c9c70aad51b18caf7bd6a99e6f739ee26d Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:04:52 +0200 Subject: [PATCH 51/71] Fix: add MITRE relevantTechniques to HoneyForge_FleetCoverage.yaml --- .../HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml index f08b675ef2a..890d636334b 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml @@ -12,7 +12,9 @@ requiredDataConnectors: dataTypes: - CommonSecurityLog tactics: [] -relevantTechniques: [] +relevantTechniques: + - T1595 + - T1590 query: | let lookback = 30d; let offlineThreshold = 10m; From 2c4bef8d4010c3896be395f39bf1e36a50a21711 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:04:55 +0200 Subject: [PATCH 52/71] Fix: add MITRE relevantTechniques to HoneyForge_HighFrequency.yaml --- .../HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml index af685ba69ee..1ccb93d0c95 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml @@ -16,7 +16,9 @@ requiredDataConnectors: tactics: - Reconnaissance - LateralMovement -relevantTechniques: [] +relevantTechniques: + - T1595 + - T1190 query: | let lookback = 24h; let burstWindow = 10m; From a7cf29ddb208b9e1e0c37ed074686b5f4cad89e7 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:04:57 +0200 Subject: [PATCH 53/71] Fix: add MITRE relevantTechniques to HoneyForge_OffHoursActivity.yaml --- .../Hunting Queries/HoneyForge_OffHoursActivity.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml index f8e429ac97b..694ac29c5b4 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml @@ -16,7 +16,9 @@ requiredDataConnectors: tactics: - Reconnaissance - LateralMovement -relevantTechniques: [] +relevantTechniques: + - T1595 + - T1133 query: | let lookback = 7d; let businessStart = 7; // 07:00 UTC From 24cc7e5b41e15118e3836c3f785a0c95191d0466 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:04:59 +0200 Subject: [PATCH 54/71] Fix: add MITRE relevantTechniques to HoneyForge_RepeatedProbes.yaml --- .../HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml index 514b2566cf0..e69938a9225 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_RepeatedProbes.yaml @@ -13,7 +13,9 @@ requiredDataConnectors: - CommonSecurityLog tactics: - Reconnaissance -relevantTechniques: [] +relevantTechniques: + - T1595 + - T1590 query: | let lookback = 14d; let minSessionGap = 1h; From c693e3e89ae90d6e9664753bccb0ab4afe4c3976 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:05:01 +0200 Subject: [PATCH 55/71] Fix: add MITRE relevantTechniques to HoneyForge_TopAttackingSources.yaml --- .../Hunting Queries/HoneyForge_TopAttackingSources.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml index 3102049a56c..60f8da9ae6f 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml @@ -14,7 +14,9 @@ requiredDataConnectors: - CommonSecurityLog tactics: - Reconnaissance -relevantTechniques: [] +relevantTechniques: + - T1595 + - T1590 query: | CommonSecurityLog | where TimeGenerated >= ago(7d) From 86ccde397eadc41f5a28fb36f800d6632a382b10 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:05:14 +0200 Subject: [PATCH 56/71] Add ReleaseNotes.md for HoneyForge solution --- Solutions/HoneyForge/ReleaseNotes.md | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 Solutions/HoneyForge/ReleaseNotes.md diff --git a/Solutions/HoneyForge/ReleaseNotes.md b/Solutions/HoneyForge/ReleaseNotes.md new file mode 100644 index 00000000000..2cbab5e1951 --- /dev/null +++ b/Solutions/HoneyForge/ReleaseNotes.md @@ -0,0 +1,3 @@ +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|------------|-------------------------------|-------------------| +| 3.0.0 | 09-10-2026 | Initial release of HoneyForge Threat Detection solution | From 48472a1952da9bdabb32b9bb37829f5b5251329a Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:51:40 +0200 Subject: [PATCH 57/71] fix: rename customDetails keys and remove empty groupByAlertDetails to pass ARM-TTK --- .../HoneyForge_DeceptionSensorInteraction.yaml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml index 84213891b8c..07db4e777b9 100644 --- a/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml +++ b/Solutions/HoneyForge/Analytic Rules/HoneyForge_DeceptionSensorInteraction.yaml @@ -105,10 +105,9 @@ incidentConfiguration: matchingMethod: Selected groupByEntities: - IP - groupByAlertDetails: [] groupByCustomDetails: - - CustomerID - - SensorID + - Customer + - Sensor eventGroupingSettings: aggregationKind: AlertPerResult alertDetailsOverride: @@ -117,8 +116,8 @@ alertDetailsOverride: HoneyForge detected {{EventCount}} event(s) targeting {{DstIpAddr}} using {{ProtocolList}}. Treat this activity as unauthorised until validated. customDetails: - CustomerID: CustomerID - SensorID: SensorID + Customer: CustomerID + Sensor: SensorID SensorName: SensorName EventType: EventType Activity: ActivityList From 69794e8c5d5ba345ba19214e4d68f324495046e5 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:52:13 +0200 Subject: [PATCH 58/71] =?UTF-8?q?fix:=20rename=20customDetails=20keys=20(C?= =?UTF-8?q?ustomerID=E2=86=92Customer,=20SensorID=E2=86=92Sensor)=20and=20?= =?UTF-8?q?remove=20empty=20groupByAlertDetails=20to=20pass=20ARM-TTK?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../HoneyForge/Package/mainTemplate.json | 49 +++++++++---------- 1 file changed, 24 insertions(+), 25 deletions(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index 4f2754a23a9..cb0da6170b8 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -122,7 +122,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -197,7 +197,7 @@ "id": "[variables('_uiConfigId1')]", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -209,15 +209,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -279,7 +279,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -296,11 +296,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -316,7 +316,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ] } @@ -403,7 +403,7 @@ "connectorUiConfig": { "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "graphQueries": [ { "metricName": "Total events received", @@ -427,15 +427,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -483,7 +483,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -500,11 +500,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -520,7 +520,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ], "id": "[variables('_uiConfigId1')]" @@ -606,11 +606,11 @@ "FirstSeen": "FirstSeen", "EventCount": "EventCount", "DeviceVersion": "DeviceVersionList", - "CustomerID": "CustomerID", + "Customer": "CustomerID", "LastSeen": "LastSeen", "SensorName": "SensorName", "Activity": "ActivityList", - "SensorID": "SensorID", + "Sensor": "SensorID", "Protocol": "ProtocolList", "EventType": "EventType", "DestinationPorts": "DestinationPortList", @@ -626,10 +626,9 @@ "lookbackDuration": "4h", "matchingMethod": "Selected", "groupByCustomDetails": [ - "CustomerID", - "SensorID" + "Customer", + "Sensor" ], - "groupByAlertDetails": [], "reopenClosedIncident": false, "groupByEntities": [ "IP" @@ -1099,7 +1098,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "HoneyForge", "publisherDisplayName": "BUI", - "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", + "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From 25b96eb07a760f4496af5aeacb2716b12428f5d4 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Fri, 9 Oct 2026 11:54:16 +0200 Subject: [PATCH 59/71] fix: rebuild Package.zip with ARM-TTK fixes (rename customDetails keys, remove empty groupByAlertDetails) --- Solutions/HoneyForge/Package/Package.zip | Bin 97856 -> 97975 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip index 0b0f6d2221394100f4212390a0b1e62e1e40af59..a5cb8851a795fbc538a35e32fd378f57053b2006 100644 GIT binary patch delta 750 zcmX@`hjsg3RKO-AbIzhZY@fI@EBu zY4aK-cR{`8LmPnH`B1z_!9Oo2GcPqJCPqm|0Yn}~D3}7&BWRK-hh#);Pzf`FJGrn+ zaZ)(v$=*Go2sIj$&-VynsM~x#Vy^%~ zbaQ{E1`C2a`SctlTQnwX&AkPcYy-NLFF%x#2kzZNQxql}=7~E^xjGZ{hd z(VnF`c|iyZ(6JJe9b#A~f5_6FJYkl`ojCWP?j({n6g8X>;5W}IA`$u;@F99DiK1z@~E;~DDl&H3}c zBgNI`%*8C?lk<0N*sQp_mw9>-2csy+-)zCDdByoflQ%5X+pNETcQwMk>2IwVrz5!A z+pQTV@$<+dC9mzW-i$Mi)X-BOELB2iSX!KZrIt}w3ZxwY;(+NDE)O(Je7aU0BM;XU LpbFkPMj#0QQu;df delta 596 zcmdn~m-WCOR=EIgW)=|!7`Rw$dGCT3BLfHv0tGj!bt^G1I@GXvmy)}n+=fH*fpC$6 ze_l>zUTRECjFOH5h&&9En6g>lBvTHocwtZpGl((yVwd7%g+-i`3woO;pAK6977OT= zhl+JgR*P7NEVj9zH+EJ=}Zk4Fyl{dAR~~` zwmB?66vSwle0#n*P^0^1qe4N55}#5*0kGPIL57T*r?(kGgfDjKLNo;Qt^!&gI{m%} zqr&tAR!08GroBR74FSE5JYX|VXL?RvFj-)-PS(oFceB){K427^d~c!Jq-fU3G1=;q zyR$VX@5xpLxpT5YHpg_mC`PW$b7#+mnExl&0Lkp)yjwscLGHC?oP1zD#G>2t`N58w z>{F^X`P?nu$vMS5li9pQHoGm^D8}UJGWq+i4M1x1^4-16lbLsmgDm#j&jylFOcw*$ z3lxz^FUl`1aH@37Ni8aINi9jt%qdo~QizV79Qay%bJPCa)hxj9IW&EtFQeG>SZl@x zkk__9vu2#c&ms7RA&_ze_zz4X)4S>zmAP7gg3D?d Gfg}J(E8ejH From c4dbf45a7e81ea8ba63cd9bf19191ee8df074f81 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 13 Oct 2026 07:39:25 +0200 Subject: [PATCH 60/71] =?UTF-8?q?fix:=20correct=20MITRE=20ATT&CK=20tactic?= =?UTF-8?q?=20LateralMovement=20=E2=86=92=20InitialAccess=20for=20T1190?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../HoneyForge/Package/mainTemplate.json | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index cb0da6170b8..1bc262fd796 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -122,7 +122,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -197,7 +197,7 @@ "id": "[variables('_uiConfigId1')]", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -209,15 +209,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -279,7 +279,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -296,11 +296,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -316,7 +316,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ] } @@ -403,7 +403,7 @@ "connectorUiConfig": { "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "graphQueries": [ { "metricName": "Total events received", @@ -427,15 +427,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -483,7 +483,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -500,11 +500,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -520,7 +520,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ], "id": "[variables('_uiConfigId1')]" @@ -798,7 +798,7 @@ }, { "name": "tactics", - "value": "Reconnaissance,LateralMovement" + "value": "Reconnaissance,InitialAccess" } ] } @@ -879,7 +879,7 @@ }, { "name": "tactics", - "value": "Reconnaissance,LateralMovement" + "value": "Reconnaissance,InitialAccess" } ] } @@ -1098,7 +1098,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "HoneyForge", "publisherDisplayName": "BUI", - "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", + "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From 36889b9621b4675537dbd68a993eee6fb0b8867d Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 13 Oct 2026 07:40:12 +0200 Subject: [PATCH 61/71] =?UTF-8?q?fix:=20correct=20MITRE=20ATT&CK=20tactic?= =?UTF-8?q?=20LateralMovement=20=E2=86=92=20InitialAccess=20for=20T1190=20?= =?UTF-8?q?(repackage)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Solutions/HoneyForge/Package/Package.zip | Bin 97975 -> 98261 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip index a5cb8851a795fbc538a35e32fd378f57053b2006..66fb4215f5af8ab65da8730b79dbac48ff6bd53e 100644 GIT binary patch delta 957 zcmdn~m-Xs@R*3*_W)=|!5cqB58yj5TSYq$P$YAfYQDU}|VDsUoLyHbKA8G>94Ip~+ z4kd3vNs#acsPKGbdNPlR1XkH8V9mNFxpG*{oF7!dj43?%e3$ZMg+-i`3woO;pAK7u zMTK9lB2-1!WVMJ5xK(T}=nZ9@te?&~`9qTMHlOb@#AdHw?;2o`gigQj!Kg4jft8VevT3gfru#Pg^}6z43Qss%~G5CfKhDny@hI%qFE=$WUEi^&eoi~CtDR1l9Ls(Ii~AHF>-C5 zJ9|DBmuz;NYl|uj3ol#7$p_|RbJNZF*urY_$Ho2byq*ZX#l@2q(?uq4 z$Q7CtBQSYG>6FQ*uRfYA@SbJzf=}X`!`}W7C8&CO9S@`Qb`@4eX)_Uwv<^(<(--;LAmCC)Pn^TMhpxfEYH9&y|Io_Vf$=vMiwU4!;20zfQ@N^ pFt@AwF@DnLL(OZ`)$1576|k5D&X*9P%x8K-9it(ec0D6d005ee&LRK+ delta 661 zcmccmpLP3RR*3*_W)=|!7*Lj7$gb|q$e`}MQDU|d>!QO=hZ;5?QSuhl+5lwEhvG#F z{&_i>d8simF-kfLAo6hYA((1U?vsTgMNnloCqy0)fa*2O(qVzhD$X<7ydX~*VpQAa{Q0(w zV6*tMxcGxhQVSG}6o9S*`(X0L1(qPQH}5MHhH3x0L}RkU9FEBfo&u9UxU)?DpDF}o z%TMmh<(quKrF`?9GHHIOr5tT(tWZl6!jz}yXfmo!-VoM5xi^;|s8n!r!c>9D?crKb z)dzcA5Z+re`E}&!>G^StJd>X@*(elLg!aHXonm$qd!4IL{X0 zBUm_XzPJG9?#*A9^tB$lKWCFc0%m!;;W=9Nq~3>N`=ay3vmwmwe{2|A_<2D|q;E#aq#`2*hNA7gK8#vSOph9- z@9|@70n*!D{TV;$^MMp0($I9*dPYkHkQiJeP_sNp01o23r_ZZrG-TtgV+4u;0J) Date: Tue, 13 Oct 2026 08:33:22 +0200 Subject: [PATCH 62/71] fix: remove incorrect LateralMovement tactic from HoneyForge_HighFrequency hunting query --- .../HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml index 1ccb93d0c95..cbaea89ce02 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_HighFrequency.yaml @@ -15,7 +15,6 @@ requiredDataConnectors: - CommonSecurityLog tactics: - Reconnaissance - - LateralMovement relevantTechniques: - T1595 - T1190 From 56a334ffbe08470360acc97b8f085ab1f2c6859f Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 13 Oct 2026 08:33:24 +0200 Subject: [PATCH 63/71] fix: remove incorrect LateralMovement tactic from HoneyForge_OffHoursActivity hunting query --- .../HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml index 694ac29c5b4..81178f4a002 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_OffHoursActivity.yaml @@ -15,7 +15,6 @@ requiredDataConnectors: - CommonSecurityLog tactics: - Reconnaissance - - LateralMovement relevantTechniques: - T1595 - T1133 From 438b00eecde25aa05123ae93c700d202334f43e1 Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 13 Oct 2026 08:33:25 +0200 Subject: [PATCH 64/71] fix: add missing Reconnaissance tactic to HoneyForge_FleetCoverage hunting query --- .../HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml index 890d636334b..0106f4ba7a9 100644 --- a/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml +++ b/Solutions/HoneyForge/Hunting Queries/HoneyForge_FleetCoverage.yaml @@ -11,7 +11,8 @@ requiredDataConnectors: - connectorId: HoneyForge dataTypes: - CommonSecurityLog -tactics: [] +tactics: + - Reconnaissance relevantTechniques: - T1595 - T1590 From a0b0cc7d4173800bae7ee65f3c768c59b7c1bedc Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 13 Oct 2026 08:50:26 +0200 Subject: [PATCH 65/71] fix: update hunting query tactics in mainTemplate to match corrected source YAMLs --- .../HoneyForge/Package/mainTemplate.json | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index 1bc262fd796..bfec0e99d97 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -122,7 +122,7 @@ }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -197,7 +197,7 @@ "id": "[variables('_uiConfigId1')]", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -209,15 +209,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -279,7 +279,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -296,11 +296,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -316,7 +316,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ] } @@ -403,7 +403,7 @@ "connectorUiConfig": { "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "graphQueries": [ { "metricName": "Total events received", @@ -427,15 +427,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -483,7 +483,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -500,11 +500,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -520,7 +520,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ], "id": "[variables('_uiConfigId1')]" @@ -798,7 +798,7 @@ }, { "name": "tactics", - "value": "Reconnaissance,InitialAccess" + "value": "Reconnaissance" } ] } @@ -879,7 +879,7 @@ }, { "name": "tactics", - "value": "Reconnaissance,InitialAccess" + "value": "Reconnaissance" } ] } @@ -1098,7 +1098,7 @@ "contentSchemaVersion": "3.0.0", "displayName": "HoneyForge", "publisherDisplayName": "BUI", - "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", + "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", From 245c5af1a75d054bc15bdfb2f3a133ef61c45f6d Mon Sep 17 00:00:00 2001 From: johndoebui <133871067+johndoebui@users.noreply.github.com> Date: Tue, 13 Oct 2026 08:51:15 +0200 Subject: [PATCH 66/71] fix: repackage solution with corrected MITRE tactics in all source files --- Solutions/HoneyForge/Package/Package.zip | Bin 98261 -> 98801 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip index 66fb4215f5af8ab65da8730b79dbac48ff6bd53e..db4003689da3961db0a19d18e96e0ce3b73214b9 100644 GIT binary patch delta 1199 zcmccmpY>xin?!&&Gm8iV2xPeV#vc9a6A2 zLVZkFBqI^Z_J!vVp=|QL@Ex09M_LLHVWMu92@7FmlV#_bZC;S4j@$A!cnDp{PsFVZ z9&3}&F0h?!AMU<+U!gcL4*0l4XR^Z_j>!t10+T^2{1>6KSAD`vROj!A5 z*?F$GV+}cS9T_KISi(Pf_X18LOg+0mnuQ2uAD2vW-+sb?aSh|-d7q^>N4)zk3gJ$# z<7JfIuENGBZ${Xd={`1$iwP^+{=KP5$+#4Bzr4s-(n2Xf_ delta 714 zcmey^%y#uZt3-e|Gm8iV2>iD3jSa4EEV1`tWU%+yC^27&bJ5}ELrsU94mE7Pp%g4A zxB<$Y52Gi?m?&U~PT9QHq*M+`uTQ%<<7EE?j?GOWj!X#g$+vsdCksUNOr9RT3?aHX zE+U5!!JQlzv19Y%C`$n(A%QvmlLPWNCdbd&38o*U@l2k#L=4F0nfzdv)MSHD_Q`!E z+LI3?vrev`s}5Epu#|W6g`7lW>+jAtn{2R)WAlW3d4z>+n=ce3BDf8c_b#%XoEObG z`9iqeX3fQ!j6fH2PL`aj3bcgmEw#jl*+?(f=1R|NfnXgr}QFe7pA&UZyv2lApL Date: Mon, 19 Oct 2026 12:13:24 +0530 Subject: [PATCH 67/71] Add HoneyForge logo and reset version Add the HoneyForge logo asset and set the solution version to 3.0.0. --- Logos/HoneyForgeLogo.svg | 4 ++++ Solutions/HoneyForge/Data/Solution_HoneyForge.json | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 Logos/HoneyForgeLogo.svg diff --git a/Logos/HoneyForgeLogo.svg b/Logos/HoneyForgeLogo.svg new file mode 100644 index 00000000000..ce4a81b0dd4 --- /dev/null +++ b/Logos/HoneyForgeLogo.svg @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/Solutions/HoneyForge/Data/Solution_HoneyForge.json b/Solutions/HoneyForge/Data/Solution_HoneyForge.json index 765d04845ce..daac7b00839 100644 --- a/Solutions/HoneyForge/Data/Solution_HoneyForge.json +++ b/Solutions/HoneyForge/Data/Solution_HoneyForge.json @@ -1,7 +1,7 @@ { "Name": "HoneyForge", "Author": "BUI - support@bui.co.za", - "Logo": "", + "Logo": "", "Description": "The [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.", "Workbooks": [ "Solutions/HoneyForge/Workbooks/HoneyForge.json" @@ -20,7 +20,7 @@ "Solutions/HoneyForge/Hunting Queries/HoneyForge_TopAttackingSources.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\", - "Version": "3.0.3", + "Version": "3.0.0", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "Is1PConnector": false From 09ea5a7bd0e22bc865dd3de20af33f531f1dbc1e Mon Sep 17 00:00:00 2001 From: maheshji001 Date: Mon, 19 Oct 2026 13:15:22 +0530 Subject: [PATCH 68/71] Refresh HoneyForge 3.0.0 solution package Add the 3.0.0 archive and align package versions. Populate workbook metadata and dependencies, add MITRE technique mappings, and fix corrupted Unicode text. Update logo references to the shared Logos path and remove the solution-local SVG. --- Solutions/HoneyForge/Logos/HoneyForgeLogo.svg | 4 - Solutions/HoneyForge/Package/3.0.0.zip | Bin 0 -> 15680 bytes .../Package/createUiDefinition.json | 6 +- .../HoneyForge/Package/mainTemplate.json | 177 +++++++++++------- .../HoneyForge/Package/testParameters.json | 2 +- 5 files changed, 111 insertions(+), 78 deletions(-) delete mode 100644 Solutions/HoneyForge/Logos/HoneyForgeLogo.svg create mode 100644 Solutions/HoneyForge/Package/3.0.0.zip diff --git a/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg b/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg deleted file mode 100644 index ce4a81b0dd4..00000000000 --- a/Solutions/HoneyForge/Logos/HoneyForgeLogo.svg +++ /dev/null @@ -1,4 +0,0 @@ - - - - \ No newline at end of file diff --git a/Solutions/HoneyForge/Package/3.0.0.zip b/Solutions/HoneyForge/Package/3.0.0.zip new file mode 100644 index 0000000000000000000000000000000000000000..eae33e200063aaf3346710a10a3de19344d440e2 GIT binary patch literal 15680 zcmZ{LW2`7J)8?^pk8RtwZQHuXwr$(CZQHhOTYKO4&+dNNZJRc2CX;EKcJfT0%1Z%* zAOipZKmeSYD(N8fvJPFr003+=0RW)=8#Qt;F>o?bu@E*fwXm^pvaq$G{p)CJv#t4S zgEflq!^gj4(1-fRA};A@NStbkLYX24b}jlZ1q0MPM2f4UE7tXO)+@LLDa)MMdEv7} z#CkW^PJEKpu&VVNoQR!@#!$YaVMlLxaQfgm1hF+zK(gS+z@)x~$_l6yGbVjNnFn zh&r1A+5PPic5@=;vJXX-P~&fsL&ImR#Nh=(I`;eP679n}KnkPt@ZkDhCiwE@IsjCX z`~Jr6?#z?)Zs)73gPYSWZWaYHYQKI67`8vvA4bK96vb2e(I}XJr4`8HH^|=BB5vC= z2)CNwpHIF!Zu5p$MA}@VtjyE~y3lE#L*3flJf^T|+S$wT4zBImQ`kk>Nv9z}04aNg zJOT1ys1t}(wTu+ZqUN5?jyA-_g_})}W>HNn(b0aQvN?7F=QX-YVNG*l458-gdIv29 zrId>T{x)r?o|J+;GYq~=PU(nwO-l?6b88IDVt~I4YUTzaIjc#WVwd_nEI}Al4snJ7 z{abwnEye(7W!a$RIM*5O1fW@7ujapR>-XrCLeS|CJ!lIP?aB+)2dM)b@!I|*wunte zb^}Le^wnzh`&wd<6kK5WN_L>0`0Rn4&G>HH_&w(lniQJBet)7Ll-U8vidaZvqD(%y zu?M?7>Bh9D!)sRLVw&Zt$dKG_P-^h_Ub-r=fA;6c-o60kyx)<7=j9(T!a3Yqg^;vZ z5d)Ns$cf(2tY#NBPN(r&RZ|ohBkoJ!;8$il@AHv30KmWsJ7x#UhsK=NaR9g5UWI~1 zgH&>w{at!>+B+|t@t~fCwct=)d?ijMR0#z-@vMQOx6z=Yp`m&WT6U24=WNiwk{r^5 z;?oO?ah$+=w13?eRniNDuawooWs3&Fr_o@L8D$ti_D1KsG9^apgvaLno#HSkg&>rY z0?S~h1S=zQoOI&RwbyizS@Z0o&!+u-Y{%5J9-w17cDqwjWZdjPX5Maur+c6IriU!o zEMy8J`81QLm+{43pWZ||lWUZ1RDuaEjVz`;Jgg=TC3E6jLX>~02%QPs(E_32;?k92 za_IG{Sxoy;1^^#&_%HIdPMhKI$pNV;rLjx8+mRM5_`P$!8R6w^LZF;)A`Ilh2j`Pq z*)j2=bYDv7-zEy3JEMy5!EXCscXgg<9OWU^f>4ka!tDlY9O1;2(qmpZckXK7p41e^ zC1iMUclg?T={epOkM`_rpB(BgokrQR4<2yf?}8>0o}QNEoh7BVv8so#QQ&v2VUrOd zQHvJFDrW}Y{m$C@WmMxZD-=hzik*0eH$oJGa2uWUy9pUCpLA2$0< zC@Kt?#|)fe_jPvxUqlx{;qiocY(U_9K}q!l|8hA!C8d~Oxc;+jWR82&!nbf9J!HWE zD|hX8S5(AKQy>@q>c?M$}A9n{HE3RMYOQTWVM9`wq%o`pt9as z`~t25_SyuAr)uz`x<9b+@4~=?jpat)%}!oBB89FvT2Z?_afP3jmUt`1oU4=zyZzgS z_5O78kG+5G_AWAsnpUp7-3N_Qz85yY6$`ZBdRWaT_rmvn|8GE#9XA@HX#-yUw&h8T&P@_2Vkzl z7Q28{P!xN#$LJ~TBGcmPRdv>?n5e|XMdn~~I#9@WFmbDpM*Lf+GezULoW7b50=aw? zX@3o}Hr&NTp;#y+q{K`I47l6guC+f^FSh3khSdE)O@_v+gn{zBPr48Ji@skQS5H`oH%Mm_=_s^W%@ z7qfUcy@f!XZ3|XVu@h(*ZH<-cWvN}28coMk(-O2||bQcZfCF6{Q!j`d}`&P zRWU{KW}w<&S5OQKhHMMkXe#v~{cs90kN)dRC#14!yg(s^kc6+51k@mbvY=)MgrZWE zqP95g%Ror-sp3QuG5F2~I4M;DD6e`GvklZE6{rjXctlF6T9W~zK;1W75*t1b(Y*%C z?fd4KC5t!x5*AKUIDMr2_Z(9g?2RaS`2|AtX>{}w=Oq%#k}(sLGGmh^LSK+M>I2Z> zN;kfGEDknW2Ai^?E#`+7_LbDDMc_tF-ZD@xsxS<^h)7hnUYPLYRa#{eOjT!`g8omT zjSxdVHSNk)cksL=g}sXzzw(emF{t@|NSe7i2D>|tD8crFKz}7$Haxyl1g~|Tb6u3c zXA_F4ikH|w*En9z0OjiI3`dN8^PFmiaSkApf}|qwB!)*gtF~|BRCM#h$Yi`#w-*$X zNlOsMrX5Kw)hZ?QOHDm}F{zH!)BAu)ik_p|%wQ3wP%h?^t7wG)`g|K56Btjhf!q-!ib{ef$pO^pf(r~m=_wRgo-IK6YH^X2W6ETPuu)X?f{RVS^j|^De_)G- z1gL^KZ1@eEDhE(F&T$#e)J#G*oA;S|jOn8s(5B|aZedMZT}D1#kE3Eubfs~FskpPN zT;xSO$!^?!3m=C+aIePGgR!0IXW~ZvS9d=6FQC%V>hO=HSU*NMK-3_rH^iORzlNQ>+-btA8Rt;ZMNZ0E)+AX%gE%a4$N}&`u)8W`)FF2< zX)nd`@dRq@CnH>0#>R+Q7Cq!m{)sf>Nk}BMc99Jt6XRyN&1QPyW&|RUrvCVoh)Uy8 z^BChckVyPm28i!9N0gAPl1VNlSU=Ul0c2(}azxb)W?hsvVJ=nP65T zuzY?^ZM|1^I-KG)SUse5)kl-zt-eoZyWOkdO-Iglj|;92x|FPp8()+_NFv&<^^A4u zt7k}4AWyYJ#IDRZAtk{hLE5wxSQy&b;Bw&2%a@ru$Hy^65Y)Xmbc5i>2udxN*~$@=aar*uaSYaP1zohY^yg~>~iqG@gbY9)_p`uFxwrFzGxP*Y@KWE4h6aHEk7xQEra9<=NEGS7MwzkhL^ zVQDx0fj(*(;V9Xp#hEHTDmjuQuxr-67@B4#3Exx2gGOyHZKG|50N-MpxTc>U7}fWl z(aG8u#7NF+9Hj>jS#ugcsV8zV$$SERpxrcx)sy!(Uj+YhHV91*2dHPM~%*0i!%? z3zzOF7`0=oEJa=OS(UhC>sKyyW1{NVKTG2J_OadFL)UZ9w|W#Y|FTT69X=-Q(+xB*N3?pGv;1?_ zA_h;Ji8r_t=S)QwyI!xkn2zc6aWYA_;IQrQN7+5 zd-0b(^cc|-A#HdBs_PY%-i<9MxzArlDLQxErL+ae`Fk9PF1yh@%N+=N_a{;ibsGB#G4*WD%Hj`iE%esb$5lOVNrJ zfjZYriIuAFK`ID~-!>w^(=*5M3YHa{DgjkXk&t7x!wdCNc*?AaM{CK+(|Kbj5X2BY zGsPI{+!o>|j1uDeqHyQb*g9>i`8;n@&h@pB01K41$W^y$=c^~wMT6A~M#aSiiQ6*| zD-u$Z;uO!s6DsD<)?SNomKx!T8JyCnW#dVlqM#b|2_gF25I#W*BuR+aK~xj6ke)q~ zpq)BI058~Ye?`%bGNThwDu{!0;}c*)@y-wH;T04Gl+b?Zr2C=^5-m}(u1EE_3(`v0 z!~&WDs$N>&j*B;fiiN1eJ7pc5h!)6#O8{vDS^*zAW{V^U6Z`pAH!Ia>=sDi5vauh2o}PBYF?VkvmslcXM}zi5@sLgYas3(i+a|iz=Fg{-3my1C+z*P13{Q9f4aC^b zyg*ce%$=LSh?j`EvidaG9BpjT%FCe|=wl)wPkk6Zwyn%hxa0sDBjg62jUmJ&WL{Fp zOu}W5lVH(VlCeAc6uqk!mUI&jCXttZu1=Q%}; z6P>)}Fnp|u<-SehqgvbXCARhA$Vmb?*Lf-h=zC2%>0n*h-IDxrm;_Rv_c!IqteU6R z<9(<%Q(3?9;fSO`ZK5rR8lShp(hhDe;73;L4Z^c zxJ;K}t^s#5`dj#p9xfq9D}cgFmNDs0qo%tTwn)peRtIk7i7zgHuRK4`y0D?6=E7~7 znLhUHgo;Gjc`7F}H4WFEwWts%vean|<-T;v^LQ2|td?j79TFK$#ghD+U&j8|2xXX( z?I0MpkmeXHa9hCE_0^v24A$Q4cAxf!+v85ZwULYXZNE@Il$)4KSIS4|`P0z99FB+( zdCBn$s?xN2{FP^B)_Gr79WRpmk_|hUtr;cJfu?4}(4s~*$?7c9qIf-R3VfA$Fdgtj z`PLpr^5g7xNO)>Oea%;Ia=@pb8k!Fq#ue}81=smyzuJx}ralDhcqdnESLgJ2W#rA_j!#{0qpj)p{9b+fv+PFWXc2+C>uq?KOvqeZ zm*?YH=W1402l={ZS2v&ATUjI0RY*2Z1K$<*$foJf_7fZN?G8_T>whiq#dUwp{Er21 zZoYSZAe-4b59qEhVBOg>h5Nc|=lj|HHUJA({dENHueVa{%;t<>#^EOV>ZB}>2w zE-kJuu(G@9P!0m)#cE50?#1Rp23oU!<8V_pKh!6vAh$BB(Gw^P^1VhCBhF4=eX*UX z!vY<-7p|2V0z%(@GGeSK-;y9iyvgff3ZCTULk;qzDn`n;4+f_2Ci46`${|aprlnt~ zT=gd;c$JyYlkDX^@E=chv(UBMe?ScTuV;G}j&HsRX{OWt& z#@}otTOTHo&w1}{r}|8)pXi7Gg-*n>FA3iUZ}I<%+}Y6`&g|aKj$n($RbF0S_tjPz z#}YQFzOK~U{6>u-^l?X)8YW9&RqK!)N4`mt+n+&HGUpW^x_{il?m+v2xj8bk3nPM5 zdc!I!EWyl`W_RqowB)^bUGLQxJalvr0DfRHAV53Y+g0e@1xMohlFLt00oAEjh9N0# z9{E$?1aJmGVdJd080K!K+@B45i>1s6_gS4$UHU8o7{`$WI$^2Km#R(9oc6vu$ViXe z3bSR4BdQ=+OWk@vUnFW_4>iL@)YP>d0UDz}x)lUZLm_%*HQ)*^<(7O3;{MsD*QN2_%q?8X!(V)oL2hjy>jmK;qAg&!dOp5R2e6A^jvKN3@gF^ zRCMY(N6Tr4>F??8%>B0l0E2|QsGz9){64~;$lhYHcfaR?g;8z}TGXe+ys z$0SIG=^S9|Rc*j8fmm1%(X{J>k_3YJfu!0Uw0FMW-v{mz!N(!q;&WGu3S%Epj#PcF zH_<28AI^RRB}Ny3PrOC4*VqB@vs=HvKj7&m; z6T3#qB1nI_%yoY+sf+I*(V{BsE;o5aqUSb*3O-Z_v2Tf#XDm{e2~PyED@11eiRZoS zwIhqXB|(kku_K6g-0Vy8{PG}d0m>(Oz>n>TFpj=c6jD)HL*nfw0D?XFbodo#!gQ^- zEK0y&dDzKWgy<9QCwY6^>GoP-j2qGoS#AxhDxm({(&oZRNQjmczfGULJNrnW1KJ0$ z9tWX#3c{|+t=Abe0Ydm7R@g4iSa8aM(zO?t-Zd=Vo%&I{&^eW}f*_=74 zf9KquI?YOXTbOz@fxnqYc_GJS2mG4OQL$qkW`YV zM9_bRg!VVPMDmj5l{i?nEZlh!)ruYXVzW47Nx4Y+^KI+oNBZ_!HRq?$SJ_XUy<7!z z4+fH!?*mDS(bT9%BRlhke0^0Y6#Waxn6^pMOS%pOk>JCI$UGI1ENo`KP$arYLCz6- za>*VL#0PaoM$Y*WH5L3}f6|00Ldq8(kYZRi6YOEeQji^Rbg-ywrU6--b=SdFp7ecm z|9HibuU_n`2R_9yI(acj5{6dD$s9+Q)8>F|ajMWVHS-kGppM`!slmS|HHT0I0TC-l zAicdIoT_d~G(xw^wqfC`xItBAhz^uwtBu9O!{2R9B=viW_xoo16l0-+k5Kpf82kI- zd$w(NmSc)S_o+Y~=+X|54Fxv?lFo~Y!92_N4s8B0^eKLhjCxY3BXICH-iFg(S2T$H zDPm7Nx|d49hBV(zdHLZn9Y2H zEP0)O7H-a{Q8gAsg}G1DxaCyU!<@3apwPY%%Clqu3vt0Mp%$oD?@@{>bbs7C8%-yd zDPSU1YG-1XCI{A}B)ZmWU+x?h2Oddv9QThmPqj`}v3s$6VONz&qLl?LO!)*Qz^k#; zEQC5#B)F=X=xtHc9BV2y&A(9xEhs4vZTt$~ivZ_-plUaB zbvu}PGAZnroKya%R@qdGKrb*c*DsJmNN&on5MXukOXp<&cuf5DSVI z;+DeY(RMI9J8B2;77t=$I}B z|3t*LPgG1A}HQ5jQ)ISPE8o#AF}gCkpt(0opv1#UL#J~L4*Fa)lJM2&*5Qp{q1 zyEIezy`rM`q)}d&qheh(=+jP@i>I9J2su5hqt*@#rXG)g#&o@AQLgZ$JjFZ4Mayb$ zYkkF&;}*htN4E{Qde3-!UodzTJ%mGSzrAOPXHdR!%v^v0?n77ZXTyqh-yTDKh7r!pRP~8tten9k-APQ2Ht(HecC(4Ik+Z=d1ko^MAzeyiP`>x%2jf5&s2rp}< z7%#CpH0brUj4VaeemSWr%9-Pr*j;EM!O_VI??gNeFD`W*h>2E>hxq&cN<0vu8;4Xi z@VbJt2eBj(4JekzI4;f@A8@Mo=EKib|TcqB4wsLJ2{h_#7iN}Yn=2XgD z94YbCz|Uqila_fVX7Z7)4Jr~olj0l@Y$&Xp6hY4QY9zFP&8Q<1V83`DymL{5T{Lek z4OctZI!on&3{lai(t|#||0AhIM_Uf`CjZk9gT&WbP;I=WVx(6jX6(k^58D|ZHdE1) z#Pic^+;c*K@*`KNe(wqno*-&xUP_U!zzQ0laSC8vwfOgCR%AePdYKv_e~o8H*gwN zwOl4S?D_%5$Q^TlqtyOj*y{FBK=^p=EP1)2qP1mL-yZitN@l5%K>%+t_NPNP-_gdc zGPeOC9g;m z)984>x&R}hOgZR0DRCG8$Kt@FYYdC%s16G&*_xkLh_OgoEVTK%4m)fYBMv~wV7~(AFjP^Xn-`1W)gfNPN4#} zB0~4C*Pm*}&#fQ}l%YTKeD`zAxH_f%6vmGeofVtB}k1&mAC`dvTj-fj%ctMD^)MRHu z_eI0Yzagx2IYu!pk(OD>jCdVZ$dx`=C2}z@uNi+)Ev#URTrue8tV|Q(P_CjL&0GNO zPnf~^e`Bf1TawfrH6QDnpy(l^g=?9fFo?4u>cD$X3SV7Hsn{S(ZyLw2 z$T-QDd`jG{*tW{j3KaiX&$mlS6HiX1a;2j{M6D*-pDP{GE|amwi@X zkpuk&CRb#^iIm6D)5kP0Qm^D>^Uuli_FxJ>awI9^t~Z+_6BkQKNv29&sHQ+bqTE;4 z3J>xWbGAf8cDAfeP@3{zShn?|tU1ZDdd;W+d>I(R{!?*g0 zh1%v?)!S@QvPg6~Y)&@mD}_dO<>9noB$B{^$!M4nP|}h|%2ybV6DFq6)M-eXe~x_7 zVHimnr+-FD*NGJKnvus&7oF!wAD<$DIgyQkxy*|#9n$7Re82~5n$~X3XODnDg^_8) zhk$ph>LSfMMwWqa$L}l`g57h+Txa^dmS!)Eh^#IL1#P(tqhD?>qCQG}nDxq|H_1kR z%r^jUtaFq##gejr(Kg%xRKiNy$HZ3uDbR)rJSkYN$mp)kafUvHK)!=$;KZ;}H{y+I zoFR}V|9FpnvBzg(4lfoo@)C%1cO(b$PKS+wN%=!Ku=fP#^}=aTn&ikF$)b-l&A|9s zXS6ovQ={3cZo_a&!ANTE*oYg!;pN!Yp04}1(1Hmcmxr9`k1FI$qMa|AH#aK^%<^Ib zz!d^ZwA~(pT>|e^e0-g3)x5eqZVT~9ir38JxZiE|5Y5zcColvmIDO>#a)b)31y!4q ze>YYckzu!{EK2$gNZ6f~Iun1u&#bNT*y#`asZOj5R7!WguLMbOau2yUAi0gOO!)yS1=U12h~eIZ=)?bVE=s zueJG32B#fD4~bcWefRIBG_xu&Zc_peXBQWTixPa-N~MM{z~k+$ruX%yY4d;c{HzL; zHT^qZqCQH7P%j9Zx8#=@!tV^ zw`Yylv&U2<0W$R|AHv4US<~woltLH+`(&)S^p3b46?g^WGa-AONSZBWmzJWNoJv$6e~JS&c9*z0 zCgRE|WCM)))?m3+Y$UN2P3r-?VmSWQdYIPFA#T^q9A=3HCy%XkUvjw_Y__~wjc2-i3E(|2YOhWUVTx%i^sB^C ziz|=eHK68FLQc+r-Q&LDFzX{*%+6+aroMQG+CzutyKLvlv4LaAfqQR`UG=PxOT^ic zbxWD7in4zGx-py9Ba-e6f;u3ga9Ref!|&%k_ZKZ2x7RJOWv;yB_{6kz)}`|dR2`ve z#mOtc4jqc{_=J?5HdRvoPuw0|I4j$$r)NicH!bI~hM~Zt$GwB&;yF}^a!14vTAlrk z>%4++pyM_hYDOe83t+S<813?)hT+k&29|#SUB9E2BqfTee@pO%J5YS?G3wOcj6 ziGQSwe+4Motlnz>r_w!HFq?De0(R+*xh#!Ix?rwNqyfCaq0l|Dd21sq1Am+uzCUQl zAHpLB@*G*nm5ijGuqFUKA5qSy;z*ws4a#VO9aexjAk+X|V$#y9lS&yJIsFb^-yg3Z zttGS8sMw3O!kv~MT(1|mFmyQ&%aMrCzC8--4RQ7Aelx}*kl6l9qp9|aZE4iC{>$WI z5to}_m+Pq*9X+?5lgw>5e{&5^nohLUtHB>|8*8c=-y&nS8MOBXonDMp+aYM%fz@4c z*Jd|K)P~vX)@#7;<{%Z7j*=Z!b(N6q3ZqIWHA-Ek0ZJt1$LU@6bPUbr!M86g4y+&` z>OVV+Q|n7D^%3_P!*A4t4BxqxY4IftMAO3jymm#3Ku3jQn4C{D@HpkYXe|O?V}`KQ zlzlc#2}Nx>bSMH3C^oapsaDHuDwwPFPcnMRfCRg_vUc7A^lIR3Gdp_qr?cUw*;u2U zZeKQ}b9LOht(?3q?p`)0OeptlGCfRWKP|jBF8*$tmF~io((<5$YP0ipM>K$_-|DTOZXfztwO<+DqH7 zopz7ag@!`lZ-3itdImkS3qM~^_kJuLH)g|&DHpy<3`={))5_l=9;}B&yebEx4XVBEB6bZ@{ z3Fb`xeW`hmhj2v6S2+@R?dUk79N3FRHK1o}$n)xLuNDumWedp5-!*7HHCOT-9O(&} zCIZe70a@Z8(&Yl$`@H|Ebz#;X8@IDC>pfuJ_5=SN;2NJ$@;xrsOPRYX;eJ9h9ZM$r z(Q!XuTZ5cTjv(dIFWj#65A`;o{)P2i@)gT@LSZdKFN%kxT> z$jqMq^u|VTbQQL>F1+NUF?RTQCjFA44XN-iMiQRwmkjq%%XdYr{x?{@Ee{gv+8rIFKeiaoc-2*U!;eT2K!&+R;kBS% zU^Q|mt!NM~UrNouum@A;KgnA;t57v!Y#3temE}~Ek>r8|)1D}#lRvAC3X7pX;zUnl zSJsD+aR=Q!=1dDW1w%u?;n+u})K6d}cJ_dux`9>EeaS_RV6(y)!F{i~kv4ptz1&bW zrlXO6%@Ws+g)>>}$jn9}sY3mfB`%VFlGtSIQ2d<*eQj<3TQcO%CVz69%hQa95>VcCWTHX!GGeNwjn&`3UTKjUwah)Bh|4$oRJI$j&T*IuQ!`L`Az9)gA(tQp z%@fgKmLBl@x;E2J+HmDOK&p`o6MPEFd5)%`K^^%n2rbc0r`j$-D?%O{f@j`f` z9bIJkgL3>6nk7HaWxZV1MVLMz2G>Vhd-k6H)I!q>XG-B(isn`_izxb#!!drqBUvn# zk1Y;yYtSGJeL$CfwyF%2D^3Db#cM!tH)RC8F8Yo7BtlI+W%H!i{5sTn!~N?qalGB&`jg0F_cp5iu_X;;(Q{w z`nEP;v`>-tP_3D4*PM7v+*XJdUl&-BOt_1TF-CcjN-`RH*Rg;;x`OXi8S+i`;nu-E z*=j$0wf#pyckTMN<9A0_Phm@mM~1qlHcxqJ+#C$dYoZ(q1qI0&in5rG(xXI!(PZYZ z!c#kYq7Wfk_`BS?nPRgQ(PXrbB*yzQ;@A+{amk zfpxPL z(K~-wPDoSzWnaYyM6TNWM;3U1s81z-mWk08LlQfsX;ajn`{tCgyN!E-uh_42sJ7Lg zbs9MajcU1D24|%k%tz6t5M6W<)6D=U<9y?X45Tutts5(~4gZy$UCPuo>n*-%p$aH|lD2ea@lGq_Gn_eN&2Y=`VuqB;UI zSOFo2(+eNCd^uUV)XyY9bC&d_c5ZUU%VI@OEn}i7D<)2Wekr4fr5a%taYQ|_U~jxP zSnu{F?ixxajq{n|2I!G(m71nUNAhOMpWDb15NOH~Ib8+gb5_dHb&CdNSZZq{O^my? zS(eQ5o_SuDF~9oc{bQXHy202JVbrRLul9u~OV81VRKh>IBp0m@*6CM|TZhnR<|E`> z@Sex5FD0@KFnRB8$?IuO{85D(hyjJ-2%6U2WxXufbcdSCzQ~&FgMGn&Mo-&>yyl!^ zl?9Ty4x@@|1~Ptz18>A0+2HOYE^IJ05}I&+ko!4AHd|{WNn`aqvhZ8j8Jt4{@j(0A zg?sj_p^uQ|dVZKTxX!s+L==255Hu zeI5OxX;$6M`eQBg3p^}($_h@sDQe=Zvy7K(VXVQJfm`*gpQ6u26`a}IY46?{M0>vt zu*T&GaFwlcbt?nBwx|7rsNDt$ZR%?bz%}dHQZVb_YYyOfiUnNfU(W?;mb%7!TrIf9 zuYQW4H)CcnWJs?5O@4OV2?{Tn}>2 zYLr}C=6z{*69lpzz?nxGDgMdsh?$=nTz3kv_URLp8SYS3p%UdJ-D|=AsBDmbk?*E- z2MV1yi;T28hy@UyNKT8lBNFJfXzgq7)_A1wyDngppQNSZHw0jQdI*%5s>0w625O7B zbSkc+NtGU|xVMF+#37p#=|#17U;zwDOD${SGXwSIRv{dZIIQ4v?AIo>u}5--hjFs- zj)oqgL2Z<+VIVDL5mXZH$4Zja& z+}^s)u;-F16Q0MtbymRCS66CR+^G-X4sHaK36G#WAVTLAW>>|2qzfUV2?BJV42(bp zl-dtoG>g1yH3n+znB_$1Aq(Y>B)tQ^b{jJ8!&V{*RES_N(A8<4lxIgRj3a!M1VVZa zf|JpN7!s!Zk}eeh_&SB1%Wl+HJOjGV$cdjdJ`2!J!zc=nSO<6olMuqs5?}=thLQ&t z?@Y!2oe8|;N-1~6jf%l2dme8CdEi;}l<_hy!<19(Bjzx}BNc+tAg-rbee zhQRO50I^itl)y6Oj8v7fs@XYKf% zov-k`Z40B~%ZBa3?AZBDKb~TjssAB#3dieL=15rVPX#|Wi1$ZOOUwLoKk?f7Y5$5` zYsxPfyzKQ2T&L=louXx6-4@WS6~#}0Hw&kq5B}*m-wXXfgQMaLdv*ubm*7bI@XT!_ zG&LwIb*t>csAqIxT;1=ao>-T1w3-HFx_>+BvQ&MTa462;USLhMl!1w_1xGdex*xC$ z5TEK1;_rnMK)P*LWO7I|c4fMhA^`{R6JD0h;z10qoa5J|$b;nI7UUu-ZyC{tHPkpV z>Fc;%UM027*%;^ZZcRSXv|n0DOw;gbNo>~XckWFa@g|_uKI_K1*2GjoI1+iIrEyK} zbJ@B4k0+C=d4jV0I~DE>dd?g^PLr5m-K0wKd!}U>dB-stHHzZ`P)811qo&s}Ys8{D z%szm80?dX~3e3-)Isq<7J-}0z*82dyrBo6`C@+(P=|2ye86De6MV|m$6TM?cbA>EM z2MT*X#eO#^qIQ?o$O|k0Dsjiw;i1I_OU9w)bb>Jpk>~xwQ|KRcoCKC6^d?z4TQ*VT zIfDTnMbqbg6KFxInspBuYr@>9ksF=O|AYYotZ%f$4)Y84-q7y?uq|~6(sbE7gKMb$ z-i~e{TC5N;a#BsvZwAPalo!f1^*l2g<}saww=l$uWCC?;d%FJ@psT0TG0wPt<4j_Q=4uN$#( zNXx;3V*pIRtNnv9G0z6STw~O-=;nS3VM zRBh9; z`YfaXra~nc=H-K-tc3k}J3qxy>6S<`G$vi2^-M%|=1xF=fs2m&t7h@Pv@Q{Jo@7f` z`=KDa0T6|X=hFS9sR8*vIg8_p5Rs{(8;zPD7WGJa-boGayC)7`ceeWuJYT^gS7E<5 z>fB@wT|pz+xF^<4)#~1$P+xyk>)y8C&e@WY*nlGGfWW-8&fH)zdM%v1&h5Qh&)$Bp zoxFU5V|JN2eMU+{IVZ`qtoCV5B0J8@^6d6Gj1^V`wsDYD=Sus?M`esn+pZ4Tse zX1{m($~&3eWe>kNlHVR3a`q-W0_f7)N;FO~G>_T=r?mHqNdQi7@x`X=J0DhyxaH<7 zf~J!fhC<7;#n>U|gQSA31kq41zKIe`NoDkM_}9^fq<((niMn(=`2(~sgZxb+>8&an zW)asmXMbhPj3#p&?rD&uEET8Gy6pA$j-bz zdn__(->n~MC(s6CEv6`yUPpfQlXvygMIe-((}&@VZ>gq$Ysx1$XG&}XlLk!fyO0Nf zCB)4l0$hb~@DHhSWVYYGD_scHJnnoo>w>*3&EJrq%Ct1>t)#D|F z>fz`-p<6v^@CQjmfzr0SG}E!Zl@s*>^5 zufnhBAq1U?b-Ny>x%l5_=cqm@=PT(UjaS76!#{hDTiIhY7QMF~w6hq!#>x|EV?LMZ zKfzOSZ$MeRC?(QLAYq~;4&By;7V#yCgcO|;Y_lUKJXnKiq4X!TTN%r?JW}O(pK--Ktbd}bmYKd47=bmz6KL2`_#FlsVZGn$Iub;{|Wtu+QMxDENRct zd-i6QTih@-rUhCN1rLXv0k?D9Uv|JTEQpzTSBXmU>$ibINe4Brs+jqSpP#CKa;T!? z*pGQFdW2xJ>qc2#n%H#~qoYX0dKUG5WKEOlZO zR0P4*0O`5HrfBqzQak(o-dxycTq0@SQXe_T-Il(Ye)WW!Vi0ITWfgrw#2bdOki z#T#-X97e+wK3mmxAWmnsF=V$9i?1uBX2iCl66Cp^A^o+#UiMWXqPAW2&Dc3@y~?}v zFWv0Cxg))y@A_q+ONsv=U69`WO+%CNut!R#zVV%kbZ6cT%6#~ab!VXdBn7zGO8d_3 zRlQmhqDRb4dwg*`lmKlT1isr_AJ5tDuUM!mdUm8x0uqGt(IP?JPiedb*fW(Civ#A2 zI1B5Wp5h32AKuNF%bvRXz9&_e4e!ho$xmVCe@{t>I!L=J_&6L1tQj_9iB7iP_*m@K z{yx|H;ggpF1VRS*|Nm3|$Hf0X(*Nhz^8ZxwKe_z>TLS^?|AW~tF9izr9}%E`Ip|+o J!u_A#{{lG1ZJYoA literal 0 HcmV?d00001 diff --git a/Solutions/HoneyForge/Package/createUiDefinition.json b/Solutions/HoneyForge/Package/createUiDefinition.json index 0d3916ee4d2..d07385e2836 100644 --- a/Solutions/HoneyForge/Package/createUiDefinition.json +++ b/Solutions/HoneyForge/Package/createUiDefinition.json @@ -6,7 +6,7 @@ "config": { "isWizard": false, "basics": { - "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", + "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/HoneyForge/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [HoneyForge](https://honeyforge.tech) solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.\n\n**Data Connectors:** 1, **Workbooks:** 1, **Analytic Rules:** 1, **Hunting Queries:** 5\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)", "subscription": { "resourceProviders": [ "Microsoft.OperationsManagement/solutions", @@ -104,13 +104,13 @@ { "name": "workbook1", "type": "Microsoft.Common.Section", - "label": "HoneyForge", + "label": "HoneyForge Threat Detection", "elements": [ { "name": "workbook1-text", "type": "Microsoft.Common.TextBlock", "options": { - "text": "This solution installs the HoneyForge workbook to gain insights into deception sensor events." + "text": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment." } } ] diff --git a/Solutions/HoneyForge/Package/mainTemplate.json b/Solutions/HoneyForge/Package/mainTemplate.json index bfec0e99d97..cad72a4c0f1 100644 --- a/Solutions/HoneyForge/Package/mainTemplate.json +++ b/Solutions/HoneyForge/Package/mainTemplate.json @@ -30,7 +30,7 @@ }, "workbook1-name": { "type": "string", - "defaultValue": "HoneyForge", + "defaultValue": "HoneyForge Threat Detection", "minLength": 1, "metadata": { "description": "Name for the workbook" @@ -41,11 +41,11 @@ "email": "support@bui.co.za", "_email": "[variables('email')]", "_solutionName": "HoneyForge", - "_solutionVersion": "3.0.3", + "_solutionVersion": "3.0.0", "solutionId": "bui.honeyforge-threat-detection", "_solutionId": "[variables('solutionId')]", - "workbookVersion1": "", - "workbookContentId1": "", + "workbookVersion1": "1.0.0", + "workbookContentId1": "HoneyForgeWorkbook", "workbookId1": "[resourceId('Microsoft.Insights/workbooks', variables('workbookContentId1'))]", "workbookTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-wb-',uniquestring(variables('_workbookContentId1'))))]", "_workbookContentId1": "[variables('workbookContentId1')]", @@ -104,7 +104,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge Workbook with template version 3.0.3", + "description": "HoneyForge Workbook with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('workbookVersion1')]", @@ -118,11 +118,11 @@ "kind": "shared", "apiVersion": "2021-08-01", "metadata": { - "description": "" + "description": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment." }, "properties": { "displayName": "[parameters('workbook1-name')]", - "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\n", + "serializedData": "{\"version\":\"Notebook/1.0\",\"items\":[{\"type\":9,\"content\":{\"version\":\"KqlParameterItem/1.0\",\"parameters\":[{\"id\":\"a1b2c3d4-0001-0000-0000-000000000001\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"TimeRange\",\"label\":\"Time Range\",\"type\":4,\"isRequired\":true,\"value\":{\"durationMs\":604800000},\"typeSettings\":{\"selectableValues\":[{\"durationMs\":3600000},{\"durationMs\":14400000},{\"durationMs\":43200000},{\"durationMs\":86400000},{\"durationMs\":259200000},{\"durationMs\":604800000},{\"durationMs\":2592000000}],\"allowCustom\":true}},{\"id\":\"a1b2c3d4-0002-0000-0000-000000000002\",\"version\":\"KqlParameterItem/1.0\",\"name\":\"CustomerID\",\"label\":\"Customer\",\"type\":2,\"isRequired\":false,\"query\":\"CommonSecurityLog\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where isnotempty(CustomerID)\\n| distinct CustomerID\\n| sort by CustomerID asc\",\"value\":\"All\",\"typeSettings\":{\"additionalResourceOptions\":[\"value:All\"],\"showDefault\":false},\"defaultValue\":\"value:All\",\"timeContext\":{\"durationMs\":0},\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"}],\"style\":\"pills\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\"},\"name\":\"parameters\"},{\"type\":1,\"content\":{\"json\":\"# HoneyForge Threat Detection\\n---\\nThis workbook provides operational visibility into HoneyForge deception sensor activity. Any event shown here represents a connection attempt against a passive decoy device — treat all interactions as suspicious until validated.\"},\"name\":\"header\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n SensorsHit = dcount(iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))),\\n CustomersAffected = dcount(CustomerID)\\n| extend\\n TotalEventsLabel = tostring(TotalEvents),\\n UniqueSourcesLabel = tostring(UniqueSources),\\n SensorsHitLabel = tostring(SensorsHit),\\n CustomersLabel = tostring(CustomersAffected)\",\"size\":4,\"title\":\"Overview\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"tiles\",\"tileSettings\":{\"titleContent\":{\"columnMatch\":\"TotalEventsLabel\",\"formatter\":12,\"formatOptions\":{\"palette\":\"auto\"}},\"showBorder\":false,\"tiles\":[{\"id\":\"tile-events\",\"title\":\"Total Events\",\"query\":\"TotalEventsLabel\"},{\"id\":\"tile-sources\",\"title\":\"Unique Source IPs\",\"query\":\"UniqueSourcesLabel\"},{\"id\":\"tile-sensors\",\"title\":\"Sensors Triggered\",\"query\":\"SensorsHitLabel\"},{\"id\":\"tile-customers\",\"title\":\"Customers Affected\",\"query\":\"CustomersLabel\"}]}},\"name\":\"overview-tiles\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend CustomerID = tostring(DeviceCustomString2)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by bin(TimeGenerated, 1h)\\n| sort by TimeGenerated asc\",\"size\":0,\"title\":\"Event Timeline\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"timechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Events\",\"color\":\"blue\"}]}},\"name\":\"timeline\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n TotalEvents = count(),\\n SensorsHit = dcount(SensorName),\\n SensorList = strcat_array(make_set(SensorName, 10), \\\", \\\"),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr\\n| sort by TotalEvents desc\\n| take 25\",\"size\":0,\"title\":\"Top 25 Attacking Source IPs\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"redBright\"}}],\"sortBy\":[{\"itemKey\":\"TotalEvents\",\"sortOrder\":2}]}},\"name\":\"top-sources\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n SensorID = tostring(DeviceCustomString1)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize\\n TotalEvents = count(),\\n UniqueSources = dcount(SourceIP),\\n LastEvent = max(TimeGenerated)\\n by SensorName, SensorID, CustomerID\\n| extend\\n MinutesSinceLast = datetime_diff('minute', now(), LastEvent),\\n Status = iff(datetime_diff('minute', now(), LastEvent) <= 10, \\\"🟢 Online\\\", \\\"🔴 Offline\\\")\\n| sort by Status asc, TotalEvents desc\\n| project\\n Status,\\n SensorName,\\n SensorID,\\n CustomerID,\\n TotalEvents,\\n UniqueSources,\\n LastEvent,\\n MinutesSinceLast\",\"size\":0,\"title\":\"Sensor Fleet Health\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Status\",\"formatter\":1},{\"columnMatch\":\"TotalEvents\",\"formatter\":8,\"formatOptions\":{\"palette\":\"blue\"}}]}},\"name\":\"sensor-health\"},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n Severity = case(\\n toint(LogSeverity) >= 9, \\\"Critical\\\",\\n toint(LogSeverity) >= 7, \\\"High\\\",\\n toint(LogSeverity) >= 4, \\\"Medium\\\",\\n \\\"Low\\\"\\n )\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| summarize Events = count() by Severity\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Severity\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\",\"chartSettings\":{\"seriesLabelSettings\":[{\"seriesName\":\"Critical\",\"color\":\"redBright\"},{\"seriesName\":\"High\",\"color\":\"red\"},{\"seriesName\":\"Medium\",\"color\":\"orange\"},{\"seriesName\":\"Low\",\"color\":\"yellow\"}]}},\"name\":\"severity-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n EventProtocol = tostring(Protocol)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| where isnotempty(EventProtocol)\\n| summarize Events = count() by EventProtocol\\n| sort by Events desc\",\"size\":3,\"title\":\"Events by Protocol\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"piechart\"},\"name\":\"protocol-chart\",\"styleSettings\":{\"maxWidth\":\"50%\"}},{\"type\":3,\"content\":{\"version\":\"KqlItem/1.0\",\"query\":\"CommonSecurityLog\\n| where TimeGenerated {TimeRange}\\n| where DeviceVendor =~ \\\"BUI\\\"\\n| where DeviceProduct =~ \\\"HoneyForge\\\"\\n| extend\\n CustomerID = tostring(DeviceCustomString2),\\n SrcIpAddr = tostring(SourceIP),\\n SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3)),\\n HourUTC = hourofday(TimeGenerated),\\n DayOfWeek = dayofweek(TimeGenerated)\\n| where \\\"{CustomerID}\\\" == \\\"All\\\" or CustomerID =~ \\\"{CustomerID}\\\"\\n| extend IsOffHours = (DayOfWeek == 0d or DayOfWeek == 6d or HourUTC < 7 or HourUTC >= 19)\\n| where IsOffHours == true\\n| where isnotempty(SrcIpAddr)\\n| summarize\\n Events = count(),\\n SensorsHit = dcount(SensorName),\\n FirstSeen = min(TimeGenerated),\\n LastSeen = max(TimeGenerated)\\n by SrcIpAddr, CustomerID\\n| sort by Events desc\\n| take 20\",\"size\":0,\"title\":\"Off-Hours Activity (Top 20 Sources)\",\"timeContextFromParameter\":\"TimeRange\",\"queryType\":0,\"resourceType\":\"microsoft.operationalinsights/workspaces\",\"visualization\":\"table\",\"gridSettings\":{\"formatters\":[{\"columnMatch\":\"Events\",\"formatter\":8,\"formatOptions\":{\"palette\":\"orange\"}}]}},\"name\":\"offhours\"}],\"fromTemplateId\":\"sentinel-HoneyForge\",\"$schema\":\"https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json\"}\r\n", "version": "1.0", "sourceId": "[variables('workspaceResourceId')]", "category": "sentinel" @@ -133,7 +133,7 @@ "apiVersion": "2022-01-01-preview", "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Workbook-', last(split(variables('workbookId1'),'/'))))]", "properties": { - "description": ".description", + "description": "@{workbookKey=HoneyForgeWorkbook; logoFileName=HoneyForge.svg; description=Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment.; dataTypesDependencies=System.Object[]; dataConnectorsDependencies=System.Object[]; previewImagesFileNames=System.Object[]; version=1.0.0; title=HoneyForge Threat Detection; templateRelativePath=HoneyForge.json; subtitle=; provider=BUI}.description", "parentId": "[variables('workbookId1')]", "contentId": "[variables('_workbookContentId1')]", "kind": "Workbook", @@ -152,6 +152,19 @@ "email": "support@bui.co.za", "tier": "Partner", "link": "https://honeyforge.tech" + }, + "dependencies": { + "operator": "AND", + "criteria": [ + { + "contentId": "CommonSecurityLog", + "kind": "DataType" + }, + { + "contentId": "CefAma", + "kind": "DataConnector" + } + ] } } } @@ -179,7 +192,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge data connector with template version 3.0.3", + "description": "HoneyForge data connector with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('dataConnectorVersion1')]", @@ -197,7 +210,7 @@ "id": "[variables('_uiConfigId1')]", "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "logo": "Logos/HoneyForgeLogo.svg", "graphQueriesTableName": "CommonSecurityLog", "graphQueries": [ @@ -209,15 +222,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -279,7 +292,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -296,11 +309,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -316,7 +329,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ] } @@ -403,7 +416,7 @@ "connectorUiConfig": { "title": "HoneyForge Threat Detection", "publisher": "BUI", - "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", + "descriptionMarkdown": "The [HoneyForge](https://honeyforge.tech) connector ingests deception sensor events from the HoneyForge Threat Detection Platform into Microsoft Sentinel. HoneyForge deploys hardware honeypot sensors across your network that passively listen for connection attempts. Any interaction with a sensor is, by definition, suspicious — because legitimate systems should never communicate with a decoy device.\n\nEvents are forwarded to Microsoft Sentinel in Common Event Format (CEF) via syslog. The connector provides immediate detection coverage through the bundled analytic rule, hunting queries, and operational workbook.", "graphQueries": [ { "metricName": "Total events received", @@ -427,15 +440,15 @@ ], "sampleQueries": [ { - "description": "All HoneyForge events — last 24 hours", + "description": "All HoneyForge events — last 24 hours", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc" }, { - "description": "Top source IPs interacting with sensors — last 7 days", + "description": "Top source IPs interacting with sensors — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| summarize EventCount = count() by SourceIP\n| top 20 by EventCount desc" }, { - "description": "Events by sensor — last 7 days", + "description": "Events by sensor — last 7 days", "query": "CommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| where TimeGenerated >= ago(7d)\n| extend SensorName = iff(isempty(tostring(DeviceCustomString3)), tostring(Computer), tostring(DeviceCustomString3))\n| summarize EventCount = count() by SensorName\n| sort by EventCount desc" } ], @@ -483,7 +496,7 @@ "description": "Deploy a Linux machine to act as the syslog forwarder between your HoneyForge deployment and Microsoft Sentinel. This machine can be on-premises, in Azure, or in another cloud. It must have network line-of-sight to receive syslog from HoneyForge and outbound HTTPS to the Log Analytics workspace.\n\n**Requirements:**\n- Python 2.7 or 3.x\n- sudo / elevated permissions\n- Outbound HTTPS (TCP 443) to `*.ods.opinsights.azure.com`\n- Inbound TCP/UDP 514 from the HoneyForge backend", "innerSteps": [ { - "title": "1.1 — Install the Log Analytics agent and CEF collector", + "title": "1.1 — Install the Log Analytics agent and CEF collector", "description": "Run the following command on your Linux forwarder machine. Replace `{WorkspaceId}` and `{PrimaryKey}` with your Microsoft Sentinel workspace values.", "instructions": [ { @@ -500,11 +513,11 @@ ] } ], - "title": "Step 1 — Deploy the CEF syslog forwarder" + "title": "Step 1 — Deploy the CEF syslog forwarder" }, { - "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", - "title": "Step 2 — Configure HoneyForge syslog forwarding" + "description": "Configure HoneyForge to forward CEF-formatted sensor events to the Linux forwarder.\n\n1. Log in to the HoneyForge dashboard at [platform.honeyforge.tech](https://platform.honeyforge.tech).\n2. Navigate to **Settings → SIEM / Syslog**.\n3. Enter the **IP address** of your Linux forwarder and port **514**.\n4. Select **CEF** as the format and save.\n5. Click **Send test event** to verify connectivity.\n\nFor assistance configuring syslog forwarding, contact BUI at [support@bui.co.za](mailto:support@bui.co.za).", + "title": "Step 2 — Configure HoneyForge syslog forwarding" }, { "description": "Allow up to 20 minutes for the first events to appear in the `CommonSecurityLog` table. Validate that events are arriving with the following query:\n\n```kql\nCommonSecurityLog\n| where DeviceVendor =~ \"BUI\"\n| where DeviceProduct =~ \"HoneyForge\"\n| take 10\n```\n\nIf no events appear after 20 minutes, run the connectivity troubleshooter:", @@ -520,7 +533,7 @@ "type": "CopyableLabel" } ], - "title": "Step 3 — Validate connectivity" + "title": "Step 3 — Validate connectivity" } ], "id": "[variables('_uiConfigId1')]" @@ -536,7 +549,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge_DeceptionSensorInteraction_AnalyticalRules Analytics Rule with template version 3.0.3", + "description": "HoneyForge_DeceptionSensorInteraction_AnalyticalRules Analytics Rule with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('analyticRuleObject1').analyticRuleVersion1]", @@ -560,62 +573,68 @@ "status": "Available", "requiredDataConnectors": [ { + "connectorId": "HoneyForge", "dataTypes": [ "CommonSecurityLog" - ], - "connectorId": "HoneyForge" + ] } ], "tactics": [ "Reconnaissance", "InitialAccess" ], + "techniques": [ + "T1595", + "T1590", + "T1190", + "T1133" + ], "entityMappings": [ { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "SrcIpAddr" + "columnName": "SrcIpAddr", + "identifier": "Address" } - ] + ], + "entityType": "IP" }, { - "entityType": "IP", "fieldMappings": [ { - "identifier": "Address", - "columnName": "DstIpAddr" + "columnName": "DstIpAddr", + "identifier": "Address" } - ] + ], + "entityType": "IP" }, { - "entityType": "Host", "fieldMappings": [ { - "identifier": "HostName", - "columnName": "SensorName" + "columnName": "SensorName", + "identifier": "HostName" } - ] + ], + "entityType": "Host" } ], "eventGroupingSettings": { "aggregationKind": "AlertPerResult" }, "customDetails": { - "FirstSeen": "FirstSeen", - "EventCount": "EventCount", - "DeviceVersion": "DeviceVersionList", - "Customer": "CustomerID", "LastSeen": "LastSeen", - "SensorName": "SensorName", + "EventType": "EventType", "Activity": "ActivityList", + "SourcePorts": "SourcePortList", + "DeviceVersion": "DeviceVersionList", + "FirstSeen": "FirstSeen", "Sensor": "SensorID", - "Protocol": "ProtocolList", - "EventType": "EventType", + "Customer": "CustomerID", + "SensorName": "SensorName", + "Collector": "CollectorList", "DestinationPorts": "DestinationPortList", - "SourcePorts": "SourcePortList", - "Collector": "CollectorList" + "EventCount": "EventCount", + "Protocol": "ProtocolList" }, "alertDetailsOverride": { "alertDisplayNameFormat": "HoneyForge: {{EventType}} from {{SrcIpAddr}} on {{SensorName}}", @@ -623,8 +642,7 @@ }, "incidentConfiguration": { "groupingConfiguration": { - "lookbackDuration": "4h", - "matchingMethod": "Selected", + "enabled": true, "groupByCustomDetails": [ "Customer", "Sensor" @@ -633,16 +651,11 @@ "groupByEntities": [ "IP" ], - "enabled": true + "lookbackDuration": "4h", + "matchingMethod": "Selected" }, "createIncident": true - }, - "relevantTechniques": [ - "T1595", - "T1590", - "T1190", - "T1133" - ] + } } }, { @@ -696,7 +709,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge_FleetCoverage_HuntingQueries Hunting Query with template version 3.0.3", + "description": "HoneyForge_FleetCoverage_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject1').huntingQueryVersion1]", @@ -718,6 +731,14 @@ { "name": "description", "value": "Provides a per-sensor event summary for the past 30 days, giving visibility\ninto which sensors are active, which are quiet, and which may be offline or\nmisconfigured (no events in the last 10 minutes is the offline threshold).\n\nUse this query during routine operations to confirm full fleet coverage and\nidentify any gaps in your deception layer before an attacker does." + }, + { + "name": "tactics", + "value": "Reconnaissance" + }, + { + "name": "techniques", + "value": "T1595,T1590" } ] } @@ -773,7 +794,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge_HighFrequency_HuntingQueries Hunting Query with template version 3.0.3", + "description": "HoneyForge_HighFrequency_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject2').huntingQueryVersion2]", @@ -799,6 +820,10 @@ { "name": "tactics", "value": "Reconnaissance" + }, + { + "name": "techniques", + "value": "T1595,T1190" } ] } @@ -854,7 +879,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge_OffHoursActivity_HuntingQueries Hunting Query with template version 3.0.3", + "description": "HoneyForge_OffHoursActivity_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject3').huntingQueryVersion3]", @@ -880,6 +905,10 @@ { "name": "tactics", "value": "Reconnaissance" + }, + { + "name": "techniques", + "value": "T1595,T1133" } ] } @@ -935,7 +964,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge_RepeatedProbes_HuntingQueries Hunting Query with template version 3.0.3", + "description": "HoneyForge_RepeatedProbes_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject4').huntingQueryVersion4]", @@ -961,6 +990,10 @@ { "name": "tactics", "value": "Reconnaissance" + }, + { + "name": "techniques", + "value": "T1595,T1590" } ] } @@ -1016,7 +1049,7 @@ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]" ], "properties": { - "description": "HoneyForge_TopAttackingSources_HuntingQueries Hunting Query with template version 3.0.3", + "description": "HoneyForge_TopAttackingSources_HuntingQueries Hunting Query with template version 3.0.0", "mainTemplate": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", "contentVersion": "[variables('huntingQueryObject5').huntingQueryVersion5]", @@ -1042,6 +1075,10 @@ { "name": "tactics", "value": "Reconnaissance" + }, + { + "name": "techniques", + "value": "T1595,T1590" } ] } @@ -1093,16 +1130,16 @@ "apiVersion": "2023-04-01-preview", "location": "[parameters('workspace-location')]", "properties": { - "version": "3.0.3", + "version": "3.0.0", "kind": "Solution", "contentSchemaVersion": "3.0.0", "displayName": "HoneyForge", "publisherDisplayName": "BUI", - "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", + "descriptionHtml": "

    Note: Please refer to the following before installing the solution:

    \n

    • Review the solution Release Notes

    \n

    • There may be known issues pertaining to this Solution, please refer to them before installing.

    \n

    The HoneyForge solution for Microsoft Sentinel enables you to ingest HoneyForge honeypot deception sensor events into Microsoft Sentinel via CEF/AMA, providing visibility into attack sources, targeted sensors, protocols, and threat trends across your honeypot deployment.

    \n

    Data Connectors: 1, Workbooks: 1, Analytic Rules: 1, Hunting Queries: 5

    \n

    Learn more about Microsoft Sentinel | Learn more about Solutions

    \n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", - "icon": "", + "icon": "", "contentId": "[variables('_solutionId')]", "parentId": "[variables('_solutionId')]", "source": { @@ -1178,4 +1215,4 @@ } ], "outputs": {} -} \ No newline at end of file +} diff --git a/Solutions/HoneyForge/Package/testParameters.json b/Solutions/HoneyForge/Package/testParameters.json index ce5f1185079..ce2e02dbf30 100644 --- a/Solutions/HoneyForge/Package/testParameters.json +++ b/Solutions/HoneyForge/Package/testParameters.json @@ -23,7 +23,7 @@ }, "workbook1-name": { "type": "string", - "defaultValue": null, + "defaultValue": "HoneyForge Threat Detection", "minLength": 1, "metadata": { "description": "Name for the workbook" From 3187bee984082fcd22e743725341735b116bbab4 Mon Sep 17 00:00:00 2001 From: maheshji001 Date: Mon, 19 Oct 2026 14:22:50 +0530 Subject: [PATCH 69/71] Delete Package.zip --- Solutions/HoneyForge/Package/Package.zip | Bin 98801 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 Solutions/HoneyForge/Package/Package.zip diff --git a/Solutions/HoneyForge/Package/Package.zip b/Solutions/HoneyForge/Package/Package.zip deleted file mode 100644 index db4003689da3961db0a19d18e96e0ce3b73214b9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 98801 zcmeHw+j1O7l4bYI>^{u%yv)<4RnHCzG*sa(UPjamM2I3xq=+FP$z}l>nN^ilmCdTk zQf3w*NX@a{ZnOP>v3}pR{(^njFX*=UkNuIc-QynN5s{gZg~E+D0WyKe%(!}ZczB#} z_t^jHFaPRqenCIOhfkjW`+q#%Kl=KYzo7sB7Vq}M?yGPR9go9!au|)LqcD%!zs{1$ zPk$W*jlavf!)P2f?gfouo=>xTtE=iwdmK)XZ5&PVcKG8gjoRI0tiNTe8*A%#TWedb zwe{6rG#w?Ul&(LU=GY!)am7+Pe%2Cn{DYtop((}`4L?vf=8czngPP`w-lgH6ykPq>3ol4|J_o99{ z8|B}IqZ#KqN~0{9rQPVuG?`7C%WbLRxl>ZP>$;?@o5oY!oW|El9?Y_+w-R(_c`%8h zUepWnB$$R-7KG`zmFKU}=`0UkKGwZx9SoD%sMkW)*5^^{QJD6+39`Lx2f=qy5Kpo^ z3VT#)kPoBaEmzI~GpV4Wzul0SZ<*r3|;yW3zU;KKL4QLkSvuS-FI!W?sy+!4^9jR+>xr5GxGgHGqVJh>U_^8o~ip($F zBR(azqSlq#ZYK8YFpa~`D01dC#z~h+6qDjl#UugIr?nlT4;!mCJ3TEzfDF&`398 zovMLI zqb^aD8zK|fopzLgCDYRK%F?QB#zEAbrEz|0nzOW`r+;nk)=8(ev@)B--_IZ{Nu)QO zcE6CO6&g;HT{xhcfN1LuNHs-iV7MpG^tzx2RAds7c`Wm_{d5{ZHbDx7Bh$t2gcd~d znr?d93%bzqyPqb#SvQx_)zr$vS5bisE>o>+uYu|y+R{k}zwk$($akQ~r^|4uSjf&< zsns-TRRL~VAGuU5PAW+x{0we#24xmwxcc!x_sTOVODWvpay~iZM5+i1onRU!DgGeZ z)fYb}wOdt9vbt(zkfI+@J1I?;XPPd**!ke&7a|>V+&q3+37pAYnN@{$muC8l!beLf zcfJ?XNVlBfEtG-pbrg9g0;AWRCol?4FLd8w&_W{NVUioH0vp*3Mdl~$zHhWH1#yE zbvm1!_07$@t?qh1Y;E1%3|n_T`DC-T*^k28ce)$V?Px=fLa9DsR{wmf%#@u`l;+e8 z;Z&L}ON&%*S-#W)De0{)l3`lr`2{;+nZ9O3F0}xK>4o{(D8)27s+7gLq!@aMXDYF+ z*863XGn|o1J^1HYl%9Hc*Zn+?cinVF-o4%FZ{FTqzth_4ZAYz7`nSW@T4%l6+URXY zTm9|ulg{m~CxJ*(KroNq;fQa&hl~vWxVf zX}w+psDo;aRxqz9ZW(%W#PFoiD+SD2bpNzEO_SF#fY5AJlS)?D%rZtejde?id>d;U zn+hFoP1ERg9G%#d8e8*X2U4(6`U>iyppZO3UI@S-u7!L6LZeA9drJ7Wq6LF(NAG-t zDV(PcD9Srbcl<^D3WDbbSj4aZC&^<6@$-R*78VEujR;QSd}xmfUaPZ-z{TshB=^Jw zv=a{EZ`XWoLUquO=lsNl7ODV=Kvp`tWfSUv)?W2DvlFj=s!ku3Cnyks-kF0EJDm(> zC9SjbL`rGQn*|RH?&7ks$$G(QVDi6;Cyc>n!!V7krf0rart*4g?G6sQ%oH{$y&$&v zS^~2Lx0dgPv7ncY8itk(jb5DL@a|MV=p#F}%_SkV!tQ-^Lj@TQbHY*lW7MNS5uNPK6e9bCsPW0#)*Wuz8ziDK4x*fP zgY*q))gcm{Meuo`(63O$<|n#K5jqXO@VwJ?H@%?`dj*pM&^qKytq|$nl zB(uwlNzLnOFOYWb?FRR8WUEgdR8{JmLee*uojT%df;l*z=BG`YUnRiw2a|Pkr(n*Q z;dDIcoI0Y0-4%8byPNd&M_TXs{fGVYnk2FcpBLx4{_FPqzIQ*oX$L^he{f)p>$cS z^s8f>(d(1XHfad@Bqeswt`stU++hCB^3#zL8`F3+LcdYwRn~#xj9_x*AWtIA!0Sj< zkg8;$!F~UgW5y61@(BaXdT$KLsIh;rLG&8OAOQ{iB;cdvG=f@-q&aL50yLY>OX$=+ z%$awCZ~$8q*d&B(rvL*2ssU&5J)UR5pMU?S-~ah{`2Y8R`W^oLqkjIKe*SIg`42%( z$D;w{5Vag5%C(_x9B0q6Y21yIS%%Z8JRV_>Fp7aaN4+*i*QNXrMh{U+FTsDB>YHV% zmsXj=61JEqAy)k|nh@K;Y~m-wxo@0F{{Dy?l371lL4!sfH-h{3Spd?Ur$?}ZO(9~h zoJmQd*?5do_#Y!Yk=AmUL|KA0Ut zYuYNG_I8z=R^q=(g2$wVQ0tx5z@d<-sz4N-$;ndqY%*E;m}=a5>}Qihnw{AUZVvNV zI=swsF{9CK+#`)Ck8>?HpJLk3CReR6??jNJJ&|zlzHqx1QIe ziC&YsKqAJICt=Y z)8-hqXD_k{sveg{`7rfia>lx+`fUn&9A^1J6tPl?Q5c6m6om%$f;1}#6w@;%rja3b zEypGVyJOn>)8R(2vCXs5D^3oRDZU3gc@Bgc_)dA1q`9THweMWE5ZuH)8KiN~ksc5p zMrXk?%8JGuO^1sx8Ib-CMAaEO4p#QhvBVD{*WRcNH4ur<33VaSMG)dwk-}gcbyrax z37=|>Xrm&zl4;B6EH}c7Y*shSjIguj+NDx)+C#n;N zw33SVo6hEv#EViLNQj&vUmS6z24Qb^#n~XUWGQR`pTraFHM0X?cM;Wu3J9Pe;qjtJ z3kocMDFsZ%Cdmml$AM{&9qv5L0dc4WXyM$!r}rUJl`PemieN7PyM(d)&oiF?7(AV@ zP6b5ZLIwVzRKfoVp7#4vVo~8cP@M&cxl(`-jNk^mMb?6v2~_eTm-2EV-+9C^O8VJq z3i8HbBY9QW_Q*>!F7l#0v`VO{EpkyaRjd*`97RzcJc`0mj!h=(t{=w|q6UGx0gX z!Cf`aA0SiQ4M(&q6uz&|bX#S51a)As3|lJ0lc*QZ#^o&Z{5UzGe{^%-!rJ29rwV1z zjNibeOr5x>ZJ1IhX)#nefvPI`I9mogCd6jPr@bexIeOB>}(k50>O(fMGgs7qt(@m<^_;f)>l z_S%1CY!7|<_zn~*t0k*Ob0BuBobtTDIcc6i@)7*YYl^)L`vqz`?Sh)N zQ8=tz>(Loy;ngSnN_zTfaGO%dBXpbfyRHaw%f@iQ_{ZtZ;;0!*4t3H=ge`4G)eb

    &AgVGYp zf?J@iPgx6*upI*!waz*mrNh`_uI@~yBWUkrozW7z%+`0>D>qy1jFQgk73YTe#9|Yxzo7pab|!s!hX7 zCarDvxm+0fiGG29{VZUbQ#4psRf#E7HLKTC-&=&3`3iM>JnC@qd912+BNc~ZAj^D4 z-y2fDI5>FfcUZyBZ-2VF*<}16_Ifmn3bTQlQL!>cohHJLx81^=pMSIGZ;Cf$h6<#y za1(Sujyl>c-iEr!9@KaHgY9^f(u{*yVGi3Yf5(7EzM@1TP=_W!M;mcDh92UU$gSew zNVV?MbCc2;5X=vb%=DEuNcV7xB>C2gTbEJI=fe8v-bLAg6LO4P7k5=!pry+DrOvX9tCSj8#&@Q0$7FuS-foaTD`C>8b5O+N) zN8JoCO@Pc&a^)Kx4u}TcEVq&jg!71IZxA4xh5k}VK9SFvV`Ve^$|!Np>8vw~GZ@TM z?pk%q(V?G&>8l=$>?!>rLY^JjDxWuNw321u44MEijvpYn6$R}pne#`=2AejR9K_F- zTk$9e_7NYFHn_@3!0?O-BG)cD4p5A}EPz#8?*!UD&?M|rrwCf8PUB#sPp%kQaEg5{ z!WZVW7@`TV=BEgT@C+E81|SmFRE}e(`{MW#WXc7>vHMpdEfiOUI74hiaxLh`6P#2f zlNHw~pmgkgwyQxW>V^~=afCR6fG)5F4YE_TZwy}pY}Q9T^a3k2s6HOgCbYFiXgYEy z4TcvlmliOb|IFLqie56ZA$D$^krHk+(CO^hPjWm#8^Giohr5LfUW5SsO#F}@{jKd+;039&5>5tD4y@)td~v)49&raQYDgEX8D|5;UeNES?@ zs#ct}{I$CIQTvf++E-BkX+Z;9`ZVSUbUfk6L`=E5WI>7@)$-&9f52UgGTP1x zORDKspSOeaSL!t*8_#$!)eWNqq<|Ern~zRp@mU6vPiAk!(aK_>;JzL(8OdPf$WQf{iW4t*a}Nv|pK-Q?=JfUpo*5=$sDE!$H#A z*n%aqb6i|ZMAWGnpz@lpI^|o`c$i9bCJ`%U-T zJw^87G2a7nEV8gXAIM`->PCC}G)Otwdalu1mf9-ywT+Qp8Bm)Vjq|(2@ih2w21B3X z9GK${jKuXGck#?Sn*~gR+?l!<3wTx=zZ?~ zCG2Kz*)Kv7C&V*4=UMw`=W~dS(*?#!c8C?y22HCgEZ3_CG_`k8y^!i{s0zi|LMv76 z098yZD0R&^EUs&WuMw*`RQ}1}SpOtIGqfB>q@;1vqx&A3Ee=TR>5OK=3k1Kv;elJ1PIVc;WXXi?ZWhv_63Ct$Czli<<< z+VZO+sALOdAZOMdn@|m1+%CcQOsL;21nYW%NJqivq*XEoUDQxT$u5^tm;)qz!zQitF2$!=JIQ0y8)nKMAs%L z=$S#L3Cs<4=+cnj+a~}Mz)7dU7?lDjLNEyRWhd=oa{`Hu%t}Z_6T$#`?cnIKVIs>f z%vcLB4D(4=^#}Ib<18%!G!6kn>iFQfCe#O zW)=s7zS-FXD#4(GsHg6*uxSZKjB?DIZe*#4zzp)TM8jy(nz5w=9eu54VW??`oeA5X zsM}v!@(7KgNR%ZbQ;ogF%7+$W0Ihh#CHdW3+C-if}MlCClt>g zcFRHYrPU943-WSV-N8a2E9Qtg%b`dwG6qz~glG>8Rmo#pH;Hd9{c8og9z?9&1p0a( zzvAqrf4w*;({)$fxe^AC;nMU2H2m%mj@Z;nh&PJYLXA>TrqB=l?x2C>-N`&}NdPEQ zZWdx4#&S5ek%~3d=t(u*aDuV|$R32Jfig!pCZ-aLn-#JE#6yVqN`T~p?kJf-((L7q zToQbm+>%;Jzr~kbP~$ZmXj)D~+D~!Hke)*Sz$>2N zXNrCba)fJ4=BYX8fFm^P1txWse(D6L`ijzu2df^*Eh*K%jXpwYeTQ=q4Cm3AsZqW| znz`d5)if;K{E|!((!Vu&kefsW2_)vDk*1r(X!^1gGedfBftDG}1(yzC)}9RD@7H=7 zbff+Y8W39F)AsZeN6-z&i}RU)PG{in4z!B6XN&Z1t;iePDH3{D;-(^FF5IOfXyV(a!#JXp2tQkScC zc&$Vs$rM~bsOSZan1N(RdFk@^vW8@JbF3_CFtE7QhLmSV07I6G!hwdg@HfXH>Ir~c zT=z?i%j?a0o0lW3fqHRrO7Df)u#@0`5+U4zBiV8}S5&bDoYf}lQY@pUjdt*L_&OfY zVI*q0bxS;`&JyYWqvRs|Z^6Od7f-P89q`%bty?I3vmJbaDU$N^ymf1DKS2CKpfVYB zvZSvxh*IZS&e9cvXbP4$E@rC@jhgo?Q1iZch|F3yQFP@j8MZ2@al0KnfC=?0?g+#^ zU$)28R%#&5SmXXFRs%kTS5fom@b@9~4Lah+oQLB#edj@?m7~Z-c(X#E5o96{U?#vr zP_b)#j))oYC{ONHzRcO~miT|;tP%KaX$1a&Lun5$R@#3p(_n`d+F&*%Cc?>#a+0^m zM4#LwCF9*y0*Pog^dieI8BWJX%6QL#SOMcmbKG*P(%c znIpayP;|N?fiAfC&sq50@~>^}FIVDO{>w?A0r+PwQE?6$LLbk&>R)#4-aNnTG85gM z4gL=MTKBxdWaU)F=hCWQo+E}}W*d73;(syclRCRx8Z-L2YUh)JCR*=-QnYcrtRD(C zBhZqy5jh_%f57+Tsc})i#SqSH-0ehyB|zp z=GDz}krUz!Q#Z}a9x=|AZ;lPKl#WyG8h4mNBeA@m*C*y&`LV+iU(^0ITG->gdpZH&ru{%1dIy zEQPL&@GQq}6?)YyEx!xYF@L$8yUaF5i@KT0_QEg7#LDcF5~X&MyGxJbhg6k$b^b?} z5w(T&!J4>SSi*=icGb_QR`@{F&h;y@*qUYjiZ@MhHq3Pha#7$LM<7l88%H3($N>7^ zdq<#xD^KOjPqZ(yJ-vwQP2&PCH;s4WY9o@H`fJo9dT5Yf^P3e{Xe0u@0yNJzBL=+r z!J7})(@*5Wd{g=gEf+SOHz@8=W&eKNo+(b;%$O$2jgerao`E znDbGs+t-Ka?&T<=BpS}5<2!NddLQU|o$g%c9D^^EAN4i4ZM{dt{)pVQ>gC#8my=po zlesP?1%7hv{21XpU=!hp$Si)?orWq7U2^W0C1p?l$aw=2+`<_>7;8%SDmf zo;$o&psZ`_Qi<0XCc>ylHOo*gJ}u|j^}q} zFc{c}?!r)#$d*RtXlenMh2ny$%5axe^`@MvGCX!BzZF-6QrF8oUY^o8?7ML}z*Y1& zE(iHPb!IXAkJ>+m=W;nH@%LMDH8>}m-?$XuKESu(QgHUlTb4*9Mi+4%SY)*=thCM! zNQr9tT@lafQ*q@a4-nU69=;amTTJIHq;9z%fJ;DWo@r{ysoEK<=y})1>oN6rTTvMP z1p>nw9+E=TznUt-%0{cWfQ3KKHOYojVq-fdFO_(|XWJM$Ha!yN^BJOiKJ8FoEyPT2 zyKkjR6OP-)9KNu*O`S#IJ2%zWWZqYS_cL6W;n3>pgK@vul}NmB;KfZld*r&P(83ox zlW=s(H!ITEWKNg>de*TX^ldPKHh~Q&p8lqT=QrRKIFS)7oiQ}@B{2lnh_|th{Q$pp z_{3A(0UHiL-~W=WZmg}}ZLMt~r1UDr5s@b-oz%g%!u-l<0i?Djs`e6~>Rb~%m)HCp zDDDN8@kqXu7K4HWf?!1mJ@RRzJ{Ld9xk`1zC-YQEFVrCN%g$Hv7ep)pj+U^x19$D5 z21E#8XQnAe3^mT~^$V96nrtwpEq0tc@0;~}uM8qvypE%j!U%8(9)*@GrRbrFaf@i;tzn;m<(a-?b%?3rc=8F(B|;>qh|#6Fp! zYeb;qtVrOT98th1E(Uyf5qcWj8pF;0G?-1)O(zHh(mS3Y`e!_%$O-KH*`r9Gw7_Rk zcgEMEnqbEWQWAw@c>W$woR+F8(Iq&F>d@7NfX}%1tK|zCO%Wo zRRm}B$EDpkJjHX515O_UNK%osGlV<=k>Eg#C|M9KBLv=h%@dpBoq+yKONz3Ma1|Iu zii*-h!(YeU$QM6ij>AAJFw%^|5kZ_GdWex{6`sTV((#-yM>!N<74vv&C*JBj`*=bO zYj5ZCU(LsfcC&nMx&zm8gh4ddSMDOZdOYDsXMB6ODo#oE-C{zbuev($070fFgLT~6 z#>t)g1PdjXGth0CPWcpd4>eH8RP~yAg0UP=^V6o&z;ZF0%Tf+yFbQE(HpP|WsrO^` zO7~3!)TR8Aob4dUjBU{-afS!5Ow0Cm3oSZs%qFjJ?fHbRHRC!8?Nm)EGBw6eSF*BoPrdg zih+)WjX2ivKEfc-1&ZVFRrDf@a?3gg<~uH+-&hl}IV@kFx0I+*fRMaUE4Nd=tYA+n z)#*{gI^#Bylgog*twZPreKB(>hhcOCV3Mnw(JWh$xahNIQK2%EwUDHc`GGoQMdTH? zl_sN|TvVarg$@=o;%xdc0?6Tb!${6Mtux}{dXv>k59g&yM-sw$$uy%WO2GsQ;?E59 zW5lLF2M}5fK1DAO{Q!4>S~fuJEX+y#FJn_0Wnb=6l1dRWD%lNt__CUhHXDu5R7E}Z2o61_Mn>po5eNFw&V2o%%w%N- zvja`7)R{`-=X{aTabA_!v%-ZHUNtPKYjX!yzp}%^qh^{#%bMOMI4v-=q<8*%D&PYXd>BQD=zA%oIk)Lp!u;k1l=*M?2jvMzPuwU#+xB$WNajXbhCIy2@(^t@4s= zB{tdH_cjX6>c`QjcSaRN8-F$Q1<({#hJrX&H0h(%!>S@piRlLeG@6Ykv=&g?j1Z_2 zMWwF}5xsw2+2DE1+$f>H<!?zYH>(wS7b`;Jb6sl)s2c?w1>q|Ad1tqr+-u9NX92#wq+idM=pHp9v z)tfk+Ro%0C-8t-1t&rnzz-q>AlYjjTTz z61{n&;=TU#lUXeA3g=vSVJ7~YH-3)NEz7!TJf#Wft4&`>2GmK{%2(^4j)-P?Geel# zFh!J1Om(C%0{IOt9-n3Er91p@-rx>2!ux>UArLYt4+Iqw_UGb#cqqVqfb$lU1M#HG zi|zw$5h3cJm)Zj@qZUaFkubs)+!RRH)iSqyDk-h4fcA5Wo;-LGAtW&0G^Rop*4|16 zA54hM&rg*cu%hg!!evxGY7l|p9b8VKC#$yrkL2b&X#^;B@?ewzY24G)1OwJUfSg4) z{0q_>6vkZJW~f`|YK_GpYc6!~%s7yy%aF3ud~a?~Ubr7nm}WXL=?*6`;s(}fmyN^q z?YrAv+Vdy(-ejVZ`oX95yY-(oH>>0+t8+!AuhfS!pL-5Tp5iEgr$sn2=OpGH296}p zccWyh@bV4G;kDAoY7hZF+n9HW=|rovmkf7+%>)Nfk<+(~&UWepsJQ1f{=+LA->fXH z;__a)zPG&G)CCtXgW1C+a9Va2Wpw#CaJ^DCn6wZd#TmlkSuwY9|d5?72`bA{(w zC|b^^3Y7Qt3M-s1+|Sva@}DE>X_GPRg>ID@oW7gJd83?|(GniCOR1;*C{5M1c+?ZA zpfnY^W$Fm4uHDk2&pkKia`r`|qReZ8KT3+^sEw9l5|}p3kD6lA-vlWuO+I6oKpI`? z!uhE(WjK@BtZ0%+e$d57Z*6)mLkngO&dY573au=cMcg|#e=I8a=W#58wOpDgjK7pS-c&F&}06B z$NYsS&vhFUMTg;l)}vdM=0dmXS!{#S*mlGGM(tJu=4eE&hb)Da8^`j06on()MIzHg zR1K6z7q|}+brrYE?X(T`B>!Hn?S_kZAp3b7qHeDB{^58+FOz;B5#AySuL*-6+!ucz zr@&);tivHIAyU+GR)@Wq_c%1=BUf>U+B@`Y+N9R{{Za_IAss z{!eg|4Q{SD0KA3!S@_%^J9D6JD{g=KVqAejtCg!<}v zdP-N?uoWgODs#wCzFU4J7^rJFUdLIiE(9h+P(-mf8OGhAzVJp_Vlw;-##dj+HWOh& zqI`vgzIsW9lXNMZ=CcG8gApW@S>^E73!3&`4SjjYh+4C5uN(o+Os1kzL@uJ8Zo4_2 ze8V^IAq}q$K@aAnfU*I_(iL@qYgS6(8BlFH4*D~?wvjY1yt3;Q`l$|lfoD%ngF!gW z=t2{|5X_p&j>1#8qI4ngMOb6 zmvo6|HTfEvdW#lZQj>;9->3Omky-#o{S9#6eyi}z0(3xAkbe9@m(@3XmA2i$lGVlL z=I#V$AdUYCpyuHe%;@ebY=kr)(yqxx_6?+|WWQnygCMiyMv=2NPJhU6fVdKsdNznacrPJv)6+c1@0!s4_v{2sq(m71wN z40{SU8se2i`m8_5-lD%&<>7M><@zyfS>BYz4G`+f|SX&DhlBd(npZUX%d&XKq-RKQk3V)?y` z!)~v=r!Z{V)y{@!zX3VR7^H=zkcuF?>w{7?%w&Nsw_R0uc*B9HYklWR(Cp_lXlx2d z6TJ+~s=j8A;#_?dSk_o17C}j}rBn$GfNH7bx_t?7CUCGxZm2FPfPijGCA%;VRo-u< zN=zVZmEWaVGFbz>$pc)*;6#;TLcimTJnlv4wwyV_eL4CFqok#w$BHoKbS9 zkJEh^=NhA+^SultY z!4Rf@z&C+A&S0QBV^8}b7J>kt`ZG8w;}&klcmdE35S)S>vz$Y^jQNF8%@9$EY3NRr z=~MzET38;ln>>^VOotT5Aar|r7mks6l8o>U7&Ocm$E{KPDysO=GsMdaU0;;8 zU>L)R7CaWEucIIykE33UY7i?Zrt?M|L`K;(>Z%|Fai6hcO~e>s0MJ2p?1$+Kh$`6i zNixG(p?LTMGw(Y7`eEeNkB&E?VO#Wq%|b2sR-1AKX|3KSM7>^p^Y za2m$y1x(Z@M~xIc+c5XWC>95$$>d{1pBEGcB3~|pKA&qVE)_yC{Q&UiIaK_R@#l+n z>m$UUH_yPIH|^4SgFn;ya~b>@23L<@%aDnu?#~v2E_0n;fgENdQvVE1em6fL2pZhn zVs;kvS=hSL2MpyEAYP#P!_?GOd)$f zsP7^jlC9r0$=*lXV1dgBvot{GhXhJ%u#MOQV?mSoelWyC((fVCmDhN8H#~jX|1OGN zQCg%*`X_iOr7Z)bdzr{oWa@@l$MFjH|6K;7m6LII^H6sbPx!EkprQ4ec9AhXmw z`mrsze?M635ja(NMLGFuGn)l7;7+Ri0C6-GJw65Q>+&yZ zl242Yt8WBtmMdgeZdIUzDZ69<$D}h3J*EuT7d;hl>|@c~>pc~)LGDZ>4<^wWw%r_q zPZHKyb`v4h3JW|C{V?YYn!*TTwbK=OA48O(l*`=mH;#Kqiw}k97 zNffNlB+1;cb9vG`g^h9CwE+no5+Y)x#G+d;O*MB5f9Gobpk zo~weXH5}QakEpdSVvfUu%thFM%}b$k02?`2=96_v;zX7|9HrnukBMdk@H!phAS|P-famItV9m#_iIB0 z`#Hq>kU{&4cIzVq?YGVV?YHcTc>~&$biNE||16sF6(^YdohbX+LiS~z(~!NxYDDOt zA!NVhtTaRd5aGSG8W&y;6f>($@B#L%fdZE+T|sBA2)SS166hZ0ga<0*`)IT^SoUM&s(L7<&p(H38T0H_k$PwW+QNHH)yVh{sTX;^`He^}>=9 zmo@!Zxxiu{H(*f?j2c~rRRrf@>}_$?=rt-L_?6R{N-0eh!~Z%u(HwycWL|I52SDPf zQYwtDb1K#db5Ci}a_}j|1+k2^5+L4%s;p%G?x2#GtW}_!ZzIs=@vxnqjpKfEFSBi2 z3EU@Yq3O4UH%SiIkR}z|c>{Y=IwVBXi(L~+3LeVoC}AD!t*RzyRF^2%%%~6KC(75i zsIvnKVAPO+o$BT<&<jPF9Bqw(n8s7wm57*7uu1R2(j2IDNWnu< zTtwHmlkqp$40!e^qM#lLB61LZyMie-7_igE03$t$J7m`m{;?oU=tmljg(o_zJGPJ={HHN&PFcA5284URx+iIx}8}JXn{(BA$KV&HR zqTTukq2%o|pyX}4a9$MFLI7l3O47@oPB3YYjFV#Hh_`pNWq4*oye%H}%=r1yRr0jq zP{Aq+4uCLTa$?3+JOH&cd23hFA12cs4j2ft6a~2beDUNm<7qtE;WrZbKSMmZdM(XG zC!Sg}iHK)hA%Eeh&tT}laJ0sd$y@y@apd#bXWu51UO}`JTKX--58#FS{|Zw^cm*Ce z$_eyptWsFSLnSPjZ3<`x+Ae0Ajbv{-V2InYDqMV#h#?L-rkJXVnhIE^nQjjDDQ2SC z4h-=SHGsl&>mVcY2{)COVK!mrg|Si|p#|YmomOAWT|!KCOTZ(1fw@GCMyri!v9ZyY zM1?3M5^`d0PD)e^V*(>-KUga$syixY+Zdz01-oC1P#O#0QctzTa4Da3(MAH%*`%BP zZ1UA+I}@gL`lqWQ=4a@gOV#QCrgF2n{sR-h?d8leB8FhIkE=iX*Gw2i>wbUscInjvKo z=mYlxrbz~;2ZIqyeu@$8gy*2hC9Nq!illUjAkK2wJlBNbK(rAJu2$e+Wh-2XF`_z( zXdSryj@udi&>g|g0(kWZFfAj+rHIkEx)7i+#Rnow;b{T_>A=`ze%vB@je=;BBKY-~ zU|u?dg3&Q(12bh89;Oer}n?NBM zVei?h)!|pCDr9;3USD1J_F-aDll?F;LS$V(Ok7n)-x5qbuith{DoOzwbq-``PTAg~ zuN)>`Z11BwcLNjOz{Hl#>8~4@_~N(cRbk=goWywppi*fQ73&KhDxf{cd5Oj15gR zTFuiaS{-A%7Nx7=W0I{}glqK~uFOXFsLxq@+&gZ3rr+RBD7^Y~HT>-2eK^EOz|Kb9 z0#t2$_$q9VvsG*lxv@gD>=mxTf*)sw`@7K|euBLXJyLV%Mxz|jEt%Fd95BU^uHhh{ zI$GoEAhk`O&_oYehcGcZMWo6>)J7oAAzEQc#%++c@@CP*7$i$I?h3YyVP}M`H?9vN zoHj%$> zqAw=WmR-PHu*Dr9s3_ubswkkGSK(R8DOedWA$9;A)#yFEa;tTkIvpjav=6rQlS#9S zyT)aZjLA&$b!U zT22dTiU_-5P#@zKN7%CQT}~Z1TYKouqx~BXi)iL86e(Ph^^&fycwtj#TDj6oZ(&5m zkkp5h=NS3W>DcU_#76W>{2#^XVdrCmoDrQu0i38Wd~v+8o{ zWz#&d^f(zLuAHLhcJ_L3+yGG3%ZI4-_V)A#JPsp*63p{w9%@xhhfHTHH=z`QVEPDK z$)ON8ki<3Vo44j+of21ZD^;9kUy{&r9yYU-Yt#* zEKw<*afpxh$eMOv?kLl<8EFx2g>pEBo(Z1eB>am6;sbN{SaF_Gc2wagSMDfD?r#Yx zO(yGw@uG|lThL=|(@A)v2}*XKr~NSgwiz$hi9!*V?ujfR|V*I%sr_I>H@oCuIr2(WH+-HzE1 z#O_<&U0khV*+4S_`Tci&av;hOn0eRPj}%0`EI*A2d}tHcd1xU zcVVGZ?5^|Vw^QxMxNl@%ZOyUNaFCphwT(~cV)TtQM{G4l*r_g*P&*}hR`nk49l&n9 zvTirT`U?k*ha6le*rU_EQH+}vx{=cgnxSs$ucMq+TDR9uKXvboz&2XY5f&RXvsq)B zc2;cqpicP|rHo+U=M(lv;92gn;A zR_@ieY;~=@-rm50E&~^<4^#zvP6bcMY3SQASM)0;cmr2X^hOb@U}mq|W+bES6rj?+ zR%#A4t5B8tYROD=;8CIF9ybk}XLK#jzKeehQ`-G-Bs~f5)abx>sasSLU6_a}{q#NE z@z6!cw{9_Nb?esU;HrSi`tu+E^xHrA0jQ$_IP|~YmF6bxTr`l1_BK#`7IILJ0& z0VrwtN`ND37-2?7cI#$aQQDF$8yxWG3KJ>Tr0s=^4S`Dm3f;OTJErWOyxA!tK=S&L zGVV8^58iK6(MJmaICgY=h|O~Fo1j{XATQbc%!0KL+_UT~Ah;g4qg)vwRvqcX3yT;y z1Hz#z+WB_9BNkWmnSL5p5}Nz)vL{CJu9|9{D(muvqdmE7o7S)l_t8d~V`~vY_~s0^ z)fZMMf#JLQw7_ZNE}M1q0gz`kYo>K-wHdlR-Xg7D(4zZW9u=ys}ojzLu@hvhoEV#1q4W zfy*zyICN?RQ{XbHAy=oBE_Vi^mbeFXOM&I+q;n~dnPA?D@{i#(ZfUjSJ~Y;~*4iCJ zHZ0&QY9yT7x%o!h&x*51Vlh?{s6b|OBf@^Zj*glRoYMi3`NgaaNF zn4GJ7x3j_IhMc0*Z@ap(8ZNzYNh~2i>FA` z`izj@1QR{;zM! zcQK>8#Lh9|xuT~`O^YQ2@ipx&vL)7DOgLnQv3EGo-65(MFQO1NUJQql8zC71| z8KT=BniZY|Zdtujf{5Bog1_<=%iLqVGS~t!1F#8)a0P47#-4INFx*Ab+gB6if=PHW z+b+(*t*T@ikF-Tu;ceXcq=aeHTb2)^OJYw%5zI_&Q-qvt3qj&mqoZb$!O--o*Icn6V5ZwYK&w` zs~go@9L@5xh~Z*Nd27boQqxe;>>-^&v17I)J52ZM1%PzX#(#cxLjc65WPPnpa82*G#%<*1n!3w-Hc@s>F?{=u zCxi!&a6-l^E)ru;L<>r$cV=?O2;Zm@h2u7X#ZF7L4P-zLiST92VuZUx>l0iK!k2r~ zZ6SLSICj zJ7x>Eh!sD_W9&isd{Nz$4)Uy2E<)#f(m{WwWdv*n6#~tIry~khO@50@p*|D-eg^v} zz&Do1?Rr=O?Aukej4ZABj_F$$#mJ}#v$A3 zH7z-Mp?Nrp08c$2uWTI3vv7J8g(CprrD3X>NklXcwMFMEbi_BInCREK^yo7(^3jIT ze@m|vY#>i@dB-6(-LL><+0Q=dn``Wpz7h;@e-#!QYZXt+5B3(yVcV7eN~YrMh+Vm9 zMF3bE<;o~tz0?j2@NmZ@Ag^xtw#S(P>=2cBk_5(VpIbwQEW!F3MbJe6XTCOz7APr# zrY=^HQE!=-rjk>751fp~<8XSphw{;mMwjK7%eOul?bnT32D!KBBaNkg%&N09K#7m1BE5O2%|Qu0O>v<>nVA{ zACgDJa(S|qr(5}1_GZLvi)ec;*KU+2LM^i{z9)xbaIX8ld6Hay0&cvU2`IXsLOv<7 z4Mqclu7CEwM)&Y z#E5_^Oee*ZY(Z{x5y64ZLGcd!37ljMBi2k*7yo@e&7Xj)KbR|lmJI3R2 z)Qd^`%YivT7K2NiKo@aeX{SJ-2&sqmD7rLY0}xe&&k3uPq8NfWu9}Ay7KM(|`$(?w z9f2fXv?lq{OkmfGaQ8ni9fKaR6HN1hc5VQk z$vW+#wr(phKnq8iSjQ2 Date: Thu, 22 Oct 2026 14:43:19 +0530 Subject: [PATCH 70/71] Update WorkbooksMetadata.json --- Workbooks/WorkbooksMetadata.json | 64 ++++++++++++++++---------------- 1 file changed, 32 insertions(+), 32 deletions(-) diff --git a/Workbooks/WorkbooksMetadata.json b/Workbooks/WorkbooksMetadata.json index f331f840e16..7cb1c90f448 100644 --- a/Workbooks/WorkbooksMetadata.json +++ b/Workbooks/WorkbooksMetadata.json @@ -113,26 +113,6 @@ "subtitle": "", "provider": "Microsoft" }, - { - "workbookKey": "HoneyForgeWorkbook", - "logoFileName": "HoneyForge.svg", - "description": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment.", - "dataTypesDependencies": [ - "CommonSecurityLog" - ], - "dataConnectorsDependencies": [ - "CefAma" - ], - "previewImagesFileNames": [ - "HoneyForgeBlack.png", - "HoneyForgeWhite.png" - ], - "version": "1.0.0", - "title": "HoneyForge Threat Detection", - "templateRelativePath": "HoneyForge.json", - "subtitle": "", - "provider": "BUI" - }, { "workbookKey": "IdentityAndAccessWorkbook", "logoFileName": "Microsoft_logo.svg", @@ -349,7 +329,7 @@ "tier": "Community" }, "author": { - "name": "Tomáš Kubica" + "name": "Tom\u00e1\u0161 Kubica" }, "source": { "kind": "Community" @@ -3078,7 +3058,7 @@ "dataTypesDependencies": [ "DeviceNetworkEvents", "DeviceProcessEvents" - ], + ], "dataConnectorsDependencies": [], "previewImagesFileNames": [ "AIGovernanceBlack.png", @@ -5274,7 +5254,7 @@ { "workbookKey": "ThreatAnalysis&Response", "logoFileName": "Azure_Sentinel.svg", - "description": "The Defenders for IoT workbook provide guided investigations for OT entities based on open incidents, alert notifications, and activities for OT assets. They also provide a hunting experience across the MITRE ATT&CK® framework for ICS, and are designed to enable analysts, security engineers, and MSSPs to gain situational awareness of OT security posture.", + "description": "The Defenders for IoT workbook provide guided investigations for OT entities based on open incidents, alert notifications, and activities for OT assets. They also provide a hunting experience across the MITRE ATT&CK\u00ae framework for ICS, and are designed to enable analysts, security engineers, and MSSPs to gain situational awareness of OT security posture.", "dataTypesDependencies": [ "SecurityAlert" ], @@ -6489,7 +6469,7 @@ { "workbookKey": "MicrosoftExchangeSearchAdminAuditLog", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook is dedicated to On-Premises Exchange organizations. It uses the MSExchange Management event logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Exchange Audit Event logs via Legacy Agent.", + "description": "This workbook is dedicated to On-Premises Exchange organizations. It uses the MSExchange Management event logs to give you a simple way to view administrators\u2019 activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Exchange Audit Event logs via Legacy Agent.", "dataTypesDependencies": [ "ESIExchangeConfig_CL" ], @@ -6510,7 +6490,7 @@ { "workbookKey": "MicrosoftExchangeSearchAdminAuditLog-Online", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators’ activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange).", + "description": "This workbook is dedicated to Online Exchange organizations. It uses the Office Activity logs to give you a simple way to view administrators\u2019 activities in your Exchange environment with Cmdlets usage statistics and multiple pivots to understand who and/or what is affected to modifications on your environment. Required Data Connector: Microsoft 365 (Exchange).", "dataTypesDependencies": [ "OfficeActivity" ], @@ -7032,7 +7012,7 @@ { "workbookKey": "MicrosoftSentinelCostGBP", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook provides an estimated cost in GBP (£) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", + "description": "This workbook provides an estimated cost in GBP (\u00a3) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", "dataTypesDependencies": [], "dataConnectorsDependencies": [], "previewImagesFileNames": [ @@ -7188,7 +7168,7 @@ { "workbookKey": "MicrosoftSentinelCostEUR", "logoFileName": "Azure_Sentinel.svg", - "description": "This workbook provides an estimated cost in EUR (€) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", + "description": "This workbook provides an estimated cost in EUR (\u20ac) across the main billed items in Microsoft Sentinel: ingestion, retention and automation. It also provides insight about the possible impact of the Microsoft 365 E5 offer.", "dataTypesDependencies": [], "dataConnectorsDependencies": [], "previewImagesFileNames": [ @@ -7724,7 +7704,7 @@ { "workbookKey": "InsiderRiskManagementWorkbook", "logoFileName": "Azure_Sentinel.svg", - "description": "The Microsoft Insider Risk Management Workbook integrates telemetry from 25+ Microsoft security products to provide actionable insights into insider risk management. Reporting tools provide “Go to Alert” links to provide deeper integration between products and a simplified user experience for exploring alerts. ", + "description": "The Microsoft Insider Risk Management Workbook integrates telemetry from 25+ Microsoft security products to provide actionable insights into insider risk management. Reporting tools provide \u201cGo to Alert\u201d links to provide deeper integration between products and a simplified user experience for exploring alerts. ", "dataTypesDependencies": [ "SigninLogsSigninLogs", "AuditLogs", @@ -10853,7 +10833,7 @@ "subtitle": "", "provider": "Google" }, -{ + { "workbookKey": "DatawizaAccessProxyDashboard", "logoFileName": "datawiza_logo.svg", "description": "Datawiza Access Proxy Dashboard. Unified monitoring of DAP traffic, policy decisions, authentication activity, and error trends ingested into Microsoft Sentinel.", @@ -10940,7 +10920,7 @@ { "workbookKey": "HybridAttack-Cloud&Identity", "logoFileName": "Azure_Sentinel.svg", - "description": "Behavior-led hunting for a hybrid identity attack, end-to-end across 7 MITRE ATT&CK phases: Initial Access → Lateral Movement → Persistence → Discovery → Defense Evasion → Credential Access → Exfiltration. Each tile correlates Entra ID, Azure, on-prem AD, and Defender XDR signals.", + "description": "Behavior-led hunting for a hybrid identity attack, end-to-end across 7 MITRE ATT&CK phases: Initial Access \u2192 Lateral Movement \u2192 Persistence \u2192 Discovery \u2192 Defense Evasion \u2192 Credential Access \u2192 Exfiltration. Each tile correlates Entra ID, Azure, on-prem AD, and Defender XDR signals.", "dataTypesDependencies": [ "AADNonInteractiveUserSignInLogs", "AADServicePrincipalSignInLogs", @@ -10984,7 +10964,7 @@ "HybridAttack-Cloud&IdentityWhite.png" ], "version": "1.0.0", - "title": "Hybrid Attack — Cloud & Identity Kill-Chain (Preview)", + "title": "Hybrid Attack \u2014 Cloud & Identity Kill-Chain (Preview)", "templateRelativePath": "HybridAttack-Cloud&Identity.json", "subtitle": "", "provider": "Microsoft" @@ -11830,5 +11810,25 @@ "templateRelativePath": "NetcraftAdvertResultOperations.json", "subtitle": "", "provider": "Netcraft" + }, + { + "workbookKey": "HoneyForgeWorkbook", + "logoFileName": "HoneyForge.svg", + "description": "Provides visibility into HoneyForge honeypot sensor activity, showing attack sources, attack types, targeted sensors, threat severity trends, and geo-distribution of threats across your deployment.", + "dataTypesDependencies": [ + "CommonSecurityLog" + ], + "dataConnectorsDependencies": [ + "CefAma" + ], + "previewImagesFileNames": [ + "HoneyForgeBlack.png", + "HoneyForgeWhite.png" + ], + "version": "1.0.0", + "title": "HoneyForge Threat Detection", + "templateRelativePath": "HoneyForge.json", + "subtitle": "", + "provider": "BUI" } -] +] \ No newline at end of file From 839917a39f45859d39d8b81e2e0d8985dd2c1727 Mon Sep 17 00:00:00 2001 From: maheshji001 Date: Thu, 22 Oct 2026 15:04:14 +0530 Subject: [PATCH 71/71] Move HoneyForge workbook preview images Relocate the black and white preview images to Workbooks/Images/Preview and normalize their file permissions. --- .../Preview}/HoneyForgeBlack.png | Bin .../Preview}/HoneyForgeWhite.png | Bin 2 files changed, 0 insertions(+), 0 deletions(-) rename Solutions/HoneyForge/Workbooks/{HoneyForgePreviewImages => Images/Preview}/HoneyForgeBlack.png (100%) mode change 100755 => 100644 rename Solutions/HoneyForge/Workbooks/{HoneyForgePreviewImages => Images/Preview}/HoneyForgeWhite.png (100%) mode change 100755 => 100644 diff --git a/Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeBlack.png b/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeBlack.png old mode 100755 new mode 100644 similarity index 100% rename from Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeBlack.png rename to Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeBlack.png diff --git a/Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeWhite.png b/Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeWhite.png old mode 100755 new mode 100644 similarity index 100% rename from Solutions/HoneyForge/Workbooks/HoneyForgePreviewImages/HoneyForgeWhite.png rename to Solutions/HoneyForge/Workbooks/Images/Preview/HoneyForgeWhite.png